@safepassage/sdk 3.2.4 → 3.4.0

package/README.md

@@ -31,8 +31,7 @@ npm install @safepassage/sdk
 // Initialize SDK
 const safePassage = new SafePassage({
   apiKey: 'sk_xxxxx',         // Your API key
-  returnUrl: 'https://yoursite.com/verified',
-  cancelUrl: 'https://yoursite.com/cancelled'
+  returnUrl: 'https://yoursite.com/verified'
 });
 
 // Generate a session ID (must be UUID v4)
@@ -52,11 +51,9 @@ safePassage.verify({
 |--------|------|----------|-------------|
 | apiKey | string | Yes | Your API key (pk_xxx for client-side, sk_xxx for server-side) |
 | returnUrl | string | Yes | URL to redirect after successful verification |
-| cancelUrl | string | Yes | URL to redirect if user cancels |
 | environment | string | No | 'production', 'staging', or 'development' (auto-detected) |
 | mode | string | No | 'redirect' (default) or 'new-tab' |
 | onComplete | function | No | Callback for new-tab mode completion |
-| onCancel | function | No | Callback for new-tab mode cancellation |
 | onError | function | No | Error handler |
 
 ### API Key Types
@@ -127,8 +124,7 @@ User is redirected to SafePassage, then back to your site:
 ```javascript
 const safePassage = new SafePassage({
   apiKey: 'sk_xxxxx',
-  returnUrl: '/age-verified',
-  cancelUrl: '/age-gate'
+  returnUrl: '/age-verified'
 });
 
 safePassage.verify({ sessionId: crypto.randomUUID() });
@@ -141,20 +137,54 @@ Verification opens in a popup window:
 const safePassage = new SafePassage({
   apiKey: 'sk_xxxxx',
   returnUrl: '/age-verified',
-  cancelUrl: '/age-gate',
   mode: 'new-tab',
   onComplete: (result) => {
     console.log('Verified:', result.sessionId);
     // Validate on your server!
-  },
-  onCancel: () => {
-    console.log('User cancelled');
   }
 });
 
 safePassage.verify({ sessionId: crypto.randomUUID() });
 ```
 
+## URL Query Parameters
+
+SafePassage supports optional query parameters for streamlined verification flows:
+
+### skip_intro
+Skip the introductory screen and navigate directly to camera access:
+
+```javascript
+// Via SDK (automatic)
+safePassage.verify({ sessionId: crypto.randomUUID() });
+
+// Via server-side session creation
+const url = new URL(verifyUrl);
+url.searchParams.set('skip_intro', 'true');
+window.location.href = url.toString();
+```
+
+### auto_return
+Automatically redirect to `returnUrl` after successful verification (redirect mode only):
+
+```javascript
+// Via server-side session creation
+const url = new URL(verifyUrl);
+url.searchParams.set('auto_return', 'true');
+window.location.href = url.toString();
+```
+
+### Combined Example
+```javascript
+const url = new URL(verifyUrl);
+url.searchParams.set('skip_intro', 'true');
+url.searchParams.set('auto_return', 'true');
+// Result: Streamlined flow with minimal user interaction
+window.location.href = url.toString();
+```
+
+**For comprehensive parameter documentation, usage examples, and integration patterns, see [URL Parameters Reference](../../../docs/technical/api/VERIFY_UI_PARAMETERS.md).**
+
 ## Server-Side Validation (Required!)
 
 Always validate the session on your server:
@@ -209,8 +239,7 @@ function generateUUID() {
   <script>
     const safePassage = new SafePassage({
       apiKey: 'sk_xxxxx',
-      returnUrl: window.location.href + '?verified=true',
-      cancelUrl: window.location.href
+      returnUrl: window.location.href + '?verified=true'
     });
 
     function verifyAge() {
@@ -248,8 +277,7 @@ import { SafePassage, SafePassageConfig } from '@safepassage/sdk';
 
 const config: SafePassageConfig = {
   apiKey: process.env.SAFEPASSAGE_PUBLIC_KEY!,
-  returnUrl: '/verified',
-  cancelUrl: '/cancelled'
+  returnUrl: '/verified'
 };
 
 const safePassage = new SafePassage(config);
@@ -261,8 +289,7 @@ New streamlined approach (10 lines):
 ```javascript
 const safePassage = new SafePassage({
   apiKey: 'sk_xxxxx',
-  returnUrl: '/verified',
-  cancelUrl: '/cancelled'
+  returnUrl: '/verified'
 });
 safePassage.verify({ sessionId: crypto.randomUUID() });
 ```
@@ -280,4 +307,4 @@ safePassage.verify({ sessionId: crypto.randomUUID() });
 1. Always generate session IDs on the merchant side
 2. Validate sessions server-side before granting access
 3. Pre-register callback URLs in your dashboard
-4. Never expose your secret key (sk_xxx)
+4. Never expose your secret key (sk_xxx)

package/dist/core/SafePassageSDK.js

@@ -70,11 +70,7 @@ export class SafePassage {
             console.warn(`SafePassage SDK: Unknown environment '${normalizedEnvironment}', defaulting to 'production'`);
             normalizedEnvironment = 'production';
         }
-        this.config = {
-            ...config,
-            environment: normalizedEnvironment,
-            mode: config.mode || 'redirect',
-        };
+        this.config = Object.assign(Object.assign({}, config), { environment: normalizedEnvironment, mode: config.mode || 'redirect' });
         // Comprehensive environment security validation
         validateEnvironmentSecurity(this.config.environment);
         // Enforce HTTPS in production (additional layer)
@@ -109,6 +105,7 @@ export class SafePassage {
      * @throws {Error} If verification cannot be started or is already in progress
      */
     async verify(options = {}) {
+        var _a, _b, _c, _d, _e, _f;
         const isPublicKey = this.isPublicKey();
         // For public keys, create session via API (SafePassage generates the sessionId)
         let sessionId;
@@ -125,13 +122,13 @@ export class SafePassage {
         }
         // Race condition check - prevent multiple simultaneous verifications
         if (this.isVerificationInProgress) {
-            const error = new Error(`Verification already in progress for session ${this.currentSessionId?.substring(0, 8)}...`);
+            const error = new Error(`Verification already in progress for session ${(_a = this.currentSessionId) === null || _a === void 0 ? void 0 : _a.substring(0, 8)}...`);
             logSecurityEvent('RACE_CONDITION_PREVENTED', {
-                currentSession: this.currentSessionId?.substring(0, 8) + '...',
+                currentSession: ((_b = this.currentSessionId) === null || _b === void 0 ? void 0 : _b.substring(0, 8)) + '...',
                 attemptedSession: 'new-session-attempt',
                 origin: window.location.origin,
             });
-            this.config.onError?.(error);
+            (_d = (_c = this.config).onError) === null || _d === void 0 ? void 0 : _d.call(_c, error);
             throw error;
         }
         // Lock verification process
@@ -149,7 +146,7 @@ export class SafePassage {
                         ? sessionId.substring(0, 8) + '...'
                         : 'undefined',
                 });
-                this.config.onError?.(error);
+                (_f = (_e = this.config).onError) === null || _f === void 0 ? void 0 : _f.call(_e, error);
                 throw error;
             }
             const verificationUrl = await this.buildVerificationUrl(options, sessionId);
@@ -224,13 +221,28 @@ export class SafePassage {
                 const url = new URL(this.lastVerifyUrl);
                 url.searchParams.set('state', state);
                 url.searchParams.set('mode', this.config.mode);
+                // Append skip parameters if provided
+                if (options.skipIntro) {
+                    url.searchParams.set('skip_intro', 'true');
+                }
+                if (options.autoReturn) {
+                    url.searchParams.set('auto_return', 'true');
+                }
                 return url.toString();
             }
-            catch {
+            catch (_a) {
                 // Fall back to client-constructed URL if parsing fails
             }
         }
+        // Client-constructed URL fallback (for backwards compatibility)
         const params = new URLSearchParams({ state, sessionId, mode: this.config.mode });
+        // Append skip parameters if provided
+        if (options.skipIntro) {
+            params.set('skip_intro', 'true');
+        }
+        if (options.autoReturn) {
+            params.set('auto_return', 'true');
+        }
         return `${baseUrl}/?${params.toString()}`;
     }
     /**
@@ -257,6 +269,7 @@ export class SafePassage {
      * @private
      */
     openNewTab(url, sessionId) {
+        var _a, _b;
         // Clean up any existing resources
         this.cleanup();
         // Clear any existing popup monitor interval
@@ -267,18 +280,19 @@ export class SafePassage {
         // Open new tab
         this.popupWindow = window.open(url, 'safepassage-verify', 'width=600,height=700');
         if (!this.popupWindow) {
-            this.config.onError?.(new Error('Failed to open verification window. Please check popup blocker settings.'));
+            (_b = (_a = this.config).onError) === null || _b === void 0 ? void 0 : _b.call(_a, new Error('Failed to open verification window. Please check popup blocker settings.'));
             return;
         }
         // Set up PostMessage listener with enhanced security
         this.messageListener = (event) => {
+            var _a, _b, _c, _d, _e, _f, _g, _h;
             // Enhanced origin validation with strict allowlist
             if (!validatePostMessageOrigin(event, this.config.environment)) {
                 logSecurityEvent('POSTMESSAGE_ORIGIN_BLOCKED', {
                     origin: event.origin,
                     environment: this.config.environment,
                     expectedOrigins: `SafePassage trusted origins for ${this.config.environment}`,
-                    messageType: event.data?.type,
+                    messageType: (_a = event.data) === null || _a === void 0 ? void 0 : _a.type,
                 });
                 return;
             }
@@ -289,7 +303,7 @@ export class SafePassage {
                     error: messageValidation.error,
                     origin: event.origin,
                     sessionId: sessionId.substring(0, 8) + '...',
-                    messageType: event.data?.type,
+                    messageType: (_b = event.data) === null || _b === void 0 ? void 0 : _b.type,
                 });
                 return;
             }
@@ -314,18 +328,19 @@ export class SafePassage {
             }
             // Trigger appropriate callback
             if (result.status === 'verified') {
-                this.config.onComplete?.(result);
+                (_d = (_c = this.config).onComplete) === null || _d === void 0 ? void 0 : _d.call(_c, result);
             }
             else if (result.status === 'cancelled') {
-                this.config.onCancel?.();
+                (_f = (_e = this.config).onCancel) === null || _f === void 0 ? void 0 : _f.call(_e);
             }
             else {
-                this.config.onError?.(new Error(`Verification failed: ${result.status}`));
+                (_h = (_g = this.config).onError) === null || _h === void 0 ? void 0 : _h.call(_g, new Error(`Verification failed: ${result.status}`));
             }
         };
         window.addEventListener('message', this.messageListener);
         // Monitor popup window with proper cleanup
         this.popupMonitorInterval = setInterval(() => {
+            var _a, _b;
             if (this.popupWindow && this.popupWindow.closed) {
                 // Log popup closed event
                 logSecurityEvent('POPUP_CLOSED_BY_USER', {
@@ -336,7 +351,7 @@ export class SafePassage {
                 this.cleanup();
                 // Unlock verification after popup closed
                 this.unlockVerification();
-                this.config.onCancel?.();
+                (_b = (_a = this.config).onCancel) === null || _b === void 0 ? void 0 : _b.call(_a);
             }
         }, 500);
     }
@@ -556,6 +571,7 @@ export class SafePassage {
      * @private
      */
     async createInternalSession(options) {
+        var _a, _b;
         try {
             const portalApiUrl = this.getPortalApiUrl();
             const response = await fetch(`${portalApiUrl}/api/v1/sessions/create`, {
@@ -612,7 +628,7 @@ export class SafePassage {
                 environment: this.config.environment,
                 apiKeyType: 'public',
             });
-            this.config.onError?.(error);
+            (_b = (_a = this.config).onError) === null || _b === void 0 ? void 0 : _b.call(_a, error);
             throw new Error(`Failed to create verification session: ${errorMessage}`);
         }
     }

package/dist/index.d.ts

@@ -18,4 +18,4 @@
  */
 export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
 export type { SafePassageConfig, VerificationOptions, VerificationResult, SessionValidationResponse, } from './types';
-export declare const VERSION = "3.0.15";
+export declare const VERSION = "3.4.0";

package/dist/index.js

@@ -24,8 +24,8 @@ if (typeof window !== 'undefined') {
     checkBrowserCompatibility();
 }
 export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
-// Version - Updated for handoffToken QR code fix
-export const VERSION = '3.0.15';
+// Version - 3.4.0: Deprecated cancelUrl (all redirects now use returnUrl with status param)
+export const VERSION = '3.4.0';
 // For UMD builds
 if (typeof window !== 'undefined' && window) {
     // Dynamic import for UMD builds

package/dist/safepassage.min.js

@@ -1,3 +1,3 @@
 /* SafePassage SDK v3.0.15 - Redirect Implementation with Enhanced Security */
-"use strict";var SafePassageSDK=(()=>{var f=Object.defineProperty;var X=Object.getOwnPropertyDescriptor;var Y=Object.getOwnPropertyNames;var z=Object.prototype.hasOwnProperty;var p=(t,e)=>()=>(t&&(e=t(t=0)),e);var h=(t,e)=>{for(var n in e)f(t,n,{get:e[n],enumerable:!0})},Z=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of Y(e))!z.call(t,r)&&r!==n&&f(t,r,{get:()=>e[r],enumerable:!(i=X(e,r))||i.enumerable});return t};var A=t=>Z(f({},"__esModule",{value:!0}),t);function Q(t,e){return x[e].includes(t)}function V(t,e,n=[]){let{origin:i}=t;return Q(i,e)||n.length>0&&n.some(s=>{if(s.startsWith("*.")){let o=s.slice(2);return i.endsWith(`.${o}`)||i===`https://${o}`||i===`http://${o}`}return i===s})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:x[e],allowedCustomOrigins:n,eventType:t.data?.type}),!1)}function k(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed","cancelled"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function M(t){t==="production"&&window.location.protocol!=="https:"&&console.warn("SafePassage Warning: HTTPS recommended for production environment",{current:window.location.href})}function w(t,e){try{let n=new URL(t);if(n.protocol!=="https:"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"))return{isValid:!1,error:`HTTPS required for return URLs in ${e}`};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let r of i)if(r.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch{return{isValid:!1,error:"Invalid URL format"}}}function a(t,e){console.warn(`SafePassage Security Event: ${t}`,{timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href,...e})}var x,m,L,v=p(()=>{"use strict";x={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av.staging.safepassageapp.com","https://portal.staging.safepassageapp.com","https://api.staging.safepassageapp.com"]};m=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),r=(this.attempts.get(e)||[]).filter(s=>n-s<this.timeWindow);return r.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(r.push(n),this.attempts.set(e,r),!0)}reset(e){this.attempts.delete(e)}},L=new m});var R={};h(R,{createSignedState:()=>te,generateHMAC:()=>S,generateSecureToken:()=>C,getSigningSecret:()=>y,parseSignedState:()=>ne,verifyHMAC:()=>_});async function S(t,e){let n=new TextEncoder,i=n.encode(e),r=n.encode(t),s=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",s,r);return Array.from(new Uint8Array(o)).map(l=>l.toString(16).padStart(2,"0")).join("")}async function _(t,e,n){try{let i=await S(t,n);return ee(e,i)}catch{return!1}}function ee(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function C(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function y(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025"}[t]}async function te(t,e){let n={...t,timestamp:Date.now(),nonce:C(16)},i=JSON.stringify(n),r=y(e),s=await S(i,r);return btoa(JSON.stringify({data:n,signature:s}))}async function ne(t,e,n=$){try{let i=atob(t),r=JSON.parse(i);if(!r.data||!r.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:s,signature:o}=r,l=JSON.stringify(s),u=y(e);if(!await _(l,o,u))return console.warn("SafePassage: State signature verification failed"),null;if(s.timestamp){let U=Date.now()-s.timestamp;if(U>n)return console.warn("SafePassage: State parameter expired",{age:U,maxAge:n}),null}let{timestamp:ce,nonce:le,...J}=s;return J}catch(i){return console.warn("SafePassage: Failed to parse signed state",i),null}}var D=p(()=>{"use strict";E()});function W(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>K)throw new Error(`apiKey exceeds maximum length of ${K} characters`);if(!ie.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window<"u"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>g)throw new Error(`returnUrl exceeds maximum length of ${g} characters`);if(!t.cancelUrl)throw new Error("cancelUrl is required");if(t.cancelUrl.length>g)throw new Error(`cancelUrl exceeds maximum length of ${g} characters`);let e=re(),n=w(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);let i=w(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`);if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<O)throw new Error(`defaultChallengeAge must be at least ${O}`);if(t.defaultChallengeAge>N)throw new Error(`defaultChallengeAge cannot exceed ${N}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function re(){if(typeof window>"u")return"production";let t=window.location.hostname;return t.includes("staging")||t.includes("stage")?"staging":"production"}async function H(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(D(),R));return n(t,e)}var O,N,g,K,$,ie,E=p(()=>{"use strict";v();O=25,N=150,g=2048,K=128,$=6e5,ie=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function I(t){let e=q[t]||q.production;if(!e||!