@incodetech/core 2.3.2 → 2.4.0-rc.1

package/dist/{wasmWebClient-B7baE-Wf.esm.js → wasmWebClient-BjZw_7OB.esm.js}

@@ -1,3 +1,191 @@
+import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
+//#region ../infra/src/wasm/wasmIntegrityManifest.ts
+/** SHA-256 digests of the official WASM release files this SDK loads. */
+const WASM_INTEGRITY_MANIFEST = {
+	wasmVersion: "v2.14.50-post1",
+	files: {
+		"models/current/age_estimation_v2_2_2_fp16.ortmodelv2": "70bd372b5e140ea8e9773a25d371cb65e5a9090651fdfe73ab6fc7ce25d59c83",
+		"models/current/barcode_enhance_896x224_fp16.ortmodelv2": "bccecd74abf48181efb95bf020784b7e50d37ae255bf89c14c2c5186976279e0",
+		"models/current/face_attributes_v1_3_fp16.ortmodelv2": "96079ec080a92ae1821b456f06281a604b4b013af42313f9668210c9bbe7041f",
+		"models/current/face_occlusion_v0_2_fp16.ortmodelv2": "7a846b12b7a9a5afe72e07f19b408095439a214aaa306e88d34d1f17ffce72fb",
+		"models/current/id_capture_2_01_fp16.ortmodelv2": "06b337368249131af6bab66bdf4fca680298034e3e83d678656d255cdb480507",
+		"models/current/id_facedetector_v2_1_fp16.ortmodelv2": "ab35d7c2f69d5c156f7e247bde652c4ac7b78cdc4a90ef55f5a928edc54e2bd8",
+		"models/current/id_fiqa_19a81a0b9bf6492eb03b4667f6db4c85_fp16.ortmodelv2": "1cc02608aed0078bf9cc66ae4f51b150e7b5aa65c5fb270248bda7c327867d26",
+		"models/current/mls_regressor_4773007c657b4f05a460321456740d0f_fp16.ortmodelv2": "74a955dff00183c69544a9b61cc7e1122c7cd3814811dcd7ae8cf862bda35c41",
+		"models/current/ondevice_physical_liveness_v2_1_fp16.ortmodelv2": "188227beafee6ccce16d562ae531eae894aa4b1056dce339741b5e80a695794a",
+		"models/current/selfie_bf_angles_192x192_opset9_fp16.ortmodelv2": "6bdb142f67e81d9e6006d94888eba2e6a7bf20a6283c66e14db8b654c8fa9bfd",
+		"models/legacy/age_estimation_v2_2_2_fp16.ortmodelv2": "28ffdec742ec7856a3b113ee86af01e4629b576139faff1cf7094bf451c94a60",
+		"models/legacy/barcode_enhance_896x224_fp16.ortmodelv2": "aef15080020d5a329870cc3d50f73a1c676526d1f6f6df282f7dc0c95e6018b9",
+		"models/legacy/face_attributes_v1_3_fp16.ortmodelv2": "7c6754b63b4e205370463df4c6396f29123d7b5a17823a2d78a59b2fb17cc98b",
+		"models/legacy/face_occlusion_v0_2_fp16.ortmodelv2": "19fc95f2081e55962045f0e38387399fb11c1b636699e31558383d2ea4156aed",
+		"models/legacy/id_capture_2_01_fp16.ortmodelv2": "2f791bbf1f0dc9c6b8ff95587ce61479a764a18070e83658f6366996a7df9615",
+		"models/legacy/id_facedetector_v2_1_fp16.ortmodelv2": "f790693395cc1473a824a97b86fd2943586b490582e003b240dff4d51d9f417f",
+		"models/legacy/id_fiqa_19a81a0b9bf6492eb03b4667f6db4c85_fp16.ortmodelv2": "d058e82efca7c30a35dd0a03472695656c105952f27af2ea158cb00818caab8c",
+		"models/legacy/mls_regressor_4773007c657b4f05a460321456740d0f_fp16.ortmodelv2": "e41887f75b284ba1f973f2a26209bf365da8a587d266492b642e5b7c36716069",
+		"models/legacy/ondevice_physical_liveness_v2_1_fp16.ortmodelv2": "405eee9fd961c48fff608246ef579dc8ce9f0b5ce51361e05dac7d9afcf9162d",
+		"models/legacy/selfie_bf_angles_192x192_opset9_fp16.ortmodelv2": "1c8dda528d5111fa7b4272ffabca7cf0a59099f57258aaece7262974aebafc4a",
+		"webLib.js": "2953d4da3b8eddf1ff48e113ac4ff11d69eb379e1ab091fec1dad34a17d23844",
+		"webLib.wasm": "7616ea70cab3171ef376f9d0fa646548efc90beab49fdefa25d1b241ca704673",
+		"webLibSimd.js": "51407ce3032dd330ae806d9aea1b43eb5c245e2b64780b4b62c9c62310a0bee1",
+		"webLibSimd.wasm": "0575425989803e58ccb82fcd30d64508a7c7b52019564d8644b59d5cf11135ab"
+	},
+	dist: {
+		"webLib.js": "6d7177b6e2e86a0d975b595ea546bf87fc11a194ad4cbdc0613fb3b2a2810e90",
+		"webLibSimd.js": "4ac981fa15dd748ec1a312bd25408fb4af3449d8c1bb6ebb8fe436476049d446"
+	}
+};
+//#endregion
+//#region ../infra/src/wasm/wasmIntegrity.ts
+/**
+* Integrity check for every WASM binary, glue file and ML model the SDK loads.
+*
+* Each asset is matched, by slot, against the SHA-256 digests of the official
+* ml-wasm-kit release in {@link WASM_INTEGRITY_MANIFEST}. The host does not
+* matter: the Incode CDN, a self-hosted copy and `@incodetech/wasm-assets` all
+* serve the same official files, so they all carry the same digests. A file
+* that does not match is never instantiated or evaluated.
+*
+* The one input this cannot hash is a `loadGlue` callback: the integrator's
+* bundler hands over a module, not bytes. That glue is part of the
+* integrator's own bundle, the same trust boundary as the SDK code running
+* this check, and is reported as `bundled`.
+*/
+var WasmIntegrityError = class extends Error {
+	constructor(code, asset, message, cause) {
+		super(`[Incode SDK] ${message}`);
+		this.name = "WasmIntegrityError";
+		this.code = code;
+		this.asset = asset;
+		this.cause = cause;
+	}
+};
+const DIGEST_PREFIX_LENGTH = 12;
+const HTML_SNIFF_BYTES = 512;
+let observer = null;
+let verified = 0;
+let failed = 0;
+let bundled = 0;
+let hashMs = 0;
+/**
+* Installs the sink core maps to TrueSight and the event log. Infra cannot
+* import either, so core injects it, as with `setWebApiHttpTransport`.
+*/
+function setWasmIntegrityObserver(next) {
+	observer = next;
+}
+function notify(check) {
+	if (check.status === "verified") verified += 1;
+	else if (check.status === "bundled") bundled += 1;
+	else failed += 1;
+	hashMs += check.durationMs ?? 0;
+	try {
+		observer?.onAssetChecked?.(check);
+	} catch {}
+}
+/** Reports the totals since the last summary, then resets them. */
+function reportWasmIntegritySummary() {
+	if (verified + failed + bundled === 0) return;
+	const summary = {
+		wasmVersion: WASM_INTEGRITY_MANIFEST.wasmVersion,
+		verified,
+		failed,
+		bundled,
+		hashMs: Math.round(hashMs)
+	};
+	verified = 0;
+	failed = 0;
+	bundled = 0;
+	hashMs = 0;
+	try {
+		observer?.onSummary?.(summary);
+	} catch {}
+}
+/** Records glue that arrived through a `loadGlue` callback and has no bytes. */
+function reportBundledWasmGlue(slot) {
+	notify({
+		asset: slot,
+		status: "bundled"
+	});
+}
+function assetLabel(asset) {
+	return asset.kind === "model" ? asset.file ?? "model" : asset.slot;
+}
+function expectedDigests(asset) {
+	const { files, dist } = WASM_INTEGRITY_MANIFEST;
+	if (asset.kind === "binary") return [files[asset.slot]].filter(isDigest);
+	if (asset.kind === "glue") return [files[asset.slot], dist[asset.slot]].filter(isDigest);
+	if (asset.file === void 0) return Object.entries(files).filter(([key]) => key.startsWith("models/")).map(([, digest]) => digest);
+	return [files[`models/current/${asset.file}`], files[`models/legacy/${asset.file}`]].filter(isDigest);
+}
+function isDigest(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function toHex(buffer) {
+	return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function looksLikeHtml(bytes) {
+	let text = new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, HTML_SNIFF_BYTES));
+	if (text.charCodeAt(0) === 65279) text = text.slice(1);
+	const start = text.trimStart().slice(0, 9).toLowerCase();
+	return start.startsWith("<!doctype") || start.startsWith("<html");
+}
+/**
+* Rejects an HTML page served in place of an asset. The Incode CDN answers
+* every missing path with HTTP 200 and a small HTML page, so `response.ok`
+* cannot detect a miss.
