@arkyc/widget 1.2.2 → 1.2.3

package/dist/client.d.mts

@@ -115,7 +115,12 @@ declare class WidgetApiError extends Error {
 interface ArkycClientOptions {
   /** Short-lived client token minted for this session. */
   token: string;
-  /** API origin (defaults to the same origin the widget is served from). */
+  /**
+   * API base. Omitted or a relative path (e.g. `/api`) resolves against the
+   * current origin — same-origin, so no CORS. An absolute URL (e.g.
+   * `https://api.example.com/api`) is used as-is and requires the API to allow
+   * this origin via CORS.
+   */
   baseUrl?: string;
   /** Injectable for testing; defaults to the global `fetch`. */
   fetch?: typeof fetch;

package/dist/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;UAWiB,aAAA;EACf,EAAA;EACA,MAAA,EAAQ,kBAAA;EACR,UAAA;EADQ;EAGR,aAAA,GAAgB,YAAA;EAEM;EAAtB,mBAAA,GAAsB,iBAAA;EAIX;EAFX,OAAA,GAAU,aAAA;EAMC;EAJX,QAAA,GAAW,cAAA;EAIc;EAFzB,QAAA,GAAW,eAAA;EAXX;EAaA,QAAA,GAAW,cAAA;AAAA;;;;;;;;UAUI,cAAA;EACf,SAAA;EAbW;EAeX,OAAA;EAbW;EAeX,KAAA;EAAA,CACC,KAAA;AAAA;;UAIc,aAAA;EACf,OAAA;EAVA;EAYA,aAAA;EARA;EAUA,GAAA;AAAA;AATc;AAIhB;;;AAJgB,UAgBC,mBAAA;EACf,aAAA;EACA,cAAA;EACA,OAAA;EACA,cAAA;EACA,eAAA;EACA,cAAA;EACA,eAAA;EACA,iBAAA;EACA,aAAA;EACA,cAAA;AAAA;;UAIe,YAAA;EATf;EAWA,KAAA;EACA,KAAA;EACA,IAAA;EACA,MAAA;EACA,UAAA;EAVc;EAYd,OAAA;EARe;EAUf,GAAA,GAAM,IAAA;;EAEN,QAAA;EACA,SAAA;EACA,OAAA,GAAU,mBAAmB;AAAA;;UAId,kBAAA;EACf,KAAA,GAAQ,IAAA;EACR,OAAA;EACA,YAAA,GAAe,YAAA;EACf,OAAA,GAAU,mBAAA;AAAA;;UAIK,iBAAA;EACf,KAAA,GAAQ,IAAA;EACR,OAAA;EACA,YAAA,GAAe,YAAY;AAAA;;UAIZ,aAAA;EACf,MAAA,GAAS,IAAA;EAZC;EAcV,KAAA,GAAQ,IAAA;EAdqB;EAgB7B,IAAA,GAAO,YAAA;EAnBC;EAqBR,UAAA,GAAa,iBAAA;EACb,OAAA,GAAU,mBAAA;AAAA;;UAIK,aAAA;EACf,OAAA,GAAU,mBAAmB;AAAA;AApB/B;;;AAAA,cA0Ba,cAAA,SAAuB,KAAK;EAAA,SAC9B,MAAA;EAAA,SACA,IAAA;cAEG,OAAA,UAAiB,MAAA,UAAgB,IAAA;AAAA;;UAS9B,kBAAA;EApCY;EAsC3B,KAAA;EAlC4B;EAoC5B,OAAA;EAnCS;EAqCT,KAAA,UAAe,KAAK;AAAA;;;;;;cAkBT,WAAA;EAAA,iBACM,KAAA;EAAA,iBACA,OAAA;EAAA,iBACA,SAAA;cAEL,OAAA,EAAS,kBAAA;EAtDrB;;;;;EAoEA,UAAA,IAAc,OAAA,CAAQ,aAAA;EA/DP;;;;AACc;AAM/B;EAkEE,mBAAA,CAAoB,KAAA,EAAO,kBAAA,GAAqB,OAAA,CAAQ,aAAA;;;;;;;EAexD,kBAAA,CAAmB,KAAA,EAAO,iBAAA,GAAoB,OAAA,CAAQ,aAAA;EA7EzB;;;AAA6B;AAS5D;;EAkFE,cAAA,CAAe,KAAA,EAAO,aAAA,GAAgB,OAAA,CAAQ,aAAA;EA5E1B;;;;;;AAAA;EA6FpB,aAAA,CAAc,KAAA,EAAO,YAAA,GAAe,OAAA,CAAQ,aAAA;EA3EtB;;;;;;EAqGtB,QAAA,CAAS,KAAA,GAAO,aAAA,GAAqB,OAAA,CAAQ,aAAA;EAAA,QAI/B,OAAA;AAAA"}
+{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;UAWiB,aAAA;EACf,EAAA;EACA,MAAA,EAAQ,kBAAA;EACR,UAAA;EADQ;EAGR,aAAA,GAAgB,YAAA;EAEM;EAAtB,mBAAA,GAAsB,iBAAA;EAIX;EAFX,OAAA,GAAU,aAAA;EAMC;EAJX,QAAA,GAAW,cAAA;EAIc;EAFzB,QAAA,GAAW,eAAA;EAXX;EAaA,QAAA,GAAW,cAAA;AAAA;;;;;;;;UAUI,cAAA;EACf,SAAA;EAbW;EAeX,OAAA;EAbW;EAeX,KAAA;EAAA,CACC,KAAA;AAAA;;UAIc,aAAA;EACf,OAAA;EAVA;EAYA,aAAA;EARA;EAUA,GAAA;AAAA;AATc;AAIhB;;;AAJgB,UAgBC,mBAAA;EACf,aAAA;EACA,cAAA;EACA,OAAA;EACA,cAAA;EACA,eAAA;EACA,cAAA;EACA,eAAA;EACA,iBAAA;EACA,aAAA;EACA,cAAA;AAAA;;UAIe,YAAA;EATf;EAWA,KAAA;EACA,KAAA;EACA,IAAA;EACA,MAAA;EACA,UAAA;EAVc;EAYd,OAAA;EARe;EAUf,GAAA,GAAM,IAAA;;EAEN,QAAA;EACA,SAAA;EACA,OAAA,GAAU,mBAAmB;AAAA;;UAId,kBAAA;EACf,KAAA,GAAQ,IAAA;EACR,OAAA;EACA,YAAA,GAAe,YAAA;EACf,OAAA,GAAU,mBAAA;AAAA;;UAIK,iBAAA;EACf,KAAA,GAAQ,IAAA;EACR,OAAA;EACA,YAAA,GAAe,YAAY;AAAA;;UAIZ,aAAA;EACf,MAAA,GAAS,IAAA;EAZC;EAcV,KAAA,GAAQ,IAAA;EAdqB;EAgB7B,IAAA,GAAO,YAAA;EAnBC;EAqBR,UAAA,GAAa,iBAAA;EACb,OAAA,GAAU,mBAAA;AAAA;;UAIK,aAAA;EACf,OAAA,GAAU,mBAAmB;AAAA;AApB/B;;;AAAA,cA0Ba,cAAA,SAAuB,KAAK;EAAA,SAC9B,MAAA;EAAA,SACA,IAAA;cAEG,OAAA,UAAiB,MAAA,UAAgB,IAAA;AAAA;;UAS9B,kBAAA;EApCY;EAsC3B,KAAA;EAlC4B;;;;;;EAyC5B,OAAA;EAjC6B;EAmC7B,KAAA,UAAe,KAAK;AAAA;;AAnCS;AAI/B;;;cAiEa,WAAA;EAAA,iBACM,KAAA;EAAA,iBACA,OAAA;EAAA,iBACA,SAAA;cAEL,OAAA,EAAS,kBAAA;EA/DkB;;;;;EA6EvC,UAAA,IAAc,OAAA,CAAQ,aAAA;EAzEO;;;AAA6B;AAS5D;;EA0EE,mBAAA,CAAoB,KAAA,EAAO,kBAAA,GAAqB,OAAA,CAAQ,aAAA;EA/DpC;;;;;;EA8EpB,kBAAA,CAAmB,KAAA,EAAO,iBAAA,GAAoB,OAAA,CAAQ,aAAA;EA5C3C;;;;;;EA0DX,cAAA,CAAe,KAAA,EAAO,aAAA,GAAgB,OAAA,CAAQ,aAAA;EA7BU;;;;;;;EA8CxD,aAAA,CAAc,KAAA,EAAO,YAAA,GAAe,OAAA,CAAQ,aAAA;EAAvB;;;;;;EA0BrB,QAAA,CAAS,KAAA,GAAO,aAAA,GAAqB,OAAA,CAAQ,aAAA;EAAA,QAI/B,OAAA;AAAA"}

package/dist/client.mjs

@@ -12,6 +12,21 @@ var WidgetApiError = class extends Error {
 		this.code = code;
 	}
 };
+/**
+* Resolve the request base per the rule: an absolute URL is used as-is
+* (cross-origin, CORS); anything else — empty or a relative path — resolves
+* against the current origin, keeping calls same-origin and CORS-free.
