@safepassage/sdk 3.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 SafePassage
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,222 @@
+# SafePassage SDK v3.0.0 - Redirect Implementation
+
+A lightweight SDK for integrating SafePassage age verification using a simple redirect flow.
+
+## Features
+
+- **Ultra-lightweight**: Only 4.9KB minified (1.9KB gzipped)
+- **Simple integration**: Just 10 lines of code
+- **Two modes**: Same-tab redirect or new-tab popup
+- **TypeScript support**: Full type definitions included
+- **Auto-environment detection**: Works seamlessly in development
+- **Secure**: Merchant-generated session IDs prevent attacks
+- **Compliant**: Enforces minimum age of 25
+
+## Installation
+
+```bash
+npm install @safepassage/sdk
+```
+
+## Quick Start
+
+```javascript
+// Initialize SDK
+const sp = new SafePassage({
+  apiKey: 'pk_live_xxxxx',
+  returnUrl: 'https://yoursite.com/verified',
+  cancelUrl: 'https://yoursite.com/cancelled'
+});
+
+// Trigger verification
+sp.verify({ 
+  sessionId: generateUUID() // You must generate this
+});
+```
+
+## Configuration
+
+| Option | Type | Required | Description |
+|--------|------|----------|-------------|
+| apiKey | string | Yes | Your public API key (pk_live_xxx or pk_test_xxx) |
+| returnUrl | string | Yes | URL to redirect after successful verification |
+| cancelUrl | string | Yes | URL to redirect if user cancels |
+| environment | string | No | 'production', 'staging', or 'development' (auto-detected) |
+| mode | string | No | 'redirect' (default) or 'new-tab' |
+| onComplete | function | No | Callback for new-tab mode completion |
+| onCancel | function | No | Callback for new-tab mode cancellation |
+| onError | function | No | Error handler |
+
+## Verification Options
+
+```javascript
+sp.verify({
+  sessionId: 'uuid-v4',        // Required: merchant-generated UUID
+  challengeAge: 30,            // Optional: min 25 (default from dashboard)
+  verificationMode: 'L2'       // Optional: 'L1' or 'L2' (default from dashboard)
+});
+```
+
+## Modes
+
+### Same-Tab Redirect (Default)
+User is redirected to SafePassage, then back to your site:
+
+```javascript
+const sp = new SafePassage({
+  apiKey: 'pk_live_xxxxx',
+  returnUrl: '/age-verified',
+  cancelUrl: '/age-gate'
+});
+
+sp.verify({ sessionId: generateUUID() });
+```
+
+### New-Tab Mode
+Verification opens in a popup window:
+
+```javascript
+const sp = new SafePassage({
+  apiKey: 'pk_live_xxxxx',
+  returnUrl: '/age-verified',
+  cancelUrl: '/age-gate',
+  mode: 'new-tab',
+  onComplete: (result) => {
+    console.log('Verified:', result.sessionId);
+    // Validate on your server!
+  },
+  onCancel: () => {
+    console.log('User cancelled');
+  }
+});
+
+sp.verify({ sessionId: generateUUID() });
+```
+
+## Server-Side Validation (Required!)
