@safepassage/sdk 3.0.3 → 3.0.4

package/README.md

@@ -43,7 +43,7 @@ safePassage.verify({
 
 | Option | Type | Required | Description |
 |--------|------|----------|-------------|
-| apiKey | string | Yes | Your API key (sk_live_xxx or sk_test_xxx) |
+| apiKey | string | Yes | Your API key (pk_xxx for client-side, sk_xxx for server-side) |
 | returnUrl | string | Yes | URL to redirect after successful verification |
 | cancelUrl | string | Yes | URL to redirect if user cancels |
 | environment | string | No | 'production', 'staging', or 'development' (auto-detected) |
@@ -52,13 +52,27 @@ safePassage.verify({
 | onCancel | function | No | Callback for new-tab mode cancellation |
 | onError | function | No | Error handler |
 
+### API Key Types
+
+SafePassage provides two types of API keys:
+
+- **Public Keys (`pk_`)**: Safe for client-side use (websites, mobile apps)
+  - Limited to creating and initiating verifications
+  - Cannot read verification results or override settings
+  - SDK auto-generates sessionId if not provided
+  
+- **Secret Keys (`sk_`)**: Server-side only - keep these private!
+  - Full API access including reading verification results
+  - Can override challenge age and verification mode
+  - Requires merchant-generated sessionId
+
 ## Verification Options
 
 ```javascript
 safePassage.verify({
-  sessionId: 'uuid-v4',        // Required: merchant-generated UUID
-  challengeAge: 30,            // Optional: min 25 (overrides dashboard setting)
-  verificationMode: 'L2'       // Optional: 'L1' or 'L2' (overrides dashboard setting)
+  sessionId: 'uuid-v4',        // Required for sk_ keys, optional for pk_ keys
+  challengeAge: 30,            // Optional: min 25 (sk_ keys only)
+  verificationMode: 'L2'       // Optional: 'L1' or 'L2' (sk_ keys only)
 });
 ```
 

package/dist/core/SafePassageSDK.d.ts

@@ -0,0 +1,68 @@
+/**
+ * SafePassage SDK - Redirect-based age verification
+ * Lightweight SDK for integrating SafePassage age verification using redirect flow
+ */
+import type { SafePassageConfig, VerificationOptions } from '../types';
+export declare class SafePassage {
+    private config;
+    private popupWindow;
+    private messageListener;
+    private popupMonitorInterval;
+    private unloadListener;
+    private isVerificationInProgress;
+    private currentSessionId;
+    constructor(config: SafePassageConfig);
+    /**
+     * Initiate age verification with race condition protection
+     */
+    verify(options?: VerificationOptions): Promise<void>;
+    /**
+     * Build verification URL with HMAC-signed state
+     */
+    private buildVerificationUrl;
+    /**
+     * Redirect in same tab
+     */
+    private redirect;
+    /**
+     * Open in new tab with PostMessage communication and proper cleanup
+     */
+    private openNewTab;
+    /**
+     * Set up automatic cleanup on page unload to prevent memory leaks
+     */
+    private setupAutoCleanup;
+    /**
+     * Auto-detect environment based on current URL
+     */
+    private detectEnvironment;
+    /**
+     * Unlock verification process to allow new verifications
+     */
+    private unlockVerification;
+    /**
+     * Internal cleanup method to prevent memory leaks
+     */
+    private cleanup;
+    /**
+     * Remove auto-cleanup listeners
+     */
+    private removeAutoCleanupListeners;
+    /**
+     * Public cleanup method for manual resource management
+     */
+    destroy(): void;
+    /**
+     * Detect if this is a public key (pk_ prefix) vs private key (sk_ prefix)
+     */
+    private isPublicKey;
+    /**
+     * Create session internally for public keys
+     */
+    private createInternalSession;
+    /**
+     * Get portal API URL based on environment
+     */
+    private getPortalApiUrl;
+}
+export default SafePassage;

package/dist/core/SafePassageSDK.js

@@ -0,0 +1,392 @@
+/**
+ * SafePassage SDK - Redirect-based age verification
+ * Lightweight SDK for integrating SafePassage age verification using redirect flow
+ */
+import { generateState, validateConfig } from '../utils/validation';
+import { getEnvironmentUrl, validateEnvironmentSecurity } from '../utils/environment';
+import { validatePostMessageOrigin, validateSafePassageMessage, enforceHTTPS, verificationRateLimit, logSecurityEvent } from '../utils/security';
+export class SafePassage {
+    constructor(config) {
+        this.popupWindow = null;
+        this.messageListener = null;
+        this.popupMonitorInterval = null;
+        this.unloadListener = null;
+        this.isVerificationInProgress = false;
+        this.currentSessionId = null;
+        validateConfig(config);
+        this.config = {
+            ...config,
+            environment: config.environment || this.detectEnvironment(),
+            mode: config.mode || 'redirect'
+        };
+        // Comprehensive environment security validation
+        validateEnvironmentSecurity(this.config.environment);
+        // Enforce HTTPS in production (additional layer)
+        enforceHTTPS(this.config.environment);
+        // Log initialization for security monitoring
+        logSecurityEvent('SDK_INITIALIZED', {
+            environment: this.config.environment,
+            mode: this.config.mode,
+            origin: window.location.origin,
+            protocol: window.location.protocol,
+            hostname: window.location.hostname
+        });
+        // Set up automatic cleanup on page unload
+        this.setupAutoCleanup();
+    }
+    /**
+     * Initiate age verification with race condition protection
+     */
