@passflow/core 0.14.0 → 0.14.1

package/dist/index.mjs

@@ -1,9 +1,9 @@
-import F from "axios";
-import { v4 as X } from "uuid";
-import { startAuthentication as W, startRegistration as J } from "@simplewebauthn/browser";
-const Z = "0.14.0", Q = {
-  version: Z
-}, b = "X-Passflow-Clientid", I = "Authorization", ee = "X-Passflow-DeviceId", te = "X-Passflow-DeviceType", re = Q.version, Qe = ["id", "offline", "openid"], se = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], G = "https://auth.passflow.cloud", et = "default", ie = 500, oe = 600, ne = 100, ae = 6e4, V = 30, ce = 3, he = 30, de = 200, ue = (i) => {
+import M from "axios";
+import { v4 as te } from "uuid";
+import { startAuthentication as re, startRegistration as se } from "@simplewebauthn/browser";
+const ie = "0.14.1", oe = {
+  version: ie
+}, A = "X-Passflow-Clientid", I = "Authorization", ne = "X-Passflow-DeviceId", ae = "X-Passflow-DeviceType", ce = oe.version, gt = ["id", "offline", "openid"], he = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], Y = "https://auth.passflow.cloud", ft = "default", de = 500, ue = 600, le = 100, pe = 6e4, j = 30, ge = 3, fe = 30, ke = 200, me = (i) => {
   const e = [];
   let t;
   for (t in i) {
@@ -18,14 +18,14 @@ const Z = "0.14.0", Q = {
   }
   return { raw: i, tenants: e };
 };
-function le(i) {
+function ve(i) {
   if (typeof window < "u" && typeof window.atob == "function")
     return window.atob(i);
   if (typeof Buffer < "u")
     return Buffer.from(i, "base64").toString("utf-8");
   throw new Error("No Base64 decoding method available in this environment");
 }
-class pe {
+class ye {
   constructor(e) {
     this.storageManager = e;
   }
@@ -54,19 +54,19 @@ class pe {
       return m(t);
   }
 }
-function y(i, e = V) {
+function y(i, e = j) {
   return Math.floor(Date.now() / 1e3) + e > i.exp;
 }
 function m(i) {
   const e = i.split(".")[1];
   if (!e) throw new Error("Invalid token string");
-  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = le(r), o = decodeURIComponent(
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = ve(r), o = decodeURIComponent(
     s.split("").map((h) => "%" + ("00" + h.charCodeAt(0).toString(16)).slice(-2)).join("")
   ), n = JSON.parse(o);
-  return n.membership = n.passflow_tm && n.type !== "invite" ? ue(n.passflow_tm) : void 0, n;
+  return n.membership = n.passflow_tm && n.type !== "invite" ? me(n.passflow_tm) : void 0, n;
 }
-var k = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(k || {}), v = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(v || {}), q = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(q || {});
-class B {
+var k = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(k || {}), v = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(v || {}), H = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(H || {});
+class z {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
   }
@@ -176,7 +176,7 @@ class B {
   loadPersistedSessionState() {
     try {
       const e = this.storageManager.storage.getItem(this.SESSION_STATE_KEY);
-      e && Object.values(q).includes(e) && (this.sessionState = e);
+      e && Object.values(H).includes(e) && (this.sessionState = e);
     } catch {
     }
   }
@@ -217,7 +217,7 @@ class B {
     }
   }
 }
-class $ {
+class L {
   constructor({ storage: e, prefix: t } = {}) {
     this.keyStoragePrefix = "", this.scopes = `${this.keyStoragePrefix}tokens_scopes`, this.deviceId = `${this.keyStoragePrefix}passflowDeviceId`, this.invitationToken = `${this.keyStoragePrefix}passflowInvitationToken`, this.previousRedirectUrl = `${this.keyStoragePrefix}passflowPreviousRedirectUrl`, this.STORAGE_PREFIX = "passflow_", this.ID_TOKEN_KEY = `${this.STORAGE_PREFIX}id_token`, this.CSRF_TOKEN_KEY = `${this.STORAGE_PREFIX}csrf_token`, this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.storage = e ?? localStorage, this.keyStoragePrefix = t ? `${t}_` : "";
   }
@@ -400,9 +400,9 @@ class $ {
     return `${this.keyStoragePrefix}${e}`;
   }
 }
-class Y {
+class X {
   constructor(e) {
-    this.storageManager = e ?? new $();
+    this.storageManager = e ?? new L();
   }
   getDeviceId() {
     const e = this.storageManager.getDeviceId();
@@ -413,19 +413,19 @@ class Y {
     return e;
   }
   generateUniqueDeviceId() {
-    return X();
+    return te();
   }
 }
-class j extends Error {
+class W extends Error {
   constructor(e = "Authentication popup was closed") {
     super(e), this.name = "PopupClosedError";
   }
 }
-class ge {
+class Se {
   constructor() {
     this.passkeys = {
-      startRegistration: (e) => J({ optionsJSON: e }),
-      startAuthentication: (e) => W({ optionsJSON: e })
+      startRegistration: (e) => se({ optionsJSON: e }),
+      startAuthentication: (e) => re({ optionsJSON: e })
     };
   }
   // ----------------------------------------------------------------
@@ -557,25 +557,25 @@ class ge {
           'openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.'
