@checktiv/sdk-web 1.0.0

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+import { C as ChecktivInitOptions, a as ChecktivClient, I as InitOptions } from './types-CnlkFS7V.js';
+export { b as ChecktivError, c as ChecktivErrorCode, d as ChecktivEvent, e as ChecktivFraudEvent, f as ChecktivIdvEvent, g as CrossDeviceHandoffHook, F as FraudHandle, h as FraudMountOptions, G as GetSessionToken, i as GetSessionTokenContext, j as IdvCoachingHint, k as IdvHandle, l as IdvMountOptions, m as InvalidPublishableKeyError, M as MountProvisionedOptions, P as ParsedPublishableKey, n as ProvisionedHandle, R as ResolvedIdvConfig, S as SdkMode, o as SdkRegion, p as SyntheticIdvScript, q as parsePublishableKey } from './types-CnlkFS7V.js';
+export { ChecktivIdvProps, ChecktivProviderProps } from './react.js';
+import './machine--zVZIM4F.js';
+import './copy-DeUly5vr.js';
+import 'react';
+
+declare function init(opts: ChecktivInitOptions): ChecktivClient;
+
+declare const version: string;
+declare function mountButton(opts: InitOptions): void;
+
+export { ChecktivClient, ChecktivInitOptions, InitOptions, init, mountButton, version };

package/dist/index.js

@@ -0,0 +1,12 @@
+import { parsePublishableKey } from './chunk-BYTKOKAD.js';
+export { InvalidPublishableKeyError, init, parsePublishableKey } from './chunk-BYTKOKAD.js';
+import './chunk-CXNPD67Z.js';
+import { sdkPublicSettings } from './chunk-FGWZZNAN.js';
+import { R, k } from './chunk-XOGHMNBX.js';
+import { getServiceOrigin } from './chunk-QFA3K5ZV.js';
+import './chunk-WQCYRLWP.js';
+import './chunk-AIK7CDV6.js';
+
+var HOST_TAG="checktiv-root";var MOUNTED_FLAG="__checktivMounted";var LEGACY_HOST_ATTR="data-autohost-kyc-host";var HOST_ATTR="data-checktiv-host";var shadowCache=new WeakMap;function mountShadowHost(target){const existing=findExistingHost(target);if(existing){const cached=shadowCache.get(existing);if(cached)return cached}const host=document.createElement("div");host.setAttribute(HOST_ATTR,HOST_TAG);host.setAttribute(LEGACY_HOST_ATTR,HOST_TAG);host[MOUNTED_FLAG]=true;target.appendChild(host);const shadow=host.attachShadow({mode:"closed"});shadowCache.set(host,shadow);return shadow}function findExistingHost(target){for(const child of Array.from(target.children)){if(!(child instanceof HTMLElement))continue;const candidate=child;if(candidate[MOUNTED_FLAG]===true)return candidate}return null}var version="1.0.0";var initialised=new WeakSet;function resolveVerifyOrigin(parsed){return getServiceOrigin(sdkPublicSettings.apps.verify.subdomain,"prod",parsed.region,sdkPublicSettings)}function buildPopupUrl(parsed,opts){const origin=resolveVerifyOrigin(parsed);if(opts.applicantLinkToken){return `${origin}/start?lt=${encodeURIComponent(opts.applicantLinkToken)}`}return `${origin}/`}function launchPopup(url){const w=460;const h=760;const left=Math.max(0,Math.floor((window.screen.width-w)/2));const top=Math.max(0,Math.floor((window.screen.height-h)/2));const features=`popup=yes,width=${w},height=${h},left=${left},top=${top}`;const popup=window.open(url,"checktiv",features);if(!popup){window.location.href=url;return null}return popup}var COMPLETE_EVENT_TYPE="autohost.kyc.complete";function isCompletionMessage(data){if(typeof data!=="object"||data===null)return false;if(!("type"in data))return false;return data.type===COMPLETE_EVENT_TYPE}function listenForCompletion(expectedOrigin,onComplete){if(!onComplete)return;const handler=event=>{if(event.origin!==expectedOrigin)return;const data=event.data;if(!isCompletionMessage(data))return;onComplete(data);};window.addEventListener("message",handler);}function buildButton(onClick){const children="Start verification";return k("button",{type:"button",onClick,style:'display: inline-flex; align-items: center; justify-content: center; padding: 10px 20px; font-family: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", sans-serif; font-size: 14px; font-weight: 600; color: #fff; background: #0b5fff; border: none; border-radius: 6px; cursor: pointer;'},children)}function resolveTarget(opts){if(opts.target)return opts.target;return document.querySelector("[data-checktiv]")??document.querySelector("[data-autohost-kyc]")}function mountButton(opts){const parsed=parsePublishableKey(opts.publishableKey);const target=resolveTarget(opts);if(!target){console.warn("[Checktiv] No mount target found. Either pass `target` explicitly or add `<div data-checktiv>` to your page.");return}if(initialised.has(target))return;initialised.add(target);const shadow=mountShadowHost(target);const verifyOrigin=resolveVerifyOrigin(parsed);listenForCompletion(verifyOrigin,opts.onComplete);const onClick=()=>{const popupUrl=buildPopupUrl(parsed,opts);launchPopup(popupUrl);};R(buildButton(onClick),shadow);}
+
+export { mountButton, version };

package/dist/machine--zVZIM4F.d.ts

@@ -0,0 +1,144 @@
+type CaptureDocumentSide = 'front' | 'back';
+type CaptureErrorCode = 'cv_gate_failed' | 'upload_failed' | 'sdk_load_failed' | 'token_expired' | 'biometric_unsupported' | 'selfie_camera_denied' | 'liveness_camera_denied' | 'liveness_timeout' | 'liveness_server_error' | 'liveness_runtime_error' | 'liveness_cancelled' | 'protocol_mismatch';
+interface SelfiePromptMap {
+    no_face?: string;
+    multiple_faces?: string;
+    too_dark?: string;
+    move_closer?: string;
+    not_centered?: string;
+    hold_still?: string;
+    ready?: string;
+}
+type DataMode = 'live' | 'test';
+type TestHint = 'pass' | 'review' | 'fail' | 'doc_quality';
+interface CaptureBrandTokens {
+    primary: string;
+    primaryHover: string;
+    onPrimary: string;
+    secondary: string;
+    onSecondary: string;
+    ring: string;
+}
+interface CaptureTheme {
+    colorMode: 'light' | 'dark';
+    brandTokens: CaptureBrandTokens | null;
+}
+type IdvDocumentType = 'passport' | 'drivers_license' | 'id_card';
+interface IdVerificationConfig {
+    documentTypes: IdvDocumentType[];
+    biometricMode: 'none' | 'selfie' | 'liveness';
+    requireMrzMatch: boolean;
+    requireExpiryValid: boolean;
+    requireNameMatch: boolean;
+    documentAuthenticity: boolean;
+    minAge?: number;
+}
+interface CaptureInitMessage {
+    type: 'capture:init';
+    captureToken: string;
+    config: IdVerificationConfig;
+    locale: string;
+    theme: CaptureTheme;
+    mode?: DataMode;
+    testHint?: TestHint;
+    protocolVersion?: number;
+    beginScanPrompt?: string;
+    beginScanLabel?: string;
+    selfiePromptMap?: SelfiePromptMap;
+}
+interface IdvR2Keys {
+    front: string;
+    back?: string;
+    selfie?: string;
+}
+interface CaptureBehaviorStep {
+    stepId: string;
+    seconds: number;
+    pasteCount: number;
+}
+interface CaptureBehaviorTraits {
+    webdriver: boolean;
+    maxTouchPoints: number;
+    timezone: string | null;
+    pluginCount: number;
+    deviceModelHint: string | null;
+}
+interface CaptureBehaviorMessage {
+    type: 'capture:behavior';
+    steps: CaptureBehaviorStep[];
+    traits: CaptureBehaviorTraits;
+}
+
+type CapturePhase = 'ready' | 'document_front' | 'document_back' | 'selfie' | 'liveness' | 'uploading' | 'coaching';
+type CoachingKind = 'move_closer' | 'move_farther' | 'reduce_glare' | 'too_dark' | 'wrong_side' | 'hold_steady';
+type CaptureState = {
+    kind: 'minting';
+} | {
+    kind: 'mint_error';
+} | {
+    kind: 'waiting_for_init';
+    captureToken: string;
+    embedOrigin: string;
+    runIndex: number;
+} | {
+    kind: 'ready';
+    embedOrigin: string;
+    runIndex: number;
+} | {
+    kind: 'capturing';
+    embedOrigin: string;
+    runIndex: number;
+    phase: CapturePhase;
+    coaching: CoachingKind | null;
+    lastCvRejectReason: string | null;
+    biometricLoading: boolean;
+} | {
+    kind: 'submitting';
+} | {
+    kind: 'submit_error';
+} | {
+    kind: 'submit_pending';
+} | {
+    kind: 'token_expired';
+} | {
+    kind: 'capture_error';
+    errorKind: CaptureErrorKind;
+};
+type CaptureErrorKind = Exclude<CaptureErrorCode, 'token_expired'>;
+type CaptureAction = {
+    type: 'mint_ok';
+    captureToken: string;
+    embedOrigin: string;
+    runIndex: number;
+} | {
+    type: 'mint_failed';
+} | {
+    type: 'iframe_ready';
+} | {
+    type: 'phase';
+    phase: CapturePhase;
+} | {
+    type: 'coaching';
+    coaching: CoachingKind;
+} | {
+    type: 'selfie_cv_reject';
+    reason: string | null;
+} | {
+    type: 'biometric_camera_live';
+} | {
+    type: 'submitting';
+} | {
+    type: 'submit_failed';
+} | {
+    type: 'submit_pending';
+} | {
+    type: 'token_expired';
+} | {
+    type: 'capture_error';
+    errorKind: CaptureErrorKind;
+};
+declare function reducer(state: CaptureState, action: CaptureAction): CaptureState;
+declare function nextCapturePhaseAfterDocument(side: CaptureDocumentSide, documentTypes: IdVerificationConfig['documentTypes'], biometricMode: IdVerificationConfig['biometricMode']): CapturePhase;
+declare function isBiometricPhase(phase: CapturePhase): boolean;
+
+export { type CaptureBehaviorMessage as C, type IdvR2Keys as I, type SelfiePromptMap as S, type CoachingKind as a, type CaptureAction as b, type CaptureErrorKind as c, type CapturePhase as d, type CaptureState as e, type CaptureInitMessage as f, isBiometricPhase as i, nextCapturePhaseAfterDocument as n, reducer as r };

package/dist/react.d.ts

@@ -0,0 +1,23 @@
+import { ReactNode, ReactElement } from 'react';
+import { f as ChecktivIdvEvent, C as ChecktivInitOptions, r as ChecktivInitScope, a as ChecktivClient } from './types-CnlkFS7V.js';
+import { C as CaptureBehaviorMessage } from './machine--zVZIM4F.js';
+import { M as MountCopy } from './copy-DeUly5vr.js';
+
+interface ChecktivProviderPropsBase {
+    getSessionToken: ChecktivInitOptions['getSessionToken'];
+    theme?: ChecktivInitOptions['theme'];
+    locale?: string;
+    children: ReactNode;
+}
+type ChecktivProviderProps = ChecktivProviderPropsBase & ChecktivInitScope;
+declare function ChecktivProvider(props: ChecktivProviderProps): ReactElement | null;
+declare function useChecktiv(): ChecktivClient;
+interface ChecktivIdvProps {
+    onEvent: (e: ChecktivIdvEvent) => void;
+    copy?: MountCopy;
+    onBeforeSubmit?: () => Promise<void>;
+    onBehaviorSegment?: (segment: Pick<CaptureBehaviorMessage, 'steps' | 'traits'>) => void;
+}
+declare function ChecktivIdv({ onEvent, copy, onBeforeSubmit, onBehaviorSegment, }: ChecktivIdvProps): ReactElement | null;
+
+export { ChecktivIdv, type ChecktivIdvProps, ChecktivProvider, type ChecktivProviderProps, type ChecktivProviderPropsBase, useChecktiv };

package/dist/react.js

@@ -0,0 +1,12 @@
+import { init } from './chunk-BYTKOKAD.js';
+import './chunk-CXNPD67Z.js';
+import './chunk-FGWZZNAN.js';
+import './chunk-QFA3K5ZV.js';
+import './chunk-WQCYRLWP.js';
+import './chunk-AIK7CDV6.js';
+import { createContext, useMemo, useContext, useRef, useEffect } from 'react';
+import { jsx } from 'react/jsx-runtime';
+
