@corbado/observe 1.1.2 → 1.1.4

package/dist/index.d.mts

@@ -5,9 +5,17 @@ interface SdkInfo {
 type EventType = "predefined" | "custom" | "error" | "identify";
 type AuthMethodType = "identifier-email"
 /** Neutral "enter an identifier" choice; the identifier kind is the provide-identifier spec type. */
- | "identifier" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "reset-flow" | "provide-data";
-type SubflowType = "key-signing" | "key-registration" | "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
+ | "identifier" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "totp" | "totp-login" | "totp-enrollment" | "app-confirmation" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "sso-login" | "reset-flow" | "provide-data";
+type SubflowType = "key-signing" | "key-registration" | "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sso-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
 type FlowType = "login" | "signup" | "recovery" | "enrollment" | (string & {});
+type SetFlowTagsOptions = {
+    /** Flow type to tag; defaults to `"*"` (the innermost open flow of any type). */
+    flowType?: FlowType;
+    /** Whether child flows inherit the tags (default `true`). */
+    expandToChildren?: boolean;
+    /** Whether following sibling flows inherit the tags (default `true`). */
+    expandToFollowing?: boolean;
+};
 type SocialLoginProviderType = "google" | "apple" | "facebook" | "github" | "microsoft" | "line" | "kakao" | "singpass" | "other";
 declare enum AuthEventName {
     FlowStarted = "flow_started",
@@ -1296,8 +1304,49 @@ declare class SocialLoginOperationFull extends OperationFull {
     constructor(tracker: CorbadoTracker, config?: SocialLoginOperationConfig);
 }
 
-/** How the confirmation is reached: a QR handoff or an app on the browser's device. */
-type AppConfirmationOperationSpecType = "qr-code" | "same-device";
+type SsoLoginSpecType = "pre-identifier" | "post-identifier";
+type SsoLoginGetRedirectUrlStart = {
+    explicitSpecType?: SsoLoginSpecType;
+};
+type SsoLoginGetRedirectUrlFinished = {};
+type SsoLoginExchangeCodeStart = {};
+type SsoLoginExchangeCodeFinished = {};
+type SsoLoginOperationConfig = {
+    /** The classifier drops the attempt if no spec type arrives on any of its events — supply it here or on a step's start data as soon as known. */
+    explicitSpecType?: SsoLoginSpecType;
+    /** The organization's claimed email domain only (e.g. `example.com`), never a full address. Max 253 characters. */
+    organizationDomain?: string;
+    /** `"system"` when the application routed to SSO without a user choice, e.g. by the email domain. */
+    actor?: "user" | "system";
+};
+/** Enterprise SSO (SAML/OIDC) via the organization's identity provider; kept apart from user-chosen social login. */
+declare class SsoLoginOperationFull extends OperationFull {
+    readonly getRedirectUrl: StepHelper<SsoLoginGetRedirectUrlStart, SsoLoginGetRedirectUrlFinished>;
+    readonly exchangeCode: StepHelper<SsoLoginExchangeCodeStart, SsoLoginExchangeCodeFinished>;
+    constructor(tracker: CorbadoTracker, config?: SsoLoginOperationConfig);
+}
+
+type TotpOperationSpecType = "totp-login" | "totp-enrollment";
+type TotpOperationPostResponseStart = {
+    explicitSpecType?: TotpOperationSpecType;
+};
+type TotpOperationConfig = {
+    /** One real input, or an ordered group representing one code. */
+    inputHtmlField?: HTMLInputElement;
+    inputHtmlFields?: HTMLInputElement[];
+    explicitSpecType?: TotpOperationSpecType;
+};
+declare class TotpOperationFull extends OperationFull {
+    private lowEventTracker?;
+    readonly postResponse: StepHelper<TotpOperationPostResponseStart>;
+    constructor(tracker: CorbadoTracker, config?: TotpOperationConfig);
+    /** Rebind the ordered code input group without starting a new subflow. An empty list detaches it. */
+    setInputFields(fields: readonly HTMLInputElement[]): void;
+    destroy(): void;
+}
+
+/** How the confirmation is reached: a QR handoff, an app on the browser's device, or a push to an already-enrolled device. */
+type AppConfirmationOperationSpecType = "qr-code" | "same-device" | "push";
 type AppConfirmationOperationStart = {
     explicitSpecType?: AppConfirmationOperationSpecType;
 };
@@ -1816,6 +1865,36 @@ declare class CorbadoTracker {
      * ```
      */
     setUser(user: UserReference): void;
+    /**
+     * Attach tags to the flow that is open right now.
+     *
+     * @remarks
+     * Emits one `flow_enriched` carrying `tags` and no user reference, with data
+     * `{ match: { flowType, at: "during" } }` plus `expCh` / `expFol` when the options set them.
+     *
+     * - The tags land on the innermost flow open at call time (of `flowType` when given; default `"*"`, any type).
+     * - `expandToChildren` (default `true`): child flows of that flow inherit the tags.
+     * - `expandToFollowing` (default `true`): later sibling flows inherit the tags until the next
+     *   sibling of the same flow type as the tagged flow.
+     * - Per key the last `setFlowTags()` value wins; it also overrides a same-key tag passed to that
+     *   flow's own tracking calls (e.g. `flowStarted()`).
+     * - Call while the target flow is open. An enrichment after the flow's last container event
+     *   (for example after `flowFinished()`) matches no flow and is dropped with a
+     *   `flow_enriched/no_matching_flow` classification warning.
+     * - Tag keys and values are case-sensitive. Entries with an empty key or a non-string value are
+     *   dropped with a warning; nothing is sent when no valid entry remains.
+     *
+     * @param tags - Key-value tags for filtering and segmentation.
+     * @param options - Target flow type and tag expansion; omitted flags default to `true`.
+     *
+     * @example
+     * ```typescript
+     * tracker.flowStarted({ flowName: "login" });
+     * tracker.setFlowTags({ entryPoint: "checkout" });
+     * tracker.flowFinished({ flowName: "login" });
+     * ```
+     */
+    setFlowTags(tags: Record<string, string>, options?: SetFlowTagsOptions): void;
     /**
      * Track when you present authentication method choices to the user.
      *
@@ -1920,9 +1999,48 @@ declare class CorbadoTracker {
     continueEmailLinkOperation(config?: EmailLinkContinuationConfig): EmailLinkContinuationOperation;
     emailOtpOperationFull(config?: EmailOTPOperationConfig): EmailOtpOperationFull;
     smsOtpOperationFull(config?: SmsOTPOperationConfig): SmsOtpOperationFull;
+    /**
+     * Track a code from an authenticator app (TOTP) through its verification.
+     *
+     * @param config - Optional code input field(s) and spec type (`totp-login` or `totp-enrollment`).
+     * @remarks
+     * There is no send step: the code comes from the user's authenticator, not from the application.
+     * Report the verification request on postResponse. Bind the code input to capture typing and
+     * autofill; use setInputFields when the input is rendered after the operation starts.
+     * @example
+     * ```ts
+     * const totp = tracker.totpOperationFull({ explicitSpecType: "totp-login", inputHtmlField: codeInput });
+     * totp.postResponse.start({});
+     * totp.postResponse.finished({});
+     * ```
+     */
+    totpOperationFull(config?: TotpOperationConfig): TotpOperationFull;
     provideIdentifierOperationFull(config?: OperationFullProvideIdentifierWithCUIConfig): OperationFullProvideIdentifierWithCUI;
     provideDataOperationFull(config?: ProvideDataOperationConfig): ProvideDataOperationFull;
     socialLoginOperationFull(config?: SocialLoginOperationConfig): SocialLoginOperationFull;
+    /**
+     * Track enterprise SSO (SAML/OIDC) through the organization's identity provider.
+     *
+     * @param config - Optional spec type, organization email domain and actor.
+     * @remarks
+     * Use for policy-routed SSO, kept apart from user-chosen social login. Set `actor: "system"` when
+     * the application routed to SSO without a user choice, e.g. by the email domain. Report only the
+     * organization's domain, never a full address.
+     * @example
+     * ```ts
+     * const sso = tracker.ssoLoginOperationFull({
+     *   explicitSpecType: "post-identifier",
+     *   organizationDomain: "example.com",
+     *   actor: "system",
+     * });
+     * sso.getRedirectUrl.start({});
+     * sso.getRedirectUrl.finished({});
+     * // After the identity provider redirects back:
+     * sso.exchangeCode.start({});
+     * sso.exchangeCode.finished({});
+     * ```
+     */
+    ssoLoginOperationFull(config?: SsoLoginOperationConfig): SsoLoginOperationFull;
     appConfirmationOperationFull(config?: AppConfirmationOperationConfig): AppConfirmationOperationFull;
     /**
      * Track direct key signing outside WebAuthn through prepare and sign.
@@ -2517,6 +2635,11 @@ declare function getSessionId(): string | undefined;
  * See {@link CorbadoTracker.setUser}.
  */
 declare function setUser(user: UserReference): void;
+/**
+ * Attach tags to the global tracker's innermost open flow.
+ * See {@link CorbadoTracker.setFlowTags}.
+ */
+declare function setFlowTags(tags: Record<string, string>, options?: SetFlowTagsOptions): void;
 declare function setExperiment(key: string, variant: string): void;
 declare function setExperiments(assignments: Record<string, string>): void;
 declare function clearExperiment(key: string): void;
@@ -2527,4 +2650,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };

package/dist/index.d.ts

@@ -5,9 +5,17 @@ interface SdkInfo {
 type EventType = "predefined" | "custom" | "error" | "identify";
 type AuthMethodType = "identifier-email"
 /** Neutral "enter an identifier" choice; the identifier kind is the provide-identifier spec type. */
- | "identifier" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "reset-flow" | "provide-data";
-type SubflowType = "key-signing" | "key-registration" | "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
+ | "identifier" | "passkey-login-known-identifier" | "passkey-login-no-identifier" | "passkey-login-cui" | "passkey-login-immediate" | "passkey-enrollment" | "password-login" | "password-login-known-identifier" | "password-login-with-identifier" | "password-enrollment" | "email-otp" | "email-otp-login" | "email-otp-enrollment" | "email-link" | "email-link-login" | "email-link-enrollment" | "sms-otp" | "sms-otp-login" | "sms-otp-enrollment" | "totp" | "totp-login" | "totp-enrollment" | "app-confirmation" | "social-google" | "social-apple" | "social-facebook" | "social-other" | "sso-login" | "reset-flow" | "provide-data";
+type SubflowType = "key-signing" | "key-registration" | "trusted-device-check" | "trusted-device-enrollment" | "passkey-enrollment" | "passkey-login" | "email-otp" | "email-link" | "social-login" | "sso-login" | "sms-otp" | "provide-identifier" | "provide-data" | "password-login" | "password-enrollment" | "totp" | "app-confirmation" | "captcha";
 type FlowType = "login" | "signup" | "recovery" | "enrollment" | (string & {});
+type SetFlowTagsOptions = {
+    /** Flow type to tag; defaults to `"*"` (the innermost open flow of any type). */
+    flowType?: FlowType;
+    /** Whether child flows inherit the tags (default `true`). */
+    expandToChildren?: boolean;
+    /** Whether following sibling flows inherit the tags (default `true`). */
+    expandToFollowing?: boolean;
+};
 type SocialLoginProviderType = "google" | "apple" | "facebook" | "github" | "microsoft" | "line" | "kakao" | "singpass" | "other";
 declare enum AuthEventName {
     FlowStarted = "flow_started",
@@ -1296,8 +1304,49 @@ declare class SocialLoginOperationFull extends OperationFull {
     constructor(tracker: CorbadoTracker, config?: SocialLoginOperationConfig);
 }
 
-/** How the confirmation is reached: a QR handoff or an app on the browser's device. */
-type AppConfirmationOperationSpecType = "qr-code" | "same-device";
+type SsoLoginSpecType = "pre-identifier" | "post-identifier";
+type SsoLoginGetRedirectUrlStart = {
+    explicitSpecType?: SsoLoginSpecType;
+};
+type SsoLoginGetRedirectUrlFinished = {};
+type SsoLoginExchangeCodeStart = {};
+type SsoLoginExchangeCodeFinished = {};
+type SsoLoginOperationConfig = {
+    /** The classifier drops the attempt if no spec type arrives on any of its events — supply it here or on a step's start data as soon as known. */
+    explicitSpecType?: SsoLoginSpecType;
+    /** The organization's claimed email domain only (e.g. `example.com`), never a full address. Max 253 characters. */
+    organizationDomain?: string;
+    /** `"system"` when the application routed to SSO without a user choice, e.g. by the email domain. */
+    actor?: "user" | "system";
+};
+/** Enterprise SSO (SAML/OIDC) via the organization's identity provider; kept apart from user-chosen social login. */
+declare class SsoLoginOperationFull extends OperationFull {
+    readonly getRedirectUrl: StepHelper<SsoLoginGetRedirectUrlStart, SsoLoginGetRedirectUrlFinished>;
+    readonly exchangeCode: StepHelper<SsoLoginExchangeCodeStart, SsoLoginExchangeCodeFinished>;
+    constructor(tracker: CorbadoTracker, config?: SsoLoginOperationConfig);
+}
+
+type TotpOperationSpecType = "totp-login" | "totp-enrollment";
+type TotpOperationPostResponseStart = {
+    explicitSpecType?: TotpOperationSpecType;
+};
+type TotpOperationConfig = {
+    /** One real input, or an ordered group representing one code. */
+    inputHtmlField?: HTMLInputElement;
+    inputHtmlFields?: HTMLInputElement[];
+    explicitSpecType?: TotpOperationSpecType;
+};
+declare class TotpOperationFull extends OperationFull {
+    private lowEventTracker?;
+    readonly postResponse: StepHelper<TotpOperationPostResponseStart>;
+    constructor(tracker: CorbadoTracker, config?: TotpOperationConfig);
+    /** Rebind the ordered code input group without starting a new subflow. An empty list detaches it. */
+    setInputFields(fields: readonly HTMLInputElement[]): void;
+    destroy(): void;
+}
+
+/** How the confirmation is reached: a QR handoff, an app on the browser's device, or a push to an already-enrolled device. */
+type AppConfirmationOperationSpecType = "qr-code" | "same-device" | "push";
 type AppConfirmationOperationStart = {
     explicitSpecType?: AppConfirmationOperationSpecType;
 };
@@ -1816,6 +1865,36 @@ declare class CorbadoTracker {
      * ```
      */
     setUser(user: UserReference): void;
+    /**
+     * Attach tags to the flow that is open right now.
+     *
+     * @remarks
+     * Emits one `flow_enriched` carrying `tags` and no user reference, with data
+     * `{ match: { flowType, at: "during" } }` plus `expCh` / `expFol` when the options set them.
+     *
+     * - The tags land on the innermost flow open at call time (of `flowType` when given; default `"*"`, any type).
+     * - `expandToChildren` (default `true`): child flows of that flow inherit the tags.
+     * - `expandToFollowing` (default `true`): later sibling flows inherit the tags until the next
+     *   sibling of the same flow type as the tagged flow.
+     * - Per key the last `setFlowTags()` value wins; it also overrides a same-key tag passed to that
+     *   flow's own tracking calls (e.g. `flowStarted()`).
+     * - Call while the target flow is open. An enrichment after the flow's last container event
+     *   (for example after `flowFinished()`) matches no flow and is dropped with a
+     *   `flow_enriched/no_matching_flow` classification warning.
+     * - Tag keys and values are case-sensitive. Entries with an empty key or a non-string value are
+     *   dropped with a warning; nothing is sent when no valid entry remains.
+     *
+     * @param tags - Key-value tags for filtering and segmentation.
+     * @param options - Target flow type and tag expansion; omitted flags default to `true`.
+     *
+     * @example
+     * ```typescript
+     * tracker.flowStarted({ flowName: "login" });
+     * tracker.setFlowTags({ entryPoint: "checkout" });
+     * tracker.flowFinished({ flowName: "login" });
+     * ```
+     */
+    setFlowTags(tags: Record<string, string>, options?: SetFlowTagsOptions): void;
     /**
      * Track when you present authentication method choices to the user.
      *
@@ -1920,9 +1999,48 @@ declare class CorbadoTracker {
     continueEmailLinkOperation(config?: EmailLinkContinuationConfig): EmailLinkContinuationOperation;
     emailOtpOperationFull(config?: EmailOTPOperationConfig): EmailOtpOperationFull;
     smsOtpOperationFull(config?: SmsOTPOperationConfig): SmsOtpOperationFull;
+    /**
+     * Track a code from an authenticator app (TOTP) through its verification.
+     *
+     * @param config - Optional code input field(s) and spec type (`totp-login` or `totp-enrollment`).
+     * @remarks
+     * There is no send step: the code comes from the user's authenticator, not from the application.
+     * Report the verification request on postResponse. Bind the code input to capture typing and
+     * autofill; use setInputFields when the input is rendered after the operation starts.
+     * @example
+     * ```ts
+     * const totp = tracker.totpOperationFull({ explicitSpecType: "totp-login", inputHtmlField: codeInput });
+     * totp.postResponse.start({});
+     * totp.postResponse.finished({});
+     * ```
+     */
+    totpOperationFull(config?: TotpOperationConfig): TotpOperationFull;
     provideIdentifierOperationFull(config?: OperationFullProvideIdentifierWithCUIConfig): OperationFullProvideIdentifierWithCUI;
     provideDataOperationFull(config?: ProvideDataOperationConfig): ProvideDataOperationFull;
     socialLoginOperationFull(config?: SocialLoginOperationConfig): SocialLoginOperationFull;
+    /**
+     * Track enterprise SSO (SAML/OIDC) through the organization's identity provider.
+     *
+     * @param config - Optional spec type, organization email domain and actor.
+     * @remarks
+     * Use for policy-routed SSO, kept apart from user-chosen social login. Set `actor: "system"` when
+     * the application routed to SSO without a user choice, e.g. by the email domain. Report only the
+     * organization's domain, never a full address.
+     * @example
+     * ```ts
+     * const sso = tracker.ssoLoginOperationFull({
+     *   explicitSpecType: "post-identifier",
+     *   organizationDomain: "example.com",
+     *   actor: "system",
+     * });
+     * sso.getRedirectUrl.start({});
+     * sso.getRedirectUrl.finished({});
+     * // After the identity provider redirects back:
+     * sso.exchangeCode.start({});
+     * sso.exchangeCode.finished({});
+     * ```
+     */
+    ssoLoginOperationFull(config?: SsoLoginOperationConfig): SsoLoginOperationFull;
     appConfirmationOperationFull(config?: AppConfirmationOperationConfig): AppConfirmationOperationFull;
     /**
      * Track direct key signing outside WebAuthn through prepare and sign.
@@ -2517,6 +2635,11 @@ declare function getSessionId(): string | undefined;
  * See {@link CorbadoTracker.setUser}.
  */
 declare function setUser(user: UserReference): void;
+/**
+ * Attach tags to the global tracker's innermost open flow.
+ * See {@link CorbadoTracker.setFlowTags}.
+ */
+declare function setFlowTags(tags: Record<string, string>, options?: SetFlowTagsOptions): void;
 declare function setExperiment(key: string, variant: string): void;
 declare function setExperiments(assignments: Record<string, string>): void;
 declare function clearExperiment(key: string): void;
@@ -2527,4 +2650,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };