@corbado/observe 1.1.4 → 1.1.6

package/dist/index.d.mts

@@ -16,6 +16,7 @@ type SetFlowTagsOptions = {
     /** Whether following sibling flows inherit the tags (default `true`). */
     expandToFollowing?: boolean;
 };
+type ProvideIdentifierSpecType = "email" | "phone" | "username";
 type SocialLoginProviderType = "google" | "apple" | "facebook" | "github" | "microsoft" | "line" | "kakao" | "singpass" | "other";
 declare enum AuthEventName {
     FlowStarted = "flow_started",
@@ -190,6 +191,20 @@ type StepOptions = {
     explicitTimestamp?: number;
     /** Per-call experiment override (experiment key → variant), merged over the persistent assignments. */
     experiments?: Record<string, string>;
+    /**
+     * Identifier the user submitted with this step (e.g. on `pi-post-response`). Sent by step start,
+     * finished and error only. Makes the attempt searchable by identifier, including failed attempts;
+     * unlike `setUser`, it never identifies the user of the flow.
+     */
+    identifier?: StepIdentifier;
+};
+/**
+ * Sent exactly as given: apply your normalization (e.g. trim and lowercase an email) and, if your data
+ * policy requires it, hash the value before passing it. Search must use the same representation.
+ */
+type StepIdentifier = {
+    value: string;
+    type?: ProvideIdentifierSpecType;
 };
 type SubflowTrigger = {
     actor: "system" | "user";
@@ -1241,7 +1256,6 @@ type PasskeyLoginCUITypedError = {
     code: PasskeyLoginCUITypedErrorCode;
 };
 type PasskeyLoginCUITypedErrorCode = "cancel_detected";
-type ProvideIdentifierSpecType = "email" | "phone" | "username";
 type ProvideIdentifierPostResponseStart = {
     explicitSpecType?: ProvideIdentifierSpecType;
 };
@@ -2573,11 +2587,28 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
+/**
+ * Synchronous WebAuthn telemetry projection. Binary identifiers arrive as base64url strings;
+ * JSON strings arrive as supplied. Return a string to replace the identifier, null to retain an
+ * explicit null, or undefined to omit it. Exceptions and unsupported return values omit it too.
+ * Never returns a Promise. The original authentication objects are not changed.
+ */
+type WebAuthnIdentifierProjector = (value: string) => string | null | undefined;
+/**
+ * Optional user identifier projection shared by native WebAuthn capture and network serializers.
+ * A missing callback preserves user identifiers. Callbacks should be deterministic across payloads.
+ * Credential IDs and encoded attestation/authenticator data are retained unchanged.
+ */
+type WebAuthnIdentifierProjectors = {
+    /** Projects creation user.id and credential response.userHandle. Missing/null inputs are not passed to the callback. */
+    userId?: WebAuthnIdentifierProjector;
+};
 /**
  * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
- * Binary values become base64url strings. Other fields remain, including user IDs and challenges.
+ * Binary values become base64url strings. User IDs are retained unless a projector is supplied.
  *
  * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
  * @example
@@ -2586,16 +2617,17 @@ declare class EventStore<T = Event> {
  * const optionsJson = sanitizeCreationOptions({ user: { id: "user-id", name: "private" } });
  * ```
  */
-declare function sanitizeCreationOptions(value: unknown): string | undefined;
+declare function sanitizeCreationOptions(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
- * Other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ * By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
  *
  * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
  */
-declare function sanitizeCreationResponse(value: unknown): string | undefined;
+declare function sanitizeCreationResponse(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes WebAuthn authentication options. No fields are currently blacklisted;
  * challenges, credential IDs, and extension inputs remain. Binary values become base64url strings.
@@ -2607,13 +2639,14 @@ declare function sanitizeCreationResponse(value: unknown): string | undefined;
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
 /**
  * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
- * Other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ * By default other fields remain, including credential IDs and user handles. Binary values become base64url strings.
  *
  * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
  */
-declare function sanitizeAssertionResponse(value: unknown): string | undefined;
+declare function sanitizeAssertionResponse(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 
 /**
  * Create a tracker and make it the default for all package-level helpers.
@@ -2650,4 +2683,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };

package/dist/index.d.ts

@@ -16,6 +16,7 @@ type SetFlowTagsOptions = {
     /** Whether following sibling flows inherit the tags (default `true`). */
     expandToFollowing?: boolean;
 };
+type ProvideIdentifierSpecType = "email" | "phone" | "username";
 type SocialLoginProviderType = "google" | "apple" | "facebook" | "github" | "microsoft" | "line" | "kakao" | "singpass" | "other";
 declare enum AuthEventName {
     FlowStarted = "flow_started",
@@ -190,6 +191,20 @@ type StepOptions = {
     explicitTimestamp?: number;
     /** Per-call experiment override (experiment key → variant), merged over the persistent assignments. */
     experiments?: Record<string, string>;
+    /**
+     * Identifier the user submitted with this step (e.g. on `pi-post-response`). Sent by step start,
+     * finished and error only. Makes the attempt searchable by identifier, including failed attempts;
+     * unlike `setUser`, it never identifies the user of the flow.
+     */
+    identifier?: StepIdentifier;
+};
+/**
+ * Sent exactly as given: apply your normalization (e.g. trim and lowercase an email) and, if your data
+ * policy requires it, hash the value before passing it. Search must use the same representation.
+ */
+type StepIdentifier = {
+    value: string;
+    type?: ProvideIdentifierSpecType;
 };
 type SubflowTrigger = {
     actor: "system" | "user";
@@ -1241,7 +1256,6 @@ type PasskeyLoginCUITypedError = {
     code: PasskeyLoginCUITypedErrorCode;
 };
 type PasskeyLoginCUITypedErrorCode = "cancel_detected";
-type ProvideIdentifierSpecType = "email" | "phone" | "username";
 type ProvideIdentifierPostResponseStart = {
     explicitSpecType?: ProvideIdentifierSpecType;
 };
@@ -2573,11 +2587,28 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
+/**
+ * Synchronous WebAuthn telemetry projection. Binary identifiers arrive as base64url strings;
+ * JSON strings arrive as supplied. Return a string to replace the identifier, null to retain an
+ * explicit null, or undefined to omit it. Exceptions and unsupported return values omit it too.
+ * Never returns a Promise. The original authentication objects are not changed.
+ */
+type WebAuthnIdentifierProjector = (value: string) => string | null | undefined;
+/**
+ * Optional user identifier projection shared by native WebAuthn capture and network serializers.
+ * A missing callback preserves user identifiers. Callbacks should be deterministic across payloads.
+ * Credential IDs and encoded attestation/authenticator data are retained unchanged.
+ */
+type WebAuthnIdentifierProjectors = {
+    /** Projects creation user.id and credential response.userHandle. Missing/null inputs are not passed to the callback. */
+    userId?: WebAuthnIdentifierProjector;
+};
 /**
  * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
- * Binary values become base64url strings. Other fields remain, including user IDs and challenges.
+ * Binary values become base64url strings. User IDs are retained unless a projector is supplied.
  *
  * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
  * @example
@@ -2586,16 +2617,17 @@ declare class EventStore<T = Event> {
  * const optionsJson = sanitizeCreationOptions({ user: { id: "user-id", name: "private" } });
  * ```
  */
-declare function sanitizeCreationOptions(value: unknown): string | undefined;
+declare function sanitizeCreationOptions(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
- * Other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ * By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
  *
  * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
  */
-declare function sanitizeCreationResponse(value: unknown): string | undefined;
+declare function sanitizeCreationResponse(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes WebAuthn authentication options. No fields are currently blacklisted;
  * challenges, credential IDs, and extension inputs remain. Binary values become base64url strings.
@@ -2607,13 +2639,14 @@ declare function sanitizeCreationResponse(value: unknown): string | undefined;
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
 /**
  * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
- * Other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ * By default other fields remain, including credential IDs and user handles. Binary values become base64url strings.
  *
  * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
  */
-declare function sanitizeAssertionResponse(value: unknown): string | undefined;
+declare function sanitizeAssertionResponse(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 
 /**
  * Create a tracker and make it the default for all package-level helpers.
@@ -2650,4 +2683,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };