@sekyro/web 0.1.0-rc.5 → 0.1.0-rc.7

package/dist/popup/index.cjs

@@ -1,76 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/popup/index.ts
-var popup_exports = {};
-__export(popup_exports, {
-  SEKYRO_EVENTS: () => SEKYRO_EVENTS,
-  open: () => open,
-  openHosted: () => openHosted
-});
-module.exports = __toCommonJS(popup_exports);
-var SEKYRO_EVENTS = [
-  "session.completed",
-  "session.failed",
-  "session.review_pending",
-  "session.expired",
-  "session.cancelled"
-];
-var WINDOW_NAME = "sekyro-verify";
-var WINDOW_FEATURES = "width=480,height=720,noopener=false";
-var EVENT_NAMES = new Set(SEKYRO_EVENTS);
-function isSekyroEvent(data) {
-  if (data === null || typeof data !== "object") return false;
-  const d = data;
-  return d.source === "sekyro" && d.version === 1 && typeof d.sessionId === "string" && typeof d.event === "string" && EVENT_NAMES.has(d.event);
-}
-function open(opts) {
-  const origin = new URL(opts.hostedUrl).origin;
-  const popup = window.open(opts.hostedUrl, WINDOW_NAME, WINDOW_FEATURES);
-  if (!popup) return { error: "popup_blocked" };
-  const listener = (ev) => {
-    if (ev.source !== popup) return;
-    if (ev.origin !== origin) return;
-    if (!isSekyroEvent(ev.data)) return;
-    const { source, version, event, sessionId } = ev.data;
-    opts.onEvent({ source, version, event, sessionId });
-  };
-  window.addEventListener("message", listener);
-  return {
-    close() {
-      window.removeEventListener("message", listener);
-      popup.close();
-    }
-  };
-}
-function openHosted(hostedUrl, opts) {
-  if (opts.mode === "redirect") {
-    window.location.assign(hostedUrl);
-    return { close() {
-    } };
-  }
-  return open({ hostedUrl, onEvent: opts.onEvent ?? (() => void 0) });
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  SEKYRO_EVENTS,
-  open,
-  openHosted
-});
-//# sourceMappingURL=index.cjs.map
+"use strict";var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var f=(n,e)=>{for(var t in e)s(n,t,{get:e[t],enumerable:!0})},y=(n,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of E(e))!l.call(n,o)&&o!==t&&s(n,o,{get:()=>e[o],enumerable:!(r=a(e,o))||r.enumerable});return n};var k=n=>y(s({},"__esModule",{value:!0}),n);var m={};f(m,{SEKYRO_EVENTS:()=>i,open:()=>p,openHosted:()=>x});module.exports=k(m);var i=["session.completed","session.failed","session.review_pending","session.expired","session.cancelled"],S="sekyro-verify",g="width=480,height=720,noopener=false",w=new Set(i);function O(n){if(n===null||typeof n!="object")return!1;let e=n;return e.source==="sekyro"&&e.version===1&&typeof e.sessionId=="string"&&typeof e.event=="string"&&w.has(e.event)}function p(n){let e=new URL(n.hostedUrl).origin,t=window.open(n.hostedUrl,S,g);if(!t)return{error:"popup_blocked"};let r=o=>{if(o.source!==t||o.origin!==e||!O(o.data))return;let{source:d,version:c,event:v,sessionId:u}=o.data;n.onEvent({source:d,version:c,event:v,sessionId:u})};return window.addEventListener("message",r),{close(){window.removeEventListener("message",r),t.close()}}}function x(n,e){return e.mode==="redirect"?(window.location.assign(n),{close(){}}):p({hostedUrl:n,onEvent:e.onEvent??(()=>{})})}0&&(module.exports={SEKYRO_EVENTS,open,openHosted});

package/dist/popup/index.js

@@ -1,11 +1 @@
-import {
-  SEKYRO_EVENTS,
-  open,
-  openHosted
-} from "../chunk-NILNKLK6.js";
-export {
-  SEKYRO_EVENTS,
-  open,
-  openHosted
-};
-//# sourceMappingURL=index.js.map
+import{a,b,c}from"../chunk-SXZCL5NO.js";export{a as SEKYRO_EVENTS,b as open,c as openHosted};

package/dist/scanic-ml-stub-KW7IZHUT.js

@@ -0,0 +1 @@
+function e(){throw new Error("scanic ML detector is not vendored (classical pipeline only)")}var t={};export{t as default,e as initMlDetector};

package/package.json

@@ -1,17 +1,13 @@
 {
   "name": "@sekyro/web",
-  "version": "0.1.0-rc.5",
-    "description": "Sekyro web SDK — browser liveness capture, hosted-verification client and popup embed for Sekyro identity verification",
+  "version": "0.1.0-rc.7",
+  "description": "Sekyro AI web SDK — browser liveness capture, hosted-verification client and popup embed for Sekyro AI identity verification",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/IBTIKAR-Technologies/sekyro-sdks.git",
+    "url": "git+https://github.com/IBTIKAR-Technologies/ibtikar-identity.git",
     "directory": "packages/sekyro-web"
   },
-  "homepage": "https://github.com/IBTIKAR-Technologies/sekyro-sdks/tree/main/packages/sekyro-web#readme",
-  "bugs": {
-    "url": "https://github.com/IBTIKAR-Technologies/sekyro-sdks/issues"
-  },
   "keywords": [
     "sekyro",
     "kyc",
@@ -96,7 +92,8 @@
     "dist",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "sbom.cdx.json"
   ],
   "scripts": {
     "build": "tsup",

