@incodetech/core 2.1.1 → 2.2.0-rc.0

package/dist/{WasmUtilProvider-BgzcXBdl.esm.js → safeStorage-Ep56I-f_.esm.js}

@@ -1,437 +1,5 @@
-//#region ../infra/src/wasm/wasmPathUtils.ts
-function deriveSiblingJsPath(wasmPath) {
-	const index = wasmPath.lastIndexOf(".wasm");
-	if (index === -1) return wasmPath;
-	const rest = wasmPath.slice(index + 5);
-	if (rest !== "" && !rest.startsWith("?")) return wasmPath;
-	return `${wasmPath.slice(0, index)}.js${rest}`;
-}
-
-//#endregion
-//#region ../infra/src/providers/browser/SemaphoreProvider.ts
-const DEFAULT_ACQUIRE_TIMEOUT_MS = 3e4;
-/**
-* Counting-semaphore implementation of {@link IConcurrencyCapability}.
-*
-* Default `maxConcurrent=1` makes it behave as a mutex; set higher for
-* parallel-bounded access. Each acquire returns a numeric `threadId` for
-* tracing — the slot index, in `[0, maxConcurrent)` — that must be passed back
-* to `release`.
-*
-* If all slots stay occupied longer than `acquireTimeoutMs` (default 30s), the
-* pending wait still resolves when a slot frees, but `console.error` is logged
-* as a deadlock-watchdog signal. Misuse — out-of-range or double-released
-* `threadId`s — is also logged and treated as a no-op rather than thrown.
-*/
-var SemaphoreProvider = class {
-	constructor(maxConcurrent = 1, acquireTimeoutMs = DEFAULT_ACQUIRE_TIMEOUT_MS) {
-		this.pending = [];
-		this.available = [];
-		this.processing = /* @__PURE__ */ new Set();
-		this.maxId = maxConcurrent - 1;
-		this.acquireTimeoutMs = acquireTimeoutMs;
-		for (let i = 0; i < maxConcurrent; i++) this.available.push(i);
-	}
-	/**
-	* Acquire a slot. Resolves immediately with the slot's `threadId` if one is
-	* free, otherwise queues FIFO and resolves when a holder releases.
-	*/
-	async acquire() {
-		if (this.available.length > 0) {
-			const threadId = this.available.shift();
-			this.processing.add(threadId);
-			return threadId;
-		}
-		return new Promise((resolve, reject) => {
-			const entry = {
-				resolve: (threadId) => {
-					clearTimeout(entry.timer);
-					this.processing.add(threadId);
-					resolve(threadId);
-				},
-				reject: (error) => {
-					clearTimeout(entry.timer);
-					reject(error);
-				},
-				timer: setTimeout(() => {
-					console.error(`SemaphoreProvider: all slots occupied for ${this.acquireTimeoutMs}ms, ${this.pending.length} request(s) waiting`);
-				}, this.acquireTimeoutMs)
-			};
-			this.pending.push(entry);
-		});
-	}
-	/**
-	* Return a slot to the pool. The next pending waiter (if any) is resolved
-	* with this `threadId`; otherwise the slot is added back to `available`.
-	* Releasing an out-of-range or already-released `threadId` logs an error and
-	* is otherwise a no-op.
-	*/
-	release(threadId) {
-		if (threadId < 0 || threadId > this.maxId) {
-			console.error(`SemaphoreProvider: invalid threadId ${threadId}`);
-			return;
-		}
-		if (!this.processing.has(threadId)) {
-			console.error(`SemaphoreProvider: double-release of threadId ${threadId}`);
-			return;
-		}
-		this.processing.delete(threadId);
-		if (this.pending.length > 0) this.pending.shift().resolve(threadId);
-		else this.available.unshift(threadId);
-	}
-	/**
-	* Cancel all pending acquires with a reset error and replenish all slots.
-	* Existing holders are not contacted — a `release` after reset will log a
-	* double-release warning rather than disrupt the new pool.
-	*/
-	reset() {
-		const waiters = this.pending;
-		this.pending = [];
-		this.available = [];
-		this.processing = /* @__PURE__ */ new Set();
-		for (let i = 0; i <= this.maxId; i++) this.available.push(i);
-		for (const waiter of waiters) waiter.reject(/* @__PURE__ */ new Error("SemaphoreProvider reset: pending acquire cancelled"));
-	}
-	/**
-	* Acquire a slot, invoke `fn(threadId, ...args)`, then release the slot in a
-	* `finally` block. Errors thrown by `fn` propagate to the caller after the
-	* slot is released.
-	*/
-	async withLock(fn, ...args) {
-		const threadId = await this.acquire();
-		try {
-			return await fn(threadId, ...args);
-		} finally {
-			this.release(threadId);
-		}
-	}
-};
-
-//#endregion
-//#region ../infra/src/wasm/apiUtilities.ts
-/**
-* Shared WASM module loader.
-*
-* The pinned `webLib.wasm` (see `wasmDefaults.ts`) bundles BOTH the ML pipeline
-* APIs (used by `mlWasmJSApi.ts`) AND a C++ `WebClient` HTTP client (used by
-* `wasmWebClient.ts`). Both consumers must share a single instantiated
-* `wasmModule` — calling the glue `Module()` factory twice would re-instantiate
-* the WASM heap and produce divergent state.
-*
-* This module memoizes the load: the first caller (whichever arrives first —
-* ML init or HTTP init) triggers the fetch + glue load, and subsequent callers
-* await the same promise. Idempotent on success; on failure, the singleton is
-* cleared so the next caller retries.
-*
-* SIMD fallback mirrors the legacy behavior: try the SIMD binary + SIMD glue
-* (`webLibSimd.js` + `webLibSimd.wasm`) first, fall back to the non-SIMD pair
-* (`webLib.js` + `webLib.wasm`) on instantiation failure. Each binary MUST be
-* paired with its matching glue — the CDN ships them as paired artifacts and
-* mixing them produces an unusable module.
-*/
-if (typeof window !== "undefined" && window.wasmArrayBuffer === void 0) window.wasmArrayBuffer = null;
-let loadPromise = null;
-let loadedResult = null;
-async function importGlue(glueCodePath) {
-	const mod = await import(
-		/* @vite-ignore */
-		/* webpackIgnore: true */
-		glueCodePath
-);
-	if (typeof mod.Module !== "function") throw new Error(`WASM glue at ${glueCodePath} did not export a Module factory`);
-	return mod.Module;
-}
-async function fetchWasmBinary(libPath) {
-	const response = await fetch(libPath);
-	if (!response.ok) throw new Error(`Failed to fetch WASM binary at ${libPath}: ${response.status} ${response.statusText}`);
-	const buffer = await response.arrayBuffer();
-	return new Uint8Array(buffer);
-}
-async function instantiate(factory, libPath) {
-	window.wasmArrayBuffer = await fetchWasmBinary(libPath);
-	return await factory();
-}
-/**
-* Load the WASM module, memoized. Subsequent calls return the same instance.
-*
-* SIMD-first with fallback: if `useSimd !== false` and a `wasmSimdPath` is
-* provided, the SIMD binary + SIMD glue are tried first; on instantiation
-* failure the non-SIMD binary + non-SIMD glue are used. Each `.wasm` is
-* paired with its matching `.js` glue — they cannot be mixed.
-*/
-async function loadWasmModule(config) {
-	if (loadedResult) return loadedResult;
-	if (loadPromise) return loadPromise;
-	loadPromise = (async () => {
-		try {
-			const wantSimd = config.useSimd !== false;
-			const simdBinary = config.wasmSimdPath ?? config.wasmPath;
-			if (wantSimd && simdBinary !== config.wasmPath) try {
-				const simdFactory = await importGlue(config.glueCodeSimdPath ?? deriveSiblingJsPath(simdBinary));
-				window.Module = simdFactory;
-				const result$1 = {
-					wasmModule: await instantiate(simdFactory, simdBinary),
-					simdUsed: true
-				};
-				loadedResult = result$1;
-				return result$1;
-			} catch (simdError) {
-				console.warn("[Incode SDK] SIMD WASM load failed, falling back to non-SIMD", simdError);
-			}
-			const nonSimdFactory = await importGlue(config.glueCodePath);
-			window.Module = nonSimdFactory;
-			const result = {
-				wasmModule: await instantiate(nonSimdFactory, config.wasmPath),
-				simdUsed: false
-			};
-			loadedResult = result;
-			return result;
-		} catch (error) {
-			loadPromise = null;
-			throw error;
-		}
-	})();
-	return loadPromise;
-}
-
-//#endregion
-//#region ../infra/src/wasm/IdCaptureModelType.ts
-let IdCaptureModelType = /* @__PURE__ */ function(IdCaptureModelType$1) {
-	IdCaptureModelType$1[IdCaptureModelType$1["IdCaptureV1x"] = 0] = "IdCaptureV1x";
-	IdCaptureModelType$1[IdCaptureModelType$1["IdCaptureV2x"] = 1] = "IdCaptureV2x";
-	IdCaptureModelType$1[IdCaptureModelType$1["IdCaptureV3x"] = 2] = "IdCaptureV3x";
-	return IdCaptureModelType$1;
-}({});
-
-//#endregion
-//#region ../infra/src/wasm/WasmPipelineType.ts
-let WasmPipelineType = /* @__PURE__ */ function(WasmPipelineType$1) {
-	WasmPipelineType$1[WasmPipelineType$1["IdBlurGlarePipeline"] = 0] = "IdBlurGlarePipeline";
-	WasmPipelineType$1[WasmPipelineType$1["IdBarcodeAndTextQualityPipeline"] = 1] = "IdBarcodeAndTextQualityPipeline";
-	WasmPipelineType$1[WasmPipelineType$1["IdVideoSelfiePipeline"] = 2] = "IdVideoSelfiePipeline";
-	WasmPipelineType$1[WasmPipelineType$1["SelfieWithAggregationMetrics"] = 3] = "SelfieWithAggregationMetrics";
-	WasmPipelineType$1[WasmPipelineType$1["SelfieWithQualityMetrics"] = 4] = "SelfieWithQualityMetrics";
-	WasmPipelineType$1[WasmPipelineType$1["OnDeviceSelfieWorkflow"] = 5] = "OnDeviceSelfieWorkflow";
-	return WasmPipelineType$1;
-}({});
-
-//#endregion
-//#region ../infra/src/wasm/wasmCallUtils.ts
-async function wasmCallWrapper(concurrency, wasmMethod, useSemaphore = true, ...args) {
-	const innerCall = async () => {
-		while (true) {
-			if (wasmMethod(...args)) return;
-			await new Promise((resolve) => setTimeout(resolve, 0));
-		}
-	};
-	if (useSemaphore) {
-		await concurrency.withLock(innerCall);
-		return;
-	}
-	await innerCall();
-}
-
-//#endregion
-//#region ../infra/src/wasm/wasmWebClient.ts
-/**
-* JavaScript bridge for the C++ `WebClient` exposed by `webLib.wasm`.
-*
-* The pinned WASM bundle ships a `WebClient` class alongside the ML pipeline
-* APIs. This module instantiates it once (sharing the singleton `wasmModule`
-* with `mlWasmJSApi`) and exposes a small TypeScript-friendly surface that
-* `createWasmApi` can drive.
-*
-* Concurrency model mirrors the legacy implementation:
-* - 4-slot semaphore keyed by per-request `threadId` so multiple HTTP calls
-*   can run in parallel without trampling shared C++ state.
-* - Each WASM-side method that performs in-binary HTTP (request methods AND
-*   `createApi`'s in-binary `/e2ee/key` handshake) returns `false` while in
-*   flight and `true` once the C++ side has finished; the JS bridge awaits
-*   completion via {@link wasmCallWrapper}.
-* - Result extraction (`getRequestResult`) is per-thread for HTTP requests
-*   and uses `threadId = -1` for the session-level `createApi` handshake.
-*
-* Encryption support: `setupConnection` accepts an `encryptionEnabled` flag
-* that triggers the in-binary RSA/AES handshake. The OAEP MGF1 hash is
-* controlled by the `useSha256` flag forwarded to the C++ `createApi`:
-* `true` = SHA-256 MGF1, `false` = SHA-1 MGF1 (Java-compat default).
-* State lives in the C++ binary and (for SDK config) in
-* `@incodetech/core`'s `setup.ts` — this module caches nothing.
-*/
-const HTTP_CONCURRENCY = 4;
-/**
-* Sentinel `threadId` used by the session-level `createApi` handshake when we
-* read its result via `getRequestResult`. Per-request HTTP traffic uses real
-* thread ids handed out by the semaphore; the handshake has no slot of its
-* own, so the C++ side stores its result under `-1`. Mirrors legacy
-* `checkError(threadId = -1)`.
-*/
-const SETUP_THREAD_ID = -1;
-var WasmWebClientError = class extends Error {
-	constructor(message, statusCode, data) {
-		super(message);
-		this.name = "WasmWebClientError";
-		this.status = statusCode;
-		this.statusCode = statusCode;
-		if (statusCode > 0 || data !== void 0) this.response = {
-			status: statusCode,
-			data
-		};
-	}
-};
-let webClientApi = null;
-let initPromise = null;
-let semaphore = new SemaphoreProvider(HTTP_CONCURRENCY);
-const isWebClientWasm = (mod) => {
-	return typeof mod.WebClient === "function";
-};
-const toStringRecord = (obj) => {
-	if (!obj) return void 0;
-	const result = {};
-	for (const key of Object.keys(obj)) {
-		const value = obj[key];
-		if (value === void 0 || value === null) continue;
-		result[key] = String(value);
-	}
-	return result;
-};
-/**
-* Loads the shared WASM module (if not already loaded) and instantiates the
-* C++ `WebClient`. Idempotent — repeated calls reuse the existing instance.
-*
-* `glueCodeSimdPath` is paired with `wasmSimdPath` (`webLibSimd.js` for
-* `webLibSimd.wasm`). Pass `''` to derive it automatically from
-* `wasmSimdPath` by replacing the `.wasm` extension with `.js`.
-*/
-async function initializeWasmWebClient(wasmPath, wasmSimdPath, glueCodePath, glueCodeSimdPath, useSimd) {
-	if (webClientApi) return;
-	if (initPromise) return initPromise;
-	initPromise = (async () => {
-		try {
-			const { wasmModule } = await loadWasmModule({
-				wasmPath,
-				wasmSimdPath,
-				glueCodePath,
-				glueCodeSimdPath: glueCodeSimdPath || void 0,
-				useSimd
-			});
-			if (!isWebClientWasm(wasmModule)) throw new Error("WASM module does not expose a WebClient class. Update webLib.wasm to a build that includes WebClient.");
-			webClientApi = new wasmModule.WebClient();
-		} catch (error) {
-			initPromise = null;
-			throw error;
-		}
-	})();
-	return initPromise;
-}
-/**
-* Configures the C++ WebClient connection. Safe to call multiple times — each
-* call resets the underlying session and re-applies default headers.
-*
-* `defaultHeaders` are applied **before** `createApi`, so the in-binary RSA
-* handshake (`GET /e2ee/key/v2` + `POST /e2ee/key`) sees the same headers as
-* data requests. Without this ordering, environments that require auth/version
-* headers on the handshake (e.g. `x-api-key`, `api-version`) would 401/4xx
-* before any encrypted traffic ever flowed.
-*
-* The C++ `createApi` returns `false` while the in-binary handshake is still
-* in flight and `true` once both the `/e2ee/key/v2` GET and the `/e2ee/key`
-* POST have completed (encryption on) or once the WebClient is configured
-* (encryption off — same boolean convention, just no network traffic). The
-* JS bridge waits on that boolean via {@link wasmCallWrapper}, then surfaces
-* any handshake error captured on the session-level (`threadId = -1`)
-* request slot. Mirrors legacy
-* `ms-incodesmile-web/packages/incode-welcome/src/wasmUtils/webClientApi.ts`
-* `setupConnection`.
-*
-* `useSha256` selects the OAEP MGF1 hash for the in-binary RSA wrap:
-* - `true` → MGF1 = SHA-256. Caller is responsible for attaching the
-*   `X-RSA-Encryption-Scheme: RSA/NONE/OAEPWITHSHA-256ANDMGF1PADDING`
-*   header on subsequent encrypted requests so the server matches.
-* - `false` → MGF1 = SHA-1 (Java-compat default). No scheme header needed;
-*   the server falls back to the legacy Java default.
-*/
-async function setupWasmConnection(apiURL, token, encryptionEnabled, defaultHeaders, useSha256) {
-	const api = ensureReady();
-	api.resetSessionState?.();
-	api.setDefaultHeaders?.(defaultHeaders);
-	await wasmCallWrapper(semaphore, () => api.createApi(apiURL, token, useSha256, encryptionEnabled), false);
-	const result = api.getRequestResult(SETUP_THREAD_ID);
-	if (result.hasError) throw new WasmWebClientError(result.errorMessage || "WebClient handshake failed", result.statusCode, result.result);
-}
-/**
-* Executes a single HTTP request through the WASM WebClient.
-*
-* Acquires a semaphore slot for `threadId`, registers progress callbacks, runs
-* the request via {@link wasmCallWrapper} (busy-polls until the WASM method
-* returns `true`), then extracts the per-thread result. Throws
-* {@link WasmWebClientError} on non-2xx or transport errors.
-*
-* The `ie` (inline-encryption) flag is forwarded to the C++ WebClient for
-* mutating methods. Default `false` — the SDK HTTP path leaves payloads
-* unencrypted at the WebClient layer. The C++ `WebApi.postFaceResults`
-* pre-encrypts its JSON via `SessionEncryptor` and calls back into this
-* function with `ie=true`; see {@link createWebApiHostAdapter}.