+
+Always validate the session on your server:
+
+```javascript
+// Node.js example
+const response = await fetch('https://api.safepassageapp.com/v1/sessions/validate', {
+  method: 'POST',
+  headers: {
+    'Authorization': 'Bearer sk_live_xxxxx', // Secret key
+    'Content-Type': 'application/json'
+  },
+  body: JSON.stringify({ sessionId })
+});
+
+const result = await response.json();
+if (result.verified && result.estimatedAge >= result.challengeAge) {
+  // Grant access
+}
+```
+
+## UUID Generation
+
+You must generate session IDs on your end:
+
+```javascript
+function generateUUID() {
+  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
+    const r = Math.random() * 16 | 0;
+    const v = c === 'x' ? r : (r & 0x3 | 0x8);
+    return v.toString(16);
+  });
+}
+```
+
+## Complete Example
+
+```html
+<!DOCTYPE html>
+<html>
+<head>
+  <!-- Install via NPM: npm install @safepassage/sdk -->
+  <script src="node_modules/@safepassage/sdk/dist/safepassage.min.js"></script>
+</head>
+<body>
+  <button onclick="verifyAge()">Verify Your Age</button>
+
+  <script>
+    function generateUUID() {
+      return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
+        const r = Math.random() * 16 | 0;
+        const v = c === 'x' ? r : (r & 0x3 | 0x8);
+        return v.toString(16);
+      });
+    }
+
+    const sp = new SafePassage({
+      apiKey: 'pk_live_xxxxx',
+      returnUrl: window.location.href + '?verified=true',
+      cancelUrl: window.location.href
+    });
+
+    function verifyAge() {
+      const sessionId = generateUUID();
+      sessionStorage.setItem('pendingVerification', sessionId);
+      sp.verify({ sessionId });
+    }
+
+    // Check if returning from verification
+    const urlParams = new URLSearchParams(window.location.search);
+    if (urlParams.get('verified') === 'true') {
+      const sessionId = sessionStorage.getItem('pendingVerification');
+      // Validate session server-side here
+      console.log('Validate session:', sessionId);
+    }
+  </script>
+</body>
+</html>
+```
+
+## TypeScript
+
+Full TypeScript support included:
+
+```typescript
+import { SafePassage, SafePassageConfig } from '@safepassage/sdk';
+
+const config: SafePassageConfig = {
+  apiKey: process.env.SAFEPASSAGE_PUBLIC_KEY!,
+  returnUrl: '/verified',
+  cancelUrl: '/cancelled'
+};
+
+const sp = new SafePassage(config);
+```
+
+## Migration from v2 (iframe)
+
+Old iframe approach (1000+ lines):
+```javascript
+// Complex iframe setup...
+```
+
+New redirect approach (10 lines):
+```javascript
+const sp = new SafePassage({
+  apiKey: 'pk_live_xxxxx',
+  returnUrl: '/verified',
+  cancelUrl: '/cancelled'
+});
+sp.verify({ sessionId: generateUUID() });
+```
+
+## Browser Support
+
+- Chrome 60+
+- Firefox 60+
+- Safari 12+
+- Edge 79+
+- Mobile browsers
+
+## Security Notes
+
+1. Always generate session IDs on the merchant side
+2. Validate sessions server-side before granting access
+3. Pre-register callback URLs in your dashboard
+4. Never expose your secret key (sk_live_xxx)

package/dist/components/SafePassageVerification.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+import type { SafePassageOptions } from '../types';
+declare const SafePassageVerification: React.FC<SafePassageOptions>;
+export default SafePassageVerification;

package/dist/components/SafePassageVerification.js

@@ -0,0 +1,196 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useSafePassage } from '../hooks/useSafePassage';
+const SafePassageVerification = ({ wsUrl, mode = 'enhanced_verification', maxReconnectAttempts = 5, reconnectDelay = 3000, frameRate = 10, imageQuality = 0.8, config_overrides, onSuccess, onFailure, onStateChange, customMessages, className = '', style = {} }) => {
+    const { error, feedback, processingStep, zoneTransition, qualityScore, videoRef, canvasRef, isSessionStarted } = useSafePassage({
+        wsUrl,
+        mode,
+        maxReconnectAttempts,
+        reconnectDelay,
+        frameRate,
+        imageQuality,
+        config_overrides
+    }, {
+        onSuccess,
+        onFailure,
+        onStateChange
+    }, customMessages);
+    const getDisplayMessage = () => {
+        if (zoneTransition) {
+            return zoneTransition.message;
+        }
+        if (feedback && !processingStep) {
