@passflow/core 0.13.3 → 0.14.1

package/dist/index.mjs

@@ -1,9 +1,9 @@
-import F from "axios";
-import { v4 as H } from "uuid";
-import { startAuthentication as z, startRegistration as X } from "@simplewebauthn/browser";
-const W = "0.13.3", J = {
-  version: W
-}, b = "X-Passflow-Clientid", I = "Authorization", Z = "X-Passflow-DeviceId", Q = "X-Passflow-DeviceType", ee = J.version, qe = ["id", "offline", "openid"], te = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], K = "https://auth.passflow.cloud", Be = "default", re = 500, se = 600, ie = 100, oe = 6e4, G = 30, ne = 3, ae = 30, ce = 200, he = (i) => {
+import M from "axios";
+import { v4 as te } from "uuid";
+import { startAuthentication as re, startRegistration as se } from "@simplewebauthn/browser";
+const ie = "0.14.1", oe = {
+  version: ie
+}, A = "X-Passflow-Clientid", I = "Authorization", ne = "X-Passflow-DeviceId", ae = "X-Passflow-DeviceType", ce = oe.version, gt = ["id", "offline", "openid"], he = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], Y = "https://auth.passflow.cloud", ft = "default", de = 500, ue = 600, le = 100, pe = 6e4, j = 30, ge = 3, fe = 30, ke = 200, me = (i) => {
   const e = [];
   let t;
   for (t in i) {
@@ -18,14 +18,14 @@ const W = "0.13.3", J = {
   }
   return { raw: i, tenants: e };
 };
-function de(i) {
+function ve(i) {
   if (typeof window < "u" && typeof window.atob == "function")
     return window.atob(i);
   if (typeof Buffer < "u")
     return Buffer.from(i, "base64").toString("utf-8");
   throw new Error("No Base64 decoding method available in this environment");
 }
-class ue {
+class ye {
   constructor(e) {
     this.storageManager = e;
   }
@@ -39,7 +39,7 @@ class ue {
     const t = this.storageManager.getToken(e);
     if (!t) return !0;
     const r = m(t);
-    return r ? S(r) : !0;
+    return r ? y(r) : !0;
   }
   /**
    * Parse token from storage by type.
@@ -54,19 +54,19 @@ class ue {
       return m(t);
   }
 }
-function S(i, e = G) {
+function y(i, e = j) {
   return Math.floor(Date.now() / 1e3) + e > i.exp;
 }
 function m(i) {
   const e = i.split(".")[1];
   if (!e) throw new Error("Invalid token string");
-  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = de(r), o = decodeURIComponent(
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = ve(r), o = decodeURIComponent(
     s.split("").map((h) => "%" + ("00" + h.charCodeAt(0).toString(16)).slice(-2)).join("")
   ), n = JSON.parse(o);
-  return n.membership = n.passflow_tm && n.type !== "invite" ? he(n.passflow_tm) : void 0, n;
+  return n.membership = n.passflow_tm && n.type !== "invite" ? me(n.passflow_tm) : void 0, n;
 }
-var k = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(k || {}), y = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(y || {}), V = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(V || {});
-class q {
+var k = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(k || {}), v = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(v || {}), H = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(H || {});
+class z {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
   }
@@ -166,7 +166,7 @@ class q {
   loadPersistedMode() {
     try {
       const e = this.storageManager.storage.getItem(this.DELIVERY_MODE_KEY);
-      e && Object.values(y).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
+      e && Object.values(v).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
     } catch {
     }
   }
@@ -176,7 +176,7 @@ class q {
   loadPersistedSessionState() {
     try {
       const e = this.storageManager.storage.getItem(this.SESSION_STATE_KEY);
-      e && Object.values(V).includes(e) && (this.sessionState = e);
+      e && Object.values(H).includes(e) && (this.sessionState = e);
     } catch {
     }
   }
@@ -217,7 +217,7 @@ class q {
     }
   }
 }
-class $ {
+class L {
   constructor({ storage: e, prefix: t } = {}) {
     this.keyStoragePrefix = "", this.scopes = `${this.keyStoragePrefix}tokens_scopes`, this.deviceId = `${this.keyStoragePrefix}passflowDeviceId`, this.invitationToken = `${this.keyStoragePrefix}passflowInvitationToken`, this.previousRedirectUrl = `${this.keyStoragePrefix}passflowPreviousRedirectUrl`, this.STORAGE_PREFIX = "passflow_", this.ID_TOKEN_KEY = `${this.STORAGE_PREFIX}id_token`, this.CSRF_TOKEN_KEY = `${this.STORAGE_PREFIX}csrf_token`, this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.storage = e ?? localStorage, this.keyStoragePrefix = t ? `${t}_` : "";
   }
@@ -228,7 +228,7 @@ class $ {
    */
   saveTokens(e, t) {
     const { id_token: r, access_token: s, refresh_token: o, scopes: n } = e;
-    t === y.Cookie || t === y.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(k.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(k.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(k.refresh_token), o), n && this.storage.setItem(this.scopes, n.join(",")));
+    t === v.Cookie || t === v.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(k.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(k.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(k.refresh_token), o), n && this.storage.setItem(this.scopes, n.join(",")));
   }
   getToken(e) {
     const t = this.getKeyForTokenType(e);
@@ -241,7 +241,7 @@ class $ {
    */
   getTokens() {
     const e = this.getDeliveryMode();
-    if (e === y.Cookie || e === y.BFF) {
+    if (e === v.Cookie || e === v.BFF) {
       const r = this.storage.getItem(this.ID_TOKEN_KEY);
       return r ? {
         id_token: r
@@ -324,7 +324,7 @@ class $ {
   getDeliveryMode() {
     try {
       const e = this.storage.getItem(this.DELIVERY_MODE_KEY);
-      if (e && Object.values(y).includes(e))
+      if (e && Object.values(v).includes(e))
         return e;
     } catch {
     }
@@ -400,9 +400,9 @@ class $ {
     return `${this.keyStoragePrefix}${e}`;
   }
 }
-class B {
+class X {
   constructor(e) {
-    this.storageManager = e ?? new $();
+    this.storageManager = e ?? new L();
   }
   getDeviceId() {
     const e = this.storageManager.getDeviceId();
@@ -413,19 +413,19 @@ class B {
     return e;
   }
   generateUniqueDeviceId() {
-    return H();
+    return te();
   }
 }
-class Y extends Error {
+class W extends Error {
   constructor(e = "Authentication popup was closed") {
     super(e), this.name = "PopupClosedError";
   }
 }
-class le {
+class Se {
   constructor() {
     this.passkeys = {
-      startRegistration: (e) => X({ optionsJSON: e }),
-      startAuthentication: (e) => z({ optionsJSON: e })
+      startRegistration: (e) => se({ optionsJSON: e }),
+      startAuthentication: (e) => re({ optionsJSON: e })
     };
   }
   // ----------------------------------------------------------------
@@ -557,25 +557,25 @@ class le {
           'openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.'
