@corbado/observe 1.14.1 → 1.15.1

package/dist/manifest/index.js

@@ -0,0 +1,787 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/manifest/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AC_CEREMONY: () => AC_CEREMONY,
+  CATEGORIES: () => CATEGORIES,
+  CATEGORY_VALUE_LEVELS: () => CATEGORY_VALUE_LEVELS,
+  KIND_LADDERS: () => KIND_LADDERS,
+  NON_VALUE_LEVELS: () => NON_VALUE_LEVELS,
+  SDK_API: () => SDK_API,
+  SDK_CAPABILITIES: () => SDK_CAPABILITIES,
+  SDK_DEVICE: () => SDK_DEVICE,
+  SDK_GATEWAYS: () => SDK_GATEWAYS,
+  SDK_GENERATED: () => SDK_GENERATED,
+  SDK_INPUT: () => SDK_INPUT,
+  SDK_OWN_STORAGE: () => SDK_OWN_STORAGE,
+  SDK_PAGE: () => SDK_PAGE,
+  SDK_PASSWORD_MANAGERS: () => SDK_PASSWORD_MANAGERS,
+  SDK_PRIVATE_MODE: () => SDK_PRIVATE_MODE,
+  SDK_RECORD: () => SDK_RECORD,
+  SDK_TRANSPORT: () => SDK_TRANSPORT,
+  SDK_WINDOW: () => SDK_WINDOW,
+  VALUE_LEVELS: () => VALUE_LEVELS,
+  capabilities: () => capabilities,
+  gateways: () => gateways
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/manifest/ac-ceremony.ts
+var AC_CEREMONY = {
+  key: "ac:ceremony",
+  version: 1,
+  title: "Passkey prompts, without credentials or challenges",
+  why: "Shows whether passkey sign-in and creation work, and why they fail.",
+  collects: [
+    "kind (sign-in or creation), how it was offered, phase, outcome, timing",
+    "error name from a fixed list",
+    "request settings (timeout, user verification, hints, attestation, authenticator selection, names of requested extensions)",
+    "the site's domain the passkey belongs to (relying party id)",
+    "allowed passkeys: how many, transports or hybrid named, whether the one used was among them (their ids replaced by random stand-ins that only match within the page)",
+    "origin the browser reports, cross-origin flags",
+    "attestation: format, authenticator certificates (model, not person), the passkey's public key",
+    "authenticator data as reported: the site's hash, flags and signature counter",
+    "authenticator model (AAGUID), user present / verified, backup eligible / backed up, transports, attachment, algorithm, resident key, PRF enabled",
+    "whether a user handle exists"
+  ],
+  never: [
+    {
+      text: "the challenge (replaced by zeros in the options and the client data)",
+      proof: "ac:ceremony@1#never.challenge"
+    },
+    { text: "signature", proof: "ac:ceremony@1#never.signature" },
+    { text: "user handle (only whether one exists)", proof: "ac:ceremony@1#never.user-handle" },
+    { text: "user name, display name or id", proof: "ac:ceremony@1#never.user" },
+    { text: "the site's display name in the creation request", proof: "ac:ceremony@1#never.rp-name" },
+    { text: "PRF results", proof: "ac:ceremony@1#never.prf" },
+    {
+      text: "the passkey's id, unless the project names the passkey reference option",
+      proof: "ac:ceremony@1#never.credential-id"
+    }
+  ],
+  options: [
+    {
+      name: "passkeyReference",
+      adds: "the passkey's random id, to recognize the same passkey across sign-ins. Its own field, category opaque-identifier, level raw. Without it the ids are replaced by random stand-ins that only match within one page load, so projects that track credentials (passkey KPIs, passkey provider at sign-in) declare passkeyReference: true (adx, vg, vr, adb). A runtime option (not a build switch): the autocapture runtime passes it from the static config, the manifest records its value from build.config."
+    }
+  ],
+  sideEffects: [
+    {
+      id: "ceremony.wrap-credentials",
+      text: "wraps navigator.credentials.get and navigator.credentials.create, so every passkey prompt of the page passes through it"
+    },
+    {
+      id: "ceremony.credentials-proxy",
+      text: "navigator.credentials is replaced by a proxy that forwards to the original",
+      when: "aap"
+    }
+  ],
+  usedOn: "passkey prompts, passkey data in request bodies and page attributes (fields declared via ac:ceremony@1); default set: technical and device facts only",
+  when: "ceremony"
+};
+
+// src/manifest/sdk-api.ts
+var SDK_API = {
+  key: "sdk:api",
+  version: 1,
+  source: { key: "host-config:sdk.api", kind: "host-config", title: "Values the integration passes to Observe" },
+  title: "Values the integration passes to Observe",
+  fields: [
+    {
+      path: "experiments",
+      level: "raw",
+      category: "technical",
+      label: "Experiment names and variants the site assigns"
+    },
+    { path: "dataPolicy", level: "raw", category: "technical", label: "Code of the data policy the site applies" },
+    {
+      path: "emailLink.transactionId",
+      level: "pseudonym",
+      category: "personal-identifier",
+      label: "Transaction reference of an email link, as the integration passes it (a projects' declaration narrows it)",
+      // email-link typed operation (`utils/email-link-operation-full.ts`), optional code
+      requires: "sdk-operations"
+    }
+  ]
+};
+
+// src/manifest/sdk-device.ts
+var enumBool = { values: [true, false] };
+var SDK_DEVICE = {
+  key: "sdk:device",
+  version: 1,
+  title: "Device and browser features",
+  source: { key: "browser-api:sdk.device", kind: "browser-api", title: "Device and browser features" },
+  fields: [
+    {
+      path: "uaHints.platform",
+      level: "raw",
+      category: "device",
+      label: "Operating system",
+      examples: ["macOS", "Android", "Windows"]
+    },
+    {
+      path: "uaHints.platformVersion",
+      level: "raw",
+      category: "device",
+      label: "Operating system version",
+      examples: ["15.1.0"]
+    },
+    {
+      path: "uaHints.mobile",
+      level: "enum",
+      category: "device",
+      label: "Whether the device is a mobile device",
+      transform: enumBool
+    },
+    {
+      path: "uaHints.model",
+      level: "raw",
+      category: "device",
+      label: "Device model",
+      examples: ["Pixel 8", "SM-S918B"]
+    },
+    {
+      path: "passkeys.platform",
+      level: "enum",
+      category: "device",
+      label: "Whether the device has a built-in passkey authenticator",
+      transform: enumBool
+    },
+    {
+      path: "passkeys.autofill",
+      level: "enum",
+      category: "device",
+      label: "Whether passkey autofill is available",
+      transform: enumBool
+    },
+    {
+      path: "clientCapabilities.<capability>",
+      level: "enum",
+      category: "device",
+      label: "Supported passkey features (names as the browser reports them)",
+      transform: { values: ["true", "false"] }
+    },
+    {
+      path: "bluetooth",
+      level: "enum",
+      category: "device",
+      label: "Whether Bluetooth is available",
+      transform: enumBool
+    },
+    {
+      path: "webdriver",
+      level: "enum",
+      category: "device",
+      label: "Whether the browser is controlled by automation",
+      transform: enumBool
+    },
+    {
+      path: "maxTouchPoints",
+      level: "raw",
+      category: "device",
+      label: "Number of touch points of the screen",
+      examples: [0, 5]
+    },
+    {
+      path: "collectionErrors[]",
+      level: "raw",
+      category: "technical",
+      label: "Which device check failed or timed out, with the browser's error name and message"
+    },
+    {
+      path: "privateMode",
+      level: "enum",
+      category: "device",
+      label: "Whether the window is private",
+      transform: enumBool,
+      via: "sdk:private-mode@1",
+      when: "privateMode"
+    },
+    {
+      path: "passwordManagers[]",
+      level: "enum",
+      category: "device",
+      label: "Names of detected password managers",
+      transform: {
+        values: ["1password", "bitwarden", "dashlane", "kaspersky", "keeper", "lastpass", "nordpass", "protonpass"]
+      },
+      via: "sdk:password-managers@1",
+      when: "pmd"
+    },
+    {
+      path: "userAgent.blocked",
+      level: "enum",
+      category: "device",
+      label: "Whether the browser looks like a crawler or bot (then nothing is sent)",
+      transform: enumBool
+    }
+  ]
+};
+
+// src/manifest/sdk-generated.ts
+var SDK_GENERATED = {
+  key: "sdk:generated",
+  version: 1,
+  title: "Identifiers the script creates",
+  generated: [
+    {
+      id: "generated:sdk.device-handle",
+      category: "opaque-identifier",
+      pointsTo: "browser",
+      lifetime: "persistent",
+      scope: "origin",
+      exposedTo: ["corbado", "page scripts (local storage)"],
+      label: "Random id of this browser, kept until the site's storage is cleared, sent with the device information together with the time it was created. With the option deviceHandleMaxAge (from the static config, recorded in build.config) it is replaced once older than that maximum; the lifetime is then that duration."
+    },
+    {
+      id: "generated:sdk.session",
+      category: "opaque-identifier",
+      pointsTo: "session",
+      lifetime: "PT30M",
+      scope: "all tabs",
+      exposedTo: ["corbado", "page scripts (getSessionId)", "page scripts (local storage)"],
+      label: "Random id of a visit, shared by the site's tabs and renewed after the configured time without activity (built-in 30 minutes; the build's config decides); without session continuity per tab.",
+      when: "sessionContinuity"
+    },
+    {
+      id: "generated:sdk.tab-session",
+      category: "opaque-identifier",
+      pointsTo: "session",
+      lifetime: "tab",
+      scope: "tab",
+      exposedTo: ["corbado", "page scripts (getSessionId)", "page scripts (session storage)"],
+      label: "Random id of a visit in one tab (without session continuity)."
+    },
+    {
+      id: "generated:sdk.tab",
+      category: "opaque-identifier",
+      pointsTo: "tab",
+      lifetime: "tab",
+      scope: "tab",
+      exposedTo: ["corbado", "page scripts (session storage)"],
+      label: "Random id of the browser tab."
+    },
+    {
+      id: "generated:sdk.page",
+      category: "opaque-identifier",
+      pointsTo: "page",
+      lifetime: "page-load",
+      scope: "page",
+      exposedTo: ["corbado"],
+      label: "Random id of one page load, on the field and window interaction records."
+    },
+    {
+      id: "generated:sdk.event",
+      category: "opaque-identifier",
+      pointsTo: "event",
+      lifetime: "event",
+      exposedTo: ["corbado"],
+      label: "Random id of each record, so a record sent twice counts once (contains its creation time)."
+    },
+    {
+      id: "generated:sdk.passkey-stand-in",
+      category: "opaque-identifier",
+      pointsTo: "credential",
+      lifetime: "page-load",
+      scope: "page",
+      exposedTo: ["corbado"],
+      label: "Random stand-in for a passkey's id within one page load, so the allowed passkeys can be matched with the one used without sending the id.",
+      when: "ceremony"
+    }
+  ]
+};
+var SDK_RECORD = {
+  key: "sdk:record",
+  version: 1,
+  title: "Fields the script adds to each record",
+  source: { key: "record:sdk.event", kind: "record", title: "Fields the script adds to each record" },
+  fields: [
+    {
+      path: "seq",
+      level: "raw",
+      category: "technical",
+      label: "Counters that order the records of a visit and of a page (kept with the visit in local storage, shared by the visit's tabs)",
+      examples: [1, 2, 17]
+    }
+  ]
+};
+
+// src/manifest/sdk-own-storage.ts
+var DEVICE = "browser-api:sdk.device";
+var API = "host-config:sdk.api";
+var SDK_OWN_STORAGE = {
+  key: "sdk:own-storage",
+  version: 1,
+  title: "What the script keeps in the browser",
+  stored: [
+    {
+      id: "storage:sdk.outbox",
+      keys: ["cbo_outbox_*"],
+      area: "local",
+      scope: "origin",
+      retention: "P7D",
+      enforced: true,
+      owner: "sdk",
+      contents: ["sent:events"],
+      label: "Records not yet delivered, deleted once sent; never kept longer than 7 days",
+      when: "durableOutbox"
+    },
+    {
+      id: "storage:sdk.low-outbox",
+      // `cbo_low_outbox_v1` with the default storage scope, `cbo_low_outbox_v1_<projectId>` with storageScope "project"
+      keys: ["cbo_low_outbox_v1", "cbo_low_outbox_v1_*"],
+      area: "local",
+      scope: "origin",
+      retention: "P7D",
+      enforced: true,
+      owner: "sdk",
+      contents: ["sent:events"],
+      label: "Field and window interaction records not yet delivered; never kept longer than 7 days",
+      // queue.ts enqueueLow writes only with durableLowOutbox; the queue always opens the low outbox to recover and
+      // resend (or drop after 7 days / on rejection) what an earlier load left
+      when: "durableLowOutbox",
+      otherwise: {
+        note: "Not written by this build (durableLowOutbox is off): low events are sent from memory; entries left by an older build are sent or removed."
+      }
+    },
+    {
+      id: "storage:sdk.session",
+      keys: ["cbo_session_*"],
+      area: "local",
+      scope: "origin",
+      retention: "persistent",
+      enforced: false,
+      owner: "sdk",
+      contents: ["generated:sdk.session"],
+      label: "Visit id with its last activity time; replaced on the next visit after the inactivity window",
+      when: "sessionContinuity"
+    },
+    {
+      id: "storage:sdk.seq",
+      keys: ["cbo_seq_*"],
+      area: "local",
+      scope: "origin",
+      retention: "persistent",
+      owner: "sdk",
+      contents: ["record:sdk.event#seq"],
+      label: "Record counter of the visit",
+      when: "sessionContinuity"
+    },
+    {
+      id: "storage:sdk.tab-session",
+      keys: ["cbo_session_id_*"],
+      area: "session",
+      scope: "tab",
+      retention: "tab",
+      owner: "sdk",
+      contents: ["generated:sdk.tab-session"],
+      label: "Visit id of this tab"
+    },
+    {
+      id: "storage:sdk.tab-id",
+      keys: ["cbo_tab_id_*"],
+      area: "session",
+      scope: "tab",
+      retention: "tab",
+      owner: "sdk",
+      contents: ["generated:sdk.tab"],
+      label: "Tab id"
+    },
+    {
+      id: "storage:sdk.device-handle",
+      keys: ["cbo_client_env_handle_*"],
+      area: "local",
+      scope: "origin",
+      retention: "persistent",
+      owner: "sdk",
+      contents: ["generated:sdk.device-handle"],
+      label: "Browser id with the time it was created; replaced after the deviceHandleMaxAge option's maximum when set (build.config)"
+    },
+    {
+      id: "storage:sdk.config",
+      keys: ["cbo_sdk_config_cache_*", "cbo_sdk_config_*"],
+      area: "local",
+      scope: "origin",
+      retention: "P1D",
+      enforced: false,
+      owner: "sdk",
+      contents: [],
+      label: "Corbado's settings for the script (no personal data); refreshed at most daily",
+      // only ConfigManager (absent from static-config builds) reads, writes or removes it; nothing removes an older
+      // cache in a static build (storage/migration.ts may still copy a pre-multi-project `cbo_sdk_config` once)
+      when: "!static"
+    },
+    {
+      id: "storage:sdk.private-mode",
+      keys: ["cbo_pm_*"],
+      area: "local",
+      scope: "origin",
+      retention: "P7D",
+      enforced: true,
+      owner: "sdk",
+      contents: [`${DEVICE}#privateMode`],
+      label: "Result of the private-mode check, reused for 7 days",
+      when: "privateMode"
+    },
+    {
+      id: "storage:sdk.experiments",
+      keys: ["cbo_experiments_*"],
+      area: "local",
+      scope: "origin",
+      retention: "persistent",
+      owner: "sdk",
+      contents: [`${API}#experiments`],
+      label: "Experiment assignments the site set"
+    },
+    {
+      id: "storage:sdk.data-policy",
+      keys: ["cbo_data_policy_*"],
+      area: "local",
+      scope: "origin",
+      retention: "persistent",
+      owner: "sdk",
+      contents: [`${API}#dataPolicy`],
+      label: "Data policy code the site set"
+    },
+    {
+      id: "storage:sdk.email-link-starts",
+      keys: ["cbo_email_link_starts_*"],
+      area: "local",
+      scope: "origin",
+      retention: "P1D",
+      enforced: true,
+      owner: "sdk",
+      contents: [`${API}#emailLink.transactionId`, "generated:sdk.event", "generated:sdk.session"],
+      label: "Started email links (at most 10), to continue them on the link's page; deleted after 24 hours",
+      // written only by the email-link typed operation (`utils/email-link-operation-full.ts`)
