@corbado/observe 1.10.1 → 1.11.0

package/dist/index.d.ts

@@ -796,116 +796,6 @@ type SdkReliabilityConfigOverrides = Partial<Omit<SdkReliabilityConfig, "retry"
     pmd?: boolean;
 };
 
-/**
- * Where low events go. `flushKeepalive` is requested on `pagehide` teardown so lows batched after
- * the queue's own lifecycle flush still get out; operations wire it to the client's
- * `lowEventFlushKeepalive()`, which is gated by the server-controlled `tlf` trigger switch
- * (default true = historical behavior, can be disabled remotely).
- */
-interface LowEventSink {
-    reserveCaptureSeq?(): number;
-    enqueueLowEvent(low: LowEvent): void;
-    flushKeepalive(): void;
-    registerInputs?(fields: readonly HTMLInputElement[], flush: () => void): () => void;
-    beginCeremony?(initiator?: LowEventInitiator): {
-        settle(tailMs: number): void;
-        destroy(): void;
-    };
-}
-
-/**
- * Limits for optional raw-error serialization. Modeled on Sentry's client options
- * (`normalizeDepth`, `normalizeMaxBreadth`, `maxValueLength`, `normalizeToSize`, the
- * stack-frame limit and the linked-errors limit) with defaults tuned for an authentication
- * event stream rather than an error monitor. Every value is clamped to {@link RAW_ERROR_BOUNDS};
- * invalid values fall back to the default. A fixed 1024-node budget per depth attempt and
- * incremental text-byte accounting also bound work before the final JSON-size check.
- */
-type SerializeRawErrorOptions = {
-    /** Include `stack` strings. Default false. */
-    stack?: boolean;
-    /** Stack lines kept after the header line when `stack` is on. Default 50 (Sentry: 50). */
-    maxStackFrames?: number;
-    /** Object nesting depth below the envelope. Default 3 (Sentry `normalizeDepth`: 3). */
-    depth?: number;
-    /** Keys per object and items per array, Map or Set. Default 30 (Sentry `normalizeMaxBreadth`: 1000). */
-    maxBreadth?: number;
-    /** Characters kept per string. Default 1024 (Sentry `maxValueLength`: 250). */
-    maxValueLength?: number;
-    /** `cause` hops followed. Default 3 (Sentry linked errors: 5, Datadog: 10). */
-    maxCauseDepth?: number;
-    /** Maximum UTF-8 JSON size in bytes. Depth is reduced until the output fits; omit diagnostics that cannot fit. Default 32768 (Sentry `normalizeToSize`: 100 KiB). */
-    maxBytes?: number;
-};
-/** Envelope produced by {@link serializeRawError}. */
-type RawErrorEnvelope = {
-    /** Class tag of the original value: `DOMException`, `Error`, `Object`, `Response`, `number`, `null`, `unserializable`, … */
-    type: string;
-    /** Bounded plain-JSON copy of the value; absent when it could not be serialized within the limits. */
-    value?: unknown;
-    /** Set when even the shallowest serialization exceeded `maxBytes`. */
-    truncated?: true;
-};
-type Limits = Required<Omit<SerializeRawErrorOptions, "stack">> & {
-    stack: boolean;
-};
-/** Inclusive bounds for every numeric limit; defaults sit inside them. */
-declare const RAW_ERROR_BOUNDS: {
-    readonly maxStackFrames: {
-        readonly min: 1;
-        readonly max: 100;
-        readonly default: 50;
-    };
-    readonly depth: {
-        readonly min: 0;
-        readonly max: 10;
-        readonly default: 3;
-    };
-    readonly maxBreadth: {
-        readonly min: 1;
-        readonly max: 1000;
-        readonly default: 30;
-    };
-    readonly maxValueLength: {
-        readonly min: 1;
-        readonly max: 10000;
-        readonly default: 1024;
-    };
-    readonly maxCauseDepth: {
-        readonly min: 0;
-        readonly max: 10;
-        readonly default: 3;
-    };
-    readonly maxBytes: {
-        readonly min: 0;
-        readonly max: 65536;
-        readonly default: 32768;
-    };
-};
-/** Resolve caller options into clamped limits. Exported for tests and integrations that want to inspect the effective values. */
-declare function resolveRawErrorLimits(options?: SerializeRawErrorOptions): Limits;
-/**
- * Serialize an arbitrary thrown value for the `rawError` diagnostic field.
- *
- * Copies standard error fields and serializable own properties within the configured limits.
- * Standard fields are read through the prototype chain so DOMException and cross-realm errors
- * serialize. Output is plain JSON, bounded in depth, breadth, string length, cause chain and
- * UTF-8 size, and never throws.
- *
- * The result is an envelope `{ type, value }`: `type` is the value's class tag (`DOMException`,
- * `Error`, `Object`, `number`, …) and `value` is a bounded diagnostic copy. Keeping the class tag
- * outside value preserves the library's own `type` field. When the value cannot be serialized
- * within the limits the envelope carries `truncated: true` or the type `unserializable` and no
- * `value`.
- *
- * Stacks are omitted unless `stack: true`; they carry page URLs and add the most bytes.
- * Binary data (ArrayBuffer, typed arrays) is reported by type and length only, never by content.
- *
- * @param value - Original thrown value or an explicit diagnostic projection.
- * @param options - Limits; see {@link SerializeRawErrorOptions} for defaults and {@link RAW_ERROR_BOUNDS} for clamping.
- */
-declare function serializeRawError(value: unknown, options?: SerializeRawErrorOptions): RawErrorEnvelope | undefined;
-
 /** Sink that escalates a diagnostic message to the telemetry stream. */
 type TelemetrySink = (level: TelemetryLevel, message: string) => void;
 interface Logger {
@@ -928,152 +818,6 @@ interface CreateLoggerOptions {
 }
 declare function createLogger(options: CreateLoggerOptions): Logger;
 
-/** Ceremony context lease on the shared observer. Never installs its own window listeners. */
-declare class LowEventWindowTracker {
-    private logger;
-    private sink;
-    private lease?;
-    private destroyed;
-    constructor(logger: Logger, sink: LowEventSink);
-    arm(initiator?: LowEventInitiator, conditional?: boolean): void;
-    scheduleDisarm(delayMs: number): void;
-    disarm(): void;
-    destroy(): void;
-}
-
-/**
- * How long window low-event listeners stay armed after a ceremony settles: focus return and
- * picker dismiss animations land shortly after the WebAuthn promise resolves/rejects.
- */
-declare const CEREMONY_LOW_EVENT_TAIL_MS = 1500;
-/**
- * Optional diagnostic context for both normal and typed step errors.
- *
- * Use `rawError` when a library error contains useful context beyond its classified name,
- * code and message, such as a nested cause, an error array or a response status.
- * Serialization requires SDK config `rawErrors: true` (default true). Config refreshes apply
- * to subsequent errors; diagnostics already queued are unchanged.
- * It is emitted as a bounded `{ type, value }` envelope in `stepData.rawError` for raw-event
- * inspection. The envelope type describes the JavaScript value; the library's own fields
- * stay inside value. See {@link serializeRawError} for serialization limits.
- *
- * @remarks
- * The first argument to `.error()` or `.errorTyped()` supplies the classified diagnostic.
- * `rawError` does not fill missing classified fields or affect outcomes, error-group assignment
- * or severity: a code-only typed error remains code-only even if its raw diagnostic has a name
- * and message. Existing StepOptions such as userReference and explicitTimestamp can accompany
- * rawError; calls without it behave as before.
- *
- * Supply a deliberate diagnostic object without credentials, cookies or personal data.
- * Arrays retain their structure in rawError; arrays passed directly to `.error()` become a
- * string message. Keep the original error for application handling; serialization makes a copy.
- *
- * @example
- * ```ts
- * // Normal error with additional provider context.
- * passkey.ceremony.error(originalError, { rawError: providerDiagnostic });
- *
- * // Typed error with the original error available for inspection.
- * password.postResponse.errorTyped(
- *   { code: "invalid_password" },
- *   { rawError: originalError },
- * );
- *
- * // A classified code and message plus additional raw context.
- * password.postResponse.error(
- *   { code: "invalid_password", name: "AuthenticationError", message: "The password was rejected" },
- *   { rawError: providerDiagnostic },
- * );
- * ```
- */
-type ErrorStepOptions = StepOptions & {
-    /** Explicit opt-in. Serialized with bounded depth and UTF-8 size; stacks are omitted by default and binary contents are summarized. */
-    rawError?: unknown;
-    /** Per-call limits for `rawError` serialization (depth, breadth, string length, cause chain, bytes, stack). See {@link SerializeRawErrorOptions}. */
-    rawErrorLimits?: SerializeRawErrorOptions;
-};
-type StepHelper<TStart = {}, TFinished = {}, TTypedError = never> = {
-    start: (data: TStart, options?: StepOptions) => void;
-    finished: (data: TFinished, options?: StepOptions) => void;
-    error: (error: unknown, options?: ErrorStepOptions) => void;
-} & ([TTypedError] extends [never] ? {} : {
-    errorTyped: (error: TTypedError, options?: ErrorStepOptions) => void;
-});
-declare abstract class OperationFull {
-    private tracker;
-    private operationName;
-    private startReference?;
-    private captureSpecType?;
-    private captureSessionId?;
-    private readonly lowFlushers;
-    private readonly lowPrefillCapturers;
-    protected lowEventSink(sourceKind: LowEventSourceKind, fieldRole?: LowEventFieldRole): LowEventSink;
-    protected createLowCollector<T extends {
-        capturePrefill(newCapture?: boolean): void;
-    }>(create: () => T): T | undefined;
-    protected registerLowFlusher(flush: () => void): void;
-    private captureOptions;
-    constructor(tracker: CorbadoTracker, operationName: SubflowType);
-    /** Anchor (subflowStartEventId) of the current start; undefined before the first start. */
-    protected get captureReference(): string | undefined;
-    /** Session the current start was tracked under. */
-    protected get captureSession(): string | undefined;
-    /**
-     * Continue an attempt started elsewhere (e.g. on another page of the same session) without
-     * emitting a subflow_started: later steps and low events carry the given anchor and session.
-     */
-    protected adoptCapture(reference: string, sessionId: string, specType?: string): void;
-    /**
-     * Emits an additional subflow_started; construction already emits the initial start.
-     * `data` supports SubflowTrigger fields (`actor`, `explicitSpecType`, `ignoreAsInteraction`)
-     * plus free-form extras; see SubflowTrigger for programmatic interaction suppression.
-     */
-    subflowStart(data: any, options?: StepOptions): void;
-    /**
-     * Capture values initialized by the application after constructing this operation, without
-     * dispatching DOM input events. Call immediately after initialization, before user editing.
-     * Each field/group emits at most one prefill per subflow start; values are never recorded.
-     */
-    capturePrefill(): void;
-    private captureInputPrefills;
-    /**
-     * @deprecated `subflow_trigger` will be removed in the next major version.
-     */
-    trigger(data: SubflowTrigger, options?: StepOptions): void;
-    customStep<TStart = {}, TFinished = {}>(stepName: string): StepHelper<TStart, TFinished>;
-    protected subflowStepStarted(stepName: string, data: any, options?: StepOptions, ignoreAsInteraction?: boolean): void;
-    protected subflowStepFinished(stepName: string, data: any, options?: StepOptions): void;
-    protected subflowStepError(stepName: string, data: any, options?: ErrorStepOptions): void;
-    /**
-     * Decorate a (ceremony) step so window low-event collection follows its lifecycle: `start` arms
-     * the tracker, `finished`/`error`/`errorTyped` schedule disarming after
-     * {@link CEREMONY_LOW_EVENT_TAIL_MS}. A `start` during the tail (ceremony retry) keeps the
-     * tracker armed.
-     */
-    protected withWindowLowEvents<S extends StepHelper<never, never, never>>(step: S, windowTracker: LowEventWindowTracker): S;
-    protected defineStep<TStart = {}, TFinished = {}, TTypedError = never>(stepName: string, ignoreAsInteractionOnStart?: boolean): StepHelper<TStart, TFinished, TTypedError>;
-}
-
-/** Shared configuration for direct key signing and authority registration. */
-type KeyOperationConfig = {
-    /** Reserved for future variants; no spec types are currently defined. */
-    explicitSpecType?: undefined;
-};
-declare class KeySigningOperationFull extends OperationFull {
-    /** Resolve an eligible key and prepare the input for an actual signing attempt. */
-    readonly prepare: StepHelper;
-    /** Sign and assemble the usable signed artifact. Does not include submitting it. */
-    readonly sign: StepHelper;
-    constructor(tracker: CorbadoTracker, config?: KeyOperationConfig);
-}
-declare class KeyRegistrationOperationFull extends OperationFull {
-    /** Build the request that will establish the key's authority. */
-    readonly prepare: StepHelper;
-    /** Submit and await acceptance: finish only when the key is authorized and usable. */
-    readonly postResponse: StepHelper;
-    constructor(tracker: CorbadoTracker, config?: KeyOperationConfig);
-}
-
 type WindowCaptureContext = Pick<LowEvent, "subflowStartEventId" | "fieldRole" | "initiator"> & {
     sessionId?: string;
 };
@@ -1219,9 +963,867 @@ declare class SessionStorage implements StorageEngine {
     removeItem(key: string): void;
 }
 
