@incodetech/core 2.3.2-rc.4 → 2.4.0-rc.0

package/dist/{setup-DmB0JHAB.esm.js → setup-C38QkrSP.esm.js}

@@ -1,105 +1,21 @@
-import { D as resolveWasmConfig, S as upgradeToWasmHttpClient$1, b as installFreshHttpClient, l as trueSightLog, o as resetTrueSight, t as finalizeTrueSight, x as resetHttpClientState, y as getStoredHttpConfig } from "./trueSightService-oMFESSSb.esm.js";
-import { i as setWasmOnDeviceMode, o as warmupWasm } from "./warmup-ChDwHSel.esm.js";
-import { r as WasmUtilProvider, t as resolveLocalStorage } from "./safeStorage-BdU9_m2E.esm.js";
-import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { C as resetFeatureManagement, D as applyEnvironment, O as getEnvironment, S as optOutFeatureManagement, b as initializeFeatureManagement, c as resetResolvedExperiments, k as resetEnvironment, v as getIsFeatureManagementLocked, w as resetFeatureManagementProviderInstance } from "./feature-management-zY6FcYx_.esm.js";
+import { S as setWasmIntegrityObserver } from "./wasmWebClient-kbYZ2sxw.esm.js";
+import { D as resolveWasmConfig, d as getStoredHttpConfig, f as installFreshHttpClient, l as trueSightLog, m as upgradeToWasmHttpClient$1, o as resetTrueSight, p as resetHttpClientState, t as finalizeTrueSight } from "./trueSightService-BWgRVGIT.esm.js";
+import { i as setWasmOnDeviceMode, o as warmupWasm } from "./warmup-DMtbyb2l.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-CIdnE7Fx.esm.js";
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
+import { b as resetAnalyticsBatcher, c as resetExperimentAssignments, x as setAnalyticsBatcher, y as getAnalyticsBatcher } from "./events-CAgFE-k3.esm.js";
 import { a as resetApi, i as isApiConfigured, n as getApi, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { b as resetAnalyticsBatcher, c as resetExperimentAssignments, x as setAnalyticsBatcher, y as getAnalyticsBatcher } from "./events-ijlbX_Wx.esm.js";
-import { a as resetSessionInit, c as setClientIpLookupEnabled, d as registerFlowPreloader, f as resetStandaloneFlowPolicy, i as initializeSession, m as setStandaloneFlowPolicy, o as setClientFingerprintEnabled, p as resolveStandaloneFlowPolicy, s as setClientHostingApp } from "./sessionInitializer-Ce9zO78j.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-CZcy2J53.esm.js";
+import { t as endpoints } from "./endpoints-DHzlkQNe.esm.js";
+import { a as resetSessionInit, c as setClientIpLookupEnabled, d as registerFlowPreloader, f as resetStandaloneFlowPolicy, i as initializeSession, m as setStandaloneFlowPolicy, o as setClientFingerprintEnabled, p as resolveStandaloneFlowPolicy, s as setClientHostingApp, x as fingerprintSignalsReporter } from "./sessionInitializer-jxbfCnE-.esm.js";
+import { t as resolveLocalStorage } from "./safeStorage-UxDrnjwa.esm.js";
+import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
+import { C as resetFeatureManagement, D as applyEnvironment, O as getEnvironment, S as optOutFeatureManagement, b as initializeFeatureManagement, c as resetResolvedExperiments, k as resetEnvironment, v as getIsFeatureManagementLocked, w as resetFeatureManagementProviderInstance } from "./feature-management-BTbYruNe.esm.js";
+import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-DmG_tkGk.esm.js";
 import { a as resetTRI, n as initializeTRI, o as resetTRIProviderInstance } from "./tri-xzRLIIMN.esm.js";
-import { i as resetDashboardFlowCache, r as preloadDashboardFlow } from "./flowServices-JW6uRaUt.esm.js";
-//#region ../infra/src/providers/browser/BrowserPageLifecycleProvider.ts
-var BrowserPageLifecycleProvider = class {
-	sendBeacon(url, body, contentType = "application/json") {
-		if (typeof navigator === "undefined" || typeof navigator.sendBeacon !== "function") return false;
-		const blob = new Blob([body], { type: contentType });
-		return navigator.sendBeacon(url, blob);