+            return feedback;
+        }
+        if (processingStep) {
+            return processingStep;
+        }
+        if (!isSessionStarted) {
+            return 'Starting camera...';
+        }
+        return 'Position your face in the camera and look forward';
+    };
+    const getMessageClass = () => {
+        if (zoneTransition)
+            return 'safepassage-instruction-zone-transition';
+        if (feedback && !processingStep)
+            return 'safepassage-instruction-feedback';
+        if (processingStep)
+            return 'safepassage-instruction-processing';
+        return 'safepassage-instruction-default';
+    };
+    // Calculate glow intensity based on quality score and feedback
+    const getGlowIntensity = () => {
+        // Base glow on quality score (0-1)
+        let intensity = qualityScore;
+        // Boost intensity for positive feedback (both generic and zone-specific)
+        if (feedback === 'good_position' ||
+            feedback === 'good_wide_position' ||
+            feedback === 'good_close_position') {
+            intensity = Math.max(intensity, 0.9);
+        }
+        // Medium intensity for zone positioning messages
+        if (feedback === 'position_at_comfortable_distance' ||
+            feedback === 'move_closer_to_camera') {
+            intensity = Math.max(intensity, 0.6);
+        }
+        // Reduce intensity for negative feedback
+        if (feedback === 'no_face_detected' ||
+            feedback === 'move_closer' ||
+            feedback === 'move_further' ||
+            feedback === 'center_face' ||
+            feedback === 'improve_lighting') {
+            intensity = Math.min(intensity, 0.3);
+        }
+        // Special handling for zone transitions - pulse effect
+        if (zoneTransition) {
+            intensity = Math.max(intensity, 0.7);
+        }
+        // Clamp between 0 and 1
+        return Math.max(0, Math.min(1, intensity));
+    };
+    const glowIntensity = getGlowIntensity();
+    return (_jsxs("div", { className: `safepassage-verification-container ${className}`, style: style, children: [_jsxs("div", { className: "safepassage-video-container", children: [_jsx("video", { ref: videoRef, autoPlay: true, playsInline: true, className: "safepassage-verification-video" }), _jsx("div", { className: "safepassage-video-overlay", children: _jsx("div", { className: "safepassage-oval-frame", style: {
+                                '--glow-intensity': glowIntensity,
+                                '--glow-opacity': glowIntensity > 0.1 ? glowIntensity : 0
+                            } }) })] }), _jsx("div", { className: "safepassage-instructions-area", children: _jsx("div", { className: `safepassage-instruction-text ${getMessageClass()}`, children: getDisplayMessage() }) }), _jsx("canvas", { ref: canvasRef, style: { display: 'none' } }), error && (_jsx("div", { className: "safepassage-error-message", children: error })), _jsx("style", { children: `
+        .safepassage-verification-container {
+          display: flex;
+          flex-direction: column;
+          align-items: center;
+          justify-content: center;
+          width: 100%;
+          min-height: 100vh;
+          margin: 0;
+          padding: 40px 20px;
+          text-align: center;
+          background-color: #2a2a2a;
+          position: fixed;
+          top: 0;
+          left: 0;
+          right: 0;
+          bottom: 0;
+        }
+        
+        .safepassage-video-container {
+          position: relative;
+          width: 320px;
+          height: 320px;
+          margin-bottom: 40px;
+        }
+        
+        .safepassage-verification-video {
+          width: 100%;
+          height: 100%;
+          object-fit: cover;
+          border-radius: 50%;
+          background-color: #000;
+        }
+        
+        .safepassage-video-overlay {
+          position: absolute;
+          top: 0;
+          left: 0;
+          width: 100%;
+          height: 100%;
+          pointer-events: none;
+        }
+        
+        .safepassage-oval-frame {
+          width: 100%;
+          height: 100%;
+          border: 3px solid #ffffff;
+          border-radius: 50%;
+          box-shadow: 
+            0 0 20px rgba(255, 255, 255, 0.3),
+            0 0 calc(30px * var(--glow-intensity, 0)) rgba(34, 197, 94, calc(var(--glow-opacity, 0) * 0.8)),
+            0 0 calc(50px * var(--glow-intensity, 0)) rgba(34, 197, 94, calc(var(--glow-opacity, 0) * 0.4)),
+            0 0 calc(80px * var(--glow-intensity, 0)) rgba(34, 197, 94, calc(var(--glow-opacity, 0) * 0.2));
+          transition: box-shadow 0.3s ease-out;
+        }
+        
+        .safepassage-instructions-area {
+          width: 100%;
+          max-width: 400px;
+        }
+        
+        .safepassage-instruction-text {
+          font-size: 18px;
+          font-weight: 500;
+          color: #ffffff;
+          text-align: center;
+          line-height: 1.4;
+          min-height: 50px;
+          display: flex;
+          align-items: center;
+          justify-content: center;
+        }
+        
+        .safepassage-instruction-zone-transition {
+          color: #4fc3f7;
+          font-weight: 600;
+          animation: safepassage-pulse 0.5s ease-in-out;
+        }
+        
+        .safepassage-instruction-feedback {
+          color: #ffffff;
+        }
+        
+        .safepassage-instruction-processing {
+          color: #81c784;
+        }
+        
+        .safepassage-instruction-default {
+          color: #ffffff;
+          opacity: 0.9;
+        }
+        
+        .safepassage-error-message {
+          color: #e53e3e;
+          margin-top: 10px;
+        }
+        
+        @keyframes safepassage-pulse {
+          0% { opacity: 0.7; transform: scale(1); }
+          50% { opacity: 1; transform: scale(1.02); }
+          100% { opacity: 0.9; transform: scale(1); }
+        }
+        
+        @media (max-width: 480px) {
+          .safepassage-verification-container {
+            padding: 20px 15px;
+          }
+          
+          .safepassage-video-container {
+            width: 280px;
+            height: 280px;
+            margin-bottom: 30px;
+          }
+          
+          .safepassage-instruction-text {
+            font-size: 16px;
+            min-height: 45px;
+          }
+        }
+      ` })] }));
+};
+export default SafePassageVerification;

package/dist/index.d.ts

@@ -0,0 +1,102 @@
+/**
+ * SafePassage SDK Type Definitions
+ */
+export interface SafePassageConfig {
+    /**
+     * Public API key (starts with pk_live_ or pk_test_)
+     */
+    apiKey: string;
+    /**
+     * URL to redirect to after successful verification
+     * Must be pre-registered in dashboard
+     */
+    returnUrl: string;
+    /**
+     * URL to redirect to if user cancels verification
+     * Must be pre-registered in dashboard
+     */
+    cancelUrl: string;
+    /**
+     * Environment to use
+     * @default Auto-detected based on hostname
+     */
+    environment?: 'production' | 'staging' | 'development';
+    /**
+     * Verification mode
+     * @default 'redirect'
+     */
+    mode?: 'redirect' | 'new-tab';
+    /**
+     * Default challenge age (minimum 25)
+     * Can be overridden per verification
+     */
+    defaultChallengeAge?: number;
+    /**
+     * Default verification mode
+     * Can be overridden per verification
+     */
+    defaultVerificationMode?: 'L1' | 'L2';
+    /**
+     * Callback when verification completes (new-tab mode only)
+     */
+    onComplete?: (result: VerificationResult) => void;
+    /**
+     * Callback when user cancels (new-tab mode only)
+     */
+    onCancel?: () => void;
+    /**
+     * Callback for errors
+     */
+    onError?: (error: Error) => void;
+}
+export interface VerificationOptions {
+    /**
+     * Merchant-generated UUID v4 for this verification session
+     * Required for security - prevents session fixation attacks
+     */
+    sessionId: string;
+    /**
+     * Minimum age to verify (minimum 25)
+     * @default Uses merchant dashboard configuration
+     */
+    challengeAge?: number;
+    /**
+     * Verification mode
+     * L1: Age estimation allowed if user appears older
+     * L2: Full ID verification required
+     * @default Uses merchant dashboard configuration
+     */
+    verificationMode?: 'L1' | 'L2';
+}
+export interface VerificationResult {
+    /**
+     * The session ID that was verified
+     */
+    sessionId: string;
+    /**
+     * Binary result: 'verified' or 'failed'
+     * Full details available via server-side API
+     */
+    status: 'verified' | 'failed' | 'cancelled';
+}
+export interface StatePayload {
+    merchantId: string;
+    sessionId: string;
+    returnUrl: string;
+    cancelUrl: string;
+    challengeAge?: number;
+    verificationMode?: 'L1' | 'L2';
+    timestamp: number;
+}
+export interface SessionValidationResponse {
+    sessionId: string;
+    merchantId: string;
+    status: 'verified' | 'failed';
+    verified: boolean;
+    estimatedAge?: number;
+    challengeAge: number;
+    verificationMode: 'L1' | 'L2';
+    verificationMethod?: 'facial' | 'document' | 'combined';
+    timestamp: string;
+    expiresAt: string;
+}

package/dist/index.js

@@ -0,0 +1,7 @@
+// SafePassage SDK v3.0.0 - Redirect Implementation 
+// Main export for the new redirect-based SDK
+export { SafePassage } from '../src-redirect/core/SafePassageSDK';
+// Re-export for convenience
+export * from '../src-redirect/types';
+// Default export
+export { SafePassage as default } from '../src-redirect/core/SafePassageSDK';

package/dist/safepassage.min.js

@@ -0,0 +1,3 @@
+/* SafePassage SDK v3.0.0 - Redirect Implementation */
+"use strict";var SafePassageSDK=(()=>{var p=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var H=Object.getOwnPropertyNames;var K=Object.prototype.hasOwnProperty;var c=(t,e)=>()=>(t&&(e=t(t=0)),e);var u=(t,e)=>{for(var n in e)p(t,n,{get:e[n],enumerable:!0})},q=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of H(e))!K.call(t,o)&&o!==n&&p(t,o,{get:()=>e[o],enumerable:!(i=W(e,o))||i.enumerable});return t};var I=t=>q(p({},"__esModule",{value:!0}),t);function j(t,e){return E[e].includes(t)}function P(t,e,n=[]){let{origin:i}=t;return j(i,e)||n.length>0&&n.some(r=>{if(r.startsWith("*.")){let a=r.slice(2);return i.endsWith(`.${a}`)||i===`https://${a}`||i===`http://${a}`}return i===r})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:E[e],allowedCustomOrigins:n,eventType:t.data?.type}),!1)}function T(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed","cancelled"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function U(t){if(t==="production"&&window.location.protocol!=="https:"){let e=window.location.href.replace("http:","https:");console.error("SafePassage Security: HTTPS required in production. Redirecting...",{current:window.location.href,redirect:e}),window.location.replace(e)}}function f(t,e){try{let n=new URL(t);if(e==="production"&&n.protocol!=="https:")return{isValid:!1,error:"HTTPS required for return URLs in production"};if(e==="development"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"||n.hostname.endsWith(".local"))&&n.protocol!=="https:")return{isValid:!1,error:"Non-localhost URLs must use HTTPS"};if(e==="staging"&&n.protocol!=="https:")return{isValid:!1,error:"HTTPS required for return URLs in staging"};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let o of i)if(o.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch{return{isValid:!1,error:"Invalid URL format"}}}function s(t,e){console.warn(`SafePassage Security Event: ${t}`,{timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href,...e})}var E,g,V,h=c(()=>{"use strict";E={production:["https://verify.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://verify-staging.safepassageapp.com","https://portal-staging.safepassageapp.com","https://api-staging.safepassageapp.com"],development:["http://localhost:5173","http://localhost:3000","http://localhost:3001","http://localhost:3002","http://127.0.0.1:5173","http://127.0.0.1:3000","http://127.0.0.1:3001","http://127.0.0.1:3002"]};g=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),o=(this.attempts.get(e)||[]).filter(r=>n-r<this.timeWindow);return o.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(o.push(n),this.attempts.set(e,o),!0)}reset(e){this.attempts.delete(e)}},V=new g});var L={};u(L,{createSignedState:()=>J,generateHMAC:()=>m,generateSecureToken:()=>b,getSigningSecret:()=>w,parseSignedState:()=>B,verifyHMAC:()=>A});async function m(t,e){let n=new TextEncoder,i=n.encode(e),o=n.encode(t),r=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),a=await crypto.subtle.sign("HMAC",r,o);return Array.from(new Uint8Array(a)).map(d=>d.toString(16).padStart(2,"0")).join("")}async function A(t,e,n){try{let i=await m(t,n);return F(e,i)}catch{return!1}}function F(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function b(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function w(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025",development:"safepassage-dev-hmac-2025"}[t]}async function J(t,e){let n={...t,timestamp:Date.now(),nonce:b(16)},i=JSON.stringify(n),o=w(e),r=await m(i,o);return btoa(JSON.stringify({data:n,signature:r}))}async function B(t,e,n=10*60*1e3){try{let i=atob(t),o=JSON.parse(i);if(!o.data||!o.