@incodetech/core 2.3.2 → 2.4.0-rc.1

package/dist/{trueSightService-M5VpCo96.esm.js → trueSightService-BzLdXpmJ.esm.js}

@@ -1,177 +1,719 @@
-import { a as setWebApiHttpTransport, f as deriveSiblingJsPath, i as initializeWasmWebClient, o as setupWasmConnection, p as WASM_MODEL_FILES, r as executeWasmRequest, t as WasmWebClientError, v as buildModelVariantSources } from "./wasmWebClient-B7baE-Wf.esm.js";
+import { a as setWebApiHttpTransport, g as emitWasmDiagnostic, i as initializeWasmWebClient, o as setupWasmConnection, r as executeWasmRequest, t as WasmWebClientError, w as resolveWasmConfig } from "./wasmWebClient-BjZw_7OB.esm.js";
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
-import { i as isApiConfigured, n as getApi, o as setClient, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { n as eventModuleNames } from "./events-ijlbX_Wx.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-N1UiyFiY.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-//#region ../infra/src/wasm/wasmDefaults.ts
-const WASM_CDN_BASE_URL = "https://cdn.incodesmile.com/ml-wasm-kit-release";
-/** The WASM version bundled and tested with this SDK release. */
-const DEFAULT_WASM_VERSION = "v2.14.50-post1";
-const PATH_KEYS = [
-	"wasmPath",
-	"wasmSimdPath",
-	"glueCodePath",
-	"glueCodeSimdPath",
-	"modelsBasePath"
-];
-function isBlank(value) {
-	return value.trim() === "";
-}
-function hasDisallowedControlChars(value) {
-	for (let i = 0; i < value.length; i += 1) {
-		const code = value.charCodeAt(i);
-		if (code < 32 || code === 127) return true;
-	}
-	return false;
-}
-function isMalformedPath(value) {
-	const trimmed = value.trim();
-	if (trimmed === "") return false;
-	if (hasDisallowedControlChars(trimmed)) return true;
-	if (/^https?:\/\//i.test(trimmed)) try {
-		new URL(trimmed);
-		return false;
-	} catch {
-		return true;
-	}
-	return false;
+import { C as subscribeEvent, n as eventModuleNames } from "./events-Du2A4-Qr.esm.js";
+import { i as isApiConfigured, l as withTiming, n as getApi, o as setClient, r as getToken, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-BtROs6OA.esm.js";
+import { n as reportHttpError, t as HttpRequestError } from "./HttpRequestError-Bh0pNGSC.esm.js";
+/** Dirty-timer half of the interrupted-snapshot rebuild debounce (module boundaries + timer). */
+const SNAPSHOT_DIRTY_INTERVAL_MS = 15e3;
+/** Hard cap per log message, UTF-8 bytes (contract). */
+const MESSAGE_MAX_BYTES = 8 * 1024;
+const TRUESIGHT_SDK_ID = "IncdOnboarding";
+/** localStorage key prefix for persisted snapshot envelopes (A3: one slot per session). */
+const PENDING_STORAGE_KEY_PREFIX = "incode.truesight.pending.";
+//#endregion
+//#region src/internal/trueSight/sanitize.ts
+/**
+* Deny-by-default message scrubber — runs at INGESTION (inside the log buffer's
+* `append`), so the buffer, every persisted snapshot, and every upload are
+* already clean; there is no code path around it (ENG-48677 plan §1.2).
+*
+* Ordered pipeline. Two deliberate deviations from the plan's original rule
+* order, both from the P1-A adversarial review (2026-07-23, recorded in the
+* plan's Operating-decisions section):
+* - Inputs are pre-clamped to 2× the message cap BEFORE any regex runs — the
+*   unanchored patterns are quadratic on pathological non-matching runs
+*   (measured ~4.5 s on a 100 KB run), so regex cost must be bounded first.
+*   The final 8 KB cap still runs last.
+* - The base64-blob rule runs BEFORE the digit-run rule — a digit run inside a
+*   blob would otherwise split it into sub-64-char fragments that escape
+*   redaction.
+*
+* ENG-58122 additions, from the pre-restore review:
+* - JSON bodies run FIRST, on the raw message BEFORE the pre-clamp: error
+*   text can embed a whole response body (the WASM HTTP client's error
+*   text, kit messages), no field-level rule can vouch for an arbitrary
+*   body, and a clamp that cut a body's closing bracket would otherwise let
+*   its head through. Only the JSON span itself is replaced — the text
+*   around it, and the body's size, are kept (`[json:<chars>]`).
+* - Relative Incode paths: per-request ids in the path
+*   (`/digital-id/verifications/<id>/…`) and query strings on relative URLs
+*   (`/omni/get/ekyc?id=…`); the absolute-URL rules never matched these.
+*
+* The regex table ships in the PR description for privacy sign-off (see
+* .agents/guides/privacy.md). Known hardening backlog (D4, Phase 4): formatted
+* phone numbers, unicode digits/emails, fuzz/property tests.
+*/
+/** Three dot-joined base64url segments — JWT/JWS shape. */
+const JWT_PATTERN = /\b[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g;
+/**
+* Credential-ish key with a `:`/`=` value (quoted, `Bearer …`, or bare token).
+* The key may carry prefixes (`access_token`, `x-api-key`, `sessionToken`) —
+* a plain \b boundary would miss `_token` since `_` is a word character —
+* and a JSON closing quote (`"token":"…"` in a fragment the JSON rule could
+* not see as a body, e.g. one sliced mid-object by its source).
+*/
+const CREDENTIAL_KV_PATTERN = /([\w-]*(?:token|api[-_]?key|authorization|auth|secret|password|passwd))"?\s*[:=]\s*("[^"]*"|'[^']*'|(?:Bearer\s+)?[^\s,;&]+)/gi;
+/** Userinfo credentials in an absolute URL (`https://user:pass@host/…`). */
+const URL_USERINFO_PATTERN = /(\bhttps?:\/\/)[^\s/@]*(?::[^\s/@]*)?@/gi;
+/** Query string / fragment of an absolute URL — kills signed URLs. */
+const URL_TAIL_PATTERN = /(https?:\/\/[^\s?#]+)[?#][^\s]*/g;
+/** Per-request id segment of a verifications path (`…/verifications/<id>/status`). */
+const VERIFICATION_ID_SEGMENT_PATTERN = /(\/verifications\/)[^\s/?#]+/g;
+/**
+* Query string / fragment of a RELATIVE path (`/omni/get/ekyc?id=…`). Runs
+* after the absolute-URL rule, so only relative paths still carry one.
+*/
+const RELATIVE_PATH_TAIL_PATTERN = /((?:^|[\s"'(=])\/[^\s?#"'(=]*)[?#][^\s"')]*/g;
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+/** base64-ish blobs (media, keys) — 64+ chars of the base64/base64url alphabet. */
+const BASE64_BLOB_PATTERN = /[-A-Za-z0-9+/_]{64,}={0,2}/g;
+/** Runs of 8+ digits — phones, CURP, document numbers. */
+const DIGIT_RUN_PATTERN = /\d{8,}/g;
+const TRUNCATION_SUFFIX = "…[truncated]";
+/** Regex-cost bound: clamp raw input before any pattern runs (see header note). */
+const REGEX_INPUT_MAX_BYTES = MESSAGE_MAX_BYTES * 2;
+function sanitizeMessage(message) {
+	return truncateUtf8(truncateUtf8(redactJsonBodies(message), REGEX_INPUT_MAX_BYTES).replace(JWT_PATTERN, "[jwt]").replace(CREDENTIAL_KV_PATTERN, "$1=[redacted]").replace(URL_USERINFO_PATTERN, "$1[redacted]@").replace(URL_TAIL_PATTERN, "$1").replace(RELATIVE_PATH_TAIL_PATTERN, "$1").replace(VERIFICATION_ID_SEGMENT_PATTERN, "$1:id").replace(EMAIL_PATTERN, "[email]").replace(BASE64_BLOB_PATTERN, (match) => `[blob:${match.length}]`).replace(DIGIT_RUN_PATTERN, "[digits]"), MESSAGE_MAX_BYTES);
 }
-function warnInvalidWasmPath(field, reason) {
-	if (reason === "empty") {
-		console.warn(`[Incode SDK] wasm.${field} is empty. Falling back to CDN default.`);
-		return;
+/**
+* Replaces every serialized JSON object or array with `[json:<chars>]`. A
+* span opens where JSON does and diagnostic text does not — `{"`, `["` or
+* `[{"` (whitespace allowed), never `pipeline={face}` or
+* `pipelines=[selfie,idCapture]` — and closes at its matching bracket,
+* skipping brackets inside strings. Text outside the spans is kept as is.
+* An unclosed span is a body its source cut short, so it runs to the end.
+* A scan, not a regex: one linear pass, safe on an unbounded message.
+*/
+function redactJsonBodies(text) {
+	let redacted = "";
+	let keptFrom = 0;
+	let index = 0;
+	while (index < text.length) if (opensJsonSpan(text, index)) {
+		const end = jsonSpanEnd(text, index);
+		redacted += `${text.slice(keptFrom, index)}[json:${end - index}]`;
+		keptFrom = end;
+		index = end;
+	} else index += 1;
+	return keptFrom === 0 ? text : redacted + text.slice(keptFrom);
+}
+function opensJsonSpan(text, index) {
+	const char = text[index];
+	if (char !== "{" && char !== "[") return false;
+	let next = skipWhitespace(text, index + 1);
+	if (char === "[" && text[next] === "{") next = skipWhitespace(text, next + 1);
+	return text[next] === "\"";
+}
+function skipWhitespace(text, index) {
+	let next = index;
+	while (next < text.length && /\s/.test(text[next])) next += 1;
+	return next;
+}
+/** Exclusive end of the span opening at `start`; the text's end when unclosed. */
+function jsonSpanEnd(text, start) {
+	let depth = 0;
+	let inString = false;
+	for (let index = start; index < text.length; index += 1) {
+		const char = text[index];
+		if (inString) {
+			if (char === "\\") index += 1;
+			else if (char === "\"") inString = false;
+		} else if (char === "\"") inString = true;
+		else if (char === "{" || char === "[") depth += 1;
+		else if (char === "}" || char === "]") {
+			depth -= 1;
+			if (depth === 0) return index + 1;
+		}
 	}
-	console.warn(`[Incode SDK] wasm.${field} appears malformed. Falling back to CDN default.`);
-}
-function warnMalformedWasmPath(field) {
-	console.warn(`[Incode SDK] wasm.${field} appears malformed. Check the URL or path.`);
+	return text.length;
 }
 /**
-* Validates merged WASM path strings. When overrides contained blank path
-* values, callers should have already fallen back to defaults before this runs.
+* UTF-8 byte length without TextEncoder (banned browser global in L1 —
+* see the no-browser-api-in-core lint rule). Counts by code point.
 */
-function validateWasmPaths(config) {
-	for (const key of PATH_KEYS) {
-		const value = config[key];
-		if (typeof value === "string" && isMalformedPath(value)) warnMalformedWasmPath(key);
+function utf8ByteLength(value) {
+	let bytes = 0;
+	for (const char of value) bytes += codePointByteLength(char);
+	return bytes;
+}
+function codePointByteLength(char) {
+	const codePoint = char.codePointAt(0) ?? 0;
+	if (codePoint < 128) return 1;
+	if (codePoint < 2048) return 2;
+	if (codePoint < 65536) return 3;
+	return 4;
+}
+/** Cuts on a code-point boundary so no surrogate half ever reaches the wire. */
+function truncateUtf8(value, maxBytes) {
+	if (utf8ByteLength(value) <= maxBytes) return value;
+	const budget = maxBytes - utf8ByteLength(TRUNCATION_SUFFIX);
+	let bytes = 0;
+	let result = "";
+	for (const char of value) {
+		const charBytes = codePointByteLength(char);
+		if (bytes + charBytes > budget) break;
+		bytes += charBytes;
+		result += char;
 	}
+	return result + TRUNCATION_SUFFIX;
 }
-function pickPath(key, overrides, defaultValue) {
-	if (!overrides || !(key in overrides)) return defaultValue;
-	const raw = overrides[key];
-	if (raw === void 0) return defaultValue;
-	if (typeof raw !== "string") return defaultValue;
-	if (isBlank(raw)) {
-		warnInvalidWasmPath(key, "empty");
-		return defaultValue;
+const EVICTION_ORDER = [
+	"verbose",
+	"debug",
+	"info"
+];
+/** Stored in place of a message that is blank after sanitizing. */
+const EMPTY_MESSAGE = "[empty]";
+function createLogBuffer(options = {}) {
+	const flushThresholdBytes = options.flushThresholdBytes ?? 6e5;
+	const maxEntries = options.maxEntries ?? 5e3;
+	const { onOverflow } = options;
+	const entries = [];
+	let mode = onOverflow ? "flush" : "evict";
+	let nextIndex = 0;
+	let bytes = 0;
+	let dropped = 0;
+	let overflowPending = false;
+	function entryCost(entry) {
+		return utf8ByteLength(entry.message) + utf8ByteLength(entry.subsystem) + 120;
+	}
+	function removeAt(position) {
+		const [removed] = entries.splice(position, 1);
+		bytes -= entryCost(removed);
+		dropped += 1;
+	}
+	/** Lowest level first (oldest within it); warning+ only as the last resort. */
+	function evictOne() {
+		for (const level of EVICTION_ORDER) {
+			const position = entries.findIndex((entry) => entry.level === level);
+			if (position !== -1) {
+				removeAt(position);
+				return;
+			}
+		}
+		removeAt(0);
 	}
-	if (isMalformedPath(raw)) {
-		warnInvalidWasmPath(key, "malformed");
-		return defaultValue;
+	function copyOf(entry) {
+		return { ...entry };
 	}
-	return raw.trim();
-}
-function pickSource(key, overrides, defaultValue) {
-	if (!(key in overrides) || overrides[key] === void 0) return defaultValue;
-	const source = overrides[key];
-	if (typeof source !== "string") return source;
-	return pickPath(key, overrides, String(defaultValue));
-}
-function resolveBasePath(overrides) {
-	const defaultValue = `${WASM_CDN_BASE_URL}/${DEFAULT_WASM_VERSION}`;
-	if (!("basePath" in overrides) || overrides.basePath === void 0) return defaultValue;
-	const basePath = overrides.basePath;
-	if (typeof basePath !== "string" || isBlank(basePath) || isMalformedPath(basePath)) throw new Error("[Incode SDK] wasm.basePath is invalid.");
-	return basePath.trim();
-}
-/** Builds a WarmupConfig from a directory that mirrors the ml-wasm-kit CDN layout. */
-function buildWasmConfigFromBasePath(basePath) {
-	const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
 	return {
-		wasmPath: `${base}/webLib.wasm`,
-		wasmSimdPath: `${base}/webLibSimd.wasm`,
-		glueCodePath: `${base}/webLib.js`,
-		glueCodeSimdPath: `${base}/webLibSimd.js`,
-		modelsBasePath: `${base}/models`
+		append(level, subsystem, category, message, timestampMs) {
+			const sanitized = sanitizeMessage(message);
+			const entry = {
+				index: nextIndex,
+				timestampMs: timestampMs !== void 0 && Number.isFinite(timestampMs) ? timestampMs : getTimestamp(),
+				level,
+				subsystem,
+				category,
+				message: sanitized.trim() === "" ? EMPTY_MESSAGE : sanitized
+			};
+			nextIndex += 1;
+			entries.push(entry);
+			bytes += entryCost(entry);
+			if (mode === "flush" && onOverflow) {
+				if (!overflowPending && bytes >= flushThresholdBytes) {
+					overflowPending = true;
+					onOverflow(entries.map(copyOf));
+				}
+			} else while (bytes > flushThresholdBytes && entries.length > 1) evictOne();
+			while (entries.length > maxEntries) evictOne();
+		},
+		snapshot() {
+			return entries.map(copyOf);
+		},
+		sliceSince(index) {
+			return entries.filter((entry) => entry.index > index).map(copyOf);
+		},
+		markFlushed(uptoIndex) {
+			let removedBytes = 0;
+			let keepFrom = 0;
+			while (keepFrom < entries.length && entries[keepFrom].index <= uptoIndex) {
+				removedBytes += entryCost(entries[keepFrom]);
+				keepFrom += 1;
+			}
+			entries.splice(0, keepFrom);
+			bytes -= removedBytes;
+			overflowPending = false;
+		},
+		reserveIndex() {
+			const reserved = nextIndex;
+			nextIndex += 1;
+			return reserved;
+		},
+		setOverflowMode(next) {
+			mode = next;
+		},
+		get droppedCount() {
+			return dropped;
+		},
+		get byteEstimate() {
+			return bytes;
+		}
 	};
 }
-/** Builds the standard WarmupConfig from the Incode CDN. */
-function buildDefaultWasmConfig() {
-	return buildWasmConfigFromBasePath(`${WASM_CDN_BASE_URL}/${DEFAULT_WASM_VERSION}`);
+//#endregion
+//#region ../infra/src/crypto/randomUUID.ts
+/**
+* Cryptographically-strong UUID v4 (RFC 4122).
