@passflow/core 0.13.1 → 0.13.3

package/dist/index.mjs

@@ -1,9 +1,9 @@
 import F from "axios";
 import { v4 as H } from "uuid";
-import { startRegistration as K, startAuthentication as j } from "@simplewebauthn/browser";
-const z = "0.13.1", X = {
-  version: z
-}, C = "X-Passflow-Clientid", I = "Authorization", W = "X-Passflow-DeviceId", J = "X-Passflow-DeviceType", Z = X.version, Ne = ["id", "offline", "openid"], Q = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], V = "https://auth.passflow.cloud", Ke = "default", ee = 500, te = 600, re = 100, se = 6e4, G = 30, ie = 3, oe = 30, ne = 200, ae = (i) => {
+import { startAuthentication as z, startRegistration as X } from "@simplewebauthn/browser";
+const W = "0.13.3", J = {
+  version: W
+}, b = "X-Passflow-Clientid", I = "Authorization", Z = "X-Passflow-DeviceId", Q = "X-Passflow-DeviceType", ee = J.version, qe = ["id", "offline", "openid"], te = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], K = "https://auth.passflow.cloud", Be = "default", re = 500, se = 600, ie = 100, oe = 6e4, G = 30, ne = 3, ae = 30, ce = 200, he = (i) => {
   const e = [];
   let t;
   for (t in i) {
@@ -12,20 +12,20 @@ const z = "0.13.1", X = {
       continue;
     const s = { tenant: { id: r.tenant_id, name: r.tenant_name } };
     s.groups = r.groups ? Object.keys(r.groups).map((o) => {
-      const a = r.groups[o] || [];
-      return { group: { id: o, name: r.group_names?.[o] ?? "unknown" }, roles: a };
+      const n = r.groups[o] || [];
+      return { group: { id: o, name: r.group_names?.[o] ?? "unknown" }, roles: n };
     }) : [], s.tenantRoles = s.groups?.find((o) => o.group.id === r.root_group_id), e.push(s);
   }
   return { raw: i, tenants: e };
 };
-function ce(i) {
+function de(i) {
   if (typeof window < "u" && typeof window.atob == "function")
     return window.atob(i);
   if (typeof Buffer < "u")
     return Buffer.from(i, "base64").toString("utf-8");
   throw new Error("No Base64 decoding method available in this environment");
 }
-class he {
+class ue {
   constructor(e) {
     this.storageManager = e;
   }
@@ -38,7 +38,7 @@ class he {
   isTokenTypeExpired(e) {
     const t = this.storageManager.getToken(e);
     if (!t) return !0;
-    const r = v(t);
+    const r = m(t);
     return r ? S(r) : !0;
   }
   /**
@@ -51,22 +51,22 @@ class he {
   parseTokenType(e) {
     const t = this.storageManager.getToken(e);
     if (t)
-      return v(t);
+      return m(t);
   }
 }
 function S(i, e = G) {
   return Math.floor(Date.now() / 1e3) + e > i.exp;
 }
-function v(i) {
+function m(i) {
   const e = i.split(".")[1];
   if (!e) throw new Error("Invalid token string");
-  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = ce(r), o = decodeURIComponent(
-    s.split("").map((d) => "%" + ("00" + d.charCodeAt(0).toString(16)).slice(-2)).join("")
-  ), a = JSON.parse(o);
-  return a.membership = a.passflow_tm && a.type !== "invite" ? ae(a.passflow_tm) : void 0, a;
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = de(r), o = decodeURIComponent(
+    s.split("").map((h) => "%" + ("00" + h.charCodeAt(0).toString(16)).slice(-2)).join("")
+  ), n = JSON.parse(o);
+  return n.membership = n.passflow_tm && n.type !== "invite" ? he(n.passflow_tm) : void 0, n;
 }
-var p = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(p || {}), m = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(m || {}), q = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(q || {});
-class Y {
+var k = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(k || {}), y = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(y || {}), V = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(V || {});
+class q {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
   }
@@ -166,7 +166,7 @@ class Y {
   loadPersistedMode() {
     try {
       const e = this.storageManager.storage.getItem(this.DELIVERY_MODE_KEY);
-      e && Object.values(m).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
+      e && Object.values(y).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
     } catch {
     }
   }
@@ -176,7 +176,7 @@ class Y {
   loadPersistedSessionState() {
     try {
       const e = this.storageManager.storage.getItem(this.SESSION_STATE_KEY);
-      e && Object.values(q).includes(e) && (this.sessionState = e);
+      e && Object.values(V).includes(e) && (this.sessionState = e);
     } catch {
     }
   }
@@ -227,8 +227,8 @@ class $ {
    * In JSON mode: save all tokens (existing behavior)
    */
   saveTokens(e, t) {
-    const { id_token: r, access_token: s, refresh_token: o, scopes: a } = e;
-    t === m.Cookie || t === m.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(p.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(p.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(p.refresh_token), o), a && this.storage.setItem(this.scopes, a.join(",")));
+    const { id_token: r, access_token: s, refresh_token: o, scopes: n } = e;
+    t === y.Cookie || t === y.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(k.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(k.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(k.refresh_token), o), n && this.storage.setItem(this.scopes, n.join(",")));
   }
   getToken(e) {
     const t = this.getKeyForTokenType(e);
@@ -241,19 +241,19 @@ class $ {
    */
   getTokens() {
     const e = this.getDeliveryMode();
-    if (e === m.Cookie || e === m.BFF) {
+    if (e === y.Cookie || e === y.BFF) {
       const r = this.storage.getItem(this.ID_TOKEN_KEY);
       return r ? {
         id_token: r
         // access_token and refresh_token are in HttpOnly cookies, not localStorage
       } : void 0;
     }
-    const t = this.storage.getItem(this.getKeyForTokenType(p.access_token));
+    const t = this.storage.getItem(this.getKeyForTokenType(k.access_token));
     if (t)
       return {
         access_token: t,
-        id_token: this.storage.getItem(this.getKeyForTokenType(p.id_token)) ?? void 0,
-        refresh_token: this.storage.getItem(this.getKeyForTokenType(p.refresh_token)) ?? void 0,
+        id_token: this.storage.getItem(this.getKeyForTokenType(k.id_token)) ?? void 0,
+        refresh_token: this.storage.getItem(this.getKeyForTokenType(k.refresh_token)) ?? void 0,
         scopes: this.storage.getItem(this.scopes)?.split(",") ?? void 0
       };
   }
@@ -265,7 +265,7 @@ class $ {
    * Used to detect stale state where delivery_mode is set but JSON tokens exist
    */
   hasJsonModeTokens() {
-    return !!this.storage.getItem(this.getKeyForTokenType(p.access_token));
+    return !!this.storage.getItem(this.getKeyForTokenType(k.access_token));
   }
   /**
    * Check if cookie mode ID token exists in storage
@@ -279,7 +279,7 @@ class $ {
     this.storage.removeItem(t);
   }
   deleteTokens() {
-    this.storage.removeItem(this.getKeyForTokenType(p.id_token)), this.storage.removeItem(this.getKeyForTokenType(p.access_token)), this.storage.removeItem(this.getKeyForTokenType(p.refresh_token)), this.storage.removeItem(this.scopes), this.clearIdToken(), this.clearDeliveryMode(), this.clearCsrfToken();
+    this.storage.removeItem(this.getKeyForTokenType(k.id_token)), this.storage.removeItem(this.getKeyForTokenType(k.access_token)), this.storage.removeItem(this.getKeyForTokenType(k.refresh_token)), this.storage.removeItem(this.scopes), this.clearIdToken(), this.clearDeliveryMode(), this.clearCsrfToken();
   }
   getDeviceId() {
     return this.storage.getItem(this.deviceId) ?? void 0;
@@ -324,7 +324,7 @@ class $ {
   getDeliveryMode() {
     try {
       const e = this.storage.getItem(this.DELIVERY_MODE_KEY);
-      if (e && Object.values(m).includes(e))
+      if (e && Object.values(y).includes(e))
         return e;
     } catch {
     }
@@ -416,84 +416,308 @@ class B {
     return H();
   }
 }
-var E = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(E || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorMethodSetupBegin = "/v2/user/2fa/methods/:method/setup/begin", i.TwoFactorMethodSetupConfirm = "/v2/user/2fa/methods/:method/setup/confirm", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), _ = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(_ || {});
-class u extends Error {
+class Y extends Error {
+  constructor(e = "Authentication popup was closed") {
+    super(e), this.name = "PopupClosedError";
+  }
+}
+class le {
+  constructor() {
+    this.passkeys = {
+      startRegistration: (e) => X({ optionsJSON: e }),
+      startAuthentication: (e) => z({ optionsJSON: e })
+    };
+  }
+  // ----------------------------------------------------------------
+  // Storage
+  // Replaces: StorageManager constructor default `storage ?? localStorage`
+  // File: lib/storage/index.ts line 41
+  // ----------------------------------------------------------------
+  get storage() {
+    return typeof localStorage > "u" ? {
+      getItem: () => null,
+      // biome-ignore lint/suspicious/noEmptyBlockStatements: intentional no-op for SSR
+      setItem: () => {
+      },
+      // biome-ignore lint/suspicious/noEmptyBlockStatements: intentional no-op for SSR
+      removeItem: () => {
+      }
+    } : localStorage;
+  }
+  // ----------------------------------------------------------------
+  // Navigation
+  // ----------------------------------------------------------------
+  /**
+   * Replaces:
+   *   window.location.origin  (passflow.ts:95, axios-client.ts:49)
+   *   window.location.search  (passflow.ts:338,416, auth-service.ts:610,826)
+   *   window.location.hash    (passflow.ts:342)
+   *   window.location.href    (auth-service.ts:826)
+   *   window.location.pathname (passflow.ts:429,441,443)
+   *   window?.location?.hostname (user-service.ts:57)
+   */
+  getCurrentUrl() {
+    return typeof window > "u" ? null : {
+      href: window.location.href,
+      origin: window.location.origin,
+      pathname: window.location.pathname,
+      search: window.location.search,
+      hash: window.location.hash,
+      hostname: window.location.hostname
+    };
+  }
+  /**
+   * Replaces:
+   *   window.history.replaceState({}, document.title, ...)
+   *   (passflow.ts:429, 441, 443)
+   */
+  replaceUrl(e) {
+    typeof window > "u" || window.history.replaceState({}, document.title, e);
+  }
+  /**
+   * Replaces:
+   *   window.location.href = url
+   *   (auth-service.ts:795, 813, 845, passflow.ts indirectly)
+   */
+  navigateTo(e) {
+    typeof window > "u" || (window.location.href = e);
+  }
+  // ----------------------------------------------------------------
+  // Lifecycle
+  // ----------------------------------------------------------------
+  /**
+   * Replaces:
+   *   document.addEventListener('visibilitychange', handler) where !document.hidden
+   *   (token-cache-service.ts:134-145)
+   */
+  onForeground(e) {
+    if (typeof document > "u")
+      return () => {
+      };
+    const t = () => {
+      document.hidden || e();
+    };
+    return document.addEventListener("visibilitychange", t), () => document.removeEventListener("visibilitychange", t);
+  }
+  /**
+   * Replaces:
+   *   document.addEventListener('visibilitychange', handler) where document.hidden
+   *   (token-cache-service.ts:134-145, complementary to onForeground)
+   *
+   * NOTE: Not currently called by the SDK. Included in the interface for
+   * React Native adapter compatibility (future use).
+   */
+  onBackground(e) {
+    if (typeof document > "u")
+      return () => {
+      };
+    const t = () => {
+      document.hidden && e();
+    };
+    return document.addEventListener("visibilitychange", t), () => document.removeEventListener("visibilitychange", t);
+  }
+  /**
+   * Replaces:
+   *   window.addEventListener('beforeunload', ...)
+   *   (token-cache-service.ts:151)
+   */
+  onBeforeUnload(e) {
+    return typeof window > "u" ? () => {
+    } : (window.addEventListener("beforeunload", e), () => window.removeEventListener("beforeunload", e));
+  }
+  /**
+   * Replaces:
+   *   typeof document !== 'undefined' && document.hidden
+   *   (token-cache-service.ts:112)
+   */
+  isInForeground() {
+    return typeof document > "u" ? !0 : !document.hidden;
+  }
+  // ----------------------------------------------------------------
+  // Auth UI
+  // ----------------------------------------------------------------
+  /**
+   * Replaces:
+   *   window.open(passflowURL, '_blank', `width=...,height=...`)
+   *   + polling loop with popupWindow.location.href/search
+   *   + window.location.href = origin (post-auth redirect)
+   *   (auth-service.ts:741-805)
+   *
+   *   window.location.href = passflowURL (redirect mode)
+   *   (auth-service.ts:813)
+   */
+  openAuthUrl(e, t = {}) {
+    const r = t.mode ?? "popup";
+    if (r === "redirect")
+      return window.location.href = e, new Promise(() => {
+      });
+    if (r === "deeplink")
+      return Promise.reject(
+        new Error(
+          'openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.'
+        )
+      );
+    const s = t.width ?? re, o = t.height ?? se, n = t.expectedReturnOrigin ?? window.location.origin, h = window.open(e, "_blank", `width=${s},height=${o}`);
+    return h ? new Promise((d, u) => {
+      const g = Date.now(), f = setInterval(() => {
+        if (h.closed) {
+          clearInterval(f), u(new Y());
+          return;
+        }
+        if (Date.now() - g > oe) {
+          clearInterval(f), h.close(), u(new Error("Authentication popup timed out"));
+          return;
+        }
+        try {
+          if (h.location.href.startsWith(n)) {
+            const M = h.location.search, j = h.location.hash;
+            clearInterval(f), h.close(), d({ callbackSearch: M, callbackHash: j });
+          }
+        } catch {
+        }
+      }, ie);
+    }) : (window.location.href = e, new Promise(() => {
+    }));
+  }
+  // ----------------------------------------------------------------
+  // Base64
+  // ----------------------------------------------------------------
+  /**
+   * Replaces:
+   *   btoa(publicKey.user.id)
+   *   (auth-service.ts:644, user-service.ts:64)
+   */
+  btoa(e) {
+    return btoa(e);
+  }
+  /**
+   * Replaces:
+   *   window.atob(base64) / Buffer.from(base64, 'base64').toString('utf-8')
+   *   (token/service.ts:26-27)
+   */
+  atob(e) {
+    if (typeof window < "u" && typeof window.atob == "function")
+      return window.atob(e);
+    if (typeof Buffer < "u")
+      return Buffer.from(e, "base64").toString("utf-8");
+    throw new Error("No Base64 decoding method available in this environment");
+  }
+  // ----------------------------------------------------------------
+  // Cookies
+  // ----------------------------------------------------------------
+  /**
+   * Replaces:
+   *   document.cookie write/read test
+   *   (axios-client.ts:221-223)
+   */
+  cookiesSupported() {
+    if (typeof document > "u") return !1;
+    try {
+      document.cookie = "passflow_test=1; SameSite=Lax";
+      const e = document.cookie.indexOf("passflow_test=1") !== -1;
+      return document.cookie = "passflow_test=; expires=Thu, 01 Jan 1970 00:00:00 UTC", e;
+    } catch {
+      return !1;
+    }
+  }
+  // ----------------------------------------------------------------
+  // Device
+  // ----------------------------------------------------------------
+  /**
+   * Replaces:
+   *   Hardcoded 'web' string in DEVICE_TYPE_HEADER_KEY header
+   *   (axios-client.ts:91)
+   *   OS.web enum value (auth-service.ts:244, 358, 637, 676, user-service.ts:55)
+   */
+  getDeviceType() {
+    return "web";
+  }
+}
+const A = new le();
+var _ = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(_ || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorMethodSetupBegin = "/v2/user/2fa/methods/:method/setup/begin", i.TwoFactorMethodSetupConfirm = "/v2/user/2fa/methods/:method/setup/confirm", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), E = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(E || {});
+class l extends Error {
   constructor(e) {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
-var de = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(de || {}), b = /* @__PURE__ */ ((i) => (i.web = "web", i))(b || {});
-function y(i, e) {
+var pe = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(pe || {}), ge = /* @__PURE__ */ ((i) => (i.web = "web", i.ios = "ios", i.android = "android", i))(ge || {});
+function Ye(i) {
+  return i;
+}
+function v(i, e) {
   let t = i;
   return Object.entries(e).forEach(([r, s]) => {
     t = t.replace(`:${r}`, s);
   }), t;
 }
-var ue = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(ue || {});
-const le = 3, ge = 1e3;
+var fe = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(fe || {});
+const ke = 3, me = 1e3;
 class w {
   constructor(e, t, r) {
-    this.refreshPromise = null, this.isRefreshing = !1, this.origin = typeof window < "u" ? window.location.origin : "", this.defaultHeaders = {
+    this.refreshPromise = null, this.isRefreshing = !1, this.defaultHeaders = {
       Accept: "application/json",
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh"];
-    const { url: s, appId: o, keyStoragePrefix: a } = e;
-    this.url = s || V, this.storageManager = t ?? new $({
-      prefix: a ?? ""
-    }), this.deviceService = r ?? new B(this.storageManager), this.tokenService = new he(this.storageManager), this.tokenDeliveryManager = new Y(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
+    const { url: s, appId: o, keyStoragePrefix: n } = e;
+    this._platform = e.platform ?? A, this.url = s || K, this.storageManager = t ?? new $({
+      prefix: n ?? ""
+    }), this.deviceService = r ?? new B(this.storageManager), this.tokenService = new ue(this.storageManager), this.tokenDeliveryManager = new q(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [C]: o
+      [b]: o
     });
-    const d = this.deviceService.getDeviceId();
+    const h = this.deviceService.getDeviceId();
     this.defaultHeaders = {
       ...this.defaultHeaders,
-      [W]: d,
-      [J]: "web"
+      [Z]: h,
+      [Q]: this._platform.getDeviceType()
     }, this.detectCookieSupport(), this.instance = F.create({
       baseURL: this.url,
       headers: { ...this.defaultHeaders }
-    }), this.instance.interceptors.request.use(async (h) => {
-      if (this.isNonAuthEndpoint(h.url))
-        return h;
+    }), this.instance.interceptors.request.use(async (d) => {
+      if (this.isNonAuthEndpoint(d.url))
+        return d;
       if (this.tokenDeliveryManager.isCookieMode()) {
-        h.withCredentials = !0;
-        const f = this.storageManager.getCsrfToken();
-        return f && (h.headers["X-CSRF-Token"] = f), h;
+        d.withCredentials = !0;
+        const g = this.storageManager.getCsrfToken();
+        return g && (d.headers["X-CSRF-Token"] = g), d;
       }
-      if (h.url?.includes("refresh")) {
+      if (d.url?.includes("refresh")) {
         if (this.isRefreshing) {
-          const f = new AbortController();
-          return f.abort(), h.signal = f.signal, h;
+          const g = new AbortController();
+          return g.abort(), d.signal = g.signal, d;
         }
-        return h;
+        return d;
       }
-      const g = this.storageManager.getTokens();
-      if (g?.access_token) {
-        const f = v(g.access_token);
-        if (S(f, G) && g.refresh_token)
+      const u = this.storageManager.getTokens();
+      if (u?.access_token) {
+        const g = m(u.access_token);
+        if (S(g, G) && u.refresh_token)
           try {
             if (this.refreshPromise) {
-              const k = await this.refreshPromise;
-              return k?.data?.access_token && (h.headers[I] = `Bearer ${k.data.access_token}`), h;
+              const f = await this.refreshPromise;
+              return f?.data?.access_token && (d.headers[I] = `Bearer ${f.data.access_token}`), d;
             }
             this.refreshPromise = this.refreshTokens();
             try {
-              const k = await this.refreshPromise;
-              return k?.data?.access_token && (h.headers[I] = `Bearer ${k.data.access_token}`), h;
+              const f = await this.refreshPromise;
+              return f?.data?.access_token && (d.headers[I] = `Bearer ${f.data.access_token}`), d;
             } finally {
               this.refreshPromise = null;
             }
-          } catch (k) {
-            return this.refreshPromise = null, this.isRefreshing = !1, this.storageManager.deleteTokens(), Promise.reject(k);
+          } catch (f) {
+            return this.refreshPromise = null, this.isRefreshing = !1, this.storageManager.deleteTokens(), Promise.reject(f);
           }
-        return h.headers[I] = `Bearer ${g.access_token}`, h;
+        return d.headers[I] = `Bearer ${u.access_token}`, d;
       }
-      return h;
+      return d;
     }), this.instance.interceptors.response.use(
-      (h) => h,
-      async (h) => (h.response?.status === 401 && this.tokenDeliveryManager.setSessionInvalid(), h.response?.status === 429 ? await this.handleRateLimitError(h) : this.handleAxiosError(h))
+      (d) => d,
+      async (d) => (d.response?.status === 401 && this.tokenDeliveryManager.setSessionInvalid(), d.response?.status === 429 ? await this.handleRateLimitError(d) : this.handleAxiosError(d))
     );
   }
+  get origin() {
+    return this._platform.getCurrentUrl()?.origin ?? "";
+  }
   isProtectedEndpoint(e) {
     return this.protectedEndpoints.some((t) => e?.includes(t));
   }
@@ -501,17 +725,19 @@ class w {
     return this.nonAccessTokenEndpoints.some((t) => e?.includes(t)) && !this.isProtectedEndpoint(e);
   }
   /**
-   * Detect if cookies are supported/enabled in the browser
-   * Falls back to JSON mode if cookies are blocked
+   * Detect if cookies are supported/enabled in the browser.
+   * If cookie mode is already active (restored from storage) and cookies are not
+   * supported, throws immediately to prevent silent misconfiguration.
+   *
+   * Note: If cookie mode is set later (e.g., server responds with token_delivery=cookie
+   * on a non-cookie platform), this check will not catch it. The server should not
+   * configure cookie mode for platforms where cookiesSupported() returns false.
    */
   detectCookieSupport() {
-    if (!(typeof document > "u"))
-      try {
-        document.cookie = "passflow_test=1; SameSite=Lax";
-        const e = document.cookie.indexOf("passflow_test=1") !== -1;
-        document.cookie = "passflow_test=; expires=Thu, 01 Jan 1970 00:00:00 UTC", !e && this.tokenDeliveryManager.isCookieMode();
-      } catch {
-      }
+    if (!this._platform.cookiesSupported() && this.tokenDeliveryManager.isCookieMode())
+      throw new Error(
+        "Passflow SDK: Cookie delivery mode is configured but cookies are not supported in this environment. Use a platform adapter that supports cookies or configure the server to use JSON token delivery."
+      );
   }
   /**
    * Refresh tokens using single-flight pattern to prevent race conditions
@@ -550,20 +776,20 @@ class w {
     if (!["GET", "HEAD", "OPTIONS"].includes(r || ""))
       return Promise.reject(e);
     const o = t._retryCount || 0;
-    if (o >= le)
+    if (o >= ke)
       return Promise.reject(e);
-    let a = ge * Math.pow(2, o);
-    const d = e.response?.headers?.["retry-after"];
-    if (d) {
-      const h = Number.parseInt(d, 10);
-      if (!Number.isNaN(h))
-        a = h * 1e3;
+    let n = me * Math.pow(2, o);
+    const h = e.response?.headers?.["retry-after"];
+    if (h) {
+      const d = Number.parseInt(h, 10);
+      if (!Number.isNaN(d))
+        n = d * 1e3;
       else {
-        const g = new Date(d);
-        Number.isNaN(g.getTime()) || (a = Math.max(0, g.getTime() - Date.now()));
+        const u = new Date(h);
+        Number.isNaN(u.getTime()) || (n = Math.max(0, u.getTime() - Date.now()));
       }
     }
-    return await new Promise((h) => setTimeout(h, a)), t._retryCount = o + 1, this.instance.request(t);
+    return await new Promise((d) => setTimeout(d, n)), t._retryCount = o + 1, this.instance.request(t);
   }
   // eslint-disable-next-line complexity
   // biome-ignore lint/suspicious/useAwait: <explanation>
@@ -573,10 +799,10 @@ class w {
     const t = e.response.status, r = e.response.data;
     if ("error" in r && typeof r.error == "object" && r.error !== null) {
       const { error: s } = r;
-      return Promise.reject(new u(s));
+      return Promise.reject(new l(s));
     }
     return Promise.reject(
-      new u({
+      new l({
         id: `error.http.${t}`,
         message: e.message || "An error occurred",
         status: t,
@@ -593,19 +819,19 @@ class w {
     })).data;
   }
   get(e, t) {
-    return this.send(E.GET, e, t);
+    return this.send(_.GET, e, t);
   }
   post(e, t, r) {
-    return this.send(E.POST, e, { data: t, ...r });
+    return this.send(_.POST, e, { data: t, ...r });
   }
   put(e, t, r) {
-    return this.send(E.PUT, e, { data: t, ...r });
+    return this.send(_.PUT, e, { data: t, ...r });
   }
   patch(e, t, r) {
-    return this.send(E.PATCH, e, { data: t, ...r });
+    return this.send(_.PATCH, e, { data: t, ...r });
   }
   delete(e, t) {
-    return this.send(E.DELETE, e, t);
+    return this.send(_.DELETE, e, t);
   }
   /**
    * Update the appId and propagate it to axios headers.
@@ -616,11 +842,11 @@ class w {
   setAppId(e) {
     this.appId = e, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [C]: e
-    }, this.instance.defaults.headers.common[C] = e;
+      [b]: e
+    }, this.instance.defaults.headers.common[b] = e;
   }
 }
-class pe {
+class ve {
   constructor(e, t, r) {
     this.axiosClient = new w(e, t, r);
   }
@@ -631,7 +857,7 @@ class pe {
     return this.axiosClient.get(c.appSettings);
   }
 }
-class fe {
+class ye {
   constructor(e, t, r) {
     this.axiosClient = new w(e, t, r);
   }
@@ -690,7 +916,7 @@ class fe {
     );
   }
   logOut(e, t, r = !1) {
-    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? _.logout : c.logout;
+    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? E.logout : c.logout;
     return this.axiosClient.post(o, s);
   }
   validateSession() {
@@ -710,26 +936,26 @@ class fe {
     return this.axiosClient.post(c.resetPassword, s, {
       headers: {
         [I]: `Bearer ${r}`,
-        [C]: void 0
+        [b]: void 0
       }
     });
   }
   passkeyRegisterStart(e, t, r, s = !1) {
-    const { create_tenant: o } = e, a = {
+    const { create_tenant: o } = e, n = {
       ...e,
       create_tenant: o ?? !1,
       device: t,
       os: r
-    }, d = s ? _.passkeyRegisterStart : c.passkeyRegisterStart;
-    return this.axiosClient.post(d, a);
+    }, h = s ? E.passkeyRegisterStart : c.passkeyRegisterStart;
+    return this.axiosClient.post(h, n);
   }
   passkeyRegisterComplete(e, t, r, s = !1) {
     const o = {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, a = s ? _.passkeyRegisterComplete : c.passkeyRegisterComplete;
-    return this.axiosClient.post(a, o);
+    }, n = s ? E.passkeyRegisterComplete : c.passkeyRegisterComplete;
+    return this.axiosClient.post(n, o);
   }
   passkeyAuthenticateStart(e, t, r, s = !1) {
     const o = {
@@ -737,9 +963,9 @@ class fe {
       user_id: e.user_id ?? "",
       device: t,
       os: r
-    }, a = s ? _.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
+    }, n = s ? E.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
     return this.axiosClient.post(
-      a,
+      n,
       o
     );
   }
@@ -748,22 +974,22 @@ class fe {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, a = s ? _.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
-    return this.axiosClient.post(a, o);
+    }, n = s ? E.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
+    return this.axiosClient.post(n, o);
   }
   passkeyValidate(e, t, r, s = !1, o) {
-    const a = {
+    const n = {
       otp: e,
       device: t,
       challenge_id: r
     };
-    let d = c.passkeyValidate;
-    !o && s && (d = _.passkeyValidate);
-    const h = o ? { [C]: o } : {};
-    return this.axiosClient.post(d, a, { headers: h });
+    let h = c.passkeyValidate;
+    !o && s && (h = E.passkeyValidate);
+    const d = o ? { [b]: o } : {};
+    return this.axiosClient.post(h, n, { headers: d });
   }
 }
-class Ve {
+class je {
   constructor(e, t, r) {
     this.axiosClient = new w(e, t, r);
   }
@@ -771,14 +997,14 @@ class Ve {
     this.axiosClient.setAppId(e);
   }
   getCLIAuthStatus(e) {
-    const t = y(c.cliAuthStatus, { sessionId: e });
+    const t = v(c.cliAuthStatus, { sessionId: e });
     return this.axiosClient.get(t);
   }
   completeCLIAuth(e) {
     return this.axiosClient.post(c.cliAuthComplete, e);
   }
 }
-class ke {
+class Se {
   constructor(e, t, r) {
     this.axiosClient = new w(e, t, r);
   }
@@ -804,7 +1030,7 @@ class ke {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const r = y(c.invitationsPath, {
+    const r = v(c.invitationsPath, {
       tenantID: e.tenantID
     });
     return this.axiosClient.get(r, { params: t }).then((s) => ({
@@ -818,7 +1044,7 @@ class ke {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = y(c.invitationDelete, {
+    const t = v(c.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -829,7 +1055,7 @@ class ke {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = y(c.invitationResend, {
+    const t = v(c.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -840,13 +1066,13 @@ class ke {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = y(c.invitationGetLink, {
+    const t = v(c.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
   }
 }
-class ve {
+class we {
   constructor(e, t, r) {
     this.axiosClient = new w(e, t, r);
   }
@@ -863,7 +1089,7 @@ class ve {
     return this.axiosClient.get(c.settingsPasskey);
   }
 }
-class ye {
+class Te {
   constructor(e, t, r) {
     this.axiosClient = new w(e, t, r);
   }
@@ -967,8 +1193,8 @@ class ye {
    * @param role Role to assign
    */
   addUserToGroup(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/add`, a = { user_id: r, role: s };
-    return this.axiosClient.post(o, a);
+    const o = `${c.tenantPath}/${e}/group/${t}/add`, n = { user_id: r, role: s };
+    return this.axiosClient.post(o, n);
   }
   /**
    * Remove user roles from a group
@@ -978,8 +1204,8 @@ class ye {
    * @param roles Roles to remove
    */
   removeUserRolesFromGroup(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/remove_roles`, a = { user_id: r, roles: s };
-    return this.axiosClient.post(o, a);
+    const o = `${c.tenantPath}/${e}/group/${t}/remove_roles`, n = { user_id: r, roles: s };
+    return this.axiosClient.post(o, n);
   }
   /**
    * Change user roles in a group
@@ -989,8 +1215,8 @@ class ye {
    * @param roles New roles to assign
    */
   changeUserRoles(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/change`, a = { user_id: r, roles: s };
-    return this.axiosClient.post(o, a);
+    const o = `${c.tenantPath}/${e}/group/${t}/change`, n = { user_id: r, roles: s };
+    return this.axiosClient.post(o, n);
   }
   /**
    * Delete a user from a group
@@ -1096,7 +1322,7 @@ class ye {
     return this.axiosClient.delete(s);
   }
 }
-class me {
+class Ee {
   constructor(e, t, r) {
     this.axiosClient = new w(e, t, r);
   }
@@ -1212,13 +1438,13 @@ class me {
       };
     }).catch((r) => {
       if (r.response) {
-        const s = r.response.status, o = r.response.data || {}, a = r.response.headers?.["retry-after"] ? parseInt(r.response.headers["retry-after"], 10) : void 0;
+        const s = r.response.status, o = r.response.data || {}, n = r.response.headers?.["retry-after"] ? parseInt(r.response.headers["retry-after"], 10) : void 0;
         return {
           success: !1,
           error: {
             code: o.error || this.mapStatusToErrorCode(s),
             message: o.message || this.getDefaultErrorMessage(s),
-            retryAfter: a
+            retryAfter: n
           }
         };
       }
@@ -1287,7 +1513,7 @@ class me {
    * POST /v2/user/2fa/methods/:method/setup/begin
    */
   beginMethodSetup(e) {
-    const t = y(c.TwoFactorMethodSetupBegin, { method: e });
+    const t = v(c.TwoFactorMethodSetupBegin, { method: e });
     return this.axiosClient.post(t, {});
   }
   /**
@@ -1295,7 +1521,7 @@ class me {
    * POST /v2/user/2fa/methods/:method/setup/confirm
    */
   confirmMethodSetup(e, t) {
-    const r = y(c.TwoFactorMethodSetupConfirm, { method: e });
+    const r = v(c.TwoFactorMethodSetupConfirm, { method: e });
     return this.axiosClient.post(r, t);
   }
   /**
@@ -1303,7 +1529,7 @@ class me {
    * DELETE /v2/user/2fa/methods/:id
    */
   removeMethod(e) {
-    const t = y(c.TwoFactorMethodRemove, { id: e });
+    const t = v(c.TwoFactorMethodRemove, { id: e });
     return this.axiosClient.delete(t);
   }
   /**
@@ -1348,11 +1574,11 @@ class me {
    * DELETE /v2/user/2fa/trusted-devices/:id
    */
   revokeTrustedDevice(e) {
-    const t = y(c.TwoFactorTrustedDeviceRevoke, { id: e });
+    const t = v(c.TwoFactorTrustedDeviceRevoke, { id: e });
     return this.axiosClient.delete(t);
   }
 }
-class Se {
+class _e {
   constructor(e, t, r) {
     this.axiosClient = new w(e, t, r);
   }
@@ -1380,14 +1606,14 @@ class Se {
     passkeyDisplayName: s,
     passkeyUsername: o
   }) {
-    const a = {
+    const n = {
       passkey_display_name: s,
       passkey_username: o,
       relying_party_id: e,
       deviceId: t,
       os: r
     };
-    return this.axiosClient.post(c.addUserPasskey, a);
+    return this.axiosClient.post(c.addUserPasskey, n);
   }
   addUserPasskeyComplete(e, t, r) {
     return this.axiosClient.post(c.completeAddUserPasskey, {
@@ -1397,8 +1623,8 @@ class Se {
     });
   }
 }
-var n = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.SessionExpired = "session:expired", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(n || {});
-class we {
+var a = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.SessionExpired = "session:expired", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(a || {});
+class Ie {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
   }
@@ -1445,8 +1671,8 @@ function D(i) {
   const t = /^[A-Za-z0-9_-]+$/;
   return e.every((r) => t.test(r) && r.length > 0);
 }
-function Te(i) {
-  return i.replace(/<[^>]*>/g, "").substring(0, ne);
+function be(i) {
+  return i.replace(/<[^>]*>/g, "").substring(0, ce);
 }
 function P(i) {
   if (!i || typeof i != "string") return !1;
@@ -1458,22 +1684,22 @@ function x(i) {
   const e = i.trim();
   return /^\+[1-9]\d{1,14}$/.test(e);
 }
-function _e(i) {
+function Ae(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
-  return e.length < ie || e.length > oe ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
+  return e.length < ne || e.length > ae ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
 }
-function R(i, e = 6) {
+function C(i, e = 6) {
   return !i || typeof i != "string" ? !1 : (e === 8 ? /^\d{8}$/ : /^\d{6}$/).test(i);
 }
-function Ee(i) {
+function Ce(i) {
   if (!i || typeof i != "string") return null;
   const e = i.toUpperCase().replace(/\s+/g, "");
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
-class Ie {
-  constructor(e, t, r, s, o, a, d, h, g, f, k, A) {
-    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = a, this.createTenantForNewUser = d, this.origin = h, this.url = g, this.sessionCallbacks = f, this.appId = k, this.tokenExchangeConfig = A, this.tokenDeliveryManager = new Y(r), A?.enabled && this.tokenDeliveryManager.setMode(m.BFF), this.initializeSession();
+class Re {
+  constructor(e, t, r, s, o, n, h, d, u, g, f, M = A) {
+    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = h, this.url = d, this.sessionCallbacks = u, this.appId = g, this.platform = M, this.tokenExchangeConfig = f, this.tokenDeliveryManager = new q(r), f?.enabled && this.tokenDeliveryManager.setMode(y.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -1502,7 +1728,7 @@ class Ie {
       return !1;
     try {
       const e = await this.authApi.validateSession();
-      return e.valid ? (this.tokenDeliveryManager.setSessionValid(), e.user && this.subscribeStore.notify(n.SessionRestored, e.user), !0) : (this.tokenDeliveryManager.setSessionInvalid(), !1);
+      return e.valid ? (this.tokenDeliveryManager.setSessionValid(), e.user && this.subscribeStore.notify(a.SessionRestored, e.user), !0) : (this.tokenDeliveryManager.setSessionInvalid(), !1);
     } catch {
       return this.tokenDeliveryManager.setSessionInvalid(), !1;
     }
@@ -1546,9 +1772,9 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if ("username" in e && e.username && !_e(e.username)) {
+    if ("username" in e && e.username && !Ae(e.username)) {
       const s = new Error(
         "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens"
       ), o = {
@@ -1556,7 +1782,7 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
     if ("phone" in e && e.phone && !x(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
@@ -1564,18 +1790,18 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
-    this.subscribeStore.notify(n.SignInStart, { email: e.email });
-    const t = this.deviceService.getDeviceId(), r = b.web;
+    this.subscribeStore.notify(a.SignInStart, { email: e.email });
+    const t = this.deviceService.getDeviceId(), r = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes;
     try {
       const s = await this.authApi.signIn(e, t, r);
-      return "requires_2fa" in s && s.requires_2fa === !0 || "tfa_token" in s && s.tfa_token ? (this.subscribeStore.notify(n.TwoFactorRequired, {
