@corbado/observe 1.7.1 → 1.8.0

package/dist/analysis/utils/password-manager-sampler.mjs

@@ -0,0 +1,130 @@
+// src/utils/password-manager-sampler.ts
+import {
+  readPasswordManagerExtensions
+} from "../readers/password-manager-extensions.mjs";
+var LOAD_RESAMPLE_DELAY_MS = 3e3;
+var INPUT_FOCUS_SAMPLE_DELAY_MS = 500;
+var MAX_FOCUS_SAMPLES = 6;
+var IDLE_TIMEOUT_MS = 1e3;
+var PasswordManagerSampler = class {
+  constructor(logger, isEnabled, windowObserver) {
+    this.logger = logger;
+    this.isEnabled = isEnabled;
+    if (typeof window === "undefined" || typeof document === "undefined") return;
+    this.sample();
+    if (document.readyState === "complete") {
+      this.sampleAfter(LOAD_RESAMPLE_DELAY_MS);
+    } else {
+      const onLoad = () => {
+        this.sampleWhenIdle();
+        this.sampleAfter(LOAD_RESAMPLE_DELAY_MS);
+      };
+      window.addEventListener("load", onLoad, { once: true });
+      this.removers.push(() => window.removeEventListener("load", onLoad));
+    }
+    const removeFocus = windowObserver.onInputFocus((field) => {
+      if (!this.isEnabled() || this.sampledFields.has(field)) return;
+      this.sampledFields.add(field);
+      if (++this.focusSamples >= MAX_FOCUS_SAMPLES) removeFocus();
+      this.sampleAfter(INPUT_FOCUS_SAMPLE_DELAY_MS);
+    });
+    this.removers.push(removeFocus);
+  }
+  detected = /* @__PURE__ */ new Map();
+  timers = /* @__PURE__ */ new Set();
+  idleCallbacks = /* @__PURE__ */ new Set();
+  /** Registered fields whose first focus already scheduled a sample (weak, so removed forms are not retained). */
+  sampledFields = /* @__PURE__ */ new WeakSet();
+  focusSamples = 0;
+  removers = [];
+  destroyed = false;
+  /** Per session, how many managers the last reported set held; the set only grows, so a count suffices. */
+  reportedCounts = /* @__PURE__ */ new Map();
+  /** Managers detected on this page so far, in detection order. */
+  getDetected() {
+    return [...this.detected.values()];
+  }
+  /**
+   * The full set of detected manager names when it grew since the last report for `sessionId`, otherwise
+   * undefined. Each session's first event after a detection carries the set (also after `resetSession()`),
+   * later events only when a sample added a manager. Signed-in upgrades are not reported, so they never
+   * count as growth. A lost event that carried the set is not repaired by later events of the same page.
+   */
+  takeReport(sessionId) {
+    if (!this.isEnabled() || this.detected.size <= (this.reportedCounts.get(sessionId) ?? 0)) return void 0;
+    this.reportedCounts.set(sessionId, this.detected.size);
+    return this.getDetected().map(({ name }) => ({ name }));
+  }
+  destroy() {
+    this.destroyed = true;
+    for (const remove of this.removers) remove();
+    for (const timer of this.timers) clearTimeout(timer);
+    this.timers.clear();
+    for (const handle of this.idleCallbacks) cancelIdleCallback(handle);
+    this.idleCallbacks.clear();
+  }
+  sampleAfter(delayMs) {
+    const timer = setTimeout(() => {
+      this.timers.delete(timer);
+      this.sampleWhenIdle();
+    }, delayMs);
+    this.timers.add(timer);
+  }
+  sampleWhenIdle() {
+    if (typeof requestIdleCallback !== "function") {
+      this.sample();
+      return;
+    }
+    const handle = requestIdleCallback(
+      () => {
+        this.idleCallbacks.delete(handle);
+        this.sample();
+      },
+      { timeout: IDLE_TIMEOUT_MS }
+    );
+    this.idleCallbacks.add(handle);
+  }
+  sample() {
+    if (this.destroyed || !this.isEnabled()) return;
+    try {
+      const found = readPasswordManagerExtensions({
+        key: "browser-api:password-managers.extensions",
+        fields: [
+          {
+            path: "result[].name",
+            exposure: "enum",
+            transform: {
+              values: [
+                "1password",
+                "bitwarden",
+                "dashlane",
+                "kaspersky",
+                "keeper",
+                "lastpass",
+                "nordpass",
+                "protonpass"
+              ]
+            }
+          },
+          // Read to merge samples, never reported (takeReport keeps only the name).
+          { path: "result[].signedIn", exposure: "none" }
+        ],
+        dataConfig: "pmd"
+      });
+      for (const extension of found) {
+        const known = this.detected.get(extension.name);
+        if (!known || extension.signedIn && !known.signedIn) {
+          this.detected.set(extension.name, extension);
+        }
+      }
+    } catch (error) {
+      this.logger.error("Failed to detect password manager extensions", error);
+    }
+  }
+};
+export {
+  INPUT_FOCUS_SAMPLE_DELAY_MS,
+  LOAD_RESAMPLE_DELAY_MS,
+  MAX_FOCUS_SAMPLES,
+  PasswordManagerSampler
+};

package/dist/analysis/utils/provide-data-operation-full.mjs

@@ -0,0 +1,28 @@
+// src/utils/provide-data-operation-full.ts
+import { LowEventInputTracker } from "../low-events/input-tracker.mjs";
+import { OperationFull } from "./operation-full.mjs";
+var ProvideDataOperationFull = class extends OperationFull {
+  clientValidation;
+  postResponse;
+  lowEventTracker;
+  constructor(tracker, config = {}) {
+    super(tracker, "provide-data");
+    this.clientValidation = this.defineStep("client-validation");
+    this.postResponse = this.defineStep("post-response");
+    const { inputHtmlField, ...startData } = config;
+    void this.subflowStart(startData);
+    if (!inputHtmlField) {
+      return;
+    }
+    this.lowEventTracker = this.createLowCollector(
+      () => new LowEventInputTracker(tracker.getLogger(), inputHtmlField, this.lowEventSink("input", "data"))
+    );
+    this.registerLowFlusher(() => this.lowEventTracker?.flushPending());
+  }
+  destroy() {
+    this.lowEventTracker?.destroy();
+  }
+};
+export {
+  ProvideDataOperationFull
+};

package/dist/analysis/utils/serialize-raw-error.mjs

@@ -0,0 +1,205 @@
+// src/utils/serialize-raw-error.ts
+var RAW_ERROR_BOUNDS = {
+  maxStackFrames: { min: 1, max: 100, default: 50 },
+  depth: { min: 0, max: 10, default: 3 },
+  maxBreadth: { min: 1, max: 1e3, default: 30 },
+  maxValueLength: { min: 1, max: 1e4, default: 1024 },
+  maxCauseDepth: { min: 0, max: 10, default: 3 },
+  maxBytes: { min: 0, max: 65536, default: 32768 }
+};
+var MAX_NODES = 1024;
+var RawErrorBudgetExceeded = class extends Error {
+};
+var ERROR_FIELDS = ["name", "message", "code", "errors", "stack"];
+var HAS_MULTI_BYTE_CHARACTERS = /[^\x20-\x7E]/;
+var tag = (value) => Object.prototype.toString.call(value).slice(8, -1);
+var typeOf = (value) => value === null ? "null" : typeof value === "object" ? tag(value) : typeof value;
+var isErrorLike = (value) => value instanceof Error || tag(value) === "Error" || tag(value) === "DOMException";
+function byteLength(json) {
+  return HAS_MULTI_BYTE_CHARACTERS.test(json) ? new TextEncoder().encode(json).byteLength : json.length;
+}
+function clamp(name, value) {
+  const bounds = RAW_ERROR_BOUNDS[name];
+  if (typeof value !== "number" || !Number.isFinite(value)) return bounds.default;
+  return Math.min(bounds.max, Math.max(bounds.min, Math.floor(value)));
+}
+function resolveRawErrorLimits(options = {}) {
+  return {
+    stack: options.stack === true,
+    maxStackFrames: clamp("maxStackFrames", options.maxStackFrames),
+    depth: clamp("depth", options.depth),
+    maxBreadth: clamp("maxBreadth", options.maxBreadth),
+    maxValueLength: clamp("maxValueLength", options.maxValueLength),
+    maxCauseDepth: clamp("maxCauseDepth", options.maxCauseDepth),
+    maxBytes: clamp("maxBytes", options.maxBytes)
+  };
+}
+function serializeRawError(value, options = {}) {
+  if (value === void 0) return void 0;
+  let limits = resolveRawErrorLimits();
+  const fits = (out) => {
+    const json = JSON.stringify(out);
+    return json === void 0 || byteLength(json) <= limits.maxBytes;
+  };
