@safepassage/sdk 3.4.1 → 3.4.2

package/README.md

@@ -1,22 +1,15 @@
-# SafePassage SDK v3.0.12 - Performance-Optimized
+# SafePassage SDK v3.4
 
-A lightweight SDK for integrating SafePassage age verification using a simple redirect flow.
-
-## What's New in v3.0.12
-
-- **40% faster launch times**: Removed blocking config fetch, saving 100-300ms
-- **Instant redirects**: SDK now redirects immediately without API calls
-- **Improved reliability**: Eliminates dependency on config endpoint
+A lightweight SDK for integrating SafePassage age verification into your website or application.
 
 ## Features
 
-- **Ultra-lightweight**: 17.6KB minified
-- **Instant verification**: No blocking API calls during launch
-- **Simple integration**: Just 10 lines of code
+- **Ultra-lightweight**: ~18KB minified
+- **Simple integration**: 5 lines of code to get started
 - **Two modes**: Same-tab redirect or new-tab popup
 - **TypeScript support**: Full type definitions included
-- **Auto-environment detection**: Works seamlessly in development
-- **Secure**: Merchant-generated session IDs prevent attacks
+- **Auto-environment detection**: Works seamlessly across environments
+- **Secure**: HMAC-signed state parameters, automatic session management
 - **Compliant**: Enforces minimum age of 25
 
 ## Installation
@@ -25,286 +18,327 @@ A lightweight SDK for integrating SafePassage age verification using a simple re
 npm install @safepassage/sdk
 ```
 
+Or load directly from jsDelivr CDN (no bundler required):
+
+```html
+<script src="https://cdn.jsdelivr.net/npm/@safepassage/sdk@latest/dist/safepassage.min.js"></script>
+```
+
 ## Quick Start
 
+### With npm/bundler
+
 ```javascript
-// Initialize SDK
-const safePassage = new SafePassage({
-  apiKey: 'sk_xxxxx',         // Your API key
-  returnUrl: 'https://yoursite.com/verified'
+import { SafePassage } from '@safepassage/sdk';
+
+const sp = new SafePassage({
+  apiKey: 'pk_...',  // Your public key from the dashboard
+  returnUrl: window.location.origin + '/verified'
 });
 
-// Generate a session ID (must be UUID v4)
-const sessionId = crypto.randomUUID();
+// Start verification - redirects user to SafePassage
+await sp.verify();
+```
 
-// Trigger verification
-safePassage.verify({ 
-  sessionId: sessionId,             // Required: merchant-generated UUID
-  challengeAge: 25,                 // Optional: minimum age (25 or higher)
-  verificationMode: 'L1'            // Optional: 'L1' or 'L2'
-});
+### With CDN (no bundler)
+
+```html
+<script src="https://cdn.jsdelivr.net/npm/@safepassage/sdk@latest/dist/safepassage.min.js"></script>
+<script>
+  const sp = new SafePassage({
+    apiKey: 'pk_...',
+    returnUrl: window.location.origin + '/verified'
+  });
+
+  document.getElementById('verify-btn').onclick = () => sp.verify();
+</script>
 ```
 
+That's it! The SDK handles session creation automatically.
+
 ## Configuration
 
 | Option | Type | Required | Description |
 |--------|------|----------|-------------|
-| apiKey | string | Yes | Your API key (pk_xxx for client-side, sk_xxx for server-side) |
-| returnUrl | string | Yes | URL to redirect after successful verification |
-| environment | string | No | 'production', 'staging', or 'development' (auto-detected) |
-| mode | string | No | 'redirect' (default) or 'new-tab' |
-| onComplete | function | No | Callback for new-tab mode completion |
+| apiKey | string | Yes | Your public API key (`pk_...`) |
+| returnUrl | string | Yes | URL to redirect after verification |
+| environment | string | No | `'production'` or `'staging'` (auto-detected) |
+| mode | string | No | `'redirect'` (default) or `'new-tab'` |
+| defaultChallengeAge | number | No | Default minimum age (25 or higher) |
+| defaultVerificationMode | string | No | `'L1'` or `'L2'` |
+| onComplete | function | No | Callback for new-tab mode |
+| onCancel | function | No | Called when user closes popup (new-tab mode) |
 | onError | function | No | Error handler |
 
-### API Key Types
-
-SafePassage provides two types of API keys:
-
-- **Public Keys (`pk_`)**: Safe for client-side use (websites, mobile apps)
-  - Limited to creating and initiating verifications
-  - Cannot read verification results or override settings
-  - SDK auto-generates sessionId if not provided
-  
-- **Secret Keys (`sk_`)**: Server-side only - keep these private!
-  - Full API access including reading verification results
-  - Can override challenge age and verification mode
-  - Requires merchant-generated sessionId
-
 ## Verification Options
 
-```javascript
-safePassage.verify({
-  sessionId: 'uuid-v4',        // Required for sk_ keys, optional for pk_ keys
-  challengeAge: 30,            // Optional: min 25 (sk_ keys only)
-  verificationMode: 'L2'       // Optional: 'L1' or 'L2' (sk_ keys only)
-});
-```
-
-### Configuration Override Behavior
-
-When you pass `challengeAge` or `verificationMode` to the `verify()` method, these values take precedence over your dashboard configuration for that specific verification session:
+Override settings per-verification:
 
-- **No overrides**: Uses your current dashboard settings
-- **With overrides**: SDK values are used instead of dashboard settings
-- **Challenge age**: Must be 25 or higher (lower values will be rejected)
-- **Verification mode**: 
-  - `'L1'`: Age estimation with computer vision
-  - `'L2'`: Always requires ID verification
-
-Example use cases:
 ```javascript
-// Use dashboard defaults
-safePassage.verify({ sessionId: crypto.randomUUID() });
-
-// Override just challenge age
-safePassage.verify({ 
-  sessionId: crypto.randomUUID(),
-  challengeAge: 30  // Require age 30+ for this session
+await sp.verify({
+  challengeAge: 30,           // Override minimum age for this session
+  verificationMode: 'L2',     // Force ID verification for this session
+  externalUserId: 'user-123', // Your user ID (returned in webhooks)
+  skipIntro: true,            // Skip intro screen
+  autoReturn: true            // Auto-redirect after success
 });
+```
 
