feat: add Delta Dental Individual (DeltaIndiv) eligibility check flow; fix CCA eligibility false-positive error

CCA step1 was treating the harmless "password set to expire" banner as a
fatal error, closing the browser before the eligibility popup/report
could be captured. Now it short-circuits to success once the patient
popup renders and ignores password-expiration notices.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/Backend/src/queue/jobRunner.ts

@@ -12,6 +12,7 @@ import { runClaimStatusProcessor } from "./processors/claimStatusProcessor";
 import { runClaimSubmitProcessor } from "./processors/claimSubmitProcessor";
 import { runOcrProcessor } from "./processors/ocrProcessor";
 import { runDdmaEligibilityProcessor } from "./processors/ddmaEligibilityProcessor";
+import { runDeltaIndivEligibilityProcessor } from "./processors/deltaIndivEligibilityProcessor";
 import { runDeltaInsEligibilityProcessor } from "./processors/deltaInsEligibilityProcessor";
 import { runUnitedSCOEligibilityProcessor } from "./processors/unitedSCOEligibilityProcessor";
 import { runUnitedUcardEligibilityProcessor } from "./processors/unitedUcardEligibilityProcessor";
@@ -117,6 +118,20 @@ export function enqueueSeleniumJob(data: SeleniumJobData): string {
         job.id
       );
     }
+    if (jobType === "deltaindiv-eligibility-check") {
+      return runDeltaIndivEligibilityProcessor(
+        {
+          enrichedPayload: data.enrichedPayload,
+          userId: data.userId,
+          insuranceId: data.insuranceId!,
+          formFirstName: data.formFirstName,
+          formLastName: data.formLastName,
+          formDob: data.formDob,
+          socketId: data.socketId,
+        },
+        job.id
+      );
+    }
     if (jobType === "unitedsco-eligibility-check") {
       return runUnitedSCOEligibilityProcessor(
         {

apps/Backend/src/queue/processors/deltaIndivEligibilityProcessor.ts

@@ -0,0 +1,393 @@
+/**
+ * Processor for "deltaindiv-eligibility-check" jobs.
+ *
+ * Integrates the full Delta Indiv persistent-session flow into the InProcessQueue:
+ *   1. Start a session on the Python agent (POST /deltaindiv-eligibility)
+ *   2. Emit selenium:deltaindiv_session_started → frontend stores session_id for OTP
+ *   3. Poll agent status, emitting selenium:otp_required when OTP is needed
+ *   4. On completion: save PDF, create/update patient, update eligibility status
+ *   5. Return { pdfFileId, pdfFilename, patientUpdateStatus, pdfUploadStatus }
+ *
+ * The OTP submission endpoint (/api/insurance-status-deltaindiv/selenium/submit-otp)
+ * continues to forward OTPs directly to the Python agent — it does NOT go
+ * through the queue.
+ */
+import fs from "fs/promises";
+import fsSync from "fs";
+import path from "path";
+import { storage } from "../../storage";
+import { emptyFolderContainingFile } from "../../utils/emptyTempFolder";
+import {
+  forwardToSeleniumDeltaIndivEligibilityAgent,
+  getSeleniumDeltaIndivSessionStatus,
+} from "../../services/seleniumDeltaIndivEligibilityClient";
+import {
+  splitName,
+  createOrUpdatePatientByInsuranceId,
+  imageToPdfBuffer,
+} from "./_shared";
+import { io } from "../../socket";
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+function now() {
+  return new Date().toISOString();
+}
+
+function log(tag: string, msg: string, ctx?: any) {
+  console.log(`${now()} [${tag}] ${msg}`, ctx ?? "");
+}
+
+function emitToSocket(socketId: string | undefined, event: string, payload: any) {
+  if (!socketId || !io) return;
+  try {
+    const socket = io.sockets.sockets.get(socketId);
+    if (socket) {
+      socket.emit(event, payload);
+      log("deltaindiv-processor", `emitted ${event}`, { socketId });
+    }
+  } catch (err: any) {
+    log("deltaindiv-processor", `emit failed for ${event}`, { err: err?.message });
+  }
+}
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+
+export interface DeltaIndivEligibilityProcessorInput {
+  enrichedPayload: any;
+  userId: number;
+  insuranceId: string;
+  formFirstName?: string;
+  formLastName?: string;
+  formDob?: string;
+  socketId?: string;
+}
+
+export interface DeltaIndivEligibilityProcessorResult {
+  patientUpdateStatus?: string;
+  pdfUploadStatus?: string;
+  pdfFileId?: number | string | null;
+  pdfFilename?: string | null;
+}
+
+// ─── Core DB processing (mirrors handleDeltaIndivCompletedJob in the route) ─────────
+
+async function processDeltaIndivResult(
+  userId: number,
+  insuranceId: string,
+  formFirstName: string | undefined,
+  formLastName: string | undefined,
+  formDob: string | undefined,
+  seleniumResult: any
+): Promise<DeltaIndivEligibilityProcessorResult> {
+  const output: DeltaIndivEligibilityProcessorResult = {};
+  let createdPdfFileId: number | string | null = null;
+
+  try {
+    // 1) Resolve patient name (prefer selenium extraction → form data)
+    const rawName =
+      typeof seleniumResult?.patientName === "string"
+        ? seleniumResult.patientName.trim()
+        : null;
+
+    let firstName: string;
+    let lastName: string;
+
+    if (rawName) {
+      // Strip trailing bare dates Delta Indiv appends to names e.g. "Christian Rodriguez 04/27/2026"
+      const cleanName = rawName.replace(/\s+\d{1,2}\/\d{1,2}\/\d{2,4}$/, "").trim();
+
+      if (cleanName.includes(",")) {
+        // "LAST, FIRST" format common on insurance portals
+        const [last, ...firstParts] = cleanName.split(",").map((s: string) => s.trim());
+        lastName = last || formLastName || "";
+        firstName = firstParts.join(" ").trim() || formFirstName || "";
+      } else {
+        const parsed = splitName(cleanName);
+        if (!parsed.lastName) {
+          // Single word — treat as last name, pull first name from form
+          lastName = parsed.firstName || formLastName || "";
+          firstName = formFirstName || "";
+        } else {
+          firstName = parsed.firstName || formFirstName || "";
+          lastName = parsed.lastName || formLastName || "";
+        }
+      }
+    } else {
+      firstName = formFirstName ?? "";
+      lastName = formLastName ?? "";
+    }
+
+    // 2) Create / update patient
+    const upsertedPatient = await createOrUpdatePatientByInsuranceId({
+      insuranceId,
+      firstName,
+      lastName,
+      dob: formDob,
+      userId,
+    });
+
+    // 3) Fetch patient (needed for ID)
+    const normalizedInsuranceId = insuranceId.replace(/\s+/g, "");
+    // Use the patient just created/updated (family members share an insuranceId, so an
+    // id-only lookup could return a different member).
+    const dobForLookup = formDob ? new Date(formDob) : null;
+    const patient =
+      upsertedPatient ??
+      (dobForLookup && !isNaN(dobForLookup.getTime())
+        ? await storage.getPatientByInsuranceIdAndDob(normalizedInsuranceId, dobForLookup)
+        : await storage.getPatientByInsuranceId(normalizedInsuranceId));
+    log("deltaindiv-processor", `patient lookup after create: ${patient ? `id=${patient.id}` : "NOT FOUND"} for insuranceId="${normalizedInsuranceId}"`);
+    if (!patient?.id) {
+      output.patientUpdateStatus = "Patient not found; no update performed";
+      return output;
+    }
+
+    // 4) Determine and update eligibility status + insurance provider name
+    const eligStatus = (seleniumResult?.eligibility ?? "").toLowerCase();
+    let newStatus = "UNKNOWN";
+    if (eligStatus === "active" || eligStatus === "y") newStatus = "ACTIVE";
+    else if (eligStatus === "inactive" || eligStatus === "n" || eligStatus === "termed") newStatus = "INACTIVE";
+    await storage.updatePatient(patient.id, {
+      status: newStatus,
+      insuranceProvider: "Delta Dental Indiv",
+    });
+    output.patientUpdateStatus = `Patient status updated to ${newStatus}`;
+
+    // 5) Resolve PDF buffer
+    //    New Delta Indiv worker returns a real PDF via pdf_path / ss_path (.pdf).
+    //    Old worker returned a screenshot (.png) via ss_path.
+    let pdfBuffer: Buffer | null = null;
+    let pdfFilename: string | null = null;
+
+    const pdfPath: string | null =
+      seleniumResult?.pdf_path ?? seleniumResult?.ss_path ?? null;
+
+    if (pdfPath && fsSync.existsSync(pdfPath)) {
+      if (pdfPath.endsWith(".pdf")) {
+        // Already a PDF — read directly
+        try {
+          pdfBuffer = await fs.readFile(pdfPath);
+          pdfFilename = path.basename(pdfPath);
+          log("deltaindiv-processor", "read PDF directly", { pdfPath });
+        } catch (e: any) {
+          output.pdfUploadStatus = `Failed to read PDF: ${e.message}`;
+        }
+      } else if (
+        pdfPath.endsWith(".png") ||
+        pdfPath.endsWith(".jpg") ||
+        pdfPath.endsWith(".jpeg")
+      ) {
+        // Legacy screenshot → convert to PDF
+        try {
+          pdfBuffer = await imageToPdfBuffer(pdfPath);
+          pdfFilename = `deltaindiv_eligibility_${insuranceId}_${Date.now()}.pdf`;
+          log("deltaindiv-processor", "converted screenshot to PDF", { pdfPath });
+        } catch (e: any) {
+          output.pdfUploadStatus = `Failed to convert screenshot to PDF: ${e.message}`;
+        }
+      }
+    } else {
+      output.pdfUploadStatus = "No valid file path from Selenium; nothing uploaded.";
+    }
+
+    // 6) Save PDF to patient document group
+    if (pdfBuffer && pdfFilename) {
+      const patientName = `${patient.firstName ?? ""} ${patient.lastName ?? ""}`.trim() || `Patient ${patient.id}`;
+      const cloudFile = await storage.savePdfToCloudStorage(
+        userId,
+        patient.id,
+        patientName,
+        "Eligibility",
+        pdfFilename,
+        pdfBuffer
+      );
+      createdPdfFileId = `cloud:${cloudFile.id}`;
+      output.pdfUploadStatus = "PDF saved to Eligibility folder";
+      output.pdfFilename = pdfFilename;
+    }
+
+    output.pdfFileId = createdPdfFileId;
+    return output;
+  } catch (err: any) {
+    log("deltaindiv-processor", `processDeltaIndivResult ERROR: ${err?.message ?? String(err)}`, err);
+    return {
+      ...output,
+      pdfUploadStatus:
+        output.pdfUploadStatus ?? `Processing failed: ${err?.message ?? String(err)}`,
+      pdfFileId: createdPdfFileId,
+    };
+  } finally {
+    // Always clean up temp files
+    const cleanupPath =
+      seleniumResult?.pdf_path ?? seleniumResult?.ss_path ?? null;
+    if (cleanupPath) {
+      try {
+        await emptyFolderContainingFile(cleanupPath);
+      } catch (e) {
+        log("deltaindiv-processor", "cleanup failed", { cleanupPath });
+      }
+    }
+  }
+}
+
+// ─── Polling loop ────────────────────────────────────────────────────────────
+
+async function pollUntilDone(
+  sessionId: string,
+  socketId: string | undefined,
+  jobId: string,
+  pollTimeoutMs = 5 * 60 * 1000 // 5 min total (includes OTP wait)
+): Promise<any> {
+  const maxAttempts = 600; // 600 × 500ms = 5 min
+  const pollIntervalMs = 500;
+  const maxTransientErrors = 12;
+  const noProgressLimit = 120; // 60 s of same status → abort
+
+  let transientErrors = 0;
+  let consecutiveNoProgress = 0;
+  let lastStatus: string | null = null;
+  const deadline = Date.now() + pollTimeoutMs;
+
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    if (Date.now() > deadline) {
+      throw new Error(
+        `Delta Indiv polling timeout (${Math.round(pollTimeoutMs / 1000)}s) for session ${sessionId}`
+      );
+    }
+
+    try {
+      const st = await getSeleniumDeltaIndivSessionStatus(sessionId);
+      const status: string = st?.status ?? "unknown";
+
+      log("deltaindiv-processor", `poll attempt=${attempt}`, { sessionId, status });
+
+      transientErrors = 0; // reset on success
+
+      // Track no-progress
+      const isTerminal =
+        status === "completed" || status === "error" || status === "not_found";
+      if (status === lastStatus && !isTerminal) {
+        consecutiveNoProgress++;
+      } else {
+        consecutiveNoProgress = 0;
+      }
+      lastStatus = status;
+
+      if (consecutiveNoProgress >= noProgressLimit) {
+        throw new Error(
+          `No progress from Python agent (status="${status}") after ${consecutiveNoProgress} polls`
+        );
+      }
+
+      // OTP required — notify frontend and keep polling
+      if (status === "waiting_for_otp") {
+        emitToSocket(socketId, "selenium:otp_required", {
+          session_id: sessionId,
+          jobId,
+          message: "OTP required. Please enter the OTP shown by the Delta Indiv portal.",
+        });
+        await new Promise((r) => setTimeout(r, pollIntervalMs));
+        continue;
+      }
+
+      if (status === "completed") {
+        log("deltaindiv-processor", "session completed", { sessionId });
+        return st.result;
+      }
+
+      if (status === "error" || status === "not_found") {
+        throw new Error(
+          st?.message || `Delta Indiv session ended with status: ${status}`
+        );
+      }
+
+      // Still running / otp_submitted / created — keep polling
+      await new Promise((r) => setTimeout(r, pollIntervalMs));
+    } catch (err: any) {
+      // Propagate terminal errors immediately
+      const isTerminal =
+        err?.response?.status === 404 ||
+        (typeof err?.message === "string" &&
+          (err.message.includes("not_found") ||
+            err.message.includes("polling timeout") ||
+            err.message.includes("No progress")));
+
+      if (isTerminal) throw err;
+
+      // Transient network errors — back off
+      transientErrors++;
+      if (transientErrors > maxTransientErrors) {
+        throw new Error(
+          `Too many transient network errors polling Delta Indiv session ${sessionId}`
+        );
+      }
+      const backoff = Math.min(30_000, 500 * Math.pow(2, transientErrors - 1));
+      log("deltaindiv-processor", `transient error #${transientErrors}, backoff ${backoff}ms`, {
+        err: err?.message,
+      });
+      await new Promise((r) => setTimeout(r, backoff));
+    }
+  }
+
+  throw new Error(`Delta Indiv polling exhausted all attempts for session ${sessionId}`);
+}
+
+// ─── Main processor entry point ───────────────────────────────────────────────
+
+export async function runDeltaIndivEligibilityProcessor(
+  input: DeltaIndivEligibilityProcessorInput,
+  jobId: string
+): Promise<DeltaIndivEligibilityProcessorResult> {
+  const {
+    enrichedPayload,
+    userId,
+    insuranceId,
+    formFirstName,
+    formLastName,
+    formDob,
+    socketId,
+  } = input;
+
+  // 1) Tell Python agent to start a Delta Indiv session
+  log("deltaindiv-processor", "starting Python agent session", { insuranceId });
+  const agentResp = await forwardToSeleniumDeltaIndivEligibilityAgent(enrichedPayload);
+
+  if (!agentResp?.session_id) {
+    throw new Error(
+      "Python agent did not return a session_id for Delta Indiv eligibility"
+    );
+  }
+
+  const sessionId = agentResp.session_id as string;
+  log("deltaindiv-processor", "got session_id", { sessionId });
+
+  // 2) Emit session started so frontend can store session_id for OTP submission
+  emitToSocket(socketId, "selenium:deltaindiv_session_started", {
+    session_id: sessionId,
+    jobId,
+  });
+
+  // 3) Poll until done (handles OTP events internally)
+  const seleniumResult = await pollUntilDone(sessionId, socketId, jobId);
+
+  if (!seleniumResult || seleniumResult.status === "error") {
+    throw new Error(
+      seleniumResult?.message ?? "Delta Indiv session returned an error result"
+    );
+  }
+
+  // 4) Process DB writes and PDF upload
+  log("deltaindiv-processor", "processing DB result", { insuranceId });
+  const result = await processDeltaIndivResult(
+    userId,
+    insuranceId,
+    formFirstName,
+    formLastName,
+    formDob,
+    seleniumResult
+  );
+
+  log("deltaindiv-processor", "done", { result });
+  return result;
+}

apps/Backend/src/queue/queues.ts

@@ -9,6 +9,7 @@ export type SeleniumJobType =
   | "claim-pre-auth"
   | "ddma-eligibility-check"
   | "deltains-eligibility-check"
+  | "deltaindiv-eligibility-check"
   | "unitedsco-eligibility-check"
   | "uniteducard-eligibility-check"
   | "cca-eligibility-check"

apps/Backend/src/routes/index.ts

@@ -12,6 +12,7 @@ import documentsRoutes from "./documents";
 import patientDocumentsRoutes from "./patient-documents";
 import insuranceStatusRoutes from "./insuranceStatus";
 import insuranceStatusDdmaRoutes from "./insuranceStatusDDMA";
+import insuranceStatusDeltaIndivRoutes from "./insuranceStatusDeltaIndiv";
 import insuranceStatusDeltaInsRoutes from "./insuranceStatusDeltaIns";
 import insuranceStatusUnitedSCORoutes from "./insuranceStatusUnitedSCO";
 import insuranceStatusUnitedUcardRoutes from "./insuranceStatusUnitedUcard";
@@ -68,6 +69,7 @@ router.use("/patient-documents", patientDocumentsRoutes);
 router.use("/insurance-status", insuranceStatusRoutes);
 router.use("/insurance-status-ddma", insuranceStatusDdmaRoutes);
 router.use("/insurance-status-deltains", insuranceStatusDeltaInsRoutes);
+router.use("/insurance-status-deltaindiv", insuranceStatusDeltaIndivRoutes);
 router.use("/insurance-status-unitedsco", insuranceStatusUnitedSCORoutes);
 router.use("/insurance-status-uniteducard", insuranceStatusUnitedUcardRoutes);
 router.use("/insurance-status-tuftssco", insuranceStatusTuftsSCORoutes);

apps/Backend/src/routes/insuranceStatusDeltaIndiv.ts

@@ -0,0 +1,147 @@
+import { Router, Request, Response } from "express";
+import { storage } from "../storage";
+import { forwardOtpToSeleniumDeltaIndivAgent } from "../services/seleniumDeltaIndivEligibilityClient";
+import { io } from "../socket";
+import { enqueueSeleniumJob } from "../queue/jobRunner";
+
+const router = Router();
+
+function log(tag: string, msg: string, ctx?: any) {
+  console.log(`${new Date().toISOString()} [${tag}] ${msg}`, ctx ?? "");
+}
+
+function emitSafe(socketId: string | undefined, event: string, payload: any) {
+  if (!socketId || !io) return;
+  try {
+    const socket = io.sockets.sockets.get(socketId);
+    if (socket) socket.emit(event, payload);
+  } catch (err: any) {
+    log("socket", "emit failed", { socketId, event, err: err?.message });
+  }
+}
+
+/**
+ * POST /deltaindiv-eligibility
+ *
+ * Enqueues a Delta Indiv eligibility check in the shared InProcessQueue
+ * (concurrency=1, mirrors the Python semaphore).
+ *
+ * Body:
+ *   data     — patient + search fields (memberId, dateOfBirth, …)
+ *   socketId — socket.io client id for real-time updates
+ *
+ * Response: { status: "queued", jobId: "…" }
+ *
+ * Real-time events emitted to socketId during job execution:
+ *   job:update               { jobId, jobType, status: "active"|"completed"|"failed", … }
+ *   selenium:deltaindiv_session_started { session_id, jobId }
+ *   selenium:otp_required    { session_id, jobId, message }
+ */
+router.post(
+  "/deltaindiv-eligibility",
+  async (req: Request, res: Response): Promise<any> => {
+    if (!req.body.data) {
+      return res
+        .status(400)
+        .json({ error: "Missing Insurance Eligibility data for selenium" });
+    }
+    if (!req.user?.id) {
+      return res.status(401).json({ error: "Unauthorized: user info missing" });
+    }
+
+    try {
+      const rawData =
+        typeof req.body.data === "string"
+          ? JSON.parse(req.body.data)
+          : req.body.data;
+
+      // Fetch credentials from DB
+      const credentials = await storage.getInsuranceCredentialByUserAndSiteKey(
+        req.user.id,
+        rawData.insuranceSiteKey
+      );
+      if (!credentials) {
+        return res.status(404).json({
+          error:
+            "No insurance credentials found for this provider. Please update them at the Settings page.",
+        });
+      }
+
+      // Fetch NPI providers to pick the target provider on the Delta Indiv portal
+      const npiProviders = await storage.getNpiProvidersByUser(req.user.id);
+      const primaryProvider = npiProviders[0]; // sorted by sortOrder asc, then id asc
+
+      const enrichedData = {
+        ...rawData,
+        deltaindivUsername: credentials.username,
+        deltaindivPassword: credentials.password,
+        providerName: primaryProvider?.providerName ?? "",
+      };
+
+      const socketId: string | undefined = req.body.socketId;
+
+      // Enqueue — this enforces the same concurrency=1 as all other selenium jobs
+      const jobId = enqueueSeleniumJob({
+        jobType: "deltaindiv-eligibility-check",
+        userId: req.user.id,
+        socketId,
+        enrichedPayload: enrichedData,
+        insuranceId: String(rawData.memberId ?? "").trim(),
+        formFirstName: rawData.firstName,
+        formLastName: rawData.lastName,
+        formDob: rawData.dateOfBirth,
+      });
+
+      log("deltaindiv-route", "job enqueued", { jobId, insuranceId: rawData.memberId });
+
+      return res.json({ status: "queued", jobId });
+    } catch (err: any) {
+      console.error("[deltaindiv-route] enqueue failed:", err);
+      return res.status(500).json({
+        error: err.message || "Failed to enqueue Delta Indiv selenium job",
+      });
+    }
+  }
+);
+
+/**
+ * POST /selenium/submit-otp
+ *
+ * Forwards the OTP entered by the user directly to the Python agent.
+ * This is a side-channel — it does NOT go through the queue.
+ * The polling loop inside deltaindivEligibilityProcessor picks up the completed
+ * state after OTP is submitted.
+ *
+ * Body: { session_id, otp, socketId? }
+ */
+router.post(
+  "/selenium/submit-otp",
+  async (req: Request, res: Response): Promise<any> => {
+    const { session_id: sessionId, otp, socketId } = req.body;
+    if (!sessionId || !otp) {
+      return res.status(400).json({ error: "session_id and otp are required" });
+    }
+
+    try {
+      const r = await forwardOtpToSeleniumDeltaIndivAgent(sessionId, otp);
+
+      emitSafe(socketId, "selenium:otp_submitted", {
+        session_id: sessionId,
+        result: r,
+      });
+
+      return res.json(r);
+    } catch (err: any) {
+      console.error(
+        "[deltaindiv-route] submit-otp failed:",
+        err?.response?.data || err?.message || err
+      );
+      return res.status(500).json({
+        error: "Failed to forward OTP to selenium agent",
+        detail: err?.message || err,
+      });
+    }
+  }
+);
+
+export default router;

apps/Backend/src/services/seleniumDeltaIndivEligibilityClient.ts

@@ -0,0 +1,122 @@
+import axios from "axios";
+import http from "http";
+import https from "https";
+import dotenv from "dotenv";
+dotenv.config();
+
+export interface SeleniumPayload {
+  data: any;
+  url?: string;
+}
+
+const SELENIUM_AGENT_BASE = process.env.SELENIUM_AGENT_BASE_URL;
+
+const httpAgent = new http.Agent({ keepAlive: true, keepAliveMsecs: 60_000 });
+const httpsAgent = new https.Agent({ keepAlive: true, keepAliveMsecs: 60_000 });
+
+const client = axios.create({
+  baseURL: SELENIUM_AGENT_BASE,
+  timeout: 5 * 60 * 1000,
+  httpAgent,
+  httpsAgent,
+  validateStatus: (s) => s >= 200 && s < 600,
+});
+
+async function requestWithRetries(
+  config: any,
+  retries = 4,
+  baseBackoffMs = 300
+) {
+  for (let attempt = 1; attempt <= retries; attempt++) {
+    try {
+      const r = await client.request(config);
+      if (![502, 503, 504].includes(r.status)) return r;
+      console.warn(
+        `[selenium-client] retryable HTTP status ${r.status} (attempt ${attempt})`
+      );
+    } catch (err: any) {
+      const code = err?.code;
+      const isTransient =
+        code === "ECONNRESET" ||
+        code === "ECONNREFUSED" ||
+        code === "EPIPE" ||
+        code === "ETIMEDOUT";
+      if (!isTransient) throw err;
+      console.warn(
+        `[selenium-client] transient network error ${code} (attempt ${attempt})`
+      );
+    }
+    await new Promise((r) => setTimeout(r, baseBackoffMs * attempt));
+  }
+  // final attempt (let exception bubble if it fails)
+  return client.request(config);
+}
+
+function now() {
+  return new Date().toISOString();
+}
+function log(tag: string, msg: string, ctx?: any) {
+  console.log(`${now()} [${tag}] ${msg}`, ctx ?? "");
+}
+
+export async function forwardToSeleniumDeltaIndivEligibilityAgent(
+  insuranceEligibilityData: any
+): Promise<any> {
+  const payload = { data: insuranceEligibilityData };
+  const url = `/deltaindiv-eligibility`;
+  log("selenium-client", "POST deltaindiv-eligibility", {
+    url: SELENIUM_AGENT_BASE + url,
+    keys: Object.keys(payload),
+  });
+  const r = await requestWithRetries({ url, method: "POST", data: payload }, 4);
+  log("selenium-client", "agent response", {
+    status: r.status,
+    dataKeys: r.data ? Object.keys(r.data) : null,
+  });
+  if (r.status >= 500)
+    throw new Error(`Selenium agent server error: ${r.status}`);
+  return r.data;
+}
+
+export async function forwardOtpToSeleniumDeltaIndivAgent(
+  sessionId: string,
+  otp: string
+): Promise<any> {
+  const url = `/submit-otp`;
+  log("selenium-client", "POST submit-otp", {
+    url: SELENIUM_AGENT_BASE + url,
+    sessionId,
+  });
+  const r = await requestWithRetries(
+    { url, method: "POST", data: { session_id: sessionId, otp } },
+    4
+  );
+  log("selenium-client", "submit-otp response", {
+    status: r.status,
+    data: r.data,
+  });
+  if (r.status >= 500)
+    throw new Error(`Selenium agent server error on submit-otp: ${r.status}`);
+  return r.data;
+}
+
+export async function getSeleniumDeltaIndivSessionStatus(
+  sessionId: string
+): Promise<any> {
+  const url = `/session/${sessionId}/status`;
+  log("selenium-client", "GET session status", {
+    url: SELENIUM_AGENT_BASE + url,
+    sessionId,
+  });
+  const r = await requestWithRetries({ url, method: "GET" }, 4);
+  log("selenium-client", "session status response", {
+    status: r.status,
+    dataKeys: r.data ? Object.keys(r.data) : null,
+  });
+  if (r.status === 404) {
+    const e: any = new Error("not_found");
+    e.response = { status: 404, data: r.data };
+    throw e;
+  }
+  return r.data;
+}