@corbado/observe 1.11.0 → 1.12.1

package/CHANGELOG.md

@@ -0,0 +1,306 @@
+# @corbado/observe
+
+## 1.12.1
+
+### Patch Changes
+
+- a5b4069: Reader metadata: optional `storage` (`ReaderStorage`: area, keys, lifetime, retention) for readers of Observe's own storage. The SDK's local, session and cookie storage readers declare it and no longer list fields, so the manifest extractor lists them in the new `storage` section instead of `sources`. Reader metadata is stripped from builds; no runtime change.
+
+## 1.12.0
+
+### Minor Changes
+
+- c4bbb15: Collection manifest fields declare a data `category` (`ReaderCategory`: `personal-identifier`, `personal-data`, `secret`, `passkey`, `device`, `behavior`, `technical`; list in `READER_CATEGORIES`). Every SDK reader field declares one (`check:browser-globals` enforces it); `ReaderMeta.category` is the default for an item's fields. In `@corbado/autocapture`, `f(path, { category })`, `q` / `p` / `h` options, `clearValue({ max, reason, category })`, the element role `category` (applies to `value` / `value.length`, also via the input-tracking handoff), and store field `category` carry it into `describe()`; library fields (WebAuthn, Connect, endpoint timing/status, input tracking, trusted submit, validation) declare theirs. Metadata only: no runtime behavior changes, reader metadata literals stay stripped from shipped builds.
+
+  **Action required:** declare a `category` on project spec fields with a content-carrying exposure (`format`, `partial`, `computed`, `token`, `pseudonym`, `redacted`, `raw`): `f` / `q` / `p` / `h` options, `clearValue`, element roles that read the value, store fields. The manifest extractor reports them as missing otherwise.
+
+## 1.11.0
+
+### Minor Changes
+
+- 1aaa288: Tree-shakeable core: `initCore()` returns a `CorbadoTrackerCore` with only what every integration runs;
+  everything else is imported, so a bundle that does not use it does not contain it. `init()` and
+  `CorbadoTracker` (which now extends the core) keep their API and wire behaviour.
+  - Typed operations as standalone functions that take the tracker, e.g.
+    `passkeyLoginFullOperation(tracker, config)`, `totpOperationFull(tracker, config)` (all 21 factories).
+  - Rarely used tracker features as functions: `setUser`, `setFlowTags`, `resetSession`, `setExperiment`,
+    `clearExperiment`, `clearExperiments`, `logInfo`, `logError` (the existing package-level helpers now
+    also accept a tracker as first argument), `conversion`, `authDecisionStarted`, `authDecisionFinished`,
+    `setCrossOriginContext`, `getCrossOriginContext`.
+  - Option-driven features as plugins (`initCore({ plugins: [...] })`): `cookieStorage()`,
+    `crossOriginSession()`, `rawErrors()` (raw-error serializer), `probes()` (SDK probe lane).
+  - `getTrackerCore()` returns the default tracker of either kind; `getTracker()` keeps returning only a
+    full tracker.
+  - Operations and the function forms need a tracker from the same `@corbado/observe` copy (1.11+); mixing
+    copies drops optional features such as the raw-error serializer.
+
+## 1.10.1
+
+### Patch Changes
+
+- c40eefc: Low events: `captureSeq` is reserved once per run of input changes (and once per further event the run sends) instead of once per keystroke. Before, an input batch carried only its first number while every keystroke used one, so the gap to the next event revealed how many keys were pressed, i.e. the length of a typed password or identifier. Ordering is unchanged: a batch still sorts by its first observed change, also across fields and before the deferred grouped-input flush. Every reserved number is now sent, so a gap only means a lost event.
+- c40eefc: Collection manifest: "Browser and operating system" (`browser-api:device.user-agent`) now declares what actually reaches Corbado, the full User-Agent header the browser sends with every request (`exposure: "raw"`), instead of an OS/browser category. The unused `DeviceCollector.getOsAndBrowserInfo()` that carried the old declaration is removed. No change to what is sent.
+- c40eefc: Remove the DOM password-manager scan of input trackers: the `pa-1`..`pa-6` low events (1Password elements, LastPass attributes and two popover style profiles) are no longer sent. Password manager detection is the extension sampler alone, reported as `Event.passwordManagers` and controlled by `pmd` (server config, `fixedDataConfig.pmd` or `__CBO_DATA_PMD__`). An omitted `fixedDataConfig.pmd` now simply means off; there is no separate scan left that it kept running.
+
+## 1.10.0
+
+### Minor Changes
+
+- 21503ae: Opt-in cross-origin session continuity under a shared parent domain: `init({ fixedDataConfig: { pmd, privateMode, crossOriginSession: { cookieDomain: ".example.com" } } })` keeps a small first-party cookie `cbo_xs_<projectId>` on that domain (random session id, last activity, sequence reservation mark, optional integration context of at most 128 cookie-safe characters; `Secure`, `SameSite=Lax`, `Max-Age` = the session inactivity window; the browser sends it to every subdomain of the domain). A tracker on another origin under the same domain adopts that session at init and continues its sequence numbers above the mark, so one journey across subdomains reports into one Observe session; batches report `meta.crossOriginSession: "adopted" | "own"`. Only init, `resetSession()` and `setCrossOriginContext()` take the cookie over from another session. `setCrossOriginContext()` / `getCrossOriginContext()` carry an opaque integration string with the session. As part of `fixedDataConfig` the option also fixes `pmd` and `privateMode`; with it, separate tabs merge into one session even without server-side session continuity. Without the option nothing changes; blocked cookies, a domain that does not match the page, non-HTTPS pages and sandboxed frames turn the feature off without affecting tracking.
+
+## 1.9.1
+
+### Patch Changes
+
+- 346a0d8: The SDK config is fetched only when the cached copy is stale instead of at every page load and every 10 minutes. The cache is now one localStorage record, `cbo_sdk_config_cache_<projectId>`, holding the config, the endpoint it was fetched from, and when it was fetched and expires, written in a single write (a failed write keeps the previous record as a whole). The expiry is `max-age` minus `Age` of the response, clamped to 5 minutes..24 hours, 1 hour when the response has no `max-age`. A record for another endpoint, with invalid times or with an expiry beyond 24 hours is stale. The check runs at init and when the page becomes visible again or is restored from the back/forward cache. All tabs of the origin share the record. The previous cache key `cbo_sdk_config_<projectId>` is applied once as stale and removed after the first successful fetch; an older SDK on the same origin then starts from defaults and fetches at init as before. Requests use `cache: "no-cache"`, so the browser revalidates with `If-None-Match` once the server sends an `ETag`, still without a CORS preflight. Failed requests keep the current config and its expiry; after the in-attempt retries, the next trigger tries again at most once per 60 s.
+
+## 1.9.0
+
+### Minor Changes
+
+- f2c714a: Browser access moved into readers: all remaining reads of browser globals (SDK storage and `cbo_*` keys, durable outbox locks, event delivery via fetch and sendBeacon, SDK config refresh, page lifecycle and window low events, input low events on handed-over fields, source path, blocked user-agent check, `window.Corbado` loader global) now go through `src/readers/**`, each call with a literal `ReaderMeta`. `ReaderMeta` (internal) gains the optional `title`, `group` and `origin` (`observe-external` | `observe-internal` | `host-config`), filled for every SDK reader. A CI check (`pnpm check:browser-globals`) fails when code outside `src/readers/**` references a browser global. Titles are customer-facing plain language; technical detail is in the new optional `accessNote`. `ReaderField` gains the optional `label` (what the field is, plain language, same rule as titles), declared on every SDK field; the check enforces it. Reader metadata is stripped from the npm and CDN builds (each literal becomes `0`; `dist/analysis` keeps it), and the strip plugin ships as `@corbado/observe/tools/strip-reader-meta.mjs` for downstream release builds. No behaviour change.
+- 921feca: Opaque SDK handoffs: new types `SdkInputHandoff`, `SdkWebAuthnPayload` and `SdkWebAuthnError` (memberless brands, e.g. returned by `@corbado/autocapture` readers) and additive overloads that accept them: the tracker factories `provideIdentifierOperationFull`, `provideDataOperationFull`, `passwordLoginFullOperation`, `passwordEnrollmentFullOperation`, `emailOtpOperationFull`, `smsOtpOperationFull`, `totpOperationFull` and `formOperationFull` take an `SdkInputHandoff` wherever the config takes an input element, `setInputFields` on the OTP, TOTP and form operations takes handoffs, and the passkey steps (`getOptions`, `ceremony`, `postResponse` of passkey login and enrollment, and the CUI steps of provide-identifier and password login) take an `SdkWebAuthnPayload` for `assertionOptions`, `assertionResponse`, `attestationOptions` and `attestationResponse`. The existing signatures are unchanged and listed last, so `Parameters<…>` and existing assignments resolve as before. No runtime change: a handoff is the original element, JSON string or rejection.
+
+## 1.8.0
+
+### Minor Changes
+
+- 32cbb64: Add the opt-in `init({ fixedDataConfig })` option, which fixes the data-collection switches on the integration side instead of taking them from the server config or the cached `cbo_sdk_config`. Batches of such a tracker carry `meta.fixedData: true`. `pmd: true` runs password manager detection (extension probes and the DOM scan, `pa-1`..`pa-6`), `pmd: false` runs neither, and an omitted `pmd` turns the extension probes off while the DOM scan keeps running as before. `privateMode: false` skips private-mode detection and its `cbo_pm` cache (default on). Without `fixedDataConfig`, behaviour is unchanged.
+
+  `init({ sdkConfig: { pmd } })` is deprecated in favour of `fixedDataConfig.pmd`. It keeps working exactly as before when `fixedDataConfig` is not given; when both are given, `fixedDataConfig` wins.
+
+  Builds can fix the same switches at build time with the esbuild/tsup defines `__CBO_DATA_PMD__` and `__CBO_DATA_PRIVATE_MODE__` (booleans). A define wins over the option and lets the bundler remove the disabled code, including detectincognitojs. The package now declares `sideEffects` (only `dist/cdn/*` has side effects).
+
+  The package also ships `dist/analysis/**/*.mjs`, an unminified ESM build that keeps one output file per module, for static analysis of what a consumer build collects. Browser reads go through readers that take literal metadata (`ReaderMeta`, exported as internal). `main`, `module` and `types` are unchanged.
+
+- 166e06f: Password manager extension detection is on by default. A project can still switch it off in its server-side SDK configuration.
+
+## 1.7.2
+
+### Patch Changes
+
+- b62e2c3: WebAuthn payload sanitizers omit user identifiers (creation `user.id`, credential `response.userHandle`) by default. Relying parties often put an email there. Pass `identifierProjectors.userId` to send a projected value instead.
+
+## 1.7.1
+
+### Patch Changes
+
+- e6a4779: Social login reports how an attempt began: `socialLoginOperationFull({ entry })` with `"button"` (default), `"popup"` or `"one-tap"`, also accepted on `exchangeCode.start`. A One Tap reports only `exchangeCode`.
+
+## 1.7.0
+
+### Minor Changes
+
+- 5d291d5: Track passkey deletion. The new `passkeyDeletionOperationFull()` emits a `passkey-deletion` subflow (no spec type) with the steps `userConfirmation` (the confirmation dialog: start when it opens, finish when the user confirms, `errorTyped({ code: "cancelled" })` when it is dismissed) and `deletion` (the delete request: finish when the passkey was deleted, `error(error)` or `errorTyped({ code })` when it failed).
+
+  `SubflowType` and `AuthMethodType` gain `"passkey-deletion"`. The script-tag snippet supports the new operation and its steps.
+
+## 1.6.0
+
+### Minor Changes
+
+- 9be8da3: Forms can be dated back and report field interaction. `formOperationFull` accepts `startedAt` (epoch ms, at most a minute back) for a form that became visible before the call, and `inputHtmlFields` plus `setInputFields(fields)` to collect low-level interaction signals (focus, typing, paste, autofill; never values) from the form's fields, rebinding them per page without starting a new subflow. `flowStarted` takes an optional `explicitTimestamp` for the same reason, so a backdated form can stay inside its backdated flow.
+- da114e1: Track forms of a process flow such as an onboarding. The new `formOperationFull({ name, fields? })` emits a `form` subflow when the form is shown, with the steps `submit` (the application accepted the form) and `skip` (the user left it forward without submitting, e.g. "Do it later").
+  - `name` identifies the form across visits; the backend normalizes it, so `"personalDetails"` and `"personal_details"` are one form. A missing or blank name is logged as a warning and the form is still reported; the backend then records it as a classification error instead of counting it.
+  - `fields` takes field names only: entries outside `[A-Za-z0-9._-]` or longer than 40 characters are dropped with a warning, and at most 50 are sent.
+
+  `SubflowType` gains `"form"`. The script-tag snippet supports the new operation and its `submit`/`skip` steps.
+
+### Patch Changes
+
+- d64d7ef: Checkboxes and radio buttons no longer report a prefill when they appear. Their `value` is what the form submits when they are checked (`"on"` by default), not their content, so every bound box used to count as prefilled. Their content is now whether they are checked: an unchecked box is empty, checking it is reported as filling and unchecking as clearing, and a box that is already checked when it appears still reports a prefill.
+
+## 1.5.2
+
+### Patch Changes
+
+- 201f06f: A device info snapshot that no event carried (typically the late `privateMode` update after the page's last event) is now sent on its own as the batch's request-level `deviceInfo`, on the ordinary flush timer or with the unload flush — only on pages that tracked events, never persisted or retried. Requires the backend that accepts a device info without events.
+
+## 1.5.1
+
+### Patch Changes
+
+- a88b5f0: The `privateMode` detection starts together with the other device info fields instead of after the fast snapshot, so a quick detection (Safari, Firefox) is part of the fast snapshot and needs no update, and Chromium's slower detection has more time before the page goes away. The late deadline for the update is now 6000 ms (was 3000 ms); a detection that fails early is reported in the fast snapshot's `collectionErrors`.
