# Visitt and Visitt+: technical investigation dossier
[Start with the five-minute team brief](visitt-rea-team-brief.html) · [Browse every technical record](technical-records.html) · [Download the record set](supplements/visitt-rea/records.jsonl)
**Reading this evidence:** code observations describe the captured client, not guaranteed behavior in a customer tenant. The source investigation audited the retained findings and repeated five native functions. This publishing host verified the transfer and integration; it did not repeat the raw-code investigation. Historical phase statements remain dated. Source artifact URNs identify withheld files; they are not download links.
Research snapshots: 2026-10-11 and 2026-10-12. Supplement publication date: 2026-10-13.
This is an independent static artifact investigation with two bounded unauthenticated account-entry observations. It is not an authenticated product benchmark. The same tested identifier was unrecognized in both apps; that does not establish that personal email signup, invitations or sanctioned evaluation access are impossible.
## What was recovered
The two installed iOS ARM64 packages use React Native / Hermes shells around separately hosted frontends. Visitt points to app.visitt.io; Visitt+ points to portal.visitt.io. All Hermes function blocks were disassembled with approximate reconstruction; 67 selected native functions were analyzed across three passes (46 Visitt, 21 Visitt+). This is partial native coverage.
The supplement indexes 125 findings, 848 client API variants/documents, 120 selected route declarations and 20 client-selected model families. These counts describe extraction coverage, not features, backend completeness or successful workflow execution.
## Publication verification
All 125 retained findings received an independent source audit before this supplement was prepared. Five representative functions were repeated in fresh Ghidra databases through REA, and the compared procedure identities, pseudocode, assembly, control flow, calls and references matched the retained dossiers. Original executable digests matched. This is bounded source and repeatability verification; it does not establish authenticated behavior or complete semantic recovery. Fresh repeats do not increase the 67 unique native dossier count.
## Evidence boundaries
The first 100 findings describe the initial static/anonymous phase, followed by two runtime account-entry tests, six initial Ghidra findings, twelve continuation/selector findings, and 5 further offline export/SSO findings. Earlier no-login/no-OTP, deferred-Ghidra and unresolved native-implementation statements are historical phase records; current sections supersede those statuses.
Source byte intervals are zero-based UTF-8 and end-exclusive unless the originating ledger specifies otherwise. Portal character_start/character_end are JavaScript UTF-16 code-unit positions, distinct from byte coordinates. Hermes offsets are file offsets in main.jsbundle. Ghidra virtual body ranges have inclusive ends; separately mapped file ranges have exclusive ends. Pseudocode is reconstructed, not original source.
Installed app versions and current hosted frontend snapshots are independent. Expo OTA introduces another independent update layer.
Backend resolver logic, actual session cookie flags, server authorization, tenant configuration, AI models/prompts, delivery/financial outcomes, runtime permissions and complete native internals remain unknown.
Runtime scope: one login-code request per app using a newly generated identifier; both remained unauthenticated. No deliberate GraphQL operations, business mutations, upload or successful SSO was tested. Native metadata and client code establish selected implementation paths, not server outcomes.
Raw executables, extracted JavaScript, full pseudocode, original archives, private workstation paths and test mailbox details are excluded. Local-artifact sources use portable URNs with hashes; those URNs identify withheld artifacts rather than public downloads.
## Finding register
### Package metadata
#### META-01 — These are iOS App Store bundles wrapped for macOS, both arm64 and built with new React Native architecture enabled
These are iOS App Store bundles wrapped for macOS, both arm64 and built with new React Native architecture enabled. Visitt 0.5.9 build1 is io.visitt.visitt; Visitt+ 1.0.0 build2 is io.visitt.portal. Both declare iOS minimum18 and Mac minimum12. Their display names differ although both executable names are Visitt.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-3ddc38be0a7a63a6`, `src-47faff5c967aa877`.
#### META-02 — Both signed app entitlements use developer team G8B7738PMZ and production APNs
Both signed app entitlements use developer team G8B7738PMZ and production APNs. Visitt has associated domains app.visitt.io and visitt.co.il. Plus has portal.visitt.io and portal.visitt.co.il. Their scheme pairs are visitt/io.visitt.visitt and visitt-portal/io.visitt.portal respectively.
Limit: Declarations establish routing capability, not proof every route executes.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-3ddc38be0a7a63a6`, `src-47faff5c967aa877`.
#### META-03 — Both apps configure Expo SDK54, an sdkVersion runtime policy, production OTA channels, EXUpdatesEnabled=true, EXUpdatesCheckOnLaunch=ALWAYS, and zero
Both apps configure Expo SDK54, an sdkVersion runtime policy, production OTA channels, EXUpdatesEnabled=true, EXUpdatesCheckOnLaunch=ALWAYS, and zero launch wait. Their distinct Expo project IDs and URLs identify separate configured update projects.
Limit: The installed embedded code can differ from later downloaded OTA code. Runtime cache and remote update state were not inspected.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-01c082dd8e6184ba`, `src-4c4ed428d837eed5`, `src-d91417166c3ddd7f`, `src-f4d31a2a7e3aaf44`.
#### META-04 — Embedded manifest commitTime is 2025-11-23T16:01:21.244Z for Visitt and 2026-09-02T13:40:22.567Z for Plus
Embedded manifest commitTime is 2025-11-23T16:01:21.244Z for Visitt and 2026-09-02T13:40:22.567Z for Plus. Visitt manifest embeds one EvilIcons font asset; Plus manifest asset list is empty.
Limit: commitTime is a package metadata field, not observed build, install, or publication time. Empty asset list does not imply the bundle contains no image assets.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-1f55f71beb4a3a56`, `src-a6cc2fb4faf754e3`.
#### META-05 — Visitt declares camera use for work orders/documents/visits; geolocation for work orders/routine inspections; and saving downloaded photos
Visitt declares camera use for work orders/documents/visits; geolocation for work orders/routine inspections; and saving downloaded photos. It also declares microphone/video usage and always-location usage strings. Plus declares camera for requests/updates and microphone/video, with no location/photo-library usage keys in the shipped Info.plist.
Limit: Permission prompts describe intended uses; actual execution and user grants were not observed. Absence scoped to shipped Info.plist.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-3ddc38be0a7a63a6`, `src-47faff5c967aa877`.
#### META-06 — Both Info.plist ATS dictionaries forbid arbitrary loads and permit local networking
Both Info.plist ATS dictionaries forbid arbitrary loads and permit local networking. Visitt additionally declares WKAppBoundDomains pwa-visitt.eu.ngrok.io, app.visitt.io, staging.visitt.io; Plus lacks this key.
Limit: WKAppBoundDomains only constrains navigation when the WebView is configured accordingly; the declaration alone does not prove navigation restriction.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-3ddc38be0a7a63a6`, `src-47faff5c967aa877`.
#### META-07 — Visitt uses light UI style and has a single splash/icon appearance
Visitt uses light UI style and has a single splash/icon appearance. Plus uses automatic UI style and its asset catalog contains dark AppIcon, SplashScreenLogo and SplashScreenBackground renditions.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-3ddc38be0a7a63a6`, `src-47faff5c967aa877`, `src-875e9cfa5c993a3f`, `src-c5dfacb6dfee3fe6`.
#### META-08 — React.framework, ReactNativeDependencies.framework and hermes.framework have byte-identical executables between the two apps
React.framework, ReactNativeDependencies.framework and hermes.framework have byte-identical executables between the two apps. Hermes framework reports0.12.0. All three framework Mach-O encryption commands have cryptid=0.
Limit: Framework version labels do not determine exact React Native npm version. SDK54 is independently declared in Expo config.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-02d4f0822d6f9674`, `src-2961c72b1ec15d07`, `src-40bb0c25481e942d`, `src-4fb13cae4b6ea83c`, `src-53437f5ebe46c2d8`, `src-6b1c60679d9460fc`, `src-8606881a5641c5e1`, `src-a7a3d97b16b94cb6`, `src-ad99434c5c926e1e`, `src-bcf8b13b6ae1d3ed`, `src-c48ca223867ebdfb`, `src-dd5b9e862fa8c2a6`.
#### META-09 — Both main executables are thin little-endian arm64 Mach-O and report LC_ENCRYPTION_INFO_64 cryptid=1 for file byte interval [20480,24576)
Both main executables are thin little-endian arm64 Mach-O and report LC_ENCRYPTION_INFO_64 cryptid=1 for file byte interval [20480,24576). Command offset is4896 in Visitt and4976 in Plus; cryptid fields are4912 and4992. The remainder is not covered by the declared encryption range.
Limit: No decryption was attempted. Any native disassembly crossing this 4KB region requires an encrypted-code caveat. cryptid is metadata, not runtime plaintext verification.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-3546d601dcbc0d7f`, `src-8c920a69b64bdfa8`.
#### META-10-visitt — Native Objective-C class-name section contains the following CocoaPods marker strings, establishing that corresponding native libraries were linked.
Native Objective-C class-name section contains the following CocoaPods marker strings, establishing that corresponding native libraries were linked.
Limit: Library inclusion is not evidence that every library feature is exposed or used.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-8c920a69b64bdfa8`.
#### META-10-visitt-plus — Native Objective-C class-name section contains the following CocoaPods marker strings, establishing that corresponding native libraries were linked.
Native Objective-C class-name section contains the following CocoaPods marker strings, establishing that corresponding native libraries were linked.
Limit: Library inclusion is not evidence that every library feature is exposed or used.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-3546d601dcbc0d7f`.
#### META-11 — Visitt is the operations-oriented shell and Plus is the tenant portal shell
Visitt is the operations-oriented shell and Plus is the tenant portal shell. The split is supported by permission text, domain/bundle IDs and public store links in app.config.
Limit: Product workflow details require JavaScript/web tracing; metadata alone does not establish the complete feature set.
Evidence status: `static_inference_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-4c4ed428d837eed5`, `src-d91417166c3ddd7f`.
#### META-12 — Each top-level PrivacyInfo.xcprivacy declares no collected-data types and no tracking, plus required-reason APIs for file timestamps, user defaults, b
Each top-level PrivacyInfo.xcprivacy declares no collected-data types and no tracking, plus required-reason APIs for file timestamps, user defaults, boot time, and disk space. Plus also has a Sentry privacy manifest declaring crash, performance and other diagnostic data for app functionality with linked/tracking=false.
Limit: Privacy manifests are developer/library declarations, not an observation of actual data collection. Root manifest empty declarations do not cancel Sentry declarations or exclude data collection by remote web content.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-1cd54d1a72f6a92d`, `src-f4ff396562d24eb3`.
#### META-13 — Plus app.config includes @sentry/react-native configuration for organization visittio/project portal-native; native class marker RNSentry and Sentry p
Plus app.config includes @sentry/react-native configuration for organization visittio/project portal-native; native class marker RNSentry and Sentry privacy bundle corroborate library packaging. Plus also includes ExpoOtpAutofillConsent native marker.
Limit: Native OTP and Sentry packaging do not prove a specific OTP channel or active session replay without JavaScript initialization evidence.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-3546d601dcbc0d7f`, `src-4c4ed428d837eed5`.
#### META-14 — The shipped tree is compact: Visitt has77 regular files plus1 symlink,28,563,224 bytes; Plus has60 regular files plus1 symlink,26,571,570 bytes
The shipped tree is compact: Visitt has77 regular files plus1 symlink,28,563,224 bytes; Plus has60 regular files plus1 symlink,26,571,570 bytes. Both include one main.jsbundle and3 dynamic frameworks. No independent app extension directory or additional app executable was found within either selected tree.
Limit: File totals count wrapper and receipt artifacts, exclude directories, and do not double-count symlink targets. Search bounded to selected app bundles.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-40c8dd7a73c1cc32`, `src-5341a8123c5a8238`.
#### META-15 — The initial metadata pass identified Ghidra as potentially useful for focused native questions
The initial metadata pass identified Ghidra as potentially useful for focused native questions. Subsequent completed passes recovered 67 selected native functions across both apps, clarifying WebView, camera/scanner, location, notifications, linking, FileSystem/Sharing and SSO paths. Hermes and hosted frontend code remain the main evidence for business workflows. Each main executable declares a 4 KiB encrypted interval; shared dependency libraries are identical.
Limit: Historical metadata assessment, updated with the completed native passes. Selected native bodies avoid encrypted bytes, but some called helpers remain opaque. These results do not establish authenticated behavior or complete native recovery.
Evidence status: `static_inference_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt, Visitt+.
Sources: `src-2dd63e33831da665`, `src-39f0261df0149d70`, `src-a69f285c2f6c762f`.
### Visitt native shell
#### CORE-01 — The bundled Visitt application is a React Native shell around hosted https://app.visitt.io
The bundled Visitt application is a React Native shell around hosted https://app.visitt.io. App wraps AppContent in SafeAreaProvider. AppContent renders a WebView, a conditional barcode overlay, a connection error fallback, keyboard/safe-area layout, and a dark status bar. Business screens are supplied by the hosted web app.
Limit: Static shipped shell, not an observed session. Business-screen conclusion is an architectural inference from the WebView source; later OTA or web deploys may differ.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-02 — Web-to-native messages are JSON parsed from nativeEvent.data
Web-to-native messages are JSON parsed from nativeEvent.data. The main dispatcher first invokes deep-link/notification handlers, then switches on message. Native-to-web messages serialize an object and inject JavaScript calling window.postMessage(object,"*"). The injected script also logs the object.
Limit: No runtime messaging or actual payloads were captured. Malformed JSON behavior is not normalized by a dispatcher-wide catch in the inspected function.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-03 — The native SSO capability probe responds native_sso_available/available=true
The native SSO capability probe responds native_sso_available/available=true. sso_login accepts authorizationUrl and returnToPath; it makes an Expo redirect URI, calls openAuthSessionAsync(authorizationUrl,redirectURI), extracts the first /code=([^&]+)/ match from result.url, and returns sso_login_code with returnToPath and code (null if no match). The inspected branch has no explicit result.type check or code URL-decoding step.
Limit: No provider login was performed. OAuth server, state/PKCE handling and token exchange are outside this shell branch and may exist in the web app or Expo implementation. A cancelled auth result without URL is not handled by a dedicated result-type branch here.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-04 — ask_for_camera_permissions checks Camera.getCameraPermissionsAsync; if status is not granted it requests camera permissions and returns the granted bo
ask_for_camera_permissions checks Camera.getCameraPermissionsAsync; if status is not granted it requests camera permissions and returns the granted boolean to its caller. ask_for_location_permissions uses foreground permissions, requesting if not already granted. These standalone requests do not emit a dedicated permission response message from the main dispatcher.
Limit: Info.plist contains always-location descriptions, but the app-level permission helper traced here requests foreground location. No inference of background tracking.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-05 — request_geo_position awaits the foreground-permission helper, attempts getCurrentPositionAsync({accuracy:5}), and sends response_geo_position with coo
request_geo_position awaits the foreground-permission helper, attempts getCurrentPositionAsync({accuracy:5}), and sends response_geo_position with coords on success. It sends response_geo_position_permission_denied when the permission result is false or E_LOCATION_SETTINGS_UNSATISFIED is caught. The code still attempts position acquisition after the permission helper, before inspecting its boolean in cleanup.
Limit: accuracy is numeric5 in the bytecode; exact device GPS behavior and OS permission enforcement were not observed. Other position errors can leave no dedicated error payload.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-06 — is_barcode_scanner_available always reports barcode_scanner_available/available=true
is_barcode_scanner_available always reports barcode_scanner_available/available=true. open_barcode_scanner requests camera permission; granted shows a scanner overlay, denied shows a Camera Permission alert with Cancel and Settings/openSettings. ScannerScreen configures qr,pdf417,code128,code39,code93,codabar,ean13,ean8,upc_e,datamatrix,aztec. On a scan it triggers Success haptics, closes the scanner, and posts barcode_scanned with barcode:{type,data}. Close posts barcode_scanner_closed.
Limit: Capability availability is a hard-coded response, not device runtime probing. Barcode success values and camera UI were not exercised.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-07 — download_image accepts url,filename,format and calls a URL-file export helper
download_image accepts url,filename,format and calls a URL-file export helper. It appends .format when missing (case-insensitive), permits the image/video and document extension lists shown below, downloads using Expo File.downloadFileAsync into Paths.document with filename/idempotent=true, confirms file exists, resolves MIME, opens Sharing.shareAsync with mimeType/UTI and dialogTitle Save , then posts success and deletes the local file. It reports unsupported format and download/share errors as download_error.
Limit: download_started is emitted after the URL download completes and format validation passes, just before shareAsync. download_success means shareAsync resolved; it does not prove the user saved or chose a destination. Cleanup is best-effort.
Limit: The download_success bridge message follows native share-promise resolution; it does not establish that the user saved or shared the file. The later native completion review includes a resolver path for nil activityType with completed=false.
Limit: The Hermes helper supplies filename as an option, but the retained native DownloadOptions declares only headers and idempotent. With a directory destination the native completion chooses response.suggestedFilename or the source URL basename, so the displayed Save title and native destination basename can differ. Unknown-option decoding is not established.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-08 — save_file_from_base64 accepts base64,filename,mimeType
save_file_from_base64 accepts base64,filename,mimeType. It appends a MIME-derived extension only when the filename has no terminal alphanumeric extension, strips a data: prefix through the comma when present, decodes base64 into bytes, creates a file under Paths.document, writes it, posts download_started, shares it, posts download_success, then tries to delete it. Default create MIME is application/octet-stream. This branch has no URL-helper extension allowlist.
Limit: Again success is share completion, not observed saving. File existence, payload validity, OS destinations and cancellation behavior are not runtime-tested.
Limit: The download_success bridge message follows native share-promise resolution; it does not establish that the user saved or shared the file. The later native completion review includes a resolver path for nil activityType with completed=false.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-09 — WebView explicitly enables geolocationEnabled,cacheEnabled,startInLoadingState,useWebKit,allowsBackForwardNavigationGestures and limitsNavigationsToAp
WebView explicitly enables geolocationEnabled,cacheEnabled,startInLoadingState,useWebKit,allowsBackForwardNavigationGestures and limitsNavigationsToAppBoundDomains. A NetInfo hook holds connectionState. cacheMode is LOAD_DEFAULT when isInternetReachable is truthy, otherwise LOAD_CACHE_ONLY.
Limit: LOAD_CACHE_ONLY is a prop selection; this static evidence does not establish usable offline business workflows, cached data completeness, or equivalent behavior on each platform.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-10 — When navigation URL does not include the baseURL string https://app.visitt.io, the shell stops WebView loading, calls Linking.canOpenURL, and when all
When navigation URL does not include the baseURL string https://app.visitt.io, the shell stops WebView loading, calls Linking.canOpenURL, and when allowed calls WebBrowser.openBrowserAsync. URLs containing the base string remain in the WebView path. The check is substring includes rather than a parsed-host comparison. Native hardwareBackPress goesBack when canGoBack state is true.
Limit: This is implementation behavior, not a validated security finding. OS app-bound domains and WebView library navigation policies also apply.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-11 — Native app visibility changes post app_state_visibility_change with state to the WebView
Native app visibility changes post app_state_visibility_change with state to the WebView. Incoming universal/deep links are parsed into /path plus serialized queryParams; exp dev links get /--/ handling. At startup the parsed path is appended to the hosted base URL. Later Linking url events post change_url with the relative URL.
Limit: Only the parsed path/query are forwarded by this helper; actual web route handling was delegated to separate analysis. No live URL event was sent.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-12 — Notification navigation reads notification.request.content.data.link and optional trackingLink
Notification navigation reads notification.request.content.data.link and optional trackingLink. When link is truthy it optionally fetches trackingLink and posts change_url with link. app_ready replays the stored notification link. The hook takes the last notification response when online and subscribes to future response/tap events.
Limit: The tracing did not fetch tracking links or trigger notifications. Static code indicates the call, but endpoint semantics and notification provenance are unknown.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-13 — When online, push registration requires Device.isDevice and existing permission status granted; it calls getExpoPushTokenAsync and stores token.data
When online, push registration requires Device.isDevice and existing permission status granted; it calls getExpoPushTokenAsync and stores token.data. A separate ask_for_push_notifications_permissions message explicitly requests permissions and then retrieves a token if granted. Tokens are forwarded as push_notification_token_updated/token on state change and in response to user_ready. Project options prefer expoConfig.extra.eas.projectId, then easConfig.projectId, else experienceId @visitt/visitt.
Limit: No token was acquired or disclosed. Server token association is in the web app; OS permission state and device capability were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-14 — The push hook sets badge count to0 on initial setup and whenever AppState becomes active
The push hook sets badge count to0 on initial setup and whenever AppState becomes active. It stores notification responses for routing, rather than demonstrating a full in-app notification inbox in the native shell.
Limit: This does not exclude an inbox or notification center in hosted web code.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-15 — WebView errors post webview_error with serialized error details, display code/description/URL, and for nonempty failing URLs increment retry count and
WebView errors post webview_error with serialized error details, display code/description/URL, and for nonempty failing URLs increment retry count and schedule reload after count*500ms through count5. Above5 the shell shows its Connection Error fallback. The fallback exposes network IP,type,connected/reachable state and retry attempts, with Retry Connection. The manual retry returns to the WebView. Content process termination increments a WebView key and retains the terminated URL, remounting it.
Limit: Retry counter reset on successful load is not established in this function; inspected loadEnd callback sets completion=true. Network diagnostics are UI content, not captured real addresses.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-16 — Splash auto-hide is prevented during module initialization
Splash auto-hide is prevented during module initialization. The shell hides it once reachability state is defined, loadEnd is truthy and error is absent, or when giving up on retry/no-url failures. Background color changes for parsed login,signup,forgot-password,magic-code paths between configured #F5F8FB and white.
Limit: A path list establishes shell styling decisions, not the full authentication route implementation.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
#### CORE-17 — No app-specific biometric login, secure keychain storage, background-location loop or complete offline synchronization engine was established in the t
No app-specific biometric login, secure keychain storage, background-location loop or complete offline synchronization engine was established in the traced shell modules. Native dependency presence alone is insufficient to claim those features.
Limit: Bounded negative result: app main module569 and linked app hook functions only. Hosted web code, native library interiors, OTA state and runtime were outside this negative search.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-3a77fc64351d025f`, `src-bc5d6bb3cfaa7727`.
### Visitt workflows
#### CW01 — Work order creation and acceptance
Observed: The work order form validates description and building, conditionally requires a category, and clears a subcategory when no parent category is selected.
Observed: The normal submit path transforms form data and invokes createWorkOrder; a successful response supplies the issue ID/sequence for the success toast and its issue navigation action. Draft storage is removed after success.
Observed: The acceptance banner exists only when the company acceptance feature is enabled, the issue type passes a helper check, status is AWAITING_ACCEPTANCE, and the current user is assigned. Accept sets OPEN; the success toast offers a separate IN_PROGRESS mutation.
Client sequence: User fills description/building/category/site/assignee/contact fields. Form validation precedes the submit callback.
Client sequence: Submit transforms the input and calls createWorkOrder; response leads to a success toast and optional /issue/{id} modal link. Errors are mapped into form state.
Client sequence: An assigned user clicks accept on the eligible banner -> updateIssueStatus(OPEN). Clicking start-work in that toast -> updateIssueStatus(IN_PROGRESS).
Client rule: Displayed statuses include AWAITING_ACCEPTANCE, PENDING, OPEN, IN_PROGRESS, COMPLETED, CANCELED. The option hook hides AWAITING_ACCEPTANCE without the acceptance feature, except its superadmin branch.
Client rule: OPEN can be displayed as accepted when acceptance workflow is in use. These display and update paths establish client lifecycle behavior, not a complete server transition matrix.
Unknown: The backend transition authorization and all legal transitions are not visible in the downloaded client.
Unknown: Role hierarchy is not evaluated here; feature/assignment conditions are direct client observations.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-42f47fdd77746304`, `src-c31c4c6d00c29dcf`, `src-caf9def2a900f05c`, `src-de2c8b09c1c6d91d`, `src-e8de3f8559ae6185`.
#### CW02 — Recurring work order schedules
Observed: The same work order submit callback branches on isRecurring plus recurrenceData. It creates or updates a recurring schedule rather than creating an immediate ordinary work order.
Observed: Conditional schema requires rrule.freq, interval, and firstDueDate; optional creationLeadTime requires count/unit. The recurrence hook fetches existing schedule/workOrderData, and create/update/archive mutations refresh recurringWorkOrderSchedules.
Observed: A local RRule preview expands frequency, interval and optional weekday/monthday/setposition/month selectors from firstDueDate; it is a client date preview, not proof of server dispatch timing.
Client sequence: Toggle recurring and enter recurrence dates/rule.
Client sequence: Validation -> form-to-schedule transform -> createRecurringWorkOrderSchedule or updateRecurringWorkOrderSchedule(scheduleId,input).
Client sequence: Success clears the draft, gives a recurring success toast, and closes the form; archiveSchedules returns deleted IDs and chooses singular/plural toast.
Client rule: Existing schedule query is skipped when caller requests skip or schedule ID is absent.
Client rule: Creation/update both refetch recurringWorkOrderSchedules.
Unknown: The server scheduler, retry behavior, timezone execution, and scheduling guarantees are not contained here.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-b159f4c9791b434b`, `src-e8de3f8559ae6185`.
#### CW03 — Inspection assignment builder and completion policy
Observed: Submission copies assignment items, strips client-only fields and __typename, separates parent/site tasks from subitems, trims multiple-choice options and trigger values, and normalizes numeric thresholds.
Observed: The serialized payload maps selected sites to buildingIds/siteIds, users to assignedUserIds, and custom scheduling to rrule. Completion is represented as END_OF_UNIT, NEXT_OCCURRENCE, or an ISO duration.
