@safepassage/sdk 3.4.2 → 3.4.4

package/README.md

@@ -178,6 +178,8 @@ For reliable verification tracking, configure webhooks in your dashboard:
 }
 ```
 
+Webhook `timestamp` values are ISO 8601 strings. SDK `onComplete` results use milliseconds since epoch.
+
 ## Complete Example
 
 ### HTML + CDN
@@ -246,6 +248,8 @@ import { SafePassage, SafePassageConfig, VerificationResult } from '@safepassage
 const config: SafePassageConfig = {
   apiKey: process.env.NEXT_PUBLIC_SAFEPASSAGE_KEY!,
   returnUrl: '/verified',
+  // Optional: used as a fallback redirect for Emblem login failures
+  cancelUrl: '/verify-cancelled',
   mode: 'new-tab',
   onComplete: (result: VerificationResult) => {
     console.log(`Session ${result.sessionId}: ${result.status}`);

package/dist/core/SafePassageSDK.d.ts

@@ -49,6 +49,7 @@ export declare class SafePassage {
     private currentSessionId;
     private lastVerifyUrl;
     private lastSessionToken;
+    private temporaryHandoffToken;
     /**
      * Initialize SafePassage SDK
      *

package/dist/core/SafePassageSDK.js

@@ -63,6 +63,8 @@ export class SafePassage {
         this.lastVerifyUrl = null;
         // Server-provided session token (WS auth)
         this.lastSessionToken = null;
+        // Temporary storage for QR handoff token to include in state
+        this.temporaryHandoffToken = null;
         validateConfig(config);
         // Normalize environment: treat 'development' or any unknown value as 'production'
         let normalizedEnvironment = config.environment || this.detectEnvironment();
@@ -210,7 +212,7 @@ export class SafePassage {
                 qualityThreshold: 0.6,
             },
             // Include handoffToken if available (for QR code desktop flow)
-            handoffToken: this._temporaryHandoffToken,
+            handoffToken: this.temporaryHandoffToken || undefined,
             // Include sessionToken and verifyUrl to make UI auth deterministic
             sessionToken: this.lastSessionToken || undefined,
             verifyUrl: this.lastVerifyUrl || undefined,
@@ -310,6 +312,8 @@ export class SafePassage {
             const result = {
                 sessionId: event.data.sessionId,
                 status: event.data.status,
+                timestamp: event.data.timestamp,
+                externalUserId: event.data.externalUserId,
             };
             // Log successful verification completion
             logSecurityEvent('VERIFICATION_COMPLETED', {
@@ -609,7 +613,7 @@ export class SafePassage {
             // Store the handoffToken if it exists for desktop QR flow
             if (sessionData.handoffToken) {
                 // Store it temporarily so it can be included in the state
-                this._temporaryHandoffToken = sessionData.handoffToken;
+                this.temporaryHandoffToken = sessionData.handoffToken;
             }
             // Log successful session creation
             logSecurityEvent('INTERNAL_SESSION_CREATED', {

package/dist/index.d.ts

@@ -18,4 +18,4 @@
  */
 export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
 export type { SafePassageConfig, VerificationOptions, VerificationResult, SessionValidationResponse, } from './types';
-export declare const VERSION = "3.4.2";
+export declare const VERSION = "3.4.4";

package/dist/index.js

@@ -1,40 +1,1086 @@
-/**
- * SafePassage SDK - Redirect-based age verification
- *
- * @example
- * ```javascript
- * // Initialize SDK
- * const sp = new SafePassage({
- *   apiKey: 'pk_xxxxx',
- *   returnUrl: 'https://merchant.com/verified',
- *   cancelUrl: 'https://merchant.com/cancelled'
- * });
- *
- * // Trigger verification
- * sp.verify({
- *   sessionId: generateUUID() // Merchant-generated UUID v4
- * });
- * ```
- */
-// Setup polyfills and check browser compatibility
-import { setupPolyfills, checkBrowserCompatibility } from './utils/polyfills';
-// Initialize polyfills immediately
-if (typeof window !== 'undefined') {
-    setupPolyfills();
-    checkBrowserCompatibility();
-}
-export { SafePassage, SafePassage as default } from './core/SafePassageSDK';
-// Version - 3.4.2: Fixed CDN references, aligned documentation
-export const VERSION = '3.4.2';
-// For UMD builds
-if (typeof window !== 'undefined' && window) {
-    // Dynamic import for UMD builds
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { SafePassage } = require('./core/SafePassageSDK');
-    // Attach to window object for global access
-    const globalWindow = window;
-    globalWindow.SafePassage = SafePassage;
-    if (globalWindow.SafePassage) {
-        globalWindow.SafePassage.VERSION = VERSION;
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
     }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __objRest = (source, exclude) => {
+  var target = {};
+  for (var prop in source)
+    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
+      target[prop] = source[prop];
+  if (source != null && __getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(source)) {
+      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
+        target[prop] = source[prop];
+    }
+  return target;
+};
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src-redirect/utils/security.ts
+function isOriginTrusted(origin, environment) {
+  const trustedOrigins = TRUSTED_ORIGINS[environment];
+  return trustedOrigins.includes(origin);
+}
+function validatePostMessageOrigin(event, environment, allowedCustomOrigins = []) {
+  var _a;
+  const { origin } = event;
+  if (isOriginTrusted(origin, environment)) {
+    return true;
+  }
+  if (allowedCustomOrigins.length > 0) {
+    const isCustomOriginAllowed = allowedCustomOrigins.some((allowedOrigin) => {
+      if (allowedOrigin.startsWith("*.")) {
+        const domain = allowedOrigin.slice(2);
+        return origin.endsWith(`.${domain}`) || origin === `https://${domain}` || origin === `http://${domain}`;
+      }
+      return origin === allowedOrigin;
+    });
+    if (isCustomOriginAllowed) {
+      return true;
+    }
+  }
+  console.warn(
+    `SafePassage Security: Blocked PostMessage from untrusted origin: ${origin}`,
+    {
+      environment,
+      trustedOrigins: TRUSTED_ORIGINS[environment],
+      allowedCustomOrigins,
+      eventType: (_a = event.data) == null ? void 0 : _a.type
+    }
+  );
+  return false;
+}
+function validateSafePassageMessage(event, expectedSessionId) {
+  const { data } = event;
+  if (!data || typeof data !== "object") {
+    return { isValid: false, error: "Invalid message format" };
+  }
+  if (data.type !== "safepassage:verification:complete") {
+    return { isValid: false, error: "Invalid message type" };
+  }
+  if (!data.sessionId || data.sessionId !== expectedSessionId) {
+    return { isValid: false, error: "Session ID mismatch" };
+  }
+  if (!data.status || !["verified", "failed"].includes(data.status)) {
+    return { isValid: false, error: "Invalid status value" };
+  }
+  return { isValid: true };
+}
+function enforceHTTPS(environment) {
+  if (environment === "production" && window.location.protocol !== "https:") {
+    console.warn(
+      "SafePassage Warning: HTTPS recommended for production environment",
+      {
+        current: window.location.href
+      }
+    );
+  }
+}
+function validateReturnUrl(url, environment) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") {
+      const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+      if (!isLocalhost) {
+        return {
+          isValid: false,
+          error: `HTTPS required for return URLs in ${environment}`
+        };
+      }
+    }
+    const suspiciousPatterns = [
+      /data:/i,
+      /javascript:/i,
+      /vbscript:/i,
+      /file:/i,
+      /ftp:/i
+    ];
+    for (const pattern of suspiciousPatterns) {
+      if (pattern.test(url)) {
+        return { isValid: false, error: "Blocked suspicious URL scheme" };
+      }
+    }
+    return { isValid: true };
+  } catch (e) {
+    return { isValid: false, error: "Invalid URL format" };
