@passflow/core 0.13.3 → 0.14.0

package/dist/index.mjs

@@ -1,9 +1,9 @@
 import F from "axios";
-import { v4 as H } from "uuid";
-import { startAuthentication as z, startRegistration as X } from "@simplewebauthn/browser";
-const W = "0.13.3", J = {
-  version: W
-}, b = "X-Passflow-Clientid", I = "Authorization", Z = "X-Passflow-DeviceId", Q = "X-Passflow-DeviceType", ee = J.version, qe = ["id", "offline", "openid"], te = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], K = "https://auth.passflow.cloud", Be = "default", re = 500, se = 600, ie = 100, oe = 6e4, G = 30, ne = 3, ae = 30, ce = 200, he = (i) => {
+import { v4 as X } from "uuid";
+import { startAuthentication as W, startRegistration as J } from "@simplewebauthn/browser";
+const Z = "0.14.0", Q = {
+  version: Z
+}, b = "X-Passflow-Clientid", I = "Authorization", ee = "X-Passflow-DeviceId", te = "X-Passflow-DeviceType", re = Q.version, Qe = ["id", "offline", "openid"], se = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], G = "https://auth.passflow.cloud", et = "default", ie = 500, oe = 600, ne = 100, ae = 6e4, V = 30, ce = 3, he = 30, de = 200, ue = (i) => {
   const e = [];
   let t;
   for (t in i) {
@@ -18,14 +18,14 @@ const W = "0.13.3", J = {
   }
   return { raw: i, tenants: e };
 };
-function de(i) {
+function le(i) {
   if (typeof window < "u" && typeof window.atob == "function")
     return window.atob(i);
   if (typeof Buffer < "u")
     return Buffer.from(i, "base64").toString("utf-8");
   throw new Error("No Base64 decoding method available in this environment");
 }
-class ue {
+class pe {
   constructor(e) {
     this.storageManager = e;
   }
@@ -39,7 +39,7 @@ class ue {
     const t = this.storageManager.getToken(e);
     if (!t) return !0;
     const r = m(t);
-    return r ? S(r) : !0;
+    return r ? y(r) : !0;
   }
   /**
    * Parse token from storage by type.
@@ -54,19 +54,19 @@ class ue {
       return m(t);
   }
 }
-function S(i, e = G) {
+function y(i, e = V) {
   return Math.floor(Date.now() / 1e3) + e > i.exp;
 }
 function m(i) {
   const e = i.split(".")[1];
   if (!e) throw new Error("Invalid token string");
-  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = de(r), o = decodeURIComponent(
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = le(r), o = decodeURIComponent(
     s.split("").map((h) => "%" + ("00" + h.charCodeAt(0).toString(16)).slice(-2)).join("")
   ), n = JSON.parse(o);
-  return n.membership = n.passflow_tm && n.type !== "invite" ? he(n.passflow_tm) : void 0, n;
+  return n.membership = n.passflow_tm && n.type !== "invite" ? ue(n.passflow_tm) : void 0, n;
 }
-var k = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(k || {}), y = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(y || {}), V = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(V || {});
-class q {
+var k = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(k || {}), v = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(v || {}), q = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(q || {});
+class B {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
   }
@@ -166,7 +166,7 @@ class q {
   loadPersistedMode() {
     try {
       const e = this.storageManager.storage.getItem(this.DELIVERY_MODE_KEY);
-      e && Object.values(y).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
+      e && Object.values(v).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
     } catch {
     }
   }
@@ -176,7 +176,7 @@ class q {
   loadPersistedSessionState() {
     try {
       const e = this.storageManager.storage.getItem(this.SESSION_STATE_KEY);
-      e && Object.values(V).includes(e) && (this.sessionState = e);
+      e && Object.values(q).includes(e) && (this.sessionState = e);
     } catch {
     }
   }
@@ -228,7 +228,7 @@ class $ {
    */
   saveTokens(e, t) {
     const { id_token: r, access_token: s, refresh_token: o, scopes: n } = e;
-    t === y.Cookie || t === y.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(k.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(k.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(k.refresh_token), o), n && this.storage.setItem(this.scopes, n.join(",")));
+    t === v.Cookie || t === v.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(k.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(k.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(k.refresh_token), o), n && this.storage.setItem(this.scopes, n.join(",")));
   }
   getToken(e) {
     const t = this.getKeyForTokenType(e);
@@ -241,7 +241,7 @@ class $ {
    */
   getTokens() {
     const e = this.getDeliveryMode();
-    if (e === y.Cookie || e === y.BFF) {
+    if (e === v.Cookie || e === v.BFF) {
       const r = this.storage.getItem(this.ID_TOKEN_KEY);
       return r ? {
         id_token: r
@@ -324,7 +324,7 @@ class $ {
   getDeliveryMode() {
     try {
       const e = this.storage.getItem(this.DELIVERY_MODE_KEY);
-      if (e && Object.values(y).includes(e))
+      if (e && Object.values(v).includes(e))
         return e;
     } catch {
     }
@@ -400,7 +400,7 @@ class $ {
     return `${this.keyStoragePrefix}${e}`;
   }
 }
-class B {
+class Y {
   constructor(e) {
     this.storageManager = e ?? new $();
   }
@@ -413,19 +413,19 @@ class B {
     return e;
   }
   generateUniqueDeviceId() {
-    return H();
+    return X();
   }
 }
-class Y extends Error {
+class j extends Error {
   constructor(e = "Authentication popup was closed") {
     super(e), this.name = "PopupClosedError";
   }
 }
-class le {
+class ge {
   constructor() {
     this.passkeys = {
-      startRegistration: (e) => X({ optionsJSON: e }),
-      startAuthentication: (e) => z({ optionsJSON: e })
+      startRegistration: (e) => J({ optionsJSON: e }),
+      startAuthentication: (e) => W({ optionsJSON: e })
     };
   }
   // ----------------------------------------------------------------
@@ -557,25 +557,25 @@ class le {
           'openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.'
         )
       );
-    const s = t.width ?? re, o = t.height ?? se, n = t.expectedReturnOrigin ?? window.location.origin, h = window.open(e, "_blank", `width=${s},height=${o}`);
+    const s = t.width ?? ie, o = t.height ?? oe, n = t.expectedReturnOrigin ?? window.location.origin, h = window.open(e, "_blank", `width=${s},height=${o}`);
     return h ? new Promise((d, u) => {
       const g = Date.now(), f = setInterval(() => {
         if (h.closed) {
-          clearInterval(f), u(new Y());
+          clearInterval(f), u(new j());
           return;
         }
-        if (Date.now() - g > oe) {
+        if (Date.now() - g > ae) {
           clearInterval(f), h.close(), u(new Error("Authentication popup timed out"));
           return;
         }
         try {
           if (h.location.href.startsWith(n)) {
-            const M = h.location.search, j = h.location.hash;
-            clearInterval(f), h.close(), d({ callbackSearch: M, callbackHash: j });
+            const M = h.location.search, z = h.location.hash;
+            clearInterval(f), h.close(), d({ callbackSearch: M, callbackHash: z });
           }
         } catch {
         }
-      }, ie);
+      }, ne);
     }) : (window.location.href = e, new Promise(() => {
     }));
   }
@@ -633,43 +633,87 @@ class le {
     return "web";
   }
 }
-const A = new le();
-var _ = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(_ || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorMethodSetupBegin = "/v2/user/2fa/methods/:method/setup/begin", i.TwoFactorMethodSetupConfirm = "/v2/user/2fa/methods/:method/setup/confirm", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), E = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(E || {});
+const A = new ge(), fe = "insufficient_user_authentication", ke = "upgrade_required", L = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, me = (i) => i.replace(/\\(.)/g, "$1"), ve = (i) => {
+  const e = {};
+  L.lastIndex = 0;
+  for (const t of i.matchAll(L)) {
+    const r = t[1];
+    if (!r)
+      continue;
+    const s = t[2], o = t[3];
+    e[r.toLowerCase()] = s !== void 0 ? me(s) : o ?? "";
+  }
+  return e;
+}, H = (i) => {
+  const e = typeof i == "number" ? i : Number.parseInt(String(i ?? ""), 10);
+  return Number.isFinite(e) && e > 0 ? e : void 0;
+}, ye = (i, e) => {
+  if (!i || !/(^|[\s,])Bearer\b/i.test(i))
+    return;
+  const t = ve(i);
+  if (t.error === fe)
+    return {
+      acrValues: t.acr_values || void 0,
+      maxAge: H(t.max_age),
+      status: e
+    };
+}, Se = (i, e) => {
+  if (!i || typeof i != "object")
+    return;
+  const t = i;
+  if (t.error === ke)
+    return {
+      acrValues: typeof t.acr_values == "string" && t.acr_values ? t.acr_values : void 0,
+      maxAge: H(t.max_age),
+      status: e
+    };
+}, we = (i, e, t) => {
+  if (!(i !== 401 && i !== 403))
+    return ye(e("www-authenticate"), i) ?? Se(t, i);
+};
+var E = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(E || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorSetupStart = "/v2/user/2fa/setup/start", i.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), T = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(T || {});
 class l extends Error {
   constructor(e) {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
-var pe = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(pe || {}), ge = /* @__PURE__ */ ((i) => (i.web = "web", i.ios = "ios", i.android = "android", i))(ge || {});
-function Ye(i) {
+var Te = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(Te || {}), _e = /* @__PURE__ */ ((i) => (i.web = "web", i.ios = "ios", i.android = "android", i))(_e || {});
+function tt(i) {
   return i;
 }
-function v(i, e) {
+function _(i, e) {
   let t = i;
   return Object.entries(e).forEach(([r, s]) => {
     t = t.replace(`:${r}`, s);
   }), t;
 }
-var fe = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(fe || {});
-const ke = 3, me = 1e3;
-class w {
+var Ee = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(Ee || {});
+const Ie = 3, be = 1e3, Ae = (i) => we(
+  i.status,
+  (e) => {
+    const t = i.headers?.[e] ?? i.headers?.[e.toLowerCase()];
+    return Array.isArray(t) ? t.join(", ") : t;
+  },
+  i.data
+) !== void 0;
+class S {
   constructor(e, t, r) {
     this.refreshPromise = null, this.isRefreshing = !1, this.defaultHeaders = {
       Accept: "application/json",
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh"];
     const { url: s, appId: o, keyStoragePrefix: n } = e;
-    this._platform = e.platform ?? A, this.url = s || K, this.storageManager = t ?? new $({
+    this._platform = e.platform ?? A, this.url = s || G, this.storageManager = t ?? new $({
       prefix: n ?? ""
-    }), this.deviceService = r ?? new B(this.storageManager), this.tokenService = new ue(this.storageManager), this.tokenDeliveryManager = new q(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
+    }), this.deviceService = r ?? new Y(this.storageManager), this.tokenService = new pe(this.storageManager), this.tokenDeliveryManager = new B(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
       ...this.defaultHeaders,
       [b]: o
     });
     const h = this.deviceService.getDeviceId();
     this.defaultHeaders = {
       ...this.defaultHeaders,
-      [Z]: h,
-      [Q]: this._platform.getDeviceType()
+      [ee]: h,
+      [te]: this._platform.getDeviceType()
     }, this.detectCookieSupport(), this.instance = F.create({
       baseURL: this.url,
       headers: { ...this.defaultHeaders }
@@ -691,7 +735,7 @@ class w {
       const u = this.storageManager.getTokens();
       if (u?.access_token) {
         const g = m(u.access_token);
-        if (S(g, G) && u.refresh_token)
+        if (y(g, V) && u.refresh_token)
           try {
             if (this.refreshPromise) {
               const f = await this.refreshPromise;
@@ -712,7 +756,7 @@ class w {
       return d;
     }), this.instance.interceptors.response.use(
       (d) => d,
-      async (d) => (d.response?.status === 401 && this.tokenDeliveryManager.setSessionInvalid(), d.response?.status === 429 ? await this.handleRateLimitError(d) : this.handleAxiosError(d))
+      async (d) => (d.response?.status === 401 && !Ae(d.response) && this.tokenDeliveryManager.setSessionInvalid(), d.response?.status === 429 ? await this.handleRateLimitError(d) : this.handleAxiosError(d))
     );
   }
   get origin() {
@@ -776,9 +820,9 @@ class w {
     if (!["GET", "HEAD", "OPTIONS"].includes(r || ""))
       return Promise.reject(e);
     const o = t._retryCount || 0;
-    if (o >= ke)
+    if (o >= Ie)
       return Promise.reject(e);
-    let n = me * Math.pow(2, o);
+    let n = be * Math.pow(2, o);
     const h = e.response?.headers?.["retry-after"];
     if (h) {
       const d = Number.parseInt(h, 10);
@@ -819,19 +863,19 @@ class w {
     })).data;
   }
   get(e, t) {
-    return this.send(_.GET, e, t);
+    return this.send(E.GET, e, t);
   }
   post(e, t, r) {
-    return this.send(_.POST, e, { data: t, ...r });
+    return this.send(E.POST, e, { data: t, ...r });
   }
   put(e, t, r) {
-    return this.send(_.PUT, e, { data: t, ...r });
+    return this.send(E.PUT, e, { data: t, ...r });
   }
   patch(e, t, r) {
-    return this.send(_.PATCH, e, { data: t, ...r });
+    return this.send(E.PATCH, e, { data: t, ...r });
   }
   delete(e, t) {
-    return this.send(_.DELETE, e, t);
+    return this.send(E.DELETE, e, t);
   }
   /**
    * Update the appId and propagate it to axios headers.