-*/
-async function executeWasmRequest(method, url, body, headers, params, timeout, onUploadProgress, ie = false) {
-	const api = ensureReady();
-	const stringParams = toStringRecord(params);
-	return semaphore.withLock(async (threadId) => {
-		if (onUploadProgress && api.setOnUploadProgress) api.setOnUploadProgress((event) => {
-			try {
-				onUploadProgress(event);
-			} catch (error) {
-				console.error("WasmWebClient: error in onUploadProgress callback", error);
-			}
-		});
-		try {
-			await wasmCallWrapper(semaphore, () => callWasmMethod(api, method, threadId, url, body, headers, stringParams, timeout, ie), false);
-			return readResult(api, threadId);
-		} finally {
-			api.clearOnUploadProgress?.(threadId);
-			api.clearOnDownloadProgress?.(threadId);
-		}
-	});
-}
-function callWasmMethod(api, method, threadId, url, body, headers, params, timeout, ie) {
-	switch (method) {
-		case "GET": return api.get(threadId, url, params, headers, timeout);
-		case "POST": return api.post(threadId, url, body ?? {}, headers, params, timeout, ie);
-		case "PUT": return api.put(threadId, url, body ?? {}, headers, params, timeout, ie);
-		case "PATCH": return api.patch(threadId, url, body ?? {}, headers, params, timeout, ie);
-		case "DELETE": return api.del(threadId, url, body ?? {}, headers, params, timeout, ie);
-		default: throw new Error(`Unsupported WASM HTTP method: ${method}`);
-	}
-}
-const DEFAULT_WEBAPI_TIMEOUT_MS = 3e4;
-let webApiHttpTransport = null;
-function setWebApiHttpTransport(transport) {
-	webApiHttpTransport = transport;
-}
-function createWebApiHostAdapter() {
-	return { post(url, body, config) {
-		const effectiveConfig = config ?? {};
-		const transport = webApiHttpTransport;
-		if (transport) return transport(url, body, effectiveConfig);
-		return executeWasmRequest("POST", url, body, effectiveConfig.headers ?? {}, effectiveConfig.params, effectiveConfig.timeout ?? DEFAULT_WEBAPI_TIMEOUT_MS, void 0, effectiveConfig.ie === true);
-	} };
-}
-function readResult(api, threadId) {
-	const response = api.getRequestResult(threadId);
-	if (response.hasError) throw new WasmWebClientError(response.errorMessage || "WasmWebClient request failed", response.statusCode, response.result);
-	return {
-		data: response.result,
-		status: response.statusCode
-	};
-}
-function ensureReady() {
-	if (!webClientApi) throw new Error("WasmWebClient not initialized. Call initializeWasmWebClient() first.");
-	return webClientApi;
-}
-
-//#endregion
-//#region ../infra/src/wasm/mlWasmJSApi.ts
-var MlWasmJSApi = class MlWasmJSApi {
+import { c as loadWasmModule, l as SemaphoreProvider, n as createWebApiHostAdapter, s as wasmCallWrapper } from "./wasmWebClient-DM8lkb0z.esm.js";
+var mlWasmJSApi_default = class MlWasmJSApi {
 	constructor() {
 		this.versionsFile = null;
 		this.modelsBuffers = null;
@@ -605,12 +173,12 @@ var MlWasmJSApi = class MlWasmJSApi {
 		if (this.inputImageBuffer === null) throw new Error("Unable to process the image, buffers haven't been allocated!");
 		this.inputImageBuffer.set(image.data);
 		switch (type) {
-			case WasmPipelineType.IdBlurGlarePipeline:
-			case WasmPipelineType.IdBarcodeAndTextQualityPipeline: return this.idCaptureWasmApi.runIdCaptureWorkflow(this.pipelineTypeToWasmEnum(type));
-			case WasmPipelineType.IdVideoSelfiePipeline: return this.idCaptureWasmApi.runIdVideoSelfieWorkflow();
-			case WasmPipelineType.SelfieWithAggregationMetrics:
-			case WasmPipelineType.SelfieWithQualityMetrics:
-			case WasmPipelineType.OnDeviceSelfieWorkflow: return this.faceProcessingWasmApi.runSelfieWorkflow(this.pipelineTypeToWasmEnum(type));
+			case 0:
+			case 1: return this.idCaptureWasmApi.runIdCaptureWorkflow(this.pipelineTypeToWasmEnum(type));
+			case 2: return this.idCaptureWasmApi.runIdVideoSelfieWorkflow();
+			case 3:
+			case 4:
+			case 5: return this.faceProcessingWasmApi.runSelfieWorkflow(this.pipelineTypeToWasmEnum(type));
 			default: throw new Error("Unknown pipeline type");
 		}
 	}
@@ -670,6 +238,23 @@ var MlWasmJSApi = class MlWasmJSApi {
 		this.checkWasmInitialization("Unable to set model type, cpp API hasn't been initialized");
 		this.idCaptureWasmApi.setIdCaptureModelType(this.pipelineTypeToWasmEnum(pipelineType), this.IdCaptureModelTypeToWasmEnum(modelType));
 	}
+	setIdBarcodeCaptureEnabled(pipelineType, enabled) {
+		this.checkWasmInitialization("Unable to set barcode capture enabled, cpp API hasn't been initialized");
+		this.idCaptureWasmApi.setIdBarcodeCaptureEnabled(this.pipelineTypeToWasmEnum(pipelineType), enabled);
+	}
+	setIdBarcodeAutoCaptureOnDecode(pipelineType, enabled) {
+		this.checkWasmInitialization("Unable to set barcode auto-capture-on-decode, cpp API hasn't been initialized");
+		this.idCaptureWasmApi.setIdBarcodeAutoCaptureOnDecode(this.pipelineTypeToWasmEnum(pipelineType), enabled);
+	}
+	setIdBarcodeDecodedCallback(pipelineType, onBarcodeDecoded) {
+		this.checkWasmInitialization("Unable to set barcode decoded callback, cpp API hasn't been initialized");
+		this.idCaptureWasmApi.setIdBarcodeDecodedCallback(this.pipelineTypeToWasmEnum(pipelineType), onBarcodeDecoded);
+	}
+	async setIdBarcodeEnhancementModel(pipelineType, modelPath) {
+		this.checkWasmInitialization("Unable to set barcode enhancement model, cpp API hasn't been initialized");
+		const buffer = await fetch(modelPath).then((response) => response.arrayBuffer()).then((buf) => new Uint8Array(buf));
+		return this.idCaptureWasmApi.setBarcodeEnhancementModel(this.pipelineTypeToWasmEnum(pipelineType), buffer);
+	}
 	IdPerspectiveTransform(image, frameRect) {
 		this.checkWasmInitialization("Unable to perform perspective transform, cpp API hasn't been initialized");
 		return this.idCaptureWasmApi.IdPerspectiveTransform(image, frameRect);
@@ -689,8 +274,8 @@ var MlWasmJSApi = class MlWasmJSApi {
 			const sizes = new this.wasmModule.VectorInt();
 			for (const path of modelsPaths) {
 				if (!loadedModels.has(path)) {
-					const model$1 = await fetch(path).then((response) => response.arrayBuffer()).then((buffer) => new Uint8Array(buffer));
-					loadedModels.set(path, model$1);
+					const model = await fetch(path).then((response) => response.arrayBuffer()).then((buffer) => new Uint8Array(buffer));
+					loadedModels.set(path, model);
 				}
 				const model = loadedModels.get(path);
 				sizes.push_back(model.byteLength);
@@ -855,48 +440,46 @@ var MlWasmJSApi = class MlWasmJSApi {
 	}
 	pipelineTypeToWasmEnum(type) {
 		switch (type) {
-			case WasmPipelineType.IdBlurGlarePipeline: return this.wasmModule.WorkflowType.IdBlurGlareWorkflow;
-			case WasmPipelineType.IdBarcodeAndTextQualityPipeline: return this.wasmModule.WorkflowType.IdBarcodeAndTextQualityWorkflow;
-			case WasmPipelineType.IdVideoSelfiePipeline: return this.wasmModule.WorkflowType.IdVideoSelfieWorkflow;
-			case WasmPipelineType.SelfieWithAggregationMetrics: return this.wasmModule.WorkflowType.SelfieWithAggregationMetrics;
-			case WasmPipelineType.SelfieWithQualityMetrics: return this.wasmModule.WorkflowType.SelfieWithQualityMetrics;
-			case WasmPipelineType.OnDeviceSelfieWorkflow: return this.wasmModule.WorkflowType.OnDeviceSelfieWorkflow;
+			case 0: return this.wasmModule.WorkflowType.IdBlurGlareWorkflow;
+			case 1: return this.wasmModule.WorkflowType.IdBarcodeAndTextQualityWorkflow;
+			case 2: return this.wasmModule.WorkflowType.IdVideoSelfieWorkflow;
+			case 3: return this.wasmModule.WorkflowType.SelfieWithAggregationMetrics;
+			case 4: return this.wasmModule.WorkflowType.SelfieWithQualityMetrics;
+			case 5: return this.wasmModule.WorkflowType.OnDeviceSelfieWorkflow;
 			default: throw new Error("Unknown pipeline type");
 		}
 	}
 	pipelineTypeFromWasmEnum(type) {
 		switch (type) {
-			case this.wasmModule.WorkflowType.IdBlurGlareWorkflow: return WasmPipelineType.IdBlurGlarePipeline;
-			case this.wasmModule.WorkflowType.IdBarcodeAndTextQualityWorkflow: return WasmPipelineType.IdBarcodeAndTextQualityPipeline;
-			case this.wasmModule.WorkflowType.IdVideoSelfieWorkflow: return WasmPipelineType.IdVideoSelfiePipeline;
-			case this.wasmModule.WorkflowType.SelfieWithAggregationMetrics: return WasmPipelineType.SelfieWithAggregationMetrics;
-			case this.wasmModule.WorkflowType.SelfieWithQualityMetrics: return WasmPipelineType.SelfieWithQualityMetrics;
-			case this.wasmModule.WorkflowType.OnDeviceSelfieWorkflow: return WasmPipelineType.OnDeviceSelfieWorkflow;
+			case this.wasmModule.WorkflowType.IdBlurGlareWorkflow: return 0;
+			case this.wasmModule.WorkflowType.IdBarcodeAndTextQualityWorkflow: return 1;
+			case this.wasmModule.WorkflowType.IdVideoSelfieWorkflow: return 2;
+			case this.wasmModule.WorkflowType.SelfieWithAggregationMetrics: return 3;
+			case this.wasmModule.WorkflowType.SelfieWithQualityMetrics: return 4;
+			case this.wasmModule.WorkflowType.OnDeviceSelfieWorkflow: return 5;
 			default: throw new Error("Unknown pipeline type");
 		}
 	}
 	IdCaptureModelTypeToWasmEnum(type) {
 		switch (type) {
-			case IdCaptureModelType.IdCaptureV1x: return this.wasmModule.IdCaptureModelType.IdCaptureV1x;
-			case IdCaptureModelType.IdCaptureV2x: return this.wasmModule.IdCaptureModelType.IdCaptureV2x;
-			case IdCaptureModelType.IdCaptureV3x: return this.wasmModule.IdCaptureModelType.IdCaptureV3x;
+			case 0: return this.wasmModule.IdCaptureModelType.IdCaptureV1x;
+			case 1: return this.wasmModule.IdCaptureModelType.IdCaptureV2x;
+			case 2: return this.wasmModule.IdCaptureModelType.IdCaptureV3x;
 			default: throw new Error("Unknown Id Capture model type");
 		}
 	}
 	IdCaptureModelTypeFromWasmEnum(type) {
 		switch (type) {
-			case this.wasmModule.IdCaptureModelType.IdCaptureV1x: return IdCaptureModelType.IdCaptureV1x;
-			case this.wasmModule.IdCaptureModelType.IdCaptureV2x: return IdCaptureModelType.IdCaptureV2x;
-			case this.wasmModule.IdCaptureModelType.IdCaptureV3x: return IdCaptureModelType.IdCaptureV3x;
+			case this.wasmModule.IdCaptureModelType.IdCaptureV1x: return 0;
+			case this.wasmModule.IdCaptureModelType.IdCaptureV2x: return 1;
+			case this.wasmModule.IdCaptureModelType.IdCaptureV3x: return 2;
 			default: throw new Error("Unknown Id Capture model type");
 		}
 	}
 	checkWasmInitialization(message) {
 		if (!this.isInitialized()) throw new Error(message);
 	}
-};
-var mlWasmJSApi_default = MlWasmJSApi.getInstance();
-
+}.getInstance();
 //#endregion
 //#region ../infra/src/wasm/warmup.ts
 /**
@@ -942,11 +525,11 @@ let lastConfig = null;
 let pipelinesInFlight = [];
 function mapPipelineToWasmType(pipeline) {
 	switch (pipeline) {
-		case "selfie": return WasmPipelineType.SelfieWithQualityMetrics;
-		case "onDeviceSelfie": return WasmPipelineType.OnDeviceSelfieWorkflow;
-		case "idCapture": return WasmPipelineType.IdBlurGlarePipeline;
-		case "videoSelfie": return WasmPipelineType.SelfieWithAggregationMetrics;
-		case "videoSelfieId": return WasmPipelineType.IdVideoSelfiePipeline;
+		case "selfie": return 4;
+		case "onDeviceSelfie": return 5;
+		case "idCapture": return 0;
+		case "videoSelfie": return 3;
+		case "videoSelfieId": return 2;
 		default: throw new Error(`Unknown pipeline: ${pipeline}`);
 	}
 }
@@ -961,6 +544,17 @@ function deriveModelsBasePath(wasmPath) {
 	return `${wasmPath.substring(0, lastSlashIndex)}/models`;
 }
 /**
+* The models base path resolved from the last successful warmup, mirroring the
+* load-time resolution (explicit `modelsBasePath`, else derived from
+* `wasmPath`). `undefined` before any warmup. Used to locate lazily-loaded
+* models such as the PDF417 barcode enhancement model at the correct base so
+* self-hosted / air-gapped deployments resolve it too.
+*/
+function getResolvedModelsBasePath() {
+	if (!lastConfig) return;
+	return lastConfig.modelsBasePath ?? deriveModelsBasePath(lastConfig.wasmPath);
+}
+/**
 * Builds the pipelines map with model paths for WASM initialization.
 * @param pipelines - Array of pipeline types to initialize
 * @param modelsBasePath - Base path where model files are located
@@ -1017,7 +611,7 @@ async function warmupWasm(config) {
 		if (pipelines.filter((p) => !loadedPipelines.includes(p)).length === 0) return;
 		if (!lastConfig) throw new Error("Cannot add pipelines: original warmup config not available");
 		if (lastConfig.wasmPath !== config.wasmPath || lastConfig.glueCodePath !== config.glueCodePath || (lastConfig.wasmSimdPath ?? lastConfig.wasmPath) !== (config.wasmSimdPath ?? config.wasmPath) || (lastConfig.glueCodeSimdPath ?? "") !== (config.glueCodeSimdPath ?? "") || (lastConfig.useSimd ?? true) !== (config.useSimd ?? true)) throw new Error("Cannot add pipelines: WASM config mismatch. Use same wasmPath, glueCodePath, and useSimd settings.");
-		const combinedPipelines = [...new Set([...loadedPipelines, ...pipelines])];
+		const combinedPipelines = [.../* @__PURE__ */ new Set([...loadedPipelines, ...pipelines])];
 		state = "loading";
 		pipelinesInFlight = combinedPipelines;
 		wasmError = null;
@@ -1117,7 +711,6 @@ function waitForWasm() {
 function setWasmOnDeviceMode(enabled) {
 	mlWasmJSApi_default.setOnDeviceMode(enabled);
 }
-
 //#endregion
 //#region ../infra/src/providers/wasm/BaseWasmProvider.ts
 /**
@@ -1202,7 +795,6 @@ var BaseWasmProvider = class {
 		this._isInitialized = false;
 	}
 };
-
 //#endregion
 //#region ../infra/src/providers/wasm/WasmUtilProvider.ts
 var WasmUtilProvider = class WasmUtilProvider extends BaseWasmProvider {
@@ -1352,6 +944,39 @@ var WasmUtilProvider = class WasmUtilProvider extends BaseWasmProvider {
 		return mlWasmJSApi_default.getVersions();
 	}
 };
-
 //#endregion
-export { mlWasmJSApi_default as a, initializeWasmWebClient as c, WasmPipelineType as d, IdCaptureModelType as f, warmupWasm as i, setWebApiHttpTransport as l, BaseWasmProvider as n, WasmWebClientError as o, deriveSiblingJsPath as p, setWasmOnDeviceMode as r, executeWasmRequest as s, WasmUtilProvider as t, setupWasmConnection as u };
+//#region ../infra/src/storage/safeStorage.ts
+/**
+* Storage resolvers that tolerate hosts which make Web Storage unreachable.
+*
+* Two hostile shapes occur in the field, and they fail differently:
+*
+* 1. **Deleted bare global** — a page mitigates self-XSS with
+*    `delete window.localStorage` and keeps a module-private reference. Since
+*    `window` *is* the global object, the identifier stops resolving: a bare
+*    read throws `ReferenceError`. `typeof` is the only safe probe, because it
+*    is the one operator that tolerates an unresolvable identifier.
+* 2. **Blocked storage** — a webview or a cross-origin/partitioned context
+*    makes the accessor itself throw (`SecurityError`). Here `typeof` is *not*
+*    enough: it invokes the getter, so the throw escapes the guard.
+*
+* Handling only one shape leaves the other live, so always go through these
+* resolvers instead of touching the globals directly. A `null` return means
+* "no storage in this host" — callers degrade, they do not throw.
+*/
+function resolveLocalStorage() {
+	try {
+		return typeof localStorage === "undefined" ? null : localStorage;
+	} catch {
+		return null;
+	}
+}
+function resolveSessionStorage() {
+	try {
+		return typeof sessionStorage === "undefined" ? null : sessionStorage;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { getResolvedModelsBasePath as a, mlWasmJSApi_default as c, BaseWasmProvider as i, resolveSessionStorage as n, setWasmOnDeviceMode as o, WasmUtilProvider as r, warmupWasm as s, resolveLocalStorage as t };