+*/
+function assertNotHtml(contentType, bytes, asset) {
+	if (contentType?.toLowerCase().includes("text/html") || looksLikeHtml(bytes)) {
+		const label = assetLabel(asset);
+		notify({
+			asset: label,
+			status: "not-binary",
+			byteLength: bytes.byteLength
+		});
+		throw new WasmIntegrityError("WASM_ASSET_NOT_BINARY", label, `The WASM asset ${label} was served as an HTML page (${bytes.byteLength} bytes), not the release file. Check that the file exists at its configured URL.`);
+	}
+}
+/**
+* Verifies `bytes` against the official digests for `asset` and throws a
+* {@link WasmIntegrityError} when they do not match. `fetchMs`, when the
+* bytes came over the network, rides along on the reported check.
+*/
+async function verifyWasmAsset(asset, bytes, fetchMs) {
+	const label = assetLabel(asset);
+	const subtle = globalThis.crypto?.subtle;
+	if (subtle === void 0) {
+		notify({
+			asset: label,
+			status: "unavailable"
+		});
+		throw new WasmIntegrityError("WASM_INTEGRITY_UNAVAILABLE", label, "WASM assets cannot be verified because crypto.subtle is unavailable. Serve the page over HTTPS.");
+	}
+	const startedAt = performance.now();
+	const actual = toHex(await subtle.digest("SHA-256", bytes));
+	const durationMs = performance.now() - startedAt;
+	const expected = expectedDigests(asset);
+	if (expected.includes(actual)) {
+		notify({
+			asset: label,
+			status: "verified",
+			durationMs,
+			fetchMs,
+			byteLength: bytes.byteLength
+		});
+		return;
+	}
+	notify({
+		asset: label,
+		status: "mismatch",
+		durationMs,
+		fetchMs,
+		byteLength: bytes.byteLength,
+		expectedDigestPrefix: expected[0]?.slice(0, DIGEST_PREFIX_LENGTH),
+		actualDigestPrefix: actual.slice(0, DIGEST_PREFIX_LENGTH)
+	});
+	throw new WasmIntegrityError("WASM_INTEGRITY_MISMATCH", label, `The WASM asset ${label} does not match the official ${WASM_INTEGRITY_MANIFEST.wasmVersion} release file. Serve the unmodified files for this SDK release.`);
+}
+//#endregion
 //#region ../infra/src/wasm/wasmAssets.ts
 const WASM_MODEL_FILES = {
 	idCapture: "id_capture_2_01_fp16.ortmodelv2",
@@ -83,9 +271,21 @@ const WASM_PIPELINE_MODELS = {
 	videoSelfie: WASM_PIPELINE_MODEL_NAMES.videoSelfie.map((model) => WASM_MODEL_FILES[model]),
 	videoSelfieId: WASM_PIPELINE_MODEL_NAMES.videoSelfieId.map((model) => WASM_MODEL_FILES[model])
 };
-async function resolveWasmSource(source, kind) {
+/**
+* Loads a WASM asset as bytes and verifies it against the official release
+* digests before returning it. Byte sources are verified too: the check does
+* not depend on where an asset comes from.
+*/
+async function resolveWasmSource(source, asset) {
+	const fetchStartedAt = performance.now();
+	const bytes = await fetchWasmSource(source, asset);
+	await verifyWasmAsset(asset, bytes, typeof source === "string" ? performance.now() - fetchStartedAt : void 0);
+	return bytes;
+}
+async function fetchWasmSource(source, asset) {
 	if (source instanceof Uint8Array) return source;
 	if (source instanceof ArrayBuffer) return new Uint8Array(source);
+	const { kind } = asset;
 	let response;
 	try {
 		response = await fetch(source);
@@ -94,7 +294,9 @@ async function resolveWasmSource(source, kind) {
 		throw new Error(`[Incode SDK] Could not load the WASM ${kind} at ${source}: ${detail}`);
 	}
 	if (!response.ok) throw new Error(`[Incode SDK] Could not load the WASM ${kind} at ${source}: ${response.status} ${response.statusText}`);
-	return new Uint8Array(await response.arrayBuffer());
+	const bytes = new Uint8Array(await response.arrayBuffer());
+	assertNotHtml(response.headers.get("content-type"), bytes, asset);
+	return bytes;
 }
 function missingWasmModelError(fileName, pipeline) {
 	return /* @__PURE__ */ new Error(`[Incode SDK] The "${pipeline}" pipeline needs ${fileName}, but the self-hosted WASM configuration does not provide it.`);
@@ -109,6 +311,155 @@ function deriveSiblingJsPath(wasmPath) {
 	return `${wasmPath.slice(0, index)}.js${rest}`;
 }
 //#endregion
+//#region ../infra/src/wasm/wasmDefaults.ts
+const WASM_CDN_BASE_URL = "https://cdn.incodesmile.com/ml-wasm-kit-release";
+/** The WASM version bundled and tested with this SDK release. */
+const DEFAULT_WASM_VERSION = "v2.14.50-post1";
+const PATH_KEYS = [
+	"wasmPath",
+	"wasmSimdPath",
+	"glueCodePath",
+	"glueCodeSimdPath",
+	"modelsBasePath"
+];
+function isBlank(value) {
+	return value.trim() === "";
+}
+function hasDisallowedControlChars(value) {
+	for (let i = 0; i < value.length; i += 1) {
+		const code = value.charCodeAt(i);
+		if (code < 32 || code === 127) return true;
+	}
+	return false;
+}
+function isMalformedPath(value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return false;
+	if (hasDisallowedControlChars(trimmed)) return true;
+	if (/^https?:\/\//i.test(trimmed)) try {
+		new URL(trimmed);
+		return false;
+	} catch {
+		return true;
+	}
+	return false;
+}
+function warnInvalidWasmPath(field, reason) {
+	if (reason === "empty") {
+		console.warn(`[Incode SDK] wasm.${field} is empty. Falling back to CDN default.`);
+		return;
+	}
+	console.warn(`[Incode SDK] wasm.${field} appears malformed. Falling back to CDN default.`);
+}
+function warnMalformedWasmPath(field) {
+	console.warn(`[Incode SDK] wasm.${field} appears malformed. Check the URL or path.`);
+}
+/**
+* Validates merged WASM path strings. When overrides contained blank path
+* values, callers should have already fallen back to defaults before this runs.
+*/
+function validateWasmPaths(config) {
+	for (const key of PATH_KEYS) {
+		const value = config[key];
+		if (typeof value === "string" && isMalformedPath(value)) warnMalformedWasmPath(key);
+	}
+}
+function pickPath(key, overrides, defaultValue) {
+	if (!overrides || !(key in overrides)) return defaultValue;
+	const raw = overrides[key];
+	if (raw === void 0) return defaultValue;
+	if (typeof raw !== "string") return defaultValue;
+	if (isBlank(raw)) {
+		warnInvalidWasmPath(key, "empty");
+		return defaultValue;
+	}
+	if (isMalformedPath(raw)) {
+		warnInvalidWasmPath(key, "malformed");
+		return defaultValue;
+	}
+	return raw.trim();
+}
+function pickSource(key, overrides, defaultValue) {
+	if (!(key in overrides) || overrides[key] === void 0) return defaultValue;
+	const source = overrides[key];
+	if (typeof source !== "string") return source;
+	return pickPath(key, overrides, String(defaultValue));
+}
+function resolveBasePath(overrides) {
+	const defaultValue = `${WASM_CDN_BASE_URL}/${DEFAULT_WASM_VERSION}`;
+	if (!("basePath" in overrides) || overrides.basePath === void 0) return defaultValue;
+	const basePath = overrides.basePath;
+	if (typeof basePath !== "string" || isBlank(basePath) || isMalformedPath(basePath)) throw new Error("[Incode SDK] wasm.basePath is invalid.");
+	return basePath.trim();
+}
+/** Builds a WarmupConfig from a directory that mirrors the ml-wasm-kit CDN layout. */
+function buildWasmConfigFromBasePath(basePath) {
+	const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+	return {
+		wasmPath: `${base}/webLib.wasm`,
+		wasmSimdPath: `${base}/webLibSimd.wasm`,
+		glueCodePath: `${base}/webLib.js`,
+		glueCodeSimdPath: `${base}/webLibSimd.js`,
+		modelsBasePath: `${base}/models`
+	};
+}
+/** Builds the standard WarmupConfig from the Incode CDN. */
+function buildDefaultWasmConfig() {
+	return buildWasmConfigFromBasePath(`${WASM_CDN_BASE_URL}/${DEFAULT_WASM_VERSION}`);
+}
+/**
+* Whether `config` loads the SDK's own CDN build of `DEFAULT_WASM_VERSION`.
+* TrueSight reports its negation as `basePathPinned`: the host pointed the
+* SDK at its own location, version, or bytes.
+*/
+function isDefaultCdnWasmConfig(config) {
+	const defaults = buildDefaultWasmConfig();
+	return config.selfHosted !== true && config.wasmPath === defaults.wasmPath && config.glueCodePath === defaults.glueCodePath;
+}
+const BARCODE_ENHANCE_MODEL_FILE = WASM_MODEL_FILES.barcode;
+/**
+* URL of the lazily-loaded PDF417 barcode enhancement model (US Smart Capture).
