@passflow/core 0.16.0 → 0.18.0

package/dist/index.mjs

@@ -1,9 +1,9 @@
-import B from "axios";
-import { v4 as mt } from "uuid";
-import { startAuthentication as vt, startRegistration as yt } from "@simplewebauthn/browser";
-const kt = "0.16.0", wt = {
-  version: kt
-}, N = "X-Passflow-Clientid", U = "Authorization", St = "X-Passflow-DeviceId", bt = "X-Passflow-DeviceType", Tt = wt.version, Ks = ["id", "offline", "openid"], _t = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], De = "https://auth.passflow.cloud", js = "default", Et = 500, It = 600, At = 100, Ct = 6e4, xe = 30, Rt = 3, Ft = 30, Mt = 200, Pt = (r) => {
+import K from "axios";
+import { v4 as kt } from "uuid";
+import { startAuthentication as wt, startRegistration as St } from "@simplewebauthn/browser";
+const bt = "0.18.0", Tt = {
+  version: bt
+}, V = "X-Passflow-Clientid", D = "Authorization", _t = "X-Passflow-DeviceId", Et = "X-Passflow-DeviceType", It = Tt.version, Hs = ["id", "offline", "openid"], At = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], Le = "https://auth.passflow.cloud", zs = "default", Ct = 500, Rt = 600, Ft = 100, Pt = 6e4, $e = 30, Mt = 3, Dt = 30, Ut = 200, xt = (r) => {
   const e = [];
   let t;
   for (t in r) {
@@ -18,14 +18,14 @@ const kt = "0.16.0", wt = {
   }
   return { raw: r, tenants: e };
 };
-function Ut(r) {
+function Ot(r) {
   if (typeof window < "u" && typeof window.atob == "function")
     return window.atob(r);
   if (typeof Buffer < "u")
     return Buffer.from(r, "base64").toString("utf-8");
   throw new Error("No Base64 decoding method available in this environment");
 }
-class Dt {
+class Lt {
   constructor(e) {
     this.storageManager = e;
   }
@@ -54,19 +54,19 @@ class Dt {
       return T(t);
   }
 }
-function C(r, e = xe) {
+function C(r, e = $e) {
   return Math.floor(Date.now() / 1e3) + e > r.exp;
 }
 function T(r) {
   const e = r.split(".")[1];
   if (!e) throw new Error("Invalid token string");
-  const t = e.replace(/-/g, "+").replace(/_/g, "/"), s = t + "=".repeat((4 - t.length % 4) % 4), i = Ut(s), n = decodeURIComponent(
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), s = t + "=".repeat((4 - t.length % 4) % 4), i = Ot(s), n = decodeURIComponent(
     i.split("").map((a) => "%" + ("00" + a.charCodeAt(0).toString(16)).slice(-2)).join("")
   ), o = JSON.parse(n);
-  return o.membership = o.passflow_tm && o.type !== "invite" ? Pt(o.passflow_tm) : void 0, o;
+  return o.membership = o.passflow_tm && o.type !== "invite" ? xt(o.passflow_tm) : void 0, o;
 }
-var b = /* @__PURE__ */ ((r) => (r.id_token = "id_token", r.access_token = "access", r.refresh_token = "refresh", r.invite_token = "invite", r.reset_token = "reset", r.web_cookie = "web-cookie", r.management = "management", r.signin = "signin", r.actor = "actor", r.two_factor = "2fa", r))(b || {}), A = /* @__PURE__ */ ((r) => (r.JsonBody = "json_body", r.Cookie = "cookie", r.Mobile = "mobile", r.BFF = "bff", r))(A || {}), Oe = /* @__PURE__ */ ((r) => (r.Unknown = "unknown", r.Valid = "valid", r.Invalid = "invalid", r))(Oe || {});
-class Le {
+var b = /* @__PURE__ */ ((r) => (r.id_token = "id_token", r.access_token = "access", r.refresh_token = "refresh", r.invite_token = "invite", r.reset_token = "reset", r.web_cookie = "web-cookie", r.management = "management", r.signin = "signin", r.actor = "actor", r.two_factor = "2fa", r))(b || {}), A = /* @__PURE__ */ ((r) => (r.JsonBody = "json_body", r.Cookie = "cookie", r.Mobile = "mobile", r.BFF = "bff", r))(A || {}), qe = /* @__PURE__ */ ((r) => (r.Unknown = "unknown", r.Valid = "valid", r.Invalid = "invalid", r))(qe || {});
+class Ne {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
   }
@@ -176,7 +176,7 @@ class Le {
   loadPersistedSessionState() {
     try {
       const e = this.storageManager.storage.getItem(this.SESSION_STATE_KEY);
-      e && Object.values(Oe).includes(e) && (this.sessionState = e);
+      e && Object.values(qe).includes(e) && (this.sessionState = e);
     } catch {
     }
   }
@@ -217,7 +217,7 @@ class Le {
     }
   }
 }
-class me {
+class ke {
   constructor({ storage: e, prefix: t } = {}) {
     this.keyStoragePrefix = "", this.scopes = `${this.keyStoragePrefix}tokens_scopes`, this.deviceId = `${this.keyStoragePrefix}passflowDeviceId`, this.invitationToken = `${this.keyStoragePrefix}passflowInvitationToken`, this.previousRedirectUrl = `${this.keyStoragePrefix}passflowPreviousRedirectUrl`, this.STORAGE_PREFIX = "passflow_", this.ID_TOKEN_KEY = `${this.STORAGE_PREFIX}id_token`, this.CSRF_TOKEN_KEY = `${this.STORAGE_PREFIX}csrf_token`, this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.storage = e ?? localStorage, this.keyStoragePrefix = t ? `${t}_` : "";
   }
@@ -400,9 +400,9 @@ class me {
     return `${this.keyStoragePrefix}${e}`;
   }
 }
-class $e {
+class Ve {
   constructor(e) {
-    this.storageManager = e ?? new me();
+    this.storageManager = e ?? new ke();
   }
   getDeviceId() {
     const e = this.storageManager.getDeviceId();
@@ -413,19 +413,19 @@ class $e {
     return e;
   }
   generateUniqueDeviceId() {
-    return mt();
+    return kt();
   }
 }
-class qe extends Error {
+class Be extends Error {
   constructor(e = "Authentication popup was closed") {
     super(e), this.name = "PopupClosedError";
   }
 }
-class xt {
+class $t {
   constructor() {
     this.passkeys = {
-      startRegistration: (e) => yt({ optionsJSON: e }),
-      startAuthentication: (e) => vt({ optionsJSON: e })
+      startRegistration: (e) => St({ optionsJSON: e }),
+      startAuthentication: (e) => wt({ optionsJSON: e })
     };
   }
   // ----------------------------------------------------------------
@@ -557,14 +557,14 @@ class xt {
           'openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.'
         )
       );
-    const i = t.width ?? Et, n = t.height ?? It, o = t.expectedReturnOrigin ?? window.location.origin, a = window.open(e, "_blank", `width=${i},height=${n}`);
+    const i = t.width ?? Ct, n = t.height ?? Rt, o = t.expectedReturnOrigin ?? window.location.origin, a = window.open(e, "_blank", `width=${i},height=${n}`);
     return a ? new Promise((h, p) => {
       const m = Date.now(), d = setInterval(() => {
         if (a.closed) {
-          clearInterval(d), p(new qe());
+          clearInterval(d), p(new Be());
           return;
         }
-        if (Date.now() - m > Ct) {
+        if (Date.now() - m > Pt) {
           clearInterval(d), a.close(), p(new Error("Authentication popup timed out"));
           return;
         }
@@ -575,7 +575,7 @@ class xt {
           }
         } catch {
         }
-      }, At);
+      }, Ft);
     }) : (window.location.href = e, new Promise(() => {
     }));
   }
@@ -633,78 +633,78 @@ class xt {
     return "web";
   }
 }
-const z = new xt(), Ot = /^[0-9]+$/, be = Object.freeze({ unorderable: !1, zero: !1 }), Lt = (r) => Ot.test(r) ? Number.parseInt(r, 10) : void 0, Q = (r) => {
+const Y = new $t(), qt = /^[0-9]+$/, Ee = Object.freeze({ unorderable: !1, zero: !1 }), Nt = (r) => qt.test(r) ? Number.parseInt(r, 10) : void 0, te = (r) => {
   if (!r)
-    return be;
+    return Ee;
   const e = r.split(/\s+/).filter((i) => i !== "");
   if (e.length === 0)
-    return be;
+    return Ee;
   const t = [];
   for (const i of e) {
-    const n = Lt(i);
+    const n = Nt(i);
     n !== void 0 && t.push(n);
   }
   if (t.length === 0)
     return { raw: r, unorderable: !0, zero: !1 };
   const s = Math.min(...t);
   return s === 0 ? { raw: r, unorderable: !1, zero: !0 } : { level: s, raw: r, unorderable: !1, zero: !1 };
-}, $t = (r) => Q(r).level, qt = "insufficient_user_authentication", Nt = "upgrade_required", Te = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, Vt = (r) => r.replace(/\\(.)/g, "$1"), Ne = (r) => {
+}, Vt = (r) => te(r).level, Bt = "insufficient_user_authentication", Kt = "upgrade_required", Ie = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, jt = (r) => r.replace(/\\(.)/g, "$1"), Ke = (r) => {
   const e = {};
-  Te.lastIndex = 0;
-  for (const t of r.matchAll(Te)) {
+  Ie.lastIndex = 0;
+  for (const t of r.matchAll(Ie)) {
     const s = t[1];
     if (!s)
       continue;
     const i = t[2], n = t[3];
-    e[s.toLowerCase()] = i !== void 0 ? Vt(i) : n ?? "";
+    e[s.toLowerCase()] = i !== void 0 ? jt(i) : n ?? "";
   }
   return e;
-}, Ve = (r) => {
+}, je = (r) => {
   if (r == null || r === "")
     return { kind: "absent" };
   const e = typeof r == "number" ? r : Number.parseInt(String(r), 10);
   return Number.isFinite(e) && e > 0 ? { kind: "valid", value: e } : { kind: "invalid", raw: r };
-}, Be = (r) => {
-  const e = Ve(r);
+}, Ge = (r) => {
+  const e = je(r);
   return e.kind === "valid" ? e.value : void 0;
-}, Bt = (r, e) => {
+}, Gt = (r, e) => {
   if (!r || !/(^|[\s,])Bearer\b/i.test(r))
     return;
-  const t = Ne(r);
-  if (t.error === qt)
+  const t = Ke(r);
+  if (t.error === Bt)
     return {
       acrValues: t.acr_values || void 0,
-      maxAge: Be(t.max_age),
+      maxAge: Ge(t.max_age),
       status: e
     };
-}, Kt = (r, e) => {
+}, Ht = (r, e) => {
   if (!r || typeof r != "object")
     return;
   const t = r;
-  if (t.error === Nt)
+  if (t.error === Kt)
     return {
       acrValues: typeof t.acr_values == "string" && t.acr_values ? t.acr_values : void 0,
-      maxAge: Be(t.max_age),
+      maxAge: Ge(t.max_age),
       status: e
     };
-}, _e = (r, e, t) => ({
+}, Ae = (r, e, t) => ({
   channel: r,
-  acr: Q(e.acrValues),
-  maxAge: Ve(t),
+  acr: te(e.acrValues),
+  maxAge: je(t),
   raw: e.acrValues
-}), jt = (r) => r ? Ne(r) : {}, ve = (r, e) => {
+}), zt = (r) => r ? Ke(r) : {}, we = (r, e) => {
   const { status: t } = r;
   if (t !== 401 && t !== 403)
     return { diagnostics: [] };
-  const s = e?.requireChallengeChannel === "header", i = r.getHeader("www-authenticate"), n = Bt(i, t), o = s ? void 0 : Kt(r.body, t), a = [], h = (u, y) => {
+  const s = e?.requireChallengeChannel === "header", i = r.getHeader("www-authenticate"), n = Gt(i, t), o = s ? void 0 : Ht(r.body, t), a = [], h = (u, y) => {
     a.push({ status: t, url: "", reason: u, ...y ? { detail: y } : {} });
   };
   if (!n && !o)
     return s && h("header-required-but-absent", i ? { header: i } : void 0), { diagnostics: a };
   const p = [];
-  if (n && p.push(_e("header", n, jt(i).max_age)), o) {
+  if (n && p.push(Ae("header", n, zt(i).max_age)), o) {
     const u = r.body;
-    p.push(_e("body", o, u?.max_age));
+    p.push(Ae("body", o, u?.max_age));
   }
   const m = (u) => u;
   for (const u of p)
@@ -719,8 +719,8 @@ const z = new xt(), Ot = /^[0-9]+$/, be = Object.freeze({ unorderable: !1, zero:
   for (const u of p)
     u.maxAge.kind === "valid" && (v === void 0 || u.maxAge.value < v) && (v = u.maxAge.value);
   if (p.length === 2) {
-    const [u, y] = p, I = u.acr.level !== void 0 && y.acr.level !== void 0 && u.acr.level !== y.acr.level, Y = u.maxAge.kind === "valid" && y.maxAge.kind === "valid" && u.maxAge.value !== y.maxAge.value;
-    (I || Y) && h("channels-disagree", { header: u.raw ?? y.raw, body: y.raw ?? u.raw });
+    const [u, y] = p, I = u.acr.level !== void 0 && y.acr.level !== void 0 && u.acr.level !== y.acr.level, W = u.maxAge.kind === "valid" && y.maxAge.kind === "valid" && u.maxAge.value !== y.maxAge.value;
+    (I || W) && h("channels-disagree", { header: u.raw ?? y.raw, body: y.raw ?? u.raw });
   }
   return {
     challenge: {
@@ -732,15 +732,15 @@ const z = new xt(), Ot = /^[0-9]+$/, be = Object.freeze({ unorderable: !1, zero:
     },
     diagnostics: a
   };
-}, Gt = (r, e, t) => ve({ status: r, getHeader: e, body: t }).challenge, Ke = "__passflowUpgradeTransaction", je = "__passflowUpgradeReplayed", Ge = (r, e) => typeof r == "object" && r !== null && r[e] === !0, He = (r) => ({
+}, Yt = (r, e, t) => we({ status: r, getHeader: e, body: t }).challenge, He = "__passflowUpgradeTransaction", ze = "__passflowUpgradeReplayed", Ye = (r, e) => typeof r == "object" && r !== null && r[e] === !0, We = (r) => ({
   ...r ?? {},
-  [Ke]: !0
-}), ze = (r) => Ge(r, Ke), Ht = (r) => ({
+  [He]: !0
+}), Xe = (r) => Ye(r, He), Wt = (r) => ({
   ...r,
-  [je]: !0
-}), zt = (r) => Ge(r, je);
-var P = /* @__PURE__ */ ((r) => (r.GET = "get", r.POST = "post", r.PUT = "put", r.PATCH = "patch", r.DELETE = "delete", r))(P || {}), l = /* @__PURE__ */ ((r) => (r.signin = "/auth/login", r.signup = "/auth/register", r.signInWithProvider = "/auth/federated/start/", r.passwordless = "/auth/passwordless/start", r.passwordlessComplete = "/auth/passwordless/complete", r.logout = "/user/logout", r.refresh = "/auth/refresh", r.validateSession = "/user/me", r.sendPasswordResetEmail = "/auth/password/reset", r.resetPassword = "/auth/password/change", r.appSettings = "/app/settings", r.passkeyRegisterStart = "/auth/passkey/register/start", r.passkeyRegisterComplete = "/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", r.passkeyValidate = "/auth/validate", r.settingsAll = "/settings", r.settingsPasswordPolicy = "/settings/password", r.settingsPasskey = "/settings/passkey", r.userPasskey = "/user/passkey", r.addUserPasskey = "/user/passkey/add/start", r.completeAddUserPasskey = "/user/passkey/add/complete", r.joinInvitation = "/user/tenant/join", r.tenantPath = "/user/tenant", r.invitationsPath = "/user/tenant/:tenantID/invitations", r.requestInvitation = "/user/invite", r.invitationDelete = "/user/invite/:invitationID", r.invitationResend = "/user/invite/:invitationID/resend", r.invitationGetLink = "/user/invite/:invitationID/link", r.twoFactor = "/user/2fa", r.twoFactorStatus = "/user/2fa/status", r.twoFactorSetupBegin = "/user/2fa/setup/begin", r.twoFactorSetupConfirm = "/user/2fa/setup/confirm", r.twoFactorVerify = "/auth/2fa/verify", r.twoFactorRecovery = "/auth/2fa/recovery", r.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", r.twoFactorSetupMagicLink = "/auth/2fa-setup", r.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", r.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", r.TwoFactorSetupStart = "/v2/user/2fa/setup/start", r.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", r.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", r.TwoFactorChallenge = "/v2/auth/2fa/challenge", r.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", r.TwoFactorAlternative = "/v2/auth/2fa/alternative", r.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", r.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", r.cliAuthStatus = "/cli/auth/status/:sessionId", r.cliAuthComplete = "/cli/auth/complete", r.upgradeStart = "/auth/upgrade/start", r))(l || {}), F = /* @__PURE__ */ ((r) => (r.passkeyRegisterStart = "/admin/auth/passkey/register/start", r.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", r.passkeyValidate = "/admin/auth/validate", r.logout = "/admin/auth/logout", r))(F || {});
-const Ye = (r) => {
+  [ze]: !0
+}), Xt = (r) => Ye(r, ze);
+var M = /* @__PURE__ */ ((r) => (r.GET = "get", r.POST = "post", r.PUT = "put", r.PATCH = "patch", r.DELETE = "delete", r))(M || {}), l = /* @__PURE__ */ ((r) => (r.signin = "/auth/login", r.signup = "/auth/register", r.signInWithProvider = "/auth/federated/start/", r.passwordless = "/auth/passwordless/start", r.passwordlessComplete = "/auth/passwordless/complete", r.logout = "/user/logout", r.refresh = "/auth/refresh", r.validateSession = "/user/me", r.sendPasswordResetEmail = "/auth/password/reset", r.resetPassword = "/auth/password/change", r.appSettings = "/app/settings", r.passkeyRegisterStart = "/auth/passkey/register/start", r.passkeyRegisterComplete = "/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", r.passkeyValidate = "/auth/validate", r.settingsAll = "/settings", r.settingsPasswordPolicy = "/settings/password", r.settingsPasskey = "/settings/passkey", r.userPasskey = "/user/passkey", r.addUserPasskey = "/user/passkey/add/start", r.completeAddUserPasskey = "/user/passkey/add/complete", r.joinInvitation = "/user/tenant/join", r.tenantPath = "/user/tenant", r.invitationsPath = "/user/tenant/:tenantID/invitations", r.requestInvitation = "/user/invite", r.invitationDelete = "/user/invite/:invitationID", r.invitationResend = "/user/invite/:invitationID/resend", r.invitationGetLink = "/user/invite/:invitationID/link", r.twoFactor = "/user/2fa", r.twoFactorStatus = "/user/2fa/status", r.twoFactorSetupBegin = "/user/2fa/setup/begin", r.twoFactorSetupConfirm = "/user/2fa/setup/confirm", r.twoFactorVerify = "/auth/2fa/verify", r.twoFactorRecovery = "/auth/2fa/recovery", r.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", r.twoFactorSetupMagicLink = "/auth/2fa-setup", r.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", r.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", r.TwoFactorSetupStart = "/v2/user/2fa/setup/start", r.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", r.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", r.TwoFactorChallenge = "/v2/auth/2fa/challenge", r.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", r.TwoFactorAlternative = "/v2/auth/2fa/alternative", r.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", r.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", r.cliAuthStatus = "/cli/auth/status/:sessionId", r.cliAuthComplete = "/cli/auth/complete", r.upgradeStart = "/auth/upgrade/start", r))(l || {}), F = /* @__PURE__ */ ((r) => (r.passkeyRegisterStart = "/admin/auth/passkey/register/start", r.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", r.passkeyValidate = "/admin/auth/validate", r.logout = "/admin/auth/logout", r))(F || {});
+const Je = (r) => {
   if (!r)
     return null;
   try {
@@ -755,21 +755,21 @@ class w extends Error {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
-var Yt = /* @__PURE__ */ ((r) => (r.google = "google", r.facebook = "facebook", r))(Yt || {}), Wt = /* @__PURE__ */ ((r) => (r.web = "web", r.ios = "ios", r.android = "android", r))(Wt || {});
-function Gs(r) {
+var Jt = /* @__PURE__ */ ((r) => (r.google = "google", r.facebook = "facebook", r))(Jt || {}), Zt = /* @__PURE__ */ ((r) => (r.web = "web", r.ios = "ios", r.android = "android", r))(Zt || {});
+function Ys(r) {
   return r;
 }
-function M(r, e) {
+function P(r, e) {
   let t = r;
   return Object.entries(e).forEach(([s, i]) => {
     t = t.replace(`:${s}`, i);
   }), t;
 }
-var Xt = /* @__PURE__ */ ((r) => (r.Disabled = "disabled", r.Optional = "optional", r.Required = "required", r))(Xt || {});
-const Jt = 3, Zt = 1e3, Qt = (r) => (e) => {
+var Qt = /* @__PURE__ */ ((r) => (r.Disabled = "disabled", r.Optional = "optional", r.Required = "required", r))(Qt || {});
+const er = 3, tr = 1e3, rr = (r) => (e) => {
   const t = r.headers?.[e] ?? r.headers?.[e.toLowerCase()];
   return Array.isArray(t) ? t.join(", ") : t;
-}, We = (r) => Gt(r.status, Qt(r), r.data), er = (r) => We(r) !== void 0;
+}, Ze = (r) => Yt(r.status, rr(r), r.data), sr = (r) => Ze(r) !== void 0;
 class E {
   constructor(e, t, s) {
     this.refreshPromise = null, this.isRefreshing = !1, this.defaultHeaders = {
@@ -777,18 +777,18 @@ class E {
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh", "upgrade"];
     const { url: i, appId: n, keyStoragePrefix: o } = e;
-    this._platform = e.platform ?? z, this.url = i || De, this.upgradeDomain = Ye(i), this.storageManager = t ?? new me({
+    this._platform = e.platform ?? Y, this.url = i || Le, this.upgradeDomain = Je(i), this.storageManager = t ?? new ke({
       prefix: o ?? ""
-    }), this.deviceService = s ?? new $e(this.storageManager), this.tokenService = new Dt(this.storageManager), this.tokenDeliveryManager = new Le(this.storageManager), n && (this.appId = n, this.defaultHeaders = {
+    }), this.deviceService = s ?? new Ve(this.storageManager), this.tokenService = new Lt(this.storageManager), this.tokenDeliveryManager = new Ne(this.storageManager), n && (this.appId = n, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [N]: n
+      [V]: n
     });
     const a = this.deviceService.getDeviceId();
     this.defaultHeaders = {
       ...this.defaultHeaders,
-      [St]: a,
-      [bt]: this._platform.getDeviceType()
-    }, this.detectCookieSupport(), this.instance = B.create({
+      [_t]: a,
+      [Et]: this._platform.getDeviceType()
+    }, this.detectCookieSupport(), this.instance = K.create({
       baseURL: this.url,
       headers: { ...this.defaultHeaders }
     }), this.instance.interceptors.request.use(async (h) => {
@@ -809,30 +809,30 @@ class E {
       const p = this.storageManager.getTokens();
       if (p?.access_token) {
         const m = T(p.access_token);
-        if (C(m, xe) && p.refresh_token)
+        if (C(m, $e) && p.refresh_token)
           try {
             if (this.refreshPromise) {
               const d = await this.refreshPromise;
-              return d?.data?.access_token && (h.headers[U] = `Bearer ${d.data.access_token}`), h;
+              return d?.data?.access_token && (h.headers[D] = `Bearer ${d.data.access_token}`), h;
             }
             this.refreshPromise = this.refreshTokens();
             try {
               const d = await this.refreshPromise;
-              return d?.data?.access_token && (h.headers[U] = `Bearer ${d.data.access_token}`), h;
+              return d?.data?.access_token && (h.headers[D] = `Bearer ${d.data.access_token}`), h;
             } finally {
               this.refreshPromise = null;
             }
           } catch (d) {
             return this.refreshPromise = null, this.isRefreshing = !1, this.storageManager.deleteTokens(), Promise.reject(d);
           }
-        return h.headers[U] = `Bearer ${p.access_token}`, h;
+        return h.headers[D] = `Bearer ${p.access_token}`, h;
       }
       return h;
     }), this.instance.interceptors.response.use(
       (h) => h,
       async (h) => {
         if (h.response?.status === 401 && !this.isUpgradeTransactionError(h) && this.tokenDeliveryManager.setSessionInvalid(), h.response && this.upgradeHandler) {
-          const p = We(h.response);
+          const p = Ze(h.response);
           if (p)
             try {
               return await this.upgradeHandler(h, p);
@@ -854,7 +854,7 @@ class E {
    * speak upgrade vocabulary", which is unsound in both directions.
    */
   isUpgradeTransactionError(e) {
-    return ze(e.config) || e.response !== void 0 && er(e.response);
+    return Xe(e.config) || e.response !== void 0 && sr(e.response);
   }
   /**
    * Installs (or clears) the handler consulted when a response carries an
@@ -915,7 +915,7 @@ class E {
         scopes: t
       }, i = await this.instance.post(l.refresh, s, {
         headers: {
-          [U]: `Bearer ${e.refresh_token}`
+          [D]: `Bearer ${e.refresh_token}`
         }
       });
       return i.data && this.storageManager.saveTokens(i.data), this.isRefreshing = !1, i;
@@ -929,9 +929,9 @@ class E {
     if (!["GET", "HEAD", "OPTIONS"].includes(s || ""))
       return Promise.reject(e);
     const n = t._retryCount || 0;
-    if (n >= Jt)
+    if (n >= er)
       return Promise.reject(e);
-    let o = Zt * Math.pow(2, n);
+    let o = tr * Math.pow(2, n);
     const a = e.response?.headers?.["retry-after"];
     if (a) {
       const h = Number.parseInt(a, 10);
@@ -972,19 +972,19 @@ class E {
     })).data;
   }
   get(e, t) {
-    return this.send(P.GET, e, t);
+    return this.send(M.GET, e, t);
   }
   post(e, t, s) {
-    return this.send(P.POST, e, { data: t, ...s });
+    return this.send(M.POST, e, { data: t, ...s });
   }
   put(e, t, s) {
-    return this.send(P.PUT, e, { data: t, ...s });
+    return this.send(M.PUT, e, { data: t, ...s });
   }
   patch(e, t, s) {
-    return this.send(P.PATCH, e, { data: t, ...s });
+    return this.send(M.PATCH, e, { data: t, ...s });
   }
   delete(e, t) {
-    return this.send(P.DELETE, e, t);
+    return this.send(M.DELETE, e, t);
   }
   /**
    * Update the appId and propagate it to axios headers.
@@ -995,11 +995,11 @@ class E {
   setAppId(e) {
     this.appId = e, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [N]: e
-    }, this.instance.defaults.headers.common[N] = e;
+      [V]: e
+    }, this.instance.defaults.headers.common[V] = e;
   }
 }
-class tr {
+class ir {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1010,7 +1010,8 @@ class tr {
     return this.axiosClient.get(l.appSettings);
   }
 }
-class rr {
+const q = { withCredentials: !0 };
+class nr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1041,13 +1042,13 @@ class rr {
       ...i ? { upgrade: i } : {}
     }, o = {
       headers: {
-        [U]: `Bearer ${e}`
+        [D]: `Bearer ${e}`
       }
     };
     return this.axiosClient.post(
       l.refresh,
       n,
-      i ? He(o) : o
+      i ? We(o) : o
     );
   }
   signIn(e, t, s) {
@@ -1058,7 +1059,8 @@ class rr {
     };
     return this.axiosClient.post(
       l.signin,
-      i
+      i,
+      q
     );
   }
   signUp(e) {
@@ -1069,7 +1071,8 @@ class rr {
     };
     return this.axiosClient.post(
       l.signup,
-      i
+      i,
+      q
     );
   }
   passwordlessSignIn(e, t, s) {
@@ -1087,7 +1090,8 @@ class rr {
   passwordlessSignInComplete(e) {
     return this.axiosClient.post(
       l.passwordlessComplete,
-      e
+      e,
+      q
     );
   }
   logOut(e, t, s = !1) {
@@ -1110,8 +1114,8 @@ class rr {
     };
     return this.axiosClient.post(l.resetPassword, i, {
       headers: {
-        [U]: `Bearer ${s}`,
-        [N]: void 0
+        [D]: `Bearer ${s}`,
+        [V]: void 0
       }
     });
   }
@@ -1130,7 +1134,11 @@ class rr {
       device: t,
       passkey_data: e
     }, o = i ? F.passkeyRegisterComplete : l.passkeyRegisterComplete;
-    return this.axiosClient.post(o, n);
+    return this.axiosClient.post(
+      o,
+      n,
+      q
+    );
   }
   passkeyAuthenticateStart(e, t, s, i = !1) {
     const n = {
@@ -1150,7 +1158,11 @@ class rr {
       device: t,
       passkey_data: e
     }, o = i ? F.passkeyAuthenticateComplete : l.passkeyAuthenticateComplete;
-    return this.axiosClient.post(o, n);
+    return this.axiosClient.post(
+      o,
+      n,
+      q
+    );
   }
   passkeyValidate(e, t, s, i = !1, n) {
     const o = {
@@ -1160,11 +1172,11 @@ class rr {
     };
     let a = l.passkeyValidate;
     !n && i && (a = F.passkeyValidate);
-    const h = n ? { [N]: n } : {};
+    const h = n ? { [V]: n } : {};
     return this.axiosClient.post(a, o, { headers: h });
   }
 }
-class Hs {
+class Ws {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1172,14 +1184,14 @@ class Hs {
     this.axiosClient.setAppId(e);
   }
   getCLIAuthStatus(e) {
-    const t = M(l.cliAuthStatus, { sessionId: e });
+    const t = P(l.cliAuthStatus, { sessionId: e });
     return this.axiosClient.get(t);
   }
   completeCLIAuth(e) {
     return this.axiosClient.post(l.cliAuthComplete, e);
   }
 }
-class sr {
+class or {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1205,7 +1217,7 @@ class sr {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const s = M(l.invitationsPath, {
+    const s = P(l.invitationsPath, {
       tenantID: e.tenantID
     });
     return this.axiosClient.get(s, { params: t }).then((i) => ({
@@ -1219,7 +1231,7 @@ class sr {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = M(l.invitationDelete, {
+    const t = P(l.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -1230,7 +1242,7 @@ class sr {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = M(l.invitationResend, {
+    const t = P(l.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -1241,13 +1253,13 @@ class sr {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = M(l.invitationGetLink, {
+    const t = P(l.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
   }
 }
-class ir {
+class ar {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1264,7 +1276,7 @@ class ir {
     return this.axiosClient.get(l.settingsPasskey);
   }
 }
-class nr {
+class cr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1497,7 +1509,11 @@ class nr {
     return this.axiosClient.delete(i);
   }
 }
-class or {
+const pe = (r) => r ? { headers: { Authorization: `Bearer ${r}` } } : {}, ie = (r) => ({
+  withCredentials: !0,
+  ...pe(r)
+});
+class hr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1536,15 +1552,11 @@ class or {
    * Uses tfa_token as Bearer token for authentication
    */
   verify(e) {
-    const { tfa_token: t, code: s } = e;
+    const { tfa_token: t, code: s, trust_device: i } = e;
     return this.axiosClient.post(
       l.twoFactorVerify,
-      { code: s },
-      {
-        headers: {
-          Authorization: `Bearer ${t}`
-        }
-      }
+      { code: s, ...i ? { trust_device: !0 } : {} },
+      ie(t)
     );
   }
   /**
@@ -1553,15 +1565,11 @@ class or {
    * Uses tfa_token as Bearer token for authentication
    */
   useRecoveryCode(e) {
-    const { tfa_token: t, recovery_code: s } = e;
+    const { tfa_token: t, recovery_code: s, trust_device: i } = e;
     return this.axiosClient.post(
       l.twoFactorRecovery,
-      { recovery_code: s },
-      {
-        headers: {
-          Authorization: `Bearer ${t}`
-        }
-      }
+      { recovery_code: s, ...i ? { trust_device: !0 } : {} },
+      ie(t)
     );
   }
   /**
@@ -1711,56 +1719,72 @@ class or {
    * DELETE /v2/user/2fa/methods/:id
    */
   removeMethod(e) {
-    const t = M(l.TwoFactorMethodRemove, { id: e });
+    const t = P(l.TwoFactorMethodRemove, { id: e });
     return this.axiosClient.delete(t);
   }
   /**
    * Request 2FA challenge during login
    * POST /v2/auth/2fa/challenge
+   * `tfaToken`, when given, goes as the Bearer token the route is gated on.
    */
-  requestChallenge(e) {
+  requestChallenge(e, t) {
     return this.axiosClient.post(
       l.TwoFactorChallenge,
-      e
+      e,
+      pe(t)
     );
   }
   /**
    * Verify 2FA challenge (v2)
-   * POST /v2/auth/2fa/verify
+   * POST /v2/auth/2fa/verify (the server's verify-challenge)
+   *
+   * `tfaToken` is the 2FA token the first factor returned; the route is gated
+   * on it, so it goes as the Bearer token when given.
    */
-  verifyV2(e) {
+  verifyV2(e, t) {
+    const { trust_device: s, ...i } = e;
     return this.axiosClient.post(
       l.TwoFactorVerifyV2,
-      e
+      { ...i, ...s ? { trust_device: !0 } : {} },
+      ie(t)
     );
   }
   /**
    * Switch to alternative 2FA method during challenge
    * POST /v2/auth/2fa/alternative
+   * `tfaToken`, when given, goes as the Bearer token the route is gated on.
    */
-  switchToAlternative(e) {
+  switchToAlternative(e, t) {
     return this.axiosClient.post(
       l.TwoFactorAlternative,
-      e
+      e,
+      pe(t)
     );
   }
   /**
-   * Get trusted devices
+   * List the devices the user trusted on this app
    * GET /v2/user/2fa/trusted-devices
+   *
+   * Sent with credentials so the server sees this device's trust cookie and
+   * can mark it `current`.
