@corbado/observe 1.7.2 → 1.9.0

package/dist/analysis/client.mjs

@@ -0,0 +1,1877 @@
+// src/client.ts
+import {
+  KeySigningOperationFull,
+  KeyRegistrationOperationFull
+} from "./utils/key-operation-full.mjs";
+import { reserveCaptureSeq } from "./low-events/capture-sequence.mjs";
+import { readSourcePath } from "./readers/page.mjs";
+import { readUserAgent } from "./readers/device.mjs";
+import { SharedWindowObserver, getCapturePageId } from "./low-events/shared-window-observer.mjs";
+import {
+  AuthEventName
+} from "./types.mjs";
+import { FetchTransport } from "./transports/fetch.mjs";
+import { RequestQueue } from "./queue.mjs";
+import { DeviceCollector } from "./device.mjs";
+import { DeviceInfoManager } from "./device-info-manager.mjs";
+import {
+  CookieStorage,
+  LocalStorage,
+  namespacedKey,
+  NamespacedStorage,
+  SessionStorage
+} from "./storage/index.mjs";
+import { OUTBOX_LOCK_NAME } from "./store/event-store.mjs";
+import { migrateLegacyStorage } from "./storage/migration.mjs";
+import {
+  DEFAULT_RELIABILITY_CONFIG,
+  resolveFixedDataConfig,
+  resolveReliabilityConfig
+} from "./config.mjs";
+import { ConfigManager } from "./config-manager.mjs";
+import { v7 as uuidv7 } from "uuid";
+import { PasskeyLoginOperationFull } from "./utils/passkey-login-operation-full.mjs";
+import { EmailOtpOperationFull } from "./utils/email-otp-operation-full.mjs";
+import { SmsOtpOperationFull } from "./utils/sms-otp-operation-full.mjs";
+import { isBlockedUserAgent } from "./utils/blocked-user-agents.mjs";
+import { hasWebLocks, withWebLock } from "./readers/web-lock.mjs";
+import { SDK_NAME, SDK_VERSION } from "./version.mjs";
+import {
+  EmailLinkContinuationOperation,
+  EmailLinkOperationFull
+} from "./utils/email-link-operation-full.mjs";
+import {
+  PasskeyEnrollmentOperationFull
+} from "./utils/passkey-enrollment-operation-full.mjs";
+import { createLogger } from "./logger.mjs";
+import { PasskeyDeletionOperationFull } from "./utils/passkey-deletion-operation-full.mjs";
+import { PasswordLoginOperationFull } from "./utils/password-login-operation-full.mjs";
+import { PasswordEnrollmentOperationFull } from "./utils/password-enrollment-operation-full.mjs";
+import {
+  OperationFullProvideIdentifierWithCUI
+} from "./utils/operation-full-provide-identifier-with-cui.mjs";
+import { SocialLoginOperationFull } from "./utils/social-operation-login.mjs";
+import { SsoLoginOperationFull } from "./utils/sso-operation-login.mjs";
+import { TotpOperationFull } from "./utils/totp-operation-full.mjs";
+import { AppConfirmationOperationFull } from "./utils/appconfirmation-operation-full.mjs";
+import { CaptchaOperationFull } from "./utils/captcha-operation-full.mjs";
+import { FormOperationFull } from "./utils/form-operation-full.mjs";
+import {
+  TrustedDeviceCheckOperationFull,
+  TrustedDeviceEnrollmentOperationFull
+} from "./utils/trusted-device-operation-full.mjs";
+import { ProvideDataOperationFull } from "./utils/provide-data-operation-full.mjs";
+import { PasswordManagerSampler } from "./utils/password-manager-sampler.mjs";
+var SDK_INFO = {
+  name: SDK_NAME,
+  version: SDK_VERSION
+};
+var INTEGRATION_VERSION_PATTERN = /^[0-9A-Za-z.+_-]{1,32}$/;
+function sdkInfo(integrationVersion, logger) {
+  if (integrationVersion === void 0) return SDK_INFO;
+  if (typeof integrationVersion === "string" && INTEGRATION_VERSION_PATTERN.test(integrationVersion)) {
+    return { ...SDK_INFO, integrationVersion };
+  }
+  logger.debug("Ignoring invalid integrationVersion (expected <= 32 chars of [0-9A-Za-z.+_-])");
+  return SDK_INFO;
+}
+var SESSION_STORAGE_KEY = "cbo_session_id";
+var SESSION_CONTINUITY_KEY = "cbo_session";
+var SEQ_STORAGE_KEY = "cbo_seq";
+var EXPERIMENTS_STORAGE_KEY = "cbo_experiments";
+var DATA_POLICY_STORAGE_KEY = "cbo_data_policy";
+var DATA_POLICY_MAX = 255;
+var EXPERIMENT_KEY_RE = /^[A-Za-z0-9_-]+$/;
+var EXPERIMENT_KEY_MAX = 128;
+var EXPERIMENT_VALUE_MAX = 256;
+var TELEMETRY_MESSAGE_MAX = 1e3;
+var PROBE_KIND_RE = /^[a-z][a-z0-9_-]{0,31}$/;
+var PROBE_ID_RE = /^[A-Za-z0-9_-]{1,16}$/;
+var PROBE_CTX_MAX = 64;
+var PROBE_PAGE_IDS_MAX = 32;
+var MAX_SELF_TELEMETRY = 50;
+var SEQ_LOCK_NAME = "cbo_seq";
+var SESSION_ACTIVITY_WRITE_INTERVAL_MS = 1e3;
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var CorbadoTracker = class _CorbadoTracker {
+  constructor(options) {
+    this.options = options;
+    this.options.debug = options.debug ?? false;
+    this.logger = options.logger ?? createLogger({ debug: this.options.debug });
+    const localStorage = new LocalStorage(this.logger);
+    const sessionStorage = new SessionStorage(this.logger);
+    const isCookie = options.storage === "cookie";
+    const cookieStorage = isCookie ? new CookieStorage(this.logger, options.cookieDomain) : void 0;
+    migrateLegacyStorage(options.projectId, localStorage, sessionStorage, cookieStorage, this.logger);
+    const namespace = options.projectId;
+    const scoped = (engine) => new NamespacedStorage(engine, namespace);
+    this.seqLockName = namespacedKey(SEQ_LOCK_NAME, namespace);
+    this.sessionStorage = scoped(sessionStorage);
+    this.persistentStorage = scoped(localStorage);
+    this.storage = scoped(cookieStorage ?? localStorage);
+    this.configOverrides = {
+      ...options.sdkConfig,
+      ...options.sdkConfig?.retry && { retry: { ...options.sdkConfig.retry } },
+      ...options.sdkConfig?.flushOnFlowTypeFinished && {
+        flushOnFlowTypeFinished: [...options.sdkConfig.flushOnFlowTypeFinished]
+      },
+      ...options.sdkConfig?.sourcePathQueryAllow && {
+        sourcePathQueryAllow: [...options.sdkConfig.sourcePathQueryAllow]
+      }
+    };
+    this.fixedData = resolveFixedDataConfig(options.fixedDataConfig);
+    if (this.fixedData) {
+      this.configOverrides.pmd = this.fixedData.pmd;
+    }
+    const completeOverride = Object.keys(DEFAULT_RELIABILITY_CONFIG).every(
+      (key) => this.configOverrides[key] !== void 0
+    ) && Object.keys(DEFAULT_RELIABILITY_CONFIG.retry).every(
+      (key) => this.configOverrides.retry?.[key] !== void 0
+    );
+    if (!completeOverride) {
+      this.configManager = new ConfigManager(
+        options.apiBaseUrl + (options.apiConfigPath ?? "/v1/observe/config") + "/" + options.projectId,
+        this.persistentStorage,
+        this.logger
+      );
+    }
+    const cachedConfig = this.configManager?.initialConfig;
+    this.config = resolveReliabilityConfig(cachedConfig, this.configOverrides);
+    if (!completeOverride && !cachedConfig && options.flushInterval != null && this.configOverrides.flushIntervalMs === void 0) {
+      this.config = { ...this.config, flushIntervalMs: options.flushInterval };
+    }
+    if (!completeOverride && !cachedConfig && options.deviceInfoCollectorTimeout != null && this.configOverrides.deviceInfoCollectorTimeoutMs === void 0) {
+      this.config = { ...this.config, deviceInfoCollectorTimeoutMs: options.deviceInfoCollectorTimeout };
+    }
+    if (options.apiBaseUrl !== "") {
+      if (!/^https?:\/\//.test(options.apiBaseUrl)) {
+        this.logger.critical(
+          `Invalid apiBaseUrl: URL must start with http:// or https:// (got: "${options.apiBaseUrl}")`
+        );
+        this.reportTelemetry("error", "invalid apiBaseUrl: missing http(s) scheme");
+      }
+      if (options.apiBaseUrl.endsWith("/")) {
+        this.logger.critical(`Invalid apiBaseUrl: URL must not have a trailing slash (got: "${options.apiBaseUrl}")`);
+        this.reportTelemetry("error", "invalid apiBaseUrl: trailing slash");
+      }
+    }
+    const url = options.apiBaseUrl + (options.apiEventPath ?? "/v1/observe/events") + "/" + options.projectId;
+    this.logger.debug(`Using API endpoint: ${url}`);
+    const transport = new FetchTransport({
+      logger: this.logger,
+      url
+    });
+    this.sessionId = this.resolveSessionId();
+    this.queue = new RequestQueue(
+      this.logger,
+      transport,
+      this.sessionId,
+      sdkInfo(this.options.integrationVersion, this.logger),
+      {
+        debug: this.options.debug,
+        config: this.config,
+        requestConfig: false,
+        outboxLockName: namespacedKey(OUTBOX_LOCK_NAME, namespace),
+        getDataPolicy: () => this.dataPolicy,
+        fixedData: this.fixedData !== void 0 || typeof __CBO_DATA_PMD__ === "boolean" || typeof __CBO_DATA_PRIVATE_MODE__ === "boolean",
+        beforeEventBatchSend: (events) => this.attachUndeliveredDeviceInfo(events),
+        // The queue is created before the device info manager; both are only called once it exists.