-	}
-	onPageHide(listener) {
-		const onVisibilityChange = () => {
-			if (document.visibilityState === "hidden") listener();
-		};
-		document.addEventListener("visibilitychange", onVisibilityChange);
-		window.addEventListener("pagehide", listener);
-		window.addEventListener("beforeunload", listener);
-		return () => {
-			document.removeEventListener("visibilitychange", onVisibilityChange);
-			window.removeEventListener("pagehide", listener);
-			window.removeEventListener("beforeunload", listener);
-		};
-	}
-};
-//#endregion
-//#region ../infra/src/providers/browser/BrowserStorageProvider.ts
-/**
-* Browser-based storage provider wrapping localStorage.
-* Handles JSON serialization/deserialization automatically.
-*
-* Degrades silently when the host makes localStorage unreachable: reads return
-* `null` and writes are no-ops. Deliberately quiet — hosts that harden against
-* self-XSS by deleting the global would otherwise see a warning on every call.
-*/
-var BrowserStorageProvider = class {
-	/**
-	* Retrieves a value from localStorage.
-	* @param key - The storage key
-	* @returns The stored value, or null if not found or storage is unavailable
-	* @throws Error if stored value is invalid JSON
-	*/
-	async get(key) {
-		const storage = resolveLocalStorage();
-		if (!storage) return null;
-		try {
-			const item = storage.getItem(key);
-			if (item === null) return null;
-			return JSON.parse(item);
-		} catch (error) {
-			if (error instanceof SyntaxError) throw new Error(`Invalid JSON stored at key "${key}": ${error.message}`);
-			throw error;
-		}
-	}
-	/**
-	* Stores a value in localStorage. No-op when storage is unavailable.
-	* @param key - The storage key
-	* @param value - The value to store (will be serialized as JSON)
-	* @throws Error if value cannot be serialized or quota is exceeded
-	*/
-	async set(key, value) {
-		const storage = resolveLocalStorage();
-		if (!storage) return;
-		try {
-			const serialized = JSON.stringify(value);
-			storage.setItem(key, serialized);
-		} catch (error) {
-			if ((error instanceof DOMException || error.name === "QuotaExceededError") && error.name === "QuotaExceededError") throw new Error(`Storage quota exceeded for key "${key}"`);
-			if (error instanceof TypeError) throw new Error(`Failed to serialize value for key "${key}": ${error.message}`);
-			throw error;
-		}
-	}
-	/**
-	* Removes a value from localStorage. No-op when storage is unavailable.
-	* @param key - The storage key to remove
-	*/
-	async remove(key) {
-		const storage = resolveLocalStorage();
-		if (!storage) return;
-		storage.removeItem(key);
-	}
-	/**
-	* Clears all values from localStorage. No-op when storage is unavailable.
-	*/
-	async clear() {
-		const storage = resolveLocalStorage();
-		if (!storage) return;
-		storage.clear();
-	}
-};
-//#endregion
+import { i as resetDashboardFlowCache, r as preloadDashboardFlow } from "./flowServices-DA64AEZC.esm.js";
 //#region src/internal/events/AnalyticsBatchingService.ts
 const DEFAULT_MAX_BATCH_SIZE = 50;
+const MAX_STATE_BATCH_SIZE = 50;
 const DEFAULT_MAX_BATCH_AGE_MS = 1e3;
 const DEFAULT_MAX_RETRIES = 2;
 const RETRY_BASE_DELAY_MS = 250;
@@ -109,6 +25,10 @@ function isTransientStatus(status) {
 function createAnalyticsBatchingService(options) {
 	const { endpoint, authToken, pageLifecycle, timer, apiBaseUrl, apiClient = api, maxBatchSize = DEFAULT_MAX_BATCH_SIZE, maxBatchAgeMs = DEFAULT_MAX_BATCH_AGE_MS, maxRetries = DEFAULT_MAX_RETRIES } = options;
 	let buffer = [];
+	let stateBuffer = [];
+	let stateToken = null;
+	let stateBatches = [];
+	let stateRequestInFlight = false;
 	let started = false;
 	let disposed = false;
 	let ageTimerHandle = null;
@@ -163,16 +83,46 @@ function createAnalyticsBatchingService(options) {
 		}
 		sendBatch(batch, 0);
 	}
-	function handlePageHide() {