    */
-  getTrustedDevices() {
-    return this.axiosClient.get(l.TwoFactorTrustedDevices);
+  async getTrustedDevices() {
+    return (await this.axiosClient.get(
+      l.TwoFactorTrustedDevices,
+      { withCredentials: !0 }
+    ))?.devices ?? [];
   }
   /**
    * Revoke trusted device
    * DELETE /v2/user/2fa/trusted-devices/:id
+   * The server answers 404 when the user has no such device.
    */
   revokeTrustedDevice(e) {
-    const t = M(l.TwoFactorTrustedDeviceRevoke, { id: e });
+    const t = P(l.TwoFactorTrustedDeviceRevoke, { id: e });
     return this.axiosClient.delete(t);
   }
 }
-class ar {
+class dr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1782,11 +1806,11 @@ class ar {
     return this.axiosClient.post(
       l.upgradeStart,
       e,
-      He({})
+      We({})
     );
   }
 }
-class cr {
+class lr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1832,7 +1856,7 @@ class cr {
   }
 }
 var c = /* @__PURE__ */ ((r) => (r.SignIn = "signin", r.SignInStart = "signin:start", r.Register = "register", r.RegisterStart = "register:start", r.SignOut = "signout", r.SessionRestored = "session:restored", r.SessionExpired = "session:expired", r.Error = "error", r.Refresh = "refresh", r.RefreshStart = "refresh:start", r.TokenCacheExpired = "token-cache-expired", r.TwoFactorRequired = "2fa:required", r.TwoFactorSetupStarted = "2fa:setup_started", r.TwoFactorEnabled = "2fa:enabled", r.TwoFactorDisabled = "2fa:disabled", r.TwoFactorVerified = "2fa:verified", r.TwoFactorRecoveryUsed = "2fa:recovery_used", r.TwoFactorRecoveryCodesLow = "2fa:recovery_low", r.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", r.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", r.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", r.TwoFactorChallengeReceived = "two_factor_challenge_received", r.TwoFactorMethodSwitched = "two_factor_method_switched", r.TwoFactorDeviceTrusted = "two_factor_device_trusted", r))(c || {});
-class hr {
+class ur {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
   }
@@ -1886,18 +1910,18 @@ const k = {
   twoFactorNotEnabled: "error.2fa.not_enabled",
   notImplemented: "error.not.implemented",
   tokenInvalid: "error.api.request.token.invalid"
-}, dr = Object.freeze([
+}, pr = Object.freeze([
   k.twoFactorCodeInvalid,
   k.twoFactorNotEnabled,
   k.challengeInvalid,
   k.challengeSessionMismatch,
   k.challengeTooManyAttempts
-]), lr = Object.freeze([k.tokenInvalid]), ur = Object.freeze([
+]), fr = Object.freeze([k.tokenInvalid]), gr = Object.freeze([
   "wrong_code",
   "challenge_spent",
   "not_registered",
   "prepare_not_required"
-]), pr = (r) => ur.includes(r), fr = {
+]), vr = (r) => gr.includes(r), mr = {
   wrong_code: "That code was not accepted. Try again.",
   challenge_spent: "That verification challenge is no longer valid. Start again.",
   exhausted: "Too many attempts. Try again later.",
@@ -1912,17 +1936,17 @@ const k = {
 };
 class _ extends Error {
   constructor(e) {
-    super(e.message || fr[e.kind]), this.name = "UpgradeTransportError", this.code = "upgrade_transport", this.kind = e.kind, this.status = e.status, this.errorId = e.errorId, this.retryable = pr(e.kind), e.cause !== void 0 && (this.cause = e.cause);
+    super(e.message || mr[e.kind]), this.name = "UpgradeTransportError", this.code = "upgrade_transport", this.kind = e.kind, this.status = e.status, this.errorId = e.errorId, this.retryable = vr(e.kind), e.cause !== void 0 && (this.cause = e.cause);
   }
 }
-const gr = Object.freeze([
+const yr = Object.freeze([
   "upgrade_transport",
   "upgrade_insufficient",
   "upgrade_unavailable",
   "upgrade_session_changed",
   "upgrade_cancelled",
   "upgrade_unsatisfiable"
-]), Xe = (r) => typeof r == "object" && r !== null && typeof r.code == "string" && gr.includes(r.code), mr = (r) => r instanceof _ || typeof r == "object" && r !== null && r.code === "upgrade_transport", vr = (r) => {
+]), Qe = (r) => typeof r == "object" && r !== null && typeof r.code == "string" && yr.includes(r.code), kr = (r) => r instanceof _ || typeof r == "object" && r !== null && r.code === "upgrade_transport", wr = (r) => {
   if (typeof r != "object" || r === null)
     return { hasResponse: !1, message: typeof r == "string" ? r : void 0 };
   const e = r, t = e.response, s = t?.data, i = typeof s?.error?.id == "string" ? s.error.id : void 0;
@@ -1932,7 +1956,7 @@ const gr = Object.freeze([
     message: typeof e.message == "string" ? e.message : void 0,
     hasResponse: t !== void 0 || typeof e.status == "number"
   };
-}, yr = (r, e) => {
+}, Sr = (r, e) => {
   switch (r) {
     case k.twoFactorCodeInvalid:
       return "wrong_code";
@@ -1981,13 +2005,13 @@ const gr = Object.freeze([
     default:
       return;
   }
-}, kr = (r, e) => r === void 0 ? "network" : r === 501 ? "unavailable" : r === 400 ? "fatal" : r === 401 || r === 403 ? e === "start" ? "challenge_spent" : "session_changed" : r >= 500 ? "network" : "fatal", Ee = (r, e) => {
+}, br = (r, e) => r === void 0 ? "network" : r === 501 ? "unavailable" : r === 400 ? "fatal" : r === 401 || r === 403 ? e === "start" ? "challenge_spent" : "session_changed" : r >= 500 ? "network" : "fatal", Ce = (r, e) => {
   if (r instanceof _)
     return r;
-  const t = vr(r);
+  const t = wr(r);
   if (!t.hasResponse)
     return new _({ kind: "network", message: t.message, cause: r });
-  const s = yr(t.errorId, e) ?? kr(t.status, e);
+  const s = Sr(t.errorId, e) ?? br(t.status, e);
   return new _({
     kind: s,
     message: t.message,
@@ -1995,13 +2019,13 @@ const gr = Object.freeze([
     errorId: t.errorId,
     cause: r
   });
-}, zs = (r) => r.errorId !== void 0 && dr.includes(r.errorId), wr = (r) => r.errorId !== void 0 && lr.includes(r.errorId);
-class K extends Error {
+}, Xs = (r) => r.errorId !== void 0 && pr.includes(r.errorId), Tr = (r) => r.errorId !== void 0 && fr.includes(r.errorId);
+class j extends Error {
   constructor(e, t, s) {
     super(s ?? "The session was elevated, but this action requires a higher assurance level"), this.name = "UpgradeInsufficientError", this.code = "upgrade_insufficient", this.obtained = e, this.required = t;
   }
 }
-class j extends Error {
+class G extends Error {
   constructor(e = "Step-up verification is not available on this deployment") {
     super(e), this.name = "UpgradeUnavailableError", this.code = "upgrade_unavailable";
   }
@@ -2011,46 +2035,46 @@ class $ extends Error {
     super(e), this.name = "UpgradeSessionChangedError", this.code = "upgrade_session_changed";
   }
 }
-const Sr = (r) => {
+const _r = (r) => {
   if (!(!r || typeof r.sub != "string" || r.sub === ""))
     return typeof r.sid == "string" && r.sid !== "" ? { sub: r.sub, sid: r.sid } : { sub: r.sub };
-}, br = (r, e) => !e || e.sub !== r.sub ? !1 : r.sid !== void 0 && e.sid !== void 0 ? r.sid === e.sid : !0;
-function re(r) {
+}, Er = (r, e) => !e || e.sub !== r.sub ? !1 : r.sid !== void 0 && e.sid !== void 0 ? r.sid === e.sid : !0;
+function X(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.split(".");
   if (e.length !== 3) return !1;
   const t = /^[A-Za-z0-9_-]+$/;
   return e.every((s) => t.test(s) && s.length > 0);
 }
-function Tr(r) {
-  return r.replace(/<[^>]*>/g, "").substring(0, Mt);
+function Ir(r) {
+  return r.replace(/<[^>]*>/g, "").substring(0, Ut);
 }
-function se(r) {
+function ne(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
   return e.length === 0 ? !1 : /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
 }
-function ie(r) {
+function oe(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
   return /^\+[1-9]\d{1,14}$/.test(e);
 }
-function _r(r) {
+function Ar(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
-  return e.length < Rt || e.length > Ft ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
+  return e.length < Mt || e.length > Dt ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
 }
-function W(r, e = 6) {
+function J(r, e = 6) {
   return !r || typeof r != "string" ? !1 : (e === 8 ? /^\d{8}$/ : /^\d{6}$/).test(r);
 }
-function Er(r) {
+function Cr(r) {
   if (!r || typeof r != "string") return null;
   const e = r.toUpperCase().replace(/\s+/g, "");
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
-class Ir {
-  constructor(e, t, s, i, n, o, a, h, p, m, d, g = z) {
-    this.authApi = e, this.deviceService = t, this.storageManager = s, this.subscribeStore = i, this.tokenCacheService = n, this.scopes = o, this.createTenantForNewUser = a, this.url = h, this.sessionCallbacks = p, this.appId = m, this.platform = g, this.tokenExchangeConfig = d, this.tokenDeliveryManager = new Le(s), d?.enabled && this.tokenDeliveryManager.setMode(A.BFF), this.initializeSession();
+class Rr {
+  constructor(e, t, s, i, n, o, a, h, p, m, d, g = Y) {
+    this.authApi = e, this.deviceService = t, this.storageManager = s, this.subscribeStore = i, this.tokenCacheService = n, this.scopes = o, this.createTenantForNewUser = a, this.url = h, this.sessionCallbacks = p, this.appId = m, this.platform = g, this.tokenExchangeConfig = d, this.tokenDeliveryManager = new Ne(s), d?.enabled && this.tokenDeliveryManager.setMode(A.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -2092,6 +2116,24 @@ class Ir {
   async processAuthResponse(e, t) {
     this.tokenExchangeConfig?.enabled || "token_delivery" in e && e.token_delivery && this.tokenDeliveryManager.setMode(e.token_delivery), this.tokenDeliveryManager.setSessionValid(), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.callbackUrl && await this.forwardTokensToBFF(e), e.scopes = t, this.storageManager.saveTokens(e, this.tokenDeliveryManager.getMode()), this.tokenCacheService.setTokensCache(e), e.csrf_token && this.storageManager.setCsrfToken(e.csrf_token);
   }
+  /**
+   * Reports whether a sign-in response is still waiting on its second factor,
+   * and when it is, hands the 2FA token on.
+   *
+   * Every sign-in path can end this way: the server answers with a
+   * `tfa_token` (or `requires_2fa`) in place of tokens. That response is not
+   * a session, so on `true` the caller returns it as it is — without
+   * `processAuthResponse`, a `SignIn`/`Register` event or a session check.
+   * The `TwoFactorRequired` event is what the TwoFactorService listens to, so
+   * its verify and recovery calls can carry the token.
+   */
+  handlePendingSecondFactor(e, t) {
+    return e.requires_2fa !== !0 && !e.tfa_token ? !1 : (this.subscribeStore.notify(c.TwoFactorRequired, {
+      email: t || "",
+      challengeId: e.challenge_id || "",
+      tfaToken: e.tfa_token || ""
+    }), !0);
+  }
   /**
    * Forward tokens to BFF server for httpOnly cookie storage
    */
@@ -2117,7 +2159,7 @@ class Ir {
       throw new Error(`BFF token storage failed: ${t.status}`);
   }
   async signIn(e) {
-    if ("email" in e && e.email && !se(e.email)) {
+    if ("email" in e && e.email && !ne(e.email)) {
       const i = new Error("Invalid email format"), n = {
         message: "Invalid email format",
         originalError: i,
@@ -2125,7 +2167,7 @@ class Ir {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if ("username" in e && e.username && !_r(e.username)) {
+    if ("username" in e && e.username && !Ar(e.username)) {
       const i = new Error(
         "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens"
       ), n = {
@@ -2135,7 +2177,7 @@ class Ir {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if ("phone" in e && e.phone && !ie(e.phone)) {
+    if ("phone" in e && e.phone && !oe(e.phone)) {
       const i = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), n = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: i,
@@ -2148,14 +2190,10 @@ class Ir {
     e.scopes = e.scopes ?? this.scopes;
     try {
       const i = await this.authApi.signIn(e, t, s);
-      return "requires_2fa" in i && i.requires_2fa === !0 || "tfa_token" in i && i.tfa_token ? (this.subscribeStore.notify(c.TwoFactorRequired, {
-        email: e.email || "",
-        challengeId: i.challenge_id || "",
-        tfaToken: i.tfa_token || ""
-      }), i) : (await this.processAuthResponse(i, e.scopes), this.subscribeStore.notify(c.SignIn, {
+      return this.handlePendingSecondFactor(i, e.email) || (await this.processAuthResponse(i, e.scopes), this.subscribeStore.notify(c.SignIn, {
         tokens: i,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), i);
+      }), await this.submitSessionCheck()), i;
     } catch (i) {
       const n = {
         message: i instanceof Error ? i.message : "Sign in failed",
@@ -2166,7 +2204,7 @@ class Ir {
     }
   }
   async signUp(e) {
-    if (e.user.email && !se(e.user.email)) {
+    if (e.user.email && !ne(e.user.email)) {
       const t = new Error("Invalid email format"), s = {
         message: "Invalid email format",
         originalError: t,
@@ -2174,7 +2212,7 @@ class Ir {
       };
       throw this.subscribeStore.notify(c.Error, s), t;
     }
-    if (e.user.phone_number && !ie(e.user.phone_number)) {
+    if (e.user.phone_number && !oe(e.user.phone_number)) {
       const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), s = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: t,
@@ -2185,10 +2223,10 @@ class Ir {
     this.subscribeStore.notify(c.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
       const t = await this.authApi.signUp(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(c.Register, {
+      return this.handlePendingSecondFactor(t, e.user.email) || (await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(c.Register, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), t;
+      }), await this.submitSessionCheck()), t;
     } catch (t) {
       const s = {
         message: t instanceof Error ? t.message : "Sign up failed",
@@ -2199,7 +2237,7 @@ class Ir {
     }
   }
   async passwordlessSignIn(e) {
-    if (e.email && !se(e.email)) {
+    if (e.email && !ne(e.email)) {
       const i = new Error("Invalid email format"), n = {
         message: "Invalid email format",
         originalError: i,
@@ -2207,7 +2245,7 @@ class Ir {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if (e.phone && !ie(e.phone)) {
+    if (e.phone && !oe(e.phone)) {
       const i = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), n = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: i,
@@ -2232,10 +2270,10 @@ class Ir {
     this.subscribeStore.notify(c.SignInStart, {}), e.scopes = e.scopes ?? this.scopes, e.device = this.deviceService.getDeviceId();
     try {
       const t = await this.authApi.passwordlessSignInComplete(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(c.SignIn, {
+      return this.handlePendingSecondFactor(t) || (await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(c.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), t;
+      }), await this.submitSessionCheck()), t;
     } catch (t) {
       const s = {
         message: t instanceof Error ? t.message : "Passwordless sign in failed",
@@ -2278,7 +2316,7 @@ class Ir {
     const e = this.storageManager.getToken(b.access_token);
     if (e)
       try {
-        return Sr(T(e));
+        return _r(T(e));
       } catch {
         return;
       }
@@ -2305,7 +2343,7 @@ class Ir {
    * state — two different axes.
    */
   assertSessionPin(e) {
-    if (e && !br(e, this.readSessionPin()))
+    if (e && !Er(e, this.readSessionPin()))
       throw console.warn(
         "[passflow] the session or user changed while a step-up upgrade was in flight; the elevated tokens were discarded and the live session was left untouched."
       ), new $("The session changed during verification, so the elevated tokens were discarded");
@@ -2398,13 +2436,13 @@ class Ir {
         message: n instanceof Error ? n.message : "Token refresh failed",
         originalError: n,
         code: n instanceof w ? n.id : void 0,
-        details: B.isAxiosError(n) && n.response ? {
+        details: K.isAxiosError(n) && n.response ? {
           status: n.response.status,
           data: n.response.data
         } : void 0
       };
       this.subscribeStore.notify(c.Error, o);
-      const a = B.isAxiosError(n) && n.response?.status && n.response.status >= 400 && n.response.status < 500;
+      const a = K.isAxiosError(n) && n.response?.status && n.response.status >= 400 && n.response.status < 500;
       throw a && !e && (this.tokenCacheService.tokenExpiredFlag = !0, this.tokenCacheService.setTokensCache(void 0), this.storageManager.deleteTokens(), this.subscribeStore.notify(c.SessionExpired, { reason: "refresh_failed" })), n instanceof w ? n : a && !e ? new Error(`Getting unknown error message from server with code:${n.response?.status}`) : n;
     }
   }
@@ -2425,10 +2463,10 @@ class Ir {
     const i = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("token") ?? void 0, n = t ?? this.scopes;
     try {
       const o = await this.authApi.resetPassword(e, n, i);
-      return await this.processAuthResponse(o, n), this.subscribeStore.notify(c.SignIn, {
+      return this.handlePendingSecondFactor(o) || (await this.processAuthResponse(o, n), this.subscribeStore.notify(c.SignIn, {
         tokens: o,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), o;
+      }), await this.submitSessionCheck()), o;
     } catch (o) {
       const a = {
         message: o instanceof Error ? o.message : "Password reset failed",
@@ -2454,10 +2492,10 @@ class Ir {
         i,
         !this.appId
       );
-      return await this.processAuthResponse(a, e.scopes), this.subscribeStore.notify(c.Register, {
+      return this.handlePendingSecondFactor(a) || (await this.processAuthResponse(a, e.scopes), this.subscribeStore.notify(c.Register, {
         tokens: a,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), a;
+      }), await this.submitSessionCheck()), a;
     } catch (i) {
       const n = {
         message: i instanceof Error ? i.message : "Passkey registration failed",
@@ -2481,7 +2519,7 @@ class Ir {
         i,
         !this.appId
       );
-      return "access_token" in a && (await this.processAuthResponse(a, e.scopes), this.subscribeStore.notify(c.SignIn, {
+      return this.handlePendingSecondFactor(a) || "access_token" in a && (await this.processAuthResponse(a, e.scopes), this.subscribeStore.notify(c.SignIn, {
         tokens: a,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck()), a;
@@ -2514,20 +2552,23 @@ class Ir {
       const n = await this.platform.openAuthUrl(i, {
         mode: "popup",
         expectedReturnOrigin: this.platform.getCurrentUrl()?.origin ?? ""
-      }), o = new URLSearchParams(n.callbackSearch), a = o.get("access_token") || "", h = o.get("refresh_token") || "", p = o.get("id_token") || "", m = {
-        access_token: a,
-        refresh_token: h || void 0,
-        id_token: p || void 0,
+      }), o = new URLSearchParams(n.callbackHash.replace(/^#/, ""));
+      if (this.handlePendingSecondFactor({ tfa_token: o.get("tfa_token") ?? void 0 }))
+        return;
+      const a = new URLSearchParams(n.callbackSearch), h = a.get("access_token") || "", p = a.get("refresh_token") || "", m = a.get("id_token") || "", d = {
+        access_token: h,
+        refresh_token: p || void 0,
+        id_token: m || void 0,
         scopes: t
       };
-      await this.processAuthResponse(m, t), this.subscribeStore.notify(c.SignIn, {
-        tokens: m,
+      await this.processAuthResponse(d, t), this.subscribeStore.notify(c.SignIn, {
+        tokens: d,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), this.platform.navigateTo(this.platform.getCurrentUrl()?.origin ?? "");
     } catch (n) {
       const o = {
         message: n instanceof Error ? n.message : "Authentication failed",
-        code: n instanceof qe ? "POPUP_CLOSED" : "AUTH_FAILED",
+        code: n instanceof Be ? "POPUP_CLOSED" : "AUTH_FAILED",
         originalError: n
       };
       this.subscribeStore.notify(c.Error, o);
@@ -2628,7 +2669,7 @@ class Ir {
     }
   }
 }
-class Ar {
+class Fr {
   constructor(e) {
     this.invitationApi = e;
   }
@@ -2673,7 +2714,7 @@ class Ar {
     return this.invitationApi.getInvitationLink(e);
   }
 }
-class Cr {
+class Pr {
   error(e, ...t) {
     console.error(e, ...t);
   }
@@ -2687,10 +2728,10 @@ class Cr {
     console.debug(e, ...t);
   }
 }
-function Rr() {
-  return new Cr();
+function Mr() {
+  return new Pr();
 }
-class Fr {
+class Dr {
   constructor(e) {
     this.data = this.normalize(e);
   }
@@ -2760,9 +2801,9 @@ class Fr {
     return this.data;
   }
 }
-class Mr {
+class Ur {
   constructor(e, t, s) {
-    this.tenantApi = e, this.scopes = t, this.logger = s || Rr();
+    this.tenantApi = e, this.scopes = t, this.logger = s || Mr();
   }
   /**
    * Handle Passflow API errors
@@ -2771,7 +2812,7 @@ class Mr {
    * @throws Formatted error with Passflow API error details
    */
   handlePassflowError(e, t) {
-    if (B.isAxiosError(e) && e.response?.data) {
+    if (K.isAxiosError(e) && e.response?.data) {
       const s = e.response.data;
       if (typeof s == "object" && s !== null && "error" in s && typeof s.error == "object" && s.error !== null) {
         const i = s.error;
@@ -2832,7 +2873,7 @@ class Mr {
   async getTenantUserMembership(e) {
     try {
       const t = await this.tenantApi.getTenantDetails(e);
-      return new Fr(t);
+      return new Dr(t);
     } catch (t) {
       this.handlePassflowError(t, `Get tenant user membership failed for tenant ID ${e}`);
     }
@@ -3130,8 +3171,8 @@ class Mr {
     }
   }
 }
-class Pr {
-  constructor(e, t, s, i = z) {
+class xr {
+  constructor(e, t, s, i = Y) {
     this.storageManager = e, this.authApi = t, this.subscribeStore = s, this.platform = i, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.unsubscribeForeground = null, this.unsubscribeUnload = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupLifecycleListeners();
   }
   initialize() {
@@ -3229,7 +3270,7 @@ class Pr {
     return C(e);
   }
 }
-class Ur {
+class Or {
   constructor(e, t) {
     this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
     const s = {
@@ -3238,9 +3279,14 @@ class Ur {
           const o = n;
           this.setPartialAuthState(o.email, o.challengeId, o.tfaToken);
         }
+        (i === c.SignIn || i === c.Register) && this.clearPartialAuthState();
       }
     };
-    this.subscribeStore.subscribe(s, [c.TwoFactorRequired]);
+    this.subscribeStore.subscribe(s, [
+      c.TwoFactorRequired,
+      c.SignIn,
+      c.Register
+    ]);
   }
   /**
    * Emit error event and throw the error
@@ -3282,7 +3328,7 @@ class Ur {
    * Returns recovery codes that MUST be displayed to user
    */
   async confirmSetup(e) {
-    if (!W(e, this.totpDigits))
+    if (!J(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.confirmSetup({ code: e });
@@ -3299,57 +3345,63 @@ class Ur {
   /**
    * Verify TOTP code during login
    * Completes authentication if successful
+   *
+   * @param options.trustDevice - ask the server to trust this device for later sign-ins
    */
-  async verify(e) {
-    if (!W(e, this.totpDigits))
+  async verify(e, t) {
+    if (!J(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     if (this.recoverPartialAuthState(), !this.isVerificationRequired())
       throw new Error("2FA verification expired or not required. User must sign in first.");
     if (!this.partialAuthState?.tfaToken)
       throw new Error("No TFA token found. User must sign in first.");
     try {
-      const t = await this.twoFactorApi.verify({
+      const s = await this.twoFactorApi.verify({
         code: e,
-        tfa_token: this.partialAuthState.tfaToken
+        tfa_token: this.partialAuthState.tfaToken,
+        ...t?.trustDevice ? { trust_device: !0 } : {}
       });
-      return this.clearPartialAuthState(), this.subscribeStore.notify(c.TwoFactorVerified, { tokens: t }), t;
-    } catch (t) {
-      this.emitErrorAndThrow(t, "Verify 2FA code");
+      return this.clearPartialAuthState(), this.subscribeStore.notify(c.TwoFactorVerified, { tokens: s }), s;
+    } catch (s) {
+      this.emitErrorAndThrow(s, "Verify 2FA code");
     }
   }
   /**
    * Use recovery code for authentication
    * Completes authentication if successful
+   *
+   * @param options.trustDevice - ask the server to trust this device for later sign-ins
    */
-  async useRecoveryCode(e) {
+  async useRecoveryCode(e, t) {
     try {
-      const t = Er(e);
-      if (!t)
+      const s = Cr(e);
+      if (!s)
         throw new Error("Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).");
       if (this.recoverPartialAuthState(), !this.isVerificationRequired())
         throw new Error("2FA verification expired or not required. User must sign in first.");
       if (!this.partialAuthState?.tfaToken)
         throw new Error("No TFA token found. User must sign in first.");
-      const s = await this.twoFactorApi.useRecoveryCode({
-        recovery_code: t,
-        tfa_token: this.partialAuthState.tfaToken
+      const i = await this.twoFactorApi.useRecoveryCode({
+        recovery_code: s,
+        tfa_token: this.partialAuthState.tfaToken,
+        ...t?.trustDevice ? { trust_device: !0 } : {}
       });
-      return this.clearPartialAuthState(), s.remaining_recovery_codes === 0 ? this.subscribeStore.notify(c.TwoFactorRecoveryCodesExhausted, { tokens: s }) : s.remaining_recovery_codes <= 2 && this.subscribeStore.notify(c.TwoFactorRecoveryCodesLow, {
-        tokens: s,
-        remainingCodes: s.remaining_recovery_codes
+      return this.clearPartialAuthState(), i.remaining_recovery_codes === 0 ? this.subscribeStore.notify(c.TwoFactorRecoveryCodesExhausted, { tokens: i }) : i.remaining_recovery_codes <= 2 && this.subscribeStore.notify(c.TwoFactorRecoveryCodesLow, {
+        tokens: i,
+        remainingCodes: i.remaining_recovery_codes
       }), this.subscribeStore.notify(c.TwoFactorRecoveryUsed, {
-        tokens: s,
-        remainingCodes: s.remaining_recovery_codes
-      }), this.subscribeStore.notify(c.TwoFactorVerified, { tokens: s }), s;
-    } catch (t) {
-      this.emitErrorAndThrow(t, "Use recovery code");
+        tokens: i,
+        remainingCodes: i.remaining_recovery_codes
+      }), this.subscribeStore.notify(c.TwoFactorVerified, { tokens: i }), i;
+    } catch (s) {
+      this.emitErrorAndThrow(s, "Use recovery code");
     }
   }
   /**
    * Disable 2FA (requires TOTP verification)
    */
   async disable(e) {
-    if (!W(e, this.totpDigits))
+    if (!J(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.disable({ code: e });
@@ -3362,7 +3414,7 @@ class Ur {
    * Regenerate recovery codes
    */
   async regenerateRecoveryCodes(e) {
-    if (!W(e, this.totpDigits))
+    if (!J(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.regenerateRecoveryCodes({ code: e }), s = [...t.recovery_codes];
@@ -3406,6 +3458,12 @@ class Ur {
       } catch {
       }
   }
+  /**
+   * The 2FA token of the sign-in waiting on its second factor, if any.
+   */
+  pendingTfaToken() {
+    return this.isVerificationRequired() && this.partialAuthState?.tfaToken || void 0;
+  }
   /**
    * Attempt to recover partial auth state from sessionStorage
    * Called before verification operations to handle page refresh
@@ -3564,7 +3622,7 @@ class Ur {
    */
   async requestChallenge(e) {
     try {
-      const t = await this.twoFactorApi.requestChallenge(e);
+      const t = await this.twoFactorApi.requestChallenge(e, this.pendingTfaToken());
       return this.subscribeStore.notify(c.TwoFactorChallengeReceived, {
         challengeId: t.challenge_id,
         method: t.method,
@@ -3576,11 +3634,12 @@ class Ur {
   }
   /**
    * Verify 2FA challenge (v2)
+   * Set `trust_device` on the payload to ask the server to trust this device.
    */
   async verifyV2(e) {
     try {
-      const t = await this.twoFactorApi.verifyV2(e);
-      return t.success && (this.subscribeStore.notify(c.TwoFactorVerified, {
+      const t = await this.twoFactorApi.verifyV2(e, this.pendingTfaToken());
+      return t.success && (this.clearPartialAuthState(), this.subscribeStore.notify(c.TwoFactorVerified, {
         tokens: {
           access_token: t.access_token,
           refresh_token: t.refresh_token
@@ -3595,7 +3654,7 @@ class Ur {
    */
   async switchToAlternative(e) {
     try {
-      const t = await this.twoFactorApi.switchToAlternative(e);
+      const t = await this.twoFactorApi.switchToAlternative(e, this.pendingTfaToken());
       return this.subscribeStore.notify(c.TwoFactorMethodSwitched, {
         challengeId: t.challenge_id,
         method: t.method,
@@ -3606,7 +3665,8 @@ class Ur {
     }
   }
   /**
-   * Get trusted devices
+   * List the devices the user trusted to skip the second factor on this app.
+   * The one this request came from has `current: true`.
    */
   async getTrustedDevices() {
     try {
@@ -3616,7 +3676,8 @@ class Ur {
     }
   }
   /**
-   * Revoke trusted device
+   * Revoke a trusted device; its next sign-in asks for the second factor again.
+   * Rejects with the server's 404 when the user has no such device.
    */
   async revokeTrustedDevice(e) {
     try {
@@ -3626,8 +3687,8 @@ class Ur {
     }
   }
 }
-class Dr {
-  constructor(e, t, s = z) {
+class Lr {
+  constructor(e, t, s = Y) {
     this.userAPI = e, this.deviceService = t, this.platform = s;
   }
   /**
@@ -3678,85 +3739,85 @@ class Dr {
     return await this.userAPI.addUserPasskeyComplete(h, i, o);
   }
 }
-class D extends Error {
+class U extends Error {
   constructor(e, t, s = !1) {
     super(t), this.name = "UpgradeFactorError", this.factor = e, this.cancelled = s;
   }
 }
-const Je = (r, e) => {
+const et = (r, e) => {
   const t = e?.trim();
   if (!t)
-    throw new D(r, "A verification code is required");
+    throw new U(r, "A verification code is required");
   return t;
-}, xr = {
+}, $r = {
   type: "totp",
   requiresPrepare: !1,
   input: "code",
-  assert: async ({ code: r }) => ({ code: Je("totp", r) })
-}, Or = {
+  assert: async ({ code: r }) => ({ code: et("totp", r) })
+}, qr = {
   type: "recovery_codes",
   requiresPrepare: !1,
   input: "code",
-  assert: async ({ code: r }) => ({ code: Je("recovery_codes", r) })
-}, Lr = {
+  assert: async ({ code: r }) => ({ code: et("recovery_codes", r) })
+}, Nr = {
   type: "passkey",
   requiresPrepare: !0,
   input: "none",
   assert: async ({ prepared: r, platform: e }) => {
     if (!r?.webauthn)
-      throw new D("passkey", "The upgrade challenge carried no WebAuthn options");
+      throw new U("passkey", "The upgrade challenge carried no WebAuthn options");
     const t = e.passkeys;
     if (!t)
-      throw new D("passkey", "This platform does not support passkeys");
+      throw new U("passkey", "This platform does not support passkeys");
     let s;
     try {
       s = await t.startAuthentication(r.webauthn);
     } catch (i) {
-      throw new D("passkey", i?.message || "Passkey verification was cancelled", !0);
+      throw new U("passkey", i?.message || "Passkey verification was cancelled", !0);
     }
     if (!s)
-      throw new D("passkey", "Passkey verification was cancelled", !0);
+      throw new U("passkey", "Passkey verification was cancelled", !0);
     return { challenge_id: r.challengeId, credential: s };
   }
-}, ye = Object.freeze([
-  xr,
-  Lr,
-  Or
-]), $r = (r = ye) => new Map(r.map((e) => [e.type, e])), qr = 3, Nr = {
+}, Se = Object.freeze([
+  $r,
+  Nr,
+  qr
+]), Vr = (r = Se) => new Map(r.map((e) => [e.type, e])), Br = 3, Kr = {
   passkey: 0,
   totp: 1,
   email_otp: 2,
   sms_otp: 3,
   recovery_codes: 9
-}, Vr = (r) => r.requiredLevel ?? $t(r.acrValues), Ie = (r, e) => {
-  const t = Nr[r.type] ?? 5, s = e !== void 0 && e >= qr, i = r.type === "passkey";
+}, jr = (r) => r.requiredLevel ?? Vt(r.acrValues), Re = (r, e) => {
+  const t = Kr[r.type] ?? 5, s = e !== void 0 && e >= Br, i = r.type === "passkey";
   return (s && !i ? 100 : 0) + t;
-}, Br = (r, e) => {
-  const t = Vr(e);
-  return [...r].sort((s, i) => Ie(s, t) - Ie(i, t));
+}, Gr = (r, e) => {
+  const t = jr(e);
+  return [...r].sort((s, i) => Re(s, t) - Re(i, t));
 };
 class O extends Error {
   constructor(e) {
     super("Upgrade authentication was cancelled"), this.code = "upgrade_cancelled", this.name = "UpgradeCancelledError", e !== void 0 && (this.cause = e);
   }
 }
-class Z extends Error {
+class ee extends Error {
   constructor(e = "No available authentication factor can satisfy this challenge") {
     super(e), this.code = "upgrade_unsatisfiable", this.name = "UpgradeUnsatisfiableError";
   }
 }
-const Kr = 4, jr = 3e4, Gr = () => {
+const Hr = 4, zr = 3e4, Yr = () => {
   let r = () => {
   }, e = () => {
   };
   return { promise: new Promise((s, i) => {
     r = s, e = i;
   }), resolve: r, reject: e };
-}, G = (r) => ({
+}, H = (r) => ({
   acrValues: r.acrValues,
   level: r.requiredLevel,
   maxAge: r.maxAge
-}), Hr = (r, e) => e.level === void 0 ? !0 : r.level === void 0 ? !1 : r.level >= e.level, zr = (r, e) => {
+}), Wr = (r, e) => e.level === void 0 ? !0 : r.level === void 0 ? !1 : r.level >= e.level, Xr = (r, e) => {
   const t = r.requiredLevel === void 0 ? e.requiredLevel : e.requiredLevel === void 0 ? r.requiredLevel : Math.max(r.requiredLevel, e.requiredLevel), s = t === void 0 ? r.acrValues ?? e.acrValues : t === r.requiredLevel ? r.acrValues : e.acrValues, i = r.maxAge === void 0 ? e.maxAge : e.maxAge === void 0 ? r.maxAge : Math.min(r.maxAge, e.maxAge), n = Array.from(/* @__PURE__ */ new Set([...r.channels ?? [], ...e.channels ?? []]));
   return {
     acrValues: s,
@@ -3765,13 +3826,13 @@ const Kr = 4, jr = 3e4, Gr = () => {
     status: r.status,
     ...n.length > 0 ? { channels: n } : {}
   };
-}, Yr = (r, e) => {
+}, Jr = (r, e) => {
   const t = e.requiredLevel !== void 0 && (r.requiredLevel === void 0 || e.requiredLevel > r.requiredLevel), s = e.maxAge !== void 0 && (r.maxAge === void 0 || e.maxAge < r.maxAge);
   return t || s;
 };
-class Wr {
+class Zr {
   constructor(e) {
-    this.state = "idle", this.inFlight = null, this.requirement = null, this.selected = null, this.rankedRequirement = null, this.registrations = [], this.proof = null, this.pruned = /* @__PURE__ */ new Set(), this.openPrompt = null, this.transport = e.transport, this.prompt = e.prompt, this.platform = e.platform, this.available = e.factors ?? ye, this.registry = $r(this.available), this.maxAttempts = e.maxAttempts ?? Kr, this.readObtainedBar = e.readObtainedBar, this.onFlightSettled = e.onFlightSettled, this.settleTimeoutMs = e.replaySettleTimeoutMs ?? jr;
+    this.state = "idle", this.inFlight = null, this.requirement = null, this.selected = null, this.rankedRequirement = null, this.registrations = [], this.proof = null, this.pruned = /* @__PURE__ */ new Set(), this.openPrompt = null, this.transport = e.transport, this.prompt = e.prompt, this.platform = e.platform, this.available = e.factors ?? Se, this.registry = Vr(this.available), this.maxAttempts = e.maxAttempts ?? Hr, this.readObtainedBar = e.readObtainedBar, this.onFlightSettled = e.onFlightSettled, this.settleTimeoutMs = e.replaySettleTimeoutMs ?? zr;
   }
   /** The current lifecycle state. Read-only. */
   get currentState() {
@@ -3808,9 +3869,9 @@ class Wr {
   /** Registers a waiter and the bar it arrived demanding. */
   register(e, t) {
     const s = t.kind === "imperative" && t.requested !== void 0, n = {
-      demanded: t.kind === "imperative" && t.requested ? t.requested : G(e),
+      demanded: t.kind === "imperative" && t.requested ? t.requested : H(e),
       statedBar: s,
-      settlement: Gr(),
+      settlement: Yr(),
       reported: !1,
       entry: {
         ...t,
@@ -3838,13 +3899,13 @@ class Wr {
       this.requirement = e;
       return;
     }
-    const s = Yr(t, e);
-    this.requirement = zr(t, e), s && this.state === "collecting" && this.selected === null && this.openPrompt?.onRequirementRaised?.({ challenge: this.requirement, factors: this.offeredFactors() });
+    const s = Jr(t, e);
+    this.requirement = Xr(t, e), s && this.state === "collecting" && this.selected === null && this.openPrompt?.onRequirementRaised?.({ challenge: this.requirement, factors: this.offeredFactors() });
   }
   /** The factors to offer right now: ranked for the merged bar, minus what the server refused. */
   offeredFactors() {
     const e = this.available.filter((s) => !this.pruned.has(s.type)), t = this.requirement;
-    return t ? Br(e, t) : e;
+    return t ? Gr(e, t) : e;
   }
   /** The waiter's inbound edge. Idempotent — a second call is ignored. */
   receiveReport(e, t) {
@@ -3912,8 +3973,8 @@ class Wr {
    */
   release(e, t) {
     if (e.entry.kind === "imperative") {
-      if (e.statedBar && !Hr(t, e.demanded)) {
-        this.receiveReport(e, { outcome: "insufficient", obtained: t, required: e.demanded }), e.settlement.reject(new K(t, e.demanded));
+      if (e.statedBar && !Wr(t, e.demanded)) {
+        this.receiveReport(e, { outcome: "insufficient", obtained: t, required: e.demanded }), e.settlement.reject(new j(t, e.demanded));
         return;
       }
       this.receiveReport(e, { outcome: "replayed", obtained: t }), e.settlement.resolve({ waiter: e.entry, obtained: t });
@@ -3988,7 +4049,7 @@ class Wr {
     for (let t = 0; t < this.maxAttempts; t++) {
       const s = this.offeredFactors();
       if (s.length === 0)
-        return { status: "failed", reason: new Z() };
+        return { status: "failed", reason: new ee() };
       const i = this.requirement;
       let n;
       try {
@@ -4000,13 +4061,13 @@ class Wr {
         return { status: "failed", reason: new O() };
       const o = this.registry.get(n.factor);
       if (!o) {
-        e = new Z(`Unknown authentication factor: ${n.factor}`), this.state = "collecting", this.selected = null;
+        e = new ee(`Unknown authentication factor: ${n.factor}`), this.state = "collecting", this.selected = null;
         continue;
       }
       try {
-        return await this.proveAndCommit(o, n.code), { status: "proven", obtained: this.readObtainedBar?.() ?? G(this.rankedRequirement ?? i) };
+        return await this.proveAndCommit(o, n.code), { status: "proven", obtained: this.readObtainedBar?.() ?? H(this.rankedRequirement ?? i) };
       } catch (a) {
-        if (a instanceof D && a.cancelled)
+        if (a instanceof U && a.cancelled)
           return { status: "failed", reason: new O() };
         const h = this.classifyProofFailure(a);
         if (h)
@@ -4036,12 +4097,12 @@ class Wr {
   }
   /** Maps a proof failure to a terminal reason, or `undefined` when the user may retry. */
   classifyProofFailure(e) {
-    if (e instanceof K || e instanceof j || e instanceof $)
+    if (e instanceof j || e instanceof G || e instanceof $)
       return e;
     if (e instanceof _)
       switch (e.kind) {
         case "unavailable":
-          return new j(e.message);
+          return new G(e.message);
         case "exhausted":
         case "attempts_exhausted":
         case "fatal":
@@ -4060,14 +4121,14 @@ class Wr {
     await this.transport.commit(e.type, i);
   }
 }
-const Ze = "https://passflow-relative.invalid", Xr = () => {
+const tt = "https://passflow-relative.invalid", Qr = () => {
   const r = globalThis, e = r.document?.baseURI;
   if (typeof e == "string" && e !== "")
     return e;
   const t = r.location?.href;
-  return typeof t == "string" && t !== "" && t !== "about:blank" ? t : Ze;
-}, Ae = (r, e = Xr()) => {
-  const t = e === Ze;
+  return typeof t == "string" && t !== "" && t !== "about:blank" ? t : tt;
+}, Fe = (r, e = Qr()) => {
+  const t = e === tt;
   let s;
   try {
     s = new URL(e).origin;
@@ -4092,32 +4153,32 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     relativeToBase: s !== void 0 && i.origin === s,
     sentinelBase: t
   };
-}, ne = (r, e) => typeof e == "string" ? [r.toLowerCase(), e] : void 0, Jr = (r) => {
+}, ae = (r, e) => typeof e == "string" ? [r.toLowerCase(), e] : void 0, es = (r) => {
   const e = [];
   if (r == null)
     return Object.freeze(e);
   const t = r;
   if (typeof t.forEach == "function" && typeof t.entries == "function")
     return r.forEach((s, i) => {
-      const n = ne(i, s);
+      const n = ae(i, s);
       n && e.push(n);
     }), Object.freeze(e);
   if (Array.isArray(r)) {
     for (const s of r)
       if (Array.isArray(s) && s.length >= 2) {
-        const i = ne(String(s[0]), s[1]);
+        const i = ae(String(s[0]), s[1]);
         i && e.push(i);
       }
     return Object.freeze(e);
   }
   if (typeof r == "object")
     for (const [s, i] of Object.entries(r)) {
-      const n = Array.isArray(i) ? i.join(", ") : i, o = ne(s, n);
+      const n = Array.isArray(i) ? i.join(", ") : i, o = ae(s, n);
       o && e.push(o);
     }
   return Object.freeze(e);
-}, Qe = (r) => {
-  const e = r.base === void 0 ? Ae(r.url) : Ae(r.url, r.base), t = {
+}, rt = (r) => {
+  const e = r.base === void 0 ? Fe(r.url) : Fe(r.url, r.base), t = {
     raw: r.url,
     href: e.href,
     dispatchUrl: e.sentinelBase || !e.resolved ? r.url : e.href,
@@ -4126,25 +4187,25 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     resolved: e.resolved,
     relativeToBase: e.relativeToBase,
     method: (r.method ?? "GET").toUpperCase(),
-    headers: Jr(r.headers),
+    headers: es(r.headers),
     bodyKind: r.bodyKind,
     ..."body" in r ? { body: r.body } : {}
   };
   return Object.freeze(t);
-}, et = (r, e) => {
+}, st = (r, e) => {
   if (!e || e.from === e.to)
     return r;
   let t = !1;
   const s = r.map(([i, n]) => i === "authorization" && n === e.from ? (t = !0, [i, e.to]) : [i, n]);
   return t ? Object.freeze(s) : r;
-}, tt = (r) => {
+}, it = (r) => {
   const e = {};
   for (const [t, s] of r)
     e[t] = s;
   return e;
-}, Zr = new Set(
-  ye.filter((r) => !r.requiresPrepare).map((r) => r.type)
-), Qr = (r) => {
+}, ts = new Set(
+  Se.filter((r) => !r.requiresPrepare).map((r) => r.type)
+), rs = (r) => {
   if (!r || typeof r != "object" || !r.challenge_id || !r.expires_at)
     throw new _({
       kind: "protocol",
@@ -4157,16 +4218,16 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     webauthn: r.webauthn,
     codeSentTo: r.code_sent_to
   };
-}, Ce = (r) => Xe(r) && !mr(r), es = (r) => ({
+}, Pe = (r) => Qe(r) && !kr(r), ss = (r) => ({
   async prepare(e) {
-    if (!Zr.has(e))
+    if (!ts.has(e))
       try {
         const t = r.relyingPartyId?.(), s = await r.startUpgrade(t ? { method: e, relying_party_id: t } : { method: e });
-        return Qr(s);
+        return rs(s);
       } catch (t) {
-        if (Ce(t))
+        if (Pe(t))
           throw t;
-        const s = Ee(t, "start");
+        const s = Ce(t, "start");
         if (s.kind === "prepare_not_required")
           return;
         throw s;
@@ -4179,42 +4240,42 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     try {
       await r.commitRefresh({ type: e, assertion: t });
     } catch (i) {
-      if (Ce(i))
+      if (Pe(i))
         throw i;
-      const n = Ee(i, "refresh");
-      throw n.status === 401 && wr(n) && r.markSessionInvalid?.(), n;
+      const n = Ce(i, "refresh");
+      throw n.status === 401 && Tr(n) && r.markSessionInvalid?.(), n;
     }
   }
-}), rt = (r) => typeof r == "function" ? r() : r, Re = (r) => {
+}), nt = (r) => typeof r == "function" ? r() : r, Me = (r) => {
   try {
     return new URL(r);
   } catch {
     return;
   }
-}, le = (r, e) => {
+}, fe = (r, e) => {
   if (!e || e === "/")
     return !0;
   const t = e.replace(/\/+$/, "");
   return r === t || r.startsWith(`${t}/`);
-}, ts = (r, e) => !e || r.origin === void 0 ? !1 : r.origin === e.origin && le(r.pathname, e.pathPrefix), rs = (r, e) => {
+}, is = (r, e) => !e || r.origin === void 0 ? !1 : r.origin === e.origin && fe(r.pathname, e.pathPrefix), ns = (r, e) => {
   for (const t of e) {
     if (t === "")
       continue;
     if (t.startsWith("/")) {
-      if (r.relativeToBase && le(r.pathname, t))
+      if (r.relativeToBase && fe(r.pathname, t))
         return !0;
       continue;
     }
-    const s = Re(t) ?? Re(`https://${t}`);
-    if (!(!s || r.origin === void 0) && r.origin === s.origin && le(r.pathname, s.pathname))
+    const s = Me(t) ?? Me(`https://${t}`);
+    if (!(!s || r.origin === void 0) && r.origin === s.origin && fe(r.pathname, s.pathname))
       return !0;
   }
   return !1;
-}, Fe = (r, e, t) => ts(r, e.passflow) || rs(r, e.backend) ? t ? t(r.href) !== !1 : !0 : !1, st = (r) => {
+}, De = (r, e, t) => is(r, e.passflow) || ns(r, e.backend) ? t ? t(r.href) !== !1 : !0 : !1, ot = (r) => {
   const e = r.detail, t = e?.message ?? `[passflow] upgrade challenge not actioned: ${r.reason}`;
   console.warn(t, { status: r.status, url: r.url, reason: r.reason, detail: e });
-}, ss = (r, e) => {
-  const t = e.onUpgradeDiagnostic ?? st;
+}, os = (r, e) => {
+  const t = e.onUpgradeDiagnostic ?? ot;
   return (s, i) => {
     t({
       status: r.status,
@@ -4223,12 +4284,12 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
       detail: { method: r.request.method, ...i ?? {} }
     });
   };
-}, ue = (r, e, t) => {
-  const s = t.onUpgradeDiagnostic ?? st;
+}, ge = (r, e, t) => {
+  const s = t.onUpgradeDiagnostic ?? ot;
   for (const i of r)
     s({ ...i, url: e.request.href, detail: { method: e.request.method, ...i.detail ?? {} } });
-}, is = /\bjson\b/i, pe = async (r, e) => {
-  const t = e.requireChallengeChannel === "header", s = r.getHeader("content-type") ?? "", i = !t && is.test(s);
+}, as = /\bjson\b/i, ve = async (r, e) => {
+  const t = e.requireChallengeChannel === "header", s = r.getHeader("content-type") ?? "", i = !t && as.test(s);
   let n;
   if (i)
     try {
@@ -4237,23 +4298,23 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
       n = void 0;
     }
   const o = i ? { status: r.status, getHeader: (a) => r.getHeader(a) ?? void 0, body: n } : { status: r.status, getHeader: (a) => r.getHeader(a) ?? void 0 };
-  return ve(o, { requireChallengeChannel: e.requireChallengeChannel });
-}, ns = (r) => ve(
+  return we(o, { requireChallengeChannel: e.requireChallengeChannel });
+}, cs = (r) => we(
   { status: r.status, getHeader: (e) => r.getHeader(e) ?? void 0 },
   { requireChallengeChannel: "header" }
-).challenge, os = (r, e) => e.passflow === null ? `[passflow] a 401/403 from ${r} carried an upgrade challenge, but no Passflow endpoint is configured — set \`url\` on the Passflow config.` : `[passflow] a 401/403 from ${r} carried an upgrade challenge, but that URL is not covered by the provider's \`backend\` prop — add it there to enable step-up for this API.`, as = (r, e) => r instanceof O ? { kind: "cancelled" } : r instanceof Z ? { kind: "unsatisfiable" } : r instanceof j ? { kind: "unavailable" } : r instanceof $ ? { kind: "session-changed" } : r instanceof K ? { kind: "insufficient", obtained: r.obtained, required: r.required } : r instanceof _ ? r.kind === "exhausted" || r.kind === "attempts_exhausted" ? { kind: "exhausted", error: r } : r.kind === "unavailable" ? { kind: "unavailable" } : r.kind === "session_changed" ? { kind: "session-changed" } : { kind: "transport-failure", status: r.status, retryable: r.retryable, error: r } : {
+).challenge, hs = (r, e) => e.passflow === null ? `[passflow] a 401/403 from ${r} carried an upgrade challenge, but no Passflow endpoint is configured — set \`url\` on the Passflow config.` : `[passflow] a 401/403 from ${r} carried an upgrade challenge, but that URL is not covered by the provider's \`backend\` prop — add it there to enable step-up for this API.`, ds = (r, e) => r instanceof O ? { kind: "cancelled" } : r instanceof ee ? { kind: "unsatisfiable" } : r instanceof G ? { kind: "unavailable" } : r instanceof $ ? { kind: "session-changed" } : r instanceof j ? { kind: "insufficient", obtained: r.obtained, required: r.required } : r instanceof _ ? r.kind === "exhausted" || r.kind === "attempts_exhausted" ? { kind: "exhausted", error: r } : r.kind === "unavailable" ? { kind: "unavailable" } : r.kind === "session_changed" ? { kind: "session-changed" } : { kind: "transport-failure", status: r.status, retryable: r.retryable, error: r } : {
   kind: "transport-failure",
   retryable: !1,
   error: r instanceof Error ? r : new Error(String(r))
-}, cs = async (r, e, t, s) => {
+}, ls = async (r, e, t, s) => {
   if (r.status !== 401 && r.status !== 403)
     return { kind: "replayed", response: r };
-  const { challenge: i, diagnostics: n } = await pe(r, e);
-  if (ue(n, r, e), !i)
+  const { challenge: i, diagnostics: n } = await ve(r, e);
+  if (ge(n, r, e), !i)
     return { kind: "replayed", response: r };
-  const o = G(i);
+  const o = H(i);
   return s("elevated-insufficient", { obtained: t, required: o }), { kind: "insufficient", obtained: t, required: o, response: r };
-}, hs = async (r, e) => {
+}, us = async (r, e) => {
   if (!e)
     return { aborted: !1, value: await r };
   if (e.aborted)
@@ -4269,28 +4330,28 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
   } finally {
     t && e.removeEventListener?.("abort", t);
   }
-}, it = async (r, e) => {
+}, at = async (r, e) => {
   if (r.status !== 401 && r.status !== 403)
     return { kind: "not-a-challenge" };
   if (r.markers.upgradeTransaction)
     return { kind: "not-a-challenge" };
-  const t = ss(r, e);
+  const t = os(r, e);
   if (r.markers.replayed) {
-    if (!Fe(r.request, e.scope, e.shouldIntercept))
+    if (!De(r.request, e.scope, e.shouldIntercept))
       return { kind: "not-a-challenge" };
-    const { challenge: y, diagnostics: I } = await pe(r, e);
-    if (ue(I, r, e), !y)
+    const { challenge: y, diagnostics: I } = await ve(r, e);
+    if (ge(I, r, e), !y)
       return { kind: "not-a-challenge" };
-    const Y = e.readObtainedBar?.() ?? {}, Se = G(y);
-    return t("elevated-insufficient", { obtained: Y, required: Se }), { kind: "insufficient", obtained: Y, required: Se, response: r };
+    const W = e.readObtainedBar?.() ?? {}, _e = H(y);
+    return t("elevated-insufficient", { obtained: W, required: _e }), { kind: "insufficient", obtained: W, required: _e, response: r };
   }
-  if (!Fe(r.request, e.scope, e.shouldIntercept))
-    return ns(r) ? (t("challenge-out-of-scope", {
+  if (!De(r.request, e.scope, e.shouldIntercept))
+    return cs(r) ? (t("challenge-out-of-scope", {
       header: r.getHeader("www-authenticate") ?? void 0,
-      message: os(r.request.href, e.scope)
+      message: hs(r.request.href, e.scope)
     }), { kind: "out-of-scope" }) : { kind: "not-a-challenge" };
-  const { challenge: s, diagnostics: i } = await pe(r, e);
-  if (ue(i, r, e), !s) {
+  const { challenge: s, diagnostics: i } = await ve(r, e);
+  if (ge(i, r, e), !s) {
     const u = r.getHeader("www-authenticate");
     return e.requireChallengeChannel !== "header" && t("no-channel", {
       ...u ? { header: u } : {},
@@ -4304,9 +4365,9 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
   const n = e.authorizationSwap?.(), o = { kind: "request", url: r.request.href, method: r.request.method };
   let a, h;
   try {
-    a = Promise.resolve(e.elevate(s, o)), h = await hs(a, r.signal);
+    a = Promise.resolve(e.elevate(s, o)), h = await us(a, r.signal);
   } catch (u) {
-    return as(u);
+    return ds(u);
   }
   if (h.aborted)
     return a?.then(
@@ -4317,32 +4378,32 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
   const p = h.value;
   if (r.signal?.aborted)
     return p?.waiter.report({ outcome: "failed" }), { kind: "aborted", reason: r.signal.reason };
-  const m = p?.obtained ?? e.readObtainedBar?.() ?? G(s), d = e.authorizationSwap?.(), g = d ? { from: n?.from ?? d.from, to: d.to } : void 0;
+  const m = p?.obtained ?? e.readObtainedBar?.() ?? H(s), d = e.authorizationSwap?.(), g = d ? { from: n?.from ?? d.from, to: d.to } : void 0;
   r.markers.replayed = !0;
   let f;
   try {
     f = await r.replay(g ? { authorizationSwap: g } : void 0);
   } catch (u) {
-    if (u instanceof K)
+    if (u instanceof j)
       return p?.waiter.report({ outcome: "insufficient", obtained: u.obtained, required: u.required }), r.signal?.aborted ? { kind: "aborted", reason: r.signal.reason } : { kind: "insufficient", obtained: u.obtained, required: u.required };
     if (p?.waiter.report({ outcome: "failed" }), r.signal?.aborted)
       return { kind: "aborted", reason: r.signal.reason };
     throw u;
   }
-  const v = await cs(f, e, m, t);
+  const v = await ls(f, e, m, t);
   return v.kind === "insufficient" ? p?.waiter.report({ outcome: "insufficient", obtained: v.obtained, required: v.required }) : p?.waiter.report({ outcome: "replayed", obtained: m }), v;
-}, ds = (r) => {
+}, ps = (r) => {
   switch (r.kind) {
     case "cancelled":
       return new O();
     case "unsatisfiable":
-      return new Z();
+      return new ee();
     case "unavailable":
-      return new j();
+      return new G();
     case "session-changed":
       return new $();
     case "insufficient":
-      return new K(r.obtained, r.required);
+      return new j(r.obtained, r.required);
     case "exhausted":
       return r.error;
     case "transport-failure":
@@ -4350,7 +4411,7 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     default:
       return;
   }
-}, ls = (r, e, t) => {
+}, fs = (r, e, t) => {
   switch (r.kind) {
     case "replayed":
       return { settle: "resolve", value: r.response.raw };
@@ -4361,47 +4422,47 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     case "aborted":
       return { settle: "reject", error: r.reason };
     case "cancelled":
-      return t.onCancel === "reject" ? { settle: "reject", error: new O() } : { settle: "resolve", value: oe(e, r) };
+      return t.onCancel === "reject" ? { settle: "reject", error: new O() } : { settle: "resolve", value: ce(e, r) };
     case "insufficient":
-      return { settle: "resolve", value: oe(r.response?.raw ?? e, r) };
+      return { settle: "resolve", value: ce(r.response?.raw ?? e, r) };
     default:
-      return { settle: "resolve", value: oe(e, r) };
+      return { settle: "resolve", value: ce(e, r) };
   }
-}, us = (r, e) => {
+}, gs = (r, e) => {
   switch (r.kind) {
     case "replayed":
       return r.response.rejected ? { settle: "reject", error: r.response.raw ?? e } : { settle: "resolve", value: r.response.raw };
     case "aborted":
       return { settle: "reject", error: r.reason };
     default:
-      return { settle: "reject", error: ds(r) ?? e };
+      return { settle: "reject", error: ps(r) ?? e };
   }
-}, nt = /* @__PURE__ */ new WeakSet(), ot = /* @__PURE__ */ new WeakSet(), at = /* @__PURE__ */ new WeakSet(), ct = /* @__PURE__ */ new WeakSet(), ht = /* @__PURE__ */ new WeakSet(), dt = /* @__PURE__ */ new WeakSet(), lt = /* @__PURE__ */ new WeakSet(), oe = (r, e) => {
+}, ct = /* @__PURE__ */ new WeakSet(), ht = /* @__PURE__ */ new WeakSet(), dt = /* @__PURE__ */ new WeakSet(), lt = /* @__PURE__ */ new WeakSet(), ut = /* @__PURE__ */ new WeakSet(), pt = /* @__PURE__ */ new WeakSet(), ft = /* @__PURE__ */ new WeakSet(), ce = (r, e) => {
   switch (e.kind) {
     case "cancelled":
-      nt.add(r);
+      ct.add(r);
       break;
     case "exhausted":
-      ot.add(r);
+      ht.add(r);
       break;
     case "insufficient":
-      at.add(r);
+      dt.add(r);
       break;
     case "unsatisfiable":
-      ct.add(r);
+      lt.add(r);
       break;
     case "unavailable":
-      ht.add(r);
+      ut.add(r);
       break;
     case "session-changed":
-      dt.add(r);
+      pt.add(r);
       break;
     case "transport-failure":
-      lt.add(r);
+      ft.add(r);
       break;
   }
   return r;
-}, Ys = (r) => nt.has(r), Ws = (r) => ot.has(r), Xs = (r) => at.has(r), Js = (r) => ct.has(r), Zs = (r) => ht.has(r), Qs = (r) => dt.has(r), ei = (r) => lt.has(r), ps = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]), ee = (r) => typeof r == "object" && r !== null && typeof r.url == "string" && typeof r.clone == "function" && "method" in r, fs = (r) => typeof r == "string" ? r : ee(r) ? r.url : String(r), gs = (r, e) => (e?.method ?? (ee(r) ? r.method : void 0) ?? "GET").toUpperCase(), ms = (r) => r == null ? "none" : typeof r == "string" ? "reusable" : typeof r.getReader == "function" ? "one-shot" : "reusable", vs = (r) => {
+}, Js = (r) => ct.has(r), Zs = (r) => ht.has(r), Qs = (r) => dt.has(r), ei = (r) => lt.has(r), ti = (r) => ut.has(r), ri = (r) => pt.has(r), si = (r) => ft.has(r), vs = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]), re = (r) => typeof r == "object" && r !== null && typeof r.url == "string" && typeof r.clone == "function" && "method" in r, ms = (r) => typeof r == "string" ? r : re(r) ? r.url : String(r), ys = (r, e) => (e?.method ?? (re(r) ? r.method : void 0) ?? "GET").toUpperCase(), ks = (r) => r == null ? "none" : typeof r == "string" ? "reusable" : typeof r.getReader == "function" ? "one-shot" : "reusable", ws = (r) => {
   if (typeof r == "string")
     return r.length;
   const e = r;
@@ -4409,7 +4470,7 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     return e.size;
   if (typeof e?.byteLength == "number")
     return e.byteLength;
-}, J = (r, e, t) => r === void 0 || r === "always" ? !0 : r === "idempotent-only" ? ps.has(e.method) : typeof r == "function" ? r(e) : !(r.maxBodyBytes !== void 0 && t !== void 0 && t > r.maxBodyBytes), q = (r, e, t, s, i) => ({
+}, Q = (r, e, t) => r === void 0 || r === "always" ? !0 : r === "idempotent-only" ? vs.has(e.method) : typeof r == "function" ? r(e) : !(r.maxBodyBytes !== void 0 && t !== void 0 && t > r.maxBodyBytes), N = (r, e, t, s, i) => ({
   replayable: !1,
   bodyKind: r,
   reason: e,
@@ -4417,12 +4478,12 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
   forwardInit: i,
   snapshot: s,
   replay: () => Promise.reject(new Error(`This request cannot be replayed: ${e}`))
-}), ut = (r, e) => tt(et(r.headers, e?.authorizationSwap)), ae = (r) => {
+}), gt = (r, e) => it(st(r.headers, e?.authorizationSwap)), he = (r) => {
   if (!r || !("headers" in r))
     return r;
   const { headers: e, ...t } = r;
   return t;
-}, ys = (r, e) => e && "headers" in e && e.headers !== void 0 ? e.headers : ee(r) ? r.headers : void 0, ks = (r) => {
+}, Ss = (r, e) => e && "headers" in e && e.headers !== void 0 ? e.headers : re(r) ? r.headers : void 0, bs = (r) => {
   if (r === null || typeof r == "string")
     return r;
   if (typeof FormData < "u" && r instanceof FormData) {
@@ -4432,12 +4493,12 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     return e;
   }
   return typeof URLSearchParams < "u" && r instanceof URLSearchParams ? new URLSearchParams(r) : r instanceof ArrayBuffer ? r.slice(0) : ArrayBuffer.isView(r) ? new Uint8Array(r.buffer, r.byteOffset, r.byteLength).slice() : r;
-}, Me = (r, e, t) => new Request(r, { headers: ut(e, t) }), ws = (r, e, t) => {
-  const s = fs(r), i = gs(r, e), n = ys(r, e), o = (d, g) => Qe({ url: s, method: i, headers: n, bodyKind: d, ...g === void 0 ? {} : { body: g } });
-  if (ee(r)) {
+}, Ue = (r, e, t) => new Request(r, { headers: gt(e, t) }), Ts = (r, e, t) => {
+  const s = ms(r), i = ys(r, e), n = Ss(r, e), o = (d, g) => rt({ url: s, method: i, headers: n, bodyKind: d, ...g === void 0 ? {} : { body: g } });
+  if (re(r)) {
     if (r.body === null || r.body === void 0) {
       const v = o("none");
-      return J(t, { url: s, method: i, bodyKind: "none" }) ? {
+      return Q(t, { url: s, method: i, bodyKind: "none" }) ? {
         replayable: !0,
         bodyKind: "none",
         forwardInput: r,
@@ -4446,17 +4507,17 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
         // The snapshot's effective header set is applied to the `Request` and
         // `init.headers` is dropped, so `fetch` has only one set to choose
         // from. See `replayHeaders` for why that matters.
-        replay: (y, I) => y(Me(r, v, I), ae(e))
-      } : q("none", "the replay policy refused this request", r, v, e);
+        replay: (y, I) => y(Ue(r, v, I), he(e))
+      } : N("none", "the replay policy refused this request", r, v, e);
     }
     const d = o("request-clone");
-    if (!J(t, { url: s, method: i, bodyKind: "request-clone" }))
-      return q("request-clone", "the replay policy refused this request", r, d, e);
+    if (!Q(t, { url: s, method: i, bodyKind: "request-clone" }))
+      return N("request-clone", "the replay policy refused this request", r, d, e);
     let f;
     try {
       f = r.clone();
     } catch {
-      return q("one-shot", "the Request body was already consumed and cannot be cloned", r, d, e);
+      return N("one-shot", "the Request body was already consumed and cannot be cloned", r, d, e);
     }
     return {
       replayable: !0,
@@ -4464,15 +4525,15 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
       forwardInput: r,
       forwardInit: e,
       snapshot: d,
-      replay: (v, u) => v(Me(f, d, u), ae(e))
+      replay: (v, u) => v(Ue(f, d, u), he(e))
     };
   }
-  const a = ms(e?.body);
+  const a = ks(e?.body);
   if (a === "one-shot")
-    return q("one-shot", "a streaming request body is consumed by the first send", r, o("one-shot"), e);
-  if (!J(t, { url: s, method: i, bodyKind: a }, vs(e?.body)))
-    return q(a, "the replay policy refused this request", r, o(a), e);
-  const p = e && "body" in e ? ks(e.body ?? null) : void 0, m = o(a, p);
+    return N("one-shot", "a streaming request body is consumed by the first send", r, o("one-shot"), e);
+  if (!Q(t, { url: s, method: i, bodyKind: a }, ws(e?.body)))
+    return N(a, "the replay policy refused this request", r, o(a), e);
+  const p = e && "body" in e ? bs(e.body ?? null) : void 0, m = o(a, p);
   return {
     replayable: !0,
     bodyKind: a,
@@ -4497,22 +4558,22 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     // unchanged, so an abort during the replay behaves identically to an abort
     // during the original.
     replay: (d, g) => d(m.dispatchUrl, {
-      ...ae(e),
+      ...he(e),
       ...p === void 0 ? {} : { body: p },
-      headers: ut(m, g),
+      headers: gt(m, g),
       method: m.method
     })
   };
-}, te = (r) => typeof r == "object" && r !== null, Ss = (r) => (e) => {
-  if (!te(r))
+}, se = (r) => typeof r == "object" && r !== null, _s = (r) => (e) => {
+  if (!se(r))
     return;
   const s = r[e] ?? r[e.toLowerCase()] ?? (typeof r.get == "function" ? r.get(e) : void 0);
   return Array.isArray(s) ? s.join(", ") : typeof s == "string" ? s : void 0;
-}, bs = (r) => {
+}, Es = (r) => {
   const e = r?.url ?? "", t = r?.baseURL;
   return !t || /^([a-z][a-z\d+\-.]*:)?\/\//i.test(e) ? e : `${t.replace(/\/+$/, "")}/${e.replace(/^\/+/, "")}`;
-}, Ts = (r) => (r?.method ?? "GET").toUpperCase(), _s = (r) => r == null ? "none" : te(r) && (typeof r.pipe == "function" || typeof r.getReader == "function") ? "one-shot" : "reusable", Es = (r, e, t) => {
-  const s = tt(et(e.headers, t?.authorizationSwap)), i = e.dispatchUrl === e.href && e.resolved;
+}, Is = (r) => (r?.method ?? "GET").toUpperCase(), As = (r) => r == null ? "none" : se(r) && (typeof r.pipe == "function" || typeof r.getReader == "function") ? "one-shot" : "reusable", Cs = (r, e, t) => {
+  const s = it(st(e.headers, t?.authorizationSwap)), i = e.dispatchUrl === e.href && e.resolved;
   return {
     ...r,
     ...i ? { baseURL: void 0 } : {},
@@ -4521,56 +4582,56 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     headers: s,
     ..."body" in e ? { data: e.body } : {}
   };
-}, fe = (r, e, t, s, i, n) => {
-  const o = e ?? r?.config, a = _s(o?.data), h = n ?? Qe({
-    url: bs(o),
-    method: Ts(o),
+}, me = (r, e, t, s, i, n) => {
+  const o = e ?? r?.config, a = As(o?.data), h = n ?? rt({
+    url: Es(o),
+    method: Is(o),
     headers: o?.headers,
     bodyKind: a,
     body: o?.data
-  }), p = { url: h.href, method: h.method, bodyKind: a }, m = a !== "one-shot" && J(i.replay, p);
+  }), p = { url: h.href, method: h.method, bodyKind: a }, m = a !== "one-shot" && Q(i.replay, p);
   return {
     status: r?.status ?? 0,
-    getHeader: Ss(r?.headers),
+    getHeader: _s(r?.headers),
     // Pre-read by axios into `data`; nothing is consumed by reading it again,
     // and the core still decides whether reading it is in scope.
     readBody: async () => r?.data,
     request: h,
     replay: async (d) => {
-      const g = Ht(Es(o ?? {}, h, d));
+      const g = Wt(Cs(o ?? {}, h, d));
       try {
         const f = await s(g);
-        return fe(f, f?.config ?? g, f, s, i, h);
+        return me(f, f?.config ?? g, f, s, i, h);
       } catch (f) {
-        const v = te(f) ? f : {};
-        if (!v.response || typeof v.response.status != "number" || Xe(f))
+        const v = se(f) ? f : {};
+        if (!v.response || typeof v.response.status != "number" || Qe(f))
           throw f;
-        return { ...fe(v.response, v.config ?? g, f, s, i, h), rejected: !0 };
+        return { ...me(v.response, v.config ?? g, f, s, i, h), rejected: !0 };
       }
     },
     markers: {
-      ...ze(o) ? { upgradeTransaction: !0 } : {},
-      ...zt(o) ? { replayed: !0 } : {}
+      ...Xe(o) ? { upgradeTransaction: !0 } : {},
+      ...Xt(o) ? { replayed: !0 } : {}
     },
     raw: t,
     replayable: m,
     replayUnsupportedReason: a === "one-shot" ? "a streaming request body is consumed by the first send" : "the replay policy refused this request",
     signal: o?.signal
   };
-}, pt = (r, e) => async (t) => {
-  const s = rt(r), i = te(t) ? t : {}, n = fe(i.response, i.config, i.response, e, s), o = await it(n, s), a = us(o, t);
+}, vt = (r, e) => async (t) => {
+  const s = nt(r), i = se(t) ? t : {}, n = me(i.response, i.config, i.response, e, s), o = await at(n, s), a = gs(o, t);
   if (a.settle === "reject")
     throw a.error;
   return a.value;
-}, Is = (r, e, t) => {
-  const s = r.request, i = typeof s == "function" ? (a) => s.call(r, a) : () => Promise.reject(new Error("Passflow: this client exposes no request() to replay through.")), n = r.interceptors.response.use(void 0, pt(e, i));
+}, Rs = (r, e, t) => {
+  const s = r.request, i = typeof s == "function" ? (a) => s.call(r, a) : () => Promise.reject(new Error("Passflow: this client exposes no request() to replay through.")), n = r.interceptors.response.use(void 0, vt(e, i));
   let o = !1;
   return () => {
     o || (o = !0, r.interceptors.response.eject(n));
   };
 };
-let ce = 0;
-const As = (r, e) => {
+let de = 0;
+const Fs = (r, e) => {
   const t = e?.signal ?? (typeof r == "object" && r !== null ? r.signal : void 0) ?? void 0;
   if (t)
     return {
@@ -4585,9 +4646,9 @@ const As = (r, e) => {
         removeEventListener: (s, i) => t.removeEventListener(s, i)
       } : {}
     };
-}, Cs = (r) => (e) => r.headers?.get(e), ft = (r, e, t, s, i) => ({
+}, Ps = (r) => (e) => r.headers?.get(e), mt = (r, e, t, s, i) => ({
   status: r.status,
-  getHeader: Cs(r),
+  getHeader: Ps(r),
   // A CLONE, always. The response the caller receives must still have an unread
   // body, and the core calls this only when the scope and the channel policy
   // both permit a body read.
@@ -4600,7 +4661,7 @@ const As = (r, e) => {
   request: e.snapshot,
   replay: async (n) => {
     const o = await e.replay(t, n);
-    return ft(o, e, t, s, i);
+    return mt(o, e, t, s, i);
   },
   markers: s,
   raw: r,
@@ -4608,89 +4669,89 @@ const As = (r, e) => {
   replayUnsupportedReason: e.reason,
   signal: i,
   responseType: r.type
-}), he = (r, e) => {
+}), le = (r, e) => {
   const t = (s, i) => {
-    ce += 1;
+    de += 1;
     try {
       return r(s, i);
     } finally {
-      ce -= 1;
+      de -= 1;
     }
   };
   return async (s, i) => {
-    if (ce > 0)
+    if (de > 0)
       return t(s, i);
-    const n = rt(e), o = ws(s, i, n.replay), a = await t(o.forwardInput, o.forwardInit), h = ft(a, o, t, {}, As(s, i)), p = await it(h, n), m = ls(p, a, n);
+    const n = nt(e), o = Ts(s, i, n.replay), a = await t(o.forwardInput, o.forwardInit), h = mt(a, o, t, {}, Fs(s, i)), p = await at(h, n), m = fs(p, a, n);
     if (m.settle === "reject")
       throw m.error;
     return m.value;
   };
-}, Rs = (r, e) => {
-  const t = B.create(r);
+}, Ms = (r, e) => {
+  const t = K.create(r);
   return e(t), t;
-}, ti = 10, Fs = 20;
-class Ms extends Error {
+}, ii = 10, Ds = 20;
+class Us extends Error {
   constructor(e) {
     super(
       `Passflow fetch middleware '${e}' resolved without calling next(). Every registered middleware must delegate exactly once; swallowing a request would drop a caller's fetch inside the Passflow wrapper.`
     ), this.name = "FetchMiddlewareContractError", this.middlewareName = e;
   }
 }
-let x = [], Ps = 0, H = !1, V, L;
-const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof globalThis > "u" ? void 0 : globalThis, ge = async (r, e, t, s) => {
+let x = [], xs = 0, z = !1, B, L;
+const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof globalThis > "u" ? void 0 : globalThis, ye = async (r, e, t, s) => {
   if (e >= r.length) {
-    const h = V;
+    const h = B;
     if (!h)
       throw new Error("Passflow fetch registry: no captured fetch to delegate to.");
     return h(t, s);
   }
   const i = r[e];
   if (!i)
-    return ge(r, r.length, t, s);
+    return ye(r, r.length, t, s);
   let n = !1;
-  const o = (h, p) => (n = !0, ge(r, e + 1, h, p)), a = await i.middleware(o, t, s);
+  const o = (h, p) => (n = !0, ye(r, e + 1, h, p)), a = await i.middleware(o, t, s);
   if (!n)
-    throw new Ms(i.name);
+    throw new Us(i.name);
   return a;
-}, Us = () => {
-  const r = ke();
+}, Os = () => {
+  const r = be();
   if (!r || typeof r.fetch != "function")
     return !1;
-  const e = r.fetch.bind(r), t = (s, i) => ge([...x].sort(gt), 0, s, i);
-  return V = e, L = t, r.fetch = t, H = !0, !0;
-}, Ds = () => {
-  const r = ke();
-  !r || !L || r.fetch === L && (V && (r.fetch = V), H = !1, L = void 0, V = void 0);
-}, xs = (r, e) => {
-  if (!H && !Us())
+  const e = r.fetch.bind(r), t = (s, i) => ye([...x].sort(yt), 0, s, i);
+  return B = e, L = t, r.fetch = t, z = !0, !0;
+}, Ls = () => {
+  const r = be();
+  !r || !L || r.fetch === L && (B && (r.fetch = B), z = !1, L = void 0, B = void 0);
+}, $s = (r, e) => {
+  if (!z && !Os())
     return () => {
     };
   const t = {
     middleware: r,
     name: e.name,
     priority: e.priority,
-    seq: Ps++
+    seq: xs++
   };
   x.push(t);
   let s = !1;
   return () => {
-    s || (s = !0, x = x.filter((i) => i !== t), x.length === 0 && Ds());
+    s || (s = !0, x = x.filter((i) => i !== t), x.length === 0 && Ls());
   };
-}, ri = () => {
-  const r = ke();
+}, ni = () => {
+  const r = be();
   return {
-    installed: H,
-    names: [...x].sort(gt).map((e) => e.name),
-    foreignPatch: H && !!r && !!L && r.fetch !== L
+    installed: z,
+    names: [...x].sort(yt).map((e) => e.name),
+    foreignPatch: z && !!r && !!L && r.fetch !== L
   };
-}, Os = (r) => r === void 0 ? [] : (Array.isArray(r) ? r : [r]).filter((e) => e !== ""), Ls = (r) => {
+}, qs = (r) => r === void 0 ? [] : (Array.isArray(r) ? r : [r]).filter((e) => e !== ""), Ns = (r) => {
   let e;
   const t = (d) => d !== void 0 && e === d, s = (d) => {
     const g = () => {
       if (!t(d()))
         throw new _({ kind: "session_changed" });
     };
-    return es({
+    return ss({
       ...r,
       relyingPartyId: () => e?.options.relyingPartyId ?? r.relyingPartyId?.(),
       startUpgrade: (f) => (g(), r.startUpgrade(f)),
@@ -4703,7 +4764,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
     });
   }, i = (d, g) => {
     const f = {}, u = {
-      controller: new Wr({
+      controller: new Zr({
         transport: s(() => f.current),
         prompt: d.prompt,
         platform: r.platform,
@@ -4713,14 +4774,14 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
         ...d.onFlightSettled ? { onFlightSettled: d.onFlightSettled } : {}
       }),
       options: d,
-      scope: { passflow: r.passflowDomain, backend: Os(d.backend) },
+      scope: { passflow: r.passflowDomain, backend: qs(d.backend) },
       generation: g
     };
     return f.current = u, u;
   }, n = async (d, g) => {
     const f = e;
     if (!f)
-      throw new j("Step-up verification is not enabled on this Passflow instance");
+      throw new G("Step-up verification is not enabled on this Passflow instance");
     f.controller.active || (f.pin = r.readSessionPin?.());
     const v = await f.controller.elevate(d, g);
     if (!t(f))
@@ -4742,7 +4803,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
   };
   let a;
   return Object.defineProperties(async (d) => {
-    const g = d?.acrValues === void 0 ? void 0 : Q(d.acrValues).level, f = {
+    const g = d?.acrValues === void 0 ? void 0 : te(d.acrValues).level, f = {
       status: 401,
       ...d?.acrValues === void 0 ? {} : { acrValues: d.acrValues },
       ...g === void 0 ? {} : { requiredLevel: g },
@@ -4759,11 +4820,11 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       const g = [];
       if (r.attachInternalSeam) {
         const v = r.attachInternalSeam;
-        v((u) => pt(o, u)), g.push(() => v(void 0));
+        v((u) => vt(o, u)), g.push(() => v(void 0));
       }
       d.interceptFetch && g.push(
-        xs((v, u, y) => he(v, o)(u, y), {
-          priority: Fs,
+        $s((v, u, y) => le(v, o)(u, y), {
+          priority: Ds,
           name: "passflow-upgrade"
         })
       ), r.onSessionChange && g.push(
@@ -4796,19 +4857,19 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       enumerable: !0,
       value: (d) => {
         if (d)
-          return he(d, o);
+          return le(d, o);
         const g = typeof globalThis > "u" ? void 0 : globalThis;
         if (!g || typeof g.fetch != "function")
           throw new Error("Passflow: withAuth() needs a fetch to wrap — this runtime has none.");
-        return he(g.fetch.bind(g), o);
+        return le(g.fetch.bind(g), o);
       }
     },
     attachAuth: {
       enumerable: !0,
-      value: (d) => Is(d, o)
+      value: (d) => Rs(d, o)
     }
   });
-}, we = class we {
+}, Te = class Te {
   constructor(e) {
     this.doRefreshTokens = !1, this.session = async ({
       createSession: n,
@@ -4818,10 +4879,10 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       this.createSessionCallback = n, this.expiredSessionCallback = o, this.doRefreshTokens = a, await this.submitSessionCheck();
     };
     const { url: t, appId: s, scopes: i } = e;
-    this.url = t || De, this.appId = s, this.platform = e.platform ?? z, this.storageManager = new me({
+    this.url = t || Le, this.appId = s, this.platform = e.platform ?? Y, this.storageManager = new ke({
       prefix: e.keyStoragePrefix ?? "",
       storage: this.platform.storage
-    }), this.deviceService = new $e(this.storageManager), this.authApi = new rr(e, this.storageManager, this.deviceService), this.appApi = new tr(e, this.storageManager, this.deviceService), this.userApi = new cr(e, this.storageManager, this.deviceService), this.settingApi = new ir(e, this.storageManager, this.deviceService), this.tenantApi = new nr(e, this.storageManager, this.deviceService), this.invitationApi = new sr(e, this.storageManager, this.deviceService), this.twoFactorApi = new or(e, this.storageManager, this.deviceService), this.upgradeApi = new ar(e, this.storageManager, this.deviceService), this.upgradeDomain = Ye(e.url), this.subscribeStore = new hr(), this.tokenCacheService = new Pr(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = i ?? _t, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ir(
+    }), this.deviceService = new Ve(this.storageManager), this.authApi = new nr(e, this.storageManager, this.deviceService), this.appApi = new ir(e, this.storageManager, this.deviceService), this.userApi = new lr(e, this.storageManager, this.deviceService), this.settingApi = new ar(e, this.storageManager, this.deviceService), this.tenantApi = new cr(e, this.storageManager, this.deviceService), this.invitationApi = new or(e, this.storageManager, this.deviceService), this.twoFactorApi = new hr(e, this.storageManager, this.deviceService), this.upgradeApi = new dr(e, this.storageManager, this.deviceService), this.upgradeDomain = Je(e.url), this.subscribeStore = new ur(), this.tokenCacheService = new xr(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = i ?? At, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Rr(
       this.authApi,
       this.deviceService,
       this.storageManager,
@@ -4837,7 +4898,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       this.appId ?? "",
       e.tokenExchange,
       this.platform
-    ), this.userService = new Dr(this.userApi, this.deviceService, this.platform), this.tenantService = new Mr(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Ar(this.invitationApi), this.twoFactorService = new Ur(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, this.upgrade = Ls({
+    ), this.userService = new Lr(this.userApi, this.deviceService, this.platform), this.tenantService = new Ur(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Fr(this.invitationApi), this.twoFactorService = new Or(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, this.upgrade = Ns({
       // The prepare round. The commit round is `/auth/refresh`, which must go
       // through AuthService: it is the only path that STORES the rotated tokens,
       // so posting directly would elevate the session on the server and leave
@@ -4945,7 +5006,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * ```
    */
   createClient(e) {
-    return Rs(e, (t) => this.upgrade.attachAuth(t));
+    return Ms(e, (t) => this.upgrade.attachAuth(t));
   }
   /**
    * The assurance bar the session currently holds, read from the `acr` claim of
@@ -4962,7 +5023,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
         const t = T(e), s = typeof t.acr == "string" ? t.acr : void 0;
         if (!s)
           return;
-        const i = Q(s).level;
+        const i = te(s).level;
         return i === void 0 ? { acrValues: s } : { acrValues: s, level: i };
       } catch {
         return;
@@ -5104,10 +5165,14 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       const p = new URLSearchParams(e.hash.substring(1));
       p.get("access_token") && (t = p, s = !0);
     }
+    if (!t.get("access_token") && this.adoptTwoFactorTokenFromUrl(e)) {
+      this.error = void 0;
+      return;
+    }
     const i = t.get("access_token"), n = t.get("refresh_token"), o = t.get("id_token"), a = t.get("scopes")?.split(",") ?? this.scopes;
     let h;
     if (i) {
-      if (!re(i)) {
+      if (!X(i)) {
         const p = {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -5115,7 +5180,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
         this.subscribeStore.notify(c.Error, p), this.cleanupUrlParams(s, e);
         return;
       }
-      if (n && !re(n)) {
+      if (n && !X(n)) {
         const p = {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -5123,7 +5188,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
         this.subscribeStore.notify(c.Error, p), this.cleanupUrlParams(s, e);
         return;
       }
-      if (o && !re(o)) {
+      if (o && !X(o)) {
         const p = {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
@@ -5140,10 +5205,32 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
     } else
       this.error = this.checkErrorsFromURL();
   }
+  /**
+   * Adopts a `#tfa_token=` fragment: the 2FA token goes to the TwoFactorService
+   * through `TwoFactorRequired`, exactly as a password sign-in's does, and the
+   * fragment is stripped from the URL. Nothing is saved as a session.
+   *
+   * @returns true when the URL carried a 2FA token
+   */
+  adoptTwoFactorTokenFromUrl(e) {
+    if (!e?.hash) return !1;
+    const t = new URLSearchParams(e.hash.substring(1)), s = t.get("tfa_token");
+    if (!s) return !1;
+    t.delete("tfa_token");
+    const i = t.toString();
+    if (this.platform.replaceUrl(e.pathname + e.search + (i ? `#${i}` : "")), !X(s)) {
+      const n = {
+        message: "Invalid 2FA token format received",
+        code: "INVALID_TOKEN_FORMAT"
+      };
+      return this.subscribeStore.notify(c.Error, n), !0;
+    }
+    return this.subscribeStore.notify(c.TwoFactorRequired, { email: "", challengeId: "", tfaToken: s }), !0;
+  }
   checkErrorsFromURL() {
     const t = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("error");
     if (t) {
-      const s = Tr(t);
+      const s = Ir(t);
       return new Error(s);
     }
   }
@@ -6123,6 +6210,8 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * Completes the authentication process and saves tokens.
    *
    * @param code - 6-digit TOTP code from authenticator app
+   * @param options - `trustDevice: true` asks the server to trust this device,
+   *   so later sign-ins from it skip the second factor where the app allows it
    * @returns Promise with verification response containing tokens
    * @throws {PassflowError} If verification fails
    *
@@ -6130,20 +6219,20 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * ```typescript
    * // After signIn returns requires_2fa: true
    * if (passflow.isTwoFactorVerificationRequired()) {
-   *   const response = await passflow.verifyTwoFactor('123456');
+   *   const response = await passflow.verifyTwoFactor('123456', { trustDevice: true });
    *   console.log('Authentication complete', response.access_token);
    * }
    * ```
    */
-  async verifyTwoFactor(e) {
+  async verifyTwoFactor(e, t) {
     try {
-      const t = await this.twoFactorService.verify(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(c.SignIn, {
-        tokens: t,
+      const s = await this.twoFactorService.verify(e, t);
+      return this.storageManager.saveTokens(s), this.tokenCacheService.setTokensCache(s), this.subscribeStore.notify(c.SignIn, {
+        tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), t;
-    } catch (t) {
-      this.handleError(t, "Verify 2FA");
+      }), await this.submitSessionCheck(), s;
+    } catch (s) {
+      this.handleError(s, "Verify 2FA");
     }
   }
   /**
@@ -6151,6 +6240,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * Completes the authentication process and saves tokens.
    *
    * @param code - Recovery code from the list provided during setup
+   * @param options - `trustDevice: true` asks the server to trust this device
    * @returns Promise with recovery response containing tokens and remaining codes count
    * @throws {PassflowError} If recovery code is invalid
    *
@@ -6162,15 +6252,15 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * console.log(`${result.remaining_recovery_codes} recovery codes remaining`);
    * ```
    */
-  async useTwoFactorRecoveryCode(e) {
+  async useTwoFactorRecoveryCode(e, t) {
     try {
-      const t = await this.twoFactorService.useRecoveryCode(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(c.SignIn, {
-        tokens: t,
+      const s = await this.twoFactorService.useRecoveryCode(e, t);
+      return this.storageManager.saveTokens(s), this.tokenCacheService.setTokensCache(s), this.subscribeStore.notify(c.SignIn, {
+        tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), t;
-    } catch (t) {
-      this.handleError(t, "Use 2FA recovery code");
+      }), await this.submitSessionCheck(), s;
+    } catch (s) {
+      this.handleError(s, "Use 2FA recovery code");
     }
   }
   /**
@@ -6216,6 +6306,45 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       this.handleError(t, "Regenerate 2FA recovery codes");
     }
   }
+  /**
+   * List the devices the signed-in user trusted to skip the second factor on
+   * this app. The device making the request has `current: true`.
+   *
+   * @returns Promise with the trusted devices
+   * @throws {PassflowError} If the request fails
+   *
+   * @example
+   * ```typescript
+   * const devices = await passflow.getTrustedDevices();
+   * devices.forEach((d) => console.log(d.user_agent, d.current ? '(this device)' : ''));
+   * ```
+   */
+  async getTrustedDevices() {
+    try {
+      return await this.twoFactorService.getTrustedDevices();
+    } catch (e) {
+      this.handleError(e, "Get trusted devices");
+    }
+  }
+  /**
+   * Revoke one of the signed-in user's trusted devices. Its next sign-in
+   * asks for the second factor again.
+   *
+   * @param id - The trusted device's `id` from `getTrustedDevices()`
+   * @throws {PassflowError} If the request fails, including a 404 for an unknown id
+   *
+   * @example
+   * ```typescript
+   * await passflow.revokeTrustedDevice(device.id);
+   * ```
+   */
+  async revokeTrustedDevice(e) {
+    try {
+      await this.twoFactorService.revokeTrustedDevice(e);
+    } catch (t) {
+      this.handleError(t, "Revoke trusted device");
+    }
+  }
   /**
    * Check if 2FA verification is currently required (local state check).
    * Returns true if user has signed in but needs to complete 2FA verification.
@@ -6327,8 +6456,8 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
     this.twoFactorService.clearMagicLinkSession();
   }
 };
-we.version = Tt;
-let Pe = we;
+Te.version = It;
+let xe = Te;
 class S extends Error {
   constructor(e) {
     super(e.message), this.name = "M2MError", this.code = e.code, this.status = e.status ?? 400, this.errorUri = e.errorUri, this.rateLimitInfo = e.rateLimitInfo, this.headers = e.headers, this.cause = e.cause, this.timestamp = (/* @__PURE__ */ new Date()).toISOString(), Error.captureStackTrace && Error.captureStackTrace(this, S);
@@ -6424,7 +6553,7 @@ class S extends Error {
     return this.status && (e += ` (HTTP ${this.status})`), e;
   }
 }
-class Ue extends S {
+class Oe extends S {
   constructor(e, t) {
     super({
       code: "temporarily_unavailable",
@@ -6434,7 +6563,7 @@ class Ue extends S {
     }), this.name = "M2MNetworkError";
   }
 }
-class X extends S {
+class Z extends S {
   constructor(e, t) {
     super({
       code: "invalid_request",
@@ -6444,7 +6573,7 @@ class X extends S {
     }), this.name = "M2MTokenParseError";
   }
 }
-class de extends S {
+class ue extends S {
   constructor(e) {
     super({
       code: "invalid_request",
@@ -6453,7 +6582,7 @@ class de extends S {
     }), this.name = "M2MConfigError";
   }
 }
-const si = {
+const oi = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -6477,7 +6606,7 @@ const si = {
   /** Content-Type for token requests */
   CONTENT_TYPE: "application/x-www-form-urlencoded"
 };
-class $s {
+class Vs {
   constructor() {
     this.cache = /* @__PURE__ */ new Map();
   }
@@ -6495,7 +6624,7 @@ class $s {
     return this.cache.delete(e), Promise.resolve();
   }
 }
-const qs = {
+const Bs = {
   shouldRetry(r, e) {
     return e >= 3 ? !1 : r.code === "server_error" || r.code === "temporarily_unavailable" || r.code === "rate_limit_exceeded" || r.status !== void 0 && r.status >= 500;
   },
@@ -6503,7 +6632,7 @@ const qs = {
     return Math.pow(2, r - 1) * 1e3;
   }
 };
-class ii {
+class ai {
   /**
    * Create a new M2M client
    *
@@ -6521,11 +6650,11 @@ class ii {
    */
   constructor(e) {
     if (!e.url)
-      throw new de("M2M client requires a URL");
+      throw new ue("M2M client requires a URL");
     if (!e.clientId)
-      throw new de("M2M client requires a clientId");
+      throw new ue("M2M client requires a clientId");
     if (!e.clientSecret)
-      throw new de("M2M client requires a clientSecret");
+      throw new ue("M2M client requires a clientSecret");
     const t = e.url.replace(/\/$/, "");
     this.config = {
       url: t,
@@ -6543,7 +6672,7 @@ class ii {
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new $s(), this.retryStrategy = e.retryStrategy ?? qs, this.tokenEndpoint = `${t}${R.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new Vs(), this.retryStrategy = e.retryStrategy ?? Bs, this.tokenEndpoint = `${t}${R.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
@@ -6663,7 +6792,7 @@ class ii {
       }
       return a;
     } catch (n) {
-      throw clearTimeout(i), n instanceof Error && n.name === "AbortError" ? new Ue(`Request timed out after ${this.config.timeout}ms`) : n instanceof TypeError && n.message.includes("fetch") ? new Ue(`Network error: ${n.message}`, n) : n instanceof S ? n : S.fromError(n instanceof Error ? n : new Error(String(n)));
+      throw clearTimeout(i), n instanceof Error && n.name === "AbortError" ? new Oe(`Request timed out after ${this.config.timeout}ms`) : n instanceof TypeError && n.message.includes("fetch") ? new Oe(`Network error: ${n.message}`, n) : n instanceof S ? n : S.fromError(n instanceof Error ? n : new Error(String(n)));
     }
   }
   /**
@@ -6758,14 +6887,14 @@ class ii {
     try {
       const t = e.split(".");
       if (t.length !== 3)
-        throw new X("Invalid JWT format: expected 3 parts");
+        throw new Z("Invalid JWT format: expected 3 parts");
       const s = t[1];
       if (!s)
-        throw new X("Invalid JWT format: missing payload");
+        throw new Z("Invalid JWT format: missing payload");
       const i = atob(s.replace(/-/g, "+").replace(/_/g, "/")), n = JSON.parse(i);
       return n.scopes && typeof n.scopes == "string" ? n.scopes = n.scopes.split(" ") : n.scopes || (n.scopes = []), n;
     } catch (t) {
-      throw t instanceof X ? t : new X(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
+      throw t instanceof Z ? t : new Z(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
     }
   }
   /**
@@ -6851,110 +6980,110 @@ class ii {
   }
 }
 export {
-  N as APP_ID_HEADER_KEY,
-  U as AUTHORIZATION_HEADER_KEY,
-  tr as AppAPI,
-  rr as AuthAPI,
-  Ir as AuthService,
-  Hs as CLIAuthAPI,
-  js as DEFAULT_GROUP_NAME,
-  _t as DEFAULT_SCOPES,
-  ye as DEFAULT_UPGRADE_FACTORS,
-  St as DEVICE_ID_HEADER_KEY,
-  bt as DEVICE_TYPE_HEADER_KEY,
-  Mt as ERROR_MESSAGE_MAX_LENGTH,
-  ti as FETCH_PRIORITY_OIDC,
-  Fs as FETCH_PRIORITY_UPGRADE,
-  Ms as FetchMiddlewareContractError,
-  qt as INSUFFICIENT_USER_AUTHENTICATION,
-  sr as InvitationAPI,
-  Ar as InvitationService,
-  ii as M2MClient,
-  de as M2MConfigError,
+  V as APP_ID_HEADER_KEY,
+  D as AUTHORIZATION_HEADER_KEY,
+  ir as AppAPI,
+  nr as AuthAPI,
+  Rr as AuthService,
+  Ws as CLIAuthAPI,
+  zs as DEFAULT_GROUP_NAME,
+  At as DEFAULT_SCOPES,
+  Se as DEFAULT_UPGRADE_FACTORS,
+  _t as DEVICE_ID_HEADER_KEY,
+  Et as DEVICE_TYPE_HEADER_KEY,
+  Ut as ERROR_MESSAGE_MAX_LENGTH,
+  ii as FETCH_PRIORITY_OIDC,
+  Ds as FETCH_PRIORITY_UPGRADE,
+  Us as FetchMiddlewareContractError,
+  Bt as INSUFFICIENT_USER_AUTHENTICATION,
+  or as InvitationAPI,
+  Fr as InvitationService,
+  ai as M2MClient,
+  ue as M2MConfigError,
   S as M2MError,
-  si as M2MErrorCodes,
-  Ue as M2MNetworkError,
-  X as M2MTokenParseError,
+  oi as M2MErrorCodes,
+  Oe as M2MNetworkError,
+  Z as M2MTokenParseError,
   R as M2M_DEFAULTS,
-  Ks as MINIMAL_DEFAULT_SCOPES,
-  Wt as OS,
-  De as PASSFLOW_CLOUD_URL,
-  It as POPUP_HEIGHT,
-  At as POPUP_POLL_INTERVAL_MS,
-  Ct as POPUP_TIMEOUT_MS,
-  Et as POPUP_WIDTH,
-  Pe as Passflow,
+  Hs as MINIMAL_DEFAULT_SCOPES,
+  Zt as OS,
+  Le as PASSFLOW_CLOUD_URL,
+  Rt as POPUP_HEIGHT,
+  Ft as POPUP_POLL_INTERVAL_MS,
+  Pt as POPUP_TIMEOUT_MS,
+  Ct as POPUP_WIDTH,
+  xe as Passflow,
   F as PassflowAdminEndpointPaths,
   l as PassflowEndpointPaths,
   w as PassflowError,
   c as PassflowEvent,
-  qe as PopupClosedError,
-  Yt as Providers,
-  dr as RECOVERABLE_COMMIT_ERROR_IDS,
-  P as RequestMethod,
-  Tt as SDK_VERSION,
-  lr as SESSION_INVALIDATING_COMMIT_ERROR_IDS,
-  Oe as SessionState,
-  ir as SettingAPI,
-  xe as TOKEN_EXPIRY_BUFFER_SECONDS,
-  nr as TenantAPI,
-  Mr as TenantService,
-  Fr as TenantUserMembership,
-  Pr as TokenCacheService,
+  Be as PopupClosedError,
+  Jt as Providers,
+  pr as RECOVERABLE_COMMIT_ERROR_IDS,
+  M as RequestMethod,
+  It as SDK_VERSION,
+  fr as SESSION_INVALIDATING_COMMIT_ERROR_IDS,
+  qe as SessionState,
+  ar as SettingAPI,
+  $e as TOKEN_EXPIRY_BUFFER_SECONDS,
+  cr as TenantAPI,
+  Ur as TenantService,
+  Dr as TenantUserMembership,
+  xr as TokenCacheService,
   A as TokenDeliveryMode,
   b as TokenType,
-  or as TwoFactorApiClient,
-  Xt as TwoFactorPolicy,
-  Ur as TwoFactorService,
-  Nt as UPGRADE_REQUIRED,
-  Ft as USERNAME_MAX_LENGTH,
-  Rt as USERNAME_MIN_LENGTH,
-  ar as UpgradeAPI,
+  hr as TwoFactorApiClient,
+  Qt as TwoFactorPolicy,
+  Or as TwoFactorService,
+  Kt as UPGRADE_REQUIRED,
+  Dt as USERNAME_MAX_LENGTH,
+  Mt as USERNAME_MIN_LENGTH,
+  dr as UpgradeAPI,
   O as UpgradeCancelledError,
-  Wr as UpgradeController,
+  Zr as UpgradeController,
   k as UpgradeErrorIds,
-  D as UpgradeFactorError,
-  K as UpgradeInsufficientError,
+  U as UpgradeFactorError,
+  j as UpgradeInsufficientError,
   $ as UpgradeSessionChangedError,
   _ as UpgradeTransportError,
-  j as UpgradeUnavailableError,
-  Z as UpgradeUnsatisfiableError,
-  cr as UserAPI,
-  Dr as UserService,
-  xt as WebAdapter,
-  Ee as classifyUpgradeError,
-  $r as factorRegistry,
-  ri as fetchRegistryState,
-  Gs as getOSFromDeviceType,
-  wr as invalidatesSessionOnCommit,
-  zs as isRecoverableCommitFailure,
-  pr as isRetryableUpgradeKind,
+  G as UpgradeUnavailableError,
+  ee as UpgradeUnsatisfiableError,
+  lr as UserAPI,
+  Lr as UserService,
+  $t as WebAdapter,
+  Ce as classifyUpgradeError,
+  Vr as factorRegistry,
+  ni as fetchRegistryState,
+  Ys as getOSFromDeviceType,
+  Tr as invalidatesSessionOnCommit,
+  Xs as isRecoverableCommitFailure,
+  vr as isRetryableUpgradeKind,
   C as isTokenExpired,
-  Ys as isUpgradeCancelled,
-  Ws as isUpgradeExhausted,
-  Xs as isUpgradeInsufficient,
-  Qs as isUpgradeSessionChanged,
-  mr as isUpgradeTransportError,
-  ei as isUpgradeTransportFailure,
-  Zs as isUpgradeUnavailable,
-  Js as isUpgradeUnsatisfiable,
-  se as isValidEmail,
-  re as isValidJWTFormat,
-  ie as isValidPhoneNumber,
-  _r as isValidUsername,
-  Kt as parseChallengeBody,
-  Bt as parseChallengeHeader,
+  Js as isUpgradeCancelled,
+  Zs as isUpgradeExhausted,
+  Qs as isUpgradeInsufficient,
+  ri as isUpgradeSessionChanged,
+  kr as isUpgradeTransportError,
+  si as isUpgradeTransportFailure,
+  ti as isUpgradeUnavailable,
+  ei as isUpgradeUnsatisfiable,
+  ne as isValidEmail,
+  X as isValidJWTFormat,
+  oe as isValidPhoneNumber,
+  Ar as isValidUsername,
+  Ht as parseChallengeBody,
+  Gt as parseChallengeHeader,
   T as parseToken,
-  Gt as parseUpgradeChallenge,
-  Lr as passkeyFactor,
-  M as pathWithParams,
-  Or as recoveryCodesFactor,
-  xs as registerFetchMiddleware,
-  $t as requiredAcrLevel,
-  Ye as resolveUpgradeDomain,
-  Tr as sanitizeErrorMessage,
-  Br as selectFactors,
-  xr as totpFactor,
-  z as webAdapter
+  Yt as parseUpgradeChallenge,
+  Nr as passkeyFactor,
+  P as pathWithParams,
+  qr as recoveryCodesFactor,
+  $s as registerFetchMiddleware,
+  Vt as requiredAcrLevel,
+  Je as resolveUpgradeDomain,
+  Ir as sanitizeErrorMessage,
+  Gr as selectFactors,
+  $r as totpFactor,
+  Y as webAdapter
 };
 //# sourceMappingURL=index.mjs.map