@@ -846,9 +890,9 @@ class w {
     }, this.instance.defaults.headers.common[b] = e;
   }
 }
-class ve {
+class Ce {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -857,9 +901,9 @@ class ve {
     return this.axiosClient.get(c.appSettings);
   }
 }
-class ye {
+class Re {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -916,7 +960,7 @@ class ye {
     );
   }
   logOut(e, t, r = !1) {
-    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? E.logout : c.logout;
+    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? T.logout : c.logout;
     return this.axiosClient.post(o, s);
   }
   validateSession() {
@@ -946,7 +990,7 @@ class ye {
       create_tenant: o ?? !1,
       device: t,
       os: r
-    }, h = s ? E.passkeyRegisterStart : c.passkeyRegisterStart;
+    }, h = s ? T.passkeyRegisterStart : c.passkeyRegisterStart;
     return this.axiosClient.post(h, n);
   }
   passkeyRegisterComplete(e, t, r, s = !1) {
@@ -954,7 +998,7 @@ class ye {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, n = s ? E.passkeyRegisterComplete : c.passkeyRegisterComplete;
+    }, n = s ? T.passkeyRegisterComplete : c.passkeyRegisterComplete;
     return this.axiosClient.post(n, o);
   }
   passkeyAuthenticateStart(e, t, r, s = !1) {
@@ -963,7 +1007,7 @@ class ye {
       user_id: e.user_id ?? "",
       device: t,
       os: r
-    }, n = s ? E.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
+    }, n = s ? T.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
     return this.axiosClient.post(
       n,
       o
@@ -974,7 +1018,7 @@ class ye {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, n = s ? E.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
+    }, n = s ? T.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
     return this.axiosClient.post(n, o);
   }
   passkeyValidate(e, t, r, s = !1, o) {
@@ -984,29 +1028,29 @@ class ye {
       challenge_id: r
     };
     let h = c.passkeyValidate;
-    !o && s && (h = E.passkeyValidate);
+    !o && s && (h = T.passkeyValidate);
     const d = o ? { [b]: o } : {};
     return this.axiosClient.post(h, n, { headers: d });
   }
 }
-class je {
+class rt {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
   }
   getCLIAuthStatus(e) {
-    const t = v(c.cliAuthStatus, { sessionId: e });
+    const t = _(c.cliAuthStatus, { sessionId: e });
     return this.axiosClient.get(t);
   }
   completeCLIAuth(e) {
     return this.axiosClient.post(c.cliAuthComplete, e);
   }
 }
-class Se {
+class Fe {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1030,7 +1074,7 @@ class Se {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const r = v(c.invitationsPath, {
+    const r = _(c.invitationsPath, {
       tenantID: e.tenantID
     });
     return this.axiosClient.get(r, { params: t }).then((s) => ({
@@ -1044,7 +1088,7 @@ class Se {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = v(c.invitationDelete, {
+    const t = _(c.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -1055,7 +1099,7 @@ class Se {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = v(c.invitationResend, {
+    const t = _(c.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -1066,15 +1110,15 @@ class Se {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = v(c.invitationGetLink, {
+    const t = _(c.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
   }
 }
-class we {
+class Me {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1089,9 +1133,9 @@ class we {
     return this.axiosClient.get(c.settingsPasskey);
   }
 }
-class Te {
+class De {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1322,9 +1366,9 @@ class Te {
     return this.axiosClient.delete(s);
   }
 }
-class Ee {
+class Pe {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1509,27 +1553,34 @@ class Ee {
     return this.axiosClient.get(c.TwoFactorMethodsRegistered);
   }
   /**
-   * Begin 2FA method setup
-   * POST /v2/user/2fa/methods/:method/setup/begin
+   * Start 2FA method setup.
+   * POST /v2/user/2fa/setup/start
+   *
+   * The method travels in the body: at this point it is a parameter of the
+   * request, not the identity of an enrolled resource.
    */
-  beginMethodSetup(e) {
-    const t = v(c.TwoFactorMethodSetupBegin, { method: e });
-    return this.axiosClient.post(t, {});
+  startMethodSetup(e, t) {
+    return this.axiosClient.post(c.TwoFactorSetupStart, {
+      ...t,
+      method: e
+    });
   }
   /**
-   * Confirm 2FA method setup
-   * POST /v2/user/2fa/methods/:method/setup/confirm
+   * Complete 2FA method setup.
