@corbado/observe 0.2.0-next.30-5569831 → 0.3.0

package/dist/index.d.mts

@@ -156,6 +156,12 @@ interface EventBatchMeta {
     transport: "fetch" | "beacon";
     /** Number of prior failed delivery attempts for this batch; omitted on the first attempt. */
     retryCount?: number;
+    /**
+     * Version of the SDK reliability config this batch was captured under; omitted when running on
+     * built-in defaults. Lets server-side analyses segment by the config actually in effect (config
+     * changes propagate with page-load lag, so calendar-date cohorts are mixed).
+     */
+    configVersion?: string;
 }
 interface EventMeta {
     trackingSourcePath: string;
@@ -221,8 +227,20 @@ interface SdkRetryConfig {
  * SDK reliability configuration returned by the events endpoint (opt-in via the
  * `X-Corbado-Observe-Config` header). Mirrors the server `observeEventCreateRes` schema.
  * All delivery-reliability features default OFF until the server returns config.
+ *
+ * @remarks
+ * Boot-snapshot model: the config resolved at construction (from the localStorage cache) is the
+ * config for the entire page load. A config received from the server during the load is only
+ * cached for the NEXT load, never applied live — this keeps session identity, seq source and
+ * outbox mode coherent within one load.
  */
 interface SdkReliabilityConfig {
+    /**
+     * Content-derived version (hash) assigned by the server. Echoed in the config request header so
+     * the server can answer 204 when nothing changed, and stamped into every batch's
+     * `meta.configVersion`. Empty string for the built-in defaults (nothing cached yet).
+     */
+    version: string;
     /** How often the SDK flushes its event queue, in milliseconds. */
     flushIntervalMs: number;
     /** Persist queued events to a durable outbox so they survive reloads, redirects and context switches. */
@@ -231,6 +249,29 @@ interface SdkReliabilityConfig {
     beaconKeepalive: boolean;
     /** Maintain session continuity across reloads/tabs by persisting the session id in localStorage. */
     sessionContinuity: boolean;
+    /**
+     * Inactivity threshold for continuity sessions, in milliseconds. When more time than this has
+     * passed since the last tracked activity, the session id is rotated on the next load. Only
+     * relevant when `sessionContinuity` is enabled.
+     */
+    sessionInactivityMs: number;
+    /**
+     * Flush-trigger switch: flush pending events when the document becomes hidden
+     * (`visibilitychange`). Defaults to true — a missing value can never disable delivery.
+     */
+    tvc: boolean;
+    /** Flush-trigger switch: flush pending events on `pagehide` (navigation/close). Defaults to true. */
+    tph: boolean;
+    /** Flush-trigger switch: flush pending events when the integrator calls `destroy()`. Defaults to true. */
+    td: boolean;
+    /**
+     * Event names that trigger an immediate flush when enqueued (e.g. `flow_finished`,
+     * `conversion`), so high-value events go out via a normal fetch while the page is still alive
+     * instead of relying on unload delivery. Empty by default (no priority events). The whole
+     * pending queue is sent, and the immediate flush coexists with the interval timer without
+     * double-sending (the in-flight drain absorbs it).
+     */
+    flushOnEventNames: string[];
     /** Retry configuration for failed event flushes. */
     retry: SdkRetryConfig;
 }
@@ -436,6 +477,12 @@ interface TrackerOptions {
     deviceInfoDebounceTime?: number;
     defaultTags?: Record<string, string>;
     applicationId?: string;
+    /**
+     * @deprecated The flush interval is server-controlled via the SDK reliability config
+     * (`flushIntervalMs`). This option only applies as long as no server config has been received
+     * (i.e. before the first config response is cached); once a server config is cached it wins.
+     * It will be removed in a future release.
+     */
     flushInterval?: number;
 }
 declare class CorbadoTracker {
@@ -447,16 +494,17 @@ declare class CorbadoTracker {
     private sessionStorage;
     /** Dedicated localStorage engine for reliability state (config cache, outbox, continuity session, seq). */
     private persistentStorage;
-    private config;
+    /** Boot snapshot of the reliability config; immutable for the lifetime of this page load. */
+    private readonly config;
     private deviceInfoCollector;
     private deviceInfoDebounceTime;
     private deviceInfoTransmittedLastTime;
     private seq;
     constructor(options: TrackerOptions);
     /**
-     * Apply and cache fresh server config. Knobs consumed by the queue (flush interval, retry, outbox,
-     * beacon) are applied there; session-resolution knobs (`sessionContinuity`) take effect on the next
-     * load via the cache.
+     * Cache fresh server config as last-known. Boot-snapshot model: the config is NOT applied to this
+     * load — `this.config` stays the construction-time snapshot — it takes effect on the next page
+     * load via {@link loadCachedConfig}.
      */
     private handleConfig;
     /**
@@ -468,12 +516,19 @@ declare class CorbadoTracker {
     private getSessionId;
     /**
      * Resolve the session id from localStorage so it survives reloads and is shared across tabs of the
-     * same browser. Rotates after {@link SESSION_INACTIVITY_MS} of inactivity, resetting the seq counter.
+     * same browser. Rotates after `config.sessionInactivityMs` of inactivity (server-controlled,
+     * boot-snapshot like the rest of the config), resetting the seq counter.
      */
     private getContinuitySessionId;
     /**
-     * Return the next sequence number. With session continuity the counter is persisted (and re-read to
-     * reduce, but not eliminate, cross-tab races) so ordering survives reloads/redirects.
+     * Return the next sequence number. With session continuity the counter is persisted so ordering
+     * survives reloads/redirects; the read-increment-write runs under a cross-tab Web Lock
+     * ({@link SEQ_LOCK_NAME}) so two tabs sharing the session cannot allocate the same seq (where Web
+     * Locks are unavailable it degrades to the historical best-effort merge). Lock grants are FIFO, so
+     * seq order matches `track()` call order within a tab. Every tracked event also bumps the
+     * continuity session's `lastActiveAt`, so the inactivity window measures real user inactivity
+     * instead of time-since-page-load (a long-lived active tab must not rotate the session on the next
+     * reload).
      */
     private nextSeq;
     private updateDeviceDebounced;
@@ -667,6 +722,8 @@ declare class CorbadoTracker {
      * After calling destroy, the tracker must not be used. Operation objects
      * returned by factory methods (e.g. `passwordLoginFullOperation`) that hold
      * DOM references must be destroyed separately by the caller.
+     * The final flush is gated by the server-controlled trigger switch `td` (default true);
+     * resources are released either way.
      */
     destroy(): Promise<void>;
     /** @internal */
@@ -774,13 +831,25 @@ declare class SessionStorage implements StorageEngine {
 }
 
 interface QueueOptions {
+    /**
+     * Maximum number of events per request (payload cap). A backlog larger than this is drained in
+     * sequential capped batches within one flush. Reaching this size does NOT trigger an early
+     * flush — delivery cadence is controlled solely by the flush interval.
+     */
     batchSize?: number;
-    /** Optional explicit override of the flush timer interval; otherwise `config.flushIntervalMs` is used. */
+    /**
+     * Explicit override of the flush timer interval; otherwise `config.flushIntervalMs` is used.
+     * Internal/test use only — the tracker does not pass this; the interval is server-controlled.
+     */
     flushInterval?: number;
     debug?: boolean;
-    /** Reliability config; defaults to all-features-OFF. */
+    /**
+     * Reliability config snapshot for this page load; defaults to all-features-OFF. Boot-snapshot
+     * model: the queue never changes its behavior mid-load. A fresh config returned by the server is
+     * only handed to {@link QueueOptions.onConfigReceived} for caching and applies on the next load.
+     */
     config?: SdkReliabilityConfig;
-    /** Called whenever the server returns a fresh config (so the client can cache it). */
+    /** Called when the server returns a fresh config, so the client can cache it for the next load. */
     onConfigReceived?: (config: SdkReliabilityConfig) => void;
     /** Whether to send the opt-in config header on the first flush of this load. Defaults to true. */
     requestConfig?: boolean;
@@ -788,12 +857,19 @@ interface QueueOptions {
 /**
  * @remarks When `window` is defined, `visibilitychange` (when the document becomes hidden) and `pagehide`
  * trigger a synchronous unload flush (`flushSync`). Any thrown error in that path is logged as
- * "Unexpected error in queue flushSync".
+ * "Unexpected error in queue flushSync". Sync flushes are deduplicated: once everything pending has
+ * been handed to a sync transport, further lifecycle signals are no-ops until something new is
+ * enqueued — otherwise a single navigation would resend the same batch several times
+ * (visibilitychange + pagehide + per-input flushKeepalive), since entries are intentionally kept
+ * under `durableOutbox`.
  *
  * Pending events are held as {@link OutboxEntry} records. When `config.durableOutbox` is enabled they are
  * additionally persisted to a localStorage-backed {@link EventStore} and recovered on the next load.
  * Delivery removes an entry only on a 2xx response; retryable failures back off (honoring `Retry-After`)
  * up to `config.retry.maxAttempts`. Low events are best-effort and never persisted.
+ *
+ * Flushing is timer-driven only (the flush interval); `batchSize` caps the events per request, and a
+ * flush drains all due work in sequential capped batches, stopping at the first failed send.
  */
 declare class RequestQueue {
     private readonly logger;
@@ -805,6 +881,12 @@ declare class RequestQueue {
     private lowsQueue;
     private timer;
     private isFlushing;
+    /**
+     * True when something was enqueued (or recovered) since the last sync flush. visibilitychange,
+     * pagehide and per-input flushKeepalive calls all funnel into flushSync; this flag makes the
+     * duplicate calls no-ops. The async flush path ignores it.
+     */
+    private dirtySinceSyncFlush;
     private onVisibilityChange;
     private onPageHide;
     private readonly batchSize;
@@ -812,21 +894,27 @@ declare class RequestQueue {
     private readonly debug;
     private readonly requestConfig;
     private readonly onConfigReceived?;
-    private config;
+    private readonly config;
+    /** Event names that trigger an immediate flush at enqueue time (config.flushOnEventNames). */
+    private readonly priorityNames;
     private store?;
-    /** Once the server has answered the config request (200 or 204) we stop sending the header. */
+    /**
+     * Once the server has answered the config request with a 2xx (200 = fresh config cached for the
+     * next load, 204 = cached version still current) we stop sending the header for this load. A
+     * transport-level failure or error status keeps the request pending for the next flush.
+     */
     private configResolved;
     constructor(logger: Logger, transport: Transport, sessionId: string, sdk: SdkInfo, options?: QueueOptions, storage?: StorageEngine | undefined);
     setSessionId(sessionId: string): void;
     private flushInterval;
     /**
      * Error situations:
-     *  - Any error while enqueueing or scheduling flush (including a synchronous throw from `flush`): log "Failed to enqueue event"
+     *  - Any error while enqueueing or scheduling the flush timer: log "Failed to enqueue event"
      */
     enqueue(event: Event): void;
     /**
      * Error situations:
-     *  - Any error while enqueueing or scheduling flush (including a synchronous throw from `flush`): log "Failed to enqueue low event"
+     *  - Any error while enqueueing or scheduling the flush timer: log "Failed to enqueue low event"
      */
     enqueueLow(low: LowEvent): void;
     private scheduleAfterEnqueue;
@@ -840,16 +928,22 @@ declare class RequestQueue {
      */
     flush(): Promise<void>;
     /**
-     * Stamps the batch with the number of prior failed delivery attempts (the max across its entries),
-     * but only when at least one entry is a retry. `entry.attempts` is incremented on each failed flush,
+     * Stamps delivery metadata onto the batch: the config version this load runs under (omitted on
+     * built-in defaults) and the number of prior failed delivery attempts (the max across its entries,
+     * only when at least one entry is a retry). `entry.attempts` is incremented on each failed flush,
      * so it equals the retry count at send time. The transport later merges in `sent`/`transport`.
      */
-    private attachRetryMeta;
+    private attachBatchMeta;
     private getDuePending;
     private takeLows;
     private shouldRequestConfig;
+    /**
+     * Handle the server's answer to the config request. Boot-snapshot model: a fresh config is ONLY
+     * handed to `onConfigReceived` for caching — it is never applied to this load. The behavior the
+     * queue was constructed with stays in effect until the page unloads.
+     */
     private handleConfigResponse;
-    private applyConfig;
+    /** Returns true when the batch was acknowledged with a 2xx (safe to keep draining). */
     private handleSendResult;
     private isRetryable;
     /**
@@ -868,9 +962,13 @@ declare class RequestQueue {
      * Synchronously flush pending events (and best-effort lows) during page unload.
      *
      * @remarks
-     * When `config.beaconKeepalive` is on, uses `sendBeacon`; otherwise fires a fire-and-forget
-     * `fetch` keepalive request. With `config.durableOutbox` enabled, entries are NOT removed (they are
-     * resent on the next load and deduped server-side); otherwise they are removed best-effort.
+     * When `config.beaconKeepalive` is on, uses `sendBeacon` (falling back to fetch keepalive when
+     * the UA refuses the beacon); otherwise fires a fire-and-forget `fetch` keepalive request. The
+     * send is capped at one `batchSize` chunk per call (unload transports share an in-flight budget
+     * with the host app). With `config.durableOutbox` enabled, entries are NOT removed (they are
+     * resent on the next load and deduped server-side); otherwise the sent chunk is removed
+     * best-effort and a remainder keeps the next lifecycle signal flush-worthy.
+     * Deduplicated: a call with nothing newly enqueued since the last sync flush is a no-op.
      */
     flushKeepalive(): void;
     private flushSync;
@@ -883,24 +981,63 @@ declare class RequestQueue {
 
 /** localStorage key under which the last-known server config is cached. */
 declare const CONFIG_STORAGE_KEY = "cbo_sdk_config";
-/** Opt-in request header that asks the events endpoint to return the SDK reliability config. */
+/**
+ * Opt-in request header that asks the events endpoint to return the SDK reliability config. Its value
+ * is the config version the SDK is currently running, or "1" when none is cached yet. The server
+ * answers 204 when that version is still current and 200 + config body when it is stale.
+ */
 declare const CONFIG_REQUEST_HEADER = "X-Corbado-Observe-Config";
 /** Built-in flush interval used until the server provides one. Matches the historical default. */
 declare const DEFAULT_FLUSH_INTERVAL_MS = 500;
+/**
+ * Clamping bounds for server-provided config values. They protect the client from a dangerous
+ * server-side config mistake (e.g. a 0ms flush interval would busy-loop); the server clamps with
+ * the same bounds as the first line of defense.
+ */
+declare const CONFIG_BOUNDS: {
+    readonly flushIntervalMs: {
+        readonly min: 100;
+        readonly max: 60000;
+    };
+    readonly retryMaxAttempts: {
+        readonly min: 1;
+        readonly max: 10;
+    };
+    readonly retryDelayMs: {
+        readonly min: 50;
+        readonly max: 120000;
+    };
+    readonly sessionInactivityMs: {
+        readonly min: 60000;
+        readonly max: 86400000;
+    };
+    readonly flushOnEventNames: {
+        readonly maxEntries: 20;
+        readonly maxNameLength: 100;
+    };
+};
+/** Built-in continuity-session inactivity threshold (30 minutes); matches the historical default. */
+declare const DEFAULT_SESSION_INACTIVITY_MS: number;
 /**
  * Default config: every delivery-reliability feature is OFF. The SDK behaves like a plain async
- * fetch-keepalive flusher until the server returns config (which is then cached as last-known).
+ * fetch-keepalive flusher until the server returns config (which is then cached as last-known and
+ * applied on the NEXT page load — boot-snapshot model). The empty version means "nothing cached";
+ * the config request header sends "1" in that case.
  */
 declare const DEFAULT_RELIABILITY_CONFIG: SdkReliabilityConfig;
 /**
  * Coerce an arbitrary value (cached blob or parsed API body) into a {@link SdkReliabilityConfig}.
- * Returns `null` if the input is not an object. Missing fields fall back to the OFF defaults so a
- * partial/older payload can never silently enable a feature.
+ * Returns `null` if the input is not an object or carries no `version` (a config without identity
+ * cannot participate in the version handshake and must not be trusted). Missing fields fall back to
+ * the OFF defaults so a partial/older payload can never silently enable a feature; the
+ * flush-trigger switches (`tvc`/`tph`/`td`) invert this and default ON, so a partial payload can
+ * never silently disable delivery. Numeric values are clamped to {@link CONFIG_BOUNDS} so a bad
+ * server value cannot harm the client.
  */
 declare function parseReliabilityConfig(raw: unknown): SdkReliabilityConfig | null;
 /** Read the cached config from storage, or `null` if absent/invalid. */
 declare function loadCachedConfig(storage: StorageEngine): SdkReliabilityConfig | null;
-/** Persist the config as last-known so the next page load starts with features already enabled. */
+/** Persist the config as last-known so the next page load starts with these features enabled. */
 declare function cacheConfig(storage: StorageEngine, config: SdkReliabilityConfig): void;
 
 /** A persisted, not-yet-acknowledged event awaiting delivery. */
@@ -918,34 +1055,51 @@ interface OutboxEntry {
 }
 /** localStorage key under which the durable outbox is persisted. */
 declare const OUTBOX_STORAGE_KEY = "cbo_outbox";
+/** Web Lock name guarding outbox mutations across tabs. */
+declare const OUTBOX_LOCK_NAME = "cbo_outbox";
 /** Default maximum number of entries kept; oldest are evicted past this. */
 declare const DEFAULT_MAX_ENTRIES = 500;
+/**
+ * Default budget for the outbox's serialized size, in UTF-16 code units (the unit localStorage
+ * quotas are measured in; ~1 MB on disk). The entry-count cap alone does not bound bytes —
+ * `event.data` is arbitrary customer payload — and localStorage's ~5M-unit quota is shared with
+ * the HOST app: an unbounded outbox could make the host's own writes throw QuotaExceededError.
+ */
+declare const DEFAULT_MAX_SERIALIZED_LENGTH: number;
 /**
  * Durable, localStorage-backed outbox of pending events, mirrored in memory.
  *
  * @remarks
- * Every mutation uses a read-merge-write against storage so concurrent tabs sharing the same
- * localStorage do not clobber each other's entries (last-write-wins only on the merged set).
+ * Every mutation is a read-merge-write against storage, executed under a cross-tab Web Lock
+ * ({@link OUTBOX_LOCK_NAME}) so concurrent tabs sharing the same localStorage cannot interleave
+ * between the read and the write (which would silently drop the other tab's entries). Where the
+ * Web Locks API is unavailable the mutation runs unlocked, matching the historical best-effort
+ * behavior. Mutations never reject; failures are logged.
  * The store is size-capped; overflow evicts the oldest entries and logs the count.
  */
 declare class EventStore {
     private readonly storage;
     private readonly logger;
     private readonly maxEntries;
+    private readonly maxSerializedLength;
     private entries;
-    constructor(storage: StorageEngine, logger: Logger, maxEntries?: number);
+    /** Malformed entries are dropped on every read; report only once per instance to avoid log spam. */
+    private reportedMalformed;
+    constructor(storage: StorageEngine, logger: Logger, maxEntries?: number, maxSerializedLength?: number);
     private read;
     private mutate;
+    /** Evict oldest entries until the serialized outbox fits {@link maxSerializedLength}. */
+    private enforceSizeBudget;
     /** Append an entry. No-op if an entry with the same id already exists. */
-    add(entry: OutboxEntry): void;
+    add(entry: OutboxEntry): Promise<void>;
     /** Re-read from storage and return all entries (memory mirror refreshed). */
     all(): OutboxEntry[];
     /** Entries whose `flushAfter` has elapsed, in insertion order. */
     getDue(now: number): OutboxEntry[];
     /** Remove entries by id (acknowledged or permanently dropped). */
-    remove(ids: string[]): void;
+    remove(ids: string[]): Promise<void>;
     /** Replace existing entries (matched by id) with updated copies, e.g. after bumping backoff. */
-    update(updated: OutboxEntry[]): void;
+    update(updated: OutboxEntry[]): Promise<void>;
     size(): number;
 }
 
@@ -954,4 +1108,4 @@ declare function getTracker(): CorbadoTracker | undefined;
 declare function resetSession(): string | undefined;
 declare function destroy(): Promise<void>;
 
-export { type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_RELIABILITY_CONFIG, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type JavaScriptHighEntropy, LocalStorage, type Logger, type LowEvent, type MultiFlowReset, type MultiFlowStarted, type NormalizedError, OUTBOX_STORAGE_KEY, OperationFull, OperationFullProvideIdentifierWithCUI, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, PasskeyEnrollmentOperationFull, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, PasskeyLoginOperationFull, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentAutoTrackConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginAutoTrackConfig, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkRetryConfig, SessionStorage, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type UserReference, cacheConfig, createLogger, destroy, getTracker, init, loadCachedConfig, parseReliabilityConfig, resetSession };
+export { type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowReset, type FlowStarted, type FlowType, type JavaScriptHighEntropy, LocalStorage, type Logger, type LowEvent, type MultiFlowReset, type MultiFlowStarted, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, OperationFull, OperationFullProvideIdentifierWithCUI, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, PasskeyEnrollmentOperationFull, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, PasskeyLoginOperationFull, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentAutoTrackConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginAutoTrackConfig, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkRetryConfig, SessionStorage, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type UserReference, cacheConfig, createLogger, destroy, getTracker, init, loadCachedConfig, parseReliabilityConfig, resetSession };