-declare const INPUT_HANDOFF: unique symbol;
-declare const WEBAUTHN_PAYLOAD_HANDOFF: unique symbol;
-declare const WEBAUTHN_ERROR_HANDOFF: unique symbol;
+/**
+ * Limits for optional raw-error serialization. Modeled on Sentry's client options
+ * (`normalizeDepth`, `normalizeMaxBreadth`, `maxValueLength`, `normalizeToSize`, the
+ * stack-frame limit and the linked-errors limit) with defaults tuned for an authentication
+ * event stream rather than an error monitor. Every value is clamped to {@link RAW_ERROR_BOUNDS};
+ * invalid values fall back to the default. A fixed 1024-node budget per depth attempt and
+ * incremental text-byte accounting also bound work before the final JSON-size check.
+ */
+type SerializeRawErrorOptions = {
+    /** Include `stack` strings. Default false. */
+    stack?: boolean;
+    /** Stack lines kept after the header line when `stack` is on. Default 50 (Sentry: 50). */
+    maxStackFrames?: number;
+    /** Object nesting depth below the envelope. Default 3 (Sentry `normalizeDepth`: 3). */
+    depth?: number;
+    /** Keys per object and items per array, Map or Set. Default 30 (Sentry `normalizeMaxBreadth`: 1000). */
+    maxBreadth?: number;
+    /** Characters kept per string. Default 1024 (Sentry `maxValueLength`: 250). */
+    maxValueLength?: number;
+    /** `cause` hops followed. Default 3 (Sentry linked errors: 5, Datadog: 10). */
+    maxCauseDepth?: number;
+    /** Maximum UTF-8 JSON size in bytes. Depth is reduced until the output fits; omit diagnostics that cannot fit. Default 32768 (Sentry `normalizeToSize`: 100 KiB). */
+    maxBytes?: number;
+};
+/** Envelope produced by {@link serializeRawError}. */
+type RawErrorEnvelope = {
+    /** Class tag of the original value: `DOMException`, `Error`, `Object`, `Response`, `number`, `null`, `unserializable`, … */
+    type: string;
+    /** Bounded plain-JSON copy of the value; absent when it could not be serialized within the limits. */
+    value?: unknown;
+    /** Set when even the shallowest serialization exceeded `maxBytes`. */
+    truncated?: true;
+};
+type Limits = Required<Omit<SerializeRawErrorOptions, "stack">> & {
+    stack: boolean;
+};
+/** Inclusive bounds for every numeric limit; defaults sit inside them. */
+declare const RAW_ERROR_BOUNDS: {
+    readonly maxStackFrames: {
+        readonly min: 1;
+        readonly max: 100;
+        readonly default: 50;
+    };
+    readonly depth: {
+        readonly min: 0;
+        readonly max: 10;
+        readonly default: 3;
+    };
+    readonly maxBreadth: {
+        readonly min: 1;
+        readonly max: 1000;
+        readonly default: 30;
+    };
+    readonly maxValueLength: {
+        readonly min: 1;
+        readonly max: 10000;
+        readonly default: 1024;
+    };
+    readonly maxCauseDepth: {
+        readonly min: 0;
+        readonly max: 10;
+        readonly default: 3;
+    };
+    readonly maxBytes: {
+        readonly min: 0;
+        readonly max: 65536;
+        readonly default: 32768;
+    };
+};
+/** Resolve caller options into clamped limits. Exported for tests and integrations that want to inspect the effective values. */
+declare function resolveRawErrorLimits(options?: SerializeRawErrorOptions): Limits;
+/**
+ * Serialize an arbitrary thrown value for the `rawError` diagnostic field.
+ *
+ * Copies standard error fields and serializable own properties within the configured limits.
+ * Standard fields are read through the prototype chain so DOMException and cross-realm errors
+ * serialize. Output is plain JSON, bounded in depth, breadth, string length, cause chain and
+ * UTF-8 size, and never throws.
+ *
+ * The result is an envelope `{ type, value }`: `type` is the value's class tag (`DOMException`,
+ * `Error`, `Object`, `number`, …) and `value` is a bounded diagnostic copy. Keeping the class tag
+ * outside value preserves the library's own `type` field. When the value cannot be serialized
+ * within the limits the envelope carries `truncated: true` or the type `unserializable` and no
+ * `value`.
+ *
+ * Stacks are omitted unless `stack: true`; they carry page URLs and add the most bytes.
+ * Binary data (ArrayBuffer, typed arrays) is reported by type and length only, never by content.
+ *
+ * @param value - Original thrown value or an explicit diagnostic projection.
+ * @param options - Limits; see {@link SerializeRawErrorOptions} for defaults and {@link RAW_ERROR_BOUNDS} for clamping.
+ */
+declare function serializeRawError(value: unknown, options?: SerializeRawErrorOptions): RawErrorEnvelope | undefined;
+
+interface TrackerOptions {
+    /** All persisted SDK state and cross-tab locks are isolated by this project id. */
+    projectId: string;
+    apiBaseUrl: string;
+    apiEventPath?: string;
+    /**
+     * Per-field overrides over server config and defaults. A complete policy disables remote fetching.
+     * Data-collection switches (`pmd`) are deprecated here: use {@link TrackerOptions.fixedDataConfig}.
+     */
+    sdkConfig?: SdkReliabilityConfigOverrides;
+    /**
+     * Opt-in: fix the data-collection switches (password-manager and private-mode detection) instead of
+     * taking them from the server config or the cached `cbo_sdk_config_cache`. Batches then carry
+     * `meta.fixedData: true`. Omitted (default): unchanged, server-driven behaviour. See {@link FixedDataConfig}.
+     */
+    fixedDataConfig?: FixedDataConfig;
+    /** Config endpoint override for integrations that proxy Observe under a different path. */
+    apiConfigPath?: string;
+    storage?: "cookie" | "local";
+    cookieDomain?: string;
+    debug?: boolean;
+    logger?: Logger;
+    /** Minimum time between attaching cached device info to events. */
+    deviceInfoDebounceTime?: number;
+    /**
+     * @deprecated No effect: device info is collected with built-in deadlines (a fast snapshot within
+     * 300 ms, slower fields as a later update within 6000 ms). Still accepted so existing integrations
+     * keep compiling. It will be removed in a future release.
+     */
+    deviceInfoCollectorTimeout?: number;
+    defaultTags?: Record<string, string>;
+    /**
+     * Experiment assignments to seed at init (experiment key → variant). Merged over any persisted
+     * assignments and then attached to every event the tracker produces (see {@link CorbadoTracker.setExperiment}).
+     */
+    experiments?: Record<string, string>;
+    /**
+     * Data policy code to seed at init: a project-scoped non-negative integer (0..255) selecting a
+     * policy configured in Corbado (0 is the project default). Overlays any persisted code and is then
+     * sent as `meta.dataPolicy` on every batch (see {@link CorbadoTracker.setDataPolicy}).
+     */
+    dataPolicy?: number;
+    /**
+     * Version of the integration that drives the SDK (e.g. an autocapture bundle `"1.1.22"`), sent as
+     * `sdk.integrationVersion` on every batch so analyses can cohort sessions by integration version.
+     * At most 32 characters of `[0-9A-Za-z.+_-]`; any other value is ignored (logged in debug mode).
+     */
+    integrationVersion?: string;
+    applicationId?: string;
+    /**
+     * @deprecated The flush interval is server-controlled via the SDK reliability config
+     * (`flushIntervalMs`). This option only applies as long as no server config has been received
+     * (i.e. before the first config response is cached); once a server config is cached it wins.
+     * It will be removed in a future release.
+     */
+    flushInterval?: number;
+}
+/**
+ * Options of {@link CorbadoTrackerCore} ({@link initCore}). The same as {@link TrackerOptions}, except that
+ * optional features are selected by importing them and passing them in `plugins` instead of by option
+ * values, so a bundle that does not import a feature does not contain its code:
+ *
+ * - `storage: "cookie"` / `cookieDomain` → `plugins: [cookieStorage({ cookieDomain })]`
+ * - `fixedDataConfig.crossOriginSession` → `plugins: [crossOriginSession({ cookieDomain })]` (the core
+ *   ignores this field of `fixedDataConfig`; `pmd` and `privateMode` apply as on the full tracker)
+ * - raw-error serialization of `error(e, { rawError })` → `plugins: [rawErrors()]`
+ * - the SDK probe lane (`probe(tracker, input)`) → `plugins: [probes()]`
+ */
+interface TrackerCoreOptions extends Omit<TrackerOptions, "storage" | "cookieDomain"> {
+    /** Optional features, see {@link TrackerPlugin}. Each is installed once, in array order. */
+    plugins?: readonly TrackerPlugin[];
+}
+/**
+ * Storage engine a plugin supplies for the tracker's device-level state (device id, device info cache).
+ * @internal
+ */
+type TrackerStorageEngine = {
+    engine: StorageEngine;
+    /** Reported as the device info storage source. */
+    source: "cookie";
+};
+/**
+ * Session reconciliation a plugin adds to the tracker (the cross-origin session).
+ * @internal
+ */
+interface SessionBridge {
+    /** Resolve this load's session (at boot and on recovery); replaces the local-only resolution. */
+    resolve(): string;
+    /** Seq to allocate in `sessionId` instead of `seq` (above another origin's reservation). */
+    claim(sessionId: string, seq: number, now: number): number;
+    /** `meta.crossOriginSession` of a batch of `sessionId`. */
+    meta(sessionId: string): "adopted" | "own" | undefined;
+    /** The tracker started a new session. */
+    reset(sessionId: string): void;
+    /** The tracker is destroyed. */
+    stop(): void;
+}
+/**
+ * Optional tracker feature for {@link CorbadoTrackerCore}, created by a factory function and passed in
+ * {@link TrackerCoreOptions.plugins}: `cookieStorage()`, `crossOriginSession()`, `rawErrors()`, `probes()`.
+ *
+ * @remarks
+ * The hooks are internal; integrations only pass the objects the factories return. A failing plugin
+ * never breaks the tracker or the host page: its error is logged and the tracker continues without it.
+ * The full {@link CorbadoTracker} ({@link init}) installs every feature its options ask for, so its
+ * behaviour does not depend on plugins.
+ */
+interface TrackerPlugin {
+    /** @internal Storage engine for the device-level state (default: localStorage). */
+    readonly storage?: (logger: Logger) => TrackerStorageEngine | undefined;
+    /** @internal Session reconciliation; called once the tracker's config and storage exist. */
+    readonly session?: (tracker: CorbadoTrackerCore) => SessionBridge | undefined;
+    /** @internal Raw-error serializer behind `error(e, { rawError })` of the typed operations. */
+    readonly rawErrors?: RawErrorSerializer;
+    /** @internal Runs at the end of the constructor, once the queue exists. */
+    readonly setup?: (tracker: CorbadoTrackerCore) => void;
+}
+/** @internal Serializer of the `rawError` option of operation step errors. */
+type RawErrorSerializer = (value: unknown, options?: SerializeRawErrorOptions) => RawErrorEnvelope | undefined;
+/**
+ * The part of the tracker every integration runs: sessions, sequencing, the event queue, device info,
+ * flows, subflow steps, low events, telemetry, experiments and data policy. Created by {@link initCore}.
+ *
+ * @remarks
+ * Optional features are standalone functions that take the tracker (typed operations such as
+ * `passkeyLoginFullOperation(tracker, config)`, `setUser(tracker, user)`, `resetSession(tracker)`) or
+ * plugins passed at construction ({@link TrackerCoreOptions.plugins}), so a bundle only contains what it
+ * imports. {@link CorbadoTracker} ({@link init}) extends this class with every feature as a method.
+ *
+ * **Constructor**
+ * - If `apiBaseUrl` is non-empty and missing `http://` or `https://`: logs via `logger.critical` (does not throw).
+ * - If `apiBaseUrl` is non-empty and ends with `/`: logs via `logger.critical` (does not throw).
+ * - Session bootstrap (`resolveSessionId`): on failure logs `Failed to get session id` and continues with an empty session id (does not throw).
+ * - A plugin hook that throws: logs `Failed to install tracker plugin` and continues without it (does not throw).
+ *
+ * **Typed tracking helpers** (`flowStarted`, `flowDecided`, and the other public methods that call `track`)
+ * - Error handling for queued events is defined on {@link CorbadoTrackerCore.track}.
+ */
+declare class CorbadoTrackerCore {
+    private options;
+    private logger;
+    private queue;
+    private sessionId;
+    private storage;
+    private sessionStorage;
+    /** Dedicated localStorage engine for reliability state (config cache, outbox, continuity session, seq). */
+    private persistentStorage;
+    /** Seq/continuity Web Lock name; project-scoped together with the storage keys it guards. */
+    private readonly seqLockName;
+    /** Current resolved policy. Continuity and persistence stay enabled once activated within a document. */
+    private config;
+    private readonly configManager?;
+    private readonly configOverrides;
+    /** Resolved `fixedDataConfig`; undefined when not given (server-driven data switches). */
+    private readonly fixedData?;
+    private deviceInfoManager;
+    private deviceCollector;
+    /**
+     * Cached per-tab id stamped onto every event's meta (see {@link EventMeta.tabId}). Resolved
+     * lazily from the collector's sessionStorage-backed id; stable for the whole page lifetime.
+     */
+    private eventTabId?;
+    private seq;
+    /**
+     * When the continuity record's `lastActiveAt` was last persisted. Throttles that write inside the
+     * seq critical section (see {@link SESSION_ACTIVITY_WRITE_INTERVAL_MS}). 0 = not written yet on
+     * this load, so the first allocation always persists.
+     */
+    private lastActivityWriteAt;
+    /** Persistent experiment assignments (experiment key → variant), attached to every produced event. */
+    private experiments;
+    /**
+     * Persistent data policy code, stamped into every batch's `meta.dataPolicy` once set. Never
+     * cleared (only overwritten): it survives reloads, session rotation, resetSession and destroy.
+     */
+    private dataPolicy?;
+    /** Self-instrumentation state: re-entrancy guard, readiness, per-load dedupe, and pre-queue buffer. */
+    private telemetryReporting;
+    private telemetryReady;
+    private readonly reportedTelemetryKeys;
+    private pendingSelfTelemetry;
+    private windowObserver?;
+    private passwordManagerSampler?;
+    /** Session reconciliation of a plugin (the cross-origin session); undefined when none is installed. */
+    private bridge?;
+    /** Raw-error serializer of a plugin; undefined = operation step errors drop `rawError`. */
+    private rawErrors?;
+    /** @internal Shared passive page observation and per-operation context registration. */
+    getWindowObserver(): SharedWindowObserver;
+    /**
+     * @param options - Tracker options; `options.plugins` selects the optional features.
+     * @param plugins - Plugins installed before `options.plugins` (used by {@link CorbadoTracker}).
+     */
+    constructor(options: TrackerCoreOptions, plugins?: readonly TrackerPlugin[]);
+    /** Runs `install` per plugin; a missing or throwing plugin is logged and skipped (never throws). */
+    private eachPlugin;
+    /**
+     * Whether this tracker is the full {@link CorbadoTracker} (created by {@link init} or its constructor).
+     * @internal
+     */
+    isFullTracker(): this is CorbadoTracker;
+    /** Apply init overrides on every refresh; continuity and persistence only activate within a document. */
+    private handleConfig;
+    /**
+     * Returns the logger used by this tracker.
+     * @internal
+     */
+    getLogger(): Logger;
+    private applicationTag;
+    /**
+     * Register several experiment assignments at once (experiment key → variant). Additive: existing
+     * assignments for other keys are kept. See {@link CorbadoTracker.setExperiment}.
+     *
+     * Never throws: invalid input is ignored with a debug log.
+     */
+    setExperiments(assignments: Record<string, string>): void;
+    /** Returns a copy of the currently active experiment assignments. */
+    getExperiments(): Record<string, string>;
+    /**
+     * Returns the currently active public SDK configuration, including live updates.
+     *
+     * @returns A frozen snapshot, created fresh on every call.
+     */
+    /** @internal Project-scoped localStorage used by operation helpers (e.g. email-link continuity). */
+    getPersistentStorage(): StorageEngine | undefined;
+    getSdkConfig(): ObserveSdkConfigSnapshot;
+    /**
+     * Set the data policy code for this tracker (e.g. `setDataPolicy(1)` once the user agreed to
+     * extended processing; `setDataPolicy(0)` to return to the project default). Codes are
+     * project-scoped non-negative integers (0..255) selecting a policy configured in Corbado; they
+     * carry no ordering.
+     *
+     * The code is persisted (localStorage, project-scoped) and sent as `meta.dataPolicy` on every
+     * subsequent batch, across reloads and session rotation. It is never cleared, only overwritten.
+     * The server records the latest code it receives for a session (last write wins). Invalid codes
+     * are ignored with a debug log; never throws.
+     */
+    setDataPolicy(code: number): void;
+    /** Returns the current data policy code, or undefined when none has ever been set. */
+    getDataPolicy(): number | undefined;
+    private static isValidDataPolicy;
+    private loadPersistedDataPolicy;
+    private persistDataPolicy;
+    private static isValidExperimentKey;
+    private static isValidExperimentVariant;
+    private loadPersistedExperiments;
+    private persistExperiments;
+    /**
+     * Resolves the experiments to attach to one event: the persistent assignments with any per-call
+     * override merged on top. Returns undefined when there are none (so the field is omitted).
+     */
+    private resolveExperiments;
+    private isTrackingBlocked;
+    /**
+     * Resolve the session of this load: locally ({@link resolveSessionId}), or through the session bridge
+     * of a plugin (cross-origin session) when one is installed. Used at boot and by the recovery in
+     * `getSessionId`.
+     */
+    private resolveSession;
+    private resolveSessionId;
+    /**
+     * Resolve the session id from localStorage so it survives reloads and is shared across tabs of the
+     * same browser. Rotates after `config.sessionInactivityMs` of inactivity (server-controlled,
+     * evaluated at boot), resetting the seq counter.
+     *
+     * Inactivity rotation happens at boot only, here and on the per-tab path {@link resolveSessionId}
+     * takes without continuity. Boot is chosen on an assumption, not a guarantee: that a load
+     * re-announces its flow, so the fresh session id gets a classifiable flow. That holds where a
+     * flow is opened per load. Where one is opened once and carried across loads it does not, and a
+     * boot rotation splits that flow — such a project needs a window long enough to span the journey.
+     * Mid-page the assumption is not even available: nothing re-announces between two tracked events,
+     * so rotating there would leave the started flow unfinished in the old session and the remaining
+     * events without a flow start in the new one — one gap counted as a drop-off, one completion
+     * counted as nothing. `nextSeq` therefore never rotates on inactivity, on either path.
+     */
+    private getContinuitySessionId;
+    /**
+     * Persist the continuity record and remember when, so the throttled refresh in the seq critical
+     * section measures from the last write that actually happened — whoever made it.
+     */
+    private persistContinuitySession;
+    /**
+     * Read the per-tab session record. A bare string is the format that predates dating: it carries no
+     * `lastActiveAt`, so its window can only start on the load that reads it. That load rewrites it in
+     * the dated shape, so a tab converts once and ages normally from then on, and the case drains as
+     * the rollout replaces the bundles that write it.
+     */
+    private readPerTabSession;
+    /**
+     * Persist the per-tab record and remember when, sharing the throttle bookkeeping with the
+     * continuity record — a load resolves its session on one path or the other, never both.
+     *
+     * An explicit timeout override or server config stamps the window. Otherwise carry forward what
+     * the tab already knows, so a defaults boot does not replace a previously configured threshold.
+     */
+    private persistPerTabSession;
+    /** Explicit init timeout wins; otherwise retain the window a prior configured load recorded. */
+    private perTabInactivityMs;
+    /**
+     * Return the next sequence number. With session continuity the counter is persisted so ordering
+     * survives reloads/redirects; the read-increment-write runs under a cross-tab Web Lock
+     * ({@link SEQ_LOCK_NAME}) so two tabs sharing the session cannot allocate the same seq (where Web
+     * Locks are unavailable or exceed the configured timeout it degrades to the historical best-effort merge).
+     * Lock grants are FIFO, so seq order matches `track()` call order within a tab. Tracking also keeps the
+     * continuity session's `lastActiveAt` fresh (throttled, see {@link SESSION_ACTIVITY_WRITE_INTERVAL_MS}),
+     * so the window the NEXT boot evaluates measures real user
+     * inactivity instead of time-since-page-load (a long-lived active tab must not rotate the session
+     * on the next reload). It never rotates the session itself: the inactivity window is evaluated at
+     * boot only ({@link getContinuitySessionId} documents why). Consequence: while a page is never
+     * reloaded — foreground idle, bfcache restore, long-lived SPA tab — a session can outlive
+     * `sessionInactivityMs`. That inflates flow durations but keeps flow counts correct, which is the
+     * better half of the trade. An empty store while this load already has a session id means
+     * persistence is failing (or was cleared); the in-memory id is reused then — never re-minted — so
+     * a broken store degrades to one session per page load instead of one session per event.
+     */
+    private nextSeq;
+    private resolveTrackingSourcePath;
+    /**
+     * Per-tab id for event meta, cached after the first successful resolution: the id is
+     * sessionStorage-backed and stable for the whole page lifetime.
+     */
+    private resolveEventTabId;
+    /** @internal */
+    trackSubflowStarted(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions, eventId?: string): void;
+    /** @internal */
+    trackSubflowTrigger(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions): void;
+    /** @internal */
+    trackSubflowStepStarted(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions, ignoreAsInteraction?: boolean): void;
+    /** @internal */
+    trackSubflowStepFinished(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions): void;
+    /** @internal */
+    trackSubflowStepError(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions): void;
+    /**
+     * Error situations:
+     *  - Blocked user agent (see `isBlockedUserAgent`): skip with a debug log and return
+     *  - Any error before the event is enqueued (e.g. `JSON.stringify` in debug logging, `queue.enqueue`): log `Failed to process event "<name>" before enqueue`
+     *
+     * @internal
+     */
+    track(name: AuthEventName, data: Record<string, any>, userReference?: UserReference, tags?: Record<string, string>, contexts?: Record<string, any>, explicitTimestamp?: number, experiments?: Record<string, string>, capture?: {
+        id?: string;
+        subflowStartEventId?: string;
+        sessionId?: string;
+        initiator?: StepOptions["initiator"];
+    }): Promise<void>;
+    /**
+     * Track when an authentication flow (or flow selection screen) becomes visible.
+     *
+     * @remarks
+     * Call this once when the user first enters an auth touchpoint (for example account login,
+     * checkout login, or account recovery). If users can choose between multiple flows
+     * (such as login vs signup), pass `flowNames` and optionally `defaultFlowName`.
+     *
+     * The returned handle can attach identity after completion with `await flow.enrich({ userId })`.
+     * Enrichment requires a backend supporting explicit event targeting.
+     *
+     * @param data - Flow metadata, including one flow (`flowName`) or multiple candidates (`flowNames`).
+     * @param tags - Optional key-value tags for filtering and segmentation.
+     * @param experiments - Optional per-call experiment overrides.
+     * @param contexts - Optional structured event context (e.g. technical metadata that is not an
+     *   analytical dimension). Written to the event's `contexts` field verbatim.
+     * @param options - Optional `explicitTimestamp` (epoch ms) when the flow became visible earlier than
+     *   this call, e.g. because an integration confirms a screen only after it stayed up for a while.
+     *
+     * @example
+     * ```typescript
+     * tracker.flowStarted({
+     *   flowNames: ["login", "signup"],
+     *   defaultFlowName: "login",
+     *   touchpoint: "account",
+     * });
+     * ```
+     */
+    flowStarted(data: FlowStarted | MultiFlowStarted, tags?: Record<string, string>, experiments?: Record<string, string>, contexts?: Record<string, unknown>, options?: Pick<StepOptions, "explicitTimestamp">): FlowHandle;
+    /**
+     * Track when the user commits to a specific flow.
+     *
+     * @remarks
+     * Use this after presenting alternatives and once you know which path the user takes
+     * (for example when identifier checks route to login vs signup).
+     *
+     * @param data - Selected flow name.
+     * @param tags - Optional key-value tags for filtering and segmentation.
+     *
+     * @example
+     * ```typescript
+     * tracker.flowDecided({flowName: "signup"});
+     * ```
+     */
+    flowDecided(data: FlowDecided, tags?: Record<string, string>, experiments?: Record<string, string>): void;
+    /**
+     * Track when a flow successfully completes.
+     *
+     * @remarks
+     * Fire this when the user has finished the target flow end-to-end, such as completed login,
+     * signup, or recovery. Record identity with `setUser()` while the flow is active,
+     * or enrich it after completion through the handle returned by `flowStarted()` or by this call.
+     *
+     * The returned handle targets the flow this event finished, so identity learned only after
+     * completion — for example from a profile request that follows account creation — can be
+     * attached with `await finished.enrich({ userId })` even on a page that never saw the flow start.
+     * Enrichment requires a backend supporting explicit flow-event targeting.
+     *
+     * Legacy identity fields in `data` remain supported but are deprecated.
+     *
+     * @param data - Finished flow name, optional explicit outcome, and deprecated user reference fields.
+     * @param tags - Optional key-value tags for filtering and segmentation.
+     *
+     * @example
+     * ```typescript
+     * const finished = tracker.flowFinished({ flowName: "signup" });
+     * const userId = await hashUserId(createdAccountId);
+     * await finished.enrich({ userId });
+     * ```
+     */
+    flowFinished(data: FlowFinished, tags?: Record<string, string>, experiments?: Record<string, string>): FlowHandle;
+    /** Emits `flow_enriched` against an explicit target, in the session that emitted the target. */
+    private flowHandle;
+    /**
+     * Track when an in-progress flow is reset and restarted.
+     *
+     * @remarks
+     * Use this when users abandon the current path and return to the beginning of the same flow,
+     * for example after switching account/identifier and reopening the first step.
+     *
+     * @param data - Flow name being reset.
+     * @param tags - Optional key-value tags for filtering and segmentation.
+     *
+     * @example
+     * ```typescript
+     * tracker.flowReset({flowName: "login"});
+     * ```
+     */
+    flowReset(data: FlowReset | MultiFlowReset, tags?: Record<string, string>, experiments?: Record<string, string>): void;
+    /**
+     * Track when a flow is considered finished because another flow finished it implicitly.
+     *
+     * @remarks
+     * Use this for automatic completions where no separate explicit finish action happens in the
+     * current flow. Set `flowName` to the auto-finished flow and `finishedByFlowName` to the flow
+     * that caused it. Record identity with `setUser()` while the intended flow is still
+     * current, before it is auto-finished.
+     *
+     * Legacy identity fields in `data` remain supported but are deprecated.
+     *
+     * @param data - Auto-finished flow, finishing flow, and deprecated user reference fields.
+     * @param tags - Optional key-value tags for filtering and segmentation.
+     *
+     * @example
+     * ```typescript
+     * tracker.flowAutoFinished({
+     *   flowName: "signup",
+     *   finishedByFlowName: "login",
+     * });
+     * ```
+     */
+    flowAutoFinished(data: FlowAutoFinished, tags?: Record<string, string>, experiments?: Record<string, string>): void;
+    /**
+     * Track when you present authentication method choices to the user.
+     *
+     * @remarks
+     * Use this whenever a decision point is shown with a concrete method set, such as
+     * identifier entry options (`d1`) or post-identifier options (`d3`). Set
+     * `explicitDecisionValue` when the options are re-offered after a user action and you want
+     * to capture what triggered that transition.
+     *
+     * @param data - Decision identifier, offered options, and optional transition reason.
+     * @param tags - Optional key-value tags for filtering and segmentation.
+     * @param experiments - Optional per-call experiment assignments.
+     * @param options - Optional explicit event timestamp.
+     *
+     * @example
+     * ```typescript
+     * tracker.authMethodsDecisionStarted({
+     *   decisionName: "d3",
+     *   options: ["passkey", "social-google", "password", "reset-flow"],
+     * });
+     * ```
+     */
+    authMethodsDecisionStarted(data: AuthMethodDecisionStarted, tags?: Record<string, string>, experiments?: Record<string, string>, options?: Pick<StepOptions, "explicitTimestamp">): void;
+    authMethodsDecisionFinished(data: AuthMethodDecisionFinished, tags?: Record<string, string>, experiments?: Record<string, string>): void;
+    /**
+     * Enqueue a "low" event (granular DOM/window/visualviewport/PWM signal) for the current session.
+     *
+     * @remarks
+     * Low events are sent in the `lows` array of the events endpoint payload, alongside any
+     * pending typed events. Blocked user agents are skipped silently.
+     *
+     * @internal
+     */
+    enqueueLowEvent(low: LowEvent, capturedSessionId?: string): void;
+    /**
+     * Record a diagnostic telemetry entry (a `level` + free-form `message`) for the current session.
+     *
+     * @remarks
+     * Telemetry is delivered in the `telemetry` array of the events endpoint payload, tied to the same
+     * session, and is never classified as an auth-flow event. By default a telemetry entry piggybacks
+     * the next normal flush (it does not trigger one on its own); this is server-controlled. Collection
+     * can be turned off server-side via the `telemetry` config flag. Blocked user agents are skipped.
+     *
+     * The message is truncated to {@link TELEMETRY_MESSAGE_MAX} characters. Never pass credentials or
+     * PII — telemetry is for diagnostics only. Like all SDK entry points, this never throws.
+     */
+    telemetry(level: TelemetryLevel, message: string): void;
+    /**
+     * Queue hook run right before an event batch is sent: a device info snapshot that no event carried
+     * yet (typically the fast snapshot after a burst of events at page load, or the privateMode update)
+     * rides the first event of this page in the batch that has none. Events of other pages (outbox
+     * replays) are never touched. A snapshot no event can carry goes as the batch's request-level device
+     * info instead (queue option `standaloneDeviceInfo`).
+     *
+     * Error situations:
+     *  - Any error: log "Failed to attach device info to batch" and send the batch unchanged
+     */
+    private attachUndeliveredDeviceInfo;
+    /**
+     * Escalate an internal SDK diagnostic to the telemetry stream (self-instrumentation). This is the
+     * sink behind {@link Logger.reportTelemetry}; chosen internal failure sites route here so faults
+     * that are otherwise only visible with `debug: true` become observable in the field.
+     *
+     * @remarks
+     * Bounded and deduped per load (a persistent fault — blocked storage, a downed endpoint — cannot
+     * flood the stream), re-entrancy-guarded so it can never recurse, and it never throws into the
+     * host. Diagnostics raised before the queue exists (early boot) are buffered and replayed once the
+     * queue is ready. Messages must be stable and low-cardinality (no raw error objects / PII).
+     */
+    private reportTelemetry;
+    /**
+     * Synchronously flush any pending events and low events via beacon. Use during page-unload
+     * style teardown where async flushing is unreliable.
+     *
+     * @param reason What triggered the flush; recorded as `meta.flushReason` on the batch. Defaults
+     * to a direct call by the host app.
+     *
+     * @internal
+     */
+    flushKeepalive(reason?: FlushReason): void;
+    /**
+     * Keepalive flush requested by a low-event tracker's `pagehide` teardown. Gated by the
+     * server-controlled trigger switch `tlf` (boot-snapshot, default true = historical behavior):
+     * disabling it server-side makes low-event delivery rely solely on the queue's own triggers.
+     *
+     * @internal
+     */
+    lowEventFlushKeepalive(): void;
+    /**
+     * Flush any pending events and release all resources (timers, event listeners).
+     *
+     * @remarks
+     * After calling destroy, the tracker must not be used. Operation objects
+     * returned by factory methods (e.g. `passwordLoginFullOperation`) that hold
+     * DOM references must be destroyed separately by the caller.
+     * The final flush is gated by the server-controlled trigger switch `td` (default true);
+     * resources are released either way.
+     */
+    destroy(): Promise<void>;
+    /**
+     * Return the Observe session id this tracker is currently reporting under.
+     *
+     * @remarks
+     * Use this to route a server-side event into the same session the browser reports to: read the id,
+     * pass it to your own backend, and let the backend use it as the `sessionID` of its ingest call.
+     * Reading it here is the supported path — the storage layout behind it is an implementation detail
+     * that has already changed once (per-tab `sessionStorage` to the cross-tab continuity record).
+     *
+     * The value is **not stable for the lifetime of the page**. It changes on
+     * {@link CorbadoTracker.resetSession}, when this tab adopts a continuity session another tab
+     * rotated to, and when a failed bootstrap recovers. Read it at the moment you need it; never cache
+     * it across a request.
+     *
+     * `undefined` means no session id could be established at all — an environment without Web Crypto,
+     * where tracking is not working either. Skip the server-side event instead of sending an empty id:
+     * the ingest API requires a UUID and would reject the batch.
+     *
+     * @returns The current session id, or `undefined` if none could be established.
+     *
+     * @example
+     * ```typescript
+     * const sessionId = tracker.getSessionId();
+     * if (sessionId) {
+     *   await fetch("/api/checkout", {
+     *     method: "POST",
+     *     body: JSON.stringify({ ...payload, observeSessionId: sessionId }),
+     *   });
+     * }
+     * ```
+     */
+    getSessionId(): string | undefined;
+}
+
+/**
+ * Where low events go. `flushKeepalive` is requested on `pagehide` teardown so lows batched after
+ * the queue's own lifecycle flush still get out; operations wire it to the client's
+ * `lowEventFlushKeepalive()`, which is gated by the server-controlled `tlf` trigger switch
+ * (default true = historical behavior, can be disabled remotely).
+ */
+interface LowEventSink {
+    reserveCaptureSeq?(): number;
+    enqueueLowEvent(low: LowEvent): void;
+    flushKeepalive(): void;
+    registerInputs?(fields: readonly HTMLInputElement[], flush: () => void): () => void;
+    beginCeremony?(initiator?: LowEventInitiator): {
+        settle(tailMs: number): void;
+        destroy(): void;
+    };
+}
+
+/** Ceremony context lease on the shared observer. Never installs its own window listeners. */
+declare class LowEventWindowTracker {
+    private logger;
+    private sink;
+    private lease?;
+    private destroyed;
+    constructor(logger: Logger, sink: LowEventSink);
+    arm(initiator?: LowEventInitiator, conditional?: boolean): void;
+    scheduleDisarm(delayMs: number): void;
+    disarm(): void;
+    destroy(): void;
+}
+
+/**
+ * How long window low-event listeners stay armed after a ceremony settles: focus return and
+ * picker dismiss animations land shortly after the WebAuthn promise resolves/rejects.
+ */
+declare const CEREMONY_LOW_EVENT_TAIL_MS = 1500;
+/**
+ * Optional diagnostic context for both normal and typed step errors.
+ *
+ * Use `rawError` when a library error contains useful context beyond its classified name,
+ * code and message, such as a nested cause, an error array or a response status.
+ * Serialization requires SDK config `rawErrors: true` (default true). Config refreshes apply
+ * to subsequent errors; diagnostics already queued are unchanged.
+ * It is emitted as a bounded `{ type, value }` envelope in `stepData.rawError` for raw-event
+ * inspection. The envelope type describes the JavaScript value; the library's own fields
+ * stay inside value. See {@link serializeRawError} for serialization limits.
+ *
+ * @remarks
+ * The first argument to `.error()` or `.errorTyped()` supplies the classified diagnostic.
+ * `rawError` does not fill missing classified fields or affect outcomes, error-group assignment
+ * or severity: a code-only typed error remains code-only even if its raw diagnostic has a name
+ * and message. Existing StepOptions such as userReference and explicitTimestamp can accompany
+ * rawError; calls without it behave as before.
+ *
+ * Supply a deliberate diagnostic object without credentials, cookies or personal data.
+ * Arrays retain their structure in rawError; arrays passed directly to `.error()` become a
+ * string message. Keep the original error for application handling; serialization makes a copy.
+ *
+ * @example
+ * ```ts
+ * // Normal error with additional provider context.
+ * passkey.ceremony.error(originalError, { rawError: providerDiagnostic });
+ *
+ * // Typed error with the original error available for inspection.
+ * password.postResponse.errorTyped(
+ *   { code: "invalid_password" },
+ *   { rawError: originalError },
+ * );
+ *
+ * // A classified code and message plus additional raw context.
+ * password.postResponse.error(
+ *   { code: "invalid_password", name: "AuthenticationError", message: "The password was rejected" },
+ *   { rawError: providerDiagnostic },
+ * );
+ * ```
+ */
+type ErrorStepOptions = StepOptions & {
+    /** Explicit opt-in. Serialized with bounded depth and UTF-8 size; stacks are omitted by default and binary contents are summarized. */
+    rawError?: unknown;
+    /** Per-call limits for `rawError` serialization (depth, breadth, string length, cause chain, bytes, stack). See {@link SerializeRawErrorOptions}. */
+    rawErrorLimits?: SerializeRawErrorOptions;
+};
+type StepHelper<TStart = {}, TFinished = {}, TTypedError = never> = {
+    start: (data: TStart, options?: StepOptions) => void;
+    finished: (data: TFinished, options?: StepOptions) => void;
+    error: (error: unknown, options?: ErrorStepOptions) => void;
+} & ([TTypedError] extends [never] ? {} : {
+    errorTyped: (error: TTypedError, options?: ErrorStepOptions) => void;
+});
+declare abstract class OperationFull {
+    private tracker;
+    private operationName;
+    private startReference?;
+    private captureSpecType?;
+    private captureSessionId?;
+    private readonly lowFlushers;
+    private readonly lowPrefillCapturers;
+    protected lowEventSink(sourceKind: LowEventSourceKind, fieldRole?: LowEventFieldRole): LowEventSink;
+    protected createLowCollector<T extends {
+        capturePrefill(newCapture?: boolean): void;
+    }>(create: () => T): T | undefined;
+    protected registerLowFlusher(flush: () => void): void;
+    private captureOptions;
+    constructor(tracker: CorbadoTrackerCore, operationName: SubflowType);
+    /** Anchor (subflowStartEventId) of the current start; undefined before the first start. */
+    protected get captureReference(): string | undefined;
+    /** Session the current start was tracked under. */
+    protected get captureSession(): string | undefined;
+    /**
+     * Continue an attempt started elsewhere (e.g. on another page of the same session) without
+     * emitting a subflow_started: later steps and low events carry the given anchor and session.
+     */
+    protected adoptCapture(reference: string, sessionId: string, specType?: string): void;
+    /**
+     * Emits an additional subflow_started; construction already emits the initial start.
+     * `data` supports SubflowTrigger fields (`actor`, `explicitSpecType`, `ignoreAsInteraction`)
+     * plus free-form extras; see SubflowTrigger for programmatic interaction suppression.
+     */
+    subflowStart(data: any, options?: StepOptions): void;
+    /**
+     * Capture values initialized by the application after constructing this operation, without
+     * dispatching DOM input events. Call immediately after initialization, before user editing.
+     * Each field/group emits at most one prefill per subflow start; values are never recorded.
+     */
+    capturePrefill(): void;
+    private captureInputPrefills;
+    /**
+     * @deprecated `subflow_trigger` will be removed in the next major version.
+     */
+    trigger(data: SubflowTrigger, options?: StepOptions): void;
+    customStep<TStart = {}, TFinished = {}>(stepName: string): StepHelper<TStart, TFinished>;
+    protected subflowStepStarted(stepName: string, data: any, options?: StepOptions, ignoreAsInteraction?: boolean): void;
+    protected subflowStepFinished(stepName: string, data: any, options?: StepOptions): void;
+    protected subflowStepError(stepName: string, data: any, options?: ErrorStepOptions): void;
+    /**
+     * Decorate a (ceremony) step so window low-event collection follows its lifecycle: `start` arms
+     * the tracker, `finished`/`error`/`errorTyped` schedule disarming after
+     * {@link CEREMONY_LOW_EVENT_TAIL_MS}. A `start` during the tail (ceremony retry) keeps the
+     * tracker armed.
+     */
+    protected withWindowLowEvents<S extends StepHelper<never, never, never>>(step: S, windowTracker: LowEventWindowTracker): S;
+    protected defineStep<TStart = {}, TFinished = {}, TTypedError = never>(stepName: string, ignoreAsInteractionOnStart?: boolean): StepHelper<TStart, TFinished, TTypedError>;
+}
+
+/** Shared configuration for direct key signing and authority registration. */
+type KeyOperationConfig = {
+    /** Reserved for future variants; no spec types are currently defined. */
+    explicitSpecType?: undefined;
+};
+declare class KeySigningOperationFull extends OperationFull {
+    /** Resolve an eligible key and prepare the input for an actual signing attempt. */
+    readonly prepare: StepHelper;
+    /** Sign and assemble the usable signed artifact. Does not include submitting it. */
+    readonly sign: StepHelper;
+    constructor(tracker: CorbadoTrackerCore, config?: KeyOperationConfig);
+}
+declare class KeyRegistrationOperationFull extends OperationFull {
+    /** Build the request that will establish the key's authority. */
+    readonly prepare: StepHelper;
+    /** Submit and await acceptance: finish only when the key is authorized and usable. */
+    readonly postResponse: StepHelper;
+    constructor(tracker: CorbadoTrackerCore, config?: KeyOperationConfig);
+}
+/**
+ * Create a {@link KeySigningOperationFull} for `tracker`: the standalone form of `CorbadoTracker.keySigningOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function keySigningOperationFull(tracker: CorbadoTrackerCore, config?: KeyOperationConfig): KeySigningOperationFull;
+/**
+ * Create a {@link KeyRegistrationOperationFull} for `tracker`: the standalone form of `CorbadoTracker.keyRegistrationOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function keyRegistrationOperationFull(tracker: CorbadoTrackerCore, config?: KeyOperationConfig): KeyRegistrationOperationFull;
+
+declare const INPUT_HANDOFF: unique symbol;
+declare const WEBAUTHN_PAYLOAD_HANDOFF: unique symbol;
+declare const WEBAUTHN_ERROR_HANDOFF: unique symbol;
 /**
  * An input element released to the SDK input tracking only (e.g. by `@corbado/autocapture`'s
  * `dom.handoff`). Opaque: it has no readable members, so project code cannot inspect the element
@@ -1315,7 +1917,7 @@ declare class PasskeyLoginOperationFull extends OperationFull {
     readonly ceremony: HandoffStepHelper<PasskeyLoginCeremonyStart, PasskeyLoginCeremonyFinished>;
     readonly postResponse: HandoffStepHelper<PasskeyLoginPostResponseStart>;
     private lowEventTracker;
-    constructor(tracker: CorbadoTracker, config?: PasskeyLoginOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: PasskeyLoginOperationConfig);
     /**
      * @deprecated `subflow_trigger` is not supported for passkey-login and will be removed in the
      * next major version.
@@ -1323,6 +1925,12 @@ declare class PasskeyLoginOperationFull extends OperationFull {
     trigger(data: SubflowTrigger, options?: StepOptions): void;
     destroy(): void;
 }
+/**
+ * Create a {@link PasskeyLoginOperationFull} for `tracker`: the standalone form of `CorbadoTracker.passkeyLoginFullOperation()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function passkeyLoginFullOperation(tracker: CorbadoTrackerCore, config?: PasskeyLoginOperationConfig): PasskeyLoginOperationFull;
 
 type EmailOTPOperationSpecType = "email-otp-login" | "email-otp-enrollment";
 type EmailOTPOperationSendOTPStart = {
@@ -1344,7 +1952,7 @@ declare class EmailOtpOperationFull extends OperationFull {
     readonly send: StepHelper<EmailOTPOperationSendOTPStart>;
     readonly postResponse: StepHelper<EmailOTPOperationPostResponseStart>;
     readonly resend: StepHelper;
-    constructor(tracker: CorbadoTracker, config?: EmailOTPOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: EmailOTPOperationConfig);
     /**
      * Rebind the ordered OTP group without starting a new subflow. An empty list detaches it.
      * Also takes opaque {@link SdkInputHandoff}s (additive overload); at runtime they are the input elements.
@@ -1353,6 +1961,13 @@ declare class EmailOtpOperationFull extends OperationFull {
     setInputFields(fields: readonly HTMLInputElement[]): void;
     destroy(): void;
 }
+/**
+ * Create a {@link EmailOtpOperationFull} for `tracker`: the standalone form of `CorbadoTracker.emailOtpOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function emailOtpOperationFull(tracker: CorbadoTrackerCore, config?: WithHandoffs<EmailOTPOperationConfig>): EmailOtpOperationFull;
+declare function emailOtpOperationFull(tracker: CorbadoTrackerCore, config?: EmailOTPOperationConfig): EmailOtpOperationFull;
 
 type SmsOTPOperationSpecType = "sms-otp-login" | "sms-otp-enrollment";
 type SmsOTPOperationPostResponseStart = {
@@ -1369,7 +1984,7 @@ declare class SmsOtpOperationFull extends OperationFull {
     readonly send: StepHelper;
     readonly postResponse: StepHelper<SmsOTPOperationPostResponseStart>;
     readonly resend: StepHelper;
-    constructor(tracker: CorbadoTracker, config?: SmsOTPOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: SmsOTPOperationConfig);
     /**
      * Rebind the ordered OTP group without starting a new subflow. An empty list detaches it.
      * Also takes opaque {@link SdkInputHandoff}s (additive overload); at runtime they are the input elements.
@@ -1378,6 +1993,13 @@ declare class SmsOtpOperationFull extends OperationFull {
     setInputFields(fields: readonly HTMLInputElement[]): void;
     destroy(): void;
 }
+/**
+ * Create a {@link SmsOtpOperationFull} for `tracker`: the standalone form of `CorbadoTracker.smsOtpOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function smsOtpOperationFull(tracker: CorbadoTrackerCore, config?: WithHandoffs<SmsOTPOperationConfig>): SmsOtpOperationFull;
+declare function smsOtpOperationFull(tracker: CorbadoTrackerCore, config?: SmsOTPOperationConfig): SmsOtpOperationFull;
 
 type EmailLinkOperationSpecType = "email-link-login" | "email-link-enrollment";
 type EmailLinkOperationSendStart = {
@@ -1416,7 +2038,7 @@ declare class EmailLinkOperationFull extends OperationFull {
     readonly resend: StepHelper;
     /** Transaction ID of this email link; hand it to the page that continues it. */
     readonly transactionId: string;
-    constructor(tracker: CorbadoTracker, config?: EmailLinkOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: EmailLinkOperationConfig);
 }
 /**
  * Page 2 of an email-link journey (the link's target): continues the `email-link` subflow started
@@ -1442,7 +2064,7 @@ declare class EmailLinkContinuationOperation extends OperationFull {
     private deferred;
     private readonly onPageHide;
     private removePageHide?;
-    constructor(tracker: CorbadoTracker, config?: EmailLinkContinuationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: EmailLinkContinuationConfig);
     /** Transaction ID of the continued email link, when known. */
     get transactionId(): string | undefined;
     /**
@@ -1461,6 +2083,18 @@ declare class EmailLinkContinuationOperation extends OperationFull {
     /** Defer step calls until the detached start is emitted; mark the continued link on completion. */
     private deferrable;
 }
+/**
+ * Create a {@link EmailLinkOperationFull} for `tracker`: the standalone form of `CorbadoTracker.emailLinkOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function emailLinkOperationFull(tracker: CorbadoTrackerCore, config?: EmailLinkOperationConfig): EmailLinkOperationFull;
+/**
+ * Create a {@link EmailLinkContinuationOperation} for `tracker`: the standalone form of `CorbadoTracker.continueEmailLinkOperation()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function continueEmailLinkOperation(tracker: CorbadoTrackerCore, config?: EmailLinkContinuationConfig): EmailLinkContinuationOperation;
 
 /**
  * Passkey-enrollment spec types. Two vocabularies coexist:
@@ -1516,9 +2150,15 @@ declare class PasskeyEnrollmentOperationFull extends OperationFull {
     readonly ceremony: HandoffStepHelper<PasskeyEnrollmentCeremonyStart, PasskeyEnrollmentCeremonyFinished>;
     readonly postResponse: HandoffStepHelper<PasskeyEnrollmentPostResponseStart>;
     private lowEventTracker;
-    constructor(tracker: CorbadoTracker, config?: PasskeyEnrollmentOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: PasskeyEnrollmentOperationConfig);
     destroy(): void;
 }
+/**
+ * Create a {@link PasskeyEnrollmentOperationFull} for `tracker`: the standalone form of `CorbadoTracker.passkeyEnrollmentFullOperation()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function passkeyEnrollmentFullOperation(tracker: CorbadoTrackerCore, config?: PasskeyEnrollmentOperationConfig): PasskeyEnrollmentOperationFull;
 
 /** The user dismissed the confirmation dialog without confirming the deletion. */
 type PasskeyDeletionUserConfirmationTypedError = {
@@ -1535,8 +2175,14 @@ declare class PasskeyDeletionOperationFull extends OperationFull {
     readonly userConfirmation: StepHelper<{}, {}, PasskeyDeletionUserConfirmationTypedError>;
     /** The deletion request: finish only when the passkey was actually deleted. */
     readonly deletion: StepHelper<{}, {}, PasskeyDeletionDeletionTypedError>;
-    constructor(tracker: CorbadoTracker, _config?: PasskeyDeletionOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, _config?: PasskeyDeletionOperationConfig);
 }
+/**
+ * Create a {@link PasskeyDeletionOperationFull} for `tracker`: the standalone form of `CorbadoTracker.passkeyDeletionOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function passkeyDeletionOperationFull(tracker: CorbadoTrackerCore, config?: PasskeyDeletionOperationConfig): PasskeyDeletionOperationFull;
 
 type PasswordLoginTypedError = {
     code: PasswordLoginTypedErrorCode;
@@ -1588,7 +2234,7 @@ declare class PasswordLoginOperationFull extends OperationFull {
     };
     private lowEventTracker?;
     private identifierLowEventTracker?;
-    constructor(tracker: CorbadoTracker, config?: PasswordLoginConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: PasswordLoginConfig);
     /**
      * @deprecated `subflow_trigger` is not supported for password-login and will be removed in the
      * next major version.
@@ -1596,6 +2242,13 @@ declare class PasswordLoginOperationFull extends OperationFull {
     trigger(data: SubflowTrigger, options?: StepOptions): void;
     destroy(): void;
 }
+/**
+ * Create a {@link PasswordLoginOperationFull} for `tracker`: the standalone form of `CorbadoTracker.passwordLoginFullOperation()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function passwordLoginFullOperation(tracker: CorbadoTrackerCore, config?: WithHandoffs<PasswordLoginConfig>): PasswordLoginOperationFull;
+declare function passwordLoginFullOperation(tracker: CorbadoTrackerCore, config?: PasswordLoginConfig): PasswordLoginOperationFull;
 