+        standaloneDeviceInfo: {
+          has: () => this.deviceInfoManager?.hasStandalone() ?? false,
+          take: () => this.deviceInfoManager?.takeStandalone()
+        }
+      },
+      this.persistentStorage
+    );
+    this.telemetryReady = true;
+    this.logger.setTelemetrySink?.((level, message) => this.reportTelemetry(level, message));
+    try {
+      this.getWindowObserver();
+    } catch (error) {
+      this.logger.error("Failed to attach page low-event observer", error);
+    }
+    if (typeof __CBO_DATA_PMD__ === "boolean" ? __CBO_DATA_PMD__ : this.fixedData?.pmd !== false) {
+      try {
+        this.passwordManagerSampler = this.isTrackingBlocked() ? void 0 : new PasswordManagerSampler(
+          this.logger,
+          () => typeof __CBO_DATA_PMD__ === "boolean" ? __CBO_DATA_PMD__ : this.config.pmd,
+          this.getWindowObserver()
+        );
+      } catch (error) {
+        this.logger.error("Failed to start password manager detection", error);
+      }
+    }
+    const bufferedTelemetry = this.pendingSelfTelemetry;
+    this.pendingSelfTelemetry = [];
+    for (const item of bufferedTelemetry) {
+      this.telemetry(item.level, item.message);
+    }
+    const deviceInfoCollector = new DeviceCollector(
+      this.logger,
+      this.storage,
+      isCookie ? "cookie" : "localstorage",
+      this.sessionStorage,
+      () => ({
+        timing: this.config.deviceInfoTiming
+      }),
+      // Timing entries carry raw millisecond values, so they go through the public telemetry path
+      // rather than reportTelemetry: the latter dedupes by exact message and is capped per load,
+      // where ever-changing messages would crowd out real error diagnostics.
+      (level, message) => this.telemetry(level, message),
+      this.fixedData?.privateMode ?? true
+    );
+    this.deviceCollector = deviceInfoCollector;
+    const deviceInfoDebounceTime = options.deviceInfoDebounceTime ?? 3e4;
+    this.deviceInfoManager = new DeviceInfoManager(
+      this.logger,
+      deviceInfoCollector,
+      Math.max(1, deviceInfoDebounceTime),
+      deviceInfoDebounceTime,
+      {
+        timing: () => this.config.deviceInfoTiming,
+        emit: (level, message) => this.telemetry(level, message)
+      },
+      () => this.queue.notifyDeviceInfo()
+    );
+    this.deviceInfoManager.start();
+    this.experiments = this.loadPersistedExperiments();
+    if (options.experiments) {
+      this.setExperiments(options.experiments);
+    }
+    this.dataPolicy = this.loadPersistedDataPolicy();
+    if (options.dataPolicy !== void 0) {
+      this.setDataPolicy(options.dataPolicy);
+    }
+    this.configManager?.start((config) => this.handleConfig(config));
+  }
+  logger;
+  queue;
+  sessionId;
+  storage;
+  sessionStorage;
+  /** Dedicated localStorage engine for reliability state (config cache, outbox, continuity session, seq). */
+  persistentStorage;
+  /** Seq/continuity Web Lock name; project-scoped together with the storage keys it guards. */
+  seqLockName;
+  /** Current resolved policy. Continuity and persistence stay enabled once activated within a document. */
+  config;
+  configManager;
+  configOverrides;
+  /** Resolved `fixedDataConfig`; undefined when not given (server-driven data switches). */
+  fixedData;
+  deviceInfoManager;
+  deviceCollector;
+  /**
+   * Cached per-tab id stamped onto every event's meta (see {@link EventMeta.tabId}). Resolved
+   * lazily from the collector's sessionStorage-backed id; stable for the whole page lifetime.
+   */
+  eventTabId;
+  seq = 0;
+  /**
+   * When the continuity record's `lastActiveAt` was last persisted. Throttles that write inside the
+   * seq critical section (see {@link SESSION_ACTIVITY_WRITE_INTERVAL_MS}). 0 = not written yet on
+   * this load, so the first allocation always persists.
+   */
+  lastActivityWriteAt = 0;
+  /** Persistent experiment assignments (experiment key → variant), attached to every produced event. */
+  experiments = {};
+  /**
+   * Persistent data policy code, stamped into every batch's `meta.dataPolicy` once set. Never
+   * cleared (only overwritten): it survives reloads, session rotation, resetSession and destroy.
+   */
+  dataPolicy;
+  /** Self-instrumentation state: re-entrancy guard, readiness, per-load dedupe, and pre-queue buffer. */
+  telemetryReporting = false;
+  telemetryReady = false;
+  reportedTelemetryKeys = /* @__PURE__ */ new Set();
+  pendingSelfTelemetry = [];
+  /** Default probe page id (one per tracker instance) and the probe seq counter per page id. */
+  probePageId;
+  probeSeqs = /* @__PURE__ */ new Map();
+  windowObserver;
+  passwordManagerSampler;
+  /** @internal Shared passive page observation and per-operation context registration. */
+  getWindowObserver() {
+    return this.windowObserver ??= new SharedWindowObserver(
+      this.logger,
+      (low, sessionId) => this.enqueueLowEvent(low, sessionId),
+      () => this.lowEventFlushKeepalive()
+    );
+  }
+  /** Apply init overrides on every refresh; continuity and persistence only activate within a document. */
+  handleConfig(config) {
+    const next = resolveReliabilityConfig(config, this.configOverrides);
+    next.sessionContinuity ||= this.config.sessionContinuity;
+    next.durableOutbox ||= this.config.durableOutbox;
+    this.config = next;
+    this.queue.updateConfig(this.config);
+  }
+  /**
+   * Returns the logger used by this tracker.
+   * @internal
+   */
+  getLogger() {
+    return this.logger;
+  }
+  applicationTag() {
+    if (this.options.applicationId) {
+      return { applicationId: this.options.applicationId.toLowerCase() };
+    }
+    return {};
+  }
+  // --- Experiments ---
+  /**
+   * Register the user's variant for an experiment (e.g. `setExperiment("button_color", "blue")`).
+   *
+   * @remarks
+   * Corbado Observe does not assign variants — your app decides, and this records the assignment so
+   * Observe can attribute flows to it. The assignment persists (localStorage) across reloads and
+   * `resetSession`, and is attached to every event the tracker produces until you change or clear it.
+   * Multiple experiments can be active at once. Set it close to where the variant actually affects the
+   * user (or use the per-call `experiments` argument on a tracking method) to avoid over-attributing
+   * exposure; call {@link clearExperiment} when it no longer applies (e.g. on logout).
+   *
+   * Never throws: invalid input is ignored with a debug log.
+   */
+  setExperiment(key, variant) {
+    this.setExperiments({ [key]: variant });
+  }
+  /**
+   * Register several experiment assignments at once (experiment key → variant). Additive: existing
+   * assignments for other keys are kept. See {@link setExperiment}.
+   */
+  setExperiments(assignments) {
+    try {
+      if (!assignments || typeof assignments !== "object") {
+        return;
+      }
+      let changed = false;
+      for (const [key, variant] of Object.entries(assignments)) {
+        if (!_CorbadoTracker.isValidExperimentKey(key) || !_CorbadoTracker.isValidExperimentVariant(variant)) {
+          this.logger.debug(`Ignoring invalid experiment assignment "${String(key)}"`);
+          continue;
+        }
+        if (this.experiments[key] !== variant) {
+          this.experiments[key] = variant;
+          changed = true;
+        }
+      }
+      if (changed) {
+        this.persistExperiments();
+      }
+    } catch (error) {
+      this.logger.error("Failed to set experiments", error);
+    }
+  }
+  /** Remove a single experiment assignment. */
+  clearExperiment(key) {
+    try {
+      if (Object.prototype.hasOwnProperty.call(this.experiments, key)) {
+        delete this.experiments[key];
+        this.persistExperiments();
+      }
+    } catch (error) {
+      this.logger.error("Failed to clear experiment", error);
+    }
+  }
+  /** Remove all experiment assignments. */
+  clearExperiments() {
+    try {
+      if (Object.keys(this.experiments).length === 0) {
+        return;
+      }
+      this.experiments = {};
+      this.persistExperiments();
+    } catch (error) {
+      this.logger.error("Failed to clear experiments", error);
+    }
+  }
+  /** Returns a copy of the currently active experiment assignments. */
+  getExperiments() {
+    return { ...this.experiments };
+  }
+  /**
+   * Returns the currently active public SDK configuration, including live updates.
+   *
+   * @returns A frozen snapshot, created fresh on every call.
+   */
+  /** @internal Project-scoped localStorage used by operation helpers (e.g. email-link continuity). */
+  getPersistentStorage() {
+    return this.persistentStorage;
+  }
+  getSdkConfig() {
+    return Object.freeze({
+      version: this.config.version,
+      aap: this.config.aap,
+      rawErrors: this.config.rawErrors
+    });
+  }
+  // --- Data policy ---
+  /**
+   * Set the data policy code for this tracker (e.g. `setDataPolicy(1)` once the user agreed to
+   * extended processing; `setDataPolicy(0)` to return to the project default). Codes are
+   * project-scoped non-negative integers (0..255) selecting a policy configured in Corbado; they
+   * carry no ordering.
