@incodetech/core 2.4.0 → 2.4.1-agentic.1

package/dist/tri.esm.js

@@ -1,2 +1,2 @@
-import { a as resetTRI, c as startTRI, l as stopTRI, r as isTRIStarted, s as setupTRI, t as createTRISession } from "./tri-xzRLIIMN.esm.js";
+import { c as resetTRI, d as stopTRI, i as isTRIStarted, l as setupTRI, n as createTRISession, u as startTRI } from "./tri-DG6priFa.esm.js";
 export { createTRISession, isTRIStarted, resetTRI, setupTRI, startTRI, stopTRI };

package/dist/{trueSightService-BMT-TubT.esm.js → trueSightService-GuLthUVK.esm.js}

@@ -1,8 +1,8 @@
-import { a as setWebApiHttpTransport, g as emitWasmDiagnostic, i as initializeWasmWebClient, o as setupWasmConnection, r as executeWasmRequest, t as WasmWebClientError, w as resolveWasmConfig } from "./wasmWebClient-BjZw_7OB.esm.js";
-import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
-import { C as subscribeEvent, n as eventModuleNames } from "./events-Du2A4-Qr.esm.js";
-import { i as isApiConfigured, l as withTiming, n as getApi, o as setClient, r as getToken, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-CsIbltJF.esm.js";
+import { T as resolveWasmConfig, _ as emitWasmDiagnostic, a as setWebApiHttpTransport, i as initializeWasmWebClient, o as setupWasmConnection, r as executeWasmRequest, t as WasmWebClientError } from "./wasmWebClient-BDrax6Eu.esm.js";
+import { n as getTimestamp } from "./IBrowserEnvironmentCapability-D7JG7ML3.esm.js";
+import { C as subscribeEvent, n as eventModuleNames } from "./events-ggpBBaZ8.esm.js";
+import { i as isApiConfigured, l as withTiming, n as getApi, o as setClient, r as getToken, t as api, u as endpoints } from "./api-CpP4PS4S.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-CDd_gaR7.esm.js";
 import { n as reportHttpError, t as HttpRequestError } from "./HttpRequestError-Bh0pNGSC.esm.js";
 /** Dirty-timer half of the interrupted-snapshot rebuild debounce (module boundaries + timer). */
 const SNAPSHOT_DIRTY_INTERVAL_MS = 15e3;
@@ -774,7 +774,7 @@ const requestWithXHR = (fullUrl, method, mergedHeaders, requestBody, timeout, si
 			else reject(reportHttpError(new FetchHttpError(xhr.status, xhr.statusText, fullUrl, method, responseHeaders, data), mergedHeaders));
 		};
 		xhr.onerror = () => {
-			reject(new FetchHttpError(0, "Network Error", fullUrl, method, {}, null));
+			reject(reportHttpError(new FetchHttpError(0, "Network Error", fullUrl, method, {}, null), mergedHeaders));
 		};
 		xhr.ontimeout = () => {
 			reject(new FetchHttpError(0, "Request timeout", fullUrl, method, {}, null));
@@ -849,6 +849,7 @@ const createApi = (config) => {
 				if (timeoutId) clearTimeout(timeoutId);
 				if (error instanceof FetchHttpError) throw error;
 				if (error instanceof Error && error.name === "AbortError") throw new FetchHttpError(0, "Request timeout", fullUrl, method, {}, null);
+				if (error instanceof TypeError && !keepalive) reportHttpError(new FetchHttpError(0, "Network Error", fullUrl, method, {}, null), mergedHeaders);
 				throw error;
 			}
 		},
@@ -974,6 +975,12 @@ const getErrorStatus = (error) => {
 	}
 	return 0;
 };
+const NETWORK_FAILURE = /^(failed to fetch|load failed)$|network ?error|network connection|internet connection/i;
+/**
+* Status 0 marks connectivity lost, so it is reported only for a network
+* failure, and never for keepalive requests.
+*/
+const shouldReport = (status, error, keepalive = false) => status !== 0 || !keepalive && error instanceof WasmWebClientError && NETWORK_FAILURE.test(error.message);
 const getErrorData = (error) => {
 	if (error instanceof WasmWebClientError) return error.response?.data ?? null;
 	return null;
@@ -1002,7 +1009,8 @@ const createWasmApi = async (config) => {
 		await setupWasmConnection(config.apiURL, "", config.encryptionEnabled ?? false, headers, useSha256);
 	} catch (error) {
 		if (!(error instanceof WasmWebClientError)) throw error;
-		throw reportHttpError(new WasmHttpError(error.statusCode, "", config.apiURL, "POST", {}, getErrorData(error)), headers);
+		const failure = new WasmHttpError(error.statusCode, "", config.apiURL, "POST", {}, getErrorData(error));
+		throw shouldReport(failure.status, error) ? reportHttpError(failure, headers) : failure;
 	}
 	const defaults = {
 		baseURL: config.apiURL,
@@ -1011,7 +1019,7 @@ const createWasmApi = async (config) => {
 	const client = {
 		defaults,
 		async request(requestConfig) {
-			const { method = "GET", url, headers: requestHeaders = {}, query, params, body, signal, timeout: timeoutOverride, onUploadProgress, ie = false } = requestConfig;
+			const { method = "GET", url, headers: requestHeaders = {}, query, params, body, signal, timeout: timeoutOverride, onUploadProgress, keepalive, ie = false } = requestConfig;
 			const upperMethod = normalizeMethod(method);
 			const requestParams = params ?? query;
 			const fullUrl = buildUrl(defaults.baseURL, url, requestParams);
@@ -1041,7 +1049,8 @@ const createWasmApi = async (config) => {
 				};
 			} catch (error) {
 				if (error instanceof WasmHttpError) throw error;
-				throw reportHttpError(new WasmHttpError(getErrorStatus(error), getErrorMessage(error), fullUrl, upperMethod, {}, getErrorData(error)), mergedHeaders);
+				const failure = new WasmHttpError(getErrorStatus(error), getErrorMessage(error), fullUrl, upperMethod, {}, getErrorData(error));
+				throw shouldReport(failure.status, error, keepalive) ? reportHttpError(failure, mergedHeaders) : failure;
 			}
 		},
 		get(url, requestConfig) {
@@ -1380,7 +1389,7 @@ function categoryForEndpoint(endpoint) {
 	if (/\/omni\/es\//.test(endpoint)) return "other";
 	if (/face|selfie|video|speech|personhood|authenticate|recordings/.test(endpoint)) return "faceScan";
 	if (/front-id|back-id|second-id|process\/id|images|barcode|ocr|document|curp|cfdi|address-statement|digital-id|device\/wallet/.test(endpoint)) return "idScan";
-	if (/start|flow|workflow|feature-config|onboarding|finish-status/.test(endpoint)) return "orchestration";
+	if (/start|session\/continue|flow|workflow|feature-config|onboarding|finish-status/.test(endpoint)) return "orchestration";
 	return "other";
 }
 /** Coarse contract category from the RAW `event.module` value (plan rule). */