         )
       );
-    const s = t.width ?? re, o = t.height ?? se, n = t.expectedReturnOrigin ?? window.location.origin, h = window.open(e, "_blank", `width=${s},height=${o}`);
+    const s = t.width ?? de, o = t.height ?? ue, n = t.expectedReturnOrigin ?? window.location.origin, h = window.open(e, "_blank", `width=${s},height=${o}`);
     return h ? new Promise((d, u) => {
       const g = Date.now(), f = setInterval(() => {
         if (h.closed) {
-          clearInterval(f), u(new Y());
+          clearInterval(f), u(new W());
           return;
         }
-        if (Date.now() - g > oe) {
+        if (Date.now() - g > pe) {
           clearInterval(f), h.close(), u(new Error("Authentication popup timed out"));
           return;
         }
         try {
           if (h.location.href.startsWith(n)) {
-            const M = h.location.search, j = h.location.hash;
-            clearInterval(f), h.close(), d({ callbackSearch: M, callbackHash: j });
+            const D = h.location.search, ee = h.location.hash;
+            clearInterval(f), h.close(), d({ callbackSearch: D, callbackHash: ee });
           }
         } catch {
         }
-      }, ie);
+      }, le);
     }) : (window.location.href = e, new Promise(() => {
     }));
   }
@@ -633,44 +633,88 @@ class le {
     return "web";
   }
 }
-const A = new le();
-var _ = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(_ || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorMethodSetupBegin = "/v2/user/2fa/methods/:method/setup/begin", i.TwoFactorMethodSetupConfirm = "/v2/user/2fa/methods/:method/setup/confirm", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), E = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(E || {});
+const C = new Se(), we = "insufficient_user_authentication", Te = "upgrade_required", K = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, Ee = (i) => i.replace(/\\(.)/g, "$1"), _e = (i) => {
+  const e = {};
+  K.lastIndex = 0;
+  for (const t of i.matchAll(K)) {
+    const r = t[1];
+    if (!r)
+      continue;
+    const s = t[2], o = t[3];
+    e[r.toLowerCase()] = s !== void 0 ? Ee(s) : o ?? "";
+  }
+  return e;
+}, J = (i) => {
+  const e = typeof i == "number" ? i : Number.parseInt(String(i ?? ""), 10);
+  return Number.isFinite(e) && e > 0 ? e : void 0;
+}, Ie = (i, e) => {
+  if (!i || !/(^|[\s,])Bearer\b/i.test(i))
+    return;
+  const t = _e(i);
+  if (t.error === we)
+    return {
+      acrValues: t.acr_values || void 0,
+      maxAge: J(t.max_age),
+      status: e
+    };
+}, be = (i, e) => {
+  if (!i || typeof i != "object")
+    return;
+  const t = i;
+  if (t.error === Te)
+    return {
+      acrValues: typeof t.acr_values == "string" && t.acr_values ? t.acr_values : void 0,
+      maxAge: J(t.max_age),
+      status: e
+    };
+}, Ae = (i, e, t) => {
+  if (!(i !== 401 && i !== 403))
+    return Ie(e("www-authenticate"), i) ?? be(t, i);
+};
+var _ = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(_ || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorSetupStart = "/v2/user/2fa/setup/start", i.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), T = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(T || {});
 class l extends Error {
   constructor(e) {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
-var pe = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(pe || {}), ge = /* @__PURE__ */ ((i) => (i.web = "web", i.ios = "ios", i.android = "android", i))(ge || {});
-function Ye(i) {
+var Ce = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(Ce || {}), Re = /* @__PURE__ */ ((i) => (i.web = "web", i.ios = "ios", i.android = "android", i))(Re || {});
+function kt(i) {
   return i;
 }
-function v(i, e) {
+function E(i, e) {
   let t = i;
   return Object.entries(e).forEach(([r, s]) => {
     t = t.replace(`:${r}`, s);
   }), t;
 }
-var fe = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(fe || {});
-const ke = 3, me = 1e3;
-class w {
+var Fe = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(Fe || {});
+const Me = 3, De = 1e3, Pe = (i) => Ae(
+  i.status,
+  (e) => {
+    const t = i.headers?.[e] ?? i.headers?.[e.toLowerCase()];
+    return Array.isArray(t) ? t.join(", ") : t;
+  },
+  i.data
+) !== void 0;
+class S {
   constructor(e, t, r) {
     this.refreshPromise = null, this.isRefreshing = !1, this.defaultHeaders = {
       Accept: "application/json",
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh"];
     const { url: s, appId: o, keyStoragePrefix: n } = e;
-    this._platform = e.platform ?? A, this.url = s || K, this.storageManager = t ?? new $({
+    this._platform = e.platform ?? C, this.url = s || Y, this.storageManager = t ?? new L({
       prefix: n ?? ""
-    }), this.deviceService = r ?? new B(this.storageManager), this.tokenService = new ue(this.storageManager), this.tokenDeliveryManager = new q(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
+    }), this.deviceService = r ?? new X(this.storageManager), this.tokenService = new ye(this.storageManager), this.tokenDeliveryManager = new z(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [b]: o
+      [A]: o
     });
     const h = this.deviceService.getDeviceId();
     this.defaultHeaders = {
       ...this.defaultHeaders,
-      [Z]: h,
-      [Q]: this._platform.getDeviceType()
-    }, this.detectCookieSupport(), this.instance = F.create({
+      [ne]: h,
+      [ae]: this._platform.getDeviceType()
+    }, this.detectCookieSupport(), this.instance = M.create({
       baseURL: this.url,
       headers: { ...this.defaultHeaders }
     }), this.instance.interceptors.request.use(async (d) => {
@@ -691,7 +735,7 @@ class w {
       const u = this.storageManager.getTokens();
       if (u?.access_token) {
         const g = m(u.access_token);
-        if (S(g, G) && u.refresh_token)
+        if (y(g, j) && u.refresh_token)
           try {
             if (this.refreshPromise) {
               const f = await this.refreshPromise;
@@ -712,7 +756,7 @@ class w {
       return d;
     }), this.instance.interceptors.response.use(
       (d) => d,
-      async (d) => (d.response?.status === 401 && this.tokenDeliveryManager.setSessionInvalid(), d.response?.status === 429 ? await this.handleRateLimitError(d) : this.handleAxiosError(d))
+      async (d) => (d.response?.status === 401 && !Pe(d.response) && this.tokenDeliveryManager.setSessionInvalid(), d.response?.status === 429 ? await this.handleRateLimitError(d) : this.handleAxiosError(d))
     );
   }
   get origin() {
@@ -776,9 +820,9 @@ class w {
     if (!["GET", "HEAD", "OPTIONS"].includes(r || ""))
       return Promise.reject(e);
     const o = t._retryCount || 0;
-    if (o >= ke)
+    if (o >= Me)
       return Promise.reject(e);
-    let n = me * Math.pow(2, o);
+    let n = De * Math.pow(2, o);
     const h = e.response?.headers?.["retry-after"];
     if (h) {
       const d = Number.parseInt(h, 10);
@@ -842,13 +886,13 @@ class w {
   setAppId(e) {
     this.appId = e, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [b]: e
-    }, this.instance.defaults.headers.common[b] = e;
+      [A]: e
+    }, this.instance.defaults.headers.common[A] = e;
   }
 }
-class ve {
+class xe {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -857,9 +901,9 @@ class ve {
     return this.axiosClient.get(c.appSettings);
   }
 }
-class ye {
+class Ue {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -916,7 +960,7 @@ class ye {
     );
   }
   logOut(e, t, r = !1) {
-    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? E.logout : c.logout;
+    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? T.logout : c.logout;
     return this.axiosClient.post(o, s);
   }
   validateSession() {
@@ -936,7 +980,7 @@ class ye {
     return this.axiosClient.post(c.resetPassword, s, {
       headers: {
         [I]: `Bearer ${r}`,
-        [b]: void 0
+        [A]: void 0
       }
     });
   }
@@ -946,7 +990,7 @@ class ye {
       create_tenant: o ?? !1,
       device: t,
       os: r
-    }, h = s ? E.passkeyRegisterStart : c.passkeyRegisterStart;
+    }, h = s ? T.passkeyRegisterStart : c.passkeyRegisterStart;
     return this.axiosClient.post(h, n);
   }
   passkeyRegisterComplete(e, t, r, s = !1) {
@@ -954,7 +998,7 @@ class ye {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, n = s ? E.passkeyRegisterComplete : c.passkeyRegisterComplete;
+    }, n = s ? T.passkeyRegisterComplete : c.passkeyRegisterComplete;
     return this.axiosClient.post(n, o);
   }
   passkeyAuthenticateStart(e, t, r, s = !1) {
@@ -963,7 +1007,7 @@ class ye {
       user_id: e.user_id ?? "",
       device: t,
       os: r
-    }, n = s ? E.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
+    }, n = s ? T.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
     return this.axiosClient.post(
       n,
       o
@@ -974,7 +1018,7 @@ class ye {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, n = s ? E.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
+    }, n = s ? T.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
     return this.axiosClient.post(n, o);
   }
   passkeyValidate(e, t, r, s = !1, o) {
@@ -984,29 +1028,29 @@ class ye {
       challenge_id: r
     };
     let h = c.passkeyValidate;
-    !o && s && (h = E.passkeyValidate);
-    const d = o ? { [b]: o } : {};
+    !o && s && (h = T.passkeyValidate);
+    const d = o ? { [A]: o } : {};
     return this.axiosClient.post(h, n, { headers: d });
   }
 }
-class je {
+class mt {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
   }
   getCLIAuthStatus(e) {
-    const t = v(c.cliAuthStatus, { sessionId: e });
+    const t = E(c.cliAuthStatus, { sessionId: e });
     return this.axiosClient.get(t);
   }
   completeCLIAuth(e) {
     return this.axiosClient.post(c.cliAuthComplete, e);
   }
 }
-class Se {
+class $e {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1030,7 +1074,7 @@ class Se {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const r = v(c.invitationsPath, {
+    const r = E(c.invitationsPath, {
       tenantID: e.tenantID
     });
     return this.axiosClient.get(r, { params: t }).then((s) => ({
@@ -1044,7 +1088,7 @@ class Se {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = v(c.invitationDelete, {
+    const t = E(c.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -1055,7 +1099,7 @@ class Se {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = v(c.invitationResend, {
+    const t = E(c.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -1066,15 +1110,15 @@ class Se {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = v(c.invitationGetLink, {
+    const t = E(c.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
   }
 }
-class we {
+class Oe {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1089,9 +1133,9 @@ class we {
     return this.axiosClient.get(c.settingsPasskey);
   }
 }
-class Te {
+class Le {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1322,9 +1366,9 @@ class Te {
     return this.axiosClient.delete(s);
   }
 }
-class Ee {
+class Ne {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1509,27 +1553,34 @@ class Ee {
     return this.axiosClient.get(c.TwoFactorMethodsRegistered);
   }
   /**
-   * Begin 2FA method setup
-   * POST /v2/user/2fa/methods/:method/setup/begin
+   * Start 2FA method setup.
+   * POST /v2/user/2fa/setup/start
+   *
+   * The method travels in the body: at this point it is a parameter of the
+   * request, not the identity of an enrolled resource.
    */
-  beginMethodSetup(e) {
-    const t = v(c.TwoFactorMethodSetupBegin, { method: e });
-    return this.axiosClient.post(t, {});
+  startMethodSetup(e, t) {
+    return this.axiosClient.post(c.TwoFactorSetupStart, {
+      ...t,
+      method: e
+    });
   }
   /**
-   * Confirm 2FA method setup
-   * POST /v2/user/2fa/methods/:method/setup/confirm
+   * Complete 2FA method setup.
