@corbado/observe 1.1.5 → 1.2.0

package/dist/index.d.mts

@@ -1,3 +1,31 @@
+type PasswordManagerExtensionName = "1password" | "bitwarden" | "dashlane" | "kaspersky" | "keeper" | "lastpass" | "nordpass" | "protonpass";
+type PasswordManagerExtension = {
+    name: PasswordManagerExtensionName;
+    /**
+     * Set when the page shows the extension has an account signed in: 1Password (signed in, possibly locked,
+     * while a login field is focused), Bitwarden (signed in, possibly locked, passkeys enabled) and LastPass
+     * (unlocked with passkeys enabled when the page loaded). Unset when the sign-in state is not observable.
+     */
+    signedIn?: true;
+};
+/**
+ * Detect password manager browser extensions in the current frame. Synchronous; probes never call into an
+ * extension's messaging, never use extension IDs, never insert DOM nodes and only touch throwaway objects.
+ * The Bitwarden probe briefly adopts a throwaway stylesheet and cancels the animation it creates on `<html>`
+ * in the same task; adopted sheets are not DOM nodes, so MutationObservers see nothing.
+ *
+ * The result reflects the moment of the call. Most extensions are visible from the first inline `<head>`
+ * script. Signed-out LastPass appears only once it decorates a login field (shortly after load; sample at
+ * first focus or later), and 1Password's signed-in button only while a login field is focused. Extensions
+ * do not disappear during a page's life, so callers that sample more than once can union the results.
+ *
+ * @example
+ * ```ts
+ * detectPasswordManagerExtensions(); // [{ name: "1password" }, { name: "bitwarden", signedIn: true }]
+ * ```
+ */
+declare function detectPasswordManagerExtensions(): PasswordManagerExtension[];
+
 interface SdkInfo {
     name: string;
     version: string;
@@ -59,6 +87,15 @@ interface BaseEvent {
      */
     experiments?: Record<string, string>;
     deviceInfo?: DeviceInfo;
+    /**
+     * Password manager extensions detected on the page up to this event (when enabled), e.g.
+     * `[{ name: "1password" }, { name: "keeper" }]`. The full set, captured when the event is tracked, and only
+     * attached when it grew since the last event of the same session on this page; omitted otherwise. Signed-in
+     * state is detected for some managers but not reported.
+     */
+    passwordManagers?: Array<{
+        name: PasswordManagerExtensionName;
+    }>;
     meta?: EventMeta;
 }
 type UserReference = {
@@ -488,6 +525,8 @@ interface SdkReliabilityConfig {
     deviceInfoTiming: boolean;
     /** Serialize explicitly supplied raw error diagnostics. Defaults to true; refreshes apply to subsequent errors. Already queued events are unchanged. */
     rawErrors: boolean;
+    /** Internal: password manager detection switch. Defaults to false. */
+    pmd: boolean;
     /**
      * How far autocapture may attach when another integration already holds the surface it
      * instruments.
@@ -803,6 +842,7 @@ declare class SharedWindowObserver {
     private enqueue;
     private flushKeepalive;
     private inputs;
+    private inputFocusListeners;
     private ceremonies;
     private removers;
     private lastBlur?;
@@ -818,6 +858,12 @@ declare class SharedWindowObserver {
         settle: (tailMs: number) => void;
         destroy: () => void;
     };
+    /**
+     * Calls `listener` with the field whenever a registered input gains focus, including one already focused when
+     * registered.
+     */
+    onInputFocus(listener: (field: EventTarget) => void): () => void;
+    private notifyInputFocus;
     private context;
     private findInput;
     /** Flush all registered input batches before a high-level lifecycle boundary. */
@@ -1559,6 +1605,7 @@ declare class CorbadoTracker {
     private readonly reportedTelemetryKeys;
     private pendingSelfTelemetry;
     private windowObserver?;
+    private passwordManagerSampler?;
     /** @internal Shared passive page observation and per-operation context registration. */
     getWindowObserver(): SharedWindowObserver;
     constructor(options: TrackerOptions);
@@ -2587,11 +2634,28 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
+/**
+ * Synchronous WebAuthn telemetry projection. Binary identifiers arrive as base64url strings;
+ * JSON strings arrive as supplied. Return a string to replace the identifier, null to retain an
+ * explicit null, or undefined to omit it. Exceptions and unsupported return values omit it too.
+ * Never returns a Promise. The original authentication objects are not changed.
+ */
+type WebAuthnIdentifierProjector = (value: string) => string | null | undefined;
+/**
+ * Optional user identifier projection shared by native WebAuthn capture and network serializers.
+ * A missing callback preserves user identifiers. Callbacks should be deterministic across payloads.
+ * Credential IDs and encoded attestation/authenticator data are retained unchanged.
+ */
+type WebAuthnIdentifierProjectors = {
+    /** Projects creation user.id and credential response.userHandle. Missing/null inputs are not passed to the callback. */
+    userId?: WebAuthnIdentifierProjector;
+};
 /**
  * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
- * Binary values become base64url strings. Other fields remain, including user IDs and challenges.
+ * Binary values become base64url strings. User IDs are retained unless a projector is supplied.
  *
  * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
  * @example
@@ -2600,16 +2664,17 @@ declare class EventStore<T = Event> {
  * const optionsJson = sanitizeCreationOptions({ user: { id: "user-id", name: "private" } });
  * ```
  */
-declare function sanitizeCreationOptions(value: unknown): string | undefined;
+declare function sanitizeCreationOptions(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
- * Other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ * By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
  *
  * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
  */
-declare function sanitizeCreationResponse(value: unknown): string | undefined;
+declare function sanitizeCreationResponse(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes WebAuthn authentication options. No fields are currently blacklisted;
  * challenges, credential IDs, and extension inputs remain. Binary values become base64url strings.
@@ -2621,13 +2686,14 @@ declare function sanitizeCreationResponse(value: unknown): string | undefined;
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
 /**
  * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
- * Other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ * By default other fields remain, including credential IDs and user handles. Binary values become base64url strings.
  *
  * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
  */
-declare function sanitizeAssertionResponse(value: unknown): string | undefined;
+declare function sanitizeAssertionResponse(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 
 /**
  * Create a tracker and make it the default for all package-level helpers.
@@ -2664,4 +2730,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };

package/dist/index.d.ts

@@ -1,3 +1,31 @@
+type PasswordManagerExtensionName = "1password" | "bitwarden" | "dashlane" | "kaspersky" | "keeper" | "lastpass" | "nordpass" | "protonpass";
+type PasswordManagerExtension = {
+    name: PasswordManagerExtensionName;
+    /**
+     * Set when the page shows the extension has an account signed in: 1Password (signed in, possibly locked,
+     * while a login field is focused), Bitwarden (signed in, possibly locked, passkeys enabled) and LastPass
+     * (unlocked with passkeys enabled when the page loaded). Unset when the sign-in state is not observable.
+     */
+    signedIn?: true;
+};
+/**
+ * Detect password manager browser extensions in the current frame. Synchronous; probes never call into an
+ * extension's messaging, never use extension IDs, never insert DOM nodes and only touch throwaway objects.
+ * The Bitwarden probe briefly adopts a throwaway stylesheet and cancels the animation it creates on `<html>`
+ * in the same task; adopted sheets are not DOM nodes, so MutationObservers see nothing.
+ *
+ * The result reflects the moment of the call. Most extensions are visible from the first inline `<head>`
+ * script. Signed-out LastPass appears only once it decorates a login field (shortly after load; sample at
+ * first focus or later), and 1Password's signed-in button only while a login field is focused. Extensions
+ * do not disappear during a page's life, so callers that sample more than once can union the results.
+ *
+ * @example
+ * ```ts
+ * detectPasswordManagerExtensions(); // [{ name: "1password" }, { name: "bitwarden", signedIn: true }]
+ * ```
+ */
+declare function detectPasswordManagerExtensions(): PasswordManagerExtension[];
+
 interface SdkInfo {
     name: string;
     version: string;
@@ -59,6 +87,15 @@ interface BaseEvent {
      */
     experiments?: Record<string, string>;
     deviceInfo?: DeviceInfo;
+    /**
+     * Password manager extensions detected on the page up to this event (when enabled), e.g.
+     * `[{ name: "1password" }, { name: "keeper" }]`. The full set, captured when the event is tracked, and only
+     * attached when it grew since the last event of the same session on this page; omitted otherwise. Signed-in
+     * state is detected for some managers but not reported.