         )
       );
-    const s = t.width ?? ie, o = t.height ?? oe, n = t.expectedReturnOrigin ?? window.location.origin, h = window.open(e, "_blank", `width=${s},height=${o}`);
+    const s = t.width ?? de, o = t.height ?? ue, n = t.expectedReturnOrigin ?? window.location.origin, h = window.open(e, "_blank", `width=${s},height=${o}`);
     return h ? new Promise((d, u) => {
       const g = Date.now(), f = setInterval(() => {
         if (h.closed) {
-          clearInterval(f), u(new j());
+          clearInterval(f), u(new W());
           return;
         }
-        if (Date.now() - g > ae) {
+        if (Date.now() - g > pe) {
           clearInterval(f), h.close(), u(new Error("Authentication popup timed out"));
           return;
         }
         try {
           if (h.location.href.startsWith(n)) {
-            const M = h.location.search, z = h.location.hash;
-            clearInterval(f), h.close(), d({ callbackSearch: M, callbackHash: z });
+            const D = h.location.search, ee = h.location.hash;
+            clearInterval(f), h.close(), d({ callbackSearch: D, callbackHash: ee });
           }
         } catch {
         }
-      }, ne);
+      }, le);
     }) : (window.location.href = e, new Promise(() => {
     }));
   }
@@ -633,62 +633,62 @@ class ge {
     return "web";
   }
 }
-const A = new ge(), fe = "insufficient_user_authentication", ke = "upgrade_required", L = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, me = (i) => i.replace(/\\(.)/g, "$1"), ve = (i) => {
+const C = new Se(), we = "insufficient_user_authentication", Te = "upgrade_required", K = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, Ee = (i) => i.replace(/\\(.)/g, "$1"), _e = (i) => {
   const e = {};
-  L.lastIndex = 0;
-  for (const t of i.matchAll(L)) {
+  K.lastIndex = 0;
+  for (const t of i.matchAll(K)) {
     const r = t[1];
     if (!r)
       continue;
     const s = t[2], o = t[3];
-    e[r.toLowerCase()] = s !== void 0 ? me(s) : o ?? "";
+    e[r.toLowerCase()] = s !== void 0 ? Ee(s) : o ?? "";
   }
   return e;
-}, H = (i) => {
+}, J = (i) => {
   const e = typeof i == "number" ? i : Number.parseInt(String(i ?? ""), 10);
   return Number.isFinite(e) && e > 0 ? e : void 0;
-}, ye = (i, e) => {
+}, Ie = (i, e) => {
   if (!i || !/(^|[\s,])Bearer\b/i.test(i))
     return;
-  const t = ve(i);
-  if (t.error === fe)
+  const t = _e(i);
+  if (t.error === we)
     return {
       acrValues: t.acr_values || void 0,
-      maxAge: H(t.max_age),
+      maxAge: J(t.max_age),
       status: e
     };
-}, Se = (i, e) => {
+}, be = (i, e) => {
   if (!i || typeof i != "object")
     return;
   const t = i;
-  if (t.error === ke)
+  if (t.error === Te)
     return {
       acrValues: typeof t.acr_values == "string" && t.acr_values ? t.acr_values : void 0,
-      maxAge: H(t.max_age),
+      maxAge: J(t.max_age),
       status: e
     };
-}, we = (i, e, t) => {
+}, Ae = (i, e, t) => {
   if (!(i !== 401 && i !== 403))
-    return ye(e("www-authenticate"), i) ?? Se(t, i);
+    return Ie(e("www-authenticate"), i) ?? be(t, i);
 };
-var E = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(E || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorSetupStart = "/v2/user/2fa/setup/start", i.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), T = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(T || {});
+var _ = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(_ || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorSetupStart = "/v2/user/2fa/setup/start", i.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), T = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(T || {});
 class l extends Error {
   constructor(e) {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
-var Te = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(Te || {}), _e = /* @__PURE__ */ ((i) => (i.web = "web", i.ios = "ios", i.android = "android", i))(_e || {});
-function tt(i) {
+var Ce = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(Ce || {}), Re = /* @__PURE__ */ ((i) => (i.web = "web", i.ios = "ios", i.android = "android", i))(Re || {});
+function kt(i) {
   return i;
 }
-function _(i, e) {
+function E(i, e) {
   let t = i;
   return Object.entries(e).forEach(([r, s]) => {
     t = t.replace(`:${r}`, s);
   }), t;
 }
-var Ee = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(Ee || {});
-const Ie = 3, be = 1e3, Ae = (i) => we(
+var Fe = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(Fe || {});
+const Me = 3, De = 1e3, Pe = (i) => Ae(
   i.status,
   (e) => {
     const t = i.headers?.[e] ?? i.headers?.[e.toLowerCase()];
@@ -703,18 +703,18 @@ class S {
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh"];
     const { url: s, appId: o, keyStoragePrefix: n } = e;
-    this._platform = e.platform ?? A, this.url = s || G, this.storageManager = t ?? new $({
+    this._platform = e.platform ?? C, this.url = s || Y, this.storageManager = t ?? new L({
       prefix: n ?? ""
-    }), this.deviceService = r ?? new Y(this.storageManager), this.tokenService = new pe(this.storageManager), this.tokenDeliveryManager = new B(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
+    }), this.deviceService = r ?? new X(this.storageManager), this.tokenService = new ye(this.storageManager), this.tokenDeliveryManager = new z(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [b]: o
+      [A]: o
     });
     const h = this.deviceService.getDeviceId();
     this.defaultHeaders = {
       ...this.defaultHeaders,
-      [ee]: h,