+  try {
+    limits = resolveRawErrorLimits(options);
+    if (limits.maxBytes === 0) return void 0;
+    const type = truncate(typeOf(value), 1024);
+    for (let depth = limits.depth; depth >= 0; depth--) {
+      const ctx = { limits, causeBudget: limits.maxCauseDepth, seen: /* @__PURE__ */ new Set(), nodes: 0, textBytes: 0 };
+      try {
+        const out = { type, value: walk(value, depth, ctx) };
+        if (fits(out)) return out;
+      } catch (error) {
+        if (!(error instanceof RawErrorBudgetExceeded)) throw error;
+      }
+    }
+    const fallback = { type, truncated: true };
+    return fits(fallback) ? fallback : void 0;
+  } catch {
+    const fallback = { type: "unserializable" };
+    return fits(fallback) ? fallback : void 0;
+  }
+}
+function accountText(text, ctx) {
+  if (text.length > ctx.limits.maxBytes) throw new RawErrorBudgetExceeded();
+  ctx.textBytes += byteLength(JSON.stringify(text));
+  if (ctx.textBytes > ctx.limits.maxBytes) throw new RawErrorBudgetExceeded();
+  return text;
+}
+function walk(value, depth, ctx) {
+  if (++ctx.nodes > MAX_NODES) throw new RawErrorBudgetExceeded();
+  const out = walkValue(value, depth, ctx);
+  return typeof out === "string" ? accountText(out, ctx) : out;
+}
+function walkValue(value, depth, ctx) {
+  switch (typeof value) {
+    case "string":
+      return truncate(value, ctx.limits.maxValueLength);
+    case "number":
+      return Number.isFinite(value) ? value : String(value);
+    case "boolean":
+    case "undefined":
+      return value;
+    case "bigint":
+    case "symbol":
+      return truncate(String(value), ctx.limits.maxValueLength);
+    case "function":
+      return `[Function: ${value.name || "anonymous"}]`;
+  }
+  if (value === null) return null;
+  const obj = value;
+  if (ctx.seen.has(obj)) return "[Circular]";
+  if (depth < 0) return `[${tag(obj)}]`;
+  ctx.seen.add(obj);
+  try {
+    return walkObject(obj, depth, ctx);
+  } finally {
+    ctx.seen.delete(obj);
+  }
+}
+function truncate(value, max) {
+  return value.length > max ? value.slice(0, max) + "\u2026" : value;
+}
+function truncateStack(stack, maxFrames, maxValueLength) {
+  const textTruncated = stack.length > maxValueLength;
+  stack = truncate(stack, maxValueLength);
+  const lines = stack.split("\n");
+  if (lines.length <= maxFrames + 1) return truncate(stack, maxValueLength);
+  const kept = lines.slice(0, maxFrames + 1).join("\n");
+  const marker = textTruncated ? "[truncated]" : `[+${lines.length - maxFrames - 1} frames]`;
+  return truncate(`${kept}
+${marker}`, maxValueLength);
+}
+function walkObject(obj, depth, ctx) {
+  const { limits } = ctx;
+  const kind = tag(obj);
+  const next = (v) => walk(v, depth - 1, ctx);
+  if (kind === "Date") return Number.isNaN(obj.getTime()) ? "[Invalid Date]" : obj.toISOString();
+  if (kind === "RegExp") return truncate(String(obj), limits.maxValueLength);
+  if (kind === "ArrayBuffer") return `[ArrayBuffer(${obj.byteLength})]`;
+  if (ArrayBuffer.isView(obj)) return `[${kind}(${obj.byteLength})]`;
+  if (kind === "Map" || kind === "Set") {