+*
+* Lives in infra (L0) so Core (L1) can mint secure identifiers without touching
+* the `crypto` browser API directly — Core delegates here, keeping it free of
+* browser globals (enforced by the `no-browser-api-in-core` lint rule). Backed
+* by `crypto.randomUUID`, which browsers expose only in secure contexts — check
+* `isRandomUUIDAvailable()` where a plain-`http` page must not throw.
+*/
+function randomUUID() {
+	return crypto.randomUUID();
+}
+/** `false` on insecure (plain-`http`) pages, where `randomUUID()` throws. */
+function isRandomUUIDAvailable() {
+	return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function";
+}
+//#endregion
+//#region ../infra/src/time/epochMsToIsoString.ts
+/**
+* Converts an epoch-milliseconds timestamp to a full ISO-8601 UTC string
+* (e.g. `2026-07-23T09:41:00.000Z`).
+*
+* Lives in Infra (L0) so Core can format wire timestamps without touching the
+* `Date` global directly — banned in Core by the `no-browser-api-in-core` lint
+* rule — mirroring the `crypto/randomUUID.ts` free-function precedent.
+* (`DateFormattingProvider.utcToIsoDateString` is date-only and not suitable.)
+*/
+function epochMsToIsoString(epochMs) {
+	return new Date(epochMs).toISOString();
+}
+//#endregion
+//#region src/internal/trueSight/recordBuilder.ts
+/**
+* Assembles the exact plaintext contract record — the ONLY place a diagnostics
+* payload is shaped. Pure: same function serves final records, interrupted
+* snapshots, and future incremental slices (ENG-48677 plan §1.1).
+*
+* Deny-by-default is structural here: every field is an explicit literal —
+* nothing is spread from internal state, so no unexpected field can ever leak
+* into an upload.
+*
+* Hard gates enforced:
+* - empty/missing `sessionId` or `startedAt` → returns `null` (upload skipped —
+*   expected for sessions that die before `/omni/start`).
+* - `failureReason` present if-and-only-if `outcome === 'failure'` (defaults to
+*   `'unknown'` when a failure arrives without one, or with a blank one, rather
+*   than dropping the record — TrueSight answers 400 to a blank reason).
+* - fresh record `id` per build; `endedAt` stamped at build time.
+*/
+function buildDiagnosticsRecord(meta, logs, outcome, failureReason, recordId) {
+	if (!meta.sessionId || meta.startedAtMs === null) return null;
+	const flowType = meta.flowType ?? deriveFlowTypeFromSurface(meta.integrationType);
+	if (flowType === null) return null;
+	return {
+		schemaVersion: "1.0",
+		id: recordId ?? randomUUID(),
+		session: {
+			sessionId: meta.sessionId,
+			sdkId: TRUESIGHT_SDK_ID,
+			sdkVersion: SDK_VERSION,
+			platform: "web",
+			sdkMode: null,
+			browser: meta.browser,
+			osVersion: meta.osVersion,
+			osLanguage: meta.osLanguage,
+			sdkLanguage: meta.sdkLanguage,
+			integrationType: meta.integrationType,
+			flowType,
+			flowId: meta.flowId,
+			workflowId: meta.workflowId,
+			outcome,
+			...outcome === "failure" ? { failureReason: failureReason?.trim() || "unknown" } : {},
+			startedAt: epochMsToIsoString(meta.startedAtMs),
+			endedAt: epochMsToIsoString(getTimestamp()),
+			testing: meta.testing,
+			e2eEncryptionEnabled: meta.e2eEncryptionEnabled,
+			configurationId: meta.hasConfigurationId,
+			externalCustomerId: meta.hasExternalCustomerId,
+			hasProvidedSessionId: meta.hasProvidedSessionId,
+			token: meta.hasToken,
+			externalToken: meta.hasExternalToken,
+			...meta.wasmProfile ? { webProfile: toWebProfile(meta.wasmProfile) } : {}
+		},
+		logs: logs.map(toContractEntry)
+	};
 }
-const BARCODE_ENHANCE_MODEL_FILE = WASM_MODEL_FILES.barcode;
 /**
-* URL of the lazily-loaded PDF417 barcode enhancement model (US Smart Capture).
-* Derived from the resolved `modelsBasePath` so self-hosted / air-gapped
-* deployments resolve it correctly, falling back to the CDN default. Loaded on
-* demand via `IIdCaptureCapability.setBarcodeEnhancementModel` — deliberately
-* NOT part of any warmup model bundle.
+* `session.webProfile`, field by field: TrueSight decodes it strictly
+* (unknown keys reject the record), so nothing is spread from the source.
 */
-function getBarcodeEnhanceModelUrl(modelsBasePath, variant = "current") {
-	const source = buildModelVariantSources(modelsBasePath ?? `${WASM_CDN_BASE_URL}/v2.14.50-post1/models`, BARCODE_ENHANCE_MODEL_FILE);
-	return typeof source === "string" ? source : source[variant];
+function toWebProfile(wasm) {
+	return { wasm: {
+		version: wasm.version,
+		basePathPinned: wasm.basePathPinned,
+		simd: wasm.simd,
+		...wasm.diagnosticsMode !== void 0 ? { diagnosticsMode: wasm.diagnosticsMode } : {},
+		warmupDurationMs: wasm.warmupDurationMs
+	} };
 }
 /**
-* Merges optional WASM path overrides with CDN defaults. Explicit non-blank
-* paths take precedence. Blank override strings log a warning and fall back to defaults.
+* Wire `flowType` when no orchestrator was OBSERVED (an observed one — set by
+* the bridge on any flow event — always wins). Stage ingest requires a
+* non-null enum (probe 2026-07-23: null/omitted/off-enum all 400), so the
+* entry surface decides, and the mapping is deliberately exhaustive:
+*
+* - `startWorkflow`  → 'workflow'  (Webflows engine entered, died pre-ready)
+* - `startFlow`      → 'flow'      (flow/orchestrated manager, died pre-ready)
+* - `startOnboarding`→ 'flow'      (self-loading UI wraps the flow engine)
+* - `startOnboardingSection` → null → the BUILD ABORTS (record withheld):
+*   a standalone session has no truthful flowType, and mislabeling it as a
+*   flow session is worse than skipping the upload. Withheld until the
+*   DECIDED BE ask ships (`flowType:"standalone"`, not nullable) — then this
+*   branch returns 'standalone' and standalone diagnostics start flowing,
+*   coordinated with the BE deploy since off-enum values 400 today.
 */
-function resolveWasmConfig(overrides) {
-	if (!overrides) return buildDefaultWasmConfig();
-	const defaults = buildWasmConfigFromBasePath(resolveBasePath(overrides));
-	const resolvedWasmPath = pickSource("wasmPath", overrides, defaults.wasmPath);
-	const simdDefault = overrides.selfHosted ? resolvedWasmPath : defaults.wasmSimdPath;
-	const modelsDefault = defaults.modelsBasePath;
-	const resolvedWasmSimdPath = pickSource("wasmSimdPath", overrides, simdDefault);
-	const glueCodeSimdDefault = typeof resolvedWasmSimdPath === "string" ? deriveSiblingJsPath(resolvedWasmSimdPath) : defaults.glueCodeSimdPath;
-	const merged = {
-		wasmPath: resolvedWasmPath,
-		wasmSimdPath: resolvedWasmSimdPath,
-		glueCodePath: pickPath("glueCodePath", overrides, defaults.glueCodePath),
-		glueCodeSimdPath: pickPath("glueCodeSimdPath", overrides, glueCodeSimdDefault),
-		modelsBasePath: pickPath("modelsBasePath", overrides, modelsDefault),
-		useSimd: overrides.useSimd,
-		pipelines: overrides.pipelines,
-		pipelineModels: overrides.pipelineModels,
-		modelUrls: overrides.modelUrls,
-		legacyModelUrls: overrides.legacyModelUrls,
-		loadGlue: overrides.loadGlue,
-		loadGlueSimd: overrides.loadGlueSimd,
-		selfHosted: overrides.selfHosted
+function deriveFlowTypeFromSurface(integrationType) {
+	switch (integrationType) {
+		case "startWorkflow": return "workflow";
+		case "startFlow":
+		case "startOnboarding": return "flow";
+		case "startOnboardingSection": return null;
+	}
+}
+function toContractEntry(entry) {
+	return {
+		index: entry.index,
+		timestamp: epochMsToIsoString(entry.timestampMs),
+		level: entry.level,
+		thread: "main",
+		message: entry.message,
+		subsystem: entry.subsystem,
+		category: entry.category
 	};
-	validateWasmPaths(merged);
-	return merged;
 }
 //#endregion
-//#region ../infra/src/http/createApi.ts
-var FetchHttpError = class extends Error {
-	constructor(status, statusText, url, method, headers, data) {
-		super(`HTTP ${status} ${statusText}`);
-		this.ok = false;
-		this.status = status;
-		this.statusText = statusText;
-		this.url = url;
-		this.method = method;
-		this.headers = headers;
-		this.data = data;
-		this.name = "FetchHttpError";
+//#region src/internal/trueSight/sessionMetadata.ts
+/**
+* Hosts that match this pattern are non-prod by heuristic. Known failure modes
+* (customer CNAMEs, devMode left on in prod) are documented for the planned
+* P1 team review — see plan §Operating decisions (B6).
+*/
+const NON_PROD_HOST_PATTERN = /stage|demo|saas-dev|localhost/i;
+function createInitialState() {
+	return {
+		sessionId: null,
+		startedAtMs: null,
+		browser: null,
+		osVersion: null,
+		osLanguage: null,
+		sdkLanguage: "en-US",
+		integrationType: "startOnboardingSection",
+		flowType: null,
+		flowId: null,
+		workflowId: null,
+		testing: false,
+		devModeSignal: void 0,
+		apiUrlSignal: void 0,
+		hasConfigurationId: false,
+		hasExternalCustomerId: false,
+		hasProvidedSessionId: false,
+		hasExternalToken: false
+	};
+}
+let state = createInitialState();
+let sources = {};
+function stampStartedAtOnce() {
+	if (state.startedAtMs === null) state.startedAtMs = getTimestamp();
+}
+/** Tap for `createSession` — sessionId comes from the returned `interviewId`. */
+function noteSessionCreated(session, options = {}) {
+	if (session.interviewId) state.sessionId = session.interviewId;
+	stampStartedAtOnce();
+	state.sdkLanguage = options.language ?? state.sdkLanguage;
+	state.hasConfigurationId = state.hasConfigurationId || options.configurationId !== void 0;
+	state.hasExternalCustomerId = state.hasExternalCustomerId || options.externalCustomerId !== void 0;
+	state.hasProvidedSessionId = state.hasProvidedSessionId || options.interviewId !== void 0;
+}
+/**
+* Fallback sessionId for host-minted-token integrations that never called
+* `createSession`: `Features.sessionIdentifier` — used only when no
+* `interviewId` was observed.
+*/
+function noteFeatureConfig(features) {
+	if (!state.sessionId && features.sessionIdentifier) {
+		state.sessionId = features.sessionIdentifier;
+		stampStartedAtOnce();
 	}
-};
-const buildQueryString$1 = (query) => {
-	if (!query) return "";
-	const params = new URLSearchParams();
-	Object.entries(query).forEach(([key, value]) => {
-		if (value !== void 0 && value !== null) params.append(key, String(value));
-	});
-	const str = params.toString();
-	return str ? `?${str}` : "";
-};
-const buildUrl$1 = (baseURL, url, query) => {
-	const queryString = buildQueryString$1(query);
-	if (url.startsWith("http://") || url.startsWith("https://")) return `${url}${queryString}`;
-	return `${baseURL.endsWith("/") ? baseURL.slice(0, -1) : baseURL}${url.startsWith("/") ? url : `/${url}`}${queryString}`;
-};
-const prepareBody$1 = (body) => {
+}
+/**
+* Entry-surface discriminator. `startOnboardingSection` is the default (weakest
+* signal — standalone module managers); richer surfaces upgrade it and are never
+* downgraded back.
+*/
+function noteIntegrationSurface(integrationType) {
+	if (integrationType === "startOnboardingSection") return;
+	state.integrationType = integrationType;
+}
+function noteEnvironment(environment) {
+	state.browser = environment.browser ?? state.browser;
+	state.osVersion = environment.osVersion ?? state.osVersion;
+	state.osLanguage = environment.osLanguage ?? state.osLanguage;
+}
+/**
+* WRITE-ONCE orchestrator identity (determinism guarantee for debugging):
+* a session is a flow or a workflow from its first orchestrator observation
+* and can never flip mid-session — a record labeled `flow` must always point
+* at a real flow. First non-null value wins for each of flowType/flowId/
+* workflowId; later calls are ignored (the service logs a self-health line
+* when a CONFLICTING orchestrator kind shows up).
+*/
+function noteFlowContext(context) {
+	state.flowType = state.flowType ?? context.flowType;
+	state.flowId = state.flowId ?? context.flowId ?? null;
+	state.workflowId = state.workflowId ?? context.workflowId ?? null;
+}
+/**
+* `testing` heuristic: devMode OR non-prod API host pattern. Always a boolean —
+* the contract requires the field present on every record. Signals MERGE across
+* calls (a later apiUrl-only call must not erase an earlier devMode signal);
+* `testing` is recomputed from the merged pair.
+*/
+function noteTestingSignals(signals) {
+	state.devModeSignal = signals.devMode ?? state.devModeSignal;
+	state.apiUrlSignal = signals.apiUrl ?? state.apiUrlSignal;
+	state.testing = state.devModeSignal === true || state.apiUrlSignal !== void 0 && NON_PROD_HOST_PATTERN.test(state.apiUrlSignal);
+}
+/**
+* Live read of the merged testing signal (devMode OR non-prod host). Used to
+* gate host-console self-health noise so production host pages stay quiet while
+* staging/dev keeps the console signal (the record always captures it either
+* way via `trueSightLog`). Same signal the overflow-flush staging gate uses.
+*/
+function isTrueSightTesting() {
+	return state.testing;
+}
+/**
+* Tap for `initializeSession({ token })` with a host-minted token — records
+* only the presence fact ("this token came from outside the SDK"), never the
+* token itself.
+*/
+function noteExternalTokenProvided() {
+	state.hasExternalToken = true;
+}
+/**
+* Wiring tap for every `initializeSession({ token })`: a token activated
+* before any `createSession` was observed on this page is host-minted, i.e.
+* external. (The exact `token`/`externalToken` web-semantics are a pending
+* Phase 0 contract ask — this inference is the interim mapping.)
+*/
+function noteTokenActivated() {
+	if (state.sessionId === null) noteExternalTokenProvided();
+}
+function configureTrueSightMetadataSources(next) {
+	sources = next;
+}
+/** Explicit literal — the metadata half handed to the record builder. */
+function buildSessionMetadata() {
+	return {
+		sessionId: state.sessionId,
+		startedAtMs: state.startedAtMs,
+		browser: state.browser,
+		osVersion: state.osVersion,
+		osLanguage: state.osLanguage,
+		sdkLanguage: state.sdkLanguage,
+		integrationType: state.integrationType,
+		flowType: state.flowType,
+		flowId: state.flowId,
+		workflowId: state.workflowId,
+		testing: state.testing,
+		e2eEncryptionEnabled: readE2eEncryptionEnabled(),
+		hasConfigurationId: state.hasConfigurationId,
+		hasExternalCustomerId: state.hasExternalCustomerId,
+		hasProvidedSessionId: state.hasProvidedSessionId,
+		hasToken: readHasToken(),
+		hasExternalToken: state.hasExternalToken,
+		wasmProfile: readWasmProfile()
+	};
+}
+/** Fail-open: diagnostics must never throw into the host flow. */
+function readE2eEncryptionEnabled() {
+	try {
+		return sources.getE2eEncryptionEnabled?.() ?? false;
+	} catch {
+		return false;
+	}
+}
+/** Fail-open, like readE2eEncryptionEnabled. */
+function readWasmProfile() {
+	try {
+		return sources.getWasmProfile?.() ?? null;
+	} catch {
+		return null;
+	}
+}
+/** Fail-open, like readE2eEncryptionEnabled. */
+function readHasToken() {
+	try {
+		return sources.getHasToken?.() ?? false;
+	} catch {
+		return false;
+	}
+}
+function resetTrueSightMetadata() {
+	state = createInitialState();
+	sources = {};
+}
+//#endregion
+//#region src/internal/trueSight/pendingEnvelopeStore.ts
+/** Index slot listing sessionIds with pending entries (no enumeration API). */
+const PENDING_INDEX_KEY = `${PENDING_STORAGE_KEY_PREFIX}index`;
+function slotKey(sessionId) {
+	return `${PENDING_STORAGE_KEY_PREFIX}${sessionId}`;
+}
+/**
+* Adds the session to the pending index. Called once at collection start —
+* long before any page-hide — so the hide path never needs the index
+* read-modify-write and stays a single synchronous-effective write.
+*/
+async function registerPendingSlot(sessionId, deps) {
+	try {
+		const index = await readIndex(deps.storage);
+		if (index.includes(sessionId)) return;
+		await deps.storage.set(PENDING_INDEX_KEY, [...index, sessionId]);
+	} catch {}
+}
+/**
+* Writes the sealed snapshot envelope into the session's slot. `BrowserStorageProvider`
+* executes the underlying `localStorage.setItem` synchronously in the first
+* slice of the async call, which is what makes this safe to fire (void) from
+* a page-hide handler.
+*/
+async function writePendingEnvelope(sessionId, entry, deps) {
+	try {
+		await deps.storage.set(slotKey(sessionId), entry);
+	} catch {}
+}
+/** Removes the entry and its index membership (terminal upload dispatched). */
+async function clearPending(sessionId, deps) {
+	try {
+		await deps.storage.remove(slotKey(sessionId));
+		const index = await readIndex(deps.storage);
+		if (index.includes(sessionId)) await deps.storage.set(PENDING_INDEX_KEY, index.filter((candidate) => candidate !== sessionId));
+	} catch {}
+}
+/**
+* Next-load recovery, invoked from the first-token-observed hook (A1 — never
+* at `setup()`, which has no auth). For each foreign, old-enough entry: the
+* slot is cleared AT DISPATCH, then the envelope is posted fire-and-forget —
+* no 200-tracking, no retries (A2; a crash between clear and fire loses that
+* record, consistent with no-retry). Entries at/past the retention ceiling
+* are deleted unsent (A4). Never rejects; returns the A5 loss counters.
+*/
+async function recoverPendingEnvelopes(options) {
+	const { storage, post, currentSessionId } = options;
+	const now = options.now ?? getTimestamp;
+	const counters = {
+		recovered: 0,
+		gcExpired: 0
+	};
+	try {
+		const index = await readIndex(storage);
+		if (index.length === 0) return counters;
+		const keptInIndex = [];
+		for (const sessionId of index) {
+			if (sessionId === currentSessionId) {
+				keptInIndex.push(sessionId);
+				continue;
+			}
+			const entry = await readEntry(storage, sessionId);
+			if (entry === "missing") continue;
+			if (entry === "corrupt") {
+				counters.gcExpired += 1;
+				continue;
+			}
+			const age = now() - entry.persistedAt;
+			if (age >= 6048e5) {
+				counters.gcExpired += 1;
+				await storage.remove(slotKey(sessionId));
+				continue;
+			}
+			if (age < 12e4) {
+				keptInIndex.push(sessionId);
+				continue;
+			}
+			await storage.remove(slotKey(sessionId));
+			counters.recovered += 1;
+			post(endpoints.diagnosticsData, entry.envelope, {}).catch(() => {});
+		}
+		await storage.set(PENDING_INDEX_KEY, keptInIndex);
+	} catch {}
+	return counters;
+}
+async function readIndex(storage) {
+	const index = await storage.get(PENDING_INDEX_KEY);
+	if (!Array.isArray(index)) return [];
+	return index.filter((value) => typeof value === "string");
+}
+/** Reads one entry; malformed slots are pruned and reported as corrupt. */
+async function readEntry(storage, sessionId) {
+	try {
+		const value = await storage.get(slotKey(sessionId));
+		if (value === null) return "missing";
+		if (typeof value === "object" && value.v === 1 && typeof value.persistedAt === "number" && typeof value.envelope === "object") return value;
+		await storage.remove(slotKey(sessionId));
+		return "corrupt";
+	} catch {
+		try {
+			await storage.remove(slotKey(sessionId));
+		} catch {}
+		return "corrupt";
+	}
+}
+//#endregion
+//#region src/internal/featureConfig/featureConfigService.ts
+let cachedFeatures = null;
+/**
+* Checks if a feature is enabled in the feature config.
+*/
+function isFeatureEnabled(feature, features) {
+	return features?.find((f) => f.feature === feature)?.enabled ?? false;
+}
+/**
+* Fetches feature configuration from the backend.
+* Results are cached for the session lifetime.
+*/
+async function fetchFeatureConfig(signal) {
+	if (cachedFeatures) return cachedFeatures;
+	const response = await api.get(endpoints.featureConfig, { signal });
+	if (!response.ok) throw new Error(`Failed to fetch feature config: ${response.status} ${response.statusText}`);
+	cachedFeatures = response.data;
+	return cachedFeatures;
+}
+/**
+* Resets the cached feature config (useful for testing).
+*/
+function resetFeatureConfigCache() {
+	cachedFeatures = null;
+}
+//#endregion
+//#region ../infra/src/http/createApi.ts
+var FetchHttpError = class extends HttpRequestError {
+	constructor(..._args) {
+		super(..._args);
+		this.name = "FetchHttpError";
+	}
+};
+const buildQueryString$1 = (query) => {
+	if (!query) return "";
+	const params = new URLSearchParams();
+	Object.entries(query).forEach(([key, value]) => {
+		if (value !== void 0 && value !== null) params.append(key, String(value));
+	});
+	const str = params.toString();
+	return str ? `?${str}` : "";
+};
+const buildUrl$1 = (baseURL, url, query) => {
+	const queryString = buildQueryString$1(query);
+	if (url.startsWith("http://") || url.startsWith("https://")) return `${url}${queryString}`;
+	return `${baseURL.endsWith("/") ? baseURL.slice(0, -1) : baseURL}${url.startsWith("/") ? url : `/${url}`}${queryString}`;
+};
+const prepareBody$1 = (body) => {
 	if (body === null || body === void 0) return null;
 	if (body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer) return body;
 	if (typeof body === "object") return JSON.stringify(body);
@@ -229,7 +771,7 @@ const requestWithXHR = (fullUrl, method, mergedHeaders, requestBody, timeout, si
 				headers: responseHeaders,
 				data
 			});
-			else reject(new FetchHttpError(xhr.status, xhr.statusText, fullUrl, method, responseHeaders, data));
+			else reject(reportHttpError(new FetchHttpError(xhr.status, xhr.statusText, fullUrl, method, responseHeaders, data), mergedHeaders));
 		};
 		xhr.onerror = () => {
 			reject(new FetchHttpError(0, "Network Error", fullUrl, method, {}, null));
@@ -294,7 +836,7 @@ const createApi = (config) => {
 					responseHeaders[key] = value;
 				});
 				const data = await parseResponse(response, parse);
-				if (!response.ok) throw new FetchHttpError(response.status, response.statusText, fullUrl, method, responseHeaders, data);
+				if (!response.ok) throw reportHttpError(new FetchHttpError(response.status, response.statusText, fullUrl, method, responseHeaders, data), mergedHeaders);
 				return {
 					ok: true,
 					status: response.status,
@@ -385,16 +927,9 @@ function buildWasmDefaultHeaders(customHeaders) {
 		...customHeaders ?? {}
 	};
 }
-var WasmHttpError = class extends Error {
-	constructor(status, statusText, url, method, headers, data) {
-		super(`HTTP ${status} ${statusText}`);
-		this.ok = false;
-		this.status = status;
-		this.statusText = statusText;
-		this.url = url;
-		this.method = method;
-		this.headers = headers;
-		this.data = data;
+var WasmHttpError = class extends HttpRequestError {
+	constructor(..._args) {
+		super(..._args);
 		this.name = "WasmHttpError";
 	}
 };
@@ -449,9 +984,9 @@ const getErrorMessage = (error) => {
 };
 const withAbortSignal = async (promise, signal, error) => {
 	if (!signal) return await promise;
-	if (signal.aborted) throw error;
+	if (signal.aborted) throw error();
 	return await new Promise((resolve, reject) => {
-		const onAbort = () => reject(error);
+		const onAbort = () => reject(error());
 		signal.addEventListener("abort", onAbort, { once: true });
 		promise.then(resolve, reject).finally(() => {
 			signal.removeEventListener("abort", onAbort);
@@ -463,7 +998,12 @@ const createWasmApi = async (config) => {
 	const isEncryptionEnabled = config.isEncryptionEnabled ?? (() => false);
 	const useSha256 = config.mgf1 === "sha256";
 	await initializeWasmWebClient(config.wasm);
-	await setupWasmConnection(config.apiURL, "", config.encryptionEnabled ?? false, headers, useSha256);
+	try {
+		await setupWasmConnection(config.apiURL, "", config.encryptionEnabled ?? false, headers, useSha256);
+	} catch (error) {
+		if (!(error instanceof WasmWebClientError)) throw error;
+		throw reportHttpError(new WasmHttpError(error.statusCode, "", config.apiURL, "POST", {}, getErrorData(error)), headers);
+	}
 	const defaults = {
 		baseURL: config.apiURL,
 		headers
@@ -486,11 +1026,11 @@ const createWasmApi = async (config) => {
 			const wasmProgress = onUploadProgress ? (progress) => {
 				if (progress.total > 0) onUploadProgress(Math.round(progress.loaded / progress.total * 100));
 			} : void 0;
-			const abortError = new WasmHttpError(0, "Request aborted", fullUrl, upperMethod, {}, null);
-			if (signal?.aborted) throw abortError;
+			const abortError = () => new WasmHttpError(0, "Request aborted", fullUrl, upperMethod, {}, null);
+			if (signal?.aborted) throw abortError();
 			try {
 				const response = await withAbortSignal(executeWasmRequest(upperMethod, url, requestBody, mergedHeaders, requestParams, timeout, wasmProgress, ie), signal, abortError);
-				if (response.status < 200 || response.status >= 300) throw new WasmHttpError(response.status, "", fullUrl, upperMethod, {}, response.data);
+				if (response.status < 200 || response.status >= 300) throw reportHttpError(new WasmHttpError(response.status, "", fullUrl, upperMethod, {}, response.data), mergedHeaders);
 				return {
 					ok: true,
 					status: response.status,
@@ -501,7 +1041,7 @@ const createWasmApi = async (config) => {
 				};
 			} catch (error) {
 				if (error instanceof WasmHttpError) throw error;
-				throw new WasmHttpError(getErrorStatus(error), getErrorMessage(error), fullUrl, upperMethod, {}, getErrorData(error));
+				throw reportHttpError(new WasmHttpError(getErrorStatus(error), getErrorMessage(error), fullUrl, upperMethod, {}, getErrorData(error)), mergedHeaders);
 			}
 		},
 		get(url, requestConfig) {
@@ -570,10 +1110,15 @@ const createWasmApi = async (config) => {
 * host called `setup()` without `wasm` and warmed WASM separately), swap to
 * the WASM client first. The module is already loaded — the payload came
 * out of it — so the swap only creates the `WebClient`.
+*
+* These requests bypass the `api.*` helpers, so the transport reports them
+* to the same timing observer itself (TrueSight row 23b): the protected
+* image uploads are otherwise the only requests a record never shows.
 */
 function bindWebApiTransport(client) {
 	return async (url, body, config) => {
-		const response = await (config.ie === true && storedHttpConfig && !storedHttpConfig.isWasm ? await ensureWasmHttpClient() : client).request({
+		const activeClient = config.ie === true && storedHttpConfig && !storedHttpConfig.isWasm ? await ensureWasmHttpClient() : client;
+		const response = await withTiming("POST", url, () => activeClient.request({
 			method: "POST",
 			url,
 			body,
@@ -581,7 +1126,7 @@ function bindWebApiTransport(client) {
 			params: config.params,
 			timeout: config.timeout,
 			ie: config.ie
-		});
+		}));
 		return {
 			data: response.data,
 			status: response.status
@@ -606,511 +1151,225 @@ function getStoredHttpConfig() {
 function isHttpEncrypted() {
 	return storedHttpConfig?.encryption.enabled ?? false;
 }
-/** Clears all HTTP-client state. Called by `reset()`. */
-function resetHttpClientState() {
-	storedHttpConfig = void 0;
-	setWebApiHttpTransport(null);
-}
-/**
-* Builds (or replaces) the HTTP client when `setup()` receives an `apiURL`.
-* Picks `createWasmApi` when `effectiveWasm` is set, otherwise plain
-* `createApi`. Wraps the call in handshake-failure context when encryption
-* is requested.
-*/
-async function installFreshHttpClient(apiURL, options, effectiveWasm, encryption) {
-	installClient(effectiveWasm ? await withHandshakeFailureContext(encryption.enabled, () => createWasmApi({
-		apiURL,
-		customHeaders: options.customHeaders,
-		timeout: options.timeout,
-		wasm: effectiveWasm,
-		encryptionEnabled: encryption.enabled,
-		mgf1: encryption.mgf1,
-		isEncryptionEnabled: isHttpEncrypted
-	})) : createApi({
-		apiURL,
-		customHeaders: options.customHeaders,
-		timeout: options.timeout
-	}));
-	storedHttpConfig = {
-		apiURL,
-		customHeaders: options.customHeaders,
-		timeout: options.timeout,
-		isWasm: Boolean(effectiveWasm),
-		encryption
-	};
-}
-/**
-* Replaces the active HTTP client with the WASM-backed one. Used internally
-* by lazy-loading UI components (`<incode-flow>`, `<incode-workflow>`) when
-* WASM finishes warming up.
-*
-* No-op when no apiURL was previously configured, or when the active client
-* is already WASM-backed. The encryption state (enabled + MGF1 scheme) is
-* preserved across the swap — this is *not* a user-facing encryption change.
-*
-* @internal NOT a public API. Application code should use
-*   `setup({ wasm: {...} })` instead.
-*/
-async function upgradeToWasmHttpClient(resolved) {
-	const stored = storedHttpConfig;
-	if (!stored || stored.isWasm) return;
-	pendingUpgrade ??= (async () => {
-		installClient(await createWasmApi({
-			apiURL: stored.apiURL,
-			customHeaders: stored.customHeaders,
-			timeout: stored.timeout,
-			wasm: resolved,
-			encryptionEnabled: stored.encryption.enabled,
-			mgf1: stored.encryption.mgf1,
-			isEncryptionEnabled: isHttpEncrypted
-		}));
-		storedHttpConfig = {
-			...stored,
-			isWasm: true
-		};
-	})().finally(() => {
-		pendingUpgrade = void 0;
-	});
-	return pendingUpgrade;
-}
-/**
-* When `wantsEncryption` is true, wraps a call that triggers the in-binary
-* RSA/AES handshake so its rejection surfaces as a single, descriptive error
-* with the original error preserved as `cause`. Pass-through otherwise.
-*/
-async function withHandshakeFailureContext(wantsEncryption, fn) {
-	if (!wantsEncryption) return fn();
-	try {
-		return await fn();
-	} catch (cause) {
-		const error = /* @__PURE__ */ new Error("Failed to establish encrypted transport. The /e2ee/key handshake did not complete. Verify the apiURL is reachable and that the environment supports E2EE.");
-		error.cause = cause;
-		throw error;
-	}
-}
-/** Hard cap per log message, UTF-8 bytes (contract). */
-const MESSAGE_MAX_BYTES = 8 * 1024;
-const TRUESIGHT_SDK_ID = "IncdOnboarding";
-/** localStorage key prefix for persisted sealed snapshots (A3: one slot per session). */
-const PENDING_STORAGE_KEY_PREFIX = "incode.truesight.pending.";
-//#endregion
-//#region src/internal/trueSight/sanitize.ts
-/**
-* Deny-by-default message scrubber — runs at INGESTION (inside the log buffer's
-* `append`), so the buffer, every persisted snapshot, and every upload are
-* already clean; there is no code path around it (ENG-48677 plan §1.2).
-*
-* Ordered pipeline. Two deliberate deviations from the plan's original rule
-* order, both from the P1-A adversarial review (2026-07-23, recorded in the
-* plan's Operating-decisions section):
-* - Inputs are pre-clamped to 2× the message cap BEFORE any regex runs — the
-*   unanchored patterns are quadratic on pathological non-matching runs
-*   (measured ~4.5 s on a 100 KB run), so regex cost must be bounded first.
-*   The final 8 KB cap still runs last.
-* - The base64-blob rule runs BEFORE the digit-run rule — a digit run inside a
-*   blob would otherwise split it into sub-64-char fragments that escape
-*   redaction.
-*
-* The regex table ships in the P1-A PR description for privacy sign-off (see
-* .agents/guides/privacy.md). Known hardening backlog (D4, Phase 4): formatted
-* phone numbers, unicode digits/emails, fuzz/property tests.
-*/
-/** Three dot-joined base64url segments — JWT/JWS shape. */
-const JWT_PATTERN = /\b[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g;
-/**
-* Credential-ish key with a `:`/`=` value (quoted, `Bearer …`, or bare token).
-* The key may carry prefixes (`access_token`, `x-api-key`, `sessionToken`) —
-* a plain \b boundary would miss `_token` since `_` is a word character.
-*/
-const CREDENTIAL_KV_PATTERN = /([\w-]*(?:token|api[-_]?key|authorization|auth|secret|password|passwd))\s*[:=]\s*("[^"]*"|'[^']*'|(?:Bearer\s+)?[^\s,;&]+)/gi;
-/** Userinfo credentials in an absolute URL (`https://user:pass@host/…`). */
-const URL_USERINFO_PATTERN = /(\bhttps?:\/\/)[^\s/@]*(?::[^\s/@]*)?@/gi;
-/** Query string / fragment of an absolute URL — kills signed URLs. */
-const URL_TAIL_PATTERN = /(https?:\/\/[^\s?#]+)[?#][^\s]*/g;
-const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
-/** base64-ish blobs (media, keys) — 64+ chars of the base64/base64url alphabet. */
-const BASE64_BLOB_PATTERN = /[-A-Za-z0-9+/_]{64,}={0,2}/g;
-/** Runs of 8+ digits — phones, CURP, document numbers. */
-const DIGIT_RUN_PATTERN = /\d{8,}/g;
-const TRUNCATION_SUFFIX = "…[truncated]";
-/** Regex-cost bound: clamp raw input before any pattern runs (see header note). */
-const REGEX_INPUT_MAX_BYTES = MESSAGE_MAX_BYTES * 2;
-function sanitizeMessage(message) {
-	return truncateUtf8(truncateUtf8(message, REGEX_INPUT_MAX_BYTES).replace(JWT_PATTERN, "[jwt]").replace(CREDENTIAL_KV_PATTERN, "$1=[redacted]").replace(URL_USERINFO_PATTERN, "$1[redacted]@").replace(URL_TAIL_PATTERN, "$1").replace(EMAIL_PATTERN, "[email]").replace(BASE64_BLOB_PATTERN, (match) => `[blob:${match.length}]`).replace(DIGIT_RUN_PATTERN, "[digits]"), MESSAGE_MAX_BYTES);
-}
-/**
-* UTF-8 byte length without TextEncoder (banned browser global in L1 —
-* see the no-browser-api-in-core lint rule). Counts by code point.
-*/
-function utf8ByteLength(value) {
-	let bytes = 0;
-	for (const char of value) bytes += codePointByteLength(char);
-	return bytes;
-}
-function codePointByteLength(char) {
-	const codePoint = char.codePointAt(0) ?? 0;
-	if (codePoint < 128) return 1;
-	if (codePoint < 2048) return 2;
-	if (codePoint < 65536) return 3;
-	return 4;
-}
-/** Cuts on a code-point boundary so no surrogate half ever reaches the wire. */
-function truncateUtf8(value, maxBytes) {
-	if (utf8ByteLength(value) <= maxBytes) return value;
-	const budget = maxBytes - utf8ByteLength(TRUNCATION_SUFFIX);
-	let bytes = 0;
-	let result = "";
-	for (const char of value) {
-		const charBytes = codePointByteLength(char);
-		if (bytes + charBytes > budget) break;
-		bytes += charBytes;
-		result += char;
-	}
-	return result + TRUNCATION_SUFFIX;
-}
-//#endregion
-//#region ../infra/src/crypto/randomUUID.ts
-/**
-* Cryptographically-strong UUID v4 (RFC 4122).
-*
-* Lives in infra (L0) so Core (L1) can mint secure identifiers without touching
-* the `crypto` browser API directly — Core delegates here, keeping it free of
-* browser globals (enforced by the `no-browser-api-in-core` lint rule). Backed
-* by `crypto.randomUUID`, available in every browser the SDK targets.
-*/
-function randomUUID() {
-	return crypto.randomUUID();
-}
-//#endregion
-//#region ../infra/src/time/epochMsToIsoString.ts
-/**
-* Converts an epoch-milliseconds timestamp to a full ISO-8601 UTC string
-* (e.g. `2026-07-23T09:41:00.000Z`).
-*
-* Lives in Infra (L0) so Core can format wire timestamps without touching the
-* `Date` global directly — banned in Core by the `no-browser-api-in-core` lint
-* rule — mirroring the `crypto/randomUUID.ts` free-function precedent.
-* (`DateFormattingProvider.utcToIsoDateString` is date-only and not suitable.)
-*/
-function epochMsToIsoString(epochMs) {
-	return new Date(epochMs).toISOString();
-}
-//#endregion
-//#region src/internal/trueSight/recordBuilder.ts
-/**
-* Assembles the exact plaintext contract record — the ONLY place a diagnostics
-* payload is shaped. Pure: same function serves final records, interrupted
-* snapshots, and future incremental slices (ENG-48677 plan §1.1).
-*
-* Deny-by-default is structural here: every field is an explicit literal —
-* nothing is spread from internal state, so no unexpected field can ever leak
-* into an upload.
-*
-* Hard gates enforced:
-* - empty/missing `sessionId` or `startedAt` → returns `null` (upload skipped —
-*   expected for sessions that die before `/omni/start`).
-* - `failureReason` present if-and-only-if `outcome === 'failure'` (defaults to
-*   `'unknown'` when a failure arrives without one, rather than dropping the record).
-* - fresh record `id` per build; `endedAt` stamped at build time.
-*/
-function buildDiagnosticsRecord(meta, logs, outcome, failureReason, recordId) {
-	if (!meta.sessionId || meta.startedAtMs === null) return null;
-	const flowType = meta.flowType ?? deriveFlowTypeFromSurface(meta.integrationType);
-	if (flowType === null) return null;
-	return {
-		schemaVersion: "1.0",
-		id: recordId ?? randomUUID(),
-		session: {
-			sessionId: meta.sessionId,
-			sdkId: TRUESIGHT_SDK_ID,
-			sdkVersion: SDK_VERSION,
-			platform: "web",
-			sdkMode: null,
-			browser: meta.browser,
-			osVersion: meta.osVersion,
-			osLanguage: meta.osLanguage,
-			sdkLanguage: meta.sdkLanguage,
-			integrationType: meta.integrationType,
-			flowType,
-			flowId: meta.flowId,
-			workflowId: meta.workflowId,
-			outcome,
-			...outcome === "failure" ? { failureReason: failureReason ?? "unknown" } : {},
-			startedAt: epochMsToIsoString(meta.startedAtMs),
-			endedAt: epochMsToIsoString(getTimestamp()),
-			testing: meta.testing,
-			e2eEncryptionEnabled: meta.e2eEncryptionEnabled,
-			configurationId: meta.hasConfigurationId,
-			externalCustomerId: meta.hasExternalCustomerId,
-			hasProvidedSessionId: meta.hasProvidedSessionId,
-			token: meta.hasToken,
-			externalToken: meta.hasExternalToken
-		},
-		logs: logs.map(toContractEntry)
-	};
-}
-/**
-* Wire `flowType` when no orchestrator was OBSERVED (an observed one — set by
-* the bridge on any flow event — always wins). Stage ingest requires a
-* non-null enum (probe 2026-07-23: null/omitted/off-enum all 400), so the
-* entry surface decides, and the mapping is deliberately exhaustive:
-*
-* - `startWorkflow`  → 'workflow'  (Webflows engine entered, died pre-ready)
-* - `startFlow`      → 'flow'      (flow/orchestrated manager, died pre-ready)
-* - `startOnboarding`→ 'flow'      (self-loading UI wraps the flow engine)
-* - `startOnboardingSection` → null → the BUILD ABORTS (record withheld):
-*   a standalone session has no truthful flowType, and mislabeling it as a
-*   flow session is worse than skipping the upload. Withheld until the
-*   DECIDED BE ask ships (`flowType:"standalone"`, not nullable) — then this
-*   branch returns 'standalone' and standalone diagnostics start flowing,
-*   coordinated with the BE deploy since off-enum values 400 today.
-*/
-function deriveFlowTypeFromSurface(integrationType) {
-	switch (integrationType) {
-		case "startWorkflow": return "workflow";
-		case "startFlow":
-		case "startOnboarding": return "flow";
-		case "startOnboardingSection": return null;
-	}
-}
-function toContractEntry(entry) {
-	return {
-		index: entry.index,
-		timestamp: epochMsToIsoString(entry.timestampMs),
-		level: entry.level,
-		thread: "main",
-		message: entry.message,
-		subsystem: entry.subsystem,
-		category: entry.category
-	};
-}
-function createInitialState() {
-	return {
-		sessionId: null,
-		startedAtMs: null,
-		browser: null,
-		osVersion: null,
-		osLanguage: null,
-		sdkLanguage: "en-US",
-		integrationType: "startOnboardingSection",
-		flowType: null,
-		flowId: null,
-		workflowId: null,
-		testing: false,
-		devModeSignal: void 0,
-		apiUrlSignal: void 0,
-		hasConfigurationId: false,
-		hasExternalCustomerId: false,
-		hasProvidedSessionId: false,
-		hasExternalToken: false
-	};
-}
-let state = createInitialState();
-let sources = {};
-/** Tap for `createSession` — sessionId comes from the returned `interviewId`. */
-function noteSessionCreated(session, options = {}) {}
-function noteEnvironment(environment) {}
-/**
-* `testing` heuristic: devMode OR non-prod API host pattern. Always a boolean —
-* the contract requires the field present on every record. Signals MERGE across
-* calls (a later apiUrl-only call must not erase an earlier devMode signal);
-* `testing` is recomputed from the merged pair.
-*/
-function noteTestingSignals(signals) {}
-/**
-* Live read of the merged testing signal (devMode OR non-prod host). Used to
-* gate host-console self-health noise so production host pages stay quiet while
-* staging/dev keeps the console signal (the record always captures it either
-* way via `trueSightLog`). Same signal the overflow-flush staging gate uses.
-*/
-function isTrueSightTesting() {
-	return state.testing;
-}
-/**
-* Wiring tap for every `initializeSession({ token })`: a token activated
-* before any `createSession` was observed on this page is host-minted, i.e.
-* external. (The exact `token`/`externalToken` web-semantics are a pending
-* Phase 0 contract ask — this inference is the interim mapping.)
-*/
-function noteTokenActivated() {}
-/** Explicit literal — the metadata half handed to the record builder. */
-function buildSessionMetadata() {
-	return {
-		sessionId: state.sessionId,
-		startedAtMs: state.startedAtMs,
-		browser: state.browser,
-		osVersion: state.osVersion,
-		osLanguage: state.osLanguage,
-		sdkLanguage: state.sdkLanguage,
-		integrationType: state.integrationType,
-		flowType: state.flowType,
-		flowId: state.flowId,
-		workflowId: state.workflowId,
-		testing: state.testing,
-		e2eEncryptionEnabled: readE2eEncryptionEnabled(),
-		hasConfigurationId: state.hasConfigurationId,
-		hasExternalCustomerId: state.hasExternalCustomerId,
-		hasProvidedSessionId: state.hasProvidedSessionId,
-		hasToken: readHasToken(),
-		hasExternalToken: state.hasExternalToken
-	};
-}
-/** Fail-open: diagnostics must never throw into the host flow. */
-function readE2eEncryptionEnabled() {
-	try {
-		return sources.getE2eEncryptionEnabled?.() ?? false;
-	} catch {
-		return false;
-	}
-}
-/** Fail-open, like readE2eEncryptionEnabled. */
-function readHasToken() {
-	try {
-		return sources.getHasToken?.() ?? false;
-	} catch {
-		return false;
-	}
-}
-function resetTrueSightMetadata() {
-	state = createInitialState();
-	sources = {};
-}
-//#endregion
-//#region src/internal/trueSight/pendingEnvelopeStore.ts
-/** Index slot listing sessionIds with pending entries (no enumeration API). */
-const PENDING_INDEX_KEY = `${PENDING_STORAGE_KEY_PREFIX}index`;
-function slotKey(sessionId) {
-	return `${PENDING_STORAGE_KEY_PREFIX}${sessionId}`;
-}
-/**
-* Adds the session to the pending index. Called once at collection start —
-* long before any page-hide — so the hide path never needs the index
-* read-modify-write and stays a single synchronous-effective write.
-*/
-async function registerPendingSlot(sessionId, deps) {
-	try {
-		const index = await readIndex(deps.storage);
-		if (index.includes(sessionId)) return;
-		await deps.storage.set(PENDING_INDEX_KEY, [...index, sessionId]);
-	} catch {}
-}
-/**
-* Writes the sealed snapshot into the session's slot. `BrowserStorageProvider`
-* executes the underlying `localStorage.setItem` synchronously in the first
-* slice of the async call, which is what makes this safe to fire (void) from
-* a page-hide handler.
-*/
-async function writePendingEnvelope(sessionId, entry, deps) {
-	try {
-		await deps.storage.set(slotKey(sessionId), entry);
-	} catch {}
-}
-/** Removes the entry and its index membership (terminal upload dispatched). */
-async function clearPending(sessionId, deps) {
-	try {
-		await deps.storage.remove(slotKey(sessionId));
-		const index = await readIndex(deps.storage);
-		if (index.includes(sessionId)) await deps.storage.set(PENDING_INDEX_KEY, index.filter((candidate) => candidate !== sessionId));
-	} catch {}
-}
+/** Clears all HTTP-client state. Called by `reset()`. */
+function resetHttpClientState() {
+	storedHttpConfig = void 0;
+	setWebApiHttpTransport(null);
+}
 /**
-* Next-load recovery, invoked from the first-token-observed hook (A1 — never
-* at `setup()`, which has no auth). For each foreign, old-enough entry: the
-* slot is cleared AT DISPATCH, then the envelope is posted fire-and-forget —
-* no 200-tracking, no retries (A2; a crash between clear and fire loses that
-* record, consistent with no-retry). Entries at/past the retention ceiling
-* are deleted unsent (A4). Never rejects; returns the A5 loss counters.
+* Builds (or replaces) the HTTP client when `setup()` receives an `apiURL`.
+* Picks `createWasmApi` when `effectiveWasm` is set, otherwise plain
+* `createApi`. Wraps the call in handshake-failure context when encryption
+* is requested.
 */
-async function recoverPendingEnvelopes(options) {
-	const { storage, post, currentSessionId } = options;
-	const now = options.now ?? getTimestamp;
-	const counters = {
-		recovered: 0,
-		gcExpired: 0
+async function installFreshHttpClient(apiURL, options, effectiveWasm, encryption) {
+	installClient(effectiveWasm ? await withHandshakeFailureContext(encryption.enabled, () => createWasmApi({
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout,
+		wasm: effectiveWasm,
+		encryptionEnabled: encryption.enabled,
+		mgf1: encryption.mgf1,
+		isEncryptionEnabled: isHttpEncrypted
+	})) : createApi({
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout
+	}));
+	storedHttpConfig = {
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout,
+		isWasm: Boolean(effectiveWasm),
+		encryption
 	};
-	try {
-		const index = await readIndex(storage);
-		if (index.length === 0) return counters;
-		const keptInIndex = [];
-		for (const sessionId of index) {
-			if (sessionId === currentSessionId) {
-				keptInIndex.push(sessionId);
-				continue;
-			}
-			const entry = await readEntry(storage, sessionId);
-			if (entry === "missing") continue;
-			if (entry === "corrupt") {
-				counters.gcExpired += 1;
-				continue;
-			}
-			const age = now() - entry.persistedAt;
-			if (age >= 6048e5) {
-				counters.gcExpired += 1;
-				await storage.remove(slotKey(sessionId));
-				continue;
-			}
-			if (age < 12e4) {
-				keptInIndex.push(sessionId);
-				continue;
-			}
-			await storage.remove(slotKey(sessionId));
-			counters.recovered += 1;
-			post(endpoints.diagnosticsData, entry.envelope, {}).catch(() => {});
-		}
-		await storage.set(PENDING_INDEX_KEY, keptInIndex);
-	} catch {}
-	return counters;
 }
-async function readIndex(storage) {
-	const index = await storage.get(PENDING_INDEX_KEY);
-	if (!Array.isArray(index)) return [];
-	return index.filter((value) => typeof value === "string");
+/**
+* Replaces the active HTTP client with the WASM-backed one. Used internally
+* by lazy-loading UI components (`<incode-flow>`, `<incode-workflow>`) when
+* WASM finishes warming up.
+*
+* No-op when no apiURL was previously configured, or when the active client
+* is already WASM-backed. The encryption state (enabled + MGF1 scheme) is
+* preserved across the swap — this is *not* a user-facing encryption change.
+*
+* @internal NOT a public API. Application code should use
+*   `setup({ wasm: {...} })` instead.
+*/
+async function upgradeToWasmHttpClient(resolved) {
+	const stored = storedHttpConfig;
+	if (!stored || stored.isWasm) return;
+	pendingUpgrade ??= (async () => {
+		try {
+			installClient(await createWasmApi({
+				apiURL: stored.apiURL,
+				customHeaders: stored.customHeaders,
+				timeout: stored.timeout,
+				wasm: resolved,
+				encryptionEnabled: stored.encryption.enabled,
+				mgf1: stored.encryption.mgf1,
+				isEncryptionEnabled: isHttpEncrypted
+			}));
+			storedHttpConfig = {
+				...stored,
+				isWasm: true
+			};
+			emitWasmDiagnostic({
+				level: "info",
+				subsystem: "client",
+				category: "other",
+				message: `http client upgraded to wasm encrypted=${stored.encryption.enabled}`
+			});
+		} catch (error) {
+			emitWasmDiagnostic({
+				level: "error",
+				subsystem: "client",
+				category: "other",
+				message: `http client upgrade failed error=${String(error)}`
+			});
+			throw error;
+		}
+	})().finally(() => {
+		pendingUpgrade = void 0;
+	});
+	return pendingUpgrade;
 }
-/** Reads one entry; malformed slots are pruned and reported as corrupt. */
-async function readEntry(storage, sessionId) {
+/**
+* When `wantsEncryption` is true, wraps a call that triggers the in-binary
+* RSA/AES handshake so its rejection surfaces as a single, descriptive error
+* with the original error preserved as `cause`. Pass-through otherwise.
+*/
+async function withHandshakeFailureContext(wantsEncryption, fn) {
+	if (!wantsEncryption) return fn();
 	try {
-		const value = await storage.get(slotKey(sessionId));
-		if (value === null) return "missing";
-		if (typeof value === "object" && value.v === 1 && typeof value.persistedAt === "number" && typeof value.envelope === "object") return value;
-		await storage.remove(slotKey(sessionId));
-		return "corrupt";
-	} catch {
-		try {
-			await storage.remove(slotKey(sessionId));
-		} catch {}
-		return "corrupt";
+		return await fn();
+	} catch (cause) {
+		const error = /* @__PURE__ */ new Error("Failed to establish encrypted transport. The /e2ee/key handshake did not complete. Verify the apiURL is reachable and that the environment supports E2EE.");
+		error.cause = cause;
+		throw error;
 	}
 }
 //#endregion
-//#region src/internal/featureConfig/featureConfigService.ts
-let cachedFeatures = null;
+//#region src/internal/trueSight/eventBridge.ts
 /**
-* Checks if a feature is enabled in the feature config.
+* Canonical subsystem registry (plan §Subsystem registry): one stable
+* lowercase dotted string per SDK area. The raw `eventModuleNames` wire
+* values are inconsistent (`SELFIE`, `datasharingconsent`, `AdSign`…), four
+* keys collapse into `ID`, and `workflow` doubles as a module name — this
+* table is the single normalization point, snapshot-frozen in tests so the
+* dashboard facet stays bounded (~70 strings) forever.
 */
-function isFeatureEnabled(feature, features) {
-	return features?.find((f) => f.feature === feature)?.enabled ?? false;
-}
+const MODULE_SUBSYSTEMS = {
+	[eventModuleNames.selfie]: "module.selfie",
+	[eventModuleNames.faceCapture]: "module.face-capture",
+	[eventModuleNames.authentication]: "module.authentication",
+	[eventModuleNames.authFace]: "module.auth-face",
+	[eventModuleNames.mlConsent]: "module.ml-consent",
+	[eventModuleNames.combinedConsent]: "module.combined-consent",
+	[eventModuleNames.curpValidation]: "module.curp",
+	[eventModuleNames.faceMatch]: "module.face-match",
+	[eventModuleNames.qr]: "module.qr",
+	[eventModuleNames.videoSelfie]: "module.video-selfie",
+	[eventModuleNames.id]: "module.id",
+	[eventModuleNames.idCapture]: "module.id-capture",
+	[eventModuleNames.idVerification]: "module.id-verification",
+	[eventModuleNames.idOcr]: "module.id-ocr",
+	[eventModuleNames.document]: "module.document-capture",
+	[eventModuleNames.creditCard]: "module.credit-card-front",
+	[eventModuleNames.creditCardBack]: "module.credit-card-back",
+	[eventModuleNames.conference]: "module.conference",
+	[eventModuleNames.otp]: "module.otp",
+	[eventModuleNames.signature]: "module.e-sign",
+	[eventModuleNames.ekyc]: "module.e-kyc",
+	[eventModuleNames.watchlist]: "module.watchlist",
+	[eventModuleNames.globalWatchList]: "module.global-watchlist",
+	[eventModuleNames.customWatchList]: "module.custom-watchlist",
+	[eventModuleNames.email]: "module.email",
+	[eventModuleNames.phone]: "module.phone-number",
+	[eventModuleNames.instantVerifyEmail]: "module.instant-verify-email",
+	[eventModuleNames.instantVerifyConsent]: "module.instant-verify-consent",
+	[eventModuleNames.forms]: "module.forms",
+	[eventModuleNames.customModule]: "module.custom-module",
+	[eventModuleNames.geolocation]: "module.geolocation",
+	[eventModuleNames.ekyb]: "module.e-kyb",
+	[eventModuleNames.identityReuse]: "module.identity-reuse",
+	[eventModuleNames.antifraud]: "module.antifraud",
+	[eventModuleNames.aeSignature]: "module.ae-signature",
+	[eventModuleNames.qeSignature]: "module.qe-signature",
+	[eventModuleNames.crossDocumentDataMatch]: "module.cross-document-data-match",
+	[eventModuleNames.customFields]: "module.custom-fields",
+	[eventModuleNames.fieldComparison]: "module.field-comparison",
+	[eventModuleNames.personhood]: "module.personhood",
+	[eventModuleNames.watchlistForBusiness]: "module.watchlist-for-business",
+	[eventModuleNames.trustGraph]: "module.trust-graph",
+	[eventModuleNames.certificateIssuance]: "module.certificate-issuance",
+	[eventModuleNames.governmentValidation]: "module.government-validation",
+	[eventModuleNames.documentUpload]: "module.document-upload",
+	[eventModuleNames.home]: "module.home",
+	[eventModuleNames.workflow]: "module.workflow",
+	[eventModuleNames.fiscalQr]: "module.fiscal-qr"
+};
 /**
-* Fetches feature configuration from the backend.
-* Results are cached for the session lifetime.
+* Raw orchestrator module keys (flow `currentStep`, workflow
+* `currentNode.moduleKey`) whose kebab fallback would NOT land on the
+* module's canonical subsystem. Advanceable-error events carry these keys
+* instead of `eventModuleNames`, so they alias here; keys whose fallback
+* already matches (`DOCUMENT_CAPTURE`, `COMBINED_CONSENT`, …) or that name a
+* distinct step (`ADDRESS`, `INE_VALIDATION`, `SECOND_ID`) need no entry.
+* Snapshot-frozen in tests with the table above.
 */
-async function fetchFeatureConfig(signal) {
-	if (cachedFeatures) return cachedFeatures;
-	const response = await api.get(endpoints.featureConfig, { signal });
-	if (!response.ok) throw new Error(`Failed to fetch feature config: ${response.status} ${response.statusText}`);
-	cachedFeatures = response.data;
-	return cachedFeatures;
-}
+const ORCHESTRATOR_KEY_SUBSYSTEMS = {
+	PHONE: "module.phone-number",
+	EXTERNAL_VERIFICATION: "module.e-kyc",
+	EKYB: "module.e-kyb",
+	SIGNATURE: "module.e-sign",
+	DYNAMIC_FORMS: "module.forms",
+	CURP_VALIDATION: "module.curp",
+	GOVT_VALIDATION_PROVISIONING: "module.government-validation",
+	WATCHLIST_BUSINESS: "module.watchlist-for-business",
+	INCODE_WATCHLIST: "module.custom-watchlist",
+	REDIRECT_TO_MOBILE: "module.qr"
+};
+const CUSTOM_SUBSYSTEM_MAX_CHARS = 40;
 /**
-* Resets the cached feature config (useful for testing).
+* Canonical `module.<kebab>` for a raw wire module name. Unknown/integrator-
+* custom names get a sanitized lowercase fallback (capped) — custom SDK 2
+* integrations get real per-module detail, not a lumped `other`.
 */
-function resetFeatureConfigCache() {
-	cachedFeatures = null;
-}
-eventModuleNames.selfie, eventModuleNames.faceCapture, eventModuleNames.authentication, eventModuleNames.authFace, eventModuleNames.mlConsent, eventModuleNames.combinedConsent, eventModuleNames.curpValidation, eventModuleNames.faceMatch, eventModuleNames.qr, eventModuleNames.videoSelfie, eventModuleNames.id, eventModuleNames.idCapture, eventModuleNames.idVerification, eventModuleNames.idOcr, eventModuleNames.document, eventModuleNames.creditCard, eventModuleNames.creditCardBack, eventModuleNames.conference, eventModuleNames.otp, eventModuleNames.signature, eventModuleNames.ekyc, eventModuleNames.watchlist, eventModuleNames.globalWatchList, eventModuleNames.customWatchList, eventModuleNames.email, eventModuleNames.phone, eventModuleNames.instantVerifyEmail, eventModuleNames.instantVerifyConsent, eventModuleNames.forms, eventModuleNames.customModule, eventModuleNames.geolocation, eventModuleNames.ekyb, eventModuleNames.identityReuse, eventModuleNames.antifraud, eventModuleNames.aeSignature, eventModuleNames.qeSignature, eventModuleNames.crossDocumentDataMatch, eventModuleNames.customFields, eventModuleNames.fieldComparison, eventModuleNames.personhood, eventModuleNames.watchlistForBusiness, eventModuleNames.trustGraph, eventModuleNames.certificateIssuance, eventModuleNames.governmentValidation, eventModuleNames.documentUpload, eventModuleNames.home, eventModuleNames.workflow, eventModuleNames.fiscalQr;
-eventModuleNames.id, eventModuleNames.idCapture, eventModuleNames.idVerification, eventModuleNames.idOcr, eventModuleNames.document, eventModuleNames.documentUpload, eventModuleNames.creditCard, eventModuleNames.creditCardBack, eventModuleNames.curpValidation;
-eventModuleNames.selfie, eventModuleNames.faceCapture, eventModuleNames.authentication, eventModuleNames.authFace, eventModuleNames.faceMatch, eventModuleNames.videoSelfie, eventModuleNames.personhood;
-eventModuleNames.home, eventModuleNames.workflow;
+function normalizeSubsystem(rawModule) {
+	if (rawModule === void 0) return "module.unknown";
+	const canonical = MODULE_SUBSYSTEMS[rawModule] ?? ORCHESTRATOR_KEY_SUBSYSTEMS[rawModule];
+	if (canonical !== void 0) return canonical;
+	const sanitized = rawModule.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, CUSTOM_SUBSYSTEM_MAX_CHARS).replace(/-+$/g, "");
+	return `module.${sanitized === "" ? "unknown" : sanitized}`;
+}
+const ID_SCAN_MODULES = /* @__PURE__ */ new Set([
+	eventModuleNames.id,
+	eventModuleNames.idCapture,
+	eventModuleNames.idVerification,
+	eventModuleNames.idOcr,
+	eventModuleNames.document,
+	eventModuleNames.documentUpload,
+	eventModuleNames.creditCard,
+	eventModuleNames.creditCardBack,
+	eventModuleNames.curpValidation,
+	"ID_CAPTURE",
+	"TUTORIAL_ID",
+	"SECOND_ID",
+	"DOCUMENT_CAPTURE",
+	"ADDRESS",
+	"CURP_VALIDATION"
+]);
+const FACE_SCAN_MODULES = /* @__PURE__ */ new Set([
+	eventModuleNames.selfie,
+	eventModuleNames.faceCapture,
+	eventModuleNames.authentication,
+	eventModuleNames.authFace,
+	eventModuleNames.faceMatch,
+	eventModuleNames.videoSelfie,
+	eventModuleNames.personhood
+]);
+const ORCHESTRATION_MODULES = /* @__PURE__ */ new Set([eventModuleNames.home, eventModuleNames.workflow]);
 /**
 * Coarse category for HTTP-failure entries, from the endpoint path (event
 * map row 23: "by endpoint"). A conservative token heuristic — the category
@@ -1118,36 +1377,220 @@ eventModuleNames.home, eventModuleNames.workflow;
 * scan bucket.
 */
 function categoryForEndpoint(endpoint) {
+	if (/\/omni\/es\//.test(endpoint)) return "other";
 	if (/face|selfie|video|speech|personhood|authenticate|recordings/.test(endpoint)) return "faceScan";
-	if (/front-id|back-id|second-id|process\/id|images|barcode|ocr|document|curp|cfdi|address-statement/.test(endpoint)) return "idScan";
+	if (/front-id|back-id|second-id|process\/id|images|barcode|ocr|document|curp|cfdi|address-statement|digital-id|device\/wallet/.test(endpoint)) return "idScan";
 	if (/start|flow|workflow|feature-config|onboarding|finish-status/.test(endpoint)) return "orchestration";
 	return "other";
 }
+/** Coarse contract category from the RAW `event.module` value (plan rule). */
+function categoryForModule(rawModule) {
+	if (rawModule === void 0) return "other";
+	if (ID_SCAN_MODULES.has(rawModule)) return "idScan";
+	if (FACE_SCAN_MODULES.has(rawModule)) return "faceScan";
+	if (ORCHESTRATION_MODULES.has(rawModule)) return "orchestration";
+	return "other";
+}
+/** `verb key=value` line: undefined values drop their pair entirely. */
+function formatLine(verb, pairs = []) {
+	const parts = [verb];
+	for (const [key, value] of pairs) if (value !== void 0 && value !== null && value !== "") parts.push(`${key}=${String(value)}`);
+	return parts.join(" ");
+}
+/**
+* Analytics event → contract log tuple, or `null` for codes the taxonomy
+* does not cover (deny-by-default: nothing rides into the record unreviewed).
+* Levels/subsystems/categories per the plan's event map rows 5–6 and 16–20.
+*/
+function mapAnalyticsEventToLog(event) {
+	const payload = event.payload ?? {};
+	const subsystem = normalizeSubsystem(event.module);
+	const category = categoryForModule(event.module);
+	switch (event.code) {
+		case "moduleOpened":
+		case "moduleClosed": return {
+			level: "info",
+			subsystem,
+			category,
+			message: formatLine(event.code === "moduleOpened" ? "module opened" : "module closed", [["screen", event.screen]])
+		};
+		case "screenOpened":
+		case "screenClosed": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine(event.code === "screenOpened" ? "screen opened" : "screen closed", [["screen", event.screen]])
+		};
+		case "errorTriggered": return {
+			level: "error",
+			subsystem,
+			category,
+			message: formatLine("errorTriggered", [
+				["errorName", stringOrUndefined(payload.errorName) ?? "unknown"],
+				["errorCode", stringOrUndefined(payload.errorCode)],
+				["reason", stringOrUndefined(payload.reason)]
+			])
+		};
+		case "captureAttemptFinished": {
+			const logs = stringOrUndefined(payload.logs);
+			return {
+				level: "debug",
+				subsystem,
+				category,
+				message: formatLine("capture attempt finished", [["logsBytes", logs === void 0 ? void 0 : utf8ByteLength(logs)]])
+			};
+		}
+		case "background":
+		case "foreground": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: `visibility ${event.code}`
+		};
+		case "switchToAutoCaptureFrontId":
+		case "switchToAutoCaptureBackId": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine("capture mode switched to auto", [["side", event.code === "switchToAutoCaptureBackId" ? "back" : "front"]])
+		};
+		case "experimentAssigned": return {
+			level: "info",
+			subsystem,
+			category,
+			message: formatLine("experiment assigned", [["screen", event.screen], ["fields", Object.keys(payload).filter((key) => key !== "module").length]])
+		};
+		case "elementClicked": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine("element clicked", [["element", stringOrUndefined(payload.element)], ["action", stringOrUndefined(payload.action)]])
+		};
+		case "browser": {
+			const browser = nameVersion(payload.browser);
+			const os = nameVersion(payload.os);
+			const device = typeof payload.device === "object" && payload.device !== null ? stringOrUndefined(payload.device.type) : void 0;
+			return {
+				level: "info",
+				subsystem: "session",
+				category: "other",
+				message: formatLine("browser info", [
+					["browser", browser],
+					["os", os],
+					["device", device],
+					["webrtc", typeof payload.isWebRtcSupported === "boolean" ? payload.isWebRtcSupported : void 0]
+				])
+			};
+		}
+		default: return null;
+	}
+}
+function stringOrUndefined(value) {
+	return typeof value === "string" ? value : void 0;
+}
+function nameVersion(value) {
+	if (typeof value !== "object" || value === null) return;
+	const { name, version } = value;
+	const joined = [name, version].filter((part) => typeof part === "string" && part !== "").join(" ");
+	return joined === "" ? void 0 : joined;
+}
 //#endregion
 //#region src/internal/trueSight/uploader.ts
-let cryptoProviderPromise = null;
+let sealerProviderPromise = null;
 /**
-* Loads the browser sealer as a LAZY chunk, once — crypto stays off the host
+* Loads the browser sealer as a LAZY chunk, once — it stays off the host
 * page's critical path until diagnostics actually need it (first upload or
-* the service's prewarm).
+* the service's prewarm). A future sealing scheme swaps in here.
+*/
+function loadDiagnosticsEnvelopeProvider() {
+	sealerProviderPromise ??= import("./BrowserDiagnosticsEnvelopeProvider-BQca6KPG.esm.js").then((module) => new module.BrowserDiagnosticsEnvelopeProvider());
+	return sealerProviderPromise;
+}
+/**
+* Seals a record inside the contract limits: the record JSON at or under
+* `MAX_RECORD_JSON_BYTES` (decompressed) and the serialized envelope at or
+* under `MAX_ENVELOPE_BYTES`. Over either cap, rebuilds ONCE with the oldest
+* half of the logs dropped; still over → `null` rather than an invalid
+* envelope. Rejects only when sealing itself fails.
 */
-function loadDiagnosticsCryptoProvider() {
-	cryptoProviderPromise ??= import("./BrowserDiagnosticsCryptoProvider-BuzqvbhN.esm.js").then((module) => new module.BrowserDiagnosticsCryptoProvider());
-	return cryptoProviderPromise;
+async function sealWithinLimits(record, sealer, warn) {
+	const first = await sealMeasured(record, sealer);
+	if (withinLimits(first)) {
+		if (first.envelopeBytes > 9e5) warn(`[TrueSight] envelope ${first.envelopeBytes}B is approaching the 1MB cap`);
+		return first;
+	}
+	const trimmed = {
+		...record,
+		logs: record.logs.slice(Math.floor(record.logs.length / 2))
+	};
+	warn(`[TrueSight] envelope ${first.envelopeBytes}B (record ${first.recordBytes}B) over the cap — rebuilt with the oldest ${record.logs.length - trimmed.logs.length} logs dropped`);
+	const second = await sealMeasured(trimmed, sealer);
+	if (!withinLimits(second)) {
+		warn("[TrueSight] envelope still over the cap after trim — upload dropped");
+		return null;
+	}
+	return second;
 }
 /**
-* Seals and posts one diagnostics record. Never rejects (fail-open). Size
-* guards per contract: warn approaching the 1 MB envelope cap; over the cap,
-* rebuild ONCE with the oldest half of the logs dropped; still over → drop
-* the upload entirely rather than send an invalid envelope.
+* Seals and posts one diagnostics record. Never rejects (fail-open); resolves
+* with how the attempt ended. Size guards per contract: warn approaching the
+* 1 MB envelope cap; over a cap, rebuild ONCE with the oldest half of the
+* logs dropped; still over → drop the upload entirely rather than send an
+* invalid envelope.
 */
-async function uploadDiagnostics(record, options) {}
+async function uploadDiagnostics(record, options) {
+	const warn = options.warn ?? defaultWarn;
+	let sealed;
+	try {
+		sealed = await sealWithinLimits(record, await (options.loadSealer ?? loadDiagnosticsEnvelopeProvider)(), warn);
+	} catch (error) {
+		warn(`[TrueSight] diagnostics upload failed (no retry): ${String(error)}`);
+		return "unsent";
+	}
+	if (sealed === null) return "dropped";
+	if (options.onSealed) try {
+		await options.onSealed(sealed);
+	} catch {}
+	try {
+		const keepalive = options.keepalive === true && sealed.envelopeBytes <= 6e4;
+		const response = await options.post(endpoints.diagnosticsData, sealed.envelope, keepalive ? { keepalive: true } : {});
+		if (isForwardedFalse(response.data)) warn("[TrueSight] proxy accepted the record but did not forward it (forwarded:false)");
+		return response.ok ? "delivered" : "rejected";
+	} catch (error) {
+		warn(`[TrueSight] diagnostics upload failed (no retry): ${String(error)}`);
+		return hasHttpStatus(error) ? "rejected" : "unsent";
+	}
+}
+/** An HTTP answer arrived (the client threw for a non-2xx status). */
+function hasHttpStatus(error) {
+	if (typeof error !== "object" || error === null || !("status" in error)) return false;
+	const { status } = error;
+	return typeof status === "number" && status > 0;
+}
+async function sealMeasured(record, sealer) {
+	const json = JSON.stringify(record);
+	const envelope = await sealer.seal(json);
+	return {
+		envelope,
+		envelopeBytes: utf8ByteLength(JSON.stringify(envelope)),
+		recordBytes: utf8ByteLength(json)
+	};
+}
+function withinLimits(measured) {
+	return measured.envelopeBytes <= 1e6 && measured.recordBytes <= 2097152;
+}
+function isForwardedFalse(data) {
+	return typeof data === "object" && data !== null && "forwarded" in data && data.forwarded === false;
+}
+function defaultWarn() {}
 //#endregion
 //#region src/internal/trueSight/trueSightService.ts
 let active = false;
+/** The lifecycle's first `initialize` opted out — later calls cannot re-enable. */
+let optedOut = false;
 let remoteKilled = false;
 let finalized = false;
-let cryptoUnsupported = false;
+let sealerUnsupported = false;
 let collectionStarted = false;
 let flagResolutionStarted = false;
 let lastError = null;
@@ -1158,15 +1601,26 @@ let options = defaultOptions();
 let observedManagerKind = null;
 let orchestratorConflictLogged = false;
 let snapshotRecordId = null;
+let cachedPendingEnvelope = null;
 let snapshotDirty = false;
 let captureActive = false;
 let rebuildInFlight = false;
+/**
+* Bumped by `resetTrueSight()`: an async continuation started under an older
+* value belongs to a torn-down lifecycle and must not touch this one.
+*/
+let lifecycleGeneration = 0;
 let sealFailureLogged = false;
 let pendingSlotRegistered = false;
 let recoveryStarted = false;
+let bridgeFailureCount = 0;
+let envSnapshotLogged = false;
 let hintTransitionCount = 0;
 let hintSuppressedCount = 0;
 let lastHintStatus = null;
+let overflowBatchCount = 0;
+let lastFlushRecordId = null;
+let overflowDormant = false;
 let overflowFlushInFlightUpTo = null;
 let dirtyTimerHandle = null;
 let unsubscribePageHide = null;
@@ -1175,20 +1629,45 @@ function defaultOptions() {
 		fetchFeatures: fetchFeatureConfig,
 		captureTransport: captureLiveTransport,
 		upload: uploadDiagnostics,
-		loadCrypto: loadDiagnosticsCryptoProvider
+		loadSealer: loadDiagnosticsEnvelopeProvider
 	};
 }
 /**
-* Boot-time entry, called from `setup()`. Idempotent — the first activating
-* call wins for the SDK lifecycle (like the analytics batcher and the
-* encryption lock); `reset()` → `resetTrueSight()` starts a new one.
-* `enabled:false` is a no-op by design: zero subscriptions, zero state.
+* Boot-time entry, called from `setup()`. Idempotent — the first call decides
+* for the SDK lifecycle, an opt-out included (like the analytics batcher and
+* the encryption lock); `reset()` → `resetTrueSight()` starts a new one.
+* `enabled:false` collects nothing by design — zero subscriptions, zero
+* state — and holds even when a later `setup()` omits the option (the web
+* wrapper's `setup()` never forwards it).
 */
-function initializeTrueSightDiagnostics(serviceOptions) {}
+function initializeTrueSightDiagnostics(serviceOptions) {
+	if (active || optedOut) return;
+	if (!serviceOptions.enabled) {
+		optedOut = true;
+		return;
+	}
+	active = true;
+	options = {
+		...defaultOptions(),
+		...pickDefined(serviceOptions)
+	};
+	buffer = createLogBuffer({ onOverflow: handleBufferOverflow });
+	configureTrueSightMetadataSources({
+		getHasToken: () => getToken() !== null,
+		getE2eEncryptionEnabled: isHttpEncrypted,
+		getWasmProfile: options.getWasmProfile
+	});
+	unsubscribeEvents = subscribeEvent(handleAnalyticsEvent);
+	trueSightLog("debug", "diagnostics", "other", "diagnostics initialized");
+	if (options.pageLifecycle && options.storage) unsubscribePageHide = options.pageLifecycle.onPageHide(handlePageHide);
+	if (options.timer && options.storage) dirtyTimerHandle = options.timer.setInterval(() => {
+		maybeRebuildSnapshot();
+	}, SNAPSHOT_DIRTY_INTERVAL_MS);
+}
 /**
 * Session-time entry, called from `initializeSession` once feature config is
 * known. Collection is already running by then (buffering starts at
-* initialize); this resolves the remote flag and prewarms the crypto chunk.
+* initialize); this resolves the remote flag and prewarms the sealer chunk.
 * When the host's fetch failed, call with no argument — the service resolves
 * the cached `fetchFeatureConfig()` itself (a token is present at this point).
 */
@@ -1196,9 +1675,10 @@ function startTrueSightCollection(features) {
 	if (!active || remoteKilled || finalized) return;
 	if (!collectionStarted) {
 		collectionStarted = true;
-		prewarmCrypto();
+		prewarmSealer();
 	}
 	if (features) {
+		noteFeatureConfig(features);
 		if (!flagResolutionStarted) {
 			flagResolutionStarted = true;
 			applyFeatureResolution(features, false);
@@ -1206,6 +1686,7 @@ function startTrueSightCollection(features) {
 	} else if (!flagResolutionStarted) {
 		flagResolutionStarted = true;
 		options.fetchFeatures().then((fetched) => {
+			noteFeatureConfig(fetched);
 			applyFeatureResolution(fetched, false);
 		}, () => {
 			applyFeatureResolution(null, true);
@@ -1218,38 +1699,64 @@ function startTrueSightCollection(features) {
 * snapshot rebuilds are suppressed — the collector must never compete with
 * 30 fps capture. Deactivation flushes the deferred rebuild.
 */
-function noteTrueSightCaptureActivity(activityActive) {}
+function noteTrueSightCaptureActivity(activityActive) {
+	if (activityActive && !captureActive) resetHintBudget();
+	captureActive = activityActive;
+	if (!activityActive) maybeRebuildSnapshot();
+}
 /**
 * Seals and uploads the one final record per session. The upload-relevant
 * state — transport, metadata (live token/E2EE getters read NOW), buffered
 * logs — is captured SYNCHRONOUSLY before the first await, because `reset()`
 * calls `resetApi()` immediately after this returns. Finalize-once: later
-* terminals and late events are no-ops. Never rejects.
+* terminals and late events are no-ops. Never rejects and never throws:
+* `reset()` and the flow bridge call it synchronously.
 */
 function finalizeTrueSight(outcome, failureReason) {
 	if (!active || remoteKilled || finalized) return Promise.resolve();
 	finalized = true;
+	try {
+		return uploadTerminalRecord(outcome, failureReason);
+	} catch {
+		return Promise.resolve();
+	}
+}
+function uploadTerminalRecord(outcome, failureReason) {
+	drainExternalDiagnostics();
 	trueSightLog("info", "session", "orchestration", `finalizing outcome=${outcome}${failureReason !== void 0 ? ` reason=${failureReason}` : ""}`);
 	const metadata = buildSessionMetadata();
 	const logs = (buffer?.snapshot() ?? []).filter((entry) => overflowFlushInFlightUpTo === null || entry.index > overflowFlushInFlightUpTo);
 	const transport = safeCaptureTransport();
-	if (transport === null || cryptoUnsupported) return Promise.resolve();
+	if (transport === null || sealerUnsupported) return Promise.resolve();
 	const record = buildDiagnosticsRecord(metadata, logs, outcome, failureReason);
 	if (record === null) return Promise.resolve();
-	if (options.storage && metadata.sessionId) clearPending(metadata.sessionId, { storage: options.storage });
+	cachedPendingEnvelope = null;
+	const storage = options.storage;
+	const { sessionId } = record.session;
 	return options.upload(record, {
 		post: transport,
 		keepalive: true,
-		loadCrypto: options.loadCrypto,
-		warn: selfHealthWarn
+		loadSealer: options.loadSealer,
+		warn: selfHealthWarn,
+		onSealed: storage ? (sealed) => persistTerminalEnvelope(sessionId, sealed, storage) : void 0
+	}).then((uploadOutcome) => {
+		if (storage && uploadOutcome !== "unsent") clearPending(sessionId, { storage });
 	});
 }
+async function persistTerminalEnvelope(sessionId, sealed, storage) {
+	await registerPendingSlot(sessionId, { storage });
+	await writePendingEnvelope(sessionId, {
+		v: 1,
+		persistedAt: getTimestamp(),
+		envelope: sealed.envelope
+	}, { storage });
+}
 /**
 * Capture guidance-hint transition tap (event map 19b/19c): the moment the
 * hint the user sees CHANGES, as the status CODE — never the localized text.
 * Consecutive dedupe on top of the source dedupe, plus a per-attempt budget
 * (~60, then suppress-with-counter) so a struggling capture can never flood
-* the buffer. The budget resets when a capture attempt finishes. Level is
+* the buffer. The budget resets when a capture attempt starts or finishes. Level is
 * debug so the eviction fallback drops hints before warnings/errors.
 */
 function trueSightHintTransition(subsystem, category, status) {
@@ -1267,10 +1774,33 @@ function trueSightHintTransition(subsystem, category, status) {
 	}
 	trueSightLog("debug", subsystem, category, `hint changed status=${status}`);
 }
+function resetHintBudget() {
+	if (hintSuppressedCount > 0) trueSightLog("debug", "diagnostics", "other", `hint transitions suppressed count=${hintSuppressedCount}`);
+	hintTransitionCount = 0;
+	hintSuppressedCount = 0;
+	lastHintStatus = null;
+}
+/**
+* External drain (ENG-48677 WS2): finalize and every snapshot rebuild call it
+* synchronously before building a record, so diagnostics buffered outside
+* TrueSight (the WASM kit's sink tail, or its `getAppLogs` text) land in the
+* terminal record and in an interrupted one alike. Injected by `setup()` —
+* same decoupled shape as the observers there.
+*/
+let externalDrain = null;
+function setTrueSightExternalDrain(drain) {
+	externalDrain = drain;
+}
+/** Synchronous by contract; best-effort — a broken drain never breaks a build. */
+function drainExternalDiagnostics() {
+	try {
+		externalDrain?.();
+	} catch {}
+}
 /** Buffer tap for wiring points and self-health lines. No-op when inactive. */
-function trueSightLog(level, subsystem, category, message) {
+function trueSightLog(level, subsystem, category, message, timestampMs) {
 	if (buffer === null) return;
-	buffer.append(level, subsystem, category, message);
+	buffer.append(level, subsystem, category, message, timestampMs);
 	snapshotDirty = true;
 }
 /**
@@ -1289,7 +1819,11 @@ function notifyTrueSightFlowEvent(event, managerKind) {
 				trueSightLog("info", managerKind, "orchestration", "flow.started");
 				break;
 			case "flow.ready":
-				if (identityAccepted) managerKind === "flow" && event.flowId, managerKind === "workflow" && event.flowId;
+				if (identityAccepted) noteFlowContext({
+					flowType: managerKind,
+					flowId: managerKind === "flow" ? event.flowId ?? null : null,
+					workflowId: managerKind === "workflow" ? event.flowId ?? null : null
+				});
 				trueSightLog("info", managerKind, "orchestration", `flow.ready ${managerKind === "workflow" ? "workflowId" : "flowId"}=${event.flowId ?? "unknown"}`);
 				break;
 			case "flow.module.started":
@@ -1300,8 +1834,8 @@ function notifyTrueSightFlowEvent(event, managerKind) {
 				break;
 			}
 			case "flow.error":
-				lastError = sanitizeMessage(event.error ?? "unknown");
-				trueSightLog("error", managerKind, "orchestration", `flow.error message=${event.error ?? "unknown"}`);
+				lastError = sanitizeMessage(event.error || "unknown");
+				trueSightLog("error", managerKind, "orchestration", `flow.error message=${event.error || "unknown"}`);
 				break;
 			case "flow.completed":
 				trueSightLog("info", managerKind, "orchestration", "flow.completed");
@@ -1347,6 +1881,8 @@ function stampOrchestratorIdentity(managerKind) {
 		}
 		return false;
 	}
+	noteIntegrationSurface(managerKind === "workflow" ? "startWorkflow" : "startFlow");
+	noteFlowContext({ flowType: managerKind });
 	return true;
 }
 /** Full teardown, called from `reset()` AFTER finalize captured its snapshot. */
@@ -1361,28 +1897,63 @@ function resetTrueSight() {
 	}
 	buffer = null;
 	active = false;
+	lifecycleGeneration += 1;
+	optedOut = false;
 	remoteKilled = false;
 	finalized = false;
-	cryptoUnsupported = false;
+	sealerUnsupported = false;
 	collectionStarted = false;
 	flagResolutionStarted = false;
 	lastError = null;
 	observedManagerKind = null;
 	orchestratorConflictLogged = false;
 	snapshotRecordId = null;
+	cachedPendingEnvelope = null;
 	snapshotDirty = false;
 	captureActive = false;
 	rebuildInFlight = false;
 	sealFailureLogged = false;
 	pendingSlotRegistered = false;
 	recoveryStarted = false;
+	bridgeFailureCount = 0;
+	envSnapshotLogged = false;
 	hintTransitionCount = 0;
 	hintSuppressedCount = 0;
 	lastHintStatus = null;
+	overflowBatchCount = 0;
+	lastFlushRecordId = null;
+	overflowDormant = false;
 	overflowFlushInFlightUpTo = null;
+	externalDrain = null;
 	options = defaultOptions();
 	resetTrueSightMetadata();
 }
+function handleAnalyticsEvent(event) {
+	if (finalized) return;
+	try {
+		const mapped = mapAnalyticsEventToLog(event);
+		if (mapped === null) return;
+		trueSightLog(mapped.level, mapped.subsystem, mapped.category, mapped.message);
+		if (mapped.level === "error" || mapped.level === "severe") logEnvironmentSnapshotOnce();
+		if (event.code === "captureAttemptFinished") resetHintBudget();
+	} catch {
+		bridgeFailureCount += 1;
+		if (bridgeFailureCount === 1) trueSightLog("warning", "diagnostics", "other", "bridge mapping failed");
+	}
+}
+/**
+* Environment-snapshot-on-first-error (event map 19d): the "conditions at
+* the moment of failure" line — logged once per session, right after the
+* first error-level entry. The snapshot closure is injected (navigator
+* facts live behind the L0 environment provider).
+*/
+function logEnvironmentSnapshotOnce() {
+	if (envSnapshotLogged || options.getEnvironmentSnapshot === void 0) return;
+	envSnapshotLogged = true;
+	try {
+		trueSightLog("info", "session", "other", `environment at first error ${options.getEnvironmentSnapshot()}`);
+	} catch {}
+}
 function applyFeatureResolution(features, unresolvable) {
 	if (!active || remoteKilled || finalized) return;
 	const entry = features?.features?.find((candidate) => candidate.feature === "TRUESIGHT_DIAGNOSTICS");
@@ -1399,6 +1970,70 @@ function remoteKill() {
 	unsubscribeEvents = null;
 }
 /**
+* Size-limit overflow flush (plan §1.3, event map 10b): the buffer crossed
+* ~600 KB mid-session — ship the slice as its OWN contract-valid record
+* (fresh id, same sessionId, index continuity ties the records together)
+* and keep logging. **STAGING-ONLY until BE ships `inProgress`/`flushReason`
+* (hard gate B2)**: outside staging (`testing !== true`) the machinery goes
+* dormant and the buffer falls back to eviction. Interim outcome marker is
+* the sanctioned `failure/interrupted` pair; the terminal record supersedes.
+*/
+function handleBufferOverflow(slice) {
+	dispatchOverflowSlice(slice).catch(() => {
+		overflowFlushInFlightUpTo = null;
+		goOverflowDormant("overflowFlush dormant reason=failed");
+	});
+}
+async function dispatchOverflowSlice(slice) {
+	if (!active || remoteKilled || finalized || overflowDormant || slice.length === 0) return;
+	const metadata = buildSessionMetadata();
+	if (metadata.testing !== true) {
+		goOverflowDormant("overflowFlush dormant reason=prod");
+		return;
+	}
+	if (sealerUnsupported) {
+		goOverflowDormant("overflowFlush dormant reason=sealerUnsupported");
+		return;
+	}
+	const transport = safeCaptureTransport();
+	if (transport === null) {
+		goOverflowDormant("overflowFlush dormant reason=noTransport");
+		return;
+	}
+	overflowBatchCount += 1;
+	const record = buildDiagnosticsRecord(metadata, [{
+		index: buffer?.reserveIndex() ?? slice[slice.length - 1].index + 1,
+		timestampMs: getTimestamp(),
+		level: "info",
+		subsystem: "diagnostics",
+		category: "other",
+		message: `sizeLimitFlush batch=${overflowBatchCount} prevRecordId=${lastFlushRecordId ?? "none"}`
+	}, ...slice], "failure", "interrupted");
+	if (record === null) {
+		goOverflowDormant("overflowFlush dormant reason=unbuildable");
+		return;
+	}
+	lastFlushRecordId = record.id;
+	const upToIndex = slice[slice.length - 1].index;
+	overflowFlushInFlightUpTo = upToIndex;
+	await options.upload(record, {
+		post: transport,
+		loadSealer: options.loadSealer,
+		warn: selfHealthWarn
+	});
+	buffer?.markFlushed(upToIndex);
+	overflowFlushInFlightUpTo = null;
+	snapshotDirty = true;
+	trueSightLog("info", "diagnostics", "other", `sizeLimitFlush dispatched batch=${overflowBatchCount} recordId=${record.id} entries=${slice.length}`);
+}
+/** B2 fallback: machinery dormant, eviction takes over — logged exactly once. */
+function goOverflowDormant(message) {
+	if (overflowDormant) return;
+	overflowDormant = true;
+	trueSightLog("warning", "diagnostics", "other", message);
+	buffer?.setOverflowMode("evict");
+}
+/**
 * Debounced interrupted-snapshot rebuild (plan §1.8): triggered by module
 * boundaries and the dirty-interval tick, suppressed while a capture loop is
 * active (C7). Seals the CURRENT state as a `failure/interrupted` record
@@ -1406,7 +2041,17 @@ function remoteKill() {
 * handler writes only the cache — it never builds), and persists it.
 */
 function maybeRebuildSnapshot() {
-	if (!active || remoteKilled || finalized || cryptoUnsupported || captureActive || rebuildInFlight || !snapshotDirty || options.storage === void 0) return;
+	try {
+		rebuildSnapshotIfDue();
+	} catch {
+		rebuildInFlight = false;
+		snapshotDirty = true;
+	}
+}
+function rebuildSnapshotIfDue() {
+	if (!active || remoteKilled || finalized || sealerUnsupported || captureActive || rebuildInFlight || options.storage === void 0) return;
+	drainExternalDiagnostics();
+	if (!snapshotDirty) return;
 	const metadata = buildSessionMetadata();
 	if (!metadata.sessionId) return;
 	const storage = options.storage;
@@ -1416,10 +2061,16 @@ function maybeRebuildSnapshot() {
 	if (record === null) return;
 	snapshotDirty = false;
 	rebuildInFlight = true;
-	options.loadCrypto().then((sealer) => sealer.seal(JSON.stringify(record))).then(async (envelope) => {
+	const generation = lifecycleGeneration;
+	const isStale = () => generation !== lifecycleGeneration || finalized;
+	options.loadSealer().then((sealer) => sealWithinLimits(record, sealer, () => {})).then(async (sealed) => {
+		if (sealed === null || isStale()) return;
+		const envelope = sealed.envelope;
+		cachedPendingEnvelope = envelope;
 		if (!pendingSlotRegistered) {
 			pendingSlotRegistered = true;
 			await registerPendingSlot(sessionId, { storage });
+			if (isStale()) return;
 		}
 		await writePendingEnvelope(sessionId, {
 			v: 1,
@@ -1427,16 +2078,33 @@ function maybeRebuildSnapshot() {
 			envelope
 		}, { storage });
 	}).catch(() => {
+		if (generation !== lifecycleGeneration) return;
 		snapshotDirty = true;
 		if (!sealFailureLogged) {
 			sealFailureLogged = true;
 			trueSightLog("warning", "diagnostics", "other", "snapshot seal failed persistDisabled=false");
 		}
 	}).finally(() => {
-		rebuildInFlight = false;
+		if (generation === lifecycleGeneration) rebuildInFlight = false;
 	});
 }
 /**
+* Page-hide = persist only, NEVER send (locked decision): one synchronous-
+* effective write of the freshest pre-sealed snapshot. Building or posting
+* here is forbidden — a hidden tab is frequently a user who returns.
+*/
+function handlePageHide() {
+	if (!active || remoteKilled || finalized || cachedPendingEnvelope === null || options.storage === void 0) return;
+	const sessionId = buildSessionMetadata().sessionId;
+	if (!sessionId) return;
+	writePendingEnvelope(sessionId, {
+		v: 1,
+		persistedAt: getTimestamp(),
+		envelope: cachedPendingEnvelope
+	}, { storage: options.storage });
+	trueSightLog("debug", "diagnostics", "other", "snapshot persisted on pagehide");
+}
+/**
 * Next-load recovery off the first-token-observed hook (A1) — runs once per
 * lifecycle, fire-and-forget, and reports the A5 loss counters as a
 * self-health line when there was anything to report.
@@ -1455,21 +2123,21 @@ function kickRecoveryOnce() {
 	});
 }
 /**
-* Resolves crypto support ahead of finalize (and warms the lazy chunk so the
+* Resolves sealer support ahead of finalize (and warms the lazy chunk so the
 * terminal path never pays the import). Unsupported → collect-only mode with
 * exactly one self-health warning.
 */
-function prewarmCrypto() {
-	options.loadCrypto().then((provider) => {
-		if (!provider.isSupported()) markCryptoUnsupported();
+function prewarmSealer() {
+	options.loadSealer().then((provider) => {
+		if (!provider.isSupported() || !isRandomUUIDAvailable()) markSealerUnsupported();
 	}, () => {
-		markCryptoUnsupported();
+		markSealerUnsupported();
 	});
 }
-function markCryptoUnsupported() {
-	if (cryptoUnsupported) return;
-	cryptoUnsupported = true;
-	trueSightLog("warning", "diagnostics", "other", "crypto unsupported collectOnly=true");
+function markSealerUnsupported() {
+	if (sealerUnsupported) return;
+	sealerUnsupported = true;
+	trueSightLog("warning", "diagnostics", "other", "sealer unsupported collectOnly=true");
 }
 /**
 * Default transport capture: a closure over the live client + token AS OF
@@ -1501,6 +2169,20 @@ function selfHealthWarn(message) {
 	if (isTrueSightTesting()) console.warn(message);
 	trueSightLog("warning", "diagnostics", "other", message);
 }
+/** Spread-safe subset: injected seams only, `undefined` values dropped. */
+function pickDefined(serviceOptions) {
+	const picked = {};
+	if (serviceOptions.fetchFeatures) picked.fetchFeatures = serviceOptions.fetchFeatures;
+	if (serviceOptions.captureTransport) picked.captureTransport = serviceOptions.captureTransport;
+	if (serviceOptions.upload) picked.upload = serviceOptions.upload;
+	if (serviceOptions.loadSealer) picked.loadSealer = serviceOptions.loadSealer;
+	if (serviceOptions.pageLifecycle) picked.pageLifecycle = serviceOptions.pageLifecycle;
+	if (serviceOptions.timer) picked.timer = serviceOptions.timer;
+	if (serviceOptions.storage) picked.storage = serviceOptions.storage;
+	if (serviceOptions.getWasmProfile) picked.getWasmProfile = serviceOptions.getWasmProfile;
+	if (serviceOptions.getEnvironmentSnapshot) picked.getEnvironmentSnapshot = serviceOptions.getEnvironmentSnapshot;
+	return picked;
+}
 /** ` index=i total=n` suffix when the flow event carries module positioning. */
 function modulePosition(payload) {
 	if (typeof payload !== "object" || payload === null) return "";
@@ -1508,4 +2190,4 @@ function modulePosition(payload) {
 	return `${typeof moduleIndex === "number" ? ` index=${moduleIndex}` : ""}${typeof totalModules === "number" ? ` total=${totalModules}` : ""}`;
 }
 //#endregion
-export { DEFAULT_WASM_VERSION as C, resolveWasmConfig as D, getBarcodeEnhanceModelUrl as E, upgradeToWasmHttpClient as S, buildWasmConfigFromBasePath as T, noteTestingSignals as _, notifyTrueSightManagerStopped as a, installFreshHttpClient as b, trueSightHintTransition as c, fetchFeatureConfig as d, isFeatureEnabled as f, noteSessionCreated as g, noteEnvironment as h, notifyTrueSightFlowEvent as i, trueSightLog as l, isTrueSightTesting as m, initializeTrueSightDiagnostics as n, resetTrueSight as o, resetFeatureConfigCache as p, noteTrueSightCaptureActivity as r, startTrueSightCollection as s, finalizeTrueSight as t, categoryForEndpoint as u, noteTokenActivated as v, buildDefaultWasmConfig as w, resetHttpClientState as x, getStoredHttpConfig as y };
+export { noteTokenActivated as C, noteTestingSignals as S, isFeatureEnabled as _, notifyTrueSightManagerStopped as a, noteEnvironment as b, startTrueSightCollection as c, categoryForEndpoint as d, getStoredHttpConfig as f, fetchFeatureConfig as g, upgradeToWasmHttpClient as h, notifyTrueSightFlowEvent as i, trueSightHintTransition as l, resetHttpClientState as m, initializeTrueSightDiagnostics as n, resetTrueSight as o, installFreshHttpClient as p, noteTrueSightCaptureActivity as r, setTrueSightExternalDrain as s, finalizeTrueSight as t, trueSightLog as u, resetFeatureConfigCache as v, noteSessionCreated as x, isTrueSightTesting as y };