@incodetech/core 2.4.0 → 2.4.1-agentic.1

package/dist/{faceCaptureSetup-TY8RXc2N.esm.js → faceCaptureSetup-ZfiWg0fo.esm.js}

@@ -1,19 +1,20 @@
-import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
-import { r as getToken, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
-import { l as trueSightHintTransition, r as noteTrueSightCaptureActivity, u as trueSightLog, y as isTrueSightTesting } from "./trueSightService-BMT-TubT.esm.js";
-import "./sessionInitializer-BTjYgE-V.esm.js";
-import { t as addDeviceStats } from "./stats-BEvexnKC.esm.js";
-import { t as BrowserLazyImportProvider } from "./BrowserLazyImportProvider-BhoA957O.esm.js";
+import { n as getTimestamp } from "./IBrowserEnvironmentCapability-D7JG7ML3.esm.js";
+import { r as getToken } from "./api-CpP4PS4S.esm.js";
+import { l as trueSightHintTransition, r as noteTrueSightCaptureActivity, u as trueSightLog, y as isTrueSightTesting } from "./trueSightService-GuLthUVK.esm.js";
+import "./sessionInitializer-DsL7X2j9.esm.js";
+import { t as addDeviceStats } from "./stats-CatA2dea.esm.js";
+import { c as isIPhone14OrHigher } from "./platform-aPh7gTWh.esm.js";
 import { i as assign, n as enqueueActions, r as sendTo, t as setup } from "./xstate.esm-DSajW7CJ.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-8Gzepa_A.esm.js";
-import { n as invokeRequestPermissionActor, t as checkPermission } from "./permissionServices-Ca-tSNhT.esm.js";
-import { a as sendLabelInspectionEvent, d as FACE_ERROR_CODES, i as initializeDeepsightSession, r as initializeCamera, s as stopStream, t as FaceDetectionProvider, u as getFaceUploadErrorCode } from "./FaceDetectionProvider-DcPOC2gS.esm.js";
-import { i as flagFaceManualReview, n as runProtectedAttempt, o as PROTECTED_CAPTURE_TARGET, r as cameraCycleProvider, t as createCameraCycleOwnership } from "./createCameraCycleOwnership-Dj_LHUvN.esm.js";
+import { s as isCameraDenialErrorName } from "./camera-E_Kcre4O.esm.js";
+import { n as invokeRequestPermissionActor, t as checkPermission } from "./permissionServices-D190ATGD.esm.js";
+import { a as sendLabelInspectionEvent, i as probeFaceCamera, l as getFaceUploadErrorCode, r as initializeDeepsightSession, t as FaceDetectionProvider, u as FACE_ERROR_CODES } from "./FaceDetectionProvider-CAY43vSI.esm.js";
+import { a as flagFaceManualReview, i as cameraCycleProvider, n as createCameraCycleOwnership, r as runProtectedAttempt, s as PROTECTED_CAPTURE_TARGET, t as electDesktopCameraDevice } from "./desktopCameraElection-BGMtYwk3.esm.js";
 import { n as releaseFaceAvatarWarmup, r as warmFaceAvatar, t as createFaceAvatar } from "./createFaceAvatar-BNHdeFj8.esm.js";
 import { t as IncodeCanvas } from "./canvas-BxFzWTt-.esm.js";
-import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-gcy3U0SL.esm.js";
-import { a as getAdaptiveMediaRecorderOptions, i as createRecordingCompositor, n as WorkerEncoderRecordingProvider, t as MultipartRecordingService } from "./multipartRecordingService-CLwrF5wD.esm.js";
-import { t as getDeviceClass } from "./getDeviceClass-bsWdEDxP.esm.js";
+import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-DFV-Ws0a.esm.js";
+import { t as carryAttempts } from "./attemptCarry-WOkfvFMw.esm.js";
+import { t as getDeviceClass } from "./getDeviceClass-DoIWuKI8.esm.js";
 //#region src/internal/avatar/concealment.ts
 /**
 * Maps a backend concealment option to the internal avatar flags. `OPTION_NONE`
@@ -69,396 +70,6 @@ function logFaceCameraDiagnostic(event, fields) {
 	console.debug(`${FACE_CAMERA_DIAGNOSTIC_PREFIX} ${event} ${JSON.stringify(fields)}`);
 }
 //#endregion
-//#region ../infra/src/media/VideoTrimmer.ts
-/** A trim that runs longer than this uploads the full recording instead. */
-const TRIM_TIMEOUT_MS = 1e4;
-const trimmer = BrowserLazyImportProvider.getInstance().create(() => import("./videoTrimByCopy-BFfAiNpv.esm.js").then((module) => module.trimLastNSecondsByCopy), {
-	label: "Video liveness",
-	moduleName: "mediabunny",
-	timeoutMs: 1e4,
-	disabledMessage: "the full recording will be uploaded untrimmed."
-});
-/** Starts loading the trimmer, e.g. when a recording that will be trimmed starts. */
-function preloadVideoTrimmer() {
-	trimmer.load();
-}
-/**
-* Keeps about the last `seconds` of a recording. Never rejects and never
-* hangs: when the trimmer cannot load, fails, or takes longer than
-* {@link TRIM_TIMEOUT_MS}, it resolves the untrimmed recording.
-*/
-async function trimLastNSeconds(videoBlob, seconds) {
-	const trim = await trimmer.load();
-	if (!trim) return videoBlob;
-	let timeout;
-	try {
-		return await Promise.race([trim(videoBlob, seconds), new Promise((resolve) => {
-			timeout = setTimeout(() => {
-				console.warn("[Video liveness] Trimming timed out; the full recording will be uploaded untrimmed.");
-				resolve(videoBlob);
-			}, TRIM_TIMEOUT_MS);
-		})]);
-	} catch (error) {
-		console.warn("[Video liveness] Trimming failed; the full recording will be uploaded untrimmed.", error);
-		return videoBlob;
-	} finally {
-		clearTimeout(timeout);
-	}
-}
-//#endregion
-//#region ../infra/src/providers/browser/LocalRecordingProvider.ts
-function toBase64(videoBlob) {
-	return new Promise((resolve, reject) => {
-		const reader = new FileReader();
-		reader.onloadend = () => {
-			const base64 = reader.result.split(",")[1];
-			resolve(base64);
-		};
-		reader.onerror = () => reject(reader.error ?? /* @__PURE__ */ new Error("FileReader error"));
-		reader.readAsDataURL(videoBlob);
-	});
-}
-/** `MediaRecorderOptions.videoKeyFrameIntervalDuration`, see `startRecording`. */
-const KEYFRAME_INTERVAL_MS = 1e3;
-var LocalRecordingProvider = class {
-	constructor() {
-		this.mediaRecorder = null;
-		this._isRecording = false;
-		this._hasError = false;
-		this._error = null;
-		this.mimeType = "";
-		this.stream = null;
-		this.pauseRecordingBound = this.pauseRecording.bind(this);
-	}
-	get isRecording() {
-		return this._isRecording;
-	}
-	get hasError() {
-		return this._hasError;
-	}
-	get error() {
-		return this._error;
-	}
-	startRecording(stream) {
-		this.reset();
-		preloadVideoTrimmer();
-		this.registerEventListeners();
-		this.stream = stream;
-		try {
-			const options = getAdaptiveMediaRecorderOptions();
-			this.mimeType = options.mimeType;
-			const recorder = new MediaRecorder(stream.clone(), {
-				...options,
-				videoKeyFrameIntervalDuration: KEYFRAME_INTERVAL_MS
-			});
-			recorder.onerror = (event) => {
-				this._error = `Recording error: ${event}`;
-				this._isRecording = false;
-				this._hasError = true;
-			};
-			recorder.start();
-			this.mediaRecorder = recorder;
-			this._isRecording = true;
-			this._error = null;
-			this._hasError = false;
-		} catch (err) {
-			this._error = `Failed to start recording: ${err}`;
-			this._hasError = true;
-		}
-	}
-	async stopRecording(trimSeconds, encrypt, generateChecksum) {
-		const recorder = this.mediaRecorder;
-		return new Promise((resolve, reject) => {
-			this.removeEventListeners();
-			if (recorder && this._isRecording) {
-				const chunks = [];
-				recorder.ondataavailable = (event) => {
-					if (event.data.size > 0) chunks.push(event.data);
-				};
-				recorder.onstop = async () => {
-					try {
-						const trimmedVideo = await trimLastNSeconds(new Blob(chunks, { type: this.mimeType }), trimSeconds);
-						const encryptedVideoBase64 = encrypt(await toBase64(trimmedVideo));
-						generateChecksum(await trimmedVideo.arrayBuffer());
-						this._isRecording = false;
-						resolve({
-							trimmedBlob: trimmedVideo,
-							encryptedVideo: encryptedVideoBase64
-						});
-					} catch (error) {
-						this._isRecording = false;
-						this._error = `Recording stop failed: ${error}`;
-						this._hasError = true;
-						reject(error);
-					}
-				};
-				recorder.stop();
-				this._isRecording = false;
-			} else resolve({
-				trimmedBlob: new Blob([], { type: this.mimeType }),
-				encryptedVideo: ""
-			});
-			recorder?.stream?.getTracks().forEach((track) => track.stop());
-		});
-	}
-	/**
-	* Discards the in-progress recording without producing a result: detaches
-	* the recorder's handlers, stops it, releases its cloned tracks and clears
-	* the flags. Idempotent, and safe after `stopRecording` or when never
-	* started. Mirrors `MultipartRecordingProvider.reset()` so an attempt that is
-	* released before finalization cannot leave a live camera clone behind
-	* (ENG-56648).
-	*/
-	reset() {
-		this.removeEventListeners();
-		const recorder = this.mediaRecorder;
-		if (recorder) {
-			recorder.ondataavailable = null;
-			recorder.onerror = null;
-			recorder.onstop = null;
-			if (recorder.state !== "inactive") try {
-				recorder.stop();
-			} catch {}
-			recorder.stream?.getTracks().forEach((track) => track.stop());
-			this.mediaRecorder = null;
-		}
-		this.stream = null;
-		this._isRecording = false;
-		this._error = null;
-		this._hasError = false;
-	}
-	pauseRecording() {
-		if (!this._isRecording) return;
-		if (this.mediaRecorder?.state === "recording") try {
-			this.mediaRecorder.pause();
-		} catch {}
-	}
-	registerEventListeners() {
-		document.addEventListener("visibilitychange", this.pauseRecordingBound);
-	}
-	removeEventListeners() {
-		document.removeEventListener("visibilitychange", this.pauseRecordingBound);
-	}
-};
-//#endregion
-//#region src/internal/recordings/recordingsRepository.ts
-async function uploadDeepsightVideo(encryptedVideo, token) {
-	try {
-		return (await api.post(endpoints.deepsightVideoImport, {
-			video: encryptedVideo,
-			type: "selfie"
-		}, { headers: { "X-Incode-Hardware-Id": token } })).data.recordingId ?? "";
-	} catch {
-		return "";
-	}
-}
-//#endregion
-//#region src/internal/faceCapture/recordingService.ts
-/**
-* Records on-device and uploads encrypted video for liveness.
-*/
-var LocalRecordingService = class {
-	constructor(wasmUtil, sessionToken) {
-		this.recorder = new LocalRecordingProvider();
-		this.sessionToken = sessionToken;
-		this.wasmUtil = wasmUtil;
-	}
-	async start(stream) {
-		this.recorder.startRecording(stream);
-		this.wasmUtil.osv();
-	}
-	async stop() {
-		if (!this.recorder.isRecording) return { recordingId: null };
-		this.wasmUtil.oev();
-		const result = await this.recorder.stopRecording(10, (base64) => this.wasmUtil.encryptImage(base64), (buffer) => this.wasmUtil.ckvcks(buffer));
-		if (!this.sessionToken) return { recordingId: null };
-		return { recordingId: await uploadDeepsightVideo(result.encryptedVideo, this.sessionToken) };
-	}
-	prepareUpload() {
-		return this.stop();
-	}
-	async stopAndGetVideo() {
-		if (!this.recorder.isRecording) return { videoBase64: void 0 };
-		try {
-			this.wasmUtil.oev();
-			const videoBase64 = (await this.recorder.stopRecording(10, (base64) => base64, () => {})).encryptedVideo;
-			return { videoBase64: videoBase64 ? videoBase64 : void 0 };
-		} catch {
-			return { videoBase64: void 0 };
-		}
-	}
-	cleanup() {
-		this.recorder.reset();
-	}
-};
-/**
-* Records a regular Selfie capture locally and streams it through the scoped
-* video-selfie-service multipart protocol. The recording is associated with
-* the interview asynchronously by the backend's `selfie` scope consumer, so
-* its upload id must not be forwarded to `/omni/add/face` as a legacy
-* `recordingId`.
-*
-* The recording is scoped to the capture step (ENG-56648). The recorder
-* records a stable `CameraCompositor` stream instead of a raw camera clone, so
-* every attempt can end its own clone before PRC and POC run and the next
-* attempt swaps a fresh clone into the same multipart upload. The owning
-* controller completes the upload once the backend accepts a capture or the
-* step ends without a retry.
-*/
-var MultipartFaceRecordingService = class {
-	constructor() {
-		this.recordingCompositor = createRecordingCompositor();
-		this.service = new MultipartRecordingService("selfie", new WorkerEncoderRecordingProvider(this.recordingCompositor));
-		this.audioSource = [];
-		this.needsVideoSourceReplacement = false;
-		this.pausedForAttempt = false;
-		this.startInFlight = false;
-		this.suspendRequested = false;
-		this.stopping = false;
-	}
-	async start(stream) {
-		if (this.stopping) throw new Error("Face recording already completed");
-		if (this.compositor) {
-			await this.resume(stream);
-			return;
-		}
-		const recordingSource = stream.clone();
-		const compositor = this.recordingCompositor;
-		this.startInFlight = true;
-		try {
-			const composite = compositor.start(recordingSource);
-			await this.service.start(composite);
-		} catch (error) {
-			compositor.stop();
-			recordingSource.getTracks().forEach((track) => track.stop());
-			this.service.cleanup();
-			throw error;
-		} finally {
-			this.startInFlight = false;
-		}
-		if (this.stopping) {
-			compositor.stop();
-			recordingSource.getTracks().forEach((track) => track.stop());
-			this.service.cleanup();
-			return;
-		}
-		this.compositor = compositor;
-		this.recordingSource = recordingSource;
-		this.audioSource = recordingSource.getAudioTracks();
-		if (this.suspendRequested) {
-			this.suspendRequested = false;
-			this.suspend();
-		}
-	}
-	/**
-	* Pauses the container and ends the camera clone on the calling thread. The
-	* composite stream and the upload stay open for the next attempt.
-	*/
-	suspend() {
-		if (this.stopping) return;
-		if (!this.compositor) {
-			this.suspendRequested = this.startInFlight;
-			return;
-		}
-		if (!this.pausedForAttempt) this.pausedForAttempt = this.service.pause();
-		this.releaseCameraClone({ keepAudio: true });
-		this.needsVideoSourceReplacement = true;
-	}
-	async prepareUpload() {
-		this.suspend();
-		return { recordingId: null };
-	}
-	async stop() {
-		await this.complete();
-		return { recordingId: null };
-	}
-	pauseForBackground() {
-		this.suspend();
-	}
-	async resumeFromBackground(stream) {
-		if (!this.compositor || this.stopping) return;
-		await this.resume(stream);
-	}
-	async stopAndGetVideo() {
-		await this.complete();
-		return { videoBase64: void 0 };
-	}
-	cleanup() {
-		this.suspendRequested = false;
-		this.pausedForAttempt = false;
-		this.needsVideoSourceReplacement = false;
-		this.releaseCameraClone({ keepAudio: false });
-		this.compositor?.stop();
-		this.compositor = void 0;
-		this.recordingSource = void 0;
-		this.audioSource = [];
-		this.service.cleanup();
-	}
-	/** Swaps this attempt's camera clone into the composite and resumes. */
-	async resume(stream) {
-		const compositor = this.compositor;
-		if (!compositor) return;
-		if (this.needsVideoSourceReplacement) {
-			const recordingSource = stream.clone();
-			recordingSource.getAudioTracks().forEach((track) => track.stop());
-			compositor.switchVideo(recordingSource);
-			this.needsVideoSourceReplacement = false;
-			this.recordingSource = recordingSource;
-			const result = await compositor.resume();
-			if (result !== "resumed") throw new Error(`Face recording camera did not resume: ${result}`);
-		}
-		if (this.pausedForAttempt && !this.service.resume()) throw new Error("Face recording did not resume");
-		this.pausedForAttempt = false;
-	}
-	/**
-	* Completes the scoped upload. The camera clone ends synchronously before the
-	* drain so a step that ends mid-attempt never pins the camera; the composite
-	* stays alive until the recorder has emitted its final chunk.
-	*/
-	async complete() {
-		this.stopping = true;
-		this.suspendRequested = false;
-		this.releaseCameraClone({ keepAudio: false });
-		try {
-			await this.service.stop();
-		} finally {
-			this.compositor?.stop();
-			this.compositor = void 0;
-			this.recordingSource = void 0;
-			this.audioSource = [];
-			this.pausedForAttempt = false;
-			this.needsVideoSourceReplacement = false;
-		}
-	}
-	releaseCameraClone(options) {
-		try {
-			this.compositor?.pause();
-		} catch {}
-		const tracks = options.keepAudio ? this.recordingSource?.getVideoTracks() ?? [] : /* @__PURE__ */ new Set([...this.recordingSource?.getTracks() ?? [], ...this.audioSource]);
-		for (const track of tracks) try {
-			track.stop();
-		} catch {}
-	}
-};
-/**
-* Creates the recording service for the current configuration.
-*
-* Order of precedence:
-* 1. `onDeviceFaceResultsSubmissionEnabled === true` → no recording. The
-*    on-device workflow never uploads media, only the staged face-results
-*    JSON via `WebApi.postFaceResults`. Mirrors V1's
-*    `FaceFlowManager.setRecorders()` early return.
-* 2. `deepsightLiveness === 'VIDEOLIVENESS'` → local Deepsight recorder.
-* 3. `enableFaceRecording === true` → scoped multipart recorder.
-* 4. otherwise → no recording.
-*/
-function createRecordingService(params) {
-	if (params.config.onDeviceFaceResultsSubmissionEnabled === true) return;
-	if (params.localDelivery === true) return params.config.enableFaceRecording === true || params.config.deepsightLiveness === "VIDEOLIVENESS" ? new LocalRecordingService(params.wasmUtil, null) : void 0;
-	if (params.config.deepsightLiveness === "VIDEOLIVENESS") return new LocalRecordingService(params.wasmUtil, params.sessionToken);
-	if (params.config.enableFaceRecording === true) return new MultipartFaceRecordingService();
-}
-//#endregion
 //#region src/internal/faceCapture/protectedFaceAttempt.ts
 const ON_DEVICE_MANUAL_CAPTURE_TIMEOUT_MS = 2147483647;
 /**
@@ -552,16 +163,14 @@ var ProtectedFaceRecorderHooks = class {
 let nextAttemptNumber = 1;
 /**
 * Private composition object for one still-face attempt. It owns provider
-* callbacks and raw-stream handoff outside XState; the machine sees only the
-* presentation stream/canvas and allowlisted semantic results.
+* callbacks and the camera-step options outside XState; the machine sees only
+* the presentation stream/canvas and allowlisted semantic results.
 */
 var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
 	constructor(options) {
 		this.options = options;
 		this.attemptId = `face-${nextAttemptNumber++}`;
-		this.acquiredUsingBackCamera = false;
-		this.rawHandedOff = false;
-		this.rawStreamReleased = false;
+		this.probedUsingBackCamera = false;
 		this.released = false;
 		this.recorderTransferred = false;
 		this.pendingSignals = [];
@@ -572,7 +181,7 @@ var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
 	/** Per-attempt fallback when no step owner supplies the recording service. */
 	async createAttemptRecordingService() {
 		const wasmUtil = await this.options.dependencies.getWasmUtil();
-		return createRecordingService({
+		return (await import("./recordingService-CTko6Cjn.esm.js")).createRecordingService({
 			config: this.options.config,
 			wasmUtil,
 			sessionToken: getToken(),
@@ -583,14 +192,15 @@ var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
 		return this.options.delivery;
 	}
 	get usingBackCamera() {
-		return this.acquiredUsingBackCamera;
+		return this.probedUsingBackCamera;
 	}
 	setDeepsightService(service) {
 		if (this.released || this.deepsightService) return;
 		this.deepsightService = service;
 	}
+	/** Tutorial-time preparation; the camera itself opens at attempt start. */
 	async preAcquire() {
-		await this.acquireRawStream();
+		await this.probe();
 	}
 	subscribeSignals(listener) {
 		if (this.released) return () => void 0;
@@ -608,23 +218,27 @@ var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
 			attemptId: this.attemptId,
 			target: this.options.target,
 			workflow: this.options.config.onDeviceFaceResultsSubmissionEnabled === true ? 5 : 4,
-			streamSource: {
-				kind: "acquire",
-				acquire: async () => {
-					const result = await this.acquireRawStream();
-					this.rawHandedOff = true;
-					return {
-						stream: result.stream,
-						constraints: result.constraints
-					};
-				}
+			cameraStep: async () => {
+				const { usingBackCamera } = await this.probe();
+				const facing = usingBackCamera ? "environment" : "user";
+				const resolution = usingBackCamera ? void 0 : this.options.config.cameraResolution;
+				const width = resolution?.width ?? 0;
+				const height = resolution?.height ?? 0;
+				const hasResolution = width > 0 && height > 0;
+				return {
+					vs: facing,
+					di: await electDesktopCameraDevice(facing),
+					ew: hasResolution ? width : 0,
+					eh: hasResolution ? height : 0,
+					i14: isIPhone14OrHigher(),
+					pa: false
+				};
 			},
 			cycle: this.options.cycle,
 			cycleOwnership: this.cycleOwnership,
 			recorder: this.recorder,
-			releaseUnadoptedStream: (stream) => stopStream(stream),
+			afterReady: this.options.delivery === "protected" ? (displayStream) => this.attachProtectedCameraMetadata(displayStream) : void 0,
 			configureWorkflow: () => this.configureWorkflow(),
-			runPrc: () => this.runPrc(),
 			runPoc: () => this.runPoc(),
 			onStartupTiming,
 			faceResults: this.provider
@@ -704,16 +318,18 @@ var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
 			Promise.resolve(this.provider.dispose()).catch(() => void 0);
 		} catch {}
 		this.cycleOwnership.releaseByController();
-		if (!this.rawHandedOff) this.acquired?.then(({ stream }) => this.releaseRawStream(stream), () => void 0);
 	}
-	async acquireRawStream() {
-		if (!this.acquired) this.acquired = this.options.acquireCamera(this.provider);
-		const result = await this.acquired;
-		this.acquiredUsingBackCamera = result.usingBackCamera;
-		if (this.released) {
-			this.releaseRawStream(result.stream);
-			throw new Error("Protected face attempt was released");
-		}
+	/**
+	* Runs the camera-free probe once per attempt, whether the tutorial
+	* pre-acquire or the camera step asks first. Every retry creates a fresh
+	* runtime, so the pipeline warm-up and the lens choice are re-checked per
+	* attempt.