+* Derived from the resolved `modelsBasePath` so self-hosted / air-gapped
+* deployments resolve it correctly, falling back to the CDN default. Loaded on
+* demand via `IIdCaptureCapability.setBarcodeEnhancementModel` — deliberately
+* NOT part of any warmup model bundle.
+*/
+function getBarcodeEnhanceModelUrl(modelsBasePath, variant = "current") {
+	const source = buildModelVariantSources(modelsBasePath ?? `${WASM_CDN_BASE_URL}/v2.14.50-post1/models`, BARCODE_ENHANCE_MODEL_FILE);
+	return typeof source === "string" ? source : source[variant];
+}
+/**
+* Merges optional WASM path overrides with CDN defaults. Explicit non-blank
+* paths take precedence. Blank override strings log a warning and fall back to defaults.
+*/
+function resolveWasmConfig(overrides) {
+	if (!overrides) return buildDefaultWasmConfig();
+	const defaults = buildWasmConfigFromBasePath(resolveBasePath(overrides));
+	const resolvedWasmPath = pickSource("wasmPath", overrides, defaults.wasmPath);
+	const simdDefault = overrides.selfHosted ? resolvedWasmPath : defaults.wasmSimdPath;
+	const modelsDefault = defaults.modelsBasePath;
+	const resolvedWasmSimdPath = pickSource("wasmSimdPath", overrides, simdDefault);
+	const glueCodeSimdDefault = typeof resolvedWasmSimdPath === "string" ? deriveSiblingJsPath(resolvedWasmSimdPath) : defaults.glueCodeSimdPath;
+	const merged = {
+		wasmPath: resolvedWasmPath,
+		wasmSimdPath: resolvedWasmSimdPath,
+		glueCodePath: pickPath("glueCodePath", overrides, defaults.glueCodePath),
+		glueCodeSimdPath: pickPath("glueCodeSimdPath", overrides, glueCodeSimdDefault),
+		modelsBasePath: pickPath("modelsBasePath", overrides, modelsDefault),
+		useSimd: overrides.useSimd,
+		showLogs: overrides.showLogs,
+		pipelines: overrides.pipelines,
+		pipelineModels: overrides.pipelineModels,
+		modelUrls: overrides.modelUrls,
+		legacyModelUrls: overrides.legacyModelUrls,
+		loadGlue: overrides.loadGlue,
+		loadGlueSimd: overrides.loadGlueSimd,
+		selfHosted: overrides.selfHosted
+	};
+	validateWasmPaths(merged);
+	return merged;
+}
+//#endregion
 //#region ../infra/src/providers/browser/SemaphoreProvider.ts
 const DEFAULT_ACQUIRE_TIMEOUT_MS = 3e4;
 /**
@@ -208,6 +559,44 @@ var SemaphoreProvider = class {
 	}
 };
 //#endregion
+//#region ../infra/src/wasm/wasmDiagnostics.ts
+let handler = null;
+function setWasmDiagnosticsHandler(next) {
+	handler = next;
+}
+/**
+* Fire-and-forget: a no-op without a handler, and handler exceptions are
+* swallowed — diagnostics must never throw into the host code path.
+*/
+function emitWasmDiagnostic(entry) {
+	if (handler === null) return;
+	try {
+		handler(entry);
+	} catch {}
+}
+//#endregion
+//#region ../infra/src/wasm/wasmGlueImport.ts
+/**
+* Evaluates verified glue bytes as an ES module from a `blob:` URL.
+*
+* The bytes are the ones the integrity check hashed. Importing the original URL
+* instead would fetch it a second time, and that response is not the one that
+* was checked. Kept in its own module so unit tests, which cannot import
+* `blob:` URLs under Node, can substitute it.
+*/
+async function importVerifiedGlue(bytes) {
+	const blobUrl = URL.createObjectURL(new Blob([bytes], { type: "text/javascript" }));
+	try {
+		return await import(
+			/* @vite-ignore */
+			/* webpackIgnore: true */
+			blobUrl
+);
+	} finally {
+		URL.revokeObjectURL(blobUrl);
+	}
+}
+//#endregion
 //#region ../infra/src/wasm/wasmStorageFallback.ts
 /**
 * SDK-local compatibility fallback for ml-wasm-kit releases whose embind
@@ -411,30 +800,61 @@ function acquireWasmStorageFallback() {
 if (typeof window !== "undefined" && window.wasmArrayBuffer === void 0) window.wasmArrayBuffer = null;
 let loadPromise = null;
 let loadedResult = null;
-async function importGlueAt(glueCodePath) {
-	const mod = await import(
-		/* @vite-ignore */
-		/* webpackIgnore: true */
-		glueCodePath
-);
+/** Fetches the glue, verifies it, and evaluates exactly the verified bytes. */
+async function importGlueAt(glueCodePath, slot) {
+	const bytes = await resolveWasmSource(glueCodePath, {
+		kind: "glue",
+		slot
+	});
+	let mod;
+	try {
+		mod = await importVerifiedGlue(bytes);
+	} catch (error) {
+		throw new WasmIntegrityError("WASM_GLUE_BLOCKED_BY_CSP", slot, `The verified WASM glue ${slot} could not be loaded from a blob: URL. Allow blob: in the script-src Content-Security-Policy directive.`, error);
+	}
 	if (typeof mod.Module !== "function") throw new Error(`WASM glue at ${glueCodePath} did not export a Module factory`);
 	return mod.Module;
 }
-async function resolveGlue(loader, glueCodePath) {
+async function resolveGlue(loader, glueCodePath, slot) {
 	if (loader) {
 		const module = await loader();
 		if (typeof module.Module !== "function") throw new Error("[Incode SDK] WASM glue module did not export a Module factory.");
+		reportBundledWasmGlue(slot);
 		return module.Module;
 	}
 	if (!glueCodePath) throw new Error("WASM glue code is required");
-	return await importGlueAt(glueCodePath);
+	return await importGlueAt(glueCodePath, slot);
 }
-async function instantiate(factory, libPath) {
-	window.wasmArrayBuffer = await resolveWasmSource(libPath, "binary");
-	return await factory({ wasmBinary: window.wasmArrayBuffer });
+async function instantiate(factory, libPath, slot, showLogs = false) {
+	window.wasmArrayBuffer = await resolveWasmSource(libPath, {
+		kind: "binary",
+		slot
+	});
+	return await factory({
+		wasmBinary: window.wasmArrayBuffer,
+		print: (text) => {
+			if (showLogs) console.log(text);
+		},
+		printErr: (text) => {
+			if (showLogs) console.error(text);
+		},
+		onAbort: (what) => {
+			emitWasmDiagnostic({
+				level: "severe",
+				subsystem: "abort",
+				category: "other",
+				message: `wasm aborted what=${String(what)}`
+			});
+		}
+	});
+}
+/** `code=` for integrity failures, which name a cause more precisely than the message. */
+function describeLoadError(error) {
+	return error instanceof WasmIntegrityError ? `code=${error.code} asset=${error.asset}` : `error=${String(error)}`;
 }
 /**
-* Load the WASM module, memoized. Subsequent calls return the same instance.
+* Load the WASM module, memoized. Subsequent calls return the same instance,
+* retaining the first caller's logging configuration.
 *
 * SIMD-first with fallback: if `useSimd !== false` and a `wasmSimdPath` is
 * provided, the SIMD binary + SIMD glue are tried first; on instantiation
@@ -444,6 +864,7 @@ async function instantiate(factory, libPath) {
 async function loadWasmModule(config) {
 	if (loadedResult) return loadedResult;
 	if (loadPromise) return loadPromise;
+	const startedAtMs = getTimestamp();
 	loadPromise = (async () => {
 		let storageFallbackLease = null;
 		try {
@@ -451,27 +872,52 @@ async function loadWasmModule(config) {
 			const wantSimd = config.useSimd !== false;
 			const simdBinary = config.wasmSimdPath ?? config.wasmPath;
 			if (wantSimd && simdBinary !== config.wasmPath) try {
-				const simdFactory = await resolveGlue(config.loadGlueSimd, typeof simdBinary === "string" ? config.glueCodeSimdPath || deriveSiblingJsPath(simdBinary) : config.glueCodeSimdPath);
+				const simdFactory = await resolveGlue(config.loadGlueSimd, typeof simdBinary === "string" ? config.glueCodeSimdPath || deriveSiblingJsPath(simdBinary) : config.glueCodeSimdPath, "webLibSimd.js");
