@safepassage/sdk 3.5.5 → 3.5.6

package/index.js

@@ -1,7 +1,6 @@
 var __defProp = Object.defineProperty;
 var __defProps = Object.defineProperties;
 var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
-var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __propIsEnum = Object.prototype.propertyIsEnumerable;
@@ -18,30 +17,43 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __objRest = (source, exclude) => {
-  var target = {};
-  for (var prop in source)
-    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
-      target[prop] = source[prop];
-  if (source != null && __getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(source)) {
-      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
-        target[prop] = source[prop];
-    }
-  return target;
-};
-var __esm = (fn, res, err) => function __init() {
-  if (err) throw err[0];
-  try {
-    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-  } catch (e) {
-    throw err = [e], e;
+
+// src-redirect/utils/polyfills.ts
+function setupPolyfills() {
+  if (!crypto.randomUUID) {
+    crypto.randomUUID = function() {
+      const array = new Uint8Array(16);
+      crypto.getRandomValues(array);
+      array[6] = array[6] & 15 | 64;
+      array[8] = array[8] & 63 | 128;
+      const hex = Array.from(array).map((b) => b.toString(16).padStart(2, "0")).join("");
+      return [
+        hex.slice(0, 8),
+        hex.slice(8, 12),
+        hex.slice(12, 16),
+        hex.slice(16, 20),
+        hex.slice(20, 32)
+      ].join("-");
+    };
   }
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
+}
+function checkBrowserCompatibility(logLabel = "SDK") {
+  const warnings = [];
+  if (!window.crypto || !window.crypto.getRandomValues) {
+    throw new Error(`${logLabel} requires Web Crypto API support`);
+  }
+  if (!crypto.randomUUID) {
+    warnings.push("crypto.randomUUID not supported, using polyfill");
+  }
+  if (!window.URLSearchParams) {
+    warnings.push(
+      "URLSearchParams not supported, consider adding a polyfill for IE 11 support"
+    );
+  }
+  if (warnings.length > 0) {
+    console.warn(`${logLabel} Browser Compatibility:`, warnings.join("; "));
+  }
+}
 
 // src-redirect/utils/security.ts
 function isOriginTrusted(origin, trustedOrigins) {
@@ -135,6 +147,34 @@ function validateReturnUrl(url, environment, _logLabel = "SDK") {
     return { isValid: false, error: "Invalid URL format" };
   }
 }
+var VerificationRateLimit = class {
+  constructor() {
+    this.attempts = /* @__PURE__ */ new Map();
+    this.maxAttempts = 5;
+    this.timeWindow = 6e4;
+  }
+  // 1 minute
+  isAllowed(identifier, logLabel = "SDK") {
+    const now = Date.now();
+    const attempts = this.attempts.get(identifier) || [];
+    const recentAttempts = attempts.filter(
+      (time) => now - time < this.timeWindow
+    );
+    if (recentAttempts.length >= this.maxAttempts) {
+      console.warn(
+        `${logLabel} Security: Rate limit exceeded for ${identifier}`
+      );
+      return false;
+    }
+    recentAttempts.push(now);
+    this.attempts.set(identifier, recentAttempts);
+    return true;
+  }
+  reset(identifier) {
+    this.attempts.delete(identifier);
+  }
+};
+var verificationRateLimit = new VerificationRateLimit();
 function logSecurityEvent(event, metadata, logLabel = "SDK") {
   const context = {
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -143,139 +183,13 @@ function logSecurityEvent(event, metadata, logLabel = "SDK") {
   };
   console.warn(`${logLabel} Security Event: ${event}`, __spreadValues(__spreadValues({}, context), metadata));
 }
-var VerificationRateLimit, verificationRateLimit;
-var init_security = __esm({
-  "src-redirect/utils/security.ts"() {
-    "use strict";
-    VerificationRateLimit = class {
-      constructor() {
-        this.attempts = /* @__PURE__ */ new Map();
-        this.maxAttempts = 5;
-        this.timeWindow = 6e4;
-      }
-      // 1 minute
-      isAllowed(identifier, logLabel = "SDK") {