+	*/
+	async probe() {
+		this.probed ??= this.options.probeCamera();
+		const result = await this.probed;
+		this.probedUsingBackCamera = result.usingBackCamera;
+		if (this.released) throw new Error("Protected face attempt was released");
 		return result;
 	}
 	async configureWorkflow() {
@@ -767,13 +383,6 @@ var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
 		});
 		this.emitDetection("detecting");
 	}
-	async runPrc() {
-		if (this.options.delivery === "protected") await this.attachProtectedCameraMetadata();
-		if (this.released) return;
-		const wasmUtil = await this.options.dependencies.getWasmUtil();
-		if (this.released) return;
-		await wasmUtil.prc();
-	}
 	async runPoc() {
 		if (this.options.delivery === "local") return;
 		const deepsight = this.deepsightService;
@@ -797,12 +406,11 @@ var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
 		const logs = deepsight.getPipelineState();
 		this.options.dependencies.trackCaptureAttemptFinished?.({ logs });
 	}
-	async attachProtectedCameraMetadata() {
+	async attachProtectedCameraMetadata(displayStream) {
 		const deepsight = this.deepsightService;
 		if (!deepsight) return;
 		try {
-			const { stream } = await this.acquireRawStream();
-			const [videoTrack] = stream.getVideoTracks();
+			const [videoTrack] = displayStream.getVideoTracks();
 			if (videoTrack) await deepsight.checkVirtualCamera(videoTrack);
 		} catch {
 			trueSightLog("warning", "deepsight", "faceScan", "protected camera metadata attachment failed");
@@ -819,13 +427,6 @@ var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
 		if (this.signalListener) this.signalListener(signal);
 		else this.pendingSignals.push(signal);
 	}
-	releaseRawStream(stream) {
-		if (this.rawHandedOff || this.rawStreamReleased) return;
-		this.rawStreamReleased = true;
-		try {
-			stopStream(stream);
-		} catch {}
-	}
 };
 //#endregion
 //#region src/internal/faceCapture/protectedFaceController.ts
@@ -878,8 +479,9 @@ function createProtectedFaceControllerActor(options) {
 			const input = getControllerInput();
 			const pending = (async () => {
 				const wasmUtil = await input.dependencies.getWasmUtil();
+				const recordingModule = await import("./recordingService-CTko6Cjn.esm.js");
 				if (!active) return;
-				stepRecording ??= createRecordingService({
+				stepRecording ??= recordingModule.createRecordingService({
 					config: input.config,
 					wasmUtil,
 					sessionToken: getToken(),
@@ -921,10 +523,7 @@ function createProtectedFaceControllerActor(options) {
 					authHint: input.authHint,
 					faceDetection: capabilities.faceDetection,
 					cycle: capabilities.cycle,
-					acquireCamera: (provider) => initializeCamera({
-						config: input.config,
-						provider
-					}),
+					probeCamera: () => probeFaceCamera(input.config),
 					getRecordingService: getStepRecordingService
 				});
 				if (deepsightService) runtime.setDeepsightService(deepsightService);
@@ -1068,7 +667,8 @@ function createProtectedFaceControllerActor(options) {
 				case "PROTECTED_ATTEMPT_FAILED":
 					logDiagnostic("attempt-failed", {
 						failureStage: event.failure.stage,
-						failureCode: event.failure.code
+						failureCode: event.failure.code,
+						errorName: event.failure.errorName
 					});
 					noteTrueSightCaptureActivity(false);
 					sendBack(event);
@@ -1204,6 +804,7 @@ function createDefaultProtectedFaceControllerActor(options) {
 }
 //#endregion
 //#region src/internal/faceCapture/faceCaptureSetup.ts
+const DEEPSIGHT_INITIALIZATION_FAILED_CODE = "DEEPSIGHT_INITIALIZATION_FAILED";
 const getAttemptsFromConfig = (config) => {
 	return config.captureAttempts ?? config.numberOfAttempts ?? 3;
 };
@@ -1485,11 +1086,16 @@ const faceCaptureMachine = setup({
 		hasStream: ({ context }) => context.stream !== void 0,
 		isCameraAndDeepsightReady: ({ context }) => context.stream !== void 0 && context.deepsightReady,
 		hasAttemptsRemaining: ({ context }) => context.attemptsRemaining > 0,
+		isOutOfAttempts: ({ context }) => context.attemptsRemaining <= 0 && context.attemptsRemaining < getAttemptsFromConfig(context.config),
 		hasCapturedImage: ({ context }) => context.capturedImage !== void 0,
 		isAutoCaptureAllowed: ({ context }) => !context.retainManualMode,
 		canCommitProtectedManual: ({ context }) => context.manualCaptureTriggered && context.config.onDeviceFaceResultsSubmissionEnabled !== true,
 		isProtectedManualRefusal: ({ event }) => event.failure.stage === "manualCommit",
 		isProtectedUploadFailure: ({ event }) => event.failure.stage === "upload",
+		isProtectedAcquireDenied: ({ event }) => {
+			const { failure } = event;
+			return failure.stage === "acquire" && isCameraDenialErrorName(failure.errorName);
+		},
 		hasUploadValidationError: () => false,
 		isTerminalUploadError: () => false,
 		isNoAttemptsTerminal: () => false
@@ -1498,7 +1104,7 @@ const faceCaptureMachine = setup({
 	id: "faceCapture",
 	initial: "idle",
 	entry: "bindProtectedFaceController",
-	context: ({ input }) => ({
+	context: ({ input, self }) => ({
 		config: input.config,
 		dependencies: input.dependencies,
 		authHint: input.authHint,
@@ -1510,7 +1116,7 @@ const faceCaptureMachine = setup({
 		faceCoordinates: void 0,
 		uploadResponse: void 0,
 		processResponse: void 0,
-		attemptsRemaining: getAttemptsFromConfig(input.config),
+		attemptsRemaining: carryAttempts("faceCapture", self, (s) => ({ attemptsRemaining: s.context.attemptsRemaining })).attemptsRemaining ?? getAttemptsFromConfig(input.config),
 		uploadError: void 0,
 		permissionResult: void 0,
 		deepsightReady: false,
@@ -1535,6 +1141,10 @@ const faceCaptureMachine = setup({
 	},
 	states: {
 		idle: { on: { LOAD: [
+			{
+				target: "outOfAttempts",
+				guard: "isOutOfAttempts"
+			},
 			{
 				target: "tutorial",
 				guard: "hasShowTutorial"
@@ -1809,6 +1419,11 @@ const faceCaptureMachine = setup({
 						guard: "isProtectedUploadFailure",
 						actions: "setUploadFailureAndDecrement"
 					},
+					{
+						target: "#faceCapture.permissions.denied",
+						guard: "isProtectedAcquireDenied",
+						actions: "setPermissionDenied"
+					},
 					{
 						target: "#faceCapture.error",
 						actions: "setProtectedFailure"
@@ -1832,7 +1447,11 @@ const faceCaptureMachine = setup({
 							target: "#faceCapture.error",
 							actions: assign({
 								deepsightReady: () => false,
-								error: () => "Deepsight initialization failed"
+								error: () => ({
+									type: DEEPSIGHT_INITIALIZATION_FAILED_CODE,
+									message: "Deepsight initialization failed",
+									moduleErrorCode: DEEPSIGHT_INITIALIZATION_FAILED_CODE
+								})
 							})
 						}
 					}
@@ -1952,6 +1571,14 @@ const faceCaptureMachine = setup({
 			},
 			onError: { target: "finished" }
 		} },
+		outOfAttempts: { always: [{
+			target: "error",
+			guard: "isNoAttemptsTerminal",
+			actions: "setTerminalError"
+		}, {
+			target: "terminalProcessing",
+			actions: "flagFaceManualReview"
+		}] },
 		terminalProcessing: {
 			entry: ["completeProtectedRecording", "cleanup"],
 			invoke: {