@incodetech/core 2.3.2-rc.4 → 2.4.0-rc.0

package/dist/{warmup-Cis2p6O0.d.ts → warmup-BUPPRAA1.d.ts}

@@ -30,6 +30,8 @@ declare global {
 type WasmModule = Record<string, unknown>;
 type WasmGlueFactory = (options?: Readonly<{
   wasmBinary?: Uint8Array;
+  print?: (text: string) => void;
+  printErr?: (text: string) => void;
 }>) => Promise<WasmModule>;
 /**
  * Binary and glue configuration for one WASM module instance.
@@ -38,6 +40,11 @@ type WasmGlueFactory = (options?: Readonly<{
  * use the same memoized module.
  */
 type WasmModuleConfig = {
+  /**
+   * Enables WASM console output, including native errors. Default: false.
+   * Set before the first load; shared instances retain their output sinks.
+   */
+  showLogs?: boolean;
   /** URL or bytes for the standard WASM binary. */
   wasmPath: WasmSource;
   /**

package/dist/{warmup-ChDwHSel.esm.js → warmup-DMtbyb2l.esm.js}

@@ -1,4 +1,4 @@
-import { _ as WASM_PIPELINE_OPTIONAL_MODEL_NAMES, b as resolveWasmSource, d as SemaphoreProvider, h as WASM_PIPELINE_MODELS, l as loadWasmModule, n as createWebApiHostAdapter, p as WASM_MODEL_FILES, u as acquireWasmStorageFallback, v as buildModelVariantSources, y as missingWasmModelError } from "./wasmWebClient-B7baE-Wf.esm.js";
+import { _ as WASM_PIPELINE_OPTIONAL_MODEL_NAMES, b as resolveWasmSource, d as SemaphoreProvider, h as WASM_PIPELINE_MODELS, l as loadWasmModule, n as createWebApiHostAdapter, p as WASM_MODEL_FILES, u as acquireWasmStorageFallback, v as buildModelVariantSources, x as reportWasmIntegritySummary, y as missingWasmModelError } from "./wasmWebClient-kbYZ2sxw.esm.js";
 //#region ../infra/src/wasm/wasmEnumMaps.ts
 function pipelineTypeToWasmEnum(wasmModule, type) {
 	switch (type) {
@@ -120,6 +120,9 @@ function deleteWasmHandle(firstFailure, handle) {
 function releaseCameraCycleResources(stream, cameraCycleApi) {
 	return attemptCleanup(stopStreamTracks(stream), () => cameraCycleApi?.rcc());
 }
+function isWasmModelEntry(source) {
+	return typeof source === "object" && !(source instanceof ArrayBuffer) && !(source instanceof Uint8Array) && "file" in source;
+}
 var WasmRuntime = class WasmRuntime {
 	constructor(loadModule = loadWasmModule) {
 		this.loadModule = loadModule;
@@ -153,6 +156,7 @@ var WasmRuntime = class WasmRuntime {
 			this.usedSimd_ = simdUsed;
 			this.workflowApiUtilities = new this.wasmModule.WorkflowApiUtilities();
 			this.utilityApi = new this.wasmModule.UtilityApi();
+			this.utilityApi.setProductionMode(module.showLogs !== true);
 			this.idCaptureWasmApi = new this.wasmModule.IdCaptureApi();
 			this.faceProcessingWasmApi = new this.wasmModule.FaceProcessingApi();
 			this.cameraCycleApi = new this.wasmModule.CameraCycleApi();
@@ -301,10 +305,14 @@ var WasmRuntime = class WasmRuntime {
 				const sizes = new (this.requireWasmModule(message)).VectorInt();
 				sizeVectors.push(sizes);
 				for (const path of modelsPaths) {
-					const resolvedSource = this.resolveModelSource(path);
+					const file = isWasmModelEntry(path) ? path.file : void 0;
+					const resolvedSource = this.resolveModelSource(isWasmModelEntry(path) ? path.source : path);
 					let model = this.loadedModels.get(resolvedSource);
 					if (!model) {
-						model = await resolveWasmSource(resolvedSource, "model");
+						model = await resolveWasmSource(resolvedSource, {
+							kind: "model",
+							file
+						});
 						this.loadedModels.set(resolvedSource, model);
 					}
 					sizes.push_back(model.byteLength);
@@ -526,16 +534,22 @@ function resolveConfiguredModelSource(config, modelFile, pipeline, modelsBasePat
 	if (current === void 0) {
 		if (config.selfHosted) throw missingWasmModelError(modelFile, pipeline);
 		if (!modelsBasePath) throw new Error("[Incode SDK] modelsBasePath is required when wasmPath is a byte source.");
-		return buildModelVariantSources(modelsBasePath, modelFile);
+		return {
+			file: modelFile,
+			source: buildModelVariantSources(modelsBasePath, modelFile)
+		};
 	}
 	const legacy = config.legacyModelUrls?.[modelFile];
-	return legacy === void 0 ? current : {
-		current,
-		legacy
+	return {
+		file: modelFile,
+		source: legacy === void 0 ? current : {
+			current,
+			legacy
+		}
 	};
 }
 /**
-* Warns once per warmup that an optional model listed in
+* When logging is enabled, warns once per warmup that an optional model listed in
 * {@link WASM_PIPELINE_OPTIONAL_MODEL_NAMES} was not supplied, so the Core
 * profile that needs it is skipped instead of failing the whole warmup.
 */
@@ -565,7 +579,7 @@ function buildPipelinesMap(pipelines, config) {
 					WASM_MODEL_FILES.idFiqa,
 					WASM_MODEL_FILES.idFaceDetector
 				]));
-				else warnMissingOptionalModel(pipeline, missingOptional);
+				else if (config.showLogs) warnMissingOptionalModel(pipeline, missingOptional);
 			}
 		}
 	}
@@ -634,6 +648,8 @@ async function warmupWasm(config) {
 				loadingPromise = null;
 				pipelinesInFlight = [];
 				throw wasmError;
+			} finally {
+				reportWasmIntegritySummary();
 			}
 		})();
 		return loadingPromise;
@@ -666,6 +682,8 @@ async function warmupWasm(config) {
 			loadingPromise = null;
 			pipelinesInFlight = [];
 			throw wasmError;
+		} finally {
+			reportWasmIntegritySummary();
 		}
 	})();
 	return loadingPromise;

package/dist/wasm.d.ts

@@ -1,5 +1,5 @@
-import { a as WASM_MODEL_FILES, c as WasmPipeline, l as WasmSource, o as WasmGlueLoader, r as warmupWasm, s as WasmModelName, t as WarmupConfig } from "./warmup-Cis2p6O0.js";
-import { c as setWasmConfig, i as initializeWasmUtil, n as WasmConfig, r as ensureWasmPipelines, s as resolveWasmConfigForPipelines, u as upgradeToWasmHttpClient } from "./setup-Cyko6cAn.js";
+import { a as WASM_MODEL_FILES, c as WasmPipeline, l as WasmSource, o as WasmGlueLoader, r as warmupWasm, s as WasmModelName, t as WarmupConfig } from "./warmup-BUPPRAA1.js";
+import { c as setWasmConfig, i as initializeWasmUtil, n as WasmConfig, r as ensureWasmPipelines, s as resolveWasmConfigForPipelines, u as upgradeToWasmHttpClient } from "./setup-lgkQ8dJW.js";
 //#region ../infra/src/wasm/wasmDefaults.d.ts
 /** The WASM version bundled and tested with this SDK release. */
 declare const DEFAULT_WASM_VERSION = "v2.14.50-post1";

package/dist/wasm.esm.js

@@ -1,7 +1,7 @@
-import { g as WASM_PIPELINE_MODEL_NAMES, m as WASM_PIPELINE_LAZY_MODEL_NAMES, p as WASM_MODEL_FILES } from "./wasmWebClient-B7baE-Wf.esm.js";
-import { C as DEFAULT_WASM_VERSION, D as resolveWasmConfig, T as buildWasmConfigFromBasePath, w as buildDefaultWasmConfig } from "./trueSightService-oMFESSSb.esm.js";
-import { o as warmupWasm } from "./warmup-ChDwHSel.esm.js";
-import { a as resolveWasmConfigForPipelines, c as upgradeToWasmHttpClient, n as initializeWasmUtil, o as setWasmConfig, t as ensureWasmPipelines } from "./setup-DmB0JHAB.esm.js";
+import { g as WASM_PIPELINE_MODEL_NAMES, m as WASM_PIPELINE_LAZY_MODEL_NAMES, p as WASM_MODEL_FILES } from "./wasmWebClient-kbYZ2sxw.esm.js";
+import { C as DEFAULT_WASM_VERSION, D as resolveWasmConfig, T as buildWasmConfigFromBasePath, w as buildDefaultWasmConfig } from "./trueSightService-BWgRVGIT.esm.js";
+import { o as warmupWasm } from "./warmup-DMtbyb2l.esm.js";
+import { a as resolveWasmConfigForPipelines, c as upgradeToWasmHttpClient, n as initializeWasmUtil, o as setWasmConfig, t as ensureWasmPipelines } from "./setup-C38QkrSP.esm.js";
 //#region src/defineWasm.ts
 function requiredModels(pipelines) {
 	const models = /* @__PURE__ */ new Set();

package/dist/{wasmDsFlagSync-DYrLUEII.esm.js → wasmDsFlagSync-BXCGqP48.esm.js}

@@ -1,4 +1,4 @@
-import { a as utilityWasmApi } from "./safeStorage-BdU9_m2E.esm.js";
+import { i as utilityWasmApi } from "./WasmUtilProvider-CIdnE7Fx.esm.js";
 //#region ../infra/src/wasm/wasmDsFlagSync.ts
 /**
 * Sets the Deepsight (ds) flag that the WASM utility API receives on every

package/dist/{wasmWebClient-B7baE-Wf.esm.js → wasmWebClient-kbYZ2sxw.esm.js}

@@ -1,3 +1,187 @@
+//#region ../infra/src/wasm/wasmIntegrityManifest.ts
+/** SHA-256 digests of the official WASM release files this SDK loads. */
+const WASM_INTEGRITY_MANIFEST = {
+	wasmVersion: "v2.14.50-post1",
+	files: {
+		"models/current/age_estimation_v2_2_2_fp16.ortmodelv2": "70bd372b5e140ea8e9773a25d371cb65e5a9090651fdfe73ab6fc7ce25d59c83",
+		"models/current/barcode_enhance_896x224_fp16.ortmodelv2": "bccecd74abf48181efb95bf020784b7e50d37ae255bf89c14c2c5186976279e0",
+		"models/current/face_attributes_v1_3_fp16.ortmodelv2": "96079ec080a92ae1821b456f06281a604b4b013af42313f9668210c9bbe7041f",
+		"models/current/face_occlusion_v0_2_fp16.ortmodelv2": "7a846b12b7a9a5afe72e07f19b408095439a214aaa306e88d34d1f17ffce72fb",
+		"models/current/id_capture_2_01_fp16.ortmodelv2": "06b337368249131af6bab66bdf4fca680298034e3e83d678656d255cdb480507",
+		"models/current/id_facedetector_v2_1_fp16.ortmodelv2": "ab35d7c2f69d5c156f7e247bde652c4ac7b78cdc4a90ef55f5a928edc54e2bd8",
+		"models/current/id_fiqa_19a81a0b9bf6492eb03b4667f6db4c85_fp16.ortmodelv2": "1cc02608aed0078bf9cc66ae4f51b150e7b5aa65c5fb270248bda7c327867d26",
+		"models/current/mls_regressor_4773007c657b4f05a460321456740d0f_fp16.ortmodelv2": "74a955dff00183c69544a9b61cc7e1122c7cd3814811dcd7ae8cf862bda35c41",
+		"models/current/ondevice_physical_liveness_v2_1_fp16.ortmodelv2": "188227beafee6ccce16d562ae531eae894aa4b1056dce339741b5e80a695794a",
+		"models/current/selfie_bf_angles_192x192_opset9_fp16.ortmodelv2": "6bdb142f67e81d9e6006d94888eba2e6a7bf20a6283c66e14db8b654c8fa9bfd",
+		"models/legacy/age_estimation_v2_2_2_fp16.ortmodelv2": "28ffdec742ec7856a3b113ee86af01e4629b576139faff1cf7094bf451c94a60",
+		"models/legacy/barcode_enhance_896x224_fp16.ortmodelv2": "aef15080020d5a329870cc3d50f73a1c676526d1f6f6df282f7dc0c95e6018b9",
+		"models/legacy/face_attributes_v1_3_fp16.ortmodelv2": "7c6754b63b4e205370463df4c6396f29123d7b5a17823a2d78a59b2fb17cc98b",
+		"models/legacy/face_occlusion_v0_2_fp16.ortmodelv2": "19fc95f2081e55962045f0e38387399fb11c1b636699e31558383d2ea4156aed",
+		"models/legacy/id_capture_2_01_fp16.ortmodelv2": "2f791bbf1f0dc9c6b8ff95587ce61479a764a18070e83658f6366996a7df9615",
+		"models/legacy/id_facedetector_v2_1_fp16.ortmodelv2": "f790693395cc1473a824a97b86fd2943586b490582e003b240dff4d51d9f417f",
+		"models/legacy/id_fiqa_19a81a0b9bf6492eb03b4667f6db4c85_fp16.ortmodelv2": "d058e82efca7c30a35dd0a03472695656c105952f27af2ea158cb00818caab8c",
+		"models/legacy/mls_regressor_4773007c657b4f05a460321456740d0f_fp16.ortmodelv2": "e41887f75b284ba1f973f2a26209bf365da8a587d266492b642e5b7c36716069",
+		"models/legacy/ondevice_physical_liveness_v2_1_fp16.ortmodelv2": "405eee9fd961c48fff608246ef579dc8ce9f0b5ce51361e05dac7d9afcf9162d",
+		"models/legacy/selfie_bf_angles_192x192_opset9_fp16.ortmodelv2": "1c8dda528d5111fa7b4272ffabca7cf0a59099f57258aaece7262974aebafc4a",
+		"webLib.js": "2953d4da3b8eddf1ff48e113ac4ff11d69eb379e1ab091fec1dad34a17d23844",
+		"webLib.wasm": "7616ea70cab3171ef376f9d0fa646548efc90beab49fdefa25d1b241ca704673",
+		"webLibSimd.js": "51407ce3032dd330ae806d9aea1b43eb5c245e2b64780b4b62c9c62310a0bee1",
+		"webLibSimd.wasm": "0575425989803e58ccb82fcd30d64508a7c7b52019564d8644b59d5cf11135ab"
+	},
+	dist: {
+		"webLib.js": "6d7177b6e2e86a0d975b595ea546bf87fc11a194ad4cbdc0613fb3b2a2810e90",
+		"webLibSimd.js": "4ac981fa15dd748ec1a312bd25408fb4af3449d8c1bb6ebb8fe436476049d446"
+	}
+};
+//#endregion
+//#region ../infra/src/wasm/wasmIntegrity.ts
+/**
+* Integrity check for every WASM binary, glue file and ML model the SDK loads.
+*
+* Each asset is matched, by slot, against the SHA-256 digests of the official
+* ml-wasm-kit release in {@link WASM_INTEGRITY_MANIFEST}. The host does not
+* matter: the Incode CDN, a self-hosted copy and `@incodetech/wasm-assets` all
+* serve the same official files, so they all carry the same digests. A file
+* that does not match is never instantiated or evaluated.
+*
+* The one input this cannot hash is a `loadGlue` callback: the integrator's
+* bundler hands over a module, not bytes. That glue is part of the
+* integrator's own bundle, the same trust boundary as the SDK code running
+* this check, and is reported as `bundled`.
+*/
+var WasmIntegrityError = class extends Error {
+	constructor(code, asset, message, cause) {
+		super(`[Incode SDK] ${message}`);
+		this.name = "WasmIntegrityError";
+		this.code = code;
+		this.asset = asset;
+		this.cause = cause;
+	}
+};
+const DIGEST_PREFIX_LENGTH = 12;
+const HTML_SNIFF_BYTES = 512;
+let observer = null;
+let verified = 0;
+let failed = 0;
+let bundled = 0;
+let hashMs = 0;
+/**
+* Installs the sink core maps to TrueSight and the event log. Infra cannot
+* import either, so core injects it, as with `setWebApiHttpTransport`.
+*/
+function setWasmIntegrityObserver(next) {
+	observer = next;
+}
+function notify(check) {
+	if (check.status === "verified") verified += 1;
+	else if (check.status === "bundled") bundled += 1;
+	else failed += 1;
+	hashMs += check.durationMs ?? 0;
+	try {
+		observer?.onAssetChecked?.(check);
+	} catch {}
+}
+/** Reports the totals since the last summary, then resets them. */
+function reportWasmIntegritySummary() {
+	if (verified + failed + bundled === 0) return;
+	const summary = {
+		wasmVersion: WASM_INTEGRITY_MANIFEST.wasmVersion,
+		verified,
+		failed,
+		bundled,
+		hashMs: Math.round(hashMs)
+	};
+	verified = 0;
+	failed = 0;
+	bundled = 0;
+	hashMs = 0;
+	try {
+		observer?.onSummary?.(summary);
+	} catch {}
+}
+/** Records glue that arrived through a `loadGlue` callback and has no bytes. */
+function reportBundledWasmGlue(slot) {
+	notify({
+		asset: slot,
+		status: "bundled"
+	});
+}
+function assetLabel(asset) {
+	return asset.kind === "model" ? asset.file ?? "model" : asset.slot;
+}
+function expectedDigests(asset) {
+	const { files, dist } = WASM_INTEGRITY_MANIFEST;
+	if (asset.kind === "binary") return [files[asset.slot]].filter(isDigest);
+	if (asset.kind === "glue") return [files[asset.slot], dist[asset.slot]].filter(isDigest);
+	if (asset.file === void 0) return Object.entries(files).filter(([key]) => key.startsWith("models/")).map(([, digest]) => digest);
+	return [files[`models/current/${asset.file}`], files[`models/legacy/${asset.file}`]].filter(isDigest);
+}
+function isDigest(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function toHex(buffer) {
+	return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function looksLikeHtml(bytes) {
+	let text = new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, HTML_SNIFF_BYTES));
+	if (text.charCodeAt(0) === 65279) text = text.slice(1);
+	const start = text.trimStart().slice(0, 9).toLowerCase();
+	return start.startsWith("<!doctype") || start.startsWith("<html");
+}
+/**
+* Rejects an HTML page served in place of an asset. The Incode CDN answers
+* every missing path with HTTP 200 and a small HTML page, so `response.ok`
+* cannot detect a miss.
+*/
+function assertNotHtml(contentType, bytes, asset) {
+	if (contentType?.toLowerCase().includes("text/html") || looksLikeHtml(bytes)) {
+		const label = assetLabel(asset);
+		notify({
+			asset: label,
+			status: "not-binary",
+			byteLength: bytes.byteLength
+		});
+		throw new WasmIntegrityError("WASM_ASSET_NOT_BINARY", label, `The WASM asset ${label} was served as an HTML page (${bytes.byteLength} bytes), not the release file. Check that the file exists at its configured URL.`);
+	}
+}
+/**
+* Verifies `bytes` against the official digests for `asset` and throws a
+* {@link WasmIntegrityError} when they do not match.
+*/
+async function verifyWasmAsset(asset, bytes) {
+	const label = assetLabel(asset);
+	const subtle = globalThis.crypto?.subtle;
+	if (subtle === void 0) {
+		notify({
+			asset: label,
+			status: "unavailable"
+		});
+		throw new WasmIntegrityError("WASM_INTEGRITY_UNAVAILABLE", label, "WASM assets cannot be verified because crypto.subtle is unavailable. Serve the page over HTTPS.");
+	}
+	const startedAt = performance.now();
+	const actual = toHex(await subtle.digest("SHA-256", bytes));
+	const durationMs = performance.now() - startedAt;
+	const expected = expectedDigests(asset);
+	if (expected.includes(actual)) {
+		notify({
+			asset: label,
+			status: "verified",
+			durationMs,
+			byteLength: bytes.byteLength
+		});
+		return;
+	}
+	notify({
+		asset: label,
+		status: "mismatch",
+		durationMs,
+		byteLength: bytes.byteLength,
+		expectedDigestPrefix: expected[0]?.slice(0, DIGEST_PREFIX_LENGTH),
+		actualDigestPrefix: actual.slice(0, DIGEST_PREFIX_LENGTH)
+	});
+	throw new WasmIntegrityError("WASM_INTEGRITY_MISMATCH", label, `The WASM asset ${label} does not match the official ${WASM_INTEGRITY_MANIFEST.wasmVersion} release file. Serve the unmodified files for this SDK release.`);
+}
+//#endregion
 //#region ../infra/src/wasm/wasmAssets.ts
 const WASM_MODEL_FILES = {
 	idCapture: "id_capture_2_01_fp16.ortmodelv2",
@@ -83,9 +267,20 @@ const WASM_PIPELINE_MODELS = {
 	videoSelfie: WASM_PIPELINE_MODEL_NAMES.videoSelfie.map((model) => WASM_MODEL_FILES[model]),
 	videoSelfieId: WASM_PIPELINE_MODEL_NAMES.videoSelfieId.map((model) => WASM_MODEL_FILES[model])
 };
-async function resolveWasmSource(source, kind) {
+/**
+* Loads a WASM asset as bytes and verifies it against the official release
+* digests before returning it. Byte sources are verified too: the check does
+* not depend on where an asset comes from.
+*/
+async function resolveWasmSource(source, asset) {
+	const bytes = await fetchWasmSource(source, asset);
+	await verifyWasmAsset(asset, bytes);
+	return bytes;
+}
+async function fetchWasmSource(source, asset) {
 	if (source instanceof Uint8Array) return source;
 	if (source instanceof ArrayBuffer) return new Uint8Array(source);
+	const { kind } = asset;
 	let response;
 	try {
 		response = await fetch(source);
@@ -94,7 +289,9 @@ async function resolveWasmSource(source, kind) {
 		throw new Error(`[Incode SDK] Could not load the WASM ${kind} at ${source}: ${detail}`);
 	}
 	if (!response.ok) throw new Error(`[Incode SDK] Could not load the WASM ${kind} at ${source}: ${response.status} ${response.statusText}`);
-	return new Uint8Array(await response.arrayBuffer());
+	const bytes = new Uint8Array(await response.arrayBuffer());
+	assertNotHtml(response.headers.get("content-type"), bytes, asset);
+	return bytes;
 }
 function missingWasmModelError(fileName, pipeline) {
 	return /* @__PURE__ */ new Error(`[Incode SDK] The "${pipeline}" pipeline needs ${fileName}, but the self-hosted WASM configuration does not provide it.`);
@@ -208,6 +405,28 @@ var SemaphoreProvider = class {
 	}
 };
 //#endregion
+//#region ../infra/src/wasm/wasmGlueImport.ts
+/**
+* Evaluates verified glue bytes as an ES module from a `blob:` URL.
+*
+* The bytes are the ones the integrity check hashed. Importing the original URL
+* instead would fetch it a second time, and that response is not the one that
+* was checked. Kept in its own module so unit tests, which cannot import
+* `blob:` URLs under Node, can substitute it.
+*/
+async function importVerifiedGlue(bytes) {
+	const blobUrl = URL.createObjectURL(new Blob([bytes], { type: "text/javascript" }));
+	try {
+		return await import(
+			/* @vite-ignore */
+			/* webpackIgnore: true */
+			blobUrl
+);
+	} finally {
+		URL.revokeObjectURL(blobUrl);
+	}
+}
+//#endregion
 //#region ../infra/src/wasm/wasmStorageFallback.ts
 /**
 * SDK-local compatibility fallback for ml-wasm-kit releases whose embind
@@ -411,30 +630,49 @@ function acquireWasmStorageFallback() {
 if (typeof window !== "undefined" && window.wasmArrayBuffer === void 0) window.wasmArrayBuffer = null;
 let loadPromise = null;
 let loadedResult = null;
-async function importGlueAt(glueCodePath) {
-	const mod = await import(
-		/* @vite-ignore */
-		/* webpackIgnore: true */
-		glueCodePath
-);
+/** Fetches the glue, verifies it, and evaluates exactly the verified bytes. */
+async function importGlueAt(glueCodePath, slot) {
+	const bytes = await resolveWasmSource(glueCodePath, {
+		kind: "glue",
+		slot
+	});
+	let mod;
+	try {
+		mod = await importVerifiedGlue(bytes);
+	} catch (error) {
+		throw new WasmIntegrityError("WASM_GLUE_BLOCKED_BY_CSP", slot, `The verified WASM glue ${slot} could not be loaded from a blob: URL. Allow blob: in the script-src Content-Security-Policy directive.`, error);
+	}
 	if (typeof mod.Module !== "function") throw new Error(`WASM glue at ${glueCodePath} did not export a Module factory`);
 	return mod.Module;
 }
-async function resolveGlue(loader, glueCodePath) {
+async function resolveGlue(loader, glueCodePath, slot) {
 	if (loader) {
 		const module = await loader();
 		if (typeof module.Module !== "function") throw new Error("[Incode SDK] WASM glue module did not export a Module factory.");
+		reportBundledWasmGlue(slot);
 		return module.Module;
 	}
 	if (!glueCodePath) throw new Error("WASM glue code is required");
-	return await importGlueAt(glueCodePath);
+	return await importGlueAt(glueCodePath, slot);
 }
-async function instantiate(factory, libPath) {
-	window.wasmArrayBuffer = await resolveWasmSource(libPath, "binary");
-	return await factory({ wasmBinary: window.wasmArrayBuffer });
+async function instantiate(factory, libPath, slot, showLogs = false) {
+	window.wasmArrayBuffer = await resolveWasmSource(libPath, {
+		kind: "binary",
+		slot
+	});
+	return await factory({
+		wasmBinary: window.wasmArrayBuffer,
+		print: (text) => {
+			if (showLogs) console.log(text);
+		},
+		printErr: (text) => {
+			if (showLogs) console.error(text);
+		}
+	});
 }
 /**
-* Load the WASM module, memoized. Subsequent calls return the same instance.
+* Load the WASM module, memoized. Subsequent calls return the same instance,
+* retaining the first caller's logging configuration.
 *
 * SIMD-first with fallback: if `useSimd !== false` and a `wasmSimdPath` is
 * provided, the SIMD binary + SIMD glue are tried first; on instantiation
@@ -451,21 +689,22 @@ async function loadWasmModule(config) {
 			const wantSimd = config.useSimd !== false;
 			const simdBinary = config.wasmSimdPath ?? config.wasmPath;
 			if (wantSimd && simdBinary !== config.wasmPath) try {
-				const simdFactory = await resolveGlue(config.loadGlueSimd, typeof simdBinary === "string" ? config.glueCodeSimdPath || deriveSiblingJsPath(simdBinary) : config.glueCodeSimdPath);
+				const simdFactory = await resolveGlue(config.loadGlueSimd, typeof simdBinary === "string" ? config.glueCodeSimdPath || deriveSiblingJsPath(simdBinary) : config.glueCodeSimdPath, "webLibSimd.js");
 				window.Module = simdFactory;
 				const result = {
-					wasmModule: await instantiate(simdFactory, simdBinary),
+					wasmModule: await instantiate(simdFactory, simdBinary, "webLibSimd.wasm", config.showLogs),
 					simdUsed: true
 				};
 				loadedResult = result;
 				return result;
 			} catch (simdError) {
-				console.warn("[Incode SDK] SIMD WASM load failed, falling back to non-SIMD", simdError);
+				if (simdError instanceof WasmIntegrityError) throw simdError;
+				if (config.showLogs) console.warn("[Incode SDK] SIMD WASM load failed, falling back to non-SIMD", simdError);
 			}
-			const nonSimdFactory = await resolveGlue(config.loadGlue, config.glueCodePath);
+			const nonSimdFactory = await resolveGlue(config.loadGlue, config.glueCodePath, "webLib.js");
 			window.Module = nonSimdFactory;
 			const result = {
-				wasmModule: await instantiate(nonSimdFactory, config.wasmPath),
+				wasmModule: await instantiate(nonSimdFactory, config.wasmPath, "webLib.wasm", config.showLogs),
 				simdUsed: false
 			};
 			loadedResult = result;
@@ -734,4 +973,4 @@ function ensureReady() {
 	return webClientApi;
 }
 //#endregion
-export { WASM_PIPELINE_OPTIONAL_MODEL_NAMES as _, setWebApiHttpTransport as a, resolveWasmSource as b, wasmCallWrapper as c, SemaphoreProvider as d, deriveSiblingJsPath as f, WASM_PIPELINE_MODEL_NAMES as g, WASM_PIPELINE_MODELS as h, initializeWasmWebClient as i, loadWasmModule as l, WASM_PIPELINE_LAZY_MODEL_NAMES as m, createWebApiHostAdapter as n, setupWasmConnection as o, WASM_MODEL_FILES as p, executeWasmRequest as r, ML_CALL_MAX_POLLS as s, WasmWebClientError as t, acquireWasmStorageFallback as u, buildModelVariantSources as v, missingWasmModelError as y };
+export { setWasmIntegrityObserver as S, WASM_PIPELINE_OPTIONAL_MODEL_NAMES as _, setWebApiHttpTransport as a, resolveWasmSource as b, wasmCallWrapper as c, SemaphoreProvider as d, deriveSiblingJsPath as f, WASM_PIPELINE_MODEL_NAMES as g, WASM_PIPELINE_MODELS as h, initializeWasmWebClient as i, loadWasmModule as l, WASM_PIPELINE_LAZY_MODEL_NAMES as m, createWebApiHostAdapter as n, setupWasmConnection as o, WASM_MODEL_FILES as p, executeWasmRequest as r, ML_CALL_MAX_POLLS as s, WasmWebClientError as t, acquireWasmStorageFallback as u, buildModelVariantSources as v, reportWasmIntegritySummary as x, missingWasmModelError as y };

package/dist/watchlist-for-business.d.ts

@@ -1,2 +1,2 @@
-import { a as createWatchlistForBusinessManager, c as WatchlistForBusinessValidationErrors, i as WatchlistForBusinessState, l as WatchlistForBusinessActor, n as WatchlistForBusinessFormState, o as createWatchlistForBusinessManagerFromActor, r as WatchlistForBusinessManager, s as WatchlistForBusinessConfig, t as WatchlistForBusinessFinishedState, u as watchlistForBusinessMachine } from "./watchlistForBusinessManager-CsnJnG-C.js";
+import { a as createWatchlistForBusinessManager, c as WatchlistForBusinessValidationErrors, i as WatchlistForBusinessState, l as WatchlistForBusinessActor, n as WatchlistForBusinessFormState, o as createWatchlistForBusinessManagerFromActor, r as WatchlistForBusinessManager, s as WatchlistForBusinessConfig, t as WatchlistForBusinessFinishedState, u as watchlistForBusinessMachine } from "./watchlistForBusinessManager-B3GDPZrr.js";
 export { type WatchlistForBusinessActor, type WatchlistForBusinessConfig, type WatchlistForBusinessFinishedState, type WatchlistForBusinessFormState, type WatchlistForBusinessManager, type WatchlistForBusinessState, type WatchlistForBusinessValidationErrors, createWatchlistForBusinessManager, createWatchlistForBusinessManagerFromActor, watchlistForBusinessMachine };

package/dist/watchlist-for-business.esm.js

@@ -1,3 +1,3 @@
-import { t as watchlistForBusinessMachine } from "./watchlistForBusinessStateMachine-CJ-MvUre.esm.js";
-import { n as createWatchlistForBusinessManagerFromActor, t as createWatchlistForBusinessManager } from "./watchlistForBusinessManager-CIMkpEhu.esm.js";
+import { t as watchlistForBusinessMachine } from "./watchlistForBusinessStateMachine-121XK-Et.esm.js";
+import { n as createWatchlistForBusinessManagerFromActor, t as createWatchlistForBusinessManager } from "./watchlistForBusinessManager-BvF4jK3S.esm.js";
 export { createWatchlistForBusinessManager, createWatchlistForBusinessManagerFromActor, watchlistForBusinessMachine };

package/dist/watchlist.d.ts

@@ -1,4 +1,4 @@
-import { n as WatchlistState, o as watchlistMachine, r as createWatchlistManager, t as WatchlistManager } from "./watchlistManager-DLXef90v.js";
+import { n as WatchlistState, o as watchlistMachine, r as createWatchlistManager, t as WatchlistManager } from "./watchlistManager-DJQOd8Pw.js";
 //#region src/modules/watchlist/types.d.ts
 /**
  * Configuration options for the global watchlist module.

package/dist/watchlist.esm.js

@@ -1,3 +1,3 @@
-import { t as watchlistMachine } from "./watchlistStateMachine-CBqk2w-h.esm.js";
-import { t as createWatchlistManager } from "./watchlistManager-CixcLNDT.esm.js";
+import { t as watchlistMachine } from "./watchlistStateMachine-Dgfm42w2.esm.js";
+import { t as createWatchlistManager } from "./watchlistManager-CNWEOYSq.esm.js";
 export { createWatchlistManager, watchlistMachine };

package/dist/{watchlistForBusinessManager-CsnJnG-C.d.ts → watchlistForBusinessManager-B3GDPZrr.d.ts}