package/dist/trust-graph.esm.js

@@ -1,4 +1,4 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-Du2A4-Qr.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-ggpBBaZ8.esm.js";
 import { s as createActor, t as setup, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
 //#region src/modules/trust-graph/trustGraphStateMachine.ts
 /**

package/dist/types-B9C8W01q.d.ts

@@ -0,0 +1,34 @@
+//#region src/modules/watchlist-for-business/types.d.ts
+/** Where a W4B field's value comes from. */
+type WatchlistForBusinessFieldSource = 'userInput' | 'eKYBData';
+/**
+ * Configuration for the watchlist-for-business module.
+ *
+ * Every field is optional. With no config the module collects country and
+ * business name from the user and submits them to the business watchlist
+ * endpoint. Tax ID and date of incorporation are extra, optional inputs that
+ * the backend enables when the AML Watcher integration is provisioned.
+ */
+type WatchlistForBusinessConfig = {
+  /**
+   * Source of the country. Typed for parity with the backend config; the
+   * module currently always collects it from the user.
+   */
+  countrySource?: WatchlistForBusinessFieldSource;
+  /**
+   * Source of the business name. Typed for parity with the backend config;
+   * the module currently always collects it from the user.
+   */
+  businessNameSource?: WatchlistForBusinessFieldSource;
+  /** Shows the optional Tax ID input and sends it when filled. */
+  taxIdEnabled?: boolean;
+  /** Shows the optional date-of-incorporation input and sends it when filled. */
+  dateOfIncorporationEnabled?: boolean;
+};
+type WatchlistForBusinessValidationErrors = {
+  businessName?: string;
+  taxId?: string;
+  dateOfIncorporation?: string;
+};
+//#endregion
+export { WatchlistForBusinessValidationErrors as n, WatchlistForBusinessConfig as t };

package/dist/{types-yPH8lAH-.d.ts → types-BEVHQbbC.d.ts}

@@ -1,6 +1,6 @@
 import { a as AvatarAssetsOverrides } from "./createFaceAvatar-lYX0VTYs.js";
-import { n as Flow, s as SelfieConcealmentOption } from "./types-B6HsSzpk.js";
-import { a as IStorageCapability, n as IWasmUtilCapability } from "./IWasmUtilCapability-GF2n7sfm.js";
+import { n as Flow, s as SelfieConcealmentOption } from "./types-CRaFu6wS.js";
+import { a as IStorageCapability, n as IWasmUtilCapability } from "./IWasmUtilCapability-Cqiaxydi.js";
 //#region src/internal/faceCapture/types.d.ts
 type CameraResolution = {
   width?: number;

package/dist/{types-BAxn7MpY.d.ts → types-BPm1JSu7.d.ts}

@@ -1,10 +1,11 @@
 import { y as IncodeCanvas } from "./createFaceAvatar-lYX0VTYs.js";
-import { a as RegulationTypes, n as Flow, o as TutorialIdConfig } from "./types-B6HsSzpk.js";
-import { a as IStorageCapability } from "./IWasmUtilCapability-GF2n7sfm.js";
+import { a as RegulationTypes, n as Flow, o as TutorialIdConfig } from "./types-CRaFu6wS.js";
+import { a as IStorageCapability } from "./IWasmUtilCapability-Cqiaxydi.js";
 import { t as PermissionResult } from "./types-BEwVKkLJ.js";
-import { n as DeepsightService, t as StreamCanvasCapture } from "./StreamCanvasCapture-7JRf-2ck.js";
+import { n as DeepsightService, t as StreamCanvasCapture } from "./StreamCanvasCapture-C3xNfOsv.js";
 import { t as CameraStream } from "./camera-9wWD-pwg.js";
 import { i as Pdf417DecodeResult, n as IIdCaptureCapability, r as IdCaptureSettings, t as DetectionOrientation } from "./IIdCaptureCapability-CGcEt2Cw.js";
+import { n as IGeolocationCapability, t as GeolocationCoords } from "./IGeolocationCapability-r49Qo7rR.js";
 //#region ../infra/src/capabilities/IDigitalCredentialsCapability.d.ts
 /**
  * Digital Credentials capability — wraps the W3C Digital Credentials API
@@ -95,25 +96,68 @@ type RedirectReturnParams = {
   resultsAccessKey: string;
 };
 //#endregion
+//#region src/modules/id/deviceWallet/types.d.ts
+/** Which wallet backend the handshake talks to. */
+type DeviceWalletPlatform = 'ios' | 'android';
+/** Explicit provider override, mirroring V1's `DigitalIdWalletProvider`. */
+type DeviceWalletProvider = 'apple_web' | 'google';
+type DeviceWalletDecision = 'ACCEPTED' | 'REJECTED';
+/**
+ * Failure classification.
+ * - `UNSUPPORTED_PLATFORM` — no Credentials API. The digital-ID funnel
+ *   resolves this away before the machine is invoked; kept for the defensive
+ *   path when the machine is started on an unsupported environment anyway.
+ * - `NO_CREDENTIAL` — the wallet sheet completed without a credential (user
+ *   dismissed, or no eligible digital ID on the device).
+ * - `WALLET_ERROR` — anything else (request/decrypt HTTP failure, the
+ *   Credentials API rejecting, missing activation, protocol errors).
+ */
+type DeviceWalletFailReason = 'UNSUPPORTED_PLATFORM' | 'NO_CREDENTIAL' | 'WALLET_ERROR';
+/** Response of both decrypt endpoints. Attributes are not inline (see above). */
+type DeviceWalletDecryptResponse = {
+  success: boolean;
+  decision?: DeviceWalletDecision;
+  [key: string]: unknown;
+};
+/** Injectable service seam (mirrors digital-id-redirect's services pattern). */
+type DeviceWalletServices = {
+  /** Builds the wallet request payload for the platform. */
+  requestWalletData: (platform: DeviceWalletPlatform, signal?: AbortSignal) => Promise<DigitalCredentialRequestOptions>;
+  /** Forwards the opaque wallet response for backend decryption. */
+  decryptWalletResponse: (platform: DeviceWalletPlatform, walletResponse: string, signal?: AbortSignal) => Promise<DeviceWalletDecryptResponse>;
+};
+/**
+ * Terminal machine output read by the ID-Capture parent (`onDone`).
+ * Projected by the machine's ROOT `output` — a top-level final node's own
+ * `output` does not propagate in this XState version.
+ */
+type DeviceWalletOutput = {
+  result: 'success';
+  decision: DeviceWalletDecision | undefined;
+  response: DeviceWalletDecryptResponse;
+} | {
+  result: 'dismissed';
+};
+//#endregion
 //#region src/modules/id/digitalIdRegistry.d.ts
 /**
  * True when a digital-ID method uses a full-page web-redirect flow (Trinsic
- * iDIN/FTN). Accepts both the module `FlowType` value (`REDIRECT`) and the
+ * iDIN, FTN, itsme, …). Accepts both the module `FlowType` value (`REDIRECT`) and the
  * backend value (`WEB_REDIRECT`). (Lives here rather than in
  * `idCaptureHelpers` to keep the registry free of circular imports; the
  * helpers re-export it.)
  */
 declare function isRedirectFlowType(flowType: string): boolean;
 /** Digital-ID document schemes the SDK knows how to verify. */
-type DigitalIdDocumentType = 'mDL' | 'iDIN' | 'FTN';
+type DigitalIdDocumentType = 'mDL' | 'iDIN' | 'FTN' | 'itsme' | 'SPID' | 'MitID' | 'BankIDSweden' | 'FranceIdentite' | 'IdentiteNumerique' | 'LAWallet' | 'DigiLocker';
 /** One way to fulfil a `DigitalIdDocumentType`, in funnel priority order. */
 type DigitalIdFunnelEntry = {
   /**
    * Incode-native device-wallet handshake (Apple Wallet web / Google
-   * Wallet). Activation is computed by `isDeviceWalletEnabled` — the
-   * `deviceWallet` flag or an enabled wallet method in
-   * `config.digitalIds` — so this entry carries no config-field name of
-   * its own.
+   * Wallet). Activation is computed by `hasEligibleDeviceWallet` — an
+   * enabled wallet method in `config.digitalIds` that this device can
+   * reach, else the `deviceWallet` flag — so this entry carries no
+   * config-field name of its own.
    */
   kind: 'incodeWallet';
   /** Chooser tile this entry surfaces as. */
@@ -129,6 +173,11 @@ type DigitalIdFunnelEntry = {
    * activates this entry (e.g. `IDIN`).
    */
   method: string;
+  /**
+   * ISO alpha-2 countries the provider serves. Fallback for chooser
+   * ranking when the backend sends a method without `countries`.
+   */
+  countries?: readonly string[];
 };
 declare const DIGITAL_ID_REGISTRY: Record<DigitalIdDocumentType, readonly DigitalIdFunnelEntry[]>;
 declare const DIGITAL_ID_DOCUMENT_TYPES: DigitalIdDocumentType[];
@@ -144,6 +193,19 @@ type ResolvedDigitalIdRoute = {
 type DigitalIdPlatformSupport = {
   /** `IDigitalCredentialsCapability.isAvailable()`. */
   credentialsAvailable: boolean;
+  /**
+   * The OS wallet this device reaches (`resolveWalletPlatform()`): `ios` for
+   * Apple Wallet (iOS / iPadOS / macOS Safari), `android` for Google Wallet
+   * (everything else). Drives the per-wallet hard filter — Apple Wallet is
+   * never offered on `android`, Google Wallet never on `ios`. Omitted → no
+   * per-wallet filtering (callers that predate the filter).
+   */
+  walletPlatform?: DeviceWalletPlatform;
+  /**
+   * Whether this is a Samsung device (`isSamsungDevice()`). Samsung Wallet is
+   * Samsung-only. Omitted → not filtered.
+   */
+  samsungDevice?: boolean;
 };
 /**
  * Resolves the implementation that should fulfil a digital-ID document type:
@@ -152,47 +214,31 @@ type DigitalIdPlatformSupport = {
  */
 declare function resolveDigitalIdImplementation(docType: DigitalIdDocumentType, config: Pick<IdCaptureConfig, 'deviceWallet' | 'digitalIds'>, platform: DigitalIdPlatformSupport): ResolvedDigitalIdRoute | undefined;
 //#endregion
-//#region src/modules/id/deviceWallet/types.d.ts
-/** Which wallet backend the handshake talks to. */
-type DeviceWalletPlatform = 'ios' | 'android';
-/** Explicit provider override, mirroring V1's `DigitalIdWalletProvider`. */
-type DeviceWalletProvider = 'apple_web' | 'google';
-type DeviceWalletDecision = 'ACCEPTED' | 'REJECTED';
-/**
- * Failure classification.
- * - `UNSUPPORTED_PLATFORM` — no Credentials API. The digital-ID funnel
- *   resolves this away before the machine is invoked; kept for the defensive
- *   path when the machine is started on an unsupported environment anyway.
- * - `NO_CREDENTIAL` — the wallet sheet completed without a credential (user
- *   dismissed, or no eligible digital ID on the device).
- * - `WALLET_ERROR` — anything else (request/decrypt HTTP failure, the
- *   Credentials API rejecting, missing activation, protocol errors).
- */
-type DeviceWalletFailReason = 'UNSUPPORTED_PLATFORM' | 'NO_CREDENTIAL' | 'WALLET_ERROR';
-/** Response of both decrypt endpoints. Attributes are not inline (see above). */
-type DeviceWalletDecryptResponse = {
-  success: boolean;
-  decision?: DeviceWalletDecision;
-  [key: string]: unknown;
-};
-/** Injectable service seam (mirrors digital-id-redirect's services pattern). */
-type DeviceWalletServices = {
-  /** Builds the wallet request payload for the platform. */
-  requestWalletData: (platform: DeviceWalletPlatform, signal?: AbortSignal) => Promise<DigitalCredentialRequestOptions>;
-  /** Forwards the opaque wallet response for backend decryption. */
-  decryptWalletResponse: (platform: DeviceWalletPlatform, walletResponse: string, signal?: AbortSignal) => Promise<DeviceWalletDecryptResponse>;
+//#region ../infra/src/capabilities/ILocaleCapability.d.ts
+type ILocaleCapability = {
+  /**
+   * The user's preferred languages as BCP 47 tags, most preferred first
+   * (`navigator.languages`, e.g. `['sv-SE', 'en-GB']`). Empty when the
+   * environment exposes none.
+   */
+  getPreferredLanguages(): readonly string[];
 };
+//#endregion
+//#region src/modules/id/digitalIdCountry.d.ts
 /**
- * Terminal machine output read by the ID-Capture parent (`onDone`).
- * Projected by the machine's ROOT `output` — a top-level final node's own
- * `output` does not propagate in this XState version.
+ * The country signals ID Capture ranks digital-ID options by. Every field is
+ * optional; an absent one is simply not consulted. `createIdCaptureActor`
+ * fills `ipCountry` and `locale`; the GPS pair is opt-in.
  */
-type DeviceWalletOutput = {
-  result: 'success';
-  decision: DeviceWalletDecision | undefined;
-  response: DeviceWalletDecryptResponse;
-} | {
-  result: 'dismissed';
+type DigitalIdCountryDetectionDependencies = {
+  /** IP → ISO alpha-2. Defaults to the backend geo-IP lookup. */
+  ipCountry?: (signal?: AbortSignal) => Promise<string | undefined>;
+  /** Browser language preferences, read for their region subtag. */
+  locale?: ILocaleCapability;
+  /** Position source for the GPS signal. Needs `reverseGeocodeCountry`. */
+  geolocation?: IGeolocationCapability;
+  /** Coordinates → ISO alpha-2. Without it the GPS signal is skipped. */
+  reverseGeocodeCountry?: (coords: GeolocationCoords, signal?: AbortSignal) => Promise<string | undefined>;
 };
 //#endregion
 //#region ../infra/src/capabilities/IAnalyticsCapability.d.ts
@@ -752,6 +798,19 @@ type IdCaptureContext = {
    * `availableDocumentTypes` whenever this list is non-empty.
    */
   digitalIdRedirectOptions: IdCaptureDigitalIdRedirectOption[];
+  /**
+   * Countries the user is likely in, strongest signal first, from the
+   * `detectingCountry` step before the chooser; `digitalIdRedirectOptions`
+   * is ranked by them. `undefined` until detection ran — it only runs when
+   * ranking can change the order — and `[]` when no signal answered.
+   */
+  detectedCountries: string[] | undefined;
+  /**
+   * The wallet family this device certainly reaches, read once from the user
+   * agent when the machine starts (`resolveWalletDevice`); names the wallet on
+   * the Digital ID chooser card. `undefined` when the OS is not certain.
+   */
+  walletDevice: 'apple' | 'samsung' | 'android' | undefined;
   /**
    * Provider picked on the chooser (`SELECT_DOCUMENT` with `providerId`).
    * Preset on the `digitalIdRedirect` child so the verification is created for
@@ -786,6 +845,15 @@ type IdCaptureEvent = {
    * Omitted → the first configured redirect method is launched.
    */
   providerId?: DigitalIdProviderId;
+} |
+/**
+ * On the chooser: the user picked the country to view options for. The
+ * redirect options are re-ranked with it as the strongest country; nothing
+ * is added or removed.
+ */
+{
+  type: 'SET_CHOOSER_COUNTRY';
+  country: string;
 } | {
   type: 'NEXT_STEP';
 } | {
@@ -927,6 +995,13 @@ type IdCaptureDependencies = {
    * `BrowserDigitalCredentialsProvider` at the composition points.
    */
   credentials?: IDigitalCredentialsCapability;
+  /**
+   * Country signals the chooser ranks digital-ID redirect options by (GPS →
+   * IP → browser locale; see `detectDigitalIdCountries`). `createIdCaptureActor`
+   * fills the IP and locale signals; the GPS pair is opt-in. Absent (direct
+   * machine construction) → no ranking, backend order.
+   */
+  countryDetection?: DigitalIdCountryDetectionDependencies;
   trackCaptureAttemptFinished?: (payload: {
     logs: string;
     resolution?: string;
@@ -970,4 +1045,4 @@ type IdCaptureOutput = {
   skipFaceMatch: boolean;
 } | undefined;
 //#endregion
-export { DeviceWalletDecision as A, DigitalIdFunnelEntry as B, IdCapturedImageData as C, IdFlowStep as D, IdErrorCode as E, DeviceWalletProvider as F, DigitalIdProviderId as G, ResolvedDigitalIdRoute as H, DeviceWalletServices as I, IDigitalCredentialsCapability as J, FailureReason as K, DIGITAL_ID_DOCUMENT_TYPES as L, DeviceWalletFailReason as M, DeviceWalletOutput as N, UploadIdResponse as O, DeviceWalletPlatform as P, DIGITAL_ID_REGISTRY as R, IdCaptureThresholds as S, IdError as T, isRedirectFlowType as U, DigitalIdPlatformSupport as V, resolveDigitalIdImplementation as W, IdCaptureGeometry as _, CaptureOnlyResponse as a, IdCaptureOnlyConfig as b, DetectionStatus as c, IdCaptureContext as d, IdCaptureDependencies as f, IdCaptureEvent as g, IdCaptureDigitalIdRedirectOption as h, CaptureIdResponse as i, DeviceWalletDecryptResponse as j, IAnalyticsCapability as k, ID_ERROR_CODES as l, IdCaptureDigitalIdMethod as m, AcceptedDocumentType as n, CapturedImage as o, IdCaptureDigitalIdFlowType as p, RedirectReturnParams as q, AddBarcodeV3Response as r, DetectionArea as s, AcceptedDocument as t, IdCaptureConfig as u, IdCaptureInput as v, IdDocumentType as w, IdCaptureOutput as x, IdCaptureMode as y, DigitalIdDocumentType as z };
+export { DigitalIdCountryDetectionDependencies as A, DeviceWalletDecryptResponse as B, IdCapturedImageData as C, IdFlowStep as D, IdErrorCode as E, DigitalIdPlatformSupport as F, DeviceWalletServices as G, DeviceWalletOutput as H, ResolvedDigitalIdRoute as I, RedirectReturnParams as J, DigitalIdProviderId as K, isRedirectFlowType as L, DIGITAL_ID_REGISTRY as M, DigitalIdDocumentType as N, UploadIdResponse as O, DigitalIdFunnelEntry as P, resolveDigitalIdImplementation as R, IdCaptureThresholds as S, IdError as T, DeviceWalletPlatform as U, DeviceWalletFailReason as V, DeviceWalletProvider as W, IDigitalCredentialsCapability as Y, IdCaptureGeometry as _, CaptureOnlyResponse as a, IdCaptureOnlyConfig as b, DetectionStatus as c, IdCaptureContext as d, IdCaptureDependencies as f, IdCaptureEvent as g, IdCaptureDigitalIdRedirectOption as h, CaptureIdResponse as i, DIGITAL_ID_DOCUMENT_TYPES as j, IAnalyticsCapability as k, ID_ERROR_CODES as l, IdCaptureDigitalIdMethod as m, AcceptedDocumentType as n, CapturedImage as o, IdCaptureDigitalIdFlowType as p, FailureReason as q, AddBarcodeV3Response as r, DetectionArea as s, AcceptedDocument as t, IdCaptureConfig as u, IdCaptureInput as v, IdDocumentType as w, IdCaptureOutput as x, IdCaptureMode as y, DeviceWalletDecision as z };

package/dist/{types-0L-eFDmr.d.ts → types-BgRHw-dR.d.ts}

@@ -1,4 +1,4 @@
-import { l as FieldDef } from "./types-BvLo3U4u.js";
+import { r as FieldDef } from "./textRules-D4NRinKY.js";
 //#region src/modules/ekyb/types.d.ts
 type UboEntry = {
   id: string;

package/dist/{types-B6HsSzpk.d.ts → types-CRaFu6wS.d.ts}

@@ -1,5 +1,7 @@
-import { s as RiskAddon } from "./types-BvLo3U4u.js";
+import { l as RiskAddon } from "./types-CuMJ2M7D.js";
 import "./createFaceAvatar-lYX0VTYs.js";
+import { t as WatchlistForBusinessConfig } from "./types-B9C8W01q.js";
+import { n as KybChecksConfig } from "./types-CTaL0XJz.js";
 //#region src/internal/avatar/concealment.d.ts
 /**
  * Backend-aligned selfie/auth face-concealment options. The backend returns a
@@ -110,7 +112,7 @@ type FlowModuleConfig = {
     }[];
   };
   DOCUMENT_CAPTURE: {
-    processingType: 'capture' | 'processPoaOcr' | 'processLoaOcr' | 'processAsylumSeekerVisaZaf' | 'processBankStatementOCR' | 'processBankCheck' | 'processIneMex' | 'processColombiaRutForm' | 'processV5CLogbook' | 'processCarInvoice' | 'processCirculationCard' | 'processFinanceSettlement';
+    processingType: 'capture' | 'processPoaOcr' | 'processLoaOcr' | 'processAsylumSeekerVisaZaf' | 'processBankStatementOCR' | 'processBankCheck' | 'processIneMex' | 'processColombiaRutForm' | 'processV5CLogbook' | 'processCarInvoice' | 'processCirculationCard' | 'processFinanceSettlement' | 'processW8BenOcr' | 'processW8BenEOcr';
     title: string;
     text: string;
     allowSkipDocumentCapture: boolean;
@@ -125,6 +127,7 @@ type FlowModuleConfig = {
     checkUniqueBeneficialOwner: boolean;
     uniqueBeneficialOwnerSource: 'userInput';
   };
+  EKYB_CHECKS: KybChecksConfig;
   EXTERNAL_VERIFICATION: {
     source: 'US_DRIVERS_LICENSE_1' | 'US_TELCO_1' | 'US_TELCO_2' | 'US_CONSUMER_1' | 'US_CREDIT_BUREAU_1' | 'US_CREDIT_TELCO' | 'MX_CONSUMER_1' | 'BR_GOVT_1' | 'CA_RES_CREDIT' | 'UK_CREDIT_BUREAU_1' | 'ES_1' | 'CL_1' | 'AR_1' | 'GR_1' | 'GT_1' | 'BR_CPF_1' | 'RISK_ADDONS_ONLY';
     checkName: boolean;
@@ -353,7 +356,7 @@ type FlowModuleConfig = {
   UNIVERSAL_IDENTITY: EmptyConfig;
   WATCHLIST: EmptyConfig;
   TRUST_GRAPH: EmptyConfig;
-  WATCHLIST_BUSINESS: EmptyConfig;
+  WATCHLIST_BUSINESS: WatchlistForBusinessConfig;
 };
 type FlowModule = { [K in keyof FlowModuleConfig]: {
   key: K;

package/dist/types-CTaL0XJz.d.ts

@@ -0,0 +1,80 @@
+import { r as FieldDef, t as CharacterClass } from "./textRules-D4NRinKY.js";
+//#region src/modules/kyb-checks/types.d.ts
+/** KYB checks a step can run. */
+type KybCheckModuleKey = 'identity' | 'address' | 'statusEntityType' | 'personAssociation' | 'webPresence' | 'websiteAnalysis' | 'industryInfo' | 'financialIntelligence' | 'groupStructure';
+/**
+ * A user-facing text: translate `key`, show `text` when it has no translation.
+ * A param that is itself a `KybText` is translated before it's inserted.
+ */
+type KybText = {
+  key: string;
+  text: string;
+  params?: Record<string, string | KybText>;
+};
+/** A string, or the entries of a list field. */
+type KybFieldValue = string | string[];
+type KybUnsupportedModule = {
+  module: KybCheckModuleKey;
+  message: KybText;
+};
+/** Passed to `onFinish`. */
+type KybChecksResult = {
+  referenceId?: string;
+};
+/** Module configuration from the flow or workflow node. The backend applies `modules` when it builds the form. */
+type KybChecksConfig = {
+  modules?: KybCheckModuleKey[];
+};
+type KybFieldValues = Record<string, KybFieldValue>;
+type KybFieldErrors = Record<string, KybText>;
+type KybChecksErrorKind = 'load' | 'submit';
+/** A field check, run in order; the first failing rule's message is shown. */
+type KybValidationRule = {
+  type: 'required';
+} | {
+  type: 'allowedCharacters';
+  classes: CharacterClass[];
+  extra: string;
+  /** `letter` means A-Z in either case. */
+  ascii: boolean;
+  message: KybText;
+} | {
+  type: 'maxLength';
+  max: number;
+  message: KybText;
+};
+/** A check across fields, shown on the first field it names. */
+type KybFormLevelRule = {
+  type: 'oneOfRequired';
+  fields: string[];
+  message: KybText;
+};
+/**
+ * One field to render, like eKYB's `EkybFieldDef`. `label` and option labels
+ * are translation keys; each `labelText` is the served English fallback.
+ */
+type KybFieldDef = Omit<FieldDef, 'type' | 'options'> & {
+  type: 'text' | 'dropdown' | 'phone' | 'list';
+  labelText: string;
+  options?: {
+    value: string;
+    label: string;
+    labelText?: string;
+  }[];
+  /** For a text field: the input type the keyboard hint asks for. */
+  inputType?: 'url' | 'email';
+  /** For a phone field: the country calling code to start with. */
+  phoneCountry?: string;
+  /** Changing the field fetches the form again with this query parameter. */
+  refetchOnChange?: string;
+  /** The value the backend served, used until the user changes it. */
+  initialValue: KybFieldValue;
+  validation: KybValidationRule[];
+};
+type KybChecksSection = {
+  id: string;
+  title?: KybText;
+  fields: KybFieldDef[];
+};
+//#endregion
+export { KybChecksSection as a, KybFieldValue as c, KybText as d, KybUnsupportedModule as f, KybChecksResult as i, KybFieldValues as l, KybChecksConfig as n, KybFieldDef as o, KybValidationRule as p, KybChecksErrorKind as r, KybFieldErrors as s, KybCheckModuleKey as t, KybFormLevelRule as u };

package/dist/{types-Ckir_BEs.d.ts → types-Cd0J0F9D.d.ts}

@@ -1,4 +1,4 @@
-import { a as RegulationTypes } from "./types-B6HsSzpk.js";
+import { a as RegulationTypes } from "./types-CRaFu6wS.js";
 //#region src/modules/mandatory-consent/types.d.ts
 type RegulatoryConsentType = 'MANDATORY' | 'ML';
 type MandatoryConsentConfig = {

package/dist/{types-CK8Jbjkp.d.ts → types-Csh8vzPo.d.ts}

@@ -1,4 +1,4 @@
-import { a as RegulationTypes } from "./types-B6HsSzpk.js";
+import { a as RegulationTypes } from "./types-CRaFu6wS.js";
 //#region src/internal/fingerprint/types.d.ts
 type DeviceFingerprintResult = {
   success: boolean;