@corbado/observe 1.7.0 → 1.7.2

package/dist/index.d.mts

@@ -1418,6 +1418,12 @@ declare class OperationFullProvideIdentifierWithCUI extends OperationFull {
 }
 
 type SocialLoginSpecType = "pre-identifier" | "post-identifier";
+/**
+ * How the attempt began. `button`: the user clicked a provider button and the provider ran in a full-page redirect.
+ * `popup`: the user clicked a provider button and the provider ran in a popup window. `one-tap`: the provider showed
+ * its own prompt (e.g. Google One Tap, a FedCM prompt) and the credential came back in page.
+ */
+type SocialLoginEntry = "button" | "one-tap" | "popup";
 type SocialLoginGetRedirectUrlStart = {
     provider?: SocialLoginProviderType;
     explicitSpecType?: SocialLoginSpecType;
@@ -1425,11 +1431,15 @@ type SocialLoginGetRedirectUrlStart = {
 type SocialLoginGetRedirectUrlFinished = {};
 type SocialLoginExchangeCodeStart = {
     provider?: SocialLoginProviderType;
+    /** Same as the operation config's `entry`, for callers that report only this step. */
+    entry?: SocialLoginEntry;
 };
 type SocialLoginExchangeCodeFinished = {};
 type SocialLoginOperationConfig = {
     /** The classifier drops the attempt if no spec type arrives on any of its events — supply it here or on a step's start data as soon as known. */
     explicitSpecType?: SocialLoginSpecType;
+    /** How the attempt began; omit for a button click with a full-page redirect. */
+    entry?: SocialLoginEntry;
 };
 declare class SocialLoginOperationFull extends OperationFull {
     readonly getRedirectUrl: StepHelper<SocialLoginGetRedirectUrlStart, SocialLoginGetRedirectUrlFinished>;
@@ -2284,6 +2294,32 @@ declare class CorbadoTracker {
      * ```
      */
     formOperationFull(config: FormOperationConfig): FormOperationFull;
+    /**
+     * Track a social login with an external provider (e.g. Google, Apple).
+     *
+     * @param config - Optional spec type and entry.
+     * @remarks
+     * Set `entry` to how the attempt began: omit it for a provider button with a full-page redirect,
+     * `"popup"` when the provider ran in a popup window, `"one-tap"` when the provider showed its own
+     * prompt (e.g. Google One Tap). A One Tap has no redirect: report only `exchangeCode`, never
+     * `getRedirectUrl`.
+     * @example
+     * ```ts
+     * // Provider button:
+     * const social = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier" });
+     * social.getRedirectUrl.start({ provider: "google" });
+     * social.getRedirectUrl.finished({});
+     * // Back from the provider, on the new page load:
+     * const back = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier" });
+     * back.exchangeCode.start({ provider: "google" });
+     * back.exchangeCode.finished({});
+     *
+     * // Google One Tap, when the credential arrives in page:
+     * const oneTap = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier", entry: "one-tap" });
+     * oneTap.exchangeCode.start({ provider: "google" });
+     * oneTap.exchangeCode.finished({});
+     * ```
+     */
     socialLoginOperationFull(config?: SocialLoginOperationConfig): SocialLoginOperationFull;
     /**
      * Track enterprise SSO (SAML/OIDC) through the organization's identity provider.
@@ -2938,7 +2974,7 @@ declare class EventStore<T = Event> {
 type WebAuthnIdentifierProjector = (value: string) => string | null | undefined;
 /**
  * Optional user identifier projection shared by native WebAuthn capture and network serializers.
- * A missing callback preserves user identifiers. Callbacks should be deterministic across payloads.
+ * A missing callback omits user identifiers. Callbacks should be deterministic across payloads.
  * Credential IDs and encoded attestation/authenticator data are retained unchanged.
  */
 type WebAuthnIdentifierProjectors = {
@@ -2947,10 +2983,10 @@ type WebAuthnIdentifierProjectors = {
 };
 /**
  * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
- * Binary values become base64url strings. User IDs are retained unless a projector is supplied.
+ * Binary values become base64url strings. `user.id` is omitted unless a projector is supplied.
  *
  * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
  * @example
@@ -2962,10 +2998,10 @@ type WebAuthnIdentifierProjectors = {
 declare function sanitizeCreationOptions(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
- * By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ * `response.userHandle` is omitted unless a projector is supplied. By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
  *
  * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
  */
@@ -2981,10 +3017,11 @@ declare function sanitizeCreationResponse(value: unknown, projectors?: WebAuthnI
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
 /**
  * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
- * By default other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ * `response.userHandle` is omitted unless a projector is supplied. Other fields remain, including credential IDs.
+ * Binary values become base64url strings.
  *
  * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
  */
@@ -3025,4 +3062,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };

package/dist/index.d.ts

@@ -1418,6 +1418,12 @@ declare class OperationFullProvideIdentifierWithCUI extends OperationFull {
 }
 
 type SocialLoginSpecType = "pre-identifier" | "post-identifier";
+/**
+ * How the attempt began. `button`: the user clicked a provider button and the provider ran in a full-page redirect.
+ * `popup`: the user clicked a provider button and the provider ran in a popup window. `one-tap`: the provider showed
+ * its own prompt (e.g. Google One Tap, a FedCM prompt) and the credential came back in page.
+ */
+type SocialLoginEntry = "button" | "one-tap" | "popup";
 type SocialLoginGetRedirectUrlStart = {
     provider?: SocialLoginProviderType;
     explicitSpecType?: SocialLoginSpecType;
@@ -1425,11 +1431,15 @@ type SocialLoginGetRedirectUrlStart = {
 type SocialLoginGetRedirectUrlFinished = {};
 type SocialLoginExchangeCodeStart = {
     provider?: SocialLoginProviderType;
+    /** Same as the operation config's `entry`, for callers that report only this step. */
+    entry?: SocialLoginEntry;
 };
 type SocialLoginExchangeCodeFinished = {};
 type SocialLoginOperationConfig = {
     /** The classifier drops the attempt if no spec type arrives on any of its events — supply it here or on a step's start data as soon as known. */
     explicitSpecType?: SocialLoginSpecType;
+    /** How the attempt began; omit for a button click with a full-page redirect. */
+    entry?: SocialLoginEntry;
 };
 declare class SocialLoginOperationFull extends OperationFull {
     readonly getRedirectUrl: StepHelper<SocialLoginGetRedirectUrlStart, SocialLoginGetRedirectUrlFinished>;
@@ -2284,6 +2294,32 @@ declare class CorbadoTracker {
      * ```
      */
     formOperationFull(config: FormOperationConfig): FormOperationFull;
+    /**
+     * Track a social login with an external provider (e.g. Google, Apple).
+     *
+     * @param config - Optional spec type and entry.
+     * @remarks
+     * Set `entry` to how the attempt began: omit it for a provider button with a full-page redirect,
+     * `"popup"` when the provider ran in a popup window, `"one-tap"` when the provider showed its own
+     * prompt (e.g. Google One Tap). A One Tap has no redirect: report only `exchangeCode`, never
+     * `getRedirectUrl`.
+     * @example
+     * ```ts
+     * // Provider button:
+     * const social = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier" });
+     * social.getRedirectUrl.start({ provider: "google" });
+     * social.getRedirectUrl.finished({});
+     * // Back from the provider, on the new page load:
+     * const back = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier" });
+     * back.exchangeCode.start({ provider: "google" });
+     * back.exchangeCode.finished({});
+     *
+     * // Google One Tap, when the credential arrives in page:
+     * const oneTap = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier", entry: "one-tap" });
+     * oneTap.exchangeCode.start({ provider: "google" });
+     * oneTap.exchangeCode.finished({});
+     * ```
+     */
     socialLoginOperationFull(config?: SocialLoginOperationConfig): SocialLoginOperationFull;
     /**
      * Track enterprise SSO (SAML/OIDC) through the organization's identity provider.
@@ -2938,7 +2974,7 @@ declare class EventStore<T = Event> {
 type WebAuthnIdentifierProjector = (value: string) => string | null | undefined;
 /**
  * Optional user identifier projection shared by native WebAuthn capture and network serializers.
- * A missing callback preserves user identifiers. Callbacks should be deterministic across payloads.
+ * A missing callback omits user identifiers. Callbacks should be deterministic across payloads.
  * Credential IDs and encoded attestation/authenticator data are retained unchanged.
  */
 type WebAuthnIdentifierProjectors = {
@@ -2947,10 +2983,10 @@ type WebAuthnIdentifierProjectors = {
 };
 /**
  * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
- * Binary values become base64url strings. User IDs are retained unless a projector is supplied.
+ * Binary values become base64url strings. `user.id` is omitted unless a projector is supplied.
  *
  * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
  * @example
@@ -2962,10 +2998,10 @@ type WebAuthnIdentifierProjectors = {
 declare function sanitizeCreationOptions(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
- * By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ * `response.userHandle` is omitted unless a projector is supplied. By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
  *
  * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
  */
@@ -2981,10 +3017,11 @@ declare function sanitizeCreationResponse(value: unknown, projectors?: WebAuthnI
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
 /**
  * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
- * By default other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ * `response.userHandle` is omitted unless a projector is supplied. Other fields remain, including credential IDs.
+ * Binary values become base64url strings.
  *
  * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
  */
@@ -3025,4 +3062,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };