@corbado/observe 0.16.0 → 0.16.2

package/dist/index.d.mts

@@ -1049,7 +1049,8 @@ declare class SocialLoginOperationFull extends OperationFull {
     constructor(tracker: CorbadoTracker, config?: SocialLoginOperationConfig);
 }
 
-type AppConfirmationOperationSpecType = "qr-code";
+/** How the confirmation is reached: a QR handoff or an app on the browser's device. */
+type AppConfirmationOperationSpecType = "qr-code" | "same-device";
 type AppConfirmationOperationStart = {
     explicitSpecType?: AppConfirmationOperationSpecType;
 };
@@ -1064,6 +1065,7 @@ type AppConfirmationOperationConfig = {
 declare class AppConfirmationOperationFull extends OperationFull {
     readonly ceremony: StepHelper<{}, {}, AppConfirmationOperationCeremonyTypedError>;
     readonly retry: StepHelper;
+    /** Optional separate browser exchange after approval; omit when the final poll already proves acceptance. */
     readonly postResponse: StepHelper;
     constructor(tracker: CorbadoTracker, config?: AppConfirmationOperationConfig);
 }
@@ -2203,13 +2205,46 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
-/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
+/**
+ * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
+ * Binary values become base64url strings. Other fields remain, including user IDs and challenges.
+ *
+ * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
+ * @example
+ * ```ts
+ * import { sanitizeCreationOptions } from "@corbado/observe";
+ * const optionsJson = sanitizeCreationOptions({ user: { id: "user-id", name: "private" } });
+ * ```
+ */
 declare function sanitizeCreationOptions(value: unknown): string | undefined;
-/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
+/**
+ * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
+ * Other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ *
+ * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
+ */
 declare function sanitizeCreationResponse(value: unknown): string | undefined;
-/** Serializes publicKey authentication options. No fields are currently blacklisted. */
+/**
+ * Serializes WebAuthn authentication options. No fields are currently blacklisted;
+ * challenges, credential IDs, and extension inputs remain. Binary values become base64url strings.
+ *
+ * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input or call toJSON. No tracker initialization is required.
+ */
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
-/** Sanitizes an authentication credential; removes its login signature and PRF results. */
+/**
+ * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
+ * Other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ *
+ * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
+ */
 declare function sanitizeAssertionResponse(value: unknown): string | undefined;
 
 /**

package/dist/index.d.ts

@@ -1049,7 +1049,8 @@ declare class SocialLoginOperationFull extends OperationFull {
     constructor(tracker: CorbadoTracker, config?: SocialLoginOperationConfig);
 }
 
-type AppConfirmationOperationSpecType = "qr-code";
+/** How the confirmation is reached: a QR handoff or an app on the browser's device. */
+type AppConfirmationOperationSpecType = "qr-code" | "same-device";
 type AppConfirmationOperationStart = {
     explicitSpecType?: AppConfirmationOperationSpecType;
 };
@@ -1064,6 +1065,7 @@ type AppConfirmationOperationConfig = {
 declare class AppConfirmationOperationFull extends OperationFull {
     readonly ceremony: StepHelper<{}, {}, AppConfirmationOperationCeremonyTypedError>;
     readonly retry: StepHelper;
+    /** Optional separate browser exchange after approval; omit when the final poll already proves acceptance. */
     readonly postResponse: StepHelper;
     constructor(tracker: CorbadoTracker, config?: AppConfirmationOperationConfig);
 }
@@ -2203,13 +2205,46 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
-/** Sanitizes publicKey creation options (native values, JSON object, or JSON string). */
+/**
+ * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
+ * Binary values become base64url strings. Other fields remain, including user IDs and challenges.
+ *
+ * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
+ * @example
+ * ```ts
+ * import { sanitizeCreationOptions } from "@corbado/observe";
+ * const optionsJson = sanitizeCreationOptions({ user: { id: "user-id", name: "private" } });
+ * ```
+ */
 declare function sanitizeCreationOptions(value: unknown): string | undefined;
-/** Sanitizes a registration credential; keeps attestation material but removes PRF results. */
+/**
+ * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
+ * Other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ *
+ * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
+ */
 declare function sanitizeCreationResponse(value: unknown): string | undefined;
-/** Serializes publicKey authentication options. No fields are currently blacklisted. */
+/**
+ * Serializes WebAuthn authentication options. No fields are currently blacklisted;
+ * challenges, credential IDs, and extension inputs remain. Binary values become base64url strings.
+ *
+ * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input or call toJSON. No tracker initialization is required.
+ */
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
-/** Sanitizes an authentication credential; removes its login signature and PRF results. */
+/**
+ * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
+ * Other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ *
+ * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
+ * @returns JSON text, or undefined for malformed or unserializable input.
+ * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
+ */
 declare function sanitizeAssertionResponse(value: unknown): string | undefined;
 
 /**