@corbado/observe 1.9.1 → 1.10.0

package/dist/analysis/client.mjs

@@ -62,6 +62,7 @@ import {
 } from "./utils/trusted-device-operation-full.mjs";
 import { ProvideDataOperationFull } from "./utils/provide-data-operation-full.mjs";
 import { PasswordManagerSampler } from "./utils/password-manager-sampler.mjs";
+import { CrossOriginSession, isValidCrossOriginContext } from "./cross-origin-session.mjs";
 var SDK_INFO = {
   name: SDK_NAME,
   version: SDK_VERSION
@@ -161,7 +162,8 @@ var CorbadoTracker = class _CorbadoTracker {
       logger: this.logger,
       url
     });
-    this.sessionId = this.resolveSessionId();
+    this.crossOrigin = this.createCrossOriginSession();
+    this.sessionId = this.resolveSession();
     this.queue = new RequestQueue(
       this.logger,
       transport,
@@ -173,6 +175,7 @@ var CorbadoTracker = class _CorbadoTracker {
         requestConfig: false,
         outboxLockName: namespacedKey(OUTBOX_LOCK_NAME, namespace),
         getDataPolicy: () => this.dataPolicy,
+        getCrossOriginSession: (sessionId) => this.crossOriginSessionMeta(sessionId),
         fixedData: this.fixedData !== void 0 || typeof __CBO_DATA_PMD__ === "boolean" || typeof __CBO_DATA_PRIVATE_MODE__ === "boolean",
         beforeEventBatchSend: (events) => this.attachUndeliveredDeviceInfo(events),
         // The queue is created before the device info manager; both are only called once it exists.
@@ -290,6 +293,10 @@ var CorbadoTracker = class _CorbadoTracker {
   probeSeqs = /* @__PURE__ */ new Map();
   windowObserver;
   passwordManagerSampler;
+  /** Cross-origin session cookie (`fixedDataConfig.crossOriginSession`); undefined when off. */
+  crossOrigin;
+  /** The session this load took from the cross-origin cookie, if any (`meta.crossOriginSession`). */
+  crossOriginAdoptedId;
   /** @internal Shared passive page observation and per-operation context registration. */
   getWindowObserver() {
     return this.windowObserver ??= new SharedWindowObserver(
@@ -526,6 +533,108 @@ var CorbadoTracker = class _CorbadoTracker {
       })
     );
   }
+  /** The cross-origin session cookie when `fixedDataConfig.crossOriginSession` is set and usable here. */
+  createCrossOriginSession() {
+    const option = this.fixedData?.crossOriginSession;
+    if (!option) {
+      return void 0;
+    }
+    try {
+      if (this.isTrackingBlocked()) {
+        return void 0;
+      }
+      return CrossOriginSession.create({
+        projectId: this.options.projectId,
+        cookieDomain: option.cookieDomain,
+        logger: this.logger,
+        inactivityMs: () => this.config.sessionInactivityMs,
+        report: (level, message) => this.reportTelemetry(level, message)
+      });
+    } catch (error) {
+      this.logger.error("Failed to set up the cross-origin session", error);
+      return void 0;
+    }
+  }
+  /**
+   * Last activity of the local session records BEFORE this load rewrites them (both paths, by id), so the
+   * cross-origin boot can tell a session that was active here from one this load just created.
+   */
+  readLocalSessionActivity() {
+    const activity = /* @__PURE__ */ new Map();
+    try {
+      const continuity = this.persistentStorage.getItem(SESSION_CONTINUITY_KEY);
+      if (continuity?.id && typeof continuity.lastActiveAt === "number") {
+        activity.set(continuity.id, continuity.lastActiveAt);
+      }
+      const perTab = this.sessionStorage.getItem(SESSION_STORAGE_KEY);
+      if (perTab && typeof perTab === "object" && perTab.id && typeof perTab.lastActiveAt === "number") {
+        activity.set(perTab.id, Math.max(activity.get(perTab.id) ?? 0, perTab.lastActiveAt));
+      }
+    } catch (error) {
+      this.logger.error("Failed to read local session activity", error);
+    }
+    return activity;
+  }
+  /**
+   * Reconcile the session this load resolved locally with the cross-origin cookie before the first event:
+   * adopt the cookie's session (and persist it locally, so reloads and same-origin tabs follow) or keep
+   * the local one, and continue the seq at or above the cookie's mark. Never throws.
+   */
+  bootCrossOriginSession(localActivity) {
+    try {
+      this.crossOriginAdoptedId = void 0;
+      const now = Date.now();
+      const continuity = this.config.sessionContinuity;
+      const localSeq = continuity ? Math.max(this.seq, this.persistentStorage.getItem(SEQ_STORAGE_KEY) ?? 0) : this.seq;
+      const result = this.crossOrigin?.boot(
+        {
+          sessionId: this.sessionId,
+          lastActiveAt: this.sessionId && localActivity.get(this.sessionId) || 0,
+          seq: localSeq
+        },
+        now
+      );
+      if (!result || !result.sessionId) {
+        return;
+      }
+      if (result.adopted) {
+        this.sessionId = result.sessionId;
+        this.crossOriginAdoptedId = result.sessionId;
+        if (continuity) {
+          this.persistContinuitySession(result.sessionId, now);
+        } else {
+          this.persistPerTabSession(result.sessionId, now);
+        }
+        this.logger.debug("Adopted cross-origin session id", result.sessionId);
+      }
+      this.seq = result.seq;
+      if (continuity) {
+        this.persistentStorage.setItem(SEQ_STORAGE_KEY, result.seq);
+      }
+    } catch (error) {
+      this.logger.error("Failed to apply the cross-origin session", error);
+    }
+  }
+  /**
+   * Resolve the session of this load: locally ({@link resolveSessionId}), then reconciled with the
+   * cross-origin cookie when that option is on. Used at boot and by the recovery in `getSessionId`.
+   */
+  resolveSession() {
+    if (!this.crossOrigin) {
+      return this.resolveSessionId();
+    }
+    const localActivity = this.readLocalSessionActivity();
+    this.sessionId = this.resolveSessionId();
+    this.bootCrossOriginSession(localActivity);
+    return this.sessionId;
+  }
+  /** `meta.crossOriginSession` of a batch of `sessionId`; undefined while the option is off on this page. */
+  crossOriginSessionMeta(sessionId) {
+    if (!this.crossOrigin?.isEnabled()) {
+      return void 0;
+    }
+    return sessionId && sessionId === this.crossOriginAdoptedId ? "adopted" : "own";
+  }
   resolveSessionId() {
     try {
       if (this.config.sessionContinuity) {
@@ -659,7 +768,9 @@ var CorbadoTracker = class _CorbadoTracker {
       if (this.sessionId && now - this.lastActivityWriteAt >= SESSION_ACTIVITY_WRITE_INTERVAL_MS) {
         this.persistPerTabSession(this.sessionId, now);
       }
-      return this.seq++;
+      const current = this.crossOrigin ? this.crossOrigin.claim(this.sessionId, this.seq, now) : this.seq;
+      this.seq = current + 1;
+      return current;
     }
     const allocate = () => {
       const now = Date.now();
@@ -689,7 +800,10 @@ var CorbadoTracker = class _CorbadoTracker {
       if (sessionChanged) {
         this.seq = typeof stored === "number" ? stored : 0;
       }
-      const current = typeof stored === "number" && stored > this.seq ? stored : this.seq;
+      let current = typeof stored === "number" && stored > this.seq ? stored : this.seq;
+      if (this.crossOrigin) {
+        current = this.crossOrigin.claim(this.sessionId, current, now);
+      }
       this.seq = current + 1;
       this.persistentStorage.setItem(SEQ_STORAGE_KEY, this.seq);
       return current;
@@ -1780,6 +1894,7 @@ var CorbadoTracker = class _CorbadoTracker {
    * resources are released either way.
    */
   async destroy() {
+    this.crossOrigin?.stop();
     this.configManager?.destroy();
     this.passwordManagerSampler?.destroy();
     this.windowObserver?.destroy();
@@ -1827,7 +1942,7 @@ var CorbadoTracker = class _CorbadoTracker {
    */
   getSessionId() {
     if (!this.sessionId) {
-      const recovered = this.resolveSessionId();
+      const recovered = this.resolveSession();
       if (recovered) {
         this.sessionId = recovered;
         this.queue.setSessionId(recovered);
@@ -1835,6 +1950,69 @@ var CorbadoTracker = class _CorbadoTracker {
     }
     return this.sessionId || void 0;
   }
+  /**
+   * Store an opaque context string with the cross-origin session, for the integration's own use on the
+   * next origin (e.g. a journey id and stage). Requires `fixedDataConfig.crossOriginSession`.
+   *
+   * @remarks
+   * The value travels in the shared cookie only (see {@link CrossOriginSessionConfig}): it is never sent
+   * to Corbado, but the browser sends the cookie with every request to every subdomain of the configured
+   * domain. It belongs to the current session: a tracker that adopts the session reads it with
+   * {@link CorbadoTracker.getCrossOriginContext}, and a new session (inactivity, `resetSession`) starts
+   * without it. At most 128 characters of `A-Z a-z 0-9 . _ ~ -`; never put personal data in it.
+   * `null`, `undefined` or `""` clears it.
+   *
+   * Never throws.
+   *
+   * @param context - The value to store; `null`, `undefined` or `""` clears it.
+   * @returns `true` when the value was accepted and written; `false` when it is invalid or the feature
+   * is off on this page (not configured, cookie blocked, domain mismatch, not HTTPS).
+   *
+   * @example
+   * ```typescript
+   * tracker.setCrossOriginContext(`v1.${journeyId}.passkey.b`);
+   * ```
+   */
+  setCrossOriginContext(context) {
+    try {
+      if (!this.crossOrigin) {
+        return false;
+      }
+      const value = context === null || context === void 0 || context === "" ? void 0 : context;
+      if (value !== void 0 && !isValidCrossOriginContext(value)) {
+        this.logger.debug("Ignoring invalid cross-origin context (expected <= 128 chars of [A-Za-z0-9._~-])");
+        return false;
+      }
+      const seq = this.config.sessionContinuity ? Math.max(this.seq, this.persistentStorage.getItem(SEQ_STORAGE_KEY) ?? 0) : this.seq;
+      const next = this.crossOrigin.setContext(this.sessionId, seq, value);
+      if (next === void 0) {
+        return false;
+      }
+      if (next > this.seq) {
+        this.seq = next;
+        if (this.config.sessionContinuity) {
+          this.persistentStorage.setItem(SEQ_STORAGE_KEY, next);
+        }
+      }
+      return true;
+    } catch (error) {
+      this.logger.error("Failed to set the cross-origin context", error);
+      return false;
+    }
+  }
+  /**
+   * The context string stored with the current cross-origin session (see
+   * {@link CorbadoTracker.setCrossOriginContext}), or `undefined` when none is set, the session has no
+   * context, or the feature is off on this page. Never throws.
+   */
+  getCrossOriginContext() {
+    try {
+      return this.crossOrigin?.getContext(this.sessionId);
+    } catch (error) {
+      this.logger.error("Failed to read the cross-origin context", error);
+      return void 0;
+    }
+  }
   /** @internal */
   resetSession() {
     const newSessionId = uuidv7();
@@ -1847,6 +2025,7 @@ var CorbadoTracker = class _CorbadoTracker {
     this.sessionId = newSessionId;
     this.seq = 0;
     this.queue.setSessionId(newSessionId);
+    this.crossOrigin?.reset(newSessionId);
     this.logger.debug(`Session reset: ${newSessionId}`);
     return newSessionId;
   }

package/dist/analysis/config.mjs

@@ -185,10 +185,13 @@ function resolveFixedDataConfig(raw) {
     const value = raw;
     const pmd = value.pmd;
     const pmdExplicit = typeof pmd === "boolean";
+    const crossOrigin = value.crossOriginSession;
+    const cookieDomain = crossOrigin && typeof crossOrigin === "object" && typeof crossOrigin.cookieDomain === "string" ? crossOrigin.cookieDomain : void 0;
     return {
       pmd: pmdExplicit ? pmd : false,
       pmdExplicit,
-      privateMode: asBoolean(value.privateMode, true)
+      privateMode: asBoolean(value.privateMode, true),
+      ...cookieDomain !== void 0 && { crossOriginSession: { cookieDomain } }
     };
   } catch {
     return void 0;

package/dist/analysis/cross-origin-session.mjs

@@ -0,0 +1,422 @@
+// src/cross-origin-session.ts
+import { readCookieScope } from "./readers/page.mjs";
+import { cookieJar } from "./readers/storage.mjs";
+var CROSS_ORIGIN_COOKIE_PREFIX = "cbo_xs";
+var CROSS_ORIGIN_COOKIE_VERSION = "1";
+var CROSS_ORIGIN_SEQ_RESERVE = 20;
+var CROSS_ORIGIN_CONTEXT_MAX = 128;
+var CONTEXT_RE = /^[A-Za-z0-9._~-]{1,128}$/;
+var CROSS_ORIGIN_ACTIVITY_WRITE_INTERVAL_MS = 1e3;
+var FUTURE_TOLERANCE_MS = 5 * 60 * 1e3;
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var PROJECT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+var DOMAIN_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/;
+var INT_RE = /^\d{1,15}$/;
+var CROSS_ORIGIN_MAX_SEQ_MARK = 1e9;
+var CROSS_ORIGIN_FOREIGN_GAP = 1e3;
+var CROSS_ORIGIN_MAX_SEQ_JUMP = 1e5;
+function isValidCrossOriginContext(value) {
+  return typeof value === "string" && CONTEXT_RE.test(value);
+}
+function parseCrossOriginCookie(value) {
+  const parts = value.split(".");
+  const [version, sessionId, lastActiveAt, seqMark] = parts;
+  if (parts.length < 4 || version !== CROSS_ORIGIN_COOKIE_VERSION || !sessionId || !UUID_RE.test(sessionId) || !lastActiveAt || !INT_RE.test(lastActiveAt) || !seqMark || !INT_RE.test(seqMark) || Number(seqMark) > CROSS_ORIGIN_MAX_SEQ_MARK) {
+    return void 0;
+  }
+  const context = parts.length > 4 ? parts.slice(4).join(".") : void 0;
+  if (context !== void 0 && !isValidCrossOriginContext(context)) {
+    return void 0;
+  }
+  return {
+    sessionId: sessionId.toLowerCase(),
+    lastActiveAt: Number(lastActiveAt),
+    seqMark: Number(seqMark),
+    ...context !== void 0 && { context }
+  };
+}
+function formatCrossOriginCookie(record) {
+  const parts = [
+    CROSS_ORIGIN_COOKIE_VERSION,
+    record.sessionId,
+    String(Math.floor(record.lastActiveAt)),
+    String(Math.floor(record.seqMark))
+  ];
+  if (record.context !== void 0) {
+    parts.push(record.context);
+  }
+  return parts.join(".");
+}
+function resolveCrossOriginDomain(raw, hostname) {
+  const domain = raw.trim().toLowerCase().replace(/^\./, "");
+  const host = hostname.toLowerCase();
+  if (!DOMAIN_RE.test(domain)) {
+    return void 0;
+  }
+  return host === domain || host.endsWith(`.${domain}`) ? domain : void 0;
+}
+var CrossOriginSession = class _CrossOriginSession {
+  constructor(name, domain, jar, contextJar, deps) {
+    this.name = name;
+    this.domain = domain;
+    this.jar = jar;
+    this.contextJar = contextJar;
+    this.deps = deps;
+  }
+  enabled = true;
+  /** Session the in-memory reservation, highest seen mark and context belong to. */
+  reservedFor;
+  /** Seq this page may allocate up to (exclusive) without rewriting the cookie. */
+  reservedMark = 0;
+  /** Highest plausible mark of {@link reservedFor} this page has seen or written. */
+  highestSeen = 0;
+  lastWriteAt = 0;
+  /** Context of {@link reservedFor} as last known to this page. */
+  context;
+  /**
+   * The feature for this page, or `undefined` when it cannot work here (invalid project id or domain, a
+   * domain that is not the page's host or a parent of it, a non-HTTPS page, no document). Never throws.
+   */
+  static create(deps) {
+    try {
+      if (typeof document === "undefined" || typeof window === "undefined") {
+        return void 0;
+      }
+      if (!PROJECT_ID_RE.test(deps.projectId)) {
+        deps.logger.debug("Cross-origin session off: project id is not cookie-safe");
+        return void 0;
+      }
+      const scope = deps.scope ? deps.scope() : readCookieScope({
+        key: "page:location.cookie-scope",
+        title: "Page host name for the shared session cookie",
+        accessNote: "location.hostname and location.protocol, compared with the configured shared cookie domain; not sent",
+        group: "Observe SDK state",
+        origin: "observe-external",
+        fields: [
+          {
+            path: "hostname",
+            label: "Host name of the page",
+            exposure: "none",
+            transform: { note: "only compared with the configured parent domain; never sent or stored" }
+          },
+          {
+            path: "https",
+            label: "Whether the page uses a secure connection",
+            exposure: "none",
+            transform: { note: "the shared cookie is only used on secure pages; never sent or stored" }
+          }
+        ]
+      });
+      if (!scope.https) {
+        deps.logger.debug("Cross-origin session off: page is not served over HTTPS");
+        return void 0;
+      }
+      const domain = resolveCrossOriginDomain(deps.cookieDomain, scope.hostname);
+      if (!domain) {
+        deps.logger.warn(`Cross-origin session off: "${deps.cookieDomain}" is not the page's domain or a parent of it`);
+        deps.report("info", "cross-origin session: cookieDomain does not match the page");
+        return void 0;
+      }
+      const jar = deps.jar ?? cookieJar({
+        key: "storage:sdk.cross-origin-session",
+        title: "Observe session shared across your subdomains",
+        accessNote: "document.cookie, Observe's own cbo_xs_ cookie on the configured parent domain (Secure, SameSite Lax, Path /, expires after the session inactivity window); the browser sends it with every request to every subdomain of that domain",
+        group: "Observe SDK state",
+        origin: "observe-internal",
+        fields: [
+          {
+            path: "sessionId",
+            label: "Random Observe session id",
+            exposure: "token",
+            transform: {
+              pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+              max: 36,
+              note: "generated by the SDK; sent to Corbado as the session id of every batch; the cookie carries it to every subdomain of the configured domain"
+            }
+          },
+          {
+            path: "lastActiveAt",
+            label: "Time of the last tracked activity",
+            exposure: "none",
+            transform: {
+              note: "decides whether the session is still active; not sent to Corbado, but the cookie carries it to every subdomain of the configured domain"
+            }
+          },
+          {
+            path: "seqMark",
+            label: "Event counter position",
+            exposure: "none",
+            transform: {
+              note: "the next page continues event numbering above it; not sent to Corbado, but the cookie carries it to every subdomain of the configured domain"
+            }
+          }
+        ]
+      });
+      const contextJar = deps.jar ?? cookieJar({
+        key: "storage:sdk.cross-origin-context",
+        title: "Reference your integration keeps with the shared session",
+        accessNote: "document.cookie, the optional context part of Observe's cbo_xs_ cookie, set and read by the integration",
+        group: "Observe SDK state",
+        origin: "host-config",
+        fields: [
+          {
+            path: "context",
+            label: "Optional reference set by your integration",
+            exposure: "none",
+            transform: {
+              note: "opaque string of at most 128 cookie-safe characters chosen by the integration; not sent to Corbado, but the cookie carries it to every subdomain of the configured domain"
+            }
+          }
+        ]
+      });
+      return new _CrossOriginSession(`${CROSS_ORIGIN_COOKIE_PREFIX}_${deps.projectId}`, domain, jar, contextJar, deps);
+    } catch (error) {
+      deps.logger.error("Cross-origin session setup failed", error);
+      return void 0;
+    }
+  }
+  /** Whether the cookie is in use on this page (false after a failed write check or {@link stop}). */
+  isEnabled() {
+    return this.enabled;
+  }
+  /** No cookie access from now on (tracker destroyed). */
+  stop() {
+    this.enabled = false;
+  }
+  /**
+   * Decide the session of this load before its first event and claim the cookie for it.
+   *
+   * `local.lastActiveAt` is the local session's last activity BEFORE this load (0 when the local session
+   * was created by this load). The cookie's session is adopted when the local one is new or was active
+   * earlier than the cookie's; the same session continues at or above the cookie's mark. A local session
+   * that was active more recently takes the cookie over. Never throws; `undefined` when the feature is off.
+   */
+  boot(local, now = Date.now()) {
+    if (!this.enabled) {
+      return void 0;
+    }
+    try {
+      const cookie = this.read(this.jar, now);
+      let sessionId = local.sessionId;
+      let adopted = false;
+      if (cookie && cookie.sessionId !== sessionId && (!sessionId || local.lastActiveAt <= 0 || cookie.lastActiveAt > local.lastActiveAt)) {
+        sessionId = cookie.sessionId;
+        adopted = true;
+      }
+      let seq = adopted ? cookie?.seqMark ?? 0 : local.seq;
+      if (sessionId) {
+        const written = this.sync(this.jar, cookie, sessionId, seq, now, true, false);
+        seq = written.seq;
+        if (!this.isStored(written.value)) {
+          this.enabled = false;
+          this.deps.logger.debug("Cross-origin session off: the cookie could not be stored");
+          this.deps.report("info", "cross-origin session: cookie not stored");
+        }
+      }
+      return { sessionId, seq, adopted };
+    } catch (error) {
+      this.enabled = false;
+      this.deps.logger.error("Cross-origin session boot failed", error);
+      this.deps.report("error", "cross-origin session: boot failed");
+      return void 0;
+    }
+  }
+  /**
+   * Called for every seq allocation with the seq about to be used; returns the seq to use instead. Reads
+   * the cookie on every call (a string scan).
+   *
+   * - Cookie of this session: continue above another page's reservation once one exists above this
+   *   page's, renew the reservation when it is used up, otherwise refresh the activity at most once per
+   *   {@link CROSS_ORIGIN_ACTIVITY_WRITE_INTERVAL_MS}. The mark is never lowered.
+   * - No (valid) cookie: written as for this session.
+   * - Cookie of another session: left alone (see the module notes); the seq stays above the highest mark
+   *   this page saw for its session.
+   *
+   * Never throws.
+   */
+  claim(sessionId, seq, now = Date.now()) {
+    if (!this.enabled || !sessionId) {
+      return seq;
+    }
+    try {
+      const cookie = this.read(this.jar, now);
+      this.follow(sessionId);
+      const same = cookie?.sessionId === sessionId;
+      const mark = same ? this.plausibleMark(cookie.seqMark, seq) : void 0;
+      if (mark !== void 0) {
+        this.highestSeen = Math.max(this.highestSeen, mark);
+      }
+      if (cookie && !same) {
+        if (seq < this.reservedMark) {
+          return seq;
+        }
+        const next = Math.max(seq, this.highestSeen) + CROSS_ORIGIN_FOREIGN_GAP;
+        this.reservedMark = next + CROSS_ORIGIN_FOREIGN_GAP;
+        this.highestSeen = this.reservedMark;
+        return next;
+      }
+      const renew = seq >= this.reservedMark || mark !== void 0 && mark > this.reservedMark;
+      if (!renew && now - this.lastWriteAt < CROSS_ORIGIN_ACTIVITY_WRITE_INTERVAL_MS) {
+        return seq;
+      }
+      return this.sync(this.jar, cookie, sessionId, seq, now, renew, false).seq;
+    } catch (error) {
+      this.deps.logger.error("Cross-origin session cookie update failed", error);
+      return seq;
+    }
+  }
+  /** A new session of this page (`resetSession`): the cookie starts over with it, without context. */
+  reset(sessionId, now = Date.now()) {
+    if (!this.enabled || !sessionId) {
+      return;
+    }
+    try {
+      this.reservedFor = void 0;
+      this.follow(sessionId);
+      this.sync(this.jar, this.read(this.jar, now), sessionId, 0, now, true, true);
+    } catch (error) {
+      this.deps.logger.error("Cross-origin session cookie reset failed", error);
+    }
+  }
+  /**
+   * Store (or with `undefined` clear) the integration context of `sessionId`; this explicit call may take
+   * the cookie over from another session. `seq` is the page's best known next seq. Returns the next seq the
+   * page must continue at (a renewed reservation can move it up), or `undefined` when nothing was written.
+   */
+  setContext(sessionId, seq, context, now = Date.now()) {
+    if (!this.enabled || !sessionId) {
+      return void 0;
+    }
+    try {
+      const cookie = this.read(this.contextJar, now);
+      this.follow(sessionId);
+      this.context = context;
+      return this.sync(this.contextJar, cookie, sessionId, seq, now, seq >= this.reservedMark, true).seq;
+    } catch (error) {
+      this.deps.logger.error("Cross-origin session context update failed", error);
+      return void 0;
+    }
+  }
+  /** The integration context of `sessionId` (the cookie's when it holds that session, else this page's). */
+  getContext(sessionId, now = Date.now()) {
+    if (!this.enabled || !sessionId) {
+      return void 0;
+    }
+    try {
+      const cookie = this.read(this.contextJar, now);
+      if (cookie?.sessionId === sessionId) {
+        if (this.reservedFor === sessionId) {
+          this.context = cookie.context;
+        }
+        return cookie.context;
+      }
+    } catch (error) {
+      this.deps.logger.error("Cross-origin session context read failed", error);
+    }
+    return this.reservedFor === sessionId ? this.context : void 0;
+  }
+  /** Switch the in-memory state to `sessionId` (fresh reservation, nothing seen, no context) when it changed. */
+  follow(sessionId) {
+    if (this.reservedFor !== sessionId) {
+      this.reservedFor = sessionId;
+      this.reservedMark = 0;
+      this.highestSeen = 0;
+      this.context = void 0;
+    }
+  }
+  /** `mark` when it is plausible next to the page's own counter `seq`; a jump beyond the cap is reported and ignored. */
+  plausibleMark(mark, seq) {
+    if (mark - seq > CROSS_ORIGIN_MAX_SEQ_JUMP) {
+      this.deps.report("info", "cross-origin session: implausible seq mark ignored");
+      return void 0;
+    }
+    return mark;
+  }
+  /**
+   * Merge the cookie (already read) with this page's state and write it back for `sessionId`.
+   *
+   * - `renew`: allocate a new reservation from `seq` (jumping above the cookie's plausible mark of the same
+   *   session and anything seen before). Otherwise the mark only grows.
+   * - `ownContext`: this page's context wins (it was just set); otherwise the cookie's context of the same
+   *   session is taken over.
+   */
+  sync(jar, cookie, sessionId, seq, now, renew, ownContext) {
+    this.follow(sessionId);
+    const same = cookie?.sessionId === sessionId;
+    const cookieMark = same ? this.plausibleMark(cookie.seqMark, seq) : void 0;
+    if (cookieMark !== void 0) {
+      this.highestSeen = Math.max(this.highestSeen, cookieMark);
+    }
+    if (same && !ownContext) {
+      this.context = cookie.context;
+    }
+    let next = seq;
+    let mark;
+    if (renew) {
+      next = Math.max(seq, cookieMark ?? 0, this.highestSeen);
+      mark = next + CROSS_ORIGIN_SEQ_RESERVE;
+    } else {
+      mark = Math.max(this.reservedMark, this.highestSeen, seq);
+    }
+    const value = formatCrossOriginCookie({
+      sessionId,
+      lastActiveAt: now,
+      seqMark: mark,
+      ...this.context !== void 0 && { context: this.context }
+    });
+    this.write(jar, value);
+    if (renew) {
+      this.reservedMark = mark;
+    }
+    this.highestSeen = Math.max(this.highestSeen, mark);
+    this.lastWriteAt = now;
+    return { seq: next, value };
+  }
+  maxAgeSeconds() {
+    return Math.max(60, Math.ceil(this.deps.inactivityMs() / 1e3));
+  }
+  write(jar, value) {
+    jar.write(
+      `${this.name}=${value}; Domain=${this.domain}; Path=/; Max-Age=${this.maxAgeSeconds()}; SameSite=Lax; Secure`
+    );
+  }
+  /** Raw values of every cookie with this name (another path or a host-only copy can shadow it). */
+  rawValues(jar) {
+    const prefix = `${this.name}=`;
+    return jar.read().split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix)).map((part) => part.substring(prefix.length));
+  }
+  isStored(value) {
+    try {
+      return this.rawValues(this.jar).includes(value);
+    } catch {
+      return false;
+    }
+  }
+  /** The valid, unexpired record with the latest activity, or `undefined`. Throws when the cookie read throws. */
+  read(jar, now) {
+    const inactivityMs = this.deps.inactivityMs();
+    let best;
+    for (const raw of this.rawValues(jar)) {
+      const record = parseCrossOriginCookie(raw);
+      if (record && now - record.lastActiveAt < inactivityMs && record.lastActiveAt <= now + FUTURE_TOLERANCE_MS && (!best || record.lastActiveAt > best.lastActiveAt)) {
+        best = record;
+      }
+    }
+    return best;
+  }
+};
+export {
+  CROSS_ORIGIN_ACTIVITY_WRITE_INTERVAL_MS,
+  CROSS_ORIGIN_CONTEXT_MAX,
+  CROSS_ORIGIN_COOKIE_PREFIX,
+  CROSS_ORIGIN_COOKIE_VERSION,
+  CROSS_ORIGIN_FOREIGN_GAP,
+  CROSS_ORIGIN_MAX_SEQ_JUMP,
+  CROSS_ORIGIN_MAX_SEQ_MARK,
+  CROSS_ORIGIN_SEQ_RESERVE,
+  CrossOriginSession,
+  formatCrossOriginCookie,
+  isValidCrossOriginContext,
+  parseCrossOriginCookie,
+  resolveCrossOriginDomain
+};