@corbado/observe 1.7.1 → 1.8.0

package/dist/index.d.mts

@@ -1,3 +1,65 @@
+/**
+ * Reader metadata: the declaration every browser read in `src/readers/**` carries.
+ *
+ * Readers are the only SDK modules meant to touch browser globals (navigator, document, window,
+ * storage, ...). Each reader call takes a literal {@link ReaderMeta} object naming the collection
+ * item it produces, the fields it collects and their exposure. The metadata has no runtime effect;
+ * a static analysis of an (unminified) bundle reads the literals at the reachable call sites to
+ * derive the collection manifest of a build, so a call removed by dead-code elimination also
+ * removes its item from the manifest.
+ *
+ * Vocabulary follows the collection manifest data model v1 (`corbado.collection/v1`).
+ *
+ * @internal
+ */
+/**
+ * How much of a value is collected, ordered from least to most exposed.
+ * See {@link READER_EXPOSURES} for the order.
+ */
+type ReaderExposure = "none" | "presence" | "size" | "class" | "format" | "partial" | "enum" | "computed" | "token" | "pseudonym" | "redacted" | "raw";
+/** All exposures, least to most exposed. */
+declare const READER_EXPOSURES: readonly ReaderExposure[];
+/** Parameters of an exposure (which ones apply depends on the exposure). */
+type ReaderTransform = {
+    /** `presence`, `enum`: the possible values. */
+    values?: readonly (string | number | boolean | null)[];
+    /** `size`: bucket boundaries, when bucketed. */
+    buckets?: readonly number[];
+    /** `class`: the possible classes. */
+    classes?: readonly string[];
+    /** `format`: the kept structure. */
+    format?: string;
+    /** `partial`: which part is kept. */
+    keep?: string;
+    /** `token`: the restrictive pattern a kept value must match, and its maximum length. */
+    pattern?: string;
+    max?: number;
+    /** `pseudonym`: how the value is derived. */
+    scheme?: string;
+    /** `redacted`: the removed parts. */
+    removed?: readonly string[];
+    /** Free text, e.g. for `computed`. */
+    note?: string;
+};
+/** One collected field of a reader item. */
+type ReaderField = {
+    /** Identity within the item, e.g. `result.isPrivate` or `signals[]`. */
+    path: string;
+    exposure: ReaderExposure;
+    transform?: ReaderTransform;
+};
+/** Build-time data switch a reader item depends on (see `FixedDataConfig`). */
+type ReaderDataConfigKey = "pmd" | "privateMode";
+/** Literal metadata passed to every reader call. */
+type ReaderMeta = {
+    /** Stable item key `<kind>:<namespace>.<name>`, e.g. `browser-api:device.webdriver`. */
+    key: string;
+    /** Fields the reader makes reachable; everything else read stays inside the reader. */
+    fields: readonly ReaderField[];
+    /** The data switch that removes this item from builds that turn it off. */
+    dataConfig?: ReaderDataConfigKey;
+};
+
 type PasswordManagerExtensionName = "1password" | "bitwarden" | "dashlane" | "kaspersky" | "keeper" | "lastpass" | "nordpass" | "protonpass";
 type PasswordManagerExtension = {
     name: PasswordManagerExtensionName;
@@ -394,6 +456,12 @@ interface EventBatchMeta {
      * receives per session (last write wins), so the SDK always sends the current value.
      */
     dataPolicy?: number;
+    /**
+     * True when the tracker runs with data-collection switches fixed by the integration
+     * (`init({ fixedDataConfig })`) or by the build (`__CBO_DATA_*__` defines), so the data-relevant
+     * fields of the server config (`pmd`) are ignored. Omitted otherwise.
+     */
+    fixedData?: boolean;
 }
 interface EventMeta {
     initiator?: LowEventInitiator;
@@ -580,7 +648,7 @@ interface SdkReliabilityConfig {
     deviceInfoTiming: boolean;
     /** Serialize explicitly supplied raw error diagnostics. Defaults to true; refreshes apply to subsequent errors. Already queued events are unchanged. */
     rawErrors: boolean;
-    /** Internal: password manager detection switch. Defaults to false. */
+    /** Internal: password manager detection switch. Defaults to true. */
     pmd: boolean;
     /**
      * How far autocapture may attach when another integration already holds the surface it
@@ -603,11 +671,47 @@ interface SdkReliabilityConfig {
     /** Retry configuration for failed event flushes. */
     retry: SdkRetryConfig;
 }
+/**
+ * Data-collection switches fixed by the integration instead of the server config (opt-in, see
+ * `TrackerOptions.fixedDataConfig`). Once given, these fields are no longer taken from the server's
+ * config or the cached `cbo_sdk_config`; a field left out resolves as documented on the field (`pmd`:
+ * off, `privateMode`: on), not from the server config.
+ *
+ * Builds can fix the same switches at build time with the esbuild/tsup defines `__CBO_DATA_PMD__` and
+ * `__CBO_DATA_PRIVATE_MODE__` (booleans), which also remove the disabled code from the bundle. A define
+ * wins over this option.
+ */
+interface FixedDataConfig {
+    /**
+     * Password-manager detection.
+     *
+     * - `true`: the extension probes (reported as {@link Event.passwordManagers}) and the DOM
+     *   password-manager scan (`pa-1`..`pa-6` lows) run.
+     * - `false`: neither runs.
+     * - omitted (with `fixedDataConfig` given): the extension probes are off (`pmd` resolves to `false`,
+     *   regardless of the built-in default, `sdkConfig.pmd` and the server config); the DOM scan keeps
+     *   today's behaviour and runs.
+     *
+     * Without `fixedDataConfig` the probes follow the server's `pmd` and the DOM scan always runs.
+     */
+    pmd?: boolean;
+    /**
+     * Private-mode detection (`deviceInfo.data.privateMode`, cached in `cbo_pm`). Defaults to true (as
+     * without `fixedDataConfig`). When false, nothing is detected, read or written for it.
+     */
+    privateMode?: boolean;
+}
 /** Query handling for `meta.trackingSourcePath`; see {@link SdkReliabilityConfig.sourcePathQuery}. */
 type SourcePathQueryMode = "all" | "allowlist";
 /** Optional init overrides; omitted fields (including nested retry fields) inherit server policy or defaults. */
-type SdkReliabilityConfigOverrides = Partial<Omit<SdkReliabilityConfig, "retry">> & {
+type SdkReliabilityConfigOverrides = Partial<Omit<SdkReliabilityConfig, "retry" | "pmd">> & {
     retry?: Partial<SdkRetryConfig>;
+    /**
+     * @deprecated use `fixedDataConfig.pmd`. Data-collection switches set by an integration belong in
+     * {@link FixedDataConfig}. Still works as before when `fixedDataConfig` is not given; when it is
+     * given, `fixedDataConfig` decides and this field is ignored.
+     */
+    pmd?: boolean;
 };
 
 /**
@@ -625,6 +729,12 @@ interface LowEventSink {
         settle(tailMs: number): void;
         destroy(): void;
     };
+    /**
+     * Whether the DOM password-manager scan (`pa-1`..`pa-6` lows) may run. Absent or true keeps the
+     * historical behaviour (always scan); false only under `fixedDataConfig` with `pmd` explicitly
+     * `false` (an omitted `pmd` keeps the scan on).
+     */
+    passwordManagerDomScan?(): boolean;
 }
 
 /**
@@ -1647,8 +1757,17 @@ interface TrackerOptions {
     projectId: string;
     apiBaseUrl: string;
     apiEventPath?: string;
-    /** Per-field overrides over server config and defaults. A complete policy disables remote fetching. */
+    /**
+     * Per-field overrides over server config and defaults. A complete policy disables remote fetching.
+     * Data-collection switches (`pmd`) are deprecated here: use {@link TrackerOptions.fixedDataConfig}.
+     */
     sdkConfig?: SdkReliabilityConfigOverrides;
+    /**
+     * Opt-in: fix the data-collection switches (password-manager and private-mode detection) instead of
+     * taking them from the server config or the cached `cbo_sdk_config`. Batches then carry
+     * `meta.fixedData: true`. Omitted (default): unchanged, server-driven behaviour. See {@link FixedDataConfig}.