+
+## 1.5.0
+
+### Minor Changes
+
+- e816a9c: Device info is collected in two steps: a fast snapshot of every field except `privateMode` within 300 ms, then one update with fields that were still running (up to 3000 ms) and the `privateMode` detection, which now runs at most once per page, only after the fast snapshot, and is cached in localStorage (`cbo_pm`, 7 days). A snapshot no event carried yet rides the first event of the current page in the next outgoing batch, so a burst of events right at page load no longer leaves the session without device info; device info is never sent on its own. Refreshes skip hidden tabs and reuse the page's `privateMode`. The `deviceInfoCollectorTimeoutMs` server config and the `deviceInfoCollectorTimeout` option no longer have an effect; `deviceInfoTiming` reports the fast snapshot, the `privateMode` source and the update's delivery.
+
+### Patch Changes
+
+- 6dd6411: Bump `detectincognitojs` to 1.9.0: Firefox no longer reports private mode when IndexedDB fails for reasons other than private browsing, and the library no longer sets a `window.detectIncognito` global on the host page. The `privateMode` cache is keyed by the new detector version.
+
+## 1.4.0
+
+### Minor Changes
+
+- 9c1fb94: Add the internal, experimental `tracker.probe()` used by Corbado autocapture bundles: redacted diagnostic items travel in a new optional `probes` array of the events batch. Probes are held in memory only (never the durable outbox), capped at 500 items / 512 KB, sent at most 200 items / 200 KB per request (probe-only batches allowed), keep their capture session across rotation, retry under `config.retry`, and go last at pagehide / destroy in their own request within the remaining unload budget. Nothing changes for integrations that never call it.
+
+### Patch Changes
+
+- 4a93061: Add `"naver"` and `"yahoo"` to `SocialLoginProviderType`, so `socialLoginOperationFull()` steps can report Naver and Yahoo as the social `provider`.
+
+## 1.3.0
+
+### Minor Changes
+
+- f681198: Add the `integrationVersion` init option: the version of the integration driving the SDK (e.g. an autocapture bundle) is sent as `sdk.integrationVersion` on every batch, so sessions can be cohorted by integration version without a telemetry line. At most 32 characters of `[0-9A-Za-z.+_-]`; other values are ignored.
+
+## 1.2.0
+
+### Minor Changes
+
+- b25aedf: Add password manager extension detection. `detectPasswordManagerExtensions()` synchronously detects the 1Password, Bitwarden, Dashlane, Kaspersky, Keeper, LastPass, NordPass and Proton Pass browser extensions without extension IDs, with `signedIn` where the page can observe it. When enabled through the SDK config (off by default), the tracker samples at SDK init, window load and the first focus of each login field and reports the detected managers as `passwordManagers` (names only) on the next tracked event whenever the detected set grows.
+
+## 1.1.6
+
+### Patch Changes
+
+- 609ae4b: Add an optional synchronous user identifier projector to WebAuthn serializers and capture. It projects creation `user.id` and response `userHandle`; defaults preserve them. Callback exceptions and unsupported return values omit the user identifier. Credential IDs and encoded attestation/authenticator data remain unchanged. Signatures and PRF results remain excluded. Autocapture requires Observe ^1.1.6 for this contract.
+
+## 1.1.5
+
+### Patch Changes
+
+- d0d7d7b: Steps accept the identifier the user submitted: `postResponse.finished({}, { identifier: { value, type } })` (also on start and error). The value is sent as given, so normalize and, if your data policy requires it, hash it first. Observe uses it to find attempts by identifier, including failed logins.
+
+## 1.1.4
+
+### Patch Changes
+
+- e30405c: Add `totpOperationFull()` for authenticator-app codes as the `totp` subflow with a `post-response` step, spec types `totp-login` / `totp-enrollment` and OTP input binding. Add `"push"` to `AppConfirmationOperationSpecType` for approvals pushed to an already-enrolled device. Add `"totp"`, `"totp-login"`, `"totp-enrollment"` and `"app-confirmation"` to `AuthMethodType` as decision options.
+
+  The inline snippet's operation proxy now exposes `setInputFields`, so OTP operations created before the SDK loads can bind late-rendered inputs.
+
+## 1.1.3
+
+### Patch Changes
+
+- a89a88c: Add `setFlowTags(tags, options?)` (tracker method and module export) to tag the innermost open flow via a `flow_enriched` event, with optional `flowType`, `expandToChildren` and `expandToFollowing`.
+- e340ca9: Add `ssoLoginOperationFull()` for enterprise SSO (SAML/OIDC) as its own `sso-login` subflow with `get-redirect-url` and `exchange-code` steps. Its config reports the spec type, the organization's email domain and whether the user or the application (`actor: "system"`, e.g. routing by email domain) chose SSO. Add `"sso-login"` to `AuthMethodType` as the decision option for that subflow.