 type PasswordEnrollmentTypedError = {
     code: PasswordEnrollmentTypedErrorCode;
@@ -1612,9 +2265,16 @@ declare class PasswordEnrollmentOperationFull extends OperationFull {
     readonly clientValidation: StepHelper;
     readonly postResponse: StepHelper<{}, {}, PasswordEnrollmentTypedError>;
     private lowEventTracker?;
-    constructor(tracker: CorbadoTracker, config?: PasswordEnrollmentConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: PasswordEnrollmentConfig);
     destroy(): void;
 }
+/**
+ * Create a {@link PasswordEnrollmentOperationFull} for `tracker`: the standalone form of `CorbadoTracker.passwordEnrollmentFullOperation()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function passwordEnrollmentFullOperation(tracker: CorbadoTrackerCore, config?: WithHandoffs<PasswordEnrollmentConfig>): PasswordEnrollmentOperationFull;
+declare function passwordEnrollmentFullOperation(tracker: CorbadoTrackerCore, config?: PasswordEnrollmentConfig): PasswordEnrollmentOperationFull;
 
 type PasskeyLoginCUITypedError = {
     code: PasskeyLoginCUITypedErrorCode;
@@ -1658,9 +2318,16 @@ declare class OperationFullProvideIdentifierWithCUI extends OperationFull {
         clientValidation: StepHelper;
         postResponse: StepHelper<ProvideIdentifierPostResponseStart>;
     };
-    constructor(tracker: CorbadoTracker, config?: OperationFullProvideIdentifierWithCUIConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: OperationFullProvideIdentifierWithCUIConfig);
     destroy(): void;
 }
+/**
+ * Create a {@link OperationFullProvideIdentifierWithCUI} for `tracker`: the standalone form of `CorbadoTracker.provideIdentifierOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function provideIdentifierOperationFull(tracker: CorbadoTrackerCore, config?: WithHandoffs<OperationFullProvideIdentifierWithCUIConfig>): OperationFullProvideIdentifierWithCUI;
+declare function provideIdentifierOperationFull(tracker: CorbadoTrackerCore, config?: OperationFullProvideIdentifierWithCUIConfig): OperationFullProvideIdentifierWithCUI;
 
 type SocialLoginSpecType = "pre-identifier" | "post-identifier";
 /**
@@ -1689,8 +2356,14 @@ type SocialLoginOperationConfig = {
 declare class SocialLoginOperationFull extends OperationFull {
     readonly getRedirectUrl: StepHelper<SocialLoginGetRedirectUrlStart, SocialLoginGetRedirectUrlFinished>;
     readonly exchangeCode: StepHelper<SocialLoginExchangeCodeStart, SocialLoginExchangeCodeFinished>;
-    constructor(tracker: CorbadoTracker, config?: SocialLoginOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: SocialLoginOperationConfig);
 }
+/**
+ * Create a {@link SocialLoginOperationFull} for `tracker`: the standalone form of `CorbadoTracker.socialLoginOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function socialLoginOperationFull(tracker: CorbadoTrackerCore, config?: SocialLoginOperationConfig): SocialLoginOperationFull;
 
 type SsoLoginSpecType = "pre-identifier" | "post-identifier";
 type SsoLoginGetRedirectUrlStart = {
@@ -1711,8 +2384,14 @@ type SsoLoginOperationConfig = {
 declare class SsoLoginOperationFull extends OperationFull {
     readonly getRedirectUrl: StepHelper<SsoLoginGetRedirectUrlStart, SsoLoginGetRedirectUrlFinished>;
     readonly exchangeCode: StepHelper<SsoLoginExchangeCodeStart, SsoLoginExchangeCodeFinished>;
-    constructor(tracker: CorbadoTracker, config?: SsoLoginOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: SsoLoginOperationConfig);
 }
+/**
+ * Create a {@link SsoLoginOperationFull} for `tracker`: the standalone form of `CorbadoTracker.ssoLoginOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function ssoLoginOperationFull(tracker: CorbadoTrackerCore, config?: SsoLoginOperationConfig): SsoLoginOperationFull;
 
 type TotpOperationSpecType = "totp-login" | "totp-enrollment";
 type TotpOperationPostResponseStart = {
@@ -1727,7 +2406,7 @@ type TotpOperationConfig = {
 declare class TotpOperationFull extends OperationFull {
     private lowEventTracker?;
     readonly postResponse: StepHelper<TotpOperationPostResponseStart>;
-    constructor(tracker: CorbadoTracker, config?: TotpOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: TotpOperationConfig);
     /**
      * Rebind the ordered code input group without starting a new subflow. An empty list detaches it.
      * Also takes opaque {@link SdkInputHandoff}s (additive overload); at runtime they are the input elements.
@@ -1736,6 +2415,13 @@ declare class TotpOperationFull extends OperationFull {
     setInputFields(fields: readonly HTMLInputElement[]): void;
     destroy(): void;
 }
+/**
+ * Create a {@link TotpOperationFull} for `tracker`: the standalone form of `CorbadoTracker.totpOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function totpOperationFull(tracker: CorbadoTrackerCore, config?: WithHandoffs<TotpOperationConfig>): TotpOperationFull;
+declare function totpOperationFull(tracker: CorbadoTrackerCore, config?: TotpOperationConfig): TotpOperationFull;
 
 /** How the confirmation is reached: a QR handoff, an app on the browser's device, or a push to an already-enrolled device. */
 type AppConfirmationOperationSpecType = "qr-code" | "same-device" | "push";
@@ -1755,8 +2441,14 @@ declare class AppConfirmationOperationFull extends OperationFull {
     readonly retry: StepHelper;
     /** Optional separate browser exchange after approval; omit when the final poll already proves acceptance. */
     readonly postResponse: StepHelper;
-    constructor(tracker: CorbadoTracker, config?: AppConfirmationOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: AppConfirmationOperationConfig);
 }
+/**
+ * Create a {@link AppConfirmationOperationFull} for `tracker`: the standalone form of `CorbadoTracker.appConfirmationOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function appConfirmationOperationFull(tracker: CorbadoTrackerCore, config?: AppConfirmationOperationConfig): AppConfirmationOperationFull;
 
 /**
  * Which captcha widget the integration observed.
@@ -1772,8 +2464,14 @@ declare class CaptchaOperationFull extends OperationFull {
     readonly ceremony: StepHelper;
     /** Submission of the captcha token and the server's verdict on it. */
     readonly postResponse: StepHelper;
-    constructor(tracker: CorbadoTracker, config?: CaptchaOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config?: CaptchaOperationConfig);
 }
+/**
+ * Create a {@link CaptchaOperationFull} for `tracker`: the standalone form of `CorbadoTracker.captchaOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function captchaOperationFull(tracker: CorbadoTrackerCore, config?: CaptchaOperationConfig): CaptchaOperationFull;
 
 type FormOperationConfig = {
     /**
@@ -1808,7 +2506,7 @@ declare class FormOperationFull extends OperationFull {
     /** The user leaves the form forward without submitting it. */
     readonly skip: StepHelper;
     private readonly inputBinding?;
-    constructor(tracker: CorbadoTracker, config: FormOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config: FormOperationConfig);
     /**
      * Bind the fields the form shows now, without starting a new subflow. An empty list detaches all.
      * Also takes opaque {@link SdkInputHandoff}s (additive overload); at runtime they are the input elements.
@@ -1817,6 +2515,13 @@ declare class FormOperationFull extends OperationFull {
     setInputFields(fields: readonly HTMLInputElement[]): void;
     destroy(): void;
 }
+/**
+ * Create a {@link FormOperationFull} for `tracker`: the standalone form of `CorbadoTracker.formOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function formOperationFull(tracker: CorbadoTrackerCore, config: WithHandoffs<FormOperationConfig>): FormOperationFull;
+declare function formOperationFull(tracker: CorbadoTrackerCore, config: FormOperationConfig): FormOperationFull;
 
 type TrustedDevicePurpose = "additional-verification" | "mfa-exemption";
 type TrustedDeviceStorage = "cookie" | "indexeddb" | "localstore" | "sessionstore";
@@ -1861,7 +2566,7 @@ declare class TrustedDeviceCheckOperationFull extends OperationFull {
     readonly getOptions: StepHelper<{}, TrustedDeviceCheckStepResult, TrustedDeviceCheckTypedError>;
     readonly ceremony: StepHelper<{}, TrustedDeviceCheckStepResult, TrustedDeviceCheckTypedError>;
     readonly postResponse: StepHelper<{}, TrustedDeviceCheckResult, TrustedDeviceCheckTypedError>;
-    constructor(tracker: CorbadoTracker, config: TrustedDeviceCheckConfig);
+    constructor(tracker: CorbadoTrackerCore, config: TrustedDeviceCheckConfig);
     private checkStep;
 }
 /** Finish registration/renewal after host acceptance. Explicit user opt-out reports skipped without creating a binding. */
@@ -1869,8 +2574,20 @@ declare class TrustedDeviceEnrollmentOperationFull extends OperationFull {
     readonly getOptions: StepHelper<{}, {}>;
     readonly ceremony: StepHelper<{}, {}>;
     readonly postResponse: StepHelper<{}, TrustedDeviceEnrollmentResult>;
-    constructor(tracker: CorbadoTracker, config: TrustedDeviceOperationConfig);
+    constructor(tracker: CorbadoTrackerCore, config: TrustedDeviceOperationConfig);
 }
+/**
+ * Create a {@link TrustedDeviceCheckOperationFull} for `tracker`: the standalone form of `CorbadoTracker.trustedDeviceCheckOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function trustedDeviceCheckOperationFull(tracker: CorbadoTrackerCore, config: TrustedDeviceCheckConfig): TrustedDeviceCheckOperationFull;
+/**
+ * Create a {@link TrustedDeviceEnrollmentOperationFull} for `tracker`: the standalone form of `CorbadoTracker.trustedDeviceEnrollmentOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function trustedDeviceEnrollmentOperationFull(tracker: CorbadoTrackerCore, config: TrustedDeviceOperationConfig): TrustedDeviceEnrollmentOperationFull;
 