+     */
+    fixedDataConfig?: FixedDataConfig;
     /** Config endpoint override for integrations that proxy Observe under a different path. */
     apiConfigPath?: string;
     storage?: "cookie" | "local";
@@ -1705,6 +1824,8 @@ declare class CorbadoTracker {
     private config;
     private readonly configManager?;
     private readonly configOverrides;
+    /** Resolved `fixedDataConfig`; undefined when not given (server-driven data switches). */
+    private readonly fixedData?;
     private deviceInfoManager;
     private deviceCollector;
     /**
@@ -2197,6 +2318,14 @@ declare class CorbadoTracker {
      * @internal
      */
     flushKeepalive(reason?: FlushReason): void;
+    /**
+     * Whether input trackers run the DOM password-manager scan (`pa-1`..`pa-6` lows): only an explicitly
+     * set `fixedDataConfig.pmd` decides; without `fixedDataConfig` or with `pmd` omitted it always runs
+     * (historical behaviour).
+     *
+     * @internal
+     */
+    isPasswordManagerDomScanEnabled(): boolean;
     /**
      * Keepalive flush requested by a low-event tracker's `pagehide` teardown. Gated by the
      * server-controlled trigger switch `tlf` (boot-snapshot, default true = historical behavior):
@@ -2547,6 +2676,11 @@ interface QueueOptions {
      * none has ever been set. Read at send time so a change applies to the next batch without a flush.
      */
     getDataPolicy?: () => number | undefined;
+    /**
+     * Stamp `meta.fixedData: true` on every batch: the tracker's data switches are fixed by the
+     * integration or the build, so the server's data flags are ignored. Omitted (no meta field) when false.
+     */
+    fixedData?: boolean;
     /**
      * Called with the events of every event batch right before it is sent (async and unload flushes),
      * before the batch's telemetry is taken. The tracker uses it to attach a device info snapshot that
@@ -2630,6 +2764,7 @@ declare class RequestQueue {
     private readonly requestConfig;
     private readonly onConfigReceived?;
     private readonly getDataPolicy?;
+    private readonly fixedData;
     private readonly beforeEventBatchSend?;
     private readonly standaloneDeviceInfo?;
     /** Current delivery policy, including live updates. */
@@ -2884,6 +3019,23 @@ declare const DEFAULT_RELIABILITY_CONFIG: SdkReliabilityConfig;
 declare function parseReliabilityConfig(raw: unknown): SdkReliabilityConfig | null;
 /** Resolve init overrides over validated server policy, then defaults, including individual retry fields. */
 declare function resolveReliabilityConfig(serverConfig: SdkReliabilityConfig | undefined, overrides?: SdkReliabilityConfigOverrides): SdkReliabilityConfig;
+/** Effective fixed data switches; every field resolved. */
+type ResolvedFixedDataConfig = Required<FixedDataConfig> & {
+    /**
+     * Whether `pmd` was set explicitly (a boolean). Only an explicit `pmd` gates the DOM password-manager
+     * scan (`pa-1`..`pa-6`); an omitted `pmd` turns the extension probes off but leaves the scan on.
+     */
+    pmdExplicit: boolean;
+};
+/**
+ * Resolve `init({ fixedDataConfig })`. Returns `undefined` (not fixed: server-driven, today's behaviour)
+ * unless the option is an object. A missing or non-boolean `pmd` resolves to `false` (not the built-in
+ * default and not `sdkConfig.pmd`: a fixed config collects only what it names) with `pmdExplicit: false`;
+ * a missing or non-boolean `privateMode` resolves to on. Never throws.
+ *
+ * @internal
+ */
+declare function resolveFixedDataConfig(raw: unknown): ResolvedFixedDataConfig | undefined;
 /** Read the cached config from storage, or `null` if absent/invalid. */
 declare function loadCachedConfig(storage: StorageEngine): SdkReliabilityConfig | null;
 /** Persist the config as last-known so the next page load starts with these features enabled. */
@@ -2974,7 +3126,7 @@ declare class EventStore<T = Event> {
 type WebAuthnIdentifierProjector = (value: string) => string | null | undefined;
 /**
  * Optional user identifier projection shared by native WebAuthn capture and network serializers.