+   * POST /v2/user/2fa/setup/complete
    */
-  confirmMethodSetup(e, t) {
-    const r = v(c.TwoFactorMethodSetupConfirm, { method: e });
-    return this.axiosClient.post(r, t);
+  completeMethodSetup(e, t) {
+    return this.axiosClient.post(c.TwoFactorSetupComplete, {
+      ...t,
+      method: e
+    });
   }
   /**
    * Remove registered 2FA method
    * DELETE /v2/user/2fa/methods/:id
    */
   removeMethod(e) {
-    const t = v(c.TwoFactorMethodRemove, { id: e });
+    const t = E(c.TwoFactorMethodRemove, { id: e });
     return this.axiosClient.delete(t);
   }
   /**
@@ -1574,13 +1625,13 @@ class Ee {
    * DELETE /v2/user/2fa/trusted-devices/:id
    */
   revokeTrustedDevice(e) {
-    const t = v(c.TwoFactorTrustedDeviceRevoke, { id: e });
+    const t = E(c.TwoFactorTrustedDeviceRevoke, { id: e });
     return this.axiosClient.delete(t);
   }
 }
-class _e {
+class Ke {
   constructor(e, t, r) {
-    this.axiosClient = new w(e, t, r);
+    this.axiosClient = new S(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1624,7 +1675,7 @@ class _e {
   }
 }
 var a = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.SessionExpired = "session:expired", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(a || {});
-class Ie {
+class Ge {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
   }
@@ -1664,42 +1715,42 @@ class Ie {
     });
   }
 }
-function D(i) {
+function P(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.split(".");
   if (e.length !== 3) return !1;
   const t = /^[A-Za-z0-9_-]+$/;
   return e.every((r) => t.test(r) && r.length > 0);
 }
-function be(i) {
-  return i.replace(/<[^>]*>/g, "").substring(0, ce);
+function Ve(i) {
+  return i.replace(/<[^>]*>/g, "").substring(0, ke);
 }
-function P(i) {
+function x(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
   return e.length === 0 ? !1 : /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
 }
-function x(i) {
+function U(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
   return /^\+[1-9]\d{1,14}$/.test(e);
 }
-function Ae(i) {
+function qe(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
-  return e.length < ne || e.length > ae ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
+  return e.length < ge || e.length > fe ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
 }
-function C(i, e = 6) {
+function R(i, e = 6) {
   return !i || typeof i != "string" ? !1 : (e === 8 ? /^\d{8}$/ : /^\d{6}$/).test(i);
 }
-function Ce(i) {
+function Be(i) {
   if (!i || typeof i != "string") return null;
   const e = i.toUpperCase().replace(/\s+/g, "");
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
-class Re {
-  constructor(e, t, r, s, o, n, h, d, u, g, f, M = A) {
-    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = h, this.url = d, this.sessionCallbacks = u, this.appId = g, this.platform = M, this.tokenExchangeConfig = f, this.tokenDeliveryManager = new q(r), f?.enabled && this.tokenDeliveryManager.setMode(y.BFF), this.initializeSession();
+class Ye {
+  constructor(e, t, r, s, o, n, h, d, u, g, f, D = C) {
+    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = h, this.url = d, this.sessionCallbacks = u, this.appId = g, this.platform = D, this.tokenExchangeConfig = f, this.tokenDeliveryManager = new z(r), f?.enabled && this.tokenDeliveryManager.setMode(v.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -1766,7 +1817,7 @@ class Re {
       throw new Error(`BFF token storage failed: ${t.status}`);
   }
   async signIn(e) {
-    if ("email" in e && e.email && !P(e.email)) {
+    if ("email" in e && e.email && !x(e.email)) {
       const s = new Error("Invalid email format"), o = {
         message: "Invalid email format",
         originalError: s,
@@ -1774,7 +1825,7 @@ class Re {
       };
       throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if ("username" in e && e.username && !Ae(e.username)) {
+    if ("username" in e && e.username && !qe(e.username)) {
       const s = new Error(
         "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens"
       ), o = {
@@ -1784,7 +1835,7 @@ class Re {
       };
       throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if ("phone" in e && e.phone && !x(e.phone)) {
+    if ("phone" in e && e.phone && !U(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: s,
@@ -1815,7 +1866,7 @@ class Re {
     }
   }
   async signUp(e) {
-    if (e.user.email && !P(e.user.email)) {
+    if (e.user.email && !x(e.user.email)) {
       const t = new Error("Invalid email format"), r = {
         message: "Invalid email format",
         originalError: t,
@@ -1823,7 +1874,7 @@ class Re {
       };
       throw this.subscribeStore.notify(a.Error, r), t;
     }
-    if (e.user.phone_number && !x(e.user.phone_number)) {
+    if (e.user.phone_number && !U(e.user.phone_number)) {
       const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), r = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: t,
@@ -1848,7 +1899,7 @@ class Re {
     }
   }
   async passwordlessSignIn(e) {
-    if (e.email && !P(e.email)) {
+    if (e.email && !x(e.email)) {
       const s = new Error("Invalid email format"), o = {
         message: "Invalid email format",
         originalError: s,
@@ -1856,7 +1907,7 @@ class Re {
       };
       throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if (e.phone && !x(e.phone)) {
+    if (e.phone && !U(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: s,
@@ -1981,13 +2032,13 @@ class Re {
         message: r instanceof Error ? r.message : "Token refresh failed",
         originalError: r,
         code: r instanceof l ? r.id : void 0,
-        details: F.isAxiosError(r) && r.response ? {
+        details: M.isAxiosError(r) && r.response ? {
           status: r.response.status,
           data: r.response.data
         } : void 0
       };
       this.subscribeStore.notify(a.Error, s);
-      const o = F.isAxiosError(r) && r.response?.status && r.response.status >= 400 && r.response.status < 500;
+      const o = M.isAxiosError(r) && r.response?.status && r.response.status >= 400 && r.response.status < 500;
       throw o && (this.tokenCacheService.tokenExpiredFlag = !0, this.tokenCacheService.setTokensCache(void 0), this.storageManager.deleteTokens(), this.subscribeStore.notify(a.SessionExpired, { reason: "refresh_failed" })), r instanceof l ? r : o ? new Error(`Getting unknown error message from server with code:${r.response?.status}`) : r;
     }
   }
@@ -2110,7 +2161,7 @@ class Re {
     } catch (o) {
       const n = {
         message: o instanceof Error ? o.message : "Authentication failed",