-        const now = Date.now();
-        const attempts = this.attempts.get(identifier) || [];
-        const recentAttempts = attempts.filter(
-          (time) => now - time < this.timeWindow
-        );
-        if (recentAttempts.length >= this.maxAttempts) {
-          console.warn(
-            `${logLabel} Security: Rate limit exceeded for ${identifier}`
-          );
-          return false;
-        }
-        recentAttempts.push(now);
-        this.attempts.set(identifier, recentAttempts);
-        return true;
-      }
-      reset(identifier) {
-        this.attempts.delete(identifier);
-      }
-    };
-    verificationRateLimit = new VerificationRateLimit();
-  }
-});
-
-// src-redirect/utils/crypto.ts
-var crypto_exports = {};
-__export(crypto_exports, {
-  createSignedState: () => createSignedState,
-  generateHMAC: () => generateHMAC,
-  generateSecureToken: () => generateSecureToken,
-  parseSignedState: () => parseSignedState,
-  verifyHMAC: () => verifyHMAC
-});
-async function generateHMAC(data, secret) {
-  const encoder = new TextEncoder();
-  const keyData = encoder.encode(secret);
-  const dataBuffer = encoder.encode(data);
-  const key = await crypto.subtle.importKey(
-    "raw",
-    keyData,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", key, dataBuffer);
-  return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function verifyHMAC(data, signature, secret) {
-  try {
-    const expectedSignature = await generateHMAC(data, secret);
-    return constantTimeCompare(signature, expectedSignature);
-  } catch (e) {
-    return false;
-  }
-}
-function constantTimeCompare(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  let result = 0;
-  for (let i = 0; i < a.length; i++) {
-    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return result === 0;
-}
-function generateSecureToken(length = 32) {
-  const array = new Uint8Array(length);
-  crypto.getRandomValues(array);
-  return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function createSignedState(payload, hmacSecret) {
-  const timestampedPayload = __spreadProps(__spreadValues({}, payload), {
-    timestamp: Date.now(),
-    nonce: generateSecureToken(16)
-  });
-  const dataString = JSON.stringify(timestampedPayload);
-  const signature = await generateHMAC(dataString, hmacSecret);
-  const signedPayload = {
-    data: timestampedPayload,
-    signature
-  };
-  return btoa(JSON.stringify(signedPayload));
-}
-async function parseSignedState(signedState, hmacSecret, maxAge = STATE_EXPIRY_MS, logLabel = "SDK") {
-  try {
-    const json = atob(signedState);
-    const signedPayload = JSON.parse(json);
-    if (!signedPayload.data || !signedPayload.signature) {
-      console.warn(`${logLabel}: Invalid signed state format`);
-      return null;
-    }
-    const { data, signature } = signedPayload;
-    const dataString = JSON.stringify(data);
-    const isValid = await verifyHMAC(dataString, signature, hmacSecret);
-    if (!isValid) {
-      console.warn(`${logLabel}: State signature verification failed`);
-      return null;
-    }
-    if (data.timestamp) {
-      const age = Date.now() - data.timestamp;
-      if (age > maxAge) {
-        console.warn(`${logLabel}: State parameter expired`, { age, maxAge });
-        return null;
-      }
-    }
-    const _a = data, { timestamp, nonce } = _a, payload = __objRest(_a, ["timestamp", "nonce"]);
-    void timestamp;
-    void nonce;
-    return payload;
-  } catch (error) {
-    console.warn(`${logLabel}: Failed to parse signed state`, error);
-    return null;
-  }
-}
-var init_crypto = __esm({
-  "src-redirect/utils/crypto.ts"() {
-    "use strict";
-    init_validation();
-  }
-});
 
 // src-redirect/utils/validation.ts
+var MINIMUM_AGE = 25;
+var MAXIMUM_AGE = 150;
+var MAX_URL_LENGTH = 2048;
+var MAX_API_KEY_LENGTH = 128;
+var API_KEY_PATTERN = /^(pk_|sk_)[a-zA-Z0-9_]+$/;
 function validateConfig(config, context) {
   var _a;
   if (!config.apiKey) {
@@ -345,68 +259,6 @@ function validateConfig(config, context) {
     throw new Error("newTabTarget must be popup or tab");
   }
 }
-async function generateState(payload, environment, hmacSecret, _logLabel = "SDK") {
-  const { createSignedState: createSignedState2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
-  return createSignedState2(payload, hmacSecret);
-}
-var MINIMUM_AGE, MAXIMUM_AGE, MAX_URL_LENGTH, MAX_API_KEY_LENGTH, STATE_EXPIRY_MS, API_KEY_PATTERN;
-var init_validation = __esm({
-  "src-redirect/utils/validation.ts"() {
-    "use strict";
-    init_security();
-    MINIMUM_AGE = 25;
-    MAXIMUM_AGE = 150;
-    MAX_URL_LENGTH = 2048;
-    MAX_API_KEY_LENGTH = 128;
-    STATE_EXPIRY_MS = 6e5;
-    API_KEY_PATTERN = /^(pk_|sk_)[a-zA-Z0-9_]+$/;
-  }
-});
-
-// src-redirect/utils/polyfills.ts
-function setupPolyfills() {
-  if (!crypto.randomUUID) {
-    crypto.randomUUID = function() {
-      const array = new Uint8Array(16);
-      crypto.getRandomValues(array);
-      array[6] = array[6] & 15 | 64;
-      array[8] = array[8] & 63 | 128;
-      const hex = Array.from(array).map((b) => b.toString(16).padStart(2, "0")).join("");
-      return [
-        hex.slice(0, 8),
-        hex.slice(8, 12),
-        hex.slice(12, 16),
-        hex.slice(16, 20),
-        hex.slice(20, 32)
-      ].join("-");
-    };
-  }
-}
-function checkBrowserCompatibility(logLabel = "SDK") {
-  const warnings = [];
-  if (!window.crypto || !window.crypto.getRandomValues) {
-    throw new Error(`${logLabel} requires Web Crypto API support`);
-  }
-  if (!window.crypto.subtle) {
-    throw new Error(
-      `${logLabel} requires Web Crypto subtle API for HMAC operations`
-    );
-  }
-  if (!crypto.randomUUID) {
-    warnings.push("crypto.randomUUID not supported, using polyfill");
-  }
-  if (!window.URLSearchParams) {
-    warnings.push(
-      "URLSearchParams not supported, consider adding a polyfill for IE 11 support"
-    );
-  }
-  if (warnings.length > 0) {
-    console.warn(`${logLabel} Browser Compatibility:`, warnings.join("; "));
-  }
-}
-
-// src-redirect/core/VerificationSDK.ts
-init_validation();
 
 // src-redirect/utils/environment.ts
 function getEnvironmentUrl(environment, urls) {
@@ -525,7 +377,6 @@ function validateEnvironmentSecurity(environment, urls, logLabel = "SDK") {
 }
 
 // src-redirect/core/VerificationSDK.ts
-init_security();
 var _VerificationSDK = class _VerificationSDK {
   /**
    * Initialize SDK
@@ -542,16 +393,10 @@ var _VerificationSDK = class _VerificationSDK {
     this.isVerificationInProgress = false;
     this.currentSessionId = null;
     this.hasReceivedResult = false;
-    // Server-provided verify URL (includes sessionToken)
+    // Server-provided verify URL (includes authoritative session context)
     this.lastVerifyUrl = null;
-    // Server-provided session token (WS auth)
-    this.lastSessionToken = null;
     // External user ID provided during verify() for cancellation redirects
     this.lastExternalUserId = null;
-    // Sandbox mode flag from session creation (for UI labeling)
-    this.lastSandboxMode = null;
-    // Temporary storage for QR handoff token to include in state
-    this.temporaryHandoffToken = null;
     this.brandUrls = brandUrls;
     this.brandConstants = brandConstants;
     const environment = resolveEnvironment(config.environment, this.brandUrls);
@@ -570,6 +415,7 @@ var _VerificationSDK = class _VerificationSDK {
       mode: config.mode || "redirect",
       newTabTarget: config.newTabTarget || "popup"
     });
+    this.validateServiceOverrides();
     validateEnvironmentSecurity(this.config.environment, this.getUrlConfig(), this.brandConstants.name);
     enforceHTTPS(this.config.environment, this.brandConstants.name);
     logSecurityEvent("SDK_INITIALIZED", {
@@ -648,82 +494,32 @@ var _VerificationSDK = class _VerificationSDK {
       throw error;
     }
   }
-  /**
-   * Build verification URL with HMAC-signed state
-   */
+  /** Build a launch URL from the Portal-issued authoritative verify URL. */
