@corbado/observe 0.16.3 → 0.16.4

package/dist/index.d.mts

@@ -6,7 +6,7 @@ type EventType = "predefined" | "custom" | "error" | "identify";
 type AuthMethodType = "identifier-email"
 /** Neutral "enter an identifier" choice; the identifier kind is the provide-identifier spec type. */
  | "identifier" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "reset-flow" | "provide-data";
-type SubflowType = "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
+type SubflowType = "key-signing" | "key-registration" | "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
 type FlowType = "login" | "signup" | "recovery" | "enrollment" | (string & {});
 type SocialLoginProviderType = "google" | "apple" | "facebook" | "github" | "microsoft" | "other";
 declare enum AuthEventName {
@@ -449,63 +449,6 @@ type SdkReliabilityConfigOverrides = Partial<Omit<SdkReliabilityConfig, "retry">
     retry?: Partial<SdkRetryConfig>;
 };
 
-/** Sink that escalates a diagnostic message to the telemetry stream. */
-type TelemetrySink = (level: TelemetryLevel, message: string) => void;
-interface Logger {
-    debug(message: string, ...args: unknown[]): void;
-    info(message: string, ...args: unknown[]): void;
-    warn(message: string, ...args: unknown[]): void;
-    error(message: string, ...args: unknown[]): void;
-    critical(message: string, ...args: unknown[]): void;
-    /**
-     * Escalate a diagnostic message to the telemetry stream, if a sink is attached (no-op otherwise).
-     * Unlike the level methods, telemetry is delivered to the backend regardless of the `debug` flag.
-     * Optional so an integrator-provided custom logger stays valid without implementing it.
-     */
-    reportTelemetry?(level: TelemetryLevel, message: string): void;
-    /** Attach (or clear) the telemetry sink. Called once by the tracker after the queue exists. */
-    setTelemetrySink?(sink: TelemetrySink | undefined): void;
-}
-interface CreateLoggerOptions {
-    debug: boolean;
-}
-declare function createLogger(options: CreateLoggerOptions): Logger;
-
-type WindowCaptureContext = Pick<LowEvent, "subflowStartEventId" | "fieldRole" | "initiator"> & {
-    sessionId?: string;
-};
-/** One passive observer per tracker. Field/ceremony collectors register context, not DOM listeners. */
-declare class SharedWindowObserver {
-    private logger;
-    private enqueue;
-    private flushKeepalive;
-    private inputs;
-    private ceremonies;
-    private removers;
-    private lastBlur?;
-    private bracket?;
-    private unrelatedPointerAt;
-    private destroyed;
-    private viewportContext;
-    private resize;
-    private scroll;
-    constructor(logger: Logger, enqueue: (low: LowEvent, sessionId?: string) => void, flushKeepalive: () => void);
-    registerInputs(fields: readonly HTMLInputElement[], context: () => WindowCaptureContext, flush: () => void): () => void;
-    beginCeremony(context: WindowCaptureContext): {
-        settle: (tailMs: number) => void;
-        destroy: () => void;
-    };
-    private context;
-    private findInput;
-    /** Flush all registered input batches before a high-level lifecycle boundary. */
-    flushInputs(): void;
-    private emit;
-    private listen;
-    private extendViewport;
-    private observeNavigation;
-    destroy(): void;
-}
-
 /**
  * Where low events go. `flushKeepalive` is requested on `pagehide` teardown so lows batched after
  * the queue's own lifecycle flush still get out; operations wire it to the client's
@@ -616,6 +559,28 @@ declare function resolveRawErrorLimits(options?: SerializeRawErrorOptions): Limi
  */
 declare function serializeRawError(value: unknown, options?: SerializeRawErrorOptions): RawErrorEnvelope | undefined;
 