-		if (disposed || buffer.length === 0) return;
-		const batch = buffer;
-		buffer = [];
-		clearAgeTimer();
+	function syncStateToken() {
 		const token = authToken();
-		if (!token) {
-			dropTokenless();
-			return;
+		if (token !== stateToken) {
+			stateBuffer = [];
+			stateBatches = [];
+			stateToken = token;
 		}
+		return token;
+	}
+	function sendNextStateBatch() {
+		if (disposed || !started || stateRequestInFlight || stateBatches.length === 0) return;
+		const token = syncStateToken();
+		const batch = stateBatches.shift();
+		if (!batch || !token) return;
+		stateRequestInFlight = true;
+		const onSettled = () => {
+			stateRequestInFlight = false;
+			sendNextStateBatch();
+		};
+		try {
+			apiClient.post(endpoint, batch.events, {
+				keepalive: true,
+				headers: { "X-Incode-Hardware-Id": batch.token }
+			}).then(onSettled, onSettled);
+		} catch {
+			Promise.resolve().then(onSettled);
+		}
+	}
+	function flushStateChanges() {
+		if (disposed) return;
+		const token = syncStateToken();
+		if (!token || stateBuffer.length === 0) return;
+		stateBatches.push({
+			events: stateBuffer,
+			token
+		});
+		stateBuffer = [];
+		sendNextStateBatch();
+	}
+	function sendBeacon(batch, token) {
 		const url = `${apiBaseUrl().replace(/\/$/, "")}${endpoint}`;
 		const body = JSON.stringify({
 			token,
@@ -180,9 +130,37 @@ function createAnalyticsBatchingService(options) {
 		});
 		pageLifecycle.sendBeacon(url, body);
 	}
+	function handlePageHide() {
+		if (disposed) return;
+		const token = syncStateToken();
+		const pendingStates = stateBatches;
+		stateBatches = [];
+		if (token && stateBuffer.length > 0) pendingStates.push({
+			events: stateBuffer,
+			token
+		});
+		stateBuffer = [];
+		for (const batch of pendingStates) sendBeacon(batch.events, batch.token);
+		if (buffer.length === 0) return;
+		const batch = buffer;
+		buffer = [];
+		clearAgeTimer();
+		if (!token) {
+			dropTokenless();
+			return;
+		}
+		sendBeacon(batch, token);
+	}
 	function enqueue(entry) {
 		if (disposed) return;
+		if (entry.code === "stateChanged") {
+			if (!syncStateToken()) return;
+			stateBuffer.push(entry);
+			if (stateBuffer.length === MAX_STATE_BATCH_SIZE) flushStateChanges();
+			return;
+		}
 		buffer.push(entry);
+		if (entry.code === "captureAttemptFinished" || entry.code === "moduleClosed" || entry.code === "errorTriggered" || entry.code === "background") flushStateChanges();
 		if (!started) return;
 		if (buffer.length >= maxBatchSize) {
 			flush();
@@ -195,6 +173,7 @@ function createAnalyticsBatchingService(options) {
 		started = true;
 		unsubscribeLifecycle = pageLifecycle.onPageHide(handlePageHide);
 		if (buffer.length > 0) flush();
+		sendNextStateBatch();
 	}
 	function dispose() {
 		if (disposed) return;
@@ -203,15 +182,106 @@ function createAnalyticsBatchingService(options) {
 		unsubscribeLifecycle?.();
 		unsubscribeLifecycle = null;
 		buffer = [];
+		stateBuffer = [];
+		stateBatches = [];
+		stateToken = null;
 	}
 	return {
 		enqueue,
 		start,
 		flush,
+		flushStateChanges,
 		dispose
 	};
 }
 //#endregion
+//#region ../infra/src/providers/browser/BrowserPageLifecycleProvider.ts
+var BrowserPageLifecycleProvider = class {
+	sendBeacon(url, body, contentType = "application/json") {
+		if (typeof navigator === "undefined" || typeof navigator.sendBeacon !== "function") return false;
+		const blob = new Blob([body], { type: contentType });
+		return navigator.sendBeacon(url, blob);
+	}
+	onPageHide(listener) {
+		const onVisibilityChange = () => {
+			if (document.visibilityState === "hidden") listener();
+		};
+		document.addEventListener("visibilitychange", onVisibilityChange);
+		window.addEventListener("pagehide", listener);
+		window.addEventListener("beforeunload", listener);
+		return () => {