+
+## 1.1.2
+
+### Patch Changes
+
+- 1b5a268: Add a `send` step to `smsOtpOperationFull()`, matching `emailOtpOperationFull()`, so a failed code send (e.g. a rate limit) is reported as an error of the SMS OTP attempt.
+
+## 1.1.1
+
+### Patch Changes
+
+- a53fc48: Add `"line"`, `"kakao"` and `"singpass"` to `SocialLoginProviderType`, so `socialLoginOperationFull()` steps can report LINE, Kakao and Singpass as the social `provider`.
+
+## 1.1.0
+
+### Minor Changes
+
+- 06d85c1: Continue email-link subflows across pages. `emailLinkOperationFull({ transactionId? })` now carries a transaction ID (generated when omitted, readable as `transactionId`) as `crossEnvironmentTransactionIDStart` and remembers the start in this browser for 24 hours. The new `continueEmailLinkOperation({ explicitSpecType?, transactionId? })` is used on the link's target page:
+  - In the same browser and session it continues page 1's subflow directly (no second `subflow_started`), so both pages form one email-link subflow.
+  - Otherwise it emits a `subflow_started` with `continuation: true` and `crossEnvironmentTransactionIDFinish`, which the backend joins to page 1 through the transaction ID. Without a transaction ID it is deferred until `setTransactionId()`, `flush()` or page hide, and steps called before that are replayed with their original timestamps.
+
+  `UserReference` gains `crossEnvironmentTransactionIDStart` and `crossEnvironmentTransactionIDFinish`. The script-tag snippet supports the new operation and its `setTransactionId`/`flush` methods.
+
+## 1.0.0
+
+### Major Changes
+
+- First stable release (1.0.0).
+
+## 0.16.7
+
+### Patch Changes
+
+- 9e78845: Mask query values in `meta.trackingSourcePath` by default. The new `sourcePathQuery` and `sourcePathQueryAllow` reliability config keys control which values are kept: `"allowlist"` (default) keeps every query key and its position but replaces each value with `*` unless its key is allowlisted (case-insensitive, trailing `*` matches a prefix, up to 50 keys; empty by default). `"all"` restores the previous behavior of reporting the full query. Empty values and keys without a value are kept; the path is never changed. Any mode other than `"all"` is treated as `"allowlist"`. Both keys can be set server-side per project or via `init({ sdkConfig })`.
+
+  **Behavior change:** after updating, query values such as `utm_*` no longer appear in `trackingSourcePath` until the project allowlists their keys or sets `sourcePathQuery` to `"all"`.
+
+## 0.16.6
+
+### Patch Changes
+
+- 59cc12d: Return a flow handle from `flowFinished()` as well. Its `enrich(user)` emits `flow_enriched` with `data.targetEventId` set to the `flow_finished` event UUID, so identity learned after completion can be attached from the page that finished the flow, even when that page never saw the flow start. Requires backend support for explicit flow-event targeting. Existing calls that ignore the return value are unaffected.
+
+  The `flowStarted()` handle now sends `data.targetEventId` instead of the deprecated `data.flowStartedEventId`, which the backend keeps accepting as an alias. Both handles require a backend supporting `targetEventId`.
+
+- 2d6cba9: Add data policy support: `init({ dataPolicy })`, `setDataPolicy(code)` and `getDataPolicy()` select a project-scoped data policy code (integer 0..255, 0 = project default) configured in Corbado. Once set, the code is sent as `meta.dataPolicy` on every batch (including an explicit 0), persisted per project in localStorage and kept across reloads, `resetSession()` and `destroy()`; it is only ever overwritten, never cleared. The server records the latest code per session (last write wins). Invalid codes are ignored with a debug log; the SDK never throws. Nothing is sent until a code is set, so existing integrations are unaffected.
+
+## 0.16.5
+
+### Patch Changes
+
+- a9151df: Return a flow handle from `flowStarted()` with `enrich(user)` for delayed identity enrichment. The handle emits `flow_enriched` with the original `flowStartedEventId` and session, allowing identity to be attached after completion without targeting a later flow. Requires backend support for explicit start-event targeting. Existing temporal enrichment remains unchanged; the tracker must remain alive until enrichment is enqueued.
+
+## 0.16.4
+
+### Patch Changes
+
+- ef1fd8a: Add keySigningOperationFull and keyRegistrationOperationFull helpers without spec types, including deferred snippet support. Track usable signing artifacts and accepted key authority separately from WebAuthn ceremonies.
+
+## 0.16.3
+
+### Patch Changes
+
+- 2a55a1c: Gate opt-in raw error diagnostics behind the `rawErrors` SDK configuration flag (default on). Disabled diagnostics skip serialization; remote refreshes apply to subsequent errors without changing normalized error reporting.
+
+## 0.16.2
+
+### Patch Changes
+
+- 51b1c87: Add the `same-device` app-confirmation spec for local companion-app authentication such as Okta FastPass. Ceremony remains the completion step; post-response is optional when a separate browser exchange exists.
+
+## 0.16.1
+
+### Patch Changes
+
+- 91ed216: Keep Observe npm and CDN bundles minified but unobfuscated so Node can resolve named imports from the CommonJS entry. Require Observe ^0.16.1 from autocapture. Allow matching Observe prereleases in staging autocapture builds.
+
+## 0.16.0
+
+### Minor Changes
+
+- a970bbf: Expose WebAuthn credential and options redaction helpers from Observe. Autocapture consumes Observe as a required peer dependency and preserves its existing helper exports for compatibility. Install Observe 0.16.0 or later within the 0.16 release line when upgrading autocapture.
+
+## 0.15.2
+
+### Patch Changes
+
+- 8af8bbd: Add the typed password-login error `invalid_identifier_or_password` for enumeration-safe credential rejection.
+- 42b57a8: Add an optional `rawError` diagnostic in the options of normal and typed step errors. It is serialized by the new `serializeRawError` helper with bounded depth, breadth and UTF-8 size, keeps `name`, `message`, `code`, `cause` and own properties of browser and library errors including `DOMException`, omits stacks unless requested, accepts Sentry-style per-call limits (`rawErrorLimits`: depth, breadth, value length, cause chain, stack frames, bytes) clamped to documented bounds, never emits binary content, and is sent alongside the classified error without affecting classification.
+- e0b9197: Add trusted-device check and enrollment operations with optional binding references and typed negative error codes that retain their diagnostics. Support a neutral identifier choice and username identifiers. Purpose distinguishes additional verification from MFA exemption. Require purpose and storage in typed configuration, with non-throwing runtime validation on both operations and omit oversized optional binding metadata with a diagnostic. Support these operations in the asynchronous CDN snippet and tolerate missing runtime typed-error payloads. Typed check errors use `code`, such as `no_eligible_local_key`; normal step responses continue to use `result`, such as `no-eligible-local-key`.
+
+## 0.15.1
+
+### Patch Changes
+
+- 7ede3a6: Infer passkey ceremony initiators from the operation or ceremony spec, so integrations no longer need to supply initiator metadata. Manual login/enrollment specs use `passkey-button`; automatic login specs, `passkey-immediate`, and automatic/conditional enrollment use `automatic`. Low events and ceremony step metadata share the inferred value. Explicit overrides remain supported, ambiguous specs remain unknown, and conditional-login collection behavior is unchanged.
+
+## 0.15.0
+
+### Minor Changes
+
+- 6f887f2: Add version 1 low-event capture with explicit subflow attribution and per-page capture ordering,
+  supporting concurrent input and passkey observations. Improve identifier, password, and single-field
+  or split-field OTP capture, including paste detection, prefill, clearing, and three-second idle
+  boundaries. Add `setInputFields()` to email and SMS OTP operations so applications can rebind
+  replaced input groups without restarting the subflow. Add `capturePrefill()` for application-controlled initialization after observation starts.
+
+  Add opt-in persistent low-event delivery through `durableLowOutbox`, preserving capture context and
+  ordering across retries and reloads. Enable it alongside `durableOutbox` to persist the corresponding
+  subflow-start events as well.
+
+  Deploy backend support for the v1 capture contract and the combined low-event capture-context
+  migration before rolling out this SDK version. Version 1 capture is enabled by default;
+  `durableLowOutbox` remains disabled by default.
+
+## 0.13.0
+
+### Minor Changes
+
+- 0bd42a1: Scope persisted SDK state and cross-tab locks by project ID so multiple projects can run in the
+  same application independently. Automatically migrate legacy global state to the first initialized
+  project, preserving sessions, sequence counters, pending events, experiment assignments, and device
+  identity. Initialize the existing project first when upgrading; migration is a one-time snapshot,
+  and later writes from older SDK versions are not imported again.

