@passflow/core 0.17.0 → 0.19.0

package/dist/index.mjs

@@ -1,9 +1,9 @@
 import B from "axios";
-import { v4 as mt } from "uuid";
-import { startAuthentication as vt, startRegistration as yt } from "@simplewebauthn/browser";
-const kt = "0.17.0", wt = {
-  version: kt
-}, N = "X-Passflow-Clientid", U = "Authorization", St = "X-Passflow-DeviceId", bt = "X-Passflow-DeviceType", Tt = wt.version, Ks = ["id", "offline", "openid"], _t = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], De = "https://auth.passflow.cloud", js = "default", Et = 500, It = 600, At = 100, Ct = 6e4, xe = 30, Rt = 3, Ft = 30, Mt = 200, Pt = (r) => {
+import { v4 as _t } from "uuid";
+import { startAuthentication as Et, startRegistration as It } from "@simplewebauthn/browser";
+const At = "0.19.0", Ct = {
+  version: At
+}, V = "X-Passflow-Clientid", D = "Authorization", Rt = "X-Passflow-DeviceId", Pt = "X-Passflow-DeviceType", Ft = Ct.version, ei = ["id", "offline", "openid"], Mt = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], qe = "https://auth.passflow.cloud", ti = "default", Ut = 500, Dt = 600, xt = 100, Ot = 6e4, Ne = 30, Lt = 3, $t = 30, qt = 200, Nt = (r) => {
   const e = [];
   let t;
   for (t in r) {
@@ -18,14 +18,14 @@ const kt = "0.17.0", wt = {
   }
   return { raw: r, tenants: e };
 };
-function Ut(r) {
+function Vt(r) {
   if (typeof window < "u" && typeof window.atob == "function")
     return window.atob(r);
   if (typeof Buffer < "u")
     return Buffer.from(r, "base64").toString("utf-8");
   throw new Error("No Base64 decoding method available in this environment");
 }
-class Dt {
+class Kt {
   constructor(e) {
     this.storageManager = e;
   }
@@ -54,19 +54,19 @@ class Dt {
       return T(t);
   }
 }
-function C(r, e = xe) {
+function C(r, e = Ne) {
   return Math.floor(Date.now() / 1e3) + e > r.exp;
 }
 function T(r) {
   const e = r.split(".")[1];
   if (!e) throw new Error("Invalid token string");
-  const t = e.replace(/-/g, "+").replace(/_/g, "/"), s = t + "=".repeat((4 - t.length % 4) % 4), i = Ut(s), n = decodeURIComponent(
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), s = t + "=".repeat((4 - t.length % 4) % 4), i = Vt(s), n = decodeURIComponent(
     i.split("").map((a) => "%" + ("00" + a.charCodeAt(0).toString(16)).slice(-2)).join("")
   ), o = JSON.parse(n);
-  return o.membership = o.passflow_tm && o.type !== "invite" ? Pt(o.passflow_tm) : void 0, o;
+  return o.membership = o.passflow_tm && o.type !== "invite" ? Nt(o.passflow_tm) : void 0, o;
 }
-var b = /* @__PURE__ */ ((r) => (r.id_token = "id_token", r.access_token = "access", r.refresh_token = "refresh", r.invite_token = "invite", r.reset_token = "reset", r.web_cookie = "web-cookie", r.management = "management", r.signin = "signin", r.actor = "actor", r.two_factor = "2fa", r))(b || {}), A = /* @__PURE__ */ ((r) => (r.JsonBody = "json_body", r.Cookie = "cookie", r.Mobile = "mobile", r.BFF = "bff", r))(A || {}), Oe = /* @__PURE__ */ ((r) => (r.Unknown = "unknown", r.Valid = "valid", r.Invalid = "invalid", r))(Oe || {});
-class Le {
+var b = /* @__PURE__ */ ((r) => (r.id_token = "id_token", r.access_token = "access", r.refresh_token = "refresh", r.invite_token = "invite", r.reset_token = "reset", r.web_cookie = "web-cookie", r.management = "management", r.signin = "signin", r.actor = "actor", r.two_factor = "2fa", r))(b || {}), A = /* @__PURE__ */ ((r) => (r.JsonBody = "json_body", r.Cookie = "cookie", r.Mobile = "mobile", r.BFF = "bff", r))(A || {}), Ve = /* @__PURE__ */ ((r) => (r.Unknown = "unknown", r.Valid = "valid", r.Invalid = "invalid", r))(Ve || {});
+class Ke {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
   }
@@ -176,7 +176,7 @@ class Le {
   loadPersistedSessionState() {
     try {
       const e = this.storageManager.storage.getItem(this.SESSION_STATE_KEY);
-      e && Object.values(Oe).includes(e) && (this.sessionState = e);
+      e && Object.values(Ve).includes(e) && (this.sessionState = e);
     } catch {
     }
   }
@@ -217,7 +217,7 @@ class Le {
     }
   }
 }
-class me {
+class Se {
   constructor({ storage: e, prefix: t } = {}) {
     this.keyStoragePrefix = "", this.scopes = `${this.keyStoragePrefix}tokens_scopes`, this.deviceId = `${this.keyStoragePrefix}passflowDeviceId`, this.invitationToken = `${this.keyStoragePrefix}passflowInvitationToken`, this.previousRedirectUrl = `${this.keyStoragePrefix}passflowPreviousRedirectUrl`, this.STORAGE_PREFIX = "passflow_", this.ID_TOKEN_KEY = `${this.STORAGE_PREFIX}id_token`, this.CSRF_TOKEN_KEY = `${this.STORAGE_PREFIX}csrf_token`, this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.storage = e ?? localStorage, this.keyStoragePrefix = t ? `${t}_` : "";
   }
@@ -400,9 +400,9 @@ class me {
     return `${this.keyStoragePrefix}${e}`;
   }
 }
-class $e {
+class Be {
   constructor(e) {
-    this.storageManager = e ?? new me();
+    this.storageManager = e ?? new Se();
   }
   getDeviceId() {
     const e = this.storageManager.getDeviceId();
@@ -413,19 +413,19 @@ class $e {
     return e;
   }
   generateUniqueDeviceId() {
-    return mt();
+    return _t();
   }
 }
-class qe extends Error {
+class Ge extends Error {
   constructor(e = "Authentication popup was closed") {
     super(e), this.name = "PopupClosedError";
   }
 }
-class xt {
+class Bt {
   constructor() {
     this.passkeys = {
-      startRegistration: (e) => yt({ optionsJSON: e }),
-      startAuthentication: (e) => vt({ optionsJSON: e })
+      startRegistration: (e) => It({ optionsJSON: e }),
+      startAuthentication: (e) => Et({ optionsJSON: e })
     };
   }
   // ----------------------------------------------------------------
@@ -557,15 +557,15 @@ class xt {
           'openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.'
         )
       );
-    const i = t.width ?? Et, n = t.height ?? It, o = t.expectedReturnOrigin ?? window.location.origin, a = window.open(e, "_blank", `width=${i},height=${n}`);
-    return a ? new Promise((h, p) => {
+    const i = t.width ?? Ut, n = t.height ?? Dt, o = t.expectedReturnOrigin ?? window.location.origin, a = window.open(e, "_blank", `width=${i},height=${n}`);
+    return a ? new Promise((h, u) => {
       const m = Date.now(), d = setInterval(() => {
         if (a.closed) {
-          clearInterval(d), p(new qe());
+          clearInterval(d), u(new Ge());
           return;
         }
-        if (Date.now() - m > Ct) {
-          clearInterval(d), a.close(), p(new Error("Authentication popup timed out"));
+        if (Date.now() - m > Ot) {
+          clearInterval(d), a.close(), u(new Error("Authentication popup timed out"));
           return;
         }
         try {
@@ -575,7 +575,7 @@ class xt {
           }
         } catch {
         }
-      }, At);
+      }, xt);
     }) : (window.location.href = e, new Promise(() => {
     }));
   }
@@ -633,94 +633,94 @@ class xt {
     return "web";
   }
 }
-const z = new xt(), Ot = /^[0-9]+$/, be = Object.freeze({ unorderable: !1, zero: !1 }), Lt = (r) => Ot.test(r) ? Number.parseInt(r, 10) : void 0, Q = (r) => {
+const Y = new Bt(), Gt = /^[0-9]+$/, Ae = Object.freeze({ unorderable: !1, zero: !1 }), jt = (r) => Gt.test(r) ? Number.parseInt(r, 10) : void 0, re = (r) => {
   if (!r)
-    return be;
+    return Ae;
   const e = r.split(/\s+/).filter((i) => i !== "");
   if (e.length === 0)
-    return be;
+    return Ae;
   const t = [];
   for (const i of e) {
-    const n = Lt(i);
+    const n = jt(i);
     n !== void 0 && t.push(n);
   }
   if (t.length === 0)
     return { raw: r, unorderable: !0, zero: !1 };
   const s = Math.min(...t);
   return s === 0 ? { raw: r, unorderable: !1, zero: !0 } : { level: s, raw: r, unorderable: !1, zero: !1 };
-}, $t = (r) => Q(r).level, qt = "insufficient_user_authentication", Nt = "upgrade_required", Te = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, Vt = (r) => r.replace(/\\(.)/g, "$1"), Ne = (r) => {
+}, Ht = (r) => re(r).level, zt = "insufficient_user_authentication", Yt = "upgrade_required", Ce = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, Wt = (r) => r.replace(/\\(.)/g, "$1"), je = (r) => {
   const e = {};
-  Te.lastIndex = 0;
-  for (const t of r.matchAll(Te)) {
+  Ce.lastIndex = 0;
+  for (const t of r.matchAll(Ce)) {
     const s = t[1];
     if (!s)
       continue;
     const i = t[2], n = t[3];
-    e[s.toLowerCase()] = i !== void 0 ? Vt(i) : n ?? "";
+    e[s.toLowerCase()] = i !== void 0 ? Wt(i) : n ?? "";
   }
   return e;
-}, Ve = (r) => {
+}, He = (r) => {
   if (r == null || r === "")
     return { kind: "absent" };
   const e = typeof r == "number" ? r : Number.parseInt(String(r), 10);
   return Number.isFinite(e) && e > 0 ? { kind: "valid", value: e } : { kind: "invalid", raw: r };
-}, Be = (r) => {
-  const e = Ve(r);
+}, ze = (r) => {
+  const e = He(r);
   return e.kind === "valid" ? e.value : void 0;
-}, Bt = (r, e) => {
+}, Xt = (r, e) => {
   if (!r || !/(^|[\s,])Bearer\b/i.test(r))
     return;
-  const t = Ne(r);
-  if (t.error === qt)
+  const t = je(r);
+  if (t.error === zt)
     return {
       acrValues: t.acr_values || void 0,
-      maxAge: Be(t.max_age),
+      maxAge: ze(t.max_age),
       status: e
     };
-}, Kt = (r, e) => {
+}, Jt = (r, e) => {
   if (!r || typeof r != "object")
     return;
   const t = r;
-  if (t.error === Nt)
+  if (t.error === Yt)
     return {
       acrValues: typeof t.acr_values == "string" && t.acr_values ? t.acr_values : void 0,
-      maxAge: Be(t.max_age),
+      maxAge: ze(t.max_age),
       status: e
     };
-}, _e = (r, e, t) => ({
+}, Re = (r, e, t) => ({
   channel: r,
-  acr: Q(e.acrValues),
-  maxAge: Ve(t),
+  acr: re(e.acrValues),
+  maxAge: He(t),
   raw: e.acrValues
-}), jt = (r) => r ? Ne(r) : {}, ve = (r, e) => {
+}), Zt = (r) => r ? je(r) : {}, be = (r, e) => {
   const { status: t } = r;
   if (t !== 401 && t !== 403)
     return { diagnostics: [] };
-  const s = e?.requireChallengeChannel === "header", i = r.getHeader("www-authenticate"), n = Bt(i, t), o = s ? void 0 : Kt(r.body, t), a = [], h = (u, y) => {
-    a.push({ status: t, url: "", reason: u, ...y ? { detail: y } : {} });
+  const s = e?.requireChallengeChannel === "header", i = r.getHeader("www-authenticate"), n = Xt(i, t), o = s ? void 0 : Jt(r.body, t), a = [], h = (p, y) => {
+    a.push({ status: t, url: "", reason: p, ...y ? { detail: y } : {} });
   };
   if (!n && !o)
     return s && h("header-required-but-absent", i ? { header: i } : void 0), { diagnostics: a };
-  const p = [];
-  if (n && p.push(_e("header", n, jt(i).max_age)), o) {
-    const u = r.body;
-    p.push(_e("body", o, u?.max_age));
-  }
-  const m = (u) => u;
-  for (const u of p)
-    u.acr.unorderable && h("channels-unorderable", { [m(u.channel)]: u.raw }), u.acr.zero && h("zero-constraint-ignored", { field: "acr_values", [m(u.channel)]: u.raw }), u.maxAge.kind === "invalid" && h("zero-constraint-ignored", { field: "max_age", [m(u.channel)]: String(u.maxAge.raw) });
-  const d = p.filter((u) => u.acr.level !== void 0);
+  const u = [];
+  if (n && u.push(Re("header", n, Zt(i).max_age)), o) {
+    const p = r.body;
+    u.push(Re("body", o, p?.max_age));
+  }
+  const m = (p) => p;
+  for (const p of u)
+    p.acr.unorderable && h("channels-unorderable", { [m(p.channel)]: p.raw }), p.acr.zero && h("zero-constraint-ignored", { field: "acr_values", [m(p.channel)]: p.raw }), p.maxAge.kind === "invalid" && h("zero-constraint-ignored", { field: "max_age", [m(p.channel)]: String(p.maxAge.raw) });
+  const d = u.filter((p) => p.acr.level !== void 0);
   let g, f;
-  for (const u of d) {
-    const y = u.acr.level;
-    g === void 0 || y > g ? (g = y, f = u.raw) : y === g && u.channel === "header" && (f = u.raw);
+  for (const p of d) {
+    const y = p.acr.level;
+    g === void 0 || y > g ? (g = y, f = p.raw) : y === g && p.channel === "header" && (f = p.raw);
   }
   let v;
-  for (const u of p)
-    u.maxAge.kind === "valid" && (v === void 0 || u.maxAge.value < v) && (v = u.maxAge.value);
-  if (p.length === 2) {
-    const [u, y] = p, I = u.acr.level !== void 0 && y.acr.level !== void 0 && u.acr.level !== y.acr.level, Y = u.maxAge.kind === "valid" && y.maxAge.kind === "valid" && u.maxAge.value !== y.maxAge.value;
-    (I || Y) && h("channels-disagree", { header: u.raw ?? y.raw, body: y.raw ?? u.raw });
+  for (const p of u)
+    p.maxAge.kind === "valid" && (v === void 0 || p.maxAge.value < v) && (v = p.maxAge.value);
+  if (u.length === 2) {
+    const [p, y] = u, I = p.acr.level !== void 0 && y.acr.level !== void 0 && p.acr.level !== y.acr.level, W = p.maxAge.kind === "valid" && y.maxAge.kind === "valid" && p.maxAge.value !== y.maxAge.value;
+    (I || W) && h("channels-disagree", { header: p.raw ?? y.raw, body: y.raw ?? p.raw });
   }
   return {
     challenge: {
@@ -728,19 +728,19 @@ const z = new xt(), Ot = /^[0-9]+$/, be = Object.freeze({ unorderable: !1, zero:
       requiredLevel: g,
       maxAge: v,
       status: t,
-      channels: p.map((u) => u.channel)
+      channels: u.map((p) => p.channel)
     },
     diagnostics: a
   };
-}, Gt = (r, e, t) => ve({ status: r, getHeader: e, body: t }).challenge, Ke = "__passflowUpgradeTransaction", je = "__passflowUpgradeReplayed", Ge = (r, e) => typeof r == "object" && r !== null && r[e] === !0, He = (r) => ({
+}, Qt = (r, e, t) => be({ status: r, getHeader: e, body: t }).challenge, Ye = "__passflowUpgradeTransaction", We = "__passflowUpgradeReplayed", Xe = (r, e) => typeof r == "object" && r !== null && r[e] === !0, Je = (r) => ({
   ...r ?? {},
-  [Ke]: !0
-}), ze = (r) => Ge(r, Ke), Ht = (r) => ({
+  [Ye]: !0
+}), Ze = (r) => Xe(r, Ye), er = (r) => ({
   ...r,
-  [je]: !0
-}), zt = (r) => Ge(r, je);
-var P = /* @__PURE__ */ ((r) => (r.GET = "get", r.POST = "post", r.PUT = "put", r.PATCH = "patch", r.DELETE = "delete", r))(P || {}), l = /* @__PURE__ */ ((r) => (r.signin = "/auth/login", r.signup = "/auth/register", r.signInWithProvider = "/auth/federated/start/", r.passwordless = "/auth/passwordless/start", r.passwordlessComplete = "/auth/passwordless/complete", r.logout = "/user/logout", r.refresh = "/auth/refresh", r.validateSession = "/user/me", r.sendPasswordResetEmail = "/auth/password/reset", r.resetPassword = "/auth/password/change", r.appSettings = "/app/settings", r.passkeyRegisterStart = "/auth/passkey/register/start", r.passkeyRegisterComplete = "/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", r.passkeyValidate = "/auth/validate", r.settingsAll = "/settings", r.settingsPasswordPolicy = "/settings/password", r.settingsPasskey = "/settings/passkey", r.userPasskey = "/user/passkey", r.addUserPasskey = "/user/passkey/add/start", r.completeAddUserPasskey = "/user/passkey/add/complete", r.joinInvitation = "/user/tenant/join", r.tenantPath = "/user/tenant", r.invitationsPath = "/user/tenant/:tenantID/invitations", r.requestInvitation = "/user/invite", r.invitationDelete = "/user/invite/:invitationID", r.invitationResend = "/user/invite/:invitationID/resend", r.invitationGetLink = "/user/invite/:invitationID/link", r.twoFactor = "/user/2fa", r.twoFactorStatus = "/user/2fa/status", r.twoFactorSetupBegin = "/user/2fa/setup/begin", r.twoFactorSetupConfirm = "/user/2fa/setup/confirm", r.twoFactorVerify = "/auth/2fa/verify", r.twoFactorRecovery = "/auth/2fa/recovery", r.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", r.twoFactorSetupMagicLink = "/auth/2fa-setup", r.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", r.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", r.TwoFactorSetupStart = "/v2/user/2fa/setup/start", r.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", r.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", r.TwoFactorChallenge = "/v2/auth/2fa/challenge", r.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", r.TwoFactorAlternative = "/v2/auth/2fa/alternative", r.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", r.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", r.cliAuthStatus = "/cli/auth/status/:sessionId", r.cliAuthComplete = "/cli/auth/complete", r.upgradeStart = "/auth/upgrade/start", r))(l || {}), F = /* @__PURE__ */ ((r) => (r.passkeyRegisterStart = "/admin/auth/passkey/register/start", r.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", r.passkeyValidate = "/admin/auth/validate", r.logout = "/admin/auth/logout", r))(F || {});
-const Ye = (r) => {
+  [We]: !0
+}), tr = (r) => Xe(r, We);
+var U = /* @__PURE__ */ ((r) => (r.GET = "get", r.POST = "post", r.PUT = "put", r.PATCH = "patch", r.DELETE = "delete", r))(U || {}), l = /* @__PURE__ */ ((r) => (r.signin = "/auth/login", r.signup = "/auth/register", r.pkceExchange = "/auth/pkce_exchange", r.signInWithProvider = "/auth/federated/start/", r.passwordless = "/auth/passwordless/start", r.passwordlessComplete = "/auth/passwordless/complete", r.logout = "/user/logout", r.refresh = "/auth/refresh", r.validateSession = "/user/me", r.sendPasswordResetEmail = "/auth/password/reset", r.resetPassword = "/auth/password/change", r.appSettings = "/app/settings", r.passkeyRegisterStart = "/auth/passkey/register/start", r.passkeyRegisterComplete = "/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", r.passkeyValidate = "/auth/validate", r.settingsAll = "/settings", r.settingsPasswordPolicy = "/settings/password", r.settingsPasskey = "/settings/passkey", r.userPasskey = "/user/passkey", r.addUserPasskey = "/user/passkey/add/start", r.completeAddUserPasskey = "/user/passkey/add/complete", r.joinInvitation = "/user/tenant/join", r.tenantPath = "/user/tenant", r.invitationsPath = "/user/tenant/:tenantID/invitations", r.requestInvitation = "/user/invite", r.invitationDelete = "/user/invite/:invitationID", r.invitationResend = "/user/invite/:invitationID/resend", r.invitationGetLink = "/user/invite/:invitationID/link", r.twoFactor = "/user/2fa", r.twoFactorStatus = "/user/2fa/status", r.twoFactorSetupBegin = "/user/2fa/setup/begin", r.twoFactorSetupConfirm = "/user/2fa/setup/confirm", r.twoFactorVerify = "/auth/2fa/verify", r.twoFactorRecovery = "/auth/2fa/recovery", r.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", r.twoFactorSetupMagicLink = "/auth/2fa-setup", r.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", r.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", r.TwoFactorSetupStart = "/v2/user/2fa/setup/start", r.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", r.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", r.TwoFactorChallenge = "/v2/auth/2fa/challenge", r.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", r.TwoFactorAlternative = "/v2/auth/2fa/alternative", r.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", r.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", r.cliAuthStatus = "/cli/auth/status/:sessionId", r.cliAuthComplete = "/cli/auth/complete", r.upgradeStart = "/auth/upgrade/start", r))(l || {}), P = /* @__PURE__ */ ((r) => (r.passkeyRegisterStart = "/admin/auth/passkey/register/start", r.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", r.passkeyValidate = "/admin/auth/validate", r.logout = "/admin/auth/logout", r))(P || {});
+const Qe = (r) => {
   if (!r)
     return null;
   try {
@@ -755,21 +755,21 @@ class w extends Error {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
-var Yt = /* @__PURE__ */ ((r) => (r.google = "google", r.facebook = "facebook", r))(Yt || {}), Wt = /* @__PURE__ */ ((r) => (r.web = "web", r.ios = "ios", r.android = "android", r))(Wt || {});
-function Gs(r) {
+var rr = /* @__PURE__ */ ((r) => (r.google = "google", r.facebook = "facebook", r))(rr || {}), sr = /* @__PURE__ */ ((r) => (r.web = "web", r.ios = "ios", r.android = "android", r))(sr || {});
+function ri(r) {
   return r;
 }
-function M(r, e) {
+function F(r, e) {
   let t = r;
   return Object.entries(e).forEach(([s, i]) => {
     t = t.replace(`:${s}`, i);
   }), t;
 }
-var Xt = /* @__PURE__ */ ((r) => (r.Disabled = "disabled", r.Optional = "optional", r.Required = "required", r))(Xt || {});
-const Jt = 3, Zt = 1e3, Qt = (r) => (e) => {
+var ir = /* @__PURE__ */ ((r) => (r.Disabled = "disabled", r.Optional = "optional", r.Required = "required", r))(ir || {});
+const nr = 3, or = 1e3, ar = (r) => (e) => {
   const t = r.headers?.[e] ?? r.headers?.[e.toLowerCase()];
   return Array.isArray(t) ? t.join(", ") : t;
-}, We = (r) => Gt(r.status, Qt(r), r.data), er = (r) => We(r) !== void 0;
+}, et = (r) => Qt(r.status, ar(r), r.data), cr = (r) => et(r) !== void 0;
 class E {
   constructor(e, t, s) {
     this.refreshPromise = null, this.isRefreshing = !1, this.defaultHeaders = {
@@ -777,17 +777,17 @@ class E {
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh", "upgrade"];
     const { url: i, appId: n, keyStoragePrefix: o } = e;
-    this._platform = e.platform ?? z, this.url = i || De, this.upgradeDomain = Ye(i), this.storageManager = t ?? new me({
+    this._platform = e.platform ?? Y, this.url = i || qe, this.upgradeDomain = Qe(i), this.storageManager = t ?? new Se({
       prefix: o ?? ""
-    }), this.deviceService = s ?? new $e(this.storageManager), this.tokenService = new Dt(this.storageManager), this.tokenDeliveryManager = new Le(this.storageManager), n && (this.appId = n, this.defaultHeaders = {
+    }), this.deviceService = s ?? new Be(this.storageManager), this.tokenService = new Kt(this.storageManager), this.tokenDeliveryManager = new Ke(this.storageManager), n && (this.appId = n, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [N]: n
+      [V]: n
     });
     const a = this.deviceService.getDeviceId();
     this.defaultHeaders = {
       ...this.defaultHeaders,
-      [St]: a,
-      [bt]: this._platform.getDeviceType()
+      [Rt]: a,
+      [Pt]: this._platform.getDeviceType()
     }, this.detectCookieSupport(), this.instance = B.create({
       baseURL: this.url,
       headers: { ...this.defaultHeaders }
@@ -806,36 +806,36 @@ class E {
         }
         return h;
       }
-      const p = this.storageManager.getTokens();
-      if (p?.access_token) {
-        const m = T(p.access_token);
-        if (C(m, xe) && p.refresh_token)
+      const u = this.storageManager.getTokens();
+      if (u?.access_token) {
+        const m = T(u.access_token);
+        if (C(m, Ne) && u.refresh_token)
           try {
             if (this.refreshPromise) {
               const d = await this.refreshPromise;
-              return d?.data?.access_token && (h.headers[U] = `Bearer ${d.data.access_token}`), h;
+              return d?.data?.access_token && (h.headers[D] = `Bearer ${d.data.access_token}`), h;
             }
             this.refreshPromise = this.refreshTokens();
             try {
               const d = await this.refreshPromise;
-              return d?.data?.access_token && (h.headers[U] = `Bearer ${d.data.access_token}`), h;
+              return d?.data?.access_token && (h.headers[D] = `Bearer ${d.data.access_token}`), h;
             } finally {
               this.refreshPromise = null;
             }
           } catch (d) {
             return this.refreshPromise = null, this.isRefreshing = !1, this.storageManager.deleteTokens(), Promise.reject(d);
           }
-        return h.headers[U] = `Bearer ${p.access_token}`, h;
+        return h.headers[D] = `Bearer ${u.access_token}`, h;
       }
       return h;
     }), this.instance.interceptors.response.use(
       (h) => h,
       async (h) => {
         if (h.response?.status === 401 && !this.isUpgradeTransactionError(h) && this.tokenDeliveryManager.setSessionInvalid(), h.response && this.upgradeHandler) {
-          const p = We(h.response);
-          if (p)
+          const u = et(h.response);
+          if (u)
             try {
-              return await this.upgradeHandler(h, p);
+              return await this.upgradeHandler(h, u);
             } catch (m) {
               if (m !== h)
                 throw m;
@@ -854,7 +854,7 @@ class E {
    * speak upgrade vocabulary", which is unsound in both directions.
    */
   isUpgradeTransactionError(e) {
-    return ze(e.config) || e.response !== void 0 && er(e.response);
+    return Ze(e.config) || e.response !== void 0 && cr(e.response);
   }
   /**
    * Installs (or clears) the handler consulted when a response carries an
@@ -915,7 +915,7 @@ class E {
         scopes: t
       }, i = await this.instance.post(l.refresh, s, {
         headers: {
-          [U]: `Bearer ${e.refresh_token}`
+          [D]: `Bearer ${e.refresh_token}`
         }
       });
       return i.data && this.storageManager.saveTokens(i.data), this.isRefreshing = !1, i;
@@ -929,17 +929,17 @@ class E {
     if (!["GET", "HEAD", "OPTIONS"].includes(s || ""))
       return Promise.reject(e);
     const n = t._retryCount || 0;
-    if (n >= Jt)
+    if (n >= nr)
       return Promise.reject(e);
-    let o = Zt * Math.pow(2, n);
+    let o = or * Math.pow(2, n);
     const a = e.response?.headers?.["retry-after"];
     if (a) {
       const h = Number.parseInt(a, 10);
       if (!Number.isNaN(h))
         o = h * 1e3;
       else {
-        const p = new Date(a);
-        Number.isNaN(p.getTime()) || (o = Math.max(0, p.getTime() - Date.now()));
+        const u = new Date(a);
+        Number.isNaN(u.getTime()) || (o = Math.max(0, u.getTime() - Date.now()));
       }
     }
     return await new Promise((h) => setTimeout(h, o)), t._retryCount = n + 1, this.instance.request(t);
@@ -972,19 +972,19 @@ class E {
     })).data;
   }
   get(e, t) {
-    return this.send(P.GET, e, t);
+    return this.send(U.GET, e, t);
   }
   post(e, t, s) {
-    return this.send(P.POST, e, { data: t, ...s });
+    return this.send(U.POST, e, { data: t, ...s });
   }
   put(e, t, s) {
-    return this.send(P.PUT, e, { data: t, ...s });
+    return this.send(U.PUT, e, { data: t, ...s });
   }
   patch(e, t, s) {
-    return this.send(P.PATCH, e, { data: t, ...s });
+    return this.send(U.PATCH, e, { data: t, ...s });
   }
   delete(e, t) {
-    return this.send(P.DELETE, e, t);
+    return this.send(U.DELETE, e, t);
   }
   /**
    * Update the appId and propagate it to axios headers.
@@ -995,11 +995,11 @@ class E {
   setAppId(e) {
     this.appId = e, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [N]: e
-    }, this.instance.defaults.headers.common[N] = e;
+      [V]: e
+    }, this.instance.defaults.headers.common[V] = e;
   }
 }
-class tr {
+class hr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1010,7 +1010,8 @@ class tr {
     return this.axiosClient.get(l.appSettings);
   }
 }
-class rr {
+const M = { withCredentials: !0 };
+class dr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1041,13 +1042,13 @@ class rr {
       ...i ? { upgrade: i } : {}
     }, o = {
       headers: {
-        [U]: `Bearer ${e}`
+        [D]: `Bearer ${e}`
       }
     };
     return this.axiosClient.post(
       l.refresh,
       n,
-      i ? He(o) : o
+      i ? Je(o) : o
     );
   }
   signIn(e, t, s) {
@@ -1058,7 +1059,8 @@ class rr {
     };
     return this.axiosClient.post(
       l.signin,
-      i
+      i,
+      M
     );
   }
   signUp(e) {
@@ -1069,7 +1071,16 @@ class rr {
     };
     return this.axiosClient.post(
       l.signup,
-      i
+      i,
+      M
+    );
+  }
+  /** Redeems the code a PKCE sign-in answered with for the tokens it stands for. */
+  pkceExchange(e, t) {
+    return this.axiosClient.post(
+      l.pkceExchange,
+      { authz_code: e, verifier: t },
+      M
     );
   }
   passwordlessSignIn(e, t, s) {
@@ -1087,11 +1098,12 @@ class rr {
   passwordlessSignInComplete(e) {
     return this.axiosClient.post(
       l.passwordlessComplete,
-      e
+      e,
+      M
     );
   }
   logOut(e, t, s = !1) {
-    const i = s ? void 0 : { refresh_token: t, device: e }, n = s ? F.logout : l.logout;
+    const i = s ? void 0 : { refresh_token: t, device: e }, n = s ? P.logout : l.logout;
     return this.axiosClient.post(n, i);
   }
   validateSession() {
@@ -1103,15 +1115,16 @@ class rr {
       e
     );
   }
-  resetPassword(e, t, s) {
-    const i = {
+  resetPassword(e, t, s, i) {
+    const n = {
       password: e,
-      scopes: t
+      scopes: t,
+      ...i ? { code_challenge: i } : {}
     };
-    return this.axiosClient.post(l.resetPassword, i, {
+    return this.axiosClient.post(l.resetPassword, n, {
       headers: {
-        [U]: `Bearer ${s}`,
-        [N]: void 0
+        [D]: `Bearer ${s}`,
+        [V]: void 0
       }
     });
   }
@@ -1121,7 +1134,7 @@ class rr {
       create_tenant: n ?? !1,
       device: t,
       os: s
-    }, a = i ? F.passkeyRegisterStart : l.passkeyRegisterStart;
+    }, a = i ? P.passkeyRegisterStart : l.passkeyRegisterStart;
     return this.axiosClient.post(a, o);
   }
   passkeyRegisterComplete(e, t, s, i = !1) {
@@ -1129,8 +1142,12 @@ class rr {
       challenge_id: s,
       device: t,
       passkey_data: e
-    }, o = i ? F.passkeyRegisterComplete : l.passkeyRegisterComplete;
-    return this.axiosClient.post(o, n);
+    }, o = i ? P.passkeyRegisterComplete : l.passkeyRegisterComplete;
+    return this.axiosClient.post(
+      o,
+      n,
+      M
+    );
   }
   passkeyAuthenticateStart(e, t, s, i = !1) {
     const n = {
@@ -1138,7 +1155,7 @@ class rr {
       user_id: e.user_id ?? "",
       device: t,
       os: s
-    }, o = i ? F.passkeyAuthenticateStart : l.passkeyAuthenticateStart;
+    }, o = i ? P.passkeyAuthenticateStart : l.passkeyAuthenticateStart;
     return this.axiosClient.post(
       o,
       n
@@ -1149,8 +1166,12 @@ class rr {
       challenge_id: s,
       device: t,
       passkey_data: e
-    }, o = i ? F.passkeyAuthenticateComplete : l.passkeyAuthenticateComplete;
-    return this.axiosClient.post(o, n);
+    }, o = i ? P.passkeyAuthenticateComplete : l.passkeyAuthenticateComplete;
+    return this.axiosClient.post(
+      o,
+      n,
+      M
+    );
   }
   passkeyValidate(e, t, s, i = !1, n) {
     const o = {
@@ -1159,12 +1180,12 @@ class rr {
       challenge_id: s
     };
     let a = l.passkeyValidate;
-    !n && i && (a = F.passkeyValidate);
-    const h = n ? { [N]: n } : {};
+    !n && i && (a = P.passkeyValidate);
+    const h = n ? { [V]: n } : {};
     return this.axiosClient.post(a, o, { headers: h });
   }
 }
-class Hs {
+class si {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1172,14 +1193,14 @@ class Hs {
     this.axiosClient.setAppId(e);
   }
   getCLIAuthStatus(e) {
-    const t = M(l.cliAuthStatus, { sessionId: e });
+    const t = F(l.cliAuthStatus, { sessionId: e });
     return this.axiosClient.get(t);
   }
   completeCLIAuth(e) {
     return this.axiosClient.post(l.cliAuthComplete, e);
   }
 }
-class sr {
+class lr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1205,7 +1226,7 @@ class sr {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const s = M(l.invitationsPath, {
+    const s = F(l.invitationsPath, {
       tenantID: e.tenantID
     });
     return this.axiosClient.get(s, { params: t }).then((i) => ({
@@ -1219,7 +1240,7 @@ class sr {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = M(l.invitationDelete, {
+    const t = F(l.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -1230,7 +1251,7 @@ class sr {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = M(l.invitationResend, {
+    const t = F(l.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -1241,13 +1262,13 @@ class sr {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = M(l.invitationGetLink, {
+    const t = F(l.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
   }
 }
-class ir {
+class ur {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1264,7 +1285,7 @@ class ir {
     return this.axiosClient.get(l.settingsPasskey);
   }
 }
-class nr {
+class pr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1497,7 +1518,11 @@ class nr {
     return this.axiosClient.delete(i);
   }
 }
-class or {
+const ge = (r) => r ? { headers: { Authorization: `Bearer ${r}` } } : {}, ne = (r) => ({
+  withCredentials: !0,
+  ...ge(r)
+});
+class fr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1536,15 +1561,11 @@ class or {
    * Uses tfa_token as Bearer token for authentication
    */
   verify(e) {
-    const { tfa_token: t, code: s } = e;
+    const { tfa_token: t, code: s, trust_device: i } = e;
     return this.axiosClient.post(
       l.twoFactorVerify,
-      { code: s },
-      {
-        headers: {
-          Authorization: `Bearer ${t}`
-        }
-      }
+      { code: s, ...i ? { trust_device: !0 } : {} },
+      ne(t)
     );
   }
   /**
@@ -1553,15 +1574,11 @@ class or {
    * Uses tfa_token as Bearer token for authentication
    */
   useRecoveryCode(e) {
-    const { tfa_token: t, recovery_code: s } = e;
+    const { tfa_token: t, recovery_code: s, trust_device: i } = e;
     return this.axiosClient.post(
       l.twoFactorRecovery,
-      { recovery_code: s },
-      {
-        headers: {
-          Authorization: `Bearer ${t}`
-        }
-      }
+      { recovery_code: s, ...i ? { trust_device: !0 } : {} },
+      ne(t)
     );
   }
   /**
@@ -1711,56 +1728,72 @@ class or {
    * DELETE /v2/user/2fa/methods/:id
    */
   removeMethod(e) {
-    const t = M(l.TwoFactorMethodRemove, { id: e });
+    const t = F(l.TwoFactorMethodRemove, { id: e });
     return this.axiosClient.delete(t);
   }
   /**
    * Request 2FA challenge during login
    * POST /v2/auth/2fa/challenge
+   * `tfaToken`, when given, goes as the Bearer token the route is gated on.
    */
-  requestChallenge(e) {
+  requestChallenge(e, t) {
     return this.axiosClient.post(
       l.TwoFactorChallenge,
-      e
+      e,
+      ge(t)
     );
   }
   /**
    * Verify 2FA challenge (v2)
-   * POST /v2/auth/2fa/verify
+   * POST /v2/auth/2fa/verify (the server's verify-challenge)
+   *
+   * `tfaToken` is the 2FA token the first factor returned; the route is gated
+   * on it, so it goes as the Bearer token when given.
    */
-  verifyV2(e) {
+  verifyV2(e, t) {
+    const { trust_device: s, ...i } = e;
     return this.axiosClient.post(
       l.TwoFactorVerifyV2,
-      e
+      { ...i, ...s ? { trust_device: !0 } : {} },
+      ne(t)
     );
   }
   /**
    * Switch to alternative 2FA method during challenge
    * POST /v2/auth/2fa/alternative
+   * `tfaToken`, when given, goes as the Bearer token the route is gated on.
    */
-  switchToAlternative(e) {
+  switchToAlternative(e, t) {
     return this.axiosClient.post(
       l.TwoFactorAlternative,
-      e
+      e,
+      ge(t)
     );
   }
   /**
-   * Get trusted devices
+   * List the devices the user trusted on this app
    * GET /v2/user/2fa/trusted-devices
+   *
+   * Sent with credentials so the server sees this device's trust cookie and
+   * can mark it `current`.
    */
-  getTrustedDevices() {
-    return this.axiosClient.get(l.TwoFactorTrustedDevices);
+  async getTrustedDevices() {
+    return (await this.axiosClient.get(
+      l.TwoFactorTrustedDevices,
+      { withCredentials: !0 }
+    ))?.devices ?? [];
   }
   /**
    * Revoke trusted device
    * DELETE /v2/user/2fa/trusted-devices/:id
+   * The server answers 404 when the user has no such device.
    */
   revokeTrustedDevice(e) {
-    const t = M(l.TwoFactorTrustedDeviceRevoke, { id: e });
+    const t = F(l.TwoFactorTrustedDeviceRevoke, { id: e });
     return this.axiosClient.delete(t);
   }
 }
-class ar {
+class gr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1782,11 +1815,11 @@ class ar {
     return this.axiosClient.post(
       l.upgradeStart,
       e,
-      He({})
+      Je({})
     );
   }
 }
-class cr {
+class vr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1831,8 +1864,27 @@ class cr {
     });
   }
 }
+const X = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", mr = 32, tt = (r) => {
+  let e = "";
+  for (let t = 0; t < r.length; t += 3) {
+    const s = r[t], i = r[t + 1], n = r[t + 2];
+    e += X.charAt(s >> 2), e += X.charAt((s & 3) << 4 | (i ?? 0) >> 4), i !== void 0 && (e += X.charAt((i & 15) << 2 | (n ?? 0) >> 6)), n !== void 0 && (e += X.charAt(n & 63));
+  }
+  return e;
+}, rt = () => {
+  const r = globalThis.crypto;
+  if (!r?.subtle)
+    throw new Error("PKCE needs the Web Crypto API, which is available only in a secure context (https or localhost)");
+  return r;
+}, yr = async (r) => {
+  const e = await rt().subtle.digest("SHA-256", new TextEncoder().encode(r));
+  return tt(new Uint8Array(e));
+}, kr = async () => {
+  const r = tt(rt().getRandomValues(new Uint8Array(mr)));
+  return { verifier: r, challenge: await yr(r) };
+};
 var c = /* @__PURE__ */ ((r) => (r.SignIn = "signin", r.SignInStart = "signin:start", r.Register = "register", r.RegisterStart = "register:start", r.SignOut = "signout", r.SessionRestored = "session:restored", r.SessionExpired = "session:expired", r.Error = "error", r.Refresh = "refresh", r.RefreshStart = "refresh:start", r.TokenCacheExpired = "token-cache-expired", r.TwoFactorRequired = "2fa:required", r.TwoFactorSetupStarted = "2fa:setup_started", r.TwoFactorEnabled = "2fa:enabled", r.TwoFactorDisabled = "2fa:disabled", r.TwoFactorVerified = "2fa:verified", r.TwoFactorRecoveryUsed = "2fa:recovery_used", r.TwoFactorRecoveryCodesLow = "2fa:recovery_low", r.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", r.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", r.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", r.TwoFactorChallengeReceived = "two_factor_challenge_received", r.TwoFactorMethodSwitched = "two_factor_method_switched", r.TwoFactorDeviceTrusted = "two_factor_device_trusted", r))(c || {});
-class hr {
+class wr {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
   }
@@ -1886,18 +1938,18 @@ const k = {
   twoFactorNotEnabled: "error.2fa.not_enabled",
   notImplemented: "error.not.implemented",
   tokenInvalid: "error.api.request.token.invalid"
-}, dr = Object.freeze([
+}, Sr = Object.freeze([
   k.twoFactorCodeInvalid,
   k.twoFactorNotEnabled,
   k.challengeInvalid,
   k.challengeSessionMismatch,
   k.challengeTooManyAttempts
-]), lr = Object.freeze([k.tokenInvalid]), ur = Object.freeze([
+]), br = Object.freeze([k.tokenInvalid]), Tr = Object.freeze([
   "wrong_code",
   "challenge_spent",
   "not_registered",
   "prepare_not_required"
-]), pr = (r) => ur.includes(r), fr = {
+]), _r = (r) => Tr.includes(r), Er = {
   wrong_code: "That code was not accepted. Try again.",
   challenge_spent: "That verification challenge is no longer valid. Start again.",
   exhausted: "Too many attempts. Try again later.",
@@ -1912,17 +1964,17 @@ const k = {
 };
 class _ extends Error {
   constructor(e) {
-    super(e.message || fr[e.kind]), this.name = "UpgradeTransportError", this.code = "upgrade_transport", this.kind = e.kind, this.status = e.status, this.errorId = e.errorId, this.retryable = pr(e.kind), e.cause !== void 0 && (this.cause = e.cause);
+    super(e.message || Er[e.kind]), this.name = "UpgradeTransportError", this.code = "upgrade_transport", this.kind = e.kind, this.status = e.status, this.errorId = e.errorId, this.retryable = _r(e.kind), e.cause !== void 0 && (this.cause = e.cause);
   }
 }
-const gr = Object.freeze([
+const Ir = Object.freeze([
   "upgrade_transport",
   "upgrade_insufficient",
   "upgrade_unavailable",
   "upgrade_session_changed",
   "upgrade_cancelled",
   "upgrade_unsatisfiable"
-]), Xe = (r) => typeof r == "object" && r !== null && typeof r.code == "string" && gr.includes(r.code), mr = (r) => r instanceof _ || typeof r == "object" && r !== null && r.code === "upgrade_transport", vr = (r) => {
+]), st = (r) => typeof r == "object" && r !== null && typeof r.code == "string" && Ir.includes(r.code), Ar = (r) => r instanceof _ || typeof r == "object" && r !== null && r.code === "upgrade_transport", Cr = (r) => {
   if (typeof r != "object" || r === null)
     return { hasResponse: !1, message: typeof r == "string" ? r : void 0 };
   const e = r, t = e.response, s = t?.data, i = typeof s?.error?.id == "string" ? s.error.id : void 0;
@@ -1932,7 +1984,7 @@ const gr = Object.freeze([
     message: typeof e.message == "string" ? e.message : void 0,
     hasResponse: t !== void 0 || typeof e.status == "number"
   };
-}, yr = (r, e) => {
+}, Rr = (r, e) => {
   switch (r) {
     case k.twoFactorCodeInvalid:
       return "wrong_code";
@@ -1981,13 +2033,13 @@ const gr = Object.freeze([
     default:
       return;
   }
-}, kr = (r, e) => r === void 0 ? "network" : r === 501 ? "unavailable" : r === 400 ? "fatal" : r === 401 || r === 403 ? e === "start" ? "challenge_spent" : "session_changed" : r >= 500 ? "network" : "fatal", Ee = (r, e) => {
+}, Pr = (r, e) => r === void 0 ? "network" : r === 501 ? "unavailable" : r === 400 ? "fatal" : r === 401 || r === 403 ? e === "start" ? "challenge_spent" : "session_changed" : r >= 500 ? "network" : "fatal", Pe = (r, e) => {
   if (r instanceof _)
     return r;
-  const t = vr(r);
+  const t = Cr(r);
   if (!t.hasResponse)
     return new _({ kind: "network", message: t.message, cause: r });
-  const s = yr(t.errorId, e) ?? kr(t.status, e);
+  const s = Rr(t.errorId, e) ?? Pr(t.status, e);
   return new _({
     kind: s,
     message: t.message,
@@ -1995,8 +2047,8 @@ const gr = Object.freeze([
     errorId: t.errorId,
     cause: r
   });
-}, zs = (r) => r.errorId !== void 0 && dr.includes(r.errorId), wr = (r) => r.errorId !== void 0 && lr.includes(r.errorId);
-class K extends Error {
+}, ii = (r) => r.errorId !== void 0 && Sr.includes(r.errorId), Fr = (r) => r.errorId !== void 0 && br.includes(r.errorId);
+class G extends Error {
   constructor(e, t, s) {
     super(s ?? "The session was elevated, but this action requires a higher assurance level"), this.name = "UpgradeInsufficientError", this.code = "upgrade_insufficient", this.obtained = e, this.required = t;
   }
@@ -2006,51 +2058,69 @@ class j extends Error {
     super(e), this.name = "UpgradeUnavailableError", this.code = "upgrade_unavailable";
   }
 }
-class $ extends Error {
+class q extends Error {
   constructor(e = "The session changed during verification") {
     super(e), this.name = "UpgradeSessionChangedError", this.code = "upgrade_session_changed";
   }
 }
-const Sr = (r) => {
+const Mr = (r) => {
   if (!(!r || typeof r.sub != "string" || r.sub === ""))
     return typeof r.sid == "string" && r.sid !== "" ? { sub: r.sub, sid: r.sid } : { sub: r.sub };
-}, br = (r, e) => !e || e.sub !== r.sub ? !1 : r.sid !== void 0 && e.sid !== void 0 ? r.sid === e.sid : !0;
-function re(r) {
+}, Ur = (r, e) => !e || e.sub !== r.sub ? !1 : r.sid !== void 0 && e.sid !== void 0 ? r.sid === e.sid : !0;
+function J(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.split(".");
   if (e.length !== 3) return !1;
   const t = /^[A-Za-z0-9_-]+$/;
   return e.every((s) => t.test(s) && s.length > 0);
 }
-function Tr(r) {
-  return r.replace(/<[^>]*>/g, "").substring(0, Mt);
+function Dr(r) {
+  return r.replace(/<[^>]*>/g, "").substring(0, qt);
 }
-function se(r) {
+function oe(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
   return e.length === 0 ? !1 : /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
 }
-function ie(r) {
+function ae(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
   return /^\+[1-9]\d{1,14}$/.test(e);
 }
-function _r(r) {
+function xr(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
-  return e.length < Rt || e.length > Ft ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
+  return e.length < Lt || e.length > $t ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
 }
-function W(r, e = 6) {
+function Z(r, e = 6) {
   return !r || typeof r != "string" ? !1 : (e === 8 ? /^\d{8}$/ : /^\d{6}$/).test(r);
 }
-function Er(r) {
+function Or(r) {
   if (!r || typeof r != "string") return null;
   const e = r.toUpperCase().replace(/\s+/g, "");
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
-class Ir {
-  constructor(e, t, s, i, n, o, a, h, p, m, d, g = z) {
-    this.authApi = e, this.deviceService = t, this.storageManager = s, this.subscribeStore = i, this.tokenCacheService = n, this.scopes = o, this.createTenantForNewUser = a, this.url = h, this.sessionCallbacks = p, this.appId = m, this.platform = g, this.tokenExchangeConfig = d, this.tokenDeliveryManager = new Le(s), d?.enabled && this.tokenDeliveryManager.setMode(A.BFF), this.initializeSession();
+class Lr {
+  error(e, ...t) {
+    console.error(e, ...t);
+  }
+  warn(e, ...t) {
+    console.warn(e, ...t);
+  }
+  info(e, ...t) {
+    console.info(e, ...t);
+  }
+  debug(e, ...t) {
+    console.debug(e, ...t);
+  }
+}
+function it() {
+  return new Lr();
+}
+const ce = "passflow_2fa_pkce", $r = 300 * 1e3;
+class qr {
+  constructor(e, t, s, i, n, o, a, h, u, m, d, g = Y, f) {
+    this.authApi = e, this.deviceService = t, this.storageManager = s, this.subscribeStore = i, this.tokenCacheService = n, this.scopes = o, this.createTenantForNewUser = a, this.url = h, this.sessionCallbacks = u, this.appId = m, this.platform = g, this.readPkceEnabled = f, this.tokenExchangeConfig = d, this.tokenDeliveryManager = new Ke(s), d?.enabled && this.tokenDeliveryManager.setMode(A.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -2090,8 +2160,112 @@ class Ir {
    * In BFF mode, forwards tokens to BFF server
    */
   async processAuthResponse(e, t) {
+    if (e.code && !e.access_token)
+      throw new Error("A PKCE authorization code was not exchanged, so there are no tokens to apply");
     this.tokenExchangeConfig?.enabled || "token_delivery" in e && e.token_delivery && this.tokenDeliveryManager.setMode(e.token_delivery), this.tokenDeliveryManager.setSessionValid(), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.callbackUrl && await this.forwardTokensToBFF(e), e.scopes = t, this.storageManager.saveTokens(e, this.tokenDeliveryManager.getMode()), this.tokenCacheService.setTokensCache(e), e.csrf_token && this.storageManager.setCsrfToken(e.csrf_token);
   }
+  /**
+   * Reports whether a sign-in response is still waiting on its second factor,
+   * and when it is, hands the 2FA token on.
+   *
+   * Every sign-in path can end this way: the server answers with a
+   * `tfa_token` (or `requires_2fa`) in place of tokens. That response is not
+   * a session, so on `true` the caller returns it as it is — without
+   * `processAuthResponse`, a `SignIn`/`Register` event or a session check.
+   * The `TwoFactorRequired` event is what the TwoFactorService listens to, so
+   * its verify and recovery calls can carry the token. On a PKCE sign-in the
+   * server keeps the login's challenge, so the second factor's answer is a code:
+   * the verifier stays here for `completePkceSignIn`, off the public event.
+   */
+  handlePendingSecondFactor(e, t, s, i) {
+    return e.requires_2fa !== !0 && !e.tfa_token ? !1 : (s ? this.rememberPkceSignIn(s.verifier, i) : this.forgetPkceSignIn(), this.subscribeStore.notify(c.TwoFactorRequired, {
+      email: t || "",
+      challengeId: e.challenge_id || "",
+      tfaToken: e.tfa_token || ""
+    }), !0);
+  }
+  /**
+   * Keeps the verifier in memory, which is where it is read from first. The copy
+   * in sessionStorage is only for a redirect or reload during the second factor,
+   * which would otherwise lose the sign-in.
+   */
+  rememberPkceSignIn(e, t) {
+    if (this.pendingPkce = { verifier: e, scopes: t, expiresAt: Date.now() + $r }, !(typeof sessionStorage > "u"))
+      try {
+        sessionStorage.setItem(ce, JSON.stringify(this.pendingPkce));
+      } catch {
+      }
+  }
+  readPendingPkce() {
+    if (!this.pendingPkce && typeof sessionStorage < "u")
+      try {
+        const e = sessionStorage.getItem(ce);
+        this.pendingPkce = e ? JSON.parse(e) : void 0;
+      } catch {
+        this.pendingPkce = void 0;
+      }
+    return this.pendingPkce && Date.now() >= this.pendingPkce.expiresAt && this.forgetPkceSignIn(), this.pendingPkce;
+  }
+  /** Whether a PKCE sign-in is waiting for the code its second factor answers with. */
+  hasPendingPkceSignIn() {
+    return this.readPendingPkce() !== void 0;
+  }
+  /** Drops the verifier of a pending sign-in. `TwoFactorService` calls this with its own state. */
+  forgetPkceSignIn() {
+    if (this.pendingPkce = void 0, !(typeof sessionStorage > "u"))
+      try {
+        sessionStorage.removeItem(ce);
+      } catch {
+      }
+  }
+  /**
+   * The proof key for a sign-in on a PKCE app, undefined on any other app.
+   *
+   * It is sent whether or not the sign-in has a parent: the parent is added to
+   * the request outside this SDK, so it is not visible here, and `pkce.Challenge`
+   * on the server wants it under a device parent and ignores it under an OIDC one.
+   * When the setting cannot be read the sign-in goes out without a challenge, and
+   * a PKCE app refuses it with its own error.
+   */
+  async startPkce() {
+    let e = !1;
+    try {
+      e = await this.readPkceEnabled?.() ?? !1;
+    } catch (t) {
+      it().warn("Passflow: could not read the app settings, so this sign-in sends no PKCE challenge", t);
+      return;
+    }
+    return e ? kr() : void 0;
+  }
+  /**
+   * Swaps a code in a sign-in's answer for what the code stands for; any other
+   * answer passes through. That can still be a 2FA token: the server re-runs its
+   * gate at the exchange unless the code records a passed second factor.
+   */
+  async exchangeCode(e, t) {
+    return !e.code || !t ? e : await this.authApi.pkceExchange(e.code, t.verifier);
+  }
+  /**
+   * Finishes a PKCE sign-in whose code came from its second factor: redeems the
+   * code with the first factor's verifier and applies the tokens. `TwoFactorService`
+   * is the caller, and clears the pending state once this has succeeded.
+   */
+  async completePkceSignIn(e) {
+    const t = this.readPendingPkce();
+    if (!t)
+      throw new Error("The sign-in answered with a PKCE code, but its verifier is gone");
+    const s = await this.authApi.pkceExchange(e, t.verifier);
+    return await this.processAuthResponse(s, t.scopes ?? this.scopes), s;
+  }
+  /**
+   * Applies tokens that were issued outside this service, honouring the delivery
+   * mode: this is the one place they reach the BFF and browser storage, so no
+   * caller saves them itself. An answer that carries no tokens is left alone.
+   */
+  async applyTokens(e) {
+    const t = e;
+    !t.access_token && !t.id_token && !t.token_delivery || await this.processAuthResponse(t, t.scopes ?? this.readPendingPkce()?.scopes ?? this.scopes);
+  }
   /**
    * Forward tokens to BFF server for httpOnly cookie storage
    */
@@ -2117,7 +2291,7 @@ class Ir {
       throw new Error(`BFF token storage failed: ${t.status}`);
   }
   async signIn(e) {
-    if ("email" in e && e.email && !se(e.email)) {
+    if ("email" in e && e.email && !oe(e.email)) {
       const i = new Error("Invalid email format"), n = {
         message: "Invalid email format",
         originalError: i,
@@ -2125,7 +2299,7 @@ class Ir {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if ("username" in e && e.username && !_r(e.username)) {
+    if ("username" in e && e.username && !xr(e.username)) {
       const i = new Error(
         "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens"
       ), n = {
@@ -2135,7 +2309,7 @@ class Ir {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if ("phone" in e && e.phone && !ie(e.phone)) {
+    if ("phone" in e && e.phone && !ae(e.phone)) {
       const i = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), n = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: i,
@@ -2147,15 +2321,14 @@ class Ir {
     const t = this.deviceService.getDeviceId(), s = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const i = await this.authApi.signIn(e, t, s);
-      return "requires_2fa" in i && i.requires_2fa === !0 || "tfa_token" in i && i.tfa_token ? (this.subscribeStore.notify(c.TwoFactorRequired, {
-        email: e.email || "",
-        challengeId: i.challenge_id || "",
-        tfaToken: i.tfa_token || ""
-      }), i) : (await this.processAuthResponse(i, e.scopes), this.subscribeStore.notify(c.SignIn, {
-        tokens: i,
+      const i = await this.startPkce(), n = await this.authApi.signIn(i ? { ...e, code_challenge: i.challenge } : e, t, s);
+      if (this.handlePendingSecondFactor(n, e.email, i, e.scopes))
+        return n;
+      const o = await this.exchangeCode(n, i);
+      return this.handlePendingSecondFactor(o, e.email) || (await this.processAuthResponse(o, e.scopes), this.subscribeStore.notify(c.SignIn, {
+        tokens: o,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), i);
+      }), await this.submitSessionCheck()), o;
     } catch (i) {
       const n = {
         message: i instanceof Error ? i.message : "Sign in failed",
@@ -2166,7 +2339,7 @@ class Ir {
     }
   }
   async signUp(e) {
-    if (e.user.email && !se(e.user.email)) {
+    if (e.user.email && !oe(e.user.email)) {
       const t = new Error("Invalid email format"), s = {
         message: "Invalid email format",
         originalError: t,
@@ -2174,7 +2347,7 @@ class Ir {
       };
       throw this.subscribeStore.notify(c.Error, s), t;
     }
-    if (e.user.phone_number && !ie(e.user.phone_number)) {
+    if (e.user.phone_number && !ae(e.user.phone_number)) {
       const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), s = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: t,
@@ -2184,11 +2357,14 @@ class Ir {
     }
     this.subscribeStore.notify(c.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
-      const t = await this.authApi.signUp(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(c.Register, {
-        tokens: t,
+      const t = await this.startPkce(), s = await this.authApi.signUp(t ? { ...e, code_challenge: t.challenge } : e);
+      if (this.handlePendingSecondFactor(s, e.user.email, t, e.scopes))
+        return s;
+      const i = await this.exchangeCode(s, t);
+      return this.handlePendingSecondFactor(i, e.user.email) || (await this.processAuthResponse(i, e.scopes), this.subscribeStore.notify(c.Register, {
+        tokens: i,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), t;
+      }), await this.submitSessionCheck()), i;
     } catch (t) {
       const s = {
         message: t instanceof Error ? t.message : "Sign up failed",
@@ -2199,7 +2375,7 @@ class Ir {
     }
   }
   async passwordlessSignIn(e) {
-    if (e.email && !se(e.email)) {
+    if (e.email && !oe(e.email)) {
       const i = new Error("Invalid email format"), n = {
         message: "Invalid email format",
         originalError: i,
@@ -2207,7 +2383,7 @@ class Ir {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if (e.phone && !ie(e.phone)) {
+    if (e.phone && !ae(e.phone)) {
       const i = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), n = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: i,
@@ -2232,10 +2408,10 @@ class Ir {
     this.subscribeStore.notify(c.SignInStart, {}), e.scopes = e.scopes ?? this.scopes, e.device = this.deviceService.getDeviceId();
     try {
       const t = await this.authApi.passwordlessSignInComplete(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(c.SignIn, {
+      return this.handlePendingSecondFactor(t) || (await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(c.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), t;
+      }), await this.submitSessionCheck()), t;
     } catch (t) {
       const s = {
         message: t instanceof Error ? t.message : "Passwordless sign in failed",
@@ -2263,7 +2439,7 @@ class Ir {
       } catch {
       }
     }
-    this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(c.SignOut, {});
+    this.forgetPkceSignIn(), this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(c.SignOut, {});
   }
   /**
    * The session and user identity this client currently holds, or `undefined`
@@ -2275,13 +2451,12 @@ class Ir {
    * nothing to read and the answer is `undefined`.
    */
   readSessionPin() {
-    const e = this.storageManager.getToken(b.access_token);
-    if (e)
-      try {
-        return Sr(T(e));
-      } catch {
-        return;
-      }
+    try {
+      const e = this.storageManager.getToken(b.access_token);
+      return e ? Mr(T(e)) : void 0;
+    } catch {
+      return;
+    }
   }
   /**
    * Refuses to APPLY tokens that belong to a different principal (§13.4
@@ -2305,10 +2480,10 @@ class Ir {
    * state — two different axes.
    */
   assertSessionPin(e) {
-    if (e && !br(e, this.readSessionPin()))
+    if (e && !Ur(e, this.readSessionPin()))
       throw console.warn(
         "[passflow] the session or user changed while a step-up upgrade was in flight; the elevated tokens were discarded and the live session was left untouched."
-      ), new $("The session changed during verification, so the elevated tokens were discarded");
+      ), new q("The session changed during verification, so the elevated tokens were discarded");
   }
   /**
    * Refreshes the session, optionally committing an assurance upgrade.
@@ -2424,11 +2599,17 @@ class Ir {
     this.subscribeStore.notify(c.SignInStart, {});
     const i = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("token") ?? void 0, n = t ?? this.scopes;
     try {
-      const o = await this.authApi.resetPassword(e, n, i);
-      return await this.processAuthResponse(o, n), this.subscribeStore.notify(c.SignIn, {
-        tokens: o,
+      const o = await this.startPkce(), a = o ? await this.authApi.resetPassword(e, n, i, o.challenge) : await this.authApi.resetPassword(e, n, i);
+      if (this.handlePendingSecondFactor(a, void 0, o, n))
+        return a;
+      const h = await this.exchangeCode(a, o);
+      if (this.handlePendingSecondFactor(h))
+        return h;
+      const u = a.redirect_url ? { ...h, redirect_url: a.redirect_url } : h;
+      return await this.processAuthResponse(u, n), this.subscribeStore.notify(c.SignIn, {
+        tokens: u,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), o;
+      }), await this.submitSessionCheck(), u;
     } catch (o) {
       const a = {
         message: o instanceof Error ? o.message : "Password reset failed",
@@ -2444,20 +2625,23 @@ class Ir {
     const t = this.deviceService.getDeviceId(), s = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
-      const { challenge_id: i, publicKey: n } = await this.authApi.passkeyRegisterStart(e, t, s, !this.appId);
-      n.user.id = this.platform.btoa(n.user.id);
-      const o = await this.platform.passkeys.startRegistration(n);
-      if (!o) throw new Error("Passkey registration was not completed");
-      const a = await this.authApi.passkeyRegisterComplete(
-        o,
+      const i = await this.startPkce(), { challenge_id: n, publicKey: o } = await this.authApi.passkeyRegisterStart(
+        i ? { ...e, code_challenge: i.challenge } : e,
         t,
-        i,
+        s,
         !this.appId
       );
-      return await this.processAuthResponse(a, e.scopes), this.subscribeStore.notify(c.Register, {
-        tokens: a,
+      o.user.id = this.platform.btoa(o.user.id);
+      const a = await this.platform.passkeys.startRegistration(o);
+      if (!a) throw new Error("Passkey registration was not completed");
+      const h = await this.authApi.passkeyRegisterComplete(a, t, n, !this.appId);
+      if (this.handlePendingSecondFactor(h, void 0, i, e.scopes))
+        return h;
+      const u = await this.exchangeCode(h, i);
+      return this.handlePendingSecondFactor(u) || (await this.processAuthResponse(u, e.scopes), this.subscribeStore.notify(c.Register, {
+        tokens: u,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), a;
+      }), await this.submitSessionCheck()), u;
     } catch (i) {
       const n = {
         message: i instanceof Error ? i.message : "Passkey registration failed",
@@ -2473,18 +2657,21 @@ class Ir {
     const t = this.deviceService.getDeviceId(), s = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const { challenge_id: i, publicKey: n } = await this.authApi.passkeyAuthenticateStart(e, t, s, !this.appId), o = await this.platform.passkeys.startAuthentication(n);
-      if (!o) throw new Error("Passkey authentication was not completed");
-      const a = await this.authApi.passkeyAuthenticateComplete(
-        o,
+      const i = await this.startPkce(), { challenge_id: n, publicKey: o } = await this.authApi.passkeyAuthenticateStart(
+        i ? { ...e, code_challenge: i.challenge } : e,
         t,
-        i,
+        s,
         !this.appId
-      );
-      return "access_token" in a && (await this.processAuthResponse(a, e.scopes), this.subscribeStore.notify(c.SignIn, {
-        tokens: a,
+      ), a = await this.platform.passkeys.startAuthentication(o);
+      if (!a) throw new Error("Passkey authentication was not completed");
+      const h = await this.authApi.passkeyAuthenticateComplete(a, t, n, !this.appId);
+      if (this.handlePendingSecondFactor(h, void 0, i, e.scopes))
+        return h;
+      const u = await this.exchangeCode(h, i);
+      return this.handlePendingSecondFactor(u) || "access_token" in u && (await this.processAuthResponse(u, e.scopes), this.subscribeStore.notify(c.SignIn, {
+        tokens: u,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck()), a;
+      }), await this.submitSessionCheck()), u;
     } catch (i) {
       const n = {
         message: i instanceof Error ? i.message : "Passkey authentication failed",
@@ -2514,20 +2701,23 @@ class Ir {
       const n = await this.platform.openAuthUrl(i, {
         mode: "popup",
         expectedReturnOrigin: this.platform.getCurrentUrl()?.origin ?? ""
-      }), o = new URLSearchParams(n.callbackSearch), a = o.get("access_token") || "", h = o.get("refresh_token") || "", p = o.get("id_token") || "", m = {
-        access_token: a,
-        refresh_token: h || void 0,
-        id_token: p || void 0,
+      }), o = new URLSearchParams(n.callbackHash.replace(/^#/, ""));
+      if (this.handlePendingSecondFactor({ tfa_token: o.get("tfa_token") ?? void 0 }))
+        return;
+      const a = new URLSearchParams(n.callbackSearch), h = a.get("access_token") || "", u = a.get("refresh_token") || "", m = a.get("id_token") || "", d = {
+        access_token: h,
+        refresh_token: u || void 0,
+        id_token: m || void 0,
         scopes: t
       };
-      await this.processAuthResponse(m, t), this.subscribeStore.notify(c.SignIn, {
-        tokens: m,
+      await this.processAuthResponse(d, t), this.subscribeStore.notify(c.SignIn, {
+        tokens: d,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), this.platform.navigateTo(this.platform.getCurrentUrl()?.origin ?? "");
     } catch (n) {
       const o = {
         message: n instanceof Error ? n.message : "Authentication failed",
-        code: n instanceof qe ? "POPUP_CLOSED" : "AUTH_FAILED",
+        code: n instanceof Ge ? "POPUP_CLOSED" : "AUTH_FAILED",
         originalError: n
       };
       this.subscribeStore.notify(c.Error, o);
@@ -2547,8 +2737,8 @@ class Ir {
         appId: n ?? this.appId ?? "",
         redirectto: s ?? this.platform.getCurrentUrl()?.href ?? "",
         scopes: a.join(",")
-      }, p = new URLSearchParams(h);
-      return o.search = p.toString(), o.toString();
+      }, u = new URLSearchParams(h);
+      return o.search = u.toString(), o.toString();
     } catch (t) {
       const s = {
         message: t instanceof Error ? t.message : "Failed to create auth redirect URL",
@@ -2628,7 +2818,7 @@ class Ir {
     }
   }
 }
-class Ar {
+class Nr {
   constructor(e) {
     this.invitationApi = e;
   }
@@ -2673,24 +2863,7 @@ class Ar {
     return this.invitationApi.getInvitationLink(e);
   }
 }
-class Cr {
-  error(e, ...t) {
-    console.error(e, ...t);
-  }
-  warn(e, ...t) {
-    console.warn(e, ...t);
-  }
-  info(e, ...t) {
-    console.info(e, ...t);
-  }
-  debug(e, ...t) {
-    console.debug(e, ...t);
-  }
-}
-function Rr() {
-  return new Cr();
-}
-class Fr {
+class Vr {
   constructor(e) {
     this.data = this.normalize(e);
   }
@@ -2760,9 +2933,9 @@ class Fr {
     return this.data;
   }
 }
-class Mr {
+class Kr {
   constructor(e, t, s) {
-    this.tenantApi = e, this.scopes = t, this.logger = s || Rr();
+    this.tenantApi = e, this.scopes = t, this.logger = s || it();
   }
   /**
    * Handle Passflow API errors
@@ -2832,7 +3005,7 @@ class Mr {
   async getTenantUserMembership(e) {
     try {
       const t = await this.tenantApi.getTenantDetails(e);
-      return new Fr(t);
+      return new Vr(t);
     } catch (t) {
       this.handlePassflowError(t, `Get tenant user membership failed for tenant ID ${e}`);
     }
@@ -3130,8 +3303,8 @@ class Mr {
     }
   }
 }
-class Pr {
-  constructor(e, t, s, i = z) {
+class Br {
+  constructor(e, t, s, i = Y) {
     this.storageManager = e, this.authApi = t, this.subscribeStore = s, this.platform = i, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.unsubscribeForeground = null, this.unsubscribeUnload = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupLifecycleListeners();
   }
   initialize() {
@@ -3229,18 +3402,23 @@ class Pr {
     return C(e);
   }
 }
-class Ur {
-  constructor(e, t) {
-    this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
-    const s = {
-      onAuthChange: (i, n) => {
-        if (i === c.TwoFactorRequired) {
-          const o = n;
-          this.setPartialAuthState(o.email, o.challengeId, o.tfaToken);
+class Gr {
+  constructor(e, t, s) {
+    this.twoFactorApi = e, this.subscribeStore = t, this.signInCompleter = s, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
+    const i = {
+      onAuthChange: (n, o) => {
+        if (n === c.TwoFactorRequired) {
+          const a = o;
+          this.setPartialAuthState(a.email, a.challengeId, a.tfaToken);
         }
+        (n === c.SignIn || n === c.Register) && this.clearPartialAuthState();
       }
     };
-    this.subscribeStore.subscribe(s, [c.TwoFactorRequired]);
+    this.subscribeStore.subscribe(i, [
+      c.TwoFactorRequired,
+      c.SignIn,
+      c.Register
+    ]);
   }
   /**
    * Emit error event and throw the error
@@ -3282,7 +3460,7 @@ class Ur {
    * Returns recovery codes that MUST be displayed to user
    */
   async confirmSetup(e) {
-    if (!W(e, this.totpDigits))
+    if (!Z(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.confirmSetup({ code: e });
@@ -3299,57 +3477,65 @@ class Ur {
   /**
    * Verify TOTP code during login
    * Completes authentication if successful
+   *
+   * @param options.trustDevice - ask the server to trust this device for later sign-ins
    */
-  async verify(e) {
-    if (!W(e, this.totpDigits))
+  async verify(e, t) {
+    if (!Z(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     if (this.recoverPartialAuthState(), !this.isVerificationRequired())
       throw new Error("2FA verification expired or not required. User must sign in first.");
     if (!this.partialAuthState?.tfaToken)
       throw new Error("No TFA token found. User must sign in first.");
     try {
-      const t = await this.twoFactorApi.verify({
+      const s = await this.twoFactorApi.verify({
         code: e,
-        tfa_token: this.partialAuthState.tfaToken
-      });
-      return this.clearPartialAuthState(), this.subscribeStore.notify(c.TwoFactorVerified, { tokens: t }), t;
-    } catch (t) {
-      this.emitErrorAndThrow(t, "Verify 2FA code");
+        tfa_token: this.partialAuthState.tfaToken,
+        ...t?.trustDevice ? { trust_device: !0 } : {}
+      }), i = await this.finishSignIn(s);
+      return this.subscribeStore.notify(c.TwoFactorVerified, { tokens: i }), i;
+    } catch (s) {
+      this.emitErrorAndThrow(s, "Verify 2FA code");
     }
   }
   /**
    * Use recovery code for authentication
    * Completes authentication if successful
+   *
+   * @param options.trustDevice - ask the server to trust this device for later sign-ins
    */
-  async useRecoveryCode(e) {
+  async useRecoveryCode(e, t) {
     try {
-      const t = Er(e);
-      if (!t)
+      const s = Or(e);
+      if (!s)
         throw new Error("Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).");
       if (this.recoverPartialAuthState(), !this.isVerificationRequired())
         throw new Error("2FA verification expired or not required. User must sign in first.");
       if (!this.partialAuthState?.tfaToken)
         throw new Error("No TFA token found. User must sign in first.");
-      const s = await this.twoFactorApi.useRecoveryCode({
-        recovery_code: t,
-        tfa_token: this.partialAuthState.tfaToken
-      });
-      return this.clearPartialAuthState(), s.remaining_recovery_codes === 0 ? this.subscribeStore.notify(c.TwoFactorRecoveryCodesExhausted, { tokens: s }) : s.remaining_recovery_codes <= 2 && this.subscribeStore.notify(c.TwoFactorRecoveryCodesLow, {
-        tokens: s,
-        remainingCodes: s.remaining_recovery_codes
+      const i = await this.finishSignIn(
+        await this.twoFactorApi.useRecoveryCode({
+          recovery_code: s,
+          tfa_token: this.partialAuthState.tfaToken,
+          ...t?.trustDevice ? { trust_device: !0 } : {}
+        })
+      );
+      return i.remaining_recovery_codes === 0 ? this.subscribeStore.notify(c.TwoFactorRecoveryCodesExhausted, { tokens: i }) : i.remaining_recovery_codes <= 2 && this.subscribeStore.notify(c.TwoFactorRecoveryCodesLow, {
+        tokens: i,
+        remainingCodes: i.remaining_recovery_codes
       }), this.subscribeStore.notify(c.TwoFactorRecoveryUsed, {
-        tokens: s,
-        remainingCodes: s.remaining_recovery_codes
-      }), this.subscribeStore.notify(c.TwoFactorVerified, { tokens: s }), s;
-    } catch (t) {
-      this.emitErrorAndThrow(t, "Use recovery code");
+        tokens: i,
+        remainingCodes: i.remaining_recovery_codes
+      }), this.subscribeStore.notify(c.TwoFactorVerified, { tokens: i }), i;
+    } catch (s) {
+      this.emitErrorAndThrow(s, "Use recovery code");
     }
   }
   /**
    * Disable 2FA (requires TOTP verification)
    */
   async disable(e) {
-    if (!W(e, this.totpDigits))
+    if (!Z(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.disable({ code: e });
@@ -3362,7 +3548,7 @@ class Ur {
    * Regenerate recovery codes
    */
   async regenerateRecoveryCodes(e) {
-    if (!W(e, this.totpDigits))
+    if (!Z(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.regenerateRecoveryCodes({ code: e }), s = [...t.recovery_codes];
@@ -3400,12 +3586,40 @@ class Ur {
    * Called on logout or successful verification
    */
   clearPartialAuthState() {
-    if (this.partialAuthState = void 0, typeof sessionStorage < "u")
+    if (this.partialAuthState = void 0, this.signInCompleter?.forgetPkceSignIn(), typeof sessionStorage < "u")
       try {
         sessionStorage.removeItem(this.SESSION_STORAGE_KEY);
       } catch {
       }
   }
+  /**
+   * Ends the pending sign-in with the second factor's answer. On a PKCE app that
+   * answer is a code, redeemed and replaced by the tokens, so no caller or
+   * subscriber ever gets a code where tokens belong. Tokens are applied once, by
+   * the completer, in the app's delivery mode. The pending state goes only after
+   * that has worked, except when no verifier can ever redeem the code.
+   */
+  async finishSignIn(e) {
+    const { code: t, ...s } = e;
+    if (t && !this.signInCompleter?.hasPendingPkceSignIn()) {
+      this.clearPartialAuthState();
+      const n = new Error("The sign-in answered with a PKCE code, but its verifier is gone");
+      throw n.id = "PKCE_VERIFIER_MISSING", n;
+    }
+    let i = e;
+    if (t && this.signInCompleter) {
+      const n = await this.signInCompleter.completePkceSignIn(t);
+      i = { ...s, ...n };
+    } else
+      await this.signInCompleter?.applyTokens(i);
+    return this.clearPartialAuthState(), i;
+  }
+  /**
+   * The 2FA token of the sign-in waiting on its second factor, if any.
+   */
+  pendingTfaToken() {
+    return this.isVerificationRequired() && this.partialAuthState?.tfaToken || void 0;
+  }
   /**
    * Attempt to recover partial auth state from sessionStorage
    * Called before verification operations to handle page refresh
@@ -3564,7 +3778,7 @@ class Ur {
    */
   async requestChallenge(e) {
     try {
-      const t = await this.twoFactorApi.requestChallenge(e);
+      const t = await this.twoFactorApi.requestChallenge(e, this.pendingTfaToken());
       return this.subscribeStore.notify(c.TwoFactorChallengeReceived, {
         challengeId: t.challenge_id,
         method: t.method,
@@ -3576,16 +3790,20 @@ class Ur {
   }
   /**
    * Verify 2FA challenge (v2)
+   * Set `trust_device` on the payload to ask the server to trust this device.
    */
   async verifyV2(e) {
     try {
-      const t = await this.twoFactorApi.verifyV2(e);
-      return t.success && (this.subscribeStore.notify(c.TwoFactorVerified, {
+      const t = await this.twoFactorApi.verifyV2(e, this.pendingTfaToken());
+      if (!t.success)
+        return t;
+      const s = await this.finishSignIn(t);
+      return this.subscribeStore.notify(c.TwoFactorVerified, {
         tokens: {
-          access_token: t.access_token,
-          refresh_token: t.refresh_token
+          access_token: s.access_token,
+          refresh_token: s.refresh_token
         }
-      }), t.device_trusted && this.subscribeStore.notify(c.TwoFactorDeviceTrusted, {})), t;
+      }), s.device_trusted && this.subscribeStore.notify(c.TwoFactorDeviceTrusted, {}), s;
     } catch (t) {
       this.emitErrorAndThrow(t, "Verify 2FA challenge");
     }
@@ -3595,7 +3813,7 @@ class Ur {
    */
   async switchToAlternative(e) {
     try {
-      const t = await this.twoFactorApi.switchToAlternative(e);
+      const t = await this.twoFactorApi.switchToAlternative(e, this.pendingTfaToken());
       return this.subscribeStore.notify(c.TwoFactorMethodSwitched, {
         challengeId: t.challenge_id,
         method: t.method,
@@ -3606,7 +3824,8 @@ class Ur {
     }
   }
   /**
-   * Get trusted devices
+   * List the devices the user trusted to skip the second factor on this app.
+   * The one this request came from has `current: true`.
    */
   async getTrustedDevices() {
     try {
@@ -3616,7 +3835,8 @@ class Ur {
     }
   }
   /**
-   * Revoke trusted device
+   * Revoke a trusted device; its next sign-in asks for the second factor again.
+   * Rejects with the server's 404 when the user has no such device.
    */
   async revokeTrustedDevice(e) {
     try {
@@ -3626,8 +3846,8 @@ class Ur {
     }
   }
 }
-class Dr {
-  constructor(e, t, s = z) {
+class jr {
+  constructor(e, t, s = Y) {
     this.userAPI = e, this.deviceService = t, this.platform = s;
   }
   /**
@@ -3678,85 +3898,85 @@ class Dr {
     return await this.userAPI.addUserPasskeyComplete(h, i, o);
   }
 }
-class D extends Error {
+class x extends Error {
   constructor(e, t, s = !1) {
     super(t), this.name = "UpgradeFactorError", this.factor = e, this.cancelled = s;
   }
 }
-const Je = (r, e) => {
+const nt = (r, e) => {
   const t = e?.trim();
   if (!t)
-    throw new D(r, "A verification code is required");
+    throw new x(r, "A verification code is required");
   return t;
-}, xr = {
+}, Hr = {
   type: "totp",
   requiresPrepare: !1,
   input: "code",
-  assert: async ({ code: r }) => ({ code: Je("totp", r) })
-}, Or = {
+  assert: async ({ code: r }) => ({ code: nt("totp", r) })
+}, zr = {
   type: "recovery_codes",
   requiresPrepare: !1,
   input: "code",
-  assert: async ({ code: r }) => ({ code: Je("recovery_codes", r) })
-}, Lr = {
+  assert: async ({ code: r }) => ({ code: nt("recovery_codes", r) })
+}, Yr = {
   type: "passkey",
   requiresPrepare: !0,
   input: "none",
   assert: async ({ prepared: r, platform: e }) => {
     if (!r?.webauthn)
-      throw new D("passkey", "The upgrade challenge carried no WebAuthn options");
+      throw new x("passkey", "The upgrade challenge carried no WebAuthn options");
     const t = e.passkeys;
     if (!t)
-      throw new D("passkey", "This platform does not support passkeys");
+      throw new x("passkey", "This platform does not support passkeys");
     let s;
     try {
       s = await t.startAuthentication(r.webauthn);
     } catch (i) {
-      throw new D("passkey", i?.message || "Passkey verification was cancelled", !0);
+      throw new x("passkey", i?.message || "Passkey verification was cancelled", !0);
     }
     if (!s)
-      throw new D("passkey", "Passkey verification was cancelled", !0);
+      throw new x("passkey", "Passkey verification was cancelled", !0);
     return { challenge_id: r.challengeId, credential: s };
   }
-}, ye = Object.freeze([
-  xr,
-  Lr,
-  Or
-]), $r = (r = ye) => new Map(r.map((e) => [e.type, e])), qr = 3, Nr = {
+}, Te = Object.freeze([
+  Hr,
+  Yr,
+  zr
+]), Wr = (r = Te) => new Map(r.map((e) => [e.type, e])), Xr = 3, Jr = {
   passkey: 0,
   totp: 1,
   email_otp: 2,
   sms_otp: 3,
   recovery_codes: 9
-}, Vr = (r) => r.requiredLevel ?? $t(r.acrValues), Ie = (r, e) => {
-  const t = Nr[r.type] ?? 5, s = e !== void 0 && e >= qr, i = r.type === "passkey";
+}, Zr = (r) => r.requiredLevel ?? Ht(r.acrValues), Fe = (r, e) => {
+  const t = Jr[r.type] ?? 5, s = e !== void 0 && e >= Xr, i = r.type === "passkey";
   return (s && !i ? 100 : 0) + t;
-}, Br = (r, e) => {
-  const t = Vr(e);
-  return [...r].sort((s, i) => Ie(s, t) - Ie(i, t));
+}, Qr = (r, e) => {
+  const t = Zr(e);
+  return [...r].sort((s, i) => Fe(s, t) - Fe(i, t));
 };
-class O extends Error {
+class L extends Error {
   constructor(e) {
     super("Upgrade authentication was cancelled"), this.code = "upgrade_cancelled", this.name = "UpgradeCancelledError", e !== void 0 && (this.cause = e);
   }
 }
-class Z extends Error {
+class te extends Error {
   constructor(e = "No available authentication factor can satisfy this challenge") {
     super(e), this.code = "upgrade_unsatisfiable", this.name = "UpgradeUnsatisfiableError";
   }
 }
-const Kr = 4, jr = 3e4, Gr = () => {
+const es = 4, ts = 3e4, rs = () => {
   let r = () => {
   }, e = () => {
   };
   return { promise: new Promise((s, i) => {
     r = s, e = i;
   }), resolve: r, reject: e };
-}, G = (r) => ({
+}, H = (r) => ({
   acrValues: r.acrValues,
   level: r.requiredLevel,
   maxAge: r.maxAge
-}), Hr = (r, e) => e.level === void 0 ? !0 : r.level === void 0 ? !1 : r.level >= e.level, zr = (r, e) => {
+}), ss = (r, e) => e.level === void 0 ? !0 : r.level === void 0 ? !1 : r.level >= e.level, is = (r, e) => {
   const t = r.requiredLevel === void 0 ? e.requiredLevel : e.requiredLevel === void 0 ? r.requiredLevel : Math.max(r.requiredLevel, e.requiredLevel), s = t === void 0 ? r.acrValues ?? e.acrValues : t === r.requiredLevel ? r.acrValues : e.acrValues, i = r.maxAge === void 0 ? e.maxAge : e.maxAge === void 0 ? r.maxAge : Math.min(r.maxAge, e.maxAge), n = Array.from(/* @__PURE__ */ new Set([...r.channels ?? [], ...e.channels ?? []]));
   return {
     acrValues: s,
@@ -3765,13 +3985,13 @@ const Kr = 4, jr = 3e4, Gr = () => {
     status: r.status,
     ...n.length > 0 ? { channels: n } : {}
   };
-}, Yr = (r, e) => {
+}, ns = (r, e) => {
   const t = e.requiredLevel !== void 0 && (r.requiredLevel === void 0 || e.requiredLevel > r.requiredLevel), s = e.maxAge !== void 0 && (r.maxAge === void 0 || e.maxAge < r.maxAge);
   return t || s;
 };
-class Wr {
+class os {
   constructor(e) {
-    this.state = "idle", this.inFlight = null, this.requirement = null, this.selected = null, this.rankedRequirement = null, this.registrations = [], this.proof = null, this.pruned = /* @__PURE__ */ new Set(), this.openPrompt = null, this.transport = e.transport, this.prompt = e.prompt, this.platform = e.platform, this.available = e.factors ?? ye, this.registry = $r(this.available), this.maxAttempts = e.maxAttempts ?? Kr, this.readObtainedBar = e.readObtainedBar, this.onFlightSettled = e.onFlightSettled, this.settleTimeoutMs = e.replaySettleTimeoutMs ?? jr;
+    this.state = "idle", this.inFlight = null, this.requirement = null, this.selected = null, this.rankedRequirement = null, this.registrations = [], this.proof = null, this.pruned = /* @__PURE__ */ new Set(), this.openPrompt = null, this.transport = e.transport, this.prompt = e.prompt, this.platform = e.platform, this.available = e.factors ?? Te, this.registry = Wr(this.available), this.maxAttempts = e.maxAttempts ?? es, this.readObtainedBar = e.readObtainedBar, this.onFlightSettled = e.onFlightSettled, this.settleTimeoutMs = e.replaySettleTimeoutMs ?? ts;
   }
   /** The current lifecycle state. Read-only. */
   get currentState() {
@@ -3808,9 +4028,9 @@ class Wr {
   /** Registers a waiter and the bar it arrived demanding. */
   register(e, t) {
     const s = t.kind === "imperative" && t.requested !== void 0, n = {
-      demanded: t.kind === "imperative" && t.requested ? t.requested : G(e),
+      demanded: t.kind === "imperative" && t.requested ? t.requested : H(e),
       statedBar: s,
-      settlement: Gr(),
+      settlement: rs(),
       reported: !1,
       entry: {
         ...t,
@@ -3838,13 +4058,13 @@ class Wr {
       this.requirement = e;
       return;
     }
-    const s = Yr(t, e);
-    this.requirement = zr(t, e), s && this.state === "collecting" && this.selected === null && this.openPrompt?.onRequirementRaised?.({ challenge: this.requirement, factors: this.offeredFactors() });
+    const s = ns(t, e);
+    this.requirement = is(t, e), s && this.state === "collecting" && this.selected === null && this.openPrompt?.onRequirementRaised?.({ challenge: this.requirement, factors: this.offeredFactors() });
   }
   /** The factors to offer right now: ranked for the merged bar, minus what the server refused. */
   offeredFactors() {
     const e = this.available.filter((s) => !this.pruned.has(s.type)), t = this.requirement;
-    return t ? Br(e, t) : e;
+    return t ? Qr(e, t) : e;
   }
   /** The waiter's inbound edge. Idempotent — a second call is ignored. */
   receiveReport(e, t) {
@@ -3912,8 +4132,8 @@ class Wr {
    */
   release(e, t) {
     if (e.entry.kind === "imperative") {
-      if (e.statedBar && !Hr(t, e.demanded)) {
-        this.receiveReport(e, { outcome: "insufficient", obtained: t, required: e.demanded }), e.settlement.reject(new K(t, e.demanded));
+      if (e.statedBar && !ss(t, e.demanded)) {
+        this.receiveReport(e, { outcome: "insufficient", obtained: t, required: e.demanded }), e.settlement.reject(new G(t, e.demanded));
         return;
       }
       this.receiveReport(e, { outcome: "replayed", obtained: t }), e.settlement.resolve({ waiter: e.entry, obtained: t });
@@ -3988,26 +4208,26 @@ class Wr {
     for (let t = 0; t < this.maxAttempts; t++) {
       const s = this.offeredFactors();
       if (s.length === 0)
-        return { status: "failed", reason: new Z() };
+        return { status: "failed", reason: new te() };
       const i = this.requirement;
       let n;
       try {
         n = await this.collect(i, s, e);
       } catch (a) {
-        return { status: "failed", reason: new O(a) };
+        return { status: "failed", reason: new L(a) };
       }
       if (n.type === "cancel")
-        return { status: "failed", reason: new O() };
+        return { status: "failed", reason: new L() };
       const o = this.registry.get(n.factor);
       if (!o) {
-        e = new Z(`Unknown authentication factor: ${n.factor}`), this.state = "collecting", this.selected = null;
+        e = new te(`Unknown authentication factor: ${n.factor}`), this.state = "collecting", this.selected = null;
         continue;
       }
       try {
-        return await this.proveAndCommit(o, n.code), { status: "proven", obtained: this.readObtainedBar?.() ?? G(this.rankedRequirement ?? i) };
+        return await this.proveAndCommit(o, n.code), { status: "proven", obtained: this.readObtainedBar?.() ?? H(this.rankedRequirement ?? i) };
       } catch (a) {
-        if (a instanceof D && a.cancelled)
-          return { status: "failed", reason: new O() };
+        if (a instanceof x && a.cancelled)
+          return { status: "failed", reason: new L() };
         const h = this.classifyProofFailure(a);
         if (h)
           return { status: "failed", reason: h };
@@ -4036,7 +4256,7 @@ class Wr {
   }
   /** Maps a proof failure to a terminal reason, or `undefined` when the user may retry. */
   classifyProofFailure(e) {
-    if (e instanceof K || e instanceof j || e instanceof $)
+    if (e instanceof G || e instanceof j || e instanceof q)
       return e;
     if (e instanceof _)
       switch (e.kind) {
@@ -4049,7 +4269,7 @@ class Wr {
         case "network":
           return e;
         case "session_changed":
-          return new $(e.message);
+          return new q(e.message);
         default:
           return;
       }
@@ -4060,14 +4280,14 @@ class Wr {
     await this.transport.commit(e.type, i);
   }
 }
-const Ze = "https://passflow-relative.invalid", Xr = () => {
+const ot = "https://passflow-relative.invalid", as = () => {
   const r = globalThis, e = r.document?.baseURI;
   if (typeof e == "string" && e !== "")
     return e;
   const t = r.location?.href;
-  return typeof t == "string" && t !== "" && t !== "about:blank" ? t : Ze;
-}, Ae = (r, e = Xr()) => {
-  const t = e === Ze;
+  return typeof t == "string" && t !== "" && t !== "about:blank" ? t : ot;
+}, Me = (r, e = as()) => {
+  const t = e === ot;
   let s;
   try {
     s = new URL(e).origin;
@@ -4092,32 +4312,32 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     relativeToBase: s !== void 0 && i.origin === s,
     sentinelBase: t
   };
-}, ne = (r, e) => typeof e == "string" ? [r.toLowerCase(), e] : void 0, Jr = (r) => {
+}, he = (r, e) => typeof e == "string" ? [r.toLowerCase(), e] : void 0, cs = (r) => {
   const e = [];
   if (r == null)
     return Object.freeze(e);
   const t = r;
   if (typeof t.forEach == "function" && typeof t.entries == "function")
     return r.forEach((s, i) => {
-      const n = ne(i, s);
+      const n = he(i, s);
       n && e.push(n);
     }), Object.freeze(e);
   if (Array.isArray(r)) {
     for (const s of r)
       if (Array.isArray(s) && s.length >= 2) {
-        const i = ne(String(s[0]), s[1]);
+        const i = he(String(s[0]), s[1]);
         i && e.push(i);
       }
     return Object.freeze(e);
   }
   if (typeof r == "object")
     for (const [s, i] of Object.entries(r)) {
-      const n = Array.isArray(i) ? i.join(", ") : i, o = ne(s, n);
+      const n = Array.isArray(i) ? i.join(", ") : i, o = he(s, n);
       o && e.push(o);
     }
   return Object.freeze(e);
-}, Qe = (r) => {
-  const e = r.base === void 0 ? Ae(r.url) : Ae(r.url, r.base), t = {
+}, at = (r) => {
+  const e = r.base === void 0 ? Me(r.url) : Me(r.url, r.base), t = {
     raw: r.url,
     href: e.href,
     dispatchUrl: e.sentinelBase || !e.resolved ? r.url : e.href,
@@ -4126,25 +4346,25 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     resolved: e.resolved,
     relativeToBase: e.relativeToBase,
     method: (r.method ?? "GET").toUpperCase(),
-    headers: Jr(r.headers),
+    headers: cs(r.headers),
     bodyKind: r.bodyKind,
     ..."body" in r ? { body: r.body } : {}
   };
   return Object.freeze(t);
-}, et = (r, e) => {
+}, ct = (r, e) => {
   if (!e || e.from === e.to)
     return r;
   let t = !1;
   const s = r.map(([i, n]) => i === "authorization" && n === e.from ? (t = !0, [i, e.to]) : [i, n]);
   return t ? Object.freeze(s) : r;
-}, tt = (r) => {
+}, ht = (r) => {
   const e = {};
   for (const [t, s] of r)
     e[t] = s;
   return e;
-}, Zr = new Set(
-  ye.filter((r) => !r.requiresPrepare).map((r) => r.type)
-), Qr = (r) => {
+}, hs = new Set(
+  Te.filter((r) => !r.requiresPrepare).map((r) => r.type)
+), ds = (r) => {
   if (!r || typeof r != "object" || !r.challenge_id || !r.expires_at)
     throw new _({
       kind: "protocol",
@@ -4157,16 +4377,16 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     webauthn: r.webauthn,
     codeSentTo: r.code_sent_to
   };
-}, Ce = (r) => Xe(r) && !mr(r), es = (r) => ({
+}, Ue = (r) => st(r) && !Ar(r), ls = (r) => ({
   async prepare(e) {
-    if (!Zr.has(e))
+    if (!hs.has(e))
       try {
         const t = r.relyingPartyId?.(), s = await r.startUpgrade(t ? { method: e, relying_party_id: t } : { method: e });
-        return Qr(s);
+        return ds(s);
       } catch (t) {
-        if (Ce(t))
+        if (Ue(t))
           throw t;
-        const s = Ee(t, "start");
+        const s = Pe(t, "start");
         if (s.kind === "prepare_not_required")
           return;
         throw s;
@@ -4179,42 +4399,42 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     try {
       await r.commitRefresh({ type: e, assertion: t });
     } catch (i) {
-      if (Ce(i))
+      if (Ue(i))
         throw i;
-      const n = Ee(i, "refresh");
-      throw n.status === 401 && wr(n) && r.markSessionInvalid?.(), n;
+      const n = Pe(i, "refresh");
+      throw n.status === 401 && Fr(n) && r.markSessionInvalid?.(), n;
     }
   }
-}), rt = (r) => typeof r == "function" ? r() : r, Re = (r) => {
+}), dt = (r) => typeof r == "function" ? r() : r, De = (r) => {
   try {
     return new URL(r);
   } catch {
     return;
   }
-}, le = (r, e) => {
+}, ve = (r, e) => {
   if (!e || e === "/")
     return !0;
   const t = e.replace(/\/+$/, "");
   return r === t || r.startsWith(`${t}/`);
-}, ts = (r, e) => !e || r.origin === void 0 ? !1 : r.origin === e.origin && le(r.pathname, e.pathPrefix), rs = (r, e) => {
+}, us = (r, e) => !e || r.origin === void 0 ? !1 : r.origin === e.origin && ve(r.pathname, e.pathPrefix), ps = (r, e) => {
   for (const t of e) {
     if (t === "")
       continue;
     if (t.startsWith("/")) {
-      if (r.relativeToBase && le(r.pathname, t))
+      if (r.relativeToBase && ve(r.pathname, t))
         return !0;
       continue;
     }
-    const s = Re(t) ?? Re(`https://${t}`);
-    if (!(!s || r.origin === void 0) && r.origin === s.origin && le(r.pathname, s.pathname))
+    const s = De(t) ?? De(`https://${t}`);
+    if (!(!s || r.origin === void 0) && r.origin === s.origin && ve(r.pathname, s.pathname))
       return !0;
   }
   return !1;
-}, Fe = (r, e, t) => ts(r, e.passflow) || rs(r, e.backend) ? t ? t(r.href) !== !1 : !0 : !1, st = (r) => {
+}, xe = (r, e, t) => us(r, e.passflow) || ps(r, e.backend) ? t ? t(r.href) !== !1 : !0 : !1, lt = (r) => {
   const e = r.detail, t = e?.message ?? `[passflow] upgrade challenge not actioned: ${r.reason}`;
   console.warn(t, { status: r.status, url: r.url, reason: r.reason, detail: e });
-}, ss = (r, e) => {
-  const t = e.onUpgradeDiagnostic ?? st;
+}, fs = (r, e) => {
+  const t = e.onUpgradeDiagnostic ?? lt;
   return (s, i) => {
     t({
       status: r.status,
@@ -4223,12 +4443,12 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
       detail: { method: r.request.method, ...i ?? {} }
     });
   };
-}, ue = (r, e, t) => {
-  const s = t.onUpgradeDiagnostic ?? st;
+}, me = (r, e, t) => {
+  const s = t.onUpgradeDiagnostic ?? lt;
   for (const i of r)
     s({ ...i, url: e.request.href, detail: { method: e.request.method, ...i.detail ?? {} } });
-}, is = /\bjson\b/i, pe = async (r, e) => {
-  const t = e.requireChallengeChannel === "header", s = r.getHeader("content-type") ?? "", i = !t && is.test(s);
+}, gs = /\bjson\b/i, ye = async (r, e) => {
+  const t = e.requireChallengeChannel === "header", s = r.getHeader("content-type") ?? "", i = !t && gs.test(s);
   let n;
   if (i)
     try {
@@ -4237,23 +4457,23 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
       n = void 0;
     }
   const o = i ? { status: r.status, getHeader: (a) => r.getHeader(a) ?? void 0, body: n } : { status: r.status, getHeader: (a) => r.getHeader(a) ?? void 0 };
-  return ve(o, { requireChallengeChannel: e.requireChallengeChannel });
-}, ns = (r) => ve(
+  return be(o, { requireChallengeChannel: e.requireChallengeChannel });
+}, vs = (r) => be(
   { status: r.status, getHeader: (e) => r.getHeader(e) ?? void 0 },
   { requireChallengeChannel: "header" }
-).challenge, os = (r, e) => e.passflow === null ? `[passflow] a 401/403 from ${r} carried an upgrade challenge, but no Passflow endpoint is configured — set \`url\` on the Passflow config.` : `[passflow] a 401/403 from ${r} carried an upgrade challenge, but that URL is not covered by the provider's \`backend\` prop — add it there to enable step-up for this API.`, as = (r, e) => r instanceof O ? { kind: "cancelled" } : r instanceof Z ? { kind: "unsatisfiable" } : r instanceof j ? { kind: "unavailable" } : r instanceof $ ? { kind: "session-changed" } : r instanceof K ? { kind: "insufficient", obtained: r.obtained, required: r.required } : r instanceof _ ? r.kind === "exhausted" || r.kind === "attempts_exhausted" ? { kind: "exhausted", error: r } : r.kind === "unavailable" ? { kind: "unavailable" } : r.kind === "session_changed" ? { kind: "session-changed" } : { kind: "transport-failure", status: r.status, retryable: r.retryable, error: r } : {
+).challenge, ms = (r, e) => e.passflow === null ? `[passflow] a 401/403 from ${r} carried an upgrade challenge, but no Passflow endpoint is configured — set \`url\` on the Passflow config.` : `[passflow] a 401/403 from ${r} carried an upgrade challenge, but that URL is not covered by the provider's \`backend\` prop — add it there to enable step-up for this API.`, ys = (r, e) => r instanceof L ? { kind: "cancelled" } : r instanceof te ? { kind: "unsatisfiable" } : r instanceof j ? { kind: "unavailable" } : r instanceof q ? { kind: "session-changed" } : r instanceof G ? { kind: "insufficient", obtained: r.obtained, required: r.required } : r instanceof _ ? r.kind === "exhausted" || r.kind === "attempts_exhausted" ? { kind: "exhausted", error: r } : r.kind === "unavailable" ? { kind: "unavailable" } : r.kind === "session_changed" ? { kind: "session-changed" } : { kind: "transport-failure", status: r.status, retryable: r.retryable, error: r } : {
   kind: "transport-failure",
   retryable: !1,
   error: r instanceof Error ? r : new Error(String(r))
-}, cs = async (r, e, t, s) => {
+}, ks = async (r, e, t, s) => {
   if (r.status !== 401 && r.status !== 403)
     return { kind: "replayed", response: r };
-  const { challenge: i, diagnostics: n } = await pe(r, e);
-  if (ue(n, r, e), !i)
+  const { challenge: i, diagnostics: n } = await ye(r, e);
+  if (me(n, r, e), !i)
     return { kind: "replayed", response: r };
-  const o = G(i);
+  const o = H(i);
   return s("elevated-insufficient", { obtained: t, required: o }), { kind: "insufficient", obtained: t, required: o, response: r };
-}, hs = async (r, e) => {
+}, ws = async (r, e) => {
   if (!e)
     return { aborted: !1, value: await r };
   if (e.aborted)
@@ -4269,32 +4489,32 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
   } finally {
     t && e.removeEventListener?.("abort", t);
   }
-}, it = async (r, e) => {
+}, ut = async (r, e) => {
   if (r.status !== 401 && r.status !== 403)
     return { kind: "not-a-challenge" };
   if (r.markers.upgradeTransaction)
     return { kind: "not-a-challenge" };
-  const t = ss(r, e);
+  const t = fs(r, e);
   if (r.markers.replayed) {
-    if (!Fe(r.request, e.scope, e.shouldIntercept))
+    if (!xe(r.request, e.scope, e.shouldIntercept))
       return { kind: "not-a-challenge" };
-    const { challenge: y, diagnostics: I } = await pe(r, e);
-    if (ue(I, r, e), !y)
+    const { challenge: y, diagnostics: I } = await ye(r, e);
+    if (me(I, r, e), !y)
       return { kind: "not-a-challenge" };
-    const Y = e.readObtainedBar?.() ?? {}, Se = G(y);
-    return t("elevated-insufficient", { obtained: Y, required: Se }), { kind: "insufficient", obtained: Y, required: Se, response: r };
+    const W = e.readObtainedBar?.() ?? {}, Ie = H(y);
+    return t("elevated-insufficient", { obtained: W, required: Ie }), { kind: "insufficient", obtained: W, required: Ie, response: r };
   }
-  if (!Fe(r.request, e.scope, e.shouldIntercept))
-    return ns(r) ? (t("challenge-out-of-scope", {
+  if (!xe(r.request, e.scope, e.shouldIntercept))
+    return vs(r) ? (t("challenge-out-of-scope", {
       header: r.getHeader("www-authenticate") ?? void 0,
-      message: os(r.request.href, e.scope)
+      message: ms(r.request.href, e.scope)
     }), { kind: "out-of-scope" }) : { kind: "not-a-challenge" };
-  const { challenge: s, diagnostics: i } = await pe(r, e);
-  if (ue(i, r, e), !s) {
-    const u = r.getHeader("www-authenticate");
+  const { challenge: s, diagnostics: i } = await ye(r, e);
+  if (me(i, r, e), !s) {
+    const p = r.getHeader("www-authenticate");
     return e.requireChallengeChannel !== "header" && t("no-channel", {
-      ...u ? { header: u } : {},
-      message: r.responseType === "cors" && !u ? `[passflow] a cross-origin ${r.status} from ${r.request.href} carried no readable challenge: \`WWW-Authenticate\` is not CORS-safelisted, so add \`Access-Control-Expose-Headers: WWW-Authenticate\` on that server, or have it emit the \`upgrade_required\` JSON body.` : `[passflow] a ${r.status} from ${r.request.href} carried no upgrade challenge on either channel; treated as an ordinary ${r.status}.`
+      ...p ? { header: p } : {},
+      message: r.responseType === "cors" && !p ? `[passflow] a cross-origin ${r.status} from ${r.request.href} carried no readable challenge: \`WWW-Authenticate\` is not CORS-safelisted, so add \`Access-Control-Expose-Headers: WWW-Authenticate\` on that server, or have it emit the \`upgrade_required\` JSON body.` : `[passflow] a ${r.status} from ${r.request.href} carried no upgrade challenge on either channel; treated as an ordinary ${r.status}.`
     }), { kind: "not-a-challenge" };
   }
   if (r.replayable === !1)
@@ -4304,45 +4524,45 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
   const n = e.authorizationSwap?.(), o = { kind: "request", url: r.request.href, method: r.request.method };
   let a, h;
   try {
-    a = Promise.resolve(e.elevate(s, o)), h = await hs(a, r.signal);
-  } catch (u) {
-    return as(u);
+    a = Promise.resolve(e.elevate(s, o)), h = await ws(a, r.signal);
+  } catch (p) {
+    return ys(p);
   }
   if (h.aborted)
     return a?.then(
-      (u) => u?.waiter.report({ outcome: "failed" }),
+      (p) => p?.waiter.report({ outcome: "failed" }),
       () => {
       }
     ), { kind: "aborted", reason: h.reason };
-  const p = h.value;
+  const u = h.value;
   if (r.signal?.aborted)
-    return p?.waiter.report({ outcome: "failed" }), { kind: "aborted", reason: r.signal.reason };
-  const m = p?.obtained ?? e.readObtainedBar?.() ?? G(s), d = e.authorizationSwap?.(), g = d ? { from: n?.from ?? d.from, to: d.to } : void 0;
+    return u?.waiter.report({ outcome: "failed" }), { kind: "aborted", reason: r.signal.reason };
+  const m = u?.obtained ?? e.readObtainedBar?.() ?? H(s), d = e.authorizationSwap?.(), g = d ? { from: n?.from ?? d.from, to: d.to } : void 0;
   r.markers.replayed = !0;
   let f;
   try {
     f = await r.replay(g ? { authorizationSwap: g } : void 0);
-  } catch (u) {
-    if (u instanceof K)
-      return p?.waiter.report({ outcome: "insufficient", obtained: u.obtained, required: u.required }), r.signal?.aborted ? { kind: "aborted", reason: r.signal.reason } : { kind: "insufficient", obtained: u.obtained, required: u.required };
-    if (p?.waiter.report({ outcome: "failed" }), r.signal?.aborted)
+  } catch (p) {
+    if (p instanceof G)
+      return u?.waiter.report({ outcome: "insufficient", obtained: p.obtained, required: p.required }), r.signal?.aborted ? { kind: "aborted", reason: r.signal.reason } : { kind: "insufficient", obtained: p.obtained, required: p.required };
+    if (u?.waiter.report({ outcome: "failed" }), r.signal?.aborted)
       return { kind: "aborted", reason: r.signal.reason };
-    throw u;
+    throw p;
   }
-  const v = await cs(f, e, m, t);
-  return v.kind === "insufficient" ? p?.waiter.report({ outcome: "insufficient", obtained: v.obtained, required: v.required }) : p?.waiter.report({ outcome: "replayed", obtained: m }), v;
-}, ds = (r) => {
+  const v = await ks(f, e, m, t);
+  return v.kind === "insufficient" ? u?.waiter.report({ outcome: "insufficient", obtained: v.obtained, required: v.required }) : u?.waiter.report({ outcome: "replayed", obtained: m }), v;
+}, Ss = (r) => {
   switch (r.kind) {
     case "cancelled":
-      return new O();
+      return new L();
     case "unsatisfiable":
-      return new Z();
+      return new te();
     case "unavailable":
       return new j();
     case "session-changed":
-      return new $();
+      return new q();
     case "insufficient":
-      return new K(r.obtained, r.required);
+      return new G(r.obtained, r.required);
     case "exhausted":
       return r.error;
     case "transport-failure":
@@ -4350,7 +4570,7 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     default:
       return;
   }
-}, ls = (r, e, t) => {
+}, bs = (r, e, t) => {
   switch (r.kind) {
     case "replayed":
       return { settle: "resolve", value: r.response.raw };
@@ -4361,47 +4581,47 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     case "aborted":
       return { settle: "reject", error: r.reason };
     case "cancelled":
-      return t.onCancel === "reject" ? { settle: "reject", error: new O() } : { settle: "resolve", value: oe(e, r) };
+      return t.onCancel === "reject" ? { settle: "reject", error: new L() } : { settle: "resolve", value: de(e, r) };
     case "insufficient":
-      return { settle: "resolve", value: oe(r.response?.raw ?? e, r) };
+      return { settle: "resolve", value: de(r.response?.raw ?? e, r) };
     default:
-      return { settle: "resolve", value: oe(e, r) };
+      return { settle: "resolve", value: de(e, r) };
   }
-}, us = (r, e) => {
+}, Ts = (r, e) => {
   switch (r.kind) {
     case "replayed":
       return r.response.rejected ? { settle: "reject", error: r.response.raw ?? e } : { settle: "resolve", value: r.response.raw };
     case "aborted":
       return { settle: "reject", error: r.reason };
     default:
-      return { settle: "reject", error: ds(r) ?? e };
+      return { settle: "reject", error: Ss(r) ?? e };
   }
-}, nt = /* @__PURE__ */ new WeakSet(), ot = /* @__PURE__ */ new WeakSet(), at = /* @__PURE__ */ new WeakSet(), ct = /* @__PURE__ */ new WeakSet(), ht = /* @__PURE__ */ new WeakSet(), dt = /* @__PURE__ */ new WeakSet(), lt = /* @__PURE__ */ new WeakSet(), oe = (r, e) => {
+}, pt = /* @__PURE__ */ new WeakSet(), ft = /* @__PURE__ */ new WeakSet(), gt = /* @__PURE__ */ new WeakSet(), vt = /* @__PURE__ */ new WeakSet(), mt = /* @__PURE__ */ new WeakSet(), yt = /* @__PURE__ */ new WeakSet(), kt = /* @__PURE__ */ new WeakSet(), de = (r, e) => {
   switch (e.kind) {
     case "cancelled":
-      nt.add(r);
+      pt.add(r);
       break;
     case "exhausted":
-      ot.add(r);
+      ft.add(r);
       break;
     case "insufficient":
-      at.add(r);
+      gt.add(r);
       break;
     case "unsatisfiable":
-      ct.add(r);
+      vt.add(r);
       break;
     case "unavailable":
-      ht.add(r);
+      mt.add(r);
       break;
     case "session-changed":
-      dt.add(r);
+      yt.add(r);
       break;
     case "transport-failure":
-      lt.add(r);
+      kt.add(r);
       break;
   }
   return r;
-}, Ys = (r) => nt.has(r), Ws = (r) => ot.has(r), Xs = (r) => at.has(r), Js = (r) => ct.has(r), Zs = (r) => ht.has(r), Qs = (r) => dt.has(r), ei = (r) => lt.has(r), ps = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]), ee = (r) => typeof r == "object" && r !== null && typeof r.url == "string" && typeof r.clone == "function" && "method" in r, fs = (r) => typeof r == "string" ? r : ee(r) ? r.url : String(r), gs = (r, e) => (e?.method ?? (ee(r) ? r.method : void 0) ?? "GET").toUpperCase(), ms = (r) => r == null ? "none" : typeof r == "string" ? "reusable" : typeof r.getReader == "function" ? "one-shot" : "reusable", vs = (r) => {
+}, ni = (r) => pt.has(r), oi = (r) => ft.has(r), ai = (r) => gt.has(r), ci = (r) => vt.has(r), hi = (r) => mt.has(r), di = (r) => yt.has(r), li = (r) => kt.has(r), _s = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]), se = (r) => typeof r == "object" && r !== null && typeof r.url == "string" && typeof r.clone == "function" && "method" in r, Es = (r) => typeof r == "string" ? r : se(r) ? r.url : String(r), Is = (r, e) => (e?.method ?? (se(r) ? r.method : void 0) ?? "GET").toUpperCase(), As = (r) => r == null ? "none" : typeof r == "string" ? "reusable" : typeof r.getReader == "function" ? "one-shot" : "reusable", Cs = (r) => {
   if (typeof r == "string")
     return r.length;
   const e = r;
@@ -4409,7 +4629,7 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     return e.size;
   if (typeof e?.byteLength == "number")
     return e.byteLength;
-}, J = (r, e, t) => r === void 0 || r === "always" ? !0 : r === "idempotent-only" ? ps.has(e.method) : typeof r == "function" ? r(e) : !(r.maxBodyBytes !== void 0 && t !== void 0 && t > r.maxBodyBytes), q = (r, e, t, s, i) => ({
+}, ee = (r, e, t) => r === void 0 || r === "always" ? !0 : r === "idempotent-only" ? _s.has(e.method) : typeof r == "function" ? r(e) : !(r.maxBodyBytes !== void 0 && t !== void 0 && t > r.maxBodyBytes), N = (r, e, t, s, i) => ({
   replayable: !1,
   bodyKind: r,
   reason: e,
@@ -4417,12 +4637,12 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
   forwardInit: i,
   snapshot: s,
   replay: () => Promise.reject(new Error(`This request cannot be replayed: ${e}`))
-}), ut = (r, e) => tt(et(r.headers, e?.authorizationSwap)), ae = (r) => {
+}), wt = (r, e) => ht(ct(r.headers, e?.authorizationSwap)), le = (r) => {
   if (!r || !("headers" in r))
     return r;
   const { headers: e, ...t } = r;
   return t;
-}, ys = (r, e) => e && "headers" in e && e.headers !== void 0 ? e.headers : ee(r) ? r.headers : void 0, ks = (r) => {
+}, Rs = (r, e) => e && "headers" in e && e.headers !== void 0 ? e.headers : se(r) ? r.headers : void 0, Ps = (r) => {
   if (r === null || typeof r == "string")
     return r;
   if (typeof FormData < "u" && r instanceof FormData) {
@@ -4432,12 +4652,12 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     return e;
   }
   return typeof URLSearchParams < "u" && r instanceof URLSearchParams ? new URLSearchParams(r) : r instanceof ArrayBuffer ? r.slice(0) : ArrayBuffer.isView(r) ? new Uint8Array(r.buffer, r.byteOffset, r.byteLength).slice() : r;
-}, Me = (r, e, t) => new Request(r, { headers: ut(e, t) }), ws = (r, e, t) => {
-  const s = fs(r), i = gs(r, e), n = ys(r, e), o = (d, g) => Qe({ url: s, method: i, headers: n, bodyKind: d, ...g === void 0 ? {} : { body: g } });
-  if (ee(r)) {
+}, Oe = (r, e, t) => new Request(r, { headers: wt(e, t) }), Fs = (r, e, t) => {
+  const s = Es(r), i = Is(r, e), n = Rs(r, e), o = (d, g) => at({ url: s, method: i, headers: n, bodyKind: d, ...g === void 0 ? {} : { body: g } });
+  if (se(r)) {
     if (r.body === null || r.body === void 0) {
       const v = o("none");
-      return J(t, { url: s, method: i, bodyKind: "none" }) ? {
+      return ee(t, { url: s, method: i, bodyKind: "none" }) ? {
         replayable: !0,
         bodyKind: "none",
         forwardInput: r,
@@ -4446,17 +4666,17 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
         // The snapshot's effective header set is applied to the `Request` and
         // `init.headers` is dropped, so `fetch` has only one set to choose
         // from. See `replayHeaders` for why that matters.
-        replay: (y, I) => y(Me(r, v, I), ae(e))
-      } : q("none", "the replay policy refused this request", r, v, e);
+        replay: (y, I) => y(Oe(r, v, I), le(e))
+      } : N("none", "the replay policy refused this request", r, v, e);
     }
     const d = o("request-clone");
-    if (!J(t, { url: s, method: i, bodyKind: "request-clone" }))
-      return q("request-clone", "the replay policy refused this request", r, d, e);
+    if (!ee(t, { url: s, method: i, bodyKind: "request-clone" }))
+      return N("request-clone", "the replay policy refused this request", r, d, e);
     let f;
     try {
       f = r.clone();
     } catch {
-      return q("one-shot", "the Request body was already consumed and cannot be cloned", r, d, e);
+      return N("one-shot", "the Request body was already consumed and cannot be cloned", r, d, e);
     }
     return {
       replayable: !0,
@@ -4464,15 +4684,15 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
       forwardInput: r,
       forwardInit: e,
       snapshot: d,
-      replay: (v, u) => v(Me(f, d, u), ae(e))
+      replay: (v, p) => v(Oe(f, d, p), le(e))
     };
   }
-  const a = ms(e?.body);
+  const a = As(e?.body);
   if (a === "one-shot")
-    return q("one-shot", "a streaming request body is consumed by the first send", r, o("one-shot"), e);
-  if (!J(t, { url: s, method: i, bodyKind: a }, vs(e?.body)))
-    return q(a, "the replay policy refused this request", r, o(a), e);
-  const p = e && "body" in e ? ks(e.body ?? null) : void 0, m = o(a, p);
+    return N("one-shot", "a streaming request body is consumed by the first send", r, o("one-shot"), e);
+  if (!ee(t, { url: s, method: i, bodyKind: a }, Cs(e?.body)))
+    return N(a, "the replay policy refused this request", r, o(a), e);
+  const u = e && "body" in e ? Ps(e.body ?? null) : void 0, m = o(a, u);
   return {
     replayable: !0,
     bodyKind: a,
@@ -4497,22 +4717,22 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     // unchanged, so an abort during the replay behaves identically to an abort
     // during the original.
     replay: (d, g) => d(m.dispatchUrl, {
-      ...ae(e),
-      ...p === void 0 ? {} : { body: p },
-      headers: ut(m, g),
+      ...le(e),
+      ...u === void 0 ? {} : { body: u },
+      headers: wt(m, g),
       method: m.method
     })
   };
-}, te = (r) => typeof r == "object" && r !== null, Ss = (r) => (e) => {
-  if (!te(r))
+}, ie = (r) => typeof r == "object" && r !== null, Ms = (r) => (e) => {
+  if (!ie(r))
     return;
   const s = r[e] ?? r[e.toLowerCase()] ?? (typeof r.get == "function" ? r.get(e) : void 0);
   return Array.isArray(s) ? s.join(", ") : typeof s == "string" ? s : void 0;
-}, bs = (r) => {
+}, Us = (r) => {
   const e = r?.url ?? "", t = r?.baseURL;
   return !t || /^([a-z][a-z\d+\-.]*:)?\/\//i.test(e) ? e : `${t.replace(/\/+$/, "")}/${e.replace(/^\/+/, "")}`;
-}, Ts = (r) => (r?.method ?? "GET").toUpperCase(), _s = (r) => r == null ? "none" : te(r) && (typeof r.pipe == "function" || typeof r.getReader == "function") ? "one-shot" : "reusable", Es = (r, e, t) => {
-  const s = tt(et(e.headers, t?.authorizationSwap)), i = e.dispatchUrl === e.href && e.resolved;
+}, Ds = (r) => (r?.method ?? "GET").toUpperCase(), xs = (r) => r == null ? "none" : ie(r) && (typeof r.pipe == "function" || typeof r.getReader == "function") ? "one-shot" : "reusable", Os = (r, e, t) => {
+  const s = ht(ct(e.headers, t?.authorizationSwap)), i = e.dispatchUrl === e.href && e.resolved;
   return {
     ...r,
     ...i ? { baseURL: void 0 } : {},
@@ -4521,56 +4741,56 @@ const Ze = "https://passflow-relative.invalid", Xr = () => {
     headers: s,
     ..."body" in e ? { data: e.body } : {}
   };
-}, fe = (r, e, t, s, i, n) => {
-  const o = e ?? r?.config, a = _s(o?.data), h = n ?? Qe({
-    url: bs(o),
-    method: Ts(o),
+}, ke = (r, e, t, s, i, n) => {
+  const o = e ?? r?.config, a = xs(o?.data), h = n ?? at({
+    url: Us(o),
+    method: Ds(o),
     headers: o?.headers,
     bodyKind: a,
     body: o?.data
-  }), p = { url: h.href, method: h.method, bodyKind: a }, m = a !== "one-shot" && J(i.replay, p);
+  }), u = { url: h.href, method: h.method, bodyKind: a }, m = a !== "one-shot" && ee(i.replay, u);
   return {
     status: r?.status ?? 0,
-    getHeader: Ss(r?.headers),
+    getHeader: Ms(r?.headers),
     // Pre-read by axios into `data`; nothing is consumed by reading it again,
     // and the core still decides whether reading it is in scope.
     readBody: async () => r?.data,
     request: h,
     replay: async (d) => {
-      const g = Ht(Es(o ?? {}, h, d));
+      const g = er(Os(o ?? {}, h, d));
       try {
         const f = await s(g);
-        return fe(f, f?.config ?? g, f, s, i, h);
+        return ke(f, f?.config ?? g, f, s, i, h);
       } catch (f) {
-        const v = te(f) ? f : {};
-        if (!v.response || typeof v.response.status != "number" || Xe(f))
+        const v = ie(f) ? f : {};
+        if (!v.response || typeof v.response.status != "number" || st(f))
           throw f;
-        return { ...fe(v.response, v.config ?? g, f, s, i, h), rejected: !0 };
+        return { ...ke(v.response, v.config ?? g, f, s, i, h), rejected: !0 };
       }
     },
     markers: {
-      ...ze(o) ? { upgradeTransaction: !0 } : {},
-      ...zt(o) ? { replayed: !0 } : {}
+      ...Ze(o) ? { upgradeTransaction: !0 } : {},
+      ...tr(o) ? { replayed: !0 } : {}
     },
     raw: t,
     replayable: m,
     replayUnsupportedReason: a === "one-shot" ? "a streaming request body is consumed by the first send" : "the replay policy refused this request",
     signal: o?.signal
   };
-}, pt = (r, e) => async (t) => {
-  const s = rt(r), i = te(t) ? t : {}, n = fe(i.response, i.config, i.response, e, s), o = await it(n, s), a = us(o, t);
+}, St = (r, e) => async (t) => {
+  const s = dt(r), i = ie(t) ? t : {}, n = ke(i.response, i.config, i.response, e, s), o = await ut(n, s), a = Ts(o, t);
   if (a.settle === "reject")
     throw a.error;
   return a.value;
-}, Is = (r, e, t) => {
-  const s = r.request, i = typeof s == "function" ? (a) => s.call(r, a) : () => Promise.reject(new Error("Passflow: this client exposes no request() to replay through.")), n = r.interceptors.response.use(void 0, pt(e, i));
+}, Ls = (r, e, t) => {
+  const s = r.request, i = typeof s == "function" ? (a) => s.call(r, a) : () => Promise.reject(new Error("Passflow: this client exposes no request() to replay through.")), n = r.interceptors.response.use(void 0, St(e, i));
   let o = !1;
   return () => {
     o || (o = !0, r.interceptors.response.eject(n));
   };
 };
-let ce = 0;
-const As = (r, e) => {
+let ue = 0;
+const $s = (r, e) => {
   const t = e?.signal ?? (typeof r == "object" && r !== null ? r.signal : void 0) ?? void 0;
   if (t)
     return {
@@ -4585,9 +4805,9 @@ const As = (r, e) => {
         removeEventListener: (s, i) => t.removeEventListener(s, i)
       } : {}
     };
-}, Cs = (r) => (e) => r.headers?.get(e), ft = (r, e, t, s, i) => ({
+}, qs = (r) => (e) => r.headers?.get(e), bt = (r, e, t, s, i) => ({
   status: r.status,
-  getHeader: Cs(r),
+  getHeader: qs(r),
   // A CLONE, always. The response the caller receives must still have an unread
   // body, and the core calls this only when the scope and the channel policy
   // both permit a body read.
@@ -4600,7 +4820,7 @@ const As = (r, e) => {
   request: e.snapshot,
   replay: async (n) => {
     const o = await e.replay(t, n);
-    return ft(o, e, t, s, i);
+    return bt(o, e, t, s, i);
   },
   markers: s,
   raw: r,
@@ -4608,89 +4828,89 @@ const As = (r, e) => {
   replayUnsupportedReason: e.reason,
   signal: i,
   responseType: r.type
-}), he = (r, e) => {
+}), pe = (r, e) => {
   const t = (s, i) => {
-    ce += 1;
+    ue += 1;
     try {
       return r(s, i);
     } finally {
-      ce -= 1;
+      ue -= 1;
     }
   };
   return async (s, i) => {
-    if (ce > 0)
+    if (ue > 0)
       return t(s, i);
-    const n = rt(e), o = ws(s, i, n.replay), a = await t(o.forwardInput, o.forwardInit), h = ft(a, o, t, {}, As(s, i)), p = await it(h, n), m = ls(p, a, n);
+    const n = dt(e), o = Fs(s, i, n.replay), a = await t(o.forwardInput, o.forwardInit), h = bt(a, o, t, {}, $s(s, i)), u = await ut(h, n), m = bs(u, a, n);
     if (m.settle === "reject")
       throw m.error;
     return m.value;
   };
-}, Rs = (r, e) => {
+}, Ns = (r, e) => {
   const t = B.create(r);
   return e(t), t;
-}, ti = 10, Fs = 20;
-class Ms extends Error {
+}, ui = 10, Vs = 20;
+class Ks extends Error {
   constructor(e) {
     super(
       `Passflow fetch middleware '${e}' resolved without calling next(). Every registered middleware must delegate exactly once; swallowing a request would drop a caller's fetch inside the Passflow wrapper.`
     ), this.name = "FetchMiddlewareContractError", this.middlewareName = e;
   }
 }
-let x = [], Ps = 0, H = !1, V, L;
-const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof globalThis > "u" ? void 0 : globalThis, ge = async (r, e, t, s) => {
+let O = [], Bs = 0, z = !1, K, $;
+const Tt = (r, e) => r.priority - e.priority || r.seq - e.seq, _e = () => typeof globalThis > "u" ? void 0 : globalThis, we = async (r, e, t, s) => {
   if (e >= r.length) {
-    const h = V;
+    const h = K;
     if (!h)
       throw new Error("Passflow fetch registry: no captured fetch to delegate to.");
     return h(t, s);
   }
   const i = r[e];
   if (!i)
-    return ge(r, r.length, t, s);
+    return we(r, r.length, t, s);
   let n = !1;
-  const o = (h, p) => (n = !0, ge(r, e + 1, h, p)), a = await i.middleware(o, t, s);
+  const o = (h, u) => (n = !0, we(r, e + 1, h, u)), a = await i.middleware(o, t, s);
   if (!n)
-    throw new Ms(i.name);
+    throw new Ks(i.name);
   return a;
-}, Us = () => {
-  const r = ke();
+}, Gs = () => {
+  const r = _e();
   if (!r || typeof r.fetch != "function")
     return !1;
-  const e = r.fetch.bind(r), t = (s, i) => ge([...x].sort(gt), 0, s, i);
-  return V = e, L = t, r.fetch = t, H = !0, !0;
-}, Ds = () => {
-  const r = ke();
-  !r || !L || r.fetch === L && (V && (r.fetch = V), H = !1, L = void 0, V = void 0);
-}, xs = (r, e) => {
-  if (!H && !Us())
+  const e = r.fetch.bind(r), t = (s, i) => we([...O].sort(Tt), 0, s, i);
+  return K = e, $ = t, r.fetch = t, z = !0, !0;
+}, js = () => {
+  const r = _e();
+  !r || !$ || r.fetch === $ && (K && (r.fetch = K), z = !1, $ = void 0, K = void 0);
+}, Hs = (r, e) => {
+  if (!z && !Gs())
     return () => {
     };
   const t = {
     middleware: r,
     name: e.name,
     priority: e.priority,
-    seq: Ps++
+    seq: Bs++
   };
-  x.push(t);
+  O.push(t);
   let s = !1;
   return () => {
-    s || (s = !0, x = x.filter((i) => i !== t), x.length === 0 && Ds());
+    s || (s = !0, O = O.filter((i) => i !== t), O.length === 0 && js());
   };
-}, ri = () => {
-  const r = ke();
+}, pi = () => {
+  const r = _e();
   return {
-    installed: H,
-    names: [...x].sort(gt).map((e) => e.name),
-    foreignPatch: H && !!r && !!L && r.fetch !== L
+    installed: z,
+    names: [...O].sort(Tt).map((e) => e.name),
+    foreignPatch: z && !!r && !!$ && r.fetch !== $
   };
-}, Os = (r) => r === void 0 ? [] : (Array.isArray(r) ? r : [r]).filter((e) => e !== ""), Ls = (r) => {
+}, zs = (r) => r === void 0 ? [] : (Array.isArray(r) ? r : [r]).filter((e) => e !== ""), Ys = (r) => {
   let e;
   const t = (d) => d !== void 0 && e === d, s = (d) => {
     const g = () => {
       if (!t(d()))
         throw new _({ kind: "session_changed" });
     };
-    return es({
+    return ls({
       ...r,
       relyingPartyId: () => e?.options.relyingPartyId ?? r.relyingPartyId?.(),
       startUpgrade: (f) => (g(), r.startUpgrade(f)),
@@ -4702,8 +4922,8 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       } : {}
     });
   }, i = (d, g) => {
-    const f = {}, u = {
-      controller: new Wr({
+    const f = {}, p = {
+      controller: new os({
         transport: s(() => f.current),
         prompt: d.prompt,
         platform: r.platform,
@@ -4713,10 +4933,10 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
         ...d.onFlightSettled ? { onFlightSettled: d.onFlightSettled } : {}
       }),
       options: d,
-      scope: { passflow: r.passflowDomain, backend: Os(d.backend) },
+      scope: { passflow: r.passflowDomain, backend: zs(d.backend) },
       generation: g
     };
-    return f.current = u, u;
+    return f.current = p, p;
   }, n = async (d, g) => {
     const f = e;
     if (!f)
@@ -4724,7 +4944,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
     f.controller.active || (f.pin = r.readSessionPin?.());
     const v = await f.controller.elevate(d, g);
     if (!t(f))
-      throw new $();
+      throw new q();
     return v;
   }, o = () => {
     const d = e, g = d?.scope ?? { passflow: r.passflowDomain, backend: [] }, f = d?.options;
@@ -4742,16 +4962,16 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
   };
   let a;
   return Object.defineProperties(async (d) => {
-    const g = d?.acrValues === void 0 ? void 0 : Q(d.acrValues).level, f = {
+    const g = d?.acrValues === void 0 ? void 0 : re(d.acrValues).level, f = {
       status: 401,
       ...d?.acrValues === void 0 ? {} : { acrValues: d.acrValues },
       ...g === void 0 ? {} : { requiredLevel: g },
       ...d?.maxAge === void 0 ? {} : { maxAge: d.maxAge }
-    }, v = d?.acrValues !== void 0 || d?.maxAge !== void 0, u = {
+    }, v = d?.acrValues !== void 0 || d?.maxAge !== void 0, p = {
       ...d?.acrValues === void 0 ? {} : { acrValues: d.acrValues },
       ...g === void 0 ? {} : { level: g },
       ...d?.maxAge === void 0 ? {} : { maxAge: d.maxAge }
-    }, I = (await n(f, { kind: "imperative", ...v ? { requested: u } : {} })).obtained.acrValues;
+    }, I = (await n(f, { kind: "imperative", ...v ? { requested: p } : {} })).obtained.acrValues;
     return { status: "elevated", ...I === void 0 ? {} : { acr: I } };
   }, {
     enable: { value: (d) => {
@@ -4759,11 +4979,11 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       const g = [];
       if (r.attachInternalSeam) {
         const v = r.attachInternalSeam;
-        v((u) => pt(o, u)), g.push(() => v(void 0));
+        v((p) => St(o, p)), g.push(() => v(void 0));
       }
       d.interceptFetch && g.push(
-        xs((v, u, y) => he(v, o)(u, y), {
-          priority: Fs,
+        Hs((v, p, y) => pe(v, o)(p, y), {
+          priority: Vs,
           name: "passflow-upgrade"
         })
       ), r.onSessionChange && g.push(
@@ -4796,19 +5016,19 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       enumerable: !0,
       value: (d) => {
         if (d)
-          return he(d, o);
+          return pe(d, o);
         const g = typeof globalThis > "u" ? void 0 : globalThis;
         if (!g || typeof g.fetch != "function")
           throw new Error("Passflow: withAuth() needs a fetch to wrap — this runtime has none.");
-        return he(g.fetch.bind(g), o);
+        return pe(g.fetch.bind(g), o);
       }
     },
     attachAuth: {
       enumerable: !0,
-      value: (d) => Is(d, o)
+      value: (d) => Ls(d, o)
     }
   });
-}, we = class we {
+}, Ee = class Ee {
   constructor(e) {
     this.doRefreshTokens = !1, this.session = async ({
       createSession: n,
@@ -4818,10 +5038,10 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       this.createSessionCallback = n, this.expiredSessionCallback = o, this.doRefreshTokens = a, await this.submitSessionCheck();
     };
     const { url: t, appId: s, scopes: i } = e;
-    this.url = t || De, this.appId = s, this.platform = e.platform ?? z, this.storageManager = new me({
+    this.url = t || qe, this.appId = s, this.platform = e.platform ?? Y, this.storageManager = new Se({
       prefix: e.keyStoragePrefix ?? "",
       storage: this.platform.storage
-    }), this.deviceService = new $e(this.storageManager), this.authApi = new rr(e, this.storageManager, this.deviceService), this.appApi = new tr(e, this.storageManager, this.deviceService), this.userApi = new cr(e, this.storageManager, this.deviceService), this.settingApi = new ir(e, this.storageManager, this.deviceService), this.tenantApi = new nr(e, this.storageManager, this.deviceService), this.invitationApi = new sr(e, this.storageManager, this.deviceService), this.twoFactorApi = new or(e, this.storageManager, this.deviceService), this.upgradeApi = new ar(e, this.storageManager, this.deviceService), this.upgradeDomain = Ye(e.url), this.subscribeStore = new hr(), this.tokenCacheService = new Pr(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = i ?? _t, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ir(
+    }), this.deviceService = new Be(this.storageManager), this.authApi = new dr(e, this.storageManager, this.deviceService), this.appApi = new hr(e, this.storageManager, this.deviceService), this.userApi = new vr(e, this.storageManager, this.deviceService), this.settingApi = new ur(e, this.storageManager, this.deviceService), this.tenantApi = new pr(e, this.storageManager, this.deviceService), this.invitationApi = new lr(e, this.storageManager, this.deviceService), this.twoFactorApi = new fr(e, this.storageManager, this.deviceService), this.upgradeApi = new gr(e, this.storageManager, this.deviceService), this.upgradeDomain = Qe(e.url), this.subscribeStore = new wr(), this.tokenCacheService = new Br(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = i ?? Mt, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new qr(
       this.authApi,
       this.deviceService,
       this.storageManager,
@@ -4836,8 +5056,9 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       },
       this.appId ?? "",
       e.tokenExchange,
-      this.platform
-    ), this.userService = new Dr(this.userApi, this.deviceService, this.platform), this.tenantService = new Mr(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Ar(this.invitationApi), this.twoFactorService = new Ur(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, this.upgrade = Ls({
+      this.platform,
+      () => this.readPkceEnabled()
+    ), this.userService = new jr(this.userApi, this.deviceService, this.platform), this.tenantService = new Kr(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Nr(this.invitationApi), this.twoFactorService = new Gr(this.twoFactorApi, this.subscribeStore, this.authService), this.twoFactor = this.twoFactorService, this.upgrade = Ys({
       // The prepare round. The commit round is `/auth/refresh`, which must go
       // through AuthService: it is the only path that STORES the rotated tokens,
       // so posting directly would elevate the session on the server and leave
@@ -4872,6 +5093,22 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
   get origin() {
     return this.platform.getCurrentUrl()?.origin ?? "";
   }
+  /**
+   * Whether the current app wants PKCE. A sign-in asks before a passkey ceremony,
+   * where a round-trip eats into the browser's user-gesture window, so the answer
+   * is kept for the appId. A failed read is not kept: the next sign-in asks again.
+   */
+  readPkceEnabled() {
+    if (!this.appId)
+      return Promise.resolve(!1);
+    if (!this.pkceEnabledRead) {
+      const e = this.appApi.getAppSettings().then((t) => t.pkce_enabled);
+      this.pkceEnabledRead = e, e.catch(() => {
+        this.pkceEnabledRead === e && (this.pkceEnabledRead = void 0);
+      });
+    }
+    return this.pkceEnabledRead;
+  }
   /**
    * Update the appId and propagate it to all API clients.
    * This ensures that all future API requests use the new appId in their headers.
@@ -4885,7 +5122,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * ```
    */
   setAppId(e) {
-    this.appId = e, this.authApi.setAppId(e), this.appApi.setAppId(e), this.userApi.setAppId(e), this.settingApi.setAppId(e), this.tenantApi.setAppId(e), this.invitationApi.setAppId(e), this.twoFactorApi.setAppId(e), this.upgradeApi.setAppId(e), this.authService;
+    this.appId = e, this.pkceEnabledRead = void 0, this.authApi.setAppId(e), this.appApi.setAppId(e), this.userApi.setAppId(e), this.settingApi.setAppId(e), this.tenantApi.setAppId(e), this.invitationApi.setAppId(e), this.twoFactorApi.setAppId(e), this.upgradeApi.setAppId(e), this.authService;
   }
   /**
    * Wraps a `fetch`, returning a new function with step-up handling attached.
@@ -4945,7 +5182,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * ```
    */
   createClient(e) {
-    return Rs(e, (t) => this.upgrade.attachAuth(t));
+    return Ns(e, (t) => this.upgrade.attachAuth(t));
   }
   /**
    * The assurance bar the session currently holds, read from the `acr` claim of
@@ -4962,7 +5199,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
         const t = T(e), s = typeof t.acr == "string" ? t.acr : void 0;
         if (!s)
           return;
-        const i = Q(s).level;
+        const i = re(s).level;
         return i === void 0 ? { acrValues: s } : { acrValues: s, level: i };
       } catch {
         return;
@@ -5101,34 +5338,38 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
     const e = this.platform.getCurrentUrl();
     let t = new URLSearchParams(e?.search ?? ""), s = !1;
     if (!t.get("access_token") && e?.hash) {
-      const p = new URLSearchParams(e.hash.substring(1));
-      p.get("access_token") && (t = p, s = !0);
+      const u = new URLSearchParams(e.hash.substring(1));
+      u.get("access_token") && (t = u, s = !0);
+    }
+    if (!t.get("access_token") && this.adoptTwoFactorTokenFromUrl(e)) {
+      this.error = void 0;
+      return;
     }
     const i = t.get("access_token"), n = t.get("refresh_token"), o = t.get("id_token"), a = t.get("scopes")?.split(",") ?? this.scopes;
     let h;
     if (i) {
-      if (!re(i)) {
-        const p = {
+      if (!J(i)) {
+        const u = {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(c.Error, p), this.cleanupUrlParams(s, e);
+        this.subscribeStore.notify(c.Error, u), this.cleanupUrlParams(s, e);
         return;
       }
-      if (n && !re(n)) {
-        const p = {
+      if (n && !J(n)) {
+        const u = {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(c.Error, p), this.cleanupUrlParams(s, e);
+        this.subscribeStore.notify(c.Error, u), this.cleanupUrlParams(s, e);
         return;
       }
-      if (o && !re(o)) {
-        const p = {
+      if (o && !J(o)) {
+        const u = {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(c.Error, p), this.cleanupUrlParams(s, e);
+        this.subscribeStore.notify(c.Error, u), this.cleanupUrlParams(s, e);
         return;
       }
       return h = {
@@ -5140,10 +5381,32 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
     } else
       this.error = this.checkErrorsFromURL();
   }
+  /**
+   * Adopts a `#tfa_token=` fragment: the 2FA token goes to the TwoFactorService
+   * through `TwoFactorRequired`, exactly as a password sign-in's does, and the
+   * fragment is stripped from the URL. Nothing is saved as a session.
+   *
+   * @returns true when the URL carried a 2FA token
+   */
+  adoptTwoFactorTokenFromUrl(e) {
+    if (!e?.hash) return !1;
+    const t = new URLSearchParams(e.hash.substring(1)), s = t.get("tfa_token");
+    if (!s) return !1;
+    t.delete("tfa_token");
+    const i = t.toString();
+    if (this.platform.replaceUrl(e.pathname + e.search + (i ? `#${i}` : "")), !J(s)) {
+      const n = {
+        message: "Invalid 2FA token format received",
+        code: "INVALID_TOKEN_FORMAT"
+      };
+      return this.subscribeStore.notify(c.Error, n), !0;
+    }
+    return this.subscribeStore.notify(c.TwoFactorRequired, { email: "", challengeId: "", tfaToken: s }), !0;
+  }
   checkErrorsFromURL() {
     const t = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("error");
     if (t) {
-      const s = Tr(t);
+      const s = Dr(t);
       return new Error(s);
     }
   }
@@ -5846,7 +6109,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
   async joinInvitation(e, t) {
     try {
       const s = await this.tenant.joinInvitation(e, t);
-      return s.scopes = t ?? this.scopes, this.storageManager.saveTokens(s), this.tokenCacheService.setTokensCache(s), s;
+      return s.scopes = t ?? this.scopes, await this.authService.applyTokens(s), s;
     } catch (s) {
       this.handleError(s, "Join invitation");
     }
@@ -6123,6 +6386,8 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * Completes the authentication process and saves tokens.
    *
    * @param code - 6-digit TOTP code from authenticator app
+   * @param options - `trustDevice: true` asks the server to trust this device,
+   *   so later sign-ins from it skip the second factor where the app allows it
    * @returns Promise with verification response containing tokens
    * @throws {PassflowError} If verification fails
    *
@@ -6130,20 +6395,20 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * ```typescript
    * // After signIn returns requires_2fa: true
    * if (passflow.isTwoFactorVerificationRequired()) {
-   *   const response = await passflow.verifyTwoFactor('123456');
+   *   const response = await passflow.verifyTwoFactor('123456', { trustDevice: true });
    *   console.log('Authentication complete', response.access_token);
    * }
    * ```
    */
-  async verifyTwoFactor(e) {
+  async verifyTwoFactor(e, t) {
     try {
-      const t = await this.twoFactorService.verify(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(c.SignIn, {
-        tokens: t,
+      const s = await this.twoFactorService.verify(e, t);
+      return this.subscribeStore.notify(c.SignIn, {
+        tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), t;
-    } catch (t) {
-      this.handleError(t, "Verify 2FA");
+      }), await this.submitSessionCheck(), s;
+    } catch (s) {
+      this.handleError(s, "Verify 2FA");
     }
   }
   /**
@@ -6151,6 +6416,7 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * Completes the authentication process and saves tokens.
    *
    * @param code - Recovery code from the list provided during setup
+   * @param options - `trustDevice: true` asks the server to trust this device
    * @returns Promise with recovery response containing tokens and remaining codes count
    * @throws {PassflowError} If recovery code is invalid
    *
@@ -6162,15 +6428,15 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
    * console.log(`${result.remaining_recovery_codes} recovery codes remaining`);
    * ```
    */
-  async useTwoFactorRecoveryCode(e) {
+  async useTwoFactorRecoveryCode(e, t) {
     try {
-      const t = await this.twoFactorService.useRecoveryCode(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(c.SignIn, {
-        tokens: t,
+      const s = await this.twoFactorService.useRecoveryCode(e, t);
+      return this.subscribeStore.notify(c.SignIn, {
+        tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), t;
-    } catch (t) {
-      this.handleError(t, "Use 2FA recovery code");
+      }), await this.submitSessionCheck(), s;
+    } catch (s) {
+      this.handleError(s, "Use 2FA recovery code");
     }
   }
   /**
@@ -6216,6 +6482,45 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
       this.handleError(t, "Regenerate 2FA recovery codes");
     }
   }
+  /**
+   * List the devices the signed-in user trusted to skip the second factor on
+   * this app. The device making the request has `current: true`.
+   *
+   * @returns Promise with the trusted devices
+   * @throws {PassflowError} If the request fails
+   *
+   * @example
+   * ```typescript
+   * const devices = await passflow.getTrustedDevices();
+   * devices.forEach((d) => console.log(d.user_agent, d.current ? '(this device)' : ''));
+   * ```
+   */
+  async getTrustedDevices() {
+    try {
+      return await this.twoFactorService.getTrustedDevices();
+    } catch (e) {
+      this.handleError(e, "Get trusted devices");
+    }
+  }
+  /**
+   * Revoke one of the signed-in user's trusted devices. Its next sign-in
+   * asks for the second factor again.
+   *
+   * @param id - The trusted device's `id` from `getTrustedDevices()`
+   * @throws {PassflowError} If the request fails, including a 404 for an unknown id
+   *
+   * @example
+   * ```typescript
+   * await passflow.revokeTrustedDevice(device.id);
+   * ```
+   */
+  async revokeTrustedDevice(e) {
+    try {
+      await this.twoFactorService.revokeTrustedDevice(e);
+    } catch (t) {
+      this.handleError(t, "Revoke trusted device");
+    }
+  }
   /**
    * Check if 2FA verification is currently required (local state check).
    * Returns true if user has signed in but needs to complete 2FA verification.
@@ -6327,8 +6632,8 @@ const gt = (r, e) => r.priority - e.priority || r.seq - e.seq, ke = () => typeof
     this.twoFactorService.clearMagicLinkSession();
   }
 };
-we.version = Tt;
-let Pe = we;
+Ee.version = Ft;
+let Le = Ee;
 class S extends Error {
   constructor(e) {
     super(e.message), this.name = "M2MError", this.code = e.code, this.status = e.status ?? 400, this.errorUri = e.errorUri, this.rateLimitInfo = e.rateLimitInfo, this.headers = e.headers, this.cause = e.cause, this.timestamp = (/* @__PURE__ */ new Date()).toISOString(), Error.captureStackTrace && Error.captureStackTrace(this, S);
@@ -6424,7 +6729,7 @@ class S extends Error {
     return this.status && (e += ` (HTTP ${this.status})`), e;
   }
 }
-class Ue extends S {
+class $e extends S {
   constructor(e, t) {
     super({
       code: "temporarily_unavailable",
@@ -6434,7 +6739,7 @@ class Ue extends S {
     }), this.name = "M2MNetworkError";
   }
 }
-class X extends S {
+class Q extends S {
   constructor(e, t) {
     super({
       code: "invalid_request",
@@ -6444,7 +6749,7 @@ class X extends S {
     }), this.name = "M2MTokenParseError";
   }
 }
-class de extends S {
+class fe extends S {
   constructor(e) {
     super({
       code: "invalid_request",
@@ -6453,7 +6758,7 @@ class de extends S {
     }), this.name = "M2MConfigError";
   }
 }
-const si = {
+const fi = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -6477,7 +6782,7 @@ const si = {
   /** Content-Type for token requests */
   CONTENT_TYPE: "application/x-www-form-urlencoded"
 };
-class $s {
+class Ws {
   constructor() {
     this.cache = /* @__PURE__ */ new Map();
   }
@@ -6495,7 +6800,7 @@ class $s {
     return this.cache.delete(e), Promise.resolve();
   }
 }
-const qs = {
+const Xs = {
   shouldRetry(r, e) {
     return e >= 3 ? !1 : r.code === "server_error" || r.code === "temporarily_unavailable" || r.code === "rate_limit_exceeded" || r.status !== void 0 && r.status >= 500;
   },
@@ -6503,7 +6808,7 @@ const qs = {
     return Math.pow(2, r - 1) * 1e3;
   }
 };
-class ii {
+class gi {
   /**
    * Create a new M2M client
    *
@@ -6521,11 +6826,11 @@ class ii {
    */
   constructor(e) {
     if (!e.url)
-      throw new de("M2M client requires a URL");
+      throw new fe("M2M client requires a URL");
     if (!e.clientId)
-      throw new de("M2M client requires a clientId");
+      throw new fe("M2M client requires a clientId");
     if (!e.clientSecret)
-      throw new de("M2M client requires a clientSecret");
+      throw new fe("M2M client requires a clientSecret");
     const t = e.url.replace(/\/$/, "");
     this.config = {
       url: t,
@@ -6543,7 +6848,7 @@ class ii {
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new $s(), this.retryStrategy = e.retryStrategy ?? qs, this.tokenEndpoint = `${t}${R.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new Ws(), this.retryStrategy = e.retryStrategy ?? Xs, this.tokenEndpoint = `${t}${R.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
@@ -6642,8 +6947,8 @@ class ii {
       });
       clearTimeout(i);
       const o = {};
-      n.headers.forEach((h, p) => {
-        o[p.toLowerCase()] = h;
+      n.headers.forEach((h, u) => {
+        o[u.toLowerCase()] = h;
       });
       const a = await n.json();
       if (!n.ok) {
@@ -6663,7 +6968,7 @@ class ii {
       }
       return a;
     } catch (n) {
-      throw clearTimeout(i), n instanceof Error && n.name === "AbortError" ? new Ue(`Request timed out after ${this.config.timeout}ms`) : n instanceof TypeError && n.message.includes("fetch") ? new Ue(`Network error: ${n.message}`, n) : n instanceof S ? n : S.fromError(n instanceof Error ? n : new Error(String(n)));
+      throw clearTimeout(i), n instanceof Error && n.name === "AbortError" ? new $e(`Request timed out after ${this.config.timeout}ms`) : n instanceof TypeError && n.message.includes("fetch") ? new $e(`Network error: ${n.message}`, n) : n instanceof S ? n : S.fromError(n instanceof Error ? n : new Error(String(n)));
     }
   }
   /**
@@ -6758,14 +7063,14 @@ class ii {
     try {
       const t = e.split(".");
       if (t.length !== 3)
-        throw new X("Invalid JWT format: expected 3 parts");
+        throw new Q("Invalid JWT format: expected 3 parts");
       const s = t[1];
       if (!s)
-        throw new X("Invalid JWT format: missing payload");
+        throw new Q("Invalid JWT format: missing payload");
       const i = atob(s.replace(/-/g, "+").replace(/_/g, "/")), n = JSON.parse(i);
       return n.scopes && typeof n.scopes == "string" ? n.scopes = n.scopes.split(" ") : n.scopes || (n.scopes = []), n;
     } catch (t) {
-      throw t instanceof X ? t : new X(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
+      throw t instanceof Q ? t : new Q(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
     }
   }
   /**
@@ -6851,110 +7156,110 @@ class ii {
   }
 }
 export {
-  N as APP_ID_HEADER_KEY,
-  U as AUTHORIZATION_HEADER_KEY,
-  tr as AppAPI,
-  rr as AuthAPI,
-  Ir as AuthService,
-  Hs as CLIAuthAPI,
-  js as DEFAULT_GROUP_NAME,
-  _t as DEFAULT_SCOPES,
-  ye as DEFAULT_UPGRADE_FACTORS,
-  St as DEVICE_ID_HEADER_KEY,
-  bt as DEVICE_TYPE_HEADER_KEY,
-  Mt as ERROR_MESSAGE_MAX_LENGTH,
-  ti as FETCH_PRIORITY_OIDC,
-  Fs as FETCH_PRIORITY_UPGRADE,
-  Ms as FetchMiddlewareContractError,
-  qt as INSUFFICIENT_USER_AUTHENTICATION,
-  sr as InvitationAPI,
-  Ar as InvitationService,
-  ii as M2MClient,
-  de as M2MConfigError,
+  V as APP_ID_HEADER_KEY,
+  D as AUTHORIZATION_HEADER_KEY,
+  hr as AppAPI,
+  dr as AuthAPI,
+  qr as AuthService,
+  si as CLIAuthAPI,
+  ti as DEFAULT_GROUP_NAME,
+  Mt as DEFAULT_SCOPES,
+  Te as DEFAULT_UPGRADE_FACTORS,
+  Rt as DEVICE_ID_HEADER_KEY,
+  Pt as DEVICE_TYPE_HEADER_KEY,
+  qt as ERROR_MESSAGE_MAX_LENGTH,
+  ui as FETCH_PRIORITY_OIDC,
+  Vs as FETCH_PRIORITY_UPGRADE,
+  Ks as FetchMiddlewareContractError,
+  zt as INSUFFICIENT_USER_AUTHENTICATION,
+  lr as InvitationAPI,
+  Nr as InvitationService,
+  gi as M2MClient,
+  fe as M2MConfigError,
   S as M2MError,
-  si as M2MErrorCodes,
-  Ue as M2MNetworkError,
-  X as M2MTokenParseError,
+  fi as M2MErrorCodes,
+  $e as M2MNetworkError,
+  Q as M2MTokenParseError,
   R as M2M_DEFAULTS,
-  Ks as MINIMAL_DEFAULT_SCOPES,
-  Wt as OS,
-  De as PASSFLOW_CLOUD_URL,
-  It as POPUP_HEIGHT,
-  At as POPUP_POLL_INTERVAL_MS,
-  Ct as POPUP_TIMEOUT_MS,
-  Et as POPUP_WIDTH,
-  Pe as Passflow,
-  F as PassflowAdminEndpointPaths,
+  ei as MINIMAL_DEFAULT_SCOPES,
+  sr as OS,
+  qe as PASSFLOW_CLOUD_URL,
+  Dt as POPUP_HEIGHT,
+  xt as POPUP_POLL_INTERVAL_MS,
+  Ot as POPUP_TIMEOUT_MS,
+  Ut as POPUP_WIDTH,
+  Le as Passflow,
+  P as PassflowAdminEndpointPaths,
   l as PassflowEndpointPaths,
   w as PassflowError,
   c as PassflowEvent,
-  qe as PopupClosedError,
-  Yt as Providers,
-  dr as RECOVERABLE_COMMIT_ERROR_IDS,
-  P as RequestMethod,
-  Tt as SDK_VERSION,
-  lr as SESSION_INVALIDATING_COMMIT_ERROR_IDS,
-  Oe as SessionState,
-  ir as SettingAPI,
-  xe as TOKEN_EXPIRY_BUFFER_SECONDS,
-  nr as TenantAPI,
-  Mr as TenantService,
-  Fr as TenantUserMembership,
-  Pr as TokenCacheService,
+  Ge as PopupClosedError,
+  rr as Providers,
+  Sr as RECOVERABLE_COMMIT_ERROR_IDS,
+  U as RequestMethod,
+  Ft as SDK_VERSION,
+  br as SESSION_INVALIDATING_COMMIT_ERROR_IDS,
+  Ve as SessionState,
+  ur as SettingAPI,
+  Ne as TOKEN_EXPIRY_BUFFER_SECONDS,
+  pr as TenantAPI,
+  Kr as TenantService,
+  Vr as TenantUserMembership,
+  Br as TokenCacheService,
   A as TokenDeliveryMode,
   b as TokenType,
-  or as TwoFactorApiClient,
-  Xt as TwoFactorPolicy,
-  Ur as TwoFactorService,
-  Nt as UPGRADE_REQUIRED,
-  Ft as USERNAME_MAX_LENGTH,
-  Rt as USERNAME_MIN_LENGTH,
-  ar as UpgradeAPI,
-  O as UpgradeCancelledError,
-  Wr as UpgradeController,
+  fr as TwoFactorApiClient,
+  ir as TwoFactorPolicy,
+  Gr as TwoFactorService,
+  Yt as UPGRADE_REQUIRED,
+  $t as USERNAME_MAX_LENGTH,
+  Lt as USERNAME_MIN_LENGTH,
+  gr as UpgradeAPI,
+  L as UpgradeCancelledError,
+  os as UpgradeController,
   k as UpgradeErrorIds,
-  D as UpgradeFactorError,
-  K as UpgradeInsufficientError,
-  $ as UpgradeSessionChangedError,
+  x as UpgradeFactorError,
+  G as UpgradeInsufficientError,
+  q as UpgradeSessionChangedError,
   _ as UpgradeTransportError,
   j as UpgradeUnavailableError,
-  Z as UpgradeUnsatisfiableError,
-  cr as UserAPI,
-  Dr as UserService,
-  xt as WebAdapter,
-  Ee as classifyUpgradeError,
-  $r as factorRegistry,
-  ri as fetchRegistryState,
-  Gs as getOSFromDeviceType,
-  wr as invalidatesSessionOnCommit,
-  zs as isRecoverableCommitFailure,
-  pr as isRetryableUpgradeKind,
+  te as UpgradeUnsatisfiableError,
+  vr as UserAPI,
+  jr as UserService,
+  Bt as WebAdapter,
+  Pe as classifyUpgradeError,
+  Wr as factorRegistry,
+  pi as fetchRegistryState,
+  ri as getOSFromDeviceType,
+  Fr as invalidatesSessionOnCommit,
+  ii as isRecoverableCommitFailure,
+  _r as isRetryableUpgradeKind,
   C as isTokenExpired,
-  Ys as isUpgradeCancelled,
-  Ws as isUpgradeExhausted,
-  Xs as isUpgradeInsufficient,
-  Qs as isUpgradeSessionChanged,
-  mr as isUpgradeTransportError,
-  ei as isUpgradeTransportFailure,
-  Zs as isUpgradeUnavailable,
-  Js as isUpgradeUnsatisfiable,
-  se as isValidEmail,
-  re as isValidJWTFormat,
-  ie as isValidPhoneNumber,
-  _r as isValidUsername,
-  Kt as parseChallengeBody,
-  Bt as parseChallengeHeader,
+  ni as isUpgradeCancelled,
+  oi as isUpgradeExhausted,
+  ai as isUpgradeInsufficient,
+  di as isUpgradeSessionChanged,
+  Ar as isUpgradeTransportError,
+  li as isUpgradeTransportFailure,
+  hi as isUpgradeUnavailable,
+  ci as isUpgradeUnsatisfiable,
+  oe as isValidEmail,
+  J as isValidJWTFormat,
+  ae as isValidPhoneNumber,
+  xr as isValidUsername,
+  Jt as parseChallengeBody,
+  Xt as parseChallengeHeader,
   T as parseToken,
-  Gt as parseUpgradeChallenge,
-  Lr as passkeyFactor,
-  M as pathWithParams,
-  Or as recoveryCodesFactor,
-  xs as registerFetchMiddleware,
-  $t as requiredAcrLevel,
-  Ye as resolveUpgradeDomain,
-  Tr as sanitizeErrorMessage,
-  Br as selectFactors,
-  xr as totpFactor,
-  z as webAdapter
+  Qt as parseUpgradeChallenge,
+  Yr as passkeyFactor,
+  F as pathWithParams,
+  zr as recoveryCodesFactor,
+  Hs as registerFetchMiddleware,
+  Ht as requiredAcrLevel,
+  Qe as resolveUpgradeDomain,
+  Dr as sanitizeErrorMessage,
+  Qr as selectFactors,
+  Hr as totpFactor,
+  Y as webAdapter
 };
 //# sourceMappingURL=index.mjs.map