 				window.Module = simdFactory;
 				const result = {
-					wasmModule: await instantiate(simdFactory, simdBinary),
+					wasmModule: await instantiate(simdFactory, simdBinary, "webLibSimd.wasm", config.showLogs),
 					simdUsed: true
 				};
 				loadedResult = result;
+				emitWasmDiagnostic({
+					level: "debug",
+					subsystem: "loader",
+					category: "other",
+					message: `wasm module loaded simd=true durationMs=${getTimestamp() - startedAtMs}`
+				});
 				return result;
 			} catch (simdError) {
-				console.warn("[Incode SDK] SIMD WASM load failed, falling back to non-SIMD", simdError);
+				if (simdError instanceof WasmIntegrityError) throw simdError;
+				if (config.showLogs) console.warn("[Incode SDK] SIMD WASM load failed, falling back to non-SIMD", simdError);
+				emitWasmDiagnostic({
+					level: "warning",
+					subsystem: "loader",
+					category: "other",
+					message: `simd load failed falling back ${describeLoadError(simdError)}`
+				});
 			}
-			const nonSimdFactory = await resolveGlue(config.loadGlue, config.glueCodePath);
+			const nonSimdFactory = await resolveGlue(config.loadGlue, config.glueCodePath, "webLib.js");
 			window.Module = nonSimdFactory;
 			const result = {
-				wasmModule: await instantiate(nonSimdFactory, config.wasmPath),
+				wasmModule: await instantiate(nonSimdFactory, config.wasmPath, "webLib.wasm", config.showLogs),
 				simdUsed: false
 			};
 			loadedResult = result;
+			emitWasmDiagnostic({
+				level: "debug",
+				subsystem: "loader",
+				category: "other",
+				message: `wasm module loaded simd=false durationMs=${getTimestamp() - startedAtMs}`
+			});
 			return result;
 		} catch (error) {
 			loadPromise = null;
+			emitWasmDiagnostic({
+				level: "error",
+				subsystem: "loader",
+				category: "other",
+				message: `wasm load failed ${describeLoadError(error)}`
+			});
 			throw error;
 		} finally {
 			storageFallbackLease?.release();
@@ -479,6 +925,98 @@ async function loadWasmModule(config) {
 	})();
 	return loadPromise;
 }
+function emptyCounters() {
+	return {
+		analyzeFrameCount: 0,
+		analyzeFrameMaxMs: 0,
+		getCheckCount: 0,
+		collisionCount: 0
+	};
+}
+let lockHeldBy = null;
+let waitWarningsLogged = 0;
+let collisionWarningsLogged = 0;
+let counters = emptyCounters();
+function noteLockAcquired(label, waitMs) {
+	lockHeldBy = label;
+	if (waitMs > 250 && waitWarningsLogged < 5) {
+		waitWarningsLogged += 1;
+		emitWasmDiagnostic({
+			level: "warning",
+			subsystem: "calls",
+			category: "other",
+			message: `semaphore wait method=${label} waitMs=${Math.round(waitMs)}`
+		});
+	}
+}
+function noteLockReleased(label, waitMs, durationMs) {
+	lockHeldBy = null;
+	emitWasmDiagnostic({
+		level: "debug",
+		subsystem: "calls",
+		category: "other",
+		message: `call method=${label} waitMs=${Math.round(waitMs)} durationMs=${Math.round(durationMs)}`
+	});
+}
+/** Collision check for the lock-bypassing deepsight methods. */
+function noteUnlockedCallStart(name) {
+	if (lockHeldBy === null) return;
+	counters.collisionCount += 1;
+	if (collisionWarningsLogged < 5) {
+		collisionWarningsLogged += 1;
+		emitWasmDiagnostic({
+			level: "warning",
+			subsystem: "calls",
+			category: "other",
+			message: `collision unlocked=${name} lockedBy=${lockHeldBy}`
+		});
+	}
+}
+function noteUnlockedCallEnd(name, durationMs) {
+	if (name === "analyzeFrame") {
+		counters.analyzeFrameCount += 1;
+		counters.analyzeFrameMaxMs = Math.max(counters.analyzeFrameMaxMs, Math.round(durationMs));
+		return;
+	}
+	counters.getCheckCount += 1;
+}
+/** Aggregates since the last snapshot; clears them for the next capture. */
+function snapshotAndResetCallCounters() {
+	const snapshot = counters;
+	counters = emptyCounters();
+	return snapshot;
+}
+let pipelinePullEmissions = 0;
+/**
+* Row 36: each pipeline-state pull (once per capture) carries the row 29b
+* counters accumulated since the previous one, then resets them. The state
+* itself is never read: what the kit's pipelines expose to diagnostics is
+* the kit's own decision (its sensor withholds verdicts such as age and
+* liveness), so the SDK keeps no second gate over the C++ blob.
+*/
+function notePipelineStatePulled() {
+	if (pipelinePullEmissions >= 20) return;
+	pipelinePullEmissions += 1;
+	const calls = snapshotAndResetCallCounters();
+	emitWasmDiagnostic({
+		level: "debug",
+		subsystem: "pipeline",
+		category: "other",
+		message: `pipeline state pulled analyzeFrames=${calls.analyzeFrameCount} maxAnalyzeMs=${calls.analyzeFrameMaxMs} getChecks=${calls.getCheckCount} collisions=${calls.collisionCount}`
+	});
+}
+/** Per-session budgets and counters; called from `setup()` via `rearmWasmDiagnostics`. */
+function rearmWasmCallDiagnostics() {
+	waitWarningsLogged = 0;
+	collisionWarningsLogged = 0;
+	counters = emptyCounters();
+	pipelinePullEmissions = 0;
+}
+/** Full reset with the runtime (`WasmRuntime.freeResources()`). */
+function resetWasmCallDiagnostics() {
+	lockHeldBy = null;
+	rearmWasmCallDiagnostics();
+}
 //#endregion
 //#region ../infra/src/wasm/wasmCallUtils.ts
 /**
@@ -513,18 +1051,6 @@ var WasmPollTimeoutError = class extends Error {
 		this.label = label;
 	}
 };
-/**
-* Busy-polls an iterative WASM method until it returns `true`, optionally under
-* a concurrency lock.
-*
-* @param concurrency - semaphore used when `useSemaphore` is true.
-* @param wasmMethod - zero-arg closure over the C++ call; `false` means "call me
-*   again", `true` means done. Bind any arguments in the closure.
-* @param useSemaphore - `false` bypasses the lock (caller already holds one, or
-*   is provably the only caller).
-* @param options - see {@link WasmPollOptions}. `maxPolls` omitted = unbounded.
-* @throws {WasmPollTimeoutError} when `maxPolls` is exhausted.
-*/
 async function wasmCallWrapper(concurrency, wasmMethod, useSemaphore = true, options = {}) {
 	const { maxPolls, label } = options;
 	const innerCall = async () => {
@@ -537,7 +1063,18 @@ async function wasmCallWrapper(concurrency, wasmMethod, useSemaphore = true, opt
 		}
 	};
 	if (useSemaphore) {
-		await concurrency.withLock(innerCall);
+		const callLabel = label ?? "unlabeled";
+		const requestedAt = performance.now();
+		await concurrency.withLock(async () => {
+			const acquiredAt = performance.now();
+			const waitMs = acquiredAt - requestedAt;
+			noteLockAcquired(callLabel, waitMs);
+			try {
+				await innerCall();
+			} finally {
+				noteLockReleased(callLabel, waitMs, performance.now() - acquiredAt);
+			}
+		});
 		return;
 	}
 	await innerCall();
@@ -734,4 +1271,4 @@ function ensureReady() {
 	return webClientApi;
 }
 //#endregion
-export { WASM_PIPELINE_OPTIONAL_MODEL_NAMES as _, setWebApiHttpTransport as a, resolveWasmSource as b, wasmCallWrapper as c, SemaphoreProvider as d, deriveSiblingJsPath as f, WASM_PIPELINE_MODEL_NAMES as g, WASM_PIPELINE_MODELS as h, initializeWasmWebClient as i, loadWasmModule as l, WASM_PIPELINE_LAZY_MODEL_NAMES as m, createWebApiHostAdapter as n, setupWasmConnection as o, WASM_MODEL_FILES as p, executeWasmRequest as r, ML_CALL_MAX_POLLS as s, WasmWebClientError as t, acquireWasmStorageFallback as u, buildModelVariantSources as v, missingWasmModelError as y };
+export { buildModelVariantSources as A, isDefaultCdnWasmConfig as C, WASM_PIPELINE_MODELS as D, WASM_PIPELINE_LAZY_MODEL_NAMES as E, resolveWasmSource as M, reportWasmIntegritySummary as N, WASM_PIPELINE_MODEL_NAMES as O, setWasmIntegrityObserver as P, getBarcodeEnhanceModelUrl as S, WASM_MODEL_FILES as T, setWasmDiagnosticsHandler as _, setWebApiHttpTransport as a, buildDefaultWasmConfig as b, wasmCallWrapper as c, noteUnlockedCallStart as d, rearmWasmCallDiagnostics as f, emitWasmDiagnostic as g, acquireWasmStorageFallback as h, initializeWasmWebClient as i, missingWasmModelError as j, WASM_PIPELINE_OPTIONAL_MODEL_NAMES as k, notePipelineStatePulled as l, loadWasmModule as m, createWebApiHostAdapter as n, setupWasmConnection as o, resetWasmCallDiagnostics as p, executeWasmRequest as r, ML_CALL_MAX_POLLS as s, WasmWebClientError as t, noteUnlockedCallEnd as u, SemaphoreProvider as v, resolveWasmConfig as w, buildWasmConfigFromBasePath as x, DEFAULT_WASM_VERSION as y };