+    async verify(options = {}) {
+        const isPublicKey = this.isPublicKey();
+        let sessionId = options.sessionId;
+        // For public keys, generate session internally if not provided
+        if (isPublicKey && !sessionId) {
+            sessionId = await this.createInternalSession(options);
+        }
+        // For private keys, sessionId is required
+        if (!isPublicKey && !sessionId) {
+            throw new Error('sessionId is required for private API keys - must be a merchant-generated UUID v4');
+        }
+        if (!sessionId) {
+            throw new Error('Failed to create or obtain sessionId');
+        }
+        // Race condition check - prevent multiple simultaneous verifications
+        if (this.isVerificationInProgress) {
+            const error = new Error(`Verification already in progress for session ${this.currentSessionId?.substring(0, 8)}...`);
+            logSecurityEvent('RACE_CONDITION_PREVENTED', {
+                currentSession: this.currentSessionId?.substring(0, 8) + '...',
+                attemptedSession: options.sessionId ? options.sessionId.substring(0, 8) + '...' : 'undefined',
+                origin: window.location.origin
+            });
+            this.config.onError?.(error);
+            throw error;
+        }
+        // Lock verification process
+        this.isVerificationInProgress = true;
+        this.currentSessionId = sessionId;
+        try {
+            // Rate limiting check
+            const rateLimitKey = `${this.config.apiKey}:${window.location.origin}`;
+            if (!verificationRateLimit.isAllowed(rateLimitKey)) {
+                const error = new Error('Too many verification attempts. Please wait before trying again.');
+                logSecurityEvent('RATE_LIMIT_EXCEEDED', {
+                    apiKey: this.config.apiKey.substring(0, 8) + '...',
+                    origin: window.location.origin,
+                    sessionId: sessionId ? sessionId.substring(0, 8) + '...' : 'undefined'
+                });
+                this.config.onError?.(error);
+                throw error;
+            }
+            const verificationUrl = await this.buildVerificationUrl({ ...options, sessionId });
+            // Log verification attempt
+            logSecurityEvent('VERIFICATION_INITIATED', {
+                environment: this.config.environment,
+                mode: this.config.mode,
+                sessionId: sessionId ? sessionId.substring(0, 8) + '...' : 'undefined',
+                origin: window.location.origin
+            });
+            if (this.config.mode === 'new-tab') {
+                this.openNewTab(verificationUrl, sessionId);
+            }
+            else {
+                // For redirect mode, unlock immediately since we're leaving the page
+                this.unlockVerification();
+                this.redirect(verificationUrl);
+            }
+        }
+        catch (error) {
+            // Always unlock on error
+            this.unlockVerification();
+            throw error;
+        }
+    }
+    /**
+     * Build verification URL with HMAC-signed state
+     */
+    async buildVerificationUrl(options) {
+        const baseUrl = getEnvironmentUrl(this.config.environment);
+        // Determine if we have explicit overrides
+        const hasExplicitChallengeAge = options.challengeAge !== undefined;
+        const hasExplicitVerificationMode = options.verificationMode !== undefined;
+        const hasOverrides = hasExplicitChallengeAge || hasExplicitVerificationMode;
+        const state = await generateState({
+            merchantId: this.config.apiKey,
+            sessionId: options.sessionId,
+            returnUrl: this.config.returnUrl,
+            cancelUrl: this.config.cancelUrl,
+            challengeAge: options.challengeAge || this.config.defaultChallengeAge,
+            verificationMode: options.verificationMode || this.config.defaultVerificationMode,
+            hasOverrides: hasOverrides, // Flag to indicate explicit overrides
+            externalUserId: options.externalUserId,
+            timestamp: Date.now()
+        }, this.config.environment);
+        const params = new URLSearchParams({
+            state,
+            sessionId: options.sessionId,
+            mode: this.config.mode
+        });
+        return `${baseUrl}/verify?${params.toString()}`;
+    }
+    /**
+     * Redirect in same tab
+     */
+    redirect(url) {
+        window.location.href = url;
+    }
+    /**
+     * Open in new tab with PostMessage communication and proper cleanup
+     */
+    openNewTab(url, sessionId) {
+        // Clean up any existing resources
+        this.cleanup();
+        // Clear any existing popup monitor interval
+        if (this.popupMonitorInterval) {
+            clearInterval(this.popupMonitorInterval);
+            this.popupMonitorInterval = null;
+        }
+        // Open new tab
+        this.popupWindow = window.open(url, 'safepassage-verify', 'width=600,height=700');
+        if (!this.popupWindow) {
+            this.config.onError?.(new Error('Failed to open verification window. Please check popup blocker settings.'));
+            return;
+        }
+        // Set up PostMessage listener with enhanced security
+        this.messageListener = (event) => {
+            // Enhanced origin validation with strict allowlist
+            if (!validatePostMessageOrigin(event, this.config.environment)) {
+                logSecurityEvent('POSTMESSAGE_ORIGIN_BLOCKED', {
+                    origin: event.origin,
+                    environment: this.config.environment,
+                    expectedOrigins: `SafePassage trusted origins for ${this.config.environment}`,
+                    messageType: event.data?.type
+                });
+                return;
+            }
+            // Enhanced message validation
+            const messageValidation = validateSafePassageMessage(event, sessionId);
+            if (!messageValidation.isValid) {
+                logSecurityEvent('POSTMESSAGE_VALIDATION_FAILED', {
+                    error: messageValidation.error,
+                    origin: event.origin,
+                    sessionId: sessionId.substring(0, 8) + '...',
+                    messageType: event.data?.type
+                });
+                return;
+            }
+            const result = {
+                sessionId: event.data.sessionId,
+                status: event.data.status
+            };
+            // Log successful verification completion
+            logSecurityEvent('VERIFICATION_COMPLETED', {
+                status: result.status,
+                sessionId: sessionId.substring(0, 8) + '...',
+                origin: event.origin
+            });
+            // Clean up resources
+            this.cleanup();
+            // Unlock verification after successful completion
+            this.unlockVerification();
+            // Clear monitoring interval
+            if (this.popupMonitorInterval) {
+                clearInterval(this.popupMonitorInterval);
+                this.popupMonitorInterval = null;
+            }
+            // Trigger appropriate callback
+            if (result.status === 'verified') {
+                this.config.onComplete?.(result);
+            }
+            else if (result.status === 'cancelled') {
+                this.config.onCancel?.();
+            }
+            else {
+                this.config.onError?.(new Error(`Verification failed: ${result.status}`));
+            }
+        };
+        window.addEventListener('message', this.messageListener);
+        // Monitor popup window with proper cleanup
+        this.popupMonitorInterval = setInterval(() => {
+            if (this.popupWindow && this.popupWindow.closed) {
+                // Log popup closed event
+                logSecurityEvent('POPUP_CLOSED_BY_USER', {
+                    sessionId: sessionId.substring(0, 8) + '...',
+                    environment: this.config.environment
+                });
+                // Clean up and trigger cancel callback
+                this.cleanup();
+                // Unlock verification after popup closed
+                this.unlockVerification();
+                this.config.onCancel?.();
+            }
+        }, 500);
+    }
+    /**
+     * Set up automatic cleanup on page unload to prevent memory leaks
+     */
+    setupAutoCleanup() {
+        this.unloadListener = () => {
+            // Log automatic cleanup
+            logSecurityEvent('SDK_AUTO_CLEANUP', {
+                environment: this.config.environment,
+                trigger: 'page_unload'
+            });
+            // Clean up all resources and unlock verification
+            this.cleanup();
+            this.unlockVerification();
+        };
+        // Listen for page unload events
+        window.addEventListener('beforeunload', this.unloadListener);
+        window.addEventListener('pagehide', this.unloadListener);
+        // For single-page applications, also listen for route changes
+        if (window.history && window.history.pushState) {
+            const originalPushState = window.history.pushState;
+            window.history.pushState = (...args) => {
+                this.cleanup();
+                this.unlockVerification();
+                return originalPushState.apply(window.history, args);
+            };
+        }
+    }
+    /**
+     * Auto-detect environment based on current URL
+     */
+    detectEnvironment() {
+        const hostname = window.location.hostname;
+        if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname.includes('.local')) {
+            return 'development';
+        }
+        if (hostname.includes('staging') || hostname.includes('stage')) {
+            return 'staging';
+        }
+        return 'production';
+    }
+    /**
+     * Unlock verification process to allow new verifications
+     */
+    unlockVerification() {
+        this.isVerificationInProgress = false;
+        this.currentSessionId = null;
+        logSecurityEvent('VERIFICATION_UNLOCKED', {
+            environment: this.config.environment,
+            origin: window.location.origin
+        });
+    }
+    /**
+     * Internal cleanup method to prevent memory leaks
+     */
+    cleanup() {
+        // Close popup window
+        if (this.popupWindow && !this.popupWindow.closed) {
+            this.popupWindow.close();
+        }
+        this.popupWindow = null;
+        // Remove message listener
+        if (this.messageListener) {
+            window.removeEventListener('message', this.messageListener);
+            this.messageListener = null;
+        }
+        // Clear monitoring interval
+        if (this.popupMonitorInterval) {
+            clearInterval(this.popupMonitorInterval);
+            this.popupMonitorInterval = null;
+        }
+        // Note: Verification unlocking is handled by specific callers
+    }
+    /**
+     * Remove auto-cleanup listeners
+     */
+    removeAutoCleanupListeners() {
+        if (this.unloadListener) {