+   * POST /v2/user/2fa/setup/complete
    */
-  confirmMethodSetup(e, t) {
-    const r = v(c.TwoFactorMethodSetupConfirm, { method: e });
-    return this.axiosClient.post(r, t);
+  completeMethodSetup(e, t) {
+    return this.axiosClient.post(c.TwoFactorSetupComplete, {
+      ...t,
+      method: e
+    });
   }
   /**
    * Remove registered 2FA method
    * DELETE /v2/user/2fa/methods/:id
    */
   removeMethod(e) {
-    const t = v(c.TwoFactorMethodRemove, { id: e });
+    const t = _(c.TwoFactorMethodRemove, { id: e });
     return this.axiosClient.delete(t);
   }
   /**
@@ -1574,13 +1625,13 @@ class Ee {
    * DELETE /v2/user/2fa/trusted-devices/:id
    */
   revokeTrustedDevice(e) {
-    const t = v(c.TwoFactorTrustedDeviceRevoke, { id: e });
+    const t = _(c.TwoFactorTrustedDeviceRevoke, { id: e });
     return this.axiosClient.delete(t);
   }
 }
-class _e {
+class xe {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1624,7 +1675,7 @@ class _e {
   }
 }
 var a = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.SessionExpired = "session:expired", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(a || {});
-class Ie {
+class Ue {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
   }
@@ -1671,8 +1722,8 @@ function D(i) {
   const t = /^[A-Za-z0-9_-]+$/;
   return e.every((r) => t.test(r) && r.length > 0);
 }
-function be(i) {
-  return i.replace(/<[^>]*>/g, "").substring(0, ce);
+function $e(i) {
+  return i.replace(/<[^>]*>/g, "").substring(0, de);
 }
 function P(i) {
   if (!i || typeof i != "string") return !1;
@@ -1684,22 +1735,22 @@ function x(i) {
   const e = i.trim();
   return /^\+[1-9]\d{1,14}$/.test(e);
 }
-function Ae(i) {
+function Oe(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
-  return e.length < ne || e.length > ae ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
+  return e.length < ce || e.length > he ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
 }
 function C(i, e = 6) {
   return !i || typeof i != "string" ? !1 : (e === 8 ? /^\d{8}$/ : /^\d{6}$/).test(i);
 }
-function Ce(i) {
+function Le(i) {
   if (!i || typeof i != "string") return null;
   const e = i.toUpperCase().replace(/\s+/g, "");
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
-class Re {
+class Ne {
   constructor(e, t, r, s, o, n, h, d, u, g, f, M = A) {
-    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = h, this.url = d, this.sessionCallbacks = u, this.appId = g, this.platform = M, this.tokenExchangeConfig = f, this.tokenDeliveryManager = new q(r), f?.enabled && this.tokenDeliveryManager.setMode(y.BFF), this.initializeSession();
+    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = h, this.url = d, this.sessionCallbacks = u, this.appId = g, this.platform = M, this.tokenExchangeConfig = f, this.tokenDeliveryManager = new B(r), f?.enabled && this.tokenDeliveryManager.setMode(v.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -1774,7 +1825,7 @@ class Re {
       };
       throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if ("username" in e && e.username && !Ae(e.username)) {
+    if ("username" in e && e.username && !Oe(e.username)) {
       const s = new Error(
         "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens"
       ), o = {
@@ -2110,7 +2161,7 @@ class Re {
     } catch (o) {
       const n = {
         message: o instanceof Error ? o.message : "Authentication failed",
-        code: o instanceof Y ? "POPUP_CLOSED" : "AUTH_FAILED",
+        code: o instanceof j ? "POPUP_CLOSED" : "AUTH_FAILED",
         originalError: o
       };
       this.subscribeStore.notify(a.Error, n);
@@ -2161,7 +2212,7 @@ class Re {
         const t = !!e?.id_token || !!this.storageManager.getIdToken(), r = this.tokenDeliveryManager.isSessionValid(), s = this.tokenDeliveryManager.isSessionUnknown();
         return t && (r || s);
       }
-      return !e || !e.access_token ? !1 : !S(e.access_token) || e.refresh_token !== void 0 && !S(e.refresh_token);
+      return !e || !e.access_token ? !1 : !y(e.access_token) || e.refresh_token !== void 0 && !y(e.refresh_token);
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to check authentication status",
@@ -2200,7 +2251,7 @@ class Re {
       const t = this.storageManager.getTokens();
       if (!t || !t.access_token) return;
       const r = m(t.access_token);
-      return S(r) ? e ? await this.refreshToken() : void 0 : t;
+      return y(r) ? e ? await this.refreshToken() : void 0 : t;
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to get tokens",
@@ -2211,7 +2262,7 @@ class Re {
     }
   }
 }
-class Fe {
+class Ke {
   constructor(e) {
     this.invitationApi = e;
   }
@@ -2256,7 +2307,7 @@ class Fe {
     return this.invitationApi.getInvitationLink(e);
   }
 }
-class Me {
+class Ge {
   error(e, ...t) {
     console.error(e, ...t);
   }
@@ -2270,10 +2321,10 @@ class Me {
     console.debug(e, ...t);
   }
 }
-function De() {
-  return new Me();
+function Ve() {
+  return new Ge();
 }
-class Pe {
+class qe {
   constructor(e) {
     this.data = this.normalize(e);
   }
@@ -2343,9 +2394,9 @@ class Pe {
     return this.data;
   }
 }
-class xe {
+class Be {
   constructor(e, t, r) {
-    this.tenantApi = e, this.scopes = t, this.logger = r || De();
+    this.tenantApi = e, this.scopes = t, this.logger = r || Ve();
   }
   /**
    * Handle Passflow API errors
@@ -2415,7 +2466,7 @@ class xe {
   async getTenantUserMembership(e) {
     try {
       const t = await this.tenantApi.getTenantDetails(e);
-      return new Pe(t);
+      return new qe(t);
     } catch (t) {
       this.handlePassflowError(t, `Get tenant user membership failed for tenant ID ${e}`);
     }
@@ -2713,7 +2764,7 @@ class xe {
     }
   }
 }
-class Ue {
+class Ye {
   constructor(e, t, r, s = A) {
     this.storageManager = e, this.authApi = t, this.subscribeStore = r, this.platform = s, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.unsubscribeForeground = null, this.unsubscribeUnload = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupLifecycleListeners();
   }
@@ -2727,7 +2778,7 @@ class Ue {
         return;
       }
       const t = m(e.access_token);
-      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
+      y(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
@@ -2791,7 +2842,7 @@ class Ue {
       if (!this.tokensCache.access_token)
         return this.tokensCache;
       const e = m(this.tokensCache.access_token);
-      return S(e) && !this.tokenExpiredFlag ? (await this.refreshTokensCache(this.tokensCache), this.tokensCache) : this.tokensCache;
+      return y(e) && !this.tokenExpiredFlag ? (await this.refreshTokensCache(this.tokensCache), this.tokensCache) : this.tokensCache;
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
@@ -2809,10 +2860,10 @@ class Ue {
     if (!this.tokensCache.access_token)
       return !1;
     const e = m(this.tokensCache.access_token);
-    return S(e);
+    return y(e);
   }
 }
-class $e {
+class je {
   constructor(e, t) {
     this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
     const r = {
@@ -2906,7 +2957,7 @@ class $e {
    */
   async useRecoveryCode(e) {
     try {
-      const t = Ce(e);
+      const t = Le(e);
       if (!t)
         throw new Error("Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).");
       if (this.recoverPartialAuthState(), !this.isVerificationRequired())
@@ -3107,29 +3158,29 @@ class $e {
     }
   }
   /**
-   * Begin 2FA method setup
+   * Start 2FA method setup
    */
-  async beginMethodSetup(e) {
+  async startMethodSetup(e, t) {
     try {
-      const t = await this.twoFactorApi.beginMethodSetup(e);
-      return this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: "", method: e }), t;
-    } catch (t) {
-      this.emitErrorAndThrow(t, "Begin 2FA method setup");
+      const r = await this.twoFactorApi.startMethodSetup(e, t);
+      return this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: "", method: e }), r;
+    } catch (r) {
+      this.emitErrorAndThrow(r, "Start 2FA method setup");
     }
   }
   /**
-   * Confirm 2FA method setup
+   * Complete 2FA method setup
    */
-  async confirmMethodSetup(e, t) {
+  async completeMethodSetup(e, t) {
     try {
-      const r = await this.twoFactorApi.confirmMethodSetup(e, t);
+      const r = await this.twoFactorApi.completeMethodSetup(e, t);
       return this.subscribeStore.notify(a.TwoFactorEnabled, {
         recoveryCodes: [],
         clearRecoveryCodes: () => {
         }
       }), r;
     } catch (r) {
-      this.emitErrorAndThrow(r, "Confirm 2FA method setup");
+      this.emitErrorAndThrow(r, "Complete 2FA method setup");
     }
   }
   /**
@@ -3209,7 +3260,7 @@ class $e {
     }
   }
 }
-class Oe {
+class He {
   constructor(e, t, r = A) {
     this.userAPI = e, this.deviceService = t, this.platform = r;
   }
@@ -3271,10 +3322,10 @@ const O = class O {
       this.createSessionCallback = o, this.expiredSessionCallback = n, this.doRefreshTokens = h, await this.submitSessionCheck();
     };
     const { url: t, appId: r, scopes: s } = e;
-    this.url = t || K, this.appId = r, this.platform = e.platform ?? A, this.storageManager = new $({
+    this.url = t || G, this.appId = r, this.platform = e.platform ?? A, this.storageManager = new $({
       prefix: e.keyStoragePrefix ?? "",
       storage: this.platform.storage
-    }), this.deviceService = new B(this.storageManager), this.authApi = new ye(e, this.storageManager, this.deviceService), this.appApi = new ve(e, this.storageManager, this.deviceService), this.userApi = new _e(e, this.storageManager, this.deviceService), this.settingApi = new we(e, this.storageManager, this.deviceService), this.tenantApi = new Te(e, this.storageManager, this.deviceService), this.invitationApi = new Se(e, this.storageManager, this.deviceService), this.twoFactorApi = new Ee(e, this.storageManager, this.deviceService), this.subscribeStore = new Ie(), this.tokenCacheService = new Ue(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = s ?? te, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Re(
+    }), this.deviceService = new Y(this.storageManager), this.authApi = new Re(e, this.storageManager, this.deviceService), this.appApi = new Ce(e, this.storageManager, this.deviceService), this.userApi = new xe(e, this.storageManager, this.deviceService), this.settingApi = new Me(e, this.storageManager, this.deviceService), this.tenantApi = new De(e, this.storageManager, this.deviceService), this.invitationApi = new Fe(e, this.storageManager, this.deviceService), this.twoFactorApi = new Pe(e, this.storageManager, this.deviceService), this.subscribeStore = new Ue(), this.tokenCacheService = new Ye(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = s ?? se, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ne(
       this.authApi,
       this.deviceService,
       this.storageManager,
@@ -3290,7 +3341,7 @@ const O = class O {
       this.appId ?? "",
       e.tokenExchange,
       this.platform
-    ), this.userService = new Oe(this.userApi, this.deviceService, this.platform), this.tenantService = new xe(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Fe(this.invitationApi), this.twoFactorService = new $e(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
+    ), this.userService = new He(this.userApi, this.deviceService, this.platform), this.tenantService = new Be(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Ke(this.invitationApi), this.twoFactorService = new je(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
   }
   get origin() {
     return this.platform.getCurrentUrl()?.origin ?? "";
@@ -3437,7 +3488,7 @@ const O = class O {
   checkErrorsFromURL() {
     const t = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("error");
     if (t) {
-      const r = be(t);
+      const r = $e(t);
       return new Error(r);
     }
   }
@@ -4621,8 +4672,8 @@ const O = class O {
     this.twoFactorService.clearMagicLinkSession();
   }
 };
-O.version = ee;
-let L = O;
+O.version = re;
+let N = O;
 class p extends Error {
   constructor(e) {
     super(e.message), this.name = "M2MError", this.code = e.code, this.status = e.status ?? 400, this.errorUri = e.errorUri, this.rateLimitInfo = e.rateLimitInfo, this.headers = e.headers, this.cause = e.cause, this.timestamp = (/* @__PURE__ */ new Date()).toISOString(), Error.captureStackTrace && Error.captureStackTrace(this, p);
@@ -4718,7 +4769,7 @@ class p extends Error {
     return this.status && (e += ` (HTTP ${this.status})`), e;
   }
 }
-class N extends p {
+class K extends p {
   constructor(e, t) {
     super({
       code: "temporarily_unavailable",
@@ -4747,7 +4798,7 @@ class U extends p {
     }), this.name = "M2MConfigError";
   }
 }
-const He = {
+const st = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -4757,7 +4808,7 @@ const He = {
   RateLimitExceeded: "rate_limit_exceeded",
   ServerError: "server_error",
   TemporarilyUnavailable: "temporarily_unavailable"
-}, T = {
+}, w = {
   /** Default token endpoint path */
   TOKEN_ENDPOINT: "/oauth2/token",
   /** Default request timeout in milliseconds */
@@ -4771,7 +4822,7 @@ const He = {
   /** Content-Type for token requests */
   CONTENT_TYPE: "application/x-www-form-urlencoded"
 };
-class Le {
+class ze {
   constructor() {
     this.cache = /* @__PURE__ */ new Map();
   }
@@ -4789,7 +4840,7 @@ class Le {
     return this.cache.delete(e), Promise.resolve();
   }
 }
-const Ne = {
+const Xe = {
   shouldRetry(i, e) {
     return e >= 3 ? !1 : i.code === "server_error" || i.code === "temporarily_unavailable" || i.code === "rate_limit_exceeded" || i.status !== void 0 && i.status >= 500;
   },
@@ -4797,7 +4848,7 @@ const Ne = {
     return Math.pow(2, i - 1) * 1e3;
   }
 };
-class ze {
+class it {
   /**
    * Create a new M2M client
    *
@@ -4828,16 +4879,16 @@ class ze {
       scopes: e.scopes,
       audience: e.audience,
       autoRefresh: e.autoRefresh ?? !1,
-      refreshThreshold: e.refreshThreshold ?? T.REFRESH_THRESHOLD,
-      timeout: e.timeout ?? T.TIMEOUT,
-      retries: e.retries ?? T.RETRIES,
-      retryDelay: e.retryDelay ?? T.RETRY_DELAY,
+      refreshThreshold: e.refreshThreshold ?? w.REFRESH_THRESHOLD,
+      timeout: e.timeout ?? w.TIMEOUT,
+      retries: e.retries ?? w.RETRIES,
+      retryDelay: e.retryDelay ?? w.RETRY_DELAY,
       retryStrategy: e.retryStrategy,
       cache: e.cache,
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new Le(), this.retryStrategy = e.retryStrategy ?? Ne, this.tokenEndpoint = `${t}${T.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new ze(), this.retryStrategy = e.retryStrategy ?? Xe, this.tokenEndpoint = `${t}${w.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
@@ -4928,7 +4979,7 @@ class ze {
       const o = await fetch(this.tokenEndpoint, {
         method: "POST",
         headers: {
-          "Content-Type": T.CONTENT_TYPE,
+          "Content-Type": w.CONTENT_TYPE,
           Accept: "application/json"
         },
         body: t.toString(),
@@ -4957,7 +5008,7 @@ class ze {
       }
       return h;
     } catch (o) {
-      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new N(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new N(`Network error: ${o.message}`, o) : o instanceof p ? o : p.fromError(o instanceof Error ? o : new Error(String(o)));
+      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new K(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new K(`Network error: ${o.message}`, o) : o instanceof p ? o : p.fromError(o instanceof Error ? o : new Error(String(o)));
     }
   }
   /**
@@ -5100,7 +5151,7 @@ class ze {
       const s = await fetch(t, {
         method: "POST",
         headers: {
-          "Content-Type": T.CONTENT_TYPE
+          "Content-Type": w.CONTENT_TYPE
         },
         body: r.toString()
       });
@@ -5147,66 +5198,66 @@ class ze {
 export {
   b as APP_ID_HEADER_KEY,
   I as AUTHORIZATION_HEADER_KEY,
-  ve as AppAPI,
-  ye as AuthAPI,
-  Re as AuthService,
-  je as CLIAuthAPI,
-  Be as DEFAULT_GROUP_NAME,
-  te as DEFAULT_SCOPES,
-  Z as DEVICE_ID_HEADER_KEY,
-  Q as DEVICE_TYPE_HEADER_KEY,
-  ce as ERROR_MESSAGE_MAX_LENGTH,
-  Se as InvitationAPI,
-  Fe as InvitationService,
-  ze as M2MClient,
+  Ce as AppAPI,
+  Re as AuthAPI,
+  Ne as AuthService,
+  rt as CLIAuthAPI,
+  et as DEFAULT_GROUP_NAME,
+  se as DEFAULT_SCOPES,
+  ee as DEVICE_ID_HEADER_KEY,
+  te as DEVICE_TYPE_HEADER_KEY,
+  de as ERROR_MESSAGE_MAX_LENGTH,
+  Fe as InvitationAPI,
+  Ke as InvitationService,
+  it as M2MClient,
   U as M2MConfigError,
   p as M2MError,
-  He as M2MErrorCodes,
-  N as M2MNetworkError,
+  st as M2MErrorCodes,
+  K as M2MNetworkError,
   R as M2MTokenParseError,
-  T as M2M_DEFAULTS,
-  qe as MINIMAL_DEFAULT_SCOPES,
-  ge as OS,
-  K as PASSFLOW_CLOUD_URL,
-  se as POPUP_HEIGHT,
-  ie as POPUP_POLL_INTERVAL_MS,
-  oe as POPUP_TIMEOUT_MS,
-  re as POPUP_WIDTH,
-  L as Passflow,
-  E as PassflowAdminEndpointPaths,
+  w as M2M_DEFAULTS,
+  Qe as MINIMAL_DEFAULT_SCOPES,
+  _e as OS,
+  G as PASSFLOW_CLOUD_URL,
+  oe as POPUP_HEIGHT,
+  ne as POPUP_POLL_INTERVAL_MS,
+  ae as POPUP_TIMEOUT_MS,
+  ie as POPUP_WIDTH,
+  N as Passflow,
+  T as PassflowAdminEndpointPaths,
   c as PassflowEndpointPaths,
   l as PassflowError,
   a as PassflowEvent,
-  Y as PopupClosedError,
-  pe as Providers,
-  _ as RequestMethod,
-  ee as SDK_VERSION,
-  V as SessionState,
-  we as SettingAPI,
-  G as TOKEN_EXPIRY_BUFFER_SECONDS,
-  Te as TenantAPI,
-  xe as TenantService,
-  Pe as TenantUserMembership,
-  Ue as TokenCacheService,
-  y as TokenDeliveryMode,
+  j as PopupClosedError,
+  Te as Providers,
+  E as RequestMethod,
+  re as SDK_VERSION,
+  q as SessionState,
+  Me as SettingAPI,
+  V as TOKEN_EXPIRY_BUFFER_SECONDS,
+  De as TenantAPI,
+  Be as TenantService,
+  qe as TenantUserMembership,
+  Ye as TokenCacheService,
+  v as TokenDeliveryMode,
   k as TokenType,
-  Ee as TwoFactorApiClient,
-  fe as TwoFactorPolicy,
-  $e as TwoFactorService,
-  ae as USERNAME_MAX_LENGTH,
-  ne as USERNAME_MIN_LENGTH,
-  _e as UserAPI,
-  Oe as UserService,
-  le as WebAdapter,
-  Ye as getOSFromDeviceType,
-  S as isTokenExpired,
+  Pe as TwoFactorApiClient,
+  Ee as TwoFactorPolicy,
+  je as TwoFactorService,
+  he as USERNAME_MAX_LENGTH,
+  ce as USERNAME_MIN_LENGTH,
+  xe as UserAPI,
+  He as UserService,
+  ge as WebAdapter,
+  tt as getOSFromDeviceType,
+  y as isTokenExpired,
   P as isValidEmail,
   D as isValidJWTFormat,
   x as isValidPhoneNumber,
-  Ae as isValidUsername,
+  Oe as isValidUsername,
   m as parseToken,
-  v as pathWithParams,
-  be as sanitizeErrorMessage,
+  _ as pathWithParams,
+  $e as sanitizeErrorMessage,
   A as webAdapter
 };
 //# sourceMappingURL=index.mjs.map