@incodetech/core 2.2.0 → 2.3.0-rc.0

package/dist/{setup-BgoWtvIS.d.ts → setup-Cv-JM9QC.d.ts}

@@ -1,4 +1,4 @@
-import { n as WasmPipeline } from "./warmup-Dv2alr2-.js";
+import { c as WasmPipeline, i as WasmModuleConfig, n as WasmModelsConfig, t as WarmupConfig } from "./warmup-Cis2p6O0.js";
 import { s as TransactionalRiskIntelligenceSetupConfig } from "./index-BKOWUhxG.js";
 import { c as FeatureManagementRedactedUserInfo } from "./IFeatureManagementCapability-De8wpbGh.js";
 //#region src/internal/environment/environment.d.ts
@@ -11,46 +11,33 @@ type EnvironmentTier = 'development' | 'staging' | 'production';
 //#endregion
 //#region src/setup.d.ts
 /**
- * WASM warmup configuration. Path fields are optional; omitted values resolve to the Incode CDN defaults.
+ * WASM setup and warmup configuration.
+ *
+ * Binary and glue fields are optional here. Omitted fields resolve to the
+ * pinned Incode CDN release.
  */
-type WasmConfig = {
+type WasmConfig = Partial<WasmModuleConfig> & WasmModelsConfig & {
   /**
-   * Self-hosted WASM root directory. Resolves standard ml-wasm-kit filenames
-   * under this path (`webLib.wasm`, `webLib.js`, `models/`, etc.). Pin a
-   * specific version folder when self-hosting so SDK updates do not change
-   * which binaries your app loads until you update this path.
+   * Root URL of a self-hosted directory that mirrors the ml-wasm-kit layout.
    *
-   * Example: `https://my-cdn.example.com/ml-wasm-kit-release/v2.13.21`
+   * The SDK resolves both binaries, both glue files, and the `models`
+   * directory under this URL. Individual paths override derived values.
    *
-   * Individual path fields override values derived from `basePath`.
+   * Use a versioned directory when the hosting system retains old releases.
    */
   basePath?: string;
-  /** Path to the WASM binary */
-  wasmPath?: string;
-  /** Path to the SIMD-optimized WASM binary (optional) */
-  wasmSimdPath?: string;
-  /** Path to the WASM glue code (paired with `wasmPath`) */
-  glueCodePath?: string;
   /**
-   * Path to the SIMD-optimized WASM glue code (paired with `wasmSimdPath`).
-   * If omitted, defaults to a sibling `.js` derived from `wasmSimdPath`.
+   * Pipelines to preload during `setup()`.
+   *
+   * The default preloads the standard selfie and ID capture pipelines.
+   * Pipelines that are not listed can still load later when a module needs
+   * them.
    */
-  glueCodeSimdPath?: string;
-  /** Whether to use SIMD optimizations (default: true) */
-  useSimd?: boolean;
-  /** Which pipelines to preload models for */
   pipelines?: WasmPipeline[];
   /**
-   * Base path for ML model files. Models will be loaded from `${modelsBasePath}/${modelFileName}`.
-   * If not provided, models are expected in a 'models' subdirectory relative to the WASM binary.
-   */
-  modelsBasePath?: string;
-  /**
-   * Enables the WASM module's verbose debug logging/console output.
+   * Enables verbose output from the native WASM module.
    *
-   * Defaults to `false` — the SDK forces WASM into production mode, so the
-   * native module stays quiet. Set to `true` only when you need the WASM
-   * diagnostics while debugging.
+   * Defaults to `false`. Enable it only while diagnosing WASM behavior.
    */
   showLogs?: boolean;
 };
@@ -99,19 +86,6 @@ type SetupOptions = {
    * mounting `<incode-flow>`).
    */
   token?: string;
-  /**
-   * Video Selfie module configuration — see {@link VideoSelfieSetupOptions}.
-   *
-   * `videoSelfie.apiURL` points the module's multipart video upload at the
-   * dedicated video-selfie-service (e.g.
-   * `https://video-selfie-service.stage.incodetest.com`).
-   *
-   * **Testing/special-env override only — omit it in production.** When
-   * omitted, the upload endpoints (`/v1/video-upload/*`) resolve against the
-   * main `apiURL` like every other endpoint, and the production service mesh
-   * (Istio) routes them to the video-selfie-service.
-   */
-  videoSelfie?: VideoSelfieSetupOptions;
   /** Custom headers to include in all requests */
   customHeaders?: Record<string, string>;
   /** Request timeout in milliseconds */
@@ -176,7 +150,26 @@ type SetupOptions = {
    *   `setup()` call.
    */
   encryption?: boolean | EncryptionOptions;
-  /** Optional hosting app identifier for fingerprint tracking */
+  /**
+   * Identifies the hosting application in the device-fingerprint record.
+   * Defaults to `'Web SDK'`. The payload has no separate field for the host's
+   * own version, so put your build in this string if you need to report it.
+   *
+   * Intended for Incode-owned host applications, and deliberately left out of
+   * the published integration docs: the field is what separates our own apps
+   * from third-party embeds in that record, so integrators should leave it
+   * unset and let it default.
+   *
+   * Registered client-side rather than consumed once: it becomes the default
+   * `hostingApp` for every later activation, including the internal