+*
+* @param baseUrl
+* @returns
+*/
+function resolveClientBaseUrl(baseUrl) {
+	const origin = (globalThis.location?.origin ?? "").replace(/\/$/, "");
+	const trimmed = (baseUrl ?? "").trim().replace(/\/$/, "");
+	if (!trimmed) return origin;
+	if (/^https?:\/\//i.test(trimmed)) return trimmed;
+	return `${origin}${trimmed.startsWith("/") ? "" : "/"}${trimmed}`;
+}
 function appendSignals(form, signals) {
 	if (!signals) return;
 	for (const [key, value] of Object.entries(signals)) {
@@ -31,7 +46,7 @@ var ArkycClient = class {
 	constructor(options) {
 		if (!options.token) throw new Error("ArkycClient requires a client `token`.");
 		this.token = options.token;
-		this.baseUrl = (options.baseUrl ?? "").replace(/\/$/, "");
+		this.baseUrl = resolveClientBaseUrl(options.baseUrl);
 		const f = options.fetch ?? globalThis.fetch;
 		if (!f) throw new Error("No `fetch` implementation available.");
 		this.fetchImpl = f.bind(globalThis);

package/dist/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type {\n  CaptureModel,\n  DocumentType,\n  LivenessChallenge,\n  LivenessMode,\n  ProjectBranding,\n  VerificationStatus,\n  WorkflowConfig,\n} from '@arkyc/types'\n\n/** The session view exposed by the Client/Widget API (`GET /v1/client/session`). */\nexport interface ClientSession {\n  id: string\n  status: VerificationStatus\n  expires_at: string\n  /** The capture flow this session runs (Phase 17). */\n  capture_model?: CaptureModel\n  /** The active-liveness challenge sequence to prompt the user through. */\n  liveness_challenges?: LivenessChallenge[]\n  /** Cross-device handoff config resolved from the project setting. */\n  handoff?: ClientHandoff\n  /** How to watch this session live (push transport params or `polling`). */\n  realtime?: ClientRealtime\n  /** Project branding (colours/logo/name) so the widget themes itself at runtime. */\n  branding?: ProjectBranding | null\n  /** The applied workflow (ordered, toggleable stages + skip_ocr), or null for the default flow. */\n  workflow?: WorkflowConfig | null\n}\n\n/**\n * Realtime connection info for this session (Phase 16). `transport` selects how\n * the widget watches the session: `pusher`/`firebase` subscribe to `channel`;\n * `polling` (and `off`/`memory`) mean poll the session endpoint instead. The\n * remaining fields carry the active transport's public connection params; `token`\n * is a per-session Firebase custom token when applicable.\n */\nexport interface ClientRealtime {\n  transport: 'pusher' | 'firebase' | 'polling' | 'off' | 'memory'\n  /** The private channel this session's events publish to. */\n  channel: string\n  /** Per-session Firebase custom token (firebase transport only). */\n  token?: string | null\n  [param: string]: unknown\n}\n\n/** Whether (and where) the widget may offer cross-device handoff. */\nexport interface ClientHandoff {\n  enabled: boolean\n  /** Whether a desktop user may continue on the desktop device instead of handing off. */\n  allow_desktop: boolean\n  /** First-party hosted page the QR points to (the phone resumes the session there). */\n  url: string\n}\n\n/**\n * Mock-driver signal hints. Real provider drivers ignore these; the `mock`\n * drivers use them to make the demo/playground flow deterministic.\n */\nexport interface ProviderSignalHints {\n  quality_score?: number\n  ocr_confidence?: number\n  expired?: boolean\n  liveness_score?: number\n  liveness_passed?: boolean\n  multiple_faces?: boolean\n  face_similarity?: number\n  face_match_passed?: boolean\n  address_score?: number\n  address_passed?: boolean\n}\n\n/** Input for the address-verification submission (opt-in stage). */\nexport interface AddressInput {\n  /** The claimed address the user entered. */\n  line1?: string | null\n  line2?: string | null\n  city?: string | null\n  region?: string | null\n  postalCode?: string | null\n  /** ISO 3166-1 alpha-2 country code. */\n  country?: string | null\n  /** Proof-of-address document image. */\n  poa?: Blob | null\n  /** Captured device coordinates. */\n  latitude?: number | null\n  longitude?: number | null\n  signals?: ProviderSignalHints\n}\n\n/** Input for the document-front submission. */\nexport interface DocumentFrontInput {\n  image?: Blob | null\n  country?: string | null\n  documentType?: DocumentType | null\n  signals?: ProviderSignalHints\n}\n\n/** Input for the document-back submission. */\nexport interface DocumentBackInput {\n  image?: Blob | null\n  country?: string | null\n  documentType?: DocumentType | null\n}\n\n/** Input for the liveness submission (passive selfie or active challenge video). */\nexport interface LivenessInput {\n  selfie?: Blob | null\n  /** Recorded challenge video (active mode). */\n  video?: Blob | null\n  /** Passive (selfie) or active (challenge video). Defaults to passive. */\n  mode?: LivenessMode\n  /** The challenge sequence the user performed, in order (active mode). */\n  challenges?: LivenessChallenge[]\n  signals?: ProviderSignalHints\n}\n\n/** Input for completing the session (runs face-match + decision). */\nexport interface CompleteInput {\n  signals?: ProviderSignalHints\n}\n\n/**\n * Raised when the Client API returns a non-2xx response.