@safepassage/sdk 3.4.1 → 3.4.3

package/dist/index.js

@@ -1,40 +1,1084 @@
-/**
- * SafePassage SDK - Redirect-based age verification
- *
- * @example
- * ```javascript
- * // Initialize SDK
- * const sp = new SafePassage({
- *   apiKey: 'pk_xxxxx',
- *   returnUrl: 'https://merchant.com/verified',
- *   cancelUrl: 'https://merchant.com/cancelled'
- * });
- *
- * // Trigger verification
- * sp.verify({
- *   sessionId: generateUUID() // Merchant-generated UUID v4
- * });
- * ```
- */
-// Setup polyfills and check browser compatibility
-import { setupPolyfills, checkBrowserCompatibility } from './utils/polyfills';
-// Initialize polyfills immediately
-if (typeof window !== 'undefined') {
-    setupPolyfills();
-    checkBrowserCompatibility();
-}
-export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
-// Version - 3.4.1: Rebuilt minified bundle with cancelUrl deprecation fix
-export const VERSION = '3.4.1';
-// For UMD builds
-if (typeof window !== 'undefined' && window) {
-    // Dynamic import for UMD builds
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { SafePassage } = require('./core/SafePassageSDK');
-    // Attach to window object for global access
-    const globalWindow = window;
-    globalWindow.SafePassage = SafePassage;
-    if (globalWindow.SafePassage) {
-        globalWindow.SafePassage.VERSION = VERSION;
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
     }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __objRest = (source, exclude) => {
+  var target = {};
+  for (var prop in source)
+    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
+      target[prop] = source[prop];
+  if (source != null && __getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(source)) {
+      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
+        target[prop] = source[prop];
+    }
+  return target;
+};
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src-redirect/utils/security.ts
+function isOriginTrusted(origin, environment) {
+  const trustedOrigins = TRUSTED_ORIGINS[environment];
+  return trustedOrigins.includes(origin);
+}
+function validatePostMessageOrigin(event, environment, allowedCustomOrigins = []) {
+  var _a;
+  const { origin } = event;
+  if (isOriginTrusted(origin, environment)) {
+    return true;
+  }
+  if (allowedCustomOrigins.length > 0) {
+    const isCustomOriginAllowed = allowedCustomOrigins.some((allowedOrigin) => {
+      if (allowedOrigin.startsWith("*.")) {
+        const domain = allowedOrigin.slice(2);
+        return origin.endsWith(`.${domain}`) || origin === `https://${domain}` || origin === `http://${domain}`;
+      }
+      return origin === allowedOrigin;
+    });
+    if (isCustomOriginAllowed) {
+      return true;
+    }
+  }
+  console.warn(
+    `SafePassage Security: Blocked PostMessage from untrusted origin: ${origin}`,
+    {
+      environment,
+      trustedOrigins: TRUSTED_ORIGINS[environment],
+      allowedCustomOrigins,
+      eventType: (_a = event.data) == null ? void 0 : _a.type
+    }
+  );
+  return false;
+}
+function validateSafePassageMessage(event, expectedSessionId) {
+  const { data } = event;
+  if (!data || typeof data !== "object") {
+    return { isValid: false, error: "Invalid message format" };
+  }
+  if (data.type !== "safepassage:verification:complete") {
+    return { isValid: false, error: "Invalid message type" };
+  }
+  if (!data.sessionId || data.sessionId !== expectedSessionId) {
+    return { isValid: false, error: "Session ID mismatch" };
+  }
+  if (!data.status || !["verified", "failed"].includes(data.status)) {
+    return { isValid: false, error: "Invalid status value" };
+  }
+  return { isValid: true };
+}
+function enforceHTTPS(environment) {
+  if (environment === "production" && window.location.protocol !== "https:") {
+    console.warn(
+      "SafePassage Warning: HTTPS recommended for production environment",
+      {
+        current: window.location.href
+      }
+    );
+  }
+}
+function validateReturnUrl(url, environment) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") {
+      const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+      if (!isLocalhost) {
+        return {
+          isValid: false,
+          error: `HTTPS required for return URLs in ${environment}`
+        };
+      }
+    }
+    const suspiciousPatterns = [
+      /data:/i,
+      /javascript:/i,
+      /vbscript:/i,
+      /file:/i,
+      /ftp:/i
+    ];
+    for (const pattern of suspiciousPatterns) {
+      if (pattern.test(url)) {