@@ -1,6 +1,6 @@
 import { i as ActorRefFrom } from "./spawn-D9jgw9pW.js";
-import { t as Manager } from "./Manager-CQQ99QOI.js";
-import "./Actor-iTq7YY48.js";
+import { t as Manager } from "./Manager-C9T5amUN.js";
+import "./Actor-DpTj5PFb.js";
 //#region src/modules/watchlist-for-business/watchlistForBusinessStateMachine.d.ts
 declare const watchlistForBusinessMachine: any;
 type WatchlistForBusinessMachine = typeof watchlistForBusinessMachine;

package/dist/{watchlistForBusinessManager-CIMkpEhu.esm.js → watchlistForBusinessManager-BvF4jK3S.esm.js}

@@ -1,7 +1,7 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-ijlbX_Wx.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-CAgFE-k3.esm.js";
 import { t as topLevelStateName } from "./topLevelStateName-B5i2avbh.esm.js";
-import { s as createActor, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
-import { t as watchlistForBusinessMachine } from "./watchlistForBusinessStateMachine-CJ-MvUre.esm.js";
+import { s as createActor, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
+import { t as watchlistForBusinessMachine } from "./watchlistForBusinessStateMachine-121XK-Et.esm.js";
 //#region src/modules/watchlist-for-business/watchlistForBusinessActor.ts
 function createWatchlistForBusinessActor() {
 	return createActor(watchlistForBusinessMachine).start();
@@ -16,13 +16,15 @@ function createWatchlistForBusinessActor() {
 * watchlist — each manager keeps its own module token per the
 * AdSign/QSign precedent.
 *
-* `idle` and `finished` are intentionally unmapped — the Figma canvas does
-* not define screens for them; `finished` collapses into `moduleClosed`.
+* `idle` and `finished` have no visible screen. Suppress their raw-state
+* fallback so every screen stays in the approved `watchlist.*` family.
 */
 function getWatchlistForBusinessScreenName(snapshot) {
 	const stateName = topLevelStateName(snapshot.value);
 	if (stateName === void 0) return void 0;
 	switch (stateName) {
+		case "idle":
+		case "finished": return "";
 		case "form": return snapshot.context.isValid ? "watchlist.filled" : "watchlist.default";
 		case "submitting": return "watchlist.processing";
 		case "success": return "watchlist.success";

package/dist/{watchlistForBusinessStateMachine-CJ-MvUre.esm.js → watchlistForBusinessStateMachine-121XK-Et.esm.js}

@@ -1,7 +1,7 @@
 import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-import { i as assign, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
-import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
+import { t as endpoints } from "./endpoints-DHzlkQNe.esm.js";
+import { i as assign, t as setup } from "./xstate.esm-DSajW7CJ.esm.js";
+import { n as fromPromise } from "./xstate-actors.esm-8Gzepa_A.esm.js";
 //#region src/modules/watchlist-for-business/watchlistForBusinessServices.ts
 async function submitWatchlistForBusiness(data, signal) {
 	const res = await api.post(endpoints.watchlistForBusinessSubmit, data, { signal });

package/dist/{watchlistManager-CixcLNDT.esm.js → watchlistManager-CNWEOYSq.esm.js}

@@ -1,7 +1,7 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-ijlbX_Wx.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-CAgFE-k3.esm.js";
 import { t as topLevelStateName } from "./topLevelStateName-B5i2avbh.esm.js";
-import { s as createActor, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
-import { t as watchlistMachine } from "./watchlistStateMachine-CBqk2w-h.esm.js";
+import { s as createActor, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
+import { t as watchlistMachine } from "./watchlistStateMachine-Dgfm42w2.esm.js";
 //#region src/modules/watchlist/watchlistActor.ts
 function createWatchlistActor() {
 	return createActor(watchlistMachine).start();

package/dist/{watchlistManager-DLXef90v.d.ts → watchlistManager-DJQOd8Pw.d.ts}

@@ -1,6 +1,6 @@
 import { i as ActorRefFrom } from "./spawn-D9jgw9pW.js";
-import { t as Manager } from "./Manager-CQQ99QOI.js";
-import "./Actor-iTq7YY48.js";
+import { t as Manager } from "./Manager-C9T5amUN.js";
+import "./Actor-DpTj5PFb.js";
 //#region src/modules/watchlist/watchlistStateMachine.d.ts
 type WatchlistResult = 'success' | 'skipped';
 declare const watchlistMachine: any;

package/dist/{watchlistStateMachine-CBqk2w-h.esm.js → watchlistStateMachine-Dgfm42w2.esm.js}

@@ -1,7 +1,7 @@
 import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-import { i as assign, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
-import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
+import { t as endpoints } from "./endpoints-DHzlkQNe.esm.js";
+import { i as assign, t as setup } from "./xstate.esm-DSajW7CJ.esm.js";
+import { n as fromPromise } from "./xstate-actors.esm-8Gzepa_A.esm.js";
 //#region src/modules/watchlist/watchlistServices.ts
 async function processWatchlist(signal) {
 	const res = await api.post(endpoints.processGlobalWatchlist, {}, { signal });