Observed: Validation requires name, interval, start date, nonempty items and sites per item. Site-task items require child tasks; an item-count limit and custom duration bounds are enforced before mutation.
Client sequence: User configures main info, tasks/sites, and ordering across a three-step form.
Client sequence: Submit normalizes payload -> validates item/site structure -> createAssignment or updateAssignment.
Client sequence: Success resets form/error/submitting state and closes; failures preserve the error. A separate submit path opens confirmation when editing certain current visit statuses.
Client rule: For a day interval, numeric closeAfter is serialized in hours; otherwise in days.
Client rule: Custom completion duration is compared to a recurrence-length approximation (weekly7, monthly30, yearly365 times interval).
Client rule: Offline inspection queue internals are outside this finding.
Unknown: The server-side inspection generation and exact holiday/scheduling engine are not reconstructed here.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-14b60356eaf54065`.
#### CW04 — Automation trigger/action model
Observed: Rules serialize eventType, optional triggerDelay{unit,number}, eventFields, action, actionValue and isBasedOnOfficeHours. Array-valued filters flatten into repeated {type,_id} records.
Observed: New issue offers due date, priority, assigned-user and notify actions; completed issue offers createIssue; other triggers offer notifyUsers. Timed events are not-seen, not-responded and not-completed.
Observed: Changing category clears subcategory; selecting set-priority removes priority conditions. Users/time/priority action values are JSON-encoded client values.
Observed: The duplicate-detected trigger is shown only with VISITT_AI. SLA customer configuration filters trigger/action choices. The completed-trigger feature expression contains a negated flag plus existing-rule exception; it should not be summarized as a conventional positive feature gate.
Client sequence: User selects trigger, optional delay, filters, action and value.
Client sequence: onSubmit blocks duplicate submissions -> validates required fields -> flattens filters -> createAutomation/updateAutomation.
Client sequence: Success tracks details, clears submitting, shows toast and closes; error returns graphQL message and increments failed attempts.
Client rule: Timed events require triggerDelay. actionValue is required except createIssue and a protected default-assigned-users automation case.
Client rule: Exact completed-trigger condition: existing eventType===ISSUE_COMPLETED OR NOT company.features includes WO_COMPLETED_CREATE_WO_AUTOMATION.
Unknown: Execution scheduling, backend matching semantics, and delivery guarantees remain server-side.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-b12bfb0dd00555c0`, `src-c575ecb704cc6f94`.
#### CW05 — COI document AI extraction, compliance, manual overrides
Observed: Document analysis queries documentItem with cache-and-network. With COI_AI enabled and images present but no extractedData, it starts polling; after extraction it can keep polling for aiValidationResult when COI requirements exist.
Observed: Polling interval is2000ms, timeout360000ms; a45000ms timer sets the slow-extraction UI flag. Retry calls aiExtractDocumentItemData(documentItemId); a mutation failure sets slow state.
Observed: Manual override edits are kept locally, merged over extracted data for display, then persisted with updateCoiExtractedDataOverrides. Approval is separately persisted using updateCoiApprovalStatus with pending/compliant/non_compliant values.
Observed: Restart compliance clears aiValidationResult in the Apollo cache, refetches and restarts polling. This client method does not itself contain a direct compliance-model API call.
Client sequence: Open a document item -> fetch images/extracted data/AI result/requirements -> feature and readiness conditions start polling.
Client sequence: Retry explicitly requests server extraction; results update from documentItem polling.
Client sequence: User changes fields -> saves overrides -> success toast/reset dirty edits. User changes approval -> separate approval mutation and documents refetch.
Client rule: Observed extraction status enum: pending,processing,extraction_completed,extraction_failed,review_completed. Review/approval statuses include pending,compliant,non_compliant.
Client rule: Manual override and approval are distinct actions; no local AI model implementation is shipped in these handlers.
Unknown: AI provider/model, prompts, confidence calibration, extraction implementation and backend revalidation are not present.
Unknown: A client compliant label does not independently establish legal/insurance compliance.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-0431cdc4d19d61d7`, `src-2aa9f55b844ad345`, `src-30329eb804192942`, `src-5997720f8bc87786`, `src-825b41c0c2d9607d`.
#### CW06 — AI text enhancement with undo/retry
Observed: The menu offers Rephrase, Fix_Spelling, Rewrite_Formal, Rewrite_Friendly and Make_Longer. It counts words and replaces the choices with a length hint when more than300 words.
Observed: A lazy network-only rephraseText query sends text, selected action, rephrase type, companyId and optional issueId. Nonempty response replaces the controlled composer text; empty result emits an error.
Observed: The original text is retained for undo. Try again resubmits the previous original text using the last action; send-anyway is a separate callback in the adoption prompt.
Client sequence: User selects an AI action -> query with current composer text/context.
Client sequence: Response rephrasedText replaces input and stores original/action for retry and undo.
Client sequence: Undo restores previous original text; sending the message remains a separate UI action.
Client rule: Menu word limit is a client UI condition, not proof of server enforcement.
Client rule: No provider/model/prompt implementation appears in this shipped chunk.
Unknown: Server AI architecture and exact text data retention are unknown.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-1e119a9e7d3bc471`.
#### CW07 — Broadcast composition, recipients and delivery request
Observed: Recipient filters are built with companyId, selected filter type/value and optional active-status condition. Recipient count is queried only once a value is selected; portal invitation presets query eligible contact IDs and prefill subject/body/filter.
Observed: Submit returns while submitting/uploading and rejects zero recipient count via a manual form error. Body, from and subject are sanitized before createBroadcast; native WebView bodies receive an additional conversion helper.
Observed: Branding is normalized into none/app-brand/brand/custom with selected header/footer image IDs. Success prepends broadcast to Apollo lists/increments counts, shows sent/invited toast and navigates back or to /broadcasts.
Client sequence: Choose recipients, channels, subject/body/from and branding.
Client sequence: Recipients drive count and eligibility queries -> validation -> sanitization -> createBroadcast(input).
Client sequence: Success updates cache/counts and navigates; errors produce server-error state and toast.
Client rule: Notification channels are passed as user-selected form values. The observed send success is the createBroadcast response.
Client rule: The handler does not prove delivery receipt, channel retry policy or scheduling support.
Unknown: Actual email/SMS/push dispatch, provider contracts and delivery outcomes remain backend concerns.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-4df4a4a26bda9b7b`, `src-5c26386528cff518`.
#### CW08 — Visitor check-in and watchlist resolution
Observed: Visitor check-in uses a ref guard against duplicate submission and sends visitorId/companyId. It trusts server isOk/reason/visitor and displays success/error; successful callbacks receive accessToken.
Observed: The check-in route parses accessToken from the URL and calls checkInVisitor with companyId/token. The UI displays returned visitor/host/comment and outcome.
Observed: Watchlist alerts show server-provided watchlistMatches and reasoning as possible-match beta alerts. Dismissing an alert calls removeWatchlistMatch(visitorId,watchlistEntryId) and refreshes visitor/list queries; deleting a watchlist entry uses a separate archive confirmation.
Observed: Watchlist name variant generation is a network-only query gated by VISITT_AI and explicit generation callback; the client does not implement the match algorithm.
Client sequence: Visitor row/manual/token scan action -> checkInVisitor -> outcome and refreshed visitor state.
Client sequence: Possible watchlist match -> show entry/name variants/action notes and server reasoning.
Client sequence: User removes match -> mutation/refetch; user deletes entry -> confirmation -> archive mutation.
Client rule: canCheckIn/canPrintAccessBadge/isActive/isExpired/isFuture/isCheckedIn are server-returned state.
Client rule: Removing one match is not shown as adding a permanent allowlist.
Client rule: An AI-generated variant is not proof that the matching engine itself uses a particular AI method.
Unknown: Match thresholds/model, token issuance, badge printing internals and server access-control decisions are unknown.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-0a2e0912e4320ac6`, `src-372cfd89017136ae`, `src-48ea3d596667c398`, `src-a50563f2d2097dea`.
#### CW09 — Amenity availability, costs, inquiry and conflict resolution
Observed: Changing amenity/date/range drives detail, slot and price queries. Slots are network-only and carry excluded current booking ID, proposed status/type; price query is skipped without a selected range start.
Observed: The form validates booking type, amenity/date/start/end, and either contact or external booker name; required custom fields are validated by format. Date changes clear the selected time range.
Observed: New external bookings default to INQUIRY. The inquiry-flow feature controls the type selector. Client code checks configured buffer-time overlap and shows slot/cost/custom-field UI.
Observed: Create sends bookingRange/customFields/type/status/notifyContacts. Structured server overlaps are displayed in a conflict modal; only its confirm callback resubmits with cancelOverlappingInquiryBookings:true. Status updates similarly take explicit comments/notification/overlap options.
Client sequence: Select booker/amenity/date -> live slots/details/costs -> fill range/custom questions.
Client sequence: Validated form -> createAmenityBooking(input) -> toast/refetch/back navigation.
Client sequence: On server overlap error -> conflict modal -> explicit confirm -> resubmit with overlap cancellation flag.
Client rule: Contact notification defaults true for new tenant bookings.
Client rule: Availability and costs come from server queries; local buffer warnings supplement server conflict handling.
Client rule: Status action UI checks amenities capability/company feature or superadmin and hides action when canceled.
Unknown: Server race-condition protection, pricing policy and actual payment processing are not reconstructed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-404fe672a036fe4f`, `src-79187d7e157ce34f`, `src-de7872cd974dd5dc`.
#### CW10 — Charge arithmetic, verification and accounting eligibility
Observed: Charge calculation converts price/markup to numbers, applies markup percent or fixed amount, multiplies by quantity (default1), then applies taxable tax. The breakdown rounds price/markup/tax/total using a shared helper.
Observed: Tax exemption reads current issue-tenant exemption for OPEN charges and the charge tenant snapshot for other statuses. Configured export transformation can split markup and tax into distinct accounting lines with charge codes and original actualChargeId.
Observed: Billing selection offers move-to-awaiting-sync only for an all-VERIFIED selection. The action UI requires a billing integration plus one of the explicit superadmin/customeradmin/companyadmin checks; missing billing tenants trigger a second selection step before updateChargesSyncEligibility.
Observed: The accounting panel queries canSyncCharges on configured integrations. The general helper separately queries company.allowChargesSyncToIntegration. Sync hook sends companyId/appId/chargeIds/postMonth to syncChargesToIntegration.
Client sequence: User creates/reviews charges -> computed totals and exemption-aware display.
Client sequence: Select verified charges -> confirm -> if needed choose integrated billing tenant for each issue -> updateChargesSyncEligibility.
Client sequence: Sync action sends selected IDs/month to accounting integration; eligibility and sync are distinct mutations.
Client rule: Role checks here are direct callsites; helper role inheritance was not reconstructed, so these are not strict claims about which other roles cannot access the workflow.
Client rule: Awaiting-sync does not itself mean posted successfully to external accounting.
Unknown: Accounting server transformations, Yardi posting behavior, retries, final ledger validation and actual payment collection are unknown.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-aee6a1cb1ba6dc8e`, `src-d1caa6d2015b0e7e`, `src-d4d0e6981730ecdc`.
### Visitt API, authentication and offline
#### core-api-graphql — Core web configures Apollo for same-origin /graphql with multipart upload support and apollo-require-preflight:true
Core web configures Apollo for same-origin /graphql with multipart upload support and apollo-require-preflight:true. Per-operation headers carry user-timezone, user-navigator-vendor, client-user-id, user-app, and activity marker. Default watch queries use cache-and-network.
Limit: Does not establish deployed server resolvers or authentication enforcement.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-9290922bbd3fcbcd`.
#### core-auth-rest — Password login, SSO initiation, magic-code validation and logout use REST endpoints
Password login, SSO initiation, magic-code validation and logout use REST endpoints. Password login lowercases emailOrPhone and sends password,userLang,recaptchaToken; SSO sends email,userLang,returnToPath,isNativeApp,recaptchaToken; magic-code validation sends code,userEmailOrPhone,userLang,newPassword,recaptchaToken.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-9290922bbd3fcbcd`.
#### core-auth-session-inference — The same-origin REST and GraphQL code is consistent with browser-managed session authentication: these app request builders do not attach an explicit
The same-origin REST and GraphQL code is consistent with browser-managed session authentication: these app request builders do not attach an explicit bearer token. The actual session cookie attributes and server session storage remain unknown.
Limit: Do not claim cookie flags, token persistence, or server session mechanism from client code.
Evidence status: `static_inference_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-9290922bbd3fcbcd`.
#### core-auth-cleanup — Login/validation and unauthorized/logout paths clear current-user state and Apollo store; login-event/logout-event localStorage markers synchronize ta
Login/validation and unauthorized/logout paths clear current-user state and Apollo store; login-event/logout-event localStorage markers synchronize tabs by reload. GraphQL UNAUTHENTICATED and HTTP 401 route to unauthorized handling outside login.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-9290922bbd3fcbcd`.
#### core-impersonation — Client exposes start/stop impersonation requests
Client exposes start/stop impersonation requests. Start submits userId and reason; both requests include x-visitt-csrf:1 and reload/redirect. This establishes client capability only.
Limit: Role authorization and audit retention are server behavior and unverified.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-9290922bbd3fcbcd`.
#### core-session-idle — Idle policy reads me.sessionIdleMinutes, records pointer/key/wheel/touch/scroll activity, shares last-activity timestamp across tabs, warns before exp
Idle policy reads me.sessionIdleMinutes, records pointer/key/wheel/touch/scroll activity, shares last-activity timestamp across tabs, warns before expiry and calls logout on expiration. Touch-session GraphQL query bypasses cache and marks x-visitt-user-activity:true. Warning period is min(60 seconds, half policy), at least one second; refresh interval is min(60 seconds, one-third policy). Enterprise-gated settings allow 1–1440 minutes and separate SSO timeout when a WorkOS connection exists.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-65dd50025e79ddbe`, `src-9290922bbd3fcbcd`.
#### core-cache-storage — Apollo normalized cache is persisted using localforage through a wrapper that disables persistence on storage failures
Apollo normalized cache is persisted using localforage through a wrapper that disables persistence on storage failures. Key apollo-cache-persist-v1, 32 MiB maximum and 1000 ms debounce. Query policies reference Assignment, Site, Visit, Issue, Delivery, Building and Category by id.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-9290922bbd3fcbcd`.
#### core-inspection-offline-prefetch — Open inspections prefetch is enabled for mobile devices with OFFLINE feature while online and not super-admin
Open inspections prefetch is enabled for mobile devices with OFFLINE feature while online and not super-admin. Discovery fetches up to 5000 ids/updatedAt; hydration fetches full DoVisitPage selection in chunks of 100. Per-user/myWork-or-company watermark advances only after complete discovery/hydration, and later queries filter updatedAt.gte.
Limit: Static code path observed; no user feature configuration or runtime download completion observed. OfflinePrefetchWatermark is synthetic Apollo cache type, not server schema.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-8e266c27042c5dc2`.
#### core-inspection-draft — Inspection draft key do-visit-${visitId}-v1 is stored via localforage with 250 ms debounce
Inspection draft key do-visit-${visitId}-v1 is stored via localforage with 250 ms debounce. It restores and saves items,issues,images,workHours,geoPositions,startDate. Successful submission clears the draft; error handling leaves it available.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-9290922bbd3fcbcd`.
#### core-inspection-offline-limit — Inspection page can render cached visit.items while offline
Inspection page can render cached visit.items while offline. Missing cached item content produces offlineUnavailable. Completion/edit submits editVisit with visitId,isCompleted,input containing issues,workHours,images,geoPositions,items,completedLateReason.
Limit: No durable offline mutation replay queue established by reviewed code. Query retry explicitly excludes mutation operations and 401 responses.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-9290922bbd3fcbcd`.
#### core-oauth-ai-clients — OAuth consent UI recognizes Claude, ChatGPT, Cursor, Visual Studio Code and generic clients
OAuth consent UI recognizes Claude, ChatGPT, Cursor, Visual Studio Code and generic clients. Default read-only scopes [read]; full scopes [read,write]. It fetches interaction details, confirms chosen scopes with CSRF header, then navigates to returned redirectTo.
Limit: This demonstrates bundled consent UI, not successful external connections or accessible MCP endpoints.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-667c49884ff710cc`.
#### core-data-contracts — GraphQL operation/fragment catalogue exposes selected input variable types, entity field paths and nested fragment relationships across Customer,Compa
GraphQL operation/fragment catalogue exposes selected input variable types, entity field paths and nested fragment relationships across Customer,Company,Site,Building,Tenant,Issue,Assignment,Visit,Document/COI,Amenity,AmenityBooking,Visitor,Delivery,Charge. Canonical operation catalogue distinguishes declaration evidence from direct call/Apollo option references.
Limit: No server schema introspection, resolver code, production data or runtime responses. Unresolved template interpolations and parse failures remain listed in errors.jsonl.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-830547df9ba1c934`.
### Visitt+ native shell
#### P01 — Remote portal shell
App module Metro 569 defines the base URL https://portal.visitt.io and constructs a React Native WebView with source.uri from useWebViewURI. The enclosing App renders SafeAreaProvider around AppContent.
Data flow: module 569 baseURL -> module 974 useWebViewURI -> AppContent WebView source.uri
Inference: The business frontend is delivered from a remote portal; the installed bundle alone cannot reconstruct its complete request, survey, announcement or amenity behavior.
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P02 — Bidirectional JSON bridge
webviewPostMessage JSON-stringifies a supplied object into injected JavaScript calling window.postMessage with targetOrigin *; onWebViewMessage parses event.nativeEvent.data and dispatches by message.
Data flow: native payload -> JSON serialization -> WebView injectJavaScript -> window.postMessage; web payload -> nativeEvent.data -> JSON.parse -> handlers
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P03 — Portal-driven readiness and splash
APP_READY sets the ready state. A useEffect hides the Expo splash when ready; a 5000 ms timeout independently sets ready true. The root module prevents automatic splash hiding and enables fade.
Data flow: portal app_ready or 5000 ms fallback -> readiness state -> hideAsync
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P04 — Camera permission bridge
ASK_FOR_CAMERA_PERMISSIONS calls askForCameraPermissions, whose async body calls getCameraPermissionsAsync, returns true if status granted, otherwise requestCameraPermissionsAsync and returns result.granted.
Data flow: web ask_for_camera_permissions -> camera status read -> possible OS prompt -> boolean return
Limit: The return value is not visibly posted back to the portal by the inspected caller. Manifest camera disclosure mentions pictures uploaded for requests and updates, but no upload endpoint or attachment mutation is present in the inspected shell.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P05 — Safe area and status bar bridge
On WebView load the shell posts INSETS_CHANGE with state.bottom and state.top. STATUS_BAR_STYLE accepts light or dark and sets React state used by StatusBar. KeyboardAvoidingView uses padding and negative bottom safe-area offset.
Data flow: safe area -> insets_change -> portal; web status_bar_style -> React state -> native StatusBar
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P06 — App visibility notifications
AppState change listener posts APP_STATE_VISIBILITY_CHANGE with the new state to the portal, removing the listener on unmount.
Data flow: OS foreground/background state -> app_state_visibility_change {state} -> portal
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P07 — Back navigation control
onLoadProgress copies nativeEvent.canGoBack into state. hardwareBackPress calls WebView.goBack only when this state is true. Native WebView gesture flag starts true and the portal can set it using a boolean CHANGE_ALLOW_BACK_FORWARD_NAVIGATION_GESTURES. A capability request returns availability true.
Data flow: WebView history -> canGoBack -> hardware handler; portal boolean -> native WebView gesture prop
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P08 — External navigation
onNavigationStateChange compares URL using url.includes(baseURL). If false it stops WebView loading, calls canOpenURL, then openBrowserAsync if supported.
Data flow: navigation URL -> includes portal baseURL check -> stopLoading -> canOpenURL -> OS browser
Limit: The check is a substring comparison, not parsed hostname equality. No exploit or runtime effect was tested.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P09 — WebView error and crash recovery
onWebViewError logs code, description and URL, releases splash readiness, and attempts to post WEBVIEW_ERROR with a JSON-serialized error. onContentProcessDidTerminate increments the WebView React key and preserves the termination event URL.
Data flow: WebView error -> logging + ready state + portal error; process termination -> new key + URL -> recreate WebView
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P10 — Initial universal/deep link
useInitialWebviewURI starts with / and resolves Linking.getInitialURL; composeRelativeWebURLFromUniversalLink extracts parsed path and queryParams, handles Expo /--/ conventions, prepends / and serializes query parameters. The base URL is concatenated with that relative path.
Data flow: initial OS link -> parse path/query -> relative URL -> portal baseURL + relative URL
Limit: The parser name says universal link; actual associated-domain entitlement and every supported route are separate evidence requirements.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P11 — Subsequent links and notification navigation
A Linking url listener parses incoming links and posts CHANGE_URL to the page. handleNotificationLink reads notification.request.content.data.link and trackingLink; if link is present it optionally calls fetch(trackingLink), then posts the link as CHANGE_URL. Existing notification is replayed when APP_READY arrives.
Data flow: OS URL or notification data.link -> change_url {url} -> portal navigation; optional trackingLink -> fetch
Limit: The tracking destination is supplied by the notification. No tracking URL was fetched during this analysis and no downstream portal router was present in this installed module.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P12 — Notification registration without initial prompt
registerForPushNotificationsAsync first checks device.isDevice. It reads current permissions and only generates a push token if status is already granted. The useExpoPushNotifications mount effect calls this registration and stores its result.
Data flow: mount -> physical-device guard -> getPermissionsAsync -> token if granted -> React state
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P13 — Portal-requested push permission
The notification bridge responds to ASK_FOR_PUSH_NOTIFICATIONS_PERMISSIONS by calling requestPermissionsAsync; on granted it retrieves a token and stores it. USER_READY posts an already available token.
Data flow: web permission request -> OS prompt -> getExpoPushTokenDataWithRetry -> token state -> push_notification_token_updated; user_ready -> resend existing token
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P14 — Push token delivery and retry
The module passes experienceId @visitt/portal to getExpoPushTokenAsync and extracts .data. It permits four total attempts, with 400, 800 and 1600 ms waits for transient errors; constants include a 3200 ms cap. Transient classification includes HTTP 408/500/502/503/504 and named connection/timeout strings.
Data flow: Expo push request -> transient classifier -> exponential wait -> retry -> token data -> portal JSON message
Limit: Token values are not included in this report. The shell contains console logging of token values, but no live logs or tokens were collected.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P15 — Notification response restoration
On mount it calls getLastNotificationResponseAsync and copies response.notification when present. It also registers addNotificationResponseReceivedListener and removes that listener on cleanup.
Data flow: cold-start notification response or later tap -> notification state -> module 974 link handler
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P16 — Foreground retry and badge reset
setBadgeCountAsync(0) runs on setup and whenever app state is active. After a transient token failure, a foreground retry requires a physical device, granted permission, no existing token, and at least 60000 ms since last attempt.
Data flow: foreground -> badge clear -> transient failure/device/permission/token/cooldown guards -> token retrieval -> portal message
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P17 — Foreground notification presentation
The registered notification handler returns shouldShowBanner true, shouldShowList true, shouldPlaySound false and shouldSetBadge false.
Data flow: Expo notification -> presentation policy object
Limit: Static code was inspected; execution and backend behavior were not observed.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P18 — SMS OTP contract is not implemented by the main handler
NativeAppMessage includes ASK_FOR_SMS_OTP and SMS_OTP. The main onWebViewMessage compares ASK_FOR_SMS_OTP but jumps directly to return. The bundle also includes an ExpoOtpAutofillConsent library, but that library alone does not establish an active OTP workflow.
Data flow: web ask_for_sms_otp -> message comparison -> no operation in this build
Limit: SMS code autofill is a contract name/library capability, not a confirmed feature implemented in the inspected app caller.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-e32a33e0352b84d0`.
#### P19 — Release and update identity
Package Info.plist identifies io.visitt.portal, display name Visitt+, app version 1.0.0 build 2, iPhoneOS platform and custom URL schemes visitt-portal and io.visitt.portal. Expo.plist enables updates, checks ALWAYS on launch with wait 0, production channel, runtime exposdk:54.0.0 and a u.expo.dev update URL.
Data flow: installed native bundle -> embedded Hermes bundle and configured Expo update endpoint
Limit: Configuration proves declared settings, not that any newer update has been downloaded or applied.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-830547df9ba1c934`.
#### P20 — No installed business GraphQL operation documents recovered
All 14473 Hermes strings were searched for GraphQL operation patterns. No string contains mutation + space or query + space. Survey and amenity substrings are absent; announcementFinished belongs to a React Native accessibility event. GraphQL and Supabase sign-in names belong to Sentry instrumentation, not an app API call site.
Data flow: full string table -> bounded operation/feature search -> direct xref qualification
Limit: This negative result is bounded to the shipped Hermes string table and inspected shell code. Current remotely served portal code is a different artifact and may contain all business operations.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-830547df9ba1c934`.
### Visitt+ portal
#### W01 — Authenticated GraphQL client
Apollo sends requests to the same-origin /public/graphql endpoint with credentials include, user-navigator-vendor and user-app headers. The error link redirects to /login on GraphQL UNAUTHENTICATED or network HTTP 401. RetryLink config permits max 5 attempts and excludes unauthorized/selected nonretryable errors. Cache redirects map issue, visitor, broadcast, delivery and customPage by their IDs.
Data flow: Apollo operations -> error/header/retry links -> same-origin credentialed HTTP -> normalized cache
Limit: The initial static pass did not deliberately invoke GraphQL. Later browser initialization may have made ordinary requests; no HTTP capture established which endpoints were invoked. Server schema, cookie/session flags, access controls and rate limits remain unobserved.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-1500f96c457778c5`, `src-5741681365f89c17`, `src-5af8fc1c340903f3`, `src-ad85f4695ef9a398`, `src-e26de85c88f381f5`.
