@corbado/observe 0.15.0 → 0.15.2

package/dist/index.d.ts

@@ -3,8 +3,10 @@ interface SdkInfo {
     version: string;
 }
 type EventType = "predefined" | "custom" | "error" | "identify";
-type AuthMethodType = "identifier-email" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "reset-flow" | "provide-data";
-type SubflowType = "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
+type AuthMethodType = "identifier-email"
+/** Neutral "enter an identifier" choice; the identifier kind is the provide-identifier spec type. */
+ | "identifier" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "reset-flow" | "provide-data";
+type SubflowType = "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
 type FlowType = "login" | "signup" | "recovery" | "enrollment" | (string & {});
 type SocialLoginProviderType = "google" | "apple" | "facebook" | "github" | "microsoft" | "other";
 declare enum AuthEventName {
@@ -148,7 +150,7 @@ type AuthDecisionFinished = {
     explicitDecisionValue?: string;
 };
 type StepOptions = {
-    /** Semantic control that explicitly initiated this step; omitted when unknown. */
+    /** Optional initiator override. Passkey ceremonies infer it from the operation/step spec when omitted. */
     initiator?: LowEventInitiator;
     /** @internal Session captured with the operation start; never sent as event metadata. */
     captureSessionId?: string;
@@ -343,32 +345,24 @@ type ObserveSdkConfigSnapshot = {
     readonly aap: string;
 };
 /**
- * SDK reliability configuration returned by the events endpoint (opt-in via the
- * `X-Corbado-Observe-Config` header). Mirrors the server `observeEventCreateRes` schema.
- * All delivery-reliability features default OFF until the server returns config.
- *
- * @remarks
- * Boot-snapshot model: the config resolved at construction (from the localStorage cache) is the
- * config for the entire page load. A config received from the server during the load is only
- * cached for the NEXT load, never applied live — this keeps session identity, seq source and
- * outbox mode coherent within one load.
+ * Resolved browser SDK reliability policy. Init overrides take precedence over server policy and defaults.
+ * Session continuity and durable outbox can activate on any refresh and stay enabled for the rest of the document.
  */
 interface SdkReliabilityConfig {
     /**
-     * Content-derived version (hash) assigned by the server. Echoed in the config request header so
-     * the server can answer 204 when nothing changed, and stamped into every batch's
-     * `meta.configVersion`. Empty string for the built-in defaults (nothing cached yet).
+     * Content-derived version assigned by the server, or a non-empty identifier for injected config.
+     * Stamped into every batch's meta.configVersion. Empty when neither the server nor init overrides supply a version.
      */
     version: string;
     /** How often the SDK flushes its event queue, in milliseconds. */
     flushIntervalMs: number;
-    /** Persist queued events to a durable outbox so they survive reloads, redirects and context switches. */
+    /** Persist queued events across reloads, redirects and context switches. Can activate on any refresh; deactivation takes effect on the next initialization. */
     durableOutbox: boolean;
     /** Persist lows in a separate bounded outbox; defaults to disabled for older configs. */
     durableLowOutbox?: boolean;
     /** Use keepalive/sendBeacon transport for flushes triggered during page unload. */
     beaconKeepalive: boolean;
-    /** Maintain session continuity across reloads/tabs by persisting the session id in localStorage. */
+    /** Maintain session continuity across reloads/tabs. Can activate on any refresh; deactivation takes effect on the next initialization. */
     sessionContinuity: boolean;
     /**
      * Inactivity threshold for continuity sessions, in milliseconds. When more time than this has
@@ -402,8 +396,8 @@ interface SdkReliabilityConfig {
     tlf: boolean;
     /**
      * Master switch for the diagnostic telemetry stream. When true the SDK sends buffered telemetry
-     * entries piggybacked on normal event requests; when false it collects and sends nothing. Defaults
-     * to true (telemetry is on out of the box) and can be turned off server-side without a redeploy.
+     * entries piggybacked on normal event requests. When false it stops collection, but already buffered
+     * entries can still be sent. Defaults to true and can be turned off server-side without a redeploy.
      */
     telemetry: boolean;
     /**
@@ -446,6 +440,10 @@ interface SdkReliabilityConfig {
     /** Retry configuration for failed event flushes. */
     retry: SdkRetryConfig;
 }
+/** Optional init overrides; omitted fields (including nested retry fields) inherit server policy or defaults. */
+type SdkReliabilityConfigOverrides = Partial<Omit<SdkReliabilityConfig, "retry">> & {
+    retry?: Partial<SdkRetryConfig>;
+};
 
 /** Sink that escalates a diagnostic message to the telemetry stream. */
 type TelemetrySink = (level: TelemetryLevel, message: string) => void;
@@ -521,6 +519,98 @@ interface LowEventSink {
     };
 }
 
+/**
+ * Limits for optional raw-error serialization. Modeled on Sentry's client options
+ * (`normalizeDepth`, `normalizeMaxBreadth`, `maxValueLength`, `normalizeToSize`, the
+ * stack-frame limit and the linked-errors limit) with defaults tuned for an authentication
+ * event stream rather than an error monitor. Every value is clamped to {@link RAW_ERROR_BOUNDS};
+ * invalid values fall back to the default.
+ */
+type SerializeRawErrorOptions = {
+    /** Include `stack` strings. Default false. */
+    stack?: boolean;
+    /** Stack lines kept after the header line when `stack` is on. Default 50 (Sentry: 50). */
+    maxStackFrames?: number;
+    /** Object nesting depth below the envelope. Default 3 (Sentry `normalizeDepth`: 3). */
+    depth?: number;
+    /** Keys per object and items per array, Map or Set. Default 30 (Sentry `normalizeMaxBreadth`: 1000). */
+    maxBreadth?: number;
+    /** Characters kept per string. Default 1024 (Sentry `maxValueLength`: 250). */
+    maxValueLength?: number;
+    /** `cause` hops followed. Default 3 (Sentry linked errors: 5, Datadog: 10). */
+    maxCauseDepth?: number;
+    /** Maximum UTF-8 JSON size in bytes. Depth is reduced until the output fits; omit diagnostics that cannot fit. Default 32768 (Sentry `normalizeToSize`: 100 KiB). */
+    maxBytes?: number;
+};
+/** Envelope produced by {@link serializeRawError}. */
+type RawErrorEnvelope = {
+    /** Class tag of the original value: `DOMException`, `Error`, `Object`, `Response`, `number`, `null`, `unserializable`, … */
+    type: string;
+    /** Bounded plain-JSON copy of the value; absent when it could not be serialized within the limits. */
+    value?: unknown;
+    /** Set when even the shallowest serialization exceeded `maxBytes`. */
+    truncated?: true;
+};
+type Limits = Required<Omit<SerializeRawErrorOptions, "stack">> & {
+    stack: boolean;
+};
+/** Inclusive bounds for every numeric limit; defaults sit inside them. */
+declare const RAW_ERROR_BOUNDS: {
+    readonly maxStackFrames: {
+        readonly min: 1;
+        readonly max: 100;
+        readonly default: 50;
+    };
+    readonly depth: {
+        readonly min: 0;
+        readonly max: 10;
+        readonly default: 3;
+    };
+    readonly maxBreadth: {
+        readonly min: 1;
+        readonly max: 1000;
+        readonly default: 30;
+    };
+    readonly maxValueLength: {
+        readonly min: 1;
+        readonly max: 10000;
+        readonly default: 1024;
+    };
+    readonly maxCauseDepth: {
+        readonly min: 0;
+        readonly max: 10;
+        readonly default: 3;
+    };
+    readonly maxBytes: {
+        readonly min: 0;
+        readonly max: 65536;
+        readonly default: 32768;
+    };
+};
+/** Resolve caller options into clamped limits. Exported for tests and integrations that want to inspect the effective values. */
+declare function resolveRawErrorLimits(options?: SerializeRawErrorOptions): Limits;
+/**
+ * Serialize an arbitrary thrown value for the `rawError` diagnostic field.
+ *
+ * Copies standard error fields and serializable own properties within the configured limits.
+ * Standard fields are read through the prototype chain so DOMException and cross-realm errors
+ * serialize. Output is plain JSON, bounded in depth, breadth, string length, cause chain and
+ * UTF-8 size, and never throws.
+ *
+ * The result is an envelope `{ type, value }`: `type` is the value's class tag (`DOMException`,
+ * `Error`, `Object`, `number`, …) and `value` is a bounded diagnostic copy. Keeping the class tag
+ * outside value preserves the library's own `type` field. When the value cannot be serialized
+ * within the limits the envelope carries `truncated: true` or the type `unserializable` and no
+ * `value`.
+ *
+ * Stacks are omitted unless `stack: true`; they carry page URLs and add the most bytes.
+ * Binary data (ArrayBuffer, typed arrays) is reported by type and length only, never by content.
+ *
+ * @param value - Original thrown value or an explicit diagnostic projection.
+ * @param options - Limits; see {@link SerializeRawErrorOptions} for defaults and {@link RAW_ERROR_BOUNDS} for clamping.
+ */
+declare function serializeRawError(value: unknown, options?: SerializeRawErrorOptions): RawErrorEnvelope | undefined;
+
 /** Ceremony context lease on the shared observer. Never installs its own window listeners. */
 declare class LowEventWindowTracker {
     private logger;
@@ -539,12 +629,56 @@ declare class LowEventWindowTracker {
  * picker dismiss animations land shortly after the WebAuthn promise resolves/rejects.
  */
 declare const CEREMONY_LOW_EVENT_TAIL_MS = 1500;
+/**
+ * Optional diagnostic context for both normal and typed step errors.
+ *
+ * Use `rawError` when a library error contains useful context beyond its classified name,
+ * code and message, such as a nested cause, an error array or a response status.
+ * It is emitted as a bounded `{ type, value }` envelope in `stepData.rawError` for raw-event
+ * inspection. The envelope type describes the JavaScript value; the library's own fields
+ * stay inside value. See {@link serializeRawError} for serialization limits.
+ *
+ * @remarks
+ * The first argument to `.error()` or `.errorTyped()` supplies the classified diagnostic.
+ * `rawError` does not fill missing classified fields or affect outcomes, error-group assignment
+ * or severity: a code-only typed error remains code-only even if its raw diagnostic has a name
+ * and message. Existing StepOptions such as userReference and explicitTimestamp can accompany
+ * rawError; calls without it behave as before.
+ *
+ * Supply a deliberate diagnostic object without credentials, cookies or personal data.
+ * Arrays retain their structure in rawError; arrays passed directly to `.error()` become a
+ * string message. Keep the original error for application handling; serialization makes a copy.
+ *
+ * @example
+ * ```ts
+ * // Normal error with additional provider context.
+ * passkey.ceremony.error(originalError, { rawError: providerDiagnostic });
+ *
+ * // Typed error with the original error available for inspection.
+ * password.postResponse.errorTyped(
+ *   { code: "invalid_password" },
+ *   { rawError: originalError },
+ * );
+ *
+ * // A classified code and message plus additional raw context.
+ * password.postResponse.error(
+ *   { code: "invalid_password", name: "AuthenticationError", message: "The password was rejected" },
+ *   { rawError: providerDiagnostic },
+ * );
+ * ```
+ */
+type ErrorStepOptions = StepOptions & {
+    /** Explicit opt-in. Serialized with bounded depth and UTF-8 size; stacks are omitted by default and binary contents are summarized. */
+    rawError?: unknown;
+    /** Per-call limits for `rawError` serialization (depth, breadth, string length, cause chain, bytes, stack). See {@link SerializeRawErrorOptions}. */
+    rawErrorLimits?: SerializeRawErrorOptions;
+};
 type StepHelper<TStart = {}, TFinished = {}, TTypedError = never> = {
     start: (data: TStart, options?: StepOptions) => void;
     finished: (data: TFinished, options?: StepOptions) => void;
-    error: (error: unknown, options?: StepOptions) => void;
+    error: (error: unknown, options?: ErrorStepOptions) => void;
 } & ([TTypedError] extends [never] ? {} : {
-    errorTyped: (error: TTypedError, options?: StepOptions) => void;
+    errorTyped: (error: TTypedError, options?: ErrorStepOptions) => void;
 });
 declare abstract class OperationFull {
     private tracker;
@@ -581,7 +715,7 @@ declare abstract class OperationFull {
     customStep<TStart = {}, TFinished = {}>(stepName: string): StepHelper<TStart, TFinished>;
     protected subflowStepStarted(stepName: string, data: any, options?: StepOptions, ignoreAsInteraction?: boolean): void;
     protected subflowStepFinished(stepName: string, data: any, options?: StepOptions): void;
-    protected subflowStepError(stepName: string, data: any, options?: StepOptions): void;
+    protected subflowStepError(stepName: string, data: any, options?: ErrorStepOptions): void;
     /**
      * Decorate a (ceremony) step so window low-event collection follows its lifecycle: `start` arms
      * the tracker, `finished`/`error`/`errorTyped` schedule disarming after
@@ -773,7 +907,7 @@ declare class PasskeyEnrollmentOperationFull extends OperationFull {
 type PasswordLoginTypedError = {
     code: PasswordLoginTypedErrorCode;
 };
-type PasswordLoginTypedErrorCode = "invalid_password" | "user_not_found" | "account_locked";
+type PasswordLoginTypedErrorCode = "invalid_identifier_or_password" | "invalid_password" | "user_not_found" | "account_locked";
 /**
  * Conditional-UI (CUI) passkey login hosted on the password-login subflow. Mirrors the CUI step
  * family of `OperationFullProvideIdentifierWithCUI`, but the steps are emitted under
@@ -852,7 +986,7 @@ type PasskeyLoginCUITypedError = {
     code: PasskeyLoginCUITypedErrorCode;
 };
 type PasskeyLoginCUITypedErrorCode = "cancel_detected";
-type ProvideIdentifierSpecType = "email" | "phone";
+type ProvideIdentifierSpecType = "email" | "phone" | "username";
 type ProvideIdentifierPostResponseStart = {
     explicitSpecType?: ProvideIdentifierSpecType;
 };
@@ -951,6 +1085,60 @@ declare class CaptchaOperationFull extends OperationFull {
     constructor(tracker: CorbadoTracker, config?: CaptchaOperationConfig);
 }
 
+type TrustedDevicePurpose = "additional-verification" | "mfa-exemption";
+type TrustedDeviceStorage = "cookie" | "indexeddb" | "localstore" | "sessionstore";
+/** Metadata about the accepted binding. Never report cookie values, proofs or key material. */
+type TrustedDeviceBindingMetadata = {
+    storage?: TrustedDeviceStorage;
+    /** Stable pseudonymous reference to the binding, max 255 characters. */
+    bindingReference?: string;
+    /** Optional name for the trust mechanism, max 128 characters. */
+    trustName?: string;
+};
+/**
+ * Identity of the operation. Only `explicitSpecType` is sent on subflow_started, as for every other
+ * subflow; `purpose`, `storage` and `trustName` are repeated by the helper on every step start
+ * and on finished results, so they survive early completion, errors or abandonment.
+ */
+type TrustedDeviceOperationConfig = {
+    explicitSpecType: "token" | "key";
+    purpose: TrustedDevicePurpose;
+    storage: TrustedDeviceStorage;
+    trustName?: string;
+};
+type TrustedDeviceCheckConfig = TrustedDeviceOperationConfig;
+type TrustedDeviceNegativeResult = "not-trusted" | "no-eligible-local-key" | "server-key-no-local-match";
+type TrustedDeviceCheckResult = TrustedDeviceBindingMetadata & {
+    result: "trusted" | TrustedDeviceNegativeResult;
+};
+/** Expected negative results can settle discovery without a server verification step. */
+type TrustedDeviceCheckStepResult = {
+    result?: TrustedDeviceNegativeResult;
+};
+/** Keeps the original diagnostic while reporting a typed negative check code. */
+type TrustedDeviceCheckTypedError = {
+    code: "not_trusted" | "no_eligible_local_key" | "server_key_no_local_match";
+    error?: unknown;
+};
+type TrustedDeviceEnrollmentResult = TrustedDeviceBindingMetadata & {
+    result: "created" | "renewed" | "unchanged" | "skipped";
+};
+/** Records a host trust verdict. Discovery or signing alone is not a successful check. */
+declare class TrustedDeviceCheckOperationFull extends OperationFull {
+    readonly getOptions: StepHelper<{}, TrustedDeviceCheckStepResult, TrustedDeviceCheckTypedError>;
+    readonly ceremony: StepHelper<{}, TrustedDeviceCheckStepResult, TrustedDeviceCheckTypedError>;
+    readonly postResponse: StepHelper<{}, TrustedDeviceCheckResult, TrustedDeviceCheckTypedError>;
+    constructor(tracker: CorbadoTracker, config: TrustedDeviceCheckConfig);
+    private checkStep;
+}
+/** Finish registration/renewal after host acceptance. Explicit user opt-out reports skipped without creating a binding. */
+declare class TrustedDeviceEnrollmentOperationFull extends OperationFull {
+    readonly getOptions: StepHelper<{}, {}>;
+    readonly ceremony: StepHelper<{}, {}>;
+    readonly postResponse: StepHelper<{}, TrustedDeviceEnrollmentResult>;
+    constructor(tracker: CorbadoTracker, config: TrustedDeviceOperationConfig);
+}
+
 type ProvideDataOperationSpecType = "signup" | "login" | "recovery" | "enrollment";
 type ProvideDataOperationStart = {
     /** Stable name of the data field collected by this subflow, when known. */
@@ -979,6 +1167,10 @@ interface TrackerOptions {
     projectId: string;
     apiBaseUrl: string;
     apiEventPath?: string;
+    /** Per-field overrides over server config and defaults. A complete policy disables remote fetching. */
+    sdkConfig?: SdkReliabilityConfigOverrides;
+    /** Config endpoint override for integrations that proxy Observe under a different path. */
+    apiConfigPath?: string;
     storage?: "cookie" | "local";
     cookieDomain?: string;
     debug?: boolean;
@@ -1018,12 +1210,10 @@ declare class CorbadoTracker {
     private persistentStorage;
     /** Seq/continuity Web Lock name; project-scoped together with the storage keys it guards. */
     private readonly seqLockName;
-    /**
-     * Reliability config for this load. A boot with a cached server config is a snapshot (immutable
-     * mid-load); a boot on the built-in defaults upgrades once to the first server-returned config
-     * (see {@link handleConfig}).
-     */
+    /** Current resolved policy. Continuity and persistence stay enabled once activated within a document. */
     private config;
+    private readonly configManager?;
+    private readonly configOverrides;
     private deviceInfoManager;
     private deviceCollector;
     /**
@@ -1049,16 +1239,11 @@ declare class CorbadoTracker {
     /** @internal Shared passive page observation and per-operation context registration. */
     getWindowObserver(): SharedWindowObserver;
     constructor(options: TrackerOptions);
-    /**
-     * Cache fresh server config as last-known so the next page load boots with it. When this load
-     * booted on the built-in defaults (no cached config), the config is additionally applied live:
-     * every field is read at use time, and a mid-load `sessionContinuity` flip is safe because
-     * `nextSeq` adopts the in-memory session id into the empty continuity store instead of minting
-     * (no session split). A load that booted on a cached config keeps its snapshot untouched.
-     */
+    /** Apply init overrides on every refresh; continuity and persistence only activate within a document. */
     private handleConfig;
     /**
      * Returns the logger used by this tracker.
+     * @internal
      */
     getLogger(): Logger;
     private applicationTag;
@@ -1088,7 +1273,7 @@ declare class CorbadoTracker {
     /** Returns a copy of the currently active experiment assignments. */
     getExperiments(): Record<string, string>;
     /**
-     * Returns the public SDK configuration for this page load.
+     * Returns the currently active public SDK configuration, including live updates.
      *
      * @returns A frozen snapshot, created fresh on every call.
      */
@@ -1107,7 +1292,7 @@ declare class CorbadoTracker {
     /**
      * Resolve the session id from localStorage so it survives reloads and is shared across tabs of the
      * same browser. Rotates after `config.sessionInactivityMs` of inactivity (server-controlled,
-     * boot-snapshot like the rest of the config), resetting the seq counter.
+     * evaluated at boot), resetting the seq counter.
      *
      * Inactivity rotation happens at boot only, here and on the per-tab path {@link resolveSessionId}
      * takes without continuity. Boot is chosen on an assumption, not a guarantee: that a load
@@ -1136,12 +1321,11 @@ declare class CorbadoTracker {
      * Persist the per-tab record and remember when, sharing the throttle bookkeeping with the
      * continuity record — a load resolves its session on one path or the other, never both.
      *
-     * Only a load that received a server config stamps the window; any other carries forward what the
-     * tab already knows. So a defaults boot never downgrades a tab that has already learned the
-     * project's threshold to the built-in one, and the window survives a rotation within the tab.
+     * An explicit timeout override or server config stamps the window. Otherwise carry forward what
+     * the tab already knows, so a defaults boot does not replace a previously configured threshold.
      */
     private persistPerTabSession;
-    /** The window this tab measures against: what a configured load recorded, else this load's own. */
+    /** Explicit init timeout wins; otherwise retain the window a prior configured load recorded. */
     private perTabInactivityMs;
     /**
      * Return the next sequence number. With session continuity the counter is persisted so ordering
@@ -1167,13 +1351,19 @@ declare class CorbadoTracker {
      * sessionStorage-backed and stable for the whole page lifetime.