+        return { isValid: false, error: "Blocked suspicious URL scheme" };
+      }
+    }
+    return { isValid: true };
+  } catch (e) {
+    return { isValid: false, error: "Invalid URL format" };
+  }
+}
+function logSecurityEvent(event, details) {
+  console.warn(`SafePassage Security Event: ${event}`, __spreadValues({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    userAgent: navigator.userAgent,
+    url: window.location.href
+  }, details));
+}
+var TRUSTED_ORIGINS, VerificationRateLimit, verificationRateLimit;
+var init_security = __esm({
+  "src-redirect/utils/security.ts"() {
+    "use strict";
+    TRUSTED_ORIGINS = {
+      production: [
+        "https://av.safepassageapp.com",
+        "https://portal.safepassageapp.com",
+        "https://api.safepassageapp.com"
+      ],
+      staging: [
+        "https://av.staging.safepassageapp.com",
+        "https://portal.staging.safepassageapp.com",
+        "https://api.staging.safepassageapp.com"
+      ]
+    };
+    VerificationRateLimit = class {
+      constructor() {
+        this.attempts = /* @__PURE__ */ new Map();
+        this.maxAttempts = 5;
+        this.timeWindow = 6e4;
+      }
+      // 1 minute
+      isAllowed(identifier) {
+        const now = Date.now();
+        const attempts = this.attempts.get(identifier) || [];
+        const recentAttempts = attempts.filter(
+          (time) => now - time < this.timeWindow
+        );
+        if (recentAttempts.length >= this.maxAttempts) {
+          console.warn(
+            `SafePassage Security: Rate limit exceeded for ${identifier}`
+          );
+          return false;
+        }
+        recentAttempts.push(now);
+        this.attempts.set(identifier, recentAttempts);
+        return true;
+      }
+      reset(identifier) {
+        this.attempts.delete(identifier);
+      }
+    };
+    verificationRateLimit = new VerificationRateLimit();
+  }
+});
+
+// src-redirect/utils/crypto.ts
+var crypto_exports = {};
+__export(crypto_exports, {
+  createSignedState: () => createSignedState,
+  generateHMAC: () => generateHMAC,
+  generateSecureToken: () => generateSecureToken,
+  getSigningSecret: () => getSigningSecret,
+  parseSignedState: () => parseSignedState,
+  verifyHMAC: () => verifyHMAC
+});
+async function generateHMAC(data, secret) {
+  const encoder = new TextEncoder();
+  const keyData = encoder.encode(secret);
+  const dataBuffer = encoder.encode(data);
+  const key = await crypto.subtle.importKey(
+    "raw",
+    keyData,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", key, dataBuffer);
+  return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyHMAC(data, signature, secret) {
+  try {
+    const expectedSignature = await generateHMAC(data, secret);
+    return constantTimeCompare(signature, expectedSignature);
+  } catch (e) {
+    return false;
+  }
+}
+function constantTimeCompare(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}
+function generateSecureToken(length = 32) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function getSigningSecret(environment) {
+  const baseSecrets = {
+    production: "safepassage-prod-hmac-2025",
+    staging: "safepassage-stage-hmac-2025"
+  };
+  return baseSecrets[environment];
+}
+async function createSignedState(payload, environment) {
+  const timestampedPayload = __spreadProps(__spreadValues({}, payload), {
+    timestamp: Date.now(),
+    nonce: generateSecureToken(16)
+    // Add nonce to prevent replay attacks
+  });
+  const dataString = JSON.stringify(timestampedPayload);
+  const secret = getSigningSecret(environment);
+  const signature = await generateHMAC(dataString, secret);
+  const signedPayload = {
+    data: timestampedPayload,
+    signature
+  };
+  return btoa(JSON.stringify(signedPayload));
+}
+async function parseSignedState(signedState, environment, maxAge = STATE_EXPIRY_MS) {
+  try {
+    const json = atob(signedState);
+    const signedPayload = JSON.parse(json);
+    if (!signedPayload.data || !signedPayload.signature) {
+      console.warn("SafePassage: Invalid signed state format");
+      return null;
+    }
+    const { data, signature } = signedPayload;
+    const dataString = JSON.stringify(data);
+    const secret = getSigningSecret(environment);
+    const isValid = await verifyHMAC(dataString, signature, secret);
+    if (!isValid) {
+      console.warn("SafePassage: State signature verification failed");
+      return null;
+    }
+    if (data.timestamp) {
+      const age = Date.now() - data.timestamp;
+      if (age > maxAge) {
+        console.warn("SafePassage: State parameter expired", { age, maxAge });
+        return null;
+      }
+    }
+    const _a = data, { timestamp, nonce } = _a, payload = __objRest(_a, ["timestamp", "nonce"]);
+    return payload;
+  } catch (error) {
+    console.warn("SafePassage: Failed to parse signed state", error);
+    return null;
+  }
+}
+var init_crypto = __esm({
+  "src-redirect/utils/crypto.ts"() {
+    "use strict";
+    init_validation();
+  }
+});
+
+// src-redirect/utils/validation.ts
+function validateConfig(config) {
+  if (!config.apiKey) {
+    throw new Error("apiKey is required");
+  }
+  if (config.apiKey.length > MAX_API_KEY_LENGTH) {
+    throw new Error(
+      `apiKey exceeds maximum length of ${MAX_API_KEY_LENGTH} characters`
+    );
+  }
+  if (!API_KEY_PATTERN.test(config.apiKey)) {
+    throw new Error(
+      "Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)"
+    );
+  }
+  if (typeof window !== "undefined" && config.apiKey.startsWith("sk_")) {
+    throw new Error(
+      "Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions"
+    );
+  }
+  if (!config.returnUrl) {
+    throw new Error("returnUrl is required");
+  }
+  if (config.returnUrl.length > MAX_URL_LENGTH) {
+    throw new Error(
+      `returnUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`
+    );
+  }
+  const environment = detectEnvironment();
+  const returnUrlValidation = validateReturnUrl(config.returnUrl, environment);
+  if (!returnUrlValidation.isValid) {
+    throw new Error(
+      `returnUrl validation failed: ${returnUrlValidation.error}`
+    );
+  }
+  if (config.cancelUrl) {
+    if (config.cancelUrl.length > MAX_URL_LENGTH) {
+      throw new Error(
+        `cancelUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`
+      );
+    }
+    const cancelUrlValidation = validateReturnUrl(config.cancelUrl, environment);
+    if (!cancelUrlValidation.isValid) {
+      throw new Error(
+        `cancelUrl validation failed: ${cancelUrlValidation.error}`
+      );
+    }
+  }
+  if (config.defaultChallengeAge !== void 0) {
+    if (config.defaultChallengeAge < MINIMUM_AGE) {
+      throw new Error(`defaultChallengeAge must be at least ${MINIMUM_AGE}`);
+    }
+    if (config.defaultChallengeAge > MAXIMUM_AGE) {
+      throw new Error(`defaultChallengeAge cannot exceed ${MAXIMUM_AGE}`);
+    }
+  }
+  if (config.defaultVerificationMode && !["L1", "L2"].includes(config.defaultVerificationMode)) {
+    throw new Error("defaultVerificationMode must be L1 or L2");
+  }
+  if (config.mode && !["redirect", "new-tab"].includes(config.mode)) {
+    throw new Error("mode must be redirect or new-tab");
+  }
+}
+function detectEnvironment() {
+  if (typeof window === "undefined") {
+    return "production";
+  }
+  const hostname = window.location.hostname;
+  if (hostname.includes("staging") || hostname.includes("stage")) {
+    return "staging";
+  }
+  return "production";
+}
+async function generateState(payload, environment) {
+  const { createSignedState: createSignedState2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
+  return createSignedState2(payload, environment);
+}
+var MINIMUM_AGE, MAXIMUM_AGE, MAX_URL_LENGTH, MAX_API_KEY_LENGTH, STATE_EXPIRY_MS, API_KEY_PATTERN;
+var init_validation = __esm({
+  "src-redirect/utils/validation.ts"() {
+    "use strict";
+    init_security();
+    MINIMUM_AGE = 25;
+    MAXIMUM_AGE = 150;
+    MAX_URL_LENGTH = 2048;
+    MAX_API_KEY_LENGTH = 128;
+    STATE_EXPIRY_MS = 6e5;
+    API_KEY_PATTERN = /^(pk_|sk_)[a-zA-Z0-9_]+$/;
+  }
+});
+
+// src-redirect/utils/environment.ts
+function getEnvironmentUrl(environment) {
+  const url = ENVIRONMENT_URLS[environment] || ENVIRONMENT_URLS.production;
+  if (!url || !url.startsWith("https://")) {
+    throw new Error(`HTTPS required for ${environment} environment`);
+  }
+  return url;
+}
+function getApiUrl(environment) {
+  const apiUrls = {
+    production: "https://api.safepassageapp.com",
+    staging: "https://api.staging.safepassageapp.com"
+  };
+  const url = apiUrls[environment] || apiUrls.production;
+  if (!url || !url.startsWith("https://")) {
+    throw new Error(
+      `HTTPS required for API URLs in ${environment} environment`
+    );
+  }
+  return url;
+}
+function validateEnvironmentSecurity(environment) {
+  const isSecure = window.location.protocol === "https:";
+  switch (environment) {
+    case "production":
+      if (!isSecure) {
+        console.warn("SafePassage Warning: HTTPS recommended for production environment");
+      }
+      break;
+    case "staging":
+      if (!isSecure) {
+        console.warn(
+          "SafePassage Warning: HTTPS strongly recommended in staging environment"
+        );
+      }
+      break;
+  }
+  try {
+    getEnvironmentUrl(environment);
+    getApiUrl(environment);
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    throw new Error(`Environment configuration validation failed: ${errorMessage}`);
+  }
+}
+var ENVIRONMENT_URLS;
+var init_environment = __esm({
+  "src-redirect/utils/environment.ts"() {
+    "use strict";
+    ENVIRONMENT_URLS = {
+      production: "https://av.safepassageapp.com",
+      staging: "https://av.staging.safepassageapp.com"
+    };
+  }
+});
+
+// src-redirect/core/SafePassageSDK.ts
+var SafePassageSDK_exports = {};
+__export(SafePassageSDK_exports, {
+  SafePassage: () => SafePassage,
+  default: () => SafePassageSDK_default
+});
+var SafePassage, SafePassageSDK_default;
+var init_SafePassageSDK = __esm({
+  "src-redirect/core/SafePassageSDK.ts"() {
+    "use strict";
+    init_validation();
+    init_environment();
+    init_security();
+    SafePassage = class {
+      /**
+       * Initialize SafePassage SDK
+       *
+       * Validates configuration, sets up security measures, and prepares the SDK
+       * for verification operations. Performs comprehensive environment validation
+       * and security initialization.
+       *
+       * @param {SafePassageConfig} config - SDK configuration object
+       * @throws {Error} If configuration validation fails
+       */
+      constructor(config) {
+        this.popupWindow = null;
+        this.messageListener = null;
+        this.popupMonitorInterval = null;
+        this.unloadListener = null;
+        this.isVerificationInProgress = false;
+        this.currentSessionId = null;
+        // Server-provided verify URL (includes sessionToken)
+        this.lastVerifyUrl = null;
+        // Server-provided session token (WS auth)
+        this.lastSessionToken = null;
+        // Temporary storage for QR handoff token to include in state
+        this.temporaryHandoffToken = null;
+        validateConfig(config);
+        let normalizedEnvironment = config.environment || this.detectEnvironment();
+        if (normalizedEnvironment !== "staging" && normalizedEnvironment !== "production") {
+          console.warn(`SafePassage SDK: Unknown environment '${normalizedEnvironment}', defaulting to 'production'`);
+          normalizedEnvironment = "production";
+        }
+        this.config = __spreadProps(__spreadValues({}, config), {
+          environment: normalizedEnvironment,
+          mode: config.mode || "redirect"
+        });
+        validateEnvironmentSecurity(this.config.environment);
+        enforceHTTPS(this.config.environment);
+        logSecurityEvent("SDK_INITIALIZED", {
+          environment: this.config.environment,
+          mode: this.config.mode,
+          origin: window.location.origin,
+          protocol: window.location.protocol,
+          hostname: window.location.hostname
+        });
+        this.setupAutoCleanup();
+      }
+      /**
+       * Initiate age verification with race condition protection
+       *
+       * Main verification method that handles session creation, security validation,
+       * and verification flow initiation. Includes race condition protection and
+       * comprehensive error handling.
+       *
+       * For public keys (pk_*), automatically creates sessions via the portal API.
+       * For private keys (sk_*), requires a pre-created sessionId.
+       *
+       * @param {VerificationOptions} [options={}] - Verification options
+       * @param {string} [options.sessionId] - Session ID (required for private keys)
+       * @param {number} [options.challengeAge] - Age challenge override
+       * @param {string} [options.verificationMode] - Verification mode override
+       * @param {string} [options.externalUserId] - External user identifier
+       * @returns {Promise<void>} Promise that resolves when verification is initiated
+       * @throws {Error} If verification cannot be started or is already in progress
+       */
+      async verify(options = {}) {
+        var _a, _b, _c, _d, _e, _f;
+        const isPublicKey = this.isPublicKey();
+        let sessionId;
+        if (isPublicKey) {
+          sessionId = await this.createInternalSession(options);
+        } else {
+          throw new Error(
+            "Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only."
+          );
+        }
+        if (!sessionId) {
+          throw new Error("Failed to obtain sessionId from server");
+        }
+        if (this.isVerificationInProgress) {
+          const error = new Error(
+            `Verification already in progress for session ${(_a = this.currentSessionId) == null ? void 0 : _a.substring(0, 8)}...`
+          );
+          logSecurityEvent("RACE_CONDITION_PREVENTED", {
+            currentSession: ((_b = this.currentSessionId) == null ? void 0 : _b.substring(0, 8)) + "...",
+            attemptedSession: "new-session-attempt",
+            origin: window.location.origin
+          });
+          (_d = (_c = this.config).onError) == null ? void 0 : _d.call(_c, error);
+          throw error;
+        }
+        this.isVerificationInProgress = true;
+        this.currentSessionId = sessionId;
+        try {
+          const rateLimitKey = `${this.config.apiKey}:${window.location.origin}`;
+          if (!verificationRateLimit.isAllowed(rateLimitKey)) {
+            const error = new Error(
+              "Too many verification attempts. Please wait before trying again."
+            );
+            logSecurityEvent("RATE_LIMIT_EXCEEDED", {
+              apiKey: this.config.apiKey.substring(0, 8) + "...",
+              origin: window.location.origin,
+              sessionId: sessionId ? sessionId.substring(0, 8) + "..." : "undefined"
+            });
+            (_f = (_e = this.config).onError) == null ? void 0 : _f.call(_e, error);
+            throw error;
+          }
+          const verificationUrl = await this.buildVerificationUrl(
+            options,
+            sessionId
+          );
+          logSecurityEvent("VERIFICATION_INITIATED", {
+            environment: this.config.environment,
+            mode: this.config.mode,
+            sessionId: sessionId ? sessionId.substring(0, 8) + "..." : "undefined",
+            origin: window.location.origin
+          });
+          if (this.config.mode === "new-tab") {
+            this.openNewTab(verificationUrl, sessionId);
+          } else {
+            this.unlockVerification();
+            this.redirect(verificationUrl);
+          }
+        } catch (error) {
+          this.unlockVerification();
+          throw error;
+        }
+      }
+      /**
+       * Build verification URL with HMAC-signed state
+       *
+       * Constructs the verification URL with signed state parameter containing
+       * all necessary configuration and security information. The state parameter
+       * includes HMAC signature for integrity protection.
+       *
+       * @param {VerificationOptions} options - Verification options
+       * @returns {Promise<string>} Complete verification URL
+       * @private
+       */
+      async buildVerificationUrl(options, sessionId) {
+        const baseUrl = getEnvironmentUrl(this.config.environment);
+        const hasExplicitChallengeAge = options.challengeAge !== void 0;
+        const hasExplicitVerificationMode = options.verificationMode !== void 0;
+        const hasOverrides = hasExplicitChallengeAge || hasExplicitVerificationMode;
+        const state = await generateState(
+          {
+            merchantId: this.config.apiKey,
+            sessionId,
+            returnUrl: this.config.returnUrl,
+            cancelUrl: this.config.cancelUrl,
+            challengeAge: options.challengeAge || this.config.defaultChallengeAge,
+            verificationMode: options.verificationMode || this.config.defaultVerificationMode,
+            hasOverrides,
+            // Flag to indicate explicit overrides
+            externalUserId: options.externalUserId,
+            timestamp: Date.now(),
+            // Phase 2: Include config for self-contained verify-ui
+            apiUrl: this.getPortalApiUrl(),
+            engineUrl: this.getEngineUrl(),
+            wsUrl: this.getWebSocketUrl(),
+            environment: this.config.environment,
+            features: {
+              testMode: false,
+              warmupPeriodMs: 500,
+              qualityThreshold: 0.6
+            },
+            // Include handoffToken if available (for QR code desktop flow)
+            handoffToken: this.temporaryHandoffToken || void 0,
+            // Include sessionToken and verifyUrl to make UI auth deterministic
+            sessionToken: this.lastSessionToken || void 0,
+            verifyUrl: this.lastVerifyUrl || void 0
+          },
+          this.config.environment
+        );
+        if (this.lastVerifyUrl) {
+          try {
+            const url = new URL(this.lastVerifyUrl);
+            url.searchParams.set("state", state);
+            url.searchParams.set("mode", this.config.mode);
+            if (options.skipIntro) {
+              url.searchParams.set("skip_intro", "true");
+            }
+            if (options.autoReturn) {
+              url.searchParams.set("auto_return", "true");
+            }
+            return url.toString();
+          } catch (e) {
+          }
+        }
+        const params = new URLSearchParams({ state, sessionId, mode: this.config.mode });
+        if (options.skipIntro) {
+          params.set("skip_intro", "true");
+        }
+        if (options.autoReturn) {
+          params.set("auto_return", "true");
+        }
+        return `${baseUrl}/?${params.toString()}`;
+      }
+      /**
+       * Redirect in same tab
+       *
+       * Performs a full page redirect to the verification URL.
+       * Used for redirect mode verification.
+       *
+       * @param {string} url - Verification URL to redirect to
+       * @private
+       */
+      redirect(url) {
+        window.location.href = url;
+      }
+      /**
+       * Open in new tab with PostMessage communication and proper cleanup
+       *
+       * Opens verification URL in a new tab/window and sets up secure PostMessage
+       * communication for receiving verification results. Includes comprehensive
+       * security validation and automatic cleanup.
+       *
+       * @param {string} url - Verification URL to open
+       * @param {string} sessionId - Session ID for result correlation
+       * @private
+       */
+      openNewTab(url, sessionId) {
+        var _a, _b;
+        this.cleanup();
+        if (this.popupMonitorInterval) {
+          clearInterval(this.popupMonitorInterval);
+          this.popupMonitorInterval = null;
+        }
+        this.popupWindow = window.open(
+          url,
+          "safepassage-verify",
+          "width=600,height=700"
+        );
+        if (!this.popupWindow) {
+          (_b = (_a = this.config).onError) == null ? void 0 : _b.call(
+            _a,
+            new Error(
+              "Failed to open verification window. Please check popup blocker settings."
+            )
+          );
+          return;
+        }
+        this.messageListener = (event) => {
+          var _a2, _b2, _c, _d, _e, _f;
+          if (!validatePostMessageOrigin(event, this.config.environment)) {
+            logSecurityEvent("POSTMESSAGE_ORIGIN_BLOCKED", {
+              origin: event.origin,
+              environment: this.config.environment,
+              expectedOrigins: `SafePassage trusted origins for ${this.config.environment}`,
+              messageType: (_a2 = event.data) == null ? void 0 : _a2.type
+            });
+            return;
+          }
+          const messageValidation = validateSafePassageMessage(event, sessionId);
+          if (!messageValidation.isValid) {
+            logSecurityEvent("POSTMESSAGE_VALIDATION_FAILED", {
+              error: messageValidation.error,
+              origin: event.origin,
+              sessionId: sessionId.substring(0, 8) + "...",
+              messageType: (_b2 = event.data) == null ? void 0 : _b2.type
+            });
+            return;
+          }
+          const result = {
+            sessionId: event.data.sessionId,
+            status: event.data.status
+          };
+          logSecurityEvent("VERIFICATION_COMPLETED", {
+            status: result.status,
+            sessionId: sessionId.substring(0, 8) + "...",
+            origin: event.origin
+          });
+          this.cleanup();
+          this.unlockVerification();
+          if (this.popupMonitorInterval) {
+            clearInterval(this.popupMonitorInterval);
+            this.popupMonitorInterval = null;
+          }
+          if (result.status === "verified") {
+            (_d = (_c = this.config).onComplete) == null ? void 0 : _d.call(_c, result);
+          } else {
+            (_f = (_e = this.config).onError) == null ? void 0 : _f.call(
+              _e,
+              new Error(`Verification failed: ${result.status}`)
+            );
+          }
+        };
+        window.addEventListener("message", this.messageListener);
+        this.popupMonitorInterval = setInterval(() => {
+          var _a2, _b2;
+          if (this.popupWindow && this.popupWindow.closed) {
+            logSecurityEvent("POPUP_CLOSED_BY_USER", {
+              sessionId: sessionId.substring(0, 8) + "...",
+              environment: this.config.environment
+            });
+            this.cleanup();
+            this.unlockVerification();
+            (_b2 = (_a2 = this.config).onCancel) == null ? void 0 : _b2.call(_a2);
+          }
+        }, 500);
+      }
+      /**
+       * Set up automatic cleanup on page unload to prevent memory leaks
+       *
+       * Registers event listeners for page unload events to ensure proper
+       * cleanup of resources and verification state. Handles both traditional
+       * page navigation and single-page application route changes.
+       *
+       * @private
+       */
+      setupAutoCleanup() {
+        this.unloadListener = () => {
+          logSecurityEvent("SDK_AUTO_CLEANUP", {
+            environment: this.config.environment,
+            trigger: "page_unload"
+          });
+          this.cleanup();
+          this.unlockVerification();
+        };
+        window.addEventListener("beforeunload", this.unloadListener);
+        window.addEventListener("pagehide", this.unloadListener);
+        if (window.history && window.history.pushState) {
+          const originalPushState = window.history.pushState;
+          window.history.pushState = (...args) => {
+            this.cleanup();
+            this.unlockVerification();
+            return originalPushState.apply(window.history, args);
+          };
+        }
+      }
+      /**
+       * Auto-detect environment based on current URL
+       *
+       * Analyzes the current hostname to determine the appropriate environment
+       * configuration. Used when environment is not explicitly specified.
+       * Always defaults to production unless staging is detected.
+       *
+       * @returns {'production' | 'staging'} Detected environment
+       * @private
+       */
+      detectEnvironment() {
+        const hostname = window.location.hostname;
+        if (hostname.includes("staging") || hostname.includes("stage")) {
+          return "staging";
+        }
+        return "production";
+      }
+      /**
+       * Get the current environment
+       * @returns {string} The current environment (production or staging)
+       */
+      getEnvironment() {
+        return this.config.environment;
+      }
+      /**
+       * Unlock verification process to allow new verifications
+       *
+       * Resets the verification lock state to allow new verification attempts.
+       * Called after successful completion, errors, or cleanup.
+       *
+       * @private
+       */
+      unlockVerification() {
+        this.isVerificationInProgress = false;
+        this.currentSessionId = null;
+        logSecurityEvent("VERIFICATION_UNLOCKED", {
+          environment: this.config.environment,
+          origin: window.location.origin
+        });
+      }
+      /**
+       * Internal cleanup method to prevent memory leaks
+       *
+       * Cleans up popup windows, event listeners, and intervals.
+       * Does not unlock verification state - that's handled by specific callers.
+       *
+       * @private
+       */
+      cleanup() {
+        if (this.popupWindow && !this.popupWindow.closed) {
+          this.popupWindow.close();
+        }
+        this.popupWindow = null;
+        if (this.messageListener) {
+          window.removeEventListener("message", this.messageListener);
+          this.messageListener = null;
+        }
+        if (this.popupMonitorInterval) {
+          clearInterval(this.popupMonitorInterval);
+          this.popupMonitorInterval = null;
+        }
+      }
+      /**
+       * Remove auto-cleanup listeners
+       *
+       * Removes page unload event listeners that were set up for automatic cleanup.
+       *
+       * @private
+       */
+      removeAutoCleanupListeners() {
+        if (this.unloadListener) {
+          window.removeEventListener("beforeunload", this.unloadListener);
+          window.removeEventListener("pagehide", this.unloadListener);
+          this.unloadListener = null;
+        }
+      }
+      /**
+       * Public cleanup method for manual resource management
+       *
+       * Completely destroys the SDK instance, cleaning up all resources and
+       * removing all event listeners. Should be called when the SDK is no longer needed.
+       *
+       * @public
+       */
+      destroy() {
+        logSecurityEvent("SDK_DESTROYED", {
+          environment: this.config.environment,
+          origin: window.location.origin
+        });
+        this.cleanup();
+        this.unlockVerification();
+        this.removeAutoCleanupListeners();
+      }
+      /**
+       * Get Portal API URL based on environment
+       *
+       * Returns the appropriate portal-api URL for the current environment.
+       *
+       * @returns {string} Portal API URL
+       * @private
+       */
+      getPortalApiUrl() {
+        switch (this.config.environment) {
+          case "staging":
+            return "https://api.staging.safepassageapp.com";
+          case "production":
+            return "https://api.safepassageapp.com";
+          default:
+            return "https://api.safepassageapp.com";
+        }
+      }
+      /**
+       * Get Engine URL based on environment
+       *
+       * Returns the appropriate verify-engine URL for the current environment.
+       * In production, engine access is proxied through portal-api.
+       *
+       * @returns {string} Engine URL
+       * @private
+       */
+      getEngineUrl() {
+        switch (this.config.environment) {
+          case "staging":
+            return "https://engine.staging.safepassageapp.com";
+          case "production":
+            return "https://engine.safepassageapp.com";
+          default:
+            return "https://engine.safepassageapp.com";
+        }
+      }
+      /**
+       * Get WebSocket URL based on environment
+       *
+       * Returns the appropriate WebSocket URL for the current environment.
+       * In production, WebSocket connections are proxied through portal-api.
+       *
+       * @returns {string} WebSocket URL
+       * @private
+       */
+      getWebSocketUrl() {
+        switch (this.config.environment) {
+          case "staging":
+            return "wss://engine.staging.safepassageapp.com/api/websocket/stream";
+          case "production":
+            return "wss://engine.safepassageapp.com/api/websocket/stream";
+          default:
+            return "wss://engine.safepassageapp.com/api/websocket/stream";
+        }
+      }
+      /**
+       * Detect if this is a public key (pk_ prefix) vs private key (sk_ prefix)
+       *
+       * Determines API key type based on prefix to handle different authentication flows.
+       *
+       * @returns {boolean} True if public key, false if private key
+       * @private
+       */
+      isPublicKey() {
+        return this.config.apiKey.startsWith("pk_");
+      }
+      /**
+       * Create session internally for public keys
+       *
+       * Creates a verification session via the portal API for public key authentication.
+       * Generates a UUID session ID and submits session creation request with
+       * verification parameters.
+       *
+       * @param {VerificationOptions} options - Verification options
+       * @returns {Promise<string>} Created session ID
+       * @throws {Error} If session creation fails
+       * @private
+       */
+      async createInternalSession(options) {
+        var _a, _b;
+        try {
+          const portalApiUrl = this.getPortalApiUrl();
+          const response = await fetch(`${portalApiUrl}/api/v1/sessions/create`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Authorization: `Bearer ${this.config.apiKey}`
+            },
+            body: JSON.stringify({
+              merchantId: this.config.apiKey,
+              // API expects merchantId even though it uses auth header
+              returnUrl: this.config.returnUrl,
+              cancelUrl: this.config.cancelUrl,
+              challengeAge: options.challengeAge,
+              verificationMode: options.verificationMode,
+              merchantName: document.title || window.location.hostname,
+              externalUserId: options.externalUserId
+            })
+          });
+          if (!response.ok) {
+            const errorData = await response.json().catch(() => ({}));
+            throw new Error(
+              `Failed to create session: ${response.status} ${response.statusText}. ${errorData.message || ""}`
+            );
+          }
+          const sessionData = await response.json();
+          const sessionId = sessionData.sessionId;
+          if (!sessionId) {
+            throw new Error("Server did not return a sessionId");
+          }
+          if (sessionData.verifyUrl) {
+            this.lastVerifyUrl = sessionData.verifyUrl;
+          }
+          if (sessionData.sessionToken) {
+            this.lastSessionToken = sessionData.sessionToken;
+          }
+          if (sessionData.handoffToken) {
+            this.temporaryHandoffToken = sessionData.handoffToken;
+          }
+          logSecurityEvent("INTERNAL_SESSION_CREATED", {
+            sessionId: sessionId.substring(0, 8) + "...",
+            environment: this.config.environment,
+            apiKeyType: "public"
+          });
+          return sessionId;
+        } catch (error) {
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          logSecurityEvent("INTERNAL_SESSION_FAILED", {
+            error: errorMessage,
+            environment: this.config.environment,
+            apiKeyType: "public"
+          });
+          (_b = (_a = this.config).onError) == null ? void 0 : _b.call(_a, error);
+          throw new Error(`Failed to create verification session: ${errorMessage}`);
+        }
+      }
+    };
+    SafePassageSDK_default = SafePassage;
+  }
+});
+
+// src-redirect/utils/polyfills.ts
+function setupPolyfills() {
+  if (!crypto.randomUUID) {
+    crypto.randomUUID = function() {
+      const array = new Uint8Array(16);
+      crypto.getRandomValues(array);
+      array[6] = array[6] & 15 | 64;
+      array[8] = array[8] & 63 | 128;
+      const hex = Array.from(array).map((b) => b.toString(16).padStart(2, "0")).join("");
+      return [
+        hex.slice(0, 8),
+        hex.slice(8, 12),
+        hex.slice(12, 16),
+        hex.slice(16, 20),
+        hex.slice(20, 32)
+      ].join("-");
+    };
+  }
+}
+function checkBrowserCompatibility() {
+  const warnings = [];
+  if (!window.crypto || !window.crypto.getRandomValues) {
+    throw new Error("SafePassage SDK requires Web Crypto API support");
+  }
+  if (!window.crypto.subtle) {
+    throw new Error(
+      "SafePassage SDK requires Web Crypto subtle API for HMAC operations"
+    );
+  }
+  if (!crypto.randomUUID) {
+    warnings.push("crypto.randomUUID not supported, using polyfill");
+  }
+  if (!window.URLSearchParams) {
+    warnings.push(
+      "URLSearchParams not supported, consider adding a polyfill for IE 11 support"
+    );
+  }
+  if (warnings.length > 0) {
+    console.warn("SafePassage SDK Browser Compatibility:", warnings.join("; "));
+  }
+}
+
+// src-redirect/index.ts
+init_SafePassageSDK();
+if (typeof window !== "undefined") {
+  setupPolyfills();
+  checkBrowserCompatibility();
+}
+var VERSION = "3.4.3";
+if (typeof window !== "undefined" && window) {
+  const { SafePassage: SafePassage2 } = (init_SafePassageSDK(), __toCommonJS(SafePassageSDK_exports));
+  const globalWindow = window;
+  globalWindow.SafePassage = SafePassage2;
+  if (globalWindow.SafePassage) {
+    globalWindow.SafePassage.VERSION = VERSION;
+  }
 }
+export {
+  SafePassage,
+  VERSION,
+  SafePassage as default
+};