#### W02 — Two-step email or phone OTP login
The email/phone form validates syntax then POSTs /public/generate-code with emailOrPhone, lang and optional preferredPortalId. isAdded gates navigation to the code form. The code form auto-submits when six characters are entered, POSTing /public/login with code and credentials include. isValid gates Apollo clearStore, me refetch and sanitized redirect. Resend and change-identifier controls exist; WebOTP/browser and native SMS_OTP listener support code autofill.
Data flow: identifier -> generate-code -> 6-digit code -> login -> clear cache -> me -> requested portal route
Limit: The initial static pass did not submit this flow. Later RUNTIME-01 tested one new disposable address once: the UI returned account not found; no code-entry or authenticated screen was reached. This does not establish behavior for other addresses or invite flows. No self-service organization/user registration form or signup route was found in the inspected auth flow.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-2109366e1b531998`, `src-3c60ece45a3f7f47`, `src-4f4a8101d30732dd`, `src-5b5bc684ce6adf90`, `src-710484aee309a5ce`, `src-78dd093e1a6b8da9`, `src-dd45673e86447250`.
#### W03 — Contact identity and portal selection
me requests name, profile, email/phone verification, language/time format, active tenants, portals/companyPortals, consent records, notification settings and flags. The company-portal provider validates preferred/stored/route portal IDs against me.companyPortals, remembers selection in localStorage under a per-contact key, POSTs /public/switch-portal when company context changes and refetches me.
Data flow: me memberships -> select allowed portal ID -> companyPortal settings query -> optional switch-portal -> me refresh
Limit: Frontend membership checks do not prove backend authorization enforcement. No authorized tenant membership or property data was obtained, and no deliberate business API or membership lookup was performed. Ordinary browser initialization requests were not captured.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-14b5499f1949a8c4`, `src-6844813c75dc5d0f`, `src-ad85f4695ef9a398`.
#### W04 — Native integration closes the installed-shell trace
On mount the web frontend sends app_ready, gesture-capability inquiry and dark status-bar style. With a logged-in contact in ReactNativeWebView it sends user_ready and asks for camera/push permissions. push_notification_token_updated calls updatePushNotificationsToken only when me._id exists. insets_change writes CSS safe-area variables. change_url navigates the router using relative path or parsed absolute URL; capability reply disables native back/forward gestures.
Data flow: web ready/contact -> native bridge; native token -> authenticated GraphQL mutation; native link -> React router
Limit: Actual OS permission prompts/token registration were not executed. Native app and current remote frontend are independent artifacts and might differ at another release date.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-972be53365fbe59f`, `src-ad85f4695ef9a398`, `src-f3a05e3022960a50`.
#### W05 — Company portal features and branding are configuration driven
companyPortal returns customer/company IDs, language, logo/image/colors, homeItems with name/path, request buildings/sites/categories/subcategories/custom fields and flags withPermissionToEnter, withAmenityBooking, withDeliveryPickup, withCustomPages, withAICategories, withVisittAI, withVisitorWatchlist and withTenantContactManagement. Home create actions gate amenity booking and visitors using these settings; people routes redirect when tenant contact management is disabled.
Data flow: companyPortal response -> available navigation/create actions/forms/branding
Limit: Flag presence proves supported configuration, not that every tenant sees every feature.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-17a0e6b1df524717`, `src-8d970706820efb57`, `src-f52661a6a7e08eee`.
#### W06 — Building portal is a distinct older route family
/:slug resolves portalSettings by portalSlug and reads buildingId/name, company/language, image/logo, sites, categories/subcategories and custom fields. If the URL uses an ID and a slug exists, the wrapper redirects to the slug. Public-building request submission uses createPortalIssue; history uses publicPortalIssues.
Data flow: building slug -> portalSettings -> request form -> createPortalIssue -> issue ID/history routes
Limit: The word public describes the app query/route family; access to issue history still passes authenticated-route wrappers. No anonymous data access claim is made.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-35e15a98d8e852c1`, `src-ad85f4695ef9a398`.
#### W07 — Request search, filters and shared home feed
requestsForPortal uses RequestSearchInput plus skip/limit/sort/direction, returning sequence, description/translations, lifecycle timestamps/status, actor/location/site, and optional amenityBooking. The shared requests connection can represent work orders and bookings. homeUpdates fetches unread requests, upcoming bookings sorted by booking start, new broadcasts and optionally active visitors.
Data flow: portal/search scope -> paginated request query -> cards and count; home -> multiple filtered collections
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-035e786b77ab73e4`, `src-f3f29704586c63dc`, `src-f52661a6a7e08eee`.
#### W08 — Create service requests with configurable form fields
CreateRequestForm validates description, required building and sometimes site, category and category-defined required custom fields. B7 folds custom-field label/value answers into description text, removes customFields from the submitted object, supplies default category and converts permission-to-enter string to a boolean when enabled. Submit calls createCompanyPortalIssue with portalId; success refetches requests and either resets description/images/custom fields for create more or opens the requests list with createdRequestId.
Data flow: form + chosen category/site/images -> validation -> custom answers appended to description -> createCompanyPortalIssue -> list/refetch or form reset
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-39b053286477aeb8`, `src-a4ceacedb9ca0465`, `src-b6c04064be0bdafb`, `src-da893e8012145834`.
#### W09 — AI category suggestion is optional and manually overridable
When withAICategories and not forceSelectRequestCategory, a nonempty description triggers generateSmartWorkOrderCategory(description, companyId) after a 500 ms debounced description change. Returned category/subcategory IDs update selection until a user manually selects a category. Without authorized request buildings the page shows a no-location empty state.
Data flow: description -> debounce -> server suggestion query -> category IDs -> form; manual choice locks automatic overwrite
Limit: No AI model/provider architecture or suggestion accuracy is inferable from this client call.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-6d10105cd4040682`, `src-a4ceacedb9ca0465`, `src-b6c04064be0bdafb`.
#### W10 — Request detail combines chat, attachments, charges and translations
issue query returns description/lifecycle/actor/site, defect and repair images, updates, charges, review eligibility, tenant approval/signature/request/vendor quote, and booking fields. Detail uses cache-and-network and partial data. Translation records with pending status and age less than 5 minutes cause 5-second polling; polling stops otherwise.
Data flow: issue ID -> detail query -> chat/details/charges/signature/review components; pending translations -> conditional polling
Limit: This is evidence for conditional translation polling; no WebSocket or general real-time update guarantee is established.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-8577b550359da5b3`, `src-a4ceacedb9ca0465`, `src-b77de1f1408d84e2`.
#### W11 — Chat sends text and media and marks updates read
Opening the chat calls markIssueUpdatesSeenByMe. The composer trims text, rejects empty messages, clears the input, builds an optimistic update with current contact/time, calls createPortalIssueUpdate and patches Apollo issue.updates without duplicate entries; failure restores the text. Media uploads call addImageToIssue, coercing video format to mp4.
Data flow: chat open -> seen mutation; text -> optimistic cache -> createPortalIssueUpdate -> reconcile; uploaded file metadata -> addImageToIssue
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-74fa5db33d3a6e39`, `src-a4ceacedb9ca0465`, `src-a5d0513d75b06a06`.
#### W12 — Cloudinary media upload pipeline
The shared upload hook compresses image files to max 2560 by 2560 at configured quality, retains other file types, filters files above 20971520 bytes, then POSTs FormData containing upload_preset production, tags and file using XMLHttpRequest to https://api.cloudinary.com/v1_1/gantzi/{image|video|raw}/upload. Timeout is 20000 ms with progress/error handling. Response public_id, format, bytes and filename become app attachment metadata. Document MIME types map to raw uploads.
Data flow: file/blob URL -> optional compression -> size filter -> Cloudinary XHR -> normalized imageId/format/type/originalFilename/bytes -> parent form or mutation
Limit: No upload was performed. The 20 MiB check applies after image preprocessing in this hook. Upload policy enforcement and Cloudinary configuration are not inspected.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-59687a41abe6e517`, `src-a4ceacedb9ca0465`, `src-a685455d448db86c`.
#### W13 — Photos distinguish tenant attachments from staff repair media
The details attachment component toggles defectImages and repairImages, sorts chronologically, allows uploads and deleteIssueImage only in the tenant/own view, and sends addImageToIssue with the request ID and uploaded metadata.
Data flow: Cloudinary metadata -> addImageToIssue -> issue defectImages; own image delete -> deleteIssueImage
Limit: UI edit gating does not establish the backend ownership checks.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-a4ceacedb9ca0465`, `src-ee35c0b453a3d1d1`.
#### W14 — Tenant charge approval includes a drawn signature
The approval modal collects a nonempty drawn signature, converts it to JPEG data URL, uploads via the shared media hook and calls setTenantApproval(input:{issueId,signatureImage}) then refetches issue. The issue fields include charges and optional vendor quote attachments.
Data flow: signature canvas -> JPEG -> Cloudinary metadata -> setTenantApproval -> issue refetch
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-9589ce0dc8d3ccbf`, `src-a4ceacedb9ca0465`.
#### W15 — Completed-request feedback survey
The review form defines satisfaction (emoji scale), speed/professionalism/attitude (star scales) and free-text comment. Satisfaction is required to submit; nonempty answers are sent as {questionKey,answerType,value} in createPortalIssueReview(input:{issueId,answers}). On isAdded it sets canReview false in the cached issue.
Data flow: eligible issue -> scale/text answers -> createPortalIssueReview -> hide review eligibility in cache
Limit: This is a request-completion review survey; no separate general survey-builder capability was found.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-360ce63eaba4ffd8`, `src-a4ceacedb9ca0465`.
#### W16 — Amenity booking handles availability, costs and configurable questions
amenity returns bookingSlots(isBooked,isBillable), pricing/currency/duration, capacity, location/media, minimum/maximum advance rules, max duration and custom fields including required answers, costs, answer choices and attachments. Date/time changes query available slots; selected range queries bookingTimeCharges. UI sums time-range charges plus selected custom-field extras and displays breakdown/total. Form validates required times and custom fields/files, then submits bookAmenity with amenityId, companyId, comment, bookingRange and customFields.
Data flow: amenity/date -> slots + booking constraints -> selected range -> charges query -> validated form -> bookAmenity -> returned issue ID
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-2f3accc20620270b`, `src-44613408bf77c66e`, `src-71fea57903592eb6`, `src-97c9b66f98921f00`, `src-f52661a6a7e08eee`, `src-fc59a7e19f5ac2c7`.
#### W17 — Bookings are represented as requests and can be edited/canceled
bookAmenity returns an issue._id; bookings list reads the requests connection with amenity filters. Editing loads amenityBookingToEdit, excludes its booking ID from availability checks, and sends updateAmenityBooking with comment/range/custom fields. cancelAmenityBooking returns request ID and updated amenityBooking status. Mutations refetch requests and amenity or issue as appropriate.
Data flow: booking request -> edit query -> availability excluding self -> update; booking ID -> cancel -> status/refetch
Limit: Server cancellation policies, payment collection and refund behavior remain unknown.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-2f3accc20620270b`, `src-a39d286af0a23829`, `src-ec7a433c369a5fb0`, `src-f52661a6a7e08eee`.
#### W18 — Visitor invitations support single and CSV/bulk input
Visitor lists query active/future visitors with dates, contact details, host, check-in and deactivation fields. The create form supports single or spreadsheet/CSV rows, validates names/contact formats and date/arrival ranges, uses activeTenants to select tenant, checks configured bulk limit and warns if QR invitations cannot be sent because contact info is absent. It dispatches createVisitor or bulkCreateVisitors and refetches visitor list; detail shows access-control status/provisioning and supports deactivateVisitor.
Data flow: single form or imported rows -> validation/tenant/date/host input -> createVisitor or bulkCreateVisitors -> list; visitor detail -> deactivate
Limit: Creation/check-in/access-control hardware behavior was not executed. Query fields establish frontend integration points, not the provider or permission model.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-29d6ed103c8818f4`, `src-c998e77e3b82252f`, `src-db8b14b231c5a549`, `src-e51ade2774abcf3c`, `src-f52661a6a7e08eee`.
#### W19 — Visitor watchlist supports aliases and optional AI assistance
With withVisitorWatchlist, the UI lists/searches watchlist records with fullName/actionNotes/nameVariants/photo/tenant, creates records from firstName,lastName, comma-separated variants, optional action notes and first uploaded imageId, and archives records. A withVisittAI control queries visitorWatchlistNameVariants(firstName,lastName), joining returned values into editable comma-separated variants.
Data flow: watchlist form + tenant/photo -> createVisitorWatchlistEntry; names -> variants query -> editable aliases; record -> archive
Limit: No automatic facial recognition, biometric matching or screening backend was established by this client evidence.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-09e4ae1446a99ac7`, `src-1bca288dde43d94c`, `src-f52661a6a7e08eee`.
#### W20 — Delivery tracking with configurable pickup confirmation
deliveriesForPortal searches company/status with pagination; detail includes barcode, courier, recipient, notes, created/closed dates and pickedupByLabel. If delivery is open and withDeliveryPickup is true, mobile UI offers slide-to-confirm and desktop a confirmation button. Both call pickupDeliveryByContact and refetch deliveries.
Data flow: delivery ID -> detail query -> conditional pickup UI -> pickupDeliveryByContact -> status/closedAt/pickedupByLabel
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-a49093fdb9a1b4d0`, `src-a4c077ea7b2d5199`, `src-f52661a6a7e08eee`, `src-fd38979b24d75636`.
#### W21 — Broadcasts, read receipts and branded content
Broadcast detail fetches sender, subject, body, attachments, timestamps and branding including header/footer/logo/colors/property name. Once a broadcast loads it calls updateBroadcastSeenByMe and refetches broadcasts/homeUpdates. Unauthorized and nonexistent broadcast errors render distinct states.
Data flow: broadcast ID -> body/attachments/branding -> render -> seen mutation -> list/home refresh
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-176104cfc22c850d`, `src-884abe468ac7add5`, `src-aa97d3028228c11e`, `src-abf858641f21f26c`, `src-f52661a6a7e08eee`, `src-f6d5710ab67c5321`.
#### W22 — Custom pages and app links
customPages/appLinks feed home/content/sidebar modules. A page detail query returns text, website, phone, cover, file attachments, child pages and parent hierarchy; the view renders HTML content, child navigation, downloadable files, external website and phone links. App links open supplied URL in a new window with noopener/noreferrer.
Data flow: portal pages/apps -> list -> customPage hierarchy/files or external app URL
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-d737b5fa5e8ec8c4`, `src-d7fbdfcfe72cabf9`, `src-f52661a6a7e08eee`.
#### W23 — Profile, language and notification settings
Profile supports updateMyName, updateMyProfilePicture from uploaded image metadata, language updateMe, portal selection and reset-data. Notification settings mutate channel activation (email, SMS, push) and tenant-contact-change subscription. Available channel controls depend on email/phone/push context.
Data flow: profile/form or uploaded photo -> mutation -> cached me; channel toggle -> updateNotificationSettings
Limit: Static call sites and UI logic establish implemented frontend behavior, not backend acceptance, enabled tenant configuration, or observed execution.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-5dd18f3d0092552f`, `src-7cc16c5ba46ae7fb`, `src-859b4457ddb1ec63`, `src-f52661a6a7e08eee`.
#### W24 — Tenant people directory and invitations
withTenantContactManagement gates people routes. paginatedContacts supports search, role/status filters and tenant context. UI supports single/bulk contact entry, roles, emergency flag, notes and invite option; addContacts, updateContact, archiveContact, unarchiveContact and inviteContact are separate mutations. Contact canUpdate and shared-contact/activeTenantAdminCount fields control editing, archive messaging and last-admin confirmation.
Data flow: tenant contacts query -> filtered directory -> add/edit/invite/archive/restore mutations -> list refetch
Limit: This is frontend capability and UI guarding. No authorization bypass or actual invitation sending was tested.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-0cd774d503d3b672`, `src-17a0e6b1df524717`, `src-2399815af898ad0b`, `src-4f712ba2a3ef22f1`, `src-5ad7dabfb14fe7f2`, `src-b90229b728fa6ee1`, `src-cea6fe83d054505b`, `src-e0dd83b265ec06fc`, `src-f52661a6a7e08eee`, `src-fedbeb27909d34f3`.
#### W25 — Current frontend is not the installed release
All public portal files came from the URLs explicitly referenced by portal HTML/JavaScript on 2026-10-11 America/New_York. The installed shell loads portal.visitt.io dynamically and has separate Expo update configuration. The two sets share bridge messages, but current web features cannot be assigned to the native 1.0.0 build date.
Data flow: installed WebView URL -> currently served web artifact -> static analysis ledger
Limit: No historical frontend snapshot or release-to-native build mapping is available.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-830547df9ba1c934`.
### Runtime account-entry tests
#### RUNTIME-01 — Visitt+ rejects the new disposable address
At https://portal.visitt.io/login, entering the new disposable address and clicking Get login code produced: Account not found for [redacted identifier]. Please try different email or phone. The page stayed on the identifier form; no code-entry or account-creation screen was reached.
Inference: This tested entry path expects an existing recognized identity. A new temporary email alone did not unlock tenant features.
Limit: One disposable address tested once per app. The result does not establish how every email domain or invite flow behaves.
Limit: No raw network capture; exact HTTP status, payload and backend implementation are unknown. No authenticated page reached.
Evidence status: `unauthenticated_runtime_ui_observation`. Research date: 2026-10-11. Apps: Visitt+.
Sources: `src-2400edc8418c07c6`, `src-367d3fe2860577e5`.
#### RUNTIME-02 — Visitt operator login rejected the tested disposable address
At https://app.visitt.io/login, entering the same disposable address and clicking Login with one time code produced: Sorry, we couldn't find you on record. Please check for typos or try a different phone or email. No authenticated screen was reached.
Inference: The observed rejection is consistent with administrator-provisioned access. Official help tells unrecognized users to contact their property manager or team admin to be added.
Limit: One disposable address tested once per app. The result does not establish how every email domain or invite flow behaves.
Limit: No raw network capture; exact HTTP status, payload and backend implementation are unknown. No authenticated page reached.
Evidence status: `unauthenticated_runtime_ui_observation`. Research date: 2026-10-11. Apps: Visitt.
Sources: `src-17a55cded525c145`, `src-50f610dff0edb63b`, `src-8337f89eb87fdb60`, `src-e594688525d15411`, `src-f4e46de9dac55d28`.
### Ghidra native pass
#### GHIDRA-01 — Native messages reach separate history and page-message callbacks
Observed: The message handler compares the WKScriptMessage name with ReactNativeHistoryShim and ReactNativeWebView.
Observed: The history branch invokes onLoadingFinish with the message body as navigationType when that callback exists.
Observed: The page-message branch invokes onMessage with data from the message body and a URL obtained through request → URL → absoluteString when that callback exists.
Inference: This supplies compiled native evidence for the transport underlying the already recovered Hermes JSON bridge.
Limit: The original Ghidra dossier left frameInfo unnamed; a later independent original-byte selector pass resolved frameInfo (GHIDRA-DEEP-12). Native transport still does not establish app message acceptance, callback runtime values, origin policy or authenticated availability.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-5a6ec981c0215a72`, `src-f7d4efe629339b87`.
#### GHIDRA-02 — The native WebView postMessage method serializes an event into injected JavaScript
Observed: postMessage: creates a dictionary with a data field, calls RCTJSONStringify, formats a window.dispatchEvent(new MessageEvent("message", …)) script, and passes it to injectJavaScript:.
Limit: This is the native library method; it is distinct from app-specific Hermes scripts that call window.postMessage. A callsite or successful runtime delivery is not established by this function alone.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-12d3f1248752b69f`, `src-2dd63e33831da665`, `src-6a21847ff2e1b236`, `src-a69f285c2f6c762f`.
#### GHIDRA-03 — Native navigation decisions can be delegated to the JavaScript callback
Observed: When onShouldStartLoadWithRequest exists, the native method uses RNCWebViewDecisionManager and emits url, navigationType, isTopFrame, hasTargetFrame and lockIdentifier, with an optional mainDocumentURL.
Observed: The separate onOpenWindow branch emits targetUrl and calls the supplied decision handler with 0. The branch without the should-start callback eventually calls that handler with 1.
Inference: The native library provides the decision mechanism; the app-specific URL predicate belongs to the recovered Hermes layer.
Limit: Several Objective-C calls were unnamed in the initial Ghidra pass; the later independent selector pass supplies names in separate review copies (GHIDRA-DEEP-12). Callback installation, runtime branch selection and asynchronous decision results remain unobserved. Server authorization is not proven.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-272183e6a2b05d1b`, `src-42d80f73471495dd`.
#### GHIDRA-04 — WebView configuration and history injection depend on library flags
Observed: setUpWkWebViewConfig creates WebKit configuration/preferences/content-controller objects and branches on JavaScript, file URL access, cache/incognito, app-bound navigation and media-related ivars.
Observed: The app-bound-navigation branch checks selector availability and the limitsNavigationsToAppBoundDomains ivar before calling an unnamed setter with 1.
Observed: resetupScripts: contains history.pushState/replaceState wrappers and a popstate listener that post history messages, and a ReactNativeWebView delegate branch conditioned by messagingEnabled.
Limit: These are supported library paths, not evidence that every option is enabled by either app. The initial Ghidra output left script/configuration calls unnamed; the later selector pass resolves setLimitsNavigationsToAppBoundDomains: and script/data-store selectors (GHIDRA-DEEP-12). The setter is conditional on selector availability and the stored flag; its presence and package domain declarations do not show active enforcement in either app.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-014c9321990970d8`, `src-46a29d22060c1e09`, `src-8008ed4e34a1a564`, `src-f1501569cbd63180`.
#### GHIDRA-05 — The AppDelegate URL callback has a React Native linking fallback
Observed: application:openURL:options: bridges Foundation URL/dictionary values, invokes helper code and contains a conditional RCTLinkingManager application:openURL:options: fallback.
Limit: The function calls helpers at 0x100005a74 and 0x100005b78, whose entries map inside the declared encrypted interval [20480,24576). Their semantics were not recovered. Swift calling-convention inference is imperfect. This is not complete native SSO callback recovery or proof of a successful login.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-232a5dea637a20e2`, `src-419738efaa58228c`.
#### GHIDRA-06 — The Expo push-token callback is a short Foundation-data forwarding wrapper
Observed: NotificationsAppDelegateSubscriber application:didRegisterForRemoteNotificationsWithDeviceToken: converts the Objective-C token to Foundation Data and calls two further native helpers.
Limit: Those helper bodies were not decompiled in this pass. This callback does not prove backend device registration, token acceptance, notification delivery or permission status.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-e8cfaa71f6e0a4b0`, `src-f240cd5c5358796a`.
### Ghidra continuation and selector recovery
#### GHIDRA-DEEP-01 — Camera permission path reaches AVFoundation through a shared Swift trampoline
The bundled Expo camera-only permission requester does reach AVCaptureDevice.requestAccessForMediaType:completionHandler:. Its Objective-C entry point loads native implementation 0x1000ec7e8 into x6 and branches to the shared Swift wrapper 0x1000ec478; the wrapper preserves x6 and invokes it through blr x19. The implementation reads the requester mediaType field, creates a completion block and invokes the AVFoundation permission API. This adds a concrete OS call beneath the separately observed Hermes ask_for_camera_permissions/open_barcode_scanner branches.
Observed: Entry 0x1000ebdcc uses ADRP/ADD to put 0x1000ec7e8 in x6; its decompiler text alone does not expose this callee.
Observed: Shared wrapper 0x1000ec478 copies incoming blocks and calls the x6 implementation after retaining the requester.
Observed: Implementation 0x1000ec7e8 reads CameraOnlyPermissionRequester::mediaType, creates a weak requester reference and supplies a copied block to the AVFoundation call.
Observed: The matching Visitt+ entry at 0x1000ed994 loads implementation 0x1000ee3b0 into x6 and branches to 0x1000ee040. Its implementation invokes the same AVFoundation permission API; no live permission result was observed.
Inference: This corroborates the native permission capability expected by the app-specific Hermes camera helper; this pass does not independently trace the Expo exported-method registration from the Hermes call to this exact native class.
Limit: The exact mediaType string/value and completion callback conversion to the permission result are not recovered by these three bodies. Completion target 0x1000ecbf4 is referenced but not analyzed in this pass.
Limit: Permission prompts, user grant/denial and camera execution were not observed at runtime.
Limit: Ghidra Swift calling-convention and allocation temporaries are imperfect; do not treat the pseudocode parameter ordinals or apparent writes to metadata addresses as source-level declarations.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-3a8301ab4e30ab01`, `src-6e19d33ed4bbc136`, `src-7f5de0c0fbf9908e`, `src-806f483c72e20b20`, `src-942971e07dbeda07`, `src-966c449cf1676f53`, `src-a563f7f4e142b508`, `src-bc5d6bb3cfaa7727`, `src-fa6bd8b520815531`.
#### GHIDRA-DEEP-02 — Barcode metadata delivery applies configured-type filtering and optional preview transformation
The Expo metadata callback bridges the received AVMetadataObject array into Swift and calls 0x100105a38. That body reads scanner settings and the encoded barcodeTypes key, iterates metadata objects, optionally transforms each through the preview layer, checks for a stringValue and compares the object type on the AVFoundation path. When the callback slot is present, it builds a result through 0x1000e83d4 and invokes BarcodeScanner::onBarcodeScanned. The application-specific ScannerScreen type allowlist and its haptic/close/web-message behavior remain separate Hermes observations.
Observed: 0x1001057a8 calls the array bridge and then 0x100105a38.
Observed: 0x100105a38 accesses settings, previewLayer, zxingBarcodeReaders and responseHandler fields.
Observed: The body visibly calls transformedMetadataObjectForMetadataObject:, stringValue and type, then branches through equality/string comparison before the callback path.
Observed: The successful path calls 0x1000e83d4 and invokes a non-null onBarcodeScanned function pointer.
Inference: The configured barcode type list participates in deciding which native metadata reaches the Expo scan callback; exact ZXing-reader bypass/mapping behavior remains partial.
Limit: The stored native settings values at runtime were not observed. The 11 app scanner formats come from Hermes function8890, not from recovery of every native enum or mapping in this pass.
Limit: Dynamic casts, Swift dictionaries and indirect closures are incompletely typed; do not claim exact native-to-JavaScript event ABI from the pseudocode variables.
Limit: The result builder calls helpers in the declared encrypted interval, so following this callback does not establish a complete implementation of every emitted field or barcode transformation.
Limit: No barcode was scanned and no callback delivery was exercised.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-3b4d367ef85ed9fc`, `src-a563f7f4e142b508`, `src-bc5d6bb3cfaa7727`, `src-c21f92cd8f8cba50`, `src-cf3b2e2c25d9fa49`.
#### GHIDRA-DEEP-03 — Native scan payload preparation includes geometry beyond the shell bridge payload
Native helper 0x1000e83d4 visibly prepares type and data dictionary entries from the metadata type/stringValue. Its nonempty-corners branch builds cornerPoints and bounds, including origin x/y and size width/height. The retained Hermes handler forwards barcode:{type,data} to the web page, so these native geometry fields are additional library payload preparation rather than evidence that Visitt forwards geometry through its own web bridge.
Observed: The dictionary key immediates decode to type, data, cornerPoints and bounds.
Observed: The nonempty-corners branch calls the imported AVMetadataMachineReadableCodeObject.get_corners and reads bounds repeatedly.
Observed: The body constructs nested origin/size entries and x/y/width/height keys.
Observed: The body also contains a conditional string prefix path; its complete barcode-type/value normalization semantics are not established.
Inference: The native Expo library supports richer scan result geometry than the app-specific web-message contract observed in Hermes. The geometry branch is not proof of the data the hosted web application receives.
Limit: Calls to 0x100005ac0, 0x100005c94 and 0x100005ce0 enter declared encrypted file interval [20480,24576), corresponding to virtual addresses [0x100005000,0x100006000). Their semantics are not recovered.
Limit: The helper body itself is outside that interval, but the encrypted callees prevent a complete source-equivalent reconstruction.
Limit: Exact type string mapping, coordinate units/orientation and the conditional prefix normalization are unknown; do not label the branch UPC-A/EAN-13 or assert specific numeric output values without further evidence.
Limit: The corners-empty path calls another helper; these fields are not asserted to be present in every scan.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-3b4d367ef85ed9fc`, `src-a563f7f4e142b508`, `src-bc5d6bb3cfaa7727`.
#### GHIDRA-DEEP-04 — Foreground location requests check Info.plist configuration before attempting OS dispatch
EXForegroundPermissionRequester::requestLocationPermissions first calls isConfiguredForWhenInUseAuthorization and checks whether its CLLocationManager responds to a stored selector. When both checks pass it sends that selector to the manager. Otherwise it invokes the reject block with ERR_LOCATION_INFO_PLIST and the message requiring NSLocationWhenInUseUsageDescription, then clears the stored resolve and reject blocks. This supplies native error-path detail beneath the Hermes foreground-permission helper.
Observed: 0x100132e38 invokes the configuration guard; 0x100132e3c and 0x100132e6c branch to rejection.
Observed: The success path obtains locationManager, tests _objc_opt_respondsToSelector against DAT_1003debe8 and uses the same selector for _objc_msgSend.
Observed: Referenced constant labels identify ERR_LOCATION_INFO_PLIST and the NSLocationWhenInUseUsageDescription requirement.
Observed: The reject block is invoked through its block function pointer at 0x100132ecc; setResolve: and setReject: receive zero afterward.
Inference: This is consistent with a when-in-use permission request path, but the exact selector at DAT_1003debe8 is not named by the retained dossier.
Limit: The exact dispatched selector remains unresolved in this REA evidence and should not be presented as an independently recovered requestWhenInUseAuthorization call.
Limit: The implementation of isConfiguredForWhenInUseAuthorization was not analyzed in this pass.
Limit: The native library guard does not demonstrate an actual permission prompt, granted state or foreground location result.
Limit: Hermes handles a permission boolean and E_LOCATION_SETTINGS_UNSATISFIED separately; this native Info.plist rejection is not evidence that the shell maps every native error into response_geo_position_permission_denied.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-a563f7f4e142b508`, `src-bc5d6bb3cfaa7727`, `src-d4f9b440184b32fc`.
#### GHIDRA-DEEP-05 — One-shot location callback selects the last delivered location and handles its continuation
The Expo LocationRequester callback bridges the CLLocation array and calls 0x10013e324. That implementation uses count minus one to choose the last location when the array is nonempty. If a stored continuation is present it resumes the checked continuation with that location. The empty-array branch constructs a Swift error and resumes the continuation through the other resume import. Both paths converge on an update to the continuation field, consistent with clearing its optional state after handling the callback. This deepens the native result path for the separately observed Hermes request_geo_position operation.
Observed: The Objective-C wrapper at 0x10013e0b8 bridges the array and directly calls 0x10013e324 at 0x10013e118.
Observed: The body handles both native and bridged Cocoa array layouts, tests count for zero, and chooses index count-1 in the nonempty case.
Observed: It reads LocationRequester::continuation, tests the optional value using Swift value witnesses and calls checked-continuation resume at 0x10013e4bc.
Observed: The empty case allocates a Swift error and calls the alternate checked-continuation resume at 0x10013e5e8.
Observed: The final block writes a newly tagged optional value to the continuation field through 0x10013e2b4 after preparing that value at 0x10013e600–0x10013e614.
Inference: The final optional-state write is consistent with clearing the pending continuation, but the value-witness/helper implementations were not separately analyzed. This supports one-shot asynchronous result handling; it does not establish background tracking or a persistent location subscription.
Inference: The final optional-state write is consistent with clearing the pending continuation, but the value-witness/helper implementations were not separately analyzed.
Inference: This supports one-shot asynchronous result handling; it does not establish background tracking or a persistent location subscription.
Limit: The exact Swift error class/message and fully typed continuation generic/result ABI are not recovered by this pass.
Limit: The callback does not itself establish timeout settings, requested accuracy, authorization state or when the manager stops updates. The app accuracy:5 is a separate Hermes observation.
Limit: The function calls generic helpers in the declared encrypted interval; that prevents claiming complete Swift type/value reconstruction.
Limit: No physical location, location permission prompt or runtime result was collected.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-8defd93840c499d7`, `src-9579656f2b5d8ab7`, `src-a563f7f4e142b508`, `src-bc5d6bb3cfaa7727`.
#### GHIDRA-DEEP-06 — WebView media decisions depend on a native setting and host equality
Both apps contain the same selected media-permission branch structure. Raw setting 0 grants a matching host and prompts for a different host; 1 grants a matching host and denies a different host; 2 denies; 3 grants; other unsigned values prompt. The compared selectors independently resolve to host. Numeric decisions are interpreted using the official WebKit enum.
Limit: The actual mediaCapturePermissionGrantType value was not observed. This method compares host only for values 0/1; it does not establish a complete origin or app security policy. OS permissions remain separate. No vulnerability or successful capture is demonstrated.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-6f4ffe24ca2807e6`, `src-7f5de0c0fbf9908e`, `src-8acaacd95ef23b78`, `src-c745468b733faa59`.
#### GHIDRA-DEEP-07 — Notification content is converted to a structured JavaScript-facing dictionary
Both selected serializers prepare title, subtitle, body, badge, sound, launchImageName, data, attachments, categoryIdentifier, threadIdentifier, targetContentIdentifier and interruptionLevel. The core response serializer also prepares actionIdentifier and notification, normalizes the default action name, and includes userText for a text-input response.
Limit: These are serializer capabilities. Notification receipt, payload contents, permission state, backend delivery and app-level handling were not exercised. Some values use additional serializers; nil-to-NSNull substitution is visible for several scalar fields.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-3ac31596f599ee7e`, `src-73c1a7dbe052f2e1`, `src-78ccc9ce3d841a6a`.
#### GHIDRA-DEEP-08 — Visitt+ push data selects the body entry from notification userInfo
The Visitt+ data serializer reads request.content.userInfo. When the trigger is a UNPushNotificationTrigger it returns the body entry; otherwise it returns the whole userInfo object. Assembly preserves the class-test result in x21 before the conditional branch, correcting a misleading variable reuse in Ghidra pseudocode.
Observed: Class-test result: 0x1000126f0; conditional test: 0x10001272c. The branch is bound to the class-test boolean, not the trigger pointer.
Limit: Only the Plus implementation was followed to this helper in this continuation. No real push payload was observed; a missing body entry can return nil and downstream consumers require separate analysis.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt+.
Sources: `src-0cb4862c1804827b`, `src-7f5de0c0fbf9908e`.
#### GHIDRA-DEEP-09 — Notification responses can be retained when delegates do not handle them
Both selected NotificationCenterManager implementations read their delegates collection, invoke delegate callbacks when present, and contain a pendingResponses append path. The no-delegates branch reaches that append directly; the delegate loop also has a path to it. The native completion block is invoked before the visible function returns.
Observed: Plus assembly preserves each delegate return flag in x26; the response pointer is not the handled-result boolean. The pending path is consistent with no delegate accepting the response, without establishing later replay behavior.
Limit: Swift witness calls and decompiled boolean flow limit exact delegate ordering/handled-result semantics. This is pending response storage, not evidence of a durable notification queue, replay guarantees or actual delivery.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-11c7d192b65b8355`, `src-25ee32d3b48f7aeb`, `src-4bbd8bfcbd58e643`, `src-54ee685ba213dae4`, `src-582cacf56878ae9f`, `src-58f7a7aa4bff2d50`, `src-7f5de0c0fbf9908e`.
#### GHIDRA-DEEP-10 — Custom URLs update the linking registry and feed an onURLReceived event path
Both custom-URL subscriber paths reach helpers that update ExpoLinkingRegistry.initialURL and publish a notification with a url entry. The matching notification handlers retrieve url, attempt a Foundation URL cast, obtain absoluteString and pass a dictionary with url to a helper alongside the decoded Swift short string onURLReceived. AppDelegate universal-link callbacks also invoke RCTLinkingManager and an Expo subscriber path.
Observed: In Visitt+, the custom-URL publication helper explicitly returns false (mov w0,#0 at 0x100130984), and its subscriber preserves and returns that result (0x100130628). Publication therefore does not imply a true handled result from this callback. The AppDelegate universal-link wrapper combines its two handler results with OR; encrypted restoration helpers still limit interpretation.
Limit: The event-emission helper and complete universal-link subscriber chain were not fully traced. Some Swift metadata/restoration helpers enter encrypted bytes. This does not establish URL authorization, tenant access, SSO completion or runtime link delivery.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-230effecfbad9ad4`, `src-38382c4f7738f18b`, `src-3cc961490650ff87`, `src-4685776f41015a1c`, `src-50e3a4aa89e7887a`, `src-6c669fc0e1e565b3`, `src-7f5de0c0fbf9908e`, `src-88f98da673e669bc`, `src-9f5c64f9d3fb38b9`, `src-a27721b610466d69`, `src-ac1173f50456f7d6`, `src-ebb1b735497d0df4`, `src-f0a4e7424ab1bab6`.
#### GHIDRA-DEEP-11 — The core WebView response policy exposes HTTP errors and download handoff
The selected core navigation-response method conditionally emits url/statusCode for main-frame HTTP responses with status at least 400. For HTTP responses, an attachment-prefixed Content-Disposition or a MIME type WebKit cannot show can trigger an onFileDownload event carrying downloadUrl when that callback exists, followed by numeric decision 0. Otherwise the visible decision is 1.
Limit: The callback is optional and its runtime installation was not observed. This response policy does not trace the app-specific ExpoFile download/share/delete implementation. Static xref lookups for two exported API-name strings yielded no references; that bounded result does not establish absence.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-0e3336d69495f03a`, `src-8a3e60d28c0899e5`.
#### GHIDRA-DEEP-12 — Independent decoding recovers previously unnamed Objective-C calls
Validated ARM64 stub and chained-fixup decoding resolves 171 selected stub addresses across both apps, including 89 previously unnamed calls. All 82 already named controls agree and 21 validation checks pass. Recovered names include host, frameInfo, addScriptMessageHandler:name:, setLimitsNavigationsToAppBoundDomains:, website data-store methods, and navigation-response selectors.
Limit: These names are derived from original file bytes and shown in separate review copies; canonical Ghidra dossiers are unchanged. Selector names do not prove receiver classes or enabled flags. Core foreground slot 0x1003debe8 is unbacked BSS with no selector fixup, so its exact name remains unresolved.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt, Visitt+.
Sources: `src-0dabf73be880bc5c`, `src-2da2ff1fdd322bb2`, `src-4cf015b35a75ae29`, `src-620403204cc5a126`, `src-6ac286fa1623c175`, `src-7ddf9ec831c07871`.
### Offline export and SSO
#### OFFLINE-01 — The newer File and Sharing APIs now have native registration links
The shipped Hermes module graph binds the newer File API to native module FileSystem and sharing to ExpoSharing. Native FileSystem registration associates downloadFileAsync with implementation 0x1001237cc and a completion route through 0x100127e74 to 0x100123c00. ExpoSharing registration associates shareAsync with wrapper 0x1001ed2dc, which reaches 0x1001ecb64. This resolves the earlier attribution gap without relying on the separate legacy file-system download delegate.
Limit: These are shipped registration and code relationships. Runtime module instances, actual downloads and successful sharing were not exercised. Some generic Swift metadata/conversion helpers remain in encrypted bytes.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-05e625ab3a28d424`, `src-18252083ecdeb6f9`, `src-73145251ae38685d`, `src-96aaa131ddf9bbe8`, `src-9c82d0137b4d838f`, `src-9f80a5ba2820fce3`, `src-a4f370134b9484d8`, `src-c85dceb71bb6920c`, `src-df8c97876b7be85b`.
#### OFFLINE-02 — Native downloads add optional headers and require a 2xx HTTP response
The newer download implementation creates a URLRequest with numeric cache policy 0 and a 60-second request timeout, adds entries from the optional headers dictionary, creates an NSURLSession.sharedSession download task with a completion block, and resumes it. Completion handles a supplied transport error, a missing/non-HTTP response, an HTTP status outside 200–299, and a missing downloaded file URL as error paths.
Limit: The preflight helper and all promise/error conversion internals were not decompiled. No network request was performed. Redirect behavior, cookies, server authorization and resource-level timeouts are not established by these bodies.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-18252083ecdeb6f9`, `src-73145251ae38685d`, `src-96aaa131ddf9bbe8`, `src-c85dceb71bb6920c`.
#### OFFLINE-03 — Download naming and replacement depend on destination type and idempotent option
For a directory destination, native completion uses response.suggestedFilename, falling back to the captured source URL’s lastPathComponent. A file destination uses its own path. It checks whether the destination exists; an enabled idempotent option permits removing the existing item before moving the temporary download to the destination. Success prepares the destination URL string. Swift reflection metadata identifies DownloadOptions fields as headers and idempotent.
Inference: The shell supplies a filename option and uses its requested filename for display/MIME decisions, but filename is not a declared field in this native DownloadOptions record. The native destination basename therefore need not match the shell’s displayed Save title. This is a cross-layer inference; generic option conversion and actual server filename behavior remain untested.
Limit: No actual file was downloaded, overwritten or moved. Missing/malformed options and all generic conversion behavior remain partial. The original Hermes finding records supplied options; this continuation adds the distinct native destination-selection behavior.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-18252083ecdeb6f9`, `src-73145251ae38685d`, `src-896bbaccb240beef`, `src-96aaa131ddf9bbe8`, `src-df8c97876b7be85b`.
#### OFFLINE-04 — Share-sheet completion does not establish that a file was saved
The share implementation requires an accepted entry from a path-permission helper and NSFileManager.isReadableFileAtPath: to succeed, creates UIActivityViewController with the file URL, uses dialogTitle, configures a popover anchor on the device-idiom branch, installs a completion handler and presents it through the current view controller. Missing readability or presentation context has an error path. The separately reviewed completion handler invokes the Promise resolver with a zero/void value for both an activity type with completed=true and a nil activity type with completed=false; it does not inspect returnedItems or error in that selected handler.
Inference: The Hermes export helper posts download_success after shareAsync settles and deletes the local file. Native completion can settle for an uncompleted combination, so that app message cannot by itself prove a user saved or shared the file.
Limit: Completion routines 0x1001ed340, 0x1001ed44c and 0x1001ed2f4 were reviewed from retained original ARM64 bytes, not added as Ghidra dossiers. The permission/context helpers were not independently recovered. No share sheet, cancellation or saved file was observed. The completion outcomes are conditional code facts, not a claim that every failure settles successfully.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-031652ecea92d13f`, `src-18252083ecdeb6f9`, `src-896bbaccb240beef`, `src-9c82d0137b4d838f`, `src-9f80a5ba2820fce3`, `src-a4f370134b9484d8`.
#### OFFLINE-05 — Native SSO sessions construct success, cancel and explicit dismiss results
The ExpoWebBrowser openAuthSessionAsync registration reaches the recovered constructor and startup routines. They create ASWebAuthenticationSession with the authorization URL and optional redirect scheme, copy the ephemeral-session option, set a presentation provider and call start. Completion prepares type, url and error: URL presence selects success; absence selects cancel; optional URL.absoluteString and Error.localizedDescription are filled independently. Cleanup invokes stored completion state and clears the session. An explicitly reviewed dismissAuthSession path sends cancel, completes with type=dismiss, and clears module session state.
Observed: The presentation anchor returns UIApplication.keyWindow when available and otherwise initializes a UIWindow.
Observed: The callback uses URL presence for its type label; that label alone does not prove successful authentication or distinguish every no-URL failure.
Observed: The app-specific Hermes branch accesses result.url.match without an explicit result-type or URL guard in the inspected branch. Cancellation/error behavior in the actual app remains unverified.
Limit: Registration-to-wrapper and explicit-dismiss supplements use original ARM64 assembly and are labeled separately from the seven SSO dossiers. Opaque metadata/error guards remain partial. No authentication session, code exchange, cancellation defect or authenticated access was exercised.
Evidence status: `static_observation_not_runtime_verified`. Research date: 2026-10-12. Apps: Visitt.
Sources: `src-1bd2a3d841024a4e`, `src-227752bbf54f6282`, `src-32cc3a6190aa12ff`, `src-4720f486135bbd69`, `src-61ce2473fff5b705`, `src-72a346b21eb0d45c`, `src-7b7850986b1c294c`, `src-8570b7be777f6156`, `src-9291e5e91fbb98aa`.
## Catalogues and reuse
API catalogue: 787 Core variants plus 61 Plus executable documents. Search the typed analysis records by operation name, variables or selected field path. Requests were not invoked during this investigation.
Routes: 96 selected Core declarations and 24 Plus declarations. Guard labels and role lists require actual role hierarchy and tenant configuration to interpret.
Models: 20 Core client-selected families. A field name such as integrations.auth is a selected schema path, not a recovered credential value.
Native: 67 metadata records retain function addresses, inclusive virtual ranges, exclusive file ranges, source digests and REA Evidence IDs. Reconstructed pseudocode and raw machine code are withheld. Assembly-only corroboration does not increase the native dossier count.
Catalogue and canonical-source records have no dossier anchor. Retrieve them by stable record ID through MCP get_record or the website record views; all 125 finding records have precise anchors in this document.
## What still requires authorized access
Confirm tenant provisioning and account invitations; run role-specific work-order, inspection, amenity, visitor and billing workflows; inspect real offline conflict recovery; observe server authorization and session cookies; verify push delivery, file destinations and SSO cancellation behavior. Use an authorized test tenant with synthetic data. Missing access or a missing public source is an evidence gap, not a missing feature.
## Source index
- `src-00676a67f0d52173`: account-on-call-schedules-page-DhrTNQ81.js — https://app.visitt.io/assets/account-on-call-schedules-page-DhrTNQ81.js (observed 2026-10-11).
- `src-00d0ee929cf3eb63`: 025-deactivateVisitor.graphql — urn:visitt-rea:artifact:sha256:382e16120d5cf6eb06c71ff01fa83d44dbee3d5f177818635b65c75449997a79 (observed 2026-10-11).
- `src-014c9321990970d8`: webview-config.json — urn:visitt-rea:artifact:sha256:317191daa3969ad2d9eda89ee20327894cbe568c54a785a1b5c4aa4b90cb8007 (observed 2026-10-12).
- `src-01c082dd8e6184ba`: Expo.plist — urn:visitt-rea:artifact:sha256:6d766e4e2807585be2dfb36972440cff6b150ce73a5b55c10192f71e477fff5b (observed 2026-10-11).
- `src-02d4f0822d6f9674`: visitt-ReactNativeDependencies-native.json — urn:visitt-rea:artifact:sha256:0ac9ebd7631ce49b3a6e0c01d2dfa6df3a1568c15f25c89ed4e05e4b6498f014 (observed 2026-10-11).
- `src-031652ecea92d13f`: share-completion-assembly.txt — urn:visitt-rea:artifact:sha256:b98d92d0eb25f4c01826d799556d2bcc7120e31d2d124caa9a230832754a4bc0 (observed 2026-10-12).
- `src-035e786b77ab73e4`: lazy__portal-app-BEeCKePb.js__uf.js — urn:visitt-rea:artifact:sha256:8134ebff9a319a9eba9618b9cddd6453c2ecc3ad8d714a5b83f243f46d8bb737 (observed 2026-10-11).
- `src-03c65a14a74574cc`: account-vendors-general-settings-page-DCiTKN20.js — https://app.visitt.io/assets/account-vendors-general-settings-page-DCiTKN20.js (observed 2026-10-11).
- `src-0431cdc4d19d61d7`: vendor-company-coi-requirements-section-CfNoJxA8.js — https://app.visitt.io/assets/vendor-company-coi-requirements-section-CfNoJxA8.js (observed 2026-10-11).
- `src-05e625ab3a28d424`: 1001228f8.json — urn:visitt-rea:artifact:sha256:3437acb4065d1c55235deff82c624b50be06e760cf8a133125d0329eccc3dc30 (observed 2026-10-12).
- `src-06df89b5ee4a1d29`: use-company-integration-DB80qOZa.js — https://app.visitt.io/assets/use-company-integration-DB80qOZa.js (observed 2026-10-11).
- `src-091083b937b5c029`: lazy__navigator-C_eBC_J8.js — https://portal.visitt.io/assets/navigator-C_eBC_J8.js (observed 2026-10-11).
- `src-09e4ae1446a99ac7`: lazy__portal-app-BEeCKePb.js__Mm.js — urn:visitt-rea:artifact:sha256:afab1b43c1e60ac8f7d0fbbf6af0dd03e46405955dfc96f74b3f0b4755bd940e (observed 2026-10-11).
- `src-0a0a2158837b7264`: customer-combobox-w3D89hfz.js — https://app.visitt.io/assets/customer-combobox-w3D89hfz.js (observed 2026-10-11).
- `src-0a2e0912e4320ac6`: use-visitor-checkin-5V9dDpVs.js — https://app.visitt.io/assets/use-visitor-checkin-5V9dDpVs.js (observed 2026-10-11).
- `src-0c8bbf0d3d27e4b6`: charge-fragments-sGQUvEyd.js — https://app.visitt.io/assets/charge-fragments-sGQUvEyd.js (observed 2026-10-11).
- `src-0c97780d8d32a678`: 016-cancelAmenityBooking.graphql — urn:visitt-rea:artifact:sha256:88b89f715e8a88af8b5e748afddad5120288398aaed0d184fb6b5e5fe8d7459b (observed 2026-10-11).
- `src-0cb4862c1804827b`: 1000126ac.json — urn:visitt-rea:artifact:sha256:2d384dad3bedd60d4512a058601f31f1b3ef617b9bcfbf59afa5465328bddac1 (observed 2026-10-12).
- `src-0cd774d503d3b672`: lazy__portal-app-BEeCKePb.js__Up.js — urn:visitt-rea:artifact:sha256:068893a61fd1fa97574fddf36646eb193be0ea7e3e80b4bc7332e17de8159679 (observed 2026-10-11).
- `src-0dabf73be880bc5c`: visitt-plus-resolved.json — urn:visitt-rea:artifact:sha256:5f1efb563549cc79a4011b84394844c8f5e2e89dcd4c6bc3a2be9d59b9b060bc (observed 2026-10-12).
- `src-0e3336d69495f03a`: 10026840c.json — urn:visitt-rea:artifact:sha256:154fdc44bce8ded1ce53fae5acdf61d249ff42e4fd03f834e7e9843dde476e1a (observed 2026-10-12).
- `src-0ea3c51ebfe1866e`: 019-amenity.graphql — urn:visitt-rea:artifact:sha256:b23a2f33c2c15cc5f9af2aa878d86f5b9e1b0082d0026381fd2d258778c7b073 (observed 2026-10-11).
- `src-0f46e476e29ee27e`: 051-customPages.graphql — urn:visitt-rea:artifact:sha256:ae14872e5fd3055466550be82e96e98429ec8ef74638634199dec2b6866c5acf (observed 2026-10-11).
- `src-10462194c16d1b4b`: status-page-bx2j1Y9t.js — https://app.visitt.io/assets/status-page-bx2j1Y9t.js (observed 2026-10-11).
- `src-10a0e68275863a1b`: 063-addImageToIssue.graphql — urn:visitt-rea:artifact:sha256:e66b85a0fd39ac8cc13049d979ab3e56b2aa866cb901c9d0daffc2d63002a393 (observed 2026-10-11).
- `src-114240a27abce468`: import-users-button-DYR0nGyP.js — https://app.visitt.io/assets/import-users-button-DYR0nGyP.js (observed 2026-10-11).
- `src-114c5508708f53a2`: 020-amenityTimeChargesInfo.graphql — urn:visitt-rea:artifact:sha256:39559f8fcdd84a43891aed9981a7523c9d21534f91a0b958fb2a382f8ba99be1 (observed 2026-10-11).
- `src-11c7d192b65b8355`: 10001d048.json — urn:visitt-rea:artifact:sha256:f66e608838f4141c498ad341166af3d5d877fe9e5594f43590e8b9bf678baf71 (observed 2026-10-12).
- `src-12d3f1248752b69f`: post-message.json — urn:visitt-rea:artifact:sha256:a8212d7857f3a366f4009ee93f9f18c70508a630b8a9aa49ffde665f5fd7d666 (observed 2026-10-12).
- `src-12f6f32df153ed31`: add-document-button-BQl8FKJ7.js — https://app.visitt.io/assets/add-document-button-BQl8FKJ7.js (observed 2026-10-11).
- `src-1380daff64ad70dd`: vendor-coi-requirements-field-DAywFu_E.js — https://app.visitt.io/assets/vendor-coi-requirements-field-DAywFu_E.js (observed 2026-10-11).
- `src-13c6a55632456a9c`: 049-unarchiveContact.graphql — urn:visitt-rea:artifact:sha256:0439f5076f5d9023ad78270b13bb4169e1076c4e17e0a36f456282436ede7227 (observed 2026-10-11).
- `src-13eb2894c1c1b825`: inspector-home-page-Bg9xf_3v.js — https://app.visitt.io/assets/inspector-home-page-Bg9xf_3v.js (observed 2026-10-11).
- `src-14b5499f1949a8c4`: 00-index-sQew8XOr.js__SEe.js — urn:visitt-rea:artifact:sha256:535b0cf013e3978ec82f8aba8430af26eda3e1468aadcfbf735f26716de6793e (observed 2026-10-11).
- `src-14b60356eaf54065`: create-assignment-items-form-uVdOTOZQ.js — https://app.visitt.io/assets/create-assignment-items-form-uVdOTOZQ.js (observed 2026-10-11).
- `src-14d73976340dabc1`: 026-createVisitor.graphql — urn:visitt-rea:artifact:sha256:bd7474b6641498b0db7ddf20b5bcfe9b4d89390bbe7e06edde035419d8819559 (observed 2026-10-11).
- `src-1500f96c457778c5`: 00-index-sQew8XOr.js__aTe.js — urn:visitt-rea:artifact:sha256:7bd5b03286570d5951ddf4ed8d2d4a777054e5ebb49c9ec8686f0cf2a7c07401 (observed 2026-10-11).
- `src-151c92a90ce015ef`: add-button-create-company-modal-BH7-aIXb.js — https://app.visitt.io/assets/add-button-create-company-modal-BH7-aIXb.js (observed 2026-10-11).
- `src-1578aab6addafa94`: documents-fragments-Dm5XZ9P0.js — https://app.visitt.io/assets/documents-fragments-Dm5XZ9P0.js (observed 2026-10-11).
- `src-16e2c96c03b41915`: equipment-page-JEFOrm1n.js — https://app.visitt.io/assets/equipment-page-JEFOrm1n.js (observed 2026-10-11).
- `src-176104cfc22c850d`: lazy__broadcast-detail-content-DyF-hol_.js__zs.js — urn:visitt-rea:artifact:sha256:4c898045fc96090c6389fbb963a6372960270ed0ca92ea285e703704683db4fb (observed 2026-10-11).
- `src-17a0e6b1df524717`: lazy__portal-app-BEeCKePb.js__Xp.js — urn:visitt-rea:artifact:sha256:8c7142daa1ca1e36cbb85b8c958573254d3aa29bd05bc951c7fcb1d2083c0713 (observed 2026-10-11).
- `src-17a55cded525c145`: CRE Property Management & Operations Software — https://visitt.io/ (observed 2026-10-11).
- `src-17b0736c5096ab02`: create-vendor-form-dialog-BAYQnLsb.js — https://app.visitt.io/assets/create-vendor-form-dialog-BAYQnLsb.js (observed 2026-10-11).
- `src-17b91eab740cdf55`: 062-createPortalIssueUpdate.graphql — urn:visitt-rea:artifact:sha256:6e47759ac7f9cf16fa5d004187c67ec1c5ee05c29d7abd95c056c1c60c7b7a1e (observed 2026-10-11).
- `src-17f6bb9852f0dc76`: 039-customPage.graphql — urn:visitt-rea:artifact:sha256:b74a4e104db6d83d9ab13b743dce7e4c996875d10fe6b7a2bcc072483d7a8fe5 (observed 2026-10-11).
- `src-18252083ecdeb6f9`: export-observations.json — urn:visitt-rea:artifact:sha256:783857292e846acf45e6734ce2095e02dab7af0fe84931c8edc99eb5e8eb79e1 (observed 2026-10-12).
- `src-1861d709f1c6909e`: assignment-templates-page-C_TpzAXE.js — https://app.visitt.io/assets/assignment-templates-page-C_TpzAXE.js (observed 2026-10-11).
- `src-1ace1da69f11aa1e`: tenant-fragments-DBCgORcQ.js — https://app.visitt.io/assets/tenant-fragments-DBCgORcQ.js (observed 2026-10-11).
- `src-1bca288dde43d94c`: lazy__portal-app-BEeCKePb.js__qm.js — urn:visitt-rea:artifact:sha256:7f7e6ddcd3aa9639cfb02c45542a545959df3bb56eec5b3c84ebfd978597b467 (observed 2026-10-11).
- `src-1bd2a3d841024a4e`: 1001efbd0.json — urn:visitt-rea:artifact:sha256:755554bd8469a9e81ce42e55259495be980b34e2b6d6051db8ee76f767d4f770 (observed 2026-10-12).
- `src-1c170145fd881dea`: account-categories-settings-page-ftsA-msc.js — https://app.visitt.io/assets/account-categories-settings-page-ftsA-msc.js (observed 2026-10-11).
- `src-1cd54d1a72f6a92d`: PrivacyInfo.xcprivacy — urn:visitt-rea:artifact:sha256:118b16e0e97ffe8b6f1f01b7e04f68e5da764474a4d39d2933b0eeaef3cdc0ca (observed 2026-10-11).
- `src-1df8ef04b288e910`: view-create-page-8qWos1Qf.js — https://app.visitt.io/assets/view-create-page-8qWos1Qf.js (observed 2026-10-11).
- `src-1e119a9e7d3bc471`: ai-text-enhancements-DkGzLHEr.js — https://app.visitt.io/assets/ai-text-enhancements-DkGzLHEr.js (observed 2026-10-11).
- `src-1e876b4c37c24f41`: visitor-page-D8ge7_rd.js — https://app.visitt.io/assets/visitor-page-D8ge7_rd.js (observed 2026-10-11).
- `src-1ec227ba6792e177`: 013-homeUpdates.graphql — urn:visitt-rea:artifact:sha256:49a82f52195e53e60e072f61c1a4bc59331ba2321d079da150cd478e2d24493f (observed 2026-10-11).
- `src-1f55f71beb4a3a56`: app.manifest — urn:visitt-rea:artifact:sha256:821dd31d18cf26cfdf4f86759892a54ef8c5488292be93ccfa412d7c76887307 (observed 2026-10-11).
- `src-1f594e3a72a641c9`: address-mutations-CEkqCxdg.js — https://app.visitt.io/assets/address-mutations-CEkqCxdg.js (observed 2026-10-11).
- `src-2109366e1b531998`: lazy__login-helpers-ojKD0y_X.js__k.js — urn:visitt-rea:artifact:sha256:8e18b6593928689a4fe3f7b2ee0bdc958b5aa7a455ecbf32a630392cf84d6ebf (observed 2026-10-11).
- `src-21f83450b2c9a219`: 044-paginatedContacts.graphql — urn:visitt-rea:artifact:sha256:ac0111001aee251ecbb04d1efad655017d02cf37d87549228a42029b9837865d (observed 2026-10-11).
- `src-225eb1873969d18d`: amenity-edit-page-BSodAbv8.js — https://app.visitt.io/assets/amenity-edit-page-BSodAbv8.js (observed 2026-10-11).
- `src-227752bbf54f6282`: 1001ef594.json — urn:visitt-rea:artifact:sha256:fd8ffe7aeca33409174f45d66ccc697688cde4d3db1ec55fa070c2358a78211a (observed 2026-10-12).
- `src-22cc58b7f6b43e76`: 067-createPortalIssueReview.graphql — urn:visitt-rea:artifact:sha256:b28c3bb0a18be5f8c85d40741fc1d3b18654f061aa394c7546cd2b17d3d02acb (observed 2026-10-11).
- `src-22f95956f1f30f30`: asset-types-page-BfOgSV-0.js — https://app.visitt.io/assets/asset-types-page-BfOgSV-0.js (observed 2026-10-11).
- `src-230ba26722d41bff`: delete-category-dialog--d8oFY4Z.js — https://app.visitt.io/assets/delete-category-dialog--d8oFY4Z.js (observed 2026-10-11).
- `src-230effecfbad9ad4`: 100004db4.json — urn:visitt-rea:artifact:sha256:3dfbbf523a8cc9ab876e69a3a05fc519f384d86368bd682ab590b99c8d81abba (observed 2026-10-12).
- `src-230fe863039956f7`: company-account-meta-badge-DT2Mpwpb.js — https://app.visitt.io/assets/company-account-meta-badge-DT2Mpwpb.js (observed 2026-10-11).
- `src-232a5dea637a20e2`: app-url-handler.json — urn:visitt-rea:artifact:sha256:5f148ce8ba9bd090a43a55084dc05f6fd1d5224d2b734376c8479d3825042359 (observed 2026-10-12).
- `src-23759083518a85bc`: 1001ab4c0.json — urn:visitt-rea:artifact:sha256:c171daa9334ea7a9c9851e49a362c68c764cd6b7fe83b04eba2b14c451b27428 (observed 2026-10-12).
- `src-2399815af898ad0b`: lazy__portal-app-BEeCKePb.js__Il.js — urn:visitt-rea:artifact:sha256:28f28e15d439123ebbc837022f15896a43b4a19fbfb1cf498faa490f75dd7c6f (observed 2026-10-11).
- `src-2400edc8418c07c6`: Public Visitt source — https://portal.visitt.io/login (observed 2026-10-11).
- `src-243c999f20635510`: work-order-templates-page-D0eVLBG8.js — https://app.visitt.io/assets/work-order-templates-page-D0eVLBG8.js (observed 2026-10-11).
- `src-249f4f605bd80482`: sub-categories-multiple-select-filter-C-j7WYWO.js — https://app.visitt.io/assets/sub-categories-multiple-select-filter-C-j7WYWO.js (observed 2026-10-11).
- `src-25cf85c03defb476`: account-billing-general-settings-page-B5jPClHe.js — https://app.visitt.io/assets/account-billing-general-settings-page-B5jPClHe.js (observed 2026-10-11).
- `src-25ee32d3b48f7aeb`: 10001d068.json — urn:visitt-rea:artifact:sha256:cebd36238a3d69cb561de8e8edab716cd29756c2ff35eab46fd3884812d54a23 (observed 2026-10-12).
- `src-261aac0fd49387d4`: template-create-page-D4_qJpqh.js — https://app.visitt.io/assets/template-create-page-D4_qJpqh.js (observed 2026-10-11).
- `src-272183e6a2b05d1b`: navigation-policy.json — urn:visitt-rea:artifact:sha256:73699ce78de9fc37d3295a0e2ef2ae24cc6260dc5446536c4fa1f55f66b41bd1 (observed 2026-10-12).
- `src-2961c72b1ec15d07`: hermes.framework — urn:visitt-rea:artifact:ref:3d210d09d2d1a1be592d5a5f (observed 2026-10-11).
- `src-29b88d38c89c90d6`: fragments-DeVJ5wQZ.js — https://app.visitt.io/assets/fragments-DeVJ5wQZ.js (observed 2026-10-11).
- `src-29d6ed103c8818f4`: lazy__portal-app-BEeCKePb.js__em.js — urn:visitt-rea:artifact:sha256:d822100a44423317b8e21e3607e7e818da846665545843fac304a07b69c07351 (observed 2026-10-11).
- `src-2a4ce3a826131d0c`: 007-broadcast.graphql — urn:visitt-rea:artifact:sha256:a6b1139b7c1980104f46b4740eaef52c17316d5f7ff5ef9c393001e04e962d3a (observed 2026-10-11).
- `src-2aa9f55b844ad345`: coi-requirements-CvnxKr4Y.js — https://app.visitt.io/assets/coi-requirements-CvnxKr4Y.js (observed 2026-10-11).
- `src-2aff4440df6b7eba`: documents-list-osDEixNY.js — https://app.visitt.io/assets/documents-list-osDEixNY.js (observed 2026-10-11).
- `src-2b8978db661ab2c2`: broadcast-contact-filter-select-CkXbvUK4.js — https://app.visitt.io/assets/broadcast-contact-filter-select-CkXbvUK4.js (observed 2026-10-11).
- `src-2bd46b249517fcf8`: sync-charges-page-DUB5LxFI.js — https://app.visitt.io/assets/sync-charges-page-DUB5LxFI.js (observed 2026-10-11).
- `src-2bdba62e62e46f5b`: export-sites-button-vUR1Hhxs.js — https://app.visitt.io/assets/export-sites-button-vUR1Hhxs.js (observed 2026-10-11).
- `src-2cb9d47ce4dfe69a`: category-page-DxTDoDxi.js — https://app.visitt.io/assets/category-page-DxTDoDxi.js (observed 2026-10-11).
- `src-2da2ff1fdd322bb2`: summary.json — urn:visitt-rea:artifact:sha256:77f320ba053cd45e09b911e073320100379ce731cb74392cfaa5b4704568711f (observed 2026-10-12).
- `src-2dd63e33831da665`: visitt-native.json — urn:visitt-rea:artifact:sha256:17f0134aec89f5456d70221e379cf06c57a2f9e4ae2e9fffa123a6cc1ee2d4ca (observed 2026-10-12).
- `src-2eb8e299d4a1c4f6`: 014-customPages.graphql — urn:visitt-rea:artifact:sha256:8a21dec2d29cec519cda320d8a4d2e069ea6d16277a2e856e18fdf6c4cb5d149 (observed 2026-10-11).
- `src-2f3accc20620270b`: lazy__portal-app-BEeCKePb.js__qr.js — urn:visitt-rea:artifact:sha256:493dc7de4b61d2652d1981f9050737f2d681e03127b84a63f14b3165bf3082d9 (observed 2026-10-11).
- `src-30329eb804192942`: coi-tenant-company-settings-page-DyiBki4q.js — https://app.visitt.io/assets/coi-tenant-company-settings-page-DyiBki4q.js (observed 2026-10-11).
- `src-32cc3a6190aa12ff`: sso-observations.json — urn:visitt-rea:artifact:sha256:ffd429e232f60ae47eb0532379808ea5d3ad1cdc5b565bca2d0b70ac8a3b6a33 (observed 2026-10-12).
- `src-3375278e2084fa01`: 052-appLinks.graphql — urn:visitt-rea:artifact:sha256:a6510ec30448dc3151ccc088dbe0ab08160b3b42a2c03b823b45fe7674ba6132 (observed 2026-10-11).
- `src-33959dfa09e1935c`: 042-updateTenantContactChangesNotification.graphql — urn:visitt-rea:artifact:sha256:8442b388580bf4e571816d92c946668750e395cd2dcfa28cf21db4e3f305e8ff (observed 2026-10-11).
- `src-33f7554da906a4d3`: change-role-confirmation-s792X4zY.js — https://app.visitt.io/assets/change-role-confirmation-s792X4zY.js (observed 2026-10-11).
- `src-34a210a896613ee4`: import-one-page-link-bsiSMjxs.js — https://app.visitt.io/assets/import-one-page-link-bsiSMjxs.js (observed 2026-10-11).
- `src-3546d601dcbc0d7f`: Visitt — urn:visitt-rea:artifact:sha256:daeb763c076676aaebdb50fadcbaddd5aa930446d5432626846b87c696449a4e (observed 2026-10-12).
- `src-354b0ab1035573b0`: reviews-page-B_M2VQli.js — https://app.visitt.io/assets/reviews-page-B_M2VQli.js (observed 2026-10-11).
- `src-355f76c7ea58a215`: account-super-admin-integrations-page-Pf1F6_GW.js — https://app.visitt.io/assets/account-super-admin-integrations-page-Pf1F6_GW.js (observed 2026-10-11).
- `src-35c59c78bc2f9c34`: company-page-B0W9U0U5.js — https://app.visitt.io/assets/company-page-B0W9U0U5.js (observed 2026-10-11).
- `src-35d2caeb655f63fd`: broadcast-page-ChlxlHev.js — https://app.visitt.io/assets/broadcast-page-ChlxlHev.js (observed 2026-10-11).
- `src-35e15a98d8e852c1`: 00-index-sQew8XOr.js__cSe.js — urn:visitt-rea:artifact:sha256:67327701e8ae37ca45bfebd8a8b655e79313b0ff41614e5e43bc671e51b78ca9 (observed 2026-10-11).
- `src-360ce63eaba4ffd8`: lazy__vui-form-phone-input-CRH0sSU4.js__hs.js — urn:visitt-rea:artifact:sha256:906b14998fae07a190e45c0929a3fb03c0c10e796ac1d5eab6346573bd6c37ac (observed 2026-10-11).
- `src-367d3fe2860577e5`: visitt-plus-account-not-found.png — urn:visitt-rea:artifact:sha256:9bc8483b1891623f5440bbb9aa7d800e19b6139a6494e595a9273bd96da78f0c (observed 2026-10-11).
- `src-36b28782085f5132`: assignment-page-CvkykEFa.js — https://app.visitt.io/assets/assignment-page-CvkykEFa.js (observed 2026-10-11).
- `src-36e1e991e5c9f297`: 027-bulkCreateVisitors.graphql — urn:visitt-rea:artifact:sha256:1c005f6510108d9ef7353c87931f7de7bfae386728baad9a25708c1e987fa875 (observed 2026-10-11).
- `src-372cfd89017136ae`: use-visitor-watchlist-hooks-CKZAGRL2.js — https://app.visitt.io/assets/use-visitor-watchlist-hooks-CKZAGRL2.js (observed 2026-10-11).
- `src-38382c4f7738f18b`: 1001a8c20.json — urn:visitt-rea:artifact:sha256:2ea491a2dd56ce6555fc760edfc0c9d62375497e0e64d671173d7027cf00087c (observed 2026-10-12).
- `src-39b053286477aeb8`: lazy__vui-form-phone-input-CRH0sSU4.js__B7.js — urn:visitt-rea:artifact:sha256:b408175774d82c89944a6a508b34bac03f165a334140d4264d264b58d48ba523 (observed 2026-10-11).
- `src-39ed4f88ab58fd2b`: convert-to-global-vendor-dialog-CyIA9OdK.js — https://app.visitt.io/assets/convert-to-global-vendor-dialog-CyIA9OdK.js (observed 2026-10-11).
- `src-39f0261df0149d70`: combined-summary.json — urn:visitt-rea:artifact:sha256:cb4348d312ee2f096d3c4ea969018c127b56b200850df84b1f7ac36ccef320f8 (observed 2026-10-11).
- `src-3a77fc64351d025f`: main.jsbundle — urn:visitt-rea:artifact:sha256:688f904058f3c9f713269ffa799fcf6abf84b469f87e8b4833e7890418cc59bb (observed 2026-10-11).
- `src-3a8301ab4e30ab01`: 1000ec478.json — urn:visitt-rea:artifact:sha256:b79b2c12b6911394bd4bf531c2ca1533d690cf7613ea33dae1b9ee3fd53043ac (observed 2026-10-12).
- `src-3ac31596f599ee7e`: 100012054.json — urn:visitt-rea:artifact:sha256:bda182d8e6682afe2af17e4033e0212217656c60ed39f6769cd4d87e49a447f2 (observed 2026-10-12).
- `src-3b323089fc524d2b`: coi-requirements-upload-actions-UDj1E7ml.js — https://app.visitt.io/assets/coi-requirements-upload-actions-UDj1E7ml.js (observed 2026-10-11).
- `src-3b39bcbc61347cf1`: documents-page-ByznyxZt.js — https://app.visitt.io/assets/documents-page-ByznyxZt.js (observed 2026-10-11).
- `src-3b4d367ef85ed9fc`: 1000e83d4.json — urn:visitt-rea:artifact:sha256:0865abd22bc776b9c8560cf30faa74245c18b6dd2b01d676ad8f74dd7199d70c (observed 2026-10-12).
- `src-3bd2006fd30ebf71`: 032-deliveriesForPortal.graphql — urn:visitt-rea:artifact:sha256:c02f3d40d0d5736fe8cbd83cf2f92a80eedcd11a1c6c3324cbfec404288f0e81 (observed 2026-10-11).
- `src-3c60ece45a3f7f47`: lazy__login-helpers-ojKD0y_X.js__u.js — urn:visitt-rea:artifact:sha256:7baa705d713e556ed666c7bf4a2ef4fd68b920635cc0563a6db71adac1ea281b (observed 2026-10-11).
- `src-3cc961490650ff87`: 100004db4.json — urn:visitt-rea:artifact:sha256:f89a1c281f16a4717df9b97a3c929bdf2030f2339bacbd2e0582e30ae7aaa9e4 (observed 2026-10-12).
- `src-3cf64e7aff1ede66`: manager-issues-page-DNiXYplY.js — https://app.visitt.io/assets/manager-issues-page-DNiXYplY.js (observed 2026-10-11).
- `src-3ddc38be0a7a63a6`: Info.plist — urn:visitt-rea:artifact:sha256:6954dd588bfe6e13eed329c9935f715f3c4d3bd4647d0d7f04112d5f2956cda4 (observed 2026-10-11).
- `src-3e78ada1389d118d`: 033-delivery.graphql — urn:visitt-rea:artifact:sha256:11268c954367f532685c5e75e58bc4a211d9cc2a6bc6f8aca7938fc409f42b4c (observed 2026-10-11).
- `src-403938bebc200f07`: properties-page-blx5AjAb.js — https://app.visitt.io/assets/properties-page-blx5AjAb.js (observed 2026-10-11).
- `src-404fe672a036fe4f`: create-amenity-booking-page-BrDScwSI.js — https://app.visitt.io/assets/create-amenity-booking-page-BrDScwSI.js (observed 2026-10-11).
- `src-40bb0c25481e942d`: hermes — urn:visitt-rea:artifact:sha256:35ae6f202d34c895fbf77d91b88e6955e179927c65a2b54ac55dd21ebc0a7ef1 (observed 2026-10-11).
- `src-40c8dd7a73c1cc32`: visitt-metadata.json — urn:visitt-rea:artifact:sha256:4dfe46996e5db49cf463250bb48be84f18dac105ec92afeef3dbf8bf856c070f (observed 2026-10-11).
- `src-419738efaa58228c`: app-url-handler.json — urn:visitt-rea:artifact:sha256:9dd16ab2d4ea1d4e86968de16d2f8b4603241b38300af180aae5271defc458ab (observed 2026-10-12).
- `src-42d80f73471495dd`: navigation-policy.json — urn:visitt-rea:artifact:sha256:5c7d0cb8f25b79adb7f1939a195eb5955e014279b1f93845fe146ff780926697 (observed 2026-10-12).
- `src-42eb546a5f3fa244`: inspector-issues-page-BjyhI1NO.js — https://app.visitt.io/assets/inspector-issues-page-BjyhI1NO.js (observed 2026-10-11).
- `src-42eef64c9152410b`: charge-code-select-combobox-DtYpQR6W.js — https://app.visitt.io/assets/charge-code-select-combobox-DtYpQR6W.js (observed 2026-10-11).
- `src-42f47fdd77746304`: issue-sla-info-BgsidoOL.js — https://app.visitt.io/assets/issue-sla-info-BgsidoOL.js (observed 2026-10-11).
- `src-440e34e83e8eb335`: company-webhooks-list-CdFR3d1D.js — https://app.visitt.io/assets/company-webhooks-list-CdFR3d1D.js (observed 2026-10-11).
- `src-44175f0ffa8738a3`: add-tenant-locations-modal-button-WHgHJYiF.js — https://app.visitt.io/assets/add-tenant-locations-modal-button-WHgHJYiF.js (observed 2026-10-11).
- `src-44613408bf77c66e`: lazy__portal-app-BEeCKePb.js__Ef.js — urn:visitt-rea:artifact:sha256:c44ba2386acd0442c937e486b1f40ebe5950bb410a16d1c423f7a422c72aee00 (observed 2026-10-11).
- `src-44bb9f764e86430f`: customer-page-D1kdU0sa.js — https://app.visitt.io/assets/customer-page-D1kdU0sa.js (observed 2026-10-11).
- `src-44f9c60796c7e3a8`: 028-createVisitorWatchlistEntry.graphql — urn:visitt-rea:artifact:sha256:6963b4af02f599fafd9b825c6bc7cc279f461b61a6886f903c6c5c3a2193eee2 (observed 2026-10-11).
- `src-4637e1db037fb60e`: send-message-to-vendor-modal-trigger-yfnrIzjJ.js — https://app.visitt.io/assets/send-message-to-vendor-modal-trigger-yfnrIzjJ.js (observed 2026-10-11).
