@corbado/observe 1.11.0 → 1.12.1

package/dist/index.d.mts

@@ -9,8 +9,8 @@
  * removes its item from the manifest.
  *
  * Vocabulary follows the collection manifest data model v1 (`corbado.collection/v1`). Call sites with the
- * same `key` describe one item (the extractor merges them). `title`, `group` and `origin` are optional in
- * the type (additive); every SDK call site declares them (`scripts/check-browser-globals.mjs` enforces it).
+ * same `key` describe one item (the extractor merges them). `title`, `group`, `origin` and field `category` are
+ * optional in the type (additive); every SDK call site declares them (`scripts/check-browser-globals.mjs` enforces it).
  *
  * @internal
  */
@@ -21,6 +21,24 @@
 type ReaderExposure = "none" | "presence" | "size" | "class" | "format" | "partial" | "enum" | "computed" | "token" | "pseudonym" | "redacted" | "raw";
 /** All exposures, least to most exposed. */
 declare const READER_EXPOSURES: readonly ReaderExposure[];
+/**
+ * WHAT KIND of data a field is (its exposure says how much of it is collected):
+ * - `personal-identifier`: email, phone, username or user id as entered or returned, including pseudonyms (hashes)
+ *   of them;
+ * - `personal-data`: other facts about a person (name, address, account details);
+ * - `secret`: passwords, one-time codes, tokens;
+ * - `passkey`: credential ids, authenticator and WebAuthn data;
+ * - `device`: user agent, client hints, screen, device handle, device capabilities;
+ * - `behavior`: input timing and length, paste, focus, clicks, user activation;
+ * - `technical`: status and error codes, timings, page and screen state, SDK state, configuration.
+ *
+ * Declared per field. The manifest extractor resolves a field without one to its item's `category`, else (only for
+ * the exposures `none`, `presence`, `enum`, `size` and `class`) to `technical`; a content-carrying field without a
+ * category is reported as missing.
+ */
+type ReaderCategory = "personal-identifier" | "personal-data" | "secret" | "passkey" | "device" | "behavior" | "technical";
+/** All categories. */
+declare const READER_CATEGORIES: readonly ReaderCategory[];
 /** Parameters of an exposure (which ones apply depends on the exposure). */
 type ReaderTransform = {
     /** `presence`, `enum`: the possible values. */
@@ -55,6 +73,11 @@ type ReaderField = {
      * the path. Every SDK field declares one (`scripts/check-browser-globals.mjs` enforces it).
      */
     label?: string;
+    /**
+     * What kind of data the field is (see {@link ReaderCategory}). Every SDK field declares one
+     * (`scripts/check-browser-globals.mjs` enforces it).
+     */
+    category?: ReaderCategory;
 };
 /** Build-time data switch a reader item depends on (see `FixedDataConfig`). */
 type ReaderDataConfigKey = "pmd" | "privateMode";
@@ -64,6 +87,21 @@ type ReaderDataConfigKey = "pmd" | "privateMode";
  * generated ids, own endpoints); `host-config` = provided by the customer's integration.
  */
 type ReaderOrigin = "observe-external" | "observe-internal" | "host-config";
+/**
+ * Own browser storage a reader writes (an output, not a source): the extractor lists it in the manifest's `storage`
+ * section instead of `sources`. Only for keys Observe writes itself (`cbo_` prefix); a reader of storage the
+ * customer's site writes is a normal source.
+ */
+type ReaderStorage = {
+    /** The storage area. */
+    area: "local" | "session" | "cookie";
+    /** The keys written, `cbo_`-prefixed; a trailing `*` names a key family (e.g. `cbo_*`). */
+    keys: readonly string[];
+    /** How long entries live: `tab` (until the tab closes), `browser` (until the browser closes), `persistent`. */
+    lifetime: "tab" | "browser" | "persistent";
+    /** Customer-readable retention, e.g. `Removed when the sign-in ends` (same text rule as `title`). */
+    retention?: string;
+};
 /** Literal metadata passed to every reader call. */
 type ReaderMeta = {
     /** Stable item key `<kind>:<namespace>.<name>`, e.g. `browser-api:device.webdriver`. */
@@ -79,10 +117,14 @@ type ReaderMeta = {
     group?: string;
     /** Where the value comes from (see {@link ReaderOrigin}). */
     origin?: ReaderOrigin;
+    /** Default {@link ReaderCategory} of the item's fields that declare none (the extractor resolves it per field). */
+    category?: ReaderCategory;
     /** Fields the reader makes reachable; everything else read stays inside the reader. */
     fields: readonly ReaderField[];
     /** The data switch that removes this item from builds that turn it off. */
     dataConfig?: ReaderDataConfigKey;
+    /** Own storage this reader writes (manifest `storage` section; `fields` stays empty). */
+    storage?: ReaderStorage;
 };
 
 type PasswordManagerExtensionName = "1password" | "bitwarden" | "dashlane" | "kaspersky" | "keeper" | "lastpass" | "nordpass" | "protonpass";
@@ -3922,4 +3964,4 @@ declare function telemetry(level: TelemetryLevel, message: string): void;
 /** Destroy the default tracker (see {@link CorbadoTrackerCore.destroy}) and clear the default. */
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_CATEGORIES, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderCategory, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderStorage, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };

package/dist/index.d.ts

@@ -9,8 +9,8 @@
  * removes its item from the manifest.
  *
  * Vocabulary follows the collection manifest data model v1 (`corbado.collection/v1`). Call sites with the
- * same `key` describe one item (the extractor merges them). `title`, `group` and `origin` are optional in
- * the type (additive); every SDK call site declares them (`scripts/check-browser-globals.mjs` enforces it).
+ * same `key` describe one item (the extractor merges them). `title`, `group`, `origin` and field `category` are
+ * optional in the type (additive); every SDK call site declares them (`scripts/check-browser-globals.mjs` enforces it).
  *
  * @internal
  */
@@ -21,6 +21,24 @@
 type ReaderExposure = "none" | "presence" | "size" | "class" | "format" | "partial" | "enum" | "computed" | "token" | "pseudonym" | "redacted" | "raw";
 /** All exposures, least to most exposed. */
 declare const READER_EXPOSURES: readonly ReaderExposure[];
+/**
+ * WHAT KIND of data a field is (its exposure says how much of it is collected):
+ * - `personal-identifier`: email, phone, username or user id as entered or returned, including pseudonyms (hashes)
+ *   of them;
+ * - `personal-data`: other facts about a person (name, address, account details);
+ * - `secret`: passwords, one-time codes, tokens;
+ * - `passkey`: credential ids, authenticator and WebAuthn data;
+ * - `device`: user agent, client hints, screen, device handle, device capabilities;
+ * - `behavior`: input timing and length, paste, focus, clicks, user activation;
+ * - `technical`: status and error codes, timings, page and screen state, SDK state, configuration.
+ *
+ * Declared per field. The manifest extractor resolves a field without one to its item's `category`, else (only for
+ * the exposures `none`, `presence`, `enum`, `size` and `class`) to `technical`; a content-carrying field without a
+ * category is reported as missing.
+ */
+type ReaderCategory = "personal-identifier" | "personal-data" | "secret" | "passkey" | "device" | "behavior" | "technical";
+/** All categories. */
+declare const READER_CATEGORIES: readonly ReaderCategory[];
 /** Parameters of an exposure (which ones apply depends on the exposure). */
 type ReaderTransform = {
     /** `presence`, `enum`: the possible values. */
@@ -55,6 +73,11 @@ type ReaderField = {
      * the path. Every SDK field declares one (`scripts/check-browser-globals.mjs` enforces it).
      */
     label?: string;
+    /**
+     * What kind of data the field is (see {@link ReaderCategory}). Every SDK field declares one
+     * (`scripts/check-browser-globals.mjs` enforces it).
+     */
+    category?: ReaderCategory;
 };
 /** Build-time data switch a reader item depends on (see `FixedDataConfig`). */
 type ReaderDataConfigKey = "pmd" | "privateMode";
@@ -64,6 +87,21 @@ type ReaderDataConfigKey = "pmd" | "privateMode";
  * generated ids, own endpoints); `host-config` = provided by the customer's integration.
  */
 type ReaderOrigin = "observe-external" | "observe-internal" | "host-config";
+/**
+ * Own browser storage a reader writes (an output, not a source): the extractor lists it in the manifest's `storage`
+ * section instead of `sources`. Only for keys Observe writes itself (`cbo_` prefix); a reader of storage the
+ * customer's site writes is a normal source.
+ */
+type ReaderStorage = {
+    /** The storage area. */
+    area: "local" | "session" | "cookie";
+    /** The keys written, `cbo_`-prefixed; a trailing `*` names a key family (e.g. `cbo_*`). */
+    keys: readonly string[];
+    /** How long entries live: `tab` (until the tab closes), `browser` (until the browser closes), `persistent`. */
+    lifetime: "tab" | "browser" | "persistent";
+    /** Customer-readable retention, e.g. `Removed when the sign-in ends` (same text rule as `title`). */
+    retention?: string;
+};
 /** Literal metadata passed to every reader call. */
 type ReaderMeta = {
     /** Stable item key `<kind>:<namespace>.<name>`, e.g. `browser-api:device.webdriver`. */
@@ -79,10 +117,14 @@ type ReaderMeta = {
     group?: string;
     /** Where the value comes from (see {@link ReaderOrigin}). */
     origin?: ReaderOrigin;
+    /** Default {@link ReaderCategory} of the item's fields that declare none (the extractor resolves it per field). */
+    category?: ReaderCategory;
     /** Fields the reader makes reachable; everything else read stays inside the reader. */
     fields: readonly ReaderField[];
     /** The data switch that removes this item from builds that turn it off. */
     dataConfig?: ReaderDataConfigKey;
+    /** Own storage this reader writes (manifest `storage` section; `fields` stays empty). */
+    storage?: ReaderStorage;
 };
 
 type PasswordManagerExtensionName = "1password" | "bitwarden" | "dashlane" | "kaspersky" | "keeper" | "lastpass" | "nordpass" | "protonpass";
@@ -3922,4 +3964,4 @@ declare function telemetry(level: TelemetryLevel, message: string): void;
 /** Destroy the default tracker (see {@link CorbadoTrackerCore.destroy}) and clear the default. */
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_CATEGORIES, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderCategory, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderStorage, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };