@incodetech/core 2.4.0-rc.0 → 2.4.0-rc.2

package/dist/{trueSightService-BWgRVGIT.esm.js → trueSightService-D-whOVP1.esm.js}

@@ -1,153 +1,15 @@
-import { a as setWebApiHttpTransport, f as deriveSiblingJsPath, i as initializeWasmWebClient, o as setupWasmConnection, p as WASM_MODEL_FILES, r as executeWasmRequest, t as WasmWebClientError, v as buildModelVariantSources } from "./wasmWebClient-kbYZ2sxw.esm.js";
+import { a as setWebApiHttpTransport, g as emitWasmDiagnostic, i as initializeWasmWebClient, o as setupWasmConnection, r as executeWasmRequest, t as WasmWebClientError, w as resolveWasmConfig } from "./wasmWebClient-BjZw_7OB.esm.js";
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
-import { n as eventModuleNames } from "./events-CAgFE-k3.esm.js";
-import { i as isApiConfigured, n as getApi, o as setClient, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-DHzlkQNe.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-F5YZbjip.esm.js";
+import { C as subscribeEvent, n as eventModuleNames } from "./events-Du2A4-Qr.esm.js";
+import { i as isApiConfigured, l as withTiming, n as getApi, o as setClient, r as getToken, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-DnWdXHbH.esm.js";
 import { n as reportHttpError, t as HttpRequestError } from "./HttpRequestError-Bh0pNGSC.esm.js";
-//#region ../infra/src/wasm/wasmDefaults.ts
-const WASM_CDN_BASE_URL = "https://cdn.incodesmile.com/ml-wasm-kit-release";
-/** The WASM version bundled and tested with this SDK release. */
-const DEFAULT_WASM_VERSION = "v2.14.50-post1";
-const PATH_KEYS = [
-	"wasmPath",
-	"wasmSimdPath",
-	"glueCodePath",
-	"glueCodeSimdPath",
-	"modelsBasePath"
-];
-function isBlank(value) {
-	return value.trim() === "";
-}
-function hasDisallowedControlChars(value) {
-	for (let i = 0; i < value.length; i += 1) {
-		const code = value.charCodeAt(i);
-		if (code < 32 || code === 127) return true;
-	}
-	return false;
-}
-function isMalformedPath(value) {
-	const trimmed = value.trim();
-	if (trimmed === "") return false;
-	if (hasDisallowedControlChars(trimmed)) return true;
-	if (/^https?:\/\//i.test(trimmed)) try {
-		new URL(trimmed);
-		return false;
-	} catch {
-		return true;
-	}
-	return false;
-}
-function warnInvalidWasmPath(field, reason) {
-	if (reason === "empty") {
-		console.warn(`[Incode SDK] wasm.${field} is empty. Falling back to CDN default.`);
-		return;
-	}
-	console.warn(`[Incode SDK] wasm.${field} appears malformed. Falling back to CDN default.`);
-}
-function warnMalformedWasmPath(field) {
-	console.warn(`[Incode SDK] wasm.${field} appears malformed. Check the URL or path.`);
-}
-/**
-* Validates merged WASM path strings. When overrides contained blank path
-* values, callers should have already fallen back to defaults before this runs.
-*/
-function validateWasmPaths(config) {
-	for (const key of PATH_KEYS) {
-		const value = config[key];
-		if (typeof value === "string" && isMalformedPath(value)) warnMalformedWasmPath(key);
-	}
-}
-function pickPath(key, overrides, defaultValue) {
-	if (!overrides || !(key in overrides)) return defaultValue;
-	const raw = overrides[key];
-	if (raw === void 0) return defaultValue;
-	if (typeof raw !== "string") return defaultValue;
-	if (isBlank(raw)) {
-		warnInvalidWasmPath(key, "empty");
-		return defaultValue;
-	}
-	if (isMalformedPath(raw)) {
-		warnInvalidWasmPath(key, "malformed");
-		return defaultValue;
-	}
-	return raw.trim();
-}
-function pickSource(key, overrides, defaultValue) {
-	if (!(key in overrides) || overrides[key] === void 0) return defaultValue;
-	const source = overrides[key];
-	if (typeof source !== "string") return source;
-	return pickPath(key, overrides, String(defaultValue));
-}
-function resolveBasePath(overrides) {
-	const defaultValue = `${WASM_CDN_BASE_URL}/${DEFAULT_WASM_VERSION}`;
-	if (!("basePath" in overrides) || overrides.basePath === void 0) return defaultValue;
-	const basePath = overrides.basePath;
-	if (typeof basePath !== "string" || isBlank(basePath) || isMalformedPath(basePath)) throw new Error("[Incode SDK] wasm.basePath is invalid.");
-	return basePath.trim();
-}
-/** Builds a WarmupConfig from a directory that mirrors the ml-wasm-kit CDN layout. */
-function buildWasmConfigFromBasePath(basePath) {
-	const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
-	return {
-		wasmPath: `${base}/webLib.wasm`,
-		wasmSimdPath: `${base}/webLibSimd.wasm`,
-		glueCodePath: `${base}/webLib.js`,
-		glueCodeSimdPath: `${base}/webLibSimd.js`,
-		modelsBasePath: `${base}/models`
-	};
-}
-/** Builds the standard WarmupConfig from the Incode CDN. */
-function buildDefaultWasmConfig() {
-	return buildWasmConfigFromBasePath(`${WASM_CDN_BASE_URL}/${DEFAULT_WASM_VERSION}`);
-}
-const BARCODE_ENHANCE_MODEL_FILE = WASM_MODEL_FILES.barcode;
-/**
-* URL of the lazily-loaded PDF417 barcode enhancement model (US Smart Capture).
-* Derived from the resolved `modelsBasePath` so self-hosted / air-gapped
-* deployments resolve it correctly, falling back to the CDN default. Loaded on
-* demand via `IIdCaptureCapability.setBarcodeEnhancementModel` — deliberately
-* NOT part of any warmup model bundle.
-*/
-function getBarcodeEnhanceModelUrl(modelsBasePath, variant = "current") {
-	const source = buildModelVariantSources(modelsBasePath ?? `${WASM_CDN_BASE_URL}/v2.14.50-post1/models`, BARCODE_ENHANCE_MODEL_FILE);
-	return typeof source === "string" ? source : source[variant];
-}
-/**
-* Merges optional WASM path overrides with CDN defaults. Explicit non-blank
-* paths take precedence. Blank override strings log a warning and fall back to defaults.
-*/
-function resolveWasmConfig(overrides) {
-	if (!overrides) return buildDefaultWasmConfig();
-	const defaults = buildWasmConfigFromBasePath(resolveBasePath(overrides));
-	const resolvedWasmPath = pickSource("wasmPath", overrides, defaults.wasmPath);
-	const simdDefault = overrides.selfHosted ? resolvedWasmPath : defaults.wasmSimdPath;
-	const modelsDefault = defaults.modelsBasePath;
-	const resolvedWasmSimdPath = pickSource("wasmSimdPath", overrides, simdDefault);
-	const glueCodeSimdDefault = typeof resolvedWasmSimdPath === "string" ? deriveSiblingJsPath(resolvedWasmSimdPath) : defaults.glueCodeSimdPath;
-	const merged = {
-		wasmPath: resolvedWasmPath,
-		wasmSimdPath: resolvedWasmSimdPath,
-		glueCodePath: pickPath("glueCodePath", overrides, defaults.glueCodePath),
-		glueCodeSimdPath: pickPath("glueCodeSimdPath", overrides, glueCodeSimdDefault),
-		modelsBasePath: pickPath("modelsBasePath", overrides, modelsDefault),
-		useSimd: overrides.useSimd,
-		showLogs: overrides.showLogs,
-		pipelines: overrides.pipelines,
-		pipelineModels: overrides.pipelineModels,
-		modelUrls: overrides.modelUrls,
-		legacyModelUrls: overrides.legacyModelUrls,
-		loadGlue: overrides.loadGlue,
-		loadGlueSimd: overrides.loadGlueSimd,
-		selfHosted: overrides.selfHosted
-	};
-	validateWasmPaths(merged);
-	return merged;
-}
+/** Dirty-timer half of the interrupted-snapshot rebuild debounce (module boundaries + timer). */
+const SNAPSHOT_DIRTY_INTERVAL_MS = 15e3;
 /** Hard cap per log message, UTF-8 bytes (contract). */
 const MESSAGE_MAX_BYTES = 8 * 1024;
 const TRUESIGHT_SDK_ID = "IncdOnboarding";
-/** localStorage key prefix for persisted sealed snapshots (A3: one slot per session). */
+/** localStorage key prefix for persisted snapshot envelopes (A3: one slot per session). */
 const PENDING_STORAGE_KEY_PREFIX = "incode.truesight.pending.";
 //#endregion
 //#region src/internal/trueSight/sanitize.ts
@@ -167,7 +29,18 @@ const PENDING_STORAGE_KEY_PREFIX = "incode.truesight.pending.";
 *   blob would otherwise split it into sub-64-char fragments that escape
 *   redaction.
 *
-* The regex table ships in the P1-A PR description for privacy sign-off (see
+* ENG-58122 additions, from the pre-restore review:
+* - JSON bodies run FIRST, on the raw message BEFORE the pre-clamp: error
+*   text can embed a whole response body (the WASM HTTP client's error
+*   text, kit messages), no field-level rule can vouch for an arbitrary
+*   body, and a clamp that cut a body's closing bracket would otherwise let
+*   its head through. Only the JSON span itself is replaced — the text
+*   around it, and the body's size, are kept (`[json:<chars>]`).