-// Override just verification mode
-safePassage.verify({ 
-  sessionId: crypto.randomUUID(),
-  verificationMode: 'L2'  // Force ID check for this session
-});
+### Verification Modes
 
-// Override both
-safePassage.verify({ 
-  sessionId: crypto.randomUUID(),
-  challengeAge: 30,
-  verificationMode: 'L2'  // ID required for 30+ verification
-});
-```
+- **L1**: Age estimation using computer vision (faster, less friction)
+- **L2**: Full ID document verification (more thorough)
 
-## Modes
+## Integration Modes
 
 ### Same-Tab Redirect (Default)
-User is redirected to SafePassage, then back to your site:
+
+User is redirected to SafePassage, then back to your `returnUrl`:
 
 ```javascript
-const safePassage = new SafePassage({
-  apiKey: 'sk_xxxxx',
+const sp = new SafePassage({
+  apiKey: 'pk_...',
   returnUrl: '/age-verified'
 });
 
-safePassage.verify({ sessionId: crypto.randomUUID() });
+await sp.verify();
+// User is redirected to SafePassage...
+// After verification, user returns to /age-verified?sessionId=xxx&status=verified
 ```
 
 ### New-Tab Mode
+
 Verification opens in a popup window:
 
 ```javascript
-const safePassage = new SafePassage({
-  apiKey: 'sk_xxxxx',
+const sp = new SafePassage({
+  apiKey: 'pk_...',
   returnUrl: '/age-verified',
   mode: 'new-tab',
   onComplete: (result) => {
-    console.log('Verified:', result.sessionId);
-    // Validate on your server!
+    console.log('Verification complete:', result.sessionId, result.status);
+    // Validate on your server, then update UI
+  },
+  onCancel: () => {
+    console.log('User closed the verification window');
+  },
+  onError: (error) => {
+    console.error('Verification error:', error.message);
   }
 });
 
-safePassage.verify({ sessionId: crypto.randomUUID() });
-```
-
-## URL Query Parameters
-
-SafePassage supports optional query parameters for streamlined verification flows:
-
-### skip_intro
-Skip the introductory screen and navigate directly to camera access:
-
-```javascript
-// Via SDK (automatic)
-safePassage.verify({ sessionId: crypto.randomUUID() });
-
-// Via server-side session creation
-const url = new URL(verifyUrl);
-url.searchParams.set('skip_intro', 'true');
-window.location.href = url.toString();
+await sp.verify();
 ```
 
-### auto_return
-Automatically redirect to `returnUrl` after successful verification (redirect mode only):
+## Server-Side Validation (Required!)
 
-```javascript
-// Via server-side session creation
-const url = new URL(verifyUrl);
-url.searchParams.set('auto_return', 'true');
-window.location.href = url.toString();
-```
+After verification completes, **always validate the result on your server** before granting access:
 
-### Combined Example
 ```javascript
-const url = new URL(verifyUrl);
-url.searchParams.set('skip_intro', 'true');
-url.searchParams.set('auto_return', 'true');
-// Result: Streamlined flow with minimal user interaction
-window.location.href = url.toString();
-```
-
-**For comprehensive parameter documentation, usage examples, and integration patterns, see [URL Parameters Reference](../../../docs/technical/api/VERIFY_UI_PARAMETERS.md).**
-
-## Server-Side Validation (Required!)
+// Node.js / Express example
+app.get('/age-verified', async (req, res) => {
+  const { sessionId } = req.query;
+
+  // Validate with your SECRET key (sk_...)
+  const response = await fetch(
+    `https://api.safepassageapp.com/api/v1/sessions/${sessionId}`,
+    {
+      headers: {
+        'Authorization': `Bearer ${process.env.SAFEPASSAGE_SECRET_KEY}`
+      }
+    }
+  );
 
-Always validate the session on your server:
+  const session = await response.json();
 
-```javascript
-// Node.js example
-const response = await fetch('https://api.safepassageapp.com/v1/sessions/validate', {
-  method: 'POST',
-  headers: {
-    'Authorization': 'Bearer sk_xxxxx', // Secret key
-    'Content-Type': 'application/json'
-  },
-  body: JSON.stringify({ sessionId })
+  if (session.status === 'VERIFIED') {
+    // Grant access
+    req.session.ageVerified = true;
+    res.redirect('/content');
+  } else {
+    res.redirect('/age-verification-failed');
+  }
 });
-
-const result = await response.json();
-if (result.verified && result.estimatedAge >= result.challengeAge) {
-  // Grant access
-}
 ```
 
-## UUID Generation
+> **Security Note**: Never trust client-side verification status alone. Always validate server-side using your secret key.
+
+## Webhooks (Recommended)
 
-You must generate session IDs on your end. Use the built-in crypto.randomUUID() when available:
+For reliable verification tracking, configure webhooks in your dashboard:
 
 ```javascript
-// Modern browsers and Node.js 16+
-const sessionId = crypto.randomUUID();
-
-// Fallback for older environments
-function generateUUID() {
-  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
-    const r = Math.random() * 16 | 0;
-    const v = c === 'x' ? r : (r & 0x3 | 0x8);
-    return v.toString(16);
-  });
+// Webhook payload example
+{
+  "event": "verification.completed",
+  "sessionId": "abc-123",
+  "verified": true,
+  "externalUserId": "your-user-id",  // If provided during verify()
+  "timestamp": "2025-01-15T10:30:00Z"
 }
 ```
 
 ## Complete Example
 
+### HTML + CDN
+
 ```html
 <!DOCTYPE html>
 <html>
 <head>
-  <!-- Install via NPM: npm install @safepassage/sdk -->
-  <script src="node_modules/@safepassage/sdk/dist/safepassage.min.js"></script>
+  <title>Age Verification</title>
+  <script src="https://cdn.jsdelivr.net/npm/@safepassage/sdk@latest/dist/safepassage.min.js"></script>
 </head>
 <body>
-  <button onclick="verifyAge()">Verify Your Age</button>
+  <button id="verify-btn">Verify Your Age</button>
 
   <script>
-    const safePassage = new SafePassage({
-      apiKey: 'sk_xxxxx',
-      returnUrl: window.location.href + '?verified=true'
+    const sp = new SafePassage({
+      apiKey: 'pk_...',
+      returnUrl: window.location.origin + '/verified'
     });
 
-    function verifyAge() {
-      // Use crypto.randomUUID() if available, otherwise fallback
-      const sessionId = typeof crypto.randomUUID === 'function' 
-        ? crypto.randomUUID()
-        : 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
-            const r = Math.random() * 16 | 0;
-            const v = c === 'x' ? r : (r & 0x3 | 0x8);
-            return v.toString(16);
-          });
-      
-      sessionStorage.setItem('pendingVerification', sessionId);
-      safePassage.verify({ sessionId });
-    }
-
-    // Check if returning from verification
-    const urlParams = new URLSearchParams(window.location.search);
-    if (urlParams.get('verified') === 'true') {
-      const sessionId = sessionStorage.getItem('pendingVerification');
-      // Validate session server-side here
-      console.log('Validate session:', sessionId);
-    }
+    document.getElementById('verify-btn').onclick = () => sp.verify();
   </script>
 </body>
 </html>
 ```
 
+### React Component
+
+```jsx
+import { useState } from 'react';
+import { SafePassage } from '@safepassage/sdk';
+
+function AgeGate() {
+  const [verifying, setVerifying] = useState(false);
+
+  const sp = new SafePassage({
+    apiKey: process.env.NEXT_PUBLIC_SAFEPASSAGE_KEY,
+    returnUrl: window.location.origin + '/verified'
+  });
+
+  const handleVerify = async () => {
+    setVerifying(true);
+    try {
+      await sp.verify();
+    } catch (error) {
+      console.error('Failed to start verification:', error);
+      setVerifying(false);
+    }
+  };
+
+  return (
+    <button onClick={handleVerify} disabled={verifying}>
+      {verifying ? 'Redirecting...' : 'Verify Your Age'}
+    </button>
+  );
+}
+```
+
 ## TypeScript
 
 Full TypeScript support included:
 
 ```typescript
-import { SafePassage, SafePassageConfig } from '@safepassage/sdk';
+import { SafePassage, SafePassageConfig, VerificationResult } from '@safepassage/sdk';
 
 const config: SafePassageConfig = {
-  apiKey: process.env.SAFEPASSAGE_PUBLIC_KEY!,
-  returnUrl: '/verified'
+  apiKey: process.env.NEXT_PUBLIC_SAFEPASSAGE_KEY!,
+  returnUrl: '/verified',
+  mode: 'new-tab',
+  onComplete: (result: VerificationResult) => {
+    console.log(`Session ${result.sessionId}: ${result.status}`);
+  }
 };
 
-const safePassage = new SafePassage(config);
+const sp = new SafePassage(config);
+```
+
+## Skip Parameters
+
+For streamlined embedded flows:
+
+```javascript
+// Skip intro screen (go directly to camera)
+await sp.verify({ skipIntro: true });
+
+// Auto-redirect after success (no success screen)
+await sp.verify({ autoReturn: true });
+
+// Both - minimal user interaction
+await sp.verify({ skipIntro: true, autoReturn: true });
 ```
 
-## Migration from v2
+## Error Handling
 
-New streamlined approach (10 lines):
 ```javascript
-const safePassage = new SafePassage({
-  apiKey: 'sk_xxxxx',
-  returnUrl: '/verified'
+const sp = new SafePassage({
+  apiKey: 'pk_...',
+  returnUrl: '/verified',
+  onError: (error) => {
+    if (error.message.includes('popup')) {
+      alert('Please allow popups for age verification');
+    } else if (error.message.includes('rate limit')) {
+      alert('Too many attempts. Please wait a moment.');
+    } else {
+      console.error('Verification error:', error);
+    }
+  }
 });
-safePassage.verify({ sessionId: crypto.randomUUID() });
 ```
 
+## API Keys
+
+SafePassage uses two types of API keys:
+
+| Key Type | Prefix | Use Case |
+|----------|--------|----------|
+| Public Key | `pk_` | Client-side SDK (this package) |
+| Secret Key | `sk_` | Server-side validation only |
+
+> **Important**: This SDK only works with public keys (`pk_`). For server-side integrations using secret keys, use the [Direct API](https://docs.safepassageapp.com/api) instead.
+
 ## Browser Support
 
 - Chrome 60+
 - Firefox 60+
 - Safari 12+
 - Edge 79+
-- Mobile browsers
+- Mobile browsers (iOS Safari, Chrome for Android)
+
+## Security Best Practices
+
+1. **Use public keys client-side** - Never expose secret keys in browser code
+2. **Validate server-side** - Always verify results using your secret key
+3. **Configure webhooks** - For reliable, tamper-proof verification notifications
+4. **Register callback URLs** - Pre-register your `returnUrl` in the dashboard
+5. **Use HTTPS** - SDK enforces HTTPS in production
+
+## Cleanup
+
+When done with the SDK (e.g., in SPA route changes):
+
+```javascript
+sp.destroy();
+```
+
+## Migration from v3.0.x
+
+If you were using merchant-generated session IDs:
+
+```javascript
+// Old (v3.0.x)
+safePassage.verify({ sessionId: crypto.randomUUID() });
+
+// New (v3.4+) - sessionId is auto-generated
+await sp.verify();
+```
+
+The SDK now creates sessions automatically via the API when using public keys.
 
-## Security Notes
+## Support
 
-1. Always generate session IDs on the merchant side
-2. Validate sessions server-side before granting access
-3. Pre-register callback URLs in your dashboard
-4. Never expose your secret key (sk_xxx)
+- [Documentation](https://docs.safepassageapp.com)
+- [API Reference](https://docs.safepassageapp.com/api)
+- [Dashboard](https://portal.safepassageapp.com)

package/dist/core/SafePassageSDK.js

@@ -285,7 +285,7 @@ export class SafePassage {
         }
         // Set up PostMessage listener with enhanced security
         this.messageListener = (event) => {
-            var _a, _b, _c, _d, _e, _f, _g, _h;
+            var _a, _b, _c, _d, _e, _f;
             // Enhanced origin validation with strict allowlist
             if (!validatePostMessageOrigin(event, this.config.environment)) {
                 logSecurityEvent('POSTMESSAGE_ORIGIN_BLOCKED', {
@@ -330,11 +330,9 @@ export class SafePassage {
             if (result.status === 'verified') {
                 (_d = (_c = this.config).onComplete) === null || _d === void 0 ? void 0 : _d.call(_c, result);
             }
-            else if (result.status === 'cancelled') {
-                (_f = (_e = this.config).onCancel) === null || _f === void 0 ? void 0 : _f.call(_e);
-            }
             else {
-                (_h = (_g = this.config).onError) === null || _h === void 0 ? void 0 : _h.call(_g, new Error(`Verification failed: ${result.status}`));
+                // Status is 'failed' - trigger error callback
+                (_f = (_e = this.config).onError) === null || _f === void 0 ? void 0 : _f.call(_e, new Error(`Verification failed: ${result.status}`));
             }
         };
         window.addEventListener('message', this.messageListener);

package/dist/index.d.ts

@@ -18,4 +18,4 @@
  */
 export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
 export type { SafePassageConfig, VerificationOptions, VerificationResult, SessionValidationResponse, } from './types';
-export declare const VERSION = "3.4.1";
+export declare const VERSION = "3.4.2";

package/dist/index.js

@@ -24,8 +24,8 @@ if (typeof window !== 'undefined') {
     checkBrowserCompatibility();
 }
 export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
-// Version - 3.4.1: Rebuilt minified bundle with cancelUrl deprecation fix
-export const VERSION = '3.4.1';
+// Version - 3.4.2: Fixed CDN references, aligned documentation
+export const VERSION = '3.4.2';
 // For UMD builds
 if (typeof window !== 'undefined' && window) {
     // Dynamic import for UMD builds

package/dist/safepassage.min.js

@@ -1,3 +1,3 @@
-/* SafePassage SDK v3.4.1 */
-"use strict";var SafePassageSDK=(()=>{var S=Object.defineProperty,oe=Object.defineProperties,ae=Object.getOwnPropertyDescriptor,ce=Object.getOwnPropertyDescriptors,le=Object.getOwnPropertyNames,v=Object.getOwnPropertySymbols;var P=Object.prototype.hasOwnProperty,C=Object.prototype.propertyIsEnumerable;var R=(t,e,n)=>e in t?S(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n,h=(t,e)=>{for(var n in e||(e={}))P.call(e,n)&&R(t,n,e[n]);if(v)for(var n of v(e))C.call(e,n)&&R(t,n,e[n]);return t},y=(t,e)=>oe(t,ce(e));var D=(t,e)=>{var n={};for(var i in t)P.call(t,i)&&e.indexOf(i)<0&&(n[i]=t[i]);if(t!=null&&v)for(var i of v(t))e.indexOf(i)<0&&C.call(t,i)&&(n[i]=t[i]);return n};var w=(t,e)=>()=>(t&&(e=t(t=0)),e);var U=(t,e)=>{for(var n in e)S(t,n,{get:e[n],enumerable:!0})},pe=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of le(e))!P.call(t,r)&&r!==n&&S(t,r,{get:()=>e[r],enumerable:!(i=ae(e,r))||i.enumerable});return t};var $=t=>pe(S({},"__esModule",{value:!0}),t);function de(t,e){return K[e].includes(t)}function W(t,e,n=[]){var r;let{origin:i}=t;return de(i,e)||n.length>0&&n.some(o=>{if(o.startsWith("*.")){let a=o.slice(2);return i.endsWith(`.${a}`)||i===`https://${a}`||i===`http://${a}`}return i===o})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:K[e],allowedCustomOrigins:n,eventType:(r=t.data)==null?void 0:r.type}),!1)}function H(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed","cancelled"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function j(t){t==="production"&&window.location.protocol!=="https:"&&console.warn("SafePassage Warning: HTTPS recommended for production environment",{current:window.location.href})}function T(t,e){try{let n=new URL(t);if(n.protocol!=="https:"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"))return{isValid:!1,error:`HTTPS required for return URLs in ${e}`};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let r of i)if(r.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch(n){return{isValid:!1,error:"Invalid URL format"}}}function l(t,e){console.warn(`SafePassage Security Event: ${t}`,h({timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href},e))}var K,A,q,b=w(()=>{"use strict";K={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av.staging.safepassageapp.com","https://portal.staging.safepassageapp.com","https://api.staging.safepassageapp.com"]};A=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),r=(this.attempts.get(e)||[]).filter(s=>n-s<this.timeWindow);return r.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(r.push(n),this.attempts.set(e,r),!0)}reset(e){this.attempts.delete(e)}},q=new A});var G={};U(G,{createSignedState:()=>ge,generateHMAC:()=>x,generateSecureToken:()=>B,getSigningSecret:()=>V,parseSignedState:()=>fe,verifyHMAC:()=>F});async function x(t,e){let n=new TextEncoder,i=n.encode(e),r=n.encode(t),s=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",s,r);return Array.from(new Uint8Array(o)).map(a=>a.toString(16).padStart(2,"0")).join("")}async function F(t,e,n){try{let i=await x(t,n);return ue(e,i)}catch(i){return!1}}function ue(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function B(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function V(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025"}[t]}async function ge(t,e){let n=y(h({},t),{timestamp:Date.now(),nonce:B(16)}),i=JSON.stringify(n),r=V(e),s=await x(i,r);return btoa(JSON.stringify({data:n,signature:s}))}async function fe(t,e,n=X){try{let r=atob(t),s=JSON.parse(r);if(!s.data||!s.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:o,signature:a}=s,p=JSON.stringify(o),c=V(e);if(!await F(p,a,c))return console.warn("SafePassage: State signature verification failed"),null;if(o.timestamp){let m=Date.now()-o.timestamp;if(m>n)return console.warn("SafePassage: State parameter expired",{age:m,maxAge:n}),null}let i=o,{timestamp:g,nonce:f}=i;return D(i,["timestamp","nonce"])}catch(r){return console.warn("SafePassage: Failed to parse signed state",r),null}}var J=w(()=>{"use strict";k()});function Q(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>Z)throw new Error(`apiKey exceeds maximum length of ${Z} characters`);if(!he.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window!="undefined"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>E)throw new Error(`returnUrl exceeds maximum length of ${E} characters`);let e=me(),n=T(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);if(t.cancelUrl){if(t.cancelUrl.length>E)throw new Error(`cancelUrl exceeds maximum length of ${E} characters`);let i=T(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`)}if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<Y)throw new Error(`defaultChallengeAge must be at least ${Y}`);if(t.defaultChallengeAge>z)throw new Error(`defaultChallengeAge cannot exceed ${z}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function me(){if(typeof window=="undefined")return"production";let t=window.location.hostname;return t.includes("staging")||t.includes("stage")?"staging":"production"}async function ee(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(J(),G));return n(t,e)}var Y,z,E,Z,X,he,k=w(()=>{"use strict";b();Y=25,z=150,E=2048,Z=128,X=6e5,he=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function M(t){let e=te[t]||te.production;if(!e||!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function we(t){let e={production:"https://api.safepassageapp.com",staging:"https://api.staging.safepassageapp.com"},n=e[t]||e.production;if(!n||!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function ne(t){let e=window.location.protocol==="https:";switch(t){case"production":e||console.warn("SafePassage Warning: HTTPS recommended for production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break}try{M(t),we(t)}catch(n){let i=n instanceof Error?n.message:String(n);throw new Error(`Environment configuration validation failed: ${i}`)}}var te,ie=w(()=>{"use strict";te={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com"}});var re={};U(re,{SafePassage:()=>u,default:()=>ve});var u,ve,_=w(()=>{"use strict";k();ie();b();u=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;this.lastVerifyUrl=null;this.lastSessionToken=null;Q(e);let n=e.environment||this.detectEnvironment();n!=="staging"&&n!=="production"&&(console.warn(`SafePassage SDK: Unknown environment '${n}', defaulting to 'production'`),n="production"),this.config=y(h({},e),{environment:n,mode:e.mode||"redirect"}),ne(this.config.environment),j(this.config.environment),l("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){var r,s,o,a,p,c;let n=this.isPublicKey(),i;if(n)i=await this.createInternalSession(e);else throw new Error("Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only.");if(!i)throw new Error("Failed to obtain sessionId from server");if(this.isVerificationInProgress){let d=new Error(`Verification already in progress for session ${(r=this.currentSessionId)==null?void 0:r.substring(0,8)}...`);throw l("RACE_CONDITION_PREVENTED",{currentSession:((s=this.currentSessionId)==null?void 0:s.substring(0,8))+"...",attemptedSession:"new-session-attempt",origin:window.location.origin}),(a=(o=this.config).onError)==null||a.call(o,d),d}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let d=`${this.config.apiKey}:${window.location.origin}`;if(!q.isAllowed(d)){let f=new Error("Too many verification attempts. Please wait before trying again.");throw l("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),(c=(p=this.config).onError)==null||c.call(p,f),f}let g=await this.buildVerificationUrl(e,i);l("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(g,i):(this.unlockVerification(),this.redirect(g))}catch(d){throw this.unlockVerification(),d}}async buildVerificationUrl(e,n){let i=M(this.config.environment),r=e.challengeAge!==void 0,s=e.verificationMode!==void 0,o=r||s,a=await ee({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this._temporaryHandoffToken,sessionToken:this.lastSessionToken||void 0,verifyUrl:this.lastVerifyUrl||void 0},this.config.environment);if(this.lastVerifyUrl)try{let c=new URL(this.lastVerifyUrl);return c.searchParams.set("state",a),c.searchParams.set("mode",this.config.mode),e.skipIntro&&c.searchParams.set("skip_intro","true"),e.autoReturn&&c.searchParams.set("auto_return","true"),c.toString()}catch(c){}let p=new URLSearchParams({state:a,sessionId:n,mode:this.config.mode});return e.skipIntro&&p.set("skip_intro","true"),e.autoReturn&&p.set("auto_return","true"),`${i}/?${p.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){var i,r;if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){(r=(i=this.config).onError)==null||r.call(i,new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=s=>{var p,c,d,g,f,I,m,L;if(!W(s,this.config.environment)){l("POSTMESSAGE_ORIGIN_BLOCKED",{origin:s.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:(p=s.data)==null?void 0:p.type});return}let o=H(s,n);if(!o.isValid){l("POSTMESSAGE_VALIDATION_FAILED",{error:o.error,origin:s.origin,sessionId:n.substring(0,8)+"...",messageType:(c=s.data)==null?void 0:c.type});return}let a={sessionId:s.data.sessionId,status:s.data.status};l("VERIFICATION_COMPLETED",{status:a.status,sessionId:n.substring(0,8)+"...",origin:s.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),a.status==="verified"?(g=(d=this.config).onComplete)==null||g.call(d,a):a.status==="cancelled"?(I=(f=this.config).onCancel)==null||I.call(f):(L=(m=this.config).onError)==null||L.call(m,new Error(`Verification failed: ${a.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{var s,o;this.popupWindow&&this.popupWindow.closed&&(l("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),(o=(s=this.config).onCancel)==null||o.call(s))},500)}setupAutoCleanup(){if(this.unloadListener=()=>{l("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,l("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){l("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){var n,i;try{let r=this.getPortalApiUrl(),s=await fetch(`${r}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!s.ok){let p=await s.json().catch(()=>({}));throw new Error(`Failed to create session: ${s.status} ${s.statusText}. ${p.message||""}`)}let o=await s.json(),a=o.sessionId;if(!a)throw new Error("Server did not return a sessionId");return o.verifyUrl&&(this.lastVerifyUrl=o.verifyUrl),o.sessionToken&&(this.lastSessionToken=o.sessionToken),o.handoffToken&&(this._temporaryHandoffToken=o.handoffToken),l("INTERNAL_SESSION_CREATED",{sessionId:a.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),a}catch(r){let s=r instanceof Error?r.message:String(r);throw l("INTERNAL_SESSION_FAILED",{error:s,environment:this.config.environment,apiKeyType:"public"}),(i=(n=this.config).onError)==null||i.call(n,r),new Error(`Failed to create verification session: ${s}`)}}},ve=u});var Se={};U(Se,{SafePassage:()=>u,VERSION:()=>se,default:()=>u});function O(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function N(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support"),t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}_();typeof window!="undefined"&&(O(),N());var se="3.4.1";if(typeof window!="undefined"&&window){let{SafePassage:t}=(_(),$(re)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=se)}return $(Se);})();
+/* SafePassage SDK v3.4.2 */
+"use strict";var SafePassageSDK=(()=>{var v=Object.defineProperty,se=Object.defineProperties,oe=Object.getOwnPropertyDescriptor,ae=Object.getOwnPropertyDescriptors,ce=Object.getOwnPropertyNames,w=Object.getOwnPropertySymbols;var I=Object.prototype.hasOwnProperty,R=Object.prototype.propertyIsEnumerable;var L=(t,e,n)=>e in t?v(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n,h=(t,e)=>{for(var n in e||(e={}))I.call(e,n)&&L(t,n,e[n]);if(w)for(var n of w(e))R.call(e,n)&&L(t,n,e[n]);return t},S=(t,e)=>se(t,ae(e));var C=(t,e)=>{var n={};for(var i in t)I.call(t,i)&&e.indexOf(i)<0&&(n[i]=t[i]);if(t!=null&&w)for(var i of w(t))e.indexOf(i)<0&&R.call(t,i)&&(n[i]=t[i]);return n};var m=(t,e)=>()=>(t&&(e=t(t=0)),e);var P=(t,e)=>{for(var n in e)v(t,n,{get:e[n],enumerable:!0})},le=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of ce(e))!I.call(t,r)&&r!==n&&v(t,r,{get:()=>e[r],enumerable:!(i=oe(e,r))||i.enumerable});return t};var D=t=>le(v({},"__esModule",{value:!0}),t);function pe(t,e){return N[e].includes(t)}function K(t,e,n=[]){var r;let{origin:i}=t;return pe(i,e)||n.length>0&&n.some(o=>{if(o.startsWith("*.")){let a=o.slice(2);return i.endsWith(`.${a}`)||i===`https://${a}`||i===`http://${a}`}return i===o})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:N[e],allowedCustomOrigins:n,eventType:(r=t.data)==null?void 0:r.type}),!1)}function W(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function H(t){t==="production"&&window.location.protocol!=="https:"&&console.warn("SafePassage Warning: HTTPS recommended for production environment",{current:window.location.href})}function A(t,e){try{let n=new URL(t);if(n.protocol!=="https:"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"))return{isValid:!1,error:`HTTPS required for return URLs in ${e}`};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let r of i)if(r.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch(n){return{isValid:!1,error:"Invalid URL format"}}}function l(t,e){console.warn(`SafePassage Security Event: ${t}`,h({timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href},e))}var N,U,j,T=m(()=>{"use strict";N={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av.staging.safepassageapp.com","https://portal.staging.safepassageapp.com","https://api.staging.safepassageapp.com"]};U=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),r=(this.attempts.get(e)||[]).filter(s=>n-s<this.timeWindow);return r.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(r.push(n),this.attempts.set(e,r),!0)}reset(e){this.attempts.delete(e)}},j=new U});var B={};P(B,{createSignedState:()=>ue,generateHMAC:()=>b,generateSecureToken:()=>F,getSigningSecret:()=>x,parseSignedState:()=>ge,verifyHMAC:()=>q});async function b(t,e){let n=new TextEncoder,i=n.encode(e),r=n.encode(t),s=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",s,r);return Array.from(new Uint8Array(o)).map(a=>a.toString(16).padStart(2,"0")).join("")}async function q(t,e,n){try{let i=await b(t,n);return de(e,i)}catch(i){return!1}}function de(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function F(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function x(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025"}[t]}async function ue(t,e){let n=S(h({},t),{timestamp:Date.now(),nonce:F(16)}),i=JSON.stringify(n),r=x(e),s=await b(i,r);return btoa(JSON.stringify({data:n,signature:s}))}async function ge(t,e,n=J){try{let r=atob(t),s=JSON.parse(r);if(!s.data||!s.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:o,signature:a}=s,p=JSON.stringify(o),c=x(e);if(!await q(p,a,c))return console.warn("SafePassage: State signature verification failed"),null;if(o.timestamp){let _=Date.now()-o.timestamp;if(_>n)return console.warn("SafePassage: State parameter expired",{age:_,maxAge:n}),null}let i=o,{timestamp:g,nonce:f}=i;return C(i,["timestamp","nonce"])}catch(r){return console.warn("SafePassage: Failed to parse signed state",r),null}}var G=m(()=>{"use strict";V()});function Z(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>z)throw new Error(`apiKey exceeds maximum length of ${z} characters`);if(!fe.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window!="undefined"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>y)throw new Error(`returnUrl exceeds maximum length of ${y} characters`);let e=he(),n=A(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);if(t.cancelUrl){if(t.cancelUrl.length>y)throw new Error(`cancelUrl exceeds maximum length of ${y} characters`);let i=A(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`)}if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<X)throw new Error(`defaultChallengeAge must be at least ${X}`);if(t.defaultChallengeAge>Y)throw new Error(`defaultChallengeAge cannot exceed ${Y}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function he(){if(typeof window=="undefined")return"production";let t=window.location.hostname;return t.includes("staging")||t.includes("stage")?"staging":"production"}async function Q(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(G(),B));return n(t,e)}var X,Y,y,z,J,fe,V=m(()=>{"use strict";T();X=25,Y=150,y=2048,z=128,J=6e5,fe=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function k(t){let e=ee[t]||ee.production;if(!e||!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function me(t){let e={production:"https://api.safepassageapp.com",staging:"https://api.staging.safepassageapp.com"},n=e[t]||e.production;if(!n||!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function te(t){let e=window.location.protocol==="https:";switch(t){case"production":e||console.warn("SafePassage Warning: HTTPS recommended for production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break}try{k(t),me(t)}catch(n){let i=n instanceof Error?n.message:String(n);throw new Error(`Environment configuration validation failed: ${i}`)}}var ee,ne=m(()=>{"use strict";ee={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com"}});var ie={};P(ie,{SafePassage:()=>u,default:()=>we});var u,we,M=m(()=>{"use strict";V();ne();T();u=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;this.lastVerifyUrl=null;this.lastSessionToken=null;Z(e);let n=e.environment||this.detectEnvironment();n!=="staging"&&n!=="production"&&(console.warn(`SafePassage SDK: Unknown environment '${n}', defaulting to 'production'`),n="production"),this.config=S(h({},e),{environment:n,mode:e.mode||"redirect"}),te(this.config.environment),H(this.config.environment),l("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){var r,s,o,a,p,c;let n=this.isPublicKey(),i;if(n)i=await this.createInternalSession(e);else throw new Error("Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only.");if(!i)throw new Error("Failed to obtain sessionId from server");if(this.isVerificationInProgress){let d=new Error(`Verification already in progress for session ${(r=this.currentSessionId)==null?void 0:r.substring(0,8)}...`);throw l("RACE_CONDITION_PREVENTED",{currentSession:((s=this.currentSessionId)==null?void 0:s.substring(0,8))+"...",attemptedSession:"new-session-attempt",origin:window.location.origin}),(a=(o=this.config).onError)==null||a.call(o,d),d}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let d=`${this.config.apiKey}:${window.location.origin}`;if(!j.isAllowed(d)){let f=new Error("Too many verification attempts. Please wait before trying again.");throw l("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),(c=(p=this.config).onError)==null||c.call(p,f),f}let g=await this.buildVerificationUrl(e,i);l("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(g,i):(this.unlockVerification(),this.redirect(g))}catch(d){throw this.unlockVerification(),d}}async buildVerificationUrl(e,n){let i=k(this.config.environment),r=e.challengeAge!==void 0,s=e.verificationMode!==void 0,o=r||s,a=await Q({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this._temporaryHandoffToken,sessionToken:this.lastSessionToken||void 0,verifyUrl:this.lastVerifyUrl||void 0},this.config.environment);if(this.lastVerifyUrl)try{let c=new URL(this.lastVerifyUrl);return c.searchParams.set("state",a),c.searchParams.set("mode",this.config.mode),e.skipIntro&&c.searchParams.set("skip_intro","true"),e.autoReturn&&c.searchParams.set("auto_return","true"),c.toString()}catch(c){}let p=new URLSearchParams({state:a,sessionId:n,mode:this.config.mode});return e.skipIntro&&p.set("skip_intro","true"),e.autoReturn&&p.set("auto_return","true"),`${i}/?${p.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){var i,r;if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){(r=(i=this.config).onError)==null||r.call(i,new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=s=>{var p,c,d,g,f,E;if(!K(s,this.config.environment)){l("POSTMESSAGE_ORIGIN_BLOCKED",{origin:s.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:(p=s.data)==null?void 0:p.type});return}let o=W(s,n);if(!o.isValid){l("POSTMESSAGE_VALIDATION_FAILED",{error:o.error,origin:s.origin,sessionId:n.substring(0,8)+"...",messageType:(c=s.data)==null?void 0:c.type});return}let a={sessionId:s.data.sessionId,status:s.data.status};l("VERIFICATION_COMPLETED",{status:a.status,sessionId:n.substring(0,8)+"...",origin:s.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),a.status==="verified"?(g=(d=this.config).onComplete)==null||g.call(d,a):(E=(f=this.config).onError)==null||E.call(f,new Error(`Verification failed: ${a.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{var s,o;this.popupWindow&&this.popupWindow.closed&&(l("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),(o=(s=this.config).onCancel)==null||o.call(s))},500)}setupAutoCleanup(){if(this.unloadListener=()=>{l("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,l("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){l("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){var n,i;try{let r=this.getPortalApiUrl(),s=await fetch(`${r}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!s.ok){let p=await s.json().catch(()=>({}));throw new Error(`Failed to create session: ${s.status} ${s.statusText}. ${p.message||""}`)}let o=await s.json(),a=o.sessionId;if(!a)throw new Error("Server did not return a sessionId");return o.verifyUrl&&(this.lastVerifyUrl=o.verifyUrl),o.sessionToken&&(this.lastSessionToken=o.sessionToken),o.handoffToken&&(this._temporaryHandoffToken=o.handoffToken),l("INTERNAL_SESSION_CREATED",{sessionId:a.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),a}catch(r){let s=r instanceof Error?r.message:String(r);throw l("INTERNAL_SESSION_FAILED",{error:s,environment:this.config.environment,apiKeyType:"public"}),(i=(n=this.config).onError)==null||i.call(n,r),new Error(`Failed to create verification session: ${s}`)}}},we=u});var ve={};P(ve,{SafePassage:()=>u,VERSION:()=>re,default:()=>u});function $(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function O(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support"),t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}M();typeof window!="undefined"&&($(),O());var re="3.4.2";if(typeof window!="undefined"&&window){let{SafePassage:t}=(M(),D(ie)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=re)}return D(ve);})();
 if(typeof SafePassageSDK !== "undefined" && SafePassageSDK.SafePassage) { window.SafePassage = SafePassageSDK.SafePassage; window.SafePassage.VERSION = SafePassageSDK.VERSION; }

package/dist/types/index.d.ts

@@ -91,7 +91,7 @@ export interface VerificationResult {
      * Binary result: 'verified' or 'failed'
      * Full details available via server-side API
      */
-    status: 'verified' | 'failed' | 'cancelled';
+    status: 'verified' | 'failed';
     /**
      * External user identifier if provided during verification
      */

package/dist/utils/security.js

@@ -78,8 +78,7 @@ export function validateSafePassageMessage(event, expectedSessionId) {
         return { isValid: false, error: 'Session ID mismatch' };
     }
     // Check status field
-    if (!data.status ||
-        !['verified', 'failed', 'cancelled'].includes(data.status)) {
+    if (!data.status || !['verified', 'failed'].includes(data.status)) {
         return { isValid: false, error: 'Invalid status value' };
     }
     return { isValid: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safepassage/sdk",
-  "version": "3.4.1",
+  "version": "3.4.2",
   "description": "SafePassage SDK - Lightweight redirect-based age verification",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",