+     */
+    passwordManagers?: Array<{
+        name: PasswordManagerExtensionName;
+    }>;
     meta?: EventMeta;
 }
 type UserReference = {
@@ -488,6 +525,8 @@ interface SdkReliabilityConfig {
     deviceInfoTiming: boolean;
     /** Serialize explicitly supplied raw error diagnostics. Defaults to true; refreshes apply to subsequent errors. Already queued events are unchanged. */
     rawErrors: boolean;
+    /** Internal: password manager detection switch. Defaults to false. */
+    pmd: boolean;
     /**
      * How far autocapture may attach when another integration already holds the surface it
      * instruments.
@@ -803,6 +842,7 @@ declare class SharedWindowObserver {
     private enqueue;
     private flushKeepalive;
     private inputs;
+    private inputFocusListeners;
     private ceremonies;
     private removers;
     private lastBlur?;
@@ -818,6 +858,12 @@ declare class SharedWindowObserver {
         settle: (tailMs: number) => void;
         destroy: () => void;
     };
+    /**
+     * Calls `listener` with the field whenever a registered input gains focus, including one already focused when
+     * registered.
+     */
+    onInputFocus(listener: (field: EventTarget) => void): () => void;
+    private notifyInputFocus;
     private context;
     private findInput;
     /** Flush all registered input batches before a high-level lifecycle boundary. */
@@ -1559,6 +1605,7 @@ declare class CorbadoTracker {
     private readonly reportedTelemetryKeys;
     private pendingSelfTelemetry;
     private windowObserver?;
+    private passwordManagerSampler?;
     /** @internal Shared passive page observation and per-operation context registration. */
     getWindowObserver(): SharedWindowObserver;
     constructor(options: TrackerOptions);
@@ -2587,11 +2634,28 @@ declare class EventStore<T = Event> {
     size(): number;
 }
 
+/**
+ * Synchronous WebAuthn telemetry projection. Binary identifiers arrive as base64url strings;
+ * JSON strings arrive as supplied. Return a string to replace the identifier, null to retain an
+ * explicit null, or undefined to omit it. Exceptions and unsupported return values omit it too.
+ * Never returns a Promise. The original authentication objects are not changed.
+ */
+type WebAuthnIdentifierProjector = (value: string) => string | null | undefined;
+/**
+ * Optional user identifier projection shared by native WebAuthn capture and network serializers.
+ * A missing callback preserves user identifiers. Callbacks should be deterministic across payloads.
+ * Credential IDs and encoded attestation/authenticator data are retained unchanged.
+ */
+type WebAuthnIdentifierProjectors = {
+    /** Projects creation user.id and credential response.userHandle. Missing/null inputs are not passed to the callback. */
+    userId?: WebAuthnIdentifierProjector;
+};
 /**
  * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
- * Binary values become base64url strings. Other fields remain, including user IDs and challenges.
+ * Binary values become base64url strings. User IDs are retained unless a projector is supplied.
  *
  * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
  * @example
@@ -2600,16 +2664,17 @@ declare class EventStore<T = Event> {
  * const optionsJson = sanitizeCreationOptions({ user: { id: "user-id", name: "private" } });
  * ```
  */
-declare function sanitizeCreationOptions(value: unknown): string | undefined;
+declare function sanitizeCreationOptions(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
- * Other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ * By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
  *
  * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
  */
-declare function sanitizeCreationResponse(value: unknown): string | undefined;
+declare function sanitizeCreationResponse(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes WebAuthn authentication options. No fields are currently blacklisted;
  * challenges, credential IDs, and extension inputs remain. Binary values become base64url strings.
@@ -2621,13 +2686,14 @@ declare function sanitizeCreationResponse(value: unknown): string | undefined;
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
 /**
  * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
- * Other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ * By default other fields remain, including credential IDs and user handles. Binary values become base64url strings.
  *
  * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
+ * @param projectors - Optional synchronous user identifier projection; default identity.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
  */
-declare function sanitizeAssertionResponse(value: unknown): string | undefined;
+declare function sanitizeAssertionResponse(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 
 /**
  * Create a tracker and make it the default for all package-level helpers.
@@ -2664,4 +2730,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry };