@corbado/observe 1.12.0 → 1.13.0

package/dist/index.d.mts

@@ -87,6 +87,21 @@ type ReaderDataConfigKey = "pmd" | "privateMode";
  * generated ids, own endpoints); `host-config` = provided by the customer's integration.
  */
 type ReaderOrigin = "observe-external" | "observe-internal" | "host-config";
+/**
+ * Own browser storage a reader writes (an output, not a source): the extractor lists it in the manifest's `storage`
+ * section instead of `sources`. Only for keys Observe writes itself (`cbo_` prefix); a reader of storage the
+ * customer's site writes is a normal source.
+ */
+type ReaderStorage = {
+    /** The storage area. */
+    area: "local" | "session" | "cookie";
+    /** The keys written, `cbo_`-prefixed; a trailing `*` names a key family (e.g. `cbo_*`). */
+    keys: readonly string[];
+    /** How long entries live: `tab` (until the tab closes), `browser` (until the browser closes), `persistent`. */
+    lifetime: "tab" | "browser" | "persistent";
+    /** Customer-readable retention, e.g. `Removed when the sign-in ends` (same text rule as `title`). */
+    retention?: string;
+};
 /** Literal metadata passed to every reader call. */
 type ReaderMeta = {
     /** Stable item key `<kind>:<namespace>.<name>`, e.g. `browser-api:device.webdriver`. */
@@ -108,6 +123,8 @@ type ReaderMeta = {
     fields: readonly ReaderField[];
     /** The data switch that removes this item from builds that turn it off. */
     dataConfig?: ReaderDataConfigKey;
+    /** Own storage this reader writes (manifest `storage` section; `fields` stays empty). */
+    storage?: ReaderStorage;
 };
 
 type PasswordManagerExtensionName = "1password" | "bitwarden" | "dashlane" | "kaspersky" | "keeper" | "lastpass" | "nordpass" | "protonpass";
@@ -1197,6 +1214,11 @@ interface TrackerPlugin {
     readonly rawErrors?: RawErrorSerializer;
     /** @internal Runs at the end of the constructor, once the queue exists. */
     readonly setup?: (tracker: CorbadoTrackerCore) => void;
+    /**
+     * @internal The batch source path (`meta.trackingSourcePath`) as the integration fixes it; replaces the
+     * server-driven `sourcePathQuery` policy (see `fixedSourcePath()`).
+     */
+    readonly sourcePath?: () => string | undefined;
 }
 /** @internal Serializer of the `rawError` option of operation step errors. */
 type RawErrorSerializer = (value: unknown, options?: SerializeRawErrorOptions) => RawErrorEnvelope | undefined;
@@ -1268,6 +1290,8 @@ declare class CorbadoTrackerCore {
     private bridge?;
     /** Raw-error serializer of a plugin; undefined = operation step errors drop `rawError`. */
     private rawErrors?;
+    /** Fixed source path of a plugin; undefined = the server-driven `sourcePathQuery` policy. */
+    private fixedSourcePath?;
     /** @internal Shared passive page observation and per-operation context registration. */
     getWindowObserver(): SharedWindowObserver;
     /**
@@ -3263,6 +3287,28 @@ declare function probes(): TrackerPlugin;
  */
 declare function probe(tracker: CorbadoTrackerCore, input: ProbeInput): void;
 
+/**
+ * An integration's source-path policy: reduces the page path and query to the batch source path
+ * (`meta.trackingSourcePath`). It must only keep what the integration declared (e.g. page templates and
+ * declared parameters) and mask everything else.
+ */
+type SourcePathPolicy = (path: string, search: string) => string;
+/** Every path segment masked (`/a/b` → `/*\/*`), no query: the result when a policy fails. */
+declare function maskedSourcePath(path: string): string;
+/**
+ * Tracker plugin: the batch source path is fixed by the integration's `policy` instead of the
+ * server-driven `sourcePathQuery` / `sourcePathQueryAllow` config, so it can be declared in the
+ * integration's collection manifest. A policy that throws or returns a non-string yields the fully masked
+ * path ({@link maskedSourcePath}); results are cut to 2048 characters.
+ *
+ * @example
+ * ```ts
+ * import { pageSourcePath } from "@corbado/autocapture/spec";
+ * const tracker = initCore({ projectId, apiBaseUrl, plugins: [fixedSourcePath(pageSourcePath(PAGES))] });
+ * ```
+ */
+declare function fixedSourcePath(policy: SourcePathPolicy): TrackerPlugin;
+
 interface TransportMakeRequestResponse {
     deliveryAccepted?: boolean;
     statusCode?: number;
@@ -3947,4 +3993,4 @@ declare function telemetry(level: TelemetryLevel, message: string): void;
 /** Destroy the default tracker (see {@link CorbadoTrackerCore.destroy}) and clear the default. */
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_CATEGORIES, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderCategory, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_CATEGORIES, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderCategory, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderStorage, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathPolicy, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, fixedSourcePath, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, maskedSourcePath, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };

package/dist/index.d.ts

@@ -87,6 +87,21 @@ type ReaderDataConfigKey = "pmd" | "privateMode";
  * generated ids, own endpoints); `host-config` = provided by the customer's integration.
  */
 type ReaderOrigin = "observe-external" | "observe-internal" | "host-config";
+/**
+ * Own browser storage a reader writes (an output, not a source): the extractor lists it in the manifest's `storage`
+ * section instead of `sources`. Only for keys Observe writes itself (`cbo_` prefix); a reader of storage the
+ * customer's site writes is a normal source.
+ */
+type ReaderStorage = {
+    /** The storage area. */
+    area: "local" | "session" | "cookie";
+    /** The keys written, `cbo_`-prefixed; a trailing `*` names a key family (e.g. `cbo_*`). */
+    keys: readonly string[];
+    /** How long entries live: `tab` (until the tab closes), `browser` (until the browser closes), `persistent`. */
+    lifetime: "tab" | "browser" | "persistent";
+    /** Customer-readable retention, e.g. `Removed when the sign-in ends` (same text rule as `title`). */
+    retention?: string;
+};
 /** Literal metadata passed to every reader call. */
 type ReaderMeta = {
     /** Stable item key `<kind>:<namespace>.<name>`, e.g. `browser-api:device.webdriver`. */
@@ -108,6 +123,8 @@ type ReaderMeta = {
     fields: readonly ReaderField[];
     /** The data switch that removes this item from builds that turn it off. */
     dataConfig?: ReaderDataConfigKey;
+    /** Own storage this reader writes (manifest `storage` section; `fields` stays empty). */
+    storage?: ReaderStorage;
 };
 
 type PasswordManagerExtensionName = "1password" | "bitwarden" | "dashlane" | "kaspersky" | "keeper" | "lastpass" | "nordpass" | "protonpass";
@@ -1197,6 +1214,11 @@ interface TrackerPlugin {
     readonly rawErrors?: RawErrorSerializer;
     /** @internal Runs at the end of the constructor, once the queue exists. */
     readonly setup?: (tracker: CorbadoTrackerCore) => void;
+    /**
+     * @internal The batch source path (`meta.trackingSourcePath`) as the integration fixes it; replaces the
+     * server-driven `sourcePathQuery` policy (see `fixedSourcePath()`).
+     */
+    readonly sourcePath?: () => string | undefined;
 }
 /** @internal Serializer of the `rawError` option of operation step errors. */
 type RawErrorSerializer = (value: unknown, options?: SerializeRawErrorOptions) => RawErrorEnvelope | undefined;
@@ -1268,6 +1290,8 @@ declare class CorbadoTrackerCore {
     private bridge?;
     /** Raw-error serializer of a plugin; undefined = operation step errors drop `rawError`. */
     private rawErrors?;
+    /** Fixed source path of a plugin; undefined = the server-driven `sourcePathQuery` policy. */
+    private fixedSourcePath?;
     /** @internal Shared passive page observation and per-operation context registration. */
     getWindowObserver(): SharedWindowObserver;
     /**
@@ -3263,6 +3287,28 @@ declare function probes(): TrackerPlugin;
  */
 declare function probe(tracker: CorbadoTrackerCore, input: ProbeInput): void;
 
+/**
+ * An integration's source-path policy: reduces the page path and query to the batch source path
+ * (`meta.trackingSourcePath`). It must only keep what the integration declared (e.g. page templates and
+ * declared parameters) and mask everything else.
+ */
+type SourcePathPolicy = (path: string, search: string) => string;
+/** Every path segment masked (`/a/b` → `/*\/*`), no query: the result when a policy fails. */
+declare function maskedSourcePath(path: string): string;
+/**
+ * Tracker plugin: the batch source path is fixed by the integration's `policy` instead of the
+ * server-driven `sourcePathQuery` / `sourcePathQueryAllow` config, so it can be declared in the
+ * integration's collection manifest. A policy that throws or returns a non-string yields the fully masked
+ * path ({@link maskedSourcePath}); results are cut to 2048 characters.
+ *
+ * @example
+ * ```ts
+ * import { pageSourcePath } from "@corbado/autocapture/spec";
+ * const tracker = initCore({ projectId, apiBaseUrl, plugins: [fixedSourcePath(pageSourcePath(PAGES))] });
+ * ```
+ */
+declare function fixedSourcePath(policy: SourcePathPolicy): TrackerPlugin;
+
 interface TransportMakeRequestResponse {
     deliveryAccepted?: boolean;
     statusCode?: number;
@@ -3947,4 +3993,4 @@ declare function telemetry(level: TelemetryLevel, message: string): void;
 /** Destroy the default tracker (see {@link CorbadoTrackerCore.destroy}) and clear the default. */
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_CATEGORIES, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderCategory, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, type CookieStorageOptions, CorbadoTracker, CorbadoTrackerCore, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, ProbeLane, type ProbePending, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_CATEGORIES, READER_EXPOSURES, type RawErrorEnvelope, type RawErrorSerializer, type ReaderCategory, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderStorage, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, type SessionBridge, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathPolicy, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerCoreOptions, type TrackerOptions, type TrackerPlugin, type TrackerStorageEngine, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, appConfirmationOperationFull, authDecisionFinished, authDecisionStarted, cacheConfigRecord, captchaOperationFull, clearExperiment, clearExperiments, continueEmailLinkOperation, conversion, cookieStorage, createLogger, crossOriginSession, destroy, detectPasswordManagerExtensions, emailLinkOperationFull, emailOtpOperationFull, fixedSourcePath, formOperationFull, getCrossOriginContext, getExperiments, getSessionId, getTracker, getTrackerCore, init, initCore, installProbeLane, keyRegistrationOperationFull, keySigningOperationFull, loadCachedConfig, loadConfigRecord, logError, logInfo, maskedSourcePath, namespacedKey, parseReliabilityConfig, passkeyDeletionOperationFull, passkeyEnrollmentFullOperation, passkeyLoginFullOperation, passwordEnrollmentFullOperation, passwordLoginFullOperation, probe, probes, provideDataOperationFull, provideIdentifierOperationFull, rawErrors, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setCrossOriginContext, setExperiment, setExperiments, setFlowTags, setUser, smsOtpOperationFull, socialLoginOperationFull, ssoLoginOperationFull, telemetry, totpOperationFull, trackSubflowError, trustedDeviceCheckOperationFull, trustedDeviceEnrollmentOperationFull, utf8Length };