+   * `initializeSession` calls made by `<incode-flow>`, `<incode-workflow>` and
+   * standalone modules — those carry a token but no host identity, so without
+   * this they would report the default. An explicit
+   * `initializeSession({ hostingApp })` still wins.
+   *
+   * Sticky across `setup()` calls: a follow-up call that omits it keeps the
+   * value registered by an earlier one. `reset()` clears it.
+   */
   hostingApp?: string;
   /**
    * Disables the third-party public-IP lookup (`api.ipify.org`) used to
@@ -199,11 +192,16 @@ type SetupOptions = {
    * collected during face capture (selfie/authentication/id/personhood) — the
    * descriptive device fields and `webglFingerprint` are unaffected.
    *
-   * When `false`, also enables WASM on-device mode: the native WASM module
-   * skips its own full fingerprint collection and keeps only the
-   * device-detection DTO. Applied immediately and honored by every
-   * subsequent WASM warmup (setup-time or lazy, e.g. triggered later by
-   * `<incode-flow>`/`<incode-workflow>`).
+   * This option controls only the client-side JavaScript collection and
+   * submission path. It does **not** suppress native fingerprint collection:
+   * against the pinned `v2.14.50-post1` runtime, WASM starts collecting during
+   * initialization regardless of this flag, and the full fingerprint bucket is
+   * serialized into the metadata bundle.
+   *
+   * This is a behaviour change from `v2.14.07-post7-post3`, where
+   * `fingerprint: false` additionally disabled native collection through
+   * ml-wasm-kit's `setOnDeviceMode`. That kill switch was never ported to the
+   * v2.14.4x line; restoring it is tracked as ENG-55971.
    *
    * Default: `true` (fingerprint submission enabled).
    */
@@ -330,30 +328,25 @@ type SetupOptions = {
    */
   environment?: EnvironmentTier;
 };
-/**
- * The `videoSelfie` option for {@link SetupOptions}.
- */
-type VideoSelfieSetupOptions = {
-  /**
-   * Base URL (origin) of the dedicated video-selfie-service that handles the
-   * Video Selfie module's multipart video upload. The service authenticates
-   * with the same session token as the main API — no extra credentials
-   * needed. Only the Video Selfie module's recording upload uses this;
-   * nothing else is affected.
-   *
-   * Testing/special-env override: in production the main `apiURL` serves the
-   * upload paths too (the service mesh routes `/v1/video-upload/*` to the
-   * video-selfie-service), so this should normally stay unset. Set it only
-   * where that routing doesn't exist — e.g. stage, or a self-hosted
-   * environment that exposes the service on its own origin.
-   */
-  apiURL?: string;
-};
 /**
  * Object form of the `featureManagement` option for {@link SetupOptions}.
  * The boolean shorthand (`featureManagement: true`) is equivalent to `{}`.
  */
 type FeatureManagementSetupOptions = {
+  /**
+   * Whether `setup()` waits for feature management to finish loading gate and
+   * experiment values before it resolves. Default `false`: `setup()` resolves
+   * as soon as the HTTP client is ready and the values load in the background
+   * (typically 150–250 ms sooner, which a host spends on `createSession` /
+   * mounting `<incode-flow>` instead). Reads made before loading settles
+   * return their documented defaults (`status: 'uninitialized'`); await
+   * `getIsFeatureManagementInitialized()` from
+   * `@incodetech/core/feature-management` when you need a value that early,
+   * or set `true` to restore the blocking behaviour. `<incode-flow>` /
+   * `<incode-workflow>` and the SDK's own modules are unaffected: the identity
+   * update they depend on waits for readiness itself.
+   */
+  awaitInitialization?: boolean;
   /**
    * Integrator-scoped randomization/targeting unit, registered as
    * the `client_experiment_id` custom ID during initialization.
@@ -579,6 +572,7 @@ declare function initializeWasmUtil(config?: WasmConfig): Promise<void>;
  * @param pipelines - The pipelines to ensure are loaded.
  */
 declare function ensureWasmPipelines(pipelines: readonly WasmPipeline[]): Promise<void>;
+declare function resolveWasmConfigForPipelines(pipelines: readonly WasmPipeline[], override?: WasmConfig): WarmupConfig;
 /**
  * Replaces the active HTTP client with the WASM-backed one. Used internally
  * by lazy-loading UI components (`<incode-flow>`, `<incode-workflow>`) when
@@ -605,4 +599,4 @@ declare function isConfigured(): boolean;
  */
 declare function reset(): void;
 //#endregion
-export { isConfigured as a, setup as c, initializeWasmUtil as i, upgradeToWasmHttpClient as l, WasmConfig as n, reset as o, ensureWasmPipelines as r, setWasmConfig as s, SetupOptions as t };
+export { isConfigured as a, setWasmConfig as c, initializeWasmUtil as i, setup as l, WasmConfig as n, reset as o, ensureWasmPipelines as r, resolveWasmConfigForPipelines as s, SetupOptions as t, upgradeToWasmHttpClient as u };

package/dist/{setup-BIAtLa8k.esm.js → setup-msLybMbC.esm.js}

@@ -1,18 +1,156 @@
-import { a as resolveWasmConfig } from "./wasmDefaults-DTUrftxR.esm.js";
-import { o as setWasmOnDeviceMode, r as WasmUtilProvider, s as warmupWasm } from "./safeStorage-Ep56I-f_.esm.js";
-import { t as BrowserStorageProvider } from "./BrowserStorageProvider-k-FDkC4W.esm.js";
+import { f as deriveSiblingJsPath, p as WASM_MODEL_FILES, v as buildModelVariantSources } from "./wasmWebClient-B7baE-Wf.esm.js";
+import { i as setWasmOnDeviceMode, o as warmupWasm } from "./warmup-CUUnwYxe.esm.js";
+import { r as WasmUtilProvider, t as resolveLocalStorage } from "./safeStorage-B-trhxg6.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { C as resetFeatureManagement, D as applyEnvironment, O as getEnvironment, S as optOutFeatureManagement, b as initializeFeatureManagement, c as resetResolvedExperiments, k as resetEnvironment, v as getIsFeatureManagementLocked, w as resetFeatureManagementProviderInstance } from "./feature-management-CPQ4qv3F.esm.js";
+import { C as resetFeatureManagement, D as applyEnvironment, O as getEnvironment, S as optOutFeatureManagement, b as initializeFeatureManagement, c as resetResolvedExperiments, k as resetEnvironment, v as getIsFeatureManagementLocked, w as resetFeatureManagementProviderInstance } from "./feature-management-B0sGlozZ.esm.js";
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
 import { a as resetApi, i as isApiConfigured, n as getApi, r as getToken, s as setHttpRequestObserver, t as api } from "./api-Bx3gKW_y.esm.js";
-import { S as upgradeToWasmHttpClient$1, b as installFreshHttpClient, g as noteTestingSignals, l as trueSightLog, n as initializeTrueSightDiagnostics, o as resetTrueSight, t as finalizeTrueSight, u as categoryForEndpoint, x as resetHttpClientState, y as getStoredHttpConfig } from "./trueSightService---iW2KKJ.esm.js";
-import { b as resetAnalyticsBatcher, c as resetExperimentAssignments, x as setAnalyticsBatcher, y as getAnalyticsBatcher } from "./events-DYiyoSlx.esm.js";
-import { a as resetSessionInit, d as resolveStandaloneFlowPolicy, f as setStandaloneFlowPolicy, i as initializeSession, l as registerFlowPreloader, o as setClientFingerprintEnabled, s as setClientIpLookupEnabled, u as resetStandaloneFlowPolicy, v as BrowserEnvironmentProvider } from "./sessionInitializer-dlfDehHk.esm.js";
-import { t as endpoints } from "./endpoints-CCzL3XD_.esm.js";
-import "./trueSight-B_icM8r2.esm.js";
-import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-B0nFKawG.esm.js";
+import { C as upgradeToWasmHttpClient$1, S as resetHttpClientState, _ as noteTestingSignals, b as getStoredHttpConfig, l as trueSightLog, n as initializeTrueSightDiagnostics, o as resetTrueSight, t as finalizeTrueSight, u as categoryForEndpoint, x as installFreshHttpClient } from "./trueSightService-CKrrfV0Q.esm.js";
+import { b as resetAnalyticsBatcher, c as resetExperimentAssignments, x as setAnalyticsBatcher, y as getAnalyticsBatcher } from "./events-ijlbX_Wx.esm.js";
+import { a as resetSessionInit, b as BrowserEnvironmentProvider, c as setClientIpLookupEnabled, d as registerFlowPreloader, f as resetStandaloneFlowPolicy, i as initializeSession, m as setStandaloneFlowPolicy, o as setClientFingerprintEnabled, p as resolveStandaloneFlowPolicy, s as setClientHostingApp } from "./sessionInitializer-BLoK7SP9.esm.js";
+import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
+import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-DkK-f8JT.esm.js";
 import { a as resetTRI, n as initializeTRI, o as resetTRIProviderInstance } from "./tri-4RsGrIt6.esm.js";
-import { n as preloadDashboardFlow, r as resetDashboardFlowCache } from "./flowServices-f5Ruz7R9.esm.js";
+import { i as resetDashboardFlowCache, r as preloadDashboardFlow } from "./flowServices-B5FwukTQ.esm.js";
+//#region ../infra/src/wasm/wasmDefaults.ts
+const WASM_CDN_BASE_URL = "https://cdn.incodesmile.com/ml-wasm-kit-release";
+/** The WASM version bundled and tested with this SDK release. */
+const DEFAULT_WASM_VERSION = "v2.14.50-post1";
+const PATH_KEYS = [
+	"wasmPath",
+	"wasmSimdPath",
+	"glueCodePath",
+	"glueCodeSimdPath",
+	"modelsBasePath"
+];
+function isBlank(value) {
+	return value.trim() === "";
+}
+function hasDisallowedControlChars(value) {
+	for (let i = 0; i < value.length; i += 1) {
+		const code = value.charCodeAt(i);
+		if (code < 32 || code === 127) return true;
+	}
+	return false;
+}
+function isMalformedPath(value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return false;
+	if (hasDisallowedControlChars(trimmed)) return true;
+	if (/^https?:\/\//i.test(trimmed)) try {
+		new URL(trimmed);
+		return false;
+	} catch {
+		return true;
+	}
+	return false;
+}
+function warnInvalidWasmPath(field, reason) {
+	if (reason === "empty") {
+		console.warn(`[Incode SDK] wasm.${field} is empty. Falling back to CDN default.`);
+		return;
+	}
+	console.warn(`[Incode SDK] wasm.${field} appears malformed. Falling back to CDN default.`);
+}
+function warnMalformedWasmPath(field) {
+	console.warn(`[Incode SDK] wasm.${field} appears malformed. Check the URL or path.`);
+}
+/**
+* Validates merged WASM path strings. When overrides contained blank path
+* values, callers should have already fallen back to defaults before this runs.
+*/
+function validateWasmPaths(config) {
+	for (const key of PATH_KEYS) {
+		const value = config[key];
+		if (typeof value === "string" && isMalformedPath(value)) warnMalformedWasmPath(key);
+	}
+}
+function pickPath(key, overrides, defaultValue) {
+	if (!overrides || !(key in overrides)) return defaultValue;
+	const raw = overrides[key];
+	if (raw === void 0) return defaultValue;
+	if (typeof raw !== "string") return defaultValue;
+	if (isBlank(raw)) {
+		warnInvalidWasmPath(key, "empty");
+		return defaultValue;
+	}
+	if (isMalformedPath(raw)) {
+		warnInvalidWasmPath(key, "malformed");
+		return defaultValue;
+	}
+	return raw.trim();
+}
+function pickSource(key, overrides, defaultValue) {
+	if (!(key in overrides) || overrides[key] === void 0) return defaultValue;
+	const source = overrides[key];
+	if (typeof source !== "string") return source;
+	return pickPath(key, overrides, String(defaultValue));
+}
+function resolveBasePath(overrides) {
+	const defaultValue = `${WASM_CDN_BASE_URL}/${DEFAULT_WASM_VERSION}`;
+	if (!("basePath" in overrides) || overrides.basePath === void 0) return defaultValue;
+	const basePath = overrides.basePath;
+	if (typeof basePath !== "string" || isBlank(basePath) || isMalformedPath(basePath)) throw new Error("[Incode SDK] wasm.basePath is invalid.");
+	return basePath.trim();
+}
+/** Builds a WarmupConfig from a directory that mirrors the ml-wasm-kit CDN layout. */
+function buildWasmConfigFromBasePath(basePath) {
+	const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+	return {
+		wasmPath: `${base}/webLib.wasm`,
+		wasmSimdPath: `${base}/webLibSimd.wasm`,
+		glueCodePath: `${base}/webLib.js`,
+		glueCodeSimdPath: `${base}/webLibSimd.js`,
+		modelsBasePath: `${base}/models`
+	};
+}
+/** Builds the standard WarmupConfig from the Incode CDN. */
+function buildDefaultWasmConfig() {
+	return buildWasmConfigFromBasePath(`${WASM_CDN_BASE_URL}/${DEFAULT_WASM_VERSION}`);
+}
+const BARCODE_ENHANCE_MODEL_FILE = WASM_MODEL_FILES.barcode;
+/**
+* URL of the lazily-loaded PDF417 barcode enhancement model (US Smart Capture).
+* Derived from the resolved `modelsBasePath` so self-hosted / air-gapped
+* deployments resolve it correctly, falling back to the CDN default. Loaded on
+* demand via `IIdCaptureCapability.setBarcodeEnhancementModel` — deliberately
+* NOT part of any warmup model bundle.
+*/
+function getBarcodeEnhanceModelUrl(modelsBasePath, variant = "current") {
+	const source = buildModelVariantSources(modelsBasePath ?? `${WASM_CDN_BASE_URL}/v2.14.50-post1/models`, BARCODE_ENHANCE_MODEL_FILE);
+	return typeof source === "string" ? source : source[variant];
+}
+/**
+* Merges optional WASM path overrides with CDN defaults. Explicit non-blank
+* paths take precedence. Blank override strings log a warning and fall back to defaults.
+*/
+function resolveWasmConfig(overrides) {
+	if (!overrides) return buildDefaultWasmConfig();
+	const defaults = buildWasmConfigFromBasePath(resolveBasePath(overrides));
+	const resolvedWasmPath = pickSource("wasmPath", overrides, defaults.wasmPath);
+	const simdDefault = overrides.selfHosted ? resolvedWasmPath : defaults.wasmSimdPath;
+	const modelsDefault = defaults.modelsBasePath;
+	const resolvedWasmSimdPath = pickSource("wasmSimdPath", overrides, simdDefault);
+	const glueCodeSimdDefault = typeof resolvedWasmSimdPath === "string" ? deriveSiblingJsPath(resolvedWasmSimdPath) : defaults.glueCodeSimdPath;
+	const merged = {
+		wasmPath: resolvedWasmPath,
+		wasmSimdPath: resolvedWasmSimdPath,
+		glueCodePath: pickPath("glueCodePath", overrides, defaults.glueCodePath),
+		glueCodeSimdPath: pickPath("glueCodeSimdPath", overrides, glueCodeSimdDefault),
+		modelsBasePath: pickPath("modelsBasePath", overrides, modelsDefault),
+		useSimd: overrides.useSimd,
+		pipelines: overrides.pipelines,
+		pipelineModels: overrides.pipelineModels,
+		modelUrls: overrides.modelUrls,
+		legacyModelUrls: overrides.legacyModelUrls,
+		loadGlue: overrides.loadGlue,
+		loadGlueSimd: overrides.loadGlueSimd,
+		selfHosted: overrides.selfHosted
+	};
+	validateWasmPaths(merged);
+	return merged;
+}
+//#endregion
 //#region ../infra/src/providers/browser/BrowserPageLifecycleProvider.ts
 var BrowserPageLifecycleProvider = class {
 	sendBeacon(url, body, contentType = "application/json") {
@@ -35,6 +173,71 @@ var BrowserPageLifecycleProvider = class {
 	}
 };
 //#endregion
+//#region ../infra/src/providers/browser/BrowserStorageProvider.ts
+/**
+* Browser-based storage provider wrapping localStorage.
+* Handles JSON serialization/deserialization automatically.
+*
+* Degrades silently when the host makes localStorage unreachable: reads return
+* `null` and writes are no-ops. Deliberately quiet — hosts that harden against
+* self-XSS by deleting the global would otherwise see a warning on every call.
+*/
+var BrowserStorageProvider = class {
+	/**
+	* Retrieves a value from localStorage.
+	* @param key - The storage key
+	* @returns The stored value, or null if not found or storage is unavailable
+	* @throws Error if stored value is invalid JSON
+	*/
+	async get(key) {
+		const storage = resolveLocalStorage();
+		if (!storage) return null;
+		try {
+			const item = storage.getItem(key);
+			if (item === null) return null;
+			return JSON.parse(item);
+		} catch (error) {
+			if (error instanceof SyntaxError) throw new Error(`Invalid JSON stored at key "${key}": ${error.message}`);
+			throw error;
+		}
+	}
+	/**
+	* Stores a value in localStorage. No-op when storage is unavailable.
+	* @param key - The storage key
+	* @param value - The value to store (will be serialized as JSON)
+	* @throws Error if value cannot be serialized or quota is exceeded
+	*/
+	async set(key, value) {
+		const storage = resolveLocalStorage();
+		if (!storage) return;
+		try {
+			const serialized = JSON.stringify(value);
+			storage.setItem(key, serialized);
+		} catch (error) {
+			if ((error instanceof DOMException || error.name === "QuotaExceededError") && error.name === "QuotaExceededError") throw new Error(`Storage quota exceeded for key "${key}"`);
+			if (error instanceof TypeError) throw new Error(`Failed to serialize value for key "${key}": ${error.message}`);
+			throw error;
+		}
+	}
+	/**
+	* Removes a value from localStorage. No-op when storage is unavailable.
+	* @param key - The storage key to remove
+	*/
