@incodetech/core 2.4.0-rc.4 → 2.4.1-agentic

package/dist/{idCaptureStateMachine-DWJOHeGn.esm.js → idCaptureStateMachine-B3G6XoDG.esm.js}

@@ -1,32 +1,33 @@
-import { n as revokeObjectURL, t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
-import { l as isGoogleWalletSignedRequestsEnabled, u as BrowserStorageProvider } from "./setup-BvKrAlOo.esm.js";
-import { t as WasmUtilProvider } from "./WasmUtilProvider-DtJuBdt-.esm.js";
-import { n as eventModuleNames, o as createManagerInstrumentation, s as recordExperimentAssignmentOnce, y as addEvent } from "./events-Du2A4-Qr.esm.js";
-import { r as getToken, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
-import { l as trueSightHintTransition, r as noteTrueSightCaptureActivity, u as trueSightLog, y as isTrueSightTesting } from "./trueSightService-BAvhAU7T.esm.js";
-import { t as getDisableIpify } from "./sessionInitializer-c3CChZts.esm.js";
+import { n as getTimestamp, r as revokeObjectURL } from "./IBrowserEnvironmentCapability-D7JG7ML3.esm.js";
+import { l as isGoogleWalletSignedRequestsEnabled, t as ensureWasmPipelines, u as BrowserStorageProvider } from "./setup-CDAKwTr7.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-GTkoJyFY.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation, s as recordExperimentAssignmentOnce, y as addEvent } from "./events-CQteqXfy.esm.js";
+import { r as getToken, t as api, u as endpoints } from "./api-BO8JA7Pf.esm.js";
+import { l as trueSightHintTransition, r as noteTrueSightCaptureActivity, u as trueSightLog, y as isTrueSightTesting } from "./trueSightService-BujtUIW6.esm.js";
+import { t as getDisableIpify } from "./sessionInitializer-CWFT4dfw.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { s as exposeExperimentOnce } from "./feature-management-DCD0I_XZ.esm.js";
-import { t as addDeviceStats } from "./stats-BEvexnKC.esm.js";
-import { a as isIOS, s as isIPad, t as isAndroid, u as isMacOsSafari } from "./platform-DkcRc9JV.esm.js";
-import "./session-Cr4IVgYu.esm.js";
+import { s as exposeExperimentOnce } from "./feature-management-DjAG5lsJ.esm.js";
+import { t as addDeviceStats } from "./stats-BpMz-hTP.esm.js";
+import { a as isIOS, c as isIPhone14OrHigher, f as isSamsungDevice, s as isIPad, t as isAndroid, u as isMacOsSafari } from "./platform-aPh7gTWh.esm.js";
+import "./session-DAaAewMX.esm.js";
 import { c as not, i as assign, l as raise, n as enqueueActions, o as and, r as sendTo, s as createActor, t as setup, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-8Gzepa_A.esm.js";
-import { n as getUrlSearchParam, t as buildUrlWithSearchParams } from "./urlUtils-6jsE6rKp.esm.js";
-import { r as getCameraReacquisitionConstraints } from "./camera-sIa9ceW2.esm.js";
-import { i as requestMotionPermission, n as invokeRequestPermissionActor, o as requiresMotionPermissionUserGesture, t as checkPermission } from "./permissionServices-Ca-tSNhT.esm.js";
-import { a as flagIdManualReview, n as runProtectedAttempt, o as PROTECTED_CAPTURE_TARGET, r as cameraCycleProvider, t as createCameraCycleOwnership } from "./createCameraCycleOwnership-Dj_LHUvN.esm.js";
+import { n as getUrlSearchParam, t as buildUrlWithSearchParams } from "./urlUtils-eYiyWjh0.esm.js";
+import { s as isCameraDenialErrorName } from "./camera-E_Kcre4O.esm.js";
+import { i as requestMotionPermission, n as invokeRequestPermissionActor, o as requiresMotionPermissionUserGesture, t as checkPermission, u as queryPermission } from "./permissionServices-DnBAN_hW.esm.js";
+import { i as cameraCycleProvider, n as createCameraCycleOwnership, o as flagIdManualReview, r as runProtectedAttempt, s as PROTECTED_CAPTURE_TARGET, t as electDesktopCameraDevice } from "./desktopCameraElection-kHY2IDJi.esm.js";
 import { t as IncodeCanvas } from "./canvas-BxFzWTt-.esm.js";
-import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-gcy3U0SL.esm.js";
-import { o as StreamCanvasProcessingSession } from "./multipartRecordingService-CLwrF5wD.esm.js";
+import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-B3OPL8Si.esm.js";
+import { t as carryAttempts } from "./attemptCarry-BjTJ6bMQ.esm.js";
+import { o as StreamCanvasProcessingSession } from "./multipartRecordingService-DMBxHKS2.esm.js";
 import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
 import { t as getBrowser } from "./getBrowser-Cbe1C4Tn.esm.js";
-import { a as isBackCameraLabel } from "./backCameraStream-CMvXj4X4.esm.js";
+import { r as isBackCameraLabel } from "./backCameraStream-C5_NNfUN.esm.js";
 import { n as getWindowDimensions } from "./getDeviceClass-CeBiEayS.esm.js";
-import { n as frameSources, r as runVirtualCameraCheck } from "./deepsightService-BrltL1DF.esm.js";
-import { t as getDeviceClass } from "./getDeviceClass-bsWdEDxP.esm.js";
-import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider } from "./idCaptureDefaults-BGsG2OAs.esm.js";
-import { C as getIdCameraStream, S as OPTIMIZING_WATCHDOG_MARGIN_MS, _ as ID_ERROR_CODES, a as getRealQualityValue, b as resolveIdCaptureThresholds, c as pauseRecordingForAttempt, d as resumeRecordingAfterPause, f as startRecordingSession, g as validateUploadResponse, h as uploadIdImage, i as finalizeRecordingSession, l as prepareRecordingForCameraRetry, m as stopStream, o as initializeIdCapture, p as stopRecording, r as disposeRecordingSession, s as isSuspendableRecordingSession, t as addBarcode, u as processId, x as CAPTURE_OPTIMIZING, y as resolveCountdownStepMs } from "./idCaptureServices-mpibFz4U.esm.js";
+import { n as frameSources, r as runVirtualCameraCheck } from "./deepsightService-twg3bXqY.esm.js";
+import { t as getDeviceClass } from "./getDeviceClass-DoIWuKI8.esm.js";
+import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider } from "./idCaptureDefaults-MSQoqScU.esm.js";
+import { C as getIdCameraStream, S as OPTIMIZING_WATCHDOG_MARGIN_MS, _ as ID_ERROR_CODES, a as getRealQualityValue, b as resolveIdCaptureThresholds, c as pauseRecordingForAttempt, d as resumeRecordingAfterPause, f as startRecordingSession, g as validateUploadResponse, h as uploadIdImage, i as finalizeRecordingSession, l as prepareRecordingForCameraRetry, m as stopStream, o as initializeIdCapture, p as stopRecording, r as disposeRecordingSession, s as isSuspendableRecordingSession, t as addBarcode, u as processId, x as CAPTURE_OPTIMIZING, y as resolveCountdownStepMs } from "./idCaptureServices-8OHinO0N.esm.js";
 import { t as StreamCanvasCapture } from "./StreamCanvasCapture-C9jtgBdT.esm.js";
 //#region src/modules/id/digitalUpload/digitalUploadErrors.ts
 const TERMINAL_FAIL_REASONS = /* @__PURE__ */ new Set(["DIGITAL_ID_REQUESTED_BUT_OTHER_PROVIDED", "ID_TYPE_UNACCEPTABLE"]);
@@ -550,7 +551,36 @@ const deviceWalletMachine = setup({
 function resolveWalletPlatform(provider) {
 	if (provider === "apple_web") return "ios";
 	if (provider === "google") return "android";
-	return isIOS() || isMacOsSafari() || isIPad() ? "ios" : "android";
+	return isApplePlatform() ? "ios" : "android";
+}
+/** iOS / iPadOS / macOS Safari — the only platforms Apple Wallet web runs on. */
+function isApplePlatform() {
+	return isIOS() || isMacOsSafari() || isIPad();
+}
+/**
+* The wallet family this device *certainly* reaches, for naming it in the UI:
+* `apple` on the Apple platform, `samsung` on a detectable Samsung Android
+* device, `android` on any other Android device. `undefined` when the OS gives
+* no certain answer (desktop Chrome, Windows, Linux). Unlike
+* `resolveWalletPlatform`, which must pick a handshake and so maps every
+* non-Apple browser to Google, this does not guess.
+*/
+function resolveWalletDevice() {
+	if (isApplePlatform()) return "apple";
+	if (isAndroid()) return isSamsungDevice() ? "samsung" : "android";
+}
+/**
+* The device facts the digital-ID funnel filters wallets on: Credentials API
+* availability, the OS wallet the device reaches (the same answer the
+* handshake later launches with) and whether it is a Samsung device.
+* No injected capability reads as "no Credentials API".
+*/
+function getDigitalIdPlatformSupport(credentials) {
+	return {
+		credentialsAvailable: credentials?.isAvailable() ?? false,
+		walletPlatform: resolveWalletPlatform(),
+		samsungDevice: isSamsungDevice()
+	};
 }
 //#endregion
 //#region src/modules/id/deviceWallet/instrumentation.ts
@@ -769,6 +799,580 @@ function renderWallet({ onSuccess, onError, ...actorOptions }) {
 	});
 }
 //#endregion
+//#region src/modules/id/digitalIdCountry.ts
+/** Longest the chooser waits for country signals before rendering. */
+const DIGITAL_ID_COUNTRY_DETECTION_TIMEOUT_MS = 1e3;
+/** Upper-cased ISO 3166-1 alpha-2, or `undefined` for anything else. */
+function normalizeCountryCode(value) {
+	if (typeof value !== "string") return;
+	const code = value.trim().toUpperCase();
+	return /^[A-Z]{2}$/.test(code) ? code : void 0;
+}
+/**
+* The region subtags of BCP 47 language tags, in order, deduped. Tags without
+* an explicit alpha-2 region (`sv`, `es-419`) or that do not parse contribute
+* nothing — a bare language is not a country.
+*/
+function getLocaleRegions(tags) {
+	const regions = [];
+	for (const tag of tags) {
+		let region;
+		try {
+			region = new Intl.Locale(tag).region;
+		} catch {
+			region = void 0;
+		}
+		const code = normalizeCountryCode(region);
+		if (code && !regions.includes(code)) regions.push(code);
+	}
+	return regions;
+}
+/** Whether any signal is wired at all (otherwise detection is a no-op). */
+function hasCountrySignals(dependencies) {
+	if (!dependencies) return false;
+	return dependencies.ipCountry !== void 0 || dependencies.locale !== void 0 || dependencies.geolocation !== void 0 && dependencies.reverseGeocodeCountry !== void 0;
+}
+async function detectGpsCountry(dependencies, signal) {
+	const { geolocation, reverseGeocodeCountry } = dependencies;
+	if (!geolocation || !reverseGeocodeCountry) return;
+	if (await queryPermission("geolocation") !== "granted") return;
+	return reverseGeocodeCountry(await geolocation.getCurrentPosition(), signal);
+}
+/**
+* Region subtags of the browser languages. A locale capability that throws
+* (e.g. a custom one) is dropped like any other failing signal, so detection
+* still never rejects.