\n */\nexport class WidgetApiError extends Error {\n  readonly status: number\n  readonly code?: string\n\n  constructor(message: string, status: number, code?: string) {\n    super(message)\n    this.name = 'WidgetApiError'\n    this.status = status\n    this.code = code\n  }\n}\n\n/** Options for {@link ArkycClient}. */\nexport interface ArkycClientOptions {\n  /** Short-lived client token minted for this session. */\n  token: string\n  /** API origin (defaults to the same origin the widget is served from). */\n  baseUrl?: string\n  /** Injectable for testing; defaults to the global `fetch`. */\n  fetch?: typeof fetch\n}\n\ntype EnvelopeNumber = number | boolean\n\nfunction appendSignals(form: FormData, signals?: ProviderSignalHints): void {\n  if (!signals) return\n  for (const [key, value] of Object.entries(signals)) {\n    if (value == null) continue\n    form.append(key, String(value as EnvelopeNumber))\n  }\n}\n\n/**\n * A thin, framework-agnostic client for the Arkyc Client/Widget API. Drives a\n * single verification session with a short-lived client token. All responses\n * are unwrapped from the standard `{ status, message, data }` envelope.\n */\nexport class ArkycClient {\n  private readonly token: string\n  private readonly baseUrl: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: ArkycClientOptions) {\n    if (!options.token) throw new Error('ArkycClient requires a client `token`.')\n    this.token = options.token\n    this.baseUrl = (options.baseUrl ?? '').replace(/\\/$/, '')\n    const f = options.fetch ?? globalThis.fetch\n    if (!f) throw new Error('No `fetch` implementation available.')\n    this.fetchImpl = f.bind(globalThis)\n  }\n\n  /**\n   * Load the current session (marks it `started` on first call).\n   *\n   * @returns\n   */\n  getSession(): Promise<ClientSession> {\n    return this.request('GET', '/v1/client/session')\n  }\n\n  /**\n   * Submit the document front image (triggers OCR + portrait extraction).\n   *\n   * @param input\n   * @returns\n   */\n  submitDocumentFront(input: DocumentFrontInput): Promise<ClientSession> {\n    const form = new FormData()\n    if (input.image) form.append('image', input.image, 'document-front.jpg')\n    if (input.country) form.append('country', input.country)\n    if (input.documentType) form.append('document_type', input.documentType)\n    appendSignals(form, input.signals)\n    return this.request('POST', '/v1/client/document/front', form)\n  }\n\n  /**\n   * Submit the document back image.\n   *\n   * @param input\n   * @returns\n   */\n  submitDocumentBack(input: DocumentBackInput): Promise<ClientSession> {\n    const form = new FormData()\n    if (input.image) form.append('image', input.image, 'document-back.jpg')\n    if (input.country) form.append('country', input.country)\n    if (input.documentType) form.append('document_type', input.documentType)\n    return this.request('POST', '/v1/client/document/back', form)\n  }\n\n  /**\n   * Submit the selfie for the liveness check.\n   *\n   * @param input\n   * @returns\n   */\n  submitLiveness(input: LivenessInput): Promise<ClientSession> {\n    const form = new FormData()\n    if (input.selfie) form.append('selfie', input.selfie, 'selfie.jpg')\n    if (input.video) form.append('video', input.video, 'liveness.webm')\n    if (input.mode) form.append('mode', input.mode)\n    if (input.challenges) form.append('challenges', JSON.stringify(input.challenges))\n    appendSignals(form, input.signals)\n    return this.request('POST', '/v1/client/liveness', form)\n  }\n\n  /**\n   * Submit address verification (opt-in stage). Sends the claimed address plus\n   * whichever evidence was gathered (proof-of-address image, device coordinates).\n   *\n   * @param input\n   * @returns\n   */\n  submitAddress(input: AddressInput): Promise<ClientSession> {\n    const form = new FormData()\n    const fields: Record<string, string | null | undefined> = {\n      line1: input.line1,\n      line2: input.line2,\n      city: input.city,\n      region: input.region,\n      postal_code: input.postalCode,\n      country: input.country,\n    }\n    for (const [key, value] of Object.entries(fields)) {\n      if (value) form.append(key, value)\n    }\n    if (input.poa) form.append('poa', input.poa, 'proof-of-address.jpg')\n    if (input.latitude != null) form.append('latitude', String(input.latitude))\n    if (input.longitude != null) form.append('longitude', String(input.longitude))\n    appendSignals(form, input.signals)\n    return this.request('POST', '/v1/client/address', form)\n  }\n\n  /**\n   * Finalise the session (runs face-match + the decision engine).\n   *\n   * @param input\n   * @returns\n   */\n  complete(input: CompleteInput = {}): Promise<ClientSession> {\n    return this.request('POST', '/v1/client/complete', input.signals ?? {})\n  }\n\n  private async request(method: string, path: string, body?: FormData | object): Promise<ClientSession> {\n    const headers: Record<string, string> = { 'X-Client-Token': this.token }\n    let payload: BodyInit | undefined\n\n    if (body instanceof FormData) {\n      payload = body\n    } else if (body) {\n      headers['Content-Type'] = 'application/json'\n      payload = JSON.stringify(body)\n    }\n\n    const res = await this.fetchImpl(`${this.baseUrl}${path}`, { method, headers, body: payload })\n    const text = await res.text()\n    const json = text ? (JSON.parse(text) as { message?: string; data?: ClientSession }) : {}\n\n    if (!res.ok) {\n      throw new WidgetApiError(json.message ?? `Request failed (${res.status})`, res.status)\n    }\n    return json.data as ClientSession\n  }\n}\n"],"mappings":";;;;AA4HA,IAAa,iBAAb,cAAoC,MAAM;CACxC;CACA;CAEA,YAAY,SAAiB,QAAgB,MAAe;EAC1D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAcA,SAAS,cAAc,MAAgB,SAAqC;CAC1E,IAAI,CAAC,SAAS;CACd,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EAClD,IAAI,SAAS,MAAM;EACnB,KAAK,OAAO,KAAK,OAAO,KAAuB,CAAC;CAClD;AACF;;;;;;AAOA,IAAa,cAAb,MAAyB;CACvB;CACA;CACA;CAEA,YAAY,SAA6B;EACvC,IAAI,CAAC,QAAQ,OAAO,MAAM,IAAI,MAAM,wCAAwC;EAC5E,KAAK,QAAQ,QAAQ;EACrB,KAAK,WAAW,QAAQ,WAAW,GAAA,CAAI,QAAQ,OAAO,EAAE;EACxD,MAAM,IAAI,QAAQ,SAAS,WAAW;EACtC,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAC9D,KAAK,YAAY,EAAE,KAAK,UAAU;CACpC;;;;;;CAOA,aAAqC;EACnC,OAAO,KAAK,QAAQ,OAAO,oBAAoB;CACjD;;;;;;;CAQA,oBAAoB,OAAmD;EACrE,MAAM,OAAO,IAAI,SAAS;EAC1B,IAAI,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,OAAO,oBAAoB;EACvE,IAAI,MAAM,SAAS,KAAK,OAAO,WAAW,MAAM,OAAO;EACvD,IAAI,MAAM,cAAc,KAAK,OAAO,iBAAiB,MAAM,YAAY;EACvE,cAAc,MAAM,MAAM,OAAO;EACjC,OAAO,KAAK,QAAQ,QAAQ,6BAA6B,IAAI;CAC/D;;;;;;;CAQA,mBAAmB,OAAkD;EACnE,MAAM,OAAO,IAAI,SAAS;EAC1B,IAAI,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,OAAO,mBAAmB;EACtE,IAAI,MAAM,SAAS,KAAK,OAAO,WAAW,MAAM,OAAO;EACvD,IAAI,MAAM,cAAc,KAAK,OAAO,iBAAiB,MAAM,YAAY;EACvE,OAAO,KAAK,QAAQ,QAAQ,4BAA4B,IAAI;CAC9D;;;;;;;CAQA,eAAe,OAA8C;EAC3D,MAAM,OAAO,IAAI,SAAS;EAC1B,IAAI,MAAM,QAAQ,KAAK,OAAO,UAAU,MAAM,QAAQ,YAAY;EAClE,IAAI,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,OAAO,eAAe;EAClE,IAAI,MAAM,MAAM,KAAK,OAAO,QAAQ,MAAM,IAAI;EAC9C,IAAI,MAAM,YAAY,KAAK,OAAO,cAAc,KAAK,UAAU,MAAM,UAAU,CAAC;EAChF,cAAc,MAAM,MAAM,OAAO;EACjC,OAAO,KAAK,QAAQ,QAAQ,uBAAuB,IAAI;CACzD;;;;;;;;CASA,cAAc,OAA6C;EACzD,MAAM,OAAO,IAAI,SAAS;EAC1B,MAAM,SAAoD;GACxD,OAAO,MAAM;GACb,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,aAAa,MAAM;GACnB,SAAS,MAAM;EACjB;EACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAC9C,IAAI,OAAO,KAAK,OAAO,KAAK,KAAK;EAEnC,IAAI,MAAM,KAAK,KAAK,OAAO,OAAO,MAAM,KAAK,sBAAsB;EACnE,IAAI,MAAM,YAAY,MAAM,KAAK,OAAO,YAAY,OAAO,MAAM,QAAQ,CAAC;EAC1E,IAAI,MAAM,aAAa,MAAM,KAAK,OAAO,aAAa,OAAO,MAAM,SAAS,CAAC;EAC7E,cAAc,MAAM,MAAM,OAAO;EACjC,OAAO,KAAK,QAAQ,QAAQ,sBAAsB,IAAI;CACxD;;;;;;;CAQA,SAAS,QAAuB,CAAC,GAA2B;EAC1D,OAAO,KAAK,QAAQ,QAAQ,uBAAuB,MAAM,WAAW,CAAC,CAAC;CACxE;CAEA,MAAc,QAAQ,QAAgB,MAAc,MAAkD;EACpG,MAAM,UAAkC,EAAE,kBAAkB,KAAK,MAAM;EACvE,IAAI;EAEJ,IAAI,gBAAgB,UAClB,UAAU;OACL,IAAI,MAAM;GACf,QAAQ,kBAAkB;GAC1B,UAAU,KAAK,UAAU,IAAI;EAC/B;EAEA,MAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAAE;GAAQ;GAAS,MAAM;EAAQ,CAAC;EAC7F,MAAM,OAAO,MAAM,IAAI,KAAK;EAC5B,MAAM,OAAO,OAAQ,KAAK,MAAM,IAAI,IAAmD,CAAC;EAExF,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,eAAe,KAAK,WAAW,mBAAmB,IAAI,OAAO,IAAI,IAAI,MAAM;EAEvF,OAAO,KAAK;CACd;AACF"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type {\n  CaptureModel,\n  DocumentType,\n  LivenessChallenge,\n  LivenessMode,\n  ProjectBranding,\n  VerificationStatus,\n  WorkflowConfig,\n} from '@arkyc/types'\n\n/** The session view exposed by the Client/Widget API (`GET /v1/client/session`). */\nexport interface ClientSession {\n  id: string\n  status: VerificationStatus\n  expires_at: string\n  /** The capture flow this session runs (Phase 17). */\n  capture_model?: CaptureModel\n  /** The active-liveness challenge sequence to prompt the user through. */\n  liveness_challenges?: LivenessChallenge[]\n  /** Cross-device handoff config resolved from the project setting. */\n  handoff?: ClientHandoff\n  /** How to watch this session live (push transport params or `polling`). */\n  realtime?: ClientRealtime\n  /** Project branding (colours/logo/name) so the widget themes itself at runtime. */\n  branding?: ProjectBranding | null\n  /** The applied workflow (ordered, toggleable stages + skip_ocr), or null for the default flow. */\n  workflow?: WorkflowConfig | null\n}\n\n/**\n * Realtime connection info for this session (Phase 16). `transport` selects how\n * the widget watches the session: `pusher`/`firebase` subscribe to `channel`;\n * `polling` (and `off`/`memory`) mean poll the session endpoint instead. The\n * remaining fields carry the active transport's public connection params; `token`\n * is a per-session Firebase custom token when applicable.\n */\nexport interface ClientRealtime {\n  transport: 'pusher' | 'firebase' | 'polling' | 'off' | 'memory'\n  /** The private channel this session's events publish to. */\n  channel: string\n  /** Per-session Firebase custom token (firebase transport only). */\n  token?: string | null\n  [param: string]: unknown\n}\n\n/** Whether (and where) the widget may offer cross-device handoff. */\nexport interface ClientHandoff {\n  enabled: boolean\n  /** Whether a desktop user may continue on the desktop device instead of handing off. */\n  allow_desktop: boolean\n  /** First-party hosted page the QR points to (the phone resumes the session there). */\n  url: string\n}\n\n/**\n * Mock-driver signal hints. Real provider drivers ignore these; the `mock`\n * drivers use them to make the demo/playground flow deterministic.\n */\nexport interface ProviderSignalHints {\n  quality_score?: number\n  ocr_confidence?: number\n  expired?: boolean\n  liveness_score?: number\n  liveness_passed?: boolean\n  multiple_faces?: boolean\n  face_similarity?: number\n  face_match_passed?: boolean\n  address_score?: number\n  address_passed?: boolean\n}\n\n/** Input for the address-verification submission (opt-in stage). */\nexport interface AddressInput {\n  /** The claimed address the user entered. */\n  line1?: string | null\n  line2?: string | null\n  city?: string | null\n  region?: string | null\n  postalCode?: string | null\n  /** ISO 3166-1 alpha-2 country code. */\n  country?: string | null\n  /** Proof-of-address document image. */\n  poa?: Blob | null\n  /** Captured device coordinates. */\n  latitude?: number | null\n  longitude?: number | null\n  signals?: ProviderSignalHints\n}\n\n/** Input for the document-front submission. */\nexport interface DocumentFrontInput {\n  image?: Blob | null\n  country?: string | null\n  documentType?: DocumentType | null\n  signals?: ProviderSignalHints\n}\n\n/** Input for the document-back submission. */\nexport interface DocumentBackInput {\n  image?: Blob | null\n  country?: string | null\n  documentType?: DocumentType | null\n}\n\n/** Input for the liveness submission (passive selfie or active challenge video). */\nexport interface LivenessInput {\n  selfie?: Blob | null\n  /** Recorded challenge video (active mode). */\n  video?: Blob | null\n  /** Passive (selfie) or active (challenge video). Defaults to passive. */\n  mode?: LivenessMode\n  /** The challenge sequence the user performed, in order (active mode). */\n  challenges?: LivenessChallenge[]\n  signals?: ProviderSignalHints\n}\n\n/** Input for completing the session (runs face-match + decision). */\nexport interface CompleteInput {\n  signals?: ProviderSignalHints\n}\n\n/**\n * Raised when the Client API returns a non-2xx response.\n */\nexport class WidgetApiError extends Error {\n  readonly status: number\n  readonly code?: string\n\n  constructor(message: string, status: number, code?: string) {\n    super(message)\n    this.name = 'WidgetApiError'\n    this.status = status\n    this.code = code\n  }\n}\n\n/** Options for {@link ArkycClient}. */\nexport interface ArkycClientOptions {\n  /** Short-lived client token minted for this session. */\n  token: string\n  /**\n   * API base. Omitted or a relative path (e.g. `/api`) resolves against the\n   * current origin — same-origin, so no CORS. An absolute URL (e.g.\n   * `https://api.example.com/api`) is used as-is and requires the API to allow\n   * this origin via CORS.\n   */\n  baseUrl?: string\n  /** Injectable for testing; defaults to the global `fetch`. */\n  fetch?: typeof fetch\n}\n\n/**\n * Resolve the request base per the rule: an absolute URL is used as-is\n * (cross-origin, CORS); anything else — empty or a relative path — resolves\n * against the current origin, keeping calls same-origin and CORS-free.\n *\n * @param baseUrl\n * @returns\n */\nexport function resolveClientBaseUrl(baseUrl?: string): string {\n  const origin = (globalThis.location?.origin ?? '').replace(/\\/$/, '')\n  const trimmed = (baseUrl ?? '').trim().replace(/\\/$/, '')\n  if (!trimmed) return origin\n  if (/^https?:\\/\\//i.test(trimmed)) return trimmed\n  return `${origin}${trimmed.startsWith('/') ? '' : '/'}${trimmed}`\n}\n\ntype EnvelopeNumber = number | boolean\n\nfunction appendSignals(form: FormData, signals?: ProviderSignalHints): void {\n  if (!signals) return\n  for (const [key, value] of Object.entries(signals)) {\n    if (value == null) continue\n    form.append(key, String(value as EnvelopeNumber))\n  }\n}\n\n/**\n * A thin, framework-agnostic client for the Arkyc Client/Widget API. Drives a\n * single verification session with a short-lived client token. All responses\n * are unwrapped from the standard `{ status, message, data }` envelope.\n */\nexport class ArkycClient {\n  private readonly token: string\n  private readonly baseUrl: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: ArkycClientOptions) {\n    if (!options.token) throw new Error('ArkycClient requires a client `token`.')\n    this.token = options.token\n    this.baseUrl = resolveClientBaseUrl(options.baseUrl)\n    const f = options.fetch ?? globalThis.fetch\n    if (!f) throw new Error('No `fetch` implementation available.')\n    this.fetchImpl = f.bind(globalThis)\n  }\n\n  /**\n   * Load the current session (marks it `started` on first call).\n   *\n   * @returns\n   */\n  getSession(): Promise<ClientSession> {\n    return this.request('GET', '/v1/client/session')\n  }\n\n  /**\n   * Submit the document front image (triggers OCR + portrait extraction).\n   *\n   * @param input\n   * @returns\n   */\n  submitDocumentFront(input: DocumentFrontInput): Promise<ClientSession> {\n    const form = new FormData()\n    if (input.image) form.append('image', input.image, 'document-front.jpg')\n    if (input.country) form.append('country', input.country)\n    if (input.documentType) form.append('document_type', input.documentType)\n    appendSignals(form, input.signals)\n    return this.request('POST', '/v1/client/document/front', form)\n  }\n\n  /**\n   * Submit the document back image.\n   *\n   * @param input\n   * @returns\n   */\n  submitDocumentBack(input: DocumentBackInput): Promise<ClientSession> {\n    const form = new FormData()\n    if (input.image) form.append('image', input.image, 'document-back.jpg')\n    if (input.country) form.append('country', input.country)\n    if (input.documentType) form.append('document_type', input.documentType)\n    return this.request('POST', '/v1/client/document/back', form)\n  }\n\n  /**\n   * Submit the selfie for the liveness check.\n   *\n   * @param input\n   * @returns\n   */\n  submitLiveness(input: LivenessInput): Promise<ClientSession> {\n    const form = new FormData()\n    if (input.selfie) form.append('selfie', input.selfie, 'selfie.jpg')\n    if (input.video) form.append('video', input.video, 'liveness.webm')\n    if (input.mode) form.append('mode', input.mode)\n    if (input.challenges) form.append('challenges', JSON.stringify(input.challenges))\n    appendSignals(form, input.signals)\n    return this.request('POST', '/v1/client/liveness', form)\n  }\n\n  /**\n   * Submit address verification (opt-in stage). Sends the claimed address plus\n   * whichever evidence was gathered (proof-of-address image, device coordinates).\n   *\n   * @param input\n   * @returns\n   */\n  submitAddress(input: AddressInput): Promise<ClientSession> {\n    const form = new FormData()\n    const fields: Record<string, string | null | undefined> = {\n      line1: input.line1,\n      line2: input.line2,\n      city: input.city,\n      region: input.region,\n      postal_code: input.postalCode,\n      country: input.country,\n    }\n    for (const [key, value] of Object.entries(fields)) {\n      if (value) form.append(key, value)\n    }\n    if (input.poa) form.append('poa', input.poa, 'proof-of-address.jpg')\n    if (input.latitude != null) form.append('latitude', String(input.latitude))\n    if (input.longitude != null) form.append('longitude', String(input.longitude))\n    appendSignals(form, input.signals)\n    return this.request('POST', '/v1/client/address', form)\n  }\n\n  /**\n   * Finalise the session (runs face-match + the decision engine).\n   *\n   * @param input\n   * @returns\n   */\n  complete(input: CompleteInput = {}): Promise<ClientSession> {\n    return this.request('POST', '/v1/client/complete', input.signals ?? {})\n  }\n\n  private async request(method: string, path: string, body?: FormData | object): Promise<ClientSession> {\n    const headers: Record<string, string> = { 'X-Client-Token': this.token }\n    let payload: BodyInit | undefined\n\n    if (body instanceof FormData) {\n      payload = body\n    } else if (body) {\n      headers['Content-Type'] = 'application/json'\n      payload = JSON.stringify(body)\n    }\n\n    const res = await this.fetchImpl(`${this.baseUrl}${path}`, { method, headers, body: payload })\n    const text = await res.text()\n    const json = text ? (JSON.parse(text) as { message?: string; data?: ClientSession }) : {}\n\n    if (!res.ok) {\n      throw new WidgetApiError(json.message ?? `Request failed (${res.status})`, res.status)\n    }\n    return json.data as ClientSession\n  }\n}\n"],"mappings":";;;;AA4HA,IAAa,iBAAb,cAAoC,MAAM;CACxC;CACA;CAEA,YAAY,SAAiB,QAAgB,MAAe;EAC1D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;;;;;;;;;AAyBA,SAAgB,qBAAqB,SAA0B;CAC7D,MAAM,UAAU,WAAW,UAAU,UAAU,GAAA,CAAI,QAAQ,OAAO,EAAE;CACpE,MAAM,WAAW,WAAW,GAAA,CAAI,KAAK,CAAC,CAAC,QAAQ,OAAO,EAAE;CACxD,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,gBAAgB,KAAK,OAAO,GAAG,OAAO;CAC1C,OAAO,GAAG,SAAS,QAAQ,WAAW,GAAG,IAAI,KAAK,MAAM;AAC1D;AAIA,SAAS,cAAc,MAAgB,SAAqC;CAC1E,IAAI,CAAC,SAAS;CACd,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EAClD,IAAI,SAAS,MAAM;EACnB,KAAK,OAAO,KAAK,OAAO,KAAuB,CAAC;CAClD;AACF;;;;;;AAOA,IAAa,cAAb,MAAyB;CACvB;CACA;CACA;CAEA,YAAY,SAA6B;EACvC,IAAI,CAAC,QAAQ,OAAO,MAAM,IAAI,MAAM,wCAAwC;EAC5E,KAAK,QAAQ,QAAQ;EACrB,KAAK,UAAU,qBAAqB,QAAQ,OAAO;EACnD,MAAM,IAAI,QAAQ,SAAS,WAAW;EACtC,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAC9D,KAAK,YAAY,EAAE,KAAK,UAAU;CACpC;;;;;;CAOA,aAAqC;EACnC,OAAO,KAAK,QAAQ,OAAO,oBAAoB;CACjD;;;;;;;CAQA,oBAAoB,OAAmD;EACrE,MAAM,OAAO,IAAI,SAAS;EAC1B,IAAI,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,OAAO,oBAAoB;EACvE,IAAI,MAAM,SAAS,KAAK,OAAO,WAAW,MAAM,OAAO;EACvD,IAAI,MAAM,cAAc,KAAK,OAAO,iBAAiB,MAAM,YAAY;EACvE,cAAc,MAAM,MAAM,OAAO;EACjC,OAAO,KAAK,QAAQ,QAAQ,6BAA6B,IAAI;CAC/D;;;;;;;CAQA,mBAAmB,OAAkD;EACnE,MAAM,OAAO,IAAI,SAAS;EAC1B,IAAI,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,OAAO,mBAAmB;EACtE,IAAI,MAAM,SAAS,KAAK,OAAO,WAAW,MAAM,OAAO;EACvD,IAAI,MAAM,cAAc,KAAK,OAAO,iBAAiB,MAAM,YAAY;EACvE,OAAO,KAAK,QAAQ,QAAQ,4BAA4B,IAAI;CAC9D;;;;;;;CAQA,eAAe,OAA8C;EAC3D,MAAM,OAAO,IAAI,SAAS;EAC1B,IAAI,MAAM,QAAQ,KAAK,OAAO,UAAU,MAAM,QAAQ,YAAY;EAClE,IAAI,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,OAAO,eAAe;EAClE,IAAI,MAAM,MAAM,KAAK,OAAO,QAAQ,MAAM,IAAI;EAC9C,IAAI,MAAM,YAAY,KAAK,OAAO,cAAc,KAAK,UAAU,MAAM,UAAU,CAAC;EAChF,cAAc,MAAM,MAAM,OAAO;EACjC,OAAO,KAAK,QAAQ,QAAQ,uBAAuB,IAAI;CACzD;;;;;;;;CASA,cAAc,OAA6C;EACzD,MAAM,OAAO,IAAI,SAAS;EAC1B,MAAM,SAAoD;GACxD,OAAO,MAAM;GACb,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,aAAa,MAAM;GACnB,SAAS,MAAM;EACjB;EACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAC9C,IAAI,OAAO,KAAK,OAAO,KAAK,KAAK;EAEnC,IAAI,MAAM,KAAK,KAAK,OAAO,OAAO,MAAM,KAAK,sBAAsB;EACnE,IAAI,MAAM,YAAY,MAAM,KAAK,OAAO,YAAY,OAAO,MAAM,QAAQ,CAAC;EAC1E,IAAI,MAAM,aAAa,MAAM,KAAK,OAAO,aAAa,OAAO,MAAM,SAAS,CAAC;EAC7E,cAAc,MAAM,MAAM,OAAO;EACjC,OAAO,KAAK,QAAQ,QAAQ,sBAAsB,IAAI;CACxD;;;;;;;CAQA,SAAS,QAAuB,CAAC,GAA2B;EAC1D,OAAO,KAAK,QAAQ,QAAQ,uBAAuB,MAAM,WAAW,CAAC,CAAC;CACxE;CAEA,MAAc,QAAQ,QAAgB,MAAc,MAAkD;EACpG,MAAM,UAAkC,EAAE,kBAAkB,KAAK,MAAM;EACvE,IAAI;EAEJ,IAAI,gBAAgB,UAClB,UAAU;OACL,IAAI,MAAM;GACf,QAAQ,kBAAkB;GAC1B,UAAU,KAAK,UAAU,IAAI;EAC/B;EAEA,MAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAAE;GAAQ;GAAS,MAAM;EAAQ,CAAC;EAC7F,MAAM,OAAO,MAAM,IAAI,KAAK;EAC5B,MAAM,OAAO,OAAQ,KAAK,MAAM,IAAI,IAAmD,CAAC;EAExF,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,eAAe,KAAK,WAAW,mBAAmB,IAAI,OAAO,IAAI,IAAI,MAAM;EAEvF,OAAO,KAAK;CACd;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arkyc/widget",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Embeddable, framework-agnostic Arkyc identity-verification widget",
   "license": "MIT",
   "keywords": [
@@ -40,7 +40,7 @@
   ],
   "dependencies": {
     "qrcode-generator": "^1.4.4",
-    "@arkyc/types": "^1.2.2"
+    "@arkyc/types": "^1.2.3"
   },
   "peerDependencies": {
     "firebase": "^11.0.0",