+      return "requires_2fa" in s && s.requires_2fa === !0 || "tfa_token" in s && s.tfa_token ? (this.subscribeStore.notify(a.TwoFactorRequired, {
         email: e.email || "",
         challengeId: s.challenge_id || "",
         tfaToken: s.tfa_token || ""
-      }), s) : (await this.processAuthResponse(s, e.scopes), this.subscribeStore.notify(n.SignIn, {
+      }), s) : (await this.processAuthResponse(s, e.scopes), this.subscribeStore.notify(a.SignIn, {
         tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), s);
@@ -1583,9 +1809,9 @@ class Ie {
       const o = {
         message: s instanceof Error ? s.message : "Sign in failed",
         originalError: s,
-        code: s instanceof u ? s.id : void 0
+        code: s instanceof l ? s.id : void 0
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
   }
   async signUp(e) {
@@ -1595,7 +1821,7 @@ class Ie {
         originalError: t,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(n.Error, r), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
     if (e.user.phone_number && !x(e.user.phone_number)) {
       const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), r = {
@@ -1603,12 +1829,12 @@ class Ie {
         originalError: t,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(n.Error, r), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
-    this.subscribeStore.notify(n.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
+    this.subscribeStore.notify(a.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
       const t = await this.authApi.signUp(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(n.Register, {
+      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(a.Register, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -1616,9 +1842,9 @@ class Ie {
       const r = {
         message: t instanceof Error ? t.message : "Sign up failed",
         originalError: t,
-        code: t instanceof u ? t.id : void 0
+        code: t instanceof l ? t.id : void 0
       };
-      throw this.subscribeStore.notify(n.Error, r), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   async passwordlessSignIn(e) {
@@ -1628,7 +1854,7 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
     if (e.phone && !x(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
@@ -1636,26 +1862,26 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
-    this.subscribeStore.notify(n.SignInStart, { email: e.email }), e.scopes = e.scopes ?? this.scopes;
-    const t = this.deviceService.getDeviceId(), r = b.web;
+    this.subscribeStore.notify(a.SignInStart, { email: e.email }), e.scopes = e.scopes ?? this.scopes;
+    const t = this.deviceService.getDeviceId(), r = this.platform.getDeviceType();
     try {
       return await this.authApi.passwordlessSignIn(e, t, r);
     } catch (s) {
       const o = {
         message: s instanceof Error ? s.message : "Failed to send passwordless sign-in link",
         originalError: s,
-        code: s instanceof u ? s.id : void 0
+        code: s instanceof l ? s.id : void 0
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
   }
   async passwordlessSignInComplete(e) {
-    this.subscribeStore.notify(n.SignInStart, {}), e.scopes = e.scopes ?? this.scopes, e.device = this.deviceService.getDeviceId();
+    this.subscribeStore.notify(a.SignInStart, {}), e.scopes = e.scopes ?? this.scopes, e.device = this.deviceService.getDeviceId();
     try {
       const t = await this.authApi.passwordlessSignInComplete(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(n.SignIn, {
+      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(a.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -1663,9 +1889,9 @@ class Ie {
       const r = {
         message: t instanceof Error ? t.message : "Passwordless sign in failed",
         originalError: t,
-        code: t instanceof u ? t.id : void 0
+        code: t instanceof l ? t.id : void 0
       };
-      throw this.subscribeStore.notify(n.Error, r), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   async logOut() {
@@ -1679,17 +1905,17 @@ class Ie {
       } catch {
       }
     else {
-      const e = this.storageManager.getToken(p.refresh_token), t = this.storageManager.getDeviceId();
+      const e = this.storageManager.getToken(k.refresh_token), t = this.storageManager.getDeviceId();
       try {
         if ((await this.authApi.logOut(t, e, !this.appId)).status !== "ok")
           throw new Error("Logout failed");
       } catch {
       }
     }
-    this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(n.SignOut, {});
+    this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(a.SignOut, {});
   }
   async refreshToken() {
-    if (this.subscribeStore.notify(n.RefreshStart, {}), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.refreshUrl)
+    if (this.subscribeStore.notify(a.RefreshStart, {}), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.refreshUrl)
       try {
         const r = await fetch(this.tokenExchangeConfig.refreshUrl, {
           method: "POST",
@@ -1699,33 +1925,33 @@ class Ie {
         if (!r.ok)
           throw this.tokenDeliveryManager.setSessionInvalid(), new Error("BFF token refresh failed");
         const s = await r.json();
-        return this.tokenDeliveryManager.setSessionValid(), s.id_token && this.storageManager.setIdToken(s.id_token), this.subscribeStore.notify(n.Refresh, {
+        return this.tokenDeliveryManager.setSessionValid(), s.id_token && this.storageManager.setIdToken(s.id_token), this.subscribeStore.notify(a.Refresh, {
           tokens: s,
           parsedTokens: this.tokenCacheService.getParsedTokens()
-        }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, s;
+        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, s;
       } catch (r) {
         this.tokenDeliveryManager.setSessionInvalid();
         const s = {
           message: r instanceof Error ? r.message : "Token refresh failed",
           originalError: r
         };
-        throw this.subscribeStore.notify(n.Error, s), r;
+        throw this.subscribeStore.notify(a.Error, s), r;
       }
     if (this.tokenDeliveryManager.isCookieMode())
       try {
         const r = await this.authApi.refreshToken("", this.scopes);
-        return this.tokenDeliveryManager.setSessionValid(), await this.processAuthResponse(r, this.scopes), this.subscribeStore.notify(n.Refresh, {
+        return this.tokenDeliveryManager.setSessionValid(), await this.processAuthResponse(r, this.scopes), this.subscribeStore.notify(a.Refresh, {
           tokens: r,
           parsedTokens: this.tokenCacheService.getParsedTokens()
-        }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, r;
+        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, r;
       } catch (r) {
         this.tokenDeliveryManager.setSessionInvalid();
         const s = {
           message: r instanceof Error ? r.message : "Token refresh failed",
           originalError: r,
-          code: r instanceof u ? r.id : void 0
+          code: r instanceof l ? r.id : void 0
         };
-        throw this.subscribeStore.notify(n.Error, s), r;
+        throw this.subscribeStore.notify(a.Error, s), r;
       }
     const e = this.storageManager.getTokens();
     if (e) {
@@ -1734,35 +1960,35 @@ class Ie {
           message: "No refresh token found",
           originalError: r
         };
-        throw this.subscribeStore.notify(n.Error, s), r;
+        throw this.subscribeStore.notify(a.Error, s), r;
       }
     } else {
       const r = new Error("No tokens found"), s = {
         message: "No tokens found",
         originalError: r
       };
-      throw this.subscribeStore.notify(n.Error, s), r;
+      throw this.subscribeStore.notify(a.Error, s), r;
     }
     const t = e?.scopes ?? this.scopes;
     try {
       const r = await this.authApi.refreshToken(e?.refresh_token ?? "", t, e?.access_token);
-      return r.scopes = t, this.storageManager.saveTokens(r), this.tokenCacheService.setTokensCache(r), this.subscribeStore.notify(n.Refresh, {
+      return r.scopes = t, this.storageManager.saveTokens(r), this.tokenCacheService.setTokensCache(r), this.subscribeStore.notify(a.Refresh, {
         tokens: r,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, this.tokenCacheService.startTokenCheck(), r;
+      }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, this.tokenCacheService.startTokenCheck(), r;
     } catch (r) {
       const s = {
         message: r instanceof Error ? r.message : "Token refresh failed",
         originalError: r,
-        code: r instanceof u ? r.id : void 0,
+        code: r instanceof l ? r.id : void 0,
         details: F.isAxiosError(r) && r.response ? {
           status: r.response.status,
           data: r.response.data
         } : void 0
       };
-      this.subscribeStore.notify(n.Error, s);
+      this.subscribeStore.notify(a.Error, s);
       const o = F.isAxiosError(r) && r.response?.status && r.response.status >= 400 && r.response.status < 500;
-      throw o && (this.tokenCacheService.tokenExpiredFlag = !0, this.tokenCacheService.setTokensCache(void 0), this.storageManager.deleteTokens(), this.subscribeStore.notify(n.SessionExpired, { reason: "refresh_failed" })), r instanceof u ? r : o ? new Error(`Getting unknown error message from server with code:${r.response?.status}`) : r;
+      throw o && (this.tokenCacheService.tokenExpiredFlag = !0, this.tokenCacheService.setTokensCache(void 0), this.storageManager.deleteTokens(), this.subscribeStore.notify(a.SessionExpired, { reason: "refresh_failed" })), r instanceof l ? r : o ? new Error(`Getting unknown error message from server with code:${r.response?.status}`) : r;
     }
   }
   async sendPasswordResetEmail(e) {
@@ -1772,81 +1998,83 @@ class Ie {
       const r = {
         message: t instanceof Error ? t.message : "Failed to send password reset email",
         originalError: t,
-        code: t instanceof u ? t.id : void 0
+        code: t instanceof l ? t.id : void 0
       };
-      throw this.subscribeStore.notify(n.Error, r), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   async resetPassword(e, t) {
-    this.subscribeStore.notify(n.SignInStart, {});
-    const s = new URLSearchParams(window.location.search).get("token") ?? void 0, o = t ?? this.scopes;
+    this.subscribeStore.notify(a.SignInStart, {});
+    const s = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("token") ?? void 0, o = t ?? this.scopes;
     try {
-      const a = await this.authApi.resetPassword(e, o, s);
-      return await this.processAuthResponse(a, o), this.subscribeStore.notify(n.SignIn, {
-        tokens: a,
+      const n = await this.authApi.resetPassword(e, o, s);
+      return await this.processAuthResponse(n, o), this.subscribeStore.notify(a.SignIn, {
+        tokens: n,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), a;
-    } catch (a) {
-      const d = {
-        message: a instanceof Error ? a.message : "Password reset failed",
-        originalError: a,
-        code: a instanceof u ? a.id : void 0
+      }), await this.submitSessionCheck(), n;
+    } catch (n) {
+      const h = {
+        message: n instanceof Error ? n.message : "Password reset failed",
+        originalError: n,
+        code: n instanceof l ? n.id : void 0
       };
-      throw this.subscribeStore.notify(n.Error, d), a;
+      throw this.subscribeStore.notify(a.Error, h), n;
     }
   }
   async passkeyRegister(e) {
-    this.subscribeStore.notify(n.RegisterStart, {});
-    const t = this.deviceService.getDeviceId(), r = b.web;
+    if (!this.platform.passkeys) throw new Error("Passkeys are not supported on this platform");
+    this.subscribeStore.notify(a.RegisterStart, {});
+    const t = this.deviceService.getDeviceId(), r = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
       const { challenge_id: s, publicKey: o } = await this.authApi.passkeyRegisterStart(e, t, r, !this.appId);
-      o.user.id = btoa(o.user.id);
-      const a = await K({
-        optionsJSON: o
-      }), d = await this.authApi.passkeyRegisterComplete(
-        a,
+      o.user.id = this.platform.btoa(o.user.id);
+      const n = await this.platform.passkeys.startRegistration(o);
+      if (!n) throw new Error("Passkey registration was not completed");
+      const h = await this.authApi.passkeyRegisterComplete(
+        n,
         t,
         s,
         !this.appId
       );
-      return await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(n.Register, {
-        tokens: d,
+      return await this.processAuthResponse(h, e.scopes), this.subscribeStore.notify(a.Register, {
+        tokens: h,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), d;
+      }), await this.submitSessionCheck(), h;
     } catch (s) {
       const o = {
         message: s instanceof Error ? s.message : "Passkey registration failed",
         originalError: s,
-        code: s instanceof u ? s.id : void 0
+        code: s instanceof l ? s.id : void 0
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
   }
   async passkeyAuthenticate(e) {
-    this.subscribeStore.notify(n.SignInStart, {});
-    const t = this.deviceService.getDeviceId(), r = b.web;
+    if (!this.platform.passkeys) throw new Error("Passkeys are not supported on this platform");
+    this.subscribeStore.notify(a.SignInStart, {});
+    const t = this.deviceService.getDeviceId(), r = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const { challenge_id: s, publicKey: o } = await this.authApi.passkeyAuthenticateStart(e, t, r, !this.appId), a = await j({
-        optionsJSON: o
-      }), d = await this.authApi.passkeyAuthenticateComplete(
-        a,
+      const { challenge_id: s, publicKey: o } = await this.authApi.passkeyAuthenticateStart(e, t, r, !this.appId), n = await this.platform.passkeys.startAuthentication(o);
+      if (!n) throw new Error("Passkey authentication was not completed");
+      const h = await this.authApi.passkeyAuthenticateComplete(
+        n,
         t,
         s,
         !this.appId
       );
-      return "access_token" in d && (await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(n.SignIn, {
-        tokens: d,
+      return "access_token" in h && (await this.processAuthResponse(h, e.scopes), this.subscribeStore.notify(a.SignIn, {
+        tokens: h,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck()), d;
+      }), await this.submitSessionCheck()), h;
     } catch (s) {
       const o = {
         message: s instanceof Error ? s.message : "Passkey authentication failed",
         originalError: s,
-        code: s instanceof u ? s.id : void 0
+        code: s instanceof l ? s.id : void 0
       };
-      throw this.subscribeStore.notify(n.Error, o), s;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
   }
   createFederatedAuthUrl(e) {
@@ -1854,92 +2082,73 @@ class Ie {
     if (!this.appId) throw new Error("AppId is required for federated auth");
     const s = {
       scopes: (e.scopes ?? this.scopes).join(" "),
-      redirect_url: e.redirect_url ?? this.origin,
+      redirect_url: e.redirect_url ?? this.platform.getCurrentUrl()?.origin ?? "",
       appId: this.appId,
       ...e.invite_token ? { invite_token: e.invite_token } : {},
       ...e.create_tenant ? { create_tenant: e.create_tenant.toString() } : {},
       ...e.device ? { device: e.device } : {}
-    }, o = new URL(t, this.url), a = new URLSearchParams(s);
-    return o.search = a.toString(), o.toString();
+    }, o = new URL(t, this.url), n = new URLSearchParams(s);
+    return o.search = n.toString(), o.toString();
   }
-  federatedAuthWithPopup(e) {
-    this.subscribeStore.notify(n.SignInStart, { provider: e.provider });
-    const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r }), o = window.open(s, "_blank", `width=${ee},height=${te}`);
-    if (!o) {
-      this.federatedAuthWithRedirect(e);
-      return;
+  async federatedAuthWithPopup(e) {
+    this.subscribeStore.notify(a.SignInStart, { provider: e.provider });
+    const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r });
+    try {
+      const o = await this.platform.openAuthUrl(s, {
+        mode: "popup",
+        expectedReturnOrigin: this.platform.getCurrentUrl()?.origin ?? ""
+      }), n = new URLSearchParams(o.callbackSearch), h = n.get("access_token") || "", d = n.get("refresh_token") || "", u = n.get("id_token") || "", g = {
+        access_token: h,
+        refresh_token: d || void 0,
+        id_token: u || void 0,
+        scopes: t
+      };
+      await this.processAuthResponse(g, t), this.subscribeStore.notify(a.SignIn, {
+        tokens: g,
+        parsedTokens: this.tokenCacheService.getParsedTokens()
+      }), this.platform.navigateTo(this.platform.getCurrentUrl()?.origin ?? "");
+    } catch (o) {
+      const n = {
+        message: o instanceof Error ? o.message : "Authentication failed",
+        code: o instanceof Y ? "POPUP_CLOSED" : "AUTH_FAILED",
+        originalError: o
+      };
+      this.subscribeStore.notify(a.Error, n);
     }
-    const a = Date.now(), d = setInterval(() => {
-      if (o.closed) {
-        clearInterval(d);
-        const h = {
-          message: "Authentication popup was closed",
-          code: "POPUP_CLOSED"
-        };
-        this.subscribeStore.notify(n.Error, h);
-        return;
-      }
-      if (Date.now() - a > se) {
-        clearInterval(d), o.close();
-        const h = {
-          message: "Authentication popup timed out",
-          code: "POPUP_TIMEOUT"
-        };
-        this.subscribeStore.notify(n.Error, h);
-        return;
-      }
-      try {
-        if (o.location.href.startsWith(this.origin)) {
-          const h = new URLSearchParams(o.location.search), g = h.get("access_token") || "", f = h.get("refresh_token") || "", k = h.get("id_token") || "", A = {
-            access_token: g,
-            refresh_token: f || void 0,
-            id_token: k || void 0,
-            scopes: t
-          };
-          this.processAuthResponse(A, t).then(() => {
-            this.subscribeStore.notify(n.SignIn, {
-              tokens: A,
-              parsedTokens: this.tokenCacheService.getParsedTokens()
-            }), window.location.href = `${this.origin}`;
-          }), clearInterval(d), o.close();
-        }
-      } catch {
-      }
-    }, re);
   }
   federatedAuthWithRedirect(e) {
-    this.subscribeStore.notify(n.SignInStart, { provider: e.provider });
+    this.subscribeStore.notify(a.SignInStart, { provider: e.provider });
     const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r });
-    window.location.href = s;
+    this.platform.navigateTo(s);
   }
   // Helper methods for authentication UI redirect
   authRedirectUrl(e = {}) {
     try {
-      const { url: t, redirectUrl: r, scopes: s, appId: o } = e ?? {}, a = new URL(t ?? this.url);
-      a.pathname = (a.pathname.endsWith("/") ? a.pathname : a.pathname + "/") + "web";
-      const d = s ?? this.scopes, h = {
+      const { url: t, redirectUrl: r, scopes: s, appId: o } = e ?? {}, n = new URL(t ?? this.url);
+      n.pathname = (n.pathname.endsWith("/") ? n.pathname : n.pathname + "/") + "web";
+      const h = s ?? this.scopes, d = {
         appId: o ?? this.appId ?? "",
-        redirectto: r ?? window.location.href,
-        scopes: d.join(",")
-      }, g = new URLSearchParams(h);
-      return a.search = g.toString(), a.toString();
+        redirectto: r ?? this.platform.getCurrentUrl()?.href ?? "",
+        scopes: h.join(",")
+      }, u = new URLSearchParams(d);
+      return n.search = u.toString(), n.toString();
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to create auth redirect URL",
         originalError: t
       };
-      throw this.subscribeStore.notify(n.Error, r), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   authRedirect(e = {}) {
     try {
-      window.location.href = this.authRedirectUrl(e);
+      this.platform.navigateTo(this.authRedirectUrl(e));
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to redirect to auth page",
         originalError: t
       };
-      throw this.subscribeStore.notify(n.Error, r), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   /**
@@ -1958,7 +2167,7 @@ class Ie {
         message: t instanceof Error ? t.message : "Failed to check authentication status",
         originalError: t
       };
-      return this.subscribeStore.notify(n.Error, r), !1;
+      return this.subscribeStore.notify(a.Error, r), !1;
     }
   }
   /**
@@ -1970,10 +2179,10 @@ class Ie {
       t = await this.getTokens(e), r = this.tokenCacheService.getParsedTokens();
     } catch (s) {
       const o = {
-        message: s instanceof Error || s instanceof u ? s.message : "Session check failed",
+        message: s instanceof Error || s instanceof l ? s.message : "Session check failed",
         originalError: s
       };
-      this.subscribeStore.notify(n.Error, o), t = void 0;
+      this.subscribeStore.notify(a.Error, o), t = void 0;
     }
     return t && this.sessionCallbacks.createSession && await this.sessionCallbacks.createSession({ tokens: t, parsedTokens: r }), !t && this.sessionCallbacks.expiredSession && await this.sessionCallbacks.expiredSession(), t;
   }
@@ -1990,19 +2199,19 @@ class Ie {
       }
       const t = this.storageManager.getTokens();
       if (!t || !t.access_token) return;
-      const r = v(t.access_token);
+      const r = m(t.access_token);
       return S(r) ? e ? await this.refreshToken() : void 0 : t;
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to get tokens",
         originalError: t
       };
-      this.subscribeStore.notify(n.Error, r);
+      this.subscribeStore.notify(a.Error, r);
       return;
     }
   }
 }
-class be {
+class Fe {
   constructor(e) {
     this.invitationApi = e;
   }
@@ -2047,7 +2256,7 @@ class be {
     return this.invitationApi.getInvitationLink(e);
   }
 }
-class Ae {
+class Me {
   error(e, ...t) {
     console.error(e, ...t);
   }
@@ -2061,40 +2270,40 @@ class Ae {
     console.debug(e, ...t);
   }
 }
-function Ce() {
-  return new Ae();
+function De() {
+  return new Me();
 }
-class Re {
+class Pe {
   constructor(e) {
     this.data = this.normalize(e);
   }
   normalize(e) {
     const t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), o = [];
-    return e.groups?.forEach((a) => {
-      r.set(a.id, {
-        id: a.id,
-        name: a.name,
-        default: a.default ?? !1,
-        updated_at: a.updated_at,
-        created_at: a.created_at
+    return e.groups?.forEach((n) => {
+      r.set(n.id, {
+        id: n.id,
+        name: n.name,
+        default: n.default ?? !1,
+        updated_at: n.updated_at,
+        created_at: n.created_at
       });
-    }), e.roles?.forEach((a) => {
-      s.set(a.id, {
-        id: a.id,
-        tenant_id: a.tenant_id,
-        name: a.name
+    }), e.roles?.forEach((n) => {
+      s.set(n.id, {
+        id: n.id,
+        tenant_id: n.tenant_id,
+        name: n.name
       });
-    }), e.users_in_groups?.forEach((a) => {
-      const d = a.user;
-      d && !t.has(d.id) && t.set(d.id, {
-        id: d.id,
-        name: d.name ?? null,
-        email: d.email ?? null,
-        phone: d.phone ?? null
-      }), d && a.group_id && r.has(a.group_id) && o.push({
-        userId: d.id,
-        groupId: a.group_id,
-        roleIds: a.roles?.map((h) => h.id) ?? []
+    }), e.users_in_groups?.forEach((n) => {
+      const h = n.user;
+      h && !t.has(h.id) && t.set(h.id, {
+        id: h.id,
+        name: h.name ?? null,
+        email: h.email ?? null,
+        phone: h.phone ?? null
+      }), h && n.group_id && r.has(n.group_id) && o.push({
+        userId: h.id,
+        groupId: n.group_id,
+        roleIds: n.roles?.map((d) => d.id) ?? []
       });
     }), {
       tenant_id: e.tenant_id,
@@ -2134,9 +2343,9 @@ class Re {
     return this.data;
   }
 }
-class Me {
+class xe {
   constructor(e, t, r) {
-    this.tenantApi = e, this.scopes = t, this.logger = r || Ce();
+    this.tenantApi = e, this.scopes = t, this.logger = r || De();
   }
   /**
    * Handle Passflow API errors
@@ -2206,7 +2415,7 @@ class Me {
   async getTenantUserMembership(e) {
     try {
       const t = await this.tenantApi.getTenantDetails(e);
-      return new Re(t);
+      return new Pe(t);
     } catch (t) {
       this.handlePassflowError(t, `Get tenant user membership failed for tenant ID ${e}`);
     }
@@ -2504,77 +2713,72 @@ class Me {
     }
   }
 }
-class Fe {
-  constructor(e, t, r) {
-    this.storageManager = e, this.authApi = t, this.subscribeStore = r, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.visibilityChangeHandler = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupPageUnloadHandler();
+class Ue {
+  constructor(e, t, r, s = A) {
+    this.storageManager = e, this.authApi = t, this.subscribeStore = r, this.platform = s, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.unsubscribeForeground = null, this.unsubscribeUnload = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupLifecycleListeners();
   }
   initialize() {
     try {
       const e = this.storageManager.getTokens();
-      if (!e) {
-        this.startTokenCheck();
+      if (!e)
         return;
-      }
       if (!e.access_token) {
         this.setTokensCache(e), this.startTokenCheck();
         return;
       }
-      const t = v(e.access_token);
-      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
+      const t = m(e.access_token);
+      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
         originalError: e
       };
-      this.subscribeStore.notify(n.Error, t), this.setTokensCache(void 0);
+      this.subscribeStore.notify(a.Error, t), this.setTokensCache(void 0);
     }
   }
   async refreshTokensCache(e) {
     if (!this.isRefreshing)
       try {
-        this.isRefreshing = !0, this.subscribeStore.notify(n.RefreshStart, {});
+        this.isRefreshing = !0, this.subscribeStore.notify(a.RefreshStart, {});
         const t = await this.authApi.refreshToken(e?.refresh_token ?? "", e.scopes ?? [], e.access_token);
-        this.setTokensCache(t), this.subscribeStore.notify(n.Refresh, { tokens: t, parsedTokens: this.getParsedTokens() }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenExpiredFlag = !1, this.startTokenCheck();
+        this.setTokensCache(t), this.subscribeStore.notify(a.Refresh, { tokens: t, parsedTokens: this.getParsedTokens() }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenExpiredFlag = !1, this.startTokenCheck();
       } catch (t) {
         const r = {
           message: t instanceof Error ? t.message : "Failed to get tokens",
           originalError: t
         };
-        this.subscribeStore.notify(n.Error, r), this.tokenExpiredFlag = !0, this.setTokensCache(void 0), this.stopTokenCheck(), this.storageManager.deleteTokens(), this.subscribeStore.notify(n.SessionExpired, { reason: "refresh_failed" });
+        this.subscribeStore.notify(a.Error, r), this.tokenExpiredFlag = !0, this.setTokensCache(void 0), this.stopTokenCheck(), this.storageManager.deleteTokens(), this.subscribeStore.notify(a.SessionExpired, { reason: "refresh_failed" });
       } finally {
         this.isRefreshing = !1;
       }
   }
   startTokenCheck() {
-    this.checkInterval && clearInterval(this.checkInterval), !this.tokenExpiredFlag && (this.setupVisibilityListener(), this.checkInterval = setInterval(() => {
-      typeof document < "u" && document.hidden || this.isRefreshing || this.tokenExpiredFlag || this.isExpired() && !this.tokenExpiredFlag && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
+    this.checkInterval && clearInterval(this.checkInterval), !this.tokenExpiredFlag && (this.setupLifecycleListeners(), this.checkInterval = setInterval(() => {
+      this.platform.isInForeground() && (this.isRefreshing || this.tokenExpiredFlag || this.isExpired() && !this.tokenExpiredFlag && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck()));
     }, this.CHECK_INTERVAL));
   }
-  setupVisibilityListener() {
-    typeof document > "u" || (this.visibilityChangeHandler && document.removeEventListener("visibilitychange", this.visibilityChangeHandler), this.visibilityChangeHandler = () => {
-      !document.hidden && this.checkInterval && !this.isRefreshing && !this.tokenExpiredFlag && this.isExpired() && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
-    }, document.addEventListener("visibilitychange", this.visibilityChangeHandler));
-  }
-  setupPageUnloadHandler() {
-    typeof window > "u" || window.addEventListener("beforeunload", () => {
+  setupLifecycleListeners() {
+    this.unsubscribeForeground && (this.unsubscribeForeground(), this.unsubscribeForeground = null), this.unsubscribeForeground = this.platform.onForeground(() => {
+      this.checkInterval && !this.isRefreshing && !this.tokenExpiredFlag && this.isExpired() && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
+    }), this.unsubscribeUnload || (this.unsubscribeUnload = this.platform.onBeforeUnload(() => {
       this.destroy();
-    });
+    }));
   }
   stopTokenCheck() {
-    this.checkInterval && (clearInterval(this.checkInterval), this.checkInterval = null), this.visibilityChangeHandler && typeof document < "u" && (document.removeEventListener("visibilitychange", this.visibilityChangeHandler), this.visibilityChangeHandler = null);
+    this.checkInterval && (clearInterval(this.checkInterval), this.checkInterval = null), this.unsubscribeForeground && (this.unsubscribeForeground(), this.unsubscribeForeground = null);
   }
   /**
    * Cleanup method to stop all intervals and remove event listeners.
    * Should be called when the service is no longer needed.
    */
   destroy() {
-    this.stopTokenCheck();
+    this.stopTokenCheck(), this.unsubscribeUnload && (this.unsubscribeUnload(), this.unsubscribeUnload = null);
   }
   setTokensCache(e) {
     this.tokensCache = e, e ? this.parsedTokensCache = {
-      access_token: e.access_token ? v(e.access_token) : void 0,
-      id_token: e.id_token ? v(e.id_token) : void 0,
-      refresh_token: e.refresh_token ? v(e.refresh_token) : void 0,
+      access_token: e.access_token ? m(e.access_token) : void 0,
+      id_token: e.id_token ? m(e.id_token) : void 0,
+      refresh_token: e.refresh_token ? m(e.refresh_token) : void 0,
       scopes: e.scopes
     } : this.parsedTokensCache = void 0;
   }
@@ -2586,14 +2790,14 @@ class Fe {
       if (!this.tokensCache) return this.tokensCache;
       if (!this.tokensCache.access_token)
         return this.tokensCache;
-      const e = v(this.tokensCache.access_token);
+      const e = m(this.tokensCache.access_token);
       return S(e) && !this.tokenExpiredFlag ? (await this.refreshTokensCache(this.tokensCache), this.tokensCache) : this.tokensCache;
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
         originalError: e
       };
-      this.subscribeStore.notify(n.Error, t);
+      this.subscribeStore.notify(a.Error, t);
       return;
     }
   }
@@ -2604,22 +2808,22 @@ class Fe {
     if (!this.tokensCache) return !0;
     if (!this.tokensCache.access_token)
       return !1;
-    const e = v(this.tokensCache.access_token);
+    const e = m(this.tokensCache.access_token);
     return S(e);
   }
 }
-class De {
+class $e {
   constructor(e, t) {
     this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
     const r = {
       onAuthChange: (s, o) => {
-        if (s === n.TwoFactorRequired) {
-          const a = o;
-          this.setPartialAuthState(a.email, a.challengeId, a.tfaToken);
+        if (s === a.TwoFactorRequired) {
+          const n = o;
+          this.setPartialAuthState(n.email, n.challengeId, n.tfaToken);
         }
       }
     };
-    this.subscribeStore.subscribe(r, [n.TwoFactorRequired]);
+    this.subscribeStore.subscribe(r, [a.TwoFactorRequired]);
   }
   /**
    * Emit error event and throw the error
@@ -2631,7 +2835,7 @@ class De {
       originalError: e,
       code: r?.id || void 0
     };
-    throw this.subscribeStore.notify(n.Error, s), e;
+    throw this.subscribeStore.notify(a.Error, s), e;
   }
   /**
    * Get 2FA enrollment status for current user
@@ -2651,7 +2855,7 @@ class De {
   async beginSetup() {
     try {
       const e = await this.twoFactorApi.beginSetup();
-      return e.totp_digits && (this.totpDigits = e.totp_digits), this.subscribeStore.notify(n.TwoFactorSetupStarted, { secret: e.secret }), e;
+      return e.totp_digits && (this.totpDigits = e.totp_digits), this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: e.secret }), e;
     } catch (e) {
       this.emitErrorAndThrow(e, "Begin 2FA setup");
     }
@@ -2661,11 +2865,11 @@ class De {
    * Returns recovery codes that MUST be displayed to user
    */
   async confirmSetup(e) {
-    if (!R(e, this.totpDigits))
+    if (!C(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.confirmSetup({ code: e });
-      return this.subscribeStore.notify(n.TwoFactorEnabled, {
+      return this.subscribeStore.notify(a.TwoFactorEnabled, {
         recoveryCodes: t.recovery_codes,
         clearRecoveryCodes: () => {
           t.recovery_codes.length = 0;
@@ -2680,7 +2884,7 @@ class De {
    * Completes authentication if successful
    */
   async verify(e) {
-    if (!R(e, this.totpDigits))
+    if (!C(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     if (this.recoverPartialAuthState(), !this.isVerificationRequired())
       throw new Error("2FA verification expired or not required. User must sign in first.");
@@ -2691,7 +2895,7 @@ class De {
         code: e,
         tfa_token: this.partialAuthState.tfaToken
       });
-      return this.clearPartialAuthState(), this.subscribeStore.notify(n.TwoFactorVerified, { tokens: t }), t;
+      return this.clearPartialAuthState(), this.subscribeStore.notify(a.TwoFactorVerified, { tokens: t }), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Verify 2FA code");
     }
@@ -2702,7 +2906,7 @@ class De {
    */
   async useRecoveryCode(e) {
     try {
-      const t = Ee(e);
+      const t = Ce(e);
       if (!t)
         throw new Error("Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).");
       if (this.recoverPartialAuthState(), !this.isVerificationRequired())
@@ -2713,13 +2917,13 @@ class De {
         recovery_code: t,
         tfa_token: this.partialAuthState.tfaToken
       });
-      return this.clearPartialAuthState(), r.remaining_recovery_codes === 0 ? this.subscribeStore.notify(n.TwoFactorRecoveryCodesExhausted, { tokens: r }) : r.remaining_recovery_codes <= 2 && this.subscribeStore.notify(n.TwoFactorRecoveryCodesLow, {
+      return this.clearPartialAuthState(), r.remaining_recovery_codes === 0 ? this.subscribeStore.notify(a.TwoFactorRecoveryCodesExhausted, { tokens: r }) : r.remaining_recovery_codes <= 2 && this.subscribeStore.notify(a.TwoFactorRecoveryCodesLow, {
         tokens: r,
         remainingCodes: r.remaining_recovery_codes
-      }), this.subscribeStore.notify(n.TwoFactorRecoveryUsed, {
+      }), this.subscribeStore.notify(a.TwoFactorRecoveryUsed, {
         tokens: r,
         remainingCodes: r.remaining_recovery_codes
-      }), this.subscribeStore.notify(n.TwoFactorVerified, { tokens: r }), r;
+      }), this.subscribeStore.notify(a.TwoFactorVerified, { tokens: r }), r;
     } catch (t) {
       this.emitErrorAndThrow(t, "Use recovery code");
     }
@@ -2728,11 +2932,11 @@ class De {
    * Disable 2FA (requires TOTP verification)
    */
   async disable(e) {
-    if (!R(e, this.totpDigits))
+    if (!C(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.disable({ code: e });
-      return this.subscribeStore.notify(n.TwoFactorDisabled, {}), t;
+      return this.subscribeStore.notify(a.TwoFactorDisabled, {}), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Disable 2FA");
     }
@@ -2741,7 +2945,7 @@ class De {
    * Regenerate recovery codes
    */
   async regenerateRecoveryCodes(e) {
-    if (!R(e, this.totpDigits))
+    if (!C(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.regenerateRecoveryCodes({ code: e }), r = [...t.recovery_codes];
@@ -2832,12 +3036,12 @@ class De {
       scope: "2fa_setup",
       timestamp: Date.now(),
       expiresAt: Date.now() + (t.expiresIn || 3600) * 1e3
-    }, this.subscribeStore.notify(n.TwoFactorSetupMagicLinkValidated, {
+    }, this.subscribeStore.notify(a.TwoFactorSetupMagicLinkValidated, {
       userId: t.userId,
       appId: t.appId,
       expiresIn: t.expiresIn || 3600,
       sessionToken: t.sessionToken
-    })) : t.error && this.subscribeStore.notify(n.TwoFactorSetupMagicLinkFailed, {
+    })) : t.error && this.subscribeStore.notify(a.TwoFactorSetupMagicLinkFailed, {
       error: t.error
     }), t;
   }
@@ -2908,7 +3112,7 @@ class De {
   async beginMethodSetup(e) {
     try {
       const t = await this.twoFactorApi.beginMethodSetup(e);
-      return this.subscribeStore.notify(n.TwoFactorSetupStarted, { secret: "", method: e }), t;
+      return this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: "", method: e }), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Begin 2FA method setup");
     }
@@ -2919,7 +3123,7 @@ class De {
   async confirmMethodSetup(e, t) {
     try {
       const r = await this.twoFactorApi.confirmMethodSetup(e, t);
-      return this.subscribeStore.notify(n.TwoFactorEnabled, {
+      return this.subscribeStore.notify(a.TwoFactorEnabled, {
         recoveryCodes: [],
         clearRecoveryCodes: () => {
         }
@@ -2944,7 +3148,7 @@ class De {
   async requestChallenge(e) {
     try {
       const t = await this.twoFactorApi.requestChallenge(e);
-      return this.subscribeStore.notify(n.TwoFactorChallengeReceived, {
+      return this.subscribeStore.notify(a.TwoFactorChallengeReceived, {
         challengeId: t.challenge_id,
         method: t.method,
         alternativeMethods: t.alternative_methods
@@ -2959,12 +3163,12 @@ class De {
   async verifyV2(e) {
     try {
       const t = await this.twoFactorApi.verifyV2(e);
-      return t.success && (this.subscribeStore.notify(n.TwoFactorVerified, {
+      return t.success && (this.subscribeStore.notify(a.TwoFactorVerified, {
         tokens: {
           access_token: t.access_token,
           refresh_token: t.refresh_token
         }
-      }), t.device_trusted && this.subscribeStore.notify(n.TwoFactorDeviceTrusted, {})), t;
+      }), t.device_trusted && this.subscribeStore.notify(a.TwoFactorDeviceTrusted, {})), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Verify 2FA challenge");
     }
@@ -2975,7 +3179,7 @@ class De {
   async switchToAlternative(e) {
     try {
       const t = await this.twoFactorApi.switchToAlternative(e);
-      return this.subscribeStore.notify(n.TwoFactorMethodSwitched, {
+      return this.subscribeStore.notify(a.TwoFactorMethodSwitched, {
         challengeId: t.challenge_id,
         method: t.method,
         alternativeMethods: t.alternative_methods
@@ -3005,9 +3209,9 @@ class De {
     }
   }
 }
-class Pe {
-  constructor(e, t) {
-    this.userAPI = e, this.deviceService = t;
+class Oe {
+  constructor(e, t, r = A) {
+    this.userAPI = e, this.deviceService = t, this.platform = r;
   }
   /**
    * Get user's registered passkeys
@@ -3043,31 +3247,34 @@ class Pe {
     passkeyUsername: t,
     passkeyDisplayName: r
   } = {}) {
-    const s = this.deviceService.getDeviceId(), o = b.web, { challenge_id: a, publicKey: d } = await this.userAPI.addUserPasskeyStart({
-      relyingPartyId: e || window?.location?.hostname,
+    if (!this.platform.passkeys) throw new Error("Passkeys are not supported on this platform");
+    const s = this.deviceService.getDeviceId(), o = this.platform.getDeviceType(), { challenge_id: n, publicKey: h } = await this.userAPI.addUserPasskeyStart({
+      relyingPartyId: (e || this.platform.getCurrentUrl()?.hostname) ?? "",
       deviceId: s,
       os: o,
       passkeyDisplayName: r,
       passkeyUsername: t
     });
-    d.user.id = btoa(d.user.id);
-    const h = await K({ optionsJSON: d });
-    return await this.userAPI.addUserPasskeyComplete(h, s, a);
+    h.user.id = this.platform.btoa(h.user.id);
+    const d = await this.platform.passkeys.startRegistration(h);
+    if (!d) throw new Error("Passkey registration was not completed");
+    return await this.userAPI.addUserPasskeyComplete(d, s, n);
   }
 }
 const O = class O {
   constructor(e) {
-    this.doRefreshTokens = !1, this.origin = window.location.origin, this.session = async ({
+    this.doRefreshTokens = !1, this.session = async ({
       createSession: o,
-      expiredSession: a,
-      doRefresh: d = !1
+      expiredSession: n,
+      doRefresh: h = !1
     }) => {
-      this.createSessionCallback = o, this.expiredSessionCallback = a, this.doRefreshTokens = d, await this.submitSessionCheck();
+      this.createSessionCallback = o, this.expiredSessionCallback = n, this.doRefreshTokens = h, await this.submitSessionCheck();
     };
     const { url: t, appId: r, scopes: s } = e;
-    this.url = t || V, this.appId = r, this.storageManager = new $({
-      prefix: e.keyStoragePrefix ?? ""
-    }), this.deviceService = new B(this.storageManager), this.authApi = new fe(e, this.storageManager, this.deviceService), this.appApi = new pe(e, this.storageManager, this.deviceService), this.userApi = new Se(e, this.storageManager, this.deviceService), this.settingApi = new ve(e, this.storageManager, this.deviceService), this.tenantApi = new ye(e, this.storageManager, this.deviceService), this.invitationApi = new ke(e, this.storageManager, this.deviceService), this.twoFactorApi = new me(e, this.storageManager, this.deviceService), this.subscribeStore = new we(), this.tokenCacheService = new Fe(this.storageManager, this.authApi, this.subscribeStore), this.scopes = s ?? Q, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ie(
+    this.url = t || K, this.appId = r, this.platform = e.platform ?? A, this.storageManager = new $({
+      prefix: e.keyStoragePrefix ?? "",
+      storage: this.platform.storage
+    }), this.deviceService = new B(this.storageManager), this.authApi = new ye(e, this.storageManager, this.deviceService), this.appApi = new ve(e, this.storageManager, this.deviceService), this.userApi = new _e(e, this.storageManager, this.deviceService), this.settingApi = new we(e, this.storageManager, this.deviceService), this.tenantApi = new Te(e, this.storageManager, this.deviceService), this.invitationApi = new Se(e, this.storageManager, this.deviceService), this.twoFactorApi = new Ee(e, this.storageManager, this.deviceService), this.subscribeStore = new Ie(), this.tokenCacheService = new Ue(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = s ?? te, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Re(
       this.authApi,
       this.deviceService,
       this.storageManager,
@@ -3075,15 +3282,18 @@ const O = class O {
       this.tokenCacheService,
       this.scopes,
       this.createTenantForNewUser,
-      this.origin,
       this.url,
       {
         createSession: this.createSessionCallback,
         expiredSession: this.expiredSessionCallback
       },
       this.appId ?? "",
-      e.tokenExchange
-    ), this.userService = new Pe(this.userApi, this.deviceService), this.tenantService = new Me(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new be(this.invitationApi), this.twoFactorService = new De(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
+      e.tokenExchange,
+      this.platform
+    ), this.userService = new Oe(this.userApi, this.deviceService, this.platform), this.tenantService = new xe(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Fe(this.invitationApi), this.twoFactorService = new $e(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
+  }
+  get origin() {
+    return this.platform.getCurrentUrl()?.origin ?? "";
   }
   /**
    * Update the appId and propagate it to all API clients.
@@ -3106,10 +3316,10 @@ const O = class O {
       e = await this.authService.getTokens(this.doRefreshTokens), t = this.tokenCacheService.getParsedTokens();
     } catch (r) {
       const s = {
-        message: r instanceof Error || r instanceof u ? r.message : "Session check failed",
+        message: r instanceof Error || r instanceof l ? r.message : "Session check failed",
         originalError: r
       };
-      this.subscribeStore.notify(n.Error, s), e = void 0;
+      this.subscribeStore.notify(a.Error, s), e = void 0;
     }
     e && this.createSessionCallback && await this.createSessionCallback({ tokens: e, parsedTokens: t }), !e && this.expiredSessionCallback && await this.expiredSessionCallback();
   }
@@ -3182,61 +3392,64 @@ const O = class O {
     return this.checkAndSetTokens();
   }
   checkAndSetTokens() {
-    let e = new URLSearchParams(window.location.search), t = !1;
-    if (!e.get("access_token") && window.location.hash) {
-      const h = new URLSearchParams(window.location.hash.substring(1));
-      h.get("access_token") && (e = h, t = !0);
+    const e = this.platform.getCurrentUrl();
+    let t = new URLSearchParams(e?.search ?? ""), r = !1;
+    if (!t.get("access_token") && e?.hash) {
+      const u = new URLSearchParams(e.hash.substring(1));
+      u.get("access_token") && (t = u, r = !0);
     }
-    const r = e.get("access_token"), s = e.get("refresh_token"), o = e.get("id_token"), a = e.get("scopes")?.split(",") ?? this.scopes;
+    const s = t.get("access_token"), o = t.get("refresh_token"), n = t.get("id_token"), h = t.get("scopes")?.split(",") ?? this.scopes;
     let d;
-    if (r) {
-      if (!D(r)) {
-        const h = {
+    if (s) {
+      if (!D(s)) {
+        const u = {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(a.Error, u), this.cleanupUrlParams(r, e);
         return;
       }
-      if (s && !D(s)) {
-        const h = {
+      if (o && !D(o)) {
+        const u = {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(a.Error, u), this.cleanupUrlParams(r, e);
         return;
       }
-      if (o && !D(o)) {
-        const h = {
+      if (n && !D(n)) {
+        const u = {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(a.Error, u), this.cleanupUrlParams(r, e);
         return;
       }
       return d = {
-        access_token: r,
-        refresh_token: s ?? void 0,
-        id_token: o ?? void 0,
-        scopes: a
-      }, this.storageManager.clearDeliveryMode(), this.storageManager.saveTokens(d), this.tokenCacheService.setTokensCache(d), this.subscribeStore.notify(n.SignIn, { tokens: d, parsedTokens: this.getParsedTokens() }), this.submitSessionCheck(), this.cleanupUrlParams(t), this.error = void 0, d;
+        access_token: s,
+        refresh_token: o ?? void 0,
+        id_token: n ?? void 0,
+        scopes: h
+      }, this.storageManager.clearDeliveryMode(), this.storageManager.saveTokens(d), this.tokenCacheService.setTokensCache(d), this.subscribeStore.notify(a.SignIn, { tokens: d, parsedTokens: this.getParsedTokens() }), this.submitSessionCheck(), this.cleanupUrlParams(r, e), this.error = void 0, d;
     } else
       this.error = this.checkErrorsFromURL();
   }
   checkErrorsFromURL() {
-    const t = new URLSearchParams(window.location.search).get("error");
+    const t = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("error");
     if (t) {
-      const r = Te(t);
+      const r = be(t);
       return new Error(r);
     }
   }
-  cleanupUrlParams(e = !1) {
-    if (e)
-      window.history.replaceState({}, document.title, window.location.pathname + window.location.search);
-    else {
-      const t = new URLSearchParams(window.location.search);
-      t.delete("access_token"), t.delete("refresh_token"), t.delete("id_token"), t.delete("client_challenge"), t.size > 0 ? window.history.replaceState({}, document.title, `${window.location.pathname}?${t.toString()}`) : window.history.replaceState({}, document.title, window.location.pathname);
-    }
+  cleanupUrlParams(e = !1, t = null) {
+    const r = t ?? this.platform.getCurrentUrl();
+    if (r)
+      if (e)
+        this.platform.replaceUrl(r.pathname + r.search);
+      else {
+        const s = new URLSearchParams(r.search);
+        s.delete("access_token"), s.delete("refresh_token"), s.delete("id_token"), s.delete("client_challenge"), s.size > 0 ? this.platform.replaceUrl(`${r.pathname}?${s.toString()}`) : this.platform.replaceUrl(r.pathname);
+      }
   }
   setTokensToCacheFromLocalStorage() {
     let e = this.storageManager.getTokens();
@@ -3452,9 +3665,9 @@ const O = class O {
     const r = {
       message: e instanceof Error ? e.message : `${t} failed`,
       originalError: e,
-      code: e instanceof u ? e.id : void 0
+      code: e instanceof l ? e.id : void 0
     };
-    throw this.subscribeStore.notify(n.Error, r), e;
+    throw this.subscribeStore.notify(a.Error, r), e;
   }
   /**
    * Sign out the current user and clear all tokens.
@@ -3475,7 +3688,7 @@ const O = class O {
    */
   async logOut() {
     try {
-      await this.authService.logOut(), this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.twoFactorService.clearPartialAuthState(), await this.submitSessionCheck(), this.subscribeStore.notify(n.SignOut, {});
+      await this.authService.logOut(), this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.twoFactorService.clearPartialAuthState(), await this.submitSessionCheck(), this.subscribeStore.notify(a.SignOut, {});
     } catch (e) {
       this.handleError(e, "Log out");
     }
@@ -3545,13 +3758,13 @@ const O = class O {
    * ```
    */
   reset(e) {
-    if (this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.subscribeStore.notify(n.SignOut, {}), e) {
+    if (this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.subscribeStore.notify(a.SignOut, {}), e) {
       this.error = new Error(e);
       const t = {
         message: e,
         code: "RESET_ERROR"
       };
-      throw this.subscribeStore.notify(n.Error, t), this.error;
+      throw this.subscribeStore.notify(a.Error, t), this.error;
     }
   }
   /**
@@ -3578,7 +3791,7 @@ const O = class O {
     try {
       return await this.authService.refreshToken();
     } catch (e) {
-      throw e instanceof u || this.subscribeStore.notify(n.Error, {
+      throw e instanceof l || this.subscribeStore.notify(a.Error, {
         message: "Failed to refresh token",
         originalError: e
       }), e;
@@ -3783,7 +3996,7 @@ const O = class O {
    * ```
    */
   setTokens(e) {
-    this.storageManager.saveTokens(e), this.tokenCacheService.setTokensCache(e), this.subscribeStore.notify(n.SignIn, {
+    this.storageManager.saveTokens(e), this.tokenCacheService.setTokensCache(e), this.subscribeStore.notify(a.SignIn, {
       tokens: e,
       parsedTokens: this.tokenCacheService.getParsedTokens()
     });
@@ -4219,7 +4432,7 @@ const O = class O {
   async verifyTwoFactor(e) {
     try {
       const t = await this.twoFactorService.verify(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(n.SignIn, {
+      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(a.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -4246,7 +4459,7 @@ const O = class O {
   async useTwoFactorRecoveryCode(e) {
     try {
       const t = await this.twoFactorService.useRecoveryCode(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(n.SignIn, {
+      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(a.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -4408,20 +4621,20 @@ const O = class O {
     this.twoFactorService.clearMagicLinkSession();
   }
 };
-O.version = Z;
+O.version = ee;
 let L = O;
-class l extends Error {
+class p extends Error {
   constructor(e) {
-    super(e.message), this.name = "M2MError", this.code = e.code, this.status = e.status ?? 400, this.errorUri = e.errorUri, this.rateLimitInfo = e.rateLimitInfo, this.headers = e.headers, this.cause = e.cause, this.timestamp = (/* @__PURE__ */ new Date()).toISOString(), Error.captureStackTrace && Error.captureStackTrace(this, l);
+    super(e.message), this.name = "M2MError", this.code = e.code, this.status = e.status ?? 400, this.errorUri = e.errorUri, this.rateLimitInfo = e.rateLimitInfo, this.headers = e.headers, this.cause = e.cause, this.timestamp = (/* @__PURE__ */ new Date()).toISOString(), Error.captureStackTrace && Error.captureStackTrace(this, p);
   }
   /**
    * Create an M2MError from an OAuth 2.0 error response
    */
   static fromOAuthError(e, t, r) {
-    const s = r ? l.parseRateLimitHeaders(r) : void 0;
-    return new l({
+    const s = r ? p.parseRateLimitHeaders(r) : void 0;
+    return new p({
       code: e.error,
-      message: e.error_description ?? l.getDefaultMessage(e.error),
+      message: e.error_description ?? p.getDefaultMessage(e.error),
       status: t,
       errorUri: e.error_uri,
       rateLimitInfo: s,
@@ -4432,7 +4645,7 @@ class l extends Error {
    * Create an M2MError from a network or other error
    */
   static fromError(e, t = "server_error") {
-    return new l({
+    return new p({
       code: t,
       message: e.message || "An unexpected error occurred",
       status: 500,
@@ -4505,7 +4718,7 @@ class l extends Error {
     return this.status && (e += ` (HTTP ${this.status})`), e;
   }
 }
-class N extends l {
+class N extends p {
   constructor(e, t) {
     super({
       code: "temporarily_unavailable",
@@ -4515,7 +4728,7 @@ class N extends l {
     }), this.name = "M2MNetworkError";
   }
 }
-class M extends l {
+class R extends p {
   constructor(e, t) {
     super({
       code: "invalid_request",
@@ -4525,7 +4738,7 @@ class M extends l {
     }), this.name = "M2MTokenParseError";
   }
 }
-class U extends l {
+class U extends p {
   constructor(e) {
     super({
       code: "invalid_request",
@@ -4534,7 +4747,7 @@ class U extends l {
     }), this.name = "M2MConfigError";
   }
 }
-const Ge = {
+const He = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -4558,7 +4771,7 @@ const Ge = {
   /** Content-Type for token requests */
   CONTENT_TYPE: "application/x-www-form-urlencoded"
 };
-class xe {
+class Le {
   constructor() {
     this.cache = /* @__PURE__ */ new Map();
   }
@@ -4576,7 +4789,7 @@ class xe {
     return this.cache.delete(e), Promise.resolve();
   }
 }
-const Ue = {
+const Ne = {
   shouldRetry(i, e) {
     return e >= 3 ? !1 : i.code === "server_error" || i.code === "temporarily_unavailable" || i.code === "rate_limit_exceeded" || i.status !== void 0 && i.status >= 500;
   },
@@ -4584,7 +4797,7 @@ const Ue = {
     return Math.pow(2, i - 1) * 1e3;
   }
 };
-class qe {
+class ze {
   /**
    * Create a new M2M client
    *
@@ -4624,7 +4837,7 @@ class qe {
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new xe(), this.retryStrategy = e.retryStrategy ?? Ue, this.tokenEndpoint = `${t}${T.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new Le(), this.retryStrategy = e.retryStrategy ?? Ne, this.tokenEndpoint = `${t}${T.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
@@ -4722,29 +4935,29 @@ class qe {
         signal: r.signal
       });
       clearTimeout(s);
-      const a = {};
-      o.headers.forEach((h, g) => {
-        a[g.toLowerCase()] = h;
+      const n = {};
+      o.headers.forEach((d, u) => {
+        n[u.toLowerCase()] = d;
       });
-      const d = await o.json();
+      const h = await o.json();
       if (!o.ok) {
-        const h = l.fromOAuthError(
+        const d = p.fromOAuthError(
           {
-            error: d.error || "server_error",
-            error_description: d.error_description || d.message,
-            error_uri: d.error_uri
+            error: h.error || "server_error",
+            error_description: h.error_description || h.message,
+            error_uri: h.error_uri
           },
           o.status,
-          a
+          n
         );
         throw this.config.onError && this.config.onError({
-          error: h.code,
-          error_description: h.message
-        }), h;
+          error: d.code,
+          error_description: d.message
+        }), d;
       }
-      return d;
+      return h;
     } catch (o) {
-      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new N(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new N(`Network error: ${o.message}`, o) : o instanceof l ? o : l.fromError(o instanceof Error ? o : new Error(String(o)));
+      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new N(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new N(`Network error: ${o.message}`, o) : o instanceof p ? o : p.fromError(o instanceof Error ? o : new Error(String(o)));
     }
   }
   /**
@@ -4756,7 +4969,7 @@ class qe {
       try {
         return await e();
       } catch (s) {
-        if (!(s instanceof l))
+        if (!(s instanceof p))
           throw s;
         if (t = s, r < this.config.retries && this.retryStrategy.shouldRetry({ code: s.code, status: s.status }, r)) {
           const o = this.retryStrategy.getDelay(r);
@@ -4765,7 +4978,7 @@ class qe {
         }
         throw s;
       }
-    throw t ?? new l({ code: "server_error", message: "Request failed after retries" });
+    throw t ?? new p({ code: "server_error", message: "Request failed after retries" });
   }
   /**
    * Sleep for a given duration
@@ -4839,14 +5052,14 @@ class qe {
     try {
       const t = e.split(".");
       if (t.length !== 3)
-        throw new M("Invalid JWT format: expected 3 parts");
+        throw new R("Invalid JWT format: expected 3 parts");
       const r = t[1];
       if (!r)
-        throw new M("Invalid JWT format: missing payload");
+        throw new R("Invalid JWT format: missing payload");
       const s = atob(r.replace(/-/g, "+").replace(/_/g, "/")), o = JSON.parse(s);
       return o.scopes && typeof o.scopes == "string" ? o.scopes = o.scopes.split(" ") : o.scopes || (o.scopes = []), o;
     } catch (t) {
-      throw t instanceof M ? t : new M(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
+      throw t instanceof R ? t : new R(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
     }
   }
   /**
@@ -4893,7 +5106,7 @@ class qe {
       });
       if (!s.ok && s.status !== 200) {
         const o = await s.json().catch(() => ({}));
-        throw l.fromOAuthError(
+        throw p.fromOAuthError(
           {
             error: o.error || "server_error",
             error_description: o.error_description || "Token revocation failed"
@@ -4903,7 +5116,7 @@ class qe {
       }
       this.clearCache();
     } catch (s) {
-      throw s instanceof l ? s : l.fromError(s instanceof Error ? s : new Error(String(s)));
+      throw s instanceof p ? s : p.fromError(s instanceof Error ? s : new Error(String(s)));
     }
   }
   /**
@@ -4932,64 +5145,68 @@ class qe {
   }
 }
 export {
-  C as APP_ID_HEADER_KEY,
+  b as APP_ID_HEADER_KEY,
   I as AUTHORIZATION_HEADER_KEY,
-  pe as AppAPI,
-  fe as AuthAPI,
-  Ie as AuthService,
-  Ve as CLIAuthAPI,
-  Ke as DEFAULT_GROUP_NAME,
-  Q as DEFAULT_SCOPES,
-  W as DEVICE_ID_HEADER_KEY,
-  J as DEVICE_TYPE_HEADER_KEY,
-  ne as ERROR_MESSAGE_MAX_LENGTH,
-  ke as InvitationAPI,
-  be as InvitationService,
-  qe as M2MClient,
+  ve as AppAPI,
+  ye as AuthAPI,
+  Re as AuthService,
+  je as CLIAuthAPI,
+  Be as DEFAULT_GROUP_NAME,
+  te as DEFAULT_SCOPES,
+  Z as DEVICE_ID_HEADER_KEY,
+  Q as DEVICE_TYPE_HEADER_KEY,
+  ce as ERROR_MESSAGE_MAX_LENGTH,
+  Se as InvitationAPI,
+  Fe as InvitationService,
+  ze as M2MClient,
   U as M2MConfigError,
-  l as M2MError,
-  Ge as M2MErrorCodes,
+  p as M2MError,
+  He as M2MErrorCodes,
   N as M2MNetworkError,
-  M as M2MTokenParseError,
+  R as M2MTokenParseError,
   T as M2M_DEFAULTS,
-  Ne as MINIMAL_DEFAULT_SCOPES,
-  b as OS,
-  V as PASSFLOW_CLOUD_URL,
-  te as POPUP_HEIGHT,
-  re as POPUP_POLL_INTERVAL_MS,
-  se as POPUP_TIMEOUT_MS,
-  ee as POPUP_WIDTH,
+  qe as MINIMAL_DEFAULT_SCOPES,
+  ge as OS,
+  K as PASSFLOW_CLOUD_URL,
+  se as POPUP_HEIGHT,
+  ie as POPUP_POLL_INTERVAL_MS,
+  oe as POPUP_TIMEOUT_MS,
+  re as POPUP_WIDTH,
   L as Passflow,
-  _ as PassflowAdminEndpointPaths,
+  E as PassflowAdminEndpointPaths,
   c as PassflowEndpointPaths,
-  u as PassflowError,
-  n as PassflowEvent,
-  de as Providers,
-  E as RequestMethod,
-  Z as SDK_VERSION,
-  q as SessionState,
-  ve as SettingAPI,
+  l as PassflowError,
+  a as PassflowEvent,
+  Y as PopupClosedError,
+  pe as Providers,
+  _ as RequestMethod,
+  ee as SDK_VERSION,
+  V as SessionState,
+  we as SettingAPI,
   G as TOKEN_EXPIRY_BUFFER_SECONDS,
-  ye as TenantAPI,
-  Me as TenantService,
-  Re as TenantUserMembership,
-  Fe as TokenCacheService,
-  m as TokenDeliveryMode,
-  p as TokenType,
-  me as TwoFactorApiClient,
-  ue as TwoFactorPolicy,
-  De as TwoFactorService,
-  oe as USERNAME_MAX_LENGTH,
-  ie as USERNAME_MIN_LENGTH,
-  Se as UserAPI,
-  Pe as UserService,
+  Te as TenantAPI,
+  xe as TenantService,
+  Pe as TenantUserMembership,
+  Ue as TokenCacheService,
+  y as TokenDeliveryMode,
+  k as TokenType,
+  Ee as TwoFactorApiClient,
+  fe as TwoFactorPolicy,
+  $e as TwoFactorService,
+  ae as USERNAME_MAX_LENGTH,
+  ne as USERNAME_MIN_LENGTH,
+  _e as UserAPI,
+  Oe as UserService,
+  le as WebAdapter,
+  Ye as getOSFromDeviceType,
   S as isTokenExpired,
   P as isValidEmail,
   D as isValidJWTFormat,
   x as isValidPhoneNumber,
-  _e as isValidUsername,
-  v as parseToken,
-  y as pathWithParams,
-  Te as sanitizeErrorMessage
+  Ae as isValidUsername,
+  m as parseToken,
+  v as pathWithParams,
+  be as sanitizeErrorMessage,
+  A as webAdapter
 };
 //# sourceMappingURL=index.mjs.map