+*/
+function readLocaleRegions(locale) {
+	if (!locale) return [];
+	try {
+		return getLocaleRegions(locale.getPreferredLanguages());
+	} catch {
+		return [];
+	}
+}
+/**
+* Collects the country signals and returns their countries, strongest first,
+* deduped (see the module doc for the order). Never rejects: a failing or
+* late signal is dropped.
+*/
+async function detectDigitalIdCountries(dependencies, options = {}) {
+	const { timeoutMs = DIGITAL_ID_COUNTRY_DETECTION_TIMEOUT_MS, signal } = options;
+	const timer = BrowserTimerProvider.getInstance();
+	let deadlineHandle;
+	const deadline = new Promise((resolve) => {
+		deadlineHandle = timer.setTimeout(() => resolve(void 0), timeoutMs);
+	});
+	const settle = (run) => Promise.race([Promise.resolve().then(run).catch(() => void 0), deadline]);
+	try {
+		const [gpsCountry, ipCountry] = await Promise.all([settle(() => detectGpsCountry(dependencies, signal)), settle(() => dependencies.ipCountry ? dependencies.ipCountry(signal) : Promise.resolve(void 0))]);
+		const localeRegions = readLocaleRegions(dependencies.locale);
+		const countries = [];
+		for (const candidate of [
+			gpsCountry,
+			ipCountry,
+			...localeRegions
+		]) {
+			const code = normalizeCountryCode(candidate);
+			if (code && !countries.includes(code)) countries.push(code);
+		}
+		return countries;
+	} finally {
+		if (deadlineHandle !== void 0) timer.clearTimeout(deadlineHandle);
+	}
+}
+//#endregion
+//#region src/modules/id/digitalIdRegistry.ts
+/**
+* True when a digital-ID method uses a full-page web-redirect flow (Trinsic
+* iDIN, FTN, itsme, …). Accepts both the module `FlowType` value (`REDIRECT`) and the
+* backend value (`WEB_REDIRECT`). (Lives here rather than in
+* `idCaptureHelpers` to keep the registry free of circular imports; the
+* helpers re-export it.)
+*/
+function isRedirectFlowType(flowType) {
+	return flowType === "REDIRECT" || flowType === "WEB_REDIRECT";
+}
+const DIGITAL_ID_REGISTRY = {
+	mDL: [{
+		kind: "incodeWallet",
+		documentType: "digitalId"
+	}, {
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_mdl_placeholder",
+		method: "MDL"
+	}],
+	iDIN: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_netherlands_idin",
+		method: "IDIN",
+		countries: ["NL"]
+	}],
+	FTN: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_finnish_trust_network",
+		method: "FTN",
+		countries: ["FI"]
+	}],
+	itsme: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_belgium_itsme",
+		method: "ITSME",
+		countries: ["BE"]
+	}],
+	SPID: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_italy_spid",
+		method: "SPID",
+		countries: ["IT"]
+	}],
+	MitID: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_denmark_mitid",
+		method: "MITID",
+		countries: ["DK"]
+	}],
+	BankIDSweden: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_sweden_bankid",
+		method: "BANKID_SWEDEN",
+		countries: ["SE"]
+	}],
+	FranceIdentite: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_france_identite",
+		method: "FRANCE_IDENTITE",
+		countries: ["FR"]
+	}],
+	IdentiteNumerique: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_france_identite_numerique",
+		method: "IDENTITE_NUMERIQUE",
+		countries: ["FR"]
+	}],
+	LAWallet: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_usa_louisiana_wallet",
+		method: "LA_WALLET",
+		countries: ["US"]
+	}],
+	DigiLocker: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_india_digilocker_aadhaar",
+		method: "DIGILOCKER",
+		countries: ["IN"]
+	}]
+};
+const DIGITAL_ID_DOCUMENT_TYPES = Object.keys(DIGITAL_ID_REGISTRY);
+/**
+* Single place that widens `config.digitalIds` to the shapes the backend
+* actually sends — the mapped array or the raw `{ enabled, methods }` object.
+* Shared so the cast is written once.
+*/
+function asDigitalIdsConfig(config) {
+	return config.digitalIds;
+}
+/**
+* TODO(test-only): the identity network's test-environment mock providers, one per
+* integration type, for E2E testing — remove before production. Persisted method →
+* provider id only: they are standalone redirect cards, never part of a wallet
+* funnel, so they need no `DigitalIdDocumentType` / `DIGITAL_ID_REGISTRY` entry and
+* stay off the public API. Like every redirect method they render a card only
+* when a flow enables the method in `digitalIds.methods`.
+*/
+const TEST_MOCK_REDIRECT_PROVIDER_BY_METHOD = {
+	TRINSIC_TEST_REDIRECT: "trinsic_trinsic_test_redirect",
+	TRINSIC_TEST_DELAYED_RESULTS: "trinsic_trinsic_test_delayed_results",
+	TRINSIC_TEST_SUB_PROVIDERS: "trinsic_trinsic_test_sub_providers",
+	TRINSIC_TEST_DEEPLINK: "trinsic_trinsic_test_deeplink",
+	TRINSIC_TEST_DEEPLINK_REFRESH: "trinsic_trinsic_test_deeplink_refresh",
+	TRINSIC_TEST_SHOW_CONTENT: "trinsic_trinsic_test_show_content",
+	TRINSIC_TEST_SHOW_CONTENT_REFRESH: "trinsic_trinsic_test_show_content_refresh",
+	TRINSIC_TEST_HANDOFF: "trinsic_trinsic_test_handoff",
+	TRINSIC_TEST_OFFLINE: "trinsic_trinsic_test_offline",
+	TRINSIC_MOCK_OUTPUT: "trinsic_trinsic_mock_output"
+};
+/**
+* Persisted method name → catalog provider id, derived from the registry's
+* Trinsic entries (single source of truth). Lets the SDK launch iDIN / FTN
+* from a backend that does not yet send `providerId` on each method.
+* TODO(roadmap: fully-catalog-driven): remove once every backend enriches
+* `digitalIds.methods[]` with `providerId` + `flowType`.
+*/
+const REDIRECT_PROVIDER_BY_METHOD = (() => {
+	const map = { ...TEST_MOCK_REDIRECT_PROVIDER_BY_METHOD };
+	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) for (const entry of DIGITAL_ID_REGISTRY[docType]) if (entry.kind === "trinsicRedirect") map[entry.method] = entry.providerId;
+	return map;
+})();
+/**
+* Catalog provider id → the countries it serves, from the registry. Lets the
+* chooser rank redirect providers by country even when the backend does not enrich
+* `digitalIds.methods[]` with `countries`.
+*/
+const REDIRECT_PROVIDER_COUNTRIES = Object.fromEntries(DIGITAL_ID_DOCUMENT_TYPES.flatMap((docType) => DIGITAL_ID_REGISTRY[docType].flatMap((entry) => entry.kind === "trinsicRedirect" && entry.countries ? [[entry.providerId, entry.countries]] : [])));
+/**
+* Redirect providers that are the fallback leg of a wallet-first funnel
+* (mDL): they are reached through the `digitalId` tile's funnel resolution,
+* not offered as a standalone chooser card.
+*/
+const WALLET_FUNNEL_REDIRECT_PROVIDER_IDS = new Set(DIGITAL_ID_DOCUMENT_TYPES.flatMap((docType) => {
+	const entries = DIGITAL_ID_REGISTRY[docType];
+	if (!entries.some((entry) => entry.kind === "incodeWallet")) return [];
+	return entries.flatMap((entry) => entry.kind === "trinsicRedirect" ? [entry.providerId] : []);
+}));
+/**
+* True for a redirect provider that gets its own chooser card (iDIN, FTN, any
+* catalog-enriched redirect method) — as opposed to the mDL wallet fallback,
+* which only surfaces through the Digital ID tile.
+*/
+function isStandaloneRedirectProvider(providerId) {
+	return !WALLET_FUNNEL_REDIRECT_PROVIDER_IDS.has(providerId);
+}
+/**
+* The provider id a configured method launches with, when it is a
+* web-redirect method; `undefined` for wallets / other flow shapes.
+*
+* Resolution order:
+* 1. an explicit redirect `flowType` with a `provider` (mapped shape) or
+*    `providerId` (catalog-enriched raw shape) — backend-authoritative;
+* 2. otherwise the persisted method name via the registry (legacy raw shape).
+*/
+function resolveRedirectProviderId(method) {
+	if (method.flowType) {
+		if (!isRedirectFlowType(method.flowType)) return;
+		const explicit = method.provider ?? method.providerId;
+		if (explicit) return explicit;
+	}
+	return method.method ? REDIRECT_PROVIDER_BY_METHOD[method.method.toUpperCase()] : void 0;
+}
+/**
+* Tolerant view over `config.digitalIds`: accepts both the mapped array
+* (`IdCaptureDigitalIdMethod[]`) and the raw backend object
+* (`{ enabled, methods: [...] }`). Extracted from the old
+* `getDigitalIdRedirectMethod` cast so every consumer parses it the same way.
+*
+* Honors both dashboard toggles: a raw object with `enabled: false` yields no
+* methods, and individual methods with `enabled: false` are dropped (absent
+* `enabled` counts as on). This is what "enabled for the flow / workflow"
+* means — for the redirect chooser cards as much as for the wallet tile.
+*/
+function normalizeDigitalIdMethods(config) {
+	const raw = asDigitalIdsConfig(config);
+	if (!Array.isArray(raw) && raw?.enabled === false) return [];
+	return (Array.isArray(raw) ? raw : raw?.methods ?? []).filter((method) => method.enabled !== false);
+}
+/**
+* Persisted method names of the Incode-native device wallets — the backend
+* `DigitalIdMethodCatalog` entries of type `MDL`. A catalog-enriched method
+* carries `type: 'MDL'` instead of relying on the name; both are honoured.
+*
+* `SAMSUNG_WALLET` is listed by name because the onboarding catalog does not
+* enrich it yet: it arrives as a bare `{ method: 'SAMSUNG_WALLET' }`. Without
+* the name it would fall through to the unfiltered `deviceWallet` flag and
+* skip `WALLET_PLATFORM_RULES`' Samsung-only rule.
+*/
+const DEVICE_WALLET_METHODS = /* @__PURE__ */ new Set([
+	"APPLE_WALLET",
+	"GOOGLE_WALLET",
+	"CA_DMV_WALLET",
+	"SAMSUNG_WALLET"
+]);
+/**
+* True for a configured method the native device-wallet handshake can fulfil.
+* Redirect methods (iDIN, FTN) never count, whatever their name or type — they
+* must not surface a wallet tile with no wallet behind it.
+*
+* Classifies by *kind* only. Whether a method is switched on is already
+* settled by `normalizeDigitalIdMethods`, which drops disabled methods before
+* any caller walks the list.
+*/
+function isDeviceWalletMethod(method) {
+	if (method.flowType && isRedirectFlowType(method.flowType)) return false;
+	if (method.type?.toUpperCase() === "MDL") return true;
+	return method.method !== void 0 && DEVICE_WALLET_METHODS.has(method.method.toUpperCase());
+}
+/**
+* Device-level hard filter per wallet method: a wallet the device cannot reach
+* is never offered. Apple Wallet needs the Apple platform, Google Wallet any
+* other, and Samsung Wallet a Samsung device. Methods without a rule (CA DMV
+* Wallet, an unknown catalog `MDL` method) run on either platform.
+*
+* A rule only rejects on a known platform fact, so a caller that omits
+* `walletPlatform` / `samsungDevice` gets no filtering.
+*/
+const WALLET_PLATFORM_RULES = {
+	APPLE_WALLET: (platform) => platform.walletPlatform !== "android",
+	GOOGLE_WALLET: (platform) => platform.walletPlatform !== "ios",
+	SAMSUNG_WALLET: (platform) => platform.walletPlatform !== "ios" && platform.samsungDevice !== false
+};
+function isDeviceWalletMethodEligible(method, platform) {
+	const rule = method.method !== void 0 ? WALLET_PLATFORM_RULES[method.method.toUpperCase()] : void 0;
+	return rule ? rule(platform) : true;
+}
+/**
+* Whether a device wallet can run for this config on this device: an enabled
+* wallet method that passes `WALLET_PLATFORM_RULES`, or, when the config lists
+* no wallet method at all, the legacy `deviceWallet` flag (which names no
+* wallet, so there is nothing to filter).
+*
+* The method list is the authority. The dashboard persists a wallet only in
+* `digitalIds.methods` and leaves the legacy `deviceWallet` / `appleWallet`
+* booleans at their stored `false`; the workflow-node response historically
+* shipped them raw, so reading the list is what keeps the tile visible there
+* (and matches SDK 1). It also means a config whose only wallet is Apple
+* Wallet yields `false` on Android even when `deviceWallet` is `true`. Unlike
+* the backend's `deriveDeviceWalletFlag`, an unrecognised method does not
+* count as a wallet: it must not launch a handshake that cannot know what to
+* request.
+*/
+function hasEligibleDeviceWallet(config, platform) {
+	const walletMethods = normalizeDigitalIdMethods(config).filter(isDeviceWalletMethod);
+	if (walletMethods.length > 0) return walletMethods.some((method) => isDeviceWalletMethodEligible(method, platform));
+	return config.deviceWallet === true;
+}
+/** Whether a funnel entry is activated by config + platform capabilities. */
+function isEntryActive(entry, config, platform) {
+	if (entry.kind === "incodeWallet") return platform.credentialsAvailable && hasEligibleDeviceWallet(config, platform);
+	return findConfiguredMethod(entry, config) !== void 0;
+}
+/**
+* The configured `digitalIds` method matching a Trinsic funnel entry — by
+* persisted method name, or (mapped shape) by provider id on a redirect
+* flowType. First match wins; disabled methods are already dropped by
+* `normalizeDigitalIdMethods`.
+*/
+function findConfiguredMethod(entry, config) {
+	return normalizeDigitalIdMethods(config).find((method) => method.method?.toUpperCase() === entry.method || method.provider === entry.providerId && !!method.flowType && isRedirectFlowType(method.flowType));
+}
+/** Normalizes a raw configured method into the mapped shape for the child input. */
+function toMappedMethod(entry, method) {
+	if (method.flowType && isRedirectFlowType(method.flowType)) return method;
+	return {
+		method: method.method,
+		provider: entry.providerId,
+		flowType: "WEB_REDIRECT",
+		country: method.country ?? method.countries?.[0],
+		displayName: method.displayName,
+		logoUrl: method.logoUrl
+	};
+}
+/**
+* Resolves the implementation that should fulfil a digital-ID document type:
+* the first funnel entry that is active under the given config and platform.
+* `undefined` when nothing can run it (the chooser then shows no tile for it).
+*/
+function resolveDigitalIdImplementation(docType, config, platform) {
+	for (const entry of DIGITAL_ID_REGISTRY[docType]) {
+		if (!isEntryActive(entry, config, platform)) continue;
+		if (entry.kind === "incodeWallet") return { kind: "incodeWallet" };
+		const method = findConfiguredMethod(entry, config);
+		return {
+			kind: "trinsicRedirect",
+			providerId: entry.providerId,
+			method: method ? toMappedMethod(entry, method) : void 0
+		};
+	}
+}
+//#endregion
+//#region src/modules/id/idCaptureHelpers.ts
+/**
+* Normalizes a configured method into the mapped redirect shape for a
+* resolved provider. The already-mapped shape is returned as-is; the raw
+* backend shape gets `provider` + `WEB_REDIRECT` filled in.
+*/
+function toRedirectMethod(method, provider) {
+	if (method.provider && method.flowType) return method;
+	return {
+		method: method.method,
+		provider,
+		flowType: "WEB_REDIRECT",
+		country: method.country ?? method.countries?.[0],
+		displayName: method.displayName,
+		logoUrl: method.logoUrl
+	};
+}
+/**
+* The enabled web-redirect digital-ID method to launch — the one matching
+* `providerId` when given (a chooser card was picked), else the first
+* configured redirect method — or `undefined` when none is configured.
+* Drives the provider and country passed to the `digitalIdRedirectMachine`.
+*
+* Accepts both the mapped array (`IdCaptureDigitalIdMethod[]`) and the raw
+* backend `configuration.digitalIds` object (`{ enabled, methods: [...] }`);
+* for the raw shape the provider comes from the backend-enriched
+* `providerId`/`flowType` when present, else from the persisted method name
+* via the digital-ID registry (`IDIN` → `trinsic_netherlands_idin`).
+*/
+function getDigitalIdRedirectMethod(config, providerId) {
+	for (const method of normalizeDigitalIdMethods(config)) {
+		const provider = resolveRedirectProviderId(method);
+		if (!provider || providerId !== void 0 && provider !== providerId) continue;
+		return toRedirectMethod(method, provider);
+	}
+}
+function collectDigitalIdRedirectOptions(config) {
+	const entries = [];
+	for (const method of normalizeDigitalIdMethods(config)) {
+		const providerId = resolveRedirectProviderId(method);
+		if (!providerId || !isStandaloneRedirectProvider(providerId) || entries.some((entry) => entry.option.providerId === providerId)) continue;
+		const countries = (method.countries ?? (method.country ? [method.country] : void 0) ?? REDIRECT_PROVIDER_COUNTRIES[providerId] ?? []).flatMap((country) => normalizeCountryCode(country) ?? []);
+		entries.push({
+			option: {
+				providerId,
+				method: method.method,
+				displayName: method.displayName,
+				logoUrl: method.logoUrl,
+				country: method.country ?? method.countries?.[0] ?? countries[0]
+			},
+			countries
+		});
+	}
+	return entries;
+}
+/**
+* Rank of an option against the detected countries: the index of the
+* strongest detected country it serves, `Infinity` when it serves none.
+*/
+function countryRank(countries, preferredCountries) {
+	const ranks = countries.map((country) => preferredCountries.indexOf(country)).filter((index) => index >= 0);
+	return ranks.length > 0 ? Math.min(...ranks) : Number.POSITIVE_INFINITY;
+}
+/**
+* The digital-ID web-redirect providers that get their own chooser card: one
+* per enabled redirect method in `config.digitalIds`, deduped by provider.
+* Wallet-funnel fallbacks (the Trinsic mDL leg) are excluded — they surface
+* through the Digital ID tile instead.
+*
+* Order: providers serving the strongest detected country first
+* (`preferredCountries`, see `detectDigitalIdCountries`), then those serving
+* weaker ones, then the rest. Country only ranks — nothing is hidden — and
+* ties keep backend (dashboard) order. With no detected country this is plain
+* backend order.
+*
+* Card display data (`displayName`, `logoUrl`, `country`) is whatever the
+* backend enriched the method with; the UI falls back to generic copy / icon
+* when absent.
+*/
+function getAvailableDigitalIdRedirectOptions(config, preferredCountries = []) {
+	const entries = collectDigitalIdRedirectOptions(config);
+	if (preferredCountries.length === 0) return entries.map((entry) => entry.option);
+	return entries.map((entry) => ({
+		entry,
+		rank: countryRank(entry.countries, preferredCountries)
+	})).sort((a, b) => a.rank - b.rank).map(({ entry }) => entry.option);
+}
+/**
+* Re-orders the given redirect options for `preferredCountries` without
+* changing the set: same ranking as `getAvailableDigitalIdRedirectOptions`,
+* ties in backend order. Each option's countries come from its configured
+* method (all of them), falling back to the option's own `country`.
+*/
+function rankDigitalIdRedirectOptions(options, config, preferredCountries) {
+	const entries = collectDigitalIdRedirectOptions(config);
+	const backendIndex = (option) => {
+		const index = entries.findIndex((entry) => entry.option.providerId === option.providerId);
+		return index >= 0 ? index : entries.length;
+	};
+	const countriesOf = (option) => {
+		const configured = entries.find((entry) => entry.option.providerId === option.providerId);
+		const own = normalizeCountryCode(option.country);
+		return configured?.countries ?? (own ? [own] : []);
+	};
+	return options.map((option, position) => ({
+		option,
+		rank: countryRank(countriesOf(option), preferredCountries),
+		order: backendIndex(option),
+		position
+	})).sort((a, b) => a.rank - b.rank || a.order - b.order || a.position - b.position).map(({ option }) => option);
+}
+/**
+* Whether country ranking can change the order of the redirect options: at
+* least two options serving different countries. When it cannot, the chooser
+* skips country detection entirely (no request, no wait).
+*/
+function canRankDigitalIdRedirectOptionsByCountry(config) {
+	const entries = collectDigitalIdRedirectOptions(config);
+	if (entries.length < 2) return false;
+	return new Set(entries.map((entry) => [...entry.countries].sort().join(","))).size > 1;
+}
+/**
+* Map of config properties received from the backend to adjusted, internal document types.
+*/
+const DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP = [
+	["enableId", "id"],
+	["enablePassport", "passport"],
+	["digitalIdsUpload", "digitalIdUpload"]
+];
+/**
+* Returns the list of document types enabled by config for the chooser screen, in display order.
+* Used to populate chooser state so UI and headless consumers can render the correct options.
+*
+* Digital-ID document types (device wallet, Trinsic web-redirect) come from
+* the digital-ID registry funnel: each registry document type contributes the
+* tile of its first active implementation. A `deviceWallet: true` config on a
+* platform without the Credentials API therefore shows the Trinsic fallback
+* tile when one is configured — or no tile at all, instead of a dead-end one.
+*
+* @param config - ID capture configuration (from flow or init)
+* @param platform - Platform capabilities consulted by the digital-ID funnel.
+*   Defaults to no Credentials API for pure-node callers; the machine passes
+*   the real capability check.
+* @returns Array of IdDocumentType values that should be shown in the document type chooser
+*/
+function getAvailableDocumentTypes(config, platform = { credentialsAvailable: false }) {
+	const adjustedDocumentTypes = [];
+	for (const [configProperty, adjustedType] of DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP) if (config[configProperty]) adjustedDocumentTypes.push(adjustedType);
+	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) {
+		const route = resolveDigitalIdImplementation(docType, config, platform);
+		if (!route) continue;
+		const documentType = route.kind === "incodeWallet" ? "digitalId" : "digitalIdRedirect";
+		if (!adjustedDocumentTypes.includes(documentType)) adjustedDocumentTypes.push(documentType);
+	}
+	if (!adjustedDocumentTypes.includes("digitalIdRedirect") && getAvailableDigitalIdRedirectOptions(config).length > 0) adjustedDocumentTypes.push("digitalIdRedirect");
+	return adjustedDocumentTypes;
+}
+/**
+* Computes `idCaptureMachine`'s terminal output — the downstream module-skip
+* signal read by the Flow orchestrator (via `runChildModule`'s `MODULE_COMPLETE`).