-        code: o instanceof Y ? "POPUP_CLOSED" : "AUTH_FAILED",
+        code: o instanceof W ? "POPUP_CLOSED" : "AUTH_FAILED",
         originalError: o
       };
       this.subscribeStore.notify(a.Error, n);
@@ -2161,7 +2212,7 @@ class Re {
         const t = !!e?.id_token || !!this.storageManager.getIdToken(), r = this.tokenDeliveryManager.isSessionValid(), s = this.tokenDeliveryManager.isSessionUnknown();
         return t && (r || s);
       }
-      return !e || !e.access_token ? !1 : !S(e.access_token) || e.refresh_token !== void 0 && !S(e.refresh_token);
+      return !e || !e.access_token ? !1 : !y(e.access_token) || e.refresh_token !== void 0 && !y(e.refresh_token);
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to check authentication status",
@@ -2200,7 +2251,7 @@ class Re {
       const t = this.storageManager.getTokens();
       if (!t || !t.access_token) return;
       const r = m(t.access_token);
-      return S(r) ? e ? await this.refreshToken() : void 0 : t;
+      return y(r) ? e ? await this.refreshToken() : void 0 : t;
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to get tokens",
@@ -2211,7 +2262,7 @@ class Re {
     }
   }
 }
-class Fe {
+class je {
   constructor(e) {
     this.invitationApi = e;
   }
@@ -2256,7 +2307,7 @@ class Fe {
     return this.invitationApi.getInvitationLink(e);
   }
 }
-class Me {
+class He {
   error(e, ...t) {
     console.error(e, ...t);
   }
@@ -2270,10 +2321,10 @@ class Me {
     console.debug(e, ...t);
   }
 }
-function De() {
-  return new Me();
+function ze() {
+  return new He();
 }
-class Pe {
+class Xe {
   constructor(e) {
     this.data = this.normalize(e);
   }
@@ -2343,9 +2394,9 @@ class Pe {
     return this.data;
   }
 }
-class xe {
+class We {
   constructor(e, t, r) {
-    this.tenantApi = e, this.scopes = t, this.logger = r || De();
+    this.tenantApi = e, this.scopes = t, this.logger = r || ze();
   }
   /**
    * Handle Passflow API errors
@@ -2354,7 +2405,7 @@ class xe {
    * @throws Formatted error with Passflow API error details
    */
   handlePassflowError(e, t) {
-    if (F.isAxiosError(e) && e.response?.data) {
+    if (M.isAxiosError(e) && e.response?.data) {
       const r = e.response.data;
       if (typeof r == "object" && r !== null && "error" in r && typeof r.error == "object" && r.error !== null) {
         const s = r.error;
@@ -2415,7 +2466,7 @@ class xe {
   async getTenantUserMembership(e) {
     try {
       const t = await this.tenantApi.getTenantDetails(e);
-      return new Pe(t);
+      return new Xe(t);
     } catch (t) {
       this.handlePassflowError(t, `Get tenant user membership failed for tenant ID ${e}`);
     }
@@ -2713,8 +2764,8 @@ class xe {
     }
   }
 }
-class Ue {
-  constructor(e, t, r, s = A) {
+class Je {
+  constructor(e, t, r, s = C) {
     this.storageManager = e, this.authApi = t, this.subscribeStore = r, this.platform = s, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.unsubscribeForeground = null, this.unsubscribeUnload = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupLifecycleListeners();
   }
   initialize() {
@@ -2727,7 +2778,7 @@ class Ue {
         return;
       }
       const t = m(e.access_token);
-      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
+      y(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
@@ -2791,7 +2842,7 @@ class Ue {
       if (!this.tokensCache.access_token)
         return this.tokensCache;
       const e = m(this.tokensCache.access_token);
-      return S(e) && !this.tokenExpiredFlag ? (await this.refreshTokensCache(this.tokensCache), this.tokensCache) : this.tokensCache;
+      return y(e) && !this.tokenExpiredFlag ? (await this.refreshTokensCache(this.tokensCache), this.tokensCache) : this.tokensCache;
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
@@ -2809,10 +2860,10 @@ class Ue {
     if (!this.tokensCache.access_token)
       return !1;
     const e = m(this.tokensCache.access_token);
-    return S(e);
+    return y(e);
   }
 }
-class $e {
+class Ze {
   constructor(e, t) {
     this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
     const r = {
@@ -2865,7 +2916,7 @@ class $e {
    * Returns recovery codes that MUST be displayed to user
    */
   async confirmSetup(e) {
-    if (!C(e, this.totpDigits))
+    if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.confirmSetup({ code: e });
@@ -2884,7 +2935,7 @@ class $e {
    * Completes authentication if successful
    */
   async verify(e) {
-    if (!C(e, this.totpDigits))
+    if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     if (this.recoverPartialAuthState(), !this.isVerificationRequired())
       throw new Error("2FA verification expired or not required. User must sign in first.");
@@ -2906,7 +2957,7 @@ class $e {
    */
   async useRecoveryCode(e) {
     try {
-      const t = Ce(e);
+      const t = Be(e);
       if (!t)
         throw new Error("Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).");
       if (this.recoverPartialAuthState(), !this.isVerificationRequired())
@@ -2932,7 +2983,7 @@ class $e {
    * Disable 2FA (requires TOTP verification)
    */
   async disable(e) {
-    if (!C(e, this.totpDigits))
+    if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.disable({ code: e });
@@ -2945,7 +2996,7 @@ class $e {
    * Regenerate recovery codes
    */
   async regenerateRecoveryCodes(e) {
-    if (!C(e, this.totpDigits))
+    if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.regenerateRecoveryCodes({ code: e }), r = [...t.recovery_codes];
@@ -3107,29 +3158,29 @@ class $e {
     }
   }
   /**
-   * Begin 2FA method setup
+   * Start 2FA method setup
    */
-  async beginMethodSetup(e) {
+  async startMethodSetup(e, t) {
     try {
-      const t = await this.twoFactorApi.beginMethodSetup(e);
-      return this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: "", method: e }), t;
-    } catch (t) {
-      this.emitErrorAndThrow(t, "Begin 2FA method setup");
+      const r = await this.twoFactorApi.startMethodSetup(e, t);
+      return this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: "", method: e }), r;
+    } catch (r) {
+      this.emitErrorAndThrow(r, "Start 2FA method setup");
     }
   }
   /**
-   * Confirm 2FA method setup
+   * Complete 2FA method setup
    */
-  async confirmMethodSetup(e, t) {
+  async completeMethodSetup(e, t) {
     try {
-      const r = await this.twoFactorApi.confirmMethodSetup(e, t);
+      const r = await this.twoFactorApi.completeMethodSetup(e, t);
       return this.subscribeStore.notify(a.TwoFactorEnabled, {