package/dist/analysis/config-manager.mjs

@@ -59,6 +59,7 @@ var ConfigManager = class {
           {
             path: "visibilityState",
             label: "Whether the page is hidden",
+            category: "technical",
             exposure: "enum",
             transform: { values: ["hidden", "other"] }
           }
@@ -78,6 +79,7 @@ var ConfigManager = class {
             {
               path: "event.visibilitychange",
               label: "Page hidden or shown again",
+              category: "technical",
               exposure: "presence",
               transform: { note: "checks whether Observe settings are due for a refresh when the page is shown" }
             }
@@ -97,6 +99,7 @@ var ConfigManager = class {
             {
               path: "event.persisted",
               label: "Page restored from the browser's back/forward cache",
+              category: "technical",
               exposure: "presence",
               transform: { note: "checks whether Observe settings are due for a refresh" }
             }
@@ -148,27 +151,31 @@ var ConfigManager = class {
           group: "Event delivery",
           origin: "observe-internal",
           fields: [
-            { path: "response.status", label: "Response code", exposure: "raw" },
+            { path: "response.status", label: "Response code", category: "technical", exposure: "raw" },
             {
               path: "response.header.retry-after",
               label: "Whether the server asked to retry later",
+              category: "technical",
               exposure: "presence"
             },
             {
               path: "response.header.cache-control",
               label: "How long the server allows reusing the settings",
+              category: "technical",
               exposure: "computed",
               transform: { note: "max-age, reduced to the settings' expiry time" }
             },
             {
               path: "response.header.age",
               label: "How long the settings were already stored on the way",
+              category: "technical",
               exposure: "computed",
               transform: { note: "subtracted from max-age for the settings' expiry time" }
             },
             {
               path: "response.body",
               label: "Observe settings",
+              category: "technical",
               exposure: "raw",
               transform: { note: "SDK reliability config" }
             }

package/dist/analysis/cross-origin-session.mjs

@@ -96,12 +96,14 @@ var CrossOriginSession = class _CrossOriginSession {
           {
             path: "hostname",
             label: "Host name of the page",
+            category: "technical",
             exposure: "none",
             transform: { note: "only compared with the configured parent domain; never sent or stored" }
           },
           {
             path: "https",
             label: "Whether the page uses a secure connection",
+            category: "technical",
             exposure: "none",
             transform: { note: "the shared cookie is only used on secure pages; never sent or stored" }
           }
@@ -127,6 +129,7 @@ var CrossOriginSession = class _CrossOriginSession {
           {
             path: "sessionId",
             label: "Random Observe session id",
+            category: "technical",
             exposure: "token",
             transform: {
               pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
@@ -137,6 +140,7 @@ var CrossOriginSession = class _CrossOriginSession {
           {
             path: "lastActiveAt",
             label: "Time of the last tracked activity",
+            category: "technical",
             exposure: "none",
             transform: {
               note: "decides whether the session is still active; not sent to Corbado, but the cookie carries it to every subdomain of the configured domain"
@@ -145,6 +149,7 @@ var CrossOriginSession = class _CrossOriginSession {
           {
             path: "seqMark",
             label: "Event counter position",
+            category: "technical",
             exposure: "none",
             transform: {
               note: "the next page continues event numbering above it; not sent to Corbado, but the cookie carries it to every subdomain of the configured domain"
@@ -162,6 +167,7 @@ var CrossOriginSession = class _CrossOriginSession {
           {
             path: "context",
             label: "Optional reference set by your integration",
+            category: "technical",
             exposure: "none",
             transform: {
               note: "opaque string of at most 128 cookie-safe characters chosen by the integration; not sent to Corbado, but the cookie carries it to every subdomain of the configured domain"

package/dist/analysis/device-info-manager.mjs

@@ -11,6 +11,7 @@ function isDocumentHidden() {
       {
         path: "visibilityState",
         label: "Whether the page is hidden",
+        category: "technical",
         exposure: "enum",
         transform: { values: ["hidden", "other"] }
       }

package/dist/analysis/device.mjs

@@ -187,6 +187,7 @@ var DeviceCollector = class {
             {
               path: "result",
               label: "Whether Bluetooth is available",
+              category: "device",
               exposure: "enum",
               transform: { values: [true, false] }
             }
@@ -206,6 +207,7 @@ var DeviceCollector = class {
             {
               path: "result.<capability>",
               label: "Supported passkey features",
+              category: "device",
               exposure: "enum",
               transform: { values: ["true", "false"], note: "open set of capability names, kept as reported" }
             }
@@ -225,6 +227,7 @@ var DeviceCollector = class {
             {
               path: "result",
               label: "Whether the device has a built-in passkey authenticator",
+              category: "device",
               exposure: "enum",
               transform: { values: [true, false] }
             }
@@ -244,6 +247,7 @@ var DeviceCollector = class {
             {
               path: "result",
               label: "Whether passkey autofill is available",
+              category: "device",
               exposure: "enum",
               transform: { values: [true, false] }
             }
@@ -260,15 +264,16 @@ var DeviceCollector = class {
           group: "Device information",
           origin: "observe-external",
           fields: [
-            { path: "result.platform", label: "Operating system", exposure: "raw" },
+            { path: "result.platform", label: "Operating system", category: "device", exposure: "raw" },
             {
               path: "result.mobile",
               label: "Whether the device is a mobile device",
+              category: "device",
               exposure: "enum",
               transform: { values: [true, false] }
             },
-            { path: "result.platformVersion", label: "Operating system version", exposure: "raw" },
-            { path: "result.model", label: "Device model", exposure: "raw" }
+            { path: "result.platformVersion", label: "Operating system version", category: "device", exposure: "raw" },
+            { path: "result.model", label: "Device model", category: "device", exposure: "raw" }
           ]
         })
       ),
@@ -285,6 +290,7 @@ var DeviceCollector = class {
             {
               path: "result",
               label: "Whether the browser is controlled by automation",
+              category: "device",
               exposure: "enum",
               transform: { values: [true, false] }
             }
@@ -300,7 +306,9 @@ var DeviceCollector = class {
           accessNote: "navigator.maxTouchPoints",
           group: "Device information",
           origin: "observe-external",
-          fields: [{ path: "result", label: "Number of touch points of the screen", exposure: "raw" }]
+          fields: [
+            { path: "result", label: "Number of touch points of the screen", category: "device", exposure: "raw" }
+          ]
         })
       )
     ];
@@ -446,6 +454,7 @@ var DeviceCollector = class {
           {
             path: "result.isPrivate",
             label: "Whether private browsing is on",
+            category: "device",
             exposure: "enum",
             transform: { values: [true, false] }
           }

package/dist/analysis/index.mjs

@@ -42,6 +42,7 @@ import {
   detectPasswordManagerExtensions
 } from "./readers/password-manager-extensions.mjs";
 import {
+  READER_CATEGORIES,
   READER_EXPOSURES
 } from "./readers/meta.mjs";
 import {
@@ -86,6 +87,7 @@ async function destroy() {
   setDefaultTracker(void 0);
 }
 export {
+  READER_CATEGORIES,
   READER_EXPOSURES,
   SDK_NAME,
   SDK_VERSION,

package/dist/analysis/low-events/grouped-input-tracker.mjs

@@ -25,12 +25,14 @@ var LowEventGroupedInputTracker = class {
           {
             path: "event.paste",
             label: "Paste into the field",
+            category: "behavior",
             exposure: "presence",
             transform: { note: "trusted paste events only" }
           },
           {
             path: "value",
             label: "Length of the pasted text",
+            category: "behavior",
             exposure: "size",
             transform: { note: "inserted length only; values are compared in memory and discarded" }
           }
@@ -66,27 +68,40 @@ var LowEventGroupedInputTracker = class {
             group: "Input interaction",
             origin: "observe-external",
             fields: [
-              { path: "event.focus", label: "Field selected", exposure: "presence" },
+              { path: "event.focus", label: "Field selected", category: "behavior", exposure: "presence" },
               {
                 path: "event.focus.relatedTarget",
                 label: "Whether focus moved between fields of the same group",
+                category: "behavior",
                 exposure: "computed",
                 transform: { note: "only whether focus moves within the group" }
               },
-              { path: "event.blur", label: "Field left", exposure: "presence" },
-              { path: "event.pointerdown", label: "Pointer pressed on the field", exposure: "presence" },
-              { path: "event.pointerup", label: "Pointer released on the field", exposure: "presence" },
-              { path: "event.click", label: "Click on the field", exposure: "presence" },
-              { path: "event.input", label: "Typing in the field", exposure: "presence" },
+              { path: "event.blur", label: "Field left", category: "behavior", exposure: "presence" },
+              {
+                path: "event.pointerdown",
+                label: "Pointer pressed on the field",
+                category: "behavior",
+                exposure: "presence"
+              },
+              {
+                path: "event.pointerup",
+                label: "Pointer released on the field",
+                category: "behavior",
+                exposure: "presence"
+              },
+              { path: "event.click", label: "Click on the field", category: "behavior", exposure: "presence" },
+              { path: "event.input", label: "Typing in the field", category: "behavior", exposure: "presence" },
               {
                 path: "event.input.isComposing",
                 label: "Whether text is being composed with an input method",
+                category: "behavior",
                 exposure: "enum",
                 transform: { values: [true, false] }
               },
               {
                 path: "event.keyup.key",
                 label: "Escape key pressed",
+                category: "behavior",
                 exposure: "enum",
                 transform: { values: ["Escape", "other"] }
               }
@@ -134,6 +149,7 @@ var LowEventGroupedInputTracker = class {
               {
                 path: "event.pagehide",
                 label: "Leaving the page",
+                category: "technical",
                 exposure: "presence",
                 transform: { note: "flushes pending input low events on unload" }
               }
@@ -157,6 +173,7 @@ var LowEventGroupedInputTracker = class {
           {
             path: "focused",
             label: "Whether the field is selected",
+            category: "behavior",
             exposure: "enum",
             transform: { values: [true, false] }
           }
@@ -191,6 +208,7 @@ var LowEventGroupedInputTracker = class {
           {
             path: "value.length",
             label: "Length of the entered text",
+            category: "behavior",
             exposure: "size",
             transform: { note: "summed over the fields of a group" }
           }