+*
+* `skipFaceMatch` is set ONLY for the US Smart Capture *camera back-only* path:
+* a back image was captured on-device (`capturedImages.back`) and no front was
+* (`!capturedImages.front`) — "no front, no ID face, no match".
+*
+* Requiring a captured back is deliberate and load-bearing: the digital-ID
+* upload path submits a full ID (front face present) but does NOT
+* populate `capturedImages` (only the camera path does). Gating on a captured
+* back excludes those upload paths so a real ID-vs-selfie match is never
+* silently skipped. `capturedImages.front`/`forceFrontIdCapture` alone are not
+* enough (a later front upload clears the request; uploads set neither field).
+*
+* Always `false` outside US Smart Capture. The selfie/face capture itself is
+* unaffected — only the ID-vs-selfie match is skipped.
+*
+* Also `true` on the Digital ID web-redirect (Trinsic iDIN/FTN) COMPLETED path
+* when the scheme returned no portrait (`isDigitalIdRedirect && !portraitPresent`,
+* FM-1/FM-2): there is no ID face to match the selfie against.
+*/
+function computeIdCaptureOutput(context) {
+	const frontIdCaptured = Boolean(context.capturedImages.front);
+	const backIdCaptured = Boolean(context.capturedImages.back);
+	return {
+		frontIdCaptured,
+		skipFaceMatch: context.isDigitalIdRedirect === true && context.portraitPresent !== true || context.config.usSmartCapture === true && backIdCaptured && !frontIdCaptured
+	};
+}
+//#endregion
 //#region src/modules/id/idCaptureGuards.ts
 function getPermissionOutput(event) {
 	if (!("output" in event)) return;
@@ -874,6 +1478,13 @@ const supportsOptimizingStatusGuard = ({ context }) => context.config.supportsOp
 const isDeepsightEnabledGuard = ({ context }) => context.dependencies !== void 0;
 const isDeepsightReadyGuard = ({ context }) => context.deepsightService !== void 0;
 const needsDeepsightInitGuard = ({ context }) => context.dependencies !== void 0 && context.deepsightService === void 0 && !context.deepsightInitAttempted;
+/**
+* Route into the chooser through `detectingCountry`: detection has not run
+* yet, a country signal is wired, and the ranking could actually reorder the
+* redirect options (two or more serving different countries). Otherwise the
+* chooser opens at once, with no request and no spinner.
+*/
+const needsCountryDetectionGuard = ({ context }) => context.detectedCountries === void 0 && hasCountrySignals(context.dependencies?.countryDetection) && canRankDigitalIdRedirectOptionsByCountry(context.config);
 /** No capture option is enabled — the ID module is misconfigured. */
 const hasNoDocumentTypesAvailableGuard = ({ context }) => context.availableDocumentTypes.length === 0;
 const isDigitalIdUploadSelectedGuard = ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "digitalIdUpload";
@@ -1420,7 +2031,7 @@ fromPromise(async ({ input }) => {
 });
 fromPromise(async ({ input }) => {
 	if (!input.dependencies) return;
-	const { loadDeepsightSession } = await import("./deepsightLoader-DkrG5zbN.esm.js");
+	const { loadDeepsightSession } = await import("./deepsightLoader-DMxtowCm.esm.js");
 	return loadDeepsightSession({
 		ds: input.ds,
 		storage: input.dependencies.storage,
@@ -1863,21 +2474,28 @@ function cleanup(service) {
 		service.cleanup();
 	} catch {}
 }
-function createIdMetadataPreparationCoordinator(load = async (input) => (await import("./deepsightLoader-DkrG5zbN.esm.js")).loadDeepsightSession(input)) {
+function createIdMetadataPreparationCoordinator(load = async (input) => (await import("./deepsightLoader-DMxtowCm.esm.js")).loadDeepsightSession(input)) {
 	let disposed = false;
 	let preparation;
 	let service;
+	let failure;
 	const prepare = (input) => {
 		if (disposed) return Promise.reject(/* @__PURE__ */ new Error("ID metadata coordinator is disposed"));
-		preparation ??= (async () => {
-			const prepared = await load(input);
-			if (disposed) {
-				cleanup(prepared);
-				throw new Error("ID metadata coordinator is disposed");
-			}
-			service = prepared;
-			return prepared;
-		})();
+		if (!preparation) {
+			const pending = (async () => {
+				const prepared = await load(input);
+				if (disposed) {
+					cleanup(prepared);
+					throw new Error("ID metadata coordinator is disposed");
+				}
+				service = prepared;
+				return prepared;
+			})();
+			preparation = pending;
+			pending.catch((error) => {
+				if (preparation === pending) failure = { error };
+			});
+		}
 		return preparation;
 	};
 	return {
@@ -1885,10 +2503,19 @@ function createIdMetadataPreparationCoordinator(load = async (input) => (await i
 			prepare(input).catch(() => void 0);
 		},
 		prepare,
+		/**
+		* The memoized preparation's rejection once it has settled. `undefined`
+		* while it is pending or after it succeeded. Preparation is never retried,
+		* so a failure here fails every later attempt of this capture too.
+		*/
+		settledFailure() {
+			return failure;
+		},
 		dispose() {
 			if (disposed) return;
 			disposed = true;
 			preparation = void 0;
+			failure = void 0;
 			const prepared = service;
 			service = void 0;
 			if (prepared) cleanup(prepared);
@@ -1981,18 +2608,18 @@ function streamUsesBackCamera(stream) {
 	if (isBackCameraLabel(label)) return true;
 	if (label.includes("front") || label.includes("user")) return false;
 }
+/** The tutorial pre-acquire's default work: have the ID pipeline loaded. */
+const warmupIdPipeline = () => ensureWasmPipelines(["idCapture"]);
 function createIdProtectedCaptureController(dependencies = {}) {
 	const metadataCoordinator = createIdMetadataPreparationCoordinator(dependencies.loadMetadata);
 	let disposed = false;
 	let visible = true;
 	let preAcquired;
 	let preAcquirePromise;
-	let preAcquireGeneration = 0;
 	let provider;
 	let displayStream;
 	let frameCapturer;
 	let captureResolution;
-	let cameraFallbackLevel;
 	let usingBackCamera;
 	let previewImageUrl;
 	let pendingPreviewCanvas;
@@ -2042,23 +2669,21 @@ function createIdProtectedCaptureController(dependencies = {}) {
 		releasePreAcquired();
 		preAcquired = value;
 		captureResolution = streamResolution(value.stream);
-		cameraFallbackLevel = value.fallbackLevel;
 		usingBackCamera = streamUsesBackCamera(value.stream);
 		return true;
 	};
+	/**
+	* Overlaps the ID pipeline warm-up with the tutorial so the attempt's
+	* `configureWorkflow` finds it loaded. Nothing here opens a camera: since
+	* ml-wasm-kit v2.14.52 the kit acquires it inside the protected camera step.
+	* In-flight calls are deduplicated; the warm-up itself is idempotent.
+	*/
 	const preAcquire = () => {
 		if (disposed) return Promise.reject(/* @__PURE__ */ new Error("ID protected capture controller is disposed"));
-		if (preAcquired) return Promise.resolve();
 		if (preAcquirePromise) return preAcquirePromise;
-		const generation = preAcquireGeneration;
 		const pending = (async () => {
-			const value = await (dependencies.acquireCamera ?? getIdCameraStream)();
-			if (disposed || generation !== preAcquireGeneration) {
-				stopStream(value.stream);
-				if (disposed) throw new Error("ID protected capture controller is disposed");
-				return;
-			}
-			acceptPreAcquired(value);
+			await (dependencies.warmupPipelines ?? warmupIdPipeline)();
+			if (disposed) throw new Error("ID protected capture controller is disposed");
 		})();
 		preAcquirePromise = pending;
 		pending.then(() => {
@@ -2148,6 +2773,7 @@ function createIdProtectedCaptureController(dependencies = {}) {
 		beginAttempt(context, send, getLiveContext) {
 			if (disposed) throw new Error("ID protected capture controller is disposed");
 			clearAttempt();
+			usingBackCamera = getDeviceClass() !== "desktop";
 			if (stepRecording.session && stepRecording.scope !== recordingScopeFor(context)) completeStepRecording();
 			diagnosticAttempt = {
 				attempt: ++protectedIdAttemptSequence,
@@ -2158,7 +2784,6 @@ function createIdProtectedCaptureController(dependencies = {}) {
 			attemptSend = send;
 			getAttemptLiveContext = getLiveContext;
 			provider = (dependencies.createProvider ?? createProtectedIdProvider)(context.config, context.currentMode);
-			cycleOwnership = createCameraCycleOwnership(cameraCycleProvider);
 			logDiagnostic("attempt-start", { aggregationMs: context.config?.thresholds?.framesAggregationInterval ?? DEFAULT_ID_CAPTURE_THRESHOLDS.framesAggregationInterval });
 			noteTrueSightCaptureActivity(true);
 		},
@@ -2171,6 +2796,9 @@ function createIdProtectedCaptureController(dependencies = {}) {
 				disableIpify: context.disableIpify
 			});
 		},
+		settledMetadataFailure() {
+			return metadataCoordinator.settledFailure();
+		},
 		prepareMetadata(context) {
 			const storage = context.dependencies?.storage;
 			if (!storage) return Promise.reject(/* @__PURE__ */ new Error("ID metadata storage is unavailable"));
@@ -2184,7 +2812,6 @@ function createIdProtectedCaptureController(dependencies = {}) {
 		dispose() {
 			if (disposed) return;
 			disposed = true;
-			preAcquireGeneration += 1;
 			metadataCoordinator.dispose();
 			releasePreAcquired();
 			clearAttempt();
@@ -2218,27 +2845,26 @@ function createIdProtectedCaptureController(dependencies = {}) {
 			return visible;
 		},
 		storePreAcquiredStream(value) {
-			preAcquireGeneration += 1;
 			return acceptPreAcquired(value);
 		},
 		takePreAcquiredStream() {
 			const value = preAcquired;
 			preAcquired = void 0;
-			if (value) cameraFallbackLevel = value.fallbackLevel;
 			return value;
 		},
 		getProvider() {
 			return provider;
 		},
 		getCycleOwnership() {
-			if (!cycleOwnership) throw new Error("Protected ID cycle ownership is unavailable");
+			if (!attemptContext) throw new Error("Protected ID cycle ownership is unavailable");
+			cycleOwnership ??= createCameraCycleOwnership(cameraCycleProvider);
 			return cycleOwnership;
 		},
 		getProjection() {
 			return {
 				stream: displayStream,
 				captureResolution,
-				cameraFallbackLevel,
+				cameraFallbackLevel: void 0,
 				usingBackCamera
 			};
 		},
@@ -2287,14 +2913,12 @@ function createIdProtectedCaptureController(dependencies = {}) {
 				type,
 				qualityElements: context.qualityElements,
 				onProgress,
-				deepsightService: void 0,
 				stream: displayStream,
 				isSecondId: context.config.isSecondId ?? false,
 				onlyFront: type === "front" && (context.config.onlyFront ?? false),
 				ageAssurance: context.config.ageAssurance,
 				dependencies: context.dependencies,
 				captureResolution,
-				cameraFallbackLevel,
 				extractIdFace: context.config.extractIdFace,
 				croppedCanvas: provider?.getCapturedCanvas() ?? null
 			};
@@ -2313,12 +2937,18 @@ function createIdProtectedCaptureController(dependencies = {}) {
 		},
 		async deliverCaptureOnly(signal) {
 			if (!dependencies.finalizeCaptureOnly || !attemptContext || !attemptSend) throw new Error(ID_ERROR_CODES.UPLOAD_ERROR);
-			return dependencies.finalizeCaptureOnly(controller.buildCaptureOnlyUpload(attemptContext, (progress) => {
+			const upload = controller.buildCaptureOnlyUpload(attemptContext, (progress) => {
 				attemptSend?.({
 					type: "UPLOAD_PROGRESS",
 					progress
 				});
-			}), signal);
+			});
+			const deepsightService = await controller.prepareMetadata(attemptContext).catch(() => void 0);
+			if (signal.aborted) throw new DOMException("Aborted", "AbortError");
+			return dependencies.finalizeCaptureOnly({
+				...upload,
+				deepsightService
+			}, signal);
 		},
 		resourceSink: {
 			ready(stream) {
@@ -2327,10 +2957,7 @@ function createIdProtectedCaptureController(dependencies = {}) {
 					return;
 				}
 				replaceDisplayStream(stream);
-				logDiagnostic("protected-camera-ready", {
-					...getIdCameraTrackDiagnosticFields(stream.getVideoTracks()[0]),
-					fallbackLevel: cameraFallbackLevel
-				});
+				logDiagnostic("protected-camera-ready", getIdCameraTrackDiagnosticFields(stream.getVideoTracks()[0]));
 			},
 			autoCommitted: storeCommit,
 			manualCommitted: storeCommit,
@@ -2775,48 +3402,34 @@ function createProtectedIdAttemptInput(input) {
 	const target = resolveProtectedIdTarget(context.config, context.currentMode);
 	const callbackSession = createProtectedIdCallbackSession(input);
 	let wasmUtil;
-	const preAcquired = controller.takePreAcquiredStream();
-	let selectedVideoTrack = preAcquired?.stream.getVideoTracks()[0];
-	const constraints = getCameraReacquisitionConstraints(selectedVideoTrack, preAcquired?.constraints);
 	const captureOnly = hasOnCaptureCallback(context.config);
 	const diagnosticAttempt = controller.getDiagnosticAttempt();
 	const isAttemptActive = () => !controller.disposed && controller.getProvider() === provider && controller.getDiagnosticAttempt() === diagnosticAttempt;
-	const logSelectedCamera = (stream, fallbackLevel, reacquisitionConstraints, preAcquiredStream) => {
-		if (!diagnosticAttempt) return;
-		logIdCameraDiagnostic("selected-camera", {
-			attempt: diagnosticAttempt.attempt,
-			side: diagnosticAttempt.side,
-			elapsedMs: Math.round(getTimestamp() - diagnosticAttempt.startedAt),
-			...getIdCameraTrackDiagnosticFields(stream.getVideoTracks()[0]),
-			preAcquired: preAcquiredStream,
-			fallbackLevel,
-			workflow: String(workflow),
-			devicePinned: reacquisitionConstraints?.deviceId !== void 0
-		});
-	};
-	if (preAcquired) logSelectedCamera(preAcquired.stream, preAcquired.fallbackLevel, constraints, true);
+	let cameraStepFacts = {};
 	return {
 		attemptId: `protected-id-${diagnosticAttempt?.attempt ?? ++protectedIdAttemptSequence}`,
 		target,
 		workflow,
-		streamSource: preAcquired ? {
-			kind: "preAcquired",
-			stream: preAcquired.stream,
-			constraints
-		} : {
-			kind: "acquire",
-			async acquire() {
-				await controller.preAcquire();
-				const adopted = controller.takePreAcquiredStream();
-				if (!adopted) throw new Error("Protected ID stream acquisition was cancelled");
-				selectedVideoTrack = adopted.stream.getVideoTracks()[0];
-				const reacquisitionConstraints = getCameraReacquisitionConstraints(selectedVideoTrack, adopted.constraints);
-				logSelectedCamera(adopted.stream, adopted.fallbackLevel, reacquisitionConstraints, false);
-				return {
-					stream: adopted.stream,
-					constraints: reacquisitionConstraints
-				};
-			}
+		preflight: captureOnly ? void 0 : () => {
+			const failure = controller.settledMetadataFailure();
+			if (failure) throw failure.error;
+		},
+		cameraStep: async () => {
+			const di = await electDesktopCameraDevice("environment");
+			const hs = controller.takePreAcquiredStream()?.stream;
+			cameraStepFacts = {
+				preAcquired: hs !== void 0,
+				devicePinned: di !== ""
+			};
+			return {
+				vs: "environment",
+				di,
+				ew: 0,
+				eh: 0,
+				i14: isIPhone14OrHigher(),
+				pa: false,
+				hs
+			};
 		},
 		initiallyBackgrounded: !controller.isVisible(),
 		resourceSink: controller.resourceSink,
@@ -2830,13 +3443,11 @@ function createProtectedIdAttemptInput(input) {
 			enabled: !captureOnly,
 			stepRecording: controller.getStepRecording()
 		}),
-		releaseUnadoptedStream: stopStream,
-		beforeAdopt: captureOnly ? void 0 : async (stream) => {
-			const track = stream.getVideoTracks()[0];
-			if (!track) throw new Error("Protected ID camera has no selected video track");
+		afterReady: captureOnly ? void 0 : async (displayStream) => {
 			const metadata = await controller.prepareMetadata(context);
 			if (!isAttemptActive()) return;
-			await metadata.checkVirtualCamera(track);
+			const track = displayStream.getVideoTracks()[0];
+			if (track) await metadata.checkVirtualCamera(track);
 		},
 		onStartupTiming(timing) {
 			if (!diagnosticAttempt) return;
@@ -2844,6 +3455,8 @@ function createProtectedIdAttemptInput(input) {
 				attempt: diagnosticAttempt.attempt,
 				side: diagnosticAttempt.side,
 				elapsedMs: Math.round(getTimestamp() - diagnosticAttempt.startedAt),
+				workflow: String(workflow),
+				...cameraStepFacts,
 				...timing
 			});
 		},
@@ -2862,12 +3475,6 @@ function createProtectedIdAttemptInput(input) {
 				callbacks: callbackSession.callbacks
 			});
 		},
-		async runPrc() {
-			if (!isAttemptActive()) return;
-			wasmUtil = await (input.getWasmUtil ?? WasmUtilProvider.getInstance)();
-			if (!isAttemptActive()) return;
-			await wasmUtil.prc();
-		},
 		async runPoc() {
 			if (captureOnly) return;
 			if (!isAttemptActive()) return;
@@ -2911,385 +3518,53 @@ function createProtectedIdAttemptInput(input) {
 					if (isAttemptActive()) trueSightLog("warning", "deepsight", "idScan", "protected capture diagnostics failed");
 				}
 			}
-		}
-	};
-}
-function protectedIdResultToCaptureResponse(result) {
-	const regulationType = result.regulationType === "US" || result.regulationType === "Worldwide" || result.regulationType === "Other" || result.regulationType === "US_Illinois" || result.regulationType === "US_Texas" || result.regulationType === "US_California" || result.regulationType === "US_Washington" ? result.regulationType : void 0;
-	return {
-		sharpness: result.sharpness ?? 0,
-		correctSharpness: result.sharpness != null && result.sharpness >= 10,
-		glare: result.glare ?? 0,
-		correctGlare: result.glare != null && result.glare >= 10,
-		horizontalResolution: 0,
-		classification: result.classification === true,
-		readability: result.readability === true,
-		typeOfId: result.typeOfId ?? "",
-		issueYear: 0,
-		issueName: "",
-		sessionStatus: result.sessionStatus ?? "",
-		countryCode: result.countryCode ?? "",
-		skipBackIdCapture: result.skipBackIdCapture,
-		skipGlareFront: result.skipGlareFront,
-		skipGlareBack: result.skipGlareBack,
-		acceptedDocuments: result.acceptedDocuments ? [...result.acceptedDocuments] : void 0,
-		forceFrontIdCapture: result.forceFrontIdCapture,
-		idValidationCompleted: result.idValidationCompleted,
-		showMandatoryConsent: result.showMandatoryConsent,
-		regulationType,
-		failReason: result.failReason,
-		side: result.side,
-		idQualityAttemptApproved: result.idQualityAttemptApproved,
-		isDocumentExpired: result.isDocumentExpired,
-		success: result.success
-	};
-}
-function getProtectedIdUploadRequest(context, sessionToken = getToken()) {
-	const target = resolveProtectedIdTarget(context.config, context.currentMode);
-	const front = context.currentMode !== "back";
-	const params = { captureType: context.manualCaptureTriggered ? "MANUAL" : "AUTO" };
-	if (front && context.config.onlyFront === true) params.onlyFront = true;
-	if (front && context.config.extractIdFace === false) params.extractIdFace = false;
-	const sharpness = context.qualityElements?.sharpness;
-	if (sharpness !== void 0 && sharpness !== 0 && Number.isFinite(sharpness)) params.sharpness = getRealQualityValue(sharpness);
-	return {
-		target,
-		config: {
-			...sessionToken ? { headers: { "X-Incode-Hardware-Id": sessionToken } } : {},
-			params
-		}
-	};
-}
-//#endregion
-//#region src/modules/id/digitalIdRegistry.ts
-/**
-* True when a digital-ID method uses a full-page web-redirect flow (Trinsic
-* iDIN/FTN). Accepts both the module `FlowType` value (`REDIRECT`) and the
-* backend value (`WEB_REDIRECT`). (Lives here rather than in
-* `idCaptureHelpers` to keep the registry free of circular imports; the
-* helpers re-export it.)
-*/
-function isRedirectFlowType(flowType) {
-	return flowType === "REDIRECT" || flowType === "WEB_REDIRECT";
-}
-const DIGITAL_ID_REGISTRY = {
-	mDL: [{
-		kind: "incodeWallet",
-		documentType: "digitalId"
-	}, {
-		kind: "trinsicRedirect",
-		documentType: "digitalIdRedirect",
-		providerId: "trinsic_mdl_placeholder",
-		method: "MDL"
-	}],
-	iDIN: [{
-		kind: "trinsicRedirect",
-		documentType: "digitalIdRedirect",
-		providerId: "trinsic_netherlands_idin",
-		method: "IDIN"
-	}],
-	FTN: [{
-		kind: "trinsicRedirect",
-		documentType: "digitalIdRedirect",
-		providerId: "trinsic_finnish_trust_network",
-		method: "FTN"
-	}]
-};
-const DIGITAL_ID_DOCUMENT_TYPES = Object.keys(DIGITAL_ID_REGISTRY);
-/**
-* Single place that widens `config.digitalIds` to the shapes the backend
-* actually sends — the mapped array or the raw `{ enabled, methods }` object.
-* Shared so the cast is written once.
-*/
-function asDigitalIdsConfig(config) {
-	return config.digitalIds;
-}
-/**
-* Persisted method name → catalog provider id, derived from the registry's
-* Trinsic entries (single source of truth). Lets the SDK launch iDIN / FTN
-* from a backend that does not yet send `providerId` on each method.
-* TODO(roadmap: fully-catalog-driven): remove once every backend enriches
-* `digitalIds.methods[]` with `providerId` + `flowType`.
-*/
-const REDIRECT_PROVIDER_BY_METHOD = (() => {
-	const map = {};
-	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) for (const entry of DIGITAL_ID_REGISTRY[docType]) if (entry.kind === "trinsicRedirect") map[entry.method] = entry.providerId;
-	return map;
-})();
-/**
-* Redirect providers that are the fallback leg of a wallet-first funnel
-* (mDL): they are reached through the `digitalId` tile's funnel resolution,
-* not offered as a standalone chooser card.
-*/
-const WALLET_FUNNEL_REDIRECT_PROVIDER_IDS = new Set(DIGITAL_ID_DOCUMENT_TYPES.flatMap((docType) => {
-	const entries = DIGITAL_ID_REGISTRY[docType];
-	if (!entries.some((entry) => entry.kind === "incodeWallet")) return [];
-	return entries.flatMap((entry) => entry.kind === "trinsicRedirect" ? [entry.providerId] : []);
-}));
-/**
-* True for a redirect provider that gets its own chooser card (iDIN, FTN, any
-* catalog-enriched redirect method) — as opposed to the mDL wallet fallback,
-* which only surfaces through the Digital ID tile.
-*/
-function isStandaloneRedirectProvider(providerId) {
-	return !WALLET_FUNNEL_REDIRECT_PROVIDER_IDS.has(providerId);
-}
-/**
-* The provider id a configured method launches with, when it is a
-* web-redirect method; `undefined` for wallets / other flow shapes.
-*
-* Resolution order:
-* 1. an explicit redirect `flowType` with a `provider` (mapped shape) or
-*    `providerId` (catalog-enriched raw shape) — backend-authoritative;
-* 2. otherwise the persisted method name via the registry (legacy raw shape).
-*/
-function resolveRedirectProviderId(method) {
-	if (method.flowType) {
-		if (!isRedirectFlowType(method.flowType)) return;
-		const explicit = method.provider ?? method.providerId;
-		if (explicit) return explicit;
-	}
-	return method.method ? REDIRECT_PROVIDER_BY_METHOD[method.method.toUpperCase()] : void 0;
-}
-/**
-* Tolerant view over `config.digitalIds`: accepts both the mapped array
-* (`IdCaptureDigitalIdMethod[]`) and the raw backend object
-* (`{ enabled, methods: [...] }`). Extracted from the old
-* `getDigitalIdRedirectMethod` cast so every consumer parses it the same way.
-*
-* Honors both dashboard toggles: a raw object with `enabled: false` yields no
-* methods, and individual methods with `enabled: false` are dropped (absent
-* `enabled` counts as on). This is what "enabled for the flow / workflow"
-* means — for the redirect chooser cards as much as for the wallet tile.
-*/
-function normalizeDigitalIdMethods(config) {
-	const raw = asDigitalIdsConfig(config);
-	if (!Array.isArray(raw) && raw?.enabled === false) return [];
-	return (Array.isArray(raw) ? raw : raw?.methods ?? []).filter((method) => method.enabled !== false);
-}
-/**
-* Persisted method names of the Incode-native device wallets — the backend
-* `DigitalIdMethodCatalog` entries of type `MDL`. A catalog-enriched method
-* carries `type: 'MDL'` instead of relying on the name; both are honoured.
-*/
-const DEVICE_WALLET_METHODS = /* @__PURE__ */ new Set([
-	"APPLE_WALLET",
-	"GOOGLE_WALLET",
-	"CA_DMV_WALLET"
-]);
-/**
-* True for a configured method the native device-wallet handshake can fulfil.
-* Redirect methods (iDIN, FTN) never count, whatever their name or type — they
-* must not surface a wallet tile with no wallet behind it.
-*
-* Classifies by *kind* only. Whether a method is switched on is already
-* settled by `normalizeDigitalIdMethods`, which drops disabled methods before
-* any caller walks the list.
-*/
-function isDeviceWalletMethod(method) {
-	if (method.flowType && isRedirectFlowType(method.flowType)) return false;
-	if (method.type?.toUpperCase() === "MDL") return true;
-	return method.method !== void 0 && DEVICE_WALLET_METHODS.has(method.method.toUpperCase());
-}
-/**
-* Whether a device wallet is enabled for this ID-capture config: the coarse
-* `deviceWallet` flag, or an enabled wallet method in `config.digitalIds`.
-*
-* The dashboard persists a wallet only in `digitalIds.methods` and leaves the
-* legacy `deviceWallet` / `appleWallet` booleans at their stored `false`. The
-* backend derives the booleans from `digitalIds` for the flow response, but
-* the workflow-node response historically shipped them raw — so a workflow
-* with Apple Wallet enabled arrived here as `deviceWallet: false`, and the
-* tile was dropped while SDK 1 (which reads `digitalIds` itself) showed it.
-* Mirrors the backend's own `deriveDeviceWalletFlag`, minus its "unknown
-* method counts as a wallet" fallback: an unrecognised method must not
-* launch a handshake that cannot know what to request.
-*/
-function isDeviceWalletEnabled(config) {
-	if (config.deviceWallet === true) return true;
-	return hasEnabledDeviceWalletMethod(config);
-}
-/** Whether a funnel entry is activated by config + platform capabilities. */
-function isEntryActive(entry, config, platform) {
-	if (entry.kind === "incodeWallet") return isDeviceWalletEnabled(config) && platform.credentialsAvailable;
-	return findConfiguredMethod(entry, config) !== void 0;
-}
-/**
-* The configured `digitalIds` method matching a Trinsic funnel entry — by
-* persisted method name, or (mapped shape) by provider id on a redirect
-* flowType. First match wins; disabled methods are already dropped by
-* `normalizeDigitalIdMethods`.
-*/
-function findConfiguredMethod(entry, config) {
-	return normalizeDigitalIdMethods(config).find((method) => method.method?.toUpperCase() === entry.method || method.provider === entry.providerId && !!method.flowType && isRedirectFlowType(method.flowType));
-}
-/** Normalizes a raw configured method into the mapped shape for the child input. */
-function toMappedMethod(entry, method) {
-	if (method.flowType && isRedirectFlowType(method.flowType)) return method;
-	return {
-		method: method.method,
-		provider: entry.providerId,
-		flowType: "WEB_REDIRECT",
-		country: method.country ?? method.countries?.[0],
-		displayName: method.displayName,
-		logoUrl: method.logoUrl
+		}
 	};
 }
-/**
-* True when `config.digitalIds` carries a device-wallet method that is switched
-* on, honouring both dashboard toggles: the `digitalIds.enabled` master switch
-* and each method's own `enabled` flag. An absent `enabled` counts as on, the
-* tolerant reading the rest of this module uses.
-*
-* Both toggles are applied by `normalizeDigitalIdMethods`, so this only has to
-* ask whether any surviving method is a wallet.
-*/
-function hasEnabledDeviceWalletMethod(config) {
-	return normalizeDigitalIdMethods(config).some(isDeviceWalletMethod);
-}
-/**
-* Resolves the implementation that should fulfil a digital-ID document type:
-* the first funnel entry that is active under the given config and platform.
-* `undefined` when nothing can run it (the chooser then shows no tile for it).
-*/
-function resolveDigitalIdImplementation(docType, config, platform) {
-	for (const entry of DIGITAL_ID_REGISTRY[docType]) {
-		if (!isEntryActive(entry, config, platform)) continue;
-		if (entry.kind === "incodeWallet") return { kind: "incodeWallet" };
-		const method = findConfiguredMethod(entry, config);
-		return {
-			kind: "trinsicRedirect",
-			providerId: entry.providerId,
-			method: method ? toMappedMethod(entry, method) : void 0
-		};
-	}
-}
-//#endregion
-//#region src/modules/id/idCaptureHelpers.ts
-/**
-* Normalizes a configured method into the mapped redirect shape for a
-* resolved provider. The already-mapped shape is returned as-is; the raw
-* backend shape gets `provider` + `WEB_REDIRECT` filled in.
-*/
-function toRedirectMethod(method, provider) {
-	if (method.provider && method.flowType) return method;
+function protectedIdResultToCaptureResponse(result) {
+	const regulationType = result.regulationType === "US" || result.regulationType === "Worldwide" || result.regulationType === "Other" || result.regulationType === "US_Illinois" || result.regulationType === "US_Texas" || result.regulationType === "US_California" || result.regulationType === "US_Washington" ? result.regulationType : void 0;
 	return {
-		method: method.method,
-		provider,
-		flowType: "WEB_REDIRECT",
-		country: method.country ?? method.countries?.[0],
-		displayName: method.displayName,
-		logoUrl: method.logoUrl
+		sharpness: result.sharpness ?? 0,
+		correctSharpness: result.sharpness != null && result.sharpness >= 10,
+		glare: result.glare ?? 0,
+		correctGlare: result.glare != null && result.glare >= 10,
+		horizontalResolution: 0,
+		classification: result.classification === true,
+		readability: result.readability === true,
+		typeOfId: result.typeOfId ?? "",
+		issueYear: 0,
+		issueName: "",
+		sessionStatus: result.sessionStatus ?? "",
+		countryCode: result.countryCode ?? "",
+		skipBackIdCapture: result.skipBackIdCapture,
+		skipGlareFront: result.skipGlareFront,
+		skipGlareBack: result.skipGlareBack,
+		acceptedDocuments: result.acceptedDocuments ? [...result.acceptedDocuments] : void 0,
+		forceFrontIdCapture: result.forceFrontIdCapture,
+		idValidationCompleted: result.idValidationCompleted,
+		showMandatoryConsent: result.showMandatoryConsent,
+		regulationType,
+		failReason: result.failReason,
+		side: result.side,
+		idQualityAttemptApproved: result.idQualityAttemptApproved,
+		isDocumentExpired: result.isDocumentExpired,
+		success: result.success
 	};
 }
-/**
-* The enabled web-redirect digital-ID method to launch — the one matching
-* `providerId` when given (a chooser card was picked), else the first
-* configured redirect method — or `undefined` when none is configured.
-* Drives the provider and country passed to the `digitalIdRedirectMachine`.
-*
-* Accepts both the mapped array (`IdCaptureDigitalIdMethod[]`) and the raw
-* backend `configuration.digitalIds` object (`{ enabled, methods: [...] }`);
-* for the raw shape the provider comes from the backend-enriched
-* `providerId`/`flowType` when present, else from the persisted method name
-* via the digital-ID registry (`IDIN` → `trinsic_netherlands_idin`).
-*/
-function getDigitalIdRedirectMethod(config, providerId) {
-	for (const method of normalizeDigitalIdMethods(config)) {
-		const provider = resolveRedirectProviderId(method);
-		if (!provider || providerId !== void 0 && provider !== providerId) continue;
-		return toRedirectMethod(method, provider);
-	}
-}
-/**
-* The digital-ID web-redirect providers that get their own chooser card: one
-* per enabled redirect method in `config.digitalIds`, in backend (dashboard)
-* order, deduped by provider. Wallet-funnel fallbacks (the Trinsic mDL leg)
-* are excluded — they surface through the Digital ID tile instead.
-*
-* Card display data (`displayName`, `logoUrl`, `country`) is whatever the
-* backend enriched the method with; the UI falls back to generic copy / icon
-* when absent.
-*/
-function getAvailableDigitalIdRedirectOptions(config) {
-	const options = [];
-	for (const method of normalizeDigitalIdMethods(config)) {
-		const providerId = resolveRedirectProviderId(method);
-		if (!providerId || !isStandaloneRedirectProvider(providerId) || options.some((option) => option.providerId === providerId)) continue;
-		options.push({
-			providerId,
-			method: method.method,
-			displayName: method.displayName,
-			logoUrl: method.logoUrl,
-			country: method.country ?? method.countries?.[0]
-		});
-	}
-	return options;
-}
-/**
-* Map of config properties received from the backend to adjusted, internal document types.
-*/
-const DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP = [
-	["enableId", "id"],
-	["enablePassport", "passport"],
-	["digitalIdsUpload", "digitalIdUpload"]
-];
-/**
-* Returns the list of document types enabled by config for the chooser screen, in display order.
-* Used to populate chooser state so UI and headless consumers can render the correct options.
-*
-* Digital-ID document types (device wallet, Trinsic web-redirect) come from
-* the digital-ID registry funnel: each registry document type contributes the
-* tile of its first active implementation. A `deviceWallet: true` config on a
-* platform without the Credentials API therefore shows the Trinsic fallback
-* tile when one is configured — or no tile at all, instead of a dead-end one.
-*
-* @param config - ID capture configuration (from flow or init)
-* @param platform - Platform capabilities consulted by the digital-ID funnel.
-*   Defaults to no Credentials API for pure-node callers; the machine passes
-*   the real capability check.
-* @returns Array of IdDocumentType values that should be shown in the document type chooser
-*/
-function getAvailableDocumentTypes(config, platform = { credentialsAvailable: false }) {
-	const adjustedDocumentTypes = [];
-	for (const [configProperty, adjustedType] of DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP) if (config[configProperty]) adjustedDocumentTypes.push(adjustedType);
-	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) {
-		const route = resolveDigitalIdImplementation(docType, config, platform);
-		if (!route) continue;
-		const documentType = route.kind === "incodeWallet" ? "digitalId" : "digitalIdRedirect";
-		if (!adjustedDocumentTypes.includes(documentType)) adjustedDocumentTypes.push(documentType);
-	}
-	if (!adjustedDocumentTypes.includes("digitalIdRedirect") && getAvailableDigitalIdRedirectOptions(config).length > 0) adjustedDocumentTypes.push("digitalIdRedirect");
-	return adjustedDocumentTypes;
-}
-/**
-* Computes `idCaptureMachine`'s terminal output — the downstream module-skip
-* signal read by the Flow orchestrator (via `runChildModule`'s `MODULE_COMPLETE`).
-*
-* `skipFaceMatch` is set ONLY for the US Smart Capture *camera back-only* path:
-* a back image was captured on-device (`capturedImages.back`) and no front was
-* (`!capturedImages.front`) — "no front, no ID face, no match".
-*
-* Requiring a captured back is deliberate and load-bearing: the digital-ID
-* upload path submits a full ID (front face present) but does NOT
-* populate `capturedImages` (only the camera path does). Gating on a captured
-* back excludes those upload paths so a real ID-vs-selfie match is never
-* silently skipped. `capturedImages.front`/`forceFrontIdCapture` alone are not
-* enough (a later front upload clears the request; uploads set neither field).
-*
-* Always `false` outside US Smart Capture. The selfie/face capture itself is
-* unaffected — only the ID-vs-selfie match is skipped.
-*
-* Also `true` on the Digital ID web-redirect (Trinsic iDIN/FTN) COMPLETED path
-* when the scheme returned no portrait (`isDigitalIdRedirect && !portraitPresent`,
-* FM-1/FM-2): there is no ID face to match the selfie against.
-*/
-function computeIdCaptureOutput(context) {
-	const frontIdCaptured = Boolean(context.capturedImages.front);
-	const backIdCaptured = Boolean(context.capturedImages.back);
+function getProtectedIdUploadRequest(context, sessionToken = getToken()) {
+	const target = resolveProtectedIdTarget(context.config, context.currentMode);
+	const front = context.currentMode !== "back";
+	const params = { captureType: context.manualCaptureTriggered ? "MANUAL" : "AUTO" };
+	if (front && context.config.onlyFront === true) params.onlyFront = true;
+	if (front && context.config.extractIdFace === false) params.extractIdFace = false;
+	const sharpness = context.qualityElements?.sharpness;
+	if (sharpness !== void 0 && sharpness !== 0 && Number.isFinite(sharpness)) params.sharpness = getRealQualityValue(sharpness);
 	return {
-		frontIdCaptured,
-		skipFaceMatch: context.isDigitalIdRedirect === true && context.portraitPresent !== true || context.config.usSmartCapture === true && backIdCaptured && !frontIdCaptured
+		target,
+		config: {
+			...sessionToken ? { headers: { "X-Incode-Hardware-Id": sessionToken } } : {},
+			params
+		}
 	};
 }
 //#endregion
@@ -3834,12 +4109,8 @@ const idCaptureMachine = setup({
 		digitalUploadMachine,
 		digitalIdRedirectMachine,
 		deviceWalletMachine,
-		readPendingDigitalIdRedirect: fromPromise(async ({ input }) => {
-			const pending = await readPendingRedirect(input.storage);
-			if (!pending) return null;
-			await clearPendingRedirect(input.storage);
-			return pending;
-		})
+		readPendingDigitalIdRedirect: fromPromise(({ input }) => readPendingRedirect(input.storage)),
+		detectCountries: fromPromise(({ input, signal }) => detectDigitalIdCountries(input.dependencies, { signal }))
 	},
 	actions: {
 		attachProtectedController: assign(({ self }) => {
@@ -3847,7 +4118,7 @@ const idCaptureMachine = setup({
 			return {};
 		}),
 		startProtectedMetadataPreparation: ({ context, self }) => {
-			if (!hasOnCaptureCallback(context.config)) getIdProtectedCaptureController(self).startMetadataPreparation(context);
+			getIdProtectedCaptureController(self).startMetadataPreparation(context);
 		},
 		bindProtectedControllerLifetime: sendTo("protectedControllerLifetime", ({ self }) => ({
 			type: "BIND_PROTECTED_ID_CONTROLLER",
@@ -4229,7 +4500,35 @@ const idCaptureMachine = setup({
 		* it runs inside the tile click's `send()`, preserving the transient
 		* user activation `navigator.credentials.get()` needs on iOS Safari.
 		*/
-		resolveDigitalIdRoute: assign(({ context }) => ({ digitalIdRoute: resolveDigitalIdImplementation("mDL", context.config, { credentialsAvailable: context.dependencies?.credentials?.isAvailable() ?? false }) })),
+		resolveDigitalIdRoute: assign(({ context }) => ({ digitalIdRoute: resolveDigitalIdImplementation("mDL", context.config, getDigitalIdPlatformSupport(context.dependencies?.credentials)) })),
+		/**
+		* Stores the detected countries and re-ranks the redirect options by them
+		* (`getAvailableDigitalIdRedirectOptions`). The option *set* is unchanged —
+		* country only reorders.
+		*/
+		storeDetectedCountries: assign(({ context, event }) => {
+			const countries = event.output ?? [];
+			return {
+				detectedCountries: countries,
+				digitalIdRedirectOptions: getAvailableDigitalIdRedirectOptions(context.config, countries)
+			};
+		}),
+		/**
+		* The user picked a country on the chooser: it becomes the strongest
+		* country, the detected ones stay behind it as tiebreakers, and the
+		* redirect options are re-ranked. An invalid code is ignored.
+		*/
+		setChooserCountry: assign(({ context, event }) => {
+			const country = event.type === "SET_CHOOSER_COUNTRY" ? normalizeCountryCode(event.country) : void 0;
+			if (!country) return {};
+			const countries = [country, ...(context.detectedCountries ?? []).filter((detected) => detected !== country)];
+			return {
+				detectedCountries: countries,
+				digitalIdRedirectOptions: rankDigitalIdRedirectOptions(context.digitalIdRedirectOptions, context.config, countries)
+			};
+		}),
+		/** Detection failed outright: mark it done so it is not retried. */
+		markCountryDetectionFailed: assign({ detectedCountries: () => [] }),
 		/**
 		* Records a completed device-wallet (mDL) handshake from the child's
 		* `onDone` output. Wallet credentials are single-side; the verified
@@ -4271,6 +4570,13 @@ const idCaptureMachine = setup({
 			digitalIdResumeProviderId: () => void 0,
 			digitalIdRoute: () => void 0
 		}),
+		/**
+		* Drops the persisted return-leg record once the digital-ID attempt ends.
+		* Fire-and-forget: a stale record is only read on the host's return route.