+   *
+   * The code is persisted (localStorage, project-scoped) and sent as `meta.dataPolicy` on every
+   * subsequent batch, across reloads and session rotation. It is never cleared, only overwritten.
+   * The server records the latest code it receives for a session (last write wins). Invalid codes
+   * are ignored with a debug log; never throws.
+   */
+  setDataPolicy(code) {
+    try {
+      if (!_CorbadoTracker.isValidDataPolicy(code)) {
+        this.logger.debug(`Ignoring invalid data policy code "${String(code)}"`);
+        return;
+      }
+      if (this.dataPolicy !== code) {
+        this.dataPolicy = code;
+        this.persistDataPolicy();
+      }
+    } catch (error) {
+      this.logger.error("Failed to set data policy", error);
+    }
+  }
+  /** Returns the current data policy code, or undefined when none has ever been set. */
+  getDataPolicy() {
+    return this.dataPolicy;
+  }
+  static isValidDataPolicy(code) {
+    return typeof code === "number" && Number.isInteger(code) && code >= 0 && code <= DATA_POLICY_MAX;
+  }
+  loadPersistedDataPolicy() {
+    try {
+      const stored = this.persistentStorage.getItem(DATA_POLICY_STORAGE_KEY);
+      return _CorbadoTracker.isValidDataPolicy(stored) ? stored : void 0;
+    } catch (error) {
+      this.logger.debug("Failed to load persisted data policy", error);
+      return void 0;
+    }
+  }
+  persistDataPolicy() {
+    try {
+      if (this.dataPolicy === void 0) {
+        return;
+      }
+      this.persistentStorage.setItem(DATA_POLICY_STORAGE_KEY, this.dataPolicy);
+    } catch (error) {
+      this.logger.debug("Failed to persist data policy", error);
+    }
+  }
+  static isValidExperimentKey(key) {
+    return typeof key === "string" && key.length > 0 && key.length <= EXPERIMENT_KEY_MAX && EXPERIMENT_KEY_RE.test(key);
+  }
+  static isValidExperimentVariant(variant) {
+    return typeof variant === "string" && variant.length > 0 && variant.length <= EXPERIMENT_VALUE_MAX;
+  }
+  loadPersistedExperiments() {
+    try {
+      const stored = this.persistentStorage.getItem(EXPERIMENTS_STORAGE_KEY);
+      if (!stored || typeof stored !== "object") {
+        return {};
+      }
+      const cleaned = {};
+      for (const [key, variant] of Object.entries(stored)) {
+        if (_CorbadoTracker.isValidExperimentKey(key) && _CorbadoTracker.isValidExperimentVariant(variant)) {
+          cleaned[key] = variant;
+        }
+      }
+      return cleaned;
+    } catch (error) {
+      this.logger.debug("Failed to load persisted experiments", error);
+      return {};
+    }
+  }
+  persistExperiments() {
+    try {
+      this.persistentStorage.setItem(EXPERIMENTS_STORAGE_KEY, this.experiments);
+    } catch (error) {
+      this.logger.debug("Failed to persist experiments", error);
+    }
+  }
+  /**
+   * Resolves the experiments to attach to one event: the persistent assignments with any per-call
+   * override merged on top. Returns undefined when there are none (so the field is omitted).
+   */
+  resolveExperiments(perCall) {
+    const merged = { ...this.experiments };
+    if (perCall && typeof perCall === "object") {
+      for (const [key, variant] of Object.entries(perCall)) {
+        if (_CorbadoTracker.isValidExperimentKey(key) && _CorbadoTracker.isValidExperimentVariant(variant)) {
+          merged[key] = variant;
+        }
+      }
+    }
+    return Object.keys(merged).length > 0 ? merged : void 0;
+  }
+  isTrackingBlocked() {
+    if (typeof navigator === "undefined") {
+      return false;
+    }
+    return isBlockedUserAgent(
+      readUserAgent({
+        key: "browser-api:sdk.blocked-user-agent",
+        title: "User agent check for crawlers and bots",
+        accessNote: "navigator.userAgent, matched against a list of crawler and bot patterns",
+        group: "Observe SDK state",
+        origin: "observe-external",
+        fields: [
+          {
+            path: "result",
+            label: "Whether the browser looks like a bot",
+            exposure: "computed",
+            transform: { note: "matched against the blocked user-agent list; only the boolean is used (tracking off)" }
+          }
+        ]
+      })
+    );
+  }
+  resolveSessionId() {
+    try {
+      if (this.config.sessionContinuity) {
+        return this.getContinuitySessionId();
+      }
+      const now = Date.now();
+      const stored = this.readPerTabSession();
+      if (stored && now - stored.lastActiveAt < this.perTabInactivityMs(stored)) {
+        this.persistPerTabSession(stored.id, now);
+        this.seq = 0;
+        return stored.id;
+      }
+      const newSessionId = uuidv7();
+      this.persistPerTabSession(newSessionId, now);
+      this.seq = 0;
+      this.logger.debug("Created session id", newSessionId);
+      return newSessionId;
+    } catch (error) {
+      this.logger.error("Failed to get session id", error);
+      this.reportTelemetry("error", "failed to get session id");
+      return "";
+    }
+  }
+  /**
+   * Resolve the session id from localStorage so it survives reloads and is shared across tabs of the
+   * same browser. Rotates after `config.sessionInactivityMs` of inactivity (server-controlled,
+   * evaluated at boot), resetting the seq counter.
+   *
+   * Inactivity rotation happens at boot only, here and on the per-tab path {@link resolveSessionId}
+   * takes without continuity. Boot is chosen on an assumption, not a guarantee: that a load
+   * re-announces its flow, so the fresh session id gets a classifiable flow. That holds where a
+   * flow is opened per load. Where one is opened once and carried across loads it does not, and a
+   * boot rotation splits that flow — such a project needs a window long enough to span the journey.
+   * Mid-page the assumption is not even available: nothing re-announces between two tracked events,
+   * so rotating there would leave the started flow unfinished in the old session and the remaining
+   * events without a flow start in the new one — one gap counted as a drop-off, one completion
+   * counted as nothing. `nextSeq` therefore never rotates on inactivity, on either path.
+   */
+  getContinuitySessionId() {
+    const now = Date.now();
+    const existing = this.persistentStorage.getItem(SESSION_CONTINUITY_KEY);
+    if (existing?.id && now - existing.lastActiveAt < this.config.sessionInactivityMs) {
+      this.persistContinuitySession(existing.id, now);
+      this.seq = this.persistentStorage.getItem(SEQ_STORAGE_KEY) ?? 0;
+      return existing.id;
+    }
+    if (!existing?.id) {
+      const perTab = this.readPerTabSession();
+      if (perTab && now - perTab.lastActiveAt < this.config.sessionInactivityMs) {
+        this.persistContinuitySession(perTab.id, now);
+        this.persistentStorage.setItem(SEQ_STORAGE_KEY, 0);
+        this.seq = 0;
+        this.logger.debug("Adopted per-tab session id as continuity session", perTab.id);
+        return perTab.id;
+      }
+    }
+    const newSessionId = uuidv7();
+    this.persistContinuitySession(newSessionId, now);
+    this.persistentStorage.setItem(SEQ_STORAGE_KEY, 0);
+    this.seq = 0;
+    this.logger.debug("Created continuity session id", newSessionId);
+    return newSessionId;
+  }
+  /**
+   * Persist the continuity record and remember when, so the throttled refresh in the seq critical
+   * section measures from the last write that actually happened — whoever made it.
+   */
+  persistContinuitySession(id, now) {
+    this.lastActivityWriteAt = now;
+    this.persistentStorage.setItem(SESSION_CONTINUITY_KEY, { id, lastActiveAt: now });
+  }
+  /**
+   * Read the per-tab session record. A bare string is the format that predates dating: it carries no
+   * `lastActiveAt`, so its window can only start on the load that reads it. That load rewrites it in
+   * the dated shape, so a tab converts once and ages normally from then on, and the case drains as
+   * the rollout replaces the bundles that write it.
+   */
+  readPerTabSession() {
+    const stored = this.sessionStorage.getItem(SESSION_STORAGE_KEY);
+    if (!stored) {
+      return void 0;
+    }
+    if (typeof stored === "string") {
+      return UUID_RE.test(stored) ? { id: stored, lastActiveAt: Date.now() } : void 0;
+    }
+    if (typeof stored.lastActiveAt !== "number") {
+      return void 0;
+    }
+    return UUID_RE.test(stored.id) ? stored : void 0;
+  }
+  /**
+   * Persist the per-tab record and remember when, sharing the throttle bookkeeping with the
+   * continuity record — a load resolves its session on one path or the other, never both.
+   *
+   * An explicit timeout override or server config stamps the window. Otherwise carry forward what
+   * the tab already knows, so a defaults boot does not replace a previously configured threshold.
+   */
+  persistPerTabSession(id, now) {
+    this.lastActivityWriteAt = now;
+    const inactivityMs = this.configOverrides.sessionInactivityMs !== void 0 || this.config.version ? this.config.sessionInactivityMs : this.readPerTabSession()?.inactivityMs;
+    this.sessionStorage.setItem(SESSION_STORAGE_KEY, {
+      id,
+      lastActiveAt: now,
+      ...inactivityMs === void 0 ? {} : { inactivityMs }
+    });
+  }
+  /** Explicit init timeout wins; otherwise retain the window a prior configured load recorded. */
+  perTabInactivityMs(stored) {
+    return this.configOverrides.sessionInactivityMs !== void 0 ? this.config.sessionInactivityMs : stored.inactivityMs ?? this.config.sessionInactivityMs;
+  }
+  /**
+   * Return the next sequence number. With session continuity the counter is persisted so ordering
+   * survives reloads/redirects; the read-increment-write runs under a cross-tab Web Lock
+   * ({@link SEQ_LOCK_NAME}) so two tabs sharing the session cannot allocate the same seq (where Web
+   * Locks are unavailable or exceed the configured timeout it degrades to the historical best-effort merge).