      */
     private resolveEventTabId;
+    /** @internal */
     trackSubflowStarted(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions, eventId?: string): void;
+    /** @internal */
     trackSubflowTrigger(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions): void;
+    /** @internal */
     trackSubflowStepStarted(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions, ignoreAsInteraction?: boolean): void;
+    /** @internal */
     trackSubflowStepFinished(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions): void;
+    /** @internal */
     trackSubflowStepError(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions): void;
     /**
      * @remarks
+     * @internal
      * Records an additional error occurrence against the subflow. Carries no outcome semantics —
      * step errors are the intended channel; not part of a normal integration.
      */
@@ -1440,6 +1630,47 @@ declare class CorbadoTracker {
     socialLoginOperationFull(config?: SocialLoginOperationConfig): SocialLoginOperationFull;
     appConfirmationOperationFull(config?: AppConfirmationOperationConfig): AppConfirmationOperationFull;
     captchaOperationFull(config?: CaptchaOperationConfig): CaptchaOperationFull;
+    /**
+     * Track a device-trust check through getOptions, ceremony and postResponse.
+     *
+     * @param config - Mechanism, purpose, storage and optional trust name.
+     * @remarks
+     * Only `trusted` completes the check. Negative results (`not-trusted`, `no-eligible-local-key`,
+     * `server-key-no-local-match`) remain incomplete and may settle an early step. Key-specific
+     * results require a key mechanism; the server-specific result requires explicit evidence.
+     * Use `errorTyped({ code, error })` to retain an original diagnostic with a negative result,
+     * or `error(error)` for an unexpected failure. An accepted result may include a stable
+     * pseudonymous `bindingReference`; never send cookie values, proofs or key material.
+     * @example
+     * ```ts
+     * const check = tracker.trustedDeviceCheckOperationFull({
+     *   explicitSpecType: "key", storage: "indexeddb", purpose: "additional-verification",
+     * });
+     * check.ceremony.start({});
+     * // On a recognized local-key failure:
+     * check.ceremony.errorTyped({ code: "no_eligible_local_key", error: originalError });
+     * ```
+     */
+    trustedDeviceCheckOperationFull(config: TrustedDeviceCheckConfig): TrustedDeviceCheckOperationFull;
+    /**
+     * Track device-trust enrollment through getOptions, ceremony and postResponse.
+     *
+     * @param config - Mechanism, purpose, storage and optional trust name.
+     * @remarks
+     * Report `created`, `renewed` or `unchanged` after host acceptance. Explicit opt-out is `skipped`;
+     * an unanswered operation remains incomplete. User identity uses the existing `setUser` API.
+     * Missing or unsupported purpose/storage logs a warning and is omitted; the operation remains usable.
+     * @example
+     * ```ts
+     * const enrollment = tracker.trustedDeviceEnrollmentOperationFull({
+     *   explicitSpecType: "token", storage: "cookie", purpose: "mfa-exemption",
+     * });
+     * enrollment.postResponse.start({});
+     * // After the host grants browser trust:
+     * enrollment.postResponse.finished({ result: "created", bindingReference });
+     * ```
+     */
+    trustedDeviceEnrollmentOperationFull(config: TrustedDeviceOperationConfig): TrustedDeviceEnrollmentOperationFull;
     /**
      * Flush any pending events and release all resources (timers, event listeners).
      *
@@ -1623,16 +1854,11 @@ interface QueueOptions {
      */
     flushInterval?: number;
     debug?: boolean;
-    /**
-     * Reliability config for this page load; defaults to all-features-OFF. Boot-snapshot model: with
-     * a cached config the queue never changes its behavior mid-load — a fresh config returned by the
-     * server is only handed to {@link QueueOptions.onConfigReceived} for caching and applies on the
-     * next load. Only a defaults boot (no cached config) applies the first server config live.
-     */
+    /** Initial delivery policy. The tracker applies later updates with updateConfig(). */
     config?: SdkReliabilityConfig;
     /** Called when the server returns a fresh config, so the client can cache it for the next load. */
     onConfigReceived?: (config: SdkReliabilityConfig) => void;
-    /** Whether to send the opt-in config header on the first flush of this load. Defaults to true. */
+    /** Legacy standalone queue handshake. Trackers set false and use the independent config manager. */
     requestConfig?: boolean;
     /**
      * Web Lock name for the durable outbox, scoped alongside the storage engine's keys (see
@@ -1692,11 +1918,7 @@ declare class RequestQueue {
     private readonly debug;
     private readonly requestConfig;
     private readonly onConfigReceived?;
-    /**
-     * Reliability config for this load. A boot with a cached server config is a snapshot that never
-     * changes mid-load; a boot on the built-in defaults upgrades once to the first server-returned
-     * config (see {@link handleConfigResponse}).
-     */
+    /** Current delivery policy, including live updates. */
     private config;
     /**
      * Flow types whose completion triggers an immediate flush at enqueue time
@@ -1729,7 +1951,7 @@ declare class RequestQueue {
      * Buffer a diagnostic telemetry entry for delivery with the next event batch.
      *
      * @remarks
-     * The master switch `config.telemetry` gates collection: when off, nothing is buffered or sent.
+     * The switch `config.telemetry` gates collection. Entries buffered while on remain eligible for delivery.
      * By default a telemetry entry does NOT arm the flush timer — it piggybacks the next flush caused
      * by events or a lifecycle signal (it is marked dirty so the unload flush picks it up). When
      * `config.flushOnTelemetry` is on it escalates to an immediate flush.
@@ -1787,13 +2009,8 @@ declare class RequestQueue {
      * reliability features.
      */
     private handleConfigResponse;
-    /**
-     * Switch this load from the built-in defaults to the first server config (defaults boot only).
-     * Most fields are read at use time, so replacing the reference is enough; only the derived state
-     * (priority flow type set, durable outbox store) needs rebuilding.
-     */
-    private applyConfigLive;
-    /** Returns true when the batch was acknowledged with a 2xx (safe to keep draining). */
+    /** Applies live delivery policy, retaining pending events, retry deadlines, and activated persistence. */
+    updateConfig(config: SdkReliabilityConfig): void;
     private handleSendResult;
     private isRetryable;
     /**
@@ -1833,7 +2050,7 @@ declare class RequestQueue {
     destroy(): void;
 }
 
-/** localStorage key under which the last-known server config is cached. */
+/** Last-known server config shared by batch-based and independently fetching SDK versions. */
 declare const CONFIG_STORAGE_KEY = "cbo_sdk_config";
 /**
  * Opt-in request header that asks the events endpoint to return the SDK reliability config. Its value
@@ -1888,11 +2105,9 @@ declare const CONFIG_BOUNDS: {
 /** Built-in continuity-session inactivity threshold (30 minutes); matches the historical default. */
 declare const DEFAULT_SESSION_INACTIVITY_MS: number;
 /**
- * Default config: every delivery-reliability feature is OFF. The SDK behaves like a plain async
- * fetch-keepalive flusher until the server returns config, which is cached as last-known for the
- * next load AND applied live to the current load (a defaults boot has no prior config to stay
- * coherent with; loads booting on a cached config keep their snapshot — boot-snapshot model). The
- * empty version means "nothing cached"; the config request header sends "1" in that case.
+ * Defaults used until a valid injected, cached, or fetched config is available.
+ * Delivery-reliability features start OFF. Last-known remote config never expires.
+ * Init overrides win per field; a complete override bypasses remote fetching and caching.
  */
 declare const DEFAULT_RELIABILITY_CONFIG: SdkReliabilityConfig;
 /**
@@ -1905,6 +2120,8 @@ declare const DEFAULT_RELIABILITY_CONFIG: SdkReliabilityConfig;
  * server value cannot harm the client.
  */
 declare function parseReliabilityConfig(raw: unknown): SdkReliabilityConfig | null;
+/** Resolve init overrides over validated server policy, then defaults, including individual retry fields. */
+declare function resolveReliabilityConfig(serverConfig: SdkReliabilityConfig | undefined, overrides?: SdkReliabilityConfigOverrides): SdkReliabilityConfig;
 /** Read the cached config from storage, or `null` if absent/invalid. */
 declare function loadCachedConfig(storage: StorageEngine): SdkReliabilityConfig | null;
 /** Persist the config as last-known so the next page load starts with these features enabled. */
@@ -2016,4 +2233,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkRetryConfig, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, setExperiment, setExperiments, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, serializeRawError, setExperiment, setExperiments, setUser, telemetry };