declare enum RecommendationType { ALLOW = "ALLOW", CHALLENGE = "CHALLENGE", DENY = "DENY", TRUST = "TRUST" } type EventResponse = { actionToken?: string; deviceId?: string; recommendation?: Recommendation; userId?: string; }; type Recommendation = { type: RecommendationType; }; type LightweightPayload = { clientId: string; deviceId?: string; userId: string | null; sdkPlatform: 'mobile_web' | 'desktop_web'; events: Array>; }; type CryptoBindingOptions = { /** Set to true if you want to scope your crypto-binding keys with your product only (default is false, to use global-platofrm scope) */ productScope?: boolean; /** Custom database name, will be affected only if set `productScope` to true */ indexedDBName?: string; /** Custom db-versioning, will be be affected only if set `productScope` to true */ dbVersion?: number; /** Custom keys-store (table) name, will be affected only if set `productScope` to true */ keysStoreName?: string; /** Set to true if product supports key rotation */ /** Expiry days - number of days after which the key will expire */ /** Started at - timestamp of the day when the rotation was enabled for the product */ keyRotation?: { isEnabled: boolean; expiryDays: number; startedAt: number; tenantId: string; }; /** Timeout in milliseconds for IDB write transactions. If not set, no timeout is applied. * Use to guard against browsers that silently freeze IDB (e.g. iOS 18.7 WKWebView ephemeral sessions). */ idbWriteTimeoutMs?: number; /** @internal * Warning! This flag shouldn't be used, it was added temporarily for multi-tenant support. * * Internal flag used when the Product SDK instance has its own client ID separate from the Platform SDK root-level client ID */ fallbackClientId?: string; /** Optional string to scope crypto-binding keys to a separate object store. * When set, keys are stored in `identifiers_store:` instead of the default `identifiers_store`. * Use only when instructed by Transmit Security to isolate key storage between browser contexts (e.g. webview vs Safari). */ keyScope?: string; }; type TransactionType = 'purchase' | 'bill_payment' | 'mobile_recharge' | 'money_transfer' | 'credit_transfer' | 'credit_redemption' | 'top_up' | 'withdrawal' | 'investment' | 'loan' | 'refund' | 'other'; type TransactionMethod = 'bank_account' | 'wire' | 'card' | 'p2p' | 'wallet'; type AvsMatchLevel = 'none' | 'postal' | 'street' | 'full' | 'unknown'; /** The outcome of an action reported via {@link TSAccountProtection.reportActionResult} */ type ActionResult = "success" | "failure" | "incomplete"; /** Type of challenge presented to the user, when a challenge was recommended for the action */ type ChallengeType = "sms_otp" | "email_otp" | "totp" | "push_otp" | "voice_otp" | "idv" | "captcha" | "password" | "passkey"; type AuthMethodType = 'password' | 'webauthn' | 'totp' | 'email_otp' | 'sms_otp' | 'direct_otp' | 'voice_otp' | 'push_otp' | 'idv' | 'email_magic_link' | 'mobile_biometric' | 'face' | 'pin_authenticator' | 'google' | 'facebook' | 'apple' | 'line' | 'saml' | 'oidc'; interface ActionResultOptions { /** Identifier containing sensitive user data. Mosaic will encrypt and securely store this data. */ privateUserIdentifier?: string; /** Type of challenge used when a challenge was recommended for this action. */ challengeType?: ChallengeType; /** Opaque identifier of the user in your system. */ userId?: string; } interface ActionResponse { /** The token return by the SDK when the action was reported */ actionToken?: string; } interface InitOptions { /** Opaque identifier of the user in your system */ userId?: string; } /** * Initial parameters for SDK */ interface ConstructorOptions { /** Print logs to console */ verbose?: boolean; /** Your server URL * @required */ serverPath: string; /** Enable session token fetching * * Default value is false */ enableSessionToken?: boolean; /** First party server url for the identifiers migration * * Default value is undefined */ firstPartyMigrationUrl?: string; /** @internal * Internal flag indicating this web_sdk instance has its own clientId separate from the Platform SDK root-level clientId */ hasOwnClientId?: boolean; /** Tier mode for the SDK: 'standard' (default) or 'lightweight' (server-to-server) */ tier?: 'standard' | 'lightweight'; /** Agentic mode for CDN-injected integrations: enables agentic identity collection and artificial action triggering. Not supported with the lightweight tier. */ agenticCollect?: boolean; /** @internal * Optional configuration for crypto-binding key scoping. * Use only when instructed by Transmit Security. */ cryptoBindingConfig?: Pick; } interface TransactionData { amount: number; currency: string; type?: TransactionType; method?: TransactionMethod; channelId?: string; reason?: string; transactionDate?: number; payer?: { accountId?: string; accountNumber?: string; accountCountryCode?: string; bankIdentifier?: string; branchIdentifier?: string; name?: string; customerTier?: string; card?: { holderName?: string; bin?: string; last4?: string; }; billingInfo?: { name?: string; addressLine1?: string; addressLine2?: string; city?: string; state?: string; zipPostalCode?: string; country?: string; email?: string; phone?: string; }; }; payee?: { accountId?: string; accountNumber?: string; accountCountryCode?: string; bankIdentifier?: string; branchIdentifier?: string; name?: string; card?: { holderName?: string; bin?: string; last4?: string; }; }; purchase?: { totalItems?: number; products: { id?: string; name?: string; amount?: number; price?: number; }[]; shippingInfo?: { name?: string; addressLine1?: string; addressLine2?: string; city?: string; state?: string; zipPostalCode?: string; country?: string; email?: string; phone?: string; }; }; avs?: { code?: string; provider?: string; matchLevel?: AvsMatchLevel; }; } interface AuthContext { /** * Opaque identifier of the authenticated user in your system. Required — providing an auth * context signals the user is already authenticated (e.g. they logged in through a flow * outside this SDK before reaching this action). */ userId: string; /** Unix timestamp (ms) of when the login happened. */ loginTimestamp?: number; /** The challenge type used for the authentication action (e.g. sms_otp, password, passkey). */ challengeType?: ChallengeType; /** The number of failed attempts for the authentication action. */ failedAttempts?: number; /** The authentication method used for the authentication action (e.g. password, biometric, sso). */ authMethod?: AuthMethodType; /** The origin url of the page the user logged in from. */ loginOrigin?: string; } interface ActionEventOptions { /** Any ID that could help relate the action with external context or session */ correlationId?: string; /** User ID of the not yet authenticated user, used to enhance risk and * trust assessments. Once the user is authenticated, * {@link TSAccountProtection.setAuthenticatedUser} should be called. */ claimedUserId?: string; /** * The reported claimedUserId type (if provided), should not contain PII unless it is hashed. * Supported values: email, phone_number, account_id, ssn, national_id, passport_number, drivers_license_number, other. */ claimedUserIdType?: string; /** * A transaction data-points object for transaction-monitoring */ transactionData?: TransactionData; /** * Custom attributes matching the schema previously defined in the Admin Portal */ customAttributes?: Record; /** @internal Set only by AgenticManager, never by customer code. @ignore */ triggerSource?: 'page_load' | 'interaction_interval'; /** @internal Per-type tally of interactions counted toward this checkpoint. Set only by AgenticManager. @ignore */ agenticCountedInteractions?: Record; /** * Authentication context for an already-authenticated user. Providing it signals the user is * authenticated (userId is required) and registers them like {@link TSAccountProtection.setAuthenticatedUser}. * Useful when the login happened outside this SDK (e.g. a different site). */ authContext?: AuthContext; /** * The fields below are supported for Enterprise-IAM sdk usage actions, added `ignore` for avoiding preseting this attribute in the docs * @ignore */ publicKey?: string; /** * @ignore */ extensionMetadata?: string; /** * @ignore */ extensionDeviceAttributes?: Record; /** * @ignore */ suspiciousSignals?: string[]; /** * @ignore */ suspiciousContext?: string; /** * @ignore */ downloadFile?: Record; /** * @ignore */ uploadFile?: Record; } declare class TSAccountProtection { private static initializedInstance; private static initializedAgenticInstance; private initializationPromise; private disabledReason; private enableSessionToken; private identifiersMigrationEnabled; private firstPartyMigrationUrl; private hasOwnClientId; private tier; private agenticCollect; private agenticActive; private agenticManager; private agenticInitStartedAt; private lastCascadePath; private validationManager; private storageManager; private eventsManager; private deviceDataManager; private agenticSignalsManager; private configManager; private requestsManager; private identityManager; private migrationsManager; private cryptoBinding; private logsReporter; private options; private clientId; /** * Creates a new Account Protection SDK instance with your client context @param clientId Your AccountProtection client identifier @param options SDK configuration options */ constructor(clientId: string, options: ConstructorOptions); /** @ignore */ constructor(serverPath: string, clientId: string); private standDownCalled; private standDown; private runDetectionCascade; private standardInitListenerRegistered; private trafficWatchStarted; private startTrafficWatch; private spaRouteHooksRegistered; private registerSpaRouteHooks; private generateDisabledToken; /** * @ignore * @returns List of loaded actions that can be invoked */ get actions(): string[]; /** @ignore */ getActions(): Promise; getSessionToken(): Promise; /** * Returns the lightweight (citadel) device payload to be forwarded to citadel via the caller's backend. * The response from citadel includes a `deviceId` that must be passed back via {@link setDeviceId} * — the server may issue a new one or rotate it, and the SDK only persists it when told to. */ getPayload(): Promise; clearQueue(): void; /** * Sets the deviceId for lightweight mode (citadel). * Should be called after every response from citadel — the server may rotate the deviceId * (e.g. after schema validation), so always propagate the returned value back into the SDK. * @param deviceId - The JWT deviceId returned from citadel backend */ setDeviceId(deviceId: string): void; private resolveAgenticActive; /** * Initializes the AccountProtection SDK, which starts automatically tracking and submitting info of the user journey * @param options Init options * @returns Indicates if the call succeeded */ init(options?: InitOptions | string): Promise; private isInitialized; /** * Reports a user action event to the SDK * @param actionType Type of user action event that was predefined in the Transmit Security server * @returns Indicates if the call succeeded */ triggerActionEvent(actionType: string, options?: ActionEventOptions): Promise; private updateUserId; /** * Sets the user context for all subsequent events in the browser session (or until the user is explicitly cleared) * It should be set only after you've fully authenticated the user (including, for example, any 2FA that was required) * @param userId Opaque identifier of the user in your system * @param options Reserved for future use * @returns Indicates if the call succeeded */ setAuthenticatedUser(userId: string, options?: {}): Promise; /** * Reports the result of an action for which a recommendation was previously issued. * This includes whether the user successfully completed the action and, when applicable, * the type of challenge that was presented. * @param actionToken The token returned when the action was triggered by {@link TSAccountProtection.triggerActionEvent} * @param result The outcome of the action * @param options Additional context associated with the action result * @returns Indicates if the call succeeded */ reportActionResult(actionToken: string, result: ActionResult, options?: ActionResultOptions): Promise; /** * Clears the user context for all subsequent events in the browser session * @param options Reserved for future use * @returns Indicates if the call succeeded */ clearUser(options?: {}): Promise; /** * Gets a secure session token that is signed with the device's private key * @param actionType Optional action type to include in the token payload (default: null) * @param expirationSeconds Optional expiration time in seconds (default: 300 seconds / 5 minutes) * @returns A JWT-like token containing the backend session token and device information, signed with the device's private key */ getSecureSessionToken(actionType?: string | null, expirationSeconds?: number): Promise; } /** * Reports a user action event to the SDK * @param actionType Type of user action event that was predefined in the Transmit Security server * @returns Indicates if the call succeeded */ declare const triggerActionEvent: TSAccountProtection['triggerActionEvent']; /** * Sets the user context for all subsequent events in the browser session (or until the user is explicitly cleared) * It should be set only after you've fully authenticated the user (including, for example, any 2FA that was required) * @param userId Opaque identifier of the user in your system * @param options Reserved for future use * @returns Indicates if the call succeeded */ declare const setAuthenticatedUser: TSAccountProtection['setAuthenticatedUser']; /** * Reports the result of an action for which a recommendation was previously issued. * This includes whether the user successfully completed the action and, when applicable, * the type of challenge that was presented. * @param actionToken The token returned when the action was triggered by triggerActionEvent() * @param result The outcome of the action ("success" | "failure" | "incomplete") * @param options Additional context associated with the action result * @returns Indicates if the call succeeded */ declare const reportActionResult: TSAccountProtection['reportActionResult']; /** * Clears the user context for all subsequent events in the browser session * @param options Reserved for future use * @returns Indicates if the call succeeded */ declare const clearUser: TSAccountProtection['clearUser']; /** @ignore */ declare const getActions: TSAccountProtection['getActions']; /** @ignore */ declare const getSessionToken: TSAccountProtection['getSessionToken']; /** * Gets a secure session token that is signed with the device's private key * @param actionType Optional action type to include in the token payload (default: null) * @param expirationSeconds Optional expiration time in seconds (default: 300 seconds / 5 minutes) * @returns A JWT-like token containing the backend session token and device information, signed with the device's private key */ declare const getSecureSessionToken: TSAccountProtection['getSecureSessionToken']; /** @ignore */ declare const getPayload: TSAccountProtection['getPayload']; /** * Sets the deviceId for lightweight mode (citadel). * Should be called after receiving deviceId from backend on first request. * @param deviceId - The JWT deviceId returned from citadel backend */ declare const setDeviceId: TSAccountProtection['setDeviceId']; /** @ignore */ declare const __internal: { getDeviceId(): string; getClientId(): string; flush(): Promise; }; declare const PACKAGE_VERSION: string; declare function initialize(config: any): void; export { ActionEventOptions, ActionResponse, ActionResultOptions, AuthContext, LightweightPayload, PACKAGE_VERSION, __internal, clearUser, getActions, getPayload, getSecureSessionToken, getSessionToken, initialize, reportActionResult, setAuthenticatedUser, setDeviceId, triggerActionEvent };