+   * Lock grants are FIFO, so seq order matches `track()` call order within a tab. Tracking also keeps the
+   * continuity session's `lastActiveAt` fresh (throttled, see {@link SESSION_ACTIVITY_WRITE_INTERVAL_MS}),
+   * so the window the NEXT boot evaluates measures real user
+   * inactivity instead of time-since-page-load (a long-lived active tab must not rotate the session
+   * on the next reload). It never rotates the session itself: the inactivity window is evaluated at
+   * boot only ({@link getContinuitySessionId} documents why). Consequence: while a page is never
+   * reloaded — foreground idle, bfcache restore, long-lived SPA tab — a session can outlive
+   * `sessionInactivityMs`. That inflates flow durations but keeps flow counts correct, which is the
+   * better half of the trade. An empty store while this load already has a session id means
+   * persistence is failing (or was cleared); the in-memory id is reused then — never re-minted — so
+   * a broken store degrades to one session per page load instead of one session per event.
+   */
+  nextSeq() {
+    if (!this.config.sessionContinuity) {
+      const now = Date.now();
+      if (this.sessionId && now - this.lastActivityWriteAt >= SESSION_ACTIVITY_WRITE_INTERVAL_MS) {
+        this.persistPerTabSession(this.sessionId, now);
+      }
+      return this.seq++;
+    }
+    const allocate = () => {
+      const now = Date.now();
+      const storedSession = this.persistentStorage.getItem(SESSION_CONTINUITY_KEY);
+      let sessionChanged = false;
+      if (!storedSession?.id && this.sessionId) {
+        this.persistContinuitySession(this.sessionId, now);
+      } else if (!storedSession?.id) {
+        const newSessionId = uuidv7();
+        this.persistContinuitySession(newSessionId, now);
+        this.persistentStorage.setItem(SEQ_STORAGE_KEY, 0);
+        this.sessionId = newSessionId;
+        this.queue.setSessionId(newSessionId);
+        this.seq = 0;
+        sessionChanged = true;
+      } else {
+        if (now - this.lastActivityWriteAt >= SESSION_ACTIVITY_WRITE_INTERVAL_MS) {
+          this.persistContinuitySession(storedSession.id, now);
+        }
+        if (storedSession.id !== this.sessionId) {
+          this.sessionId = storedSession.id;
+          this.queue.setSessionId(storedSession.id);
+          sessionChanged = true;
+        }
+      }
+      const stored = this.persistentStorage.getItem(SEQ_STORAGE_KEY);
+      if (sessionChanged) {
+        this.seq = typeof stored === "number" ? stored : 0;
+      }
+      const current = typeof stored === "number" && stored > this.seq ? stored : this.seq;
+      this.seq = current + 1;
+      this.persistentStorage.setItem(SEQ_STORAGE_KEY, this.seq);
+      return current;
+    };
+    const timeoutMs = this.config.seqLockTimeoutMs;
+    if (timeoutMs === 0 || !hasWebLocks({
+      key: "browser-api:sdk.web-locks",
+      title: "Coordination of Observe data across open tabs",
+      accessNote: "Web Locks API (navigator.locks) on Observe's own lock names",
+      group: "Observe SDK state",
+      origin: "observe-internal",
+      fields: [
+        {
+          path: "available",
+          label: "Whether the browser supports tab coordination",
+          exposure: "enum",
+          transform: { values: [true, false] }
+        }
+      ]
+    })) {
+      return allocate();
+    }
+    return withWebLock(
+      {
+        key: "browser-api:sdk.web-locks",
+        title: "Coordination of Observe data across open tabs",
+        accessNote: "Web Locks API (navigator.locks) on Observe's own lock names",
+        group: "Observe SDK state",
+        origin: "observe-internal",
+        fields: [
+          {
+            path: "result",
+            label: "Coordination between open tabs",
+            exposure: "none",
+            transform: { note: "own cbo_* lock names; serializes the SDK's storage updates across tabs" }
+          }
+        ]
+      },
+      this.seqLockName,
+      allocate,
+      {
+        timeoutMs,
+        onTimeout: () => {
+          this.logger.warn(`Sequence Web Lock acquisition timed out after ${timeoutMs}ms; using fallback`);
+          this.reportTelemetry("info", `seq web lock timeout; using fallback, ${timeoutMs}ms`);
+        }
+      }
+    );
+  }
+  resolveTrackingSourcePath() {
+    if (typeof window === "undefined") {
+      return void 0;
+    }
+    return readSourcePath(
+      {
+        key: "page:location.source-path",
+        title: "Page path and allowed query parameters",
+        accessNote: "location.pathname and location.search; the query is reduced by the sourcePathQuery policy inside the reader (trackingSourcePath)",
+        group: "Page",
+        origin: "observe-external",
+        fields: [
+          { path: "url.path", label: "Page path", exposure: "raw" },
+          {
+            path: "url.query",
+            label: "Page address parameters (allowed ones only)",
+            exposure: "redacted",
+            transform: { note: "sourcePathQuery 'allowlist': values of non-allowlisted keys become '*'; 'all': raw" }
+          }
+        ]
+      },
+      this.config.sourcePathQuery,
+      this.config.sourcePathQueryAllow
+    );
+  }
+  /**
+   * Per-tab id for event meta, cached after the first successful resolution: the id is
+   * sessionStorage-backed and stable for the whole page lifetime.
+   */
+  resolveEventTabId() {
+    if (this.eventTabId === void 0) {
+      this.eventTabId = this.deviceCollector.getTabId();
+    }
+    return this.eventTabId;
+  }
+  /** @internal */
+  trackSubflowStarted(subflowType, data, options, eventId) {
+    const wrappedData = {
+      subflowType,
+      ...data
+    };
+    void this.track(
+      AuthEventName.SubflowStarted,
+      wrappedData,
+      options?.userReference,
+      void 0,
+      void 0,
+      options?.explicitTimestamp,
+      options?.experiments,
+      {
+        id: eventId,
+        subflowStartEventId: options?.subflowStartEventId,
+        sessionId: options?.captureSessionId,
+        initiator: options?.initiator
+      }
+    );
+  }
+  /** @internal */
+  trackSubflowTrigger(subflowType, data, options) {
+    const wrappedData = {
+      subflowType,
+      ...data
+    };
+    void this.track(
+      AuthEventName.SubflowTrigger,
+      wrappedData,
+      options?.userReference,
+      void 0,
+      void 0,
+      options?.explicitTimestamp,
+      options?.experiments,
+      {
+        subflowStartEventId: options?.subflowStartEventId,
+        sessionId: options?.captureSessionId,
+        initiator: options?.initiator
+      }
+    );
+  }
+  /** @internal */
+  trackSubflowStepStarted(subflowType, stepName, data, options, ignoreAsInteraction) {
+    const wrappedData = {
+      subflowType,
+      stepName,
+      stepData: data,
+      identifier: options?.identifier,
+      ignoreAsInteraction
+    };
+    void this.track(
+      AuthEventName.SubflowStepStarted,
+      wrappedData,
+      options?.userReference,
+      void 0,
+      void 0,
+      options?.explicitTimestamp,
+      options?.experiments,
+      {
+        subflowStartEventId: options?.subflowStartEventId,
+        sessionId: options?.captureSessionId,
+        initiator: options?.initiator
+      }
+    );
+  }
+  /** @internal */
+  trackSubflowStepFinished(subflowType, stepName, data, options) {
+    const wrappedData = {
+      subflowType,
+      stepName,
+      stepData: data,
+      identifier: options?.identifier
+    };
+    void this.track(
+      AuthEventName.SubflowStepFinished,
+      wrappedData,
+      options?.userReference,
+      void 0,
+      void 0,
+      options?.explicitTimestamp,
+      options?.experiments,
+      {
+        subflowStartEventId: options?.subflowStartEventId,
+        sessionId: options?.captureSessionId,
+        initiator: options?.initiator
+      }
+    );
+  }
+  /** @internal */
+  trackSubflowStepError(subflowType, stepName, data, options) {
+    const wrappedData = {
+      subflowType,
+      stepName,
+      stepData: data,
+      identifier: options?.identifier
+    };
+    void this.track(
+      AuthEventName.SubflowStepError,
+      wrappedData,
+      options?.userReference,
+      void 0,
+      void 0,
+      options?.explicitTimestamp,
+      options?.experiments,
+      {
+        subflowStartEventId: options?.subflowStartEventId,
+        sessionId: options?.captureSessionId,
+        initiator: options?.initiator
+      }
+    );
+  }
+  /**
+   * @remarks
+   * @internal
+   * Records an additional error occurrence against the subflow. Carries no outcome semantics —
+   * step errors are the intended channel; not part of a normal integration.
+   */
+  trackSubflowError(subflowType, data, options) {
+    const wrappedData = {
+      subflowType,
+      stepData: data
+    };
+    void this.track(
+      AuthEventName.SubflowError,
+      wrappedData,
+      options?.userReference,
+      void 0,
+      void 0,
+      options?.explicitTimestamp,
+      options?.experiments,
+      {
+        subflowStartEventId: options?.subflowStartEventId,
+        sessionId: options?.captureSessionId,
+        initiator: options?.initiator
+      }
+    );
+  }
+  /**
+   * Error situations:
+   *  - Blocked user agent (see `isBlockedUserAgent`): skip with a debug log and return
+   *  - Any error before the event is enqueued (e.g. `JSON.stringify` in debug logging, `queue.enqueue`): log `Failed to process event "<name>" before enqueue`
+   *
+   * @internal
+   */
+  async track(name, data, userReference, tags, contexts, explicitTimestamp, experiments, capture) {
+    try {
+      if (this.isTrackingBlocked()) {
+        this.logger.debug(`Skipping event "${name}" for blocked user agent.`);
+        return;
+      }
+      if (name === AuthEventName.FlowFinished || name === AuthEventName.FlowAutoFinished || name === AuthEventName.FlowReset) {
+        this.windowObserver?.flushInputs();
+      }
+      const timestamp = explicitTimestamp ?? Date.now();
+      const capturedId = capture?.id ?? uuidv7();
+      const capturedSessionId = capture?.sessionId ?? this.sessionId;
+      const nextSeq = this.nextSeq();
+      const seq = typeof nextSeq === "number" ? nextSeq : await nextSeq;
+      const trackingSourcePath = this.resolveTrackingSourcePath();
+      const event = {
+        type: "predefined",
+        name,
+        id: capturedId,
+        timestamp,
+        seq,
+        data,
+        user: userReference,
+        contexts,
+        tags,
+        experiments: this.resolveExperiments(experiments),
+        meta: {
+          captureVersion: 1,
+          pageId: getCapturePageId(),
+          initiator: capture?.initiator,
+          trackingSourcePath: trackingSourcePath ?? "",
+          subflowStartEventId: capture?.subflowStartEventId,
+          tabId: this.resolveEventTabId()
+        }
+      };
+      const deviceInfo = this.deviceInfoManager.getForEvent();
+      if (deviceInfo) {
+        event.deviceInfo = deviceInfo;
+      }
+      this.logger.debug(`Track: ${name}`, JSON.stringify(event, null, 2));
+      const passwordManagers = this.passwordManagerSampler?.takeReport(capturedSessionId);
+      if (passwordManagers) {
+        event.passwordManagers = passwordManagers;
+      }
+      this.queue.enqueue(event, capturedSessionId);
+    } catch (error) {
+      this.logger.error(`Failed to process event "${name}" before enqueue`, error);
+      this.reportTelemetry("error", `failed to process event "${name}" before enqueue`);
+    }
+  }
+  // --- Typed Tracking Methods ---
+  /**
+   * Track when an authentication flow (or flow selection screen) becomes visible.
+   *
+   * @remarks
+   * Call this once when the user first enters an auth touchpoint (for example account login,
+   * checkout login, or account recovery). If users can choose between multiple flows
+   * (such as login vs signup), pass `flowNames` and optionally `defaultFlowName`.
+   *
+   * The returned handle can attach identity after completion with `await flow.enrich({ userId })`.
+   * Enrichment requires a backend supporting explicit event targeting.
+   *
+   * @param data - Flow metadata, including one flow (`flowName`) or multiple candidates (`flowNames`).
+   * @param tags - Optional key-value tags for filtering and segmentation.
+   * @param experiments - Optional per-call experiment overrides.
+   * @param contexts - Optional structured event context (e.g. technical metadata that is not an
+   *   analytical dimension). Written to the event's `contexts` field verbatim.
+   * @param options - Optional `explicitTimestamp` (epoch ms) when the flow became visible earlier than
+   *   this call, e.g. because an integration confirms a screen only after it stayed up for a while.
+   *
+   * @example
+   * ```typescript
+   * tracker.flowStarted({
+   *   flowNames: ["login", "signup"],
+   *   defaultFlowName: "login",
+   *   touchpoint: "account",
+   * });
+   * ```
+   */
+  flowStarted(data, tags, experiments, contexts, options) {
+    try {
+      const targetEventId = uuidv7();
+      const sessionId = this.sessionId;
+      const effectiveTags = { ...this.options.defaultTags, ...this.applicationTag(), ...tags };
+      void this.track(
+        AuthEventName.FlowStarted,
+        data,
+        void 0,
+        effectiveTags,
+        contexts,
+        options?.explicitTimestamp,
+        experiments,
+        {
+          id: targetEventId,
+          sessionId
+        }
+      );
+      return this.flowHandle(targetEventId, sessionId);
+    } catch (error) {
+      this.logger.warn("Failed to start flow", error);
+      return { enrich: async () => {
+      } };
+    }
+  }
+  /**
+   * Track when the user commits to a specific flow.
+   *
+   * @remarks
+   * Use this after presenting alternatives and once you know which path the user takes
+   * (for example when identifier checks route to login vs signup).
+   *
+   * @param data - Selected flow name.
+   * @param tags - Optional key-value tags for filtering and segmentation.
+   *
+   * @example
+   * ```typescript
+   * tracker.flowDecided({flowName: "signup"});
+   * ```
+   */
+  flowDecided(data, tags, experiments) {
+    void this.track(AuthEventName.FlowDecided, data, void 0, tags, void 0, void 0, experiments);
+  }
+  /**
+   * Track a business/marketing conversion that is not part of an authentication flow.
+   *
+   * @remarks
+   * Use this for outcomes you care about beyond auth, such as a completed purchase,
+   * a started subscription, or a newsletter signup. Provide a stable `name` for the
+   * conversion and (optionally) the `touchpoint` where it happened so it can be
+   * segmented in the same way as flows. Record identity separately with `setUser()`
+   * while the relevant flow is still active.
+   *
+   * Legacy identity fields in `data` remain supported but are deprecated.
+   *
+   * @param data - Conversion name, optional touchpoint, and deprecated user reference fields.
+   * @param tags - Optional key-value tags for filtering and segmentation.
+   *
+   * @example
+   * ```typescript
+   * tracker.conversion({
+   *   name: "purchase",
+   *   touchpoint: "checkout",
+   * });
+   * ```
+   */
+  conversion(data, tags, experiments) {
+    const { userId, identifier, crossEnvironmentTransactionID, ...dataOut } = data;
+    const userReference = { userId, identifier, crossEnvironmentTransactionID };
+    const effectiveTags = { ...this.options.defaultTags, ...this.applicationTag(), ...tags };
+    void this.track(AuthEventName.Conversion, dataOut, userReference, effectiveTags, void 0, void 0, experiments);
+  }
+  /**
+   * Track when a flow successfully completes.
+   *
+   * @remarks
+   * Fire this when the user has finished the target flow end-to-end, such as completed login,
+   * signup, or recovery. Record identity with `setUser()` while the flow is active,
+   * or enrich it after completion through the handle returned by `flowStarted()` or by this call.
+   *
+   * The returned handle targets the flow this event finished, so identity learned only after
+   * completion — for example from a profile request that follows account creation — can be
+   * attached with `await finished.enrich({ userId })` even on a page that never saw the flow start.
+   * Enrichment requires a backend supporting explicit flow-event targeting.
+   *
+   * Legacy identity fields in `data` remain supported but are deprecated.
+   *
+   * @param data - Finished flow name, optional explicit outcome, and deprecated user reference fields.
+   * @param tags - Optional key-value tags for filtering and segmentation.
+   *
+   * @example
+   * ```typescript
+   * const finished = tracker.flowFinished({ flowName: "signup" });
+   * const userId = await hashUserId(createdAccountId);
+   * await finished.enrich({ userId });
+   * ```
+   */
+  flowFinished(data, tags, experiments) {
+    try {
+      const { userId, identifier, ...dataOut } = data;
+      const userReference = { userId, identifier };
+      const targetEventId = uuidv7();
+      const sessionId = this.sessionId;
+      void this.track(AuthEventName.FlowFinished, dataOut, userReference, tags, void 0, void 0, experiments, {
+        id: targetEventId,
+        sessionId
+      });
+      return this.flowHandle(targetEventId, sessionId);
+    } catch (error) {
+      this.logger.warn("Failed to finish flow", error);
+      return { enrich: async () => {
+      } };
+    }
+  }
+  /** Emits `flow_enriched` against an explicit target, in the session that emitted the target. */
+  flowHandle(targetEventId, sessionId) {
+    return {
+      enrich: async (user) => {
+        try {
+          await this.track(
+            AuthEventName.FlowEnriched,
+            { targetEventId },
+            { ...user },
+            void 0,
+            void 0,
+            void 0,
+            void 0,
+            { sessionId }
+          );
+        } catch (error) {
+          this.logger.warn("Failed to enrich flow", error);
+        }
+      }
+    };
+  }
+  /**
+   * Track when an in-progress flow is reset and restarted.
+   *
+   * @remarks
+   * Use this when users abandon the current path and return to the beginning of the same flow,
+   * for example after switching account/identifier and reopening the first step.
+   *
+   * @param data - Flow name being reset.
+   * @param tags - Optional key-value tags for filtering and segmentation.
+   *
+   * @example
+   * ```typescript
+   * tracker.flowReset({flowName: "login"});
+   * ```
+   */
+  flowReset(data, tags, experiments) {
+    void this.track(AuthEventName.FlowReset, data, void 0, tags, void 0, void 0, experiments);
+  }
+  /**
+   * Track when a flow is considered finished because another flow finished it implicitly.
+   *
+   * @remarks
+   * Use this for automatic completions where no separate explicit finish action happens in the
+   * current flow. Set `flowName` to the auto-finished flow and `finishedByFlowName` to the flow
+   * that caused it. Record identity with `setUser()` while the intended flow is still
+   * current, before it is auto-finished.
+   *
+   * Legacy identity fields in `data` remain supported but are deprecated.
+   *
+   * @param data - Auto-finished flow, finishing flow, and deprecated user reference fields.