+	async remove(key) {
+		const storage = resolveLocalStorage();
+		if (!storage) return;
+		storage.removeItem(key);
+	}
+	/**
+	* Clears all values from localStorage. No-op when storage is unavailable.
+	*/
+	async clear() {
+		const storage = resolveLocalStorage();
+		if (!storage) return;
+		storage.clear();
+	}
+};
+//#endregion
 //#region src/internal/events/AnalyticsBatchingService.ts
 const DEFAULT_MAX_BATCH_SIZE = 50;
 const DEFAULT_MAX_BATCH_AGE_MS = 1e3;
@@ -149,87 +352,6 @@ function createAnalyticsBatchingService(options) {
 	};
 }
 //#endregion
-//#region src/internal/recordings/videoSelfieUploadService.ts
-/**
-* Origin of the dedicated video-selfie-service (e.g.
-* `https://video-selfie-service.stage.incodetest.com`), set from
-* `setup({ videoSelfie: { apiURL } })`. Testing/special-env override: when
-* unset (production), the upload endpoints resolve against the main `apiURL`
-* and the service mesh (Istio) routes them to the service. The service
-* accepts the same session token; the shared `api` client attaches it either
-* way.
-*/
-let serviceBaseUrl = null;
-function setVideoSelfieServiceUrl(url) {
-	let trimmed = url ?? "";
-	while (trimmed.endsWith("/")) trimmed = trimmed.slice(0, -1);
-	serviceBaseUrl = trimmed || null;
-}
-function uploadUrl(path) {
-	return serviceBaseUrl ? `${serviceBaseUrl}${path}` : path;
-}
-/**
-* Opens a multipart video-selfie upload session. Idempotent server-side: if
-* an upload is already in progress for the session, the same `uploadId`
-* comes back along with the parts already stored (`parts` non-empty) — but
-* always with a fresh `epoch` that locks out whoever held the previous one.
-*/
-async function initiateVideoSelfieUpload() {
-	const response = await api.post(uploadUrl(endpoints.videoSelfieUploadInitiate));
-	return {
-		uploadId: response.data.uploadId,
-		epoch: response.data.epoch,
-		parts: response.data.parts ?? []
-	};
-}
-/**
-* Uploads a single chunk as a multipart part. The body is the raw video bytes
-* (no base64, no client-side encryption — encryption at rest is server-side
-* S3 SSE). Every part except the last must be >= 5 MiB (enforced
-* server-side). Returns the part number + `etag` needed to complete the
-* upload. Rejects with a `409` status when a newer initiate fenced this
-* session out.
-*/
-async function uploadVideoSelfiePart(session, partNumber, chunk) {
-	const response = await api.post(uploadUrl(endpoints.videoSelfieUploadPart), chunk, {
-		query: {
-			uploadId: session.uploadId,
-			epoch: session.epoch,
-			partNumber
-		},
-		headers: { "Content-Type": "application/octet-stream" }
-	});
-	return {
-		partNumber: response.data.partNumber,
-		etag: response.data.etag
-	};
-}
-/**
-* Finalizes the upload. The service assembles from the parts it stored; the
-* optional `parts` list is deliberately NOT sent — chunks staged below the
-* S3 minimum are combined and renumbered server-side, so a client-side list
-* could contradict the authoritative one. Safe to repeat if the response
-* was lost. Returns the server-reported status. Rejects with `400` naming a
-* missing part when the sequence has a hole.
-*/
-async function completeVideoSelfieUpload(session) {
-	return (await api.post(uploadUrl(endpoints.videoSelfieUploadComplete), {
-		uploadId: session.uploadId,
-		epoch: session.epoch
-	})).data.status;
-}
-/**
-* Discards an in-progress upload and everything already sent for it, so the
-* backend fails the upload straight away instead of waiting for its expiry.
-* Call when a recording is abandoned or its upload can no longer complete.
-*/
-async function abortVideoSelfieUpload(session) {
-	return (await api.post(uploadUrl(endpoints.videoSelfieUploadAbort), {
-		uploadId: session.uploadId,
-		epoch: session.epoch
-	})).data.status;
-}
-//#endregion
 //#region ../infra/src/providers/browser/DevtoolsDetectorProvider.ts
 var DevtoolsDetectorProvider = class {
 	constructor() {
@@ -552,11 +674,11 @@ async function setup(options) {
 	setStandaloneFlowPolicy(standaloneFlowPolicy);
 	registerFlowPreloader(preloadDashboardFlow);
 	if (options.ipLookup !== void 0) setClientIpLookupEnabled(options.ipLookup);
+	if (options.hostingApp !== void 0) setClientHostingApp(options.hostingApp);
 	if (options.fingerprint !== void 0) {
 		setClientFingerprintEnabled(options.fingerprint);
 		setWasmOnDeviceMode(options.fingerprint === false);
 	}
-	if (options.videoSelfie?.apiURL !== void 0) setVideoSelfieServiceUrl(options.videoSelfie.apiURL);
 	if (!getAnalyticsBatcher()) setAnalyticsBatcher(createAnalyticsBatchingService({
 		endpoint: endpoints.events,
 		authToken: () => getToken(),
@@ -595,10 +717,7 @@ async function setup(options) {
 		throw error;
 	}
 	if (options.token && isApiConfigured()) {
-		const sessionOptions = {
-			token: options.token,
-			hostingApp: options.hostingApp
-		};
+		const sessionOptions = { token: options.token };
 		if (shouldPreloadFlow) sessionOptions.preloadFlow = true;
 		const sessionPromise = initializeSession(sessionOptions);
 		if (shouldPreloadFlow) await sessionPromise;
@@ -633,7 +752,7 @@ async function setup(options) {
 	if (!getIsFeatureManagementLocked()) if (options.featureManagement === false) optOutFeatureManagement();
 	else {
 		const featureManagementSetupOptions = typeof options.featureManagement === "object" ? options.featureManagement : {};
-		await initializeFeatureManagement({
+		const featureManagementReady = initializeFeatureManagement({
 			environment: getEnvironment(),
 			clientExperimentId: featureManagementSetupOptions.clientExperimentId,
 			disableStableId: featureManagementSetupOptions.disableStableId,
@@ -642,6 +761,7 @@ async function setup(options) {
 			appVersion: featureManagementSetupOptions.appVersion,
 			redactedUserInfo: featureManagementSetupOptions.redactedUserInfo
 		});
+		if (featureManagementSetupOptions.awaitInitialization === true) await featureManagementReady;
 	}
 	else if (options.featureManagement !== void 0) console.error("[FeatureManagement] Feature management is locked after the first setup() call and cannot be changed (re-enabled, disabled, or reconfigured). Ignoring this change. Call reset() before changing it.");
 	if (options.tri) await initializeTRI(options.tri, { sessionToken: options.token });
@@ -691,6 +811,12 @@ async function ensureWasmPipelines(pipelines) {
 		pipelines: [...pipelines]
 	});
 }
+function resolveWasmConfigForPipelines(pipelines, override) {
+	return resolveWasmConfig({
+		...override ?? wasmConfig ?? {},
+		pipelines: [...pipelines]
+	});
+}
 /**
 * Replaces the active HTTP client with the WASM-backed one. Used internally
 * by lazy-loading UI components (`<incode-flow>`, `<incode-workflow>`) when
@@ -731,8 +857,8 @@ function reset() {
 	resetStandaloneFlowPolicy();
 	setClientIpLookupEnabled(true);
 	setClientFingerprintEnabled(true);
+	setClientHostingApp(void 0);
 	setWasmOnDeviceMode(false);
-	setVideoSelfieServiceUrl(null);
 	resetAnalyticsBatcher();
 	resetExperimentAssignments();
 	resetResolvedExperiments();
@@ -748,4 +874,4 @@ function reset() {
 	resetTrueSight();
 }
 //#endregion
-export { setWasmConfig as a, abortVideoSelfieUpload as c, uploadVideoSelfiePart as d, reset as i, completeVideoSelfieUpload as l, initializeWasmUtil as n, setup as o, isConfigured as r, upgradeToWasmHttpClient as s, ensureWasmPipelines as t, initiateVideoSelfieUpload as u };
+export { resolveWasmConfigForPipelines as a, upgradeToWasmHttpClient as c, buildDefaultWasmConfig as d, buildWasmConfigFromBasePath as f, reset as i, BrowserStorageProvider as l, resolveWasmConfig as m, initializeWasmUtil as n, setWasmConfig as o, getBarcodeEnhanceModelUrl as p, isConfigured as r, setup as s, ensureWasmPipelines as t, DEFAULT_WASM_VERSION as u };

package/dist/signature.esm.js

@@ -1,3 +1,3 @@
-import { t as signatureMachine } from "./signatureStateMachine-K1LMRrxG.esm.js";
-import { n as createSignatureManagerFromActor, t as createSignatureManager } from "./signatureManager-Ca43yhwk.esm.js";
+import { t as signatureMachine } from "./signatureStateMachine-BHPwkJZS.esm.js";
+import { n as createSignatureManagerFromActor, t as createSignatureManager } from "./signatureManager-ChsB-nMD.esm.js";
 export { createSignatureManager, createSignatureManagerFromActor, signatureMachine };

package/dist/{signatureManager-Ca43yhwk.esm.js → signatureManager-ChsB-nMD.esm.js}

@@ -1,7 +1,7 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-DYiyoSlx.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-ijlbX_Wx.esm.js";
 import { t as topLevelStateName } from "./topLevelStateName-B5i2avbh.esm.js";
 import { s as createActor, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
-import { t as signatureMachine } from "./signatureStateMachine-K1LMRrxG.esm.js";
+import { t as signatureMachine } from "./signatureStateMachine-BHPwkJZS.esm.js";
 //#region src/modules/signature/signatureActor.ts
 function createSignatureActor(options) {
 	return createActor(signatureMachine, { input: { config: options.config } }).start();

package/dist/{signatureStateMachine-K1LMRrxG.esm.js → signatureStateMachine-BHPwkJZS.esm.js}

@@ -1,5 +1,5 @@
 import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-CCzL3XD_.esm.js";
+import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
 import { i as assign, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
 //#region src/modules/signature/signatureServices.ts

package/dist/{src-0Jurt29N.esm.js → src-35ekGRzK.esm.js}

@@ -1,4 +1,4 @@
-import { t as __commonJSMin } from "./rolldown-runtime-FZ4Itg2g.esm.js";
+import { t as __commonJSMin } from "./rolldown-runtime-FDOR9p9I.esm.js";
 //#region ../../node_modules/.pnpm/@statsig+client-core@3.33.3/node_modules/@statsig/client-core/src/Log.js
 var require_Log = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/{stats-B0nFKawG.esm.js → stats-DkK-f8JT.esm.js}

@@ -1,5 +1,5 @@
 import { r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-CCzL3XD_.esm.js";
+import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
 //#region src/modules/stats/statsServices.ts
 const deviceStatsQueue = [];
 async function postDeviceStatsNow(stats) {

package/dist/stats.esm.js

@@ -1,2 +1,2 @@
-import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-B0nFKawG.esm.js";
+import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-DkK-f8JT.esm.js";
 export { addDeviceStats, flushDeviceStatsQueue, resetDeviceStatsQueue };