         recoveryCodes: [],
         clearRecoveryCodes: () => {
         }
       }), r;
     } catch (r) {
-      this.emitErrorAndThrow(r, "Confirm 2FA method setup");
+      this.emitErrorAndThrow(r, "Complete 2FA method setup");
     }
   }
   /**
@@ -3209,8 +3260,8 @@ class $e {
     }
   }
 }
-class Oe {
-  constructor(e, t, r = A) {
+class Qe {
+  constructor(e, t, r = C) {
     this.userAPI = e, this.deviceService = t, this.platform = r;
   }
   /**
@@ -3261,7 +3312,7 @@ class Oe {
     return await this.userAPI.addUserPasskeyComplete(d, s, n);
   }
 }
-const O = class O {
+const N = class N {
   constructor(e) {
     this.doRefreshTokens = !1, this.session = async ({
       createSession: o,
@@ -3271,10 +3322,10 @@ const O = class O {
       this.createSessionCallback = o, this.expiredSessionCallback = n, this.doRefreshTokens = h, await this.submitSessionCheck();
     };
     const { url: t, appId: r, scopes: s } = e;
-    this.url = t || K, this.appId = r, this.platform = e.platform ?? A, this.storageManager = new $({
+    this.url = t || Y, this.appId = r, this.platform = e.platform ?? C, this.storageManager = new L({
       prefix: e.keyStoragePrefix ?? "",
       storage: this.platform.storage
-    }), this.deviceService = new B(this.storageManager), this.authApi = new ye(e, this.storageManager, this.deviceService), this.appApi = new ve(e, this.storageManager, this.deviceService), this.userApi = new _e(e, this.storageManager, this.deviceService), this.settingApi = new we(e, this.storageManager, this.deviceService), this.tenantApi = new Te(e, this.storageManager, this.deviceService), this.invitationApi = new Se(e, this.storageManager, this.deviceService), this.twoFactorApi = new Ee(e, this.storageManager, this.deviceService), this.subscribeStore = new Ie(), this.tokenCacheService = new Ue(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = s ?? te, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Re(
+    }), this.deviceService = new X(this.storageManager), this.authApi = new Ue(e, this.storageManager, this.deviceService), this.appApi = new xe(e, this.storageManager, this.deviceService), this.userApi = new Ke(e, this.storageManager, this.deviceService), this.settingApi = new Oe(e, this.storageManager, this.deviceService), this.tenantApi = new Le(e, this.storageManager, this.deviceService), this.invitationApi = new $e(e, this.storageManager, this.deviceService), this.twoFactorApi = new Ne(e, this.storageManager, this.deviceService), this.subscribeStore = new Ge(), this.tokenCacheService = new Je(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = s ?? he, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ye(
       this.authApi,
       this.deviceService,
       this.storageManager,
@@ -3290,7 +3341,7 @@ const O = class O {
       this.appId ?? "",
       e.tokenExchange,
       this.platform
-    ), this.userService = new Oe(this.userApi, this.deviceService, this.platform), this.tenantService = new xe(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Fe(this.invitationApi), this.twoFactorService = new $e(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
+    ), this.userService = new Qe(this.userApi, this.deviceService, this.platform), this.tenantService = new We(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new je(this.invitationApi), this.twoFactorService = new Ze(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
   }
   get origin() {
     return this.platform.getCurrentUrl()?.origin ?? "";
@@ -3401,7 +3452,7 @@ const O = class O {
     const s = t.get("access_token"), o = t.get("refresh_token"), n = t.get("id_token"), h = t.get("scopes")?.split(",") ?? this.scopes;
     let d;
     if (s) {
-      if (!D(s)) {
+      if (!P(s)) {
         const u = {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -3409,7 +3460,7 @@ const O = class O {
         this.subscribeStore.notify(a.Error, u), this.cleanupUrlParams(r, e);
         return;
       }
-      if (o && !D(o)) {
+      if (o && !P(o)) {
         const u = {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -3417,7 +3468,7 @@ const O = class O {
         this.subscribeStore.notify(a.Error, u), this.cleanupUrlParams(r, e);
         return;
       }
-      if (n && !D(n)) {
+      if (n && !P(n)) {
         const u = {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -3437,7 +3488,7 @@ const O = class O {
   checkErrorsFromURL() {
     const t = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("error");
     if (t) {
-      const r = be(t);
+      const r = Ve(t);
       return new Error(r);
     }
   }
@@ -4621,8 +4672,8 @@ const O = class O {
     this.twoFactorService.clearMagicLinkSession();
   }
 };
-O.version = ee;
-let L = O;
+N.version = ce;
+let G = N;
 class p extends Error {
   constructor(e) {
     super(e.message), this.name = "M2MError", this.code = e.code, this.status = e.status ?? 400, this.errorUri = e.errorUri, this.rateLimitInfo = e.rateLimitInfo, this.headers = e.headers, this.cause = e.cause, this.timestamp = (/* @__PURE__ */ new Date()).toISOString(), Error.captureStackTrace && Error.captureStackTrace(this, p);
@@ -4718,7 +4769,7 @@ class p extends Error {
     return this.status && (e += ` (HTTP ${this.status})`), e;
   }
 }
-class N extends p {
+class V extends p {
   constructor(e, t) {
     super({
       code: "temporarily_unavailable",
@@ -4728,7 +4779,7 @@ class N extends p {
     }), this.name = "M2MNetworkError";
   }
 }
-class R extends p {
+class F extends p {
   constructor(e, t) {
     super({
       code: "invalid_request",
@@ -4738,7 +4789,7 @@ class R extends p {
     }), this.name = "M2MTokenParseError";
   }
 }
-class U extends p {
+class $ extends p {
   constructor(e) {
     super({
       code: "invalid_request",
@@ -4747,7 +4798,7 @@ class U extends p {
     }), this.name = "M2MConfigError";
   }
 }
-const He = {
+const vt = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -4757,7 +4808,7 @@ const He = {
   RateLimitExceeded: "rate_limit_exceeded",
   ServerError: "server_error",
   TemporarilyUnavailable: "temporarily_unavailable"
-}, T = {
+}, w = {
   /** Default token endpoint path */
   TOKEN_ENDPOINT: "/oauth2/token",
   /** Default request timeout in milliseconds */
@@ -4771,7 +4822,7 @@ const He = {
   /** Content-Type for token requests */
   CONTENT_TYPE: "application/x-www-form-urlencoded"
 };
-class Le {
+class et {
   constructor() {
     this.cache = /* @__PURE__ */ new Map();
   }
@@ -4789,7 +4840,7 @@ class Le {
     return this.cache.delete(e), Promise.resolve();
   }
 }
-const Ne = {
+const tt = {