- * A missing callback preserves user identifiers. Callbacks should be deterministic across payloads.
+ * A missing callback omits user identifiers. Callbacks should be deterministic across payloads.
  * Credential IDs and encoded attestation/authenticator data are retained unchanged.
  */
 type WebAuthnIdentifierProjectors = {
@@ -2983,10 +3135,10 @@ type WebAuthnIdentifierProjectors = {
 };
 /**
  * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
- * Binary values become base64url strings. User IDs are retained unless a projector is supplied.
+ * Binary values become base64url strings. `user.id` is omitted unless a projector is supplied.
  *
  * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
  * @example
@@ -2998,10 +3150,10 @@ type WebAuthnIdentifierProjectors = {
 declare function sanitizeCreationOptions(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
- * By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ * `response.userHandle` is omitted unless a projector is supplied. By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
  *
  * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
  */
@@ -3017,10 +3169,11 @@ declare function sanitizeCreationResponse(value: unknown, projectors?: WebAuthnI
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
 /**
  * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
- * By default other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ * `response.userHandle` is omitted unless a projector is supplied. Other fields remain, including credential IDs.
+ * Binary values become base64url strings.
  *
  * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
  */
@@ -3061,4 +3214,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };

package/dist/index.d.ts

@@ -1,3 +1,65 @@
+/**
+ * Reader metadata: the declaration every browser read in `src/readers/**` carries.
+ *
+ * Readers are the only SDK modules meant to touch browser globals (navigator, document, window,
+ * storage, ...). Each reader call takes a literal {@link ReaderMeta} object naming the collection
+ * item it produces, the fields it collects and their exposure. The metadata has no runtime effect;
+ * a static analysis of an (unminified) bundle reads the literals at the reachable call sites to
+ * derive the collection manifest of a build, so a call removed by dead-code elimination also
+ * removes its item from the manifest.
+ *
+ * Vocabulary follows the collection manifest data model v1 (`corbado.collection/v1`).
+ *
+ * @internal
+ */
+/**
+ * How much of a value is collected, ordered from least to most exposed.
+ * See {@link READER_EXPOSURES} for the order.
+ */
+type ReaderExposure = "none" | "presence" | "size" | "class" | "format" | "partial" | "enum" | "computed" | "token" | "pseudonym" | "redacted" | "raw";
+/** All exposures, least to most exposed. */
+declare const READER_EXPOSURES: readonly ReaderExposure[];
+/** Parameters of an exposure (which ones apply depends on the exposure). */
+type ReaderTransform = {
+    /** `presence`, `enum`: the possible values. */
+    values?: readonly (string | number | boolean | null)[];
+    /** `size`: bucket boundaries, when bucketed. */
+    buckets?: readonly number[];
+    /** `class`: the possible classes. */
+    classes?: readonly string[];
+    /** `format`: the kept structure. */
+    format?: string;
+    /** `partial`: which part is kept. */
+    keep?: string;
+    /** `token`: the restrictive pattern a kept value must match, and its maximum length. */
+    pattern?: string;
+    max?: number;
+    /** `pseudonym`: how the value is derived. */
+    scheme?: string;
+    /** `redacted`: the removed parts. */
+    removed?: readonly string[];
+    /** Free text, e.g. for `computed`. */
+    note?: string;
+};
+/** One collected field of a reader item. */
+type ReaderField = {
+    /** Identity within the item, e.g. `result.isPrivate` or `signals[]`. */
+    path: string;
+    exposure: ReaderExposure;
+    transform?: ReaderTransform;
+};
+/** Build-time data switch a reader item depends on (see `FixedDataConfig`). */
+type ReaderDataConfigKey = "pmd" | "privateMode";
+/** Literal metadata passed to every reader call. */
+type ReaderMeta = {
+    /** Stable item key `<kind>:<namespace>.<name>`, e.g. `browser-api:device.webdriver`. */
+    key: string;
+    /** Fields the reader makes reachable; everything else read stays inside the reader. */
+    fields: readonly ReaderField[];
+    /** The data switch that removes this item from builds that turn it off. */
+    dataConfig?: ReaderDataConfigKey;
+};
+
 type PasswordManagerExtensionName = "1password" | "bitwarden" | "dashlane" | "kaspersky" | "keeper" | "lastpass" | "nordpass" | "protonpass";
 type PasswordManagerExtension = {
     name: PasswordManagerExtensionName;
@@ -394,6 +456,12 @@ interface EventBatchMeta {
      * receives per session (last write wins), so the SDK always sends the current value.
      */
     dataPolicy?: number;
+    /**
+     * True when the tracker runs with data-collection switches fixed by the integration
+     * (`init({ fixedDataConfig })`) or by the build (`__CBO_DATA_*__` defines), so the data-relevant
+     * fields of the server config (`pmd`) are ignored. Omitted otherwise.
+     */
+    fixedData?: boolean;
 }
 interface EventMeta {
     initiator?: LowEventInitiator;
@@ -580,7 +648,7 @@ interface SdkReliabilityConfig {
     deviceInfoTiming: boolean;
     /** Serialize explicitly supplied raw error diagnostics. Defaults to true; refreshes apply to subsequent errors. Already queued events are unchanged. */
     rawErrors: boolean;
-    /** Internal: password manager detection switch. Defaults to false. */
+    /** Internal: password manager detection switch. Defaults to true. */
     pmd: boolean;
     /**
      * How far autocapture may attach when another integration already holds the surface it
@@ -603,11 +671,47 @@ interface SdkReliabilityConfig {
     /** Retry configuration for failed event flushes. */
     retry: SdkRetryConfig;
 }
+/**
+ * Data-collection switches fixed by the integration instead of the server config (opt-in, see
+ * `TrackerOptions.fixedDataConfig`). Once given, these fields are no longer taken from the server's
+ * config or the cached `cbo_sdk_config`; a field left out resolves as documented on the field (`pmd`:
+ * off, `privateMode`: on), not from the server config.
+ *
+ * Builds can fix the same switches at build time with the esbuild/tsup defines `__CBO_DATA_PMD__` and
+ * `__CBO_DATA_PRIVATE_MODE__` (booleans), which also remove the disabled code from the bundle. A define
+ * wins over this option.
+ */
+interface FixedDataConfig {
+    /**
+     * Password-manager detection.
+     *
+     * - `true`: the extension probes (reported as {@link Event.passwordManagers}) and the DOM
+     *   password-manager scan (`pa-1`..`pa-6` lows) run.
+     * - `false`: neither runs.
+     * - omitted (with `fixedDataConfig` given): the extension probes are off (`pmd` resolves to `false`,
+     *   regardless of the built-in default, `sdkConfig.pmd` and the server config); the DOM scan keeps
+     *   today's behaviour and runs.
+     *
+     * Without `fixedDataConfig` the probes follow the server's `pmd` and the DOM scan always runs.
+     */
+    pmd?: boolean;
+    /**
+     * Private-mode detection (`deviceInfo.data.privateMode`, cached in `cbo_pm`). Defaults to true (as
+     * without `fixedDataConfig`). When false, nothing is detected, read or written for it.
+     */
+    privateMode?: boolean;
+}
 /** Query handling for `meta.trackingSourcePath`; see {@link SdkReliabilityConfig.sourcePathQuery}. */
 type SourcePathQueryMode = "all" | "allowlist";
 /** Optional init overrides; omitted fields (including nested retry fields) inherit server policy or defaults. */
-type SdkReliabilityConfigOverrides = Partial<Omit<SdkReliabilityConfig, "retry">> & {
+type SdkReliabilityConfigOverrides = Partial<Omit<SdkReliabilityConfig, "retry" | "pmd">> & {
     retry?: Partial<SdkRetryConfig>;
+    /**
+     * @deprecated use `fixedDataConfig.pmd`. Data-collection switches set by an integration belong in
+     * {@link FixedDataConfig}. Still works as before when `fixedDataConfig` is not given; when it is
+     * given, `fixedDataConfig` decides and this field is ignored.
+     */
+    pmd?: boolean;
 };
 
 /**
@@ -625,6 +729,12 @@ interface LowEventSink {
         settle(tailMs: number): void;
         destroy(): void;
     };
+    /**
+     * Whether the DOM password-manager scan (`pa-1`..`pa-6` lows) may run. Absent or true keeps the
+     * historical behaviour (always scan); false only under `fixedDataConfig` with `pmd` explicitly
+     * `false` (an omitted `pmd` keeps the scan on).
+     */
+    passwordManagerDomScan?(): boolean;
 }
 
 /**
@@ -1647,8 +1757,17 @@ interface TrackerOptions {
     projectId: string;
     apiBaseUrl: string;
     apiEventPath?: string;
-    /** Per-field overrides over server config and defaults. A complete policy disables remote fetching. */
+    /**
+     * Per-field overrides over server config and defaults. A complete policy disables remote fetching.
+     * Data-collection switches (`pmd`) are deprecated here: use {@link TrackerOptions.fixedDataConfig}.
+     */
     sdkConfig?: SdkReliabilityConfigOverrides;
+    /**
+     * Opt-in: fix the data-collection switches (password-manager and private-mode detection) instead of
+     * taking them from the server config or the cached `cbo_sdk_config`. Batches then carry
+     * `meta.fixedData: true`. Omitted (default): unchanged, server-driven behaviour. See {@link FixedDataConfig}.
+     */
+    fixedDataConfig?: FixedDataConfig;
     /** Config endpoint override for integrations that proxy Observe under a different path. */
     apiConfigPath?: string;
     storage?: "cookie" | "local";
@@ -1705,6 +1824,8 @@ declare class CorbadoTracker {
     private config;
     private readonly configManager?;
     private readonly configOverrides;
+    /** Resolved `fixedDataConfig`; undefined when not given (server-driven data switches). */
+    private readonly fixedData?;
     private deviceInfoManager;
     private deviceCollector;
     /**
@@ -2197,6 +2318,14 @@ declare class CorbadoTracker {
      * @internal
      */
     flushKeepalive(reason?: FlushReason): void;
+    /**
+     * Whether input trackers run the DOM password-manager scan (`pa-1`..`pa-6` lows): only an explicitly
+     * set `fixedDataConfig.pmd` decides; without `fixedDataConfig` or with `pmd` omitted it always runs
+     * (historical behaviour).
+     *
+     * @internal
+     */
+    isPasswordManagerDomScanEnabled(): boolean;
     /**
      * Keepalive flush requested by a low-event tracker's `pagehide` teardown. Gated by the
      * server-controlled trigger switch `tlf` (boot-snapshot, default true = historical behavior):
@@ -2547,6 +2676,11 @@ interface QueueOptions {
      * none has ever been set. Read at send time so a change applies to the next batch without a flush.
      */
     getDataPolicy?: () => number | undefined;
+    /**
+     * Stamp `meta.fixedData: true` on every batch: the tracker's data switches are fixed by the
+     * integration or the build, so the server's data flags are ignored. Omitted (no meta field) when false.
+     */
+    fixedData?: boolean;
     /**
      * Called with the events of every event batch right before it is sent (async and unload flushes),
      * before the batch's telemetry is taken. The tracker uses it to attach a device info snapshot that
@@ -2630,6 +2764,7 @@ declare class RequestQueue {
     private readonly requestConfig;
     private readonly onConfigReceived?;
     private readonly getDataPolicy?;
+    private readonly fixedData;
     private readonly beforeEventBatchSend?;
     private readonly standaloneDeviceInfo?;
     /** Current delivery policy, including live updates. */
@@ -2884,6 +3019,23 @@ declare const DEFAULT_RELIABILITY_CONFIG: SdkReliabilityConfig;
 declare function parseReliabilityConfig(raw: unknown): SdkReliabilityConfig | null;
 /** Resolve init overrides over validated server policy, then defaults, including individual retry fields. */
 declare function resolveReliabilityConfig(serverConfig: SdkReliabilityConfig | undefined, overrides?: SdkReliabilityConfigOverrides): SdkReliabilityConfig;
+/** Effective fixed data switches; every field resolved. */
+type ResolvedFixedDataConfig = Required<FixedDataConfig> & {
+    /**
+     * Whether `pmd` was set explicitly (a boolean). Only an explicit `pmd` gates the DOM password-manager
+     * scan (`pa-1`..`pa-6`); an omitted `pmd` turns the extension probes off but leaves the scan on.
+     */
+    pmdExplicit: boolean;
+};
+/**
+ * Resolve `init({ fixedDataConfig })`. Returns `undefined` (not fixed: server-driven, today's behaviour)
+ * unless the option is an object. A missing or non-boolean `pmd` resolves to `false` (not the built-in
+ * default and not `sdkConfig.pmd`: a fixed config collects only what it names) with `pmdExplicit: false`;
+ * a missing or non-boolean `privateMode` resolves to on. Never throws.
+ *
+ * @internal
+ */
+declare function resolveFixedDataConfig(raw: unknown): ResolvedFixedDataConfig | undefined;
 /** Read the cached config from storage, or `null` if absent/invalid. */
 declare function loadCachedConfig(storage: StorageEngine): SdkReliabilityConfig | null;
 /** Persist the config as last-known so the next page load starts with these features enabled. */
@@ -2974,7 +3126,7 @@ declare class EventStore<T = Event> {
 type WebAuthnIdentifierProjector = (value: string) => string | null | undefined;
 /**
  * Optional user identifier projection shared by native WebAuthn capture and network serializers.
- * A missing callback preserves user identifiers. Callbacks should be deterministic across payloads.
+ * A missing callback omits user identifiers. Callbacks should be deterministic across payloads.
  * Credential IDs and encoded attestation/authenticator data are retained unchanged.
  */
 type WebAuthnIdentifierProjectors = {
@@ -2983,10 +3135,10 @@ type WebAuthnIdentifierProjectors = {
 };
 /**
  * Serializes WebAuthn creation options, removing `user.name` and `user.displayName`.
- * Binary values become base64url strings. User IDs are retained unless a projector is supplied.
+ * Binary values become base64url strings. `user.id` is omitted unless a projector is supplied.
  *
  * @param value - Native publicKey options, a JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. No tracker initialization is required.
  * @example
@@ -2998,10 +3150,10 @@ type WebAuthnIdentifierProjectors = {
 declare function sanitizeCreationOptions(value: unknown, projectors?: WebAuthnIdentifierProjectors): string | undefined;
 /**
  * Serializes a registration credential, removing `clientExtensionResults.prf.results`.
- * By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
+ * `response.userHandle` is omitted unless a projector is supplied. By default other fields remain, including attestation material and credential IDs. Binary values become base64url strings.
  *
  * @param value - A native registration credential, JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. Encoded attestation and client-data blobs are not decoded or redacted.
  */
@@ -3017,10 +3169,11 @@ declare function sanitizeCreationResponse(value: unknown, projectors?: WebAuthnI
 declare function sanitizeRequestOptions(value: unknown): string | undefined;
 /**
  * Serializes an authentication credential, removing `response.signature` and `clientExtensionResults.prf.results`.
- * By default other fields remain, including credential IDs and user handles. Binary values become base64url strings.
+ * `response.userHandle` is omitted unless a projector is supplied. Other fields remain, including credential IDs.
+ * Binary values become base64url strings.
  *
  * @param value - A native authentication credential, JSON object, or JSON text; not an application envelope.
- * @param projectors - Optional synchronous user identifier projection; default identity.
+ * @param projectors - Optional synchronous user identifier projection; default omits user identifiers.
  * @returns JSON text, or undefined for malformed or unserializable input.
  * @remarks Does not mutate input, read blacklisted getters, or call toJSON. This is a path blacklist, not general-purpose secret detection; encoded client-data blobs are not decoded or redacted.
  */
@@ -3061,4 +3214,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, type RawErrorEnvelope, RequestQueue, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, cacheConfig, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };