@corbado/observe 1.7.2 → 1.9.0

package/dist/analysis/index.mjs

@@ -0,0 +1,118 @@
+// src/index.ts
+import { CorbadoTracker } from "./client.mjs";
+import { SDK_NAME, SDK_VERSION } from "./version.mjs";
+export * from "./types.mjs";
+export * from "./client.mjs";
+export * from "./transport.mjs";
+export * from "./queue.mjs";
+export * from "./config.mjs";
+export * from "./store/event-store.mjs";
+export * from "./storage/index.mjs";
+export * from "./logger.mjs";
+export * from "./utils/operation-full.mjs";
+export * from "./utils/key-operation-full.mjs";
+export * from "./utils/serialize-raw-error.mjs";
+export * from "./utils/trusted-device-operation-full.mjs";
+export * from "./utils/operation-full-provide-identifier-with-cui.mjs";
+export * from "./utils/provide-data-operation-full.mjs";
+export * from "./utils/form-operation-full.mjs";
+export * from "./utils/passkey-login-operation-full.mjs";
+export * from "./utils/email-otp-operation-full.mjs";
+export * from "./utils/sms-otp-operation-full.mjs";
+export * from "./utils/totp-operation-full.mjs";
+export * from "./utils/email-link-operation-full.mjs";
+export * from "./utils/social-operation-login.mjs";
+export * from "./utils/sso-operation-login.mjs";
+export * from "./utils/passkey-enrollment-operation-full.mjs";
+export * from "./utils/passkey-deletion-operation-full.mjs";
+export * from "./utils/password-login-operation-full.mjs";
+export * from "./utils/password-enrollment-operation-full.mjs";
+export * from "./utils/appconfirmation-operation-full.mjs";
+export * from "./utils/captcha-operation-full.mjs";
+import {
+  detectPasswordManagerExtensions
+} from "./readers/password-manager-extensions.mjs";
+import {
+  READER_EXPOSURES
+} from "./readers/meta.mjs";
+import {
+  sanitizeCreationOptions,
+  sanitizeCreationResponse,
+  sanitizeRequestOptions,
+  sanitizeAssertionResponse
+} from "./utils/webauthn-payloads.mjs";
+var currentTracker;
+function init(options) {
+  const tracker = new CorbadoTracker(options);
+  currentTracker = tracker;
+  return tracker;
+}
+function getTracker() {
+  return currentTracker;
+}
+function resetSession() {
+  return currentTracker?.resetSession();
+}
+function getSessionId() {
+  return currentTracker?.getSessionId();
+}
+function setUser(user) {
+  currentTracker?.setUser(user);
+}
+function setFlowTags(tags, options) {
+  currentTracker?.setFlowTags(tags, options);
+}
+function setExperiment(key, variant) {
+  currentTracker?.setExperiment(key, variant);
+}
+function setExperiments(assignments) {
+  currentTracker?.setExperiments(assignments);
+}
+function clearExperiment(key) {
+  currentTracker?.clearExperiment(key);
+}
+function clearExperiments() {
+  currentTracker?.clearExperiments();
+}
+function getExperiments() {
+  return currentTracker?.getExperiments() ?? {};
+}
+function telemetry(level, message) {
+  currentTracker?.telemetry(level, message);
+}
+function logInfo(message) {
+  currentTracker?.logInfo(message);
+}
+function logError(message) {
+  currentTracker?.logError(message);
+}
+async function destroy() {
+  if (!currentTracker) return;
+  await currentTracker.destroy();
+  currentTracker = void 0;
+}
+export {
+  READER_EXPOSURES,
+  SDK_NAME,
+  SDK_VERSION,
+  clearExperiment,
+  clearExperiments,
+  destroy,
+  detectPasswordManagerExtensions,
+  getExperiments,
+  getSessionId,
+  getTracker,
+  init,
+  logError,
+  logInfo,
+  resetSession,
+  sanitizeAssertionResponse,
+  sanitizeCreationOptions,
+  sanitizeCreationResponse,
+  sanitizeRequestOptions,
+  setExperiment,
+  setExperiments,
+  setFlowTags,
+  setUser,
+  telemetry
+};

package/dist/analysis/logger.mjs

@@ -0,0 +1,50 @@
+// src/logger.ts
+function createLogger(options) {
+  const debugEnabled = options.debug;
+  let telemetrySink;
+  const withPrefix = (level, message) => `[Corbado Observe SDK ${level}] ${message}`;
+  return {
+    reportTelemetry(level, message) {
+      if (!telemetrySink) {
+        return;
+      }
+      try {
+        telemetrySink(level, message);
+      } catch {
+      }
+    },
+    setTelemetrySink(sink) {
+      telemetrySink = sink;
+    },
+    debug(message, ...args) {
+      if (!debugEnabled) {
+        return;
+      }
+      console.log(withPrefix("DEBUG", message), ...args);
+    },
+    info(message, ...args) {
+      if (!debugEnabled) {
+        return;
+      }
+      console.log(withPrefix("INFO", message), ...args);
+    },
+    warn(message, ...args) {
+      if (!debugEnabled) {
+        return;
+      }
+      console.warn(withPrefix("WARN", message), ...args);
+    },
+    error(message, ...args) {
+      if (!debugEnabled) {
+        return;
+      }
+      console.error(withPrefix("ERROR", message), ...args);
+    },
+    critical(message, ...args) {
+      console.error(withPrefix("CRITICAL", message), ...args);
+    }
+  };
+}
+export {
+  createLogger
+};

package/dist/analysis/low-events/capture-sequence.mjs

@@ -0,0 +1,11 @@
+// src/low-events/capture-sequence.ts
+var captureSequence = 0;
+function reserveCaptureSeq() {
+  if (captureSequence === 4294967295) {
+    throw new Error("Low-event capture sequence exhausted");
+  }
+  return ++captureSequence;
+}
+export {
+  reserveCaptureSeq
+};

package/dist/analysis/low-events/ceremony-initiator.mjs

@@ -0,0 +1,26 @@
+// src/low-events/ceremony-initiator.ts
+function inferCeremonyInitiator(operation, spec) {
+  if (operation === "passkey-login") {
+    switch (spec) {
+      case "passkey-known-identifier":
+      case "passkey-no-identifier":
+        return "passkey-button";
+      case "passkey-known-identifier-auto":
+      case "passkey-no-identifier-auto":
+      case "passkey-immediate":
+        return "automatic";
+    }
+  } else if (operation === "passkey-enrollment") {
+    switch (spec) {
+      case "manual":
+        return "passkey-button";
+      case "auto":
+      case "conditional":
+        return "automatic";
+    }
+  }
+  return void 0;
+}
+export {
+  inferCeremonyInitiator
+};

package/dist/analysis/low-events/form-input-binding.mjs

@@ -0,0 +1,46 @@
+// src/low-events/form-input-binding.ts
+import { LowEventInputTracker } from "./input-tracker.mjs";
+var FormInputBinding = class {
+  constructor(logger, sink) {
+    this.logger = logger;
+    this.sink = sink;
+  }
+  trackers = /* @__PURE__ */ new Map();
+  destroyed = false;
+  /** Bind exactly these fields; an empty list detaches every field. */
+  setFields(fields) {
+    if (this.destroyed) return;
+    const next = new Set(fields);
+    for (const [field, tracker] of this.trackers) {
+      if (next.has(field)) continue;
+      this.safe(() => tracker.destroy());
+      this.trackers.delete(field);
+    }
+    for (const field of next) {
+      if (this.trackers.has(field)) continue;
+      this.safe(() => this.trackers.set(field, new LowEventInputTracker(this.logger, field, this.sink())));
+    }
+  }
+  capturePrefill(newCapture = false) {
+    for (const tracker of this.trackers.values()) this.safe(() => tracker.capturePrefill(newCapture));
+  }
+  flushPending() {
+    for (const tracker of this.trackers.values()) this.safe(() => tracker.flushPending());
+  }
+  destroy() {
+    if (this.destroyed) return;
+    this.destroyed = true;
+    for (const tracker of this.trackers.values()) this.safe(() => tracker.destroy());
+    this.trackers.clear();
+  }
+  safe(run) {
+    try {
+      run();
+    } catch (error) {
+      this.logger.error("Form input binding failed", error);
+    }
+  }
+};
+export {
+  FormInputBinding
+};