   async buildVerificationUrl(options, sessionId) {
-    var _a, _b;
-    const baseUrl = this.config.verifyUrl || getEnvironmentUrl(this.config.environment, this.getUrlConfig());
-    const hasExplicitChallengeAge = options.challengeAge !== void 0;
-    const hasExplicitVerificationMode = options.verificationMode !== void 0;
-    const hasExplicitFaceMatchEnabled = options.faceMatchEnabled !== void 0 || this.config.faceMatchEnabled !== void 0;
-    const hasOverrides = hasExplicitChallengeAge || hasExplicitVerificationMode || hasExplicitFaceMatchEnabled;
-    const faceMatchEnabled = (_a = options.faceMatchEnabled) != null ? _a : this.config.faceMatchEnabled;
-    const state = await generateState(
-      {
-        merchantId: this.config.apiKey,
-        sessionId,
-        returnUrl: this.config.returnUrl,
-        cancelUrl: this.config.cancelUrl,
-        challengeAge: options.challengeAge || this.config.defaultChallengeAge,
-        verificationMode: options.verificationMode || this.config.defaultVerificationMode,
-        faceMatchEnabled,
-        hasOverrides,
-        // Flag to indicate explicit overrides
-        externalUserId: options.externalUserId,
-        timestamp: Date.now(),
-        // Additional config for self-contained verify-ui
-        apiUrl: this.getPortalApiUrl(),
-        engineUrl: this.getEngineUrl(),
-        wsUrl: this.getWebSocketUrl(),
-        environment: this.config.environment,
-        features: {
-          testMode: false,
-          warmupPeriodMs: 500,
-          qualityThreshold: 0.6,
-          sandboxMode: (_b = this.lastSandboxMode) != null ? _b : false
-        },
-        // Include handoffToken if available (for QR code desktop flow)
-        handoffToken: this.temporaryHandoffToken || void 0,
-        // Include sessionToken and verifyUrl to make UI auth deterministic
-        sessionToken: this.lastSessionToken || void 0,
-        verifyUrl: this.lastVerifyUrl || void 0
-      },
-      this.config.environment,
-      this.getHmacSecret(),
-      this.brandConstants.name
-    );
+    if (!this.lastVerifyUrl) {
+      throw new Error("Server did not return an authoritative verification URL");
+    }
     const language = options.language || this.config.language;
-    if (this.lastVerifyUrl) {
-      try {
-        const resolvedVerifyUrl = this.applyLocalVerifyOverride(this.lastVerifyUrl);
-        const url = new URL(resolvedVerifyUrl);
-        url.searchParams.set("state", state);
-        url.searchParams.set("mode", this.config.mode);
-        if (options.skipIntro) {
-          url.searchParams.set("skip_intro", "true");
-        }
-        if (options.autoReturn) {
-          url.searchParams.set("auto_return", "true");
-        }
-        if (language) {
-          url.searchParams.set("lang", language);
-        }
-        return url.toString();
-      } catch (e) {
-      }
+    const serverUrl = new URL(this.lastVerifyUrl);
+    const trustedVerifyOrigin = new URL(this.getUrlConfig().verifyUiUrl).origin;
+    if (serverUrl.origin !== trustedVerifyOrigin) {
+      throw new Error("Server returned an untrusted verification origin");
     }
-    const params = new URLSearchParams({ state, sessionId, mode: this.config.mode });
+    if (serverUrl.searchParams.get("sessionId") !== sessionId || !serverUrl.searchParams.get("sessionToken")) {
+      throw new Error("Server verification URL is missing authoritative session context");
+    }
+    const url = new URL(this.applyLocalVerifyOverride(serverUrl.toString()));
+    url.searchParams.set("mode", this.config.mode);
     if (options.skipIntro) {
-      params.set("skip_intro", "true");
+      url.searchParams.set("skip_intro", "true");
     }
     if (options.autoReturn) {
-      params.set("auto_return", "true");
+      url.searchParams.set("auto_return", "true");
     }
     if (language) {
-      params.set("lang", language);
+      url.searchParams.set("lang", language);
     }