   shouldRetry(i, e) {
     return e >= 3 ? !1 : i.code === "server_error" || i.code === "temporarily_unavailable" || i.code === "rate_limit_exceeded" || i.status !== void 0 && i.status >= 500;
   },
@@ -4797,7 +4848,7 @@ const Ne = {
     return Math.pow(2, i - 1) * 1e3;
   }
 };
-class ze {
+class yt {
   /**
    * Create a new M2M client
    *
@@ -4815,11 +4866,11 @@ class ze {
    */
   constructor(e) {
     if (!e.url)
-      throw new U("M2M client requires a URL");
+      throw new $("M2M client requires a URL");
     if (!e.clientId)
-      throw new U("M2M client requires a clientId");
+      throw new $("M2M client requires a clientId");
     if (!e.clientSecret)
-      throw new U("M2M client requires a clientSecret");
+      throw new $("M2M client requires a clientSecret");
     const t = e.url.replace(/\/$/, "");
     this.config = {
       url: t,
@@ -4828,16 +4879,16 @@ class ze {
       scopes: e.scopes,
       audience: e.audience,
       autoRefresh: e.autoRefresh ?? !1,
-      refreshThreshold: e.refreshThreshold ?? T.REFRESH_THRESHOLD,
-      timeout: e.timeout ?? T.TIMEOUT,
-      retries: e.retries ?? T.RETRIES,
-      retryDelay: e.retryDelay ?? T.RETRY_DELAY,
+      refreshThreshold: e.refreshThreshold ?? w.REFRESH_THRESHOLD,
+      timeout: e.timeout ?? w.TIMEOUT,
+      retries: e.retries ?? w.RETRIES,
+      retryDelay: e.retryDelay ?? w.RETRY_DELAY,
       retryStrategy: e.retryStrategy,
       cache: e.cache,
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new Le(), this.retryStrategy = e.retryStrategy ?? Ne, this.tokenEndpoint = `${t}${T.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new et(), this.retryStrategy = e.retryStrategy ?? tt, this.tokenEndpoint = `${t}${w.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
@@ -4928,7 +4979,7 @@ class ze {
       const o = await fetch(this.tokenEndpoint, {
         method: "POST",
         headers: {
-          "Content-Type": T.CONTENT_TYPE,
+          "Content-Type": w.CONTENT_TYPE,
           Accept: "application/json"
         },
         body: t.toString(),
@@ -4957,7 +5008,7 @@ class ze {
       }
       return h;
     } catch (o) {
-      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new N(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new N(`Network error: ${o.message}`, o) : o instanceof p ? o : p.fromError(o instanceof Error ? o : new Error(String(o)));
+      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new V(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new V(`Network error: ${o.message}`, o) : o instanceof p ? o : p.fromError(o instanceof Error ? o : new Error(String(o)));
     }
   }
   /**
@@ -5052,14 +5103,14 @@ class ze {
     try {
       const t = e.split(".");
       if (t.length !== 3)
-        throw new R("Invalid JWT format: expected 3 parts");
+        throw new F("Invalid JWT format: expected 3 parts");
       const r = t[1];
       if (!r)
-        throw new R("Invalid JWT format: missing payload");
+        throw new F("Invalid JWT format: missing payload");
       const s = atob(r.replace(/-/g, "+").replace(/_/g, "/")), o = JSON.parse(s);
       return o.scopes && typeof o.scopes == "string" ? o.scopes = o.scopes.split(" ") : o.scopes || (o.scopes = []), o;
     } catch (t) {
-      throw t instanceof R ? t : new R(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
+      throw t instanceof F ? t : new F(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
     }
   }
   /**
@@ -5100,7 +5151,7 @@ class ze {
       const s = await fetch(t, {
         method: "POST",
         headers: {
-          "Content-Type": T.CONTENT_TYPE
+          "Content-Type": w.CONTENT_TYPE
         },
         body: r.toString()
       });
@@ -5144,69 +5195,211 @@ class ze {
     return this.config.audience;
   }
 }
+class b extends Error {
+  constructor(e, t, r = !1) {
+    super(t), this.name = "UpgradeFactorError", this.factor = e, this.cancelled = r;
+  }
+}
+const Z = (i, e) => {
+  const t = e?.trim();
+  if (!t)
+    throw new b(i, "A verification code is required");
+  return t;
+}, rt = {
+  type: "totp",
+  requiresPrepare: !1,
+  input: "code",
+  assert: async ({ code: i }) => ({ code: Z("totp", i) })
+}, st = {
+  type: "recovery_codes",
+  requiresPrepare: !1,
+  input: "code",
+  assert: async ({ code: i }) => ({ code: Z("recovery_codes", i) })
+}, it = {
+  type: "passkey",
+  requiresPrepare: !0,
+  input: "none",
+  assert: async ({ prepared: i, platform: e }) => {
+    if (!i?.webauthn)
+      throw new b("passkey", "The upgrade challenge carried no WebAuthn options");
+    const t = e.passkeys;
+    if (!t)
+      throw new b("passkey", "This platform does not support passkeys");
+    let r;
+    try {
+      r = await t.startAuthentication(i.webauthn);
+    } catch (s) {
+      throw new b("passkey", s?.message || "Passkey verification was cancelled", !0);
+    }
+    if (!r)
+      throw new b("passkey", "Passkey verification was cancelled", !0);
+    return { challenge_id: i.challengeId, credential: r };
+  }
+}, Q = Object.freeze([
+  rt,
+  it,
+  st
+]), ot = (i = Q) => new Map(i.map((e) => [e.type, e])), nt = 3, at = {
+  passkey: 0,
+  totp: 1,
+  email_otp: 2,
+  sms_otp: 3,
+  recovery_codes: 9
+}, ct = (i) => {
+  if (!i)
+    return;
+  const e = i.split(/\s+/).map((t) => Number.parseInt(t, 10)).filter((t) => Number.isFinite(t));
+  return e.length > 0 ? Math.min(...e) : void 0;
+}, q = (i, e) => {
+  const t = at[i.type] ?? 5, r = e !== void 0 && e >= nt, s = i.type === "passkey";
+  return (r && !s ? 100 : 0) + t;
+}, ht = (i, e) => {
+  const t = ct(e.acrValues);
+  return [...i].sort((r, s) => q(r, t) - q(s, t));
+};
+class B extends Error {
+  constructor() {
+    super("Upgrade authentication was cancelled"), this.name = "UpgradeCancelledError";
+  }
+}
+class O extends Error {
+  constructor(e = "No available authentication factor can satisfy this challenge") {
+    super(e), this.name = "UpgradeUnsatisfiableError";
+  }
+}
+const dt = 3;
+class St {
+  constructor(e) {
+    this.inFlight = null, this.transport = e.transport, this.prompt = e.prompt, this.platform = e.platform, this.available = e.factors ?? Q, this.registry = ot(this.available), this.maxAttempts = e.maxAttempts ?? dt;
+  }
+  /**
+   * Elevates the session so the challenged request can be retried.
+   *
+   * Concurrent callers share one elevation: the first starts it, the rest await
+   * the same promise and all resolve together. Callers retry their own request
+   * once this resolves; it rejects if the user cancelled or ran out of attempts.
+   */
+  elevate(e) {
+    return this.inFlight ? this.inFlight : (this.inFlight = this.run(e).finally(() => {
+      this.inFlight = null;
+    }), this.inFlight);
+  }
+  async run(e) {
+    const t = ht(this.available, e);
+    if (t.length === 0)
+      throw new O();
+    let r;
+    for (let s = 0; s < this.maxAttempts; s++) {
+      const o = await this.prompt({ challenge: e, factors: t, previousError: r });
+      if (o.type === "cancel")
+        throw new B();
+      const n = this.registry.get(o.factor);
+      if (!n) {
+        r = new O(`Unknown authentication factor: ${o.factor}`);
+        continue;
+      }
+      try {
+        await this.proveAndCommit(n, o.code);
+        return;
+      } catch (h) {
+        if (h instanceof b && h.cancelled)
+          throw new B();
+        r = h;
+      }
+    }
+    throw r ?? new O("Upgrade authentication failed");
+  }
+  /**
+   * Runs one full proof for a single factor.
+   *
+   * The prepare round is re-run on every attempt rather than cached: a
+   * challenge is single-use and the server consumes it atomically, so a failed
+   * attempt has already spent it. Reusing the id would fail with
+   * `ErrorUpgradeChallengeInvalid` and look like a bad code to the user.
+   */
+  async proveAndCommit(e, t) {
+    const r = e.requiresPrepare ? await this.transport.prepare(e.type) : void 0, s = await e.assert({ code: t, prepared: r, platform: this.platform });
+    await this.transport.commit(e.type, s);
+  }
+}
 export {
-  b as APP_ID_HEADER_KEY,
+  A as APP_ID_HEADER_KEY,
   I as AUTHORIZATION_HEADER_KEY,
-  ve as AppAPI,
-  ye as AuthAPI,
-  Re as AuthService,
-  je as CLIAuthAPI,
-  Be as DEFAULT_GROUP_NAME,
-  te as DEFAULT_SCOPES,
-  Z as DEVICE_ID_HEADER_KEY,
-  Q as DEVICE_TYPE_HEADER_KEY,
-  ce as ERROR_MESSAGE_MAX_LENGTH,
-  Se as InvitationAPI,
-  Fe as InvitationService,
-  ze as M2MClient,
-  U as M2MConfigError,
+  xe as AppAPI,
+  Ue as AuthAPI,
+  Ye as AuthService,
+  mt as CLIAuthAPI,
+  ft as DEFAULT_GROUP_NAME,
+  he as DEFAULT_SCOPES,
+  Q as DEFAULT_UPGRADE_FACTORS,
+  ne as DEVICE_ID_HEADER_KEY,
+  ae as DEVICE_TYPE_HEADER_KEY,
+  ke as ERROR_MESSAGE_MAX_LENGTH,
+  we as INSUFFICIENT_USER_AUTHENTICATION,
+  $e as InvitationAPI,
+  je as InvitationService,
+  yt as M2MClient,
+  $ as M2MConfigError,
   p as M2MError,
-  He as M2MErrorCodes,
-  N as M2MNetworkError,
-  R as M2MTokenParseError,
-  T as M2M_DEFAULTS,
-  qe as MINIMAL_DEFAULT_SCOPES,
-  ge as OS,
-  K as PASSFLOW_CLOUD_URL,
-  se as POPUP_HEIGHT,
-  ie as POPUP_POLL_INTERVAL_MS,
-  oe as POPUP_TIMEOUT_MS,
-  re as POPUP_WIDTH,
-  L as Passflow,
-  E as PassflowAdminEndpointPaths,
+  vt as M2MErrorCodes,
+  V as M2MNetworkError,
+  F as M2MTokenParseError,
+  w as M2M_DEFAULTS,
+  gt as MINIMAL_DEFAULT_SCOPES,
+  Re as OS,
+  Y as PASSFLOW_CLOUD_URL,
+  ue as POPUP_HEIGHT,
+  le as POPUP_POLL_INTERVAL_MS,
+  pe as POPUP_TIMEOUT_MS,
+  de as POPUP_WIDTH,
+  G as Passflow,
+  T as PassflowAdminEndpointPaths,
   c as PassflowEndpointPaths,
   l as PassflowError,
   a as PassflowEvent,
-  Y as PopupClosedError,
-  pe as Providers,
+  W as PopupClosedError,
+  Ce as Providers,
   _ as RequestMethod,
-  ee as SDK_VERSION,
-  V as SessionState,
-  we as SettingAPI,
-  G as TOKEN_EXPIRY_BUFFER_SECONDS,
-  Te as TenantAPI,
-  xe as TenantService,
-  Pe as TenantUserMembership,
-  Ue as TokenCacheService,
-  y as TokenDeliveryMode,
+  ce as SDK_VERSION,
+  H as SessionState,
+  Oe as SettingAPI,
+  j as TOKEN_EXPIRY_BUFFER_SECONDS,
+  Le as TenantAPI,
+  We as TenantService,
+  Xe as TenantUserMembership,
+  Je as TokenCacheService,
+  v as TokenDeliveryMode,
   k as TokenType,
-  Ee as TwoFactorApiClient,
-  fe as TwoFactorPolicy,
-  $e as TwoFactorService,
-  ae as USERNAME_MAX_LENGTH,
-  ne as USERNAME_MIN_LENGTH,
-  _e as UserAPI,
-  Oe as UserService,
-  le as WebAdapter,
-  Ye as getOSFromDeviceType,
-  S as isTokenExpired,
-  P as isValidEmail,
-  D as isValidJWTFormat,
-  x as isValidPhoneNumber,
-  Ae as isValidUsername,
+  Ne as TwoFactorApiClient,
+  Fe as TwoFactorPolicy,
+  Ze as TwoFactorService,
+  Te as UPGRADE_REQUIRED,
+  fe as USERNAME_MAX_LENGTH,
+  ge as USERNAME_MIN_LENGTH,
+  B as UpgradeCancelledError,
+  St as UpgradeController,
+  b as UpgradeFactorError,
+  O as UpgradeUnsatisfiableError,
+  Ke as UserAPI,
+  Qe as UserService,
+  Se as WebAdapter,
+  ot as factorRegistry,
+  kt as getOSFromDeviceType,
+  y as isTokenExpired,
+  x as isValidEmail,
+  P as isValidJWTFormat,
+  U as isValidPhoneNumber,
+  qe as isValidUsername,
+  be as parseChallengeBody,
+  Ie as parseChallengeHeader,
   m as parseToken,
-  v as pathWithParams,
-  be as sanitizeErrorMessage,
-  A as webAdapter
+  Ae as parseUpgradeChallenge,
+  it as passkeyFactor,
+  E as pathWithParams,
+  st as recoveryCodesFactor,
+  Ve as sanitizeErrorMessage,
+  ht as selectFactors,
+  rt as totpFactor,
+  C as webAdapter
 };
 //# sourceMappingURL=index.mjs.map