+  }
+}
+function logSecurityEvent(event, details) {
+  console.warn(`SafePassage Security Event: ${event}`, __spreadValues({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    userAgent: navigator.userAgent,
+    url: window.location.href
+  }, details));
+}
+var TRUSTED_ORIGINS, VerificationRateLimit, verificationRateLimit;
+var init_security = __esm({
+  "src-redirect/utils/security.ts"() {
+    "use strict";
+    TRUSTED_ORIGINS = {
+      production: [
+        "https://av.safepassageapp.com",
+        "https://portal.safepassageapp.com",
+        "https://api.safepassageapp.com"
+      ],
+      staging: [
+        "https://av.staging.safepassageapp.com",
+        "https://portal.staging.safepassageapp.com",
+        "https://api.staging.safepassageapp.com"
+      ]
+    };
+    VerificationRateLimit = class {
+      constructor() {
+        this.attempts = /* @__PURE__ */ new Map();
+        this.maxAttempts = 5;
+        this.timeWindow = 6e4;
+      }
+      // 1 minute
+      isAllowed(identifier) {
+        const now = Date.now();
+        const attempts = this.attempts.get(identifier) || [];
+        const recentAttempts = attempts.filter(
+          (time) => now - time < this.timeWindow
+        );
+        if (recentAttempts.length >= this.maxAttempts) {
+          console.warn(
+            `SafePassage Security: Rate limit exceeded for ${identifier}`
+          );
+          return false;
+        }
+        recentAttempts.push(now);
+        this.attempts.set(identifier, recentAttempts);
+        return true;
+      }
+      reset(identifier) {
+        this.attempts.delete(identifier);
+      }
+    };
+    verificationRateLimit = new VerificationRateLimit();
+  }
+});
+
+// src-redirect/utils/crypto.ts
+var crypto_exports = {};
+__export(crypto_exports, {
+  createSignedState: () => createSignedState,
+  generateHMAC: () => generateHMAC,
+  generateSecureToken: () => generateSecureToken,
+  getSigningSecret: () => getSigningSecret,
+  parseSignedState: () => parseSignedState,
+  verifyHMAC: () => verifyHMAC
+});
+async function generateHMAC(data, secret) {
+  const encoder = new TextEncoder();
+  const keyData = encoder.encode(secret);
+  const dataBuffer = encoder.encode(data);
+  const key = await crypto.subtle.importKey(
+    "raw",
+    keyData,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", key, dataBuffer);
+  return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyHMAC(data, signature, secret) {
+  try {
+    const expectedSignature = await generateHMAC(data, secret);
+    return constantTimeCompare(signature, expectedSignature);
+  } catch (e) {
+    return false;
+  }
+}
+function constantTimeCompare(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}
+function generateSecureToken(length = 32) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function getSigningSecret(environment) {
+  const baseSecrets = {
+    production: "safepassage-prod-hmac-2025",
+    staging: "safepassage-stage-hmac-2025"
+  };
+  return baseSecrets[environment];
+}
+async function createSignedState(payload, environment) {
+  const timestampedPayload = __spreadProps(__spreadValues({}, payload), {
+    timestamp: Date.now(),
+    nonce: generateSecureToken(16)
+    // Add nonce to prevent replay attacks
+  });
+  const dataString = JSON.stringify(timestampedPayload);
+  const secret = getSigningSecret(environment);
+  const signature = await generateHMAC(dataString, secret);
+  const signedPayload = {
+    data: timestampedPayload,
+    signature
+  };
+  return btoa(JSON.stringify(signedPayload));
+}
+async function parseSignedState(signedState, environment, maxAge = STATE_EXPIRY_MS) {
+  try {
+    const json = atob(signedState);
+    const signedPayload = JSON.parse(json);
+    if (!signedPayload.data || !signedPayload.signature) {
+      console.warn("SafePassage: Invalid signed state format");
+      return null;
+    }
+    const { data, signature } = signedPayload;
+    const dataString = JSON.stringify(data);
+    const secret = getSigningSecret(environment);
+    const isValid = await verifyHMAC(dataString, signature, secret);
+    if (!isValid) {
+      console.warn("SafePassage: State signature verification failed");
+      return null;
+    }
+    if (data.timestamp) {
+      const age = Date.now() - data.timestamp;
+      if (age > maxAge) {
+        console.warn("SafePassage: State parameter expired", { age, maxAge });
+        return null;
+      }
+    }
+    const _a = data, { timestamp, nonce } = _a, payload = __objRest(_a, ["timestamp", "nonce"]);
+    return payload;
+  } catch (error) {
+    console.warn("SafePassage: Failed to parse signed state", error);
+    return null;
+  }
+}
+var init_crypto = __esm({
+  "src-redirect/utils/crypto.ts"() {
+    "use strict";
+    init_validation();
+  }
+});
+
+// src-redirect/utils/validation.ts
+function validateConfig(config) {
+  if (!config.apiKey) {
+    throw new Error("apiKey is required");
+  }
+  if (config.apiKey.length > MAX_API_KEY_LENGTH) {
+    throw new Error(
+      `apiKey exceeds maximum length of ${MAX_API_KEY_LENGTH} characters`
+    );
+  }
+  if (!API_KEY_PATTERN.test(config.apiKey)) {
+    throw new Error(
+      "Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)"
+    );
+  }
+  if (typeof window !== "undefined" && config.apiKey.startsWith("sk_")) {
+    throw new Error(
+      "Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions"
+    );
+  }
+  if (!config.returnUrl) {
+    throw new Error("returnUrl is required");
+  }
+  if (config.returnUrl.length > MAX_URL_LENGTH) {
+    throw new Error(
+      `returnUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`
+    );
+  }
+  const environment = detectEnvironment();
+  const returnUrlValidation = validateReturnUrl(config.returnUrl, environment);
+  if (!returnUrlValidation.isValid) {
+    throw new Error(
+      `returnUrl validation failed: ${returnUrlValidation.error}`
+    );
+  }
+  if (config.cancelUrl) {
+    if (config.cancelUrl.length > MAX_URL_LENGTH) {
+      throw new Error(
+        `cancelUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`
+      );
+    }
+    const cancelUrlValidation = validateReturnUrl(config.cancelUrl, environment);
+    if (!cancelUrlValidation.isValid) {
+      throw new Error(
+        `cancelUrl validation failed: ${cancelUrlValidation.error}`
+      );
+    }
+  }
+  if (config.defaultChallengeAge !== void 0) {
+    if (config.defaultChallengeAge < MINIMUM_AGE) {
+      throw new Error(`defaultChallengeAge must be at least ${MINIMUM_AGE}`);
+    }
+    if (config.defaultChallengeAge > MAXIMUM_AGE) {
+      throw new Error(`defaultChallengeAge cannot exceed ${MAXIMUM_AGE}`);
+    }
+  }
+  if (config.defaultVerificationMode && !["L1", "L2"].includes(config.defaultVerificationMode)) {
+    throw new Error("defaultVerificationMode must be L1 or L2");
+  }
+  if (config.mode && !["redirect", "new-tab"].includes(config.mode)) {
+    throw new Error("mode must be redirect or new-tab");
+  }
+}
+function detectEnvironment() {
+  if (typeof window === "undefined") {
+    return "production";
+  }
+  const hostname = window.location.hostname;
+  if (hostname.includes("staging") || hostname.includes("stage")) {
+    return "staging";
+  }
+  return "production";
+}
+async function generateState(payload, environment) {
+  const { createSignedState: createSignedState2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
+  return createSignedState2(payload, environment);
+}
+var MINIMUM_AGE, MAXIMUM_AGE, MAX_URL_LENGTH, MAX_API_KEY_LENGTH, STATE_EXPIRY_MS, API_KEY_PATTERN;
+var init_validation = __esm({
+  "src-redirect/utils/validation.ts"() {
+    "use strict";
+    init_security();
+    MINIMUM_AGE = 25;
+    MAXIMUM_AGE = 150;
+    MAX_URL_LENGTH = 2048;
+    MAX_API_KEY_LENGTH = 128;
+    STATE_EXPIRY_MS = 6e5;
+    API_KEY_PATTERN = /^(pk_|sk_)[a-zA-Z0-9_]+$/;
+  }
+});
+
+// src-redirect/utils/environment.ts
+function getEnvironmentUrl(environment) {
+  const url = ENVIRONMENT_URLS[environment] || ENVIRONMENT_URLS.production;
+  if (!url || !url.startsWith("https://")) {
+    throw new Error(`HTTPS required for ${environment} environment`);
+  }
+  return url;
+}
+function getApiUrl(environment) {
+  const apiUrls = {
+    production: "https://api.safepassageapp.com",
+    staging: "https://api.staging.safepassageapp.com"
+  };
+  const url = apiUrls[environment] || apiUrls.production;
+  if (!url || !url.startsWith("https://")) {
+    throw new Error(
+      `HTTPS required for API URLs in ${environment} environment`
+    );
+  }
+  return url;
+}
+function validateEnvironmentSecurity(environment) {
+  const isSecure = window.location.protocol === "https:";
+  switch (environment) {
+    case "production":
+      if (!isSecure) {
+        console.warn("SafePassage Warning: HTTPS recommended for production environment");
+      }
+      break;
+    case "staging":
+      if (!isSecure) {
+        console.warn(
+          "SafePassage Warning: HTTPS strongly recommended in staging environment"
+        );
+      }
+      break;
+  }
+  try {
+    getEnvironmentUrl(environment);
+    getApiUrl(environment);
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    throw new Error(`Environment configuration validation failed: ${errorMessage}`);
+  }
+}
+var ENVIRONMENT_URLS;
+var init_environment = __esm({
+  "src-redirect/utils/environment.ts"() {
+    "use strict";
+    ENVIRONMENT_URLS = {
+      production: "https://av.safepassageapp.com",
+      staging: "https://av.staging.safepassageapp.com"
+    };
+  }
+});
+
+// src-redirect/core/SafePassageSDK.ts
+var SafePassageSDK_exports = {};
+__export(SafePassageSDK_exports, {
+  SafePassage: () => SafePassage,
+  default: () => SafePassageSDK_default
+});
+var SafePassage, SafePassageSDK_default;
+var init_SafePassageSDK = __esm({
+  "src-redirect/core/SafePassageSDK.ts"() {
+    "use strict";
+    init_validation();
+    init_environment();
+    init_security();
+    SafePassage = class {
+      /**
+       * Initialize SafePassage SDK
+       *
+       * Validates configuration, sets up security measures, and prepares the SDK
+       * for verification operations. Performs comprehensive environment validation
+       * and security initialization.
+       *
+       * @param {SafePassageConfig} config - SDK configuration object
+       * @throws {Error} If configuration validation fails
+       */
+      constructor(config) {
+        this.popupWindow = null;
+        this.messageListener = null;
+        this.popupMonitorInterval = null;
+        this.unloadListener = null;
+        this.isVerificationInProgress = false;
+        this.currentSessionId = null;
+        // Server-provided verify URL (includes sessionToken)
+        this.lastVerifyUrl = null;
+        // Server-provided session token (WS auth)
+        this.lastSessionToken = null;
+        // Temporary storage for QR handoff token to include in state
+        this.temporaryHandoffToken = null;
+        validateConfig(config);
+        let normalizedEnvironment = config.environment || this.detectEnvironment();
+        if (normalizedEnvironment !== "staging" && normalizedEnvironment !== "production") {
+          console.warn(`SafePassage SDK: Unknown environment '${normalizedEnvironment}', defaulting to 'production'`);
+          normalizedEnvironment = "production";
+        }
+        this.config = __spreadProps(__spreadValues({}, config), {
+          environment: normalizedEnvironment,
+          mode: config.mode || "redirect"
+        });
+        validateEnvironmentSecurity(this.config.environment);
+        enforceHTTPS(this.config.environment);
+        logSecurityEvent("SDK_INITIALIZED", {
+          environment: this.config.environment,
+          mode: this.config.mode,
+          origin: window.location.origin,
+          protocol: window.location.protocol,
+          hostname: window.location.hostname
+        });
+        this.setupAutoCleanup();
+      }
+      /**
+       * Initiate age verification with race condition protection
+       *
+       * Main verification method that handles session creation, security validation,
+       * and verification flow initiation. Includes race condition protection and
+       * comprehensive error handling.
+       *
+       * For public keys (pk_*), automatically creates sessions via the portal API.
+       * For private keys (sk_*), requires a pre-created sessionId.
+       *
+       * @param {VerificationOptions} [options={}] - Verification options
+       * @param {string} [options.sessionId] - Session ID (required for private keys)
+       * @param {number} [options.challengeAge] - Age challenge override
+       * @param {string} [options.verificationMode] - Verification mode override
+       * @param {string} [options.externalUserId] - External user identifier
+       * @returns {Promise<void>} Promise that resolves when verification is initiated
+       * @throws {Error} If verification cannot be started or is already in progress
+       */
+      async verify(options = {}) {
+        var _a, _b, _c, _d, _e, _f;
+        const isPublicKey = this.isPublicKey();
+        let sessionId;
+        if (isPublicKey) {
+          sessionId = await this.createInternalSession(options);
+        } else {
+          throw new Error(
+            "Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only."
+          );
+        }
+        if (!sessionId) {
+          throw new Error("Failed to obtain sessionId from server");
+        }
+        if (this.isVerificationInProgress) {
+          const error = new Error(
+            `Verification already in progress for session ${(_a = this.currentSessionId) == null ? void 0 : _a.substring(0, 8)}...`
+          );
+          logSecurityEvent("RACE_CONDITION_PREVENTED", {
+            currentSession: ((_b = this.currentSessionId) == null ? void 0 : _b.substring(0, 8)) + "...",
+            attemptedSession: "new-session-attempt",
+            origin: window.location.origin
+          });
+          (_d = (_c = this.config).onError) == null ? void 0 : _d.call(_c, error);
+          throw error;
+        }
+        this.isVerificationInProgress = true;
+        this.currentSessionId = sessionId;
+        try {
+          const rateLimitKey = `${this.config.apiKey}:${window.location.origin}`;
+          if (!verificationRateLimit.isAllowed(rateLimitKey)) {
+            const error = new Error(
+              "Too many verification attempts. Please wait before trying again."
+            );
+            logSecurityEvent("RATE_LIMIT_EXCEEDED", {
+              apiKey: this.config.apiKey.substring(0, 8) + "...",
+              origin: window.location.origin,
+              sessionId: sessionId ? sessionId.substring(0, 8) + "..." : "undefined"
+            });
+            (_f = (_e = this.config).onError) == null ? void 0 : _f.call(_e, error);
+            throw error;
+          }
+          const verificationUrl = await this.buildVerificationUrl(
+            options,
+            sessionId
+          );
+          logSecurityEvent("VERIFICATION_INITIATED", {
+            environment: this.config.environment,
+            mode: this.config.mode,
+            sessionId: sessionId ? sessionId.substring(0, 8) + "..." : "undefined",
+            origin: window.location.origin
+          });
+          if (this.config.mode === "new-tab") {
+            this.openNewTab(verificationUrl, sessionId);
+          } else {
+            this.unlockVerification();
+            this.redirect(verificationUrl);
+          }
+        } catch (error) {
+          this.unlockVerification();
+          throw error;
+        }
+      }
+      /**
+       * Build verification URL with HMAC-signed state
+       *
+       * Constructs the verification URL with signed state parameter containing
+       * all necessary configuration and security information. The state parameter
+       * includes HMAC signature for integrity protection.
