@safepassage/sdk 3.4.9 → 3.4.10

package/dist/index.js

@@ -1,1100 +0,0 @@
-var __defProp = Object.defineProperty;
-var __defProps = Object.defineProperties;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __spreadValues = (a, b) => {
-  for (var prop in b || (b = {}))
-    if (__hasOwnProp.call(b, prop))
-      __defNormalProp(a, prop, b[prop]);
-  if (__getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(b)) {
-      if (__propIsEnum.call(b, prop))
-        __defNormalProp(a, prop, b[prop]);
-    }
-  return a;
-};
-var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __objRest = (source, exclude) => {
-  var target = {};
-  for (var prop in source)
-    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
-      target[prop] = source[prop];
-  if (source != null && __getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(source)) {
-      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
-        target[prop] = source[prop];
-    }
-  return target;
-};
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src-redirect/utils/security.ts
-function isOriginTrusted(origin, environment) {
-  const trustedOrigins = TRUSTED_ORIGINS[environment];
-  return trustedOrigins.includes(origin);
-}
-function validatePostMessageOrigin(event, environment, allowedCustomOrigins = []) {
-  var _a;
-  const { origin } = event;
-  if (isOriginTrusted(origin, environment)) {
-    return true;
-  }
-  if (allowedCustomOrigins.length > 0) {
-    const isCustomOriginAllowed = allowedCustomOrigins.some((allowedOrigin) => {
-      if (allowedOrigin.startsWith("*.")) {
-        const domain = allowedOrigin.slice(2);
-        return origin.endsWith(`.${domain}`) || origin === `https://${domain}` || origin === `http://${domain}`;
-      }
-      return origin === allowedOrigin;
-    });
-    if (isCustomOriginAllowed) {
-      return true;
-    }
-  }
-  console.warn(
-    `SafePassage Security: Blocked PostMessage from untrusted origin: ${origin}`,
-    {
-      environment,
-      trustedOrigins: TRUSTED_ORIGINS[environment],
-      allowedCustomOrigins,
-      eventType: (_a = event.data) == null ? void 0 : _a.type
-    }
-  );
-  return false;
-}
-function validateSafePassageMessage(event, expectedSessionId) {
-  const { data } = event;
-  if (!data || typeof data !== "object") {
-    return { isValid: false, error: "Invalid message format" };
-  }
-  if (data.type !== "safepassage:verification:complete") {
-    return { isValid: false, error: "Invalid message type" };
-  }
-  if (!data.sessionId || data.sessionId !== expectedSessionId) {
-    return { isValid: false, error: "Session ID mismatch" };
-  }
-  if (!data.status || !["verified", "failed"].includes(data.status)) {
-    return { isValid: false, error: "Invalid status value" };
-  }
-  return { isValid: true };
-}
-function enforceHTTPS(environment) {
-  if (environment === "production" && window.location.protocol !== "https:") {
-    console.warn(
-      "SafePassage Warning: HTTPS recommended for production environment",
-      {
-        current: window.location.href
-      }
-    );
-  }
-}
-function validateReturnUrl(url, environment) {
-  try {
-    const parsed = new URL(url);
-    if (parsed.protocol !== "https:") {
-      const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
-      if (!isLocalhost) {
-        return {
-          isValid: false,
-          error: `HTTPS required for return URLs in ${environment}`
-        };
-      }
-    }
-    const suspiciousPatterns = [
-      /data:/i,
-      /javascript:/i,
-      /vbscript:/i,
-      /file:/i,
-      /ftp:/i
-    ];
-    for (const pattern of suspiciousPatterns) {
-      if (pattern.test(url)) {
-        return { isValid: false, error: "Blocked suspicious URL scheme" };
-      }
-    }
-    return { isValid: true };
-  } catch (e) {
-    return { isValid: false, error: "Invalid URL format" };
-  }
-}
-function logSecurityEvent(event, details) {
-  console.warn(`SafePassage Security Event: ${event}`, __spreadValues({
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    userAgent: navigator.userAgent,
-    url: window.location.href
-  }, details));
-}
-var TRUSTED_ORIGINS, VerificationRateLimit, verificationRateLimit;
-var init_security = __esm({
-  "src-redirect/utils/security.ts"() {
-    "use strict";
-    TRUSTED_ORIGINS = {
-      production: [
-        "https://av.safepassageapp.com",
-        "https://portal.safepassageapp.com",
-        "https://api.safepassageapp.com"
-      ],
-      staging: [
-        "https://av.staging.safepassageapp.com",
-        "https://portal.staging.safepassageapp.com",
-        "https://api.staging.safepassageapp.com"
-      ]
-    };
-    VerificationRateLimit = class {
-      constructor() {
-        this.attempts = /* @__PURE__ */ new Map();
-        this.maxAttempts = 5;
-        this.timeWindow = 6e4;
-      }
-      // 1 minute
-      isAllowed(identifier) {
-        const now = Date.now();
-        const attempts = this.attempts.get(identifier) || [];
-        const recentAttempts = attempts.filter(
-          (time) => now - time < this.timeWindow
-        );
-        if (recentAttempts.length >= this.maxAttempts) {
-          console.warn(
-            `SafePassage Security: Rate limit exceeded for ${identifier}`
-          );
-          return false;
-        }
-        recentAttempts.push(now);
-        this.attempts.set(identifier, recentAttempts);
-        return true;
-      }
-      reset(identifier) {
-        this.attempts.delete(identifier);
-      }
-    };
-    verificationRateLimit = new VerificationRateLimit();
-  }
-});
-
-// src-redirect/utils/crypto.ts
-var crypto_exports = {};
-__export(crypto_exports, {
-  createSignedState: () => createSignedState,
-  generateHMAC: () => generateHMAC,
-  generateSecureToken: () => generateSecureToken,
-  getSigningSecret: () => getSigningSecret,
-  parseSignedState: () => parseSignedState,
-  verifyHMAC: () => verifyHMAC
-});
-async function generateHMAC(data, secret) {
-  const encoder = new TextEncoder();
-  const keyData = encoder.encode(secret);
-  const dataBuffer = encoder.encode(data);
-  const key = await crypto.subtle.importKey(
-    "raw",
-    keyData,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", key, dataBuffer);
-  return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function verifyHMAC(data, signature, secret) {
-  try {
-    const expectedSignature = await generateHMAC(data, secret);
-    return constantTimeCompare(signature, expectedSignature);
-  } catch (e) {
-    return false;
-  }
-}
-function constantTimeCompare(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  let result = 0;
-  for (let i = 0; i < a.length; i++) {
-    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return result === 0;
-}
-function generateSecureToken(length = 32) {
-  const array = new Uint8Array(length);
-  crypto.getRandomValues(array);
-  return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-function getSigningSecret(environment) {
-  const baseSecrets = {
-    production: "safepassage-prod-hmac-2025",
-    staging: "safepassage-stage-hmac-2025"
-  };
-  return baseSecrets[environment];
-}
-async function createSignedState(payload, environment) {
-  const timestampedPayload = __spreadProps(__spreadValues({}, payload), {
-    timestamp: Date.now(),
-    nonce: generateSecureToken(16)
-    // Add nonce to prevent replay attacks
-  });
-  const dataString = JSON.stringify(timestampedPayload);
-  const secret = getSigningSecret(environment);
-  const signature = await generateHMAC(dataString, secret);
-  const signedPayload = {
-    data: timestampedPayload,
-    signature
-  };
-  return btoa(JSON.stringify(signedPayload));
-}
-async function parseSignedState(signedState, environment, maxAge = STATE_EXPIRY_MS) {
-  try {
-    const json = atob(signedState);
-    const signedPayload = JSON.parse(json);
-    if (!signedPayload.data || !signedPayload.signature) {
-      console.warn("SafePassage: Invalid signed state format");
-      return null;
-    }
-    const { data, signature } = signedPayload;
-    const dataString = JSON.stringify(data);
-    const secret = getSigningSecret(environment);
-    const isValid = await verifyHMAC(dataString, signature, secret);
-    if (!isValid) {
-      console.warn("SafePassage: State signature verification failed");
-      return null;
-    }
-    if (data.timestamp) {
-      const age = Date.now() - data.timestamp;
-      if (age > maxAge) {
-        console.warn("SafePassage: State parameter expired", { age, maxAge });
-        return null;
-      }
-    }
-    const _a = data, { timestamp, nonce } = _a, payload = __objRest(_a, ["timestamp", "nonce"]);
-    return payload;
-  } catch (error) {
-    console.warn("SafePassage: Failed to parse signed state", error);
-    return null;
-  }
-}
-var init_crypto = __esm({
-  "src-redirect/utils/crypto.ts"() {
-    "use strict";
-    init_validation();
-  }
-});
-
-// src-redirect/utils/validation.ts
-function validateConfig(config) {
-  if (!config.apiKey) {
-    throw new Error("apiKey is required");
-  }
-  if (config.apiKey.length > MAX_API_KEY_LENGTH) {
-    throw new Error(
-      `apiKey exceeds maximum length of ${MAX_API_KEY_LENGTH} characters`
-    );
-  }
-  if (!API_KEY_PATTERN.test(config.apiKey)) {
-    throw new Error(
-      "Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)"
-    );
-  }
-  if (typeof window !== "undefined" && config.apiKey.startsWith("sk_")) {
-    throw new Error(
-      "Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions"
-    );
-  }
-  if (!config.returnUrl) {