+			document.removeEventListener("visibilitychange", onVisibilityChange);
+			window.removeEventListener("pagehide", listener);
+			window.removeEventListener("beforeunload", listener);
+		};
+	}
+};
+//#endregion
+//#region ../infra/src/providers/browser/BrowserStorageProvider.ts
+/**
+* Browser-based storage provider wrapping localStorage.
+* Handles JSON serialization/deserialization automatically.
+*
+* Degrades silently when the host makes localStorage unreachable: reads return
+* `null` and writes are no-ops. Deliberately quiet — hosts that harden against
+* self-XSS by deleting the global would otherwise see a warning on every call.
+*/
+var BrowserStorageProvider = class {
+	/**
+	* Retrieves a value from localStorage.
+	* @param key - The storage key
+	* @returns The stored value, or null if not found or storage is unavailable
+	* @throws Error if stored value is invalid JSON
+	*/
+	async get(key) {
+		const storage = resolveLocalStorage();
+		if (!storage) return null;
+		try {
+			const item = storage.getItem(key);
+			if (item === null) return null;
+			return JSON.parse(item);
+		} catch (error) {
+			if (error instanceof SyntaxError) throw new Error(`Invalid JSON stored at key "${key}": ${error.message}`);
+			throw error;
+		}
+	}
+	/**
+	* Stores a value in localStorage. No-op when storage is unavailable.
+	* @param key - The storage key
+	* @param value - The value to store (will be serialized as JSON)
+	* @throws Error if value cannot be serialized or quota is exceeded
+	*/
+	async set(key, value) {
+		const storage = resolveLocalStorage();
+		if (!storage) return;
+		try {
+			const serialized = JSON.stringify(value);
+			storage.setItem(key, serialized);
+		} catch (error) {
+			if ((error instanceof DOMException || error.name === "QuotaExceededError") && error.name === "QuotaExceededError") throw new Error(`Storage quota exceeded for key "${key}"`);
+			if (error instanceof TypeError) throw new Error(`Failed to serialize value for key "${key}": ${error.message}`);
+			throw error;
+		}
+	}
+	/**
+	* Removes a value from localStorage. No-op when storage is unavailable.
+	* @param key - The storage key to remove
+	*/
+	async remove(key) {
+		const storage = resolveLocalStorage();
+		if (!storage) return;
+		storage.removeItem(key);
+	}
+	/**
+	* Clears all values from localStorage. No-op when storage is unavailable.
+	*/
+	async clear() {
+		const storage = resolveLocalStorage();
+		if (!storage) return;
+		storage.clear();
+	}
+};
+//#endregion
 //#region ../infra/src/providers/browser/DevtoolsDetectorProvider.ts
 var DevtoolsDetectorProvider = class {
 	constructor() {
@@ -324,6 +394,52 @@ function stopDevtoolsDetector() {
 	devtoolsDetector.stop();
 }
 //#endregion
+//#region src/modules/id/deviceWallet/deviceWalletSettings.ts
+/**
+* Client-side device-wallet settings registered by `setup()`. Kept in a
+* dependency-free module so `setup()` doesn't pull the wallet services into
+* the main bundle.
+*/
+let googleSignedRequests = true;
+/** Whether the Google Wallet request is fetched with `signedSupported=true`. */
+function setGoogleWalletSignedRequests(enabled) {
+	googleSignedRequests = enabled;
+}
+function isGoogleWalletSignedRequestsEnabled() {
+	return googleSignedRequests;
+}
+//#endregion
+//#region src/internal/wasmIntegrity/wasmIntegrityTelemetry.ts
+const TRUESIGHT_SUBSYSTEM = "wasm.integrity";
+function describeCheck(check) {
+	const parts = [`asset=${check.asset}`, `status=${check.status}`];
+	if (check.byteLength !== void 0) parts.push(`bytes=${check.byteLength}`);
+	if (check.durationMs !== void 0) parts.push(`durationMs=${Math.round(check.durationMs)}`);
+	if (check.expectedDigestPrefix !== void 0) parts.push(`expected=${check.expectedDigestPrefix}`);
+	if (check.actualDigestPrefix !== void 0) parts.push(`actual=${check.actualDigestPrefix}`);