+/** Sink that escalates a diagnostic message to the telemetry stream. */
+type TelemetrySink = (level: TelemetryLevel, message: string) => void;
+interface Logger {
+    debug(message: string, ...args: unknown[]): void;
+    info(message: string, ...args: unknown[]): void;
+    warn(message: string, ...args: unknown[]): void;
+    error(message: string, ...args: unknown[]): void;
+    critical(message: string, ...args: unknown[]): void;
+    /**
+     * Escalate a diagnostic message to the telemetry stream, if a sink is attached (no-op otherwise).
+     * Unlike the level methods, telemetry is delivered to the backend regardless of the `debug` flag.
+     * Optional so an integrator-provided custom logger stays valid without implementing it.
+     */
+    reportTelemetry?(level: TelemetryLevel, message: string): void;
+    /** Attach (or clear) the telemetry sink. Called once by the tracker after the queue exists. */
+    setTelemetrySink?(sink: TelemetrySink | undefined): void;
+}
+interface CreateLoggerOptions {
+    debug: boolean;
+}
+declare function createLogger(options: CreateLoggerOptions): Logger;
+
 /** Ceremony context lease on the shared observer. Never installs its own window listeners. */
 declare class LowEventWindowTracker {
     private logger;
@@ -733,6 +698,61 @@ declare abstract class OperationFull {
     protected defineStep<TStart = {}, TFinished = {}, TTypedError = never>(stepName: string, ignoreAsInteractionOnStart?: boolean): StepHelper<TStart, TFinished, TTypedError>;
 }
 
+/** Shared configuration for direct key signing and authority registration. */
+type KeyOperationConfig = {
+    /** Reserved for future variants; no spec types are currently defined. */
+    explicitSpecType?: undefined;
+};
+declare class KeySigningOperationFull extends OperationFull {
+    /** Resolve an eligible key and prepare the input for an actual signing attempt. */
+    readonly prepare: StepHelper;
+    /** Sign and assemble the usable signed artifact. Does not include submitting it. */
+    readonly sign: StepHelper;
+    constructor(tracker: CorbadoTracker, config?: KeyOperationConfig);
+}
+declare class KeyRegistrationOperationFull extends OperationFull {
+    /** Build the request that will establish the key's authority. */
+    readonly prepare: StepHelper;
+    /** Submit and await acceptance: finish only when the key is authorized and usable. */
+    readonly postResponse: StepHelper;
+    constructor(tracker: CorbadoTracker, config?: KeyOperationConfig);
+}
+
+type WindowCaptureContext = Pick<LowEvent, "subflowStartEventId" | "fieldRole" | "initiator"> & {
+    sessionId?: string;
+};
+/** One passive observer per tracker. Field/ceremony collectors register context, not DOM listeners. */
+declare class SharedWindowObserver {
+    private logger;
+    private enqueue;
+    private flushKeepalive;
+    private inputs;
+    private ceremonies;
+    private removers;
+    private lastBlur?;
+    private bracket?;
+    private unrelatedPointerAt;
+    private destroyed;
+    private viewportContext;
+    private resize;
+    private scroll;
+    constructor(logger: Logger, enqueue: (low: LowEvent, sessionId?: string) => void, flushKeepalive: () => void);
+    registerInputs(fields: readonly HTMLInputElement[], context: () => WindowCaptureContext, flush: () => void): () => void;
+    beginCeremony(context: WindowCaptureContext): {
+        settle: (tailMs: number) => void;
+        destroy: () => void;
+    };
+    private context;
+    private findInput;
+    /** Flush all registered input batches before a high-level lifecycle boundary. */
+    flushInputs(): void;
+    private emit;
+    private listen;
+    private extendViewport;
+    private observeNavigation;
+    destroy(): void;
+}
+
 type PasskeyOperationLoginExplicitSpecType = "passkey-cui" | "passkey-known-identifier" | "passkey-no-identifier"
 /**
  * The `-auto` variants are the same two ceremonies started by the integration rather than by a
@@ -1638,6 +1658,52 @@ declare class CorbadoTracker {
     provideDataOperationFull(config?: ProvideDataOperationConfig): ProvideDataOperationFull;
     socialLoginOperationFull(config?: SocialLoginOperationConfig): SocialLoginOperationFull;
     appConfirmationOperationFull(config?: AppConfirmationOperationConfig): AppConfirmationOperationFull;
+    /**
+     * Track direct key signing outside WebAuthn through prepare and sign.
+     *
+     * @param config - Optional configuration; explicitSpecType may only be undefined for now.
+     * @remarks
+     * Start prepare when resolving the eligible key and input for an actual attempt, not background
+     * prefetch. Although system-driven, that work is meaningful interaction for classification.
+     * Construction alone does not establish interaction. Finish sign only when the usable signed
+     * artifact is ready, including assembly. Submission is outside this operation. Report failures
+     * on the affected step using error(error). Never include key material, signatures or proofs.
+     * WebAuthn assertions continue to use passkeyLoginFullOperation.
+     * @example
+     * ```ts
+     * const signing = tracker.keySigningOperationFull();
+     * signing.prepare.start({});
+     * // Resolve an eligible key and prepare the signing input.
+     * signing.prepare.finished({});
+     * signing.sign.start({});
+     * // Sign and assemble the artifact returned to the caller.
+     * signing.sign.finished({});
+     * ```
+     */
+    keySigningOperationFull(config?: KeyOperationConfig): KeySigningOperationFull;
+    /**
+     * Track establishing a key's authority through prepare and postResponse.
+     *
+     * @param config - Optional configuration; explicitSpecType may only be undefined for now.
+     * @remarks
+     * Start prepare when building an actual registration request, not background prefetch.
+     * This system-driven work is meaningful interaction; construction alone is not.
+     * postResponse covers submission and acceptance. Finish only when the key is authorized and
+     * usable, not merely when submission returns. Report rejection, transport, execution or timeout
+     * errors on the affected step using error(error). Never include key material or proofs.
+     * Credential creation and any authorizing WebAuthn assertion are separate operations.
+     * @example
+     * ```ts
+     * const registration = tracker.keyRegistrationOperationFull();
+     * registration.prepare.start({});
+     * // Build the registration request.
+     * registration.prepare.finished({});
+     * registration.postResponse.start({});
+     * // Submit and await evidence that the authority is usable.
+     * registration.postResponse.finished({});
+     * ```
+     */
+    keyRegistrationOperationFull(config?: KeyOperationConfig): KeyRegistrationOperationFull;
     captchaOperationFull(config?: CaptchaOperationConfig): CaptchaOperationFull;
     /**
      * Track a device-trust check through getOptions, ceremony and postResponse.
@@ -2284,4 +2350,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setUser, telemetry };

package/dist/index.d.ts

@@ -6,7 +6,7 @@ type EventType = "predefined" | "custom" | "error" | "identify";
 type AuthMethodType = "identifier-email"
 /** Neutral "enter an identifier" choice; the identifier kind is the provide-identifier spec type. */
  | "identifier" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "reset-flow" | "provide-data";
-type SubflowType = "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
+type SubflowType = "key-signing" | "key-registration" | "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
 type FlowType = "login" | "signup" | "recovery" | "enrollment" | (string & {});
 type SocialLoginProviderType = "google" | "apple" | "facebook" | "github" | "microsoft" | "other";
 declare enum AuthEventName {
@@ -449,63 +449,6 @@ type SdkReliabilityConfigOverrides = Partial<Omit<SdkReliabilityConfig, "retry">
     retry?: Partial<SdkRetryConfig>;
 };
 
-/** Sink that escalates a diagnostic message to the telemetry stream. */
-type TelemetrySink = (level: TelemetryLevel, message: string) => void;
-interface Logger {
-    debug(message: string, ...args: unknown[]): void;
-    info(message: string, ...args: unknown[]): void;
-    warn(message: string, ...args: unknown[]): void;
-    error(message: string, ...args: unknown[]): void;
-    critical(message: string, ...args: unknown[]): void;
-    /**
-     * Escalate a diagnostic message to the telemetry stream, if a sink is attached (no-op otherwise).
-     * Unlike the level methods, telemetry is delivered to the backend regardless of the `debug` flag.
-     * Optional so an integrator-provided custom logger stays valid without implementing it.
-     */
-    reportTelemetry?(level: TelemetryLevel, message: string): void;
-    /** Attach (or clear) the telemetry sink. Called once by the tracker after the queue exists. */
-    setTelemetrySink?(sink: TelemetrySink | undefined): void;
-}
-interface CreateLoggerOptions {
-    debug: boolean;
-}
-declare function createLogger(options: CreateLoggerOptions): Logger;
-
-type WindowCaptureContext = Pick<LowEvent, "subflowStartEventId" | "fieldRole" | "initiator"> & {
-    sessionId?: string;
-};
-/** One passive observer per tracker. Field/ceremony collectors register context, not DOM listeners. */
-declare class SharedWindowObserver {
-    private logger;
-    private enqueue;
-    private flushKeepalive;
-    private inputs;
-    private ceremonies;
-    private removers;
-    private lastBlur?;
-    private bracket?;
-    private unrelatedPointerAt;
-    private destroyed;
-    private viewportContext;
-    private resize;
-    private scroll;
-    constructor(logger: Logger, enqueue: (low: LowEvent, sessionId?: string) => void, flushKeepalive: () => void);
-    registerInputs(fields: readonly HTMLInputElement[], context: () => WindowCaptureContext, flush: () => void): () => void;
-    beginCeremony(context: WindowCaptureContext): {
-        settle: (tailMs: number) => void;
-        destroy: () => void;
-    };
-    private context;
-    private findInput;
-    /** Flush all registered input batches before a high-level lifecycle boundary. */
-    flushInputs(): void;
-    private emit;
-    private listen;
-    private extendViewport;
-    private observeNavigation;
-    destroy(): void;
-}
-
 /**
  * Where low events go. `flushKeepalive` is requested on `pagehide` teardown so lows batched after
  * the queue's own lifecycle flush still get out; operations wire it to the client's
@@ -616,6 +559,28 @@ declare function resolveRawErrorLimits(options?: SerializeRawErrorOptions): Limi
  */
 declare function serializeRawError(value: unknown, options?: SerializeRawErrorOptions): RawErrorEnvelope | undefined;
 
+/** Sink that escalates a diagnostic message to the telemetry stream. */
+type TelemetrySink = (level: TelemetryLevel, message: string) => void;
+interface Logger {
+    debug(message: string, ...args: unknown[]): void;
+    info(message: string, ...args: unknown[]): void;
+    warn(message: string, ...args: unknown[]): void;
+    error(message: string, ...args: unknown[]): void;
+    critical(message: string, ...args: unknown[]): void;
+    /**
+     * Escalate a diagnostic message to the telemetry stream, if a sink is attached (no-op otherwise).
+     * Unlike the level methods, telemetry is delivered to the backend regardless of the `debug` flag.
+     * Optional so an integrator-provided custom logger stays valid without implementing it.
+     */
+    reportTelemetry?(level: TelemetryLevel, message: string): void;
+    /** Attach (or clear) the telemetry sink. Called once by the tracker after the queue exists. */
+    setTelemetrySink?(sink: TelemetrySink | undefined): void;
+}
+interface CreateLoggerOptions {
+    debug: boolean;
+}
+declare function createLogger(options: CreateLoggerOptions): Logger;
+
 /** Ceremony context lease on the shared observer. Never installs its own window listeners. */
 declare class LowEventWindowTracker {
     private logger;
@@ -733,6 +698,61 @@ declare abstract class OperationFull {
     protected defineStep<TStart = {}, TFinished = {}, TTypedError = never>(stepName: string, ignoreAsInteractionOnStart?: boolean): StepHelper<TStart, TFinished, TTypedError>;
 }
 
+/** Shared configuration for direct key signing and authority registration. */
+type KeyOperationConfig = {
+    /** Reserved for future variants; no spec types are currently defined. */
+    explicitSpecType?: undefined;
+};
+declare class KeySigningOperationFull extends OperationFull {
+    /** Resolve an eligible key and prepare the input for an actual signing attempt. */
+    readonly prepare: StepHelper;
+    /** Sign and assemble the usable signed artifact. Does not include submitting it. */
+    readonly sign: StepHelper;
+    constructor(tracker: CorbadoTracker, config?: KeyOperationConfig);
+}
+declare class KeyRegistrationOperationFull extends OperationFull {
+    /** Build the request that will establish the key's authority. */
+    readonly prepare: StepHelper;
+    /** Submit and await acceptance: finish only when the key is authorized and usable. */
+    readonly postResponse: StepHelper;
+    constructor(tracker: CorbadoTracker, config?: KeyOperationConfig);
+}
+
+type WindowCaptureContext = Pick<LowEvent, "subflowStartEventId" | "fieldRole" | "initiator"> & {
+    sessionId?: string;
+};
+/** One passive observer per tracker. Field/ceremony collectors register context, not DOM listeners. */
+declare class SharedWindowObserver {
+    private logger;
+    private enqueue;
+    private flushKeepalive;
+    private inputs;
+    private ceremonies;
+    private removers;
+    private lastBlur?;
+    private bracket?;
+    private unrelatedPointerAt;
+    private destroyed;
+    private viewportContext;
+    private resize;
+    private scroll;
+    constructor(logger: Logger, enqueue: (low: LowEvent, sessionId?: string) => void, flushKeepalive: () => void);
+    registerInputs(fields: readonly HTMLInputElement[], context: () => WindowCaptureContext, flush: () => void): () => void;
+    beginCeremony(context: WindowCaptureContext): {
+        settle: (tailMs: number) => void;
+        destroy: () => void;
+    };
+    private context;
+    private findInput;
+    /** Flush all registered input batches before a high-level lifecycle boundary. */
+    flushInputs(): void;
+    private emit;
+    private listen;
+    private extendViewport;
+    private observeNavigation;
+    destroy(): void;
+}
+
 type PasskeyOperationLoginExplicitSpecType = "passkey-cui" | "passkey-known-identifier" | "passkey-no-identifier"
 /**
  * The `-auto` variants are the same two ceremonies started by the integration rather than by a
@@ -1638,6 +1658,52 @@ declare class CorbadoTracker {
     provideDataOperationFull(config?: ProvideDataOperationConfig): ProvideDataOperationFull;
     socialLoginOperationFull(config?: SocialLoginOperationConfig): SocialLoginOperationFull;
     appConfirmationOperationFull(config?: AppConfirmationOperationConfig): AppConfirmationOperationFull;
+    /**
+     * Track direct key signing outside WebAuthn through prepare and sign.
+     *
+     * @param config - Optional configuration; explicitSpecType may only be undefined for now.
+     * @remarks
+     * Start prepare when resolving the eligible key and input for an actual attempt, not background
+     * prefetch. Although system-driven, that work is meaningful interaction for classification.
+     * Construction alone does not establish interaction. Finish sign only when the usable signed
+     * artifact is ready, including assembly. Submission is outside this operation. Report failures
+     * on the affected step using error(error). Never include key material, signatures or proofs.
+     * WebAuthn assertions continue to use passkeyLoginFullOperation.
+     * @example
+     * ```ts
+     * const signing = tracker.keySigningOperationFull();
+     * signing.prepare.start({});
+     * // Resolve an eligible key and prepare the signing input.
+     * signing.prepare.finished({});
+     * signing.sign.start({});
+     * // Sign and assemble the artifact returned to the caller.
+     * signing.sign.finished({});
+     * ```
+     */
+    keySigningOperationFull(config?: KeyOperationConfig): KeySigningOperationFull;
+    /**
+     * Track establishing a key's authority through prepare and postResponse.
+     *
+     * @param config - Optional configuration; explicitSpecType may only be undefined for now.
+     * @remarks
+     * Start prepare when building an actual registration request, not background prefetch.
+     * This system-driven work is meaningful interaction; construction alone is not.
+     * postResponse covers submission and acceptance. Finish only when the key is authorized and
+     * usable, not merely when submission returns. Report rejection, transport, execution or timeout
+     * errors on the affected step using error(error). Never include key material or proofs.
+     * Credential creation and any authorizing WebAuthn assertion are separate operations.
+     * @example
+     * ```ts
+     * const registration = tracker.keyRegistrationOperationFull();
+     * registration.prepare.start({});
+     * // Build the registration request.
+     * registration.prepare.finished({});
+     * registration.postResponse.start({});
+     * // Submit and await evidence that the authority is usable.
+     * registration.postResponse.finished({});
+     * ```
+     */
+    keyRegistrationOperationFull(config?: KeyOperationConfig): KeyRegistrationOperationFull;
     captchaOperationFull(config?: CaptchaOperationConfig): CaptchaOperationFull;
     /**
      * Track a device-trust check through getOptions, ceremony and postResponse.
@@ -2284,4 +2350,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setUser, telemetry };