- `src-466d17725cc75986`: visit-action-panel-CBSfvUCq.js — https://app.visitt.io/assets/visit-action-panel-CBSfvUCq.js (observed 2026-10-11).
- `src-4685776f41015a1c`: 100130580.json — urn:visitt-rea:artifact:sha256:0176a6e83b51111a00e942b433fab7fb607797d4d2b0d66dec98a5b6204a8043 (observed 2026-10-12).
- `src-46a29d22060c1e09`: script-setup.json — urn:visitt-rea:artifact:sha256:e578e09b8c9b279b6404e2501e250dbba2309f78b7c77c192ee9219ea88883c7 (observed 2026-10-12).
- `src-4720f486135bbd69`: 1001ef8ec.json — urn:visitt-rea:artifact:sha256:3be26714a02183d18ad467fe03d55fd56ae5a51d7d0839f2200ad18ad8490fb6 (observed 2026-10-12).
- `src-4793d309e128f75c`: add-coi-document-item-modal-DMvE1bm9.js — https://app.visitt.io/assets/add-coi-document-item-modal-DMvE1bm9.js (observed 2026-10-11).
- `src-47faff5c967aa877`: Info.plist — urn:visitt-rea:artifact:sha256:76cca6c3bc798bdec5e4084e1f568bc397076c053eca971a07dead3338c90a00 (observed 2026-10-11).
- `src-48ea3d596667c398`: visitor-checkin-page-DZUA0vxk.js — https://app.visitt.io/assets/visitor-checkin-page-DZUA0vxk.js (observed 2026-10-11).
- `src-49b340348821da8f`: use-asset-types-j_4liHG6.js — https://app.visitt.io/assets/use-asset-types-j_4liHG6.js (observed 2026-10-11).
- `src-49cc78e64c4f87e5`: account-super-admin-features-page-BHu-XIm9.js — https://app.visitt.io/assets/account-super-admin-features-page-BHu-XIm9.js (observed 2026-10-11).
- `src-4b58f55ece7cc5cd`: amenity-create-page-Cd8NUurI.js — https://app.visitt.io/assets/amenity-create-page-Cd8NUurI.js (observed 2026-10-11).
- `src-4bbd8bfcbd58e643`: 10001dfc8.json — urn:visitt-rea:artifact:sha256:d2536768168babc88aaf740e105f823fc78d703c5cdfbb4af98ba4745e203a9b (observed 2026-10-12).
- `src-4c3f3dc1f68d11ab`: activity-logs-button-DsVJURjd.js — https://app.visitt.io/assets/activity-logs-button-DsVJURjd.js (observed 2026-10-11).
- `src-4c4ed428d837eed5`: app.config — urn:visitt-rea:artifact:sha256:cd14d1804688d3fd98ca3db558beef4ea7807dfa7940cd8ceb8c858db9ac13c2 (observed 2026-10-11).
- `src-4cf015b35a75ae29`: visitt-resolved.json — urn:visitt-rea:artifact:sha256:eb1432f533ba3f553e765b2bd0a7efa93b9341600037be30942a2ba1e5e33ea8 (observed 2026-10-12).
- `src-4df4a4a26bda9b7b`: broadcast-branding-settings-page-C8VV0XEF.js — https://app.visitt.io/assets/broadcast-branding-settings-page-C8VV0XEF.js (observed 2026-10-11).
- `src-4e6944e198e8af76`: entity-import-modal-dcUDUbqC.js — https://app.visitt.io/assets/entity-import-modal-dcUDUbqC.js (observed 2026-10-11).
- `src-4f4a8101d30732dd`: lazy__login-flow-BRinyHCP.js__ht.js — urn:visitt-rea:artifact:sha256:d0da9afc8b78c4aa9f4e7da5e69895b5a48ba002ce16bb944ac4e697370b5daa (observed 2026-10-11).
- `src-4f6e55c949d77e90`: documents-list-page-Dl9dILFh.js — https://app.visitt.io/assets/documents-list-page-Dl9dILFh.js (observed 2026-10-11).
- `src-4f704f9cf3232dad`: users-page-a6bUt9hF.js — https://app.visitt.io/assets/users-page-a6bUt9hF.js (observed 2026-10-11).
- `src-4f712ba2a3ef22f1`: lazy__portal-app-BEeCKePb.js__Fp.js — urn:visitt-rea:artifact:sha256:bbe7e57ea8183832e8a290af2a0c1a8c75924e16fb71d43ea4d89643f9a323e9 (observed 2026-10-11).
- `src-4fb13cae4b6ea83c`: React — urn:visitt-rea:artifact:sha256:7b9f4c66ed0a3a890878d3d9e78e413601a5eb5016a3c5beb6eee15be5a14955 (observed 2026-10-11).
- `src-50e3a4aa89e7887a`: 100131644.json — urn:visitt-rea:artifact:sha256:5701a77cc93ce6445572b47924caef670857a040ffdb1b49c6f0c2ccf98d9416 (observed 2026-10-12).
- `src-50f610dff0edb63b`: visitt-account-not-found.png — urn:visitt-rea:artifact:sha256:dd0b75bdbe25e0da37c12a1230bac12e0f61ad9dcb407bd30a09ce40dd10c627 (observed 2026-10-11).
- `src-51598c54e372355f`: create-category-KWGu6p0O.js — https://app.visitt.io/assets/create-category-KWGu6p0O.js (observed 2026-10-11).
- `src-5160e7901c26e7ab`: 046-contact.graphql — urn:visitt-rea:artifact:sha256:2681fd0da4fd60105f78fa27061950d9a7d921f251cc77b443204696f31576d4 (observed 2026-10-11).
- `src-51778506b455827a`: 030-visitorWatchlistEntry.graphql — urn:visitt-rea:artifact:sha256:6a3ca25c576b8ad839850731677b0e4b472978c4aa3199cd4e85e704cdf18cc8 (observed 2026-10-11).
- `src-52705a1f0b2a8c9a`: customers-page-D2vCcWo6.js — https://app.visitt.io/assets/customers-page-D2vCcWo6.js (observed 2026-10-11).
- `src-52cd1b0b735e68e0`: create-visitor-watchlist-entry-page-BBFK8qLO.js — https://app.visitt.io/assets/create-visitor-watchlist-entry-page-BBFK8qLO.js (observed 2026-10-11).
- `src-5341a8123c5a8238`: visitt-plus-metadata.json — urn:visitt-rea:artifact:sha256:42250048343733926b199534eac8aba8a9b746c844c05d0e9e2996d9ef77f8cd (observed 2026-10-11).
- `src-53437f5ebe46c2d8`: visitt-plus-ReactNativeDependencies-native.json — urn:visitt-rea:artifact:sha256:a7d3c487c3a9e3e12c0c52ca523283e277b87dbf2446f3e54b7c47903bfb4649 (observed 2026-10-11).
- `src-53c607c19c0a9025`: tenant-page-CHPeta7c.js — https://app.visitt.io/assets/tenant-page-CHPeta7c.js (observed 2026-10-11).
- `src-54ee685ba213dae4`: 10001d05c.json — urn:visitt-rea:artifact:sha256:05d443ad770154250222b84b25ad0567afe3803815d49eeac22424d71fe5fa35 (observed 2026-10-12).
- `src-55c01b312721df1f`: 059-issue.graphql — urn:visitt-rea:artifact:sha256:531f41c766e3f0d3a146b97ed725ee4ad80c68b0434c815b2f1e15e393253a66 (observed 2026-10-11).
- `src-55caa97c8ad36f00`: delete-sites-modal-jsmeJ_Sr.js — https://app.visitt.io/assets/delete-sites-modal-jsmeJ_Sr.js (observed 2026-10-11).
- `src-5741681365f89c17`: 00-index-sQew8XOr.js__rTe.js — urn:visitt-rea:artifact:sha256:39dd112c94a208725e586d5d868587ee8e27973bf933897c584be29eb5927ceb (observed 2026-10-11).
- `src-582cacf56878ae9f`: 10001dfb4.json — urn:visitt-rea:artifact:sha256:66a7b830cf41550988128ed2c1c0b64d689f4c4769f13e94f7b50806c9d23af1 (observed 2026-10-12).
- `src-58f7a7aa4bff2d50`: 10001d054.json — urn:visitt-rea:artifact:sha256:d7502cd90b2e0b601c4e15cbd307357e779897d5e9b3faec34b3e9922ccd480f (observed 2026-10-12).
- `src-59687a41abe6e517`: lazy__vui-form-phone-input-CRH0sSU4.js__V8.js — urn:visitt-rea:artifact:sha256:6b3ac07e80b9cd7309e2c8895ed7f30e669c49f9eb2159b318a4dbe87d99c04a (observed 2026-10-11).
- `src-5997720f8bc87786`: coi-consts-D8FKc1kd.js — https://app.visitt.io/assets/coi-consts-D8FKc1kd.js (observed 2026-10-11).
- `src-59c4c0e4996a4b23`: tenant-app-settings-D9pgxzJn.js — https://app.visitt.io/assets/tenant-app-settings-D9pgxzJn.js (observed 2026-10-11).
- `src-5a5704d6537ea14c`: super-admins-page-DNplZyDm.js — https://app.visitt.io/assets/super-admins-page-DNplZyDm.js (observed 2026-10-11).
- `src-5a6ec981c0215a72`: message-handler.json — urn:visitt-rea:artifact:sha256:4249ba2dd3ee52aff9fd334294a99b39110e44a75aa5e3b6f766ffe85ff713b4 (observed 2026-10-12).
- `src-5ad7dabfb14fe7f2`: lazy__portal-app-BEeCKePb.js__kp.js — urn:visitt-rea:artifact:sha256:c102eebea8c5a14bf1e49329468465a666da8542cd17680bad1d8a647380a7b7 (observed 2026-10-11).
- `src-5af8fc1c340903f3`: 00-index-sQew8XOr.js__iTe.js — urn:visitt-rea:artifact:sha256:035ba2ade5b687630295992160be6bb58d93eaab269b0c760359f0b039cca0a8 (observed 2026-10-11).
- `src-5b5bc684ce6adf90`: lazy__login-flow-BRinyHCP.js__ft.js — urn:visitt-rea:artifact:sha256:e9dc16b2c5784898c0f7cdf01af39b8495a8497418caa4dea95ceacda5eccf8c (observed 2026-10-11).
- `src-5c26386528cff518`: create-broadcast-page-iI8yunXX.js — https://app.visitt.io/assets/create-broadcast-page-iI8yunXX.js (observed 2026-10-11).
- `src-5c5b8d1ab451dbd3`: visitor-fragments-BpR4-rDP.js — https://app.visitt.io/assets/visitor-fragments-BpR4-rDP.js (observed 2026-10-11).
- `src-5dd18f3d0092552f`: lazy__portal-app-BEeCKePb.js__mp.js — urn:visitt-rea:artifact:sha256:b9e7469f0067ca5b2de339e91017abe4b390a3f999de1ba77f82b55eff24f17d (observed 2026-10-11).
- `src-5e88e91c4a663124`: 009-createPortalIssue.graphql — urn:visitt-rea:artifact:sha256:6dd51624325c6603c9e1f5db8d4eeb29a17a34ebebe0b0b04e86f1020a274650 (observed 2026-10-11).
- `src-5e9c1905f931be50`: 040-updateMyName.graphql — urn:visitt-rea:artifact:sha256:cb94f76dd1e145ef8326ee183c5a62561566df95c040d2fef82407caf1190e73 (observed 2026-10-11).
- `src-5fd83a929ea2a27e`: company-settings-page-C_iIT4E3.js — https://app.visitt.io/assets/company-settings-page-C_iIT4E3.js (observed 2026-10-11).
- `src-60419fdc8124b4b0`: work-order-instructions-page-C_6lMMdP.js — https://app.visitt.io/assets/work-order-instructions-page-C_6lMMdP.js (observed 2026-10-11).
- `src-60bdeadfbb9f9e8a`: 006-updateBroadcastSeenByMe.graphql — urn:visitt-rea:artifact:sha256:c2965f8e17c0a56c5f5eaef8cdf0c2d6d676f157a0145004bc1033873f7504b0 (observed 2026-10-11).
- `src-60d1c399691071de`: site-fragments-Cvb86vlO.js — https://app.visitt.io/assets/site-fragments-Cvb86vlO.js (observed 2026-10-11).
- `src-61ce2473fff5b705`: 1001effcc.json — urn:visitt-rea:artifact:sha256:98470af0f5eb7c691fd80976848fcfaf9af6fc489634c127fd58bfdd12608466 (observed 2026-10-12).
- `src-620403204cc5a126`: webview-corroboration.json — urn:visitt-rea:artifact:sha256:edc8451a70350113ad9ee82902912a04f6eabe27863b8a2e79a8b120fcb50e49 (observed 2026-10-12).
- `src-638c4d3f9d4b92a9`: ooo-settings-page-_USLJ2Tf.js — https://app.visitt.io/assets/ooo-settings-page-_USLJ2Tf.js (observed 2026-10-11).
- `src-6413574ae293302e`: broadcast-templates-page-CsVrQkNF.js — https://app.visitt.io/assets/broadcast-templates-page-CsVrQkNF.js (observed 2026-10-11).
- `src-651fed7a4b5b3f43`: 012-visitorsForPortal.graphql — urn:visitt-rea:artifact:sha256:ce7c4eae7fa7a5a2b6c39e84c44321fd6f237628e05a040e38f090a38b84bb03 (observed 2026-10-11).
- `src-65dd50025e79ddbe`: account-security-authentication-page-DiAF9FuF.js — https://app.visitt.io/assets/account-security-authentication-page-DiAF9FuF.js (observed 2026-10-11).
- `src-663d97cd3e71c2da`: 068-createCompanyPortalIssue.graphql — urn:visitt-rea:artifact:sha256:72789a9a0bd72680d2b316d9a2e6b1813eb8df0f186573a7113a787117354ef6 (observed 2026-10-11).
- `src-667c49884ff710cc`: oauth-authorize-page-BhbMIoq2.js — https://app.visitt.io/assets/oauth-authorize-page-BhbMIoq2.js (observed 2026-10-11).
- `src-678ce5887aa5b664`: 036-customPages.graphql — urn:visitt-rea:artifact:sha256:87949dbacc2f2f405094d40d0eba4ac797e89dc458e9b3e355bb64a18c98d12f (observed 2026-10-11).
- `src-67d5698094fd358d`: paginated-documents-table-C6Gmi9a7.js — https://app.visitt.io/assets/paginated-documents-table-C6Gmi9a7.js (observed 2026-10-11).
- `src-6844813c75dc5d0f`: 00-index-sQew8XOr.js__bEe.js — urn:visitt-rea:artifact:sha256:ae39c20d323a5c553255b20ad8255b63536fd8189abca0eae79fd123fb8392a6 (observed 2026-10-11).
- `src-688ab2f6e894959a`: broadcast-groups-page-BiEgmsKd.js — https://app.visitt.io/assets/broadcast-groups-page-BiEgmsKd.js (observed 2026-10-11).
- `src-694f5d8244dbc632`: amenity-fragments-BHJral0R.js — https://app.visitt.io/assets/amenity-fragments-BHJral0R.js (observed 2026-10-11).
- `src-6a21847ff2e1b236`: post-message.json — urn:visitt-rea:artifact:sha256:dee483328f0fc42d42d5380245d9a148c8f378e923964e30e4dcccf3fb723875 (observed 2026-10-12).
- `src-6a2aaee1d682fb41`: visitor-create-page-CP5yn_I-.js — https://app.visitt.io/assets/visitor-create-page-CP5yn_I-.js (observed 2026-10-11).
- `src-6ac286fa1623c175`: extra-selectors.json — urn:visitt-rea:artifact:sha256:85d7a09a4995464a7e700124ddff18db87d264512d2cf74dca5be517899a0a77 (observed 2026-10-12).
- `src-6b1c60679d9460fc`: visitt-plus-hermes-native.json — urn:visitt-rea:artifact:sha256:b6a8d76b3520c83a09555a908ca0796e5a9cc6d457177e13b7d0937200673c86 (observed 2026-10-11).
- `src-6b658af3ea1ee005`: 061-markIssueUpdatesSeenByMe.graphql — urn:visitt-rea:artifact:sha256:7fde32121365ef27153ce44898b4fde5eb7e32169a09061a112687e1b0a3fe6d (observed 2026-10-11).
- `src-6b9b853f8474043d`: visits-list-Cjkwuzhz.js — https://app.visitt.io/assets/visits-list-Cjkwuzhz.js (observed 2026-10-11).
- `src-6c0d7744e7f53515`: 065-addImageToIssue.graphql — urn:visitt-rea:artifact:sha256:11bde086cd2daf1dbd5bc081e7f2c1e4fcd8f16648137eae51d62a7c67caa229 (observed 2026-10-11).
- `src-6c669fc0e1e565b3`: 100130050.json — urn:visitt-rea:artifact:sha256:11df2ee14f21a57dc922b872ea0a9ff784443456e9af652504f3600a08bfb1b1 (observed 2026-10-12).
- `src-6d10105cd4040682`: lazy__vui-form-phone-input-CRH0sSU4.js__yo.js — urn:visitt-rea:artifact:sha256:c98578ce013a000a7b326a59f067b91f160f02505892adfe8d9b825ff85477e1 (observed 2026-10-11).
- `src-6e19d33ed4bbc136`: 1000ec7e8.json — urn:visitt-rea:artifact:sha256:f91668f6f34b2e38e8cee4e853969ca62c7e991f8dcce910dfa9c09d499a6af9 (observed 2026-10-12).
- `src-6f4ffe24ca2807e6`: Public Visitt source — https://raw.githubusercontent.com/WebKit/WebKit/main/Source/WebKit/UIProcess/API/Cocoa/WKUIDelegate.h (observed 2026-10-12).
- `src-6f654e42d1e93753`: 066-deleteIssueImage.graphql — urn:visitt-rea:artifact:sha256:d21b828ef6ae668756f432955d1181bc27ed538336af6aa32ee287eafe59b859 (observed 2026-10-11).
- `src-710484aee309a5ce`: lazy__login-helpers-ojKD0y_X.js — https://portal.visitt.io/assets/login-helpers-ojKD0y_X.js (observed 2026-10-11).
- `src-712a8bd3a38fbd51`: use-account-tenant-app-settings-y7_KddSY.js — https://app.visitt.io/assets/use-account-tenant-app-settings-y7_KddSY.js (observed 2026-10-11).
- `src-71fea57903592eb6`: lazy__portal-app-BEeCKePb.js__Wo.js — urn:visitt-rea:artifact:sha256:f03584c214b4cb5a8f8b2cb7e9559d63be277b1e07089057bac73e88fd470075 (observed 2026-10-11).
- `src-727aa55408c8e3c0`: export-companies-button-B5a8R4Ca.js — https://app.visitt.io/assets/export-companies-button-B5a8R4Ca.js (observed 2026-10-11).
- `src-72a346b21eb0d45c`: 1001efaf8.json — urn:visitt-rea:artifact:sha256:d6b6ed3a59e5853c705577843af4a16f10fc2c78c66676c83e50bceea84f0c72 (observed 2026-10-12).
- `src-72bd9182320eb7fd`: 048-archiveContact.graphql — urn:visitt-rea:artifact:sha256:7eefe61d4277b9df9f031e739e086c0ad127ad98b1eaaf0618898ac7db336205 (observed 2026-10-11).
- `src-73097b155b8189bd`: company-coi-requirements-page-CLFKuGoh.js — https://app.visitt.io/assets/company-coi-requirements-page-CLFKuGoh.js (observed 2026-10-11).
- `src-73145251ae38685d`: 100123c00.json — urn:visitt-rea:artifact:sha256:7f5b66d0291c45b6c44cb034ac2c113b015f9368bef5fe55218611eece945efb (observed 2026-10-12).
- `src-7338e98a095bc8fd`: building-fragments-D4X6AyF7.js — https://app.visitt.io/assets/building-fragments-D4X6AyF7.js (observed 2026-10-11).
- `src-73c1a7dbe052f2e1`: 100011ca0.json — urn:visitt-rea:artifact:sha256:31c4d2dffcf8d9e6050ee6594ecfbbc7044538483de4467d65ba2a694e5ceae5 (observed 2026-10-12).
- `src-74d89fe66f799195`: company-general-settings-page-Ckf9dP6V.js — https://app.visitt.io/assets/company-general-settings-page-Ckf9dP6V.js (observed 2026-10-11).
- `src-74eea6fd394fed8b`: 002-updatePushNotificationsToken.graphql — urn:visitt-rea:artifact:sha256:66469009c6619790f9e894d926af357945da25c72c7e2ca57a0eddca1b716b6b (observed 2026-10-11).
- `src-74fa5db33d3a6e39`: lazy__vui-form-phone-input-CRH0sSU4.js__Q3.js — urn:visitt-rea:artifact:sha256:e5ff25939cfd1ec494f30672c8d86cf61a88254899692eb27f8c0dba2856f453 (observed 2026-10-11).
- `src-765134a5e2a36e90`: updatable-tenant-leased-spaces-BUJJ_9K9.js — https://app.visitt.io/assets/updatable-tenant-leased-spaces-BUJJ_9K9.js (observed 2026-10-11).
- `src-767c10b7e36df6ef`: use-categories-B_uBOofq.js — https://app.visitt.io/assets/use-categories-B_uBOofq.js (observed 2026-10-11).
- `src-77121332a96a33d0`: assignment-fragments-0z0qyJbf.js — https://app.visitt.io/assets/assignment-fragments-0z0qyJbf.js (observed 2026-10-11).
- `src-7789750e3c4d9788`: on-call-schedule-page-CbAcaD8-.js — https://app.visitt.io/assets/on-call-schedule-page-CbAcaD8-.js (observed 2026-10-11).
- `src-78099cee567fc9da`: vendors-issue-inbox-page-Cu-PddoQ.js — https://app.visitt.io/assets/vendors-issue-inbox-page-Cu-PddoQ.js (observed 2026-10-11).
- `src-78ccc9ce3d841a6a`: 100012000.json — urn:visitt-rea:artifact:sha256:f1bc6aa74e3d0ed25e06067be53c4baddad69c18d92bce564c8e2bfa6f4393b4 (observed 2026-10-12).
- `src-78dd093e1a6b8da9`: lazy__login-flow-BRinyHCP.js — https://portal.visitt.io/assets/login-flow-BRinyHCP.js (observed 2026-10-11).
- `src-79187d7e157ce34f`: amenity-booking-status-badge-kdOcgf6Z.js — https://app.visitt.io/assets/amenity-booking-status-badge-kdOcgf6Z.js (observed 2026-10-11).
- `src-79a24a5b001d9478`: user-settings-page-BSFq4Vet.js — https://app.visitt.io/assets/user-settings-page-BSFq4Vet.js (observed 2026-10-11).
- `src-7a6bc98435cdca9a`: calendar-page-CigYGJQd.js — https://app.visitt.io/assets/calendar-page-CigYGJQd.js (observed 2026-10-11).
- `src-7b7850986b1c294c`: 1001efce4.json — urn:visitt-rea:artifact:sha256:144c2088eb075a2c53d87fbec902fe30b68f53762fb93dcd1bf637b2625d9d89 (observed 2026-10-12).
- `src-7cc16c5ba46ae7fb`: lazy__portal-app-BEeCKePb.js__gl.js — urn:visitt-rea:artifact:sha256:3f11b21a218760f79080b5da9307a62da75dfae4bcca5e35176276a19f1b4d92 (observed 2026-10-11).
- `src-7da8879fa73cae01`: company-features-settings-Dfghb2kK.js — https://app.visitt.io/assets/company-features-settings-Dfghb2kK.js (observed 2026-10-11).
- `src-7ddf9ec831c07871`: verification.json — urn:visitt-rea:artifact:sha256:ecf1fa92f4cff672a8c774b93a0209b2163ca82f4f766e2a112e3ed40ec0a048 (observed 2026-10-12).
- `src-7f5de0c0fbf9908e`: plus-observations.json — urn:visitt-rea:artifact:sha256:7cf99dbb994f766e482a87d4c3a126663043c16ef501b91a40386956f25793ad (observed 2026-10-12).
- `src-7f6ba9c51e4a6fc1`: import-one-results-page-BcdrzKKI.js — https://app.visitt.io/assets/import-one-results-page-BcdrzKKI.js (observed 2026-10-11).
- `src-7f80b6c2f2ee466a`: 010-publicPortalIssues.graphql — urn:visitt-rea:artifact:sha256:9960573fa7817499724f96da0cd96102744ad42fa47e4de9b21774035dc1d7f0 (observed 2026-10-11).
- `src-7fd1354df88ffdc1`: visitor-watchlist-page-BmriD_YU.js — https://app.visitt.io/assets/visitor-watchlist-page-BmriD_YU.js (observed 2026-10-11).
- `src-7fd706adbc546198`: use-company-features-BDel7Rzz.js — https://app.visitt.io/assets/use-company-features-BDel7Rzz.js (observed 2026-10-11).
- `src-8008ed4e34a1a564`: webview-config.json — urn:visitt-rea:artifact:sha256:f2833ce2e5b311f916bf93d271ccca3405e8abca0db05c5c66664120adbba5d5 (observed 2026-10-12).
- `src-806f483c72e20b20`: 1000ed994.json — urn:visitt-rea:artifact:sha256:c1df7853954a325a45647ba024ed56a9d22fd9fe1d12175300c25bcbbb236aeb (observed 2026-10-12).
- `src-8087c8110fb48ad4`: pause-assignments-form-modal-LmkTV1Ci.js — https://app.visitt.io/assets/pause-assignments-form-modal-LmkTV1Ci.js (observed 2026-10-11).
- `src-809b01cb93fef974`: charge-name-B7HFoP8U.js — https://app.visitt.io/assets/charge-name-B7HFoP8U.js (observed 2026-10-11).
- `src-812e39be06ad1ce4`: 047-updateContact.graphql — urn:visitt-rea:artifact:sha256:3c31f6ea7ac6bbd3115b878199fd8e26097401eb6dfdb924f1e712f87e3338cf (observed 2026-10-11).
- `src-825b41c0c2d9607d`: document-analysis-page-DKPk3qn9.js — https://app.visitt.io/assets/document-analysis-page-DKPk3qn9.js (observed 2026-10-11).
- `src-8271ccc026dca94d`: reports-page-YxMdFULI.js — https://app.visitt.io/assets/reports-page-YxMdFULI.js (observed 2026-10-11).
- `src-830547df9ba1c934`: Consolidated Visitt investigation metadata — urn:visitt-rea:artifact:sha256:803c382f87f02fad05704bc6c0c0434564b94b8b3f42f31992689a2ce6182ab9 (observed 2026-10-12).
- `src-832dfc5a2dfe962d`: import-data-rows-page-D-japXDr.js — https://app.visitt.io/assets/import-data-rows-page-D-japXDr.js (observed 2026-10-11).
- `src-8337f89eb87fdb60`: How to Log In to Your Account — https://help.visitt.io/en/articles/10425978-how-to-log-in-to-your-account (observed 2026-10-11).
- `src-8570b7be777f6156`: 1001ef684.json — urn:visitt-rea:artifact:sha256:c74a3ce0a6d45f63627eb746e48ffadbcdeac8ee50d9618912e5a43961768a81 (observed 2026-10-12).
- `src-8577b550359da5b3`: lazy__vui-form-phone-input-CRH0sSU4.js__r8.js — urn:visitt-rea:artifact:sha256:418da49fbbd8418422a15f86492f457dd02c8cd6e2938c68dd4d1600369eb320 (observed 2026-10-11).
- `src-858579fd7f031da6`: my-work-page-D6YEhpN7.js — https://app.visitt.io/assets/my-work-page-D6YEhpN7.js (observed 2026-10-11).
- `src-859b4457ddb1ec63`: lazy__portal-app-BEeCKePb.js__op.js — urn:visitt-rea:artifact:sha256:443fb485a79bc8b41ba2af3a8875425b051f066707c0883b5d6f111ab5e8fed3 (observed 2026-10-11).
- `src-85dd0fb538fabd45`: visitor-emails-page-C1St9vhb.js — https://app.visitt.io/assets/visitor-emails-page-C1St9vhb.js (observed 2026-10-11).
- `src-8606881a5641c5e1`: ReactNativeDependencies — urn:visitt-rea:artifact:sha256:eccd27fd38ad07d701b79ad34626f6f478e4abc2753bd8f76de449433a8ec50c (observed 2026-10-11).
- `src-875e9cfa5c993a3f`: visitt-assetutil.json — urn:visitt-rea:artifact:sha256:6d3a8c4a62017bc4216787251c2752e6d4dd978c8d93b771c6551742397915ab (observed 2026-10-11).
- `src-87b4fbbce520f94d`: document-page-D5hmRggR.js — https://app.visitt.io/assets/document-page-D5hmRggR.js (observed 2026-10-11).
- `src-87d0b9b18d885282`: account-work-order-templates-page-D15ZGNDM.js — https://app.visitt.io/assets/account-work-order-templates-page-D15ZGNDM.js (observed 2026-10-11).
- `src-880894585f1d7b32`: tenant-coi-requirements-page-BeqTnHwn.js — https://app.visitt.io/assets/tenant-coi-requirements-page-BeqTnHwn.js (observed 2026-10-11).
- `src-884abe468ac7add5`: lazy__broadcast-detail-content-DyF-hol_.js — https://portal.visitt.io/assets/broadcast-detail-content-DyF-hol_.js (observed 2026-10-11).
- `src-888dd6629714ca7c`: building-page-GQh029MT.js — https://app.visitt.io/assets/building-page-GQh029MT.js (observed 2026-10-11).
- `src-8891ef0cf4d0f5ad`: disable-role-dialog-BMH8v8zP.js — https://app.visitt.io/assets/disable-role-dialog-BMH8v8zP.js (observed 2026-10-11).
- `src-88f98da673e669bc`: 1001318c0.json — urn:visitt-rea:artifact:sha256:aaf2a73295d91dcc68bf02bbc768dbbc95a42376454d0491176b7ca1062ea862 (observed 2026-10-12).
- `src-8966f1fe1e2f3368`: sla-settings-page-BfZ9ANcZ.js — https://app.visitt.io/assets/sla-settings-page-BfZ9ANcZ.js (observed 2026-10-11).
- `src-896bbaccb240beef`: export-derived-evidence.json — urn:visitt-rea:artifact:sha256:429a52e80fb1f31e69738cf37c6607989576fab67801d5db4dce64061cae7b9f (observed 2026-10-12).
- `src-89d2e5eed84fce5f`: visit-properties-Dvi7Lc7Z.js — https://app.visitt.io/assets/visit-properties-Dvi7Lc7Z.js (observed 2026-10-11).
- `src-8a3e60d28c0899e5`: deep-pass--10026840c.resolved.c — urn:visitt-rea:artifact:sha256:b275d582a232e59e8908b06f094f01539c6826bde16aad5372d7a802d47dcfea (observed 2026-10-12).
- `src-8acaacd95ef23b78`: 10036fa80.json — urn:visitt-rea:artifact:sha256:8d8e114c26c8b8fe25818dfe543844cf36aeed0b200c98df144898ba8a0a8597 (observed 2026-10-12).
- `src-8b1b256c77e501e1`: assignment-edit-page-Ca4f1mQG.js — https://app.visitt.io/assets/assignment-edit-page-Ca4f1mQG.js (observed 2026-10-11).
- `src-8c920a69b64bdfa8`: Visitt — urn:visitt-rea:artifact:sha256:99a591a8ad7bfcf1c6547cbc6eda990ec2c939dfb565974934a766955c86f792 (observed 2026-10-12).
- `src-8d970706820efb57`: lazy__portal-app-BEeCKePb.js__Iu.js — urn:visitt-rea:artifact:sha256:aaa779729a66abfda00037a2254bbb588d0eabcaefe2fd7e698d9e557a40ca25 (observed 2026-10-11).
- `src-8da8875d799f74eb`: property-preferences-page-ll-dw_-y.js — https://app.visitt.io/assets/property-preferences-page-ll-dw_-y.js (observed 2026-10-11).
- `src-8dcb82b1655341aa`: 10001e920.json — urn:visitt-rea:artifact:sha256:a33676ffbe5cd98c160f933b2ae079577dbc20451e03841c825566e23181a973 (observed 2026-10-12).
- `src-8defd93840c499d7`: 10013e324.json — urn:visitt-rea:artifact:sha256:75f4deccd99a8bd0fc6c4db6efab3b380a677c5e1dcdce1cd420bb1789d7b454 (observed 2026-10-12).
- `src-8dfd01d557793346`: change-priority-select-CaVJyuzt.js — https://app.visitt.io/assets/change-priority-select-CaVJyuzt.js (observed 2026-10-11).
- `src-8e266c27042c5dc2`: open-visits-dyM_rwWP.js — https://app.visitt.io/assets/open-visits-dyM_rwWP.js (observed 2026-10-11).
- `src-8e49a12c05b64323`: 031-archiveVisitorWatchlistEntry.graphql — urn:visitt-rea:artifact:sha256:3ebbbd5c19277629dfc962900f3128dd24ff34edeae9a0f431eedd4e9560bb88 (observed 2026-10-11).
- `src-8f29c51287f65fe0`: use-buildings-B7jL0dxJ.js — https://app.visitt.io/assets/use-buildings-B7jL0dxJ.js (observed 2026-10-11).
- `src-904ef95a5bf0c1a5`: 021-amenityBookingToEdit.graphql — urn:visitt-rea:artifact:sha256:197f6673e1bef1dc1c9ac5bfbe3356a040d645cabf16faa02139b732ac8333e7 (observed 2026-10-11).
- `src-9290922bbd3fcbcd`: index-BrIEt02s.js — https://app.visitt.io/assets/index-BrIEt02s.js (observed 2026-10-11).
- `src-9291e5e91fbb98aa`: sso-seeds.json — urn:visitt-rea:artifact:sha256:84e67a53095c8041b4f613e557d2d8426a1b736f4ae01100c7f9775ae709c6d4 (observed 2026-10-12).
- `src-92b94f43921ab812`: editable-issue-due-date-DA_SIJhy.js — https://app.visitt.io/assets/editable-issue-due-date-DA_SIJhy.js (observed 2026-10-11).
- `src-9389c1357fdb41a4`: super-admin-companies-page-CQ_ANTTY.js — https://app.visitt.io/assets/super-admin-companies-page-CQ_ANTTY.js (observed 2026-10-11).
- `src-93b7bf18bea9b818`: 022-amenities.graphql — urn:visitt-rea:artifact:sha256:282e9a88900b470dbff1d0360ae65b49c5e66e1f55a56f2ffbb3258e2b550888 (observed 2026-10-11).
- `src-942971e07dbeda07`: 1000ebdcc.json — urn:visitt-rea:artifact:sha256:c77a4db6eca5b0686de1aad293561b1f4b2a947d44e5511990acbd8356424530 (observed 2026-10-12).
- `src-947182a1c78dcccb`: 011-requestsForPortal.graphql — urn:visitt-rea:artifact:sha256:6dbaf439a9a0cbc8c1e2b4118a2369c5b591d813bb384452ba4b08689b7b74aa (observed 2026-10-11).
- `src-9579656f2b5d8ab7`: 10013e0b8.json — urn:visitt-rea:artifact:sha256:91cff6e8724a64278f63e0f016c2c2f521045385d1b271f723b05f8494e7409f (observed 2026-10-12).
- `src-9589ce0dc8d3ccbf`: lazy__vui-form-phone-input-CRH0sSU4.js__O2.js — urn:visitt-rea:artifact:sha256:10e0593d4df959cd2810d5ad39de4b6f1da0e566a5d6812a00f55a432f1a31ff (observed 2026-10-11).
- `src-966c449cf1676f53`: 1000ee040.json — urn:visitt-rea:artifact:sha256:26d7de5f3614a7aa67b4b8e85de87adf0f7bce27b1a31e13d805713900892942 (observed 2026-10-12).
- `src-96aaa131ddf9bbe8`: 1001237cc.json — urn:visitt-rea:artifact:sha256:995a5282efe9b27ac377bae3ed7151e1caf5bb4278c4b207989da83f32cc8c95 (observed 2026-10-12).
- `src-972be53365fbe59f`: 00-index-sQew8XOr.js__hEe.js — urn:visitt-rea:artifact:sha256:5f797dec5ec4aba85d29987a4255c0f85f3cc03aef216ed177abc461e94a6909 (observed 2026-10-11).
- `src-97aeb988577e7690`: 043-updateMyProfilePicture.graphql — urn:visitt-rea:artifact:sha256:82576e751f945b4ea248c3d9c6b7a5682511de0455538659eb0f033914d94510 (observed 2026-10-11).
- `src-97c9b66f98921f00`: lazy__portal-app-BEeCKePb.js__Ho.js — urn:visitt-rea:artifact:sha256:1a09b770ff2e526ed497761fc0d4ac94f8775138d66d3dc8a2a35be85e41b4d8 (observed 2026-10-11).
- `src-984d4b2bf3051511`: insert-customer-form-Dv1K8gnP.js — https://app.visitt.io/assets/insert-customer-form-Dv1K8gnP.js (observed 2026-10-11).
- `src-988c0ae849bf2045`: deliveries-page-DlQT7cdP.js — https://app.visitt.io/assets/deliveries-page-DlQT7cdP.js (observed 2026-10-11).
- `src-99013f37017afa60`: export-buildings-button-DylI1rnw.js — https://app.visitt.io/assets/export-buildings-button-DylI1rnw.js (observed 2026-10-11).
- `src-993e45a5a32f992a`: search-page-Dj9uK7c9.js — https://app.visitt.io/assets/search-page-Dj9uK7c9.js (observed 2026-10-11).
- `src-9ad663b6127c893d`: company-features-settings-page-DsZooH2W.js — https://app.visitt.io/assets/company-features-settings-page-DsZooH2W.js (observed 2026-10-11).
- `src-9c82d0137b4d838f`: 1001ed2dc.json — urn:visitt-rea:artifact:sha256:2ce956720d403e5d7d3255daadefb718d676a94dfa5d641fd593dc82ac9c99aa (observed 2026-10-12).
- `src-9c8e84607eda7a2e`: company-fragments-DHoLa_pT.js — https://app.visitt.io/assets/company-fragments-DHoLa_pT.js (observed 2026-10-11).
- `src-9dea69836033ba22`: lazy__broadcast-link-page-BxgTQF5w.js — https://portal.visitt.io/assets/broadcast-link-page-BxgTQF5w.js (observed 2026-10-11).
- `src-9f5c64f9d3fb38b9`: 100130304.json — urn:visitt-rea:artifact:sha256:299defe348fd763a03af6f05994c15e6942b4b2d8967372fd0e270a1e50b54b0 (observed 2026-10-12).
- `src-9f80a5ba2820fce3`: 1001ecb64.json — urn:visitt-rea:artifact:sha256:37cd15e24775e8499fcac162a279b9e3ec51675e9446b8a4b2e205528333b317 (observed 2026-10-12).
- `src-a129ec9c31225b00`: floors-multiple-select-filter-DpTKYWH1.js — https://app.visitt.io/assets/floors-multiple-select-filter-DpTKYWH1.js (observed 2026-10-11).
- `src-a27721b610466d69`: 100131390.json — urn:visitt-rea:artifact:sha256:4498ea5d616ec046905879560fa46d9bfac768568d64fd122e7794ec571838b2 (observed 2026-10-12).
- `src-a2b7726580a239ce`: coi-requirements-fragments-zuGRt0H_.js — https://app.visitt.io/assets/coi-requirements-fragments-zuGRt0H_.js (observed 2026-10-11).
- `src-a3031028d6373b82`: amenity-form-4wZKM-4I.js — https://app.visitt.io/assets/amenity-form-4wZKM-4I.js (observed 2026-10-11).
- `src-a38e918ea0669deb`: qrcode-page-DOxo7VVz.js — https://app.visitt.io/assets/qrcode-page-DOxo7VVz.js (observed 2026-10-11).
- `src-a39d286af0a23829`: lazy__portal-app-BEeCKePb.js__kf.js — urn:visitt-rea:artifact:sha256:d3bb83e78a3ff2148cedaca2097cc480c0558c95308513fe00e958cc14eb15f7 (observed 2026-10-11).
- `src-a49093fdb9a1b4d0`: lazy__portal-app-BEeCKePb.js__cl.js — urn:visitt-rea:artifact:sha256:3695569ef726a52e454658ac51c32760d13107b067327dc581a15a226754a1dc (observed 2026-10-11).
- `src-a4c077ea7b2d5199`: lazy__portal-app-BEeCKePb.js__Lh.js — urn:visitt-rea:artifact:sha256:12f8238b8ca71edd3844ec2e59a69f46f226ba51c67afeb4d9370166d56d0418 (observed 2026-10-11).
- `src-a4ceacedb9ca0465`: lazy__vui-form-phone-input-CRH0sSU4.js — https://portal.visitt.io/assets/vui-form-phone-input-CRH0sSU4.js (observed 2026-10-11).
- `src-a4f370134b9484d8`: 1001ec9c4.json — urn:visitt-rea:artifact:sha256:12c278d38cdc8b0af9a50373d59576f8bf9e48b1f15638215a0298c478c8f936 (observed 2026-10-12).
- `src-a500a87b2ed8a0c8`: billable-item-details-modal-06PuD2_e.js — https://app.visitt.io/assets/billable-item-details-modal-06PuD2_e.js (observed 2026-10-11).
- `src-a50563f2d2097dea`: visitor-watchlist-matches-BhNSlsXC.js — https://app.visitt.io/assets/visitor-watchlist-matches-BhNSlsXC.js (observed 2026-10-11).
- `src-a551f9fcfeaf3481`: visits-s5I48Y2B.js — https://app.visitt.io/assets/visits-s5I48Y2B.js (observed 2026-10-11).
- `src-a563f7f4e142b508`: core-shell-findings.json — urn:visitt-rea:artifact:sha256:86b1320c30adcc75dbd145110ce158e26e2b9c208328e11bc222d6dba95a72ff (observed 2026-10-12).
- `src-a578c1e163afeddf`: active-users-page-DFj5vYtu.js — https://app.visitt.io/assets/active-users-page-DFj5vYtu.js (observed 2026-10-11).
- `src-a5a2f6f1a999f980`: change-password-page-jOMeTGwF.js — https://app.visitt.io/assets/change-password-page-jOMeTGwF.js (observed 2026-10-11).
- `src-a5d0513d75b06a06`: lazy__vui-form-phone-input-CRH0sSU4.js__ts.js — urn:visitt-rea:artifact:sha256:6464975751c9ff4f201703b86af324b8d22d355984568f8860fb997e5143e507 (observed 2026-10-11).
- `src-a6142ecf3ce71e96`: reset-customer-companies-to-demo-button-C0BQMfND.js — https://app.visitt.io/assets/reset-customer-companies-to-demo-button-C0BQMfND.js (observed 2026-10-11).
- `src-a6331dd6536e4d40`: native-barcode-scanner-navbar-button-D1Qdjc5J.js — https://app.visitt.io/assets/native-barcode-scanner-navbar-button-D1Qdjc5J.js (observed 2026-10-11).
- `src-a685455d448db86c`: lazy__vui-form-phone-input-CRH0sSU4.js__I2.js — urn:visitt-rea:artifact:sha256:d5f03d5cc648b6e5f2f97a0382fe092dce96c877a2fdf0fec9024b774c855a26 (observed 2026-10-11).
- `src-a69f285c2f6c762f`: visitt-plus-native.json — urn:visitt-rea:artifact:sha256:f7a3b8304a0e61fbbd0fd9d93f5b25f44b1d5ddd311d1787efc2fb1688cf8552 (observed 2026-10-12).
- `src-a6cc2fb4faf754e3`: app.manifest — urn:visitt-rea:artifact:sha256:a2cfcfaa4cfe0d035cb84466b422f625ea16a40b6d76a33e3b3d0a9f77806639 (observed 2026-10-11).
- `src-a7a3d97b16b94cb6`: visitt-plus-React-native.json — urn:visitt-rea:artifact:sha256:22b7266b3f34e59a2e2d4e0fd9df071c118704bd8046ae6806bd06b6eba7c77b (observed 2026-10-11).
- `src-a8902965307c3b77`: coi-settings-graphql-C4Amt0IY.js — https://app.visitt.io/assets/coi-settings-graphql-C4Amt0IY.js (observed 2026-10-11).
- `src-a93d53c4ac8be17f`: property-group-dialog-CIpIL0OV.js — https://app.visitt.io/assets/property-group-dialog-CIpIL0OV.js (observed 2026-10-11).
- `src-aa825552c8c68c73`: 015-appLinks.graphql — urn:visitt-rea:artifact:sha256:9ca706db5211ddd06e4acd6f9d892abec62e9c8ac6da667c3bff8e01990dae28 (observed 2026-10-11).
- `src-aa97d3028228c11e`: lazy__broadcast-detail-content-DyF-hol_.js__qs.js — urn:visitt-rea:artifact:sha256:3220849736cf3037f5b100329d5edd12715be5da29a0f416f21f6da84e76a2fa (observed 2026-10-11).
- `src-aacfee09acbfd85e`: 018-updateAmenityBooking.graphql — urn:visitt-rea:artifact:sha256:d1ce57832cb5342b07ec46840494d5df54c35f8b34b53461b6e37c124daf0041 (observed 2026-10-11).
- `src-abf858641f21f26c`: lazy__portal-app-BEeCKePb.js__Fh.js — urn:visitt-rea:artifact:sha256:000c44acab9d0505ded3bb4c95f94ff73e1842f367b8da93d3a4ee00a9b660f2 (observed 2026-10-11).
- `src-ac1173f50456f7d6`: 10013077c.json — urn:visitt-rea:artifact:sha256:57032006dce4276f278cead2ef74bc5e24f73dc201f1e5108e5ab27a9a90d86f (observed 2026-10-12).
- `src-ac18bcd060c7f037`: yardi-integration-info-display-DHOZrqat.js — https://app.visitt.io/assets/yardi-integration-info-display-DHOZrqat.js (observed 2026-10-11).
- `src-ac9b90f70fcbefbe`: 045-addContacts.graphql — urn:visitt-rea:artifact:sha256:cda00b75a1b02533010c5431225f804e9548a5fd2c01874ef0ab8d59d891f80f (observed 2026-10-11).
- `src-ad85f4695ef9a398`: 00-index-sQew8XOr.js — https://portal.visitt.io/assets/index-sQew8XOr.js (observed 2026-10-11).
- `src-ad99434c5c926e1e`: ReactNativeDependencies.framework — urn:visitt-rea:artifact:ref:626c7e5653385b9b04eab993 (observed 2026-10-11).
- `src-ae13f5fe02592837`: portal-settings-common-spaces-CKlWcUBe.js — https://app.visitt.io/assets/portal-settings-common-spaces-CKlWcUBe.js (observed 2026-10-11).
- `src-aee6a1cb1ba6dc8e`: billing-page-BDpigqhH.js — https://app.visitt.io/assets/billing-page-BDpigqhH.js (observed 2026-10-11).
- `src-af21cb64039fd121`: 017-bookAmenity.graphql — urn:visitt-rea:artifact:sha256:671aa2eb0030f5e3d802f32c42734f0c1a7147bfe37cc0d3f5ac20e069c189f7 (observed 2026-10-11).
- `src-b0943f31d1114714`: buildings-page-IIG5kVlo.js — https://app.visitt.io/assets/buildings-page-IIG5kVlo.js (observed 2026-10-11).
- `src-b12bfb0dd00555c0`: automations-dZqNkSq1.js — https://app.visitt.io/assets/automations-dZqNkSq1.js (observed 2026-10-11).
- `src-b133462ba82f2179`: short-links-page-BW2kdn9g.js — https://app.visitt.io/assets/short-links-page-BW2kdn9g.js (observed 2026-10-11).
- `src-b159f4c9791b434b`: use-work-order-recurrence-B6pWZLaG.js — https://app.visitt.io/assets/use-work-order-recurrence-B6pWZLaG.js (observed 2026-10-11).
- `src-b1eb8ffb577d7bce`: export-categories-button-D7GdaL-W.js — https://app.visitt.io/assets/export-categories-button-D7GdaL-W.js (observed 2026-10-11).
- `src-b340c09b55581e2d`: site-page-BKKEMpjh.js — https://app.visitt.io/assets/site-page-BKKEMpjh.js (observed 2026-10-11).
- `src-b41d061e4e79e90e`: notifications-page-nwepBlRM.js — https://app.visitt.io/assets/notifications-page-nwepBlRM.js (observed 2026-10-11).
- `src-b56e47705926b0c8`: 003-companyPortal.graphql — urn:visitt-rea:artifact:sha256:4bcba9fa2b8758a379e0e5de8f6bd581e18c145ed6d4a316c01b89bcdbb352d8 (observed 2026-10-11).
- `src-b6c04064be0bdafb`: lazy__vui-form-phone-input-CRH0sSU4.js__X2.js — urn:visitt-rea:artifact:sha256:697c85a7439c78a93f5f6bf3ad30f4312893a1fc4e809f3db8fa869478d67084 (observed 2026-10-11).
- `src-b72ec5b536befb13`: assignments-page-BjoZDwxW.js — https://app.visitt.io/assets/assignments-page-BjoZDwxW.js (observed 2026-10-11).
- `src-b77de1f1408d84e2`: lazy__vui-form-phone-input-CRH0sSU4.js__t8.js — urn:visitt-rea:artifact:sha256:f7db661610747b616156d28406a62dc08bd270ed3c0db37b1613500b06c82ccd (observed 2026-10-11).
- `src-b801880a5b62b389`: use-visits-filters-pill-config-B0LJ-l_k.js — https://app.visitt.io/assets/use-visits-filters-pill-config-B0LJ-l_k.js (observed 2026-10-11).
- `src-b81707b15c0e79eb`: use-company-accounting-settings-Dy2YTtid.js — https://app.visitt.io/assets/use-company-accounting-settings-Dy2YTtid.js (observed 2026-10-11).
- `src-b85360c88db64d5a`: use-charge-codes-Dvo7K-X-.js — https://app.visitt.io/assets/use-charge-codes-Dvo7K-X-.js (observed 2026-10-11).
- `src-b90229b728fa6ee1`: lazy__portal-app-BEeCKePb.js__qp.js — urn:visitt-rea:artifact:sha256:1aa2b416d640a6991098a912104cd694d67bea47cb6521abb5620d7523b8c43f (observed 2026-10-11).
- `src-b9178511a65b9a26`: list-issues-page-BznTWGxA.js — https://app.visitt.io/assets/list-issues-page-BznTWGxA.js (observed 2026-10-11).
- `src-b9580407a35c9a95`: property-groups-page-B1ojF9jR.js — https://app.visitt.io/assets/property-groups-page-B1ojF9jR.js (observed 2026-10-11).
- `src-b95d330417064805`: users-tab-FBy3gq-Q.js — https://app.visitt.io/assets/users-tab-FBy3gq-Q.js (observed 2026-10-11).
- `src-b9a9adfb97103493`: issue-template-form-DanvQ54n.js — https://app.visitt.io/assets/issue-template-form-DanvQ54n.js (observed 2026-10-11).
- `src-b9ce040a4523df7a`: amenity-bookings-DmGJGctS.js — https://app.visitt.io/assets/amenity-bookings-DmGJGctS.js (observed 2026-10-11).
- `src-bb9067effc377e36`: list-visits-page-DfysyJHg.js — https://app.visitt.io/assets/list-visits-page-DfysyJHg.js (observed 2026-10-11).
- `src-bbb8c7c4478f6d98`: assignment-create-page-7SD8IGZC.js — https://app.visitt.io/assets/assignment-create-page-7SD8IGZC.js (observed 2026-10-11).
- `src-bc3db91a38845f21`: use-sync-error-charges-count-COYH3_Xd.js — https://app.visitt.io/assets/use-sync-error-charges-count-COYH3_Xd.js (observed 2026-10-11).
- `src-bc5d6bb3cfaa7727`: bytecode.hasm — urn:visitt-rea:artifact:sha256:46ed0ea04510f69a6e819220ccc10fa74164eaf44c728bf3348f841c102aa10e (observed 2026-10-12).
- `src-bcf8b13b6ae1d3ed`: visitt-hermes-native.json — urn:visitt-rea:artifact:sha256:251c13cc82e3a0e851d3618ee4e2e73ec676a59dd9fe3636b9aac62856def7e8 (observed 2026-10-11).
- `src-be40696767e2ba43`: edit-amenity-booking-page-BPGKMYBv.js — https://app.visitt.io/assets/edit-amenity-booking-page-BPGKMYBv.js (observed 2026-10-11).
- `src-bfcebef0e137ace6`: issues-print-builder-BLEJOff5.js — https://app.visitt.io/assets/issues-print-builder-BLEJOff5.js (observed 2026-10-11).
- `src-bffc9126451c8fc4`: 060-setTenantApproval.graphql — urn:visitt-rea:artifact:sha256:20cf4159f1006f3401e773be15ede41cefbbcd912a0cf88fb89061006e5ea9cd (observed 2026-10-11).
- `src-c08f17490f013738`: 041-updateNotificationSettings.graphql — urn:visitt-rea:artifact:sha256:d47f306e205ea224745d99a542cdda09201545cf8417c4b11cb7f76c51a39657 (observed 2026-10-11).
- `src-c0d92b57eb0a666c`: broadcasts-page-qy0WeQIN.js — https://app.visitt.io/assets/broadcasts-page-qy0WeQIN.js (observed 2026-10-11).
- `src-c1a2424be23b014f`: 023-paginatedVisitorWatchlist.graphql — urn:visitt-rea:artifact:sha256:3c0ed4f669c7d70f0c443003279ec46536751ec22452164120e4e7a66a3b2ce2 (observed 2026-10-11).
- `src-c21f92cd8f8cba50`: 1001057a8.json — urn:visitt-rea:artifact:sha256:e58c1359b4bd2d4eb1158cb6e7b62f547c2045f50894a5660f2b316884702714 (observed 2026-10-12).
- `src-c31c4c6d00c29dcf`: issue-page-auLPMqTp.js — https://app.visitt.io/assets/issue-page-auLPMqTp.js (observed 2026-10-11).
- `src-c429eca711bc0a1e`: 034-pickupDeliveryByContact.graphql — urn:visitt-rea:artifact:sha256:c2763ff929fa878621b0f6b1679624cba99b931189e4db86ea31f2309c4e9951 (observed 2026-10-11).
- `src-c48ca223867ebdfb`: React.framework — urn:visitt-rea:artifact:ref:676f9a838a53888fe61c1e06 (observed 2026-10-11).
- `src-c575ecb704cc6f94`: automations-consts-Ky9MdOzb.js — https://app.visitt.io/assets/automations-consts-Ky9MdOzb.js (observed 2026-10-11).
- `src-c5dfacb6dfee3fe6`: visitt-plus-assetutil.json — urn:visitt-rea:artifact:sha256:99d38df09e9aaadc02ceffc312fdf47386f27c5e166d42c29ffa6a940d6d552b (observed 2026-10-11).
- `src-c62b516f6babb820`: use-assignable-users-j6B-4g_p.js — https://app.visitt.io/assets/use-assignable-users-j6B-4g_p.js (observed 2026-10-11).
- `src-c6c8bdbee350bf0c`: 008-broadcast.graphql — urn:visitt-rea:artifact:sha256:491a54558572ee1697c9f516e76a023e95c557c656b54f417f7534a863476beb (observed 2026-10-11).
- `src-c6d60893ee3e248c`: account-preferences-page-DK_yN-2-.js — https://app.visitt.io/assets/account-preferences-page-DK_yN-2-.js (observed 2026-10-11).
- `src-c745468b733faa59`: 100267870.json — urn:visitt-rea:artifact:sha256:dbb9ba0ee95617254fc69ebab8309ed9c017d71ef81b98eb1a6eb6a11a221032 (observed 2026-10-12).
- `src-c85dceb71bb6920c`: 100127e74.json — urn:visitt-rea:artifact:sha256:893c2a0048dda97ca36de7036ee95b24ed7995281c508bc1c70eddc8f4e0886e (observed 2026-10-12).
- `src-c9006d7519cb7ef0`: issues-filters-bar-Dz37YjWj.js — https://app.visitt.io/assets/issues-filters-bar-Dz37YjWj.js (observed 2026-10-11).
- `src-c9220dc544141e5d`: update-primary-properties-dialog-smxdLeIF.js — https://app.visitt.io/assets/update-primary-properties-dialog-smxdLeIF.js (observed 2026-10-11).
- `src-c95e0a6bc2a7a184`: 004-updateMe.graphql — urn:visitt-rea:artifact:sha256:867308def61ffc88258591562ea59222158e319a0e5aef7f36108e26705bbc25 (observed 2026-10-11).
- `src-c998e77e3b82252f`: lazy__portal-app-BEeCKePb.js__am.js — urn:visitt-rea:artifact:sha256:02f22c71dba0ada2c33e422f3b874c890deb39e921aaca35ed46c01edd61575e (observed 2026-10-11).
- `src-c99dd12dad740436`: integration-logs-page-Bjm9HHAP.js — https://app.visitt.io/assets/integration-logs-page-Bjm9HHAP.js (observed 2026-10-11).
- `src-c99fd933809b0c5e`: template-edit-page-BFRX-UTV.js — https://app.visitt.io/assets/template-edit-page-BFRX-UTV.js (observed 2026-10-11).
- `src-c9f17af0dc9b2bdc`: site-select-combobox-Cf86jMwl.js — https://app.visitt.io/assets/site-select-combobox-Cf86jMwl.js (observed 2026-10-11).
- `src-ca8ad5e8ab8f03c2`: 001-me.graphql — urn:visitt-rea:artifact:sha256:d794ef2bc3fa382caac98761649d29b8ea0b02570665d732be2f5e852159ba18 (observed 2026-10-11).
- `src-caf9def2a900f05c`: issue-helpers-DRaU537l.js — https://app.visitt.io/assets/issue-helpers-DRaU537l.js (observed 2026-10-11).
- `src-cbd1a15853fb3fa4`: 069-generateSmartWorkOrderCategory.graphql — urn:visitt-rea:artifact:sha256:8e6377b6fdcb742b2fccc1d1470fbb3f087c12a7642228318a54e13aba1640a3 (observed 2026-10-11).
- `src-cd9b1f3e2c549421`: user-sort-helpers-DsAvuyGe.js — https://app.visitt.io/assets/user-sort-helpers-DsAvuyGe.js (observed 2026-10-11).
- `src-cdceffdf1797f604`: amenities-page-70Er2K6s.js — https://app.visitt.io/assets/amenities-page-70Er2K6s.js (observed 2026-10-11).
- `src-ce5191eea1472d9a`: 050-inviteContact.graphql — urn:visitt-rea:artifact:sha256:f0f32638f4d80404e7c6cf51483aa1edcf189eb486476c837d0e6daabb52634f (observed 2026-10-11).
- `src-cea6fe83d054505b`: lazy__portal-app-BEeCKePb.js__Dp.js — urn:visitt-rea:artifact:sha256:338e809c6644e283c95a289eb9ba8c578874f08f5f4c7ab4e7e093ab66696edd (observed 2026-10-11).
- `src-cf0d26aaabbbe554`: 005-portalSettings.graphql — urn:visitt-rea:artifact:sha256:fa9e2de970484eb6348ad59c712412a47ea14a7983bf70623b8c25baf4943085 (observed 2026-10-11).
- `src-cf3b2e2c25d9fa49`: 100105a38.json — urn:visitt-rea:artifact:sha256:a560ebe0d9c64d310998ffcc74f28691ee0069627fab7b2c9ea98934abcdc7dc (observed 2026-10-12).
- `src-cfb290d117f73bfa`: use-holidays-BBaqfaae.js — https://app.visitt.io/assets/use-holidays-BBaqfaae.js (observed 2026-10-11).
- `src-d163287a2d6aef20`: visit-page-Bk7kUAVe.js — https://app.visitt.io/assets/visit-page-Bk7kUAVe.js (observed 2026-10-11).
- `src-d1caa6d2015b0e7e`: use-allow-charges-sync-to-integration-KMuLAlbK.js — https://app.visitt.io/assets/use-allow-charges-sync-to-integration-KMuLAlbK.js (observed 2026-10-11).
- `src-d47ae618f2dae34a`: 024-visitor.graphql — urn:visitt-rea:artifact:sha256:dd0618b8f2385739605ed044da5e4b1c5ed04cbc8bd232b7d7341487aae28287 (observed 2026-10-11).
- `src-d48513950ade1b75`: customer-sso-settings-BFiOQWfx.js — https://app.visitt.io/assets/customer-sso-settings-BFiOQWfx.js (observed 2026-10-11).
- `src-d4d0e6981730ecdc`: use-charges-ChpdAp9T.js — https://app.visitt.io/assets/use-charges-ChpdAp9T.js (observed 2026-10-11).
- `src-d4f9b440184b32fc`: 100132e1c.json — urn:visitt-rea:artifact:sha256:b805899f4e3abe2d1eb793debdcdcddd515212d3c048369d3ef494fd02687d75 (observed 2026-10-12).
- `src-d68d6d859082bc8e`: broadcast-template-form-t-OZm7QA.js — https://app.visitt.io/assets/broadcast-template-form-t-OZm7QA.js (observed 2026-10-11).
- `src-d69396d4f6da3110`: 029-visitorWatchlistNameVariants.graphql — urn:visitt-rea:artifact:sha256:578168234163319ad59802a53bd90dc594826aa0d778f11d18c5fb907d3e295c (observed 2026-10-11).
- `src-d737b5fa5e8ec8c4`: lazy__portal-app-BEeCKePb.js__Xh.js — urn:visitt-rea:artifact:sha256:bcc0b1b8475657cc2883a7840a0db3a06f9574706ce472503a6bfc10166f3746 (observed 2026-10-11).
- `src-d7c7eda4d1bb4018`: role-page-CbqIAHMc.js — https://app.visitt.io/assets/role-page-CbqIAHMc.js (observed 2026-10-11).
- `src-d7fbdfcfe72cabf9`: lazy__portal-app-BEeCKePb.js__zh.js — urn:visitt-rea:artifact:sha256:eea498c1affc45c193cd17d664674ef875fe8db0896d2705fe0760979bcfd4d4 (observed 2026-10-11).
- `src-d91417166c3ddd7f`: app.config — urn:visitt-rea:artifact:sha256:8cf0e4a19302b2acea16adebfdb941f82a704bb8cedddcd03772ee8b8f607299 (observed 2026-10-11).
- `src-da0be3de63c95f6e`: mobile-property-office-hours-D9pS9XS4.js — https://app.visitt.io/assets/mobile-property-office-hours-D9pS9XS4.js (observed 2026-10-11).
- `src-da893e8012145834`: lazy__vui-form-phone-input-CRH0sSU4.js__V7.js — urn:visitt-rea:artifact:sha256:5760eb1e4ec1785ca283a25ba131b860b528fbbe810b5fc2d00b92e37ba40018 (observed 2026-10-11).
- `src-db8b14b231c5a549`: lazy__portal-app-BEeCKePb.js__Nm.js — urn:visitt-rea:artifact:sha256:138cd65b7e7bd23e8efcae0739e9b385fe1bfd12541db5b1d5c004a0a916e83c (observed 2026-10-11).
- `src-dd45673e86447250`: lazy__login-flow-BRinyHCP.js__lt.js — urn:visitt-rea:artifact:sha256:ce19ecbd9f13c6021ab2c7285f14c9e18ad27a608d7d118f4a764b549910f822 (observed 2026-10-11).
- `src-dd5b9e862fa8c2a6`: visitt-React-native.json — urn:visitt-rea:artifact:sha256:07e70e7cca52e69d0f963c865fdd6c7a1b4039e4b2e55f6d2aa252ac1b48eba8 (observed 2026-10-11).
- `src-de2c8b09c1c6d91d`: use-status-options-C73kAjIW.js — https://app.visitt.io/assets/use-status-options-C73kAjIW.js (observed 2026-10-11).
- `src-de346b010a12e22a`: company-integrations-page-Bq6sOnUv.js — https://app.visitt.io/assets/company-integrations-page-Bq6sOnUv.js (observed 2026-10-11).
- `src-de7872cd974dd5dc`: amenity-booking-form-DbVh3glz.js — https://app.visitt.io/assets/amenity-booking-form-DbVh3glz.js (observed 2026-10-11).
- `src-debfcd7925c00f0f`: visitors-page-wmB_dUWA.js — https://app.visitt.io/assets/visitors-page-wmB_dUWA.js (observed 2026-10-11).
- `src-df6872765e3f079f`: account-vendor-page-C6jGP71d.js — https://app.visitt.io/assets/account-vendor-page-C6jGP71d.js (observed 2026-10-11).
- `src-df8c97876b7be85b`: export-seeds.json — urn:visitt-rea:artifact:sha256:c2bc6c13d24d8e132cd999463e4e7907ce8bb42a19b67ff4b533ee06367dfc38 (observed 2026-10-12).
- `src-e01687210efb4e9b`: account-tenant-app-settings-page-DHWtJ92y.js — https://app.visitt.io/assets/account-tenant-app-settings-page-DHWtJ92y.js (observed 2026-10-11).
- `src-e032b4d035d5206f`: tenants-page-C7lVdlEF.js — https://app.visitt.io/assets/tenants-page-C7lVdlEF.js (observed 2026-10-11).
- `src-e07994b89a7672a5`: status-DkUh6kzz.js — https://app.visitt.io/assets/status-DkUh6kzz.js (observed 2026-10-11).
- `src-e0dd83b265ec06fc`: lazy__portal-app-BEeCKePb.js__bp.js — urn:visitt-rea:artifact:sha256:c4a1c92fa7137012da6401b3fcf31714a516b36e9a98e95e10fc4ce0bc7bb237 (observed 2026-10-11).
- `src-e20958b58f9b844b`: visitor-notification-settings-cards-DGg_k9Bz.js — https://app.visitt.io/assets/visitor-notification-settings-cards-DGg_k9Bz.js (observed 2026-10-11).
- `src-e25b0e4e7131a3d4`: documents-CcNW8Ghl.js — https://app.visitt.io/assets/documents-CcNW8Ghl.js (observed 2026-10-11).
- `src-e26de85c88f381f5`: 00-index-sQew8XOr.js__nTe.js — urn:visitt-rea:artifact:sha256:7df221330a1c5cd6ce944727cac9efa311bf736409eb291fd3af0e18fae9f7f5 (observed 2026-10-11).
- `src-e2a813ff99a69e07`: content-page-form-page-Ny-TuSoR.js — https://app.visitt.io/assets/content-page-form-page-Ny-TuSoR.js (observed 2026-10-11).
- `src-e32a33e0352b84d0`: bytecode.hasm — urn:visitt-rea:artifact:sha256:4f3cf55cb67e7574206b0a7d9411a87080a22ceccad7083123d084e047c02aa4 (observed 2026-10-11).
- `src-e407ae4b6ff4d14b`: completed-issues-durations-page-WD06D_8I.js — https://app.visitt.io/assets/completed-issues-durations-page-WD06D_8I.js (observed 2026-10-11).
- `src-e51ade2774abcf3c`: lazy__portal-app-BEeCKePb.js__Sm.js — urn:visitt-rea:artifact:sha256:8af0688dcffd311bc1b8e9cf9187bd08e69cc3d723aa086dd5f6bba32592f831 (observed 2026-10-11).
- `src-e594688525d15411`: Public Visitt source — https://help.visitt.io/en/articles/9246330-managing-users-in-visitt (observed 2026-10-11).
- `src-e5abc649a0a0c7b2`: edit-visitor-watchlist-entry-page-BUaYWrVa.js — https://app.visitt.io/assets/edit-visitor-watchlist-entry-page-BUaYWrVa.js (observed 2026-10-11).
- `src-e7e3ec01c981ced1`: document-item-validation-schema-BTPqZfL0.js — https://app.visitt.io/assets/document-item-validation-schema-BTPqZfL0.js (observed 2026-10-11).
- `src-e83a30942c6a7dcd`: content-page-Cxhtv8rn.js — https://app.visitt.io/assets/content-page-Cxhtv8rn.js (observed 2026-10-11).
- `src-e851980072989ed5`: shared-filter-definitions-DCqcnrqN.js — https://app.visitt.io/assets/shared-filter-definitions-DCqcnrqN.js (observed 2026-10-11).
- `src-e8cfaa71f6e0a4b0`: push-token-callback.json — urn:visitt-rea:artifact:sha256:365571ef1b896f3b4e4195a62faabbbf7e0013a5f78d09419569533583abf21a (observed 2026-10-12).
- `src-e8de3f8559ae6185`: create-work-order-form-modal-or-mobile-page-C0InEbRE.js — https://app.visitt.io/assets/create-work-order-form-modal-or-mobile-page-C0InEbRE.js (observed 2026-10-11).
- `src-e92562c359d84490`: view-edit-page-CPquKs7w.js — https://app.visitt.io/assets/view-edit-page-CPquKs7w.js (observed 2026-10-11).
- `src-eb000e928bbaa011`: issue-fragments-DSgXFX0Q.js — https://app.visitt.io/assets/issue-fragments-DSgXFX0Q.js (observed 2026-10-11).
- `src-ebb1b735497d0df4`: 1001a8b44.json — urn:visitt-rea:artifact:sha256:fec81c77dc1d344064399a8e692fbdae1754d20c5d349d4f94cfb2c84c980ddf (observed 2026-10-12).
- `src-ec7a433c369a5fb0`: lazy__portal-app-BEeCKePb.js__zo.js — urn:visitt-rea:artifact:sha256:129397f9190be29e6db4216128ac26192d51b806f14b22fc1f73c59b1be4f212 (observed 2026-10-11).
- `src-ed3f362c0b6440e4`: vendor-page-CMdDnvpe.js — https://app.visitt.io/assets/vendor-page-CMdDnvpe.js (observed 2026-10-11).
- `src-ed59387ac2d8471c`: views-page-BHc5ERdN.js — https://app.visitt.io/assets/views-page-BHc5ERdN.js (observed 2026-10-11).
- `src-ed6e92c9ef71b3cc`: issues-search-result-xSU4oU6C.js — https://app.visitt.io/assets/issues-search-result-xSU4oU6C.js (observed 2026-10-11).
- `src-ee35c0b453a3d1d1`: lazy__vui-form-phone-input-CRH0sSU4.js__os.js — urn:visitt-rea:artifact:sha256:7c313ebaf93c87033975c6377a45da14e286a1402fc623f22fda50835b7a1a8a (observed 2026-10-11).
- `src-f0a4e7424ab1bab6`: 100131abc.json — urn:visitt-rea:artifact:sha256:ee9bc82c5cf17217663568288db96472bf01b897fa314193dcf4f5ba7879a3a1 (observed 2026-10-12).
- `src-f1501569cbd63180`: script-setup.json — urn:visitt-rea:artifact:sha256:7cc0321aeed3d0d59b3c353aeb77a788110ef2c4c7f47b3668be224db1d89b91 (observed 2026-10-12).
- `src-f240cd5c5358796a`: push-token-callback.json — urn:visitt-rea:artifact:sha256:4aa289077301b76abe3a2af57591e0d121da76e0befa64ec731baecbe4628191 (observed 2026-10-12).
- `src-f2dc1166259a336a`: mobile-calendar-page-CZKHTFQ3.js — https://app.visitt.io/assets/mobile-calendar-page-CZKHTFQ3.js (observed 2026-10-11).
- `src-f32e6620da42321a`: vendor-profile-tabs-Bntedw42.js — https://app.visitt.io/assets/vendor-profile-tabs-Bntedw42.js (observed 2026-10-11).
- `src-f3a05e3022960a50`: 00-index-sQew8XOr.js__xEe.js — urn:visitt-rea:artifact:sha256:9c13fb884832f78b7f6081bf4b677419ce67d92f53cffb210f423cc3729e3763 (observed 2026-10-11).
- `src-f3f29704586c63dc`: lazy__portal-app-BEeCKePb.js__df.js — urn:visitt-rea:artifact:sha256:5e97df1db10b92ead9ba4f9524135c3fb40fd91a53db383d1cfd07b7e307c39d (observed 2026-10-11).
- `src-f4d31a2a7e3aaf44`: Expo.plist — urn:visitt-rea:artifact:sha256:b105c74d3d277a9e968bb0339b21bc7ab892668352f03aca950a93d5fc02e1e5 (observed 2026-10-11).
- `src-f4e46de9dac55d28`: Public Visitt source — https://app.visitt.io/login (observed 2026-10-11).
- `src-f4ff396562d24eb3`: PrivacyInfo.xcprivacy — urn:visitt-rea:artifact:sha256:d224f4076f4e3214db897627c1ea329eefaae889bc82d6b83ff79ebaab88f335 (observed 2026-10-11).
- `src-f52661a6a7e08eee`: lazy__portal-app-BEeCKePb.js — https://portal.visitt.io/assets/portal-app-BEeCKePb.js (observed 2026-10-11).
- `src-f5bdd1fc32981162`: editable-document-tags-Brxmsumg.js — https://app.visitt.io/assets/editable-document-tags-Brxmsumg.js (observed 2026-10-11).
- `src-f68de7445a1e6b3a`: view-page-DFncTqI6.js — https://app.visitt.io/assets/view-page-DFncTqI6.js (observed 2026-10-11).
- `src-f6d5710ab67c5321`: lazy__portal-app-BEeCKePb.js__Hh.js — urn:visitt-rea:artifact:sha256:808d9e62622809cbeb39143d4b9b87c823605e090e1f9ba58a3a372be32fe7a5 (observed 2026-10-11).
- `src-f6fd1ee257f52833`: roles-page-BBH32CI1.js — https://app.visitt.io/assets/roles-page-BBH32CI1.js (observed 2026-10-11).
- `src-f7d4efe629339b87`: message-handler.json — urn:visitt-rea:artifact:sha256:41b37ba65a77cbb86ace3fc5f375562ddbb83b6f8d81fe729478ca3943dec5aa (observed 2026-10-12).
- `src-f84bd571be884758`: views-fragment-DqV-uTZY.js — https://app.visitt.io/assets/views-fragment-DqV-uTZY.js (observed 2026-10-11).
- `src-f931c42ca55fba6e`: categories-page-DCApWLaf.js — https://app.visitt.io/assets/categories-page-DCApWLaf.js (observed 2026-10-11).
- `src-fa6bd8b520815531`: 1000ee3b0.json — urn:visitt-rea:artifact:sha256:d98a5d777380a3b37b0b4d8fdab878202f06d63bb598d2a42972b25db5ba0a68 (observed 2026-10-12).
- `src-fc59a7e19f5ac2c7`: lazy__portal-app-BEeCKePb.js__Lf.js — urn:visitt-rea:artifact:sha256:636856ef40a1aee4e98dd8466b3d7226f8a45a684d410c017658a8a1f918dee2 (observed 2026-10-11).
- `src-fd38979b24d75636`: lazy__portal-app-BEeCKePb.js__Gm.js — urn:visitt-rea:artifact:sha256:5d2efecf23ce67de2b9121b99776ea77ba0046f7b033bc1c89b6c45f674a09d1 (observed 2026-10-11).
- `src-fe12974b1d3812f7`: vendors-page-C85Xz2Dh.js — https://app.visitt.io/assets/vendors-page-C85Xz2Dh.js (observed 2026-10-11).
- `src-fe60090e20fa98fc`: 035-broadcasts.graphql — urn:visitt-rea:artifact:sha256:ac741d2f78c59c11b654d98f78d5c855d1a1e1f321d71761243e979256d1034e (observed 2026-10-11).
- `src-feace775c3111602`: terms-of-use-page-DKvL2DNw.js — https://app.visitt.io/assets/terms-of-use-page-DKvL2DNw.js (observed 2026-10-11).
- `src-fedbeb27909d34f3`: lazy__portal-app-BEeCKePb.js__Yp.js — urn:visitt-rea:artifact:sha256:3eaa1bc8b02dd692fcfee830d4c186bbce65758758a67493089433f4febba855 (observed 2026-10-11).
- `src-ffb6ebbf6d15a1a5`: vendors-manage-permission-guard-DKkCt7b3.js — https://app.visitt.io/assets/vendors-manage-permission-guard-DKkCt7b3.js (observed 2026-10-11).
- `src-ffbf054975b80f74`: address-autocomplete-CR3WY_jT.js — https://app.visitt.io/assets/address-autocomplete-CR3WY_jT.js (observed 2026-10-11).
- `src-ffedb01eb3277be4`: customer-fragments-73D-Mckb.js — https://app.visitt.io/assets/customer-fragments-73D-Mckb.js (observed 2026-10-11).