package/sbom.cdx.json

@@ -0,0 +1,195 @@
+{
+  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "tools": {
+      "components": [
+        {
+          "type": "application",
+          "name": "npm",
+          "version": "11.12.1"
+        },
+        {
+          "type": "library",
+          "name": "cyclonedx-library",
+          "group": "@cyclonedx",
+          "version": "10.3.0",
+          "author": "Jan Kowalleck",
+          "description": "Core functionality of CycloneDX for JavaScript (Node.js or WebBrowser).",
+          "licenses": [
+            {
+              "license": {
+                "id": "Apache-2.0"
+              }
+            }
+          ],
+          "externalReferences": [
+            {
+              "url": "https://github.com/CycloneDX/cyclonedx-javascript-library/issues",
+              "type": "issue-tracker",
+              "comment": "as detected from PackageJson property \"bugs.url\""
+            },
+            {
+              "url": "git+https://github.com/CycloneDX/cyclonedx-javascript-library.git",
+              "type": "vcs",
+              "comment": "as detected from PackageJson property \"repository.url\""
+            },
+            {
+              "url": "https://github.com/CycloneDX/cyclonedx-javascript-library#readme",
+              "type": "website",
+              "comment": "as detected from PackageJson property \"homepage\""
+            }
+          ],
+          "properties": [
+            {
+              "name": "cdx:npm:package:constraint:engine:node",
+              "value": ">=20.18.0"
+            }
+          ]
+        },
+        {
+          "type": "application",
+          "name": "cyclonedx-npm",
+          "group": "@cyclonedx",
+          "version": "6.0.1",
+          "author": "Jan Kowalleck",
+          "description": "Create CycloneDX Software Bill of Materials (SBOM) from NPM projects.",
+          "licenses": [
+            {
+              "license": {
+                "id": "Apache-2.0"
+              }
+            }
+          ],
+          "externalReferences": [
+            {
+              "url": "https://github.com/CycloneDX/cyclonedx-node-npm/issues",
+              "type": "issue-tracker",
+              "comment": "as detected from PackageJson property \"bugs.url\""
+            },
+            {
+              "url": "git+https://github.com/CycloneDX/cyclonedx-node-npm.git",
+              "type": "vcs",
+              "comment": "as detected from PackageJson property \"repository.url\""
+            },
+            {
+              "url": "https://github.com/CycloneDX/cyclonedx-node-npm#readme",
+              "type": "website",
+              "comment": "as detected from PackageJson property \"homepage\""
+            }
+          ],
+          "properties": [
+            {
+              "name": "cdx:npm:package:constraint:engine:node",
+              "value": ">=20.18.0"
+            },
+            {
+              "name": "cdx:npm:package:constraint:engine:npm",
+              "value": ">=9"
+            }
+          ]
+        }
+      ]
+    },
+    "component": {
+      "type": "application",
+      "name": "web",
+      "group": "@sekyro",
+      "version": "0.1.0-rc.7",
+      "bom-ref": "@sekyro/web@0.1.0-rc.7",
+      "description": "Sekyro AI web SDK — browser liveness capture, hosted-verification client and popup embed for Sekyro AI identity verification",
+      "licenses": [
+        {
+          "license": {
+            "name": "UNLICENSED",
+            "acknowledgement": "declared"
+          }
+        }
+      ],
+      "purl": "pkg:npm/%40sekyro/web@0.1.0-rc.7?vcs_url=git%2Bhttps%3A%2F%2Fgithub.com%2FIBTIKAR-Technologies%2Fibtikar-identity.git%23packages%2Fsekyro-web",
+      "externalReferences": [
+        {
+          "url": "https://github.com/IBTIKAR-Technologies/ibtikar-identity/issues",
+          "type": "issue-tracker",
+          "comment": "as detected from PackageJson property \"bugs.url\""
+        },
+        {
+          "url": "git+https://github.com/IBTIKAR-Technologies/ibtikar-identity.git#packages/sekyro-web",
+          "type": "vcs",
+          "comment": "as detected from PackageJson property \"repository.url\" and \"repository.directory\""
+        },
+        {
+          "url": "https://github.com/IBTIKAR-Technologies/ibtikar-identity#readme",
+          "type": "website",
+          "comment": "as detected from PackageJson property \"homepage\""
+        }
+      ],
+      "properties": [
+        {
+          "name": "cdx:npm:package:constraint:engine:node",
+          "value": ">=20"
+        },
+        {
+          "name": "cdx:npm:package:path",
+          "value": ""
+        }
+      ]
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ]
+  },
+  "components": [
+    {
+      "type": "library",
+      "name": "tasks-vision",
+      "group": "@mediapipe",
+      "version": "0.10.35",
+      "bom-ref": "@sekyro/web@0.1.0-rc.7|@mediapipe/tasks-vision@0.10.35",
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0",
+            "acknowledgement": "declared"
+          }
+        }
+      ],
+      "purl": "pkg:npm/%40mediapipe/tasks-vision@0.10.35",
+      "externalReferences": [
+        {
+          "url": "https://registry.npmjs.org/@mediapipe/tasks-vision/-/tasks-vision-0.10.35.tgz",
+          "type": "distribution",
+          "hashes": [
+            {
+              "alg": "SHA-512",
+              "content": "1cebda77055113a242fb8e67c988669f2c27af987f27c299bce794355386f6aff4f3be6966022dce7141f5b453bcb736eb861226a899d4db08a424ad270fde82"
+            }
+          ],
+          "comment": "as detected from npm-ls property \"resolved\" and property \"integrity\""
+        }
+      ],
+      "properties": [
+        {
+          "name": "cdx:npm:package:path",
+          "value": "node_modules/@mediapipe/tasks-vision"
+        }
+      ]
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "@sekyro/web@0.1.0-rc.7",
+      "dependsOn": [
+        "@sekyro/web@0.1.0-rc.7|@mediapipe/tasks-vision@0.10.35"
+      ]
+    },
+    {
+      "ref": "@sekyro/web@0.1.0-rc.7|@mediapipe/tasks-vision@0.10.35"
+    }
+  ]
+}

package/dist/chunk-MWNFSNMP.js

@@ -1,52 +0,0 @@
-// src/core/v3/frame-quality.ts
-var SHARP_REF = 180;
-var EXPOSURE_BAND = [100, 190];
-var EXPOSURE_FALLOFF = 64;
-function lumaAt(data, index) {
-  return 0.299 * (data[index] ?? 0) + 0.587 * (data[index + 1] ?? 0) + 0.114 * (data[index + 2] ?? 0);
-}
-function meanLuma(image) {
-  const { data, width, height } = image;
-  const pixels = width * height;
-  if (pixels === 0) return 0;
-  let sum = 0;
-  for (let i = 0; i < pixels; i += 1) sum += lumaAt(data, i * 4);
-  return sum / pixels;
-}
-function sharpness(image) {
-  const { data, width, height } = image;
-  if (width < 3 || height < 3) return 0;
-  const gray = new Float32Array(width * height);
-  for (let i = 0; i < gray.length; i += 1) gray[i] = lumaAt(data, i * 4);
-  let sum = 0;
-  let sumSquares = 0;
-  let count = 0;
-  for (let y = 1; y < height - 1; y += 1) {
-    for (let x = 1; x < width - 1; x += 1) {
-      const i = y * width + x;
-      const response = (gray[i - width] ?? 0) + (gray[i - 1] ?? 0) + (gray[i + 1] ?? 0) + (gray[i + width] ?? 0) - 4 * (gray[i] ?? 0);
-      sum += response;
-      sumSquares += response * response;
-      count += 1;
-    }
-  }
-  if (count === 0) return 0;
-  const mean = sum / count;
-  const variance = sumSquares / count - mean * mean;
-  return Math.min(1, Math.max(0, variance) / SHARP_REF);
-}
-function exposure(image) {
-  const mean = meanLuma(image);
-  const [low, high] = EXPOSURE_BAND;
-  const distance = mean < low ? low - mean : mean > high ? mean - high : 0;
-  return Math.max(0, 1 - distance / EXPOSURE_FALLOFF);
-}
-
-export {
-  SHARP_REF,
-  EXPOSURE_BAND,
-  meanLuma,
-  sharpness,
-  exposure
-};
-//# sourceMappingURL=chunk-MWNFSNMP.js.map

package/dist/chunk-MWNFSNMP.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/core/v3/frame-quality.ts"],"sourcesContent":["// frame-quality (Task 8) — pure, deterministic image measures on a small\n// (≤96px) face crop. No canvas access here: callers hand in ImageData; that\n// keeps these functions golden-testable and worker-portable.\n\n/** Laplacian-variance normalization reference — crops whose edge variance\n *  reaches this value (or beyond) count as fully sharp. */\nexport const SHARP_REF = 180;\n\n/** Mean-luma comfort band: inside → exposure 1; outside → linear falloff.\n *  Dark bound raised 70→100 (operator ruling 2026-07-07): face crops in the\n *  70–100 range passed the gate but kept drawing dark-face review verdicts —\n *  gating them here converts that into pre-capture more_light coaching. */\nexport const EXPOSURE_BAND: readonly [number, number] = [100, 190];\n\n/** Luma distance that zeroes the exposure factor (≈ one stop past the band). */\nconst EXPOSURE_FALLOFF = 64;\n\n/** Rec.601 luma. */\nfunction lumaAt(data: Uint8ClampedArray, index: number): number {\n  return (\n    0.299 * (data[index] ?? 0) + 0.587 * (data[index + 1] ?? 0) + 0.114 * (data[index + 2] ?? 0)\n  );\n}\n\nexport function meanLuma(image: ImageData): number {\n  const { data, width, height } = image;\n  const pixels = width * height;\n  if (pixels === 0) return 0;\n  let sum = 0;\n  for (let i = 0; i < pixels; i += 1) sum += lumaAt(data, i * 4);\n  return sum / pixels;\n}\n\n/**\n * Sharpness = variance of the 3×3 Laplacian (∇² kernel [0,1,0;1,−4,1;0,1,0])\n * over the interior pixels, normalized 0..1 against SHARP_REF. Flat crop → 0;\n * hard edges → 1 (clamped).\n */\nexport function sharpness(image: ImageData): number {\n  const { data, width, height } = image;\n  if (width < 3 || height < 3) return 0;\n  const gray = new Float32Array(width * height);\n  for (let i = 0; i < gray.length; i += 1) gray[i] = lumaAt(data, i * 4);\n  let sum = 0;\n  let sumSquares = 0;\n  let count = 0;\n  for (let y = 1; y < height - 1; y += 1) {\n    for (let x = 1; x < width - 1; x += 1) {\n      const i = y * width + x;\n      const response =\n        (gray[i - width] ?? 0) +\n        (gray[i - 1] ?? 0) +\n        (gray[i + 1] ?? 0) +\n        (gray[i + width] ?? 0) -\n        4 * (gray[i] ?? 0);\n      sum += response;\n      sumSquares += response * response;\n      count += 1;\n    }\n  }\n  if (count === 0) return 0;\n  const mean = sum / count;\n  const variance = sumSquares / count - mean * mean;\n  // VARIANCE against the reference (the plan's formula). Field lesson\n  // (Salem's iPhone, 2026-07-07): sqrt(variance)/REF put every real face\n  // crop at ~0.03-0.1 — permanently under the steady_camera threshold and\n  // crushing q to zero, so the gate could never fire. Real crops have\n  // Laplacian variance well above 180; a genuinely soft/blurred crop does not.\n  return Math.min(1, Math.max(0, variance) / SHARP_REF);\n}\n\n/** Exposure factor: 1 inside the band; linear falloff to 0 over\n *  EXPOSURE_FALLOFF luma outside it. */\nexport function exposure(image: ImageData): number {\n  const mean = meanLuma(image);\n  const [low, high] = EXPOSURE_BAND;\n  const distance = mean < low ? low - mean : mean > high ? mean - high : 0;\n  return Math.max(0, 1 - distance / EXPOSURE_FALLOFF);\n}\n"],"mappings":";AAMO,IAAM,YAAY;AAMlB,IAAM,gBAA2C,CAAC,KAAK,GAAG;AAGjE,IAAM,mBAAmB;AAGzB,SAAS,OAAO,MAAyB,OAAuB;AAC9D,SACE,SAAS,KAAK,KAAK,KAAK,KAAK,SAAS,KAAK,QAAQ,CAAC,KAAK,KAAK,SAAS,KAAK,QAAQ,CAAC,KAAK;AAE9F;AAEO,SAAS,SAAS,OAA0B;AACjD,QAAM,EAAE,MAAM,OAAO,OAAO,IAAI;AAChC,QAAM,SAAS,QAAQ;AACvB,MAAI,WAAW,EAAG,QAAO;AACzB,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK,EAAG,QAAO,OAAO,MAAM,IAAI,CAAC;AAC7D,SAAO,MAAM;AACf;AAOO,SAAS,UAAU,OAA0B;AAClD,QAAM,EAAE,MAAM,OAAO,OAAO,IAAI;AAChC,MAAI,QAAQ,KAAK,SAAS,EAAG,QAAO;AACpC,QAAM,OAAO,IAAI,aAAa,QAAQ,MAAM;AAC5C,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,EAAG,MAAK,CAAC,IAAI,OAAO,MAAM,IAAI,CAAC;AACrE,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,SAAS,GAAG,KAAK,GAAG;AACtC,aAAS,IAAI,GAAG,IAAI,QAAQ,GAAG,KAAK,GAAG;AACrC,YAAM,IAAI,IAAI,QAAQ;AACtB,YAAM,YACH,KAAK,IAAI,KAAK,KAAK,MACnB,KAAK,IAAI,CAAC,KAAK,MACf,KAAK,IAAI,CAAC,KAAK,MACf,KAAK,IAAI,KAAK,KAAK,KACpB,KAAK,KAAK,CAAC,KAAK;AAClB,aAAO;AACP,oBAAc,WAAW;AACzB,eAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,OAAO,MAAM;AACnB,QAAM,WAAW,aAAa,QAAQ,OAAO;AAM7C,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,QAAQ,IAAI,SAAS;AACtD;AAIO,SAAS,SAAS,OAA0B;AACjD,QAAM,OAAO,SAAS,KAAK;AAC3B,QAAM,CAAC,KAAK,IAAI,IAAI;AACpB,QAAM,WAAW,OAAO,MAAM,MAAM,OAAO,OAAO,OAAO,OAAO,OAAO;AACvE,SAAO,KAAK,IAAI,GAAG,IAAI,WAAW,gBAAgB;AACpD;","names":[]}