 type ProvideDataOperationSpecType = "signup" | "login" | "recovery" | "enrollment";
 type ProvideDataOperationStart = {
@@ -1881,293 +2598,61 @@ type ProvideDataOperationStart = {
 };
 type ProvideDataOperationConfig = ProvideDataOperationStart & {
     /** The input field whose low-level interaction signals should be collected. */
-    inputHtmlField?: HTMLInputElement;
-};
-type ProvideDataOperationPostResponseStart = {
-    explicitSpecType?: ProvideDataOperationSpecType;
-};
-/** Tracks a user-triggered data submission and its server response. */
-declare class ProvideDataOperationFull extends OperationFull {
-    readonly clientValidation: StepHelper;
-    readonly postResponse: StepHelper<ProvideDataOperationPostResponseStart>;
-    private lowEventTracker?;
-    constructor(tracker: CorbadoTracker, config?: ProvideDataOperationConfig);
-    destroy(): void;
-}
-
-interface TrackerOptions {
-    /** All persisted SDK state and cross-tab locks are isolated by this project id. */
-    projectId: string;
-    apiBaseUrl: string;
-    apiEventPath?: string;
-    /**
-     * Per-field overrides over server config and defaults. A complete policy disables remote fetching.
-     * Data-collection switches (`pmd`) are deprecated here: use {@link TrackerOptions.fixedDataConfig}.
-     */
-    sdkConfig?: SdkReliabilityConfigOverrides;
-    /**
-     * Opt-in: fix the data-collection switches (password-manager and private-mode detection) instead of
-     * taking them from the server config or the cached `cbo_sdk_config_cache`. Batches then carry
-     * `meta.fixedData: true`. Omitted (default): unchanged, server-driven behaviour. See {@link FixedDataConfig}.
-     */
-    fixedDataConfig?: FixedDataConfig;
-    /** Config endpoint override for integrations that proxy Observe under a different path. */
-    apiConfigPath?: string;
-    storage?: "cookie" | "local";
-    cookieDomain?: string;
-    debug?: boolean;
-    logger?: Logger;
-    /** Minimum time between attaching cached device info to events. */
-    deviceInfoDebounceTime?: number;
-    /**
-     * @deprecated No effect: device info is collected with built-in deadlines (a fast snapshot within
-     * 300 ms, slower fields as a later update within 6000 ms). Still accepted so existing integrations
-     * keep compiling. It will be removed in a future release.
-     */
-    deviceInfoCollectorTimeout?: number;
-    defaultTags?: Record<string, string>;
-    /**
-     * Experiment assignments to seed at init (experiment key → variant). Merged over any persisted
-     * assignments and then attached to every event the tracker produces (see {@link CorbadoTracker.setExperiment}).
-     */
-    experiments?: Record<string, string>;
-    /**
-     * Data policy code to seed at init: a project-scoped non-negative integer (0..255) selecting a
-     * policy configured in Corbado (0 is the project default). Overlays any persisted code and is then
-     * sent as `meta.dataPolicy` on every batch (see {@link CorbadoTracker.setDataPolicy}).
-     */
-    dataPolicy?: number;
-    /**
-     * Version of the integration that drives the SDK (e.g. an autocapture bundle `"1.1.22"`), sent as
-     * `sdk.integrationVersion` on every batch so analyses can cohort sessions by integration version.
-     * At most 32 characters of `[0-9A-Za-z.+_-]`; any other value is ignored (logged in debug mode).
-     */
-    integrationVersion?: string;
-    applicationId?: string;
-    /**
-     * @deprecated The flush interval is server-controlled via the SDK reliability config
-     * (`flushIntervalMs`). This option only applies as long as no server config has been received
-     * (i.e. before the first config response is cached); once a server config is cached it wins.
-     * It will be removed in a future release.
-     */
-    flushInterval?: number;
-}
-declare class CorbadoTracker {
-    private options;
-    private logger;
-    private queue;
-    private sessionId;
-    private storage;
-    private sessionStorage;
-    /** Dedicated localStorage engine for reliability state (config cache, outbox, continuity session, seq). */
-    private persistentStorage;
-    /** Seq/continuity Web Lock name; project-scoped together with the storage keys it guards. */
-    private readonly seqLockName;
-    /** Current resolved policy. Continuity and persistence stay enabled once activated within a document. */
-    private config;
-    private readonly configManager?;
-    private readonly configOverrides;
-    /** Resolved `fixedDataConfig`; undefined when not given (server-driven data switches). */
-    private readonly fixedData?;
-    private deviceInfoManager;
-    private deviceCollector;
-    /**
-     * Cached per-tab id stamped onto every event's meta (see {@link EventMeta.tabId}). Resolved
-     * lazily from the collector's sessionStorage-backed id; stable for the whole page lifetime.
-     */
-    private eventTabId?;
-    private seq;
-    /**
-     * When the continuity record's `lastActiveAt` was last persisted. Throttles that write inside the
-     * seq critical section (see {@link SESSION_ACTIVITY_WRITE_INTERVAL_MS}). 0 = not written yet on
-     * this load, so the first allocation always persists.
-     */
-    private lastActivityWriteAt;
-    /** Persistent experiment assignments (experiment key → variant), attached to every produced event. */
-    private experiments;
-    /**
-     * Persistent data policy code, stamped into every batch's `meta.dataPolicy` once set. Never
-     * cleared (only overwritten): it survives reloads, session rotation, resetSession and destroy.
-     */
-    private dataPolicy?;
-    /** Self-instrumentation state: re-entrancy guard, readiness, per-load dedupe, and pre-queue buffer. */
-    private telemetryReporting;
-    private telemetryReady;
-    private readonly reportedTelemetryKeys;
-    private pendingSelfTelemetry;
-    /** Default probe page id (one per tracker instance) and the probe seq counter per page id. */
-    private probePageId?;
-    private readonly probeSeqs;
-    private windowObserver?;
-    private passwordManagerSampler?;
-    /** Cross-origin session cookie (`fixedDataConfig.crossOriginSession`); undefined when off. */
-    private crossOrigin?;
-    /** The session this load took from the cross-origin cookie, if any (`meta.crossOriginSession`). */
-    private crossOriginAdoptedId?;
-    /** @internal Shared passive page observation and per-operation context registration. */
-    getWindowObserver(): SharedWindowObserver;
-    constructor(options: TrackerOptions);
-    /** Apply init overrides on every refresh; continuity and persistence only activate within a document. */
-    private handleConfig;
-    /**
-     * Returns the logger used by this tracker.
-     * @internal
-     */
-    getLogger(): Logger;
-    private applicationTag;
-    /**
-     * Register the user's variant for an experiment (e.g. `setExperiment("button_color", "blue")`).
-     *
-     * @remarks
-     * Corbado Observe does not assign variants — your app decides, and this records the assignment so
-     * Observe can attribute flows to it. The assignment persists (localStorage) across reloads and
-     * `resetSession`, and is attached to every event the tracker produces until you change or clear it.
-     * Multiple experiments can be active at once. Set it close to where the variant actually affects the
-     * user (or use the per-call `experiments` argument on a tracking method) to avoid over-attributing
-     * exposure; call {@link clearExperiment} when it no longer applies (e.g. on logout).
-     *
-     * Never throws: invalid input is ignored with a debug log.
-     */
-    setExperiment(key: string, variant: string): void;
-    /**
-     * Register several experiment assignments at once (experiment key → variant). Additive: existing
-     * assignments for other keys are kept. See {@link setExperiment}.
-     */
-    setExperiments(assignments: Record<string, string>): void;
-    /** Remove a single experiment assignment. */
-    clearExperiment(key: string): void;
-    /** Remove all experiment assignments. */
-    clearExperiments(): void;
-    /** Returns a copy of the currently active experiment assignments. */
-    getExperiments(): Record<string, string>;
-    /**
-     * Returns the currently active public SDK configuration, including live updates.
-     *
-     * @returns A frozen snapshot, created fresh on every call.
-     */
-    /** @internal Project-scoped localStorage used by operation helpers (e.g. email-link continuity). */
-    getPersistentStorage(): StorageEngine | undefined;
-    getSdkConfig(): ObserveSdkConfigSnapshot;
-    /**
-     * Set the data policy code for this tracker (e.g. `setDataPolicy(1)` once the user agreed to
-     * extended processing; `setDataPolicy(0)` to return to the project default). Codes are
-     * project-scoped non-negative integers (0..255) selecting a policy configured in Corbado; they
-     * carry no ordering.
-     *
-     * The code is persisted (localStorage, project-scoped) and sent as `meta.dataPolicy` on every
-     * subsequent batch, across reloads and session rotation. It is never cleared, only overwritten.
-     * The server records the latest code it receives for a session (last write wins). Invalid codes
-     * are ignored with a debug log; never throws.
-     */
-    setDataPolicy(code: number): void;
-    /** Returns the current data policy code, or undefined when none has ever been set. */
-    getDataPolicy(): number | undefined;
-    private static isValidDataPolicy;
-    private loadPersistedDataPolicy;
-    private persistDataPolicy;
-    private static isValidExperimentKey;
-    private static isValidExperimentVariant;
-    private loadPersistedExperiments;
-    private persistExperiments;
-    /**
-     * Resolves the experiments to attach to one event: the persistent assignments with any per-call
-     * override merged on top. Returns undefined when there are none (so the field is omitted).
-     */
-    private resolveExperiments;
-    private isTrackingBlocked;
-    /** The cross-origin session cookie when `fixedDataConfig.crossOriginSession` is set and usable here. */
-    private createCrossOriginSession;
-    /**
-     * Last activity of the local session records BEFORE this load rewrites them (both paths, by id), so the
-     * cross-origin boot can tell a session that was active here from one this load just created.
-     */
-    private readLocalSessionActivity;
-    /**
-     * Reconcile the session this load resolved locally with the cross-origin cookie before the first event:
-     * adopt the cookie's session (and persist it locally, so reloads and same-origin tabs follow) or keep
-     * the local one, and continue the seq at or above the cookie's mark. Never throws.
-     */
-    private bootCrossOriginSession;
-    /**
-     * Resolve the session of this load: locally ({@link resolveSessionId}), then reconciled with the
-     * cross-origin cookie when that option is on. Used at boot and by the recovery in `getSessionId`.
-     */
-    private resolveSession;
-    /** `meta.crossOriginSession` of a batch of `sessionId`; undefined while the option is off on this page. */
-    private crossOriginSessionMeta;
-    private resolveSessionId;
-    /**
-     * Resolve the session id from localStorage so it survives reloads and is shared across tabs of the
-     * same browser. Rotates after `config.sessionInactivityMs` of inactivity (server-controlled,
-     * evaluated at boot), resetting the seq counter.
-     *
-     * Inactivity rotation happens at boot only, here and on the per-tab path {@link resolveSessionId}
-     * takes without continuity. Boot is chosen on an assumption, not a guarantee: that a load
-     * re-announces its flow, so the fresh session id gets a classifiable flow. That holds where a
-     * flow is opened per load. Where one is opened once and carried across loads it does not, and a
-     * boot rotation splits that flow — such a project needs a window long enough to span the journey.
-     * Mid-page the assumption is not even available: nothing re-announces between two tracked events,
-     * so rotating there would leave the started flow unfinished in the old session and the remaining
-     * events without a flow start in the new one — one gap counted as a drop-off, one completion
-     * counted as nothing. `nextSeq` therefore never rotates on inactivity, on either path.
-     */
-    private getContinuitySessionId;
-    /**
-     * Persist the continuity record and remember when, so the throttled refresh in the seq critical
-     * section measures from the last write that actually happened — whoever made it.
-     */
-    private persistContinuitySession;
-    /**
-     * Read the per-tab session record. A bare string is the format that predates dating: it carries no
-     * `lastActiveAt`, so its window can only start on the load that reads it. That load rewrites it in
-     * the dated shape, so a tab converts once and ages normally from then on, and the case drains as
-     * the rollout replaces the bundles that write it.
-     */
-    private readPerTabSession;
+    inputHtmlField?: HTMLInputElement;
+};
+type ProvideDataOperationPostResponseStart = {
+    explicitSpecType?: ProvideDataOperationSpecType;
+};
+/** Tracks a user-triggered data submission and its server response. */
+declare class ProvideDataOperationFull extends OperationFull {
+    readonly clientValidation: StepHelper;
+    readonly postResponse: StepHelper<ProvideDataOperationPostResponseStart>;
+    private lowEventTracker?;
+    constructor(tracker: CorbadoTrackerCore, config?: ProvideDataOperationConfig);
+    destroy(): void;
+}
+/**
+ * Create a {@link ProvideDataOperationFull} for `tracker`: the standalone form of `CorbadoTracker.provideDataOperationFull()`, for trackers
+ * created by `initCore()` (a bundle that does not import this function does not contain the operation).
+ * Same semantics and documentation as the method.
+ */
+declare function provideDataOperationFull(tracker: CorbadoTrackerCore, config?: WithHandoffs<ProvideDataOperationConfig>): ProvideDataOperationFull;
+declare function provideDataOperationFull(tracker: CorbadoTrackerCore, config?: ProvideDataOperationConfig): ProvideDataOperationFull;
+
+/**
+ * The full tracker created by {@link init}: {@link CorbadoTrackerCore} plus every optional feature as a
+ * method (typed operations, `setUser`, `setFlowTags`, `resetSession`, ...), and the option-driven
+ * features (`storage: "cookie"`, `fixedDataConfig.crossOriginSession`, raw-error serialization, probes)
+ * installed from its options.
+ *
+ * @remarks
+ * Each feature method delegates to the standalone function of the same name (e.g.
+ * `tracker.totpOperationFull(config)` is `totpOperationFull(tracker, config)`), so its behaviour is the
+ * same on both trackers. Integrations that care about bundle size use {@link initCore} and import the
+ * functions they call.
+ */
+declare class CorbadoTracker extends CorbadoTrackerCore {
+    constructor(options: TrackerOptions);
+    /** @internal */
+    isFullTracker(): this is CorbadoTracker;
     /**
-     * Persist the per-tab record and remember when, sharing the throttle bookkeeping with the
-     * continuity record — a load resolves its session on one path or the other, never both.
+     * Register the user's variant for an experiment (e.g. `setExperiment("button_color", "blue")`).
      *
-     * An explicit timeout override or server config stamps the window. Otherwise carry forward what
-     * the tab already knows, so a defaults boot does not replace a previously configured threshold.
-     */
-    private persistPerTabSession;
-    /** Explicit init timeout wins; otherwise retain the window a prior configured load recorded. */
-    private perTabInactivityMs;
-    /**
-     * Return the next sequence number. With session continuity the counter is persisted so ordering
-     * survives reloads/redirects; the read-increment-write runs under a cross-tab Web Lock
-     * ({@link SEQ_LOCK_NAME}) so two tabs sharing the session cannot allocate the same seq (where Web
-     * Locks are unavailable or exceed the configured timeout it degrades to the historical best-effort merge).
-     * Lock grants are FIFO, so seq order matches `track()` call order within a tab. Tracking also keeps the
-     * continuity session's `lastActiveAt` fresh (throttled, see {@link SESSION_ACTIVITY_WRITE_INTERVAL_MS}),
-     * so the window the NEXT boot evaluates measures real user
-     * inactivity instead of time-since-page-load (a long-lived active tab must not rotate the session
-     * on the next reload). It never rotates the session itself: the inactivity window is evaluated at
-     * boot only ({@link getContinuitySessionId} documents why). Consequence: while a page is never
-     * reloaded — foreground idle, bfcache restore, long-lived SPA tab — a session can outlive
-     * `sessionInactivityMs`. That inflates flow durations but keeps flow counts correct, which is the
-     * better half of the trade. An empty store while this load already has a session id means
-     * persistence is failing (or was cleared); the in-memory id is reused then — never re-minted — so
-     * a broken store degrades to one session per page load instead of one session per event.
-     */
-    private nextSeq;
-    private resolveTrackingSourcePath;
-    /**
-     * Per-tab id for event meta, cached after the first successful resolution: the id is
-     * sessionStorage-backed and stable for the whole page lifetime.
+     * @remarks
+     * Corbado Observe does not assign variants — your app decides, and this records the assignment so
+     * Observe can attribute flows to it. The assignment persists (localStorage) across reloads and
+     * `resetSession`, and is attached to every event the tracker produces until you change or clear it.
+     * Multiple experiments can be active at once. Set it close to where the variant actually affects the
+     * user (or use the per-call `experiments` argument on a tracking method) to avoid over-attributing
+     * exposure; call {@link clearExperiment} when it no longer applies (e.g. on logout).
+     *
+     * Never throws: invalid input is ignored with a debug log.
      */
-    private resolveEventTabId;
-    /** @internal */
-    trackSubflowStarted(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions, eventId?: string): void;
-    /** @internal */
-    trackSubflowTrigger(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions): void;
-    /** @internal */
-    trackSubflowStepStarted(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions, ignoreAsInteraction?: boolean): void;
-    /** @internal */
-    trackSubflowStepFinished(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions): void;
-    /** @internal */
-    trackSubflowStepError(subflowType: SubflowType, stepName: string, data: Record<string, any>, options?: StepOptions): void;
+    setExperiment(key: string, variant: string): void;
+    /** Remove a single experiment assignment. */
+    clearExperiment(key: string): void;
+    /** Remove all experiment assignments. */
+    clearExperiments(): void;
     /**
      * @remarks
      * @internal
@@ -2175,64 +2660,6 @@ declare class CorbadoTracker {
      * step errors are the intended channel; not part of a normal integration.
      */
     trackSubflowError(subflowType: SubflowType, data: Record<string, any>, options?: StepOptions): void;
-    /**
-     * Error situations:
-     *  - Blocked user agent (see `isBlockedUserAgent`): skip with a debug log and return
-     *  - Any error before the event is enqueued (e.g. `JSON.stringify` in debug logging, `queue.enqueue`): log `Failed to process event "<name>" before enqueue`
-     *
-     * @internal
-     */
-    track(name: AuthEventName, data: Record<string, any>, userReference?: UserReference, tags?: Record<string, string>, contexts?: Record<string, any>, explicitTimestamp?: number, experiments?: Record<string, string>, capture?: {
-        id?: string;
-        subflowStartEventId?: string;
-        sessionId?: string;
-        initiator?: StepOptions["initiator"];
-    }): Promise<void>;
-    /**
-     * Track when an authentication flow (or flow selection screen) becomes visible.
-     *
-     * @remarks
-     * Call this once when the user first enters an auth touchpoint (for example account login,
-     * checkout login, or account recovery). If users can choose between multiple flows
-     * (such as login vs signup), pass `flowNames` and optionally `defaultFlowName`.
-     *
-     * The returned handle can attach identity after completion with `await flow.enrich({ userId })`.
-     * Enrichment requires a backend supporting explicit event targeting.
-     *
-     * @param data - Flow metadata, including one flow (`flowName`) or multiple candidates (`flowNames`).
-     * @param tags - Optional key-value tags for filtering and segmentation.
-     * @param experiments - Optional per-call experiment overrides.
-     * @param contexts - Optional structured event context (e.g. technical metadata that is not an
-     *   analytical dimension). Written to the event's `contexts` field verbatim.
-     * @param options - Optional `explicitTimestamp` (epoch ms) when the flow became visible earlier than
-     *   this call, e.g. because an integration confirms a screen only after it stayed up for a while.
-     *
-     * @example
-     * ```typescript
-     * tracker.flowStarted({
-     *   flowNames: ["login", "signup"],
-     *   defaultFlowName: "login",
-     *   touchpoint: "account",
-     * });
-     * ```
-     */
-    flowStarted(data: FlowStarted | MultiFlowStarted, tags?: Record<string, string>, experiments?: Record<string, string>, contexts?: Record<string, unknown>, options?: Pick<StepOptions, "explicitTimestamp">): FlowHandle;
-    /**
-     * Track when the user commits to a specific flow.
-     *
-     * @remarks
-     * Use this after presenting alternatives and once you know which path the user takes
-     * (for example when identifier checks route to login vs signup).
-     *
-     * @param data - Selected flow name.
-     * @param tags - Optional key-value tags for filtering and segmentation.
-     *
-     * @example
-     * ```typescript
-     * tracker.flowDecided({flowName: "signup"});
-     * ```
-     */
-    flowDecided(data: FlowDecided, tags?: Record<string, string>, experiments?: Record<string, string>): void;
     /**
      * Track a business/marketing conversion that is not part of an authentication flow.
      *
@@ -2257,73 +2684,6 @@ declare class CorbadoTracker {
      * ```
      */
     conversion(data: Conversion, tags?: Record<string, string>, experiments?: Record<string, string>): void;
-    /**
-     * Track when a flow successfully completes.
-     *
-     * @remarks
-     * Fire this when the user has finished the target flow end-to-end, such as completed login,
-     * signup, or recovery. Record identity with `setUser()` while the flow is active,
-     * or enrich it after completion through the handle returned by `flowStarted()` or by this call.
-     *
-     * The returned handle targets the flow this event finished, so identity learned only after
-     * completion — for example from a profile request that follows account creation — can be
-     * attached with `await finished.enrich({ userId })` even on a page that never saw the flow start.
-     * Enrichment requires a backend supporting explicit flow-event targeting.
-     *
-     * Legacy identity fields in `data` remain supported but are deprecated.
-     *
-     * @param data - Finished flow name, optional explicit outcome, and deprecated user reference fields.
-     * @param tags - Optional key-value tags for filtering and segmentation.
-     *
-     * @example
-     * ```typescript
-     * const finished = tracker.flowFinished({ flowName: "signup" });
-     * const userId = await hashUserId(createdAccountId);
-     * await finished.enrich({ userId });
-     * ```
-     */
-    flowFinished(data: FlowFinished, tags?: Record<string, string>, experiments?: Record<string, string>): FlowHandle;
-    /** Emits `flow_enriched` against an explicit target, in the session that emitted the target. */
-    private flowHandle;
-    /**
-     * Track when an in-progress flow is reset and restarted.
-     *
-     * @remarks
-     * Use this when users abandon the current path and return to the beginning of the same flow,
-     * for example after switching account/identifier and reopening the first step.
-     *
-     * @param data - Flow name being reset.
-     * @param tags - Optional key-value tags for filtering and segmentation.
-     *
-     * @example
-     * ```typescript
-     * tracker.flowReset({flowName: "login"});
-     * ```
-     */
-    flowReset(data: FlowReset | MultiFlowReset, tags?: Record<string, string>, experiments?: Record<string, string>): void;
-    /**
-     * Track when a flow is considered finished because another flow finished it implicitly.
-     *
-     * @remarks
-     * Use this for automatic completions where no separate explicit finish action happens in the
-     * current flow. Set `flowName` to the auto-finished flow and `finishedByFlowName` to the flow
-     * that caused it. Record identity with `setUser()` while the intended flow is still
-     * current, before it is auto-finished.
-     *
-     * Legacy identity fields in `data` remain supported but are deprecated.
-     *
-     * @param data - Auto-finished flow, finishing flow, and deprecated user reference fields.
-     * @param tags - Optional key-value tags for filtering and segmentation.
-     *
-     * @example
-     * ```typescript
-     * tracker.flowAutoFinished({
-     *   flowName: "signup",
-     *   finishedByFlowName: "login",
-     * });
-     * ```
-     */
-    flowAutoFinished(data: FlowAutoFinished, tags?: Record<string, string>, experiments?: Record<string, string>): void;
     /**
      * Record a newly known user reference for the current active flow.
      *
@@ -2377,62 +2737,15 @@ declare class CorbadoTracker {
      */
     setFlowTags(tags: Record<string, string>, options?: SetFlowTagsOptions): void;
     /**
-     * Track when you present authentication method choices to the user.
-     *
-     * @remarks
-     * Use this whenever a decision point is shown with a concrete method set, such as
-     * identifier entry options (`d1`) or post-identifier options (`d3`). Set
-     * `explicitDecisionValue` when the options are re-offered after a user action and you want
-     * to capture what triggered that transition.
-     *
-     * @param data - Decision identifier, offered options, and optional transition reason.
-     * @param tags - Optional key-value tags for filtering and segmentation.
-     * @param experiments - Optional per-call experiment assignments.
-     * @param options - Optional explicit event timestamp.
-     *
-     * @example
-     * ```typescript
-     * tracker.authMethodsDecisionStarted({
-     *   decisionName: "d3",
-     *   options: ["passkey", "social-google", "password", "reset-flow"],
-     * });
-     * ```
-     */
-    authMethodsDecisionStarted(data: AuthMethodDecisionStarted, tags?: Record<string, string>, experiments?: Record<string, string>, options?: Pick<StepOptions, "explicitTimestamp">): void;
-    authMethodsDecisionFinished(data: AuthMethodDecisionFinished, tags?: Record<string, string>, experiments?: Record<string, string>): void;
-    /**
-     * @deprecated Use {@link CorbadoTracker.authMethodsDecisionStarted} instead (its `options`
-     * already accept free-form strings).
-     */
-    authDecisionStarted(data: AuthDecisionStarted, tags?: Record<string, string>, experiments?: Record<string, string>): void;
-    /**
-     * @deprecated Use {@link CorbadoTracker.authMethodsDecisionFinished} instead (its `options`
-     * already accept free-form strings).
-     */
-    authDecisionFinished(data: AuthDecisionFinished, tags?: Record<string, string>, experiments?: Record<string, string>): void;
-    /**
-     * Enqueue a "low" event (granular DOM/window/visualviewport/PWM signal) for the current session.
-     *
-     * @remarks
-     * Low events are sent in the `lows` array of the events endpoint payload, alongside any
-     * pending typed events. Blocked user agents are skipped silently.
-     *
-     * @internal
-     */
-    enqueueLowEvent(low: LowEvent, capturedSessionId?: string): void;
-    /**
-     * Record a diagnostic telemetry entry (a `level` + free-form `message`) for the current session.
-     *
-     * @remarks
-     * Telemetry is delivered in the `telemetry` array of the events endpoint payload, tied to the same
-     * session, and is never classified as an auth-flow event. By default a telemetry entry piggybacks
-     * the next normal flush (it does not trigger one on its own); this is server-controlled. Collection
-     * can be turned off server-side via the `telemetry` config flag. Blocked user agents are skipped.
-     *
-     * The message is truncated to {@link TELEMETRY_MESSAGE_MAX} characters. Never pass credentials or
-     * PII — telemetry is for diagnostics only. Like all SDK entry points, this never throws.
+     * @deprecated Use {@link CorbadoTracker.authMethodsDecisionStarted} instead (its `options`
+     * already accept free-form strings).
      */
-    telemetry(level: TelemetryLevel, message: string): void;
+    authDecisionStarted(data: AuthDecisionStarted, tags?: Record<string, string>, experiments?: Record<string, string>): void;
+    /**
+     * @deprecated Use {@link CorbadoTracker.authMethodsDecisionFinished} instead (its `options`
+     * already accept free-form strings).
+     */
+    authDecisionFinished(data: AuthDecisionFinished, tags?: Record<string, string>, experiments?: Record<string, string>): void;
     /**
      * Queue a probe item (diagnostic capture produced by a Corbado autocapture bundle).
      *
@@ -2446,53 +2759,10 @@ declare class CorbadoTracker {
      * @internal
      */
     probe(input: ProbeInput): void;
-    private defaultProbePageId;
-    private nextProbeSeq;
     /** Convenience wrapper for {@link CorbadoTracker.telemetry} at `info` level. */
     logInfo(message: string): void;
     /** Convenience wrapper for {@link CorbadoTracker.telemetry} at `error` level. */
     logError(message: string): void;
-    /**
-     * Queue hook run right before an event batch is sent: a device info snapshot that no event carried
-     * yet (typically the fast snapshot after a burst of events at page load, or the privateMode update)
-     * rides the first event of this page in the batch that has none. Events of other pages (outbox
-     * replays) are never touched. A snapshot no event can carry goes as the batch's request-level device
-     * info instead (queue option `standaloneDeviceInfo`).
-     *
-     * Error situations:
-     *  - Any error: log "Failed to attach device info to batch" and send the batch unchanged
-     */
-    private attachUndeliveredDeviceInfo;
-    /**
-     * Escalate an internal SDK diagnostic to the telemetry stream (self-instrumentation). This is the
-     * sink behind {@link Logger.reportTelemetry}; chosen internal failure sites route here so faults
-     * that are otherwise only visible with `debug: true` become observable in the field.
-     *
-     * @remarks
-     * Bounded and deduped per load (a persistent fault — blocked storage, a downed endpoint — cannot
-     * flood the stream), re-entrancy-guarded so it can never recurse, and it never throws into the
-     * host. Diagnostics raised before the queue exists (early boot) are buffered and replayed once the
-     * queue is ready. Messages must be stable and low-cardinality (no raw error objects / PII).
-     */
-    private reportTelemetry;
-    /**
-     * Synchronously flush any pending events and low events via beacon. Use during page-unload
-     * style teardown where async flushing is unreliable.
-     *
-     * @param reason What triggered the flush; recorded as `meta.flushReason` on the batch. Defaults
-     * to a direct call by the host app.
-     *
-     * @internal
-     */
-    flushKeepalive(reason?: FlushReason): void;
-    /**
-     * Keepalive flush requested by a low-event tracker's `pagehide` teardown. Gated by the
-     * server-controlled trigger switch `tlf` (boot-snapshot, default true = historical behavior):
-     * disabling it server-side makes low-event delivery rely solely on the queue's own triggers.
-     *
-     * @internal
-     */
-    lowEventFlushKeepalive(): void;
     passkeyLoginFullOperation(config?: PasskeyLoginOperationConfig): PasskeyLoginOperationFull;
     passkeyEnrollmentFullOperation(config?: PasskeyEnrollmentOperationConfig): PasskeyEnrollmentOperationFull;
     /**
@@ -2739,49 +3009,6 @@ declare class CorbadoTracker {
      * ```
      */
     trustedDeviceEnrollmentOperationFull(config: TrustedDeviceOperationConfig): TrustedDeviceEnrollmentOperationFull;
-    /**
-     * Flush any pending events and release all resources (timers, event listeners).
-     *
-     * @remarks
-     * After calling destroy, the tracker must not be used. Operation objects
-     * returned by factory methods (e.g. `passwordLoginFullOperation`) that hold
-     * DOM references must be destroyed separately by the caller.
-     * The final flush is gated by the server-controlled trigger switch `td` (default true);
-     * resources are released either way.
-     */
-    destroy(): Promise<void>;
-    /**
-     * Return the Observe session id this tracker is currently reporting under.
-     *
-     * @remarks
-     * Use this to route a server-side event into the same session the browser reports to: read the id,
-     * pass it to your own backend, and let the backend use it as the `sessionID` of its ingest call.
-     * Reading it here is the supported path — the storage layout behind it is an implementation detail
-     * that has already changed once (per-tab `sessionStorage` to the cross-tab continuity record).
-     *
-     * The value is **not stable for the lifetime of the page**. It changes on
-     * {@link CorbadoTracker.resetSession}, when this tab adopts a continuity session another tab
-     * rotated to, and when a failed bootstrap recovers. Read it at the moment you need it; never cache
-     * it across a request.
-     *
-     * `undefined` means no session id could be established at all — an environment without Web Crypto,
-     * where tracking is not working either. Skip the server-side event instead of sending an empty id:
-     * the ingest API requires a UUID and would reject the batch.
-     *
-     * @returns The current session id, or `undefined` if none could be established.
-     *
-     * @example
-     * ```typescript
-     * const sessionId = tracker.getSessionId();
-     * if (sessionId) {
-     *   await fetch("/api/checkout", {
-     *     method: "POST",
-     *     body: JSON.stringify({ ...payload, observeSessionId: sessionId }),
-     *   });
-     * }
-     * ```
-     */
-    getSessionId(): string | undefined;
     /**
      * Store an opaque context string with the cross-origin session, for the integration's own use on the
      * next origin (e.g. a journey id and stage). Requires `fixedDataConfig.crossOriginSession`.
@@ -2819,6 +3046,198 @@ declare class CorbadoTracker {
 declare const SDK_NAME = "@corbado/observe";
 declare const SDK_VERSION: string;
 