+   * @param tags - Optional key-value tags for filtering and segmentation.
+   *
+   * @example
+   * ```typescript
+   * tracker.flowAutoFinished({
+   *   flowName: "signup",
+   *   finishedByFlowName: "login",
+   * });
+   * ```
+   */
+  flowAutoFinished(data, tags, experiments) {
+    const { userId, identifier, ...dataOut } = data;
+    const userReference = { userId, identifier };
+    void this.track(AuthEventName.FlowAutoFinished, dataOut, userReference, tags, void 0, void 0, experiments);
+  }
+  /**
+   * Record a newly known user reference for the current active flow.
+   *
+   * @remarks
+   * Emits one `flow_enriched` with `match: { flowType: "*", at: "during" }` and `expFol: true` in its data.
+   * Call only after the flow starts and before it finishes. The enrichment belongs
+   * to the current flow at emission time.
+   * Calling after `flowFinished()` cannot enrich that finished flow. If a parent or another
+   * flow is current then, the enrichment belongs to that flow instead.
+   * An empty reference does not clear identity. Cross-environment transaction IDs must be UUIDs;
+   * both environments must report the shared ID while their respective flows are active.
+   *
+   * @param user - User ID, identifier, and/or cross-environment transaction UUID.
+   *
+   * @example
+   * ```typescript
+   * tracker.flowStarted({ flowName: "login" });
+   * tracker.setUser({ userId: "usr_123", identifier: "max@example.com" });
+   * tracker.flowFinished({ flowName: "login" });
+   * ```
+   */
+  setUser(user) {
+    void this.track(AuthEventName.FlowEnriched, { match: { flowType: "*", at: "during" }, expFol: true }, { ...user });
+  }
+  /**
+   * Attach tags to the flow that is open right now.
+   *
+   * @remarks
+   * Emits one `flow_enriched` carrying `tags` and no user reference, with data
+   * `{ match: { flowType, at: "during" } }` plus `expCh` / `expFol` when the options set them.
+   *
+   * - The tags land on the innermost flow open at call time (of `flowType` when given; default `"*"`, any type).
+   * - `expandToChildren` (default `true`): child flows of that flow inherit the tags.
+   * - `expandToFollowing` (default `true`): later sibling flows inherit the tags until the next
+   *   sibling of the same flow type as the tagged flow.
+   * - Per key the last `setFlowTags()` value wins; it also overrides a same-key tag passed to that
+   *   flow's own tracking calls (e.g. `flowStarted()`).
+   * - Call while the target flow is open. An enrichment after the flow's last container event
+   *   (for example after `flowFinished()`) matches no flow and is dropped with a
+   *   `flow_enriched/no_matching_flow` classification warning.
+   * - Tag keys and values are case-sensitive. Entries with an empty key or a non-string value are
+   *   dropped with a warning; nothing is sent when no valid entry remains.
+   *
+   * @param tags - Key-value tags for filtering and segmentation.
+   * @param options - Target flow type and tag expansion; omitted flags default to `true`.
+   *
+   * @example
+   * ```typescript
+   * tracker.flowStarted({ flowName: "login" });
+   * tracker.setFlowTags({ entryPoint: "checkout" });
+   * tracker.flowFinished({ flowName: "login" });
+   * ```
+   */
+  setFlowTags(tags, options) {
+    try {
+      if (!tags || typeof tags !== "object") {
+        this.logger.warn("setFlowTags: ignoring non-object tags");
+        return;
+      }
+      const valid = {};
+      for (const [key, value] of Object.entries(tags)) {
+        if (key === "" || typeof value !== "string") {
+          this.logger.warn(`setFlowTags: ignoring invalid tag "${key}"`);
+          continue;
+        }
+        valid[key] = value;
+      }
+      if (Object.keys(valid).length === 0) {
+        return;
+      }
+      const data = { match: { flowType: options?.flowType ?? "*", at: "during" } };
+      if (options?.expandToChildren !== void 0) {
+        data.expCh = options.expandToChildren;
+      }
+      if (options?.expandToFollowing !== void 0) {
+        data.expFol = options.expandToFollowing;
+      }
+      void this.track(AuthEventName.FlowEnriched, data, void 0, valid);
+    } catch (error) {
+      this.logger.warn("Failed to set flow tags", error);
+    }
+  }
+  /**
+   * Track when you present authentication method choices to the user.
+   *
+   * @remarks
+   * Use this whenever a decision point is shown with a concrete method set, such as
+   * identifier entry options (`d1`) or post-identifier options (`d3`). Set
+   * `explicitDecisionValue` when the options are re-offered after a user action and you want
+   * to capture what triggered that transition.
+   *
+   * @param data - Decision identifier, offered options, and optional transition reason.
+   * @param tags - Optional key-value tags for filtering and segmentation.
+   * @param experiments - Optional per-call experiment assignments.
+   * @param options - Optional explicit event timestamp.
+   *
+   * @example
+   * ```typescript
+   * tracker.authMethodsDecisionStarted({
+   *   decisionName: "d3",
+   *   options: ["passkey", "social-google", "password", "reset-flow"],
+   * });
+   * ```
+   */
+  authMethodsDecisionStarted(data, tags, experiments, options) {
+    void this.track(
+      AuthEventName.AuthMethodDecisionStarted,
+      data,
+      void 0,
+      tags,
+      void 0,
+      options?.explicitTimestamp,
+      experiments
+    );
+  }
+  authMethodsDecisionFinished(data, tags, experiments) {
+    void this.track(AuthEventName.AuthMethodDecisionFinished, data, void 0, tags, void 0, void 0, experiments);
+  }
+  // decisions
+  /**
+   * @deprecated Use {@link CorbadoTracker.authMethodsDecisionStarted} instead (its `options`
+   * already accept free-form strings).
+   */
+  authDecisionStarted(data, tags, experiments) {
+    void this.track(AuthEventName.AuthDecisionStarted, data, void 0, tags, void 0, void 0, experiments);
+  }
+  /**
+   * @deprecated Use {@link CorbadoTracker.authMethodsDecisionFinished} instead (its `options`
+   * already accept free-form strings).
+   */
+  authDecisionFinished(data, tags, experiments) {
+    void this.track(AuthEventName.AuthDecisionFinished, data, void 0, tags, void 0, void 0, experiments);
+  }
+  /**
+   * Enqueue a "low" event (granular DOM/window/visualviewport/PWM signal) for the current session.
+   *
+   * @remarks
+   * Low events are sent in the `lows` array of the events endpoint payload, alongside any
+   * pending typed events. Blocked user agents are skipped silently.
+   *
+   * @internal
+   */
+  enqueueLowEvent(low, capturedSessionId) {
+    try {
+      if (this.isTrackingBlocked()) {
+        this.logger.debug(`Skipping low event "${low.lowType}" for blocked user agent.`);
+        return;
+      }
+      this.queue.enqueueLow(
+        {
+          ...low,
+          captureSeq: low.captureSeq ?? reserveCaptureSeq(),
+          captureVersion: 1,
+          pageId: low.pageId ?? getCapturePageId()
+        },
+        capturedSessionId
+      );
+    } catch (error) {
+      this.logger.error(`Failed to process low event "${low.lowType}" before enqueue`, error);
+    }
+  }
+  /**
+   * Record a diagnostic telemetry entry (a `level` + free-form `message`) for the current session.
+   *
+   * @remarks
+   * Telemetry is delivered in the `telemetry` array of the events endpoint payload, tied to the same
+   * session, and is never classified as an auth-flow event. By default a telemetry entry piggybacks
+   * the next normal flush (it does not trigger one on its own); this is server-controlled. Collection
+   * can be turned off server-side via the `telemetry` config flag. Blocked user agents are skipped.
+   *
+   * The message is truncated to {@link TELEMETRY_MESSAGE_MAX} characters. Never pass credentials or
+   * PII — telemetry is for diagnostics only. Like all SDK entry points, this never throws.
+   */
+  telemetry(level, message) {
+    try {
+      if (this.isTrackingBlocked()) {
+        this.logger.debug("Skipping telemetry for blocked user agent.");
+        return;
+      }
+      const text = typeof message === "string" ? message : String(message);
+      if (text.length === 0) {
+        return;
+      }
+      const entry = {
+        id: uuidv7(),
+        level,
+        message: text.length > TELEMETRY_MESSAGE_MAX ? text.slice(0, TELEMETRY_MESSAGE_MAX) : text,
+        ts: Date.now()
+      };
+      this.queue.enqueueTelemetry(entry);
+    } catch (error) {
+      this.logger.error("Failed to process telemetry before enqueue", error);
+    }
+  }
+  /**
+   * Queue a probe item (diagnostic capture produced by a Corbado autocapture bundle).
+   *
+   * @remarks
+   * The SDK fills `id` (uuidv7), `seq` (per `pageId`), `pageId` (default: one random id per tracker
+   * instance) and `ts` (default: now). Items are held in memory only (never the durable outbox) and
+   * ride the regular batches; they are the lowest priority at page unload. Invalid input is dropped.
+   * The payload must already be redacted. Blocked user agents are skipped. Never throws.
+   *
+   * @experimental Internal: used by Corbado autocapture bundles. Not part of the documented API.