+		*/
+		clearPendingDigitalIdRedirect: ({ context }) => {
+			clearPendingRedirect(resolveIdCaptureDependencies(context.dependencies).storage).catch(() => void 0);
+		},
 		incrementProcessingExpiredAttempts: assign(({ context }) => ({ processingExpiredAttempts: context.processingExpiredAttempts + 1 })),
 		setSkipProcessId: assign({ skipProcessId: () => true }),
 		setExpiredFromUpload: assign({ expiredFromUpload: () => true }),
@@ -4283,10 +4589,15 @@ const idCaptureMachine = setup({
 		isCaptureOnlyDelivery: ({ context }) => hasOnCaptureCallback(context.config),
 		isProtectedUploadFailure: ({ event }) => protectedFailure(event)?.failure.stage === "upload",
 		isProtectedManualRefusal: ({ event }) => protectedFailure(event)?.failure.stage === "manualCommit",
+		isProtectedAcquireDenied: ({ event }) => {
+			const failure = protectedFailure(event)?.failure;
+			return failure?.stage === "acquire" && isCameraDenialErrorName(failure.errorName);
+		},
 		canCaptureManuallyDuringDetection: ({ context }) => context.config.showCaptureButtonInAuto === true && context.detectionStatus !== "capturing",
 		hasShowTutorial: hasShowTutorialGuard,
 		hasAgeAssurance: hasAgeAssuranceGuard,
 		hasShowDocumentChooser: hasShowDocumentChooserGuard,
+		needsCountryDetection: needsCountryDetectionGuard,
 		isPermissionGranted: ({ event }) => isPermissionGrantedGuard({ event: asPublicIdEvent(event) }),
 		isReadyForCapture: ({ context, event }) => isReadyForCaptureGuard({
 			context,
@@ -4383,9 +4694,22 @@ const idCaptureMachine = setup({
 	},
 	context: ({ input, self }) => {
 		attachIdProtectedCaptureController(self, createIdProtectedCaptureController());
+		const carried = carryAttempts(input.config.isSecondId ? "secondIdCapture" : "idCapture", self, (s, previous) => {
+			const c = s.context;
+			const child = s.children.digitalIdUpload?.getSnapshot()?.context;
+			const left = Math.min(previous.attemptsRemaining ?? Infinity, c.attemptsRemaining, child?.attemptsRemaining ?? Infinity);
+			return {
+				attemptsRemaining: s.matches("expiredExhausted") || left <= 0 && left < c.config.captureAttempts ? -1 : left,
+				expiredAttempts: Math.max(previous.expiredAttempts ?? 0, c.expiredAttempts),
+				expiredRedirected: c.expiredRedirected,
+				processingExpiredAttempts: c.processingExpiredAttempts,
+				skipProcessId: previous.skipProcessId === true || c.skipProcessId || s.matches("expiredExhausted") && !shouldProcessAfterExhaustionGuard({ context: c })
+			};
+		});
+		const configured = input.config.captureAttempts ?? 1;
 		const config = {
 			...input.config,
-			captureAttempts: input.config.captureAttempts ?? 1
+			captureAttempts: Math.max(0, Math.min(configured, carried.attemptsRemaining ?? configured))
 		};
 		const currentMode = input.config.onlyBack ? "back" : !input.config.enableId && input.config.enablePassport ? "passport" : input.config.usSmartCapture ? "back" : "front";
 		return {
@@ -4409,11 +4733,11 @@ const idCaptureMachine = setup({
 			barcodeFastPathAttempted: false,
 			barcodeFastPathCaptured: false,
 			recordingSession: void 0,
-			attemptsRemaining: config.captureAttempts,
-			expiredAttempts: 0,
-			expiredRedirected: false,
-			processingExpiredAttempts: 0,
-			skipProcessId: input.config.skipProcessId === true,
+			attemptsRemaining: Math.min(config.captureAttempts, carried.attemptsRemaining ?? Infinity),
+			expiredAttempts: carried.expiredAttempts ?? 0,
+			expiredRedirected: carried.expiredRedirected ?? false,
+			processingExpiredAttempts: carried.processingExpiredAttempts ?? 0,
+			skipProcessId: input.config.skipProcessId === true || (carried.attemptsRemaining ?? 0) < 0 && carried.skipProcessId === true,
 			expiredFromUpload: false,
 			isDigitalUpload: false,
 			isDigitalIdRedirect: false,
@@ -4442,8 +4766,10 @@ const idCaptureMachine = setup({
 			dependencies: resolveIdCaptureDependencies(input.dependencies),
 			disableIpify: getDisableIpify(),
 			deepsightInitAttempted: false,
-			availableDocumentTypes: getAvailableDocumentTypes(input.config, { credentialsAvailable: input.dependencies?.credentials?.isAvailable() ?? false }),
+			availableDocumentTypes: getAvailableDocumentTypes(input.config, getDigitalIdPlatformSupport(input.dependencies?.credentials)),
 			digitalIdRedirectOptions: getAvailableDigitalIdRedirectOptions(input.config),
+			detectedCountries: void 0,
+			walletDevice: resolveWalletDevice(),
 			selectedDigitalIdProviderId: void 0,
 			captureResolution: void 0,
 			cameraFallbackLevel: void 0,
@@ -4460,11 +4786,20 @@ const idCaptureMachine = setup({
 				target: "digitalIdRedirectReturning",
 				guard: "hasDigitalIdReturn"
 			},
+			{
+				target: "processing",
+				guard: ({ context }) => context.attemptsRemaining < 0,
+				actions: ["flagIdManualReview", "setForceFinishAfterProcessing"]
+			},
 			{
 				target: "error",
 				guard: "hasNoDocumentTypesAvailable",
 				actions: [() => console.error(ID_CAPTURE_NO_DOCUMENT_TYPES_ERROR), assign({ error: () => ID_CAPTURE_NO_DOCUMENT_TYPES_ERROR })]
 			},
+			{
+				target: "detectingCountry",
+				guard: and(["hasShowDocumentChooser", "needsCountryDetection"])
+			},
 			{
 				target: "chooser",
 				guard: "hasShowDocumentChooser"
@@ -4479,37 +4814,53 @@ const idCaptureMachine = setup({
 			},
 			{ target: "loading" }
 		] } },
-		chooser: { on: { SELECT_DOCUMENT: [
-			{
-				target: "digitalIdRouting",
-				guard: "isDigitalIdSelected",
-				actions: ["setSelectedDocument", "resolveDigitalIdRoute"]
-			},
-			{
-				target: "digitalIdRedirect",
-				guard: "isDigitalIdRedirectSelected",
-				actions: ["setSelectedDocument"]
-			},
-			{
-				target: "digitalIdUpload",
-				guard: "isDigitalIdUploadSelected",
-				actions: ["setSelectedDocument"]
-			},
-			{
-				target: "ageVerification",
-				guard: "hasAgeAssurance",
-				actions: ["setSelectedDocument", "setCurrentMode"]
-			},
-			{
-				target: "tutorial",
-				guard: "hasShowTutorial",
-				actions: ["setSelectedDocument", "setCurrentMode"]
+		detectingCountry: { invoke: {
+			id: "detectCountries",
+			src: "detectCountries",
+			input: ({ context }) => ({ dependencies: context.dependencies?.countryDetection ?? {} }),
+			onDone: {
+				target: "chooser",
+				actions: "storeDetectedCountries"
 			},
-			{
-				target: "loading",
-				actions: ["setSelectedDocument", "setCurrentMode"]
+			onError: {
+				target: "chooser",
+				actions: "markCountryDetectionFailed"
 			}
-		] } },
+		} },
+		chooser: { on: {
+			SET_CHOOSER_COUNTRY: { actions: "setChooserCountry" },
+			SELECT_DOCUMENT: [
+				{
+					target: "digitalIdRouting",
+					guard: "isDigitalIdSelected",
+					actions: ["setSelectedDocument", "resolveDigitalIdRoute"]
+				},
+				{
+					target: "digitalIdRedirect",
+					guard: "isDigitalIdRedirectSelected",
+					actions: ["setSelectedDocument"]
+				},
+				{
+					target: "digitalIdUpload",
+					guard: "isDigitalIdUploadSelected",
+					actions: ["setSelectedDocument"]
+				},
+				{
+					target: "ageVerification",
+					guard: "hasAgeAssurance",
+					actions: ["setSelectedDocument", "setCurrentMode"]
+				},
+				{
+					target: "tutorial",
+					guard: "hasShowTutorial",
+					actions: ["setSelectedDocument", "setCurrentMode"]
+				},
+				{
+					target: "loading",
+					actions: ["setSelectedDocument", "setCurrentMode"]
+				}
+			]
+		} },
 		ageVerification: {
 			entry: "startProtectedMetadataPreparation",
 			on: { NEXT_STEP: [{
@@ -4824,6 +5175,11 @@ const idCaptureMachine = setup({
 						guard: "isProtectedUploadFailure",
 						actions: "setProtectedUploadFailure"
 					},
+					{
+						target: "#idCapture.permissions.denied",
+						guard: "isProtectedAcquireDenied",
+						actions: assign({ permissionResult: () => "denied" })
+					},
 					{
 						target: "#idCapture.error",
 						actions: "setProtectedFailure"
@@ -5475,6 +5831,11 @@ const idCaptureMachine = setup({
 						target: "digitalIdRedirect",
 						actions: ["storePendingDigitalIdRedirect"]
 					},
+					{
+						target: "detectingCountry",
+						guard: and(["hasShowDocumentChooser", "needsCountryDetection"]),
+						actions: ["clearDigitalIdAttempt"]
+					},
 					{
 						target: "chooser",
 						guard: "hasShowDocumentChooser",
@@ -5485,14 +5846,22 @@ const idCaptureMachine = setup({
 						actions: ["clearDigitalIdAttempt"]
 					}
 				],
-				onError: [{
-					target: "chooser",
-					guard: "hasShowDocumentChooser",
-					actions: ["clearDigitalIdAttempt"]
-				}, {
-					target: "loading",
-					actions: ["clearDigitalIdAttempt"]
-				}]
+				onError: [
+					{
+						target: "detectingCountry",
+						guard: and(["hasShowDocumentChooser", "needsCountryDetection"]),
+						actions: ["clearDigitalIdAttempt"]
+					},
+					{
+						target: "chooser",
+						guard: "hasShowDocumentChooser",
+						actions: ["clearDigitalIdAttempt"]
+					},
+					{
+						target: "loading",
+						actions: ["clearDigitalIdAttempt"]
+					}
+				]
 			},
 			on: { QUIT: { target: "closed" } }
 		},
@@ -5525,17 +5894,26 @@ const idCaptureMachine = setup({
 					{
 						guard: "isDigitalIdRedirectCompleted",
 						target: "#idCapture.finished",
-						actions: ["storeDigitalIdRedirectResult"]
+						actions: ["storeDigitalIdRedirectResult", "clearPendingDigitalIdRedirect"]
+					},
+					{
+						target: "detectingCountry",
+						guard: and(["hasShowDocumentChooser", "needsCountryDetection"]),
+						actions: ["clearPendingDigitalIdRedirect"]
 					},
 					{
 						target: "chooser",
-						guard: "hasShowDocumentChooser"
+						guard: "hasShowDocumentChooser",
+						actions: ["clearPendingDigitalIdRedirect"]
 					},
-					{ target: "closed" }
+					{
+						target: "closed",
+						actions: ["clearPendingDigitalIdRedirect"]
+					}
 				],
 				onError: {
 					target: "#idCapture.error",
-					actions: assign({ error: ({ event }) => String(event.error) })
+					actions: [assign({ error: ({ event }) => String(event.error) }), "clearPendingDigitalIdRedirect"]
 				}
 			},
 			on: {
@@ -5615,4 +5993,4 @@ function provideIdProtectedCaptureController(machine, controller) {
 	});
 }
 //#endregion
-export { mapDeviceWalletScreenName as _, isRedirectFlowType as a, createIdCaptureOnlyDeliveryActor as c, captureOnlyNeedsBack as d, hasOnCaptureCallback as f, BrowserDigitalCredentialsProvider as g, createDeviceWalletManager as h, DIGITAL_ID_REGISTRY as i, createIdProtectedCaptureController as l, renderWallet as m, provideIdProtectedCaptureController as n, resolveDigitalIdImplementation as o, pickIdCaptureOnlyConfig as p, DIGITAL_ID_DOCUMENT_TYPES as r, attachIdProtectedCaptureController as s, idCaptureMachine as t, findIdProtectedCaptureController as u, resolveWalletPlatform as v };
+export { mapDeviceWalletScreenName as _, createIdProtectedCaptureController as a, hasOnCaptureCallback as c, DIGITAL_ID_REGISTRY as d, isRedirectFlowType as f, BrowserDigitalCredentialsProvider as g, createDeviceWalletManager as h, createIdCaptureOnlyDeliveryActor as i, pickIdCaptureOnlyConfig as l, renderWallet as m, provideIdProtectedCaptureController as n, findIdProtectedCaptureController as o, resolveDigitalIdImplementation as p, attachIdProtectedCaptureController as r, captureOnlyNeedsBack as s, idCaptureMachine as t, DIGITAL_ID_DOCUMENT_TYPES as u, resolveWalletPlatform as v };