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function se(t){let e={production:"https://api.safepassageapp.com",staging:"https://api.staging.safepassageapp.com"},n=e[t]||e.production;if(!n||!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function j(t){let e=window.location.protocol==="https:";switch(t){case"production":e||console.warn("SafePassage Warning: HTTPS recommended for production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break}try{I(t),se(t)}catch(n){let i=n instanceof Error?n.message:String(n);throw new Error(`Environment configuration validation failed: ${i}`)}}var q,F=p(()=>{"use strict";q={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com"}});var B={};h(B,{SafePassage:()=>c,default:()=>oe});var c,oe,P=p(()=>{"use strict";E();F();v();c=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;this.lastVerifyUrl=null;this.lastSessionToken=null;W(e);let n=e.environment||this.detectEnvironment();n!=="staging"&&n!=="production"&&(console.warn(`SafePassage SDK: Unknown environment '${n}', defaulting to 'production'`),n="production"),this.config={...e,environment:n,mode:e.mode||"redirect"},j(this.config.environment),M(this.config.environment),a("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){let n=this.isPublicKey(),i;if(n)i=await this.createInternalSession(e);else throw new Error("Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only.");if(!i)throw new Error("Failed to obtain sessionId from server");if(this.isVerificationInProgress){let r=new Error(`Verification already in progress for session ${this.currentSessionId?.substring(0,8)}...`);throw a("RACE_CONDITION_PREVENTED",{currentSession:this.currentSessionId?.substring(0,8)+"...",attemptedSession:"new-session-attempt",origin:window.location.origin}),this.config.onError?.(r),r}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let r=`${this.config.apiKey}:${window.location.origin}`;if(!L.isAllowed(r)){let o=new Error("Too many verification attempts. Please wait before trying again.");throw a("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),this.config.onError?.(o),o}let s=await this.buildVerificationUrl(e,i);a("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(s,i):(this.unlockVerification(),this.redirect(s))}catch(r){throw this.unlockVerification(),r}}async buildVerificationUrl(e,n){let i=I(this.config.environment),r=e.challengeAge!==void 0,s=e.verificationMode!==void 0,o=r||s,l=await H({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this._temporaryHandoffToken,sessionToken:this.lastSessionToken||void 0,verifyUrl:this.lastVerifyUrl||void 0},this.config.environment);if(this.lastVerifyUrl)try{let d=new URL(this.lastVerifyUrl);return d.searchParams.set("state",l),d.searchParams.set("mode",this.config.mode),d.toString()}catch{}let u=new URLSearchParams({state:l,sessionId:n,mode:this.config.mode});return`${i}/?${u.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){this.config.onError?.(new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=i=>{if(!V(i,this.config.environment)){a("POSTMESSAGE_ORIGIN_BLOCKED",{origin:i.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:i.data?.type});return}let r=k(i,n);if(!r.isValid){a("POSTMESSAGE_VALIDATION_FAILED",{error:r.error,origin:i.origin,sessionId:n.substring(0,8)+"...",messageType:i.data?.type});return}let s={sessionId:i.data.sessionId,status:i.data.status};a("VERIFICATION_COMPLETED",{status:s.status,sessionId:n.substring(0,8)+"...",origin:i.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),s.status==="verified"?this.config.onComplete?.(s):s.status==="cancelled"?this.config.onCancel?.():this.config.onError?.(new Error(`Verification failed: ${s.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{this.popupWindow&&this.popupWindow.closed&&(a("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),this.config.onCancel?.())},500)}setupAutoCleanup(){if(this.unloadListener=()=>{a("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,a("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){a("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){try{let n=this.getPortalApiUrl(),i=await fetch(`${n}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!i.ok){let o=await i.json().catch(()=>({}));throw new Error(`Failed to create session: ${i.status} ${i.statusText}. ${o.message||""}`)}let r=await i.json(),s=r.sessionId;if(!s)throw new Error("Server did not return a sessionId");return r.verifyUrl&&(this.lastVerifyUrl=r.verifyUrl),r.sessionToken&&(this.lastSessionToken=r.sessionToken),r.handoffToken&&(this._temporaryHandoffToken=r.handoffToken),a("INTERNAL_SESSION_CREATED",{sessionId:s.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),s}catch(n){let i=n instanceof Error?n.message:String(n);throw a("INTERNAL_SESSION_FAILED",{error:i,environment:this.config.environment,apiKeyType:"public"}),this.config.onError?.(n),new Error(`Failed to create verification session: ${i}`)}}},oe=c});var ae={};h(ae,{SafePassage:()=>c,VERSION:()=>G,default:()=>c});function b(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function T(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support");try{if({a:{b:1}}?.a?.b!==1)throw new Error}catch{t.push("Optional chaining (?.) not supported, ensure transpilation for older browsers")}t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}P();typeof window<"u"&&(b(),T());var G="3.0.15";if(typeof window<"u"&&window){let{SafePassage:t}=(P(),A(B)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=G)}return A(ae);})();
+"use strict";var SafePassageSDK=(()=>{var S=Object.defineProperty,oe=Object.defineProperties,ae=Object.getOwnPropertyDescriptor,ce=Object.getOwnPropertyDescriptors,le=Object.getOwnPropertyNames,v=Object.getOwnPropertySymbols;var P=Object.prototype.hasOwnProperty,C=Object.prototype.propertyIsEnumerable;var R=(t,e,n)=>e in t?S(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n,h=(t,e)=>{for(var n in e||(e={}))P.call(e,n)&&R(t,n,e[n]);if(v)for(var n of v(e))C.call(e,n)&&R(t,n,e[n]);return t},y=(t,e)=>oe(t,ce(e));var D=(t,e)=>{var n={};for(var i in t)P.call(t,i)&&e.indexOf(i)<0&&(n[i]=t[i]);if(t!=null&&v)for(var i of v(t))e.indexOf(i)<0&&C.call(t,i)&&(n[i]=t[i]);return n};var w=(t,e)=>()=>(t&&(e=t(t=0)),e);var U=(t,e)=>{for(var n in e)S(t,n,{get:e[n],enumerable:!0})},pe=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of le(e))!P.call(t,r)&&r!==n&&S(t,r,{get:()=>e[r],enumerable:!(i=ae(e,r))||i.enumerable});return t};var $=t=>pe(S({},"__esModule",{value:!0}),t);function de(t,e){return K[e].includes(t)}function W(t,e,n=[]){var r;let{origin:i}=t;return de(i,e)||n.length>0&&n.some(o=>{if(o.startsWith("*.")){let a=o.slice(2);return i.endsWith(`.${a}`)||i===`https://${a}`||i===`http://${a}`}return i===o})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:K[e],allowedCustomOrigins:n,eventType:(r=t.data)==null?void 0:r.type}),!1)}function H(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed","cancelled"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function j(t){t==="production"&&window.location.protocol!=="https:"&&console.warn("SafePassage Warning: HTTPS recommended for production environment",{current:window.location.href})}function T(t,e){try{let n=new URL(t);if(n.protocol!=="https:"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"))return{isValid:!1,error:`HTTPS required for return URLs in ${e}`};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let r of i)if(r.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch(n){return{isValid:!1,error:"Invalid URL format"}}}function l(t,e){console.warn(`SafePassage Security Event: ${t}`,h({timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href},e))}var K,A,q,b=w(()=>{"use strict";K={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av.staging.safepassageapp.com","https://portal.staging.safepassageapp.com","https://api.staging.safepassageapp.com"]};A=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),r=(this.attempts.get(e)||[]).filter(s=>n-s<this.timeWindow);return r.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(r.push(n),this.attempts.set(e,r),!0)}reset(e){this.attempts.delete(e)}},q=new A});var G={};U(G,{createSignedState:()=>ge,generateHMAC:()=>x,generateSecureToken:()=>B,getSigningSecret:()=>V,parseSignedState:()=>fe,verifyHMAC:()=>F});async function x(t,e){let n=new TextEncoder,i=n.encode(e),r=n.encode(t),s=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",s,r);return Array.from(new Uint8Array(o)).map(a=>a.toString(16).padStart(2,"0")).join("")}async function F(t,e,n){try{let i=await x(t,n);return ue(e,i)}catch(i){return!1}}function ue(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function B(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function V(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025"}[t]}async function ge(t,e){let n=y(h({},t),{timestamp:Date.now(),nonce:B(16)}),i=JSON.stringify(n),r=V(e),s=await x(i,r);return btoa(JSON.stringify({data:n,signature:s}))}async function fe(t,e,n=X){try{let r=atob(t),s=JSON.parse(r);if(!s.data||!s.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:o,signature:a}=s,p=JSON.stringify(o),c=V(e);if(!await F(p,a,c))return console.warn("SafePassage: State signature verification failed"),null;if(o.timestamp){let m=Date.now()-o.timestamp;if(m>n)return console.warn("SafePassage: State parameter expired",{age:m,maxAge:n}),null}let i=o,{timestamp:g,nonce:f}=i;return D(i,["timestamp","nonce"])}catch(r){return console.warn("SafePassage: Failed to parse signed state",r),null}}var J=w(()=>{"use strict";k()});function Q(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>Z)throw new Error(`apiKey exceeds maximum length of ${Z} characters`);if(!he.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window!="undefined"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>E)throw new Error(`returnUrl exceeds maximum length of ${E} characters`);let e=me(),n=T(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);if(t.cancelUrl){if(t.cancelUrl.length>E)throw new Error(`cancelUrl exceeds maximum length of ${E} characters`);let i=T(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`)}if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<Y)throw new Error(`defaultChallengeAge must be at least ${Y}`);if(t.defaultChallengeAge>z)throw new Error(`defaultChallengeAge cannot exceed ${z}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function me(){if(typeof window=="undefined")return"production";let t=window.location.hostname;return t.includes("staging")||t.includes("stage")?"staging":"production"}async function ee(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(J(),G));return n(t,e)}var Y,z,E,Z,X,he,k=w(()=>{"use strict";b();Y=25,z=150,E=2048,Z=128,X=6e5,he=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function M(t){let e=te[t]||te.production;if(!e||!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function we(t){let e={production:"https://api.safepassageapp.com",staging:"https://api.staging.safepassageapp.com"},n=e[t]||e.production;if(!n||!