-    return `${baseUrl}/?${params.toString()}`;
+    return url.toString();
   }
   /**
    * Redirect in same tab
@@ -981,22 +777,33 @@ var _VerificationSDK = class _VerificationSDK {
    * Get Portal API URL based on environment and brand
    */
   getPortalApiUrl() {
-    if (this.config.apiUrl) {
+    const trustedApiUrl = this.getUrlConfig().apiUrl;
+    if (!this.config.apiUrl) {
+      return trustedApiUrl;
+    }
+    const configuredOrigin = this.getUrlOrigin(this.config.apiUrl);
+    const trustedOrigin = this.getUrlOrigin(trustedApiUrl);
+    if (configuredOrigin === trustedOrigin || this.getLocalOrigin(this.config.apiUrl)) {
       return this.config.apiUrl;
     }
-    return this.getUrlConfig().apiUrl;
+    throw new Error("apiUrl must use the selected brand/environment service");
   }
-  /**
-   * Get Engine URL based on environment and brand
-   */
-  getEngineUrl() {
-    return this.getUrlConfig().engineUrl;
-  }
-  /**
-   * Get WebSocket URL based on environment and brand
-   */
-  getWebSocketUrl() {
-    return this.getUrlConfig().wsUrl;
+  validateServiceOverrides() {
+    const trusted = this.getUrlConfig();
+    if (this.config.apiUrl) {
+      const configuredOrigin = this.getUrlOrigin(this.config.apiUrl);
+      const trustedOrigin = this.getUrlOrigin(trusted.apiUrl);
+      if (configuredOrigin !== trustedOrigin && !this.getLocalOrigin(this.config.apiUrl)) {
+        throw new Error("apiUrl must use the selected brand/environment service");
+      }
+    }
+    if (this.config.verifyUrl) {
+      const configuredOrigin = this.getUrlOrigin(this.config.verifyUrl);
+      const trustedOrigin = this.getUrlOrigin(trusted.verifyUiUrl);
+      if (configuredOrigin !== trustedOrigin && !this.getLocalOrigin(this.config.verifyUrl)) {
+        throw new Error("verifyUrl must use the selected brand/environment service");
+      }
+    }
   }
   /**
    * Detect if this is a public key (pk_ prefix) vs private key (sk_ prefix)
@@ -1008,7 +815,7 @@ var _VerificationSDK = class _VerificationSDK {
    * Create session internally for public keys
    */
   async createInternalSession(options) {
-    var _a, _b, _c;
+    var _a, _b;
     try {
       const portalApiUrl = this.getPortalApiUrl();
       const response = await fetch(`${portalApiUrl}/api/v1/sessions/create`, {
@@ -1021,9 +828,6 @@ var _VerificationSDK = class _VerificationSDK {
           merchantId: this.config.apiKey,
           returnUrl: this.config.returnUrl,
           cancelUrl: this.config.cancelUrl,
-          challengeAge: options.challengeAge,
-          verificationMode: options.verificationMode,
-          faceMatchEnabled: (_a = options.faceMatchEnabled) != null ? _a : this.config.faceMatchEnabled,
           merchantName: document.title || window.location.hostname,
           externalUserId: options.externalUserId
         })
@@ -1033,7 +837,7 @@ var _VerificationSDK = class _VerificationSDK {
         const errorCode = errorData == null ? void 0 : errorData.code;
         if (this.isBillingBlockError(errorCode)) {
           const language = options.language || this.config.language;
-          this.openBillingBlockPage(errorCode, errorData == null ? void 0 : errorData.portalUrl, language);
+          this.openBillingBlockPage(errorCode, language);
         }
         throw new Error(
           `Failed to create session: ${response.status} ${response.statusText}. ${errorData.message || ""}`
@@ -1047,17 +851,6 @@ var _VerificationSDK = class _VerificationSDK {
       if (sessionData.verifyUrl) {
         this.lastVerifyUrl = sessionData.verifyUrl;
       }
-      if (sessionData.sessionToken) {
-        this.lastSessionToken = sessionData.sessionToken;
-      }
-      if (sessionData.handoffToken) {
-        this.temporaryHandoffToken = sessionData.handoffToken;
-      }
-      if (typeof sessionData.sandboxMode === "boolean") {
-        this.lastSandboxMode = sessionData.sandboxMode;
-      } else {
-        this.lastSandboxMode = null;
-      }
       logSecurityEvent("INTERNAL_SESSION_CREATED", {
         sessionId: sessionId.substring(0, 8) + "...",
         environment: this.config.environment,
@@ -1071,23 +864,20 @@ var _VerificationSDK = class _VerificationSDK {
         environment: this.config.environment,
         apiKeyType: "public"
       }, this.brandConstants.name);
-      (_c = (_b = this.config).onError) == null ? void 0 : _c.call(_b, error);
+      (_b = (_a = this.config).onError) == null ? void 0 : _b.call(_a, error);
       throw new Error(`Failed to create verification session: ${errorMessage}`);
     }
   }
   isBillingBlockError(code) {
     return code === "SUBSCRIPTION_REQUIRED" || code === "PLAN_LIMIT_REACHED" || code === "SANDBOX_LIMIT_REACHED";
   }
-  openBillingBlockPage(code, portalUrl, language) {
+  openBillingBlockPage(code, language) {
     var _a, _b, _c, _d;
     try {
-      const baseUrl = this.config.verifyUrl || getEnvironmentUrl(this.config.environment, this.getUrlConfig());
+      const baseUrl = getEnvironmentUrl(this.config.environment, this.getUrlConfig());
       const resolvedUrl = this.applyLocalVerifyOverride(baseUrl);
       const url = new URL(resolvedUrl);
       url.searchParams.set("blocked", code);
-      if (portalUrl) {
-        url.searchParams.set("portalUrl", portalUrl);
-      }
       const effectiveLanguage = language || this.config.language;
       if (effectiveLanguage) {
         url.searchParams.set("lang", effectiveLanguage);
@@ -1150,6 +940,13 @@ var _VerificationSDK = class _VerificationSDK {
     }
     return null;
   }
+  getUrlOrigin(urlValue) {
+    try {
+      return new URL(urlValue).origin;
+    } catch (e) {
+      return null;
+    }
+  }
   applyLocalVerifyOverride(rawUrl) {
     const overrideOrigin = this.getLocalOrigin(this.config.verifyUrl || null);
     if (!overrideOrigin) {
@@ -1165,9 +962,6 @@ var _VerificationSDK = class _VerificationSDK {
       return rawUrl;
     }
   }
-  getHmacSecret() {
-    return this.config.environment === "staging" ? this.brandConstants.hmacSecretStaging : this.brandConstants.hmacSecretProd;
-  }
 };
 // Local override hostnames allowed for internal testing
 _VerificationSDK.LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
@@ -1180,28 +974,18 @@ var BRAND_URLS = {
     verifyUiUrl: "https://av.safepassageapp.com",
     engineUrl: "https://engine.safepassageapp.com",
     wsUrl: "wss://engine.safepassageapp.com/api/websocket/stream",
-    trustedOrigins: [
-      "https://av.safepassageapp.com",
-      "https://portal.safepassageapp.com",
-      "https://api.safepassageapp.com"
-    ]
+    trustedOrigins: ["https://av.safepassageapp.com"]
   },
   staging: {
     apiUrl: "https://api.staging.safepassageapp.com",
     verifyUiUrl: "https://verify.staging.safepassageapp.com",
     engineUrl: "https://engine.staging.safepassageapp.com",
     wsUrl: "wss://engine.staging.safepassageapp.com/api/websocket/stream",
-    trustedOrigins: [
-      "https://verify.staging.safepassageapp.com",
-      "https://portal.staging.safepassageapp.com",
-      "https://api.staging.safepassageapp.com"
-    ]
+    trustedOrigins: ["https://verify.staging.safepassageapp.com"]
   }
 };
 var BRAND_CONSTANTS = {
   name: "SafePassage",
-  hmacSecretProd: "safepassage-prod-hmac-2025",
-  hmacSecretStaging: "safepassage-stage-hmac-2025",
   messageType: "safepassage:verification:complete",
   legacyMessageType: "safepassage-verification",
   popupName: "safepassage-verify",
@@ -1214,7 +998,7 @@ var SafePassage = class extends VerificationSDK {
     super(config, BRAND_URLS, BRAND_CONSTANTS);
   }
 };
-var VERSION = "3.5.5";
+var VERSION = "3.5.6";
 SafePassage.VERSION = VERSION;
 if (typeof window !== "undefined") {
   setupPolyfills();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safepassage/sdk",
-  "version": "3.5.5",
+  "version": "3.5.6",
   "description": "SafePassage SDK - Lightweight redirect-based age verification",
   "main": "index.js",
   "types": "index.d.ts",