+	return parts.join(" ");
+}
+function onAssetChecked(check) {
+	const accepted = check.status === "verified" || check.status === "bundled";
+	trueSightLog(accepted ? "debug" : "severe", TRUESIGHT_SUBSYSTEM, "other", `wasm asset ${accepted ? "checked" : "rejected"} ${describeCheck(check)}`);
+}
+function onSummary(summary) {
+	trueSightLog(summary.failed > 0 ? "error" : "debug", TRUESIGHT_SUBSYSTEM, "other", `wasm integrity summary version=${summary.wasmVersion} verified=${summary.verified} failed=${summary.failed} bundled=${summary.bundled} hashMs=${summary.hashMs}`);
+}
+/**
+* Maps infra's WASM integrity results to TrueSight lines. Nothing carries URLs
+* or asset bytes.
+*
+* Deliberately not sent to the analytics event log: `/omni/interview-events`
+* accepts only allowlisted codes and rejects a whole batch with
+* `Illegal event code` for an unknown one, which would also drop every event
+* batched alongside it. Add an event here only once the backend accepts its code.
+*/
+const wasmIntegrityTelemetry = {
+	onAssetChecked,
+	onSummary
+};
+//#endregion
 //#region src/setup.ts
 let wasmConfig;
 /**
@@ -395,12 +511,12 @@ let configured = false;
 * });
 * ```
 *
-* @example Self-hosted WASM (pin a version folder on your CDN)
+* @example Self-hosted WASM (the release-matched files, unmodified, on your CDN)
 * ```ts
 * await setup({
 *   apiURL: 'https://api.incode.com',
 *   wasm: {
-*     basePath: 'https://my-cdn.example.com/ml-wasm-kit-release/v2.13.21',
+*     basePath: 'https://my-cdn.example.com/incode-wasm',
 *   },
 * });
 * ```
@@ -496,6 +612,7 @@ async function setup(options) {
 	setStandaloneFlowPolicy(standaloneFlowPolicy);
 	registerFlowPreloader(preloadDashboardFlow);
 	if (options.ipLookup !== void 0) setClientIpLookupEnabled(options.ipLookup);
+	if (options.deviceWallet?.googleSignedRequests !== void 0) setGoogleWalletSignedRequests(options.deviceWallet.googleSignedRequests);
 	if (options.hostingApp !== void 0) setClientHostingApp(options.hostingApp);
 	if (options.fingerprint !== void 0) {
 		setClientFingerprintEnabled(options.fingerprint);
@@ -509,6 +626,7 @@ async function setup(options) {
 		pageLifecycle: new BrowserPageLifecycleProvider(),
 		timer: BrowserTimerProvider.getInstance()
 	}));
+	setWasmIntegrityObserver(wasmIntegrityTelemetry);
 	const requestedEncryption = normalizeEncryption(options.encryption);
 	const stored = getStoredHttpConfig();
 	if (requestedEncryption && stored) {
@@ -550,13 +668,11 @@ async function setup(options) {
 			throw error;
 		}
 		trueSightLog("debug", "wasm", "other", `wasm warmup completed durationMs=${getTimestamp() - warmupStartedAt}`);
-		const provider = await WasmUtilProvider.getInstance();
-		await provider.initialize({
+		await (await WasmUtilProvider.getInstance()).initialize({
 			...effectiveWasm,
 			pipelines: effectiveWasm.pipelines ? [...effectiveWasm.pipelines] : void 0
 		});
-		const showWasmLogs = typeof options.wasm === "object" && options.wasm.showLogs === true;
-		await provider.setProductionMode(!showWasmLogs);
+		fingerprintSignalsReporter.onWasmReady();
 		if (!options.devMode) startDevtoolsDetector();
 	}
 	if (!getIsFeatureManagementLocked()) if (options.featureManagement === false) optOutFeatureManagement();
@@ -602,6 +718,7 @@ async function initializeWasmUtil(config) {
 		...resolved,
 		pipelines: resolved.pipelines ? [...resolved.pipelines] : void 0
 	});
+	fingerprintSignalsReporter.onWasmReady();
 	await upgradeToWasmHttpClient$1(resolved);
 }
 /**
@@ -665,9 +782,11 @@ function reset() {
 	resetDeviceStatsQueue();
 	resetApi();
 	resetSessionInit();
+	fingerprintSignalsReporter.reset();
 	resetDashboardFlowCache();
 	resetStandaloneFlowPolicy();
 	setClientIpLookupEnabled(true);
+	setGoogleWalletSignedRequests(true);
 	setClientFingerprintEnabled(true);
 	setClientHostingApp(void 0);
 	setWasmOnDeviceMode(false);
@@ -675,6 +794,7 @@ function reset() {
 	resetExperimentAssignments();
 	resetResolvedExperiments();
 	resetHttpClientState();
+	setWasmIntegrityObserver(null);
 	resetTRI();
 	configured = false;
 	wasmConfig = void 0;
@@ -686,4 +806,4 @@ function reset() {
 	resetTrueSight();
 }
 //#endregion
-export { resolveWasmConfigForPipelines as a, upgradeToWasmHttpClient as c, reset as i, BrowserStorageProvider as l, initializeWasmUtil as n, setWasmConfig as o, isConfigured as r, setup as s, ensureWasmPipelines as t };
+export { resolveWasmConfigForPipelines as a, upgradeToWasmHttpClient as c, reset as i, isGoogleWalletSignedRequestsEnabled as l, initializeWasmUtil as n, setWasmConfig as o, isConfigured as r, setup as s, ensureWasmPipelines as t, BrowserStorageProvider as u };

package/dist/{setup-Cyko6cAn.d.ts → setup-lgkQ8dJW.d.ts}

@@ -1,4 +1,4 @@
-import { c as WasmPipeline, i as WasmModuleConfig, n as WasmModelsConfig, t as WarmupConfig } from "./warmup-Cis2p6O0.js";
+import { c as WasmPipeline, i as WasmModuleConfig, n as WasmModelsConfig, t as WarmupConfig } from "./warmup-BUPPRAA1.js";
 import { s as TransactionalRiskIntelligenceSetupConfig } from "./index-BKOWUhxG.js";
 import { c as FeatureManagementRedactedUserInfo } from "./IFeatureManagementCapability-De8wpbGh.js";
 //#region src/internal/environment/environment.d.ts
@@ -34,12 +34,6 @@ type WasmConfig = Partial<WasmModuleConfig> & WasmModelsConfig & {
    * them.
    */
   pipelines?: WasmPipeline[];
-  /**
-   * Enables verbose output from the native WASM module.
-   *
-   * Defaults to `false`. Enable it only while diagnosing WASM behavior.
-   */
-  showLogs?: boolean;
 };
 /**
  * Object form of the `encryption` option for {@link SetupOptions}. Reach for
@@ -192,8 +186,12 @@ type SetupOptions = {
    * collected during face capture (selfie/authentication/id/personhood) — the
    * descriptive device fields and `webglFingerprint` are unaffected.
    *
-   * This option controls only the client-side JavaScript collection and
-   * submission path. It does **not** suppress native fingerprint collection:
+   * It also stops the native fingerprint signals reporter
+   * (`POST /omni/add/device-fingerprint-signals`: PID/DEVICE at session start,
+   * BEHAVIOUR after each capture attempt) and switches native behaviour-signals
+   * collection off (`sbc(false)`) once WASM is ready.
+   *
+   * It does **not** suppress the rest of native fingerprint collection:
    * against the pinned `v2.14.50-post1` runtime, WASM starts collecting during
    * initialization regardless of this flag, and the full fingerprint bucket is
    * serialized into the metadata bundle.
@@ -229,6 +227,17 @@ type SetupOptions = {
    * (off by default).
    */
   devMode?: boolean;
+  /**
+   * Device wallet (mDL) options.
+   *
+   * `googleSignedRequests` (default `true`): Google Wallet requests are fetched
+   * as signed-capable, and the backend picks signed (`openid4vp-v1-signed`) or
+   * unsigned. Pass `false` to always get unsigned (`openid4vp-v1-unsigned`)
+   * requests, e.g. for testing. Temporary — this choice moves to the backend.
+   */
+  deviceWallet?: {
+    googleSignedRequests?: boolean;
+  };
   /**
    * Transactional Risk Intelligence (TRI) telemetry configuration.
    *
@@ -435,12 +444,12 @@ type FeatureManagementSetupOptions = {
  * });
  * ```
  *
- * @example Self-hosted WASM (pin a version folder on your CDN)
+ * @example Self-hosted WASM (the release-matched files, unmodified, on your CDN)
  * ```ts
  * await setup({
  *   apiURL: 'https://api.incode.com',
  *   wasm: {
- *     basePath: 'https://my-cdn.example.com/ml-wasm-kit-release/v2.13.21',
+ *     basePath: 'https://my-cdn.example.com/incode-wasm',
  *   },
  * });
  * ```

