@corbado/observe 1.9.1 → 1.10.1

package/dist/index.d.mts

@@ -487,6 +487,12 @@ interface EventBatchMeta {
      * fields of the server config (`pmd`) are ignored. Omitted otherwise.
      */
     fixedData?: boolean;
+    /**
+     * Set while `fixedDataConfig.crossOriginSession` is active on the page: `"adopted"` when this page load
+     * took the batch's session from the shared cross-origin cookie (another origin started it), `"own"`
+     * when the session is this origin's own. Omitted when the option is off or unusable on the page.
+     */
+    crossOriginSession?: "adopted" | "own";
 }
 interface EventMeta {
     initiator?: LowEventInitiator;
@@ -710,14 +716,12 @@ interface FixedDataConfig {
     /**
      * Password-manager detection.
      *
-     * - `true`: the extension probes (reported as {@link Event.passwordManagers}) and the DOM
-     *   password-manager scan (`pa-1`..`pa-6` lows) run.
-     * - `false`: neither runs.
-     * - omitted (with `fixedDataConfig` given): the extension probes are off (`pmd` resolves to `false`,
-     *   regardless of the built-in default, `sdkConfig.pmd` and the server config); the DOM scan keeps
-     *   today's behaviour and runs.
+     * - `true`: the extension probes run (reported as {@link Event.passwordManagers}).
+     * - `false`: they do not run.
+     * - omitted (with `fixedDataConfig` given): they are off (`pmd` resolves to `false`, regardless of the
+     *   built-in default, `sdkConfig.pmd` and the server config).
      *
-     * Without `fixedDataConfig` the probes follow the server's `pmd` and the DOM scan always runs.
+     * Without `fixedDataConfig` the probes follow the server's `pmd`.
      */
     pmd?: boolean;
     /**
@@ -725,6 +729,59 @@ interface FixedDataConfig {
      * without `fixedDataConfig`). When false, nothing is detected, read or written for it.
      */
     privateMode?: boolean;
+    /**
+     * Cross-origin session continuity under a shared parent domain. Off when omitted (no cookie is read or
+     * written). Setting it fixes `pmd` and `privateMode` like any `fixedDataConfig`; pass both explicitly.
+     * See {@link CrossOriginSessionConfig}.
+     */
+    crossOriginSession?: CrossOriginSessionConfig;
+}
+/**
+ * Opt-in cross-origin session continuity (`fixedDataConfig.crossOriginSession`).
+ *
+ * @remarks
+ * Origins under one parent domain (e.g. `login.example.com` and `app.example.com`) do not share
+ * localStorage, so each would report its own Observe session. With this option the tracker keeps a small
+ * first-party cookie `cbo_xs_<projectId>` on `cookieDomain`:
+ * `1.<sessionId>.<lastActiveAtMs>.<seqMark>[.<context>]` with `Path=/`, `SameSite=Lax`, `Secure` and a
+ * `Max-Age` of the session inactivity window. It holds the random session id, its last activity, a
+ * sequence reservation mark and the optional integration context (see
+ * {@link CorbadoTracker.setCrossOriginContext}); no personal data.
+ *
+ * The browser sends this cookie with every request to every subdomain of `cookieDomain` (it is a regular
+ * first-party cookie, readable by scripts); the session id in it is the one every batch already sends to
+ * Corbado. List it in your cookie notice like other analytics cookies. It is unrelated to
+ * `TrackerOptions.storage: "cookie"` / `TrackerOptions.cookieDomain`, which only move the SDK's own
+ * per-origin state into cookies and do not share a session across origins.
+ *
+ * At init, a tracker on another origin under the domain adopts the cookie's session when its own session
+ * was just created or was last active before the cookie's, and continues its sequence numbers at or above
+ * the mark, so the journey stays one session with unique sequence numbers. Its own session wins when it
+ * was active more recently. Only init, {@link CorbadoTracker.resetSession} and
+ * {@link CorbadoTracker.setCrossOriginContext} take the cookie over from another session; tracking never
+ * does, so a page still open on an older session cannot undo a newer one. Batches report the outcome in
+ * `meta.crossOriginSession` (`"adopted"` / `"own"`).
+ *
+ * Sessions merge across tabs: without the server's `sessionContinuity` switch each tab normally has its
+ * own session, but with this option every new tab (on any participating origin, including the same one)
+ * adopts the session of the cookie while it is active, so tabs opened within the inactivity window report
+ * into one session, as with `sessionContinuity`.
+ *
+ * The feature turns itself off for the page (tracking continues as without it) when the domain is not
+ * the page's host or a parent of it, the page is not served over HTTPS, or the cookie cannot be stored
+ * (blocked cookies, sandboxed or cross-site frames). It is fixed by the integration only and never taken
+ * from the server config.
+ *
+ * Like every `fixedDataConfig`, enabling it fixes BOTH data switches: `pmd` resolves to `false` and
+ * `privateMode` to `true` unless given, and the server's values are ignored (`meta.fixedData: true`). Set
+ * both explicitly next to it, e.g. `fixedDataConfig: { pmd: true, privateMode: true, crossOriginSession }`.
+ */
+interface CrossOriginSessionConfig {
+    /**
+     * The parent domain every participating origin shares, e.g. `".example.com"` (a leading dot is
+     * optional). Must be the page's host name or a parent of it.
+     */
+    cookieDomain: string;
 }
 /** Query handling for `meta.trackingSourcePath`; see {@link SdkReliabilityConfig.sourcePathQuery}. */
 type SourcePathQueryMode = "all" | "allowlist";
@@ -754,12 +811,6 @@ interface LowEventSink {
         settle(tailMs: number): void;
         destroy(): void;
     };
-    /**
-     * Whether the DOM password-manager scan (`pa-1`..`pa-6` lows) may run. Absent or true keeps the
-     * historical behaviour (always scan); false only under `fixedDataConfig` with `pmd` explicitly
-     * `false` (an omitted `pmd` keeps the scan on).
-     */
-    passwordManagerDomScan?(): boolean;
 }
 
 /**
@@ -1949,6 +2000,10 @@ declare class CorbadoTracker {
     private readonly probeSeqs;
     private windowObserver?;
     private passwordManagerSampler?;
+    /** Cross-origin session cookie (`fixedDataConfig.crossOriginSession`); undefined when off. */
+    private crossOrigin?;
+    /** The session this load took from the cross-origin cookie, if any (`meta.crossOriginSession`). */
+    private crossOriginAdoptedId?;
     /** @internal Shared passive page observation and per-operation context registration. */
     getWindowObserver(): SharedWindowObserver;
     constructor(options: TrackerOptions);
@@ -2020,6 +2075,26 @@ declare class CorbadoTracker {
      */
     private resolveExperiments;
     private isTrackingBlocked;
+    /** The cross-origin session cookie when `fixedDataConfig.crossOriginSession` is set and usable here. */
+    private createCrossOriginSession;
+    /**
+     * Last activity of the local session records BEFORE this load rewrites them (both paths, by id), so the
+     * cross-origin boot can tell a session that was active here from one this load just created.
+     */
+    private readLocalSessionActivity;
+    /**
+     * Reconcile the session this load resolved locally with the cross-origin cookie before the first event:
+     * adopt the cookie's session (and persist it locally, so reloads and same-origin tabs follow) or keep
+     * the local one, and continue the seq at or above the cookie's mark. Never throws.
+     */
+    private bootCrossOriginSession;
+    /**
+     * Resolve the session of this load: locally ({@link resolveSessionId}), then reconciled with the
+     * cross-origin cookie when that option is on. Used at boot and by the recovery in `getSessionId`.
+     */
+    private resolveSession;
+    /** `meta.crossOriginSession` of a batch of `sessionId`; undefined while the option is off on this page. */
+    private crossOriginSessionMeta;
     private resolveSessionId;
     /**
      * Resolve the session id from localStorage so it survives reloads and is shared across tabs of the
@@ -2410,14 +2485,6 @@ declare class CorbadoTracker {
      * @internal
      */
     flushKeepalive(reason?: FlushReason): void;
-    /**
-     * Whether input trackers run the DOM password-manager scan (`pa-1`..`pa-6` lows): only an explicitly
-     * set `fixedDataConfig.pmd` decides; without `fixedDataConfig` or with `pmd` omitted it always runs
-     * (historical behaviour).
-     *
-     * @internal
-     */
-    isPasswordManagerDomScanEnabled(): boolean;
     /**
      * Keepalive flush requested by a low-event tracker's `pagehide` teardown. Gated by the
      * server-controlled trigger switch `tlf` (boot-snapshot, default true = historical behavior):
@@ -2715,6 +2782,36 @@ declare class CorbadoTracker {
      * ```
      */
     getSessionId(): string | undefined;
+    /**
+     * Store an opaque context string with the cross-origin session, for the integration's own use on the
+     * next origin (e.g. a journey id and stage). Requires `fixedDataConfig.crossOriginSession`.
+     *
+     * @remarks
+     * The value travels in the shared cookie only (see {@link CrossOriginSessionConfig}): it is never sent
+     * to Corbado, but the browser sends the cookie with every request to every subdomain of the configured
+     * domain. It belongs to the current session: a tracker that adopts the session reads it with
+     * {@link CorbadoTracker.getCrossOriginContext}, and a new session (inactivity, `resetSession`) starts
+     * without it. At most 128 characters of `A-Z a-z 0-9 . _ ~ -`; never put personal data in it.
+     * `null`, `undefined` or `""` clears it.
+     *
+     * Never throws.
+     *
+     * @param context - The value to store; `null`, `undefined` or `""` clears it.
+     * @returns `true` when the value was accepted and written; `false` when it is invalid or the feature
+     * is off on this page (not configured, cookie blocked, domain mismatch, not HTTPS).
+     *
+     * @example
+     * ```typescript
+     * tracker.setCrossOriginContext(`v1.${journeyId}.passkey.b`);
+     * ```
+     */
+    setCrossOriginContext(context: string | null | undefined): boolean;
+    /**
+     * The context string stored with the current cross-origin session (see
+     * {@link CorbadoTracker.setCrossOriginContext}), or `undefined` when none is set, the session has no
+     * context, or the feature is off on this page. Never throws.
+     */
+    getCrossOriginContext(): string | undefined;
     /** @internal */
     resetSession(): string;
 }
@@ -2791,6 +2888,11 @@ interface QueueOptions {
      * integration or the build, so the server's data flags are ignored. Omitted (no meta field) when false.
      */
     fixedData?: boolean;
+    /**
+     * Returns `meta.crossOriginSession` for a batch of the given session (`"adopted"` / `"own"`), or
+     * undefined (no meta field) while the cross-origin session option is off. Read at send time.
+     */
+    getCrossOriginSession?: (sessionId: string) => "adopted" | "own" | undefined;
     /**
      * Called with the events of every event batch right before it is sent (async and unload flushes),
      * before the batch's telemetry is taken. The tracker uses it to attach a device info snapshot that
@@ -2876,6 +2978,7 @@ declare class RequestQueue {
     private readonly requestConfig;
     private readonly onConfigReceived?;
     private readonly getDataPolicy?;
+    private readonly getCrossOriginSession?;
     private readonly fixedData;
     private readonly beforeEventBatchSend?;
     private readonly standaloneDeviceInfo?;
@@ -3141,18 +3244,15 @@ declare function parseReliabilityConfig(raw: unknown): SdkReliabilityConfig | nu
 /** Resolve init overrides over validated server policy, then defaults, including individual retry fields. */
 declare function resolveReliabilityConfig(serverConfig: SdkReliabilityConfig | undefined, overrides?: SdkReliabilityConfigOverrides): SdkReliabilityConfig;
 /** Effective fixed data switches; every field resolved. */
-type ResolvedFixedDataConfig = Required<FixedDataConfig> & {
-    /**
-     * Whether `pmd` was set explicitly (a boolean). Only an explicit `pmd` gates the DOM password-manager
-     * scan (`pa-1`..`pa-6`); an omitted `pmd` turns the extension probes off but leaves the scan on.
-     */
-    pmdExplicit: boolean;
+type ResolvedFixedDataConfig = Required<Omit<FixedDataConfig, "crossOriginSession">> & {
+    /** Cross-origin session option as given (domain not yet checked against the page); absent when not set. */
+    crossOriginSession?: CrossOriginSessionConfig;
 };
 /**
  * Resolve `init({ fixedDataConfig })`. Returns `undefined` (not fixed: server-driven, today's behaviour)
  * unless the option is an object. A missing or non-boolean `pmd` resolves to `false` (not the built-in
- * default and not `sdkConfig.pmd`: a fixed config collects only what it names) with `pmdExplicit: false`;
- * a missing or non-boolean `privateMode` resolves to on. Never throws.
+ * default and not `sdkConfig.pmd`: a fixed config collects only what it names); a missing or non-boolean `privateMode` resolves to on. `crossOriginSession` is kept only with a string
+ * `cookieDomain` (checked against the page later). Never throws.
  *
  * @internal
  */
@@ -3339,4 +3439,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, cacheConfigRecord, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, cacheConfigRecord, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };

package/dist/index.d.ts

@@ -487,6 +487,12 @@ interface EventBatchMeta {
      * fields of the server config (`pmd`) are ignored. Omitted otherwise.
      */
     fixedData?: boolean;
+    /**
+     * Set while `fixedDataConfig.crossOriginSession` is active on the page: `"adopted"` when this page load
+     * took the batch's session from the shared cross-origin cookie (another origin started it), `"own"`
+     * when the session is this origin's own. Omitted when the option is off or unusable on the page.
+     */
+    crossOriginSession?: "adopted" | "own";
 }
 interface EventMeta {
     initiator?: LowEventInitiator;
@@ -710,14 +716,12 @@ interface FixedDataConfig {
     /**
      * Password-manager detection.
      *
-     * - `true`: the extension probes (reported as {@link Event.passwordManagers}) and the DOM
-     *   password-manager scan (`pa-1`..`pa-6` lows) run.
-     * - `false`: neither runs.
-     * - omitted (with `fixedDataConfig` given): the extension probes are off (`pmd` resolves to `false`,
-     *   regardless of the built-in default, `sdkConfig.pmd` and the server config); the DOM scan keeps
-     *   today's behaviour and runs.
+     * - `true`: the extension probes run (reported as {@link Event.passwordManagers}).
+     * - `false`: they do not run.
+     * - omitted (with `fixedDataConfig` given): they are off (`pmd` resolves to `false`, regardless of the
+     *   built-in default, `sdkConfig.pmd` and the server config).
      *
-     * Without `fixedDataConfig` the probes follow the server's `pmd` and the DOM scan always runs.
+     * Without `fixedDataConfig` the probes follow the server's `pmd`.
      */
     pmd?: boolean;
     /**
@@ -725,6 +729,59 @@ interface FixedDataConfig {
      * without `fixedDataConfig`). When false, nothing is detected, read or written for it.
      */
     privateMode?: boolean;
+    /**
+     * Cross-origin session continuity under a shared parent domain. Off when omitted (no cookie is read or
+     * written). Setting it fixes `pmd` and `privateMode` like any `fixedDataConfig`; pass both explicitly.
+     * See {@link CrossOriginSessionConfig}.
+     */
+    crossOriginSession?: CrossOriginSessionConfig;
+}
+/**
+ * Opt-in cross-origin session continuity (`fixedDataConfig.crossOriginSession`).
+ *
+ * @remarks
+ * Origins under one parent domain (e.g. `login.example.com` and `app.example.com`) do not share
+ * localStorage, so each would report its own Observe session. With this option the tracker keeps a small
+ * first-party cookie `cbo_xs_<projectId>` on `cookieDomain`:
+ * `1.<sessionId>.<lastActiveAtMs>.<seqMark>[.<context>]` with `Path=/`, `SameSite=Lax`, `Secure` and a
+ * `Max-Age` of the session inactivity window. It holds the random session id, its last activity, a
+ * sequence reservation mark and the optional integration context (see
+ * {@link CorbadoTracker.setCrossOriginContext}); no personal data.
+ *
+ * The browser sends this cookie with every request to every subdomain of `cookieDomain` (it is a regular
+ * first-party cookie, readable by scripts); the session id in it is the one every batch already sends to
+ * Corbado. List it in your cookie notice like other analytics cookies. It is unrelated to
+ * `TrackerOptions.storage: "cookie"` / `TrackerOptions.cookieDomain`, which only move the SDK's own
+ * per-origin state into cookies and do not share a session across origins.
+ *
+ * At init, a tracker on another origin under the domain adopts the cookie's session when its own session
+ * was just created or was last active before the cookie's, and continues its sequence numbers at or above
+ * the mark, so the journey stays one session with unique sequence numbers. Its own session wins when it
+ * was active more recently. Only init, {@link CorbadoTracker.resetSession} and
+ * {@link CorbadoTracker.setCrossOriginContext} take the cookie over from another session; tracking never
+ * does, so a page still open on an older session cannot undo a newer one. Batches report the outcome in
+ * `meta.crossOriginSession` (`"adopted"` / `"own"`).
+ *
+ * Sessions merge across tabs: without the server's `sessionContinuity` switch each tab normally has its
+ * own session, but with this option every new tab (on any participating origin, including the same one)
+ * adopts the session of the cookie while it is active, so tabs opened within the inactivity window report
+ * into one session, as with `sessionContinuity`.
+ *
+ * The feature turns itself off for the page (tracking continues as without it) when the domain is not
+ * the page's host or a parent of it, the page is not served over HTTPS, or the cookie cannot be stored
+ * (blocked cookies, sandboxed or cross-site frames). It is fixed by the integration only and never taken
+ * from the server config.
+ *
+ * Like every `fixedDataConfig`, enabling it fixes BOTH data switches: `pmd` resolves to `false` and
+ * `privateMode` to `true` unless given, and the server's values are ignored (`meta.fixedData: true`). Set
+ * both explicitly next to it, e.g. `fixedDataConfig: { pmd: true, privateMode: true, crossOriginSession }`.
+ */
+interface CrossOriginSessionConfig {
+    /**
+     * The parent domain every participating origin shares, e.g. `".example.com"` (a leading dot is
+     * optional). Must be the page's host name or a parent of it.
+     */
+    cookieDomain: string;
 }
 /** Query handling for `meta.trackingSourcePath`; see {@link SdkReliabilityConfig.sourcePathQuery}. */
 type SourcePathQueryMode = "all" | "allowlist";
@@ -754,12 +811,6 @@ interface LowEventSink {
         settle(tailMs: number): void;
         destroy(): void;
     };
-    /**
-     * Whether the DOM password-manager scan (`pa-1`..`pa-6` lows) may run. Absent or true keeps the
-     * historical behaviour (always scan); false only under `fixedDataConfig` with `pmd` explicitly
-     * `false` (an omitted `pmd` keeps the scan on).
-     */
-    passwordManagerDomScan?(): boolean;
 }
 
 /**
@@ -1949,6 +2000,10 @@ declare class CorbadoTracker {
     private readonly probeSeqs;
     private windowObserver?;
     private passwordManagerSampler?;
+    /** Cross-origin session cookie (`fixedDataConfig.crossOriginSession`); undefined when off. */
+    private crossOrigin?;
+    /** The session this load took from the cross-origin cookie, if any (`meta.crossOriginSession`). */
+    private crossOriginAdoptedId?;
     /** @internal Shared passive page observation and per-operation context registration. */
     getWindowObserver(): SharedWindowObserver;
     constructor(options: TrackerOptions);
@@ -2020,6 +2075,26 @@ declare class CorbadoTracker {
      */
     private resolveExperiments;
     private isTrackingBlocked;
+    /** The cross-origin session cookie when `fixedDataConfig.crossOriginSession` is set and usable here. */
+    private createCrossOriginSession;
+    /**
+     * Last activity of the local session records BEFORE this load rewrites them (both paths, by id), so the
+     * cross-origin boot can tell a session that was active here from one this load just created.
+     */
+    private readLocalSessionActivity;
+    /**
+     * Reconcile the session this load resolved locally with the cross-origin cookie before the first event:
+     * adopt the cookie's session (and persist it locally, so reloads and same-origin tabs follow) or keep
+     * the local one, and continue the seq at or above the cookie's mark. Never throws.
+     */
+    private bootCrossOriginSession;
+    /**
+     * Resolve the session of this load: locally ({@link resolveSessionId}), then reconciled with the
+     * cross-origin cookie when that option is on. Used at boot and by the recovery in `getSessionId`.
+     */
+    private resolveSession;
+    /** `meta.crossOriginSession` of a batch of `sessionId`; undefined while the option is off on this page. */
+    private crossOriginSessionMeta;
     private resolveSessionId;
     /**
      * Resolve the session id from localStorage so it survives reloads and is shared across tabs of the
@@ -2410,14 +2485,6 @@ declare class CorbadoTracker {
      * @internal
      */
     flushKeepalive(reason?: FlushReason): void;
-    /**
-     * Whether input trackers run the DOM password-manager scan (`pa-1`..`pa-6` lows): only an explicitly
-     * set `fixedDataConfig.pmd` decides; without `fixedDataConfig` or with `pmd` omitted it always runs
-     * (historical behaviour).
-     *
-     * @internal
-     */
-    isPasswordManagerDomScanEnabled(): boolean;
     /**
      * Keepalive flush requested by a low-event tracker's `pagehide` teardown. Gated by the
      * server-controlled trigger switch `tlf` (boot-snapshot, default true = historical behavior):
@@ -2715,6 +2782,36 @@ declare class CorbadoTracker {
      * ```
      */
     getSessionId(): string | undefined;
+    /**
+     * Store an opaque context string with the cross-origin session, for the integration's own use on the
+     * next origin (e.g. a journey id and stage). Requires `fixedDataConfig.crossOriginSession`.
+     *
+     * @remarks
+     * The value travels in the shared cookie only (see {@link CrossOriginSessionConfig}): it is never sent
+     * to Corbado, but the browser sends the cookie with every request to every subdomain of the configured
+     * domain. It belongs to the current session: a tracker that adopts the session reads it with
+     * {@link CorbadoTracker.getCrossOriginContext}, and a new session (inactivity, `resetSession`) starts
+     * without it. At most 128 characters of `A-Z a-z 0-9 . _ ~ -`; never put personal data in it.
+     * `null`, `undefined` or `""` clears it.
+     *
+     * Never throws.
+     *
+     * @param context - The value to store; `null`, `undefined` or `""` clears it.
+     * @returns `true` when the value was accepted and written; `false` when it is invalid or the feature
+     * is off on this page (not configured, cookie blocked, domain mismatch, not HTTPS).
+     *
+     * @example
+     * ```typescript
+     * tracker.setCrossOriginContext(`v1.${journeyId}.passkey.b`);
+     * ```
+     */
+    setCrossOriginContext(context: string | null | undefined): boolean;
+    /**
+     * The context string stored with the current cross-origin session (see
+     * {@link CorbadoTracker.setCrossOriginContext}), or `undefined` when none is set, the session has no
+     * context, or the feature is off on this page. Never throws.
+     */
+    getCrossOriginContext(): string | undefined;
     /** @internal */
     resetSession(): string;
 }
@@ -2791,6 +2888,11 @@ interface QueueOptions {
      * integration or the build, so the server's data flags are ignored. Omitted (no meta field) when false.
      */
     fixedData?: boolean;
+    /**
+     * Returns `meta.crossOriginSession` for a batch of the given session (`"adopted"` / `"own"`), or
+     * undefined (no meta field) while the cross-origin session option is off. Read at send time.
+     */
+    getCrossOriginSession?: (sessionId: string) => "adopted" | "own" | undefined;
     /**
      * Called with the events of every event batch right before it is sent (async and unload flushes),
      * before the batch's telemetry is taken. The tracker uses it to attach a device info snapshot that
@@ -2876,6 +2978,7 @@ declare class RequestQueue {
     private readonly requestConfig;
     private readonly onConfigReceived?;
     private readonly getDataPolicy?;
+    private readonly getCrossOriginSession?;
     private readonly fixedData;
     private readonly beforeEventBatchSend?;
     private readonly standaloneDeviceInfo?;
@@ -3141,18 +3244,15 @@ declare function parseReliabilityConfig(raw: unknown): SdkReliabilityConfig | nu
 /** Resolve init overrides over validated server policy, then defaults, including individual retry fields. */
 declare function resolveReliabilityConfig(serverConfig: SdkReliabilityConfig | undefined, overrides?: SdkReliabilityConfigOverrides): SdkReliabilityConfig;
 /** Effective fixed data switches; every field resolved. */
-type ResolvedFixedDataConfig = Required<FixedDataConfig> & {
-    /**
-     * Whether `pmd` was set explicitly (a boolean). Only an explicit `pmd` gates the DOM password-manager
-     * scan (`pa-1`..`pa-6`); an omitted `pmd` turns the extension probes off but leaves the scan on.
-     */
-    pmdExplicit: boolean;
+type ResolvedFixedDataConfig = Required<Omit<FixedDataConfig, "crossOriginSession">> & {
+    /** Cross-origin session option as given (domain not yet checked against the page); absent when not set. */
+    crossOriginSession?: CrossOriginSessionConfig;
 };
 /**
  * Resolve `init({ fixedDataConfig })`. Returns `undefined` (not fixed: server-driven, today's behaviour)
  * unless the option is an object. A missing or non-boolean `pmd` resolves to `false` (not the built-in
- * default and not `sdkConfig.pmd`: a fixed config collects only what it names) with `pmdExplicit: false`;
- * a missing or non-boolean `privateMode` resolves to on. Never throws.
+ * default and not `sdkConfig.pmd`: a fixed config collects only what it names); a missing or non-boolean `privateMode` resolves to on. `crossOriginSession` is kept only with a string
+ * `cookieDomain` (checked against the page later). Never throws.
  *
  * @internal
  */
@@ -3339,4 +3439,4 @@ declare function logInfo(message: string): void;
 declare function logError(message: string): void;
 declare function destroy(): Promise<void>;
 
-export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, cacheConfigRecord, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };
+export { type AppConfirmationOperationCeremonyTypedError, type AppConfirmationOperationConfig, AppConfirmationOperationFull, type AppConfirmationOperationRetryReason, type AppConfirmationOperationSpecType, type AppConfirmationOperationStart, type AuthDecisionFinished, type AuthDecisionStarted, AuthEventName, type AuthMethodDecisionFinished, type AuthMethodDecisionStarted, type AuthMethodType, type BaseEvent, CEREMONY_LOW_EVENT_TAIL_MS, CONFIG_BOUNDS, CONFIG_CACHE_STORAGE_KEY, CONFIG_REQUEST_HEADER, CONFIG_STORAGE_KEY, type CaptchaOperationConfig, CaptchaOperationFull, type CaptchaOperationSpecType, type ClientCapabilities, type ClientEnvHandleMeta, type ClientEnvHandleMetaSource, type ConfigCacheRecord, type Conversion, CookieStorage, CorbadoTracker, type CreateLoggerOptions, type CrossOriginSessionConfig, type CustomEvent, DEFAULT_DEVICE_INFO_COLLECTOR_TIMEOUT_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_SERIALIZED_LENGTH, DEFAULT_RELIABILITY_CONFIG, DEFAULT_SEQ_LOCK_TIMEOUT_MS, DEFAULT_SESSION_INACTIVITY_MS, type DeviceInfo, type DeviceInfoCollectionError, type DeviceInfoDataWeb, type DeviceType, type EmailLinkContinuationConfig, EmailLinkContinuationOperation, type EmailLinkOperationConfig, EmailLinkOperationFull, type EmailLinkOperationPostResponseStart, type EmailLinkOperationSendStart, type EmailLinkOperationSpecType, type EmailOTPOperationConfig, type EmailOTPOperationPostResponseStart, type EmailOTPOperationSendOTPStart, type EmailOTPOperationSpecType, EmailOtpOperationFull, type ErrorStepOptions, type Event, type EventBatch, type EventBatchMeta, type EventMeta, EventStore, type EventType, type FixedDataConfig, type FlowAutoFinished, type FlowDecided, type FlowFinished, type FlowHandle, type FlowReset, type FlowStarted, type FlowType, type FlushReason, type FormOperationConfig, FormOperationFull, type HandoffStepHelper, type JavaScriptHighEntropy, type KeyOperationConfig, KeyRegistrationOperationFull, KeySigningOperationFull, LocalStorage, type Logger, type LowEvent, type LowEventFieldRole, type LowEventInitiator, type LowEventInputEffect, type LowEventSourceKind, type MultiFlowReset, type MultiFlowStarted, NamespacedStorage, type NormalizedError, OUTBOX_LOCK_NAME, OUTBOX_STORAGE_KEY, type ObserveSdkConfigSnapshot, OperationFull, OperationFullProvideIdentifierWithCUI, type OperationFullProvideIdentifierWithCUIConfig, type OutboxEntry, PROBE_BATCH_MAX_BYTES, PROBE_BATCH_MAX_ITEMS, PROBE_PAYLOAD_MAX_BYTES, PROBE_QUEUE_MAX_BYTES, PROBE_QUEUE_MAX_ITEMS, type PasskeyDeletionDeletionTypedError, type PasskeyDeletionOperationConfig, PasskeyDeletionOperationFull, type PasskeyDeletionUserConfirmationTypedError, type PasskeyEnrollmentCeremonyFinished, type PasskeyEnrollmentCeremonyStart, type PasskeyEnrollmentGetOptionsFinished, type PasskeyEnrollmentGetOptionsStart, type PasskeyEnrollmentOperationConfig, PasskeyEnrollmentOperationFull, type PasskeyEnrollmentPostResponseStart, type PasskeyLoginCUIGetOptionsFinished, type PasskeyLoginCUIGetOptionsStart, type PasskeyLoginCUISpecType, type PasskeyLoginCeremonyFinished, type PasskeyLoginCeremonyStart, type PasskeyLoginClientError, type PasskeyLoginFinish, type PasskeyLoginGetOptionsFinished, type PasskeyLoginGetOptionsStart, type PasskeyLoginOperationConfig, PasskeyLoginOperationFull, type PasskeyLoginPostResponseStart, type PasskeyLoginStartable, type PasskeyLoginSubmitted, type PasskeyOperationEnrollmentExplicitSpecType, type PasskeyOperationLoginExplicitSpecType, type PasswordEnrollmentConfig, PasswordEnrollmentOperationFull, type PasswordEnrollmentTypedError, type PasswordLoginCUICeremonyStart, type PasswordLoginCUIGetOptionsFinished, type PasswordLoginCUIGetOptionsStart, type PasswordLoginCUISpecType, type PasswordLoginCUITypedError, type PasswordLoginConfig, type PasswordLoginExplicitSpecType, PasswordLoginOperationFull, type PasswordLoginTypedError, type PasswordManagerExtension, type PasswordManagerExtensionName, type PredefinedEvent, type ProbeContext, type ProbeEntry, type ProbeInput, type ProvideDataOperationConfig, ProvideDataOperationFull, type ProvideDataOperationPostResponseStart, type ProvideDataOperationSpecType, type ProvideDataOperationStart, type ProvideIdentifierError, type ProvideIdentifierFinish, type ProvideIdentifierPostResponseStart, type ProvideIdentifierSpecType, type ProvideIdentifierStart, type QueueOptions, RAW_ERROR_BOUNDS, READER_EXPOSURES, type RawErrorEnvelope, type ReaderDataConfigKey, type ReaderExposure, type ReaderField, type ReaderMeta, type ReaderOrigin, type ReaderTransform, RequestQueue, type ResolvedFixedDataConfig, SDK_NAME, SDK_VERSION, type SdkInfo, type SdkInputHandoff, type SdkReliabilityConfig, type SdkReliabilityConfigOverrides, type SdkRetryConfig, type SdkWebAuthnError, type SdkWebAuthnPayload, type SerializeRawErrorOptions, SessionStorage, type SetFlowTagsOptions, type SmsOTPOperationConfig, type SmsOTPOperationPostResponseStart, type SmsOTPOperationSpecType, SmsOtpOperationFull, type SocialLoginEntry, type SocialLoginExchangeCodeFinished, type SocialLoginExchangeCodeStart, type SocialLoginGetRedirectUrlFinished, type SocialLoginGetRedirectUrlStart, type SocialLoginOperationConfig, SocialLoginOperationFull, type SocialLoginProviderType, type SocialLoginSpecType, type SourcePathQueryMode, type SsoLoginExchangeCodeFinished, type SsoLoginExchangeCodeStart, type SsoLoginGetRedirectUrlFinished, type SsoLoginGetRedirectUrlStart, type SsoLoginOperationConfig, SsoLoginOperationFull, type SsoLoginSpecType, type StandaloneDeviceInfoSource, type StepHelper, type StepIdentifier, type StepOptions, type StorageEngine, type SubflowTrigger, type SubflowType, type TelemetryEntry, type TelemetryLevel, type TelemetrySink, type TotpOperationConfig, TotpOperationFull, type TotpOperationPostResponseStart, type TotpOperationSpecType, type TrackerOptions, type Transport, type TransportMakeRequestResponse, type TransportOptions, type TrustedDeviceBindingMetadata, type TrustedDeviceCheckConfig, TrustedDeviceCheckOperationFull, type TrustedDeviceCheckResult, type TrustedDeviceCheckStepResult, type TrustedDeviceCheckTypedError, TrustedDeviceEnrollmentOperationFull, type TrustedDeviceEnrollmentResult, type TrustedDeviceOperationConfig, type TrustedDevicePurpose, type TrustedDeviceStorage, UNLOAD_BUDGET_BYTES, UNLOAD_PROBE_MAX_BYTES, type UserReference, type WebAuthnIdentifierProjector, type WebAuthnIdentifierProjectors, type WithHandoffs, cacheConfigRecord, clearExperiment, clearExperiments, createLogger, destroy, detectPasswordManagerExtensions, getExperiments, getSessionId, getTracker, init, loadCachedConfig, loadConfigRecord, logError, logInfo, namespacedKey, parseReliabilityConfig, resetSession, resolveFixedDataConfig, resolveRawErrorLimits, resolveReliabilityConfig, sanitizeAssertionResponse, sanitizeCreationOptions, sanitizeCreationResponse, sanitizeRequestOptions, serializeRawError, setExperiment, setExperiments, setFlowTags, setUser, telemetry, utf8Length };