@safepassage/sdk 3.0.14 → 3.1.0

package/dist/core/SafePassageSDK.d.ts

@@ -126,16 +126,17 @@ export declare class SafePassage {
      *
      * Analyzes the current hostname to determine the appropriate environment
      * configuration. Used when environment is not explicitly specified.
+     * Always defaults to production unless staging is detected.
      *
-     * @returns {'production' | 'staging' | 'development'} Detected environment
+     * @returns {'production' | 'staging'} Detected environment
      * @private
      */
     private detectEnvironment;
     /**
      * Get the current environment
-     * @returns {string} The current environment (production, staging, or development)
+     * @returns {string} The current environment (production or staging)
      */
-    getEnvironment(): 'production' | 'staging' | 'development';
+    getEnvironment(): 'production' | 'staging';
     /**
      * Unlock verification process to allow new verifications
      *

package/dist/core/SafePassageSDK.js

@@ -361,17 +361,13 @@ export class SafePassage {
      *
      * Analyzes the current hostname to determine the appropriate environment
      * configuration. Used when environment is not explicitly specified.
+     * Always defaults to production unless staging is detected.
      *
-     * @returns {'production' | 'staging' | 'development'} Detected environment
+     * @returns {'production' | 'staging'} Detected environment
      * @private
      */
     detectEnvironment() {
         const hostname = window.location.hostname;
-        if (hostname === 'localhost' ||
-            hostname === '127.0.0.1' ||
-            hostname.includes('.local')) {
-            return 'development';
-        }
         if (hostname.includes('staging') || hostname.includes('stage')) {
             return 'staging';
         }
@@ -379,7 +375,7 @@ export class SafePassage {
     }
     /**
      * Get the current environment
-     * @returns {string} The current environment (production, staging, or development)
+     * @returns {string} The current environment (production or staging)
      */
     getEnvironment() {
         return this.config.environment;
@@ -471,8 +467,6 @@ export class SafePassage {
      */
     getPortalApiUrl() {
         switch (this.config.environment) {
-            case 'development':
-                return 'http://localhost:3001';
             case 'staging':
                 return 'https://api.staging.safepassageapp.com';
             case 'production':
@@ -492,8 +486,6 @@ export class SafePassage {
      */
     getEngineUrl() {
         switch (this.config.environment) {
-            case 'development':
-                return 'http://localhost:8000';
             case 'staging':
                 return 'https://engine.staging.safepassageapp.com';
             case 'production':
@@ -514,8 +506,6 @@ export class SafePassage {
      */
     getWebSocketUrl() {
         switch (this.config.environment) {
-            case 'development':
-                return 'ws://localhost:8000/api/websocket/stream';
             case 'staging':
                 return 'wss://engine.staging.safepassageapp.com/api/websocket/stream';
             case 'production':

package/dist/index.d.ts

@@ -18,4 +18,4 @@
  */
 export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
 export type { SafePassageConfig, VerificationOptions, VerificationResult, SessionValidationResponse, } from './types';
-export declare const VERSION = "3.0.13";
+export declare const VERSION = "3.0.15";

package/dist/index.js

@@ -24,8 +24,8 @@ if (typeof window !== 'undefined') {
     checkBrowserCompatibility();
 }
 export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
-// Version - Updated to reflect security improvements
-export const VERSION = '3.0.13';
+// Version - Updated for handoffToken QR code fix
+export const VERSION = '3.0.15';
 // For UMD builds
 if (typeof window !== 'undefined' && window) {
     // Dynamic import for UMD builds

package/dist/safepassage.min.js

@@ -1,3 +1,3 @@
-/* SafePassage SDK v3.0.14 - Redirect Implementation with Enhanced Security */
-"use strict";var SafePassageSDK=(()=>{var u=Object.defineProperty;var J=Object.getOwnPropertyDescriptor;var X=Object.getOwnPropertyNames;var Y=Object.prototype.hasOwnProperty;var p=(t,e)=>()=>(t&&(e=t(t=0)),e);var g=(t,e)=>{for(var n in e)u(t,n,{get:e[n],enumerable:!0})},z=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of X(e))!Y.call(t,r)&&r!==n&&u(t,r,{get:()=>e[r],enumerable:!(i=J(e,r))||i.enumerable});return t};var P=t=>z(u({},"__esModule",{value:!0}),t);function Z(t,e){return b[e].includes(t)}function T(t,e,n=[]){let{origin:i}=t;return Z(i,e)||n.length>0&&n.some(o=>{if(o.startsWith("*.")){let s=o.slice(2);return i.endsWith(`.${s}`)||i===`https://${s}`||i===`http://${s}`}return i===o})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:b[e],allowedCustomOrigins:n,eventType:t.data?.type}),!1)}function x(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed","cancelled"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function V(t){if(t==="production"&&window.location.protocol!=="https:"){let e=window.location.href.replace("http:","https:");console.error("SafePassage Security: HTTPS required in production. Redirecting...",{current:window.location.href,redirect:e}),window.location.replace(e)}}function h(t,e){try{let n=new URL(t);if(e==="production"&&n.protocol!=="https:")return{isValid:!1,error:"HTTPS required for return URLs in production"};if(e==="development"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"||n.hostname.endsWith(".local"))&&n.protocol!=="https:")return{isValid:!1,error:"Non-localhost URLs must use HTTPS"};if(e==="staging"&&n.protocol!=="https:")return{isValid:!1,error:"HTTPS required for return URLs in staging"};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let r of i)if(r.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch{return{isValid:!1,error:"Invalid URL format"}}}function L(){if(crypto.randomUUID)return crypto.randomUUID();let t=new Uint8Array(16);crypto.getRandomValues(t);let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),"4"+e.slice(13,16),(parseInt(e.slice(16,17),16)&3|8).toString(16)+e.slice(17,20),e.slice(20,32)].join("-")}function a(t,e){console.warn(`SafePassage Security Event: ${t}`,{timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href,...e})}var b,f,M,m=p(()=>{"use strict";b={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av-staging.safepassageapp.com","https://portal-staging.safepassageapp.com","https://api-staging.safepassageapp.com"],development:["http://localhost:5173","http://localhost:3000","http://localhost:3001","http://localhost:3002","http://127.0.0.1:5173","http://127.0.0.1:3000","http://127.0.0.1:3001","http://127.0.0.1:3002"]};f=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),r=(this.attempts.get(e)||[]).filter(o=>n-o<this.timeWindow);return r.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(r.push(n),this.attempts.set(e,r),!0)}reset(e){this.attempts.delete(e)}},M=new f});var C={};g(C,{createSignedState:()=>ee,generateHMAC:()=>w,generateSecureToken:()=>R,getSigningSecret:()=>v,parseSignedState:()=>te,verifyHMAC:()=>k});async function w(t,e){let n=new TextEncoder,i=n.encode(e),r=n.encode(t),o=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),s=await crypto.subtle.sign("HMAC",o,r);return Array.from(new Uint8Array(s)).map(l=>l.toString(16).padStart(2,"0")).join("")}async function k(t,e,n){try{let i=await w(t,n);return Q(e,i)}catch{return!1}}function Q(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function R(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function v(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025",development:"safepassage-dev-hmac-2025"}[t]}async function ee(t,e){let n={...t,timestamp:Date.now(),nonce:R(16)},i=JSON.stringify(n),r=v(e),o=await w(i,r);return btoa(JSON.stringify({data:n,signature:o}))}async function te(t,e,n=O){try{let i=atob(t),r=JSON.parse(i);if(!r.data||!r.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:o,signature:s}=r,l=JSON.stringify(o),B=v(e);if(!await k(l,s,B))return console.warn("SafePassage: State signature verification failed"),null;if(o.timestamp){let E=Date.now()-o.timestamp;if(E>n)return console.warn("SafePassage: State parameter expired",{age:E,maxAge:n}),null}let{timestamp:le,nonce:pe,...G}=o;return G}catch(i){return console.warn("SafePassage: Failed to parse signed state",i),null}}var _=p(()=>{"use strict";S()});function K(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>N)throw new Error(`apiKey exceeds maximum length of ${N} characters`);if(!ne.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window<"u"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>d)throw new Error(`returnUrl exceeds maximum length of ${d} characters`);if(!t.cancelUrl)throw new Error("cancelUrl is required");if(t.cancelUrl.length>d)throw new Error(`cancelUrl exceeds maximum length of ${d} characters`);let e=ie(),n=h(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);let i=h(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`);if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<$)throw new Error(`defaultChallengeAge must be at least ${$}`);if(t.defaultChallengeAge>D)throw new Error(`defaultChallengeAge cannot exceed ${D}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function ie(){if(typeof window>"u")return"production";let t=window.location.hostname;return t==="localhost"||t==="127.0.0.1"||t.includes(".local")?"development":t.includes("staging")||t.includes("stage")?"staging":"production"}async function W(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(_(),C));return n(t,e)}var $,D,d,N,O,ne,S=p(()=>{"use strict";m();$=25,D=150,d=2048,N=128,O=6e5,ne=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function y(t){let e=re[t];if((t==="production"||t==="staging")&&!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function oe(t){let n={production:"https://api.safepassageapp.com",staging:"https://api-staging.safepassageapp.com",development:"http://localhost:3001"}[t];if((t==="production"||t==="staging")&&!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function H(t){let e=window.location.protocol==="https:",n=window.location.hostname;switch(t){case"production":if(!e)throw new Error("SafePassage requires HTTPS in production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break;case"development":{let i=n==="localhost"||n==="127.0.0.1"||n.includes(".local");!e&&!i&&console.warn("SafePassage Warning: HTTPS recommended for non-localhost development");break}}try{y(t),oe(t)}catch(i){throw new Error(`Environment configuration validation failed: ${i}`)}}var re,q=p(()=>{"use strict";re={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com",development:"http://localhost:5173"}});var j={};g(j,{SafePassage:()=>c,default:()=>se});var c,se,I=p(()=>{"use strict";S();q();m();c=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;K(e),this.config={...e,environment:e.environment||this.detectEnvironment(),mode:e.mode||"redirect"},H(this.config.environment),V(this.config.environment),a("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){let n=this.isPublicKey(),i=e.sessionId;if(n&&!i&&(i=await this.createInternalSession(e)),!n&&!i)throw new Error("sessionId is required for private API keys - must be a merchant-generated UUID v4");if(!i)throw new Error("Failed to create or obtain sessionId");if(this.isVerificationInProgress){let r=new Error(`Verification already in progress for session ${this.currentSessionId?.substring(0,8)}...`);throw a("RACE_CONDITION_PREVENTED",{currentSession:this.currentSessionId?.substring(0,8)+"...",attemptedSession:e.sessionId?e.sessionId.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.onError?.(r),r}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let r=`${this.config.apiKey}:${window.location.origin}`;if(!M.isAllowed(r)){let s=new Error("Too many verification attempts. Please wait before trying again.");throw a("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),this.config.onError?.(s),s}let o=await this.buildVerificationUrl({...e,sessionId:i});a("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(o,i):(this.unlockVerification(),this.redirect(o))}catch(r){throw this.unlockVerification(),r}}async buildVerificationUrl(e){let n=y(this.config.environment),i=e.challengeAge!==void 0,r=e.verificationMode!==void 0,o=i||r,s=await W({merchantId:this.config.apiKey,sessionId:e.sessionId,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this._temporaryHandoffToken},this.config.environment),l=new URLSearchParams({state:s,sessionId:e.sessionId,mode:this.config.mode});return`${n}/?${l.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){this.config.onError?.(new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=i=>{if(!T(i,this.config.environment)){a("POSTMESSAGE_ORIGIN_BLOCKED",{origin:i.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:i.data?.type});return}let r=x(i,n);if(!r.isValid){a("POSTMESSAGE_VALIDATION_FAILED",{error:r.error,origin:i.origin,sessionId:n.substring(0,8)+"...",messageType:i.data?.type});return}let o={sessionId:i.data.sessionId,status:i.data.status};a("VERIFICATION_COMPLETED",{status:o.status,sessionId:n.substring(0,8)+"...",origin:i.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),o.status==="verified"?this.config.onComplete?.(o):o.status==="cancelled"?this.config.onCancel?.():this.config.onError?.(new Error(`Verification failed: ${o.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{this.popupWindow&&this.popupWindow.closed&&(a("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),this.config.onCancel?.())},500)}setupAutoCleanup(){if(this.unloadListener=()=>{a("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e==="localhost"||e==="127.0.0.1"||e.includes(".local")?"development":e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,a("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){a("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"development":return"http://localhost:3001";case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"development":return"http://localhost:8000";case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"development":return"ws://localhost:8000/api/websocket/stream";case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){let n=L();try{let i=this.getPortalApiUrl(),r=await fetch(`${i}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!r.ok){let s=await r.json().catch(()=>({}));throw new Error(`Failed to create session: ${r.status} ${r.statusText}. ${s.message||""}`)}let o=await r.json();return o.handoffToken&&(this._temporaryHandoffToken=o.handoffToken),a("INTERNAL_SESSION_CREATED",{sessionId:n.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),n}catch(i){let r=i instanceof Error?i.message:String(i);throw a("INTERNAL_SESSION_FAILED",{error:r,environment:this.config.environment,apiKeyType:"public"}),this.config.onError?.(i),new Error(`Failed to create verification session: ${r}`)}}},se=c});var ae={};g(ae,{SafePassage:()=>c,VERSION:()=>F,default:()=>c});function U(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function A(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support");try{if({a:{b:1}}?.a?.b!==1)throw new Error}catch{t.push("Optional chaining (?.) not supported, ensure transpilation for older browsers")}t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}I();typeof window<"u"&&(U(),A());var F="3.0.13";if(typeof window<"u"&&window){let{SafePassage:t}=(I(),P(j)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=F)}return P(ae);})();
+/* SafePassage SDK v3.0.15 - Redirect Implementation with Enhanced Security */
+"use strict";var SafePassageSDK=(()=>{var g=Object.defineProperty;var J=Object.getOwnPropertyDescriptor;var X=Object.getOwnPropertyNames;var Y=Object.prototype.hasOwnProperty;var p=(t,e)=>()=>(t&&(e=t(t=0)),e);var u=(t,e)=>{for(var n in e)g(t,n,{get:e[n],enumerable:!0})},z=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of X(e))!Y.call(t,r)&&r!==n&&g(t,r,{get:()=>e[r],enumerable:!(i=J(e,r))||i.enumerable});return t};var P=t=>z(g({},"__esModule",{value:!0}),t);function Z(t,e){return b[e].includes(t)}function x(t,e,n=[]){let{origin:i}=t;return Z(i,e)||n.length>0&&n.some(s=>{if(s.startsWith("*.")){let o=s.slice(2);return i.endsWith(`.${o}`)||i===`https://${o}`||i===`http://${o}`}return i===s})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:b[e],allowedCustomOrigins:n,eventType:t.data?.type}),!1)}function T(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed","cancelled"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function V(t){t==="production"&&window.location.protocol!=="https:"&&console.warn("SafePassage Warning: HTTPS recommended for production environment",{current:window.location.href})}function h(t,e){try{if(new URL(t).protocol!=="https:")return{isValid:!1,error:`HTTPS required for return URLs in ${e}`};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let r of i)if(r.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch{return{isValid:!1,error:"Invalid URL format"}}}function M(){if(crypto.randomUUID)return crypto.randomUUID();let t=new Uint8Array(16);crypto.getRandomValues(t);let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),"4"+e.slice(13,16),(parseInt(e.slice(16,17),16)&3|8).toString(16)+e.slice(17,20),e.slice(20,32)].join("-")}function a(t,e){console.warn(`SafePassage Security Event: ${t}`,{timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href,...e})}var b,f,k,m=p(()=>{"use strict";b={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av.staging.safepassageapp.com","https://portal.staging.safepassageapp.com","https://api.staging.safepassageapp.com"]};f=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),r=(this.attempts.get(e)||[]).filter(s=>n-s<this.timeWindow);return r.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(r.push(n),this.attempts.set(e,r),!0)}reset(e){this.attempts.delete(e)}},k=new f});var _={};u(_,{createSignedState:()=>ee,generateHMAC:()=>w,generateSecureToken:()=>C,getSigningSecret:()=>v,parseSignedState:()=>te,verifyHMAC:()=>L});async function w(t,e){let n=new TextEncoder,i=n.encode(e),r=n.encode(t),s=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",s,r);return Array.from(new Uint8Array(o)).map(l=>l.toString(16).padStart(2,"0")).join("")}async function L(t,e,n){try{let i=await w(t,n);return Q(e,i)}catch{return!1}}function Q(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function C(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function v(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025"}[t]}async function ee(t,e){let n={...t,timestamp:Date.now(),nonce:C(16)},i=JSON.stringify(n),r=v(e),s=await w(i,r);return btoa(JSON.stringify({data:n,signature:s}))}async function te(t,e,n=O){try{let i=atob(t),r=JSON.parse(i);if(!r.data||!r.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:s,signature:o}=r,l=JSON.stringify(s),B=v(e);if(!await L(l,o,B))return console.warn("SafePassage: State signature verification failed"),null;if(s.timestamp){let E=Date.now()-s.timestamp;if(E>n)return console.warn("SafePassage: State parameter expired",{age:E,maxAge:n}),null}let{timestamp:le,nonce:pe,...G}=s;return G}catch(i){return console.warn("SafePassage: Failed to parse signed state",i),null}}var R=p(()=>{"use strict";S()});function K(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>N)throw new Error(`apiKey exceeds maximum length of ${N} characters`);if(!ne.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window<"u"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>d)throw new Error(`returnUrl exceeds maximum length of ${d} characters`);if(!t.cancelUrl)throw new Error("cancelUrl is required");if(t.cancelUrl.length>d)throw new Error(`cancelUrl exceeds maximum length of ${d} characters`);let e=ie(),n=h(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);let i=h(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`);if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<$)throw new Error(`defaultChallengeAge must be at least ${$}`);if(t.defaultChallengeAge>D)throw new Error(`defaultChallengeAge cannot exceed ${D}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function ie(){if(typeof window>"u")return"production";let t=window.location.hostname;return t.includes("staging")||t.includes("stage")?"staging":"production"}async function W(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(R(),_));return n(t,e)}var $,D,d,N,O,ne,S=p(()=>{"use strict";m();$=25,D=150,d=2048,N=128,O=6e5,ne=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function y(t){let e=re[t];if(!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function se(t){let n={production:"https://api.safepassageapp.com",staging:"https://api.staging.safepassageapp.com"}[t];if(!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function H(t){let e=window.location.protocol==="https:";switch(t){case"production":e||console.warn("SafePassage Warning: HTTPS recommended for production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break}try{y(t),se(t)}catch(n){throw new Error(`Environment configuration validation failed: ${n}`)}}var re,q=p(()=>{"use strict";re={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com"}});var j={};u(j,{SafePassage:()=>c,default:()=>oe});var c,oe,I=p(()=>{"use strict";S();q();m();c=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;K(e),this.config={...e,environment:e.environment||this.detectEnvironment(),mode:e.mode||"redirect"},H(this.config.environment),V(this.config.environment),a("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){let n=this.isPublicKey(),i=e.sessionId;if(n&&!i&&(i=await this.createInternalSession(e)),!n&&!i)throw new Error("sessionId is required for private API keys - must be a merchant-generated UUID v4");if(!i)throw new Error("Failed to create or obtain sessionId");if(this.isVerificationInProgress){let r=new Error(`Verification already in progress for session ${this.currentSessionId?.substring(0,8)}...`);throw a("RACE_CONDITION_PREVENTED",{currentSession:this.currentSessionId?.substring(0,8)+"...",attemptedSession:e.sessionId?e.sessionId.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.onError?.(r),r}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let r=`${this.config.apiKey}:${window.location.origin}`;if(!k.isAllowed(r)){let o=new Error("Too many verification attempts. Please wait before trying again.");throw a("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),this.config.onError?.(o),o}let s=await this.buildVerificationUrl({...e,sessionId:i});a("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(s,i):(this.unlockVerification(),this.redirect(s))}catch(r){throw this.unlockVerification(),r}}async buildVerificationUrl(e){let n=y(this.config.environment),i=e.challengeAge!==void 0,r=e.verificationMode!==void 0,s=i||r,o=await W({merchantId:this.config.apiKey,sessionId:e.sessionId,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:s,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this._temporaryHandoffToken},this.config.environment),l=new URLSearchParams({state:o,sessionId:e.sessionId,mode:this.config.mode});return`${n}/?${l.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){this.config.onError?.(new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=i=>{if(!x(i,this.config.environment)){a("POSTMESSAGE_ORIGIN_BLOCKED",{origin:i.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:i.data?.type});return}let r=T(i,n);if(!r.isValid){a("POSTMESSAGE_VALIDATION_FAILED",{error:r.error,origin:i.origin,sessionId:n.substring(0,8)+"...",messageType:i.data?.type});return}let s={sessionId:i.data.sessionId,status:i.data.status};a("VERIFICATION_COMPLETED",{status:s.status,sessionId:n.substring(0,8)+"...",origin:i.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),s.status==="verified"?this.config.onComplete?.(s):s.status==="cancelled"?this.config.onCancel?.():this.config.onError?.(new Error(`Verification failed: ${s.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{this.popupWindow&&this.popupWindow.closed&&(a("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),this.config.onCancel?.())},500)}setupAutoCleanup(){if(this.unloadListener=()=>{a("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,a("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){a("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){let n=M();try{let i=this.getPortalApiUrl(),r=await fetch(`${i}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!r.ok){let o=await r.json().catch(()=>({}));throw new Error(`Failed to create session: ${r.status} ${r.statusText}. ${o.message||""}`)}let s=await r.json();return s.handoffToken&&(this._temporaryHandoffToken=s.handoffToken),a("INTERNAL_SESSION_CREATED",{sessionId:n.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),n}catch(i){let r=i instanceof Error?i.message:String(i);throw a("INTERNAL_SESSION_FAILED",{error:r,environment:this.config.environment,apiKeyType:"public"}),this.config.onError?.(i),new Error(`Failed to create verification session: ${r}`)}}},oe=c});var ae={};u(ae,{SafePassage:()=>c,VERSION:()=>F,default:()=>c});function U(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function A(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support");try{if({a:{b:1}}?.a?.b!==1)throw new Error}catch{t.push("Optional chaining (?.) not supported, ensure transpilation for older browsers")}t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}I();typeof window<"u"&&(U(),A());var F="3.0.15";if(typeof window<"u"&&window){let{SafePassage:t}=(I(),P(j)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=F)}return P(ae);})();
 if(typeof SafePassageSDK !== "undefined" && SafePassageSDK.SafePassage) { window.SafePassage = SafePassageSDK.SafePassage; window.SafePassage.VERSION = SafePassageSDK.VERSION; }

package/dist/types/index.d.ts

@@ -18,9 +18,9 @@ export interface SafePassageConfig {
     cancelUrl: string;
     /**
      * Environment to use
-     * @default Auto-detected based on hostname
+     * @default Auto-detected based on hostname (production unless staging detected)
      */
-    environment?: 'production' | 'staging' | 'development';
+    environment?: 'production' | 'staging';
     /**
      * Verification mode
      * @default 'redirect'
@@ -103,7 +103,7 @@ export interface StatePayload {
     apiUrl?: string;
     engineUrl?: string;
     wsUrl?: string;
-    environment?: 'production' | 'staging' | 'development';
+    environment?: 'production' | 'staging';
     features?: {
         testMode: boolean;
         warmupPeriodMs: number;

package/dist/utils/crypto.d.ts

@@ -72,11 +72,11 @@ export declare function generateSecureToken(length?: number): string;
  * WARNING: Client-side secrets are NOT secure against determined attackers.
  * This is defense-in-depth only. Real security comes from server-side validation.
  *
- * @param {'production' | 'staging' | 'development'} environment - Target environment
+ * @param {'production' | 'staging'} environment - Target environment
  * @returns {string} Environment-specific secret
  * @export
  */
-export declare function getSigningSecret(environment: 'production' | 'staging' | 'development'): string;
+export declare function getSigningSecret(environment: 'production' | 'staging'): string;
 /**
  * Create signed state parameter with timestamp and integrity protection
  *
@@ -85,11 +85,11 @@ export declare function getSigningSecret(environment: 'production' | 'staging' |
  * using HMAC-SHA256 and base64 encoded for URL safety.
  *
  * @param {unknown} payload - Data to include in state parameter
- * @param {'production' | 'staging' | 'development'} environment - Target environment
+ * @param {'production' | 'staging'} environment - Target environment
  * @returns {Promise<string>} Promise resolving to base64-encoded signed state
  * @export
  */
-export declare function createSignedState(payload: unknown, environment: 'production' | 'staging' | 'development'): Promise<string>;
+export declare function createSignedState(payload: unknown, environment: 'production' | 'staging'): Promise<string>;
 /**
  * Verify and parse signed state parameter
  *
@@ -97,9 +97,9 @@ export declare function createSignedState(payload: unknown, environment: 'produc
  * and timestamp freshness. Returns the original payload if validation succeeds.
  *
  * @param {string} signedState - Base64-encoded signed state parameter
- * @param {'production' | 'staging' | 'development'} environment - Source environment
+ * @param {'production' | 'staging'} environment - Source environment
  * @param {number} [maxAge] - Maximum age in milliseconds
  * @returns {Promise<unknown | null>} Promise resolving to payload or null if invalid
  * @export
  */
-export declare function parseSignedState(signedState: string, environment: 'production' | 'staging' | 'development', maxAge?: number): Promise<unknown | null>;
+export declare function parseSignedState(signedState: string, environment: 'production' | 'staging', maxAge?: number): Promise<unknown | null>;

package/dist/utils/crypto.js

@@ -118,7 +118,7 @@ export function generateSecureToken(length = 32) {
  * WARNING: Client-side secrets are NOT secure against determined attackers.
  * This is defense-in-depth only. Real security comes from server-side validation.
  *
- * @param {'production' | 'staging' | 'development'} environment - Target environment
+ * @param {'production' | 'staging'} environment - Target environment
  * @returns {string} Environment-specific secret
  * @export
  */
@@ -128,7 +128,6 @@ export function getSigningSecret(environment) {
     const baseSecrets = {
         production: 'safepassage-prod-hmac-2025',
         staging: 'safepassage-stage-hmac-2025',
-        development: 'safepassage-dev-hmac-2025',
     };
     return baseSecrets[environment];
 }
@@ -140,7 +139,7 @@ export function getSigningSecret(environment) {
  * using HMAC-SHA256 and base64 encoded for URL safety.
  *
  * @param {unknown} payload - Data to include in state parameter
- * @param {'production' | 'staging' | 'development'} environment - Target environment
+ * @param {'production' | 'staging'} environment - Target environment
  * @returns {Promise<string>} Promise resolving to base64-encoded signed state
  * @export
  */
@@ -168,7 +167,7 @@ export async function createSignedState(payload, environment) {
  * and timestamp freshness. Returns the original payload if validation succeeds.
  *
  * @param {string} signedState - Base64-encoded signed state parameter
- * @param {'production' | 'staging' | 'development'} environment - Source environment
+ * @param {'production' | 'staging'} environment - Source environment
  * @param {number} [maxAge] - Maximum age in milliseconds
  * @returns {Promise<unknown | null>} Promise resolving to payload or null if invalid
  * @export

package/dist/utils/environment.d.ts

@@ -1,13 +1,13 @@
 /**
  * Environment utilities for SafePassage SDK with security enforcement
  */
-export declare function getEnvironmentUrl(environment: 'production' | 'staging' | 'development'): string;
-export declare function getApiUrl(environment: 'production' | 'staging' | 'development'): string;
+export declare function getEnvironmentUrl(environment: 'production' | 'staging'): string;
+export declare function getApiUrl(environment: 'production' | 'staging'): string;
 /**
- * Detect environment with security warnings
+ * Detect environment - always defaults to production unless staging is detected
  */
-export declare function detectEnvironment(): 'production' | 'staging' | 'development';
+export declare function detectEnvironment(): 'production' | 'staging';
 /**
  * Validate environment configuration on startup
  */
-export declare function validateEnvironmentSecurity(environment: 'production' | 'staging' | 'development'): void;
+export declare function validateEnvironmentSecurity(environment: 'production' | 'staging'): void;

package/dist/utils/environment.js

@@ -4,13 +4,11 @@
 const ENVIRONMENT_URLS = {
     production: 'https://av.safepassageapp.com',
     staging: 'https://av.staging.safepassageapp.com',
-    development: 'http://localhost:5173',
 };
 export function getEnvironmentUrl(environment) {
     const url = ENVIRONMENT_URLS[environment];
     // Security check: Ensure production/staging always use HTTPS
-    if ((environment === 'production' || environment === 'staging') &&
-        !url.startsWith('https://')) {
+    if (!url.startsWith('https://')) {
         throw new Error(`HTTPS required for ${environment} environment`);
     }
     return url;
@@ -18,32 +16,20 @@ export function getEnvironmentUrl(environment) {
 export function getApiUrl(environment) {
     const apiUrls = {
         production: 'https://api.safepassageapp.com',
-        staging: 'https://api-staging.safepassageapp.com',
-        development: 'http://localhost:3001',
+        staging: 'https://api.staging.safepassageapp.com',
     };
     const url = apiUrls[environment];
-    // Security check: Ensure production/staging always use HTTPS
-    if ((environment === 'production' || environment === 'staging') &&
-        !url.startsWith('https://')) {
+    // Security check: Ensure HTTPS is always used
+    if (!url.startsWith('https://')) {
         throw new Error(`HTTPS required for API URLs in ${environment} environment`);
     }
     return url;
 }
 /**
- * Detect environment with security warnings
+ * Detect environment - always defaults to production unless staging is detected
  */
 export function detectEnvironment() {
     const hostname = window.location.hostname;
-    if (hostname === 'localhost' ||
-        hostname === '127.0.0.1' ||
-        hostname.includes('.local')) {
-        // Warn if using HTTP in development with non-localhost domains
-        if (window.location.protocol === 'http:' &&
-            !hostname.match(/^(localhost|127\.0\.0\.1)$/)) {
-            console.warn('SafePassage Security Warning: Using HTTP with non-localhost domain in development');
-        }
-        return 'development';
-    }
     if (hostname.includes('staging') || hostname.includes('stage')) {
         // Enforce HTTPS in staging
         if (window.location.protocol !== 'https:') {
@@ -51,9 +37,9 @@ export function detectEnvironment() {
         }
         return 'staging';
     }
-    // Production environment - strict HTTPS enforcement
+    // Default to production environment - strict HTTPS enforcement
     if (window.location.protocol !== 'https:') {
-        console.error('SafePassage Security Error: HTTPS required in production environment');
+        console.warn('SafePassage Warning: HTTPS recommended for production environment');
     }
     return 'production';
 }
@@ -63,11 +49,10 @@ export function detectEnvironment() {
 export function validateEnvironmentSecurity(environment) {
     // Check current page protocol
     const isSecure = window.location.protocol === 'https:';
-    const hostname = window.location.hostname;
     switch (environment) {
         case 'production':
             if (!isSecure) {
-                throw new Error('SafePassage requires HTTPS in production environment');
+                console.warn('SafePassage Warning: HTTPS recommended for production environment');
             }
             break;
         case 'staging':
@@ -75,15 +60,6 @@ export function validateEnvironmentSecurity(environment) {
                 console.warn('SafePassage Warning: HTTPS strongly recommended in staging environment');
             }
             break;
-        case 'development': {
-            const isLocalhost = hostname === 'localhost' ||
-                hostname === '127.0.0.1' ||
-                hostname.includes('.local');
-            if (!isSecure && !isLocalhost) {
-                console.warn('SafePassage Warning: HTTPS recommended for non-localhost development');
-            }
-            break;
-        }
     }
     // Validate environment URLs
     try {

package/dist/utils/security.d.ts

@@ -5,11 +5,11 @@
 /**
  * Validate if an origin is trusted for the given environment
  */
-export declare function isOriginTrusted(origin: string, environment: 'production' | 'staging' | 'development'): boolean;
+export declare function isOriginTrusted(origin: string, environment: 'production' | 'staging'): boolean;
 /**
  * Enhanced origin validation with logging and strict allowlist
  */
-export declare function validatePostMessageOrigin(event: MessageEvent, environment: 'production' | 'staging' | 'development', allowedCustomOrigins?: string[]): boolean;
+export declare function validatePostMessageOrigin(event: MessageEvent, environment: 'production' | 'staging', allowedCustomOrigins?: string[]): boolean;
 /**
  * Validate SafePassage message format and content
  */
@@ -20,11 +20,11 @@ export declare function validateSafePassageMessage(event: MessageEvent, expected
 /**
  * Enforce HTTPS in production environment
  */
-export declare function enforceHTTPS(environment: 'production' | 'staging' | 'development'): void;
+export declare function enforceHTTPS(environment: 'production' | 'staging'): void;
 /**
  * Validate URL security for return/cancel URLs
  */
-export declare function validateReturnUrl(url: string, environment: 'production' | 'staging' | 'development'): {
+export declare function validateReturnUrl(url: string, environment: 'production' | 'staging'): {
     isValid: boolean;
     error?: string;
 };

package/dist/utils/security.js

@@ -13,19 +13,9 @@ const TRUSTED_ORIGINS = {
         'https://api.safepassageapp.com',
     ],
     staging: [
-        'https://av-staging.safepassageapp.com',
-        'https://portal-staging.safepassageapp.com',
-        'https://api-staging.safepassageapp.com',
-    ],
-    development: [
-        'http://localhost:5173',
-        'http://localhost:3000',
-        'http://localhost:3001',
-        'http://localhost:3002',
-        'http://127.0.0.1:5173',
-        'http://127.0.0.1:3000',
-        'http://127.0.0.1:3001',
-        'http://127.0.0.1:3002',
+        'https://av.staging.safepassageapp.com',
+        'https://portal.staging.safepassageapp.com',
+        'https://api.staging.safepassageapp.com',
     ],
 };
 /**
@@ -98,12 +88,9 @@ export function validateSafePassageMessage(event, expectedSessionId) {
  */
 export function enforceHTTPS(environment) {
     if (environment === 'production' && window.location.protocol !== 'https:') {
-        const httpsUrl = window.location.href.replace('http:', 'https:');
-        console.error('SafePassage Security: HTTPS required in production. Redirecting...', {
+        console.warn('SafePassage Warning: HTTPS recommended for production environment', {
             current: window.location.href,
-            redirect: httpsUrl,
         });
-        window.location.replace(httpsUrl);
     }
 }
 /**
@@ -112,27 +99,11 @@ export function enforceHTTPS(environment) {
 export function validateReturnUrl(url, environment) {
     try {
         const parsed = new URL(url);
-        // Production must use HTTPS
-        if (environment === 'production' && parsed.protocol !== 'https:') {
-            return {
-                isValid: false,
-                error: 'HTTPS required for return URLs in production',
-            };
-        }
-        // Development allows HTTP localhost
-        if (environment === 'development') {
-            const isLocalhost = parsed.hostname === 'localhost' ||
-                parsed.hostname === '127.0.0.1' ||
-                parsed.hostname.endsWith('.local');
-            if (!isLocalhost && parsed.protocol !== 'https:') {
-                return { isValid: false, error: 'Non-localhost URLs must use HTTPS' };
-            }
-        }
-        // Staging should use HTTPS
-        if (environment === 'staging' && parsed.protocol !== 'https:') {
+        // Production and staging should use HTTPS
+        if (parsed.protocol !== 'https:') {
             return {
                 isValid: false,
-                error: 'HTTPS required for return URLs in staging',
+                error: `HTTPS required for return URLs in ${environment}`,
             };
         }
         // Block suspicious URLs

package/dist/utils/validation.d.ts

@@ -14,8 +14,8 @@ export declare function validateChallengeAge(age?: number): void;
  * Generate signed state parameter with HMAC protection
  * Uses client-side HMAC for tamper resistance and server-side verification
  */
-export declare function generateState(payload: StatePayload, environment: 'production' | 'staging' | 'development'): Promise<string>;
+export declare function generateState(payload: StatePayload, environment: 'production' | 'staging'): Promise<string>;
 /**
  * Parse and validate signed state parameter
  */
-export declare function parseState(state: string, environment: 'production' | 'staging' | 'development'): Promise<StatePayload | null>;
+export declare function parseState(state: string, environment: 'production' | 'staging'): Promise<StatePayload | null>;

package/dist/utils/validation.js

@@ -68,7 +68,7 @@ export function validateConfig(config) {
     }
 }
 /**
- * Detect environment based on current URL
+ * Detect environment based on current URL - defaults to production unless staging detected
  */
 function detectEnvironment() {
     // If no window (server environment), default to production for safety
@@ -76,11 +76,6 @@ function detectEnvironment() {
         return 'production';
     }
     const hostname = window.location.hostname;
-    if (hostname === 'localhost' ||
-        hostname === '127.0.0.1' ||
-        hostname.includes('.local')) {
-        return 'development';
-    }
     if (hostname.includes('staging') || hostname.includes('stage')) {
         return 'staging';
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safepassage/sdk",
-  "version": "3.0.14",
+  "version": "3.1.0",
   "description": "SafePassage SDK - Lightweight redirect-based age verification",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/tests/SafePassageSDK.test.d.ts

@@ -1,4 +0,0 @@
-/**
- * Tests for SafePassage SDK
- */
-export {};

package/dist/tests/SafePassageSDK.test.js

@@ -1,130 +0,0 @@
-/**
- * Tests for SafePassage SDK
- */
-import { SafePassage } from '../core/SafePassageSDK';
-describe('SafePassage SDK', () => {
-    let mockLocation;
-    let mockWindow;
-    beforeEach(() => {
-        // Mock window.location
-        mockLocation = {
-            href: 'https://merchant.com',
-            hostname: 'merchant.com',
-            origin: 'https://merchant.com'
-        };
-        // Mock window
-        mockWindow = {
-            location: mockLocation,
-            open: jest.fn(),
-            addEventListener: jest.fn(),
-            removeEventListener: jest.fn()
-        };
-        // Replace global window
-        global.window = mockWindow;
-    });
-    describe('constructor', () => {
-        it('should initialize with valid config', () => {
-            const config = {
-                apiKey: 'sk_test_123',
-                returnUrl: 'https://merchant.com/verified',
-                cancelUrl: 'https://merchant.com/cancelled'
-            };
-            const sp = new SafePassage(config);
-            expect(sp).toBeDefined();
-        });
-        it('should throw error for missing apiKey', () => {
-            const config = {
-                returnUrl: 'https://merchant.com/verified',
-                cancelUrl: 'https://merchant.com/cancelled'
-            };
-            expect(() => new SafePassage(config)).toThrow('apiKey is required');
-        });
-        it('should throw error for invalid apiKey format', () => {
-            const config = {
-                apiKey: 'invalid_key',
-                returnUrl: 'https://merchant.com/verified',
-                cancelUrl: 'https://merchant.com/cancelled'
-            };
-            expect(() => new SafePassage(config)).toThrow('Invalid apiKey format');
-        });
-        it('should throw error for missing returnUrl', () => {
-            const config = {
-                apiKey: 'sk_test_123',
-                cancelUrl: 'https://merchant.com/cancelled'
-            };
-            expect(() => new SafePassage(config)).toThrow('returnUrl is required');
-        });
-        it('should auto-detect development environment for localhost', () => {
-            mockLocation.hostname = 'localhost';
-            const config = {
-                apiKey: 'sk_test_123',
-                returnUrl: 'http://localhost:3000/verified',
-                cancelUrl: 'http://localhost:3000/cancelled'
-            };
-            const sp = new SafePassage(config);
-            expect(sp).toBeDefined();
-        });
-        it('should enforce minimum age of 25', () => {
-            const config = {
-                apiKey: 'sk_test_123',
-                returnUrl: 'https://merchant.com/verified',
-                cancelUrl: 'https://merchant.com/cancelled',
-                defaultChallengeAge: 21
-            };
-            expect(() => new SafePassage(config)).toThrow('defaultChallengeAge must be at least 25');
-        });
-    });
-    describe('verify', () => {
-        let sp;
-        beforeEach(() => {
-            const config = {
-                apiKey: 'sk_test_123',
-                returnUrl: 'https://merchant.com/verified',
-                cancelUrl: 'https://merchant.com/cancelled'
-            };
-            sp = new SafePassage(config);
-        });
-        it('should throw error for missing sessionId', () => {
-            expect(() => sp.verify({})).toThrow('sessionId is required');
-        });
-        it('should redirect in same-tab mode', () => {
-            const sessionId = '550e8400-e29b-41d4-a716-446655440000';
-            sp.verify({ sessionId });
-            expect(mockWindow.location.href).toContain('verify.safepassageapp.com');
-            expect(mockWindow.location.href).toContain(`sessionId=${sessionId}`);
-        });
-        it('should open new tab in new-tab mode', () => {
-            const config = {
-                apiKey: 'sk_test_123',
-                returnUrl: 'https://merchant.com/verified',
-                cancelUrl: 'https://merchant.com/cancelled',
-                mode: 'new-tab'
-            };
-            const sp = new SafePassage(config);
-            const sessionId = '550e8400-e29b-41d4-a716-446655440000';
-            sp.verify({ sessionId });
-            expect(mockWindow.open).toHaveBeenCalledWith(expect.stringContaining('verify.safepassageapp.com'), 'safepassage-verify', 'width=600,height=700');
-        });
-    });
-    describe('URL building', () => {
-        it('should build correct URL with all parameters', () => {
-            const config = {
-                apiKey: 'sk_test_123',
-                returnUrl: 'https://merchant.com/verified',
-                cancelUrl: 'https://merchant.com/cancelled',
-                environment: 'staging'
-            };
-            const sp = new SafePassage(config);
-            // Access private method for testing
-            const buildUrl = sp.buildVerificationUrl.bind(sp);
-            const url = buildUrl({
-                sessionId: '550e8400-e29b-41d4-a716-446655440000',
-                challengeAge: 30,
-                verificationMode: 'L2'
-            });
-            expect(url).toContain('verify-staging.safepassageapp.com');
-            expect(url).toContain('sessionId=550e8400-e29b-41d4-a716-446655440000');
-            expect(url).toContain('state=');
-        });
-    });
-});