package/dist/chunk-NILNKLK6.js

@@ -1,50 +0,0 @@
-// src/popup/index.ts
-var SEKYRO_EVENTS = [
-  "session.completed",
-  "session.failed",
-  "session.review_pending",
-  "session.expired",
-  "session.cancelled"
-];
-var WINDOW_NAME = "sekyro-verify";
-var WINDOW_FEATURES = "width=480,height=720,noopener=false";
-var EVENT_NAMES = new Set(SEKYRO_EVENTS);
-function isSekyroEvent(data) {
-  if (data === null || typeof data !== "object") return false;
-  const d = data;
-  return d.source === "sekyro" && d.version === 1 && typeof d.sessionId === "string" && typeof d.event === "string" && EVENT_NAMES.has(d.event);
-}
-function open(opts) {
-  const origin = new URL(opts.hostedUrl).origin;
-  const popup = window.open(opts.hostedUrl, WINDOW_NAME, WINDOW_FEATURES);
-  if (!popup) return { error: "popup_blocked" };
-  const listener = (ev) => {
-    if (ev.source !== popup) return;
-    if (ev.origin !== origin) return;
-    if (!isSekyroEvent(ev.data)) return;
-    const { source, version, event, sessionId } = ev.data;
-    opts.onEvent({ source, version, event, sessionId });
-  };
-  window.addEventListener("message", listener);
-  return {
-    close() {
-      window.removeEventListener("message", listener);
-      popup.close();
-    }
-  };
-}
-function openHosted(hostedUrl, opts) {
-  if (opts.mode === "redirect") {
-    window.location.assign(hostedUrl);
-    return { close() {
-    } };
-  }
-  return open({ hostedUrl, onEvent: opts.onEvent ?? (() => void 0) });
-}
-
-export {
-  SEKYRO_EVENTS,
-  open,
-  openHosted
-};
-//# sourceMappingURL=chunk-NILNKLK6.js.map

package/dist/chunk-NILNKLK6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/popup/index.ts"],"sourcesContent":["// @sekyro/web/popup — the partner-facing popup embed wrapper\n// (Plan 6 Task 12). Framework-free browser code.\n//\n// REBRAND-CRITICAL WIRE CONTRACT (frozen on first partner integration):\n//  - `source: 'sekyro'`, `version: 1`, window name `'sekyro-verify'`;\n//  - event names mirror the webhook catalog (`session.completed` /\n//    `session.failed` / `session.review_pending` / `session.expired`) plus the\n//    page-only `session.cancelled` (user closed the popup mid-flow);\n//  - payload is the event name + sessionId ONLY — never scores, PII, or\n//    outcome detail (partners fetch the verdict server-side via API/webhooks).\n//\n// Security posture: the hosted page posts to the org's allowlisted origin\n// (backend `sdkAllowedOrigins`, surfaced as `HostedSessionView.sdkOrigin`) and\n// this listener double-checks BOTH the sender origin (must be the hosted URL's\n// origin) AND the message shape before forwarding anything to the partner.\n\n/** The frozen SDK event-name vocabulary, in catalog order. */\nexport const SEKYRO_EVENTS = [\n  \"session.completed\",\n  \"session.failed\",\n  \"session.review_pending\",\n  \"session.expired\",\n  \"session.cancelled\",\n] as const;\n\n/** One SDK event name — webhook-catalog terminal names + `session.cancelled`. */\nexport type SekyroEventName = (typeof SEKYRO_EVENTS)[number];\n\n/** The frozen postMessage payload: event name + sessionId ONLY. */\nexport interface SekyroEvent {\n  source: \"sekyro\";\n  version: 1;\n  event: SekyroEventName;\n  sessionId: string;\n}\n\nexport interface OpenOptions {\n  /** The `hosted_url` returned by `POST /api/v2/sessions` (create result). */\n  hostedUrl: string;\n  /** Called for every allowlist-validated event posted by the hosted page. */\n  onEvent: (event: SekyroEvent) => void;\n}\n\n/** Live popup handle — `close()` detaches the listener and closes the window. */\nexport interface PopupHandle {\n  close(): void;\n}\n\n/** `window.open` returned null: blocked by the browser (or a popup blocker). */\nexport interface PopupBlocked {\n  error: \"popup_blocked\";\n}\n\n/** FROZEN window name — partners may target it (e.g. to re-focus the popup). */\nconst WINDOW_NAME = \"sekyro-verify\";\n\n/** Popup geometry; `noopener=false` keeps `window.opener` alive for the page's postMessage. */\nconst WINDOW_FEATURES = \"width=480,height=720,noopener=false\";\n\nconst EVENT_NAMES: ReadonlySet<string> = new Set(SEKYRO_EVENTS);\n\n/** True when the payload matches the frozen {@link SekyroEvent} shape exactly. */\nfunction isSekyroEvent(data: unknown): data is SekyroEvent {\n  if (data === null || typeof data !== \"object\") return false;\n  const d = data as Partial<SekyroEvent>;\n  return (\n    d.source === \"sekyro\" &&\n    d.version === 1 &&\n    typeof d.sessionId === \"string\" &&\n    typeof d.event === \"string\" &&\n    EVENT_NAMES.has(d.event)\n  );\n}\n\n/**\n * Open the hosted verification flow in a popup and subscribe to its lifecycle\n * events. Incoming messages are dropped unless ALL hold:\n *  - the sender window (`ev.source`) is THIS popup — closes the spoof path of\n *    a same-origin iframe/window posting on the hosted origin's behalf\n *    (`ev.source` is identity-stable across popup navigations);\n *  - the sender origin is exactly the hosted URL's origin;\n *  - the payload matches the frozen {@link SekyroEvent} shape (allowlisted\n *    event name, string sessionId).\n *\n * Returns `{error: 'popup_blocked'}` when the browser refuses the popup —\n * callers should fall back to a full redirect to `hostedUrl`.\n *\n * Usage notes:\n *  - ONE active popup per page: the window name is shared and every `open()`\n *    installs a fresh listener, so `close()` the previous handle before\n *    reopening (a reused named window would otherwise feed stale listeners).\n *  - Events are at-least-once HINTS, not a system of record: a popup reload\n *    mid-flow fires `session.cancelled`, and a reload after a terminal state\n *    re-posts the terminal event — partners MUST confirm outcomes server-side\n *    via webhooks or the sessions API.\n *  - The popup `features` geometry is currently fixed ({@link WINDOW_FEATURES});\n *    an options field for it is reserved for a later version.\n */\nexport function open(opts: OpenOptions): PopupHandle | PopupBlocked {\n  const origin = new URL(opts.hostedUrl).origin;\n  const popup = window.open(opts.hostedUrl, WINDOW_NAME, WINDOW_FEATURES);\n  if (!popup) return { error: \"popup_blocked\" };\n\n  const listener = (ev: MessageEvent): void => {\n    if (ev.source !== popup) return;\n    if (ev.origin !== origin) return;\n    if (!isSekyroEvent(ev.data)) return;\n    const { source, version, event, sessionId } = ev.data;\n    // Re-project onto the frozen shape so extra properties never reach the partner.\n    opts.onEvent({ source, version, event, sessionId });\n  };\n  window.addEventListener(\"message\", listener);\n\n  return {\n    close(): void {\n      window.removeEventListener(\"message\", listener);\n      popup.close();\n    },\n  };\n}\n\nexport interface OpenHostedOptions {\n  /** `'popup'` opens a named window (the `open()` embed); `'redirect'` navigates this tab. */\n  mode: \"popup\" | \"redirect\";\n  /** Popup mode only — redirect mode never returns to this page. */\n  onEvent?: (event: SekyroEvent) => void;\n}\n\n/**\n * Spec §3.1 entry: `openHosted(hostedUrl, { mode, onEvent })`. Popup mode is\n * the `open()` embed; a blocked popup returns `{error: 'popup_blocked'}` so the\n * caller can fall back to `mode: 'redirect'` (never done implicitly — leaving\n * the partner page is their call). Redirect mode navigates and returns a\n * no-op handle.\n */\nexport function openHosted(hostedUrl: string, opts: OpenHostedOptions): PopupHandle | PopupBlocked {\n  if (opts.mode === \"redirect\") {\n    window.location.assign(hostedUrl);\n    return { close(): void {} };\n  }\n  return open({ hostedUrl, onEvent: opts.onEvent ?? (() => undefined) });\n}\n"],"mappings":";AAiBO,IAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA+BA,IAAM,cAAc;AAGpB,IAAM,kBAAkB;AAExB,IAAM,cAAmC,IAAI,IAAI,aAAa;AAG9D,SAAS,cAAc,MAAoC;AACzD,MAAI,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AACtD,QAAM,IAAI;AACV,SACE,EAAE,WAAW,YACb,EAAE,YAAY,KACd,OAAO,EAAE,cAAc,YACvB,OAAO,EAAE,UAAU,YACnB,YAAY,IAAI,EAAE,KAAK;AAE3B;AA0BO,SAAS,KAAK,MAA+C;AAClE,QAAM,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE;AACvC,QAAM,QAAQ,OAAO,KAAK,KAAK,WAAW,aAAa,eAAe;AACtE,MAAI,CAAC,MAAO,QAAO,EAAE,OAAO,gBAAgB;AAE5C,QAAM,WAAW,CAAC,OAA2B;AAC3C,QAAI,GAAG,WAAW,MAAO;AACzB,QAAI,GAAG,WAAW,OAAQ;AAC1B,QAAI,CAAC,cAAc,GAAG,IAAI,EAAG;AAC7B,UAAM,EAAE,QAAQ,SAAS,OAAO,UAAU,IAAI,GAAG;AAEjD,SAAK,QAAQ,EAAE,QAAQ,SAAS,OAAO,UAAU,CAAC;AAAA,EACpD;AACA,SAAO,iBAAiB,WAAW,QAAQ;AAE3C,SAAO;AAAA,IACL,QAAc;AACZ,aAAO,oBAAoB,WAAW,QAAQ;AAC9C,YAAM,MAAM;AAAA,IACd;AAAA,EACF;AACF;AAgBO,SAAS,WAAW,WAAmB,MAAqD;AACjG,MAAI,KAAK,SAAS,YAAY;AAC5B,WAAO,SAAS,OAAO,SAAS;AAChC,WAAO,EAAE,QAAc;AAAA,IAAC,EAAE;AAAA,EAC5B;AACA,SAAO,KAAK,EAAE,WAAW,SAAS,KAAK,YAAY,MAAM,QAAW,CAAC;AACvE;","names":[]}