-      [te]: this._platform.getDeviceType()
-    }, this.detectCookieSupport(), this.instance = F.create({
+      [ne]: h,
+      [ae]: this._platform.getDeviceType()
+    }, this.detectCookieSupport(), this.instance = M.create({
       baseURL: this.url,
       headers: { ...this.defaultHeaders }
     }), this.instance.interceptors.request.use(async (d) => {
@@ -735,7 +735,7 @@ class S {
       const u = this.storageManager.getTokens();
       if (u?.access_token) {
         const g = m(u.access_token);
-        if (y(g, V) && u.refresh_token)
+        if (y(g, j) && u.refresh_token)
           try {
             if (this.refreshPromise) {
               const f = await this.refreshPromise;
@@ -756,7 +756,7 @@ class S {
       return d;
     }), this.instance.interceptors.response.use(
       (d) => d,
-      async (d) => (d.response?.status === 401 && !Ae(d.response) && this.tokenDeliveryManager.setSessionInvalid(), d.response?.status === 429 ? await this.handleRateLimitError(d) : this.handleAxiosError(d))
+      async (d) => (d.response?.status === 401 && !Pe(d.response) && this.tokenDeliveryManager.setSessionInvalid(), d.response?.status === 429 ? await this.handleRateLimitError(d) : this.handleAxiosError(d))
     );
   }
   get origin() {
@@ -820,9 +820,9 @@ class S {
     if (!["GET", "HEAD", "OPTIONS"].includes(r || ""))
       return Promise.reject(e);
     const o = t._retryCount || 0;
-    if (o >= Ie)
+    if (o >= Me)
       return Promise.reject(e);
-    let n = be * Math.pow(2, o);
+    let n = De * Math.pow(2, o);
     const h = e.response?.headers?.["retry-after"];
     if (h) {
       const d = Number.parseInt(h, 10);
@@ -863,19 +863,19 @@ class S {
     })).data;
   }
   get(e, t) {
-    return this.send(E.GET, e, t);
+    return this.send(_.GET, e, t);
   }
   post(e, t, r) {
-    return this.send(E.POST, e, { data: t, ...r });
+    return this.send(_.POST, e, { data: t, ...r });
   }
   put(e, t, r) {
-    return this.send(E.PUT, e, { data: t, ...r });
+    return this.send(_.PUT, e, { data: t, ...r });
   }
   patch(e, t, r) {
-    return this.send(E.PATCH, e, { data: t, ...r });
+    return this.send(_.PATCH, e, { data: t, ...r });
   }
   delete(e, t) {
-    return this.send(E.DELETE, e, t);
+    return this.send(_.DELETE, e, t);
   }
   /**
    * Update the appId and propagate it to axios headers.
@@ -886,11 +886,11 @@ class S {
   setAppId(e) {
     this.appId = e, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [b]: e
-    }, this.instance.defaults.headers.common[b] = e;
+      [A]: e
+    }, this.instance.defaults.headers.common[A] = e;
   }
 }
-class Ce {
+class xe {
   constructor(e, t, r) {
     this.axiosClient = new S(e, t, r);
   }
@@ -901,7 +901,7 @@ class Ce {
     return this.axiosClient.get(c.appSettings);
   }
 }
-class Re {
+class Ue {
   constructor(e, t, r) {
     this.axiosClient = new S(e, t, r);
   }
@@ -980,7 +980,7 @@ class Re {
     return this.axiosClient.post(c.resetPassword, s, {
       headers: {
         [I]: `Bearer ${r}`,
-        [b]: void 0
+        [A]: void 0
       }
     });
   }
@@ -1029,11 +1029,11 @@ class Re {
     };
     let h = c.passkeyValidate;
     !o && s && (h = T.passkeyValidate);
-    const d = o ? { [b]: o } : {};
+    const d = o ? { [A]: o } : {};
     return this.axiosClient.post(h, n, { headers: d });
   }
 }
-class rt {
+class mt {
   constructor(e, t, r) {
     this.axiosClient = new S(e, t, r);
   }
@@ -1041,14 +1041,14 @@ class rt {
     this.axiosClient.setAppId(e);
   }
   getCLIAuthStatus(e) {
-    const t = _(c.cliAuthStatus, { sessionId: e });
+    const t = E(c.cliAuthStatus, { sessionId: e });
     return this.axiosClient.get(t);
   }
   completeCLIAuth(e) {
     return this.axiosClient.post(c.cliAuthComplete, e);
   }
 }
-class Fe {
+class $e {
   constructor(e, t, r) {
     this.axiosClient = new S(e, t, r);
   }
@@ -1074,7 +1074,7 @@ class Fe {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const r = _(c.invitationsPath, {
+    const r = E(c.invitationsPath, {
       tenantID: e.tenantID
     });
     return this.axiosClient.get(r, { params: t }).then((s) => ({
@@ -1088,7 +1088,7 @@ class Fe {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = _(c.invitationDelete, {
+    const t = E(c.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -1099,7 +1099,7 @@ class Fe {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = _(c.invitationResend, {
+    const t = E(c.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -1110,13 +1110,13 @@ class Fe {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = _(c.invitationGetLink, {
+    const t = E(c.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
   }
 }
-class Me {
+class Oe {
   constructor(e, t, r) {
     this.axiosClient = new S(e, t, r);
   }
@@ -1133,7 +1133,7 @@ class Me {
     return this.axiosClient.get(c.settingsPasskey);
   }
 }
-class De {
+class Le {
   constructor(e, t, r) {
     this.axiosClient = new S(e, t, r);
   }
@@ -1366,7 +1366,7 @@ class De {
     return this.axiosClient.delete(s);
   }
 }
-class Pe {
+class Ne {
   constructor(e, t, r) {
     this.axiosClient = new S(e, t, r);
   }
@@ -1580,7 +1580,7 @@ class Pe {
    * DELETE /v2/user/2fa/methods/:id
    */
   removeMethod(e) {
-    const t = _(c.TwoFactorMethodRemove, { id: e });
+    const t = E(c.TwoFactorMethodRemove, { id: e });
     return this.axiosClient.delete(t);
   }
   /**
@@ -1625,11 +1625,11 @@ class Pe {
    * DELETE /v2/user/2fa/trusted-devices/:id
    */
   revokeTrustedDevice(e) {
-    const t = _(c.TwoFactorTrustedDeviceRevoke, { id: e });
+    const t = E(c.TwoFactorTrustedDeviceRevoke, { id: e });
     return this.axiosClient.delete(t);
   }
 }
-class xe {
+class Ke {
   constructor(e, t, r) {
     this.axiosClient = new S(e, t, r);
   }
@@ -1675,7 +1675,7 @@ class xe {
   }
 }
 var a = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.SessionExpired = "session:expired", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(a || {});
-class Ue {
+class Ge {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
   }
@@ -1715,42 +1715,42 @@ class Ue {
     });
   }
 }
-function D(i) {
+function P(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.split(".");
   if (e.length !== 3) return !1;
   const t = /^[A-Za-z0-9_-]+$/;
   return e.every((r) => t.test(r) && r.length > 0);
 }
-function $e(i) {
-  return i.replace(/<[^>]*>/g, "").substring(0, de);
+function Ve(i) {
+  return i.replace(/<[^>]*>/g, "").substring(0, ke);
 }
-function P(i) {
+function x(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
   return e.length === 0 ? !1 : /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
 }
-function x(i) {
+function U(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
   return /^\+[1-9]\d{1,14}$/.test(e);
 }
-function Oe(i) {
+function qe(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
-  return e.length < ce || e.length > he ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
+  return e.length < ge || e.length > fe ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
 }
-function C(i, e = 6) {
+function R(i, e = 6) {
   return !i || typeof i != "string" ? !1 : (e === 8 ? /^\d{8}$/ : /^\d{6}$/).test(i);
 }
-function Le(i) {
+function Be(i) {
   if (!i || typeof i != "string") return null;
   const e = i.toUpperCase().replace(/\s+/g, "");
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
-class Ne {
-  constructor(e, t, r, s, o, n, h, d, u, g, f, M = A) {
-    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = h, this.url = d, this.sessionCallbacks = u, this.appId = g, this.platform = M, this.tokenExchangeConfig = f, this.tokenDeliveryManager = new B(r), f?.enabled && this.tokenDeliveryManager.setMode(v.BFF), this.initializeSession();
+class Ye {
+  constructor(e, t, r, s, o, n, h, d, u, g, f, D = C) {
+    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = h, this.url = d, this.sessionCallbacks = u, this.appId = g, this.platform = D, this.tokenExchangeConfig = f, this.tokenDeliveryManager = new z(r), f?.enabled && this.tokenDeliveryManager.setMode(v.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -1817,7 +1817,7 @@ class Ne {
       throw new Error(`BFF token storage failed: ${t.status}`);
   }
   async signIn(e) {
-    if ("email" in e && e.email && !P(e.email)) {
+    if ("email" in e && e.email && !x(e.email)) {
       const s = new Error("Invalid email format"), o = {
         message: "Invalid email format",
         originalError: s,
@@ -1825,7 +1825,7 @@ class Ne {
       };
       throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if ("username" in e && e.username && !Oe(e.username)) {
+    if ("username" in e && e.username && !qe(e.username)) {
       const s = new Error(
         "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens"
       ), o = {
@@ -1835,7 +1835,7 @@ class Ne {
       };
       throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if ("phone" in e && e.phone && !x(e.phone)) {
+    if ("phone" in e && e.phone && !U(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: s,
@@ -1866,7 +1866,7 @@ class Ne {
     }
   }
   async signUp(e) {
-    if (e.user.email && !P(e.user.email)) {
+    if (e.user.email && !x(e.user.email)) {
       const t = new Error("Invalid email format"), r = {
         message: "Invalid email format",
         originalError: t,
@@ -1874,7 +1874,7 @@ class Ne {
       };
       throw this.subscribeStore.notify(a.Error, r), t;
     }
-    if (e.user.phone_number && !x(e.user.phone_number)) {
+    if (e.user.phone_number && !U(e.user.phone_number)) {
       const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), r = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: t,
@@ -1899,7 +1899,7 @@ class Ne {
     }
   }
   async passwordlessSignIn(e) {
-    if (e.email && !P(e.email)) {
+    if (e.email && !x(e.email)) {
       const s = new Error("Invalid email format"), o = {
         message: "Invalid email format",
         originalError: s,
@@ -1907,7 +1907,7 @@ class Ne {
       };
       throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if (e.phone && !x(e.phone)) {
+    if (e.phone && !U(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: s,
@@ -2032,13 +2032,13 @@ class Ne {
         message: r instanceof Error ? r.message : "Token refresh failed",
         originalError: r,
         code: r instanceof l ? r.id : void 0,
-        details: F.isAxiosError(r) && r.response ? {
+        details: M.isAxiosError(r) && r.response ? {
           status: r.response.status,
           data: r.response.data
         } : void 0
       };
       this.subscribeStore.notify(a.Error, s);
-      const o = F.isAxiosError(r) && r.response?.status && r.response.status >= 400 && r.response.status < 500;
+      const o = M.isAxiosError(r) && r.response?.status && r.response.status >= 400 && r.response.status < 500;
       throw o && (this.tokenCacheService.tokenExpiredFlag = !0, this.tokenCacheService.setTokensCache(void 0), this.storageManager.deleteTokens(), this.subscribeStore.notify(a.SessionExpired, { reason: "refresh_failed" })), r instanceof l ? r : o ? new Error(`Getting unknown error message from server with code:${r.response?.status}`) : r;
     }
   }
@@ -2161,7 +2161,7 @@ class Ne {
     } catch (o) {
       const n = {
         message: o instanceof Error ? o.message : "Authentication failed",
-        code: o instanceof j ? "POPUP_CLOSED" : "AUTH_FAILED",
+        code: o instanceof W ? "POPUP_CLOSED" : "AUTH_FAILED",
         originalError: o
       };
       this.subscribeStore.notify(a.Error, n);
@@ -2262,7 +2262,7 @@ class Ne {
     }
   }
 }
-class Ke {
+class je {
   constructor(e) {
     this.invitationApi = e;
   }
@@ -2307,7 +2307,7 @@ class Ke {
     return this.invitationApi.getInvitationLink(e);
   }
 }
-class Ge {
+class He {
   error(e, ...t) {
     console.error(e, ...t);
   }
@@ -2321,10 +2321,10 @@ class Ge {
     console.debug(e, ...t);
   }
 }
-function Ve() {
-  return new Ge();
+function ze() {
+  return new He();
 }
-class qe {
+class Xe {
   constructor(e) {
     this.data = this.normalize(e);
   }
@@ -2394,9 +2394,9 @@ class qe {
     return this.data;
   }
 }
-class Be {
+class We {
   constructor(e, t, r) {
-    this.tenantApi = e, this.scopes = t, this.logger = r || Ve();
+    this.tenantApi = e, this.scopes = t, this.logger = r || ze();
   }
   /**
    * Handle Passflow API errors
@@ -2405,7 +2405,7 @@ class Be {
    * @throws Formatted error with Passflow API error details
    */
   handlePassflowError(e, t) {
-    if (F.isAxiosError(e) && e.response?.data) {
+    if (M.isAxiosError(e) && e.response?.data) {
       const r = e.response.data;
       if (typeof r == "object" && r !== null && "error" in r && typeof r.error == "object" && r.error !== null) {
         const s = r.error;
@@ -2466,7 +2466,7 @@ class Be {
   async getTenantUserMembership(e) {
     try {
       const t = await this.tenantApi.getTenantDetails(e);
-      return new qe(t);
+      return new Xe(t);
     } catch (t) {
       this.handlePassflowError(t, `Get tenant user membership failed for tenant ID ${e}`);
     }
@@ -2764,8 +2764,8 @@ class Be {
     }
   }
 }
-class Ye {
-  constructor(e, t, r, s = A) {
+class Je {
+  constructor(e, t, r, s = C) {
     this.storageManager = e, this.authApi = t, this.subscribeStore = r, this.platform = s, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.unsubscribeForeground = null, this.unsubscribeUnload = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupLifecycleListeners();
   }
   initialize() {
@@ -2863,7 +2863,7 @@ class Ye {
     return y(e);
   }
 }
-class je {
+class Ze {
   constructor(e, t) {
     this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
     const r = {
@@ -2916,7 +2916,7 @@ class je {
    * Returns recovery codes that MUST be displayed to user
    */
   async confirmSetup(e) {
-    if (!C(e, this.totpDigits))
+    if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.confirmSetup({ code: e });
@@ -2935,7 +2935,7 @@ class je {
    * Completes authentication if successful
    */
   async verify(e) {
-    if (!C(e, this.totpDigits))
+    if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     if (this.recoverPartialAuthState(), !this.isVerificationRequired())
       throw new Error("2FA verification expired or not required. User must sign in first.");
@@ -2957,7 +2957,7 @@ class je {
    */
   async useRecoveryCode(e) {
     try {
-      const t = Le(e);
+      const t = Be(e);
       if (!t)
         throw new Error("Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).");
       if (this.recoverPartialAuthState(), !this.isVerificationRequired())
@@ -2983,7 +2983,7 @@ class je {
    * Disable 2FA (requires TOTP verification)
    */
   async disable(e) {
-    if (!C(e, this.totpDigits))
+    if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.disable({ code: e });
@@ -2996,7 +2996,7 @@ class je {
    * Regenerate recovery codes
    */
   async regenerateRecoveryCodes(e) {
-    if (!C(e, this.totpDigits))
+    if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.regenerateRecoveryCodes({ code: e }), r = [...t.recovery_codes];
@@ -3260,8 +3260,8 @@ class je {
     }
   }
 }
-class He {
-  constructor(e, t, r = A) {
+class Qe {
+  constructor(e, t, r = C) {
     this.userAPI = e, this.deviceService = t, this.platform = r;
   }
   /**
@@ -3312,7 +3312,7 @@ class He {
     return await this.userAPI.addUserPasskeyComplete(d, s, n);
   }
 }
-const O = class O {
+const N = class N {
   constructor(e) {
     this.doRefreshTokens = !1, this.session = async ({
       createSession: o,
@@ -3322,10 +3322,10 @@ const O = class O {
       this.createSessionCallback = o, this.expiredSessionCallback = n, this.doRefreshTokens = h, await this.submitSessionCheck();
     };
     const { url: t, appId: r, scopes: s } = e;
-    this.url = t || G, this.appId = r, this.platform = e.platform ?? A, this.storageManager = new $({
+    this.url = t || Y, this.appId = r, this.platform = e.platform ?? C, this.storageManager = new L({
       prefix: e.keyStoragePrefix ?? "",
       storage: this.platform.storage
-    }), this.deviceService = new Y(this.storageManager), this.authApi = new Re(e, this.storageManager, this.deviceService), this.appApi = new Ce(e, this.storageManager, this.deviceService), this.userApi = new xe(e, this.storageManager, this.deviceService), this.settingApi = new Me(e, this.storageManager, this.deviceService), this.tenantApi = new De(e, this.storageManager, this.deviceService), this.invitationApi = new Fe(e, this.storageManager, this.deviceService), this.twoFactorApi = new Pe(e, this.storageManager, this.deviceService), this.subscribeStore = new Ue(), this.tokenCacheService = new Ye(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = s ?? se, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ne(
+    }), this.deviceService = new X(this.storageManager), this.authApi = new Ue(e, this.storageManager, this.deviceService), this.appApi = new xe(e, this.storageManager, this.deviceService), this.userApi = new Ke(e, this.storageManager, this.deviceService), this.settingApi = new Oe(e, this.storageManager, this.deviceService), this.tenantApi = new Le(e, this.storageManager, this.deviceService), this.invitationApi = new $e(e, this.storageManager, this.deviceService), this.twoFactorApi = new Ne(e, this.storageManager, this.deviceService), this.subscribeStore = new Ge(), this.tokenCacheService = new Je(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = s ?? he, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ye(
       this.authApi,
       this.deviceService,
       this.storageManager,
@@ -3341,7 +3341,7 @@ const O = class O {
       this.appId ?? "",
       e.tokenExchange,
       this.platform
-    ), this.userService = new He(this.userApi, this.deviceService, this.platform), this.tenantService = new Be(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Ke(this.invitationApi), this.twoFactorService = new je(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
+    ), this.userService = new Qe(this.userApi, this.deviceService, this.platform), this.tenantService = new We(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new je(this.invitationApi), this.twoFactorService = new Ze(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
   }
   get origin() {
     return this.platform.getCurrentUrl()?.origin ?? "";
@@ -3452,7 +3452,7 @@ const O = class O {
     const s = t.get("access_token"), o = t.get("refresh_token"), n = t.get("id_token"), h = t.get("scopes")?.split(",") ?? this.scopes;
     let d;
     if (s) {
-      if (!D(s)) {
+      if (!P(s)) {
         const u = {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -3460,7 +3460,7 @@ const O = class O {
         this.subscribeStore.notify(a.Error, u), this.cleanupUrlParams(r, e);
         return;
       }
-      if (o && !D(o)) {
+      if (o && !P(o)) {
         const u = {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -3468,7 +3468,7 @@ const O = class O {
         this.subscribeStore.notify(a.Error, u), this.cleanupUrlParams(r, e);
         return;
       }
-      if (n && !D(n)) {
+      if (n && !P(n)) {
         const u = {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -3488,7 +3488,7 @@ const O = class O {
   checkErrorsFromURL() {
     const t = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("error");
     if (t) {
-      const r = $e(t);
+      const r = Ve(t);
       return new Error(r);
     }
   }
@@ -4672,8 +4672,8 @@ const O = class O {
     this.twoFactorService.clearMagicLinkSession();
   }
 };
-O.version = re;
-let N = O;
+N.version = ce;
+let G = N;
 class p extends Error {
   constructor(e) {
     super(e.message), this.name = "M2MError", this.code = e.code, this.status = e.status ?? 400, this.errorUri = e.errorUri, this.rateLimitInfo = e.rateLimitInfo, this.headers = e.headers, this.cause = e.cause, this.timestamp = (/* @__PURE__ */ new Date()).toISOString(), Error.captureStackTrace && Error.captureStackTrace(this, p);
@@ -4769,7 +4769,7 @@ class p extends Error {
     return this.status && (e += ` (HTTP ${this.status})`), e;
   }
 }
-class K extends p {
+class V extends p {
   constructor(e, t) {
     super({
       code: "temporarily_unavailable",
@@ -4779,7 +4779,7 @@ class K extends p {
     }), this.name = "M2MNetworkError";
   }
 }
-class R extends p {
+class F extends p {
   constructor(e, t) {
     super({
       code: "invalid_request",
@@ -4789,7 +4789,7 @@ class R extends p {
     }), this.name = "M2MTokenParseError";
   }
 }
-class U extends p {
+class $ extends p {
   constructor(e) {
     super({
       code: "invalid_request",
@@ -4798,7 +4798,7 @@ class U extends p {
     }), this.name = "M2MConfigError";
   }
 }
-const st = {
+const vt = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -4822,7 +4822,7 @@ const st = {
   /** Content-Type for token requests */
   CONTENT_TYPE: "application/x-www-form-urlencoded"
 };
-class ze {
+class et {
   constructor() {
     this.cache = /* @__PURE__ */ new Map();
   }
@@ -4840,7 +4840,7 @@ class ze {
     return this.cache.delete(e), Promise.resolve();
   }
 }
-const Xe = {
+const tt = {
   shouldRetry(i, e) {
     return e >= 3 ? !1 : i.code === "server_error" || i.code === "temporarily_unavailable" || i.code === "rate_limit_exceeded" || i.status !== void 0 && i.status >= 500;
   },
@@ -4848,7 +4848,7 @@ const Xe = {
     return Math.pow(2, i - 1) * 1e3;
   }
 };
-class it {
+class yt {
   /**
    * Create a new M2M client
    *
@@ -4866,11 +4866,11 @@ class it {
    */
   constructor(e) {
     if (!e.url)
-      throw new U("M2M client requires a URL");
+      throw new $("M2M client requires a URL");
     if (!e.clientId)
-      throw new U("M2M client requires a clientId");
+      throw new $("M2M client requires a clientId");
     if (!e.clientSecret)
-      throw new U("M2M client requires a clientSecret");
+      throw new $("M2M client requires a clientSecret");
     const t = e.url.replace(/\/$/, "");
     this.config = {
       url: t,
@@ -4888,7 +4888,7 @@ class it {
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new ze(), this.retryStrategy = e.retryStrategy ?? Xe, this.tokenEndpoint = `${t}${w.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new et(), this.retryStrategy = e.retryStrategy ?? tt, this.tokenEndpoint = `${t}${w.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
@@ -5008,7 +5008,7 @@ class it {
       }
       return h;
     } catch (o) {
-      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new K(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new K(`Network error: ${o.message}`, o) : o instanceof p ? o : p.fromError(o instanceof Error ? o : new Error(String(o)));
+      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new V(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new V(`Network error: ${o.message}`, o) : o instanceof p ? o : p.fromError(o instanceof Error ? o : new Error(String(o)));
     }
   }
   /**
@@ -5103,14 +5103,14 @@ class it {
     try {
       const t = e.split(".");
       if (t.length !== 3)
-        throw new R("Invalid JWT format: expected 3 parts");
+        throw new F("Invalid JWT format: expected 3 parts");
       const r = t[1];
       if (!r)
-        throw new R("Invalid JWT format: missing payload");
+        throw new F("Invalid JWT format: missing payload");
       const s = atob(r.replace(/-/g, "+").replace(/_/g, "/")), o = JSON.parse(s);
       return o.scopes && typeof o.scopes == "string" ? o.scopes = o.scopes.split(" ") : o.scopes || (o.scopes = []), o;
     } catch (t) {
-      throw t instanceof R ? t : new R(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
+      throw t instanceof F ? t : new F(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
     }
   }
   /**
@@ -5195,69 +5195,211 @@ class it {
     return this.config.audience;
   }
 }
+class b extends Error {
+  constructor(e, t, r = !1) {
+    super(t), this.name = "UpgradeFactorError", this.factor = e, this.cancelled = r;
+  }
+}
+const Z = (i, e) => {
+  const t = e?.trim();
+  if (!t)
+    throw new b(i, "A verification code is required");
+  return t;
+}, rt = {
+  type: "totp",
+  requiresPrepare: !1,
+  input: "code",
+  assert: async ({ code: i }) => ({ code: Z("totp", i) })
+}, st = {
+  type: "recovery_codes",
+  requiresPrepare: !1,
+  input: "code",
+  assert: async ({ code: i }) => ({ code: Z("recovery_codes", i) })
+}, it = {
+  type: "passkey",
+  requiresPrepare: !0,
+  input: "none",
+  assert: async ({ prepared: i, platform: e }) => {
+    if (!i?.webauthn)
+      throw new b("passkey", "The upgrade challenge carried no WebAuthn options");
+    const t = e.passkeys;
+    if (!t)
+      throw new b("passkey", "This platform does not support passkeys");
+    let r;
+    try {
+      r = await t.startAuthentication(i.webauthn);
+    } catch (s) {
+      throw new b("passkey", s?.message || "Passkey verification was cancelled", !0);
+    }
+    if (!r)
+      throw new b("passkey", "Passkey verification was cancelled", !0);
+    return { challenge_id: i.challengeId, credential: r };
+  }
+}, Q = Object.freeze([
+  rt,
+  it,
+  st
+]), ot = (i = Q) => new Map(i.map((e) => [e.type, e])), nt = 3, at = {
+  passkey: 0,
+  totp: 1,
+  email_otp: 2,
+  sms_otp: 3,
+  recovery_codes: 9
+}, ct = (i) => {
+  if (!i)
+    return;
+  const e = i.split(/\s+/).map((t) => Number.parseInt(t, 10)).filter((t) => Number.isFinite(t));
+  return e.length > 0 ? Math.min(...e) : void 0;
+}, q = (i, e) => {
+  const t = at[i.type] ?? 5, r = e !== void 0 && e >= nt, s = i.type === "passkey";
+  return (r && !s ? 100 : 0) + t;
+}, ht = (i, e) => {
+  const t = ct(e.acrValues);
+  return [...i].sort((r, s) => q(r, t) - q(s, t));
+};
+class B extends Error {
+  constructor() {
+    super("Upgrade authentication was cancelled"), this.name = "UpgradeCancelledError";
+  }
+}
+class O extends Error {
+  constructor(e = "No available authentication factor can satisfy this challenge") {
+    super(e), this.name = "UpgradeUnsatisfiableError";
+  }
+}
+const dt = 3;
+class St {
+  constructor(e) {
+    this.inFlight = null, this.transport = e.transport, this.prompt = e.prompt, this.platform = e.platform, this.available = e.factors ?? Q, this.registry = ot(this.available), this.maxAttempts = e.maxAttempts ?? dt;
+  }
+  /**
+   * Elevates the session so the challenged request can be retried.
+   *
+   * Concurrent callers share one elevation: the first starts it, the rest await
+   * the same promise and all resolve together. Callers retry their own request
+   * once this resolves; it rejects if the user cancelled or ran out of attempts.
+   */
+  elevate(e) {
+    return this.inFlight ? this.inFlight : (this.inFlight = this.run(e).finally(() => {
+      this.inFlight = null;
+    }), this.inFlight);
+  }
+  async run(e) {
+    const t = ht(this.available, e);
+    if (t.length === 0)
+      throw new O();
+    let r;
+    for (let s = 0; s < this.maxAttempts; s++) {
+      const o = await this.prompt({ challenge: e, factors: t, previousError: r });
+      if (o.type === "cancel")
+        throw new B();
+      const n = this.registry.get(o.factor);
+      if (!n) {
+        r = new O(`Unknown authentication factor: ${o.factor}`);
+        continue;
+      }
+      try {
+        await this.proveAndCommit(n, o.code);
+        return;
+      } catch (h) {
+        if (h instanceof b && h.cancelled)
+          throw new B();
+        r = h;
+      }
+    }
+    throw r ?? new O("Upgrade authentication failed");
+  }
+  /**
+   * Runs one full proof for a single factor.
+   *
+   * The prepare round is re-run on every attempt rather than cached: a
+   * challenge is single-use and the server consumes it atomically, so a failed
+   * attempt has already spent it. Reusing the id would fail with
+   * `ErrorUpgradeChallengeInvalid` and look like a bad code to the user.
+   */
+  async proveAndCommit(e, t) {
+    const r = e.requiresPrepare ? await this.transport.prepare(e.type) : void 0, s = await e.assert({ code: t, prepared: r, platform: this.platform });
+    await this.transport.commit(e.type, s);
+  }
+}
 export {
-  b as APP_ID_HEADER_KEY,
+  A as APP_ID_HEADER_KEY,
   I as AUTHORIZATION_HEADER_KEY,
-  Ce as AppAPI,
-  Re as AuthAPI,
-  Ne as AuthService,
-  rt as CLIAuthAPI,
-  et as DEFAULT_GROUP_NAME,
-  se as DEFAULT_SCOPES,
-  ee as DEVICE_ID_HEADER_KEY,
-  te as DEVICE_TYPE_HEADER_KEY,
-  de as ERROR_MESSAGE_MAX_LENGTH,
-  Fe as InvitationAPI,
-  Ke as InvitationService,
-  it as M2MClient,
-  U as M2MConfigError,
+  xe as AppAPI,
+  Ue as AuthAPI,
+  Ye as AuthService,
+  mt as CLIAuthAPI,
+  ft as DEFAULT_GROUP_NAME,
+  he as DEFAULT_SCOPES,
+  Q as DEFAULT_UPGRADE_FACTORS,
+  ne as DEVICE_ID_HEADER_KEY,
+  ae as DEVICE_TYPE_HEADER_KEY,
+  ke as ERROR_MESSAGE_MAX_LENGTH,
+  we as INSUFFICIENT_USER_AUTHENTICATION,
+  $e as InvitationAPI,
+  je as InvitationService,
+  yt as M2MClient,
+  $ as M2MConfigError,
   p as M2MError,
-  st as M2MErrorCodes,
-  K as M2MNetworkError,
-  R as M2MTokenParseError,
+  vt as M2MErrorCodes,
+  V as M2MNetworkError,
+  F as M2MTokenParseError,
   w as M2M_DEFAULTS,
-  Qe as MINIMAL_DEFAULT_SCOPES,
-  _e as OS,
-  G as PASSFLOW_CLOUD_URL,
-  oe as POPUP_HEIGHT,
-  ne as POPUP_POLL_INTERVAL_MS,
-  ae as POPUP_TIMEOUT_MS,
-  ie as POPUP_WIDTH,
-  N as Passflow,
+  gt as MINIMAL_DEFAULT_SCOPES,
+  Re as OS,
+  Y as PASSFLOW_CLOUD_URL,
+  ue as POPUP_HEIGHT,
+  le as POPUP_POLL_INTERVAL_MS,
+  pe as POPUP_TIMEOUT_MS,
+  de as POPUP_WIDTH,
+  G as Passflow,
   T as PassflowAdminEndpointPaths,
   c as PassflowEndpointPaths,
   l as PassflowError,
   a as PassflowEvent,
-  j as PopupClosedError,
-  Te as Providers,
-  E as RequestMethod,
-  re as SDK_VERSION,
-  q as SessionState,
-  Me as SettingAPI,
-  V as TOKEN_EXPIRY_BUFFER_SECONDS,
-  De as TenantAPI,
-  Be as TenantService,
-  qe as TenantUserMembership,
-  Ye as TokenCacheService,
+  W as PopupClosedError,
+  Ce as Providers,
+  _ as RequestMethod,
+  ce as SDK_VERSION,
+  H as SessionState,
+  Oe as SettingAPI,
+  j as TOKEN_EXPIRY_BUFFER_SECONDS,
+  Le as TenantAPI,
+  We as TenantService,
+  Xe as TenantUserMembership,
+  Je as TokenCacheService,
   v as TokenDeliveryMode,
   k as TokenType,
-  Pe as TwoFactorApiClient,
-  Ee as TwoFactorPolicy,
-  je as TwoFactorService,
-  he as USERNAME_MAX_LENGTH,
-  ce as USERNAME_MIN_LENGTH,
-  xe as UserAPI,
-  He as UserService,
-  ge as WebAdapter,
-  tt as getOSFromDeviceType,
+  Ne as TwoFactorApiClient,
+  Fe as TwoFactorPolicy,
+  Ze as TwoFactorService,
+  Te as UPGRADE_REQUIRED,
+  fe as USERNAME_MAX_LENGTH,
+  ge as USERNAME_MIN_LENGTH,
+  B as UpgradeCancelledError,
+  St as UpgradeController,
+  b as UpgradeFactorError,
+  O as UpgradeUnsatisfiableError,
+  Ke as UserAPI,
+  Qe as UserService,
+  Se as WebAdapter,
+  ot as factorRegistry,
+  kt as getOSFromDeviceType,
   y as isTokenExpired,
-  P as isValidEmail,
-  D as isValidJWTFormat,
-  x as isValidPhoneNumber,
-  Oe as isValidUsername,
+  x as isValidEmail,
+  P as isValidJWTFormat,
+  U as isValidPhoneNumber,
+  qe as isValidUsername,
+  be as parseChallengeBody,
+  Ie as parseChallengeHeader,
   m as parseToken,
-  _ as pathWithParams,
-  $e as sanitizeErrorMessage,
-  A as webAdapter
+  Ae as parseUpgradeChallenge,
+  it as passkeyFactor,
+  E as pathWithParams,
+  st as recoveryCodesFactor,
+  Ve as sanitizeErrorMessage,
+  ht as selectFactors,
+  rt as totpFactor,
+  C as webAdapter
 };
 //# sourceMappingURL=index.mjs.map