+            window.removeEventListener('beforeunload', this.unloadListener);
+            window.removeEventListener('pagehide', this.unloadListener);
+            this.unloadListener = null;
+        }
+    }
+    /**
+     * Public cleanup method for manual resource management
+     */
+    destroy() {
+        // Log destruction for security monitoring
+        logSecurityEvent('SDK_DESTROYED', {
+            environment: this.config.environment,
+            origin: window.location.origin
+        });
+        // Clean up all resources
+        this.cleanup();
+        // Unlock verification
+        this.unlockVerification();
+        // Remove auto-cleanup listeners
+        this.removeAutoCleanupListeners();
+    }
+    /**
+     * Detect if this is a public key (pk_ prefix) vs private key (sk_ prefix)
+     */
+    isPublicKey() {
+        return this.config.apiKey.startsWith('pk_');
+    }
+    /**
+     * Create session internally for public keys
+     */
+    async createInternalSession(options) {
+        const sessionId = crypto.randomUUID();
+        try {
+            const portalApiUrl = this.getPortalApiUrl();
+            const response = await fetch(`${portalApiUrl}/api/v1/sessions/create`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${this.config.apiKey}`
+                },
+                body: JSON.stringify({
+                    merchantId: this.config.apiKey, // API expects merchantId even though it uses auth header
+                    sessionId,
+                    returnUrl: this.config.returnUrl,
+                    cancelUrl: this.config.cancelUrl,
+                    challengeAge: options.challengeAge,
+                    verificationMode: options.verificationMode,
+                    merchantName: document.title || window.location.hostname,
+                    externalUserId: options.externalUserId
+                })
+            });
+            if (!response.ok) {
+                const errorData = await response.json().catch(() => ({}));
+                throw new Error(`Failed to create session: ${response.status} ${response.statusText}. ${errorData.message || ''}`);
+            }
+            const sessionData = await response.json();
+            // Log successful session creation
+            logSecurityEvent('INTERNAL_SESSION_CREATED', {
+                sessionId: sessionId.substring(0, 8) + '...',
+                environment: this.config.environment,
+                apiKeyType: 'public'
+            });
+            return sessionId;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logSecurityEvent('INTERNAL_SESSION_FAILED', {
+                error: errorMessage,
+                environment: this.config.environment,
+                apiKeyType: 'public'
+            });
+            this.config.onError?.(error);
+            throw new Error(`Failed to create verification session: ${errorMessage}`);
+        }
+    }
+    /**
+     * Get portal API URL based on environment
+     */
+    getPortalApiUrl() {
+        switch (this.config.environment) {
+            case 'production':
+                return 'https://api.safepassageapp.com';
+            case 'staging':
+                return 'https://api-staging.safepassageapp.com';
+            case 'development':
+            default:
+                return 'http://localhost:3001';
+        }
+    }
+}
+// For backwards compatibility
+export default SafePassage;

package/dist/index.js

@@ -1,7 +1,34 @@
-// SafePassage SDK v3.0.0 - Redirect Implementation 
-// Main export for the new redirect-based SDK
-export { SafePassage } from '../src-redirect/core/SafePassageSDK';
-// Re-export for convenience
-export * from '../src-redirect/types';
-// Default export
-export { SafePassage as default } from '../src-redirect/core/SafePassageSDK';
+/**
+ * SafePassage SDK - Redirect-based age verification
+ *
+ * @example
+ * ```javascript
+ * // Initialize SDK
+ * const sp = new SafePassage({
+ *   apiKey: 'pk_live_xxxxx',
+ *   returnUrl: 'https://merchant.com/verified',
+ *   cancelUrl: 'https://merchant.com/cancelled'
+ * });
+ *
+ * // Trigger verification
+ * sp.verify({
+ *   sessionId: generateUUID() // Merchant-generated UUID v4
+ * });
+ * ```
+ */
+// Setup polyfills and check browser compatibility
+import { setupPolyfills, checkBrowserCompatibility } from './utils/polyfills';
+// Initialize polyfills immediately
+if (typeof window !== 'undefined') {
+    setupPolyfills();
+    checkBrowserCompatibility();
+}
+export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
+// Version - Updated to reflect security improvements
+export const VERSION = '3.0.4';
+// For UMD builds
+if (typeof window !== 'undefined' && window) {
+    const { SafePassage } = require('./core/SafePassageSDK');
+    window.SafePassage = SafePassage;
+    window.SafePassage.VERSION = VERSION;
+}

package/dist/safepassage.min.js

@@ -1,3 +1,3 @@
-/* SafePassage SDK v3.0.0 - Redirect Implementation */
-"use strict";var SafePassageSDK=(()=>{var d=Object.defineProperty;var K=Object.getOwnPropertyDescriptor;var W=Object.getOwnPropertyNames;var H=Object.prototype.hasOwnProperty;var p=(t,e)=>()=>(t&&(e=t(t=0)),e);var u=(t,e)=>{for(var i in e)d(t,i,{get:e[i],enumerable:!0})},q=(t,e,i,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of W(e))!H.call(t,o)&&o!==i&&d(t,o,{get:()=>e[o],enumerable:!(n=K(e,o))||n.enumerable});return t};var I=t=>q(d({},"__esModule",{value:!0}),t);function F(t,e){return E[e].includes(t)}function P(t,e,i=[]){let{origin:n}=t;return F(n,e)||i.length>0&&i.some(r=>{if(r.startsWith("*.")){let s=r.slice(2);return n.endsWith(`.${s}`)||n===`https://${s}`||n===`http://${s}`}return n===r})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${n}`,{environment:e,trustedOrigins:E[e],allowedCustomOrigins:i,eventType:t.data?.type}),!1)}function T(t,e){let{data:i}=t;return!i||typeof i!="object"?{isValid:!1,error:"Invalid message format"}:i.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!i.sessionId||i.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!i.status||!["verified","failed","cancelled"].includes(i.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function U(t){if(t==="production"&&window.location.protocol!=="https:"){let e=window.location.href.replace("http:","https:");console.error("SafePassage Security: HTTPS required in production. Redirecting...",{current:window.location.href,redirect:e}),window.location.replace(e)}}function f(t,e){try{let i=new URL(t);if(e==="production"&&i.protocol!=="https:")return{isValid:!1,error:"HTTPS required for return URLs in production"};if(e==="development"&&!(i.hostname==="localhost"||i.hostname==="127.0.0.1"||i.hostname.endsWith(".local"))&&i.protocol!=="https:")return{isValid:!1,error:"Non-localhost URLs must use HTTPS"};if(e==="staging"&&i.protocol!=="https:")return{isValid:!1,error:"HTTPS required for return URLs in staging"};let n=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let o of n)if(o.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch{return{isValid:!1,error:"Invalid URL format"}}}function a(t,e){console.warn(`SafePassage Security Event: ${t}`,{timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href,...e})}var E,g,A,h=p(()=>{"use strict";E={production:["https://verify.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://verify-staging.safepassageapp.com","https://portal-staging.safepassageapp.com","https://api-staging.safepassageapp.com"],development:["http://localhost:5173","http://localhost:3000","http://localhost:3001","http://localhost:3002","http://127.0.0.1:5173","http://127.0.0.1:3000","http://127.0.0.1:3001","http://127.0.0.1:3002"]};g=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let i=Date.now(),o=(this.attempts.get(e)||[]).filter(r=>i-r<this.timeWindow);return o.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(o.push(i),this.attempts.set(e,o),!0)}reset(e){this.attempts.delete(e)}},A=new g});var L={};u(L,{createSignedState:()=>J,generateHMAC:()=>m,generateSecureToken:()=>V,getSigningSecret:()=>w,parseSignedState:()=>B,verifyHMAC:()=>b});async function m(t,e){let i=new TextEncoder,n=i.encode(e),o=i.encode(t),r=await crypto.subtle.importKey("raw",n,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),s=await crypto.subtle.sign("HMAC",r,o);return Array.from(new Uint8Array(s)).map(l=>l.toString(16).padStart(2,"0")).join("")}async function b(t,e,i){try{let n=await m(t,i);return j(e,n)}catch{return!1}}function j(t,e){if(t.length!==e.length)return!1;let i=0;for(let n=0;n<t.length;n++)i|=t.charCodeAt(n)^e.charCodeAt(n);return i===0}function V(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,i=>i.toString(16).padStart(2,"0")).join("")}function w(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025",development:"safepassage-dev-hmac-2025"}[t]}async function J(t,e){let i={...t,timestamp:Date.now(),nonce:V(16)},n=JSON.stringify(i),o=w(e),r=await m(n,o);return btoa(JSON.stringify({data:i,signature:r}))}async function B(t,e,i=10*60*1e3){try{let n=atob(t),o=JSON.parse(n);if(!o.data||!o.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:r,signature:s}=o,l=JSON.stringify(r),$=w(e);if(!await b(l,s,$))return console.warn("SafePassage: State signature verification failed"),null;if(r.timestamp){let y=Date.now()-r.timestamp;if(y>i)return console.warn("SafePassage: State parameter expired",{age:y,maxAge:i}),null}let{timestamp:ie,nonce:ne,...k}=r;return k}catch(n){return console.warn("SafePassage: Failed to parse signed state",n),null}}var x=p(()=>{"use strict"});function M(t){if(!t.apiKey)throw new Error("apiKey is required");if(!G.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(!t.returnUrl)throw new Error("returnUrl is required");if(!t.cancelUrl)throw new Error("cancelUrl is required");let e=Y(),i=f(t.returnUrl,e);if(!i.isValid)throw new Error(`returnUrl validation failed: ${i.error}`);let n=f(t.cancelUrl,e);if(!n.isValid)throw new Error(`cancelUrl validation failed: ${n.error}`);if(t.defaultChallengeAge!==void 0&&t.defaultChallengeAge<C)throw new Error(`defaultChallengeAge must be at least ${C}`);if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function Y(){let t=window.location.hostname;return t==="localhost"||t==="127.0.0.1"||t.includes(".local")?"development":t.includes("staging")||t.includes("stage")?"staging":"production"}async function R(t,e){let{createSignedState:i}=await Promise.resolve().then(()=>(x(),L));return i(t,e)}var C,G,O=p(()=>{"use strict";h();C=25,G=/^(pk_|sk_)[a-zA-Z0-9]+$/});function v(t){let e=z[t];if((t==="production"||t==="staging")&&!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function Z(t){let i={production:"https://api.safepassageapp.com",staging:"https://api-staging.safepassageapp.com",development:"http://localhost:3001"}[t];if((t==="production"||t==="staging")&&!i.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return i}function D(t){let e=window.location.protocol==="https:",i=window.location.hostname;switch(t){case"production":if(!e)throw new Error("SafePassage requires HTTPS in production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break;case"development":let n=i==="localhost"||i==="127.0.0.1"||i.includes(".local");!e&&!n&&console.warn("SafePassage Warning: HTTPS recommended for non-localhost development");break}try{v(t),Z(t)}catch(n){throw new Error(`Environment configuration validation failed: ${n}`)}}var z,N=p(()=>{"use strict";z={production:"https://verify.safepassageapp.com",staging:"https://verify-staging.safepassageapp.com",development:"http://localhost:5173"}});var _={};u(_,{SafePassage:()=>c,default:()=>X});var c,X,S=p(()=>{"use strict";O();N();h();c=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;M(e),this.config={...e,environment:e.environment||this.detectEnvironment(),mode:e.mode||"redirect"},D(this.config.environment),U(this.config.environment),a("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){let i=this.isPublicKey(),n=e.sessionId;if(i&&!n&&(n=await this.createInternalSession(e)),!i&&!n)throw new Error("sessionId is required for private API keys - must be a merchant-generated UUID v4");if(!n)throw new Error("Failed to create or obtain sessionId");if(this.isVerificationInProgress){let o=new Error(`Verification already in progress for session ${this.currentSessionId?.substring(0,8)}...`);throw a("RACE_CONDITION_PREVENTED",{currentSession:this.currentSessionId?.substring(0,8)+"...",attemptedSession:e.sessionId?e.sessionId.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.onError?.(o),o}this.isVerificationInProgress=!0,this.currentSessionId=n;try{let o=`${this.config.apiKey}:${window.location.origin}`;if(!A.isAllowed(o)){let s=new Error("Too many verification attempts. Please wait before trying again.");throw a("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:n?n.substring(0,8)+"...":"undefined"}),this.config.onError?.(s),s}let r=await this.buildVerificationUrl({...e,sessionId:n});a("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:n?n.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(r,n):(this.unlockVerification(),this.redirect(r))}catch(o){throw this.unlockVerification(),o}}async buildVerificationUrl(e){let i=v(this.config.environment),n=e.challengeAge!==void 0,o=e.verificationMode!==void 0,r=n||o,s=await R({merchantId:this.config.apiKey,sessionId:e.sessionId,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:r,timestamp:Date.now()},this.config.environment),l=new URLSearchParams({state:s,sessionId:e.sessionId,mode:this.config.mode});return`${i}/verify?${l.toString()}`}redirect(e){window.location.href=e}openNewTab(e,i){if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){this.config.onError?.(new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=n=>{if(!P(n,this.config.environment)){a("POSTMESSAGE_ORIGIN_BLOCKED",{origin:n.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:n.data?.type});return}let o=T(n,i);if(!o.isValid){a("POSTMESSAGE_VALIDATION_FAILED",{error:o.error,origin:n.origin,sessionId:i.substring(0,8)+"...",messageType:n.data?.type});return}let r={sessionId:n.data.sessionId,status:n.data.status};a("VERIFICATION_COMPLETED",{status:r.status,sessionId:i.substring(0,8)+"...",origin:n.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),r.status==="verified"?this.config.onComplete?.(r):r.status==="cancelled"?this.config.onCancel?.():this.config.onError?.(new Error(`Verification failed: ${r.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{this.popupWindow&&this.popupWindow.closed&&(a("POPUP_CLOSED_BY_USER",{sessionId:i.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),this.config.onCancel?.())},500)}setupAutoCleanup(){if(this.unloadListener=()=>{a("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...i)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,i))}}detectEnvironment(){let e=window.location.hostname;return e==="localhost"||e==="127.0.0.1"||e.includes(".local")?"development":e.includes("staging")||e.includes("stage")?"staging":"production"}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,a("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){a("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){let i=crypto.randomUUID();try{let n=this.getPortalApiUrl(),o=await fetch(`${n}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,sessionId:i,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname})});if(!o.ok){let s=await o.json().catch(()=>({}));throw new Error(`Failed to create session: ${o.status} ${o.statusText}. ${s.message||""}`)}let r=await o.json();return a("INTERNAL_SESSION_CREATED",{sessionId:i.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),i}catch(n){let o=n instanceof Error?n.message:String(n);throw a("INTERNAL_SESSION_FAILED",{error:o,environment:this.config.environment,apiKeyType:"public"}),this.config.onError?.(n),new Error(`Failed to create verification session: ${o}`)}}getPortalApiUrl(){switch(this.config.environment){case"production":return"https://api.safepassageapp.com";case"staging":return"https://api-staging.safepassageapp.com";case"development":default:return"http://localhost:3001"}}},X=c});var ee={};u(ee,{SafePassage:()=>c,VERSION:()=>Q,default:()=>c});S();var Q="3.0.0";typeof window<"u"&&window&&(window.SafePassage=(S(),I(_)).SafePassage);return I(ee);})();
-if(typeof SafePassageSDK !== "undefined" && SafePassageSDK.SafePassage) { window.SafePassage = SafePassageSDK.SafePassage; }
+/* SafePassage SDK v3.0.4 - Redirect Implementation with Enhanced Security */
+"use strict";var SafePassageSDK=(()=>{var u=Object.defineProperty;var G=Object.getOwnPropertyDescriptor;var J=Object.getOwnPropertyNames;var X=Object.prototype.hasOwnProperty;var p=(t,e)=>()=>(t&&(e=t(t=0)),e);var g=(t,e)=>{for(var n in e)u(t,n,{get:e[n],enumerable:!0})},Y=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of J(e))!X.call(t,r)&&r!==n&&u(t,r,{get:()=>e[r],enumerable:!(i=G(e,r))||i.enumerable});return t};var P=t=>Y(u({},"__esModule",{value:!0}),t);function z(t,e){return T[e].includes(t)}function b(t,e,n=[]){let{origin:i}=t;return z(i,e)||n.length>0&&n.some(o=>{if(o.startsWith("*.")){let s=o.slice(2);return i.endsWith(`.${s}`)||i===`https://${s}`||i===`http://${s}`}return i===o})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:T[e],allowedCustomOrigins:n,eventType:t.data?.type}),!1)}function x(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed","cancelled"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function V(t){if(t==="production"&&window.location.protocol!=="https:"){let e=window.location.href.replace("http:","https:");console.error("SafePassage Security: HTTPS required in production. Redirecting...",{current:window.location.href,redirect:e}),window.location.replace(e)}}function h(t,e){try{let n=new URL(t);if(e==="production"&&n.protocol!=="https:")return{isValid:!1,error:"HTTPS required for return URLs in production"};if(e==="development"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"||n.hostname.endsWith(".local"))&&n.protocol!=="https:")return{isValid:!1,error:"Non-localhost URLs must use HTTPS"};if(e==="staging"&&n.protocol!=="https:")return{isValid:!1,error:"HTTPS required for return URLs in staging"};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let r of i)if(r.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch{return{isValid:!1,error:"Invalid URL format"}}}function a(t,e){console.warn(`SafePassage Security Event: ${t}`,{timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href,...e})}var T,f,L,m=p(()=>{"use strict";T={production:["https://verify.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://verify-staging.safepassageapp.com","https://portal-staging.safepassageapp.com","https://api-staging.safepassageapp.com"],development:["http://localhost:5173","http://localhost:3000","http://localhost:3001","http://localhost:3002","http://127.0.0.1:5173","http://127.0.0.1:3000","http://127.0.0.1:3001","http://127.0.0.1:3002"]};f=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),r=(this.attempts.get(e)||[]).filter(o=>n-o<this.timeWindow);return r.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(r.push(n),this.attempts.set(e,r),!0)}reset(e){this.attempts.delete(e)}},L=new f});var R={};g(R,{createSignedState:()=>Q,generateHMAC:()=>w,generateSecureToken:()=>M,getSigningSecret:()=>v,parseSignedState:()=>ee,verifyHMAC:()=>C});async function w(t,e){let n=new TextEncoder,i=n.encode(e),r=n.encode(t),o=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),s=await crypto.subtle.sign("HMAC",o,r);return Array.from(new Uint8Array(s)).map(l=>l.toString(16).padStart(2,"0")).join("")}async function C(t,e,n){try{let i=await w(t,n);return Z(e,i)}catch{return!1}}function Z(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function M(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function v(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025",development:"safepassage-dev-hmac-2025"}[t]}async function Q(t,e){let n={...t,timestamp:Date.now(),nonce:M(16)},i=JSON.stringify(n),r=v(e),o=await w(i,r);return btoa(JSON.stringify({data:n,signature:o}))}async function ee(t,e,n=D){try{let i=atob(t),r=JSON.parse(i);if(!r.data||!r.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:o,signature:s}=r,l=JSON.stringify(o),F=v(e);if(!await C(l,s,F))return console.warn("SafePassage: State signature verification failed"),null;if(o.timestamp){let E=Date.now()-o.timestamp;if(E>n)return console.warn("SafePassage: State parameter expired",{age:E,maxAge:n}),null}let{timestamp:ce,nonce:le,...B}=o;return B}catch(i){return console.warn("SafePassage: Failed to parse signed state",i),null}}var _=p(()=>{"use strict";S()});function k(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>N)throw new Error(`apiKey exceeds maximum length of ${N} characters`);if(!te.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window<"u"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>d)throw new Error(`returnUrl exceeds maximum length of ${d} characters`);if(!t.cancelUrl)throw new Error("cancelUrl is required");if(t.cancelUrl.length>d)throw new Error(`cancelUrl exceeds maximum length of ${d} characters`);let e=ne(),n=h(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);let i=h(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`);if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<$)throw new Error(`defaultChallengeAge must be at least ${$}`);if(t.defaultChallengeAge>O)throw new Error(`defaultChallengeAge cannot exceed ${O}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function ne(){let t=window.location.hostname;return t==="localhost"||t==="127.0.0.1"||t.includes(".local")?"development":t.includes("staging")||t.includes("stage")?"staging":"production"}async function K(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(_(),R));return n(t,e)}var $,O,d,N,D,te,S=p(()=>{"use strict";m();$=25,O=150,d=2048,N=128,D=6e5,te=/^(pk_|sk_)[a-zA-Z0-9]+$/});function y(t){let e=ie[t];if((t==="production"||t==="staging")&&!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function re(t){let n={production:"https://api.safepassageapp.com",staging:"https://api-staging.safepassageapp.com",development:"http://localhost:3001"}[t];if((t==="production"||t==="staging")&&!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function W(t){let e=window.location.protocol==="https:",n=window.location.hostname;switch(t){case"production":if(!e)throw new Error("SafePassage requires HTTPS in production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break;case"development":let i=n==="localhost"||n==="127.0.0.1"||n.includes(".local");!e&&!i&&console.warn("SafePassage Warning: HTTPS recommended for non-localhost development");break}try{y(t),re(t)}catch(i){throw new Error(`Environment configuration validation failed: ${i}`)}}var ie,H=p(()=>{"use strict";ie={production:"https://verify.safepassageapp.com",staging:"https://verify-staging.safepassageapp.com",development:"http://localhost:5173"}});var q={};g(q,{SafePassage:()=>c,default:()=>oe});var c,oe,I=p(()=>{"use strict";S();H();m();c=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;k(e),this.config={...e,environment:e.environment||this.detectEnvironment(),mode:e.mode||"redirect"},W(this.config.environment),V(this.config.environment),a("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){let n=this.isPublicKey(),i=e.sessionId;if(n&&!i&&(i=await this.createInternalSession(e)),!n&&!i)throw new Error("sessionId is required for private API keys - must be a merchant-generated UUID v4");if(!i)throw new Error("Failed to create or obtain sessionId");if(this.isVerificationInProgress){let r=new Error(`Verification already in progress for session ${this.currentSessionId?.substring(0,8)}...`);throw a("RACE_CONDITION_PREVENTED",{currentSession:this.currentSessionId?.substring(0,8)+"...",attemptedSession:e.sessionId?e.sessionId.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.onError?.(r),r}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let r=`${this.config.apiKey}:${window.location.origin}`;if(!L.isAllowed(r)){let s=new Error("Too many verification attempts. Please wait before trying again.");throw a("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),this.config.onError?.(s),s}let o=await this.buildVerificationUrl({...e,sessionId:i});a("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(o,i):(this.unlockVerification(),this.redirect(o))}catch(r){throw this.unlockVerification(),r}}async buildVerificationUrl(e){let n=y(this.config.environment),i=e.challengeAge!==void 0,r=e.verificationMode!==void 0,o=i||r,s=await K({merchantId:this.config.apiKey,sessionId:e.sessionId,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now()},this.config.environment),l=new URLSearchParams({state:s,sessionId:e.sessionId,mode:this.config.mode});return`${n}/verify?${l.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){this.config.onError?.(new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=i=>{if(!b(i,this.config.environment)){a("POSTMESSAGE_ORIGIN_BLOCKED",{origin:i.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:i.data?.type});return}let r=x(i,n);if(!r.isValid){a("POSTMESSAGE_VALIDATION_FAILED",{error:r.error,origin:i.origin,sessionId:n.substring(0,8)+"...",messageType:i.data?.type});return}let o={sessionId:i.data.sessionId,status:i.data.status};a("VERIFICATION_COMPLETED",{status:o.status,sessionId:n.substring(0,8)+"...",origin:i.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),o.status==="verified"?this.config.onComplete?.(o):o.status==="cancelled"?this.config.onCancel?.():this.config.onError?.(new Error(`Verification failed: ${o.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{this.popupWindow&&this.popupWindow.closed&&(a("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),this.config.onCancel?.())},500)}setupAutoCleanup(){if(this.unloadListener=()=>{a("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e==="localhost"||e==="127.0.0.1"||e.includes(".local")?"development":e.includes("staging")||e.includes("stage")?"staging":"production"}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,a("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){a("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){let n=crypto.randomUUID();try{let i=this.getPortalApiUrl(),r=await fetch(`${i}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!r.ok){let s=await r.json().catch(()=>({}));throw new Error(`Failed to create session: ${r.status} ${r.statusText}. ${s.message||""}`)}let o=await r.json();return a("INTERNAL_SESSION_CREATED",{sessionId:n.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),n}catch(i){let r=i instanceof Error?i.message:String(i);throw a("INTERNAL_SESSION_FAILED",{error:r,environment:this.config.environment,apiKeyType:"public"}),this.config.onError?.(i),new Error(`Failed to create verification session: ${r}`)}}getPortalApiUrl(){switch(this.config.environment){case"production":return"https://api.safepassageapp.com";case"staging":return"https://api-staging.safepassageapp.com";case"development":default:return"http://localhost:3001"}}},oe=c});var se={};g(se,{SafePassage:()=>c,VERSION:()=>j,default:()=>c});function U(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function A(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support");try{if({a:{b:1}}?.a?.b!==1)throw new Error}catch{t.push("Optional chaining (?.) not supported, ensure transpilation for older browsers")}t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}I();typeof window<"u"&&(U(),A());var j="3.0.4";if(typeof window<"u"&&window){let{SafePassage:t}=(I(),P(q));window.SafePassage=t,window.SafePassage.VERSION=j}return P(se);})();
+if(typeof SafePassageSDK !== "undefined" && SafePassageSDK.SafePassage) { window.SafePassage = SafePassageSDK.SafePassage; window.SafePassage.VERSION = SafePassageSDK.VERSION; }

package/dist/tests/SafePassageSDK.test.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Tests for SafePassage SDK
+ */
+export {};