document.addEventListener('DOMContentLoaded', async () => {
  if (!('OTPCredential' in window) || !window.isSecureContext) return;
  const form = document.querySelector('[data-webotp-form]');
  const input = form?.querySelector('[data-webotp]');
  if (!form || !input) return;
  const controller = new AbortController();
  form.addEventListener('submit', () => controller.abort(), { once: true });
  try {
    const credential = await navigator.credentials.get({ otp: { transport: ['sms'] }, signal: controller.signal });
    if (!credential?.code) return;
    input.value = credential.code;
    form.requestSubmit();
  } catch (error) {
    if (error.name !== 'AbortError') console.debug('WebOTP unavailable', error);
  }
});