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:r,signature:a}=o,d=JSON.stringify(r),k=w(e);if(!await A(d,a,k))return console.warn("SafePassage: State signature verification failed"),null;if(r.timestamp){let y=Date.now()-r.timestamp;if(y>n)return console.warn("SafePassage: State parameter expired",{age:y,maxAge:n}),null}let{timestamp:ne,nonce:ie,...$}=r;return $}catch(i){return console.warn("SafePassage: Failed to parse signed state",i),null}}var x=c(()=>{"use strict"});function C(t){if(!t.apiKey)throw new Error("apiKey is required");if(!G.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx or sk_xxx");if(!t.returnUrl)throw new Error("returnUrl is required");if(!t.cancelUrl)throw new Error("cancelUrl is required");let e=Y(),n=f(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);let i=f(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`);if(t.defaultChallengeAge!==void 0&&t.defaultChallengeAge<M)throw new Error(`defaultChallengeAge must be at least ${M}`);if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function Y(){let t=window.location.hostname;return t==="localhost"||t==="127.0.0.1"||t.includes(".local")?"development":t.includes("staging")||t.includes("stage")?"staging":"production"}async function R(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(x(),L));return n(t,e)}var M,G,O=c(()=>{"use strict";h();M=25,G=/^(pk|sk)_[a-zA-Z0-9]+$/});function v(t){let e=Z[t];if((t==="production"||t==="staging")&&!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function z(t){let n={production:"https://api.safepassageapp.com",staging:"https://api-staging.safepassageapp.com",development:"http://localhost:3001"}[t];if((t==="production"||t==="staging")&&!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function D(t){let e=window.location.protocol==="https:",n=window.location.hostname;switch(t){case"production":if(!e)throw new Error("SafePassage requires HTTPS in production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break;case"development":let i=n==="localhost"||n==="127.0.0.1"||n.includes(".local");!e&&!i&&console.warn("SafePassage Warning: HTTPS recommended for non-localhost development");break}try{v(t),z(t)}catch(i){throw new Error(`Environment configuration validation failed: ${i}`)}}var Z,N=c(()=>{"use strict";Z={production:"https://verify.safepassageapp.com",staging:"https://verify-staging.safepassageapp.com",development:"http://localhost:5173"}});var _={};u(_,{SafePassage:()=>l,default:()=>X});var l,X,S=c(()=>{"use strict";O();N();h();l=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;C(e),this.config={...e,environment:e.environment||this.detectEnvironment(),mode:e.mode||"redirect"},D(this.config.environment),U(this.config.environment),s("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e){if(!e.sessionId)throw new Error("sessionId is required - must be a merchant-generated UUID v4");if(this.isVerificationInProgress){let n=new Error(`Verification already in progress for session ${this.currentSessionId?.substring(0,8)}...`);throw s("RACE_CONDITION_PREVENTED",{currentSession:this.currentSessionId?.substring(0,8)+"...",attemptedSession:e.sessionId.substring(0,8)+"...",origin:window.location.origin}),this.config.onError?.(n),n}this.isVerificationInProgress=!0,this.currentSessionId=e.sessionId;try{let n=`${this.config.apiKey}:${window.location.origin}`;if(!V.isAllowed(n)){let o=new Error("Too many verification attempts. Please wait before trying again.");throw s("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:e.sessionId.substring(0,8)+"..."}),this.config.onError?.(o),o}let i=await this.buildVerificationUrl(e);s("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:e.sessionId.substring(0,8)+"...",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(i,e.sessionId):(this.unlockVerification(),this.redirect(i))}catch(n){throw this.unlockVerification(),n}}async buildVerificationUrl(e){let n=v(this.config.environment),i=await R({merchantId:this.config.apiKey,sessionId:e.sessionId,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,timestamp:Date.now()},this.config.environment),o=new URLSearchParams({state:i,sessionId:e.sessionId,mode:this.config.mode});return`${n}/verify?${o.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){this.config.onError?.(new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=i=>{if(!P(i,this.config.environment)){s("POSTMESSAGE_ORIGIN_BLOCKED",{origin:i.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:i.data?.type});return}let o=T(i,n);if(!o.isValid){s("POSTMESSAGE_VALIDATION_FAILED",{error:o.error,origin:i.origin,sessionId:n.substring(0,8)+"...",messageType:i.data?.type});return}let r={sessionId:i.data.sessionId,status:i.data.status};s("VERIFICATION_COMPLETED",{status:r.status,sessionId:n.substring(0,8)+"...",origin:i.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),r.status==="verified"?this.config.onComplete?.(r):r.status==="cancelled"?this.config.onCancel?.():this.config.onError?.(new Error(`Verification failed: ${r.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{this.popupWindow&&this.popupWindow.closed&&(s("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),this.config.onCancel?.())},500)}setupAutoCleanup(){if(this.unloadListener=()=>{s("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e==="localhost"||e==="127.0.0.1"||e.includes(".local")?"development":e.includes("staging")||e.includes("stage")?"staging":"production"}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,s("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){s("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}},X=l});var ee={};u(ee,{SafePassage:()=>l,VERSION:()=>Q,default:()=>l});S();var Q="3.0.0";typeof window<"u"&&window&&(window.SafePassage=(S(),I(_)).SafePassage);return I(ee);})();
+if(typeof SafePassageSDK !== "undefined" && SafePassageSDK.SafePassage) { window.SafePassage = SafePassageSDK.SafePassage; }

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@safepassage/sdk",
+  "version": "3.0.0",
+  "description": "SafePassage SDK - Lightweight redirect-based age verification",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc && node build-sdk.js",
+    "dev": "tsc --watch",
+    "demo": "python3 -m http.server 8080",
+    "serve-demo": "npx serve . -p 8080",
+    "test": "jest --config test/jest.config.js",
+    "test:browser": "jest --config test/jest.config.js test/browser-compat",
+    "test:mobile": "jest --config test/jest.config.js test/mobile",
+    "test:performance": "jest --config test/jest.config.js test/performance",
+    "test:security": "jest --config test/jest.config.js test/security",
+    "test:accessibility": "jest --config test/jest.config.js test/accessibility",
+    "test:edge": "jest --config test/jest.config.js test/edge-cases",
+    "test:integration": "jest --config test/jest.config.js test/integration",
+    "test:all": "node test/run-tests.js",
+    "test:coverage": "jest --config test/jest.config.js --coverage",
+    "benchmark": "node test/performance/benchmark.js",
+    "prepublishOnly": "npm run build",
+    "version": "npm run build && git add -A dist",
+    "postversion": "git push && git push --tags"
+  },
+  "keywords": [
+    "safepassage",
+    "age-verification",
+    "redirect",
+    "sdk",
+    "typescript",
+    "lightweight"
+  ],
+  "author": "SafePassage",
+  "license": "MIT",
+  "devDependencies": {
+    "@babel/core": "^7.27.4",
+    "@babel/preset-env": "^7.27.2",
+    "@types/jest": "^29.5.12",
+    "@types/node": "^24.0.1",
+    "babel-jest": "^30.0.0",
+    "esbuild": "^0.25.5",
+    "jest": "^29.7.0",
+    "jest-environment-jsdom": "^29.7.0",
+    "puppeteer": "^21.11.0",
+    "terser": "^5.42.0",
+    "ts-jest": "^29.1.2",
+    "typescript": "~5.8.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/safepassage/safepassage-monorepo",
+    "directory": "services/verify-ui/sdk"
+  },
+  "bugs": {
+    "url": "https://github.com/safepassage/safepassage-monorepo/issues"
+  },
+  "homepage": "https://safepassageapp.com/docs/sdk",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "engines": {
+    "node": ">=14.0.0"
+  }
+}