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function ne(t){let e=window.location.protocol==="https:";switch(t){case"production":e||console.warn("SafePassage Warning: HTTPS recommended for production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break}try{M(t),we(t)}catch(n){let i=n instanceof Error?n.message:String(n);throw new Error(`Environment configuration validation failed: ${i}`)}}var te,ie=w(()=>{"use strict";te={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com"}});var re={};U(re,{SafePassage:()=>u,default:()=>ve});var u,ve,_=w(()=>{"use strict";k();ie();b();u=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;this.lastVerifyUrl=null;this.lastSessionToken=null;Q(e);let n=e.environment||this.detectEnvironment();n!=="staging"&&n!=="production"&&(console.warn(`SafePassage SDK: Unknown environment '${n}', defaulting to 'production'`),n="production"),this.config=y(h({},e),{environment:n,mode:e.mode||"redirect"}),ne(this.config.environment),j(this.config.environment),l("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){var r,s,o,a,p,c;let n=this.isPublicKey(),i;if(n)i=await this.createInternalSession(e);else throw new Error("Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only.");if(!i)throw new Error("Failed to obtain sessionId from server");if(this.isVerificationInProgress){let d=new Error(`Verification already in progress for session ${(r=this.currentSessionId)==null?void 0:r.substring(0,8)}...`);throw l("RACE_CONDITION_PREVENTED",{currentSession:((s=this.currentSessionId)==null?void 0:s.substring(0,8))+"...",attemptedSession:"new-session-attempt",origin:window.location.origin}),(a=(o=this.config).onError)==null||a.call(o,d),d}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let d=`${this.config.apiKey}:${window.location.origin}`;if(!q.isAllowed(d)){let f=new Error("Too many verification attempts. Please wait before trying again.");throw l("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),(c=(p=this.config).onError)==null||c.call(p,f),f}let g=await this.buildVerificationUrl(e,i);l("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(g,i):(this.unlockVerification(),this.redirect(g))}catch(d){throw this.unlockVerification(),d}}async buildVerificationUrl(e,n){let i=M(this.config.environment),r=e.challengeAge!==void 0,s=e.verificationMode!==void 0,o=r||s,a=await ee({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this._temporaryHandoffToken,sessionToken:this.lastSessionToken||void 0,verifyUrl:this.lastVerifyUrl||void 0},this.config.environment);if(this.lastVerifyUrl)try{let c=new URL(this.lastVerifyUrl);return c.searchParams.set("state",a),c.searchParams.set("mode",this.config.mode),e.skipIntro&&c.searchParams.set("skip_intro","true"),e.autoReturn&&c.searchParams.set("auto_return","true"),c.toString()}catch(c){}let p=new URLSearchParams({state:a,sessionId:n,mode:this.config.mode});return e.skipIntro&&p.set("skip_intro","true"),e.autoReturn&&p.set("auto_return","true"),`${i}/?${p.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){var i,r;if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){(r=(i=this.config).onError)==null||r.call(i,new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=s=>{var p,c,d,g,f,I,m,L;if(!W(s,this.config.environment)){l("POSTMESSAGE_ORIGIN_BLOCKED",{origin:s.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:(p=s.data)==null?void 0:p.type});return}let o=H(s,n);if(!o.isValid){l("POSTMESSAGE_VALIDATION_FAILED",{error:o.error,origin:s.origin,sessionId:n.substring(0,8)+"...",messageType:(c=s.data)==null?void 0:c.type});return}let a={sessionId:s.data.sessionId,status:s.data.status};l("VERIFICATION_COMPLETED",{status:a.status,sessionId:n.substring(0,8)+"...",origin:s.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),a.status==="verified"?(g=(d=this.config).onComplete)==null||g.call(d,a):a.status==="cancelled"?(I=(f=this.config).onCancel)==null||I.call(f):(L=(m=this.config).onError)==null||L.call(m,new Error(`Verification failed: ${a.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{var s,o;this.popupWindow&&this.popupWindow.closed&&(l("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),(o=(s=this.config).onCancel)==null||o.call(s))},500)}setupAutoCleanup(){if(this.unloadListener=()=>{l("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,l("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){l("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){var n,i;try{let r=this.getPortalApiUrl(),s=await fetch(`${r}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!s.ok){let p=await s.json().catch(()=>({}));throw new Error(`Failed to create session: ${s.status} ${s.statusText}. ${p.message||""}`)}let o=await s.json(),a=o.sessionId;if(!a)throw new Error("Server did not return a sessionId");return o.verifyUrl&&(this.lastVerifyUrl=o.verifyUrl),o.sessionToken&&(this.lastSessionToken=o.sessionToken),o.handoffToken&&(this._temporaryHandoffToken=o.handoffToken),l("INTERNAL_SESSION_CREATED",{sessionId:a.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),a}catch(r){let s=r instanceof Error?r.message:String(r);throw l("INTERNAL_SESSION_FAILED",{error:s,environment:this.config.environment,apiKeyType:"public"}),(i=(n=this.config).onError)==null||i.call(n,r),new Error(`Failed to create verification session: ${s}`)}}},ve=u});var Se={};U(Se,{SafePassage:()=>u,VERSION:()=>se,default:()=>u});function O(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function N(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support"),t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}_();typeof window!="undefined"&&(O(),N());var se="3.4.0";if(typeof window!="undefined"&&window){let{SafePassage:t}=(_(),$(re)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=se)}return $(Se);})();
 if(typeof SafePassageSDK !== "undefined" && SafePassageSDK.SafePassage) { window.SafePassage = SafePassageSDK.SafePassage; window.SafePassage.VERSION = SafePassageSDK.VERSION; }

package/dist/types/index.d.ts

@@ -13,9 +13,10 @@ export interface SafePassageConfig {
     returnUrl: string;
     /**
      * URL to redirect to if user cancels verification
-     * Must be pre-registered in dashboard
+     * @deprecated This field is no longer used. All redirects go to returnUrl with a status parameter.
+     * Kept for backwards compatibility but will be ignored.
      */
-    cancelUrl: string;
+    cancelUrl?: string;
     /**
      * Environment to use
      * @default Auto-detected based on hostname (production unless staging detected)
@@ -68,6 +69,18 @@ export interface VerificationOptions {
      * Useful for correlating SafePassage sessions with merchant user records
      */
     externalUserId?: string;
+    /**
+     * Skip the intro screen and go directly to camera access
+     * Useful for embedded/streamlined flows where user has already consented
+     * @default false
+     */
+    skipIntro?: boolean;
+    /**
+     * Automatically redirect to returnUrl immediately after successful verification
+     * Skips the success screen for seamless embedded experiences
+     * @default false
+     */
+    autoReturn?: boolean;
 }
 export interface VerificationResult {
     /**
@@ -88,7 +101,8 @@ export interface StatePayload {
     merchantId: string;
     sessionId: string;
     returnUrl: string;
-    cancelUrl: string;
+    /** @deprecated No longer used - all redirects use returnUrl with status parameter */
+    cancelUrl?: string;
     challengeAge?: number;
     verificationMode?: 'L1' | 'L2';
     hasOverrides?: boolean;

package/dist/utils/crypto.js

@@ -22,6 +22,17 @@
  * @author SafePassage Engineering
  * @version 1.0.0
  */
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 import { STATE_EXPIRY_MS } from './validation';
 /**
  * Generate HMAC-SHA256 signature using Web Crypto API
@@ -69,7 +80,7 @@ export async function verifyHMAC(data, signature, secret) {
         const expectedSignature = await generateHMAC(data, secret);
         return constantTimeCompare(signature, expectedSignature);
     }
-    catch {
+    catch (_a) {
         return false;
     }
 }
@@ -145,11 +156,7 @@ export function getSigningSecret(environment) {
  */
 export async function createSignedState(payload, environment) {
     // Add timestamp for freshness
-    const timestampedPayload = {
-        ...payload,
-        timestamp: Date.now(),
-        nonce: generateSecureToken(16), // Add nonce to prevent replay attacks
-    };
+    const timestampedPayload = Object.assign(Object.assign({}, payload), { timestamp: Date.now(), nonce: generateSecureToken(16) });
     const dataString = JSON.stringify(timestampedPayload);
     const secret = getSigningSecret(environment);
     const signature = await generateHMAC(dataString, secret);
@@ -199,7 +206,7 @@ export async function parseSignedState(signedState, environment, maxAge = STATE_
         }
         // Remove internal fields before returning
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        const { timestamp, nonce, ...payload } = data;
+        const { timestamp, nonce } = data, payload = __rest(data, ["timestamp", "nonce"]);
         return payload;
     }
     catch (error) {

package/dist/utils/polyfills.js

@@ -51,17 +51,6 @@ export function checkBrowserCompatibility() {
     if (!window.URLSearchParams) {
         warnings.push('URLSearchParams not supported, consider adding a polyfill for IE 11 support');
     }
-    // Check for modern JavaScript features
-    try {
-        // Test optional chaining
-        const test = { a: { b: 1 } };
-        const result = test?.a?.b;
-        if (result !== 1)
-            throw new Error();
-    }
-    catch {
-        warnings.push('Optional chaining (?.) not supported, ensure transpilation for older browsers');
-    }
     // Log warnings if any
     if (warnings.length > 0) {
         console.warn('SafePassage SDK Browser Compatibility:', warnings.join('; '));

package/dist/utils/security.js

@@ -29,6 +29,7 @@ export function isOriginTrusted(origin, environment) {
  * Enhanced origin validation with logging and strict allowlist
  */
 export function validatePostMessageOrigin(event, environment, allowedCustomOrigins = []) {
+    var _a;
     const { origin } = event;
     // Check against trusted SafePassage origins
     if (isOriginTrusted(origin, environment)) {
@@ -55,7 +56,7 @@ export function validatePostMessageOrigin(event, environment, allowedCustomOrigi
         environment,
         trustedOrigins: TRUSTED_ORIGINS[environment],
         allowedCustomOrigins,
-        eventType: event.data?.type,
+        eventType: (_a = event.data) === null || _a === void 0 ? void 0 : _a.type,
     });
     return false;
 }
@@ -125,7 +126,7 @@ export function validateReturnUrl(url, environment) {
         }
         return { isValid: true };
     }
-    catch {
+    catch (_a) {
         return { isValid: false, error: 'Invalid URL format' };
     }
 }
@@ -185,11 +186,6 @@ export const verificationRateLimit = new VerificationRateLimit();
  * Security event logging for monitoring
  */
 export function logSecurityEvent(event, details) {
-    console.warn(`SafePassage Security Event: ${event}`, {
-        timestamp: new Date().toISOString(),
-        userAgent: navigator.userAgent,
-        url: window.location.href,
-        ...details,
-    });
+    console.warn(`SafePassage Security Event: ${event}`, Object.assign({ timestamp: new Date().toISOString(), userAgent: navigator.userAgent, url: window.location.href }, details));
     // In production, this could send events to a security monitoring service
 }

package/dist/utils/validation.js

@@ -35,21 +35,21 @@ export function validateConfig(config) {
     if (config.returnUrl.length > MAX_URL_LENGTH) {
         throw new Error(`returnUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`);
     }
-    if (!config.cancelUrl) {
-        throw new Error('cancelUrl is required');
-    }
-    if (config.cancelUrl.length > MAX_URL_LENGTH) {
-        throw new Error(`cancelUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`);
-    }
     // Enhanced URL validation with security checks
     const environment = detectEnvironment();
     const returnUrlValidation = validateReturnUrl(config.returnUrl, environment);
     if (!returnUrlValidation.isValid) {
         throw new Error(`returnUrl validation failed: ${returnUrlValidation.error}`);
     }
-    const cancelUrlValidation = validateReturnUrl(config.cancelUrl, environment);
-    if (!cancelUrlValidation.isValid) {
-        throw new Error(`cancelUrl validation failed: ${cancelUrlValidation.error}`);
+    // cancelUrl is deprecated but still validate if provided for backwards compatibility
+    if (config.cancelUrl) {
+        if (config.cancelUrl.length > MAX_URL_LENGTH) {
+            throw new Error(`cancelUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`);
+        }
+        const cancelUrlValidation = validateReturnUrl(config.cancelUrl, environment);
+        if (!cancelUrlValidation.isValid) {
+            throw new Error(`cancelUrl validation failed: ${cancelUrlValidation.error}`);
+        }
     }
     if (config.defaultChallengeAge !== undefined) {
         if (config.defaultChallengeAge < MINIMUM_AGE) {
@@ -121,11 +121,10 @@ export async function parseState(state, environment) {
         if (signedPayload) {
             // Type guard to ensure signedPayload has required properties
             const payload = signedPayload;
-            // Validate payload structure
+            // Validate payload structure (cancelUrl is deprecated and no longer required)
             if (!payload.merchantId ||
                 !payload.sessionId ||
-                !payload.returnUrl ||
-                !payload.cancelUrl) {
+                !payload.returnUrl) {
                 return null;
             }
             // Cast to unknown first to satisfy TypeScript's type checking
@@ -135,11 +134,10 @@ export async function parseState(state, environment) {
         console.warn('SafePassage: Falling back to legacy state format - update your SDK');
         const json = atob(state);
         const payload = JSON.parse(json);
-        // Validate payload structure
+        // Validate payload structure (cancelUrl is deprecated and no longer required)
         if (!payload.merchantId ||
             !payload.sessionId ||
-            !payload.returnUrl ||
-            !payload.cancelUrl) {
+            !payload.returnUrl) {
             return null;
         }
         // Check timestamp expiration

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safepassage/sdk",
-  "version": "3.2.4",
+  "version": "3.4.0",
   "description": "SafePassage SDK - Lightweight redirect-based age verification",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",