+/**
+ * Start a new session for `tracker` (the default tracker when omitted) and return its id.
+ *
+ * @remarks
+ * The seq restarts at 0; experiments and the data policy are kept (they are user-level facts). With the
+ * cross-origin session the shared cookie moves to the new session (without a context string).
+ *
+ * @internal
+ */
+declare function resetSession(): string | undefined;
+declare function resetSession(tracker: CorbadoTrackerCore): string;
+/**
+ * Record a newly known user reference for the current active flow of `tracker` (the default tracker
+ * when omitted). Call after the flow starts and before it finishes; matching has no grace period.
+ *
+ * @remarks
+ * Emits one `flow_enriched` with `match: { flowType: "*", at: "during" }` and `expFol: true` in its data.
+ * The enrichment belongs to the current flow at emission time. Calling after `flowFinished()` cannot
+ * enrich that finished flow. If a parent or another flow is current then, the enrichment belongs to
+ * that flow instead. An empty reference does not clear identity. Cross-environment transaction IDs must
+ * be UUIDs; both environments must report the shared ID while their respective flows are active.
+ *
+ * @example
+ * ```typescript
+ * tracker.flowStarted({ flowName: "login" });
+ * setUser(tracker, { userId: "usr_123", identifier: "max@example.com" });
+ * tracker.flowFinished({ flowName: "login" });
+ * ```
+ */
+declare function setUser(user: UserReference): void;
+declare function setUser(tracker: CorbadoTrackerCore, user: UserReference): void;
+/**
+ * Attach tags to the flow of `tracker` (the default tracker when omitted) that is open right now.
+ *
+ * @remarks
+ * Emits one `flow_enriched` carrying `tags` and no user reference, with data
+ * `{ match: { flowType, at: "during" } }` plus `expCh` / `expFol` when the options set them.
+ *
+ * - The tags land on the innermost flow open at call time (of `flowType` when given; default `"*"`, any type).
+ * - `expandToChildren` (default `true`): child flows of that flow inherit the tags.
+ * - `expandToFollowing` (default `true`): later sibling flows inherit the tags until the next
+ *   sibling of the same flow type as the tagged flow.
+ * - Per key the last `setFlowTags()` value wins; it also overrides a same-key tag passed to that
+ *   flow's own tracking calls (e.g. `flowStarted()`).
+ * - Call while the target flow is open. An enrichment after the flow's last container event
+ *   (for example after `flowFinished()`) matches no flow and is dropped with a
+ *   `flow_enriched/no_matching_flow` classification warning.
+ * - Tag keys and values are case-sensitive. Entries with an empty key or a non-string value are
+ *   dropped with a warning; nothing is sent when no valid entry remains.
+ *
+ * @example
+ * ```typescript
+ * tracker.flowStarted({ flowName: "login" });
+ * setFlowTags(tracker, { entryPoint: "checkout" });
+ * tracker.flowFinished({ flowName: "login" });
+ * ```
+ */
+declare function setFlowTags(tags: Record<string, string>, options?: SetFlowTagsOptions): void;
+declare function setFlowTags(tracker: CorbadoTrackerCore, tags: Record<string, string>, options?: SetFlowTagsOptions): void;
+/**
+ * Register the user's variant for an experiment on `tracker` (the default tracker when omitted), e.g.
+ * `setExperiment(tracker, "button_color", "blue")`. See `CorbadoTracker.setExperiment`.
+ * Never throws: invalid input is ignored with a debug log.
+ */
+declare function setExperiment(key: string, variant: string): void;
+declare function setExperiment(tracker: CorbadoTrackerCore, key: string, variant: string): void;
+/** Remove a single experiment assignment of `tracker` (the default tracker when omitted). */
+declare function clearExperiment(key: string): void;
+declare function clearExperiment(tracker: CorbadoTrackerCore, key: string): void;
+/** Remove all experiment assignments of `tracker` (the default tracker when omitted). */
+declare function clearExperiments(tracker?: CorbadoTrackerCore): void;
+/** Telemetry entry at `info` level on `tracker` (the default tracker when omitted); see `telemetry`. */
+declare function logInfo(message: string): void;
+declare function logInfo(tracker: CorbadoTrackerCore, message: string): void;
+/** Telemetry entry at `error` level on `tracker` (the default tracker when omitted); see `telemetry`. */
+declare function logError(message: string): void;
+declare function logError(tracker: CorbadoTrackerCore, message: string): void;
+/**
+ * Track a business/marketing conversion that is not part of an authentication flow on `tracker`.
+ * Standalone form of `CorbadoTracker.conversion` (same semantics).
+ */
+declare function conversion(tracker: CorbadoTrackerCore, data: Conversion, tags?: Record<string, string>, experiments?: Record<string, string>): void;
+/**
+ * @deprecated Use `tracker.authMethodsDecisionStarted` instead (its `options` already accept free-form
+ * strings). Standalone form of `CorbadoTracker.authDecisionStarted`.
+ */
+declare function authDecisionStarted(tracker: CorbadoTrackerCore, data: AuthDecisionStarted, tags?: Record<string, string>, experiments?: Record<string, string>): void;
+/**
+ * @deprecated Use `tracker.authMethodsDecisionFinished` instead (its `options` already accept free-form
+ * strings). Standalone form of `CorbadoTracker.authDecisionFinished`.
+ */
+declare function authDecisionFinished(tracker: CorbadoTrackerCore, data: AuthDecisionFinished, tags?: Record<string, string>, experiments?: Record<string, string>): void;
+/**
+ * Records an additional error occurrence against the subflow. Carries no outcome semantics — step
+ * errors are the intended channel; not part of a normal integration.
+ * @internal
+ */
+declare function trackSubflowError(tracker: CorbadoTrackerCore, subflowType: SubflowType, data: Record<string, any>, options?: StepOptions): void;
+
+type CookieStorageOptions = {
+    /** `Domain` attribute of the cookies (e.g. `example.com` to share them across subdomains). */
+    cookieDomain?: string;
+};
+/**
+ * Tracker plugin: keep the device-level state (device id and device info cache) in first-party
+ * cookies instead of localStorage — the equivalent of `storage: "cookie"` / `cookieDomain` of
+ * {@link init}.
+ *
+ * @example
+ * ```ts
+ * const tracker = initCore({ projectId, apiBaseUrl, plugins: [cookieStorage({ cookieDomain: "example.com" })] });
+ * ```
+ */
+declare function cookieStorage(options?: CookieStorageOptions): TrackerPlugin;
+
+/**
+ * Tracker plugin: share the session with the other origins of one site through a first-party cookie
+ * (see {@link CrossOriginSessionConfig}) — the equivalent of `fixedDataConfig.crossOriginSession` of
+ * {@link init}. Read and write the integration's context string with {@link setCrossOriginContext} /
+ * {@link getCrossOriginContext}.
+ *
+ * @example
+ * ```ts
+ * const tracker = initCore({ projectId, apiBaseUrl, plugins: [crossOriginSession({ cookieDomain: "example.com" })] });
+ * ```
+ */
+declare function crossOriginSession(config: CrossOriginSessionConfig): TrackerPlugin;
+/**
+ * Store an opaque context string with the cross-origin session of `tracker`, for the integration's own
+ * use on the next origin (e.g. a journey id and stage). Requires the {@link crossOriginSession} plugin
+ * (on the full tracker: `fixedDataConfig.crossOriginSession`).
+ *
+ * @remarks
+ * The value travels in the shared cookie only (see {@link CrossOriginSessionConfig}): it is never sent
+ * to Corbado, but the browser sends the cookie with every request to every subdomain of the configured
+ * domain. It belongs to the current session: a tracker that adopts the session reads it with
+ * {@link getCrossOriginContext}, and a new session (inactivity, `resetSession`) starts without it. At
+ * most 128 characters of `A-Z a-z 0-9 . _ ~ -`; never put personal data in it. `null`, `undefined` or
+ * `""` clears it.
+ *
+ * Never throws.
+ *
+ * @returns `true` when the value was accepted and written; `false` when it is invalid or the feature
+ * is off on this page (not configured, cookie blocked, domain mismatch, not HTTPS).
+ */
+declare function setCrossOriginContext(tracker: CorbadoTrackerCore, context: string | null | undefined): boolean;
+/**
+ * The context string stored with the current cross-origin session of `tracker` (see
+ * {@link setCrossOriginContext}), or `undefined` when none is set, the session has no context, or the
+ * feature is off on this page. Never throws.
+ */
+declare function getCrossOriginContext(tracker: CorbadoTrackerCore): string | undefined;
+
+/**
+ * Tracker plugin: serialize the `rawError` option of operation step errors
+ * (`op.step.error(error, { rawError })`) into `stepData.rawError` (see `serializeRawError`).
+ *
+ * @remarks
+ * Without it a {@link CorbadoTrackerCore} drops `rawError` (the step error itself is still sent), so
+ * the serializer is not part of a bundle that does not import this plugin. The full `CorbadoTracker`
+ * ({@link init}) always installs it. Serialization stays gated by the server config `rawErrors`.
+ *
+ * @example
+ * ```ts
+ * const tracker = initCore({ projectId, apiBaseUrl, plugins: [rawErrors()] });
+ * ```
+ */
+declare function rawErrors(): TrackerPlugin;
+
+/**
+ * Tracker plugin: the SDK probe lane (diagnostic captures of Corbado autocapture bundles, sent with
+ * {@link probe}). The full `CorbadoTracker` ({@link init}) always installs it.
+ *
+ * @experimental Internal: used by Corbado autocapture bundles. Not part of the documented API.
+ * @internal
+ */
+declare function probes(): TrackerPlugin;
+/**
+ * Queue a probe item (diagnostic capture produced by a Corbado autocapture bundle). Requires the
+ * {@link probes} plugin; without it the item is dropped (debug log).
+ *
+ * @remarks
+ * The SDK fills `id` (uuidv7), `seq` (per `pageId`), `pageId` (default: one random id per tracker
+ * instance) and `ts` (default: now). Items are held in memory only (never the durable outbox) and
+ * ride the regular batches; they are the lowest priority at page unload. Invalid input is dropped.
+ * The payload must already be redacted. Blocked user agents are skipped. Never throws.
+ *
+ * @experimental Internal: used by Corbado autocapture bundles. Not part of the documented API.
+ * @internal
+ */
+declare function probe(tracker: CorbadoTrackerCore, input: ProbeInput): void;
+
 interface TransportMakeRequestResponse {
     deliveryAccepted?: boolean;
     statusCode?: number;
@@ -2837,21 +3256,11 @@ interface TransportOptions {
     headers?: Record<string, string>;
 }
 
-/** In-memory probe queue caps (oldest items are dropped beyond them). */
-declare const PROBE_QUEUE_MAX_ITEMS = 500;
-declare const PROBE_QUEUE_MAX_BYTES: number;
-/** Per-request probe caps (the server keeps at most 200 probe items per batch). */
-declare const PROBE_BATCH_MAX_ITEMS = 200;
-declare const PROBE_BATCH_MAX_BYTES: number;
-/** Serialized payload cap per probe item (server rule). */
-declare const PROBE_PAYLOAD_MAX_BYTES: number;
 /**
  * Unload request budget shared by the event beacon and the probe beacon that follows it: unload
  * transports share a ~64 KB in-flight budget per page (same limit as the fetch keepalive cap).
  */
 declare const UNLOAD_BUDGET_BYTES = 60000;
-/** Absolute cap of the probe request at pagehide / destroy. */
-declare const UNLOAD_PROBE_MAX_BYTES = 32000;
 /** UTF-8 byte length of a string (no TextEncoder dependency). */
 declare function utf8Length(text: string): number;
 interface QueueOptions {
@@ -2949,15 +3358,10 @@ declare class RequestQueue {
      */
     private telemetryQueue;
     /**
-     * Probe items (`tracker.probe()`): in memory only — never the durable outbox — capped by
-     * {@link PROBE_QUEUE_MAX_ITEMS} / {@link PROBE_QUEUE_MAX_BYTES}. They arm the flush timer, ride
-     * the regular batches (probe-only batches allowed), retry under `config.retry`, and are the lowest
-     * priority at unload (a separate request after the event request, within the remaining budget).
+     * Optional probe lane (`probes()` plugin, see {@link ProbeLane}); without one, probe items are dropped
+     * and the flush paths below never see any.
      */
-    private probeQueue;
-    private probeBytes;
-    /** Probe items dropped on this load (caps, permanent rejection, exhausted retries, unload budget). */
-    private probesDropped;
+    private lane?;
     private timer;
     private isFlushing;
     private flushingDone?;
@@ -3034,29 +3438,18 @@ declare class RequestQueue {
      */
     enqueueTelemetry(entry: TelemetryEntry): void;
     /**
-     * Queue a probe item (in memory only). The payload is snapshotted (serialized once) so later host
-     * mutations cannot change it; items over {@link PROBE_PAYLOAD_MAX_BYTES} are dropped, and the
-     * oldest items are dropped beyond the queue caps. Arms the normal flush timer.
+     * Queue a probe item (in memory only) on the probe lane (see {@link ProbeLane} for snapshotting and
+     * caps). Arms the normal flush timer. Installed with the lane by the `probes()` plugin
+     * ({@link installProbeLane}; always on the full `CorbadoTracker`): a queue without a lane has neither
+     * this nor {@link droppedProbeCount} at runtime (the type keeps the 1.10 shape), so core-only bundles
+     * carry no probe code. Check for the lane (`probe(tracker, input)` does) before calling.
      *
      * Error situations:
      *  - Any error while enqueueing or scheduling the flush timer: log "Failed to enqueue probe"
      */
-    enqueueProbe(entry: ProbeEntry, capturedSessionId?: string): void;
-    /** Number of probe items dropped on this load (diagnostics / tests). */
-    droppedProbeCount(): number;
-    private dueProbes;
-    /** Oldest-first selection for one session, within an item and byte cap (at least one item when any fits the item cap). */
-    private selectProbes;
-    private removeProbes;
-    private dropProbes;
-    /** Same policy as events: 2xx delivered, non-retryable dropped, retryable backed off up to `config.retry.maxAttempts`. */
-    private handleProbeSendResult;
-    /**
-     * Unload / final teardown: one probe-only request for the current session within `budget` bytes,
-     * sent after the event request so the events' delivery is unaffected. Leftovers are dropped when
-     * `dropRest` (pagehide, destroy); otherwise they stay queued.
-     */
-    private sendUnloadProbes;
+    enqueueProbe: (entry: ProbeEntry, capturedSessionId?: string) => void;
+    /** Number of probe items dropped on this load (diagnostics / tests); installed with the lane. */
+    droppedProbeCount: () => number;
     private scheduleAfterEnqueue;
     /**
      * Whether this event completes one of the configured priority flow types. Only the two flow
@@ -3159,6 +3552,85 @@ declare class RequestQueue {
     destroy(): void;
 }
 
+/** In-memory probe queue caps (oldest items are dropped beyond them). */
+declare const PROBE_QUEUE_MAX_ITEMS = 500;
+declare const PROBE_QUEUE_MAX_BYTES: number;
+/** Per-request probe caps (the server keeps at most 200 probe items per batch). */
+declare const PROBE_BATCH_MAX_ITEMS = 200;
+declare const PROBE_BATCH_MAX_BYTES: number;
+/** Serialized payload cap per probe item (server rule). */
+declare const PROBE_PAYLOAD_MAX_BYTES: number;
+/** Absolute cap of the probe request at pagehide / destroy. */
+declare const UNLOAD_PROBE_MAX_BYTES = 32000;
+/**
+ * Install a probe lane on `queue` together with the queue's probe entry points (`enqueueProbe`,
+ * `droppedProbeCount`): what the `probes()` plugin does. Idempotent: returns the installed lane.
+ * @internal
+ */
+declare function installProbeLane(queue: RequestQueue): ProbeLane;
+/**
+ * A queued probe item: in memory only, keeps the session it was captured in, retried like events.
+ * @internal
+ */
+interface ProbePending {
+    sessionId: string;
+    entry: ProbeEntry;
+    bytes: number;
+    attempts: number;
+    flushAfter: number;
+}
+/**
+ * The probe lane of a {@link RequestQueue}: probe items (`probe(tracker, input)`), in memory only —
+ * never the durable outbox — capped by {@link PROBE_QUEUE_MAX_ITEMS} / {@link PROBE_QUEUE_MAX_BYTES}.
+ * They arm the flush timer, ride the regular batches (probe-only batches allowed), retry under
+ * `config.retry`, and are the lowest priority at unload (a separate request after the event request,
+ * within the remaining budget).
+ *
+ * @remarks
+ * Optional: installed by the `probes()` tracker plugin (always on the full `CorbadoTracker`). A queue
+ * without a lane drops probe items, and a bundle that never imports `probes()` contains none of this.
+ * The lane is a package-internal friend of the queue: it reads the queue's delivery state directly.
+ *
+ * @internal
+ */
+declare class ProbeLane {
+    private readonly queue;
+    /** Queued items, oldest first; read by the queue's flush paths. */
+    items: ProbePending[];
+    private bytes;
+    /** Probe items dropped on this load (caps, permanent rejection, exhausted retries, unload budget). */
+    dropped: number;
+    /** Default probe page id (one per tracker instance) and the probe seq counter per page id. */
+    private pageId?;
+    private readonly seqs;
+    constructor(queue: RequestQueue);
+    /**
+     * Queue a probe item. The payload is snapshotted (serialized once) so later host mutations cannot
+     * change it; items over {@link PROBE_PAYLOAD_MAX_BYTES} are dropped, and the oldest items are dropped
+     * beyond the queue caps. Arms the normal flush timer. Throws on unexpected errors (the queue logs).
+     */
+    enqueue(entry: ProbeEntry, capturedSessionId: string): void;
+    /** The probe part of one regular batch of `sessionId`. */
+    selectBatch(candidates: ProbePending[], sessionId: string): ProbePending[];
+    /** Oldest-first selection for one session, within an item and byte cap (at least one item when any fits the item cap). */
+    private select;
+    private remove;
+    /** Drop `items` (all of them: `drop(lane.items.slice())`), counting them as dropped. */
+    drop(items: ProbePending[]): void;
+    /** Same policy as events: 2xx delivered, non-retryable dropped, retryable backed off up to `config.retry.maxAttempts`. */
+    handleResult(response: TransportMakeRequestResponse, items: ProbePending[], now: number): void;
+    /**
+     * Unload / final teardown: one probe-only request for the current session within `budget` bytes,
+     * sent after the event request so the events' delivery is unaffected. Leftovers are dropped when
+     * `dropRest` (pagehide, destroy); otherwise they stay queued.
+     */
+    sendUnload(budget: number, reason: FlushReason, dropRest: boolean, useBeacon: boolean): void;
+    /** Default page id of probe items without one: one random id per lane (= per tracker instance). */
+    defaultPageId(): string;
+    /** Next probe seq of `pageId` (per-page counters, the oldest forgotten beyond {@link PROBE_PAGE_IDS_MAX}). */
+    nextSeq(pageId: string): number;
+}
+
 /** Config cache of older SDKs: read as a stale fallback until the first {@link CONFIG_CACHE_STORAGE_KEY} write. */
 declare const CONFIG_STORAGE_KEY = "cbo_sdk_config";
 /** Last-known server config with its source endpoint and freshness, written as one record. */
@@ -3410,33 +3882,44 @@ declare function sanitizeAssertionResponse(value: unknown, projectors?: WebAuthn
  * their methods, or construct {@link CorbadoTracker} instances directly without changing the default.
  */
 declare function init(options: TrackerOptions): CorbadoTracker;
-/** Return the default tracker from the most recent {@link init} call. */
-declare function getTracker(): CorbadoTracker | undefined;
-declare function resetSession(): string | undefined;
 /**
- * Session id of the global tracker, or `undefined` when no tracker was initialized or no session
- * could be established. See {@link CorbadoTracker.getSessionId}.
+ * Create a {@link CorbadoTrackerCore} and make it the default for all package-level helpers — the
+ * tree-shakeable counterpart of {@link init} for integrations that care about bundle size.
+ *
+ * @remarks
+ * The core sends exactly what {@link init} sends for the same calls. Optional features are imported:
+ * typed operations and the other tracker features as standalone functions that take the tracker
+ * (`passkeyLoginFullOperation(tracker, config)`, `setUser(tracker, user)`, `resetSession(tracker)`, ...),
+ * option-driven features as plugins (`cookieStorage()`, `crossOriginSession()`, `rawErrors()`,
+ * `probes()`), see {@link TrackerCoreOptions}. Code that is not imported is not in the bundle.
+ *
+ * @example
+ * ```ts
+ * import { initCore, passkeyLoginFullOperation, rawErrors, setUser } from "@corbado/observe";
+ *
+ * const tracker = initCore({ projectId, apiBaseUrl, plugins: [rawErrors()] });
+ * tracker.flowStarted({ flowName: "login" });
+ * const passkey = passkeyLoginFullOperation(tracker, { explicitSpecType: "pre-identifier" });
+ * setUser(tracker, { userId });
+ * ```
  */
-declare function getSessionId(): string | undefined;
+declare function initCore(options: TrackerCoreOptions): CorbadoTrackerCore;
 /**
- * Record a user reference for the global tracker's current active flow.
- * Call after the flow starts and before it finishes; matching has no grace period.
- * See {@link CorbadoTracker.setUser}.
+ * Return the default tracker from the most recent {@link init} call; `undefined` when there is none
+ * or when the default was created by {@link initCore} (use {@link getTrackerCore} for that).
  */
-declare function setUser(user: UserReference): void;
+declare function getTracker(): CorbadoTracker | undefined;
+/** Return the default tracker from the most recent {@link init} or {@link initCore} call. */
+declare function getTrackerCore(): CorbadoTrackerCore | undefined;
 /**
- * Attach tags to the global tracker's innermost open flow.
- * See {@link CorbadoTracker.setFlowTags}.
+ * Session id of the global tracker, or `undefined` when no tracker was initialized or no session
+ * could be established. See {@link CorbadoTrackerCore.getSessionId}.
  */
-declare function setFlowTags(tags: Record<string, string>, options?: SetFlowTagsOptions): void;
-declare function setExperiment(key: string, variant: string): void;
+declare function getSessionId(): string | undefined;
 declare function setExperiments(assignments: Record<string, string>): void;
-declare function clearExperiment(key: string): void;
-declare function clearExperiments(): void;
 declare function getExperiments(): Record<string, string>;
 declare function telemetry(level: TelemetryLevel, message: string): void;
-declare function logInfo(message: string): void;
-declare function logError(message: string): void;
+/** Destroy the default tracker (see {@link CorbadoTrackerCore.destroy}) and clear the default. */
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, cacheConfigRecord, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };