@checktiv/sdk-web 1.0.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Checktiv
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,181 @@
+# @checktiv/sdk-web
+
+Customer-embed Web SDK for the Checktiv identity verification platform. Published on
+npm as `@checktiv/sdk-web`; the internal workspace name is `@rf/sdk-web`.
+
+Two surfaces ship from this package:
+
+- **ESM npm package** (`@checktiv/sdk-web` and subpaths) - tree-shakeable ESM
+  modules for bundler-based apps. React peer dependency is optional; `react`/`react-dom`
+  are not bundled.
+- **CDN IIFE** (`window.Checktiv`) - the self-contained bundle served by `sdk-cdn`
+  at `https://sdk.<region>.<apex>/v1/sdk.js`. Includes all modules eagerly so a single
+  `<script>` tag is sufficient. A legacy `window.AutohostKyc` alias is kept for
+  existing customer snippets; auto-discover attributes `[data-checktiv]` (preferred)
+  and `[data-autohost-kyc]` (back-compat) work on both the CDN and npm paths.
+
+## Install (npm)
+
+```bash
+npm install @checktiv/sdk-web
+# or: pnpm add @checktiv/sdk-web
+```
+
+`react` and `react-dom` are **optional peer dependencies**. Install them only when
+using the `./react` subpath.
+
+## CDN snippet
+
+```html
+<!-- Moving pointer - always the latest release. No SRI: content changes on every release. -->
+<script src="https://sdk.us.checktiv.com/v1/sdk.js" crossorigin="anonymous"></script>
+```
+
+This loads the latest release. SRI is not usable on the moving `/v1/sdk.js` pointer
+because its content changes on every release. For production, pin to the immutable
+versioned URL and include a Subresource Integrity hash from the release notes:
+
+```html
+<script
+  src="https://sdk.us.checktiv.com/sdk/1.2.3/sdk.js"
+  integrity="sha384-<hash-from-release-notes>"
+  crossorigin="anonymous"
+></script>
+```
+
+## The two-line surface
+
+```js
+import { init } from '@checktiv/sdk-web';
+import '@checktiv/sdk-web/idv'; // self-registers the IDV module
+
+const client = init({
+  publishableKey: 'ah_pk_us_test_...',
+  getSessionToken: async (ctx) => {
+    const res = await fetch('/api/checktiv/token', {
+      method: 'POST',
+      body: JSON.stringify({ reason: ctx.reason }),
+      headers: { 'Content-Type': 'application/json' },
+    });
+    return (await res.json()).token;
+  },
+});
+
+// Server-driven: renders whatever modules the session declares.
+client.mountProvisioned({
+  target: document.getElementById('checktiv-container'),
+  onEvent: (event) => console.log(event),
+});
+```
+
+`init()` never makes a network request. `mountProvisioned()` reads the
+server-declared modules from the session (`GET /sdk/v1/sessions/me`) and renders
+each one. Your secret key never appears in client code.
+
+## Published subpaths
+
+All subpaths below are part of the published API
+(`publishConfig.exports` in `package.json`):
+
+| Subpath                   | Purpose                                                                                                                 |
+| ------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| `.` / `@checktiv/sdk-web` | `Checktiv.init(opts)` substrate. Returns a `ChecktivClient`. No Zod at runtime; safe for tree-shaking.                  |
+| `./idv`                   | Managed IDV module. Import for its self-registration side effect so `mountProvisioned` / `mount('idv')` can resolve it. |
+| `./fraud`                 | Consent-gated fraud signal collection. Import for its self-registration side effect.                                    |
+| `./custom-form`           | Custom form module (server-authored field definitions). Import for self-registration.                                   |
+| `./custom-form/style.css` | Stylesheet for the custom-form module. `<link>` or `import` this in the host page.                                      |
+| `./react`                 | React wrapper: `ChecktivProvider`, `useChecktiv()`, `ChecktivIdv`. Requires `react`/`react-dom` peer dependencies.      |
+| `./capture`               | Headless host-side IDV capture controller (`createCaptureController`). Tier-1 - no default UI.                          |
+| `./capture-ui`            | Batteries-included capture renderer (`mount()`). Tier-2 built on `./capture`.                                           |
+| `./cross-device`          | Cross-device QR/copy-link handoff overlay.                                                                              |
+| `./idv/cross-device`      | IDV-specific cross-device wiring.                                                                                       |
+| `./agents`                | Machine-readable agent steering manifest (`dist/agents/manifest.json`).                                                 |
+
+The `./agent` subpath is **workspace-only** (not published) - it is omitted from
+`publishConfig.exports`.
+
+## Back-compat surface
+
+The following identifiers are kept for existing customer integrations and will not be
+removed without a major version bump:
+
+- `window.AutohostKyc` CDN global alias (alongside `window.Checktiv`)
+- `[data-autohost-kyc]` auto-discover attribute (alongside `[data-checktiv]`)
+- `autohost.kyc.complete` postMessage completion event name
+
+## React usage
+
+```tsx
+import { ChecktivProvider, ChecktivIdv } from '@checktiv/sdk-web/react';
+import '@checktiv/sdk-web/idv'; // register the IDV module
+
+export function App() {
+  return (
+    <ChecktivProvider
+      publishableKey="ah_pk_us_test_..."
+      getSessionToken={async (ctx) => fetchToken(ctx)}
+    >
+      <ChecktivIdv onEvent={(e) => console.log(e)} />
+    </ChecktivProvider>
+  );
+}
+```
+
+See the React guide in the docs for the full SSR-safe / Next.js pattern.
+
+## Architecture notes
+
+- **No PII, no private API key in the SDK.** The publishable key is operator config,
+  not PII. Your server mints `bt_*` browser tokens; the SDK only ever holds those.
+- **Module-load seam.** The `.` entry does not statically import the IDV or fraud
+  modules. Each module self-registers via a top-level side effect when its subpath is
+  imported. Without the import, `mount('idv')` fails with a clear `sdk_load_failed`
+  error message.
+- **Event surface.** Events are `checktiv.<module>.<name>`. The stream is
+  forward-open: do not exhaustively switch on `event.type` - unknown types may be
+  added without a major bump.
+- **Bundle budget.** The CDN `sdk.js` is gated at 100 KiB gzip by CI.
+
+## Build
+
+```bash
+pnpm --filter @rf/sdk-web build
+# emits dist/ (ESM) and services/sdk-cdn/public/v1/sdk.js (CDN IIFE)
+```
+
+No sourcemaps ship in the npm tarball or the CDN bundle. Maps are CI-only build
+artifacts (they contain internal module names).
+
+## Bundle size checks
+
+```bash
+pnpm --filter @rf/sdk-web size           # CDN sdk.js (100 KiB gate)
+pnpm --filter @rf/sdk-web size:host-capture     # capture.js
+pnpm --filter @rf/sdk-web size:host-capture-ui  # capture-ui.js
+pnpm --filter @rf/sdk-web size:cross-device     # cross-device chunk
+pnpm --filter @rf/sdk-web size:npm       # per-entry npm tarball sizes
+```
+
+The canonical gate for CI is `pnpm audit:bundle-sizes` (runs all four budgets).
+
+## Publish validation
+
+```bash
+pnpm --filter @rf/sdk-web validate:publint   # publint --strict
+pnpm --filter @rf/sdk-web validate:attw      # are the types wrong?
+pnpm --filter @rf/sdk-web validate:tarball   # publish-boundary gate
+```
+
+The publish-boundary gate (`scripts/audit-sdk-publish-boundary.mjs`) checks for
+internal `@rf/` specifier leaks, vendor names, internal settings sentinels, and
+dependency hygiene in the packed tarball.
+
+## Testing
+
+```bash
+pnpm --filter @rf/sdk-web test
+pnpm --filter @rf/sdk-web typecheck
+```
+
+Tests run under jsdom. Real camera capture and the CDN IIFE are verified against a
+deployed dev cell before each release.

package/dist/agents/AGENTS.md

@@ -0,0 +1,56 @@
+# Integrating @checktiv/sdk-web (AI agent steering)
+
+This file steers AI coding agents to integrate @checktiv/sdk-web correctly from a single
+prompt. The machine-readable companion (`manifest.json`, same directory, also resolvable
+via the `@checktiv/sdk-web/agents` export) carries the module composition contract and four
+runnable recipes. Read both.
+
+## Rules
+
+1. **The server mints the session, never the browser.** Your backend calls the public API `POST /v1/sessions` with your secret key (`ah_sk_*`) and receives the session. The secret key is server-only: NEVER put `ah_sk_*` in browser code. To hand control to the frontend, your backend mints a short-lived browser token (`bt_*`) by calling `POST /sdk/v1/sessions/:sessionId/browser-token` with the same `ah_sk_*`; that route returns `{ data: { browserToken, expiresAt, modules, scopes } }`. Only the `bt_*` string crosses to the browser.
+
+2. **Use mountProvisioned as the default path.** Call `Checktiv.init({ ... }).mountProvisioned({ target })`. It reads the server-declared `session.modules` from `GET /sdk/v1/sessions/me` and renders exactly what the server composed, so the server drives composition. `mount('idv')` / `mount('fraud')` is the explicit override / escape hatch, not the first choice.
+
+3. **Completion is not a verdict: trust the signed webhook.** The client event `checktiv.idv.submitted` is terminal-for-capture only; it means the applicant finished the capture step, NOT that they passed. The decision arrives on your server through the signed `kyc.session.*` webhook. Trust the signed webhook as the only outcome anchor; never infer a pass/fail from a client event.
+
+4. **Satisfy each applicant-info requirement once, through any one path.** When a session declares applicant-info requirements (name, date of birth, address, and similar fields), each requirement is satisfied by ANY ONE of the supported collection paths, not by all of them. Supply a field through one path and the SDK treats that requirement as met; do not double-collect the same field. Let the server-declared session decide which fields are required rather than hard-coding a form.
+
+5. **Develop local-first with the synthetic driver.** Use a **test-mode publishable key** (`ah_pk_<region>_test_*`) PLUS the synthetic opt-in. Test mode is selected by the key itself, not by a `mode` property on `init`. A test-mode key without the synthetic option renders a BLANK embed on a local origin because the capture license is domain-bound, whereas the synthetic path runs the full `checktiv.idv.*` flow locally with no camera, no license, and no deployed environment. Ensure your own session-mint backend and token endpoint are running before the SDK calls `getSessionToken`. Build and verify locally with the synthetic driver, then graduate to a deployed environment for real capture and ship through the standard npm / CDN path.
+
+6. **getSessionToken supplies a fresh bt_* on demand.** `getSessionToken` is `string | ((ctx: { sessionId; reason: 'initial' | 'expired' | '401' }) => Promise<string>)`. The SDK calls it on mount and again on expiry or a 401, then retries the failed request once. Always return a freshly minted `bt_*` from your backend; never hold a long-lived credential in the browser. If your callback rejects, the SDK emits `token_expired` with `recovery: 'refresh_session'` and halts cleanly.
+
+7. **Add your frontend origin to the publishable key allowlist first.** Each publishable key carries an origin allowlist that you set in the console / dashboard. Your frontend's origin MUST be on that allowlist before the first mount, or EVERY mount fails with `origin_not_allowed` (the `bt_*` data-plane routes reject an off-allowlist `Origin`). Add your origin to the publishable key allowlist before you integrate.
+
+8. **The SDK adds X-Publishable-Key itself on the customer path.** Pass `publishableKey` to `Checktiv.init(...)` and stop there. On the customer (pk-present) path the managed transport attaches the `X-Publishable-Key` header to its own `bt_*` data-plane calls internally. Do NOT also hand-add an `X-Publishable-Key` header yourself; double-adding it is wrong. (The first-party hosted path used internally by the verify app carries no publishable key and sends none.)
+
+9. **Wire cross-device QR handoff via openCrossDeviceOverlay.** Cross-device handoff is wired via STANDALONE exports from the `@checktiv/sdk-web/idv/cross-device` subpath (NOT via an option on `IdvMountOptions` / `mountProvisioned`). Import: `import { openCrossDeviceOverlay, preloadCrossDeviceChunk } from '@checktiv/sdk-web/idv/cross-device';`
+
+`openCrossDeviceOverlay(opts: CrossDeviceOverlayOptions)` opens the overlay. Key fields on `CrossDeviceOverlayOptions`:
+  • `target: HTMLElement`: the module's root container element.
+  • `onOpenCrossDevice: CrossDeviceHandoffHook`: HOST-supplied mint hook. Type: `() => Promise<{ kind: 'ok'; url: string } | { kind: 'unavailable' }>`. Your host calls its own OTL-mint BFF and returns `{ kind: 'ok', url }` with the journey URL, or `{ kind: 'unavailable' }` if the mint fails. The URL MUST be `https:` (the SDK validates this and collapses `javascript:`, `http:`, and `data:` schemes to `'unavailable'`). The hook is re-callable (the overlay has a "refresh link" affordance); cap re-mints with a per-overlay counter on your host.
+  • `copy: CrossDeviceCopy`: host-injected copy map; no hardcoded strings.
+  • `isMobile: boolean`: `true` suppresses the QR (same-device scan is circular).
+  • `emit: (e: ChecktivIdvEvent) => void`: forward to the host's `onEvent` handler.
+  • `onClose?: () => void`: called when the applicant closes the overlay or `destroy()` is called.
+
+Returns `CrossDeviceOverlayHandle` with:
+  • `setCompleting()`: marks the session completing (phone finished; overlay stays mounted with a waiting label instead of disappearing).
+  • `destroy()`: tears down the overlay. Idempotent.
+
+`preloadCrossDeviceChunk()`: fire-and-forget preload of the lazy CDN chunk. Call it when the IDV module becomes active to reduce perceived latency on open.
+
+Events (both are token-free, NEVER contain the url/OTL/short-code):
+  • `checktiv.idv.cross_device_opened`: hook returned `ok`, overlay shown.
+  • `checktiv.idv.cross_device_unavailable`: hook returned `unavailable` or URL validation failed.
+There is NO `cross_device_completed` event. Completion is the HOST's responsibility: poll your own `/api/idv/cross-device-status` BFF (returns `{ advanced: boolean }`) and call `window.location.reload()` exactly once when `advanced: true`. The SDK module NEVER writes `window.location`. Use `setCompleting()` on the returned handle before reloading so the overlay shows a completing state rather than disappearing abruptly.
+
+The browser SDK CANNOT self-mint: `bt_*` bearers are rejected at the OTL-mint route. The host must own a server-side BFF that holds a `vt_*` cookie (HttpOnly, SameSite=Lax) and calls the sdk-api OTL-mint endpoint to produce the handoff URL.
+
+## Runnable recipes
+
+Full, copy-pasteable code for each step is in `manifest.json` under `recipes`:
+
+- **(a) Backend: mint a session with your secret key**
+- **(b) Backend: mint a bt_* browser token and hand it to the frontend**
+- **(c) Frontend: init and mountProvisioned**
+- **(d) Backend: verify the signed webhook (HMAC) - the only outcome anchor**

package/dist/agents/manifest.json

@@ -0,0 +1,101 @@
+{
+  "package": "@checktiv/sdk-web",
+  "modules": {
+    "idv": {
+      "scopes": [
+        "sessions:me:read",
+        "idv:capture-token:mint",
+        "idv:steps:submit"
+      ],
+      "eventNamespace": "checktiv.idv"
+    },
+    "fraud": {
+      "scopes": [
+        "sessions:me:read",
+        "fraud:signal:capture",
+        "telemetry:emit"
+      ],
+      "eventNamespace": "checktiv.fraud"
+    },
+    "custom_form": {
+      "scopes": [
+        "sessions:me:read",
+        "custom_form:steps:submit"
+      ],
+      "eventNamespace": "checktiv.custom_form"
+    }
+  },
+  "rules": [
+    {
+      "id": "server-mints-the-session",
+      "title": "The server mints the session, never the browser",
+      "body": "Your backend calls the public API `POST /v1/sessions` with your secret key (`ah_sk_*`) and receives the session. The secret key is server-only: NEVER put `ah_sk_*` in browser code. To hand control to the frontend, your backend mints a short-lived browser token (`bt_*`) by calling `POST /sdk/v1/sessions/:sessionId/browser-token` with the same `ah_sk_*`; that route returns `{ data: { browserToken, expiresAt, modules, scopes } }`. Only the `bt_*` string crosses to the browser."
+    },
+    {
+      "id": "mount-provisioned-is-the-default",
+      "title": "Use mountProvisioned as the default path",
+      "body": "Call `Checktiv.init({ ... }).mountProvisioned({ target })`. It reads the server-declared `session.modules` from `GET /sdk/v1/sessions/me` and renders exactly what the server composed, so the server drives composition. `mount('idv')` / `mount('fraud')` is the explicit override / escape hatch, not the first choice."
+    },
+    {
+      "id": "completion-is-not-a-verdict",
+      "title": "Completion is not a verdict: trust the signed webhook",
+      "body": "The client event `checktiv.idv.submitted` is terminal-for-capture only; it means the applicant finished the capture step, NOT that they passed. The decision arrives on your server through the signed `kyc.session.*` webhook. Trust the signed webhook as the only outcome anchor; never infer a pass/fail from a client event."
+    },
+    {
+      "id": "applicant-info-satisfaction",
+      "title": "Satisfy each applicant-info requirement once, through any one path",
+      "body": "When a session declares applicant-info requirements (name, date of birth, address, and similar fields), each requirement is satisfied by ANY ONE of the supported collection paths, not by all of them. Supply a field through one path and the SDK treats that requirement as met; do not double-collect the same field. Let the server-declared session decide which fields are required rather than hard-coding a form."
+    },
+    {
+      "id": "develop-local-first-synthetic",
+      "title": "Develop local-first with the synthetic driver",
+      "body": "Use a **test-mode publishable key** (`ah_pk_<region>_test_*`) PLUS the synthetic opt-in. Test mode is selected by the key itself, not by a `mode` property on `init`. A test-mode key without the synthetic option renders a BLANK embed on a local origin because the capture license is domain-bound, whereas the synthetic path runs the full `checktiv.idv.*` flow locally with no camera, no license, and no deployed environment. Ensure your own session-mint backend and token endpoint are running before the SDK calls `getSessionToken`. Build and verify locally with the synthetic driver, then graduate to a deployed environment for real capture and ship through the standard npm / CDN path."
+    },
+    {
+      "id": "get-session-token-refresh-contract",
+      "title": "getSessionToken supplies a fresh bt_* on demand",
+      "body": "`getSessionToken` is `string | ((ctx: { sessionId; reason: 'initial' | 'expired' | '401' }) => Promise<string>)`. The SDK calls it on mount and again on expiry or a 401, then retries the failed request once. Always return a freshly minted `bt_*` from your backend; never hold a long-lived credential in the browser. If your callback rejects, the SDK emits `token_expired` with `recovery: 'refresh_session'` and halts cleanly."
+    },
+    {
+      "id": "origin-allowlist-prerequisite",
+      "title": "Add your frontend origin to the publishable key allowlist first",
+      "body": "Each publishable key carries an origin allowlist that you set in the console / dashboard. Your frontend's origin MUST be on that allowlist before the first mount, or EVERY mount fails with `origin_not_allowed` (the `bt_*` data-plane routes reject an off-allowlist `Origin`). Add your origin to the publishable key allowlist before you integrate."
+    },
+    {
+      "id": "sdk-adds-publishable-key-internally",
+      "title": "The SDK adds X-Publishable-Key itself on the customer path",
+      "body": "Pass `publishableKey` to `Checktiv.init(...)` and stop there. On the customer (pk-present) path the managed transport attaches the `X-Publishable-Key` header to its own `bt_*` data-plane calls internally. Do NOT also hand-add an `X-Publishable-Key` header yourself; double-adding it is wrong. (The first-party hosted path used internally by the verify app carries no publishable key and sends none.)"
+    },
+    {
+      "id": "cross-device-handoff-hook",
+      "title": "Wire cross-device QR handoff via openCrossDeviceOverlay",
+      "body": "Cross-device handoff is wired via STANDALONE exports from the `@checktiv/sdk-web/idv/cross-device` subpath (NOT via an option on `IdvMountOptions` / `mountProvisioned`). Import: `import { openCrossDeviceOverlay, preloadCrossDeviceChunk } from '@checktiv/sdk-web/idv/cross-device';`\n\n`openCrossDeviceOverlay(opts: CrossDeviceOverlayOptions)` opens the overlay. Key fields on `CrossDeviceOverlayOptions`:\n  • `target: HTMLElement`: the module's root container element.\n  • `onOpenCrossDevice: CrossDeviceHandoffHook`: HOST-supplied mint hook. Type: `() => Promise<{ kind: 'ok'; url: string } | { kind: 'unavailable' }>`. Your host calls its own OTL-mint BFF and returns `{ kind: 'ok', url }` with the journey URL, or `{ kind: 'unavailable' }` if the mint fails. The URL MUST be `https:` (the SDK validates this and collapses `javascript:`, `http:`, and `data:` schemes to `'unavailable'`). The hook is re-callable (the overlay has a \"refresh link\" affordance); cap re-mints with a per-overlay counter on your host.\n  • `copy: CrossDeviceCopy`: host-injected copy map; no hardcoded strings.\n  • `isMobile: boolean`: `true` suppresses the QR (same-device scan is circular).\n  • `emit: (e: ChecktivIdvEvent) => void`: forward to the host's `onEvent` handler.\n  • `onClose?: () => void`: called when the applicant closes the overlay or `destroy()` is called.\n\nReturns `CrossDeviceOverlayHandle` with:\n  • `setCompleting()`: marks the session completing (phone finished; overlay stays mounted with a waiting label instead of disappearing).\n  • `destroy()`: tears down the overlay. Idempotent.\n\n`preloadCrossDeviceChunk()`: fire-and-forget preload of the lazy CDN chunk. Call it when the IDV module becomes active to reduce perceived latency on open.\n\nEvents (both are token-free, NEVER contain the url/OTL/short-code):\n  • `checktiv.idv.cross_device_opened`: hook returned `ok`, overlay shown.\n  • `checktiv.idv.cross_device_unavailable`: hook returned `unavailable` or URL validation failed.\nThere is NO `cross_device_completed` event. Completion is the HOST's responsibility: poll your own `/api/idv/cross-device-status` BFF (returns `{ advanced: boolean }`) and call `window.location.reload()` exactly once when `advanced: true`. The SDK module NEVER writes `window.location`. Use `setCompleting()` on the returned handle before reloading so the overlay shows a completing state rather than disappearing abruptly.\n\nThe browser SDK CANNOT self-mint: `bt_*` bearers are rejected at the OTL-mint route. The host must own a server-side BFF that holds a `vt_*` cookie (HttpOnly, SameSite=Lax) and calls the sdk-api OTL-mint endpoint to produce the handoff URL."
+    }
+  ],
+  "recipes": [
+    {
+      "id": "backend-session-mint",
+      "title": "(a) Backend: mint a session with your secret key",
+      "language": "ts",
+      "code": "// Runs on YOUR server. The secret key reads from an env var, never a literal.\n// POST /v1/sessions on the public API creates the durable verification session.\nconst region = process.env.CHECKTIV_REGION ?? \"us\"; // \"us\" | \"eu\"\nconst res = await fetch(`https://api.${region}.checktiv.com/v1/sessions`, {\n  method: 'POST',\n  headers: {\n    // ah_sk_* is server-only. NEVER expose it to the browser.\n    Authorization: `Bearer ${process.env.CHECKTIV_SECRET_KEY}`,\n    'Content-Type': 'application/json',\n  },\n  // applicant_id MUST start with app_; checks is a non-empty list of check types.\n  body: JSON.stringify({ applicant_id: 'app_01abc', checks: ['id_verification'] }),\n});\nconst { data: session } = await res.json();\nreturn session.id; // vs_* - store this server-side, keyed to your user.\n\n// curl equivalent:\n//   curl -X POST \"https://api.us.checktiv.com/v1/sessions\" \\\n//     -H \"Authorization: Bearer $CHECKTIV_SECRET_KEY\" \\\n//     -H \"Content-Type: application/json\" \\\n//     -d '{\"applicant_id\":\"app_01abc\",\"checks\":[\"id_verification\"]}'"
+    },
+    {
+      "id": "backend-browser-token-mint",
+      "title": "(b) Backend: mint a bt_* browser token and hand it to the frontend",
+      "language": "ts",
+      "code": "// Your own endpoint that getSessionToken (recipe c) fetches. It mints a\n// fresh, short-lived bt_* for a session you already own server-side and\n// returns ONLY the bt_* string. ah_sk_* never leaves the server.\nimport express from 'express';\nconst app = express();\n\napp.post('/checktiv/browser-token', async (req, res) => {\n  // Resolve the session id from YOUR session/auth, not from the client body.\n  const sessionId = await resolveSessionIdForUser(req);\n  const region = process.env.CHECKTIV_REGION ?? \"us\";\n  const minted = await fetch(\n    `https://api.${region}.checktiv.com/sdk/v1/sessions/${sessionId}/browser-token`,\n    {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${process.env.CHECKTIV_SECRET_KEY}` },\n    },\n  );\n  const { data } = await minted.json(); // { browserToken, expiresAt, modules, scopes }\n  res.json({ browserToken: data.browserToken }); // return only the bt_* string\n});"
+    },
+    {
+      "id": "frontend-init-mount-provisioned",
+      "title": "(c) Frontend: init and mountProvisioned",
+      "language": "ts",
+      "code": "import { init } from '@checktiv/sdk-web';\nimport '@checktiv/sdk-web/idv'; // self-registers the idv module\nimport '@checktiv/sdk-web/fraud'; // import every module mountProvisioned may render\n\n// mountProvisioned renders whatever the server declared in session.modules,\n// so import EVERY module the server can select (idv + fraud). A module the\n// server declares but you did not import surfaces a loud, actionable error.\n// Do NOT add an X-Publishable-Key header anywhere: the SDK attaches it itself.\nconst client = init({\n  publishableKey: import.meta.env.PUBLIC_CHECKTIV_PK, // ah_pk_* - safe in the browser\n  // Called on mount and on expiry/401. Always return a FRESH bt_* from your backend.\n  getSessionToken: async (_ctx) => {\n    const r = await fetch('/checktiv/browser-token', { method: 'POST' });\n    const { browserToken } = await r.json();\n    return browserToken;\n  },\n});\n\n// mountProvisioned renders whatever the server declared in session.modules.\nclient.mountProvisioned({ target: document.getElementById('checktiv')! });"
+    },
+    {
+      "id": "webhook-verify-hmac",
+      "title": "(d) Backend: verify the signed webhook (HMAC) - the only outcome anchor",
+      "language": "ts",
+      "code": "// The outcome arrives here, signed. This is the ONLY trust anchor for a verdict.\nimport { createHmac, timingSafeEqual } from 'node:crypto';\n\nconst seen = new Set<string>(); // dedupe store; use a durable store in production.\n\nfunction verifyWebhook(rawBody: string, headers: Headers): boolean {\n  // Header: X-Webhook-Signature: t=<unix>,v1=<hex HMAC-SHA-256(secret, `${t}.${rawBody}`)>\n  const sig = headers.get('x-webhook-signature') ?? '';\n  const parts = Object.fromEntries(\n    sig.split(',').map((kv) => kv.split('=') as [string, string]),\n  );\n  // Reject outside the 300s replay window (the platform enforces it symmetrically).\n  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;\n  // Compute HMAC over the RAW body bytes - never re-serialized JSON.\n  const expected = createHmac('sha256', process.env.CHECKTIV_WEBHOOK_SECRET!)\n    .update(`${parts.t}.${rawBody}`)\n    .digest('hex');\n  const a = Buffer.from(expected, 'hex');\n  const b = Buffer.from(parts.v1 ?? '', 'hex');\n  if (a.length !== b.length || !timingSafeEqual(a, b)) return false; // constant-time\n  // Dedupe on X-Webhook-Id (at-least-once delivery resends the same id).\n  const id = headers.get('x-webhook-id') ?? '';\n  if (seen.has(id)) return false;\n  seen.add(id);\n  return true;\n}"
+    }
+  ]
+}

package/dist/capture-ui.css

@@ -0,0 +1 @@
+.idv-capture-frame{display:block;width:100%;max-width:28rem;aspect-ratio:3 / 4;margin:0 auto;border:0;border-radius:0.5rem;background:transparent}.idv-capture-frame--biometric{aspect-ratio:auto;height:min(70dvh,520px)}@media(orientation:landscape){.idv-capture-frame,.idv-capture-frame--biometric{aspect-ratio:auto;height:min(55dvh,380px);width:auto}}.idv-capture-active{position:relative}.idv-capture-skeleton{position:absolute;top:0;left:50%;transform:translateX(-50%);z-index:1;width:100%;max-width:28rem;height:min(70dvh,520px);border-radius:0.5rem;overflow:hidden;background:#e5e7eb}.idv-capture-skeleton[data-color-mode=dark]{background:#1f2937}.idv-capture-skeleton::before{content:"";position:absolute;inset:0;background:linear-gradient(100deg,transparent 30%,rgba(255,255,255,0.22) 50%,transparent 70%);background-size:200% 100%;animation:idv-capture-skeleton-sweep 1.4s ease-in-out infinite}@keyframes idv-capture-skeleton-sweep{from{background-position:200% 0}to{background-position:-200% 0}}@media(prefers-reduced-motion:reduce){.idv-capture-skeleton::before{animation:none}}@media(orientation:landscape){.idv-capture-skeleton{height:min(55dvh,380px)}}

package/dist/capture-ui.d.ts

@@ -0,0 +1,16 @@
+import { a as CaptureControllerDeps, b as CaptureEvent } from './controller-C4vJ47JI.js';
+import { e as CaptureState } from './machine--zVZIM4F.js';
+import { M as MountCopy } from './copy-DeUly5vr.js';
+export { T as TerminalKind, f as fallbackCopy } from './copy-DeUly5vr.js';
+
+interface MountCaptureOptions extends Omit<CaptureControllerDeps, 'getIframe'> {
+    copy: MountCopy;
+    onState?: (state: CaptureState) => void;
+    onControllerEvent?: (event: CaptureEvent) => void;
+}
+interface MountHandle {
+    destroy(): void;
+}
+declare function mount(element: HTMLElement, options: MountCaptureOptions): MountHandle;
+
+export { type MountCaptureOptions, MountCopy, type MountHandle, mount };

package/dist/capture-ui.js

@@ -0,0 +1,6 @@
+export { fallbackCopy, mount } from './chunk-C7H2ZVQT.js';
+import './chunk-HV2QKVJX.js';
+import './chunk-XOGHMNBX.js';
+import './chunk-TRTAZKYV.js';
+import './chunk-QFA3K5ZV.js';
+import './chunk-AIK7CDV6.js';

package/dist/capture.d.ts

@@ -0,0 +1,7 @@
+export { C as CaptureController, a as CaptureControllerDeps, b as CaptureEvent, c as CaptureEventType, S as SubmitResult, d as createCaptureController } from './controller-C4vJ47JI.js';
+import { a as CoachingKind } from './machine--zVZIM4F.js';
+export { b as CaptureAction, c as CaptureErrorKind, d as CapturePhase, e as CaptureState, i as isBiometricPhase, n as nextCapturePhaseAfterDocument, r as reducer } from './machine--zVZIM4F.js';
+
+declare function coachingKindForState(state: string): CoachingKind;
+
+export { CoachingKind, coachingKindForState };

package/dist/capture.js

@@ -0,0 +1,3 @@
+export { coachingKindForState, createCaptureController, isBiometricPhase, nextCapturePhaseAfterDocument, reducer } from './chunk-TRTAZKYV.js';
+import './chunk-QFA3K5ZV.js';
+import './chunk-AIK7CDV6.js';

package/dist/chunk-AIK7CDV6.js

@@ -0,0 +1,3 @@
+var __defProp=Object.defineProperty;var __defNormalProp=(obj,key,value)=>key in obj?__defProp(obj,key,{enumerable:true,configurable:true,writable:true,value}):obj[key]=value;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true});};var __publicField=(obj,key,value)=>__defNormalProp(obj,typeof key!=="symbol"?key+"":key,value);
+
+export { __export, __publicField };

package/dist/chunk-BYTKOKAD.js

@@ -0,0 +1,7 @@
+import { resolveSession } from './chunk-CXNPD67Z.js';
+import { resolveApiBaseOrigin, createTokenManager, getModule } from './chunk-FGWZZNAN.js';
+import { createChecktivError } from './chunk-WQCYRLWP.js';
+
+var PUBLISHABLE_KEY_REGEX=/^ah_pk_(us|eu)_(live|test)_[A-Za-z0-9_-]{8,}$/;var InvalidPublishableKeyError=class extends Error{constructor(message){super(message);this.name="InvalidPublishableKeyError";}};function parsePublishableKey(key){const match=PUBLISHABLE_KEY_REGEX.exec(key);if(!match){throw new InvalidPublishableKeyError(`Invalid publishable key format. Expected ah_pk_<us|eu>_<live|test>_<token>, got: ${maskKey(key)}`)}const region=match[1];const mode=match[2];if(region!=="us"&&region!=="eu"){throw new InvalidPublishableKeyError(`Invalid region in publishable key: ${maskKey(key)}`)}if(mode!=="test"&&mode!=="live"){throw new InvalidPublishableKeyError(`Invalid mode in publishable key: ${maskKey(key)}`)}return {region,mode}}function maskKey(key){if(key.length<=8)return "***";return `${key.slice(0,6)}...${key.slice(-2)}`}function moduleErrorEvent(name,error){switch(name){case "idv":return {type:"checktiv.idv.error",error};case "fraud":return {type:"checktiv.fraud.error",error};case "custom_form":return {type:"checktiv.custom_form.error",error}}}function missingModuleMessage(name){return `This session requires the '${name}' module. Import '@checktiv/sdk-web/${name}' in your app.`}function missingModuleError(name){const base=createChecktivError("sdk_load_failed");return moduleErrorEvent(name,{...base,message:missingModuleMessage(name)})}function consentGateRequiredError(){const base=createChecktivError("sdk_load_failed");return moduleErrorEvent("fraud",{...base,message:"This session includes the 'fraud' module, which needs a consent gate. Pass onConsent to mountProvisioned() to enable it."})}function customFormConfigRequiredError(){const base=createChecktivError("sdk_load_failed");return moduleErrorEvent("custom_form",{...base,message:"This session includes the 'custom_form' module, which needs its form config. Pass customFormConfig to mountProvisioned() to enable it."})}function unmappedStepTypeError(stepType){const base=createChecktivError("sdk_load_failed");return moduleErrorEvent("idv",{...base,message:`This session's current step ('${stepType}') has no matching visual module in this SDK build. Upgrade '@checktiv/sdk-web' to a version that renders this step.`})}var MODULE_IS_VISUAL={idv:true,fraud:false,custom_form:true};var STEP_TYPE_TO_VISUAL_MODULE={id_verification:"idv",custom_form:"custom_form"};var stepTypeToVisualModuleView=STEP_TYPE_TO_VISUAL_MODULE;function resolveCurrentStepVisualModule(stepType){return stepTypeToVisualModuleView[stepType]}function defaultLoadModule(name){if(name==="idv"){const factory2=getModule("idv");if(factory2===void 0)return Promise.resolve(null);return Promise.resolve({mount:(ctx,opts)=>factory2(ctx,{target:opts.target,onEvent:opts.onEvent,copy:opts.copy,onBeforeSubmit:opts.onBeforeSubmit,onBehaviorSegment:opts.onBehaviorSegment,synthetic:opts.synthetic})})}if(name==="custom_form"){const factory2=getModule("custom_form");if(factory2===void 0)return Promise.resolve(null);return Promise.resolve({mount:(ctx,opts)=>{if(opts.customFormConfig===void 0){opts.onEvent?.(customFormConfigRequiredError());return {destroy:()=>void 0}}return factory2(ctx,{target:opts.target,config:opts.customFormConfig,copy:opts.customFormCopy,onEvent:opts.onEvent,session:opts.session})}})}const factory=getModule("fraud");if(factory===void 0)return Promise.resolve(null);return Promise.resolve({mount:(ctx,opts)=>{const onConsent=opts.onConsent;if(onConsent===void 0){opts.onEvent?.(consentGateRequiredError());return {destroy:()=>void 0}}return factory(ctx,{onConsent,onEvent:opts.onEvent})}})}function moduleErrorFor(name,code){return moduleErrorEvent(name,createChecktivError(code))}function createMountProvisioned(ctx,opts,deps={}){const emit=e=>opts.onEvent?.(e);const fetchImpl=opts.fetchImpl??fetch;const resolveSession2=deps.resolveSession??(()=>resolveSession(ctx,fetchImpl));const loadModule=deps.loadModule??defaultLoadModule;const handles=[];let destroyed=false;void(async()=>{try{await composeModules();}catch(err){if(destroyed)return;console.warn("[Checktiv] mountProvisioned composition failed.",err);emit(moduleErrorFor("idv","sdk_load_failed"));}})();async function composeModules(){const session=await resolveSession2();if(destroyed)return;if(session===null){emit(moduleErrorFor("idv","session_expired"));return}const currentStepVisualModule=resolveCurrentStepVisualModule(session.stepType);if(currentStepVisualModule===void 0&&session.modules.some(m=>MODULE_IS_VISUAL[m])){emit(unmappedStepTypeError(session.stepType));return}for(const name of session.modules){if(destroyed)return;if(MODULE_IS_VISUAL[name]&&name!==currentStepVisualModule){continue}if(name==="fraud"&&opts.onConsent===void 0){emit(consentGateRequiredError());continue}const mod=await loadModule(name);if(destroyed)return;if(mod===null){emit(missingModuleError(name));continue}let moduleTarget;let containerToRemove=null;if(MODULE_IS_VISUAL[name]){const resolvedParent=typeof opts.target==="string"?typeof document!=="undefined"?document.querySelector(opts.target):null:opts.target;if(resolvedParent!==null){const container=document.createElement("div");resolvedParent.appendChild(container);containerToRemove=container;moduleTarget=container;}else {moduleTarget=opts.target;}}else {moduleTarget=opts.target;}let innerHandle;try{innerHandle=mod.mount(ctx,{target:moduleTarget,onEvent:opts.onEvent,onConsent:opts.onConsent,copy:opts.copy,onBeforeSubmit:opts.onBeforeSubmit,onBehaviorSegment:opts.onBehaviorSegment,synthetic:opts.synthetic,customFormConfig:opts.customFormConfig,customFormCopy:opts.customFormCopy,session:{sessionId:session.sessionId,stepId:session.stepId}});}catch(err){containerToRemove?.remove();throw err}const capturedContainer=containerToRemove;const handle={destroy(){try{innerHandle.destroy();}finally{capturedContainer?.remove();}}};if(destroyed){handle.destroy();return}handles.push(handle);}}return {destroy(){destroyed=true;while(handles.length>0){const handle=handles.pop();handle?.destroy();}}}}function init(opts){const scope="publishableKey"in opts?{...parsePublishableKey(opts.publishableKey),publishableKey:opts.publishableKey}:{region:opts.region,mode:opts.mode,publishableKey:void 0};let sessionId="";const apiBaseOrigin=resolveApiBaseOrigin(opts.apiBase,scope.region,scope.mode);const ctx={region:scope.region,mode:scope.mode,publishableKey:scope.publishableKey,apiBaseOrigin,theme:opts.theme,locale:opts.locale??"en",betas:opts.betas??[],...opts.selfiePromptMap!==void 0?{selfiePromptMap:opts.selfiePromptMap}:{},tokens:createTokenManager(opts.getSessionToken,()=>sessionId),getSessionId:()=>sessionId,setSessionId:id=>{sessionId=id;}};function mount(...args){if(args[0]==="idv"){const factory2=getModule("idv");if(factory2===void 0)return missingIdvHandle(args[1]);return factory2(ctx,args[1])}if(args[0]==="custom_form"){const factory2=getModule("custom_form");if(factory2===void 0)return missingCustomFormHandle(args[1]);return factory2(ctx,args[1])}const factory=getModule("fraud");if(factory===void 0)return missingFraudHandle(args[1]);return factory(ctx,args[1])}return {mountProvisioned:provOpts=>createMountProvisioned(ctx,provOpts),mount}}function missingIdvHandle(opts){const base=createChecktivError("sdk_load_failed");opts.onEvent?.({type:"checktiv.idv.error",error:{...base,message:missingModuleMessage("idv")}});return {destroy:()=>void 0,unmount:()=>void 0}}function missingFraudHandle(opts){const base=createChecktivError("sdk_load_failed");opts.onEvent?.({type:"checktiv.fraud.error",error:{...base,message:missingModuleMessage("fraud")}});return {destroy:()=>void 0}}function missingCustomFormHandle(opts){const base=createChecktivError("sdk_load_failed");const error={type:"checktiv.custom_form.error",error:{...base,message:missingModuleMessage("custom_form")}};opts.onEvent?.(error);return {destroy:()=>void 0}}
+
+export { InvalidPublishableKeyError, init, parsePublishableKey };