+* - Relative Incode paths: per-request ids in the path
+*   (`/digital-id/verifications/<id>/…`) and query strings on relative URLs
+*   (`/omni/get/ekyc?id=…`); the absolute-URL rules never matched these.
+*
+* The regex table ships in the PR description for privacy sign-off (see
 * .agents/guides/privacy.md). Known hardening backlog (D4, Phase 4): formatted
 * phone numbers, unicode digits/emails, fuzz/property tests.
 */
@@ -176,13 +49,22 @@ const JWT_PATTERN = /\b[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g;
 /**
 * Credential-ish key with a `:`/`=` value (quoted, `Bearer …`, or bare token).
 * The key may carry prefixes (`access_token`, `x-api-key`, `sessionToken`) —
-* a plain \b boundary would miss `_token` since `_` is a word character.
+* a plain \b boundary would miss `_token` since `_` is a word character —
+* and a JSON closing quote (`"token":"…"` in a fragment the JSON rule could
+* not see as a body, e.g. one sliced mid-object by its source).
 */
-const CREDENTIAL_KV_PATTERN = /([\w-]*(?:token|api[-_]?key|authorization|auth|secret|password|passwd))\s*[:=]\s*("[^"]*"|'[^']*'|(?:Bearer\s+)?[^\s,;&]+)/gi;
+const CREDENTIAL_KV_PATTERN = /([\w-]*(?:token|api[-_]?key|authorization|auth|secret|password|passwd))"?\s*[:=]\s*("[^"]*"|'[^']*'|(?:Bearer\s+)?[^\s,;&]+)/gi;
 /** Userinfo credentials in an absolute URL (`https://user:pass@host/…`). */
 const URL_USERINFO_PATTERN = /(\bhttps?:\/\/)[^\s/@]*(?::[^\s/@]*)?@/gi;
 /** Query string / fragment of an absolute URL — kills signed URLs. */
 const URL_TAIL_PATTERN = /(https?:\/\/[^\s?#]+)[?#][^\s]*/g;
+/** Per-request id segment of a verifications path (`…/verifications/<id>/status`). */
+const VERIFICATION_ID_SEGMENT_PATTERN = /(\/verifications\/)[^\s/?#]+/g;
+/**
+* Query string / fragment of a RELATIVE path (`/omni/get/ekyc?id=…`). Runs
+* after the absolute-URL rule, so only relative paths still carry one.
+*/
+const RELATIVE_PATH_TAIL_PATTERN = /((?:^|[\s"'(=])\/[^\s?#"'(=]*)[?#][^\s"')]*/g;
 const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
 /** base64-ish blobs (media, keys) — 64+ chars of the base64/base64url alphabet. */
 const BASE64_BLOB_PATTERN = /[-A-Za-z0-9+/_]{64,}={0,2}/g;
@@ -192,7 +74,58 @@ const TRUNCATION_SUFFIX = "…[truncated]";
 /** Regex-cost bound: clamp raw input before any pattern runs (see header note). */
 const REGEX_INPUT_MAX_BYTES = MESSAGE_MAX_BYTES * 2;
 function sanitizeMessage(message) {
-	return truncateUtf8(truncateUtf8(message, REGEX_INPUT_MAX_BYTES).replace(JWT_PATTERN, "[jwt]").replace(CREDENTIAL_KV_PATTERN, "$1=[redacted]").replace(URL_USERINFO_PATTERN, "$1[redacted]@").replace(URL_TAIL_PATTERN, "$1").replace(EMAIL_PATTERN, "[email]").replace(BASE64_BLOB_PATTERN, (match) => `[blob:${match.length}]`).replace(DIGIT_RUN_PATTERN, "[digits]"), MESSAGE_MAX_BYTES);
+	return truncateUtf8(truncateUtf8(redactJsonBodies(message), REGEX_INPUT_MAX_BYTES).replace(JWT_PATTERN, "[jwt]").replace(CREDENTIAL_KV_PATTERN, "$1=[redacted]").replace(URL_USERINFO_PATTERN, "$1[redacted]@").replace(URL_TAIL_PATTERN, "$1").replace(RELATIVE_PATH_TAIL_PATTERN, "$1").replace(VERIFICATION_ID_SEGMENT_PATTERN, "$1:id").replace(EMAIL_PATTERN, "[email]").replace(BASE64_BLOB_PATTERN, (match) => `[blob:${match.length}]`).replace(DIGIT_RUN_PATTERN, "[digits]"), MESSAGE_MAX_BYTES);
+}
+/**
+* Replaces every serialized JSON object or array with `[json:<chars>]`. A
+* span opens where JSON does and diagnostic text does not — `{"`, `["` or
+* `[{"` (whitespace allowed), never `pipeline={face}` or
+* `pipelines=[selfie,idCapture]` — and closes at its matching bracket,
+* skipping brackets inside strings. Text outside the spans is kept as is.
+* An unclosed span is a body its source cut short, so it runs to the end.
+* A scan, not a regex: one linear pass, safe on an unbounded message.
+*/
+function redactJsonBodies(text) {
+	let redacted = "";
+	let keptFrom = 0;
+	let index = 0;
+	while (index < text.length) if (opensJsonSpan(text, index)) {
+		const end = jsonSpanEnd(text, index);
+		redacted += `${text.slice(keptFrom, index)}[json:${end - index}]`;
+		keptFrom = end;
+		index = end;
+	} else index += 1;
+	return keptFrom === 0 ? text : redacted + text.slice(keptFrom);
+}
+function opensJsonSpan(text, index) {
+	const char = text[index];
+	if (char !== "{" && char !== "[") return false;
+	let next = skipWhitespace(text, index + 1);
+	if (char === "[" && text[next] === "{") next = skipWhitespace(text, next + 1);
+	return text[next] === "\"";
+}
+function skipWhitespace(text, index) {
+	let next = index;
+	while (next < text.length && /\s/.test(text[next])) next += 1;
+	return next;
+}
+/** Exclusive end of the span opening at `start`; the text's end when unclosed. */
+function jsonSpanEnd(text, start) {
+	let depth = 0;
+	let inString = false;
+	for (let index = start; index < text.length; index += 1) {
+		const char = text[index];
+		if (inString) {
+			if (char === "\\") index += 1;
+			else if (char === "\"") inString = false;
+		} else if (char === "\"") inString = true;
+		else if (char === "{" || char === "[") depth += 1;
+		else if (char === "}" || char === "]") {
+			depth -= 1;
+			if (depth === 0) return index + 1;
+		}
+	}
+	return text.length;
 }
 /**
 * UTF-8 byte length without TextEncoder (banned browser global in L1 —
@@ -224,6 +157,100 @@ function truncateUtf8(value, maxBytes) {
 	}
 	return result + TRUNCATION_SUFFIX;
 }
+const EVICTION_ORDER = [
+	"verbose",
+	"debug",
+	"info"
+];
+/** Stored in place of a message that is blank after sanitizing. */
+const EMPTY_MESSAGE = "[empty]";
+function createLogBuffer(options = {}) {
+	const flushThresholdBytes = options.flushThresholdBytes ?? 6e5;
+	const maxEntries = options.maxEntries ?? 5e3;
+	const { onOverflow } = options;
+	const entries = [];
+	let mode = onOverflow ? "flush" : "evict";
+	let nextIndex = 0;
+	let bytes = 0;
+	let dropped = 0;
+	let overflowPending = false;
+	function entryCost(entry) {
+		return utf8ByteLength(entry.message) + utf8ByteLength(entry.subsystem) + 120;
+	}
+	function removeAt(position) {
+		const [removed] = entries.splice(position, 1);
+		bytes -= entryCost(removed);
+		dropped += 1;
+	}
+	/** Lowest level first (oldest within it); warning+ only as the last resort. */
+	function evictOne() {
+		for (const level of EVICTION_ORDER) {
+			const position = entries.findIndex((entry) => entry.level === level);
+			if (position !== -1) {
+				removeAt(position);
+				return;
+			}
+		}
+		removeAt(0);
+	}
+	function copyOf(entry) {
+		return { ...entry };
+	}
+	return {
+		append(level, subsystem, category, message, timestampMs) {
+			const sanitized = sanitizeMessage(message);
+			const entry = {
+				index: nextIndex,
+				timestampMs: timestampMs !== void 0 && Number.isFinite(timestampMs) ? timestampMs : getTimestamp(),
+				level,
+				subsystem,
+				category,
+				message: sanitized.trim() === "" ? EMPTY_MESSAGE : sanitized
+			};
+			nextIndex += 1;
+			entries.push(entry);
+			bytes += entryCost(entry);
+			if (mode === "flush" && onOverflow) {
+				if (!overflowPending && bytes >= flushThresholdBytes) {
+					overflowPending = true;
+					onOverflow(entries.map(copyOf));
+				}
+			} else while (bytes > flushThresholdBytes && entries.length > 1) evictOne();
+			while (entries.length > maxEntries) evictOne();
+		},
+		snapshot() {
+			return entries.map(copyOf);
+		},
+		sliceSince(index) {
+			return entries.filter((entry) => entry.index > index).map(copyOf);
+		},
+		markFlushed(uptoIndex) {
+			let removedBytes = 0;
+			let keepFrom = 0;
+			while (keepFrom < entries.length && entries[keepFrom].index <= uptoIndex) {
+				removedBytes += entryCost(entries[keepFrom]);
+				keepFrom += 1;
+			}
+			entries.splice(0, keepFrom);
+			bytes -= removedBytes;
+			overflowPending = false;
+		},
+		reserveIndex() {
+			const reserved = nextIndex;
+			nextIndex += 1;
+			return reserved;
+		},
+		setOverflowMode(next) {
+			mode = next;
+		},
+		get droppedCount() {
+			return dropped;
+		},
+		get byteEstimate() {
+			return bytes;
+		}
+	};
+}
 //#endregion
 //#region ../infra/src/crypto/randomUUID.ts
 /**
@@ -232,11 +259,16 @@ function truncateUtf8(value, maxBytes) {
 * Lives in infra (L0) so Core (L1) can mint secure identifiers without touching
 * the `crypto` browser API directly — Core delegates here, keeping it free of
 * browser globals (enforced by the `no-browser-api-in-core` lint rule). Backed
-* by `crypto.randomUUID`, available in every browser the SDK targets.
+* by `crypto.randomUUID`, which browsers expose only in secure contexts — check
+* `isRandomUUIDAvailable()` where a plain-`http` page must not throw.
 */
 function randomUUID() {
 	return crypto.randomUUID();
 }
+/** `false` on insecure (plain-`http`) pages, where `randomUUID()` throws. */
+function isRandomUUIDAvailable() {
+	return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function";
+}
 //#endregion
 //#region ../infra/src/time/epochMsToIsoString.ts
 /**
@@ -266,7 +298,8 @@ function epochMsToIsoString(epochMs) {
 * - empty/missing `sessionId` or `startedAt` → returns `null` (upload skipped —
 *   expected for sessions that die before `/omni/start`).
 * - `failureReason` present if-and-only-if `outcome === 'failure'` (defaults to
-*   `'unknown'` when a failure arrives without one, rather than dropping the record).
+*   `'unknown'` when a failure arrives without one, or with a blank one, rather
+*   than dropping the record — TrueSight answers 400 to a blank reason).
 * - fresh record `id` per build; `endedAt` stamped at build time.
 */
 function buildDiagnosticsRecord(meta, logs, outcome, failureReason, recordId) {
@@ -291,7 +324,7 @@ function buildDiagnosticsRecord(meta, logs, outcome, failureReason, recordId) {
 			flowId: meta.flowId,
 			workflowId: meta.workflowId,
 			outcome,
-			...outcome === "failure" ? { failureReason: failureReason ?? "unknown" } : {},
+			...outcome === "failure" ? { failureReason: failureReason?.trim() || "unknown" } : {},
 			startedAt: epochMsToIsoString(meta.startedAtMs),
 			endedAt: epochMsToIsoString(getTimestamp()),
 			testing: meta.testing,
@@ -300,12 +333,26 @@ function buildDiagnosticsRecord(meta, logs, outcome, failureReason, recordId) {
 			externalCustomerId: meta.hasExternalCustomerId,
 			hasProvidedSessionId: meta.hasProvidedSessionId,
 			token: meta.hasToken,
-			externalToken: meta.hasExternalToken
+			externalToken: meta.hasExternalToken,
+			...meta.wasmProfile ? { webProfile: toWebProfile(meta.wasmProfile) } : {}
 		},
 		logs: logs.map(toContractEntry)
 	};
 }
 /**
+* `session.webProfile`, field by field: TrueSight decodes it strictly
+* (unknown keys reject the record), so nothing is spread from the source.
+*/
+function toWebProfile(wasm) {
+	return { wasm: {
+		version: wasm.version,
+		basePathPinned: wasm.basePathPinned,
+		simd: wasm.simd,
+		...wasm.diagnosticsMode !== void 0 ? { diagnosticsMode: wasm.diagnosticsMode } : {},
+		warmupDurationMs: wasm.warmupDurationMs
+	} };
+}
+/**
 * Wire `flowType` when no orchestrator was OBSERVED (an observed one — set by
 * the bridge on any flow event — always wins). Stage ingest requires a
 * non-null enum (probe 2026-07-23: null/omitted/off-enum all 400), so the
@@ -340,6 +387,14 @@ function toContractEntry(entry) {
 		category: entry.category
 	};
 }
+//#endregion
+//#region src/internal/trueSight/sessionMetadata.ts
+/**
+* Hosts that match this pattern are non-prod by heuristic. Known failure modes
+* (customer CNAMEs, devMode left on in prod) are documented for the planned
+* P1 team review — see plan §Operating decisions (B6).
+*/
+const NON_PROD_HOST_PATTERN = /stage|demo|saas-dev|localhost/i;
 function createInitialState() {
 	return {
 		sessionId: null,
@@ -363,16 +418,67 @@ function createInitialState() {
 }
 let state = createInitialState();
 let sources = {};
+function stampStartedAtOnce() {
+	if (state.startedAtMs === null) state.startedAtMs = getTimestamp();
+}
 /** Tap for `createSession` — sessionId comes from the returned `interviewId`. */
-function noteSessionCreated(session, options = {}) {}
-function noteEnvironment(environment) {}
+function noteSessionCreated(session, options = {}) {
+	if (session.interviewId) state.sessionId = session.interviewId;
+	stampStartedAtOnce();
+	state.sdkLanguage = options.language ?? state.sdkLanguage;
+	state.hasConfigurationId = state.hasConfigurationId || options.configurationId !== void 0;
+	state.hasExternalCustomerId = state.hasExternalCustomerId || options.externalCustomerId !== void 0;
+	state.hasProvidedSessionId = state.hasProvidedSessionId || options.interviewId !== void 0;
+}
+/**
+* Fallback sessionId for host-minted-token integrations that never called
+* `createSession`: `Features.sessionIdentifier` — used only when no
+* `interviewId` was observed.
+*/
+function noteFeatureConfig(features) {
+	if (!state.sessionId && features.sessionIdentifier) {
+		state.sessionId = features.sessionIdentifier;
+		stampStartedAtOnce();
+	}
+}
+/**
+* Entry-surface discriminator. `startOnboardingSection` is the default (weakest
+* signal — standalone module managers); richer surfaces upgrade it and are never
+* downgraded back.
+*/
+function noteIntegrationSurface(integrationType) {
+	if (integrationType === "startOnboardingSection") return;
+	state.integrationType = integrationType;
+}
+function noteEnvironment(environment) {
+	state.browser = environment.browser ?? state.browser;
+	state.osVersion = environment.osVersion ?? state.osVersion;
+	state.osLanguage = environment.osLanguage ?? state.osLanguage;
+}
+/**
+* WRITE-ONCE orchestrator identity (determinism guarantee for debugging):
+* a session is a flow or a workflow from its first orchestrator observation
+* and can never flip mid-session — a record labeled `flow` must always point
+* at a real flow. First non-null value wins for each of flowType/flowId/
+* workflowId; later calls are ignored (the service logs a self-health line
+* when a CONFLICTING orchestrator kind shows up).
+*/
+function noteFlowContext(context) {
+	state.flowType = state.flowType ?? context.flowType;
+	state.flowId = state.flowId ?? context.flowId ?? null;
+	state.workflowId = state.workflowId ?? context.workflowId ?? null;
+}
 /**
 * `testing` heuristic: devMode OR non-prod API host pattern. Always a boolean —
 * the contract requires the field present on every record. Signals MERGE across
 * calls (a later apiUrl-only call must not erase an earlier devMode signal);
 * `testing` is recomputed from the merged pair.
 */
-function noteTestingSignals(signals) {}
+function noteTestingSignals(signals) {
+	state.devModeSignal = signals.devMode ?? state.devModeSignal;
+	state.apiUrlSignal = signals.apiUrl ?? state.apiUrlSignal;
+	state.testing = state.devModeSignal === true || state.apiUrlSignal !== void 0 && NON_PROD_HOST_PATTERN.test(state.apiUrlSignal);
+}
 /**
 * Live read of the merged testing signal (devMode OR non-prod host). Used to
 * gate host-console self-health noise so production host pages stay quiet while
@@ -383,12 +489,25 @@ function isTrueSightTesting() {
 	return state.testing;
 }
 /**
+* Tap for `initializeSession({ token })` with a host-minted token — records
+* only the presence fact ("this token came from outside the SDK"), never the
+* token itself.
+*/
+function noteExternalTokenProvided() {
+	state.hasExternalToken = true;
+}
+/**
 * Wiring tap for every `initializeSession({ token })`: a token activated
 * before any `createSession` was observed on this page is host-minted, i.e.
 * external. (The exact `token`/`externalToken` web-semantics are a pending
 * Phase 0 contract ask — this inference is the interim mapping.)
 */
-function noteTokenActivated() {}
+function noteTokenActivated() {
+	if (state.sessionId === null) noteExternalTokenProvided();
+}
+function configureTrueSightMetadataSources(next) {
+	sources = next;
+}
 /** Explicit literal — the metadata half handed to the record builder. */
 function buildSessionMetadata() {
 	return {
@@ -408,7 +527,8 @@ function buildSessionMetadata() {
 		hasExternalCustomerId: state.hasExternalCustomerId,
 		hasProvidedSessionId: state.hasProvidedSessionId,
 		hasToken: readHasToken(),
-		hasExternalToken: state.hasExternalToken
+		hasExternalToken: state.hasExternalToken,
+		wasmProfile: readWasmProfile()
 	};
 }
 /** Fail-open: diagnostics must never throw into the host flow. */
@@ -420,6 +540,14 @@ function readE2eEncryptionEnabled() {
 	}
 }
 /** Fail-open, like readE2eEncryptionEnabled. */
+function readWasmProfile() {
+	try {
+		return sources.getWasmProfile?.() ?? null;
+	} catch {
+		return null;
+	}
+}
+/** Fail-open, like readE2eEncryptionEnabled. */
 function readHasToken() {
 	try {
 		return sources.getHasToken?.() ?? false;
@@ -451,7 +579,7 @@ async function registerPendingSlot(sessionId, deps) {
 	} catch {}
 }
 /**
-* Writes the sealed snapshot into the session's slot. `BrowserStorageProvider`
+* Writes the sealed snapshot envelope into the session's slot. `BrowserStorageProvider`
 * executes the underlying `localStorage.setItem` synchronously in the first
 * slice of the async call, which is what makes this safe to fire (void) from
 * a page-hide handler.
@@ -982,10 +1110,15 @@ const createWasmApi = async (config) => {
 * host called `setup()` without `wasm` and warmed WASM separately), swap to
 * the WASM client first. The module is already loaded — the payload came
 * out of it — so the swap only creates the `WebClient`.
+*
+* These requests bypass the `api.*` helpers, so the transport reports them
+* to the same timing observer itself (TrueSight row 23b): the protected
+* image uploads are otherwise the only requests a record never shows.
 */
 function bindWebApiTransport(client) {
 	return async (url, body, config) => {
-		const response = await (config.ie === true && storedHttpConfig && !storedHttpConfig.isWasm ? await ensureWasmHttpClient() : client).request({
+		const activeClient = config.ie === true && storedHttpConfig && !storedHttpConfig.isWasm ? await ensureWasmHttpClient() : client;
+		const response = await withTiming("POST", url, () => activeClient.request({
 			method: "POST",
 			url,
 			body,
@@ -993,7 +1126,7 @@ function bindWebApiTransport(client) {
 			params: config.params,
 			timeout: config.timeout,
 			ie: config.ie
-		});
+		}));
 		return {
 			data: response.data,
 			status: response.status
@@ -1067,19 +1200,35 @@ async function upgradeToWasmHttpClient(resolved) {
 	const stored = storedHttpConfig;
 	if (!stored || stored.isWasm) return;
 	pendingUpgrade ??= (async () => {
-		installClient(await createWasmApi({
-			apiURL: stored.apiURL,
-			customHeaders: stored.customHeaders,
-			timeout: stored.timeout,
-			wasm: resolved,
-			encryptionEnabled: stored.encryption.enabled,
-			mgf1: stored.encryption.mgf1,
-			isEncryptionEnabled: isHttpEncrypted
-		}));
-		storedHttpConfig = {
-			...stored,
-			isWasm: true
-		};
+		try {
+			installClient(await createWasmApi({
+				apiURL: stored.apiURL,
+				customHeaders: stored.customHeaders,
+				timeout: stored.timeout,
+				wasm: resolved,
+				encryptionEnabled: stored.encryption.enabled,
+				mgf1: stored.encryption.mgf1,
+				isEncryptionEnabled: isHttpEncrypted
+			}));
+			storedHttpConfig = {
+				...stored,
+				isWasm: true
+			};
+			emitWasmDiagnostic({
+				level: "info",
+				subsystem: "client",
+				category: "other",
+				message: `http client upgraded to wasm encrypted=${stored.encryption.enabled}`
+			});
+		} catch (error) {
+			emitWasmDiagnostic({
+				level: "error",
+				subsystem: "client",
+				category: "other",
+				message: `http client upgrade failed error=${String(error)}`
+			});
+			throw error;
+		}
 	})().finally(() => {
 		pendingUpgrade = void 0;
 	});
@@ -1100,10 +1249,127 @@ async function withHandshakeFailureContext(wantsEncryption, fn) {
 		throw error;
 	}
 }
-eventModuleNames.selfie, eventModuleNames.faceCapture, eventModuleNames.authentication, eventModuleNames.authFace, eventModuleNames.mlConsent, eventModuleNames.combinedConsent, eventModuleNames.curpValidation, eventModuleNames.faceMatch, eventModuleNames.qr, eventModuleNames.videoSelfie, eventModuleNames.id, eventModuleNames.idCapture, eventModuleNames.idVerification, eventModuleNames.idOcr, eventModuleNames.document, eventModuleNames.creditCard, eventModuleNames.creditCardBack, eventModuleNames.conference, eventModuleNames.otp, eventModuleNames.signature, eventModuleNames.ekyc, eventModuleNames.watchlist, eventModuleNames.globalWatchList, eventModuleNames.customWatchList, eventModuleNames.email, eventModuleNames.phone, eventModuleNames.instantVerifyEmail, eventModuleNames.instantVerifyConsent, eventModuleNames.forms, eventModuleNames.customModule, eventModuleNames.geolocation, eventModuleNames.ekyb, eventModuleNames.identityReuse, eventModuleNames.antifraud, eventModuleNames.aeSignature, eventModuleNames.qeSignature, eventModuleNames.crossDocumentDataMatch, eventModuleNames.customFields, eventModuleNames.fieldComparison, eventModuleNames.personhood, eventModuleNames.watchlistForBusiness, eventModuleNames.trustGraph, eventModuleNames.certificateIssuance, eventModuleNames.governmentValidation, eventModuleNames.documentUpload, eventModuleNames.home, eventModuleNames.workflow, eventModuleNames.fiscalQr;
-eventModuleNames.id, eventModuleNames.idCapture, eventModuleNames.idVerification, eventModuleNames.idOcr, eventModuleNames.document, eventModuleNames.documentUpload, eventModuleNames.creditCard, eventModuleNames.creditCardBack, eventModuleNames.curpValidation;
-eventModuleNames.selfie, eventModuleNames.faceCapture, eventModuleNames.authentication, eventModuleNames.authFace, eventModuleNames.faceMatch, eventModuleNames.videoSelfie, eventModuleNames.personhood;
-eventModuleNames.home, eventModuleNames.workflow;
+//#endregion
+//#region src/internal/trueSight/eventBridge.ts
+/**
+* Canonical subsystem registry (plan §Subsystem registry): one stable
+* lowercase dotted string per SDK area. The raw `eventModuleNames` wire
+* values are inconsistent (`SELFIE`, `datasharingconsent`, `AdSign`…), four
+* keys collapse into `ID`, and `workflow` doubles as a module name — this
+* table is the single normalization point, snapshot-frozen in tests so the
+* dashboard facet stays bounded (~70 strings) forever.
+*/
+const MODULE_SUBSYSTEMS = {
+	[eventModuleNames.selfie]: "module.selfie",
+	[eventModuleNames.faceCapture]: "module.face-capture",
+	[eventModuleNames.authentication]: "module.authentication",
+	[eventModuleNames.authFace]: "module.auth-face",
+	[eventModuleNames.mlConsent]: "module.ml-consent",
+	[eventModuleNames.combinedConsent]: "module.combined-consent",
+	[eventModuleNames.curpValidation]: "module.curp",
+	[eventModuleNames.faceMatch]: "module.face-match",
+	[eventModuleNames.qr]: "module.qr",
+	[eventModuleNames.videoSelfie]: "module.video-selfie",
+	[eventModuleNames.id]: "module.id",
+	[eventModuleNames.idCapture]: "module.id-capture",
+	[eventModuleNames.idVerification]: "module.id-verification",
+	[eventModuleNames.idOcr]: "module.id-ocr",
+	[eventModuleNames.document]: "module.document-capture",
+	[eventModuleNames.creditCard]: "module.credit-card-front",
+	[eventModuleNames.creditCardBack]: "module.credit-card-back",
+	[eventModuleNames.conference]: "module.conference",
+	[eventModuleNames.otp]: "module.otp",
+	[eventModuleNames.signature]: "module.e-sign",
+	[eventModuleNames.ekyc]: "module.e-kyc",
+	[eventModuleNames.watchlist]: "module.watchlist",
+	[eventModuleNames.globalWatchList]: "module.global-watchlist",
+	[eventModuleNames.customWatchList]: "module.custom-watchlist",
+	[eventModuleNames.email]: "module.email",
+	[eventModuleNames.phone]: "module.phone-number",
+	[eventModuleNames.instantVerifyEmail]: "module.instant-verify-email",
+	[eventModuleNames.instantVerifyConsent]: "module.instant-verify-consent",
+	[eventModuleNames.forms]: "module.forms",
+	[eventModuleNames.customModule]: "module.custom-module",
+	[eventModuleNames.geolocation]: "module.geolocation",
+	[eventModuleNames.ekyb]: "module.e-kyb",
+	[eventModuleNames.identityReuse]: "module.identity-reuse",
+	[eventModuleNames.antifraud]: "module.antifraud",
+	[eventModuleNames.aeSignature]: "module.ae-signature",
+	[eventModuleNames.qeSignature]: "module.qe-signature",
+	[eventModuleNames.crossDocumentDataMatch]: "module.cross-document-data-match",
+	[eventModuleNames.customFields]: "module.custom-fields",
+	[eventModuleNames.fieldComparison]: "module.field-comparison",
+	[eventModuleNames.personhood]: "module.personhood",
+	[eventModuleNames.watchlistForBusiness]: "module.watchlist-for-business",
+	[eventModuleNames.trustGraph]: "module.trust-graph",
+	[eventModuleNames.certificateIssuance]: "module.certificate-issuance",
+	[eventModuleNames.governmentValidation]: "module.government-validation",
+	[eventModuleNames.documentUpload]: "module.document-upload",
+	[eventModuleNames.home]: "module.home",
+	[eventModuleNames.workflow]: "module.workflow",
+	[eventModuleNames.fiscalQr]: "module.fiscal-qr"
+};
+/**
+* Raw orchestrator module keys (flow `currentStep`, workflow
+* `currentNode.moduleKey`) whose kebab fallback would NOT land on the
+* module's canonical subsystem. Advanceable-error events carry these keys
+* instead of `eventModuleNames`, so they alias here; keys whose fallback
+* already matches (`DOCUMENT_CAPTURE`, `COMBINED_CONSENT`, …) or that name a
+* distinct step (`ADDRESS`, `INE_VALIDATION`, `SECOND_ID`) need no entry.
+* Snapshot-frozen in tests with the table above.
+*/
+const ORCHESTRATOR_KEY_SUBSYSTEMS = {
+	PHONE: "module.phone-number",
+	EXTERNAL_VERIFICATION: "module.e-kyc",
+	EKYB: "module.e-kyb",
+	SIGNATURE: "module.e-sign",
+	DYNAMIC_FORMS: "module.forms",
+	CURP_VALIDATION: "module.curp",
+	GOVT_VALIDATION_PROVISIONING: "module.government-validation",
+	WATCHLIST_BUSINESS: "module.watchlist-for-business",
+	INCODE_WATCHLIST: "module.custom-watchlist",
+	REDIRECT_TO_MOBILE: "module.qr"
+};
+const CUSTOM_SUBSYSTEM_MAX_CHARS = 40;
+/**
+* Canonical `module.<kebab>` for a raw wire module name. Unknown/integrator-
+* custom names get a sanitized lowercase fallback (capped) — custom SDK 2
+* integrations get real per-module detail, not a lumped `other`.
+*/
+function normalizeSubsystem(rawModule) {
+	if (rawModule === void 0) return "module.unknown";
+	const canonical = MODULE_SUBSYSTEMS[rawModule] ?? ORCHESTRATOR_KEY_SUBSYSTEMS[rawModule];
+	if (canonical !== void 0) return canonical;
+	const sanitized = rawModule.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, CUSTOM_SUBSYSTEM_MAX_CHARS).replace(/-+$/g, "");
+	return `module.${sanitized === "" ? "unknown" : sanitized}`;
+}
+const ID_SCAN_MODULES = /* @__PURE__ */ new Set([
+	eventModuleNames.id,
+	eventModuleNames.idCapture,
+	eventModuleNames.idVerification,
+	eventModuleNames.idOcr,
+	eventModuleNames.document,
+	eventModuleNames.documentUpload,
+	eventModuleNames.creditCard,
+	eventModuleNames.creditCardBack,
+	eventModuleNames.curpValidation,
+	"ID_CAPTURE",
+	"TUTORIAL_ID",
+	"SECOND_ID",
+	"DOCUMENT_CAPTURE",
+	"ADDRESS",
+	"CURP_VALIDATION"
+]);
+const FACE_SCAN_MODULES = /* @__PURE__ */ new Set([
+	eventModuleNames.selfie,
+	eventModuleNames.faceCapture,
+	eventModuleNames.authentication,
+	eventModuleNames.authFace,
+	eventModuleNames.faceMatch,
+	eventModuleNames.videoSelfie,
+	eventModuleNames.personhood
+]);
+const ORCHESTRATION_MODULES = /* @__PURE__ */ new Set([eventModuleNames.home, eventModuleNames.workflow]);
 /**
 * Coarse category for HTTP-failure entries, from the endpoint path (event
 * map row 23: "by endpoint"). A conservative token heuristic — the category
@@ -1111,36 +1377,220 @@ eventModuleNames.home, eventModuleNames.workflow;
 * scan bucket.
 */
 function categoryForEndpoint(endpoint) {
+	if (/\/omni\/es\//.test(endpoint)) return "other";
 	if (/face|selfie|video|speech|personhood|authenticate|recordings/.test(endpoint)) return "faceScan";
-	if (/front-id|back-id|second-id|process\/id|images|barcode|ocr|document|curp|cfdi|address-statement/.test(endpoint)) return "idScan";
+	if (/front-id|back-id|second-id|process\/id|images|barcode|ocr|document|curp|cfdi|address-statement|digital-id|device\/wallet/.test(endpoint)) return "idScan";
 	if (/start|flow|workflow|feature-config|onboarding|finish-status/.test(endpoint)) return "orchestration";
 	return "other";
 }
+/** Coarse contract category from the RAW `event.module` value (plan rule). */
+function categoryForModule(rawModule) {
+	if (rawModule === void 0) return "other";
+	if (ID_SCAN_MODULES.has(rawModule)) return "idScan";
+	if (FACE_SCAN_MODULES.has(rawModule)) return "faceScan";
+	if (ORCHESTRATION_MODULES.has(rawModule)) return "orchestration";
+	return "other";
+}
+/** `verb key=value` line: undefined values drop their pair entirely. */
+function formatLine(verb, pairs = []) {
+	const parts = [verb];
+	for (const [key, value] of pairs) if (value !== void 0 && value !== null && value !== "") parts.push(`${key}=${String(value)}`);
+	return parts.join(" ");
+}
+/**
+* Analytics event → contract log tuple, or `null` for codes the taxonomy
+* does not cover (deny-by-default: nothing rides into the record unreviewed).
+* Levels/subsystems/categories per the plan's event map rows 5–6 and 16–20.
+*/
+function mapAnalyticsEventToLog(event) {
+	const payload = event.payload ?? {};
+	const subsystem = normalizeSubsystem(event.module);
+	const category = categoryForModule(event.module);
+	switch (event.code) {
+		case "moduleOpened":
+		case "moduleClosed": return {
+			level: "info",
+			subsystem,
+			category,
+			message: formatLine(event.code === "moduleOpened" ? "module opened" : "module closed", [["screen", event.screen]])
+		};
+		case "screenOpened":
+		case "screenClosed": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine(event.code === "screenOpened" ? "screen opened" : "screen closed", [["screen", event.screen]])
+		};
+		case "errorTriggered": return {
+			level: "error",
+			subsystem,
+			category,
+			message: formatLine("errorTriggered", [
+				["errorName", stringOrUndefined(payload.errorName) ?? "unknown"],
+				["errorCode", stringOrUndefined(payload.errorCode)],
+				["reason", stringOrUndefined(payload.reason)]
+			])
+		};
+		case "captureAttemptFinished": {
+			const logs = stringOrUndefined(payload.logs);
+			return {
+				level: "debug",
+				subsystem,
+				category,
+				message: formatLine("capture attempt finished", [["logsBytes", logs === void 0 ? void 0 : utf8ByteLength(logs)]])
+			};
+		}
+		case "background":
+		case "foreground": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: `visibility ${event.code}`
+		};
+		case "switchToAutoCaptureFrontId":
+		case "switchToAutoCaptureBackId": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine("capture mode switched to auto", [["side", event.code === "switchToAutoCaptureBackId" ? "back" : "front"]])
+		};
+		case "experimentAssigned": return {
+			level: "info",
+			subsystem,
+			category,
+			message: formatLine("experiment assigned", [["screen", event.screen], ["fields", Object.keys(payload).filter((key) => key !== "module").length]])
+		};
+		case "elementClicked": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine("element clicked", [["element", stringOrUndefined(payload.element)], ["action", stringOrUndefined(payload.action)]])
+		};
+		case "browser": {
+			const browser = nameVersion(payload.browser);
+			const os = nameVersion(payload.os);
+			const device = typeof payload.device === "object" && payload.device !== null ? stringOrUndefined(payload.device.type) : void 0;
+			return {
+				level: "info",
+				subsystem: "session",
+				category: "other",
+				message: formatLine("browser info", [
+					["browser", browser],
+					["os", os],
+					["device", device],
+					["webrtc", typeof payload.isWebRtcSupported === "boolean" ? payload.isWebRtcSupported : void 0]
+				])
+			};
+		}
+		default: return null;
+	}
+}
+function stringOrUndefined(value) {
+	return typeof value === "string" ? value : void 0;
+}
+function nameVersion(value) {
+	if (typeof value !== "object" || value === null) return;
+	const { name, version } = value;
+	const joined = [name, version].filter((part) => typeof part === "string" && part !== "").join(" ");
+	return joined === "" ? void 0 : joined;
+}
 //#endregion
 //#region src/internal/trueSight/uploader.ts
-let cryptoProviderPromise = null;
+let sealerProviderPromise = null;
 /**
-* Loads the browser sealer as a LAZY chunk, once — crypto stays off the host
+* Loads the browser sealer as a LAZY chunk, once — it stays off the host
 * page's critical path until diagnostics actually need it (first upload or
-* the service's prewarm).
+* the service's prewarm). A future sealing scheme swaps in here.
+*/
+function loadDiagnosticsEnvelopeProvider() {
+	sealerProviderPromise ??= import("./BrowserDiagnosticsEnvelopeProvider-BQca6KPG.esm.js").then((module) => new module.BrowserDiagnosticsEnvelopeProvider());
+	return sealerProviderPromise;
+}
+/**
+* Seals a record inside the contract limits: the record JSON at or under
+* `MAX_RECORD_JSON_BYTES` (decompressed) and the serialized envelope at or
+* under `MAX_ENVELOPE_BYTES`. Over either cap, rebuilds ONCE with the oldest
+* half of the logs dropped; still over → `null` rather than an invalid
+* envelope. Rejects only when sealing itself fails.
 */
-function loadDiagnosticsCryptoProvider() {
-	cryptoProviderPromise ??= import("./BrowserDiagnosticsCryptoProvider-BuzqvbhN.esm.js").then((module) => new module.BrowserDiagnosticsCryptoProvider());
-	return cryptoProviderPromise;
+async function sealWithinLimits(record, sealer, warn) {
+	const first = await sealMeasured(record, sealer);
+	if (withinLimits(first)) {
+		if (first.envelopeBytes > 9e5) warn(`[TrueSight] envelope ${first.envelopeBytes}B is approaching the 1MB cap`);
+		return first;
+	}
+	const trimmed = {
+		...record,
+		logs: record.logs.slice(Math.floor(record.logs.length / 2))
+	};
+	warn(`[TrueSight] envelope ${first.envelopeBytes}B (record ${first.recordBytes}B) over the cap — rebuilt with the oldest ${record.logs.length - trimmed.logs.length} logs dropped`);
+	const second = await sealMeasured(trimmed, sealer);
+	if (!withinLimits(second)) {
+		warn("[TrueSight] envelope still over the cap after trim — upload dropped");
+		return null;
+	}
+	return second;
 }
 /**
-* Seals and posts one diagnostics record. Never rejects (fail-open). Size
-* guards per contract: warn approaching the 1 MB envelope cap; over the cap,
-* rebuild ONCE with the oldest half of the logs dropped; still over → drop
-* the upload entirely rather than send an invalid envelope.
+* Seals and posts one diagnostics record. Never rejects (fail-open); resolves
+* with how the attempt ended. Size guards per contract: warn approaching the
+* 1 MB envelope cap; over a cap, rebuild ONCE with the oldest half of the
+* logs dropped; still over → drop the upload entirely rather than send an
+* invalid envelope.
 */
-async function uploadDiagnostics(record, options) {}
+async function uploadDiagnostics(record, options) {
+	const warn = options.warn ?? defaultWarn;
+	let sealed;
+	try {
+		sealed = await sealWithinLimits(record, await (options.loadSealer ?? loadDiagnosticsEnvelopeProvider)(), warn);
+	} catch (error) {
+		warn(`[TrueSight] diagnostics upload failed (no retry): ${String(error)}`);
+		return "unsent";
+	}
+	if (sealed === null) return "dropped";
+	if (options.onSealed) try {
+		await options.onSealed(sealed);
+	} catch {}
+	try {
+		const keepalive = options.keepalive === true && sealed.envelopeBytes <= 6e4;
+		const response = await options.post(endpoints.diagnosticsData, sealed.envelope, keepalive ? { keepalive: true } : {});
+		if (isForwardedFalse(response.data)) warn("[TrueSight] proxy accepted the record but did not forward it (forwarded:false)");
+		return response.ok ? "delivered" : "rejected";
+	} catch (error) {
+		warn(`[TrueSight] diagnostics upload failed (no retry): ${String(error)}`);
+		return hasHttpStatus(error) ? "rejected" : "unsent";
+	}
+}
+/** An HTTP answer arrived (the client threw for a non-2xx status). */
+function hasHttpStatus(error) {
+	if (typeof error !== "object" || error === null || !("status" in error)) return false;
+	const { status } = error;
+	return typeof status === "number" && status > 0;
+}
+async function sealMeasured(record, sealer) {
+	const json = JSON.stringify(record);
+	const envelope = await sealer.seal(json);
+	return {
+		envelope,
+		envelopeBytes: utf8ByteLength(JSON.stringify(envelope)),
+		recordBytes: utf8ByteLength(json)
+	};
+}
+function withinLimits(measured) {
+	return measured.envelopeBytes <= 1e6 && measured.recordBytes <= 2097152;
+}
+function isForwardedFalse(data) {
+	return typeof data === "object" && data !== null && "forwarded" in data && data.forwarded === false;
+}
+function defaultWarn() {}
 //#endregion
 //#region src/internal/trueSight/trueSightService.ts
 let active = false;
+/** The lifecycle's first `initialize` opted out — later calls cannot re-enable. */
+let optedOut = false;
 let remoteKilled = false;
 let finalized = false;
-let cryptoUnsupported = false;
+let sealerUnsupported = false;
 let collectionStarted = false;
 let flagResolutionStarted = false;
 let lastError = null;
@@ -1151,15 +1601,26 @@ let options = defaultOptions();
 let observedManagerKind = null;
 let orchestratorConflictLogged = false;
 let snapshotRecordId = null;
+let cachedPendingEnvelope = null;
 let snapshotDirty = false;
 let captureActive = false;
 let rebuildInFlight = false;
+/**
+* Bumped by `resetTrueSight()`: an async continuation started under an older
+* value belongs to a torn-down lifecycle and must not touch this one.
+*/
+let lifecycleGeneration = 0;
 let sealFailureLogged = false;
 let pendingSlotRegistered = false;
 let recoveryStarted = false;
+let bridgeFailureCount = 0;
+let envSnapshotLogged = false;
 let hintTransitionCount = 0;
 let hintSuppressedCount = 0;
 let lastHintStatus = null;
+let overflowBatchCount = 0;
+let lastFlushRecordId = null;
+let overflowDormant = false;
 let overflowFlushInFlightUpTo = null;
 let dirtyTimerHandle = null;
 let unsubscribePageHide = null;
@@ -1168,20 +1629,45 @@ function defaultOptions() {
 		fetchFeatures: fetchFeatureConfig,
 		captureTransport: captureLiveTransport,
 		upload: uploadDiagnostics,
-		loadCrypto: loadDiagnosticsCryptoProvider
+		loadSealer: loadDiagnosticsEnvelopeProvider
 	};
 }
 /**
-* Boot-time entry, called from `setup()`. Idempotent — the first activating
-* call wins for the SDK lifecycle (like the analytics batcher and the
-* encryption lock); `reset()` → `resetTrueSight()` starts a new one.
-* `enabled:false` is a no-op by design: zero subscriptions, zero state.
+* Boot-time entry, called from `setup()`. Idempotent — the first call decides
+* for the SDK lifecycle, an opt-out included (like the analytics batcher and
+* the encryption lock); `reset()` → `resetTrueSight()` starts a new one.
+* `enabled:false` collects nothing by design — zero subscriptions, zero
+* state — and holds even when a later `setup()` omits the option (the web
+* wrapper's `setup()` never forwards it).
 */
-function initializeTrueSightDiagnostics(serviceOptions) {}
+function initializeTrueSightDiagnostics(serviceOptions) {
+	if (active || optedOut) return;
+	if (!serviceOptions.enabled) {
+		optedOut = true;
+		return;
+	}
+	active = true;
+	options = {
+		...defaultOptions(),
+		...pickDefined(serviceOptions)
+	};
+	buffer = createLogBuffer({ onOverflow: handleBufferOverflow });
+	configureTrueSightMetadataSources({
+		getHasToken: () => getToken() !== null,
+		getE2eEncryptionEnabled: isHttpEncrypted,
+		getWasmProfile: options.getWasmProfile
+	});
+	unsubscribeEvents = subscribeEvent(handleAnalyticsEvent);
+	trueSightLog("debug", "diagnostics", "other", "diagnostics initialized");
+	if (options.pageLifecycle && options.storage) unsubscribePageHide = options.pageLifecycle.onPageHide(handlePageHide);
+	if (options.timer && options.storage) dirtyTimerHandle = options.timer.setInterval(() => {
+		maybeRebuildSnapshot();
+	}, SNAPSHOT_DIRTY_INTERVAL_MS);
+}
 /**
 * Session-time entry, called from `initializeSession` once feature config is
 * known. Collection is already running by then (buffering starts at
-* initialize); this resolves the remote flag and prewarms the crypto chunk.
+* initialize); this resolves the remote flag and prewarms the sealer chunk.
 * When the host's fetch failed, call with no argument — the service resolves
 * the cached `fetchFeatureConfig()` itself (a token is present at this point).
 */
@@ -1189,9 +1675,10 @@ function startTrueSightCollection(features) {
 	if (!active || remoteKilled || finalized) return;
 	if (!collectionStarted) {
 		collectionStarted = true;
-		prewarmCrypto();
+		prewarmSealer();
 	}
 	if (features) {
+		noteFeatureConfig(features);
 		if (!flagResolutionStarted) {
 			flagResolutionStarted = true;
 			applyFeatureResolution(features, false);
@@ -1199,6 +1686,7 @@ function startTrueSightCollection(features) {
 	} else if (!flagResolutionStarted) {
 		flagResolutionStarted = true;
 		options.fetchFeatures().then((fetched) => {
+			noteFeatureConfig(fetched);
 			applyFeatureResolution(fetched, false);
 		}, () => {
 			applyFeatureResolution(null, true);
@@ -1211,38 +1699,64 @@ function startTrueSightCollection(features) {
 * snapshot rebuilds are suppressed — the collector must never compete with
 * 30 fps capture. Deactivation flushes the deferred rebuild.
 */
-function noteTrueSightCaptureActivity(activityActive) {}
+function noteTrueSightCaptureActivity(activityActive) {
+	if (activityActive && !captureActive) resetHintBudget();
+	captureActive = activityActive;
+	if (!activityActive) maybeRebuildSnapshot();
+}
 /**
 * Seals and uploads the one final record per session. The upload-relevant
 * state — transport, metadata (live token/E2EE getters read NOW), buffered
 * logs — is captured SYNCHRONOUSLY before the first await, because `reset()`
 * calls `resetApi()` immediately after this returns. Finalize-once: later
-* terminals and late events are no-ops. Never rejects.
+* terminals and late events are no-ops. Never rejects and never throws:
+* `reset()` and the flow bridge call it synchronously.
 */
 function finalizeTrueSight(outcome, failureReason) {
 	if (!active || remoteKilled || finalized) return Promise.resolve();
 	finalized = true;
+	try {
+		return uploadTerminalRecord(outcome, failureReason);
+	} catch {
+		return Promise.resolve();
+	}
+}
+function uploadTerminalRecord(outcome, failureReason) {
+	drainExternalDiagnostics();
 	trueSightLog("info", "session", "orchestration", `finalizing outcome=${outcome}${failureReason !== void 0 ? ` reason=${failureReason}` : ""}`);
 	const metadata = buildSessionMetadata();
 	const logs = (buffer?.snapshot() ?? []).filter((entry) => overflowFlushInFlightUpTo === null || entry.index > overflowFlushInFlightUpTo);
 	const transport = safeCaptureTransport();
-	if (transport === null || cryptoUnsupported) return Promise.resolve();
+	if (transport === null || sealerUnsupported) return Promise.resolve();
 	const record = buildDiagnosticsRecord(metadata, logs, outcome, failureReason);
 	if (record === null) return Promise.resolve();
-	if (options.storage && metadata.sessionId) clearPending(metadata.sessionId, { storage: options.storage });
+	cachedPendingEnvelope = null;
+	const storage = options.storage;
+	const { sessionId } = record.session;
 	return options.upload(record, {
 		post: transport,
 		keepalive: true,
-		loadCrypto: options.loadCrypto,
-		warn: selfHealthWarn
+		loadSealer: options.loadSealer,
+		warn: selfHealthWarn,
+		onSealed: storage ? (sealed) => persistTerminalEnvelope(sessionId, sealed, storage) : void 0
+	}).then((uploadOutcome) => {
+		if (storage && uploadOutcome !== "unsent") clearPending(sessionId, { storage });
 	});
 }
+async function persistTerminalEnvelope(sessionId, sealed, storage) {
+	await registerPendingSlot(sessionId, { storage });
+	await writePendingEnvelope(sessionId, {
+		v: 1,
+		persistedAt: getTimestamp(),
+		envelope: sealed.envelope
+	}, { storage });
+}
 /**
 * Capture guidance-hint transition tap (event map 19b/19c): the moment the
 * hint the user sees CHANGES, as the status CODE — never the localized text.
 * Consecutive dedupe on top of the source dedupe, plus a per-attempt budget
 * (~60, then suppress-with-counter) so a struggling capture can never flood
-* the buffer. The budget resets when a capture attempt finishes. Level is
+* the buffer. The budget resets when a capture attempt starts or finishes. Level is
 * debug so the eviction fallback drops hints before warnings/errors.
 */
 function trueSightHintTransition(subsystem, category, status) {
@@ -1260,10 +1774,33 @@ function trueSightHintTransition(subsystem, category, status) {
 	}
 	trueSightLog("debug", subsystem, category, `hint changed status=${status}`);
 }
+function resetHintBudget() {
+	if (hintSuppressedCount > 0) trueSightLog("debug", "diagnostics", "other", `hint transitions suppressed count=${hintSuppressedCount}`);
+	hintTransitionCount = 0;
+	hintSuppressedCount = 0;
+	lastHintStatus = null;
+}
+/**
+* External drain (ENG-48677 WS2): finalize and every snapshot rebuild call it
+* synchronously before building a record, so diagnostics buffered outside
+* TrueSight (the WASM kit's sink tail, or its `getAppLogs` text) land in the
+* terminal record and in an interrupted one alike. Injected by `setup()` —
+* same decoupled shape as the observers there.
+*/
+let externalDrain = null;
+function setTrueSightExternalDrain(drain) {
+	externalDrain = drain;
+}
+/** Synchronous by contract; best-effort — a broken drain never breaks a build. */
+function drainExternalDiagnostics() {
+	try {
+		externalDrain?.();
+	} catch {}
+}
 /** Buffer tap for wiring points and self-health lines. No-op when inactive. */
-function trueSightLog(level, subsystem, category, message) {
+function trueSightLog(level, subsystem, category, message, timestampMs) {
 	if (buffer === null) return;
-	buffer.append(level, subsystem, category, message);
+	buffer.append(level, subsystem, category, message, timestampMs);
 	snapshotDirty = true;
 }
 /**
@@ -1282,7 +1819,11 @@ function notifyTrueSightFlowEvent(event, managerKind) {
 				trueSightLog("info", managerKind, "orchestration", "flow.started");
 				break;
 			case "flow.ready":
-				if (identityAccepted) managerKind === "flow" && event.flowId, managerKind === "workflow" && event.flowId;
+				if (identityAccepted) noteFlowContext({
+					flowType: managerKind,
+					flowId: managerKind === "flow" ? event.flowId ?? null : null,
+					workflowId: managerKind === "workflow" ? event.flowId ?? null : null
+				});
 				trueSightLog("info", managerKind, "orchestration", `flow.ready ${managerKind === "workflow" ? "workflowId" : "flowId"}=${event.flowId ?? "unknown"}`);
 				break;
 			case "flow.module.started":
@@ -1293,8 +1834,8 @@ function notifyTrueSightFlowEvent(event, managerKind) {
 				break;
 			}
 			case "flow.error":
-				lastError = sanitizeMessage(event.error ?? "unknown");
-				trueSightLog("error", managerKind, "orchestration", `flow.error message=${event.error ?? "unknown"}`);
+				lastError = sanitizeMessage(event.error || "unknown");
+				trueSightLog("error", managerKind, "orchestration", `flow.error message=${event.error || "unknown"}`);
 				break;
 			case "flow.completed":
 				trueSightLog("info", managerKind, "orchestration", "flow.completed");
@@ -1340,6 +1881,8 @@ function stampOrchestratorIdentity(managerKind) {
 		}
 		return false;
 	}
+	noteIntegrationSurface(managerKind === "workflow" ? "startWorkflow" : "startFlow");
+	noteFlowContext({ flowType: managerKind });
 	return true;
 }
 /** Full teardown, called from `reset()` AFTER finalize captured its snapshot. */
@@ -1354,28 +1897,63 @@ function resetTrueSight() {
 	}
 	buffer = null;
 	active = false;
+	lifecycleGeneration += 1;
+	optedOut = false;
 	remoteKilled = false;
 	finalized = false;
-	cryptoUnsupported = false;
+	sealerUnsupported = false;
 	collectionStarted = false;
 	flagResolutionStarted = false;
 	lastError = null;
 	observedManagerKind = null;
 	orchestratorConflictLogged = false;
 	snapshotRecordId = null;
+	cachedPendingEnvelope = null;
 	snapshotDirty = false;
 	captureActive = false;
 	rebuildInFlight = false;
 	sealFailureLogged = false;
 	pendingSlotRegistered = false;
 	recoveryStarted = false;
+	bridgeFailureCount = 0;
+	envSnapshotLogged = false;
 	hintTransitionCount = 0;
 	hintSuppressedCount = 0;
 	lastHintStatus = null;
+	overflowBatchCount = 0;
+	lastFlushRecordId = null;
+	overflowDormant = false;
 	overflowFlushInFlightUpTo = null;
+	externalDrain = null;
 	options = defaultOptions();
 	resetTrueSightMetadata();
 }
+function handleAnalyticsEvent(event) {
+	if (finalized) return;
+	try {
+		const mapped = mapAnalyticsEventToLog(event);
+		if (mapped === null) return;
+		trueSightLog(mapped.level, mapped.subsystem, mapped.category, mapped.message);
+		if (mapped.level === "error" || mapped.level === "severe") logEnvironmentSnapshotOnce();
+		if (event.code === "captureAttemptFinished") resetHintBudget();
+	} catch {
+		bridgeFailureCount += 1;
+		if (bridgeFailureCount === 1) trueSightLog("warning", "diagnostics", "other", "bridge mapping failed");
+	}
+}
+/**
+* Environment-snapshot-on-first-error (event map 19d): the "conditions at
+* the moment of failure" line — logged once per session, right after the
+* first error-level entry. The snapshot closure is injected (navigator
+* facts live behind the L0 environment provider).
+*/
+function logEnvironmentSnapshotOnce() {
+	if (envSnapshotLogged || options.getEnvironmentSnapshot === void 0) return;
+	envSnapshotLogged = true;
+	try {
+		trueSightLog("info", "session", "other", `environment at first error ${options.getEnvironmentSnapshot()}`);
+	} catch {}
+}
 function applyFeatureResolution(features, unresolvable) {
 	if (!active || remoteKilled || finalized) return;
 	const entry = features?.features?.find((candidate) => candidate.feature === "TRUESIGHT_DIAGNOSTICS");
@@ -1392,6 +1970,70 @@ function remoteKill() {
 	unsubscribeEvents = null;
 }
 /**
+* Size-limit overflow flush (plan §1.3, event map 10b): the buffer crossed
+* ~600 KB mid-session — ship the slice as its OWN contract-valid record
+* (fresh id, same sessionId, index continuity ties the records together)
+* and keep logging. **STAGING-ONLY until BE ships `inProgress`/`flushReason`
+* (hard gate B2)**: outside staging (`testing !== true`) the machinery goes
+* dormant and the buffer falls back to eviction. Interim outcome marker is
+* the sanctioned `failure/interrupted` pair; the terminal record supersedes.
+*/
+function handleBufferOverflow(slice) {
+	dispatchOverflowSlice(slice).catch(() => {
+		overflowFlushInFlightUpTo = null;
+		goOverflowDormant("overflowFlush dormant reason=failed");
+	});
+}
+async function dispatchOverflowSlice(slice) {
+	if (!active || remoteKilled || finalized || overflowDormant || slice.length === 0) return;
+	const metadata = buildSessionMetadata();
+	if (metadata.testing !== true) {
+		goOverflowDormant("overflowFlush dormant reason=prod");
+		return;
+	}
+	if (sealerUnsupported) {
+		goOverflowDormant("overflowFlush dormant reason=sealerUnsupported");
+		return;
+	}
+	const transport = safeCaptureTransport();
+	if (transport === null) {
+		goOverflowDormant("overflowFlush dormant reason=noTransport");
+		return;
+	}
+	overflowBatchCount += 1;
+	const record = buildDiagnosticsRecord(metadata, [{
+		index: buffer?.reserveIndex() ?? slice[slice.length - 1].index + 1,
+		timestampMs: getTimestamp(),
+		level: "info",
+		subsystem: "diagnostics",
+		category: "other",
+		message: `sizeLimitFlush batch=${overflowBatchCount} prevRecordId=${lastFlushRecordId ?? "none"}`
+	}, ...slice], "failure", "interrupted");
+	if (record === null) {
+		goOverflowDormant("overflowFlush dormant reason=unbuildable");
+		return;
+	}
+	lastFlushRecordId = record.id;
+	const upToIndex = slice[slice.length - 1].index;
+	overflowFlushInFlightUpTo = upToIndex;
+	await options.upload(record, {
+		post: transport,
+		loadSealer: options.loadSealer,
+		warn: selfHealthWarn
+	});
+	buffer?.markFlushed(upToIndex);
+	overflowFlushInFlightUpTo = null;
+	snapshotDirty = true;
+	trueSightLog("info", "diagnostics", "other", `sizeLimitFlush dispatched batch=${overflowBatchCount} recordId=${record.id} entries=${slice.length}`);
+}
+/** B2 fallback: machinery dormant, eviction takes over — logged exactly once. */
+function goOverflowDormant(message) {
+	if (overflowDormant) return;
+	overflowDormant = true;
+	trueSightLog("warning", "diagnostics", "other", message);
+	buffer?.setOverflowMode("evict");
+}
+/**
 * Debounced interrupted-snapshot rebuild (plan §1.8): triggered by module
 * boundaries and the dirty-interval tick, suppressed while a capture loop is
 * active (C7). Seals the CURRENT state as a `failure/interrupted` record
@@ -1399,7 +2041,17 @@ function remoteKill() {
 * handler writes only the cache — it never builds), and persists it.
 */
 function maybeRebuildSnapshot() {
-	if (!active || remoteKilled || finalized || cryptoUnsupported || captureActive || rebuildInFlight || !snapshotDirty || options.storage === void 0) return;
+	try {
+		rebuildSnapshotIfDue();
+	} catch {
+		rebuildInFlight = false;
+		snapshotDirty = true;
+	}
+}
+function rebuildSnapshotIfDue() {
+	if (!active || remoteKilled || finalized || sealerUnsupported || captureActive || rebuildInFlight || options.storage === void 0) return;
+	drainExternalDiagnostics();
+	if (!snapshotDirty) return;
 	const metadata = buildSessionMetadata();
 	if (!metadata.sessionId) return;
 	const storage = options.storage;
@@ -1409,10 +2061,16 @@ function maybeRebuildSnapshot() {
 	if (record === null) return;
 	snapshotDirty = false;
 	rebuildInFlight = true;
-	options.loadCrypto().then((sealer) => sealer.seal(JSON.stringify(record))).then(async (envelope) => {
+	const generation = lifecycleGeneration;
+	const isStale = () => generation !== lifecycleGeneration || finalized;
+	options.loadSealer().then((sealer) => sealWithinLimits(record, sealer, () => {})).then(async (sealed) => {
+		if (sealed === null || isStale()) return;
+		const envelope = sealed.envelope;
+		cachedPendingEnvelope = envelope;
 		if (!pendingSlotRegistered) {
 			pendingSlotRegistered = true;
 			await registerPendingSlot(sessionId, { storage });
+			if (isStale()) return;
 		}
 		await writePendingEnvelope(sessionId, {
 			v: 1,
@@ -1420,16 +2078,33 @@ function maybeRebuildSnapshot() {
 			envelope
 		}, { storage });
 	}).catch(() => {
+		if (generation !== lifecycleGeneration) return;
 		snapshotDirty = true;
 		if (!sealFailureLogged) {
 			sealFailureLogged = true;
 			trueSightLog("warning", "diagnostics", "other", "snapshot seal failed persistDisabled=false");
 		}
 	}).finally(() => {
-		rebuildInFlight = false;
+		if (generation === lifecycleGeneration) rebuildInFlight = false;
 	});
 }
 /**
+* Page-hide = persist only, NEVER send (locked decision): one synchronous-
+* effective write of the freshest pre-sealed snapshot. Building or posting
+* here is forbidden — a hidden tab is frequently a user who returns.
+*/
+function handlePageHide() {
+	if (!active || remoteKilled || finalized || cachedPendingEnvelope === null || options.storage === void 0) return;
+	const sessionId = buildSessionMetadata().sessionId;
+	if (!sessionId) return;
+	writePendingEnvelope(sessionId, {
+		v: 1,
+		persistedAt: getTimestamp(),
+		envelope: cachedPendingEnvelope
+	}, { storage: options.storage });
+	trueSightLog("debug", "diagnostics", "other", "snapshot persisted on pagehide");
+}
+/**
 * Next-load recovery off the first-token-observed hook (A1) — runs once per
 * lifecycle, fire-and-forget, and reports the A5 loss counters as a
 * self-health line when there was anything to report.
@@ -1448,21 +2123,21 @@ function kickRecoveryOnce() {
 	});
 }
 /**
-* Resolves crypto support ahead of finalize (and warms the lazy chunk so the
+* Resolves sealer support ahead of finalize (and warms the lazy chunk so the
 * terminal path never pays the import). Unsupported → collect-only mode with
 * exactly one self-health warning.
 */
-function prewarmCrypto() {
-	options.loadCrypto().then((provider) => {
-		if (!provider.isSupported()) markCryptoUnsupported();
+function prewarmSealer() {
+	options.loadSealer().then((provider) => {
+		if (!provider.isSupported() || !isRandomUUIDAvailable()) markSealerUnsupported();
 	}, () => {
-		markCryptoUnsupported();
+		markSealerUnsupported();
 	});
 }
-function markCryptoUnsupported() {
-	if (cryptoUnsupported) return;
-	cryptoUnsupported = true;
-	trueSightLog("warning", "diagnostics", "other", "crypto unsupported collectOnly=true");
+function markSealerUnsupported() {
+	if (sealerUnsupported) return;
+	sealerUnsupported = true;
+	trueSightLog("warning", "diagnostics", "other", "sealer unsupported collectOnly=true");
 }
 /**
 * Default transport capture: a closure over the live client + token AS OF
@@ -1494,6 +2169,20 @@ function selfHealthWarn(message) {
 	if (isTrueSightTesting()) console.warn(message);
 	trueSightLog("warning", "diagnostics", "other", message);
 }
+/** Spread-safe subset: injected seams only, `undefined` values dropped. */
+function pickDefined(serviceOptions) {
+	const picked = {};
+	if (serviceOptions.fetchFeatures) picked.fetchFeatures = serviceOptions.fetchFeatures;
+	if (serviceOptions.captureTransport) picked.captureTransport = serviceOptions.captureTransport;
+	if (serviceOptions.upload) picked.upload = serviceOptions.upload;
+	if (serviceOptions.loadSealer) picked.loadSealer = serviceOptions.loadSealer;
+	if (serviceOptions.pageLifecycle) picked.pageLifecycle = serviceOptions.pageLifecycle;
+	if (serviceOptions.timer) picked.timer = serviceOptions.timer;
+	if (serviceOptions.storage) picked.storage = serviceOptions.storage;
+	if (serviceOptions.getWasmProfile) picked.getWasmProfile = serviceOptions.getWasmProfile;
+	if (serviceOptions.getEnvironmentSnapshot) picked.getEnvironmentSnapshot = serviceOptions.getEnvironmentSnapshot;
+	return picked;
+}
 /** ` index=i total=n` suffix when the flow event carries module positioning. */
 function modulePosition(payload) {
 	if (typeof payload !== "object" || payload === null) return "";
@@ -1501,4 +2190,4 @@ function modulePosition(payload) {
 	return `${typeof moduleIndex === "number" ? ` index=${moduleIndex}` : ""}${typeof totalModules === "number" ? ` total=${totalModules}` : ""}`;
 }
 //#endregion
-export { DEFAULT_WASM_VERSION as C, resolveWasmConfig as D, getBarcodeEnhanceModelUrl as E, noteTokenActivated as S, buildWasmConfigFromBasePath as T, resetFeatureConfigCache as _, notifyTrueSightManagerStopped as a, noteSessionCreated as b, trueSightHintTransition as c, getStoredHttpConfig as d, installFreshHttpClient as f, isFeatureEnabled as g, fetchFeatureConfig as h, notifyTrueSightFlowEvent as i, trueSightLog as l, upgradeToWasmHttpClient as m, initializeTrueSightDiagnostics as n, resetTrueSight as o, resetHttpClientState as p, noteTrueSightCaptureActivity as r, startTrueSightCollection as s, finalizeTrueSight as t, categoryForEndpoint as u, isTrueSightTesting as v, buildDefaultWasmConfig as w, noteTestingSignals as x, noteEnvironment as y };
+export { noteTokenActivated as C, noteTestingSignals as S, isFeatureEnabled as _, notifyTrueSightManagerStopped as a, noteEnvironment as b, startTrueSightCollection as c, categoryForEndpoint as d, getStoredHttpConfig as f, fetchFeatureConfig as g, upgradeToWasmHttpClient as h, notifyTrueSightFlowEvent as i, trueSightHintTransition as l, resetHttpClientState as m, initializeTrueSightDiagnostics as n, resetTrueSight as o, installFreshHttpClient as p, noteTrueSightCaptureActivity as r, setTrueSightExternalDrain as s, finalizeTrueSight as t, trueSightLog as u, resetFeatureConfigCache as v, noteSessionCreated as x, isTrueSightTesting as y };