+      requires: "sdk-operations"
+    },
+    {
+      id: "storage:sdk.storage-schema",
+      keys: ["cbo_storage_schema"],
+      area: "local",
+      scope: "origin",
+      retention: "persistent",
+      owner: "sdk",
+      contents: [],
+      label: "Version of the script's storage layout (no personal data)"
+    },
+    {
+      id: "storage:sdk.storage-schema-tab",
+      keys: ["cbo_storage_schema"],
+      area: "session",
+      scope: "tab",
+      retention: "tab",
+      owner: "sdk",
+      contents: [],
+      label: "Version of the script's storage layout in this tab (no personal data)"
+    },
+    {
+      id: "storage:sdk.legacy-debug",
+      // queue.ts removes the project-scoped keys at start (a one-time storage/migration.ts copy of a pre-multi-project
+      // unscoped key included, removed in the same start); the unscoped originals are left untouched
+      keys: ["cbo_visibility_change_debug_*", "cbo_pagehide_debug_*"],
+      area: "local",
+      scope: "origin",
+      retention: "PT0S",
+      enforced: true,
+      deleteOnly: true,
+      owner: "sdk",
+      contents: [],
+      label: "Debug keys of older versions",
+      note: "Debug keys of older versions (they held the unmasked page address); removed when found, never written."
+    },
+    {
+      id: "storage:sdk.cross-origin-session",
+      keys: ["cbo_xs_*"],
+      area: "cookie",
+      scope: "cookie domain + path /",
+      retention: "PT30M",
+      owner: "sdk",
+      contents: ["generated:sdk.session", "record:sdk.event#seq"],
+      label: "Visit shared across the site's subdomains (first-party cookie); only with the cross-origin session plugin",
+      when: "crossOriginSession",
+      requires: "cross-origin-session"
+    }
+  ]
+};
+
+// src/manifest/sdk-page.ts
+var SDK_PAGE = {
+  key: "sdk:page",
+  version: 1,
+  source: { key: "page:sdk.location", kind: "url", title: "Page address" },
+  title: "Page address",
+  fields: [
+    {
+      path: "sourcePath.path",
+      level: "raw",
+      category: "technical",
+      label: "Page path, as is",
+      examples: ["/account-login"]
+    },
+    {
+      path: "sourcePath.query",
+      level: "partial",
+      category: "technical",
+      label: "Names of the page address parameters; their values masked unless the parameter is allowlisted",
+      transform: { keep: "keys; values of allowlisted keys", masked: "*" },
+      examples: ["?flow=*&locale=*"]
+    }
+  ]
+};
+
+// src/manifest/sdk-input.ts
+var SDK_INPUT = {
+  key: "sdk:input",
+  version: 1,
+  title: "Use of form fields, never their content",
+  why: "Shows where people struggle with sign-in fields, such as retyping, pasting or autofill failing, without seeing what they enter.",
+  collects: [
+    "the field was selected or left",
+    "typed into, pasted into, filled automatically by the browser or a password manager",
+    "whether something was entered (empty or not)",
+    "whether a change inserted or removed several characters at once",
+    "start and duration of a typing run",
+    "pointer and click on the field, the Escape key pressed in it (only that key)"
+  ],
+  never: [
+    { text: "what is entered", proof: "sdk:input@1#never.content" },
+    { text: "how many characters are entered", proof: "sdk:input@1#never.length" },
+    { text: "individual keystrokes or their timing", proof: "sdk:input@1#never.keystrokes" },
+    { text: "selected text", proof: "sdk:input@1#never.selection" }
+  ],
+  modes: {
+    single: "per field",
+    group: "Group (one-time codes): only whether all fields are empty; no moves between the fields"
+  },
+  sideEffects: [
+    {
+      id: "dom.mutation-observers",
+      text: "watches the whole document for added elements (MutationObserver, child list and subtree) to find declared elements and fields when the page changes"
+    }
+  ],
+  usedOn: "input fields",
+  review: "SEC-input-v1"
+};
+
+// src/manifest/sdk-password-managers.ts
+var SDK_PASSWORD_MANAGERS = {
+  key: "sdk:password-managers",
+  version: 1,
+  title: "Installed password managers",
+  why: "Helps explain autofill behavior and failures.",
+  collects: ["names of detected password managers from a fixed list"],
+  never: [
+    { text: "whether the person is signed in to them", proof: "sdk:password-managers@1#never.signed-in" },
+    { text: "anything stored in them", proof: "sdk:password-managers@1#never.contents" }
+  ],
+  sideEffects: [
+    {
+      id: "pmd.stylesheet",
+      text: "briefly adopts a temporary stylesheet and cancels the animation it starts, in the same task",
+      when: "pmd"
+    },
+    {
+      id: "pmd.prototype-check",
+      text: "calls browser methods on throwaway objects and reads their source text and error stacks, to recognise extension wrappers",
+      when: "pmd"
+    },
+    {
+      id: "pmd.page-global",
+      text: "reads the names in one page global (the error-reporting ids of scripts)",
+      when: "pmd"
+    }
+  ],
+  usedOn: "after a tracked field gets focus, and once the page has loaded",
+  when: "pmd"
+};
+
+// src/manifest/sdk-private-mode.ts
+var SDK_PRIVATE_MODE = {
+  key: "sdk:private-mode",
+  version: 1,
+  title: "Private browsing mode",
+  why: "Private windows behave differently for passkeys and stored sessions.",
+  collects: ["whether the window is private (one yes/no)"],
+  never: [
+    { text: "browsing history", proof: "sdk:private-mode@1#never.history" },
+    { text: "anything else about the browser", proof: "sdk:private-mode@1#never.other" }
+  ],
+  sideEffects: [
+    {
+      id: "private-mode.test-storage",
+      text: "the third-party library creates temporary test databases, a test directory and a test storage entry, and removes them at once",
+      when: "privateMode"
+    }
+  ],
+  usedOn: "once per page, cached for the tab",
+  when: "privateMode"
+};
+
+// src/manifest/sdk-transport.ts
+var SDK_TRANSPORT = {
+  key: "sdk:transport",
+  version: 1,
+  title: "Sending to Corbado",
+  transport: [
+    {
+      id: "transport:user-agent",
+      label: "Browser and operating system identifier (User-Agent header)",
+      addedBy: "browser"
+    },
+    { id: "transport:origin", label: "The page's origin (Origin header)", addedBy: "browser" },
+    {
+      id: "transport:client-hints",
+      label: "The browser's default client hints (brand and version, mobile or not, operating system), if the browser sends them; the detailed device facts (for example the model) are read separately and listed under device information.",
+      addedBy: "browser"
+    },
+    {
+      id: "transport:ip-address",
+      label: "The visitor's IP address reaches Corbado's backend with every request, as with any web request. It is discarded there and not stored with the data; it is only kept for a limited time (90 days) in firewall logs when the request was flagged as suspicious.",
+      addedBy: "browser"
+    },
+    {
+      id: "transport:beacon-cookies",
+      label: "Cookies of the ingestion host, on requests sent while the page is closing",
+      addedBy: "browser",
+      when: "beaconKeepalive"
+    },
+    { id: "transport:sent-at", label: "Send time and transport kind of each batch", addedBy: "sdk" }
+  ]
+};
+
+// src/manifest/sdk-window.ts
+var SDK_WINDOW = {
+  key: "sdk:window",
+  version: 1,
+  title: "Window focus, visibility and size",
+  why: "Shows when people leave the page, switch tabs or go back during sign-in.",
+  collects: [
+    "window focus and blur, page hidden or shown",
+    "viewport resize and scroll (batched durations)",
+    "back navigation, leaving the page",
+    "whether focus went to a tracked field"
+  ],
+  never: [
+    { text: "coordinates, scroll positions", proof: "sdk:window@1#never.coordinates" },
+    { text: "key presses", proof: "sdk:window@1#never.keys" },
+    { text: "other tabs or windows", proof: "sdk:window@1#never.other-windows" }
+  ],
+  usedOn: "always on"
+};
+
+// src/manifest/contract.ts
+var NON_VALUE_LEVELS = [
+  "presence",
+  "empty",
+  "interaction",
+  "shown",
+  "request-metadata",
+  "ceremony",
+  "equality"
+];
+var VALUE_LEVELS = ["size", "class", "enum", "pseudonym", "partial", "pattern", "raw"];
+var CATEGORIES = [
+  "secret",
+  "personal-identifier",
+  "opaque-identifier",
+  "personal-data",
+  "device",
+  "technical"
+];
+var CATEGORY_VALUE_LEVELS = {
+  secret: [],
+  "personal-identifier": ["class", "enum", "pseudonym"],
+  "opaque-identifier": ["pseudonym", "raw"],
+  "personal-data": ["size", "class", "enum", "pattern"],
+  device: VALUE_LEVELS,
+  technical: VALUE_LEVELS
+};
+var KIND_LADDERS = {
+  "dom-input": {
+    nonValue: ["presence", "empty", "interaction", "shown"],
+    value: ["size", "enum", "pseudonym", "pattern", "raw"]
+  },
+  "dom-element": {
+    nonValue: ["presence", "shown", "interaction"],
+    value: ["class", "enum", "pseudonym", "pattern", "raw"]
+  },
+  url: { nonValue: ["presence"], value: ["size", "enum", "pseudonym", "partial", "pattern", "raw"] },
+  request: { nonValue: ["presence", "request-metadata"], value: ["class", "enum", "pseudonym", "pattern", "raw"] },
+  storage: { nonValue: ["presence"], value: ["enum", "pseudonym", "pattern", "raw"] },
+  "host-config": { nonValue: ["presence"], value: ["enum", "pattern", "raw"] },
+  // Decided 2026-11-08: levels apply per payload field; elements in a payload go to the input / element gateway.
+  "host-event": {
+    nonValue: ["presence", "interaction"],
+    value: ["size", "class", "enum", "pseudonym", "pattern", "raw"]
+  },
+  // `class` added with WP1 (WebAuthn error classes).
+  "browser-api": { nonValue: ["presence", "ceremony"], value: ["class", "enum", "pseudonym", "pattern", "raw"] },
+  "page/window": { nonValue: ["interaction"], value: [] },
+  // additive: technical fields the SDK adds to each record (sequence counters); nothing read from the page
+  record: { nonValue: ["presence"], value: ["enum", "raw"] }
+};
+
+// src/manifest/index.ts
+var SDK_CAPABILITIES = [
+  SDK_INPUT,
+  SDK_WINDOW,
+  SDK_PASSWORD_MANAGERS,
+  SDK_PRIVATE_MODE,
+  AC_CEREMONY
+];
+var SDK_GATEWAYS = [
+  SDK_DEVICE,
+  SDK_PAGE,
+  SDK_API,
+  SDK_GENERATED,
+  SDK_RECORD,
+  SDK_OWN_STORAGE,
+  SDK_TRANSPORT
+];
+var capabilities = [...SDK_CAPABILITIES];
+var gateways = [...SDK_GATEWAYS];
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AC_CEREMONY,
+  CATEGORIES,
+  CATEGORY_VALUE_LEVELS,
+  KIND_LADDERS,
+  NON_VALUE_LEVELS,
+  SDK_API,
+  SDK_CAPABILITIES,
+  SDK_DEVICE,
+  SDK_GATEWAYS,
+  SDK_GENERATED,
+  SDK_INPUT,
+  SDK_OWN_STORAGE,
+  SDK_PAGE,
+  SDK_PASSWORD_MANAGERS,
+  SDK_PRIVATE_MODE,
+  SDK_RECORD,
+  SDK_TRANSPORT,
+  SDK_WINDOW,
+  VALUE_LEVELS,
+  capabilities,
+  gateways
+});