+var ChecktivContext=createContext(null);function ChecktivProvider(props){if(typeof window==="undefined")return null;return jsx(ProviderImpl,{...props})}function ProviderImpl(props){const{getSessionToken,theme,locale,children}=props;const scope="publishableKey"in props?{publishableKey:props.publishableKey}:{region:props.region,mode:props.mode};const pk="publishableKey"in props?props.publishableKey:void 0;const region="publishableKey"in props?void 0:props.region;const mode="publishableKey"in props?void 0:props.mode;const themeKey=JSON.stringify(theme??null);const client=useMemo(()=>init({...scope,getSessionToken,theme,locale}),[pk,region,mode,getSessionToken,themeKey,locale]);return jsx(ChecktivContext.Provider,{value:client,children})}function useChecktiv(){const client=useContext(ChecktivContext);if(client===null){throw new Error("useChecktiv must be used within a <ChecktivProvider>. Wrap the component tree that needs the Checktiv client with <ChecktivProvider>.")}return client}function ChecktivIdv({onEvent,copy,onBeforeSubmit,onBehaviorSegment}){const client=useChecktiv();const containerRef=useRef(null);const handleRef=useRef(null);const mountConfigRef=useRef({copy,onBeforeSubmit,onBehaviorSegment});const onEventRef=useRef(onEvent);onEventRef.current=onEvent;useEffect(()=>{if(typeof window==="undefined")return;if(containerRef.current===null)return;if(handleRef.current!==null)return;const mountConfig=mountConfigRef.current;handleRef.current=client.mount("idv",{target:containerRef.current,onEvent:e=>onEventRef.current(e),...mountConfig.copy!==void 0?{copy:mountConfig.copy}:{},...mountConfig.onBeforeSubmit!==void 0?{onBeforeSubmit:mountConfig.onBeforeSubmit}:{},...mountConfig.onBehaviorSegment!==void 0?{onBehaviorSegment:mountConfig.onBehaviorSegment}:{}});return ()=>{handleRef.current?.destroy();handleRef.current=null;}},[client]);if(typeof window==="undefined")return null;return jsx("div",{ref:containerRef})}
+
+export { ChecktivIdv, ChecktivProvider, useChecktiv };

package/dist/types-CnlkFS7V.d.ts

@@ -0,0 +1,244 @@
+import { a as CoachingKind, C as CaptureBehaviorMessage, S as SelfiePromptMap } from './machine--zVZIM4F.js';
+import { M as MountCopy } from './copy-DeUly5vr.js';
+
+declare const SystemModes: readonly ["live", "test"];
+type SystemMode = (typeof SystemModes)[number];
+declare const DataRegions: readonly ["us", "eu"];
+type DataRegion = (typeof DataRegions)[number];
+
+type SdkRegion = DataRegion;
+type SdkMode = SystemMode;
+interface InitOptions {
+    readonly publishableKey: string;
+    readonly applicantLinkToken?: string;
+    readonly target?: HTMLElement;
+    readonly onComplete?: (payload: unknown) => void;
+}
+interface ParsedPublishableKey {
+    readonly region: SdkRegion;
+    readonly mode: SdkMode;
+}
+declare class InvalidPublishableKeyError extends Error {
+    constructor(message: string);
+}
+declare function parsePublishableKey(key: string): ParsedPublishableKey;
+
+interface TokenManager {
+    get(): Promise<string>;
+    refresh(reason: 'expired' | '401'): Promise<string>;
+}
+
+type ChecktivErrorCode = 'origin_not_allowed' | 'token_expired' | 'session_expired' | 'protocol_mismatch' | 'camera_denied' | 'cv_gate_failed' | 'upload_failed' | 'sdk_load_failed' | 'biometric_unsupported' | 'isolation_required';
+interface ChecktivError {
+    code: ChecktivErrorCode;
+    recoverable: boolean;
+    recovery: 'retry' | 'cross_device' | 'refresh_session' | 'contact_operator';
+    message: string;
+}
+
+type ChecktivFraudEvent = {
+    type: 'checktiv.fraud.started';
+} | {
+    type: 'checktiv.fraud.error';
+    error: ChecktivError;
+};
+interface FraudMountOptions {
+    onConsent: () => boolean | Promise<boolean>;
+    onEvent?: (e: ChecktivFraudEvent) => void;
+    fetchImpl?: typeof fetch;
+}
+interface FraudHandle {
+    destroy(): void;
+}
+declare function createFraud(ctx: SubstrateContext, opts: FraudMountOptions): FraudHandle;
+
+type IdvCoachingHint = CoachingKind;
+interface ResolvedIdvConfig {
+    documentTypes: readonly string[];
+    biometricMode: 'selfie' | 'liveness' | 'none';
+}
+type ChecktivIdvEvent = {
+    type: 'checktiv.idv.ready';
+    config: ResolvedIdvConfig;
+} | {
+    type: 'checktiv.idv.phase';
+    phase: string;
+} | {
+    type: 'checktiv.idv.coaching';
+    hint: IdvCoachingHint;
+} | {
+    type: 'checktiv.idv.submitted';
+    sessionId: string;
+} | {
+    type: 'checktiv.idv.processing';
+} | {
+    type: 'checktiv.idv.error';
+    error: ChecktivError;
+} | {
+    type: 'checktiv.idv.cross_device_opened';
+} | {
+    type: 'checktiv.idv.cross_device_unavailable';
+};
+type ChecktivEvent = ChecktivIdvEvent | ChecktivFraudEvent | {
+    type: `checktiv.${string}`;
+    [k: string]: unknown;
+};
+
+interface SyntheticIdvScript {
+    injectError?: ChecktivErrorCode;
+    stepDelayMs?: number;
+}
+
+type CrossDeviceHandoffHook = () => Promise<{
+    kind: 'ok';
+    url: string;
+} | {
+    kind: 'unavailable';
+}>;
+interface IdvMountOptions {
+    target: HTMLElement | string;
+    onEvent?: (e: ChecktivIdvEvent) => void;
+    copy?: MountCopy;
+    onBeforeSubmit?: () => Promise<void>;
+    onBehaviorSegment?: (segment: Pick<CaptureBehaviorMessage, 'steps' | 'traits'>) => void;
+    fetchImpl?: typeof fetch;
+    synthetic?: SyntheticIdvScript;
+}
+interface IdvHandle {
+    destroy(): void;
+    unmount(): void;
+}
+declare const REMINT_READY_TIMEOUT_MS = 15000;
+declare function createIdv(ctx: SubstrateContext, opts: IdvMountOptions): IdvHandle;
+
+interface CustomFormFieldCopy {
+    readonly label?: string;
+    readonly helpText?: string;
+    readonly options?: Readonly<Record<string, string>>;
+}
+interface CustomFormCopy {
+    readonly fields?: Readonly<Record<string, CustomFormFieldCopy>>;
+    readonly submit?: string;
+    readonly requiredError?: string;
+    readonly uploadError?: string;
+    readonly submitError?: string;
+    readonly booleanYes?: string;
+    readonly booleanNo?: string;
+}
+
+type ChecktivCustomFormEvent = {
+    type: 'checktiv.custom_form.ready';
+} | {
+    type: 'checktiv.custom_form.submitted';
+    sessionId: string;
+} | {
+    type: 'checktiv.custom_form.error';
+    error: ChecktivError;
+};
+
+declare const FORM_FIELD_TYPES: readonly ["short_text", "long_text", "number", "email", "phone", "date", "single_select", "multi_select", "boolean", "file_upload", "content_heading", "content_paragraph"];
+type FormFieldType = (typeof FORM_FIELD_TYPES)[number];
+
+type CustomFormApplicantLabel = Record<string, string>;
+interface CustomFormApplicantFieldValidation {
+    minLength?: number;
+    maxLength?: number;
+    min?: number;
+    max?: number;
+    minSelections?: number;
+    maxSelections?: number;
+}
+interface CustomFormApplicantFieldOption {
+    value: string;
+    label: CustomFormApplicantLabel;
+}
+interface CustomFormApplicantField {
+    id: string;
+    type: FormFieldType;
+    label: CustomFormApplicantLabel;
+    helpText?: CustomFormApplicantLabel;
+    required: boolean;
+    validation?: CustomFormApplicantFieldValidation;
+    options?: CustomFormApplicantFieldOption[];
+}
+type CustomFormApplicantConfig = {
+    supportedLocales: string[];
+    fields: CustomFormApplicantField[];
+};
+
+interface CustomFormMountOptions {
+    target: HTMLElement | string;
+    config: CustomFormApplicantConfig;
+    copy?: CustomFormCopy;
+    onEvent?: (e: ChecktivCustomFormEvent) => void;
+    session?: {
+        sessionId: string;
+        stepId: string;
+    };
+    fetchImpl?: typeof fetch;
+    preview?: boolean;
+}
+interface CustomFormHandle {
+    destroy(): void;
+}
+declare function createCustomForm(ctx: SubstrateContext, opts: CustomFormMountOptions): CustomFormHandle;
+
+interface ProvisionedHandle {
+    destroy(): void;
+}
+interface MountProvisionedOptions {
+    target: HTMLElement | string;
+    onEvent?: (e: ChecktivEvent) => void;
+    onConsent?: () => boolean | Promise<boolean>;
+    copy?: MountCopy;
+    onBeforeSubmit?: () => Promise<void>;
+    onBehaviorSegment?: (segment: Pick<CaptureBehaviorMessage, 'steps' | 'traits'>) => void;
+    fetchImpl?: typeof fetch;
+    synthetic?: IdvMountOptions['synthetic'];
+    customFormConfig?: CustomFormApplicantConfig;
+    customFormCopy?: CustomFormCopy;
+}
+
+interface GetSessionTokenContext {
+    sessionId: string;
+    reason: 'initial' | 'expired' | '401';
+}
+type GetSessionToken = string | ((ctx: GetSessionTokenContext) => Promise<string>);
+interface ChecktivInitOptionsBase {
+    getSessionToken: GetSessionToken;
+    theme?: {
+        primaryColor?: string;
+    };
+    locale?: string;
+    apiBase?: string;
+    betas?: string[];
+    selfiePromptMap?: SelfiePromptMap;
+}
+type ChecktivInitScope = {
+    publishableKey: string;
+} | {
+    region: SdkRegion;
+    mode: SdkMode;
+};
+type ChecktivInitOptions = ChecktivInitOptionsBase & ChecktivInitScope;
+interface ChecktivClient {
+    mountProvisioned(opts: MountProvisionedOptions): ProvisionedHandle;
+    mount(module: 'idv', opts: IdvMountOptions): IdvHandle;
+    mount(module: 'fraud', opts: FraudMountOptions): FraudHandle;
+    mount(module: 'custom_form', opts: CustomFormMountOptions): CustomFormHandle;
+}
+interface SubstrateContext {
+    readonly region: SdkRegion;
+    readonly mode: SdkMode;
+    readonly publishableKey: string | undefined;
+    readonly apiBaseOrigin: string;
+    readonly theme?: ChecktivInitOptions['theme'];
+    readonly locale: string;
+    readonly betas: readonly string[];
+    readonly selfiePromptMap?: SelfiePromptMap;
+    readonly tokens: TokenManager;
+    getSessionId(): string;
+    setSessionId(id: string): void;
+}
+
+export { createCustomForm as A, type ChecktivInitOptions as C, type FraudHandle as F, type GetSessionToken as G, type InitOptions as I, type MountProvisionedOptions as M, type ParsedPublishableKey as P, type ResolvedIdvConfig as R, type SdkMode as S, type ChecktivClient as a, type ChecktivError as b, type ChecktivErrorCode as c, type ChecktivEvent as d, type ChecktivFraudEvent as e, type ChecktivIdvEvent as f, type CrossDeviceHandoffHook as g, type FraudMountOptions as h, type GetSessionTokenContext as i, type IdvCoachingHint as j, type IdvHandle as k, type IdvMountOptions as l, InvalidPublishableKeyError as m, type ProvisionedHandle as n, type SdkRegion as o, type SyntheticIdvScript as p, parsePublishableKey as q, type ChecktivInitScope as r, createFraud as s, REMINT_READY_TIMEOUT_MS as t, createIdv as u, type ChecktivCustomFormEvent as v, type CustomFormCopy as w, type CustomFormFieldCopy as x, type CustomFormHandle as y, type CustomFormMountOptions as z };

package/package.json

@@ -0,0 +1,130 @@
+{
+  "name": "@checktiv/sdk-web",
+  "version": "1.0.0",
+  "private": false,
+  "license": "Apache-2.0",
+  "//publishConfigNameNote": "pnpm does NOT apply `publishConfig.name` (the publishConfig override list at https://pnpm.io/package_json#publishconfig excludes `name`; `pnpm pack` leaves the tarball `name` as the workspace name). The published `name` rewrite to `@checktiv/sdk-web` happens in the root `.pnpmfile.cjs` `beforePacking` hook (pnpm >= 10.28) instead — see that file's header. This field is retained ONLY as documentation of intent; the hook deletes it from the packed manifest. The packed-name gate in __tests__/dist-shape.test.ts reads the REAL extracted tarball, not this field.",
+  "publishConfig": {
+    "access": "public"
+  },
+  "//publishConfigExportsNote": "pnpm applies this `publishConfig.exports` override on `pnpm pack`/`pnpm publish` (NOT `npm pack`), so it defines the PUBLISHED npm shape while the top-level `exports` stays the in-repo (workspace) shape. Differences, both required: (1) every `types` target points at the built `./dist/*.d.ts` (the workspace map points `types` at `./src/*.ts` so in-repo consumers type-check against source with no build; those `.ts` files are NOT in the `files: [dist]` tarball, so publint --strict --pack would error on them). (2) `./agent` is OMITTED: it is a workspace-only export (not a customer API; keystone §5.1) that pulls the licensed, publishable-key-bound `@fingerprint/agent`, which must NEVER ship in the npm tarball (the C3 tarball guard's FORBIDDEN list proves it). `./agents` (the C13 machine-readable steering manifest -> ./dist/agents/manifest.json) IS published: C13's `scripts/generate-agent-steering.mjs` (chained into `build` after tsup) generates `dist/agents/manifest.json`, so it resolves in both the workspace map and this override; the dist-shape tarball test asserts `dist/agents/{AGENTS.md,manifest.json}` ship. publint --strict + attw (esm-only, against the pnpm-packed tarball) both validate THIS map.",
+  "description": "Customer-embed Web SDK (Checktiv): tsup dual build — (A) ESM npm package (`@checktiv/sdk-web`) with per-subpath tree-shaking and Checktiv.init substrate for managed IDV / fraud modules, React wrapper; (B) CDN IIFE assigned to window.Checktiv (with legacy window.AutohostKyc alias for existing snippets). Published dist/ is built by tsup; CDN IIFE lands at services/sdk-cdn/public/v1/sdk.js.",
+  "type": "module",
+  "//exportsNote": "Dual conditions: `types` resolves to the source `.ts` file so in-repo consumers (verify, console) type-check against source without a build step (mirrors @rf/schemas pattern). `import` resolves to the compiled `dist/*.js` for the published npm package. `./agent` is a SOURCE-ONLY interim export (tsup profile A does not build a dist/agent.js yet; the verify app consumes it via its own bundler). `./agents` ships the C13 machine-readable steering manifest; `AGENTS.md` lives alongside it in dist/agents/ (discoverable via the file tree, no export entry to avoid publint resolution warnings). `src/cdn.ts` is the CDN-IIFE-only entry (tsup profile B) and is NOT a published subpath.",
+  "//customFormStyleNote": "`./custom-form/style.css` exports the custom-form module's field stylesheet so the verify host can `import '@rf/sdk-web/custom-form/style.css'` from its island: the module renders REAL DOM field controls into the host document (unlike the IDV iframe), so its CSS must be injected into the host page. The workspace map points at the SOURCE css so verify's Vite processes + injects it WITHOUT a prior sdk-web dist build (dev-friendly); the publishConfig override points at the extracted `dist/custom-form.css` for CDN customers (who `<link>` it, like `capture-ui.css`). ONE stylesheet, single-sourced in `src/custom-form/custom-form.css`, theme-aware via `@rf/theme` tokens.",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./idv": {
+      "types": "./dist/idv.d.ts",
+      "import": "./dist/idv.js"
+    },
+    "./fraud": {
+      "types": "./dist/fraud.d.ts",
+      "import": "./dist/fraud.js"
+    },
+    "./custom-form": {
+      "types": "./dist/custom-form.d.ts",
+      "import": "./dist/custom-form.js"
+    },
+    "./custom-form/style.css": "./dist/custom-form.css",
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js"
+    },
+    "./capture": {
+      "types": "./dist/capture.d.ts",
+      "import": "./dist/capture.js"
+    },
+    "./capture-ui": {
+      "types": "./dist/capture-ui.d.ts",
+      "import": "./dist/capture-ui.js"
+    },
+    "./cross-device": {
+      "types": "./dist/cross-device.d.ts",
+      "import": "./dist/cross-device.js"
+    },
+    "./idv/cross-device": {
+      "types": "./dist/idv/cross-device.d.ts",
+      "import": "./dist/idv/cross-device.js"
+    },
+    "./agents": "./dist/agents/manifest.json",
+    "./package.json": "./package.json"
+  },
+  "//sideEffectsNote": "The module-load seam (src/substrate/module-registry.ts) makes the `./idv`, `./fraud`, and `./custom-form` entries SIDE-EFFECTFUL: each calls registerModule(...) at import-eval time so the substrate's mount('idv'|'fraud'|'custom_form')/mountProvisioned can resolve it. A blanket `sideEffects: false` would let a consumer's bundler tree-shake those registrations away (breaking the seam), so this lists ONLY the module entry files (src + published dist forms). Everything else still tree-shakes, so the `.` and `./react` entries stay Zod-free and per-subpath tree-shaking holds. When plan-C rewrites this manifest, KEEP this array (do NOT replace it with `false`).",
+  "sideEffects": [
+    "./src/idv/index.ts",
+    "./src/fraud/index.ts",
+    "./src/custom-form/index.ts",
+    "./src/cdn.ts",
+    "./dist/idv.js",
+    "./dist/fraud.js",
+    "./dist/custom-form.js",
+    "*.css"
+  ],
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "qrcode-generator": "2.0.4"
+  },
+  "peerDependencies": {
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.0",
+    "@aws-amplify/core": "6.16.4",
+    "@aws-amplify/ui-react": "6.15.4",
+    "@aws-amplify/ui-react-liveness": "3.6.7",
+    "@fingerprint/agent": "4.1.0",
+    "@microblink/capture": "^1.2.3",
+    "@tensorflow/tfjs-backend-wasm": "4.11.0",
+    "@tensorflow/tfjs-converter": "4.11.0",
+    "@tensorflow/tfjs-core": "4.11.0",
+    "@types/node": "^25.9.3",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "aws-amplify": "6.18.0",
+    "esbuild": "^0.28.1",
+    "jsdom": "^29.1.1",
+    "preact": "^10.29.2",
+    "publint": "^0.3.0",
+    "tsup": "^8.5.0",
+    "typescript": "5.9.3",
+    "vitest": "^4.1.9",
+    "@rf/config": "0.0.0",
+    "@rf/schemas": "0.1.0",
+    "@rf/theme": "0.1.0",
+    "@rf/iam-core": "0.0.1"
+  },
+  "scripts": {
+    "build": "tsup && node scripts/generate-agent-steering.mjs && pnpm run build:embed-capture && pnpm run build:host-capture && pnpm run build:cross-device",
+    "build:embed-capture": "node scripts/build-embed-capture.mjs",
+    "build:host-capture": "node scripts/build-host-capture.mjs",
+    "build:cross-device": "node scripts/build-cross-device.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "echo 'lint via tsc'",
+    "size": "node ../../scripts/audit-bundle-size.mjs ../../services/sdk-cdn/public/v1/sdk.js 106496",
+    "//sizeNote:host-capture": "MIRROR of the canonical gate scripts/audit-bundle-sizes.mjs (run by `pnpm audit:bundle-sizes` in the pre-push battery) - keep the limits in sync. Both host bundles rose one KiB to the next clean ceiling (capture.js 79->80, capture-ui.js 85->86) for the IDV branch: the new capture:biometric_camera_live wire-schema member is validated by safeParse in BOTH bundles (the controller ships in both) - an irreducible shared @rf/schemas/sdk contract - plus the controller's onBeforeSubmit SOC 2 fraud-flush hook (capture.js) and the biometric loading skeleton + MountCopy copy-seam + submit_pending render (capture-ui.js). The controller dispatch is already gzip-optimal (restructuring measurably worsens gzip).",
+    "size:host-capture": "node ../../scripts/audit-bundle-size.mjs ../../services/sdk-cdn/public/v1/capture.js 82944",
+    "size:host-capture-ui": "node ../../scripts/audit-bundle-size.mjs ../../services/sdk-cdn/public/v1/capture-ui.js 89088",
+    "//sizeNote:cross-device": "MIRROR of the canonical gate scripts/audit-bundle-sizes.mjs cross-device line. The cross-device chunk is hash-named by esbuild; this script globs for the current artifact. The limit (20 KiB = 20480 B) is a headroom-padded ceiling over the qrcode-generator + Preact fragment weight at gzip.",
+    "size:cross-device": "node ../../scripts/audit-bundle-size.mjs ../../services/sdk-cdn/public/v1/cross-device.js 20480",
+    "size:npm": "node ../../scripts/audit-sdk-entry-size.mjs",
+    "validate:publint": "publint --strict",
+    "validate:attw": "node ../../scripts/validate-sdk-attw.mjs",
+    "validate:tarball": "node ../../scripts/audit-sdk-publish-boundary.mjs"
+  }
+}