+   * @internal
+   */
+  probe(input) {
+    try {
+      if (this.isTrackingBlocked()) {
+        this.logger.debug("Skipping probe for blocked user agent.");
+        return;
+      }
+      if (!input || typeof input !== "object" || typeof input.kind !== "string" || !PROBE_KIND_RE.test(input.kind)) {
+        this.logger.debug("Dropping probe with an invalid kind.");
+        return;
+      }
+      const payload = input.payload;
+      if (!payload || typeof payload !== "object") {
+        this.logger.debug(`Dropping probe "${input.kind}" without an object payload.`);
+        return;
+      }
+      const pageId = typeof input.pageId === "string" && PROBE_ID_RE.test(input.pageId) ? input.pageId : this.defaultProbePageId();
+      const entry = {
+        id: uuidv7(),
+        kind: input.kind,
+        ts: typeof input.ts === "number" && Number.isFinite(input.ts) ? Math.round(input.ts) : Date.now(),
+        pageId,
+        seq: this.nextProbeSeq(pageId),
+        payload
+      };
+      if (typeof input.cfg === "string" && PROBE_ID_RE.test(input.cfg)) {
+        entry.cfg = input.cfg;
+      }
+      const ctx = sanitizeProbeContext(input.ctx);
+      if (ctx) {
+        entry.ctx = ctx;
+      }
+      this.queue.enqueueProbe(entry);
+    } catch (error) {
+      this.logger.error("Failed to process probe before enqueue", error);
+    }
+  }
+  defaultProbePageId() {
+    return this.probePageId ??= randomProbePageId();
+  }
+  nextProbeSeq(pageId) {
+    const seq = this.probeSeqs.get(pageId) ?? 0;
+    this.probeSeqs.delete(pageId);
+    this.probeSeqs.set(pageId, seq + 1);
+    if (this.probeSeqs.size > PROBE_PAGE_IDS_MAX) {
+      const oldest = this.probeSeqs.keys().next().value;
+      if (oldest !== void 0) this.probeSeqs.delete(oldest);
+    }
+    return seq;
+  }
+  /** Convenience wrapper for {@link CorbadoTracker.telemetry} at `info` level. */
+  logInfo(message) {
+    this.telemetry("info", message);
+  }
+  /** Convenience wrapper for {@link CorbadoTracker.telemetry} at `error` level. */
+  logError(message) {
+    this.telemetry("error", message);
+  }
+  /**
+   * Queue hook run right before an event batch is sent: a device info snapshot that no event carried
+   * yet (typically the fast snapshot after a burst of events at page load, or the privateMode update)
+   * rides the first event of this page in the batch that has none. Events of other pages (outbox
+   * replays) are never touched. A snapshot no event can carry goes as the batch's request-level device
+   * info instead (queue option `standaloneDeviceInfo`).
+   *
+   * Error situations:
+   *  - Any error: log "Failed to attach device info to batch" and send the batch unchanged
+   */
+  attachUndeliveredDeviceInfo(events) {
+    try {
+      const manager = this.deviceInfoManager;
+      if (!manager?.hasUndelivered()) {
+        return;
+      }
+      const pageId = getCapturePageId();
+      const target = events.find((event) => event.meta?.pageId === pageId && !event.deviceInfo);
+      if (target) {
+        target.deviceInfo = manager.takeUndelivered();
+      }
+    } catch (error) {
+      this.logger.error("Failed to attach device info to batch", error);
+    }
+  }
+  /**
+   * Escalate an internal SDK diagnostic to the telemetry stream (self-instrumentation). This is the
+   * sink behind {@link Logger.reportTelemetry}; chosen internal failure sites route here so faults
+   * that are otherwise only visible with `debug: true` become observable in the field.
+   *
+   * @remarks
+   * Bounded and deduped per load (a persistent fault — blocked storage, a downed endpoint — cannot
+   * flood the stream), re-entrancy-guarded so it can never recurse, and it never throws into the
+   * host. Diagnostics raised before the queue exists (early boot) are buffered and replayed once the
+   * queue is ready. Messages must be stable and low-cardinality (no raw error objects / PII).
+   */
+  reportTelemetry(level, message) {
+    if (this.telemetryReporting) {
+      return;
+    }
+    this.telemetryReporting = true;
+    try {
+      if (this.reportedTelemetryKeys.has(message) || this.reportedTelemetryKeys.size >= MAX_SELF_TELEMETRY) {
+        return;
+      }
+      this.reportedTelemetryKeys.add(message);
+      if (!this.telemetryReady) {
+        this.pendingSelfTelemetry.push({ level, message });
+        return;
+      }
+      this.telemetry(level, message);
+    } catch {
+    } finally {
+      this.telemetryReporting = false;
+    }
+  }
+  /**
+   * Synchronously flush any pending events and low events via beacon. Use during page-unload
+   * style teardown where async flushing is unreliable.
+   *
+   * @param reason What triggered the flush; recorded as `meta.flushReason` on the batch. Defaults
+   * to a direct call by the host app.
+   *
+   * @internal
+   */
+  flushKeepalive(reason = "manual") {
+    try {
+      this.queue.flushKeepalive(reason);
+    } catch (error) {
+      this.logger.error("Failed to flush queue keepalive", error);
+    }
+  }
+  /**
+   * Whether input trackers run the DOM password-manager scan (`pa-1`..`pa-6` lows): only an explicitly
+   * set `fixedDataConfig.pmd` decides; without `fixedDataConfig` or with `pmd` omitted it always runs
+   * (historical behaviour).
+   *
+   * @internal
+   */
+  isPasswordManagerDomScanEnabled() {
+    return this.fixedData?.pmdExplicit ? this.fixedData.pmd : true;
+  }
+  /**
+   * Keepalive flush requested by a low-event tracker's `pagehide` teardown. Gated by the
+   * server-controlled trigger switch `tlf` (boot-snapshot, default true = historical behavior):
+   * disabling it server-side makes low-event delivery rely solely on the queue's own triggers.
+   *
+   * @internal
+   */
+  lowEventFlushKeepalive() {
+    if (!this.config.tlf) {
+      return;
+    }
+    this.flushKeepalive("low-event-teardown");
+  }
+  passkeyLoginFullOperation(config) {
+    return new PasskeyLoginOperationFull(this, config);
+  }
+  passkeyEnrollmentFullOperation(config) {
+    return new PasskeyEnrollmentOperationFull(this, config);
+  }
+  /**
+   * Track a user deleting one of their passkeys through userConfirmation and deletion.
+   *
+   * @param config - Optional configuration; the passkey-deletion subflow has no spec types.
+   * @remarks
+   * Create the operation when the user asks to delete a passkey (e.g. clicks "Remove"); construction
+   * alone is not counted as an interaction. Start userConfirmation when the confirmation dialog opens
+   * and finish it when the user confirms; report a dismissed dialog with
+   * `userConfirmation.errorTyped({ code: "cancelled" })`. Skip userConfirmation when there is no dialog.
+   * Start deletion when the delete request is sent and finish it only when the passkey was deleted;
+   * report a rejection with `deletion.errorTyped({ code })` or a thrown error with `deletion.error(error)`.
+   * Never include credential IDs or other passkey material.
+   * @example
+   * ```ts
+   * const deletion = tracker.passkeyDeletionOperationFull();
+   * deletion.userConfirmation.start({});
+   * if (!(await confirmDialog())) {
+   *   deletion.userConfirmation.errorTyped({ code: "cancelled" });
+   *   return;
+   * }
+   * deletion.userConfirmation.finished({});
+   * deletion.deletion.start({});
+   * try {
+   *   await deletePasskey(id);
+   *   deletion.deletion.finished({});
+   * } catch (error) {
+   *   deletion.deletion.error(error);
+   * }
+   * ```
+   */
+  passkeyDeletionOperationFull(config) {
+    return new PasskeyDeletionOperationFull(this, config);
+  }
+  passwordLoginFullOperation(autoTrackConfig) {
+    return new PasswordLoginOperationFull(this, autoTrackConfig);
+  }
+  passwordEnrollmentFullOperation(autoTrackConfig) {
+    return new PasswordEnrollmentOperationFull(this, autoTrackConfig);
+  }
+  emailLinkOperationFull(config) {
+    return new EmailLinkOperationFull(this, config);
+  }
+  /**
+   * Continue an email link started on another page (the link's target page). In the same browser
+   * and session it continues page 1's subflow directly; otherwise it emits a continuation start that
+   * the backend joins to page 1 through the transaction ID. See {@link EmailLinkContinuationOperation}.
+   */
+  continueEmailLinkOperation(config) {
+    return new EmailLinkContinuationOperation(this, config);
+  }
+  emailOtpOperationFull(config) {
+    return new EmailOtpOperationFull(this, config);
+  }
+  smsOtpOperationFull(config) {
+    return new SmsOtpOperationFull(this, config);
+  }
+  totpOperationFull(config) {
+    return new TotpOperationFull(this, config);
+  }
+  provideIdentifierOperationFull(config) {
+    return new OperationFullProvideIdentifierWithCUI(
+      this,
+      config
+    );
+  }
+  provideDataOperationFull(config) {
+    return new ProvideDataOperationFull(this, config);
+  }
+  formOperationFull(config) {
+    return new FormOperationFull(this, config);
+  }
+  /**
+   * Track a social login with an external provider (e.g. Google, Apple).
+   *
+   * @param config - Optional spec type and entry.
+   * @remarks
+   * Set `entry` to how the attempt began: omit it for a provider button with a full-page redirect,
+   * `"popup"` when the provider ran in a popup window, `"one-tap"` when the provider showed its own
+   * prompt (e.g. Google One Tap). A One Tap has no redirect: report only `exchangeCode`, never
+   * `getRedirectUrl`.
+   * @example
+   * ```ts
+   * // Provider button:
+   * const social = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier" });
+   * social.getRedirectUrl.start({ provider: "google" });
+   * social.getRedirectUrl.finished({});
+   * // Back from the provider, on the new page load:
+   * const back = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier" });
+   * back.exchangeCode.start({ provider: "google" });
+   * back.exchangeCode.finished({});
+   *
+   * // Google One Tap, when the credential arrives in page:
+   * const oneTap = tracker.socialLoginOperationFull({ explicitSpecType: "pre-identifier", entry: "one-tap" });
+   * oneTap.exchangeCode.start({ provider: "google" });
+   * oneTap.exchangeCode.finished({});
+   * ```
+   */
+  socialLoginOperationFull(config) {
+    return new SocialLoginOperationFull(this, config);
+  }
+  /**
+   * Track enterprise SSO (SAML/OIDC) through the organization's identity provider.
+   *
+   * @param config - Optional spec type, organization email domain and actor.
+   * @remarks
+   * Use for policy-routed SSO, kept apart from user-chosen social login. Set `actor: "system"` when
+   * the application routed to SSO without a user choice, e.g. by the email domain. Report only the
+   * organization's domain, never a full address.
+   * @example
+   * ```ts
+   * const sso = tracker.ssoLoginOperationFull({
+   *   explicitSpecType: "post-identifier",
+   *   organizationDomain: "example.com",
+   *   actor: "system",
+   * });
+   * sso.getRedirectUrl.start({});
+   * sso.getRedirectUrl.finished({});
+   * // After the identity provider redirects back:
+   * sso.exchangeCode.start({});
+   * sso.exchangeCode.finished({});
+   * ```
+   */
+  ssoLoginOperationFull(config) {
+    return new SsoLoginOperationFull(this, config);
+  }
+  appConfirmationOperationFull(config) {
+    return new AppConfirmationOperationFull(this, config);
+  }
+  /**
+   * Track direct key signing outside WebAuthn through prepare and sign.
+   *
+   * @param config - Optional configuration; explicitSpecType may only be undefined for now.
+   * @remarks
+   * Start prepare when resolving the eligible key and input for an actual attempt, not background
+   * prefetch. Although system-driven, that work is meaningful interaction for classification.
+   * Construction alone does not establish interaction. Finish sign only when the usable signed
+   * artifact is ready, including assembly. Submission is outside this operation. Report failures
+   * on the affected step using error(error). Never include key material, signatures or proofs.
+   * WebAuthn assertions continue to use passkeyLoginFullOperation.
+   * @example
+   * ```ts
+   * const signing = tracker.keySigningOperationFull();
+   * signing.prepare.start({});
+   * // Resolve an eligible key and prepare the signing input.
+   * signing.prepare.finished({});
+   * signing.sign.start({});
+   * // Sign and assemble the artifact returned to the caller.
+   * signing.sign.finished({});
+   * ```
+   */
+  keySigningOperationFull(config) {
+    return new KeySigningOperationFull(this, config);
+  }
+  /**
+   * Track establishing a key's authority through prepare and postResponse.
+   *
+   * @param config - Optional configuration; explicitSpecType may only be undefined for now.
+   * @remarks
+   * Start prepare when building an actual registration request, not background prefetch.
+   * This system-driven work is meaningful interaction; construction alone is not.
+   * postResponse covers submission and acceptance. Finish only when the key is authorized and
+   * usable, not merely when submission returns. Report rejection, transport, execution or timeout
+   * errors on the affected step using error(error). Never include key material or proofs.
+   * Credential creation and any authorizing WebAuthn assertion are separate operations.
+   * @example
+   * ```ts
+   * const registration = tracker.keyRegistrationOperationFull();
+   * registration.prepare.start({});
+   * // Build the registration request.
+   * registration.prepare.finished({});
+   * registration.postResponse.start({});
+   * // Submit and await evidence that the authority is usable.
+   * registration.postResponse.finished({});
+   * ```
+   */
+  keyRegistrationOperationFull(config) {
+    return new KeyRegistrationOperationFull(this, config);
+  }
+  captchaOperationFull(config) {
+    return new CaptchaOperationFull(this, config);
+  }
+  /**
+   * Track a device-trust check through getOptions, ceremony and postResponse.
+   *
+   * @param config - Mechanism, purpose, storage and optional trust name.
+   * @remarks
+   * Only `trusted` completes the check. Negative results (`not-trusted`, `no-eligible-local-key`,
+   * `server-key-no-local-match`) remain incomplete and may settle an early step. Key-specific
+   * results require a key mechanism; the server-specific result requires explicit evidence.
+   * Use `errorTyped({ code, error })` to retain an original diagnostic with a negative result,
+   * or `error(error)` for an unexpected failure. An accepted result may include a stable
+   * pseudonymous `bindingReference`; never send cookie values, proofs or key material.
+   * @example
+   * ```ts
+   * const check = tracker.trustedDeviceCheckOperationFull({
+   *   explicitSpecType: "key", storage: "indexeddb", purpose: "additional-verification",
+   * });
+   * check.ceremony.start({});
+   * // On a recognized local-key failure:
+   * check.ceremony.errorTyped({ code: "no_eligible_local_key", error: originalError });
+   * ```
+   */
+  trustedDeviceCheckOperationFull(config) {
+    return new TrustedDeviceCheckOperationFull(this, config);
+  }
+  /**
+   * Track device-trust enrollment through getOptions, ceremony and postResponse.
+   *
+   * @param config - Mechanism, purpose, storage and optional trust name.
+   * @remarks
+   * Report `created`, `renewed` or `unchanged` after host acceptance. Explicit opt-out is `skipped`;
+   * an unanswered operation remains incomplete. User identity uses the existing `setUser` API.
+   * Missing or unsupported purpose/storage logs a warning and is omitted; the operation remains usable.
+   * @example
+   * ```ts
+   * const enrollment = tracker.trustedDeviceEnrollmentOperationFull({
+   *   explicitSpecType: "token", storage: "cookie", purpose: "mfa-exemption",
+   * });
+   * enrollment.postResponse.start({});
+   * // After the host grants browser trust:
+   * enrollment.postResponse.finished({ result: "created", bindingReference });
+   * ```
+   */
+  trustedDeviceEnrollmentOperationFull(config) {
+    return new TrustedDeviceEnrollmentOperationFull(this, config);
+  }
+  /**
+   * Flush any pending events and release all resources (timers, event listeners).
+   *
+   * @remarks
+   * After calling destroy, the tracker must not be used. Operation objects
+   * returned by factory methods (e.g. `passwordLoginFullOperation`) that hold
+   * DOM references must be destroyed separately by the caller.
+   * The final flush is gated by the server-controlled trigger switch `td` (default true);
+   * resources are released either way.
+   */
+  async destroy() {
+    this.configManager?.destroy();
+    this.passwordManagerSampler?.destroy();
+    this.windowObserver?.destroy();
+    this.deviceInfoManager.destroy();
+    if (this.config.td) {
+      try {
+        await this.queue.flush("destroy");
+      } catch (error) {
+        this.logger.error("Failed to flush queue during destroy", error);
+      }
+    }
+    this.queue.destroy();
+  }
+  // Session Management
+  /**
+   * Return the Observe session id this tracker is currently reporting under.
+   *
+   * @remarks
+   * Use this to route a server-side event into the same session the browser reports to: read the id,
+   * pass it to your own backend, and let the backend use it as the `sessionID` of its ingest call.
+   * Reading it here is the supported path — the storage layout behind it is an implementation detail
+   * that has already changed once (per-tab `sessionStorage` to the cross-tab continuity record).
+   *
+   * The value is **not stable for the lifetime of the page**. It changes on
+   * {@link CorbadoTracker.resetSession}, when this tab adopts a continuity session another tab
+   * rotated to, and when a failed bootstrap recovers. Read it at the moment you need it; never cache
+   * it across a request.
+   *
+   * `undefined` means no session id could be established at all — an environment without Web Crypto,
+   * where tracking is not working either. Skip the server-side event instead of sending an empty id:
+   * the ingest API requires a UUID and would reject the batch.
+   *
+   * @returns The current session id, or `undefined` if none could be established.
+   *
+   * @example
+   * ```typescript
+   * const sessionId = tracker.getSessionId();
+   * if (sessionId) {
+   *   await fetch("/api/checkout", {
+   *     method: "POST",
+   *     body: JSON.stringify({ ...payload, observeSessionId: sessionId }),
+   *   });
+   * }
+   * ```
+   */
+  getSessionId() {
+    if (!this.sessionId) {
+      const recovered = this.resolveSessionId();
+      if (recovered) {
+        this.sessionId = recovered;
+        this.queue.setSessionId(recovered);
+      }
+    }
+    return this.sessionId || void 0;
+  }
+  /** @internal */
+  resetSession() {
+    const newSessionId = uuidv7();
+    if (this.config.sessionContinuity) {
+      this.persistContinuitySession(newSessionId, Date.now());
+      this.persistentStorage.setItem(SEQ_STORAGE_KEY, 0);
+    } else {
+      this.persistPerTabSession(newSessionId, Date.now());
+    }
+    this.sessionId = newSessionId;
+    this.seq = 0;
+    this.queue.setSessionId(newSessionId);
+    this.logger.debug(`Session reset: ${newSessionId}`);
+    return newSessionId;
+  }
+};
+var PROBE_PAGE_ID_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-";
+function randomProbePageId() {
+  const bytes = new Uint8Array(16);
+  try {
+    crypto.getRandomValues(bytes);
+  } catch {
+    for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
+  }
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) out += PROBE_PAGE_ID_ALPHABET[bytes[i] & 63];
+  return out;
+}
+function sanitizeProbeContext(ctx) {
+  if (!ctx || typeof ctx !== "object") return void 0;
+  const out = {};
+  for (const key of ["state", "flowType", "step"]) {
+    const value = ctx[key];
+    if (typeof value === "string" && value.length > 0) out[key] = value.slice(0, PROBE_CTX_MAX);
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+export {
+  CorbadoTracker
+};