package/dist/signature.d.ts

@@ -1,2 +1,2 @@
-import { a as createSignatureManagerFromActor, c as SignatureConfig, i as createSignatureManager, n as SignatureManager, o as SignatureActor, r as SignatureState, s as signatureMachine, t as SignatureCaptureState } from "./signatureManager-DGBSWz2_.js";
+import { a as createSignatureManagerFromActor, c as SignatureConfig, i as createSignatureManager, n as SignatureManager, o as SignatureActor, r as SignatureState, s as signatureMachine, t as SignatureCaptureState } from "./signatureManager-BpVt_Jv7.js";
 export { type SignatureActor, type SignatureCaptureState, type SignatureConfig, type SignatureManager, type SignatureState, createSignatureManager, createSignatureManagerFromActor, signatureMachine };

package/dist/signature.esm.js

@@ -1,3 +1,3 @@
-import { t as signatureMachine } from "./signatureStateMachine-ce_XMA3l.esm.js";
-import { n as createSignatureManagerFromActor, t as createSignatureManager } from "./signatureManager-B72np4ZO.esm.js";
+import { t as signatureMachine } from "./signatureStateMachine-BkRSrkKp.esm.js";
+import { n as createSignatureManagerFromActor, t as createSignatureManager } from "./signatureManager-qqXyH93e.esm.js";
 export { createSignatureManager, createSignatureManagerFromActor, signatureMachine };

package/dist/{signatureManager-DGBSWz2_.d.ts → signatureManager-BpVt_Jv7.d.ts}

@@ -1,6 +1,6 @@
 import { i as ActorRefFrom } from "./spawn-D9jgw9pW.js";
-import { t as Manager } from "./Manager-CQQ99QOI.js";
-import "./Actor-iTq7YY48.js";
+import { t as Manager } from "./Manager-C9T5amUN.js";
+import "./Actor-DpTj5PFb.js";
 //#region src/modules/signature/types.d.ts
 /**
  * Configuration options for Signature.

package/dist/{signatureManager-B72np4ZO.esm.js → signatureManager-qqXyH93e.esm.js}

@@ -1,7 +1,7 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-ijlbX_Wx.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-CAgFE-k3.esm.js";
 import { t as topLevelStateName } from "./topLevelStateName-B5i2avbh.esm.js";
-import { s as createActor, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
-import { t as signatureMachine } from "./signatureStateMachine-ce_XMA3l.esm.js";
+import { s as createActor, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
+import { t as signatureMachine } from "./signatureStateMachine-BkRSrkKp.esm.js";
 //#region src/modules/signature/signatureActor.ts
 function createSignatureActor(options) {
 	return createActor(signatureMachine, { input: { config: options.config } }).start();
@@ -24,12 +24,8 @@ function createSignatureActor(options) {
 *
 * State → screen mapping rationale:
 *
-* - `idle`/`captureSignature` collapse to `eSign.writeSignature.default` —
-*   the state machine stays in `captureSignature` throughout drawing (stroke
-*   validity changes via `SIGNATURE_CHANGED` are context-only and don't fire
-*   a new `screenOpened`). The `eSign.writeSignature.completed` Figma surface
-*   is therefore the post-submit "signed canvas while we wait for the API"
-*   surface, mapped to `submittingSignature`.
+* - Drawing validity selects `default` or `completed` before submission.
+*   Clearing the canvas returns to `default`; submission stays on `completed`.
 * - `success`/`finished` both map to `eSign.writeYourSignature.success` so
 *   the terminal `finished` state stays on the visible success canvas rather
 *   than falling back to the generic `<module>.finished` default.
@@ -42,8 +38,8 @@ function getSignatureScreenName(snapshot) {
 	const stateName = topLevelStateName(snapshot.value);
 	if (stateName === void 0) return void 0;
 	switch (stateName) {
-		case "idle":
-		case "captureSignature": return "eSign.writeSignature.default";
+		case "idle": return "eSign.writeSignature.default";
+		case "captureSignature": return snapshot.context.isValid ? "eSign.writeSignature.completed" : "eSign.writeSignature.default";
 		case "submittingSignature": return "eSign.writeSignature.completed";
 		case "success":
 		case "finished": return "eSign.writeYourSignature.success";

package/dist/{signatureStateMachine-ce_XMA3l.esm.js → signatureStateMachine-BkRSrkKp.esm.js}

@@ -1,7 +1,7 @@
 import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-import { i as assign, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
-import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
+import { t as endpoints } from "./endpoints-DHzlkQNe.esm.js";
+import { i as assign, t as setup } from "./xstate.esm-DSajW7CJ.esm.js";
+import { n as fromPromise } from "./xstate-actors.esm-8Gzepa_A.esm.js";
 //#region src/modules/signature/signatureServices.ts
 /**
 * Uploads a signature image to the Omni API.

package/dist/splitTrackedName-3zJRd2RD.esm.js

@@ -0,0 +1,19 @@
+//#region src/internal/events/splitTrackedName.ts
+/** Splits a Figma section/state path, keeping the full state name verbatim. */
+function splitTrackedName(fullName) {
+	if (fullName === void 0) return {
+		screen: void 0,
+		state: void 0
+	};
+	const lastDot = fullName.lastIndexOf(".");
+	if (fullName.indexOf(".") === lastDot) return {
+		screen: fullName,
+		state: void 0
+	};
+	return {
+		screen: fullName.slice(0, lastDot),
+		state: fullName
+	};
+}
+//#endregion
+export { splitTrackedName as t };

package/dist/{src-35ekGRzK.esm.js → src-DJAJjRYQ.esm.js}

@@ -1,4 +1,4 @@
-import { t as __commonJSMin } from "./rolldown-runtime-FDOR9p9I.esm.js";
+import { t as __commonJSMin } from "./rolldown-runtime-B-1-B7_t.esm.js";
 //#region ../../node_modules/.pnpm/@statsig+client-core@3.33.3/node_modules/@statsig/client-core/src/Log.js
 var require_Log = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/{stats-CZcy2J53.esm.js → stats-DmG_tkGk.esm.js}

@@ -1,5 +1,5 @@
 import { r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
+import { t as endpoints } from "./endpoints-DHzlkQNe.esm.js";
 //#region src/modules/stats/statsServices.ts
 const deviceStatsQueue = [];
 async function postDeviceStatsNow(stats) {

package/dist/stats.esm.js

@@ -1,2 +1,2 @@
-import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-CZcy2J53.esm.js";
+import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-DmG_tkGk.esm.js";
 export { addDeviceStats, flushDeviceStatsQueue, resetDeviceStatsQueue };