-    throw new Error("returnUrl is required");
-  }
-  if (config.returnUrl.length > MAX_URL_LENGTH) {
-    throw new Error(
-      `returnUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`
-    );
-  }
-  const environment = detectEnvironment();
-  const returnUrlValidation = validateReturnUrl(config.returnUrl, environment);
-  if (!returnUrlValidation.isValid) {
-    throw new Error(
-      `returnUrl validation failed: ${returnUrlValidation.error}`
-    );
-  }
-  if (config.cancelUrl) {
-    if (config.cancelUrl.length > MAX_URL_LENGTH) {
-      throw new Error(
-        `cancelUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`
-      );
-    }
-    const cancelUrlValidation = validateReturnUrl(config.cancelUrl, environment);
-    if (!cancelUrlValidation.isValid) {
-      throw new Error(
-        `cancelUrl validation failed: ${cancelUrlValidation.error}`
-      );
-    }
-  }
-  if (config.defaultChallengeAge !== void 0) {
-    if (config.defaultChallengeAge < MINIMUM_AGE) {
-      throw new Error(`defaultChallengeAge must be at least ${MINIMUM_AGE}`);
-    }
-    if (config.defaultChallengeAge > MAXIMUM_AGE) {
-      throw new Error(`defaultChallengeAge cannot exceed ${MAXIMUM_AGE}`);
-    }
-  }
-  if (config.defaultVerificationMode && !["L1", "L2"].includes(config.defaultVerificationMode)) {
-    throw new Error("defaultVerificationMode must be L1 or L2");
-  }
-  if (config.mode && !["redirect", "new-tab"].includes(config.mode)) {
-    throw new Error("mode must be redirect or new-tab");
-  }
-}
-function detectEnvironment() {
-  if (typeof window === "undefined") {
-    return "production";
-  }
-  const hostname = window.location.hostname;
-  if (hostname.includes("staging") || hostname.includes("stage")) {
-    return "staging";
-  }
-  return "production";
-}
-async function generateState(payload, environment) {
-  const { createSignedState: createSignedState2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-  return createSignedState2(payload, environment);
-}
-var MINIMUM_AGE, MAXIMUM_AGE, MAX_URL_LENGTH, MAX_API_KEY_LENGTH, STATE_EXPIRY_MS, API_KEY_PATTERN;
-var init_validation = __esm({
-  "src-redirect/utils/validation.ts"() {
-    "use strict";
-    init_security();
-    MINIMUM_AGE = 25;
-    MAXIMUM_AGE = 150;
-    MAX_URL_LENGTH = 2048;
-    MAX_API_KEY_LENGTH = 128;
-    STATE_EXPIRY_MS = 6e5;
-    API_KEY_PATTERN = /^(pk_|sk_)[a-zA-Z0-9_]+$/;
-  }
-});
-
-// src-redirect/utils/environment.ts
-function getEnvironmentUrl(environment) {
-  const url = ENVIRONMENT_URLS[environment] || ENVIRONMENT_URLS.production;
-  if (!url || !url.startsWith("https://")) {
-    throw new Error(`HTTPS required for ${environment} environment`);
-  }
-  return url;
-}
-function getApiUrl(environment) {
-  const apiUrls = {
-    production: "https://api.safepassageapp.com",
-    staging: "https://api.staging.safepassageapp.com"
-  };
-  const url = apiUrls[environment] || apiUrls.production;
-  if (!url || !url.startsWith("https://")) {
-    throw new Error(
-      `HTTPS required for API URLs in ${environment} environment`
-    );
-  }
-  return url;
-}
-function validateEnvironmentSecurity(environment) {
-  const isSecure = window.location.protocol === "https:";
-  switch (environment) {
-    case "production":
-      if (!isSecure) {
-        console.warn("SafePassage Warning: HTTPS recommended for production environment");
-      }
-      break;
-    case "staging":
-      if (!isSecure) {
-        console.warn(
-          "SafePassage Warning: HTTPS strongly recommended in staging environment"
-        );
-      }
-      break;
-  }
-  try {
-    getEnvironmentUrl(environment);
-    getApiUrl(environment);
-  } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    throw new Error(`Environment configuration validation failed: ${errorMessage}`);
-  }
-}
-var ENVIRONMENT_URLS;
-var init_environment = __esm({
-  "src-redirect/utils/environment.ts"() {
-    "use strict";
-    ENVIRONMENT_URLS = {
-      production: "https://av.safepassageapp.com",
-      staging: "https://av.staging.safepassageapp.com"
-    };
-  }
-});
-
-// src-redirect/core/SafePassageSDK.ts
-var SafePassageSDK_exports = {};
-__export(SafePassageSDK_exports, {
-  SafePassage: () => SafePassage,
-  default: () => SafePassageSDK_default
-});
-var SafePassage, SafePassageSDK_default;
-var init_SafePassageSDK = __esm({
-  "src-redirect/core/SafePassageSDK.ts"() {
-    "use strict";
-    init_validation();
-    init_environment();
-    init_security();
-    SafePassage = class {
-      /**
-       * Initialize SafePassage SDK
-       *
-       * Validates configuration, sets up security measures, and prepares the SDK
-       * for verification operations. Performs comprehensive environment validation
-       * and security initialization.
-       *
-       * @param {SafePassageConfig} config - SDK configuration object
-       * @throws {Error} If configuration validation fails
-       */
-      constructor(config) {
-        this.popupWindow = null;
-        this.messageListener = null;
-        this.popupMonitorInterval = null;
-        this.unloadListener = null;
-        this.isVerificationInProgress = false;
-        this.currentSessionId = null;
-        this.hasReceivedResult = false;
-        // Server-provided verify URL (includes sessionToken)
-        this.lastVerifyUrl = null;
-        // Server-provided session token (WS auth)
-        this.lastSessionToken = null;
-        // Temporary storage for QR handoff token to include in state
-        this.temporaryHandoffToken = null;
-        validateConfig(config);
-        let normalizedEnvironment = config.environment || this.detectEnvironment();
-        if (normalizedEnvironment !== "staging" && normalizedEnvironment !== "production") {
-          console.warn(`SafePassage SDK: Unknown environment '${normalizedEnvironment}', defaulting to 'production'`);
-          normalizedEnvironment = "production";
-        }
-        this.config = __spreadProps(__spreadValues({}, config), {
-          environment: normalizedEnvironment,
-          mode: config.mode || "redirect"
-        });
-        validateEnvironmentSecurity(this.config.environment);
-        enforceHTTPS(this.config.environment);
-        logSecurityEvent("SDK_INITIALIZED", {
-          environment: this.config.environment,
-          mode: this.config.mode,
-          origin: window.location.origin,
-          protocol: window.location.protocol,
-          hostname: window.location.hostname
-        });
-        this.setupAutoCleanup();
-      }
-      /**
-       * Initiate age verification with race condition protection
-       *
-       * Main verification method that handles session creation, security validation,
-       * and verification flow initiation. Includes race condition protection and
-       * comprehensive error handling.
-       *
-       * For public keys (pk_*), automatically creates sessions via the portal API.
-       * For private keys (sk_*), requires a pre-created sessionId.
-       *
-       * @param {VerificationOptions} [options={}] - Verification options
-       * @param {string} [options.sessionId] - Session ID (required for private keys)
-       * @param {number} [options.challengeAge] - Age challenge override
-       * @param {string} [options.verificationMode] - Verification mode override
-       * @param {string} [options.externalUserId] - External user identifier
-       * @returns {Promise<void>} Promise that resolves when verification is initiated
-       * @throws {Error} If verification cannot be started or is already in progress
-       */
-      async verify(options = {}) {
-        var _a, _b, _c, _d, _e, _f;
-        const isPublicKey = this.isPublicKey();
-        let sessionId;
-        if (isPublicKey) {
-          sessionId = await this.createInternalSession(options);
-        } else {
-          throw new Error(
-            "Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only."
-          );
-        }
-        if (!sessionId) {
-          throw new Error("Failed to obtain sessionId from server");
-        }
-        if (this.isVerificationInProgress) {
-          const error = new Error(
-            `Verification already in progress for session ${(_a = this.currentSessionId) == null ? void 0 : _a.substring(0, 8)}...`
-          );
-          logSecurityEvent("RACE_CONDITION_PREVENTED", {
-            currentSession: ((_b = this.currentSessionId) == null ? void 0 : _b.substring(0, 8)) + "...",
-            attemptedSession: "new-session-attempt",
-            origin: window.location.origin
-          });
-          (_d = (_c = this.config).onError) == null ? void 0 : _d.call(_c, error);
-          throw error;
-        }
-        this.isVerificationInProgress = true;
-        this.currentSessionId = sessionId;
-        try {
-          const rateLimitKey = `${this.config.apiKey}:${window.location.origin}`;
-          if (!verificationRateLimit.isAllowed(rateLimitKey)) {
-            const error = new Error(
-              "Too many verification attempts. Please wait before trying again."
-            );
-            logSecurityEvent("RATE_LIMIT_EXCEEDED", {
-              apiKey: this.config.apiKey.substring(0, 8) + "...",
-              origin: window.location.origin,
-              sessionId: sessionId ? sessionId.substring(0, 8) + "..." : "undefined"
-            });
-            (_f = (_e = this.config).onError) == null ? void 0 : _f.call(_e, error);
-            throw error;
-          }
-          const verificationUrl = await this.buildVerificationUrl(
-            options,
-            sessionId
-          );
-          logSecurityEvent("VERIFICATION_INITIATED", {
-            environment: this.config.environment,
-            mode: this.config.mode,
-            sessionId: sessionId ? sessionId.substring(0, 8) + "..." : "undefined",
-            origin: window.location.origin
-          });
-          if (this.config.mode === "new-tab") {
-            this.openNewTab(verificationUrl, sessionId);
-          } else {
-            this.unlockVerification();
-            this.redirect(verificationUrl);
-          }
-        } catch (error) {
-          this.unlockVerification();
-          throw error;
-        }
-      }
-      /**
-       * Build verification URL with HMAC-signed state
-       *
-       * Constructs the verification URL with signed state parameter containing
-       * all necessary configuration and security information. The state parameter
-       * includes HMAC signature for integrity protection.
-       *
-       * @param {VerificationOptions} options - Verification options
-       * @returns {Promise<string>} Complete verification URL
-       * @private
-       */
-      async buildVerificationUrl(options, sessionId) {
-        const baseUrl = getEnvironmentUrl(this.config.environment);
-        const hasExplicitChallengeAge = options.challengeAge !== void 0;
-        const hasExplicitVerificationMode = options.verificationMode !== void 0;
-        const hasOverrides = hasExplicitChallengeAge || hasExplicitVerificationMode;
-        const state = await generateState(
-          {
-            merchantId: this.config.apiKey,
-            sessionId,
-            returnUrl: this.config.returnUrl,
-            cancelUrl: this.config.cancelUrl,
-            challengeAge: options.challengeAge || this.config.defaultChallengeAge,
-            verificationMode: options.verificationMode || this.config.defaultVerificationMode,
-            hasOverrides,
-            // Flag to indicate explicit overrides
-            externalUserId: options.externalUserId,
-            timestamp: Date.now(),
-            // Phase 2: Include config for self-contained verify-ui
-            apiUrl: this.getPortalApiUrl(),
-            engineUrl: this.getEngineUrl(),
-            wsUrl: this.getWebSocketUrl(),
-            environment: this.config.environment,
-            features: {
-              testMode: false,
-              warmupPeriodMs: 500,
-              qualityThreshold: 0.6
-            },
-            // Include handoffToken if available (for QR code desktop flow)
-            handoffToken: this.temporaryHandoffToken || void 0,
-            // Include sessionToken and verifyUrl to make UI auth deterministic
-            sessionToken: this.lastSessionToken || void 0,
-            verifyUrl: this.lastVerifyUrl || void 0
-          },
-          this.config.environment
-        );
-        if (this.lastVerifyUrl) {
-          try {
-            const url = new URL(this.lastVerifyUrl);
-            url.searchParams.set("state", state);
-            url.searchParams.set("mode", this.config.mode);
-            if (options.skipIntro) {
-              url.searchParams.set("skip_intro", "true");
-            }
-            if (options.autoReturn) {
-              url.searchParams.set("auto_return", "true");
-            }
-            return url.toString();
-          } catch (e) {
-          }
-        }
-        const params = new URLSearchParams({ state, sessionId, mode: this.config.mode });
-        if (options.skipIntro) {
-          params.set("skip_intro", "true");
-        }
-        if (options.autoReturn) {
-          params.set("auto_return", "true");
-        }
-        return `${baseUrl}/?${params.toString()}`;
-      }
-      /**
-       * Redirect in same tab
-       *
-       * Performs a full page redirect to the verification URL.
-       * Used for redirect mode verification.
-       *
-       * @param {string} url - Verification URL to redirect to
-       * @private
-       */
-      redirect(url) {
-        window.location.href = url;
-      }
-      /**
-       * Open in new tab with PostMessage communication and proper cleanup
-       *
-       * Opens verification URL in a new tab/window and sets up secure PostMessage
-       * communication for receiving verification results. Includes comprehensive
-       * security validation and automatic cleanup.
-       *
-       * @param {string} url - Verification URL to open
-       * @param {string} sessionId - Session ID for result correlation
-       * @private
-       */
-      openNewTab(url, sessionId) {
-        var _a, _b;
-        this.cleanup();
-        this.hasReceivedResult = false;
-        if (this.popupMonitorInterval) {
-          clearInterval(this.popupMonitorInterval);
-          this.popupMonitorInterval = null;
-        }
-        this.popupWindow = window.open(
-          url,
-          "safepassage-verify",
-          "width=600,height=700"
-        );
-        if (!this.popupWindow) {
-          (_b = (_a = this.config).onError) == null ? void 0 : _b.call(
-            _a,
-            new Error(
-              "Failed to open verification window. Please check popup blocker settings."
-            )
-          );
-          return;
-        }
-        this.messageListener = (event) => {
-          var _a2, _b2, _c, _d, _e, _f, _g;
-          const messageType = (_a2 = event.data) == null ? void 0 : _a2.type;
-          if (!messageType || typeof messageType !== "string" || !messageType.startsWith("safepassage:")) {
-            return;
-          }
-          if (!validatePostMessageOrigin(event, this.config.environment)) {
-            logSecurityEvent("POSTMESSAGE_ORIGIN_BLOCKED", {
-              origin: event.origin,
-              environment: this.config.environment,
-              expectedOrigins: `SafePassage trusted origins for ${this.config.environment}`,
-              messageType: (_b2 = event.data) == null ? void 0 : _b2.type
-            });
-            return;
-          }
-          const messageValidation = validateSafePassageMessage(event, sessionId);
-          if (!messageValidation.isValid) {
-            logSecurityEvent("POSTMESSAGE_VALIDATION_FAILED", {
-              error: messageValidation.error,
-              origin: event.origin,
-              sessionId: sessionId.substring(0, 8) + "...",
-              messageType: (_c = event.data) == null ? void 0 : _c.type
-            });
-            return;
-          }
-          const result = {
-            sessionId: event.data.sessionId,
-            status: event.data.status,
-            timestamp: event.data.timestamp,
-            externalUserId: event.data.externalUserId
-          };
-          this.hasReceivedResult = true;
-          logSecurityEvent("VERIFICATION_COMPLETED", {
-            status: result.status,
-            sessionId: sessionId.substring(0, 8) + "...",
-            origin: event.origin
-          });
-          this.cleanup({ closePopup: false });
-          this.unlockVerification();
-          if (this.popupMonitorInterval) {
-            clearInterval(this.popupMonitorInterval);
-            this.popupMonitorInterval = null;
-          }
-          if (result.status === "verified") {
-            (_e = (_d = this.config).onComplete) == null ? void 0 : _e.call(_d, result);
-          } else {
-            (_g = (_f = this.config).onError) == null ? void 0 : _g.call(
-              _f,
-              new Error(`Verification failed: ${result.status}`)
-            );
-          }
-        };
-        window.addEventListener("message", this.messageListener);
-        this.popupMonitorInterval = setInterval(() => {
-          var _a2, _b2;
-          if (this.popupWindow && this.popupWindow.closed) {
-            logSecurityEvent("POPUP_CLOSED_BY_USER", {
-              sessionId: sessionId.substring(0, 8) + "...",
-              environment: this.config.environment
-            });
-            this.cleanup();
-            this.unlockVerification();
-            if (!this.hasReceivedResult) {
-              (_b2 = (_a2 = this.config).onCancel) == null ? void 0 : _b2.call(_a2);
-            }
-          }
-        }, 500);
-      }
-      /**
-       * Set up automatic cleanup on page unload to prevent memory leaks
-       *
-       * Registers event listeners for page unload events to ensure proper
-       * cleanup of resources and verification state. Handles both traditional
-       * page navigation and single-page application route changes.
-       *
-       * @private
-       */
-      setupAutoCleanup() {
-        this.unloadListener = () => {
-          logSecurityEvent("SDK_AUTO_CLEANUP", {
-            environment: this.config.environment,
-            trigger: "page_unload"
-          });
-          this.cleanup();
-          this.unlockVerification();
-        };
-        window.addEventListener("beforeunload", this.unloadListener);
-        window.addEventListener("pagehide", this.unloadListener);
-        if (window.history && window.history.pushState) {
-          const originalPushState = window.history.pushState;
-          window.history.pushState = (...args) => {
-            this.cleanup();
-            this.unlockVerification();
-            return originalPushState.apply(window.history, args);
-          };
-        }
-      }
-      /**
-       * Auto-detect environment based on current URL
-       *
-       * Analyzes the current hostname to determine the appropriate environment
-       * configuration. Used when environment is not explicitly specified.
-       * Always defaults to production unless staging is detected.
-       *
-       * @returns {'production' | 'staging'} Detected environment
-       * @private
-       */
-      detectEnvironment() {
-        const hostname = window.location.hostname;
-        if (hostname.includes("staging") || hostname.includes("stage")) {
-          return "staging";
-        }
-        return "production";
-      }
-      /**
-       * Get the current environment
-       * @returns {string} The current environment (production or staging)
-       */
-      getEnvironment() {
-        return this.config.environment;
-      }
-      /**
-       * Unlock verification process to allow new verifications
-       *
-       * Resets the verification lock state to allow new verification attempts.
-       * Called after successful completion, errors, or cleanup.
-       *
-       * @private
-       */
-      unlockVerification() {
-        this.isVerificationInProgress = false;
-        this.currentSessionId = null;
-        logSecurityEvent("VERIFICATION_UNLOCKED", {
-          environment: this.config.environment,
-          origin: window.location.origin
-        });
-      }
-      /**
-       * Internal cleanup method to prevent memory leaks
-       *
-       * Cleans up popup windows, event listeners, and intervals.
-       * Does not unlock verification state - that's handled by specific callers.
-       *
-       * @private
-       */
-      cleanup(options = {}) {
-        const shouldClosePopup = options.closePopup !== false;
-        if (this.popupWindow) {
-          if (shouldClosePopup && !this.popupWindow.closed) {
-            this.popupWindow.close();
-          }
-          if (shouldClosePopup || this.popupWindow.closed) {
-            this.popupWindow = null;
-          }
-        }
-        if (this.messageListener) {
-          window.removeEventListener("message", this.messageListener);
-          this.messageListener = null;
-        }
-        if (this.popupMonitorInterval) {
-          clearInterval(this.popupMonitorInterval);
-          this.popupMonitorInterval = null;
-        }
-      }
-      /**
-       * Remove auto-cleanup listeners
-       *
-       * Removes page unload event listeners that were set up for automatic cleanup.
-       *
-       * @private
-       */
-      removeAutoCleanupListeners() {
-        if (this.unloadListener) {
-          window.removeEventListener("beforeunload", this.unloadListener);
-          window.removeEventListener("pagehide", this.unloadListener);
-          this.unloadListener = null;
-        }
-      }
-      /**
-       * Public cleanup method for manual resource management
-       *
-       * Completely destroys the SDK instance, cleaning up all resources and
-       * removing all event listeners. Should be called when the SDK is no longer needed.
-       *
-       * @public
-       */
-      destroy() {
-        logSecurityEvent("SDK_DESTROYED", {
-          environment: this.config.environment,
-          origin: window.location.origin
-        });
-        this.cleanup();
-        this.unlockVerification();
-        this.removeAutoCleanupListeners();
-      }
-      /**
-       * Get Portal API URL based on environment
-       *
-       * Returns the appropriate portal-api URL for the current environment.
-       *
-       * @returns {string} Portal API URL
-       * @private
-       */
-      getPortalApiUrl() {
-        switch (this.config.environment) {
-          case "staging":
-            return "https://api.staging.safepassageapp.com";
-          case "production":
-            return "https://api.safepassageapp.com";
-          default:
-            return "https://api.safepassageapp.com";
-        }
-      }
-      /**
-       * Get Engine URL based on environment
-       *
-       * Returns the appropriate verify-engine URL for the current environment.
-       * In production, engine access is proxied through portal-api.
-       *
-       * @returns {string} Engine URL
-       * @private
-       */
-      getEngineUrl() {
-        switch (this.config.environment) {
-          case "staging":
-            return "https://engine.staging.safepassageapp.com";
-          case "production":
-            return "https://engine.safepassageapp.com";
-          default:
-            return "https://engine.safepassageapp.com";
-        }
-      }
-      /**
-       * Get WebSocket URL based on environment
-       *
-       * Returns the appropriate WebSocket URL for the current environment.
-       * In production, WebSocket connections are proxied through portal-api.
-       *
-       * @returns {string} WebSocket URL
-       * @private
-       */
-      getWebSocketUrl() {
-        switch (this.config.environment) {
-          case "staging":
-            return "wss://engine.staging.safepassageapp.com/api/websocket/stream";
-          case "production":
-            return "wss://engine.safepassageapp.com/api/websocket/stream";
-          default:
-            return "wss://engine.safepassageapp.com/api/websocket/stream";
-        }
-      }
-      /**
-       * Detect if this is a public key (pk_ prefix) vs private key (sk_ prefix)
-       *
-       * Determines API key type based on prefix to handle different authentication flows.
-       *
-       * @returns {boolean} True if public key, false if private key
-       * @private
-       */
-      isPublicKey() {
-        return this.config.apiKey.startsWith("pk_");
-      }
-      /**
-       * Create session internally for public keys
-       *
-       * Creates a verification session via the portal API for public key authentication.
-       * Generates a UUID session ID and submits session creation request with
-       * verification parameters.
-       *
-       * @param {VerificationOptions} options - Verification options
-       * @returns {Promise<string>} Created session ID
-       * @throws {Error} If session creation fails
-       * @private
-       */
-      async createInternalSession(options) {
-        var _a, _b;
-        try {
-          const portalApiUrl = this.getPortalApiUrl();
-          const response = await fetch(`${portalApiUrl}/api/v1/sessions/create`, {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              Authorization: `Bearer ${this.config.apiKey}`
-            },
-            body: JSON.stringify({
-              merchantId: this.config.apiKey,
-              // API expects merchantId even though it uses auth header
-              returnUrl: this.config.returnUrl,
-              cancelUrl: this.config.cancelUrl,
-              challengeAge: options.challengeAge,
-              verificationMode: options.verificationMode,
-              merchantName: document.title || window.location.hostname,
-              externalUserId: options.externalUserId
-            })
-          });
-          if (!response.ok) {
-            const errorData = await response.json().catch(() => ({}));
-            throw new Error(
-              `Failed to create session: ${response.status} ${response.statusText}. ${errorData.message || ""}`
-            );
-          }
-          const sessionData = await response.json();
-          const sessionId = sessionData.sessionId;
-          if (!sessionId) {
-            throw new Error("Server did not return a sessionId");
-          }
-          if (sessionData.verifyUrl) {
-            this.lastVerifyUrl = sessionData.verifyUrl;
-          }
-          if (sessionData.sessionToken) {
-            this.lastSessionToken = sessionData.sessionToken;
-          }
-          if (sessionData.handoffToken) {
-            this.temporaryHandoffToken = sessionData.handoffToken;
-          }
-          logSecurityEvent("INTERNAL_SESSION_CREATED", {
-            sessionId: sessionId.substring(0, 8) + "...",
-            environment: this.config.environment,
-            apiKeyType: "public"
-          });
-          return sessionId;
-        } catch (error) {
-          const errorMessage = error instanceof Error ? error.message : String(error);
-          logSecurityEvent("INTERNAL_SESSION_FAILED", {
-            error: errorMessage,
-            environment: this.config.environment,
-            apiKeyType: "public"
-          });
-          (_b = (_a = this.config).onError) == null ? void 0 : _b.call(_a, error);
-          throw new Error(`Failed to create verification session: ${errorMessage}`);
-        }
-      }
-    };
-    SafePassageSDK_default = SafePassage;
-  }
-});
-
-// src-redirect/utils/polyfills.ts
-function setupPolyfills() {
-  if (!crypto.randomUUID) {
-    crypto.randomUUID = function() {
-      const array = new Uint8Array(16);
-      crypto.getRandomValues(array);
-      array[6] = array[6] & 15 | 64;
-      array[8] = array[8] & 63 | 128;
-      const hex = Array.from(array).map((b) => b.toString(16).padStart(2, "0")).join("");
-      return [
-        hex.slice(0, 8),
-        hex.slice(8, 12),
-        hex.slice(12, 16),
-        hex.slice(16, 20),
-        hex.slice(20, 32)
-      ].join("-");
-    };
-  }
-}
-function checkBrowserCompatibility() {
-  const warnings = [];
-  if (!window.crypto || !window.crypto.getRandomValues) {
-    throw new Error("SafePassage SDK requires Web Crypto API support");
-  }
-  if (!window.crypto.subtle) {
-    throw new Error(
-      "SafePassage SDK requires Web Crypto subtle API for HMAC operations"
-    );
-  }
-  if (!crypto.randomUUID) {
-    warnings.push("crypto.randomUUID not supported, using polyfill");
-  }
-  if (!window.URLSearchParams) {
-    warnings.push(
-      "URLSearchParams not supported, consider adding a polyfill for IE 11 support"
-    );
-  }
-  if (warnings.length > 0) {
-    console.warn("SafePassage SDK Browser Compatibility:", warnings.join("; "));
-  }
-}
-
-// src-redirect/index.ts
-init_SafePassageSDK();
-if (typeof window !== "undefined") {
-  setupPolyfills();
-  checkBrowserCompatibility();
-}
-var VERSION = "3.4.9";
-if (typeof window !== "undefined" && window) {
-  const { SafePassage: SafePassage2 } = (init_SafePassageSDK(), __toCommonJS(SafePassageSDK_exports));
-  const globalWindow = window;
-  globalWindow.SafePassage = SafePassage2;
-  if (globalWindow.SafePassage) {
-    globalWindow.SafePassage.VERSION = VERSION;
-  }
-}
-export {
-  SafePassage,
-  VERSION,
-  SafePassage as default
-};