+       *
+       * @param {VerificationOptions} options - Verification options
+       * @returns {Promise<string>} Complete verification URL
+       * @private
+       */
+      async buildVerificationUrl(options, sessionId) {
+        const baseUrl = getEnvironmentUrl(this.config.environment);
+        const hasExplicitChallengeAge = options.challengeAge !== void 0;
+        const hasExplicitVerificationMode = options.verificationMode !== void 0;
+        const hasOverrides = hasExplicitChallengeAge || hasExplicitVerificationMode;
+        const state = await generateState(
+          {
+            merchantId: this.config.apiKey,
+            sessionId,
+            returnUrl: this.config.returnUrl,
+            cancelUrl: this.config.cancelUrl,
+            challengeAge: options.challengeAge || this.config.defaultChallengeAge,
+            verificationMode: options.verificationMode || this.config.defaultVerificationMode,
+            hasOverrides,
+            // Flag to indicate explicit overrides
+            externalUserId: options.externalUserId,
+            timestamp: Date.now(),
+            // Phase 2: Include config for self-contained verify-ui
+            apiUrl: this.getPortalApiUrl(),
+            engineUrl: this.getEngineUrl(),
+            wsUrl: this.getWebSocketUrl(),
+            environment: this.config.environment,
+            features: {
+              testMode: false,
+              warmupPeriodMs: 500,
+              qualityThreshold: 0.6
+            },
+            // Include handoffToken if available (for QR code desktop flow)
+            handoffToken: this.temporaryHandoffToken || void 0,
+            // Include sessionToken and verifyUrl to make UI auth deterministic
+            sessionToken: this.lastSessionToken || void 0,
+            verifyUrl: this.lastVerifyUrl || void 0
+          },
+          this.config.environment
+        );
+        if (this.lastVerifyUrl) {
+          try {
+            const url = new URL(this.lastVerifyUrl);
+            url.searchParams.set("state", state);
+            url.searchParams.set("mode", this.config.mode);
+            if (options.skipIntro) {
+              url.searchParams.set("skip_intro", "true");
+            }
+            if (options.autoReturn) {
+              url.searchParams.set("auto_return", "true");
+            }
+            return url.toString();
+          } catch (e) {
+          }
+        }
+        const params = new URLSearchParams({ state, sessionId, mode: this.config.mode });
+        if (options.skipIntro) {
+          params.set("skip_intro", "true");
+        }
+        if (options.autoReturn) {
+          params.set("auto_return", "true");
+        }
+        return `${baseUrl}/?${params.toString()}`;
+      }
+      /**
+       * Redirect in same tab
+       *
+       * Performs a full page redirect to the verification URL.
+       * Used for redirect mode verification.
+       *
+       * @param {string} url - Verification URL to redirect to
+       * @private
+       */
+      redirect(url) {
+        window.location.href = url;
+      }
+      /**
+       * Open in new tab with PostMessage communication and proper cleanup
+       *
+       * Opens verification URL in a new tab/window and sets up secure PostMessage
+       * communication for receiving verification results. Includes comprehensive
+       * security validation and automatic cleanup.
+       *
+       * @param {string} url - Verification URL to open
+       * @param {string} sessionId - Session ID for result correlation
+       * @private
+       */
+      openNewTab(url, sessionId) {
+        var _a, _b;
+        this.cleanup();
+        if (this.popupMonitorInterval) {
+          clearInterval(this.popupMonitorInterval);
+          this.popupMonitorInterval = null;
+        }
+        this.popupWindow = window.open(
+          url,
+          "safepassage-verify",
+          "width=600,height=700"
+        );
+        if (!this.popupWindow) {
+          (_b = (_a = this.config).onError) == null ? void 0 : _b.call(
+            _a,
+            new Error(
+              "Failed to open verification window. Please check popup blocker settings."
+            )
+          );
+          return;
+        }
+        this.messageListener = (event) => {
+          var _a2, _b2, _c, _d, _e, _f;
+          if (!validatePostMessageOrigin(event, this.config.environment)) {
+            logSecurityEvent("POSTMESSAGE_ORIGIN_BLOCKED", {
+              origin: event.origin,
+              environment: this.config.environment,
+              expectedOrigins: `SafePassage trusted origins for ${this.config.environment}`,
+              messageType: (_a2 = event.data) == null ? void 0 : _a2.type
+            });
+            return;
+          }
+          const messageValidation = validateSafePassageMessage(event, sessionId);
+          if (!messageValidation.isValid) {
+            logSecurityEvent("POSTMESSAGE_VALIDATION_FAILED", {
+              error: messageValidation.error,
+              origin: event.origin,
+              sessionId: sessionId.substring(0, 8) + "...",
+              messageType: (_b2 = event.data) == null ? void 0 : _b2.type
+            });
+            return;
+          }
+          const result = {
+            sessionId: event.data.sessionId,
+            status: event.data.status,
+            timestamp: event.data.timestamp,
+            externalUserId: event.data.externalUserId
+          };
+          logSecurityEvent("VERIFICATION_COMPLETED", {
+            status: result.status,
+            sessionId: sessionId.substring(0, 8) + "...",
+            origin: event.origin
+          });
+          this.cleanup();
+          this.unlockVerification();
+          if (this.popupMonitorInterval) {
+            clearInterval(this.popupMonitorInterval);
+            this.popupMonitorInterval = null;
+          }
+          if (result.status === "verified") {
+            (_d = (_c = this.config).onComplete) == null ? void 0 : _d.call(_c, result);
+          } else {
+            (_f = (_e = this.config).onError) == null ? void 0 : _f.call(
+              _e,
+              new Error(`Verification failed: ${result.status}`)
+            );
+          }
+        };
+        window.addEventListener("message", this.messageListener);
+        this.popupMonitorInterval = setInterval(() => {
+          var _a2, _b2;
+          if (this.popupWindow && this.popupWindow.closed) {
+            logSecurityEvent("POPUP_CLOSED_BY_USER", {
+              sessionId: sessionId.substring(0, 8) + "...",
+              environment: this.config.environment
+            });
+            this.cleanup();
+            this.unlockVerification();
+            (_b2 = (_a2 = this.config).onCancel) == null ? void 0 : _b2.call(_a2);
+          }
+        }, 500);
+      }
+      /**
+       * Set up automatic cleanup on page unload to prevent memory leaks
+       *
+       * Registers event listeners for page unload events to ensure proper
+       * cleanup of resources and verification state. Handles both traditional
+       * page navigation and single-page application route changes.
+       *
+       * @private
+       */
+      setupAutoCleanup() {
+        this.unloadListener = () => {
+          logSecurityEvent("SDK_AUTO_CLEANUP", {
+            environment: this.config.environment,
+            trigger: "page_unload"
+          });
+          this.cleanup();
+          this.unlockVerification();
+        };
+        window.addEventListener("beforeunload", this.unloadListener);
+        window.addEventListener("pagehide", this.unloadListener);
+        if (window.history && window.history.pushState) {
+          const originalPushState = window.history.pushState;
+          window.history.pushState = (...args) => {
+            this.cleanup();
+            this.unlockVerification();
+            return originalPushState.apply(window.history, args);
+          };
+        }
+      }
+      /**
+       * Auto-detect environment based on current URL
+       *
+       * Analyzes the current hostname to determine the appropriate environment
+       * configuration. Used when environment is not explicitly specified.
+       * Always defaults to production unless staging is detected.
+       *
+       * @returns {'production' | 'staging'} Detected environment
+       * @private
+       */
+      detectEnvironment() {
+        const hostname = window.location.hostname;
+        if (hostname.includes("staging") || hostname.includes("stage")) {
+          return "staging";
+        }
+        return "production";
+      }
+      /**
+       * Get the current environment
+       * @returns {string} The current environment (production or staging)
+       */
+      getEnvironment() {
+        return this.config.environment;
+      }
+      /**
+       * Unlock verification process to allow new verifications
+       *
+       * Resets the verification lock state to allow new verification attempts.
+       * Called after successful completion, errors, or cleanup.
+       *
+       * @private
+       */
+      unlockVerification() {
+        this.isVerificationInProgress = false;
+        this.currentSessionId = null;
+        logSecurityEvent("VERIFICATION_UNLOCKED", {
+          environment: this.config.environment,
+          origin: window.location.origin
+        });
+      }
+      /**
+       * Internal cleanup method to prevent memory leaks
+       *
+       * Cleans up popup windows, event listeners, and intervals.
+       * Does not unlock verification state - that's handled by specific callers.
+       *
+       * @private
+       */
+      cleanup() {
+        if (this.popupWindow && !this.popupWindow.closed) {
+          this.popupWindow.close();
+        }
+        this.popupWindow = null;
+        if (this.messageListener) {
+          window.removeEventListener("message", this.messageListener);
+          this.messageListener = null;
+        }
+        if (this.popupMonitorInterval) {
+          clearInterval(this.popupMonitorInterval);
+          this.popupMonitorInterval = null;
+        }
+      }
+      /**
+       * Remove auto-cleanup listeners
+       *
+       * Removes page unload event listeners that were set up for automatic cleanup.
+       *
+       * @private
+       */
+      removeAutoCleanupListeners() {
+        if (this.unloadListener) {
+          window.removeEventListener("beforeunload", this.unloadListener);
+          window.removeEventListener("pagehide", this.unloadListener);
+          this.unloadListener = null;
+        }
+      }
+      /**
+       * Public cleanup method for manual resource management
+       *
+       * Completely destroys the SDK instance, cleaning up all resources and
+       * removing all event listeners. Should be called when the SDK is no longer needed.
+       *
+       * @public
+       */
+      destroy() {
+        logSecurityEvent("SDK_DESTROYED", {
+          environment: this.config.environment,
+          origin: window.location.origin
+        });
+        this.cleanup();
+        this.unlockVerification();
+        this.removeAutoCleanupListeners();
+      }
+      /**
+       * Get Portal API URL based on environment
+       *
+       * Returns the appropriate portal-api URL for the current environment.
+       *
+       * @returns {string} Portal API URL
+       * @private
+       */
+      getPortalApiUrl() {
+        switch (this.config.environment) {
+          case "staging":
+            return "https://api.staging.safepassageapp.com";
+          case "production":
+            return "https://api.safepassageapp.com";
+          default:
+            return "https://api.safepassageapp.com";
+        }
+      }
+      /**
+       * Get Engine URL based on environment
+       *
+       * Returns the appropriate verify-engine URL for the current environment.
+       * In production, engine access is proxied through portal-api.
+       *
+       * @returns {string} Engine URL
+       * @private
+       */
+      getEngineUrl() {
+        switch (this.config.environment) {
+          case "staging":
+            return "https://engine.staging.safepassageapp.com";
+          case "production":
+            return "https://engine.safepassageapp.com";
+          default:
+            return "https://engine.safepassageapp.com";
+        }
+      }
+      /**
+       * Get WebSocket URL based on environment
+       *
+       * Returns the appropriate WebSocket URL for the current environment.
+       * In production, WebSocket connections are proxied through portal-api.
+       *
+       * @returns {string} WebSocket URL
+       * @private
+       */
+      getWebSocketUrl() {
+        switch (this.config.environment) {
+          case "staging":
+            return "wss://engine.staging.safepassageapp.com/api/websocket/stream";
+          case "production":
+            return "wss://engine.safepassageapp.com/api/websocket/stream";
+          default:
+            return "wss://engine.safepassageapp.com/api/websocket/stream";
+        }
+      }
+      /**
+       * Detect if this is a public key (pk_ prefix) vs private key (sk_ prefix)
+       *
+       * Determines API key type based on prefix to handle different authentication flows.
+       *
+       * @returns {boolean} True if public key, false if private key
+       * @private
+       */
+      isPublicKey() {
+        return this.config.apiKey.startsWith("pk_");
+      }
+      /**
+       * Create session internally for public keys
+       *
+       * Creates a verification session via the portal API for public key authentication.
+       * Generates a UUID session ID and submits session creation request with
+       * verification parameters.
+       *
+       * @param {VerificationOptions} options - Verification options
+       * @returns {Promise<string>} Created session ID
+       * @throws {Error} If session creation fails
+       * @private
+       */
+      async createInternalSession(options) {
+        var _a, _b;
+        try {
+          const portalApiUrl = this.getPortalApiUrl();
+          const response = await fetch(`${portalApiUrl}/api/v1/sessions/create`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Authorization: `Bearer ${this.config.apiKey}`
+            },
+            body: JSON.stringify({
+              merchantId: this.config.apiKey,
+              // API expects merchantId even though it uses auth header
+              returnUrl: this.config.returnUrl,
+              cancelUrl: this.config.cancelUrl,
+              challengeAge: options.challengeAge,
+              verificationMode: options.verificationMode,
+              merchantName: document.title || window.location.hostname,
+              externalUserId: options.externalUserId
+            })
+          });
+          if (!response.ok) {
+            const errorData = await response.json().catch(() => ({}));
+            throw new Error(
+              `Failed to create session: ${response.status} ${response.statusText}. ${errorData.message || ""}`
+            );
+          }
+          const sessionData = await response.json();
+          const sessionId = sessionData.sessionId;
+          if (!sessionId) {
+            throw new Error("Server did not return a sessionId");
+          }
+          if (sessionData.verifyUrl) {
+            this.lastVerifyUrl = sessionData.verifyUrl;
+          }
+          if (sessionData.sessionToken) {
+            this.lastSessionToken = sessionData.sessionToken;
+          }
+          if (sessionData.handoffToken) {
+            this.temporaryHandoffToken = sessionData.handoffToken;
+          }
+          logSecurityEvent("INTERNAL_SESSION_CREATED", {
+            sessionId: sessionId.substring(0, 8) + "...",
+            environment: this.config.environment,
+            apiKeyType: "public"
+          });
+          return sessionId;
+        } catch (error) {
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          logSecurityEvent("INTERNAL_SESSION_FAILED", {
+            error: errorMessage,
+            environment: this.config.environment,
+            apiKeyType: "public"
+          });
+          (_b = (_a = this.config).onError) == null ? void 0 : _b.call(_a, error);
+          throw new Error(`Failed to create verification session: ${errorMessage}`);
+        }
+      }
+    };
+    SafePassageSDK_default = SafePassage;
+  }
+});
+
+// src-redirect/utils/polyfills.ts
+function setupPolyfills() {
+  if (!crypto.randomUUID) {
+    crypto.randomUUID = function() {
+      const array = new Uint8Array(16);
+      crypto.getRandomValues(array);
+      array[6] = array[6] & 15 | 64;
+      array[8] = array[8] & 63 | 128;
+      const hex = Array.from(array).map((b) => b.toString(16).padStart(2, "0")).join("");
+      return [
+        hex.slice(0, 8),
+        hex.slice(8, 12),
+        hex.slice(12, 16),
+        hex.slice(16, 20),
+        hex.slice(20, 32)
+      ].join("-");
+    };
+  }
+}
+function checkBrowserCompatibility() {
+  const warnings = [];
+  if (!window.crypto || !window.crypto.getRandomValues) {
+    throw new Error("SafePassage SDK requires Web Crypto API support");
+  }
+  if (!window.crypto.subtle) {
+    throw new Error(
+      "SafePassage SDK requires Web Crypto subtle API for HMAC operations"
+    );
+  }
+  if (!crypto.randomUUID) {
+    warnings.push("crypto.randomUUID not supported, using polyfill");
+  }
+  if (!window.URLSearchParams) {
+    warnings.push(
+      "URLSearchParams not supported, consider adding a polyfill for IE 11 support"
+    );
+  }
+  if (warnings.length > 0) {
+    console.warn("SafePassage SDK Browser Compatibility:", warnings.join("; "));
+  }
+}
+
+// src-redirect/index.ts
+init_SafePassageSDK();
+if (typeof window !== "undefined") {
+  setupPolyfills();
+  checkBrowserCompatibility();
+}
+var VERSION = "3.4.4";
+if (typeof window !== "undefined" && window) {
+  const { SafePassage: SafePassage2 } = (init_SafePassageSDK(), __toCommonJS(SafePassageSDK_exports));
+  const globalWindow = window;
+  globalWindow.SafePassage = SafePassage2;
+  if (globalWindow.SafePassage) {
+    globalWindow.SafePassage.VERSION = VERSION;
+  }
 }
+export {
+  SafePassage,
+  VERSION,
+  SafePassage as default
+};

package/dist/safepassage.min.js

@@ -1,3 +1,3 @@
-/* SafePassage SDK v3.4.2 */
-"use strict";var SafePassageSDK=(()=>{var v=Object.defineProperty,se=Object.defineProperties,oe=Object.getOwnPropertyDescriptor,ae=Object.getOwnPropertyDescriptors,ce=Object.getOwnPropertyNames,w=Object.getOwnPropertySymbols;var I=Object.prototype.hasOwnProperty,R=Object.prototype.propertyIsEnumerable;var L=(t,e,n)=>e in t?v(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n,h=(t,e)=>{for(var n in e||(e={}))I.call(e,n)&&L(t,n,e[n]);if(w)for(var n of w(e))R.call(e,n)&&L(t,n,e[n]);return t},S=(t,e)=>se(t,ae(e));var C=(t,e)=>{var n={};for(var i in t)I.call(t,i)&&e.indexOf(i)<0&&(n[i]=t[i]);if(t!=null&&w)for(var i of w(t))e.indexOf(i)<0&&R.call(t,i)&&(n[i]=t[i]);return n};var m=(t,e)=>()=>(t&&(e=t(t=0)),e);var P=(t,e)=>{for(var n in e)v(t,n,{get:e[n],enumerable:!0})},le=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of ce(e))!I.call(t,r)&&r!==n&&v(t,r,{get:()=>e[r],enumerable:!(i=oe(e,r))||i.enumerable});return t};var D=t=>le(v({},"__esModule",{value:!0}),t);function pe(t,e){return N[e].includes(t)}function K(t,e,n=[]){var r;let{origin:i}=t;return pe(i,e)||n.length>0&&n.some(o=>{if(o.startsWith("*.")){let a=o.slice(2);return i.endsWith(`.${a}`)||i===`https://${a}`||i===`http://${a}`}return i===o})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:N[e],allowedCustomOrigins:n,eventType:(r=t.data)==null?void 0:r.type}),!1)}function W(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function H(t){t==="production"&&window.location.protocol!=="https:"&&console.warn("SafePassage Warning: HTTPS recommended for production environment",{current:window.location.href})}function A(t,e){try{let n=new URL(t);if(n.protocol!=="https:"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"))return{isValid:!1,error:`HTTPS required for return URLs in ${e}`};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let r of i)if(r.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch(n){return{isValid:!1,error:"Invalid URL format"}}}function l(t,e){console.warn(`SafePassage Security Event: ${t}`,h({timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href},e))}var N,U,j,T=m(()=>{"use strict";N={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av.staging.safepassageapp.com","https://portal.staging.safepassageapp.com","https://api.staging.safepassageapp.com"]};U=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),r=(this.attempts.get(e)||[]).filter(s=>n-s<this.timeWindow);return r.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(r.push(n),this.attempts.set(e,r),!0)}reset(e){this.attempts.delete(e)}},j=new U});var B={};P(B,{createSignedState:()=>ue,generateHMAC:()=>b,generateSecureToken:()=>F,getSigningSecret:()=>x,parseSignedState:()=>ge,verifyHMAC:()=>q});async function b(t,e){let n=new TextEncoder,i=n.encode(e),r=n.encode(t),s=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",s,r);return Array.from(new Uint8Array(o)).map(a=>a.toString(16).padStart(2,"0")).join("")}async function q(t,e,n){try{let i=await b(t,n);return de(e,i)}catch(i){return!1}}function de(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function F(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function x(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025"}[t]}async function ue(t,e){let n=S(h({},t),{timestamp:Date.now(),nonce:F(16)}),i=JSON.stringify(n),r=x(e),s=await b(i,r);return btoa(JSON.stringify({data:n,signature:s}))}async function ge(t,e,n=J){try{let r=atob(t),s=JSON.parse(r);if(!s.data||!s.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:o,signature:a}=s,p=JSON.stringify(o),c=x(e);if(!await q(p,a,c))return console.warn("SafePassage: State signature verification failed"),null;if(o.timestamp){let _=Date.now()-o.timestamp;if(_>n)return console.warn("SafePassage: State parameter expired",{age:_,maxAge:n}),null}let i=o,{timestamp:g,nonce:f}=i;return C(i,["timestamp","nonce"])}catch(r){return console.warn("SafePassage: Failed to parse signed state",r),null}}var G=m(()=>{"use strict";V()});function Z(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>z)throw new Error(`apiKey exceeds maximum length of ${z} characters`);if(!fe.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window!="undefined"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>y)throw new Error(`returnUrl exceeds maximum length of ${y} characters`);let e=he(),n=A(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);if(t.cancelUrl){if(t.cancelUrl.length>y)throw new Error(`cancelUrl exceeds maximum length of ${y} characters`);let i=A(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`)}if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<X)throw new Error(`defaultChallengeAge must be at least ${X}`);if(t.defaultChallengeAge>Y)throw new Error(`defaultChallengeAge cannot exceed ${Y}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function he(){if(typeof window=="undefined")return"production";let t=window.location.hostname;return t.includes("staging")||t.includes("stage")?"staging":"production"}async function Q(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(G(),B));return n(t,e)}var X,Y,y,z,J,fe,V=m(()=>{"use strict";T();X=25,Y=150,y=2048,z=128,J=6e5,fe=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function k(t){let e=ee[t]||ee.production;if(!e||!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function me(t){let e={production:"https://api.safepassageapp.com",staging:"https://api.staging.safepassageapp.com"},n=e[t]||e.production;if(!n||!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function te(t){let e=window.location.protocol==="https:";switch(t){case"production":e||console.warn("SafePassage Warning: HTTPS recommended for production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break}try{k(t),me(t)}catch(n){let i=n instanceof Error?n.message:String(n);throw new Error(`Environment configuration validation failed: ${i}`)}}var ee,ne=m(()=>{"use strict";ee={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com"}});var ie={};P(ie,{SafePassage:()=>u,default:()=>we});var u,we,M=m(()=>{"use strict";V();ne();T();u=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;this.lastVerifyUrl=null;this.lastSessionToken=null;Z(e);let n=e.environment||this.detectEnvironment();n!=="staging"&&n!=="production"&&(console.warn(`SafePassage SDK: Unknown environment '${n}', defaulting to 'production'`),n="production"),this.config=S(h({},e),{environment:n,mode:e.mode||"redirect"}),te(this.config.environment),H(this.config.environment),l("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){var r,s,o,a,p,c;let n=this.isPublicKey(),i;if(n)i=await this.createInternalSession(e);else throw new Error("Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only.");if(!i)throw new Error("Failed to obtain sessionId from server");if(this.isVerificationInProgress){let d=new Error(`Verification already in progress for session ${(r=this.currentSessionId)==null?void 0:r.substring(0,8)}...`);throw l("RACE_CONDITION_PREVENTED",{currentSession:((s=this.currentSessionId)==null?void 0:s.substring(0,8))+"...",attemptedSession:"new-session-attempt",origin:window.location.origin}),(a=(o=this.config).onError)==null||a.call(o,d),d}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let d=`${this.config.apiKey}:${window.location.origin}`;if(!j.isAllowed(d)){let f=new Error("Too many verification attempts. Please wait before trying again.");throw l("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),(c=(p=this.config).onError)==null||c.call(p,f),f}let g=await this.buildVerificationUrl(e,i);l("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(g,i):(this.unlockVerification(),this.redirect(g))}catch(d){throw this.unlockVerification(),d}}async buildVerificationUrl(e,n){let i=k(this.config.environment),r=e.challengeAge!==void 0,s=e.verificationMode!==void 0,o=r||s,a=await Q({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this._temporaryHandoffToken,sessionToken:this.lastSessionToken||void 0,verifyUrl:this.lastVerifyUrl||void 0},this.config.environment);if(this.lastVerifyUrl)try{let c=new URL(this.lastVerifyUrl);return c.searchParams.set("state",a),c.searchParams.set("mode",this.config.mode),e.skipIntro&&c.searchParams.set("skip_intro","true"),e.autoReturn&&c.searchParams.set("auto_return","true"),c.toString()}catch(c){}let p=new URLSearchParams({state:a,sessionId:n,mode:this.config.mode});return e.skipIntro&&p.set("skip_intro","true"),e.autoReturn&&p.set("auto_return","true"),`${i}/?${p.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){var i,r;if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){(r=(i=this.config).onError)==null||r.call(i,new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=s=>{var p,c,d,g,f,E;if(!K(s,this.config.environment)){l("POSTMESSAGE_ORIGIN_BLOCKED",{origin:s.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:(p=s.data)==null?void 0:p.type});return}let o=W(s,n);if(!o.isValid){l("POSTMESSAGE_VALIDATION_FAILED",{error:o.error,origin:s.origin,sessionId:n.substring(0,8)+"...",messageType:(c=s.data)==null?void 0:c.type});return}let a={sessionId:s.data.sessionId,status:s.data.status};l("VERIFICATION_COMPLETED",{status:a.status,sessionId:n.substring(0,8)+"...",origin:s.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),a.status==="verified"?(g=(d=this.config).onComplete)==null||g.call(d,a):(E=(f=this.config).onError)==null||E.call(f,new Error(`Verification failed: ${a.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{var s,o;this.popupWindow&&this.popupWindow.closed&&(l("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),(o=(s=this.config).onCancel)==null||o.call(s))},500)}setupAutoCleanup(){if(this.unloadListener=()=>{l("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,l("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){l("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){var n,i;try{let r=this.getPortalApiUrl(),s=await fetch(`${r}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!s.ok){let p=await s.json().catch(()=>({}));throw new Error(`Failed to create session: ${s.status} ${s.statusText}. ${p.message||""}`)}let o=await s.json(),a=o.sessionId;if(!a)throw new Error("Server did not return a sessionId");return o.verifyUrl&&(this.lastVerifyUrl=o.verifyUrl),o.sessionToken&&(this.lastSessionToken=o.sessionToken),o.handoffToken&&(this._temporaryHandoffToken=o.handoffToken),l("INTERNAL_SESSION_CREATED",{sessionId:a.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),a}catch(r){let s=r instanceof Error?r.message:String(r);throw l("INTERNAL_SESSION_FAILED",{error:s,environment:this.config.environment,apiKeyType:"public"}),(i=(n=this.config).onError)==null||i.call(n,r),new Error(`Failed to create verification session: ${s}`)}}},we=u});var ve={};P(ve,{SafePassage:()=>u,VERSION:()=>re,default:()=>u});function $(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function O(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support"),t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}M();typeof window!="undefined"&&($(),O());var re="3.4.2";if(typeof window!="undefined"&&window){let{SafePassage:t}=(M(),D(ie)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=re)}return D(ve);})();
+/* SafePassage SDK v3.4.4 */
+"use strict";var SafePassageSDK=(()=>{var v=Object.defineProperty,se=Object.defineProperties,oe=Object.getOwnPropertyDescriptor,ae=Object.getOwnPropertyDescriptors,ce=Object.getOwnPropertyNames,w=Object.getOwnPropertySymbols;var I=Object.prototype.hasOwnProperty,R=Object.prototype.propertyIsEnumerable;var _=(t,e,n)=>e in t?v(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n,h=(t,e)=>{for(var n in e||(e={}))I.call(e,n)&&_(t,n,e[n]);if(w)for(var n of w(e))R.call(e,n)&&_(t,n,e[n]);return t},S=(t,e)=>se(t,ae(e));var C=(t,e)=>{var n={};for(var i in t)I.call(t,i)&&e.indexOf(i)<0&&(n[i]=t[i]);if(t!=null&&w)for(var i of w(t))e.indexOf(i)<0&&R.call(t,i)&&(n[i]=t[i]);return n};var m=(t,e)=>()=>(t&&(e=t(t=0)),e);var P=(t,e)=>{for(var n in e)v(t,n,{get:e[n],enumerable:!0})},le=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of ce(e))!I.call(t,s)&&s!==n&&v(t,s,{get:()=>e[s],enumerable:!(i=oe(e,s))||i.enumerable});return t};var D=t=>le(v({},"__esModule",{value:!0}),t);function pe(t,e){return N[e].includes(t)}function K(t,e,n=[]){var s;let{origin:i}=t;return pe(i,e)||n.length>0&&n.some(o=>{if(o.startsWith("*.")){let a=o.slice(2);return i.endsWith(`.${a}`)||i===`https://${a}`||i===`http://${a}`}return i===o})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:N[e],allowedCustomOrigins:n,eventType:(s=t.data)==null?void 0:s.type}),!1)}function W(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function H(t){t==="production"&&window.location.protocol!=="https:"&&console.warn("SafePassage Warning: HTTPS recommended for production environment",{current:window.location.href})}function A(t,e){try{let n=new URL(t);if(n.protocol!=="https:"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"))return{isValid:!1,error:`HTTPS required for return URLs in ${e}`};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let s of i)if(s.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch(n){return{isValid:!1,error:"Invalid URL format"}}}function l(t,e){console.warn(`SafePassage Security Event: ${t}`,h({timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href},e))}var N,U,j,T=m(()=>{"use strict";N={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av.staging.safepassageapp.com","https://portal.staging.safepassageapp.com","https://api.staging.safepassageapp.com"]};U=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),s=(this.attempts.get(e)||[]).filter(r=>n-r<this.timeWindow);return s.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(s.push(n),this.attempts.set(e,s),!0)}reset(e){this.attempts.delete(e)}},j=new U});var B={};P(B,{createSignedState:()=>ue,generateHMAC:()=>b,generateSecureToken:()=>F,getSigningSecret:()=>x,parseSignedState:()=>ge,verifyHMAC:()=>q});async function b(t,e){let n=new TextEncoder,i=n.encode(e),s=n.encode(t),r=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",r,s);return Array.from(new Uint8Array(o)).map(a=>a.toString(16).padStart(2,"0")).join("")}async function q(t,e,n){try{let i=await b(t,n);return de(e,i)}catch(i){return!1}}function de(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function F(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function x(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025"}[t]}async function ue(t,e){let n=S(h({},t),{timestamp:Date.now(),nonce:F(16)}),i=JSON.stringify(n),s=x(e),r=await b(i,s);return btoa(JSON.stringify({data:n,signature:r}))}async function ge(t,e,n=J){try{let s=atob(t),r=JSON.parse(s);if(!r.data||!r.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:o,signature:a}=r,p=JSON.stringify(o),c=x(e);if(!await q(p,a,c))return console.warn("SafePassage: State signature verification failed"),null;if(o.timestamp){let L=Date.now()-o.timestamp;if(L>n)return console.warn("SafePassage: State parameter expired",{age:L,maxAge:n}),null}let i=o,{timestamp:g,nonce:f}=i;return C(i,["timestamp","nonce"])}catch(s){return console.warn("SafePassage: Failed to parse signed state",s),null}}var G=m(()=>{"use strict";V()});function Z(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>z)throw new Error(`apiKey exceeds maximum length of ${z} characters`);if(!fe.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window!="undefined"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>y)throw new Error(`returnUrl exceeds maximum length of ${y} characters`);let e=he(),n=A(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);if(t.cancelUrl){if(t.cancelUrl.length>y)throw new Error(`cancelUrl exceeds maximum length of ${y} characters`);let i=A(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`)}if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<X)throw new Error(`defaultChallengeAge must be at least ${X}`);if(t.defaultChallengeAge>Y)throw new Error(`defaultChallengeAge cannot exceed ${Y}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function he(){if(typeof window=="undefined")return"production";let t=window.location.hostname;return t.includes("staging")||t.includes("stage")?"staging":"production"}async function Q(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(G(),B));return n(t,e)}var X,Y,y,z,J,fe,V=m(()=>{"use strict";T();X=25,Y=150,y=2048,z=128,J=6e5,fe=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function k(t){let e=ee[t]||ee.production;if(!e||!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function me(t){let e={production:"https://api.safepassageapp.com",staging:"https://api.staging.safepassageapp.com"},n=e[t]||e.production;if(!n||!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function te(t){let e=window.location.protocol==="https:";switch(t){case"production":e||console.warn("SafePassage Warning: HTTPS recommended for production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break}try{k(t),me(t)}catch(n){let i=n instanceof Error?n.message:String(n);throw new Error(`Environment configuration validation failed: ${i}`)}}var ee,ne=m(()=>{"use strict";ee={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com"}});var ie={};P(ie,{SafePassage:()=>u,default:()=>we});var u,we,M=m(()=>{"use strict";V();ne();T();u=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;this.lastVerifyUrl=null;this.lastSessionToken=null;this.temporaryHandoffToken=null;Z(e);let n=e.environment||this.detectEnvironment();n!=="staging"&&n!=="production"&&(console.warn(`SafePassage SDK: Unknown environment '${n}', defaulting to 'production'`),n="production"),this.config=S(h({},e),{environment:n,mode:e.mode||"redirect"}),te(this.config.environment),H(this.config.environment),l("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){var s,r,o,a,p,c;let n=this.isPublicKey(),i;if(n)i=await this.createInternalSession(e);else throw new Error("Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only.");if(!i)throw new Error("Failed to obtain sessionId from server");if(this.isVerificationInProgress){let d=new Error(`Verification already in progress for session ${(s=this.currentSessionId)==null?void 0:s.substring(0,8)}...`);throw l("RACE_CONDITION_PREVENTED",{currentSession:((r=this.currentSessionId)==null?void 0:r.substring(0,8))+"...",attemptedSession:"new-session-attempt",origin:window.location.origin}),(a=(o=this.config).onError)==null||a.call(o,d),d}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let d=`${this.config.apiKey}:${window.location.origin}`;if(!j.isAllowed(d)){let f=new Error("Too many verification attempts. Please wait before trying again.");throw l("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),(c=(p=this.config).onError)==null||c.call(p,f),f}let g=await this.buildVerificationUrl(e,i);l("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(g,i):(this.unlockVerification(),this.redirect(g))}catch(d){throw this.unlockVerification(),d}}async buildVerificationUrl(e,n){let i=k(this.config.environment),s=e.challengeAge!==void 0,r=e.verificationMode!==void 0,o=s||r,a=await Q({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this.temporaryHandoffToken||void 0,sessionToken:this.lastSessionToken||void 0,verifyUrl:this.lastVerifyUrl||void 0},this.config.environment);if(this.lastVerifyUrl)try{let c=new URL(this.lastVerifyUrl);return c.searchParams.set("state",a),c.searchParams.set("mode",this.config.mode),e.skipIntro&&c.searchParams.set("skip_intro","true"),e.autoReturn&&c.searchParams.set("auto_return","true"),c.toString()}catch(c){}let p=new URLSearchParams({state:a,sessionId:n,mode:this.config.mode});return e.skipIntro&&p.set("skip_intro","true"),e.autoReturn&&p.set("auto_return","true"),`${i}/?${p.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){var i,s;if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){(s=(i=this.config).onError)==null||s.call(i,new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=r=>{var p,c,d,g,f,E;if(!K(r,this.config.environment)){l("POSTMESSAGE_ORIGIN_BLOCKED",{origin:r.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:(p=r.data)==null?void 0:p.type});return}let o=W(r,n);if(!o.isValid){l("POSTMESSAGE_VALIDATION_FAILED",{error:o.error,origin:r.origin,sessionId:n.substring(0,8)+"...",messageType:(c=r.data)==null?void 0:c.type});return}let a={sessionId:r.data.sessionId,status:r.data.status,timestamp:r.data.timestamp,externalUserId:r.data.externalUserId};l("VERIFICATION_COMPLETED",{status:a.status,sessionId:n.substring(0,8)+"...",origin:r.origin}),this.cleanup(),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),a.status==="verified"?(g=(d=this.config).onComplete)==null||g.call(d,a):(E=(f=this.config).onError)==null||E.call(f,new Error(`Verification failed: ${a.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{var r,o;this.popupWindow&&this.popupWindow.closed&&(l("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),(o=(r=this.config).onCancel)==null||o.call(r))},500)}setupAutoCleanup(){if(this.unloadListener=()=>{l("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,l("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(){this.popupWindow&&!this.popupWindow.closed&&this.popupWindow.close(),this.popupWindow=null,this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){l("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){var n,i;try{let s=this.getPortalApiUrl(),r=await fetch(`${s}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!r.ok){let p=await r.json().catch(()=>({}));throw new Error(`Failed to create session: ${r.status} ${r.statusText}. ${p.message||""}`)}let o=await r.json(),a=o.sessionId;if(!a)throw new Error("Server did not return a sessionId");return o.verifyUrl&&(this.lastVerifyUrl=o.verifyUrl),o.sessionToken&&(this.lastSessionToken=o.sessionToken),o.handoffToken&&(this.temporaryHandoffToken=o.handoffToken),l("INTERNAL_SESSION_CREATED",{sessionId:a.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),a}catch(s){let r=s instanceof Error?s.message:String(s);throw l("INTERNAL_SESSION_FAILED",{error:r,environment:this.config.environment,apiKeyType:"public"}),(i=(n=this.config).onError)==null||i.call(n,s),new Error(`Failed to create verification session: ${r}`)}}},we=u});var ve={};P(ve,{SafePassage:()=>u,VERSION:()=>re,default:()=>u});function $(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function O(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support"),t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}M();typeof window!="undefined"&&($(),O());var re="3.4.4";if(typeof window!="undefined"&&window){let{SafePassage:t}=(M(),D(ie)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=re)}return D(ve);})();
 if(typeof SafePassageSDK !== "undefined" && SafePassageSDK.SafePassage) { window.SafePassage = SafePassageSDK.SafePassage; window.SafePassage.VERSION = SafePassageSDK.VERSION; }

package/dist/types/index.d.ts

@@ -92,6 +92,10 @@ export interface VerificationResult {
      * Full details available via server-side API
      */
     status: 'verified' | 'failed';
+    /**
+     * Timestamp when verification completed (milliseconds since epoch)
+     */
+    timestamp?: number;
     /**
      * External user identifier if provided during verification
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safepassage/sdk",
-  "version": "3.4.2",
+  "version": "3.4.4",
   "description": "SafePassage SDK - Lightweight redirect-based age verification",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,7 +10,8 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc && node build-sdk.js",
+    "build": "npm run clean && tsc && node build-sdk.js",
+    "clean": "rm -rf dist",
     "dev": "tsc --watch",
     "demo": "python3 -m http.server 8080",
     "serve-demo": "npx serve . -p 8080",