+    const collection = obj;
+    const items = [];
+    for (const value of collection) {
+      if (items.length === limits.maxBreadth) break;
+      items.push(next(value));
+    }
+    if (collection.size > items.length) items.push(`[+${collection.size - items.length} more]`);
+    return items;
+  }
+  if (kind === "Promise" || kind === "WeakMap" || kind === "WeakSet" || kind === "Window") return `[${kind}]`;
+  if (typeof Node !== "undefined" && obj instanceof Node) return `[${kind}]`;
+  if (Array.isArray(obj)) {
+    const items = obj.slice(0, limits.maxBreadth).map(next);
+    if (obj.length > limits.maxBreadth) items.push(`[+${obj.length - limits.maxBreadth} more]`);
+    return items;
+  }
+  if (typeof Response !== "undefined" && obj instanceof Response) {
+    return {
+      status: next(obj.status),
+      statusText: next(obj.statusText),
+      url: next(obj.url),
+      redirected: next(obj.redirected)
+    };
+  }
+  if (typeof Event !== "undefined" && obj instanceof Event) {
+    const ev = obj;
+    const out2 = { type: next(ev.type) };
+    for (const key of ["message", "filename", "lineno", "colno"]) {
+      if (key in ev) out2[key] = next(ev[key]);
+    }
+    if ("error" in ev && ev.error != null) out2.error = next(ev.error);
+    return out2;
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  const record = obj;
+  const errorLike = isErrorLike(obj);
+  if (errorLike) {
+    for (const field of ERROR_FIELDS) {
+      if (field === "stack" && !limits.stack) continue;
+      const v = record[field];
+      if (v === void 0 || v === null || typeof v === "function") continue;
+      if (field === "stack") {
+        if (limits.stack && typeof v === "string")
+          out.stack = accountText(truncateStack(v, limits.maxStackFrames, limits.maxValueLength), ctx);
+        continue;
+      }
+      out[field] = next(v);
+    }
+    const cause = record.cause;
+    if (cause !== void 0 && cause !== null && typeof cause !== "function") {
+      out.cause = walkCause(cause, depth - 1, ctx);
+    }
+  }
+  let keys = 0;
+  const ownKeys = Object.keys(record);
+  for (const key of ownKeys) {
+    if (key in out || key === "stack" && !limits.stack || errorLike && key === "cause") continue;
+    if (++keys > limits.maxBreadth) {
+      out["\u2026"] = `[+${ownKeys.length - limits.maxBreadth} keys]`;
+      break;
+    }
+    const v = record[key];
+    if (typeof v === "function") continue;
+    out[accountText(key, ctx)] = key === "stack" && typeof v === "string" ? accountText(truncateStack(v, limits.maxStackFrames, limits.maxValueLength), ctx) : next(v);
+  }
+  if (!errorLike && kind !== "Object" && keys === 0) return `[${kind}]`;
+  return out;
+}
+function walkCause(cause, depth, ctx) {
+  if (typeof cause !== "object" || cause === null) return walk(cause, depth, ctx);
+  if (ctx.causeBudget <= 0) return accountText(`[${tag(cause)}]`, ctx);
+  ctx.causeBudget--;
+  try {
+    return walk(cause, depth, ctx);
+  } finally {
+    ctx.causeBudget++;
+  }
+}
+export {
+  RAW_ERROR_BOUNDS,
+  resolveRawErrorLimits,
+  serializeRawError
+};

package/dist/analysis/utils/sms-otp-operation-full.mjs

@@ -0,0 +1,39 @@
+// src/utils/sms-otp-operation-full.ts
+import { OTPInputBinding } from "../low-events/otp-input-binding.mjs";
+import { OperationFull } from "./operation-full.mjs";
+var SmsOtpOperationFull = class extends OperationFull {
+  lowEventTracker;
+  send;
+  postResponse;
+  resend;
+  constructor(tracker, config = {}) {
+    super(tracker, "sms-otp");
+    this.send = this.defineStep("send");
+    this.postResponse = this.defineStep("post-response");
+    this.resend = this.defineStep("resend");
+    void this.subflowStart({ explicitSpecType: config.explicitSpecType });
+    this.lowEventTracker = this.createLowCollector(
+      () => new OTPInputBinding(
+        tracker.getLogger(),
+        this.lowEventSink("input", "otp"),
+        this.lowEventSink("input-group", "otp")
+      )
+    );
+    if (config.inputHtmlFields?.length) {
+      this.setInputFields(config.inputHtmlFields);
+    } else if (config.inputHtmlField) {
+      this.lowEventTracker?.setFields([config.inputHtmlField], false);
+    }
+    this.registerLowFlusher(() => this.lowEventTracker?.flushPending());
+  }
+  /** Rebind the ordered OTP group without starting a new subflow. An empty list detaches it. */
+  setInputFields(fields) {
+    this.lowEventTracker?.setFields(fields);
+  }
+  destroy() {
+    this.lowEventTracker?.destroy();
+  }
+};
+export {
+  SmsOtpOperationFull
+};

package/dist/analysis/utils/social-operation-login.mjs

@@ -0,0 +1,17 @@
+// src/utils/social-operation-login.ts
+import { OperationFull } from "./operation-full.mjs";
+var SocialLoginOperationFull = class extends OperationFull {
+  getRedirectUrl;
+  exchangeCode;
+  constructor(tracker, config = {}) {
+    super(tracker, "social-login");
+    this.getRedirectUrl = this.defineStep(
+      "get-redirect-url"
+    );
+    this.exchangeCode = this.defineStep("exchange-code");
+    void this.subflowStart({ explicitSpecType: config.explicitSpecType, entry: config.entry });
+  }
+};
+export {
+  SocialLoginOperationFull
+};

package/dist/analysis/utils/source-path.mjs

@@ -0,0 +1,39 @@
+// src/utils/source-path.ts
+var MASKED_QUERY_VALUE = "*";
+function decodeKey(raw) {
+  try {
+    return decodeURIComponent(raw.replace(/\+/g, " "));
+  } catch {
+    return raw;
+  }
+}
+function isAllowed(key, allow) {
+  const lower = key.toLowerCase();
+  return allow.some((pattern) => {
+    const entry = pattern.toLowerCase();
+    return entry.endsWith("*") ? lower.startsWith(entry.slice(0, -1)) : lower === entry;
+  });
+}
+function applySourcePathQuery(search, mode, allow) {
+  if (mode !== "allowlist" || search === "" || search === "?") {
+    return search;
+  }
+  const query = search.startsWith("?") ? search.slice(1) : search;
+  const masked = query.split("&").map((pair) => {
+    const separator = pair.indexOf("=");
+    if (separator === -1) {
+      return pair;
+    }
+    const key = pair.slice(0, separator);
+    const value = pair.slice(separator + 1);
+    if (value === "" || isAllowed(decodeKey(key), allow)) {
+      return pair;
+    }
+    return `${key}=${MASKED_QUERY_VALUE}`;
+  });
+  return `?${masked.join("&")}`;
+}
+export {
+  MASKED_QUERY_VALUE,
+  applySourcePathQuery
+};

package/dist/analysis/utils/sso-operation-login.mjs

@@ -0,0 +1,37 @@
+// src/utils/sso-operation-login.ts
+import { OperationFull } from "./operation-full.mjs";
+var SsoLoginOperationFull = class extends OperationFull {
+  getRedirectUrl;
+  exchangeCode;
+  constructor(tracker, config = {}) {
+    super(tracker, "sso-login");
+    this.getRedirectUrl = this.defineStep(
+      "get-redirect-url"
+    );
+    this.exchangeCode = this.defineStep("exchange-code");
+    const { explicitSpecType, organizationDomain, actor } = validateConfig(config ?? {}, tracker);
+    void this.subflowStart({ explicitSpecType, organizationDomain, actor });
+  }
+};
+function validateConfig(config, tracker) {
+  const result = { ...config };
+  const warn = (field) => {
+    try {
+      tracker.getLogger().warn(`SSO login: unsupported ${field}; omitted from telemetry`);
+    } catch {
+    }
+  };
+  const domain = result.organizationDomain;
+  if (domain !== void 0 && (typeof domain !== "string" || domain.includes("@") || domain.length > 253)) {
+    delete result.organizationDomain;
+    warn("organizationDomain");
+  }
+  if (result.actor !== void 0 && result.actor !== "user" && result.actor !== "system") {
+    delete result.actor;
+    warn("actor");
+  }
+  return result;
+}
+export {
+  SsoLoginOperationFull
+};

package/dist/analysis/utils/totp-operation-full.mjs

@@ -0,0 +1,35 @@
+// src/utils/totp-operation-full.ts
+import { OTPInputBinding } from "../low-events/otp-input-binding.mjs";
+import { OperationFull } from "./operation-full.mjs";
+var TotpOperationFull = class extends OperationFull {
+  lowEventTracker;
+  postResponse;
+  constructor(tracker, config = {}) {
+    super(tracker, "totp");
+    this.postResponse = this.defineStep("post-response");
+    void this.subflowStart({ explicitSpecType: config.explicitSpecType });
+    this.lowEventTracker = this.createLowCollector(
+      () => new OTPInputBinding(
+        tracker.getLogger(),
+        this.lowEventSink("input", "otp"),
+        this.lowEventSink("input-group", "otp")
+      )
+    );
+    if (config.inputHtmlFields?.length) {
+      this.setInputFields(config.inputHtmlFields);
+    } else if (config.inputHtmlField) {
+      this.lowEventTracker?.setFields([config.inputHtmlField], false);
+    }
+    this.registerLowFlusher(() => this.lowEventTracker?.flushPending());
+  }
+  /** Rebind the ordered code input group without starting a new subflow. An empty list detaches it. */
+  setInputFields(fields) {
+    this.lowEventTracker?.setFields(fields);
+  }
+  destroy() {
+    this.lowEventTracker?.destroy();
+  }
+};
+export {
+  TotpOperationFull
+};

package/dist/analysis/utils/trusted-device-operation-full.mjs

@@ -0,0 +1,100 @@
+// src/utils/trusted-device-operation-full.ts
+import { normalizeError } from "./normalize-error.mjs";
+import { OperationFull } from "./operation-full.mjs";
+function stampIdentity(data, identity, tracker) {
+  if (data === null || typeof data !== "object") return data;
+  try {
+    const out = { ...data };
+    if (out.purpose === void 0 && identity.purpose !== void 0) out.purpose = identity.purpose;
+    if (out.storage === void 0 && identity.storage !== void 0) out.storage = identity.storage;
+    if (out.trustName === void 0 && identity.trustName !== void 0) out.trustName = identity.trustName;
+    for (const [field, limit] of [
+      ["bindingReference", 255],
+      ["trustName", 128]
+    ]) {
+      if (typeof out[field] === "string" && [...out[field]].length > limit) {
+        delete out[field];
+        try {
+          tracker.getLogger().debug(`Trusted device: omitted ${field} exceeding ${limit} characters`);
+        } catch {
+        }
+      }
+    }
+    return out;
+  } catch {
+    return data;
+  }
+}
+function withIdentity(step, identity, tracker) {
+  return {
+    ...step,
+    start: (data, options) => step.start(stampIdentity(data, identity, tracker), options),
+    finished: (data, options) => step.finished(stampIdentity(data, identity, tracker), options)
+  };
+}
+var TrustedDeviceCheckOperationFull = class extends OperationFull {
+  getOptions;
+  ceremony;
+  postResponse;
+  constructor(tracker, config) {
+    super(tracker, "trusted-device-check");
+    config = validateConfig(config, tracker);
+    const identity = { purpose: config.purpose, storage: config.storage, trustName: config.trustName };
+    this.getOptions = this.checkStep("get-options", identity, tracker);
+    this.ceremony = this.checkStep("ceremony", identity, tracker);
+    this.postResponse = this.checkStep("post-response", identity, tracker);
+    this.subflowStart({ explicitSpecType: config.explicitSpecType, actor: "system", ignoreAsInteraction: true });
+  }
+  checkStep(name, identity, tracker) {
+    const step = this.defineStep(name, true);
+    return {
+      ...withIdentity(step, identity, tracker),
+      errorTyped: (data, options) => {
+        step.errorTyped(
+          stampIdentity({ code: data?.code, error: normalizeError(data?.error) }, identity, tracker),
+          options
+        );
+      }
+    };
+  }
+};
+var TrustedDeviceEnrollmentOperationFull = class extends OperationFull {
+  getOptions;
+  ceremony;
+  postResponse;
+  constructor(tracker, config) {
+    super(tracker, "trusted-device-enrollment");
+    config = validateConfig(config, tracker);
+    const identity = { purpose: config.purpose, storage: config.storage, trustName: config.trustName };
+    this.getOptions = withIdentity(this.defineStep("get-options"), identity, tracker);
+    this.ceremony = withIdentity(this.defineStep("ceremony"), identity, tracker);
+    this.postResponse = withIdentity(
+      this.defineStep("post-response"),
+      identity,
+      tracker
+    );
+    this.subflowStart({ explicitSpecType: config.explicitSpecType });
+  }
+};
+function validateConfig(config, tracker) {
+  const result = { ...config };
+  const warn = (field) => {
+    try {
+      tracker.getLogger().warn(`Trusted device: missing or unsupported ${field}; omitted from telemetry`);
+    } catch {
+    }
+  };
+  if (result.purpose !== "additional-verification" && result.purpose !== "mfa-exemption") {
+    delete result.purpose;
+    warn("purpose");
+  }
+  if (!["cookie", "indexeddb", "localstore", "sessionstore"].includes(result.storage)) {
+    delete result.storage;
+    warn("storage");
+  }
+  return result;
+}
+export {
+  TrustedDeviceCheckOperationFull,
+  TrustedDeviceEnrollmentOperationFull
+};

package/dist/analysis/utils/web-lock.mjs

@@ -0,0 +1,52 @@
+// src/utils/web-lock.ts
+function withWebLock(name, fn, options = {}) {
+  const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+  if (locks?.request) {
+    const timeoutMs = options.timeoutMs;
+    const controller = timeoutMs !== void 0 && typeof AbortController !== "undefined" ? new AbortController() : null;
+    if (timeoutMs !== void 0 && !controller) {
+      return Promise.resolve().then(fn);
+    }
+    try {
+      let ran = false;
+      let timer;
+      const clearAcquisitionTimer = () => {
+        if (timer !== void 0) {
+          clearTimeout(timer);
+          timer = void 0;
+        }
+      };
+      const callback = () => {
+        ran = true;
+        clearAcquisitionTimer();
+        return fn();
+      };
+      const granted = controller ? locks.request(name, { signal: controller.signal }, callback) : locks.request(name, callback);
+      if (controller && timeoutMs !== void 0 && !ran) {
+        timer = setTimeout(() => {
+          timer = void 0;
+          controller.abort();
+          try {
+            options.onTimeout?.();
+          } catch {
+          }
+        }, timeoutMs);
+      }
+      return granted.catch((error) => {
+        if (ran) {
+          throw error;
+        }
+        return fn();
+      }).finally(clearAcquisitionTimer);
+    } catch {
+    }
+  }
+  try {
+    return Promise.resolve(fn());
+  } catch (error) {
+    return Promise.reject(error);
+  }
+}
+export {
+  withWebLock
+};