@corbado/observe 0.15.1 → 0.16.0

package/dist/index.d.ts

@@ -3,8 +3,10 @@ interface SdkInfo {
     version: string;
 }
 type EventType = "predefined" | "custom" | "error" | "identify";
-type AuthMethodType = "identifier-email" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "reset-flow" | "provide-data";
-type SubflowType = "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
+type AuthMethodType = "identifier-email"
+/** Neutral "enter an identifier" choice; the identifier kind is the provide-identifier spec type. */
+ | "identifier" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "reset-flow" | "provide-data";
+type SubflowType = "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
 type FlowType = "login" | "signup" | "recovery" | "enrollment" | (string & {});
 type SocialLoginProviderType = "google" | "apple" | "facebook" | "github" | "microsoft" | "other";
 declare enum AuthEventName {
@@ -517,6 +519,98 @@ interface LowEventSink {
     };
 }
 
+/**
+ * Limits for optional raw-error serialization. Modeled on Sentry's client options
+ * (`normalizeDepth`, `normalizeMaxBreadth`, `maxValueLength`, `normalizeToSize`, the
+ * stack-frame limit and the linked-errors limit) with defaults tuned for an authentication
+ * event stream rather than an error monitor. Every value is clamped to {@link RAW_ERROR_BOUNDS};
+ * invalid values fall back to the default.
+ */
+type SerializeRawErrorOptions = {
+    /** Include `stack` strings. Default false. */
+    stack?: boolean;
+    /** Stack lines kept after the header line when `stack` is on. Default 50 (Sentry: 50). */
+    maxStackFrames?: number;
+    /** Object nesting depth below the envelope. Default 3 (Sentry `normalizeDepth`: 3). */
+    depth?: number;
+    /** Keys per object and items per array, Map or Set. Default 30 (Sentry `normalizeMaxBreadth`: 1000). */
+    maxBreadth?: number;
+    /** Characters kept per string. Default 1024 (Sentry `maxValueLength`: 250). */
+    maxValueLength?: number;
+    /** `cause` hops followed. Default 3 (Sentry linked errors: 5, Datadog: 10). */
+    maxCauseDepth?: number;
+    /** Maximum UTF-8 JSON size in bytes. Depth is reduced until the output fits; omit diagnostics that cannot fit. Default 32768 (Sentry `normalizeToSize`: 100 KiB). */
+    maxBytes?: number;
+};
+/** Envelope produced by {@link serializeRawError}. */
+type RawErrorEnvelope = {
+    /** Class tag of the original value: `DOMException`, `Error`, `Object`, `Response`, `number`, `null`, `unserializable`, … */
+    type: string;
+    /** Bounded plain-JSON copy of the value; absent when it could not be serialized within the limits. */
+    value?: unknown;
+    /** Set when even the shallowest serialization exceeded `maxBytes`. */
+    truncated?: true;
+};
+type Limits = Required<Omit<SerializeRawErrorOptions, "stack">> & {
+    stack: boolean;
+};
+/** Inclusive bounds for every numeric limit; defaults sit inside them. */
+declare const RAW_ERROR_BOUNDS: {
+    readonly maxStackFrames: {
+        readonly min: 1;
+        readonly max: 100;
+        readonly default: 50;
+    };
+    readonly depth: {
+        readonly min: 0;
+        readonly max: 10;
+        readonly default: 3;
+    };
+    readonly maxBreadth: {
+        readonly min: 1;
+        readonly max: 1000;
+        readonly default: 30;
+    };
+    readonly maxValueLength: {
+        readonly min: 1;
+        readonly max: 10000;
+        readonly default: 1024;
+    };
+    readonly maxCauseDepth: {
+        readonly min: 0;
+        readonly max: 10;
+        readonly default: 3;
+    };
+    readonly maxBytes: {
+        readonly min: 0;
+        readonly max: 65536;
+        readonly default: 32768;
+    };
+};
+/** Resolve caller options into clamped limits. Exported for tests and integrations that want to inspect the effective values. */
+declare function resolveRawErrorLimits(options?: SerializeRawErrorOptions): Limits;
+/**
+ * Serialize an arbitrary thrown value for the `rawError` diagnostic field.
+ *
+ * Copies standard error fields and serializable own properties within the configured limits.
+ * Standard fields are read through the prototype chain so DOMException and cross-realm errors
+ * serialize. Output is plain JSON, bounded in depth, breadth, string length, cause chain and
+ * UTF-8 size, and never throws.
+ *
+ * The result is an envelope `{ type, value }`: `type` is the value's class tag (`DOMException`,
+ * `Error`, `Object`, `number`, …) and `value` is a bounded diagnostic copy. Keeping the class tag
+ * outside value preserves the library's own `type` field. When the value cannot be serialized
+ * within the limits the envelope carries `truncated: true` or the type `unserializable` and no
+ * `value`.
+ *
+ * Stacks are omitted unless `stack: true`; they carry page URLs and add the most bytes.
+ * Binary data (ArrayBuffer, typed arrays) is reported by type and length only, never by content.
+ *
+ * @param value - Original thrown value or an explicit diagnostic projection.
+ * @param options - Limits; see {@link SerializeRawErrorOptions} for defaults and {@link RAW_ERROR_BOUNDS} for clamping.
+ */
+declare function serializeRawError(value: unknown, options?: SerializeRawErrorOptions): RawErrorEnvelope | undefined;
+
 /** Ceremony context lease on the shared observer. Never installs its own window listeners. */
 declare class LowEventWindowTracker {
     private logger;
@@ -535,12 +629,56 @@ declare class LowEventWindowTracker {
  * picker dismiss animations land shortly after the WebAuthn promise resolves/rejects.
  */
 declare const CEREMONY_LOW_EVENT_TAIL_MS = 1500;
+/**
+ * Optional diagnostic context for both normal and typed step errors.
+ *
+ * Use `rawError` when a library error contains useful context beyond its classified name,
+ * code and message, such as a nested cause, an error array or a response status.
+ * It is emitted as a bounded `{ type, value }` envelope in `stepData.rawError` for raw-event
+ * inspection. The envelope type describes the JavaScript value; the library's own fields
+ * stay inside value. See {@link serializeRawError} for serialization limits.
+ *
+ * @remarks
+ * The first argument to `.error()` or `.errorTyped()` supplies the classified diagnostic.
+ * `rawError` does not fill missing classified fields or affect outcomes, error-group assignment
+ * or severity: a code-only typed error remains code-only even if its raw diagnostic has a name
+ * and message. Existing StepOptions such as userReference and explicitTimestamp can accompany
+ * rawError; calls without it behave as before.
+ *
+ * Supply a deliberate diagnostic object without credentials, cookies or personal data.
+ * Arrays retain their structure in rawError; arrays passed directly to `.error()` become a
+ * string message. Keep the original error for application handling; serialization makes a copy.
+ *
+ * @example
+ * ```ts
+ * // Normal error with additional provider context.
+ * passkey.ceremony.error(originalError, { rawError: providerDiagnostic });
+ *
+ * // Typed error with the original error available for inspection.
+ * password.postResponse.errorTyped(
+ *   { code: "invalid_password" },
+ *   { rawError: originalError },
+ * );
+ *
+ * // A classified code and message plus additional raw context.
+ * password.postResponse.error(
+ *   { code: "invalid_password", name: "AuthenticationError", message: "The password was rejected" },
+ *   { rawError: providerDiagnostic },
+ * );
+ * ```
+ */
+type ErrorStepOptions = StepOptions & {
+    /** Explicit opt-in. Serialized with bounded depth and UTF-8 size; stacks are omitted by default and binary contents are summarized. */
+    rawError?: unknown;
+    /** Per-call limits for `rawError` serialization (depth, breadth, string length, cause chain, bytes, stack). See {@link SerializeRawErrorOptions}. */
+    rawErrorLimits?: SerializeRawErrorOptions;
+};
 type StepHelper<TStart = {}, TFinished = {}, TTypedError = never> = {
     start: (data: TStart, options?: StepOptions) => void;
     finished: (data: TFinished, options?: StepOptions) => void;
-    error: (error: unknown, options?: StepOptions) => void;
+    error: (error: unknown, options?: ErrorStepOptions) => void;
 } & ([TTypedError] extends [never] ? {} : {
-    errorTyped: (error: TTypedError, options?: StepOptions) => void;
+    errorTyped: (error: TTypedError, options?: ErrorStepOptions) => void;
 });
 declare abstract class OperationFull {
     private tracker;
@@ -577,7 +715,7 @@ declare abstract class OperationFull {
     customStep<TStart = {}, TFinished = {}>(stepName: string): StepHelper<TStart, TFinished>;
     protected subflowStepStarted(stepName: string, data: any, options?: StepOptions, ignoreAsInteraction?: boolean): void;
     protected subflowStepFinished(stepName: string, data: any, options?: StepOptions): void;
-    protected subflowStepError(stepName: string, data: any, options?: StepOptions): void;
+    protected subflowStepError(stepName: string, data: any, options?: ErrorStepOptions): void;
     /**
      * Decorate a (ceremony) step so window low-event collection follows its lifecycle: `start` arms
      * the tracker, `finished`/`error`/`errorTyped` schedule disarming after
@@ -769,7 +907,7 @@ declare class PasskeyEnrollmentOperationFull extends OperationFull {
 type PasswordLoginTypedError = {
     code: PasswordLoginTypedErrorCode;
 };
-type PasswordLoginTypedErrorCode = "invalid_password" | "user_not_found" | "account_locked";
+type PasswordLoginTypedErrorCode = "invalid_identifier_or_password" | "invalid_password" | "user_not_found" | "account_locked";
 /**
  * Conditional-UI (CUI) passkey login hosted on the password-login subflow. Mirrors the CUI step
  * family of `OperationFullProvideIdentifierWithCUI`, but the steps are emitted under
@@ -848,7 +986,7 @@ type PasskeyLoginCUITypedError = {
     code: PasskeyLoginCUITypedErrorCode;
 };
 type PasskeyLoginCUITypedErrorCode = "cancel_detected";
-type ProvideIdentifierSpecType = "email" | "phone";
+type ProvideIdentifierSpecType = "email" | "phone" | "username";
 type ProvideIdentifierPostResponseStart = {
     explicitSpecType?: ProvideIdentifierSpecType;
 };
@@ -947,6 +1085,60 @@ declare class CaptchaOperationFull extends OperationFull {
     constructor(tracker: CorbadoTracker, config?: CaptchaOperationConfig);
 }
 
+type TrustedDevicePurpose = "additional-verification" | "mfa-exemption";
+type TrustedDeviceStorage = "cookie" | "indexeddb" | "localstore" | "sessionstore";
+/** Metadata about the accepted binding. Never report cookie values, proofs or key material. */
+type TrustedDeviceBindingMetadata = {
+    storage?: TrustedDeviceStorage;
+    /** Stable pseudonymous reference to the binding, max 255 characters. */
+    bindingReference?: string;
+    /** Optional name for the trust mechanism, max 128 characters. */
+    trustName?: string;
+};
+/**
+ * Identity of the operation. Only `explicitSpecType` is sent on subflow_started, as for every other
+ * subflow; `purpose`, `storage` and `trustName` are repeated by the helper on every step start
+ * and on finished results, so they survive early completion, errors or abandonment.
+ */
+type TrustedDeviceOperationConfig = {
+    explicitSpecType: "token" | "key";
+    purpose: TrustedDevicePurpose;
+    storage: TrustedDeviceStorage;
+    trustName?: string;
+};
+type TrustedDeviceCheckConfig = TrustedDeviceOperationConfig;
+type TrustedDeviceNegativeResult = "not-trusted" | "no-eligible-local-key" | "server-key-no-local-match";
+type TrustedDeviceCheckResult = TrustedDeviceBindingMetadata & {
+    result: "trusted" | TrustedDeviceNegativeResult;
+};
+/** Expected negative results can settle discovery without a server verification step. */
+type TrustedDeviceCheckStepResult = {
+    result?: TrustedDeviceNegativeResult;
+};
+/** Keeps the original diagnostic while reporting a typed negative check code. */
+type TrustedDeviceCheckTypedError = {
+    code: "not_trusted" | "no_eligible_local_key" | "server_key_no_local_match";
+    error?: unknown;
+};
+type TrustedDeviceEnrollmentResult = TrustedDeviceBindingMetadata & {
+    result: "created" | "renewed" | "unchanged" | "skipped";
+};
+/** Records a host trust verdict. Discovery or signing alone is not a successful check. */
+declare class TrustedDeviceCheckOperationFull extends OperationFull {
+    readonly getOptions: StepHelper<{}, TrustedDeviceCheckStepResult, TrustedDeviceCheckTypedError>;
+    readonly ceremony: StepHelper<{}, TrustedDeviceCheckStepResult, TrustedDeviceCheckTypedError>;
+    readonly postResponse: StepHelper<{}, TrustedDeviceCheckResult, TrustedDeviceCheckTypedError>;
+    constructor(tracker: CorbadoTracker, config: TrustedDeviceCheckConfig);
+    private checkStep;
+}
+/** Finish registration/renewal after host acceptance. Explicit user opt-out reports skipped without creating a binding. */
+declare class TrustedDeviceEnrollmentOperationFull extends OperationFull {
+    readonly getOptions: StepHelper<{}, {}>;
+    readonly ceremony: StepHelper<{}, {}>;
+    readonly postResponse: StepHelper<{}, TrustedDeviceEnrollmentResult>;
+    constructor(tracker: CorbadoTracker, config: TrustedDeviceOperationConfig);
+}
+
 type ProvideDataOperationSpecType = "signup" | "login" | "recovery" | "enrollment";
 type ProvideDataOperationStart = {
     /** Stable name of the data field collected by this subflow, when known. */
@@ -1051,6 +1243,7 @@ declare class CorbadoTracker {
     private handleConfig;
     /**
      * Returns the logger used by this tracker.
+     * @internal
      */
     getLogger(): Logger;
     private applicationTag;
@@ -1158,13 +1351,19 @@ declare class CorbadoTracker {
      * sessionStorage-backed and stable for the whole page lifetime.
      */
     private resolveEventTabId;
+    /** @internal */
     trackSubflowStarted(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions, eventId?: string): void;
+    /** @internal */
     trackSubflowTrigger(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions): void;
+    /** @internal */
     trackSubflowStepStarted(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions, ignoreAsInteraction?: boolean): void;
+    /** @internal */
     trackSubflowStepFinished(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions): void;
+    /** @internal */
     trackSubflowStepError(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions): void;
     /**
      * @remarks
+     * @internal
      * Records an additional error occurrence against the subflow. Carries no outcome semantics —
      * step errors are the intended channel; not part of a normal integration.
      */
@@ -1431,6 +1630,47 @@ declare class CorbadoTracker {
     socialLoginOperationFull(config?: SocialLoginOperationConfig): SocialLoginOperationFull;
     appConfirmationOperationFull(config?: AppConfirmationOperationConfig): AppConfirmationOperationFull;
     captchaOperationFull(config?: CaptchaOperationConfig): CaptchaOperationFull;
+    /**
+     * Track a device-trust check through getOptions, ceremony and postResponse.
+     *
+     * @param config - Mechanism, purpose, storage and optional trust name.
+     * @remarks
+     * Only `trusted` completes the check. Negative results (`not-trusted`, `no-eligible-local-key`,
+     * `server-key-no-local-match`) remain incomplete and may settle an early step. Key-specific
+     * results require a key mechanism; the server-specific result requires explicit evidence.
+     * Use `errorTyped({ code, error })` to retain an original diagnostic with a negative result,
+     * or `error(error)` for an unexpected failure. An accepted result may include a stable
+     * pseudonymous `bindingReference`; never send cookie values, proofs or key material.
+     * @example
+     * ```ts
+     * const check = tracker.trustedDeviceCheckOperationFull({
+     *   explicitSpecType: "key", storage: "indexeddb", purpose: "additional-verification",
+     * });
+     * check.ceremony.start({});
+     * // On a recognized local-key failure:
+     * check.ceremony.errorTyped({ code: "no_eligible_local_key", error: originalError });
+     * ```
+     */
+    trustedDeviceCheckOperationFull(config: TrustedDeviceCheckConfig): TrustedDeviceCheckOperationFull;
+    /**
+     * Track device-trust enrollment through getOptions, ceremony and postResponse.
+     *
+     * @param config - Mechanism, purpose, storage and optional trust name.
+     * @remarks
+     * Report `created`, `renewed` or `unchanged` after host acceptance. Explicit opt-out is `skipped`;
+     * an unanswered operation remains incomplete. User identity uses the existing `setUser` API.
+     * Missing or unsupported purpose/storage logs a warning and is omitted; the operation remains usable.
+     * @example
+     * ```ts
+     * const enrollment = tracker.trustedDeviceEnrollmentOperationFull({
+     *   explicitSpecType: "token", storage: "cookie", purpose: "mfa-exemption",
+     * });
+     * enrollment.postResponse.start({});
+     * // After the host grants browser trust:
+     * enrollment.postResponse.finished({ result: "created", bindingReference });
+     * ```
+     */
+    trustedDeviceEnrollmentOperationFull(config: TrustedDeviceOperationConfig): TrustedDeviceEnrollmentOperationFull;
     /**
      * Flush any pending events and release all resources (timers, event listeners).
      *
@@ -1963,6 +2203,15 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
+/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
+declare function sanitizeCreationOptions(value: unknown): string | undefined;
+/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
+declare function sanitizeCreationResponse(value: unknown): string | undefined;
+/** Serializes publicKey authentication options. No fields are currently blacklisted. */
+declare function sanitizeRequestOptions(value: unknown): string | undefined;
+/** Sanitizes an authentication credential; removes its login signature and PRF results. */
+declare function sanitizeAssertionResponse(value: unknown): string | undefined;
+
 /**
  * Create a tracker and make it the default for all package-level helpers.
  * Each call replaces the default. For multiple projects, retain the returned instances and call
@@ -1993,4 +2242,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveReliabilityConfig, setExperiment, setExperiments, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setUser, telemetry };