package/dist/analysis/low-events/grouped-input-tracker.mjs

@@ -0,0 +1,248 @@
+// src/low-events/grouped-input-tracker.ts
+import { InputChangeRecorder } from "./input-change-recorder.mjs";
+import { InputPasteObserver } from "../readers/input-paste.mjs";
+import { observeInputField, readFocusedField, readInputGroupValueLength } from "../readers/input.mjs";
+import { listenWindow } from "../readers/page.mjs";
+var LowEventGroupedInputTracker = class {
+  constructor(logger, fields, sink) {
+    this.logger = logger;
+    this.sink = sink;
+    this.inputs = [...new Set(fields)];
+    this.changes = new InputChangeRecorder(
+      this.length(),
+      (low) => sink.enqueueLowEvent(low),
+      logger,
+      sink.reserveCaptureSeq
+    );
+    this.paste = new InputPasteObserver(
+      {
+        key: "dom:input.paste",
+        title: "Paste into tracked input fields",
+        accessNote: "paste events on the input elements the integration passes to Observe; pasted values never leave the reader",
+        group: "Input interaction",
+        origin: "observe-external",
+        fields: [
+          {
+            path: "event.paste",
+            label: "Paste into the field",
+            exposure: "presence",
+            transform: { note: "trusted paste events only" }
+          },
+          {
+            path: "value",
+            label: "Length of the pasted text",
+            exposure: "size",
+            transform: { note: "inserted length only; values are compared in memory and discarded" }
+          }
+        ]
+      },
+      this.inputs,
+      logger,
+      (ts, _inserted, captureSeq) => {
+        this.cancelChange();
+        this.changes.flush();
+        this.changes.markInputObserved();
+        const oldLength = this.changes.previousLength;
+        this.changes.previousLength = this.length();
+        sink.enqueueLowEvent({
+          ...captureSeq === void 0 ? {} : { captureSeq },
+          lowType: "input-paste",
+          ts,
+          inputEffect: this.length() === 0 ? "clear" : oldLength === 0 ? "fill" : "modify"
+        });
+      },
+      sink.reserveCaptureSeq
+    );
+    this.unregisterInputs = sink.registerInputs?.(this.inputs, () => this.flushPending());
+    this.capturePrefill();
+    const guard = (_name, run) => this.safe(run);
+    for (const input of this.inputs) {
+      this.listeners.push(
+        observeInputField(
+          {
+            key: "dom:input.events",
+            title: "Interaction with tracked input fields",
+            accessNote: "focus, blur, pointerdown, pointerup, click, input and keyup events on the input elements the integration passes to Observe, reduced to booleans and identities",
+            group: "Input interaction",
+            origin: "observe-external",
+            fields: [
+              { path: "event.focus", label: "Field selected", exposure: "presence" },
+              {
+                path: "event.focus.relatedTarget",
+                label: "Whether focus moved between fields of the same group",
+                exposure: "computed",
+                transform: { note: "only whether focus moves within the group" }
+              },
+              { path: "event.blur", label: "Field left", exposure: "presence" },
+              { path: "event.pointerdown", label: "Pointer pressed on the field", exposure: "presence" },
+              { path: "event.pointerup", label: "Pointer released on the field", exposure: "presence" },
+              { path: "event.click", label: "Click on the field", exposure: "presence" },
+              { path: "event.input", label: "Typing in the field", exposure: "presence" },
+              {
+                path: "event.input.isComposing",
+                label: "Whether text is being composed with an input method",
+                exposure: "enum",
+                transform: { values: [true, false] }
+              },
+              {
+                path: "event.keyup.key",
+                label: "Escape key pressed",
+                exposure: "enum",
+                transform: { values: ["Escape", "other"] }
+              }
+            ]
+          },
+          input,
+          {
+            input: (composing, event) => {
+              if (this.paste.handlesInput(event)) return;
+              this.composing ||= composing;
+              if (this.changeTimer !== null) return;
+              this.changeTime = Date.now();
+              this.changeSeq = sink.reserveCaptureSeq?.();
+              this.changeTimer = setTimeout(() => this.safe(() => this.flushChanges()), 0);
+            },
+            focus: (relatedTarget) => {
+              if (this.contains(relatedTarget)) return;
+              this.emit("focus");
+            },
+            blur: (relatedTarget) => {
+              if (this.contains(relatedTarget)) return;
+              this.flushPending();
+              this.emit("blur");
+            },
+            click: () => this.emit("click"),
+            pointerdown: () => this.emit("pointerdown"),
+            pointerup: () => this.emit("pointerup"),
+            keyupEscape: () => this.emit("keyup-escape")
+          },
+          guard,
+          ["input", "focus", "blur", "click", "pointerdown", "pointerup", "keyup"]
+        )
+      );
+    }
+    if (typeof window !== "undefined")
+      this.listeners.push(
+        listenWindow(
+          {
+            key: "page:lifecycle.pagehide",
+            title: "Leaving the page",
+            accessNote: "pagehide event on window",
+            group: "Page lifecycle",
+            origin: "observe-external",
+            fields: [
+              {
+                path: "event.pagehide",
+                label: "Leaving the page",
+                exposure: "presence",
+                transform: { note: "flushes pending input low events on unload" }
+              }
+            ]
+          },
+          "pagehide",
+          (_event) => this.safe(() => {
+            this.flushPending();
+            sink.flushKeepalive();
+          })
+        )
+      );
+    if (typeof document !== "undefined" && readFocusedField(
+      {
+        key: "dom:input.focused",
+        title: "Whether a tracked input field has focus",
+        accessNote: "document.activeElement compared with the passed input elements",
+        group: "Input interaction",
+        origin: "observe-external",
+        fields: [
+          {
+            path: "focused",
+            label: "Whether the field is selected",
+            exposure: "enum",
+            transform: { values: [true, false] }
+          }
+        ]
+      },
+      this.inputs
+    )) {
+      this.emit("focus");
+    }
+  }
+  inputs;
+  changes;
+  paste;
+  unregisterInputs;
+  listeners = [];
+  changeTimer = null;
+  changeTime = 0;
+  changeSeq;
+  composing = false;
+  destroyed = false;
+  contains(target) {
+    return this.inputs.some((field) => field === target);
+  }
+  length() {
+    return readInputGroupValueLength(
+      {
+        key: "dom:input.content",
+        title: "Length of the text in tracked input fields",
+        accessNote: "input value length only; the value itself does not leave the reader",
+        group: "Input interaction",
+        origin: "observe-external",
+        fields: [
+          {
+            path: "value.length",
+            label: "Length of the entered text",
+            exposure: "size",
+            transform: { note: "summed over the fields of a group" }
+          }
+        ]
+      },
+      this.inputs
+    );
+  }
+  safe(action) {
+    try {
+      action();
+    } catch (error) {
+      this.logger.error("Failed to observe grouped input", error);
+    }
+  }
+  cancelChange() {
+    if (this.changeTimer !== null) clearTimeout(this.changeTimer);
+    this.changeTimer = null;
+  }
+  flushChanges() {
+    if (this.changeTimer === null) return;
+    this.cancelChange();
+    if (!this.paste.pending) this.changes.record(this.length(), this.changeTime, this.composing, this.changeSeq);
+    this.composing = false;
+  }
+  emit(lowType) {
+    this.flushChanges();
+    this.changes.flush();
+    this.sink.enqueueLowEvent({ lowType, ts: Date.now() });
+  }
+  capturePrefill(newCapture = false) {
+    if (this.destroyed) return;
+    this.flushPending();
+    this.changes.capturePrefill(this.length(), newCapture);
+  }
+  flushPending() {
+    this.paste.flush();
+    this.flushChanges();
+    this.changes.flush();
+  }
+  destroy() {
+    if (this.destroyed) return;
+    this.destroyed = true;
+    this.safe(() => {
+      this.flushPending();
+      this.paste.destroy();
+      this.unregisterInputs?.();
+      for (const remove of this.listeners) remove();
+    });
+  }
+};
+export {
+  LowEventGroupedInputTracker
+};

package/dist/analysis/low-events/input-change-recorder.mjs

@@ -0,0 +1,200 @@
+// src/low-events/input-change-recorder.ts
+var INPUT_IDLE_MS = 3e3;
+var BIG_INPUT_DELTA_THRESHOLD = 3;
+var AUTOFILL_STREAK_LENGTH = 5;
+var AUTOFILL_FAST_INTERVAL_MS = 80;
+var AUTOFILL_UNIFORM_SPREAD_MS = 25;
+var InputChangeRecorder = class {
+  constructor(previousLength, pushLow, logger, reserveCaptureSeq) {
+    this.previousLength = previousLength;
+    this.pushLow = pushLow;
+    this.logger = logger;
+    this.reserveCaptureSeq = reserveCaptureSeq;
+  }
+  prefillSettled = false;
+  inputBatch = null;
+  currentEffect = "modify";
+  ringEffect = "modify";
+  autofillTimestamps = [];
+  autofillStreak = null;
+  idleTimer = null;
+  markInputObserved() {
+    this.prefillSettled = true;
+  }
+  capturePrefill(length, newCapture = false) {
+    if (newCapture) this.prefillSettled = false;
+    if (this.prefillSettled) return;
+    this.previousLength = length;
+    if (length === 0) return;
+    this.prefillSettled = true;
+    this.pushLow({ lowType: "input-prefill", ts: Date.now(), initiator: "unknown" });
+  }
+  flush() {
+    this.cancelIdle();
+    this.flushInputBatch();
+    this.flushAutofillStreak();
+  }
+  cancelIdle() {
+    if (this.idleTimer !== null) clearTimeout(this.idleTimer);
+    this.idleTimer = null;
+  }
+  scheduleIdle() {
+    this.cancelIdle();
+    this.idleTimer = setTimeout(() => {
+      this.idleTimer = null;
+      try {
+        this.flushInputBatch(true);
+        this.flushAutofillStreak();
+      } catch (error) {
+        this.logger.error("Failed to flush idle input", error);
+      }
+    }, INPUT_IDLE_MS);
+  }
+  extendInputBatch(timestamp, effect = this.currentEffect, captureSeq) {
+    const batch = this.inputBatch;
+    if (!batch) {
+      this.inputBatch = { firstTimestamp: timestamp, lastTimestamp: timestamp, effect, captureSeq };
+      return;
+    }
+    batch.lastTimestamp = timestamp;
+  }
+  drainAutofillRingToBatch() {
+    for (const ts of this.autofillTimestamps) {
+      this.extendInputBatch(ts.ts, this.ringEffect, ts.captureSeq);
+    }
+    this.autofillTimestamps.length = 0;
+  }
+  flushInputBatch(idle = false) {
+    this.drainAutofillRingToBatch();
+    const batch = this.inputBatch;
+    if (!batch) {
+      return;
+    }
+    this.pushLow({
+      ...batch.captureSeq === void 0 ? {} : { captureSeq: batch.captureSeq },
+      lowType: idle ? "input-idle" : "input",
+      ts: batch.firstTimestamp,
+      durationMs: batch.lastTimestamp - batch.firstTimestamp,
+      inputEffect: batch.effect
+    });
+    this.inputBatch = null;
+  }
+  flushAutofillStreak() {
+    const streak = this.autofillStreak;
+    if (!streak) {
+      return;
+    }
+    this.pushLow({
+      ...streak.captureSeq === void 0 ? {} : { captureSeq: streak.captureSeq },
+      lowType: "big-input-add",
+      ts: streak.firstTimestamp,
+      durationMs: streak.lastTimestamp - streak.firstTimestamp,
+      inputEffect: streak.effect
+    });
+    this.autofillStreak = null;
+  }
+  detectAutofillStreak() {
+    const ring = this.autofillTimestamps;
+    if (ring.length < AUTOFILL_STREAK_LENGTH) {
+      return false;
+    }
+    let minInterval = Infinity;
+    let maxInterval = -Infinity;
+    for (let i = 1; i < ring.length; i++) {
+      const interval = ring[i].ts - ring[i - 1].ts;
+      if (interval > AUTOFILL_FAST_INTERVAL_MS) {
+        return false;
+      }
+      if (interval < minInterval) {
+        minInterval = interval;
+      }
+      if (interval > maxInterval) {
+        maxInterval = interval;
+      }
+    }
+    return maxInterval - minInterval <= AUTOFILL_UNIFORM_SPREAD_MS;
+  }
+  record(newLength, timestamp = Date.now(), composing = false, captureSeq = this.reserveCaptureSeq?.()) {
+    this.markInputObserved();
+    this.scheduleIdle();
+    const oldLength = this.previousLength;
+    this.currentEffect = newLength === 0 ? "clear" : oldLength === 0 ? "fill" : "modify";
+    const delta = newLength - oldLength;
+    this.previousLength = newLength;
+    if (newLength === 0 && oldLength > 0) {
+      this.flush();
+      this.pushLow({
+        ...captureSeq === void 0 ? {} : { captureSeq },
+        lowType: "input-clear",
+        ts: timestamp,
+        inputEffect: "clear"
+      });
+      return;
+    }
+    if (composing) {
+      this.flushAutofillStreak();
+      this.drainAutofillRingToBatch();
+      this.extendInputBatch(timestamp, this.currentEffect, captureSeq);
+      return;
+    }
+    if (delta >= BIG_INPUT_DELTA_THRESHOLD) {
+      this.flushInputBatch();
+      this.flushAutofillStreak();
+      this.pushLow({
+        ...captureSeq === void 0 ? {} : { captureSeq },
+        lowType: "big-input-add",
+        ts: timestamp,
+        inputEffect: this.currentEffect
+      });
+      return;
+    }
+    if (delta <= -BIG_INPUT_DELTA_THRESHOLD) {
+      this.flushInputBatch();
+      this.flushAutofillStreak();
+      this.pushLow({
+        ...captureSeq === void 0 ? {} : { captureSeq },
+        lowType: "big-input-rem",
+        ts: timestamp,
+        inputEffect: this.currentEffect
+      });
+      return;
+    }
+    const activeStreak = this.autofillStreak;
+    if (activeStreak) {
+      if (delta === 1 && timestamp - activeStreak.lastTimestamp <= AUTOFILL_FAST_INTERVAL_MS) {
+        activeStreak.lastTimestamp = timestamp;
+        return;
+      }
+      this.flushAutofillStreak();
+    }
+    if (delta !== 1) {
+      this.drainAutofillRingToBatch();
+      this.extendInputBatch(timestamp, this.currentEffect, captureSeq);
+      return;
+    }
+    const ring = this.autofillTimestamps;
+    if (ring.length === 0) this.ringEffect = this.currentEffect;
+    ring.push({ ts: timestamp, captureSeq });
+    if (ring.length > AUTOFILL_STREAK_LENGTH) {
+      const graduated = ring.shift();
+      this.extendInputBatch(graduated.ts, this.ringEffect, graduated.captureSeq);
+      this.ringEffect = "modify";
+    }
+    if (!this.detectAutofillStreak()) {
+      return;
+    }
+    const streakStart = ring[0];
+    const streakLast = ring[ring.length - 1];
+    ring.length = 0;
+    this.flushInputBatch();
+    this.autofillStreak = {
+      firstTimestamp: streakStart.ts,
+      captureSeq: streakStart.captureSeq,
+      lastTimestamp: streakLast.ts,
+      effect: this.ringEffect
+    };
+  }
+};
+export {
+  InputChangeRecorder
+};