@passflow/core 0.18.0 → 0.19.0

package/dist/index.mjs

@@ -1,9 +1,9 @@
-import K from "axios";
-import { v4 as kt } from "uuid";
-import { startAuthentication as wt, startRegistration as St } from "@simplewebauthn/browser";
-const bt = "0.18.0", Tt = {
-  version: bt
-}, V = "X-Passflow-Clientid", D = "Authorization", _t = "X-Passflow-DeviceId", Et = "X-Passflow-DeviceType", It = Tt.version, Hs = ["id", "offline", "openid"], At = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], Le = "https://auth.passflow.cloud", zs = "default", Ct = 500, Rt = 600, Ft = 100, Pt = 6e4, $e = 30, Mt = 3, Dt = 30, Ut = 200, xt = (r) => {
+import B from "axios";
+import { v4 as _t } from "uuid";
+import { startAuthentication as Et, startRegistration as It } from "@simplewebauthn/browser";
+const At = "0.19.0", Ct = {
+  version: At
+}, V = "X-Passflow-Clientid", D = "Authorization", Rt = "X-Passflow-DeviceId", Pt = "X-Passflow-DeviceType", Ft = Ct.version, ei = ["id", "offline", "openid"], Mt = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], qe = "https://auth.passflow.cloud", ti = "default", Ut = 500, Dt = 600, xt = 100, Ot = 6e4, Ne = 30, Lt = 3, $t = 30, qt = 200, Nt = (r) => {
   const e = [];
   let t;
   for (t in r) {
@@ -18,14 +18,14 @@ const bt = "0.18.0", Tt = {
   }
   return { raw: r, tenants: e };
 };
-function Ot(r) {
+function Vt(r) {
   if (typeof window < "u" && typeof window.atob == "function")
     return window.atob(r);
   if (typeof Buffer < "u")
     return Buffer.from(r, "base64").toString("utf-8");
   throw new Error("No Base64 decoding method available in this environment");
 }
-class Lt {
+class Kt {
   constructor(e) {
     this.storageManager = e;
   }
@@ -54,19 +54,19 @@ class Lt {
       return T(t);
   }
 }
-function C(r, e = $e) {
+function C(r, e = Ne) {
   return Math.floor(Date.now() / 1e3) + e > r.exp;
 }
 function T(r) {
   const e = r.split(".")[1];
   if (!e) throw new Error("Invalid token string");
-  const t = e.replace(/-/g, "+").replace(/_/g, "/"), s = t + "=".repeat((4 - t.length % 4) % 4), i = Ot(s), n = decodeURIComponent(
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), s = t + "=".repeat((4 - t.length % 4) % 4), i = Vt(s), n = decodeURIComponent(
     i.split("").map((a) => "%" + ("00" + a.charCodeAt(0).toString(16)).slice(-2)).join("")
   ), o = JSON.parse(n);
-  return o.membership = o.passflow_tm && o.type !== "invite" ? xt(o.passflow_tm) : void 0, o;
+  return o.membership = o.passflow_tm && o.type !== "invite" ? Nt(o.passflow_tm) : void 0, o;
 }
-var b = /* @__PURE__ */ ((r) => (r.id_token = "id_token", r.access_token = "access", r.refresh_token = "refresh", r.invite_token = "invite", r.reset_token = "reset", r.web_cookie = "web-cookie", r.management = "management", r.signin = "signin", r.actor = "actor", r.two_factor = "2fa", r))(b || {}), A = /* @__PURE__ */ ((r) => (r.JsonBody = "json_body", r.Cookie = "cookie", r.Mobile = "mobile", r.BFF = "bff", r))(A || {}), qe = /* @__PURE__ */ ((r) => (r.Unknown = "unknown", r.Valid = "valid", r.Invalid = "invalid", r))(qe || {});
-class Ne {
+var b = /* @__PURE__ */ ((r) => (r.id_token = "id_token", r.access_token = "access", r.refresh_token = "refresh", r.invite_token = "invite", r.reset_token = "reset", r.web_cookie = "web-cookie", r.management = "management", r.signin = "signin", r.actor = "actor", r.two_factor = "2fa", r))(b || {}), A = /* @__PURE__ */ ((r) => (r.JsonBody = "json_body", r.Cookie = "cookie", r.Mobile = "mobile", r.BFF = "bff", r))(A || {}), Ve = /* @__PURE__ */ ((r) => (r.Unknown = "unknown", r.Valid = "valid", r.Invalid = "invalid", r))(Ve || {});
+class Ke {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
   }
@@ -176,7 +176,7 @@ class Ne {
   loadPersistedSessionState() {
     try {
       const e = this.storageManager.storage.getItem(this.SESSION_STATE_KEY);
-      e && Object.values(qe).includes(e) && (this.sessionState = e);
+      e && Object.values(Ve).includes(e) && (this.sessionState = e);
     } catch {
     }
   }
@@ -217,7 +217,7 @@ class Ne {
     }
   }
 }
-class ke {
+class Se {
   constructor({ storage: e, prefix: t } = {}) {
     this.keyStoragePrefix = "", this.scopes = `${this.keyStoragePrefix}tokens_scopes`, this.deviceId = `${this.keyStoragePrefix}passflowDeviceId`, this.invitationToken = `${this.keyStoragePrefix}passflowInvitationToken`, this.previousRedirectUrl = `${this.keyStoragePrefix}passflowPreviousRedirectUrl`, this.STORAGE_PREFIX = "passflow_", this.ID_TOKEN_KEY = `${this.STORAGE_PREFIX}id_token`, this.CSRF_TOKEN_KEY = `${this.STORAGE_PREFIX}csrf_token`, this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.storage = e ?? localStorage, this.keyStoragePrefix = t ? `${t}_` : "";
   }
@@ -400,9 +400,9 @@ class ke {
     return `${this.keyStoragePrefix}${e}`;
   }
 }
-class Ve {
+class Be {
   constructor(e) {
-    this.storageManager = e ?? new ke();
+    this.storageManager = e ?? new Se();
   }
   getDeviceId() {
     const e = this.storageManager.getDeviceId();
@@ -413,19 +413,19 @@ class Ve {
     return e;
   }
   generateUniqueDeviceId() {
-    return kt();
+    return _t();
   }
 }
-class Be extends Error {
+class Ge extends Error {
   constructor(e = "Authentication popup was closed") {
     super(e), this.name = "PopupClosedError";
   }
 }
-class $t {
+class Bt {
   constructor() {
     this.passkeys = {
-      startRegistration: (e) => St({ optionsJSON: e }),
-      startAuthentication: (e) => wt({ optionsJSON: e })
+      startRegistration: (e) => It({ optionsJSON: e }),
+      startAuthentication: (e) => Et({ optionsJSON: e })
     };
   }
   // ----------------------------------------------------------------
@@ -557,15 +557,15 @@ class $t {
           'openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.'
         )
       );
-    const i = t.width ?? Ct, n = t.height ?? Rt, o = t.expectedReturnOrigin ?? window.location.origin, a = window.open(e, "_blank", `width=${i},height=${n}`);
-    return a ? new Promise((h, p) => {
+    const i = t.width ?? Ut, n = t.height ?? Dt, o = t.expectedReturnOrigin ?? window.location.origin, a = window.open(e, "_blank", `width=${i},height=${n}`);
+    return a ? new Promise((h, u) => {
       const m = Date.now(), d = setInterval(() => {
         if (a.closed) {
-          clearInterval(d), p(new Be());
+          clearInterval(d), u(new Ge());
           return;
         }
-        if (Date.now() - m > Pt) {
-          clearInterval(d), a.close(), p(new Error("Authentication popup timed out"));
+        if (Date.now() - m > Ot) {
+          clearInterval(d), a.close(), u(new Error("Authentication popup timed out"));
           return;
         }
         try {
@@ -575,7 +575,7 @@ class $t {
           }
         } catch {
         }
-      }, Ft);
+      }, xt);
     }) : (window.location.href = e, new Promise(() => {
     }));
   }
@@ -633,94 +633,94 @@ class $t {
     return "web";
   }
 }
-const Y = new $t(), qt = /^[0-9]+$/, Ee = Object.freeze({ unorderable: !1, zero: !1 }), Nt = (r) => qt.test(r) ? Number.parseInt(r, 10) : void 0, te = (r) => {
+const Y = new Bt(), Gt = /^[0-9]+$/, Ae = Object.freeze({ unorderable: !1, zero: !1 }), jt = (r) => Gt.test(r) ? Number.parseInt(r, 10) : void 0, re = (r) => {
   if (!r)
-    return Ee;
+    return Ae;
   const e = r.split(/\s+/).filter((i) => i !== "");
   if (e.length === 0)
-    return Ee;
+    return Ae;
   const t = [];
   for (const i of e) {
-    const n = Nt(i);
+    const n = jt(i);
     n !== void 0 && t.push(n);
   }
   if (t.length === 0)
     return { raw: r, unorderable: !0, zero: !1 };
   const s = Math.min(...t);
   return s === 0 ? { raw: r, unorderable: !1, zero: !0 } : { level: s, raw: r, unorderable: !1, zero: !1 };
-}, Vt = (r) => te(r).level, Bt = "insufficient_user_authentication", Kt = "upgrade_required", Ie = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, jt = (r) => r.replace(/\\(.)/g, "$1"), Ke = (r) => {
+}, Ht = (r) => re(r).level, zt = "insufficient_user_authentication", Yt = "upgrade_required", Ce = /([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g, Wt = (r) => r.replace(/\\(.)/g, "$1"), je = (r) => {
   const e = {};
-  Ie.lastIndex = 0;
-  for (const t of r.matchAll(Ie)) {
+  Ce.lastIndex = 0;
+  for (const t of r.matchAll(Ce)) {
     const s = t[1];
     if (!s)
       continue;
     const i = t[2], n = t[3];
-    e[s.toLowerCase()] = i !== void 0 ? jt(i) : n ?? "";
+    e[s.toLowerCase()] = i !== void 0 ? Wt(i) : n ?? "";
   }
   return e;
-}, je = (r) => {
+}, He = (r) => {
   if (r == null || r === "")
     return { kind: "absent" };
   const e = typeof r == "number" ? r : Number.parseInt(String(r), 10);
   return Number.isFinite(e) && e > 0 ? { kind: "valid", value: e } : { kind: "invalid", raw: r };
-}, Ge = (r) => {
-  const e = je(r);
+}, ze = (r) => {
+  const e = He(r);
   return e.kind === "valid" ? e.value : void 0;
-}, Gt = (r, e) => {
+}, Xt = (r, e) => {
   if (!r || !/(^|[\s,])Bearer\b/i.test(r))
     return;
-  const t = Ke(r);
-  if (t.error === Bt)
+  const t = je(r);
+  if (t.error === zt)
     return {
       acrValues: t.acr_values || void 0,
-      maxAge: Ge(t.max_age),
+      maxAge: ze(t.max_age),
       status: e
     };
-}, Ht = (r, e) => {
+}, Jt = (r, e) => {
   if (!r || typeof r != "object")
     return;
   const t = r;
-  if (t.error === Kt)
+  if (t.error === Yt)
     return {
       acrValues: typeof t.acr_values == "string" && t.acr_values ? t.acr_values : void 0,
-      maxAge: Ge(t.max_age),
+      maxAge: ze(t.max_age),
       status: e
     };
-}, Ae = (r, e, t) => ({
+}, Re = (r, e, t) => ({
   channel: r,
-  acr: te(e.acrValues),
-  maxAge: je(t),
+  acr: re(e.acrValues),
+  maxAge: He(t),
   raw: e.acrValues
-}), zt = (r) => r ? Ke(r) : {}, we = (r, e) => {
+}), Zt = (r) => r ? je(r) : {}, be = (r, e) => {
   const { status: t } = r;
   if (t !== 401 && t !== 403)
     return { diagnostics: [] };
-  const s = e?.requireChallengeChannel === "header", i = r.getHeader("www-authenticate"), n = Gt(i, t), o = s ? void 0 : Ht(r.body, t), a = [], h = (u, y) => {
-    a.push({ status: t, url: "", reason: u, ...y ? { detail: y } : {} });
+  const s = e?.requireChallengeChannel === "header", i = r.getHeader("www-authenticate"), n = Xt(i, t), o = s ? void 0 : Jt(r.body, t), a = [], h = (p, y) => {
+    a.push({ status: t, url: "", reason: p, ...y ? { detail: y } : {} });
   };
   if (!n && !o)
     return s && h("header-required-but-absent", i ? { header: i } : void 0), { diagnostics: a };
-  const p = [];
-  if (n && p.push(Ae("header", n, zt(i).max_age)), o) {
-    const u = r.body;
-    p.push(Ae("body", o, u?.max_age));
-  }
-  const m = (u) => u;
-  for (const u of p)
-    u.acr.unorderable && h("channels-unorderable", { [m(u.channel)]: u.raw }), u.acr.zero && h("zero-constraint-ignored", { field: "acr_values", [m(u.channel)]: u.raw }), u.maxAge.kind === "invalid" && h("zero-constraint-ignored", { field: "max_age", [m(u.channel)]: String(u.maxAge.raw) });
-  const d = p.filter((u) => u.acr.level !== void 0);
+  const u = [];
+  if (n && u.push(Re("header", n, Zt(i).max_age)), o) {
+    const p = r.body;
+    u.push(Re("body", o, p?.max_age));
+  }
+  const m = (p) => p;
+  for (const p of u)
+    p.acr.unorderable && h("channels-unorderable", { [m(p.channel)]: p.raw }), p.acr.zero && h("zero-constraint-ignored", { field: "acr_values", [m(p.channel)]: p.raw }), p.maxAge.kind === "invalid" && h("zero-constraint-ignored", { field: "max_age", [m(p.channel)]: String(p.maxAge.raw) });
+  const d = u.filter((p) => p.acr.level !== void 0);
   let g, f;
-  for (const u of d) {
-    const y = u.acr.level;
-    g === void 0 || y > g ? (g = y, f = u.raw) : y === g && u.channel === "header" && (f = u.raw);
+  for (const p of d) {
+    const y = p.acr.level;
+    g === void 0 || y > g ? (g = y, f = p.raw) : y === g && p.channel === "header" && (f = p.raw);
   }
   let v;
-  for (const u of p)
-    u.maxAge.kind === "valid" && (v === void 0 || u.maxAge.value < v) && (v = u.maxAge.value);
-  if (p.length === 2) {
-    const [u, y] = p, I = u.acr.level !== void 0 && y.acr.level !== void 0 && u.acr.level !== y.acr.level, W = u.maxAge.kind === "valid" && y.maxAge.kind === "valid" && u.maxAge.value !== y.maxAge.value;
-    (I || W) && h("channels-disagree", { header: u.raw ?? y.raw, body: y.raw ?? u.raw });
+  for (const p of u)
+    p.maxAge.kind === "valid" && (v === void 0 || p.maxAge.value < v) && (v = p.maxAge.value);
+  if (u.length === 2) {
+    const [p, y] = u, I = p.acr.level !== void 0 && y.acr.level !== void 0 && p.acr.level !== y.acr.level, W = p.maxAge.kind === "valid" && y.maxAge.kind === "valid" && p.maxAge.value !== y.maxAge.value;
+    (I || W) && h("channels-disagree", { header: p.raw ?? y.raw, body: y.raw ?? p.raw });
   }
   return {
     challenge: {
@@ -728,19 +728,19 @@ const Y = new $t(), qt = /^[0-9]+$/, Ee = Object.freeze({ unorderable: !1, zero:
       requiredLevel: g,
       maxAge: v,
       status: t,
-      channels: p.map((u) => u.channel)
+      channels: u.map((p) => p.channel)
     },
     diagnostics: a
   };
-}, Yt = (r, e, t) => we({ status: r, getHeader: e, body: t }).challenge, He = "__passflowUpgradeTransaction", ze = "__passflowUpgradeReplayed", Ye = (r, e) => typeof r == "object" && r !== null && r[e] === !0, We = (r) => ({
+}, Qt = (r, e, t) => be({ status: r, getHeader: e, body: t }).challenge, Ye = "__passflowUpgradeTransaction", We = "__passflowUpgradeReplayed", Xe = (r, e) => typeof r == "object" && r !== null && r[e] === !0, Je = (r) => ({
   ...r ?? {},
-  [He]: !0
-}), Xe = (r) => Ye(r, He), Wt = (r) => ({
+  [Ye]: !0
+}), Ze = (r) => Xe(r, Ye), er = (r) => ({
   ...r,
-  [ze]: !0
-}), Xt = (r) => Ye(r, ze);
-var M = /* @__PURE__ */ ((r) => (r.GET = "get", r.POST = "post", r.PUT = "put", r.PATCH = "patch", r.DELETE = "delete", r))(M || {}), l = /* @__PURE__ */ ((r) => (r.signin = "/auth/login", r.signup = "/auth/register", r.signInWithProvider = "/auth/federated/start/", r.passwordless = "/auth/passwordless/start", r.passwordlessComplete = "/auth/passwordless/complete", r.logout = "/user/logout", r.refresh = "/auth/refresh", r.validateSession = "/user/me", r.sendPasswordResetEmail = "/auth/password/reset", r.resetPassword = "/auth/password/change", r.appSettings = "/app/settings", r.passkeyRegisterStart = "/auth/passkey/register/start", r.passkeyRegisterComplete = "/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", r.passkeyValidate = "/auth/validate", r.settingsAll = "/settings", r.settingsPasswordPolicy = "/settings/password", r.settingsPasskey = "/settings/passkey", r.userPasskey = "/user/passkey", r.addUserPasskey = "/user/passkey/add/start", r.completeAddUserPasskey = "/user/passkey/add/complete", r.joinInvitation = "/user/tenant/join", r.tenantPath = "/user/tenant", r.invitationsPath = "/user/tenant/:tenantID/invitations", r.requestInvitation = "/user/invite", r.invitationDelete = "/user/invite/:invitationID", r.invitationResend = "/user/invite/:invitationID/resend", r.invitationGetLink = "/user/invite/:invitationID/link", r.twoFactor = "/user/2fa", r.twoFactorStatus = "/user/2fa/status", r.twoFactorSetupBegin = "/user/2fa/setup/begin", r.twoFactorSetupConfirm = "/user/2fa/setup/confirm", r.twoFactorVerify = "/auth/2fa/verify", r.twoFactorRecovery = "/auth/2fa/recovery", r.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", r.twoFactorSetupMagicLink = "/auth/2fa-setup", r.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", r.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", r.TwoFactorSetupStart = "/v2/user/2fa/setup/start", r.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", r.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", r.TwoFactorChallenge = "/v2/auth/2fa/challenge", r.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", r.TwoFactorAlternative = "/v2/auth/2fa/alternative", r.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", r.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", r.cliAuthStatus = "/cli/auth/status/:sessionId", r.cliAuthComplete = "/cli/auth/complete", r.upgradeStart = "/auth/upgrade/start", r))(l || {}), F = /* @__PURE__ */ ((r) => (r.passkeyRegisterStart = "/admin/auth/passkey/register/start", r.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", r.passkeyValidate = "/admin/auth/validate", r.logout = "/admin/auth/logout", r))(F || {});
-const Je = (r) => {
+  [We]: !0
+}), tr = (r) => Xe(r, We);
+var U = /* @__PURE__ */ ((r) => (r.GET = "get", r.POST = "post", r.PUT = "put", r.PATCH = "patch", r.DELETE = "delete", r))(U || {}), l = /* @__PURE__ */ ((r) => (r.signin = "/auth/login", r.signup = "/auth/register", r.pkceExchange = "/auth/pkce_exchange", r.signInWithProvider = "/auth/federated/start/", r.passwordless = "/auth/passwordless/start", r.passwordlessComplete = "/auth/passwordless/complete", r.logout = "/user/logout", r.refresh = "/auth/refresh", r.validateSession = "/user/me", r.sendPasswordResetEmail = "/auth/password/reset", r.resetPassword = "/auth/password/change", r.appSettings = "/app/settings", r.passkeyRegisterStart = "/auth/passkey/register/start", r.passkeyRegisterComplete = "/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", r.passkeyValidate = "/auth/validate", r.settingsAll = "/settings", r.settingsPasswordPolicy = "/settings/password", r.settingsPasskey = "/settings/passkey", r.userPasskey = "/user/passkey", r.addUserPasskey = "/user/passkey/add/start", r.completeAddUserPasskey = "/user/passkey/add/complete", r.joinInvitation = "/user/tenant/join", r.tenantPath = "/user/tenant", r.invitationsPath = "/user/tenant/:tenantID/invitations", r.requestInvitation = "/user/invite", r.invitationDelete = "/user/invite/:invitationID", r.invitationResend = "/user/invite/:invitationID/resend", r.invitationGetLink = "/user/invite/:invitationID/link", r.twoFactor = "/user/2fa", r.twoFactorStatus = "/user/2fa/status", r.twoFactorSetupBegin = "/user/2fa/setup/begin", r.twoFactorSetupConfirm = "/user/2fa/setup/confirm", r.twoFactorVerify = "/auth/2fa/verify", r.twoFactorRecovery = "/auth/2fa/recovery", r.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", r.twoFactorSetupMagicLink = "/auth/2fa-setup", r.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", r.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", r.TwoFactorSetupStart = "/v2/user/2fa/setup/start", r.TwoFactorSetupComplete = "/v2/user/2fa/setup/complete", r.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", r.TwoFactorChallenge = "/v2/auth/2fa/challenge", r.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", r.TwoFactorAlternative = "/v2/auth/2fa/alternative", r.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", r.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", r.cliAuthStatus = "/cli/auth/status/:sessionId", r.cliAuthComplete = "/cli/auth/complete", r.upgradeStart = "/auth/upgrade/start", r))(l || {}), P = /* @__PURE__ */ ((r) => (r.passkeyRegisterStart = "/admin/auth/passkey/register/start", r.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", r.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", r.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", r.passkeyValidate = "/admin/auth/validate", r.logout = "/admin/auth/logout", r))(P || {});
+const Qe = (r) => {
   if (!r)
     return null;
   try {
@@ -755,21 +755,21 @@ class w extends Error {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
-var Jt = /* @__PURE__ */ ((r) => (r.google = "google", r.facebook = "facebook", r))(Jt || {}), Zt = /* @__PURE__ */ ((r) => (r.web = "web", r.ios = "ios", r.android = "android", r))(Zt || {});
-function Ys(r) {
+var rr = /* @__PURE__ */ ((r) => (r.google = "google", r.facebook = "facebook", r))(rr || {}), sr = /* @__PURE__ */ ((r) => (r.web = "web", r.ios = "ios", r.android = "android", r))(sr || {});
+function ri(r) {
   return r;
 }
-function P(r, e) {
+function F(r, e) {
   let t = r;
   return Object.entries(e).forEach(([s, i]) => {
     t = t.replace(`:${s}`, i);
   }), t;
 }
-var Qt = /* @__PURE__ */ ((r) => (r.Disabled = "disabled", r.Optional = "optional", r.Required = "required", r))(Qt || {});
-const er = 3, tr = 1e3, rr = (r) => (e) => {
+var ir = /* @__PURE__ */ ((r) => (r.Disabled = "disabled", r.Optional = "optional", r.Required = "required", r))(ir || {});
+const nr = 3, or = 1e3, ar = (r) => (e) => {
   const t = r.headers?.[e] ?? r.headers?.[e.toLowerCase()];
   return Array.isArray(t) ? t.join(", ") : t;
-}, Ze = (r) => Yt(r.status, rr(r), r.data), sr = (r) => Ze(r) !== void 0;
+}, et = (r) => Qt(r.status, ar(r), r.data), cr = (r) => et(r) !== void 0;
 class E {
   constructor(e, t, s) {
     this.refreshPromise = null, this.isRefreshing = !1, this.defaultHeaders = {
@@ -777,18 +777,18 @@ class E {
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh", "upgrade"];
     const { url: i, appId: n, keyStoragePrefix: o } = e;
-    this._platform = e.platform ?? Y, this.url = i || Le, this.upgradeDomain = Je(i), this.storageManager = t ?? new ke({
+    this._platform = e.platform ?? Y, this.url = i || qe, this.upgradeDomain = Qe(i), this.storageManager = t ?? new Se({
       prefix: o ?? ""
-    }), this.deviceService = s ?? new Ve(this.storageManager), this.tokenService = new Lt(this.storageManager), this.tokenDeliveryManager = new Ne(this.storageManager), n && (this.appId = n, this.defaultHeaders = {
+    }), this.deviceService = s ?? new Be(this.storageManager), this.tokenService = new Kt(this.storageManager), this.tokenDeliveryManager = new Ke(this.storageManager), n && (this.appId = n, this.defaultHeaders = {
       ...this.defaultHeaders,
       [V]: n
     });
     const a = this.deviceService.getDeviceId();
     this.defaultHeaders = {
       ...this.defaultHeaders,
-      [_t]: a,
-      [Et]: this._platform.getDeviceType()
-    }, this.detectCookieSupport(), this.instance = K.create({
+      [Rt]: a,
+      [Pt]: this._platform.getDeviceType()
+    }, this.detectCookieSupport(), this.instance = B.create({
       baseURL: this.url,
       headers: { ...this.defaultHeaders }
     }), this.instance.interceptors.request.use(async (h) => {
@@ -806,10 +806,10 @@ class E {
         }
         return h;
       }
-      const p = this.storageManager.getTokens();
-      if (p?.access_token) {
-        const m = T(p.access_token);
-        if (C(m, $e) && p.refresh_token)
+      const u = this.storageManager.getTokens();
+      if (u?.access_token) {
+        const m = T(u.access_token);
+        if (C(m, Ne) && u.refresh_token)
           try {
             if (this.refreshPromise) {
               const d = await this.refreshPromise;
@@ -825,17 +825,17 @@ class E {
           } catch (d) {
             return this.refreshPromise = null, this.isRefreshing = !1, this.storageManager.deleteTokens(), Promise.reject(d);
           }
-        return h.headers[D] = `Bearer ${p.access_token}`, h;
+        return h.headers[D] = `Bearer ${u.access_token}`, h;
       }
       return h;
     }), this.instance.interceptors.response.use(
       (h) => h,
       async (h) => {
         if (h.response?.status === 401 && !this.isUpgradeTransactionError(h) && this.tokenDeliveryManager.setSessionInvalid(), h.response && this.upgradeHandler) {
-          const p = Ze(h.response);
-          if (p)
+          const u = et(h.response);
+          if (u)
             try {
-              return await this.upgradeHandler(h, p);
+              return await this.upgradeHandler(h, u);
             } catch (m) {
               if (m !== h)
                 throw m;
@@ -854,7 +854,7 @@ class E {
    * speak upgrade vocabulary", which is unsound in both directions.
    */
   isUpgradeTransactionError(e) {
-    return Xe(e.config) || e.response !== void 0 && sr(e.response);
+    return Ze(e.config) || e.response !== void 0 && cr(e.response);
   }
   /**
    * Installs (or clears) the handler consulted when a response carries an
@@ -929,17 +929,17 @@ class E {
     if (!["GET", "HEAD", "OPTIONS"].includes(s || ""))
       return Promise.reject(e);
     const n = t._retryCount || 0;
-    if (n >= er)
+    if (n >= nr)
       return Promise.reject(e);
-    let o = tr * Math.pow(2, n);
+    let o = or * Math.pow(2, n);
     const a = e.response?.headers?.["retry-after"];
     if (a) {
       const h = Number.parseInt(a, 10);
       if (!Number.isNaN(h))
         o = h * 1e3;
       else {
-        const p = new Date(a);
-        Number.isNaN(p.getTime()) || (o = Math.max(0, p.getTime() - Date.now()));
+        const u = new Date(a);
+        Number.isNaN(u.getTime()) || (o = Math.max(0, u.getTime() - Date.now()));
       }
     }
     return await new Promise((h) => setTimeout(h, o)), t._retryCount = n + 1, this.instance.request(t);
@@ -972,19 +972,19 @@ class E {
     })).data;
   }
   get(e, t) {
-    return this.send(M.GET, e, t);
+    return this.send(U.GET, e, t);
   }
   post(e, t, s) {
-    return this.send(M.POST, e, { data: t, ...s });
+    return this.send(U.POST, e, { data: t, ...s });
   }
   put(e, t, s) {
-    return this.send(M.PUT, e, { data: t, ...s });
+    return this.send(U.PUT, e, { data: t, ...s });
   }
   patch(e, t, s) {
-    return this.send(M.PATCH, e, { data: t, ...s });
+    return this.send(U.PATCH, e, { data: t, ...s });
   }
   delete(e, t) {
-    return this.send(M.DELETE, e, t);
+    return this.send(U.DELETE, e, t);
   }
   /**
    * Update the appId and propagate it to axios headers.
@@ -999,7 +999,7 @@ class E {
     }, this.instance.defaults.headers.common[V] = e;
   }
 }
-class ir {
+class hr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1010,8 +1010,8 @@ class ir {
     return this.axiosClient.get(l.appSettings);
   }
 }
-const q = { withCredentials: !0 };
-class nr {
+const M = { withCredentials: !0 };
+class dr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1048,7 +1048,7 @@ class nr {
     return this.axiosClient.post(
       l.refresh,
       n,
-      i ? We(o) : o
+      i ? Je(o) : o
     );
   }
   signIn(e, t, s) {
@@ -1060,7 +1060,7 @@ class nr {
     return this.axiosClient.post(
       l.signin,
       i,
-      q
+      M
     );
   }
   signUp(e) {
@@ -1072,7 +1072,15 @@ class nr {
     return this.axiosClient.post(
       l.signup,
       i,
-      q
+      M
+    );
+  }
+  /** Redeems the code a PKCE sign-in answered with for the tokens it stands for. */
+  pkceExchange(e, t) {
+    return this.axiosClient.post(
+      l.pkceExchange,
+      { authz_code: e, verifier: t },
+      M
     );
   }
   passwordlessSignIn(e, t, s) {
@@ -1091,11 +1099,11 @@ class nr {
     return this.axiosClient.post(
       l.passwordlessComplete,
       e,
-      q
+      M
     );
   }
   logOut(e, t, s = !1) {
-    const i = s ? void 0 : { refresh_token: t, device: e }, n = s ? F.logout : l.logout;
+    const i = s ? void 0 : { refresh_token: t, device: e }, n = s ? P.logout : l.logout;
     return this.axiosClient.post(n, i);
   }
   validateSession() {
@@ -1107,12 +1115,13 @@ class nr {
       e
     );
   }
-  resetPassword(e, t, s) {
-    const i = {
+  resetPassword(e, t, s, i) {
+    const n = {
       password: e,
-      scopes: t
+      scopes: t,
+      ...i ? { code_challenge: i } : {}
     };
-    return this.axiosClient.post(l.resetPassword, i, {
+    return this.axiosClient.post(l.resetPassword, n, {
       headers: {
         [D]: `Bearer ${s}`,
         [V]: void 0
@@ -1125,7 +1134,7 @@ class nr {
       create_tenant: n ?? !1,
       device: t,
       os: s
-    }, a = i ? F.passkeyRegisterStart : l.passkeyRegisterStart;
+    }, a = i ? P.passkeyRegisterStart : l.passkeyRegisterStart;
     return this.axiosClient.post(a, o);
   }
   passkeyRegisterComplete(e, t, s, i = !1) {
@@ -1133,11 +1142,11 @@ class nr {
       challenge_id: s,
       device: t,
       passkey_data: e
-    }, o = i ? F.passkeyRegisterComplete : l.passkeyRegisterComplete;
+    }, o = i ? P.passkeyRegisterComplete : l.passkeyRegisterComplete;
     return this.axiosClient.post(
       o,
       n,
-      q
+      M
     );
   }
   passkeyAuthenticateStart(e, t, s, i = !1) {
@@ -1146,7 +1155,7 @@ class nr {
       user_id: e.user_id ?? "",
       device: t,
       os: s
-    }, o = i ? F.passkeyAuthenticateStart : l.passkeyAuthenticateStart;
+    }, o = i ? P.passkeyAuthenticateStart : l.passkeyAuthenticateStart;
     return this.axiosClient.post(
       o,
       n
@@ -1157,11 +1166,11 @@ class nr {
       challenge_id: s,
       device: t,
       passkey_data: e
-    }, o = i ? F.passkeyAuthenticateComplete : l.passkeyAuthenticateComplete;
+    }, o = i ? P.passkeyAuthenticateComplete : l.passkeyAuthenticateComplete;
     return this.axiosClient.post(
       o,
       n,
-      q
+      M
     );
   }
   passkeyValidate(e, t, s, i = !1, n) {
@@ -1171,12 +1180,12 @@ class nr {
       challenge_id: s
     };
     let a = l.passkeyValidate;
-    !n && i && (a = F.passkeyValidate);
+    !n && i && (a = P.passkeyValidate);
     const h = n ? { [V]: n } : {};
     return this.axiosClient.post(a, o, { headers: h });
   }
 }
-class Ws {
+class si {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1184,14 +1193,14 @@ class Ws {
     this.axiosClient.setAppId(e);
   }
   getCLIAuthStatus(e) {
-    const t = P(l.cliAuthStatus, { sessionId: e });
+    const t = F(l.cliAuthStatus, { sessionId: e });
     return this.axiosClient.get(t);
   }
   completeCLIAuth(e) {
     return this.axiosClient.post(l.cliAuthComplete, e);
   }
 }
-class or {
+class lr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1217,7 +1226,7 @@ class or {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const s = P(l.invitationsPath, {
+    const s = F(l.invitationsPath, {
       tenantID: e.tenantID
     });
     return this.axiosClient.get(s, { params: t }).then((i) => ({
@@ -1231,7 +1240,7 @@ class or {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = P(l.invitationDelete, {
+    const t = F(l.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -1242,7 +1251,7 @@ class or {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = P(l.invitationResend, {
+    const t = F(l.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -1253,13 +1262,13 @@ class or {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = P(l.invitationGetLink, {
+    const t = F(l.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
   }
 }
-class ar {
+class ur {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1276,7 +1285,7 @@ class ar {
     return this.axiosClient.get(l.settingsPasskey);
   }
 }
-class cr {
+class pr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1509,11 +1518,11 @@ class cr {
     return this.axiosClient.delete(i);
   }
 }
-const pe = (r) => r ? { headers: { Authorization: `Bearer ${r}` } } : {}, ie = (r) => ({
+const ge = (r) => r ? { headers: { Authorization: `Bearer ${r}` } } : {}, ne = (r) => ({
   withCredentials: !0,
-  ...pe(r)
+  ...ge(r)
 });
-class hr {
+class fr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1556,7 +1565,7 @@ class hr {
     return this.axiosClient.post(
       l.twoFactorVerify,
       { code: s, ...i ? { trust_device: !0 } : {} },
-      ie(t)
+      ne(t)
     );
   }
   /**
@@ -1569,7 +1578,7 @@ class hr {
     return this.axiosClient.post(
       l.twoFactorRecovery,
       { recovery_code: s, ...i ? { trust_device: !0 } : {} },
-      ie(t)
+      ne(t)
     );
   }
   /**
@@ -1719,7 +1728,7 @@ class hr {
    * DELETE /v2/user/2fa/methods/:id
    */
   removeMethod(e) {
-    const t = P(l.TwoFactorMethodRemove, { id: e });
+    const t = F(l.TwoFactorMethodRemove, { id: e });
     return this.axiosClient.delete(t);
   }
   /**
@@ -1731,7 +1740,7 @@ class hr {
     return this.axiosClient.post(
       l.TwoFactorChallenge,
       e,
-      pe(t)
+      ge(t)
     );
   }
   /**
@@ -1746,7 +1755,7 @@ class hr {
     return this.axiosClient.post(
       l.TwoFactorVerifyV2,
       { ...i, ...s ? { trust_device: !0 } : {} },
-      ie(t)
+      ne(t)
     );
   }
   /**
@@ -1758,7 +1767,7 @@ class hr {
     return this.axiosClient.post(
       l.TwoFactorAlternative,
       e,
-      pe(t)
+      ge(t)
     );
   }
   /**
@@ -1780,11 +1789,11 @@ class hr {
    * The server answers 404 when the user has no such device.
    */
   revokeTrustedDevice(e) {
-    const t = P(l.TwoFactorTrustedDeviceRevoke, { id: e });
+    const t = F(l.TwoFactorTrustedDeviceRevoke, { id: e });
     return this.axiosClient.delete(t);
   }
 }
-class dr {
+class gr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1806,11 +1815,11 @@ class dr {
     return this.axiosClient.post(
       l.upgradeStart,
       e,
-      We({})
+      Je({})
     );
   }
 }
-class lr {
+class vr {
   constructor(e, t, s) {
     this.axiosClient = new E(e, t, s);
   }
@@ -1855,8 +1864,27 @@ class lr {
     });
   }
 }
+const X = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", mr = 32, tt = (r) => {
+  let e = "";
+  for (let t = 0; t < r.length; t += 3) {
+    const s = r[t], i = r[t + 1], n = r[t + 2];
+    e += X.charAt(s >> 2), e += X.charAt((s & 3) << 4 | (i ?? 0) >> 4), i !== void 0 && (e += X.charAt((i & 15) << 2 | (n ?? 0) >> 6)), n !== void 0 && (e += X.charAt(n & 63));
+  }
+  return e;
+}, rt = () => {
+  const r = globalThis.crypto;
+  if (!r?.subtle)
+    throw new Error("PKCE needs the Web Crypto API, which is available only in a secure context (https or localhost)");
+  return r;
+}, yr = async (r) => {
+  const e = await rt().subtle.digest("SHA-256", new TextEncoder().encode(r));
+  return tt(new Uint8Array(e));
+}, kr = async () => {
+  const r = tt(rt().getRandomValues(new Uint8Array(mr)));
+  return { verifier: r, challenge: await yr(r) };
+};
 var c = /* @__PURE__ */ ((r) => (r.SignIn = "signin", r.SignInStart = "signin:start", r.Register = "register", r.RegisterStart = "register:start", r.SignOut = "signout", r.SessionRestored = "session:restored", r.SessionExpired = "session:expired", r.Error = "error", r.Refresh = "refresh", r.RefreshStart = "refresh:start", r.TokenCacheExpired = "token-cache-expired", r.TwoFactorRequired = "2fa:required", r.TwoFactorSetupStarted = "2fa:setup_started", r.TwoFactorEnabled = "2fa:enabled", r.TwoFactorDisabled = "2fa:disabled", r.TwoFactorVerified = "2fa:verified", r.TwoFactorRecoveryUsed = "2fa:recovery_used", r.TwoFactorRecoveryCodesLow = "2fa:recovery_low", r.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", r.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", r.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", r.TwoFactorChallengeReceived = "two_factor_challenge_received", r.TwoFactorMethodSwitched = "two_factor_method_switched", r.TwoFactorDeviceTrusted = "two_factor_device_trusted", r))(c || {});
-class ur {
+class wr {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
   }
@@ -1910,18 +1938,18 @@ const k = {
   twoFactorNotEnabled: "error.2fa.not_enabled",
   notImplemented: "error.not.implemented",
   tokenInvalid: "error.api.request.token.invalid"
-}, pr = Object.freeze([
+}, Sr = Object.freeze([
   k.twoFactorCodeInvalid,
   k.twoFactorNotEnabled,
   k.challengeInvalid,
   k.challengeSessionMismatch,
   k.challengeTooManyAttempts
-]), fr = Object.freeze([k.tokenInvalid]), gr = Object.freeze([
+]), br = Object.freeze([k.tokenInvalid]), Tr = Object.freeze([
   "wrong_code",
   "challenge_spent",
   "not_registered",
   "prepare_not_required"
-]), vr = (r) => gr.includes(r), mr = {
+]), _r = (r) => Tr.includes(r), Er = {
   wrong_code: "That code was not accepted. Try again.",
   challenge_spent: "That verification challenge is no longer valid. Start again.",
   exhausted: "Too many attempts. Try again later.",
@@ -1936,17 +1964,17 @@ const k = {
 };
 class _ extends Error {
   constructor(e) {
-    super(e.message || mr[e.kind]), this.name = "UpgradeTransportError", this.code = "upgrade_transport", this.kind = e.kind, this.status = e.status, this.errorId = e.errorId, this.retryable = vr(e.kind), e.cause !== void 0 && (this.cause = e.cause);
+    super(e.message || Er[e.kind]), this.name = "UpgradeTransportError", this.code = "upgrade_transport", this.kind = e.kind, this.status = e.status, this.errorId = e.errorId, this.retryable = _r(e.kind), e.cause !== void 0 && (this.cause = e.cause);
   }
 }
-const yr = Object.freeze([
+const Ir = Object.freeze([
   "upgrade_transport",
   "upgrade_insufficient",
   "upgrade_unavailable",
   "upgrade_session_changed",
   "upgrade_cancelled",
   "upgrade_unsatisfiable"
-]), Qe = (r) => typeof r == "object" && r !== null && typeof r.code == "string" && yr.includes(r.code), kr = (r) => r instanceof _ || typeof r == "object" && r !== null && r.code === "upgrade_transport", wr = (r) => {
+]), st = (r) => typeof r == "object" && r !== null && typeof r.code == "string" && Ir.includes(r.code), Ar = (r) => r instanceof _ || typeof r == "object" && r !== null && r.code === "upgrade_transport", Cr = (r) => {
   if (typeof r != "object" || r === null)
     return { hasResponse: !1, message: typeof r == "string" ? r : void 0 };
   const e = r, t = e.response, s = t?.data, i = typeof s?.error?.id == "string" ? s.error.id : void 0;
@@ -1956,7 +1984,7 @@ const yr = Object.freeze([
     message: typeof e.message == "string" ? e.message : void 0,
     hasResponse: t !== void 0 || typeof e.status == "number"
   };
-}, Sr = (r, e) => {
+}, Rr = (r, e) => {
   switch (r) {
     case k.twoFactorCodeInvalid:
       return "wrong_code";
@@ -2005,13 +2033,13 @@ const yr = Object.freeze([
     default:
       return;
   }
-}, br = (r, e) => r === void 0 ? "network" : r === 501 ? "unavailable" : r === 400 ? "fatal" : r === 401 || r === 403 ? e === "start" ? "challenge_spent" : "session_changed" : r >= 500 ? "network" : "fatal", Ce = (r, e) => {
+}, Pr = (r, e) => r === void 0 ? "network" : r === 501 ? "unavailable" : r === 400 ? "fatal" : r === 401 || r === 403 ? e === "start" ? "challenge_spent" : "session_changed" : r >= 500 ? "network" : "fatal", Pe = (r, e) => {
   if (r instanceof _)
     return r;
-  const t = wr(r);
+  const t = Cr(r);
   if (!t.hasResponse)
     return new _({ kind: "network", message: t.message, cause: r });
-  const s = Sr(t.errorId, e) ?? br(t.status, e);
+  const s = Rr(t.errorId, e) ?? Pr(t.status, e);
   return new _({
     kind: s,
     message: t.message,
@@ -2019,62 +2047,80 @@ const yr = Object.freeze([
     errorId: t.errorId,
     cause: r
   });
-}, Xs = (r) => r.errorId !== void 0 && pr.includes(r.errorId), Tr = (r) => r.errorId !== void 0 && fr.includes(r.errorId);
-class j extends Error {
+}, ii = (r) => r.errorId !== void 0 && Sr.includes(r.errorId), Fr = (r) => r.errorId !== void 0 && br.includes(r.errorId);
+class G extends Error {
   constructor(e, t, s) {
     super(s ?? "The session was elevated, but this action requires a higher assurance level"), this.name = "UpgradeInsufficientError", this.code = "upgrade_insufficient", this.obtained = e, this.required = t;
   }
 }
-class G extends Error {
+class j extends Error {
   constructor(e = "Step-up verification is not available on this deployment") {
     super(e), this.name = "UpgradeUnavailableError", this.code = "upgrade_unavailable";
   }
 }
-class $ extends Error {
+class q extends Error {
   constructor(e = "The session changed during verification") {
     super(e), this.name = "UpgradeSessionChangedError", this.code = "upgrade_session_changed";
   }
 }
-const _r = (r) => {
+const Mr = (r) => {
   if (!(!r || typeof r.sub != "string" || r.sub === ""))
     return typeof r.sid == "string" && r.sid !== "" ? { sub: r.sub, sid: r.sid } : { sub: r.sub };
-}, Er = (r, e) => !e || e.sub !== r.sub ? !1 : r.sid !== void 0 && e.sid !== void 0 ? r.sid === e.sid : !0;
-function X(r) {
+}, Ur = (r, e) => !e || e.sub !== r.sub ? !1 : r.sid !== void 0 && e.sid !== void 0 ? r.sid === e.sid : !0;
+function J(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.split(".");
   if (e.length !== 3) return !1;
   const t = /^[A-Za-z0-9_-]+$/;
   return e.every((s) => t.test(s) && s.length > 0);
 }
-function Ir(r) {
-  return r.replace(/<[^>]*>/g, "").substring(0, Ut);
+function Dr(r) {
+  return r.replace(/<[^>]*>/g, "").substring(0, qt);
 }
-function ne(r) {
+function oe(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
   return e.length === 0 ? !1 : /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
 }
-function oe(r) {
+function ae(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
   return /^\+[1-9]\d{1,14}$/.test(e);
 }
-function Ar(r) {
+function xr(r) {
   if (!r || typeof r != "string") return !1;
   const e = r.trim();
-  return e.length < Mt || e.length > Dt ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
+  return e.length < Lt || e.length > $t ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
 }
-function J(r, e = 6) {
+function Z(r, e = 6) {
   return !r || typeof r != "string" ? !1 : (e === 8 ? /^\d{8}$/ : /^\d{6}$/).test(r);
 }
-function Cr(r) {
+function Or(r) {
   if (!r || typeof r != "string") return null;
   const e = r.toUpperCase().replace(/\s+/g, "");
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
-class Rr {
-  constructor(e, t, s, i, n, o, a, h, p, m, d, g = Y) {
-    this.authApi = e, this.deviceService = t, this.storageManager = s, this.subscribeStore = i, this.tokenCacheService = n, this.scopes = o, this.createTenantForNewUser = a, this.url = h, this.sessionCallbacks = p, this.appId = m, this.platform = g, this.tokenExchangeConfig = d, this.tokenDeliveryManager = new Ne(s), d?.enabled && this.tokenDeliveryManager.setMode(A.BFF), this.initializeSession();
+class Lr {
+  error(e, ...t) {
+    console.error(e, ...t);
+  }
+  warn(e, ...t) {
+    console.warn(e, ...t);
+  }
+  info(e, ...t) {
+    console.info(e, ...t);
+  }
+  debug(e, ...t) {
+    console.debug(e, ...t);
+  }
+}
+function it() {
+  return new Lr();
+}
+const ce = "passflow_2fa_pkce", $r = 300 * 1e3;
+class qr {
+  constructor(e, t, s, i, n, o, a, h, u, m, d, g = Y, f) {
+    this.authApi = e, this.deviceService = t, this.storageManager = s, this.subscribeStore = i, this.tokenCacheService = n, this.scopes = o, this.createTenantForNewUser = a, this.url = h, this.sessionCallbacks = u, this.appId = m, this.platform = g, this.readPkceEnabled = f, this.tokenExchangeConfig = d, this.tokenDeliveryManager = new Ke(s), d?.enabled && this.tokenDeliveryManager.setMode(A.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -2114,6 +2160,8 @@ class Rr {
    * In BFF mode, forwards tokens to BFF server
    */
   async processAuthResponse(e, t) {
+    if (e.code && !e.access_token)
+      throw new Error("A PKCE authorization code was not exchanged, so there are no tokens to apply");
     this.tokenExchangeConfig?.enabled || "token_delivery" in e && e.token_delivery && this.tokenDeliveryManager.setMode(e.token_delivery), this.tokenDeliveryManager.setSessionValid(), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.callbackUrl && await this.forwardTokensToBFF(e), e.scopes = t, this.storageManager.saveTokens(e, this.tokenDeliveryManager.getMode()), this.tokenCacheService.setTokensCache(e), e.csrf_token && this.storageManager.setCsrfToken(e.csrf_token);
   }
   /**
@@ -2125,15 +2173,99 @@ class Rr {
    * a session, so on `true` the caller returns it as it is — without
    * `processAuthResponse`, a `SignIn`/`Register` event or a session check.
    * The `TwoFactorRequired` event is what the TwoFactorService listens to, so
-   * its verify and recovery calls can carry the token.
+   * its verify and recovery calls can carry the token. On a PKCE sign-in the
+   * server keeps the login's challenge, so the second factor's answer is a code:
+   * the verifier stays here for `completePkceSignIn`, off the public event.
    */
-  handlePendingSecondFactor(e, t) {
-    return e.requires_2fa !== !0 && !e.tfa_token ? !1 : (this.subscribeStore.notify(c.TwoFactorRequired, {
+  handlePendingSecondFactor(e, t, s, i) {
+    return e.requires_2fa !== !0 && !e.tfa_token ? !1 : (s ? this.rememberPkceSignIn(s.verifier, i) : this.forgetPkceSignIn(), this.subscribeStore.notify(c.TwoFactorRequired, {
       email: t || "",
       challengeId: e.challenge_id || "",
       tfaToken: e.tfa_token || ""
     }), !0);
   }
+  /**
+   * Keeps the verifier in memory, which is where it is read from first. The copy
+   * in sessionStorage is only for a redirect or reload during the second factor,
+   * which would otherwise lose the sign-in.
+   */
+  rememberPkceSignIn(e, t) {
+    if (this.pendingPkce = { verifier: e, scopes: t, expiresAt: Date.now() + $r }, !(typeof sessionStorage > "u"))
+      try {
+        sessionStorage.setItem(ce, JSON.stringify(this.pendingPkce));
+      } catch {
+      }
+  }
+  readPendingPkce() {
+    if (!this.pendingPkce && typeof sessionStorage < "u")
+      try {
+        const e = sessionStorage.getItem(ce);
+        this.pendingPkce = e ? JSON.parse(e) : void 0;
+      } catch {
+        this.pendingPkce = void 0;
+      }
+    return this.pendingPkce && Date.now() >= this.pendingPkce.expiresAt && this.forgetPkceSignIn(), this.pendingPkce;
+  }
+  /** Whether a PKCE sign-in is waiting for the code its second factor answers with. */
+  hasPendingPkceSignIn() {
+    return this.readPendingPkce() !== void 0;
+  }
+  /** Drops the verifier of a pending sign-in. `TwoFactorService` calls this with its own state. */
+  forgetPkceSignIn() {
+    if (this.pendingPkce = void 0, !(typeof sessionStorage > "u"))
+      try {
+        sessionStorage.removeItem(ce);
+      } catch {
+      }
+  }
+  /**
+   * The proof key for a sign-in on a PKCE app, undefined on any other app.
+   *
+   * It is sent whether or not the sign-in has a parent: the parent is added to
+   * the request outside this SDK, so it is not visible here, and `pkce.Challenge`
+   * on the server wants it under a device parent and ignores it under an OIDC one.
+   * When the setting cannot be read the sign-in goes out without a challenge, and
+   * a PKCE app refuses it with its own error.
+   */
+  async startPkce() {
+    let e = !1;
+    try {
+      e = await this.readPkceEnabled?.() ?? !1;
+    } catch (t) {
+      it().warn("Passflow: could not read the app settings, so this sign-in sends no PKCE challenge", t);
+      return;
+    }
+    return e ? kr() : void 0;
+  }
+  /**
+   * Swaps a code in a sign-in's answer for what the code stands for; any other
+   * answer passes through. That can still be a 2FA token: the server re-runs its
+   * gate at the exchange unless the code records a passed second factor.
+   */
+  async exchangeCode(e, t) {
+    return !e.code || !t ? e : await this.authApi.pkceExchange(e.code, t.verifier);
+  }
+  /**
+   * Finishes a PKCE sign-in whose code came from its second factor: redeems the
+   * code with the first factor's verifier and applies the tokens. `TwoFactorService`
+   * is the caller, and clears the pending state once this has succeeded.
+   */
+  async completePkceSignIn(e) {
+    const t = this.readPendingPkce();
+    if (!t)
+      throw new Error("The sign-in answered with a PKCE code, but its verifier is gone");
+    const s = await this.authApi.pkceExchange(e, t.verifier);
+    return await this.processAuthResponse(s, t.scopes ?? this.scopes), s;
+  }
+  /**
+   * Applies tokens that were issued outside this service, honouring the delivery
+   * mode: this is the one place they reach the BFF and browser storage, so no
+   * caller saves them itself. An answer that carries no tokens is left alone.
+   */
+  async applyTokens(e) {
+    const t = e;
+    !t.access_token && !t.id_token && !t.token_delivery || await this.processAuthResponse(t, t.scopes ?? this.readPendingPkce()?.scopes ?? this.scopes);
+  }
   /**
    * Forward tokens to BFF server for httpOnly cookie storage
    */
@@ -2159,7 +2291,7 @@ class Rr {
       throw new Error(`BFF token storage failed: ${t.status}`);
   }
   async signIn(e) {
-    if ("email" in e && e.email && !ne(e.email)) {
+    if ("email" in e && e.email && !oe(e.email)) {
       const i = new Error("Invalid email format"), n = {
         message: "Invalid email format",
         originalError: i,
@@ -2167,7 +2299,7 @@ class Rr {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if ("username" in e && e.username && !Ar(e.username)) {
+    if ("username" in e && e.username && !xr(e.username)) {
       const i = new Error(
         "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens"
       ), n = {
@@ -2177,7 +2309,7 @@ class Rr {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if ("phone" in e && e.phone && !oe(e.phone)) {
+    if ("phone" in e && e.phone && !ae(e.phone)) {
       const i = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), n = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: i,
@@ -2189,11 +2321,14 @@ class Rr {
     const t = this.deviceService.getDeviceId(), s = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const i = await this.authApi.signIn(e, t, s);
-      return this.handlePendingSecondFactor(i, e.email) || (await this.processAuthResponse(i, e.scopes), this.subscribeStore.notify(c.SignIn, {
-        tokens: i,
+      const i = await this.startPkce(), n = await this.authApi.signIn(i ? { ...e, code_challenge: i.challenge } : e, t, s);
+      if (this.handlePendingSecondFactor(n, e.email, i, e.scopes))
+        return n;
+      const o = await this.exchangeCode(n, i);
+      return this.handlePendingSecondFactor(o, e.email) || (await this.processAuthResponse(o, e.scopes), this.subscribeStore.notify(c.SignIn, {
+        tokens: o,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck()), i;
+      }), await this.submitSessionCheck()), o;
     } catch (i) {
       const n = {
         message: i instanceof Error ? i.message : "Sign in failed",
@@ -2204,7 +2339,7 @@ class Rr {
     }
   }
   async signUp(e) {
-    if (e.user.email && !ne(e.user.email)) {
+    if (e.user.email && !oe(e.user.email)) {
       const t = new Error("Invalid email format"), s = {
         message: "Invalid email format",
         originalError: t,
@@ -2212,7 +2347,7 @@ class Rr {
       };
       throw this.subscribeStore.notify(c.Error, s), t;
     }
-    if (e.user.phone_number && !oe(e.user.phone_number)) {
+    if (e.user.phone_number && !ae(e.user.phone_number)) {
       const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), s = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: t,
@@ -2222,11 +2357,14 @@ class Rr {
     }
     this.subscribeStore.notify(c.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
-      const t = await this.authApi.signUp(e);
-      return this.handlePendingSecondFactor(t, e.user.email) || (await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(c.Register, {
-        tokens: t,
+      const t = await this.startPkce(), s = await this.authApi.signUp(t ? { ...e, code_challenge: t.challenge } : e);
+      if (this.handlePendingSecondFactor(s, e.user.email, t, e.scopes))
+        return s;
+      const i = await this.exchangeCode(s, t);
+      return this.handlePendingSecondFactor(i, e.user.email) || (await this.processAuthResponse(i, e.scopes), this.subscribeStore.notify(c.Register, {
+        tokens: i,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck()), t;
+      }), await this.submitSessionCheck()), i;
     } catch (t) {
       const s = {
         message: t instanceof Error ? t.message : "Sign up failed",
@@ -2237,7 +2375,7 @@ class Rr {
     }
   }
   async passwordlessSignIn(e) {
-    if (e.email && !ne(e.email)) {
+    if (e.email && !oe(e.email)) {
       const i = new Error("Invalid email format"), n = {
         message: "Invalid email format",
         originalError: i,
@@ -2245,7 +2383,7 @@ class Rr {
       };
       throw this.subscribeStore.notify(c.Error, n), i;
     }
-    if (e.phone && !oe(e.phone)) {
+    if (e.phone && !ae(e.phone)) {
       const i = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), n = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: i,
@@ -2301,7 +2439,7 @@ class Rr {
       } catch {
       }
     }
-    this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(c.SignOut, {});
+    this.forgetPkceSignIn(), this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(c.SignOut, {});
   }
   /**
    * The session and user identity this client currently holds, or `undefined`
@@ -2313,13 +2451,12 @@ class Rr {
    * nothing to read and the answer is `undefined`.
    */
   readSessionPin() {
-    const e = this.storageManager.getToken(b.access_token);
-    if (e)
-      try {
-        return _r(T(e));
-      } catch {
-        return;
-      }
+    try {
+      const e = this.storageManager.getToken(b.access_token);
+      return e ? Mr(T(e)) : void 0;
+    } catch {
+      return;
+    }
   }
   /**
    * Refuses to APPLY tokens that belong to a different principal (§13.4
@@ -2343,10 +2480,10 @@ class Rr {
    * state — two different axes.
    */
   assertSessionPin(e) {
-    if (e && !Er(e, this.readSessionPin()))
+    if (e && !Ur(e, this.readSessionPin()))
       throw console.warn(
         "[passflow] the session or user changed while a step-up upgrade was in flight; the elevated tokens were discarded and the live session was left untouched."
-      ), new $("The session changed during verification, so the elevated tokens were discarded");
+      ), new q("The session changed during verification, so the elevated tokens were discarded");
   }
   /**
    * Refreshes the session, optionally committing an assurance upgrade.
@@ -2436,13 +2573,13 @@ class Rr {
         message: n instanceof Error ? n.message : "Token refresh failed",
         originalError: n,
         code: n instanceof w ? n.id : void 0,
-        details: K.isAxiosError(n) && n.response ? {
+        details: B.isAxiosError(n) && n.response ? {
           status: n.response.status,
           data: n.response.data
         } : void 0
       };
       this.subscribeStore.notify(c.Error, o);
-      const a = K.isAxiosError(n) && n.response?.status && n.response.status >= 400 && n.response.status < 500;
+      const a = B.isAxiosError(n) && n.response?.status && n.response.status >= 400 && n.response.status < 500;
       throw a && !e && (this.tokenCacheService.tokenExpiredFlag = !0, this.tokenCacheService.setTokensCache(void 0), this.storageManager.deleteTokens(), this.subscribeStore.notify(c.SessionExpired, { reason: "refresh_failed" })), n instanceof w ? n : a && !e ? new Error(`Getting unknown error message from server with code:${n.response?.status}`) : n;
     }
   }
@@ -2462,11 +2599,17 @@ class Rr {
     this.subscribeStore.notify(c.SignInStart, {});
     const i = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("token") ?? void 0, n = t ?? this.scopes;
     try {
-      const o = await this.authApi.resetPassword(e, n, i);
-      return this.handlePendingSecondFactor(o) || (await this.processAuthResponse(o, n), this.subscribeStore.notify(c.SignIn, {
-        tokens: o,
+      const o = await this.startPkce(), a = o ? await this.authApi.resetPassword(e, n, i, o.challenge) : await this.authApi.resetPassword(e, n, i);
+      if (this.handlePendingSecondFactor(a, void 0, o, n))
+        return a;
+      const h = await this.exchangeCode(a, o);
+      if (this.handlePendingSecondFactor(h))
+        return h;
+      const u = a.redirect_url ? { ...h, redirect_url: a.redirect_url } : h;
+      return await this.processAuthResponse(u, n), this.subscribeStore.notify(c.SignIn, {
+        tokens: u,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck()), o;
+      }), await this.submitSessionCheck(), u;
     } catch (o) {
       const a = {
         message: o instanceof Error ? o.message : "Password reset failed",
@@ -2482,20 +2625,23 @@ class Rr {
     const t = this.deviceService.getDeviceId(), s = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
-      const { challenge_id: i, publicKey: n } = await this.authApi.passkeyRegisterStart(e, t, s, !this.appId);
-      n.user.id = this.platform.btoa(n.user.id);
-      const o = await this.platform.passkeys.startRegistration(n);
-      if (!o) throw new Error("Passkey registration was not completed");
-      const a = await this.authApi.passkeyRegisterComplete(
-        o,
+      const i = await this.startPkce(), { challenge_id: n, publicKey: o } = await this.authApi.passkeyRegisterStart(
+        i ? { ...e, code_challenge: i.challenge } : e,
         t,
-        i,
+        s,
         !this.appId
       );
-      return this.handlePendingSecondFactor(a) || (await this.processAuthResponse(a, e.scopes), this.subscribeStore.notify(c.Register, {
-        tokens: a,
+      o.user.id = this.platform.btoa(o.user.id);
+      const a = await this.platform.passkeys.startRegistration(o);
+      if (!a) throw new Error("Passkey registration was not completed");
+      const h = await this.authApi.passkeyRegisterComplete(a, t, n, !this.appId);
+      if (this.handlePendingSecondFactor(h, void 0, i, e.scopes))
+        return h;
+      const u = await this.exchangeCode(h, i);
+      return this.handlePendingSecondFactor(u) || (await this.processAuthResponse(u, e.scopes), this.subscribeStore.notify(c.Register, {
+        tokens: u,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck()), a;
+      }), await this.submitSessionCheck()), u;
     } catch (i) {
       const n = {
         message: i instanceof Error ? i.message : "Passkey registration failed",
@@ -2511,18 +2657,21 @@ class Rr {
     const t = this.deviceService.getDeviceId(), s = this.platform.getDeviceType();
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const { challenge_id: i, publicKey: n } = await this.authApi.passkeyAuthenticateStart(e, t, s, !this.appId), o = await this.platform.passkeys.startAuthentication(n);
-      if (!o) throw new Error("Passkey authentication was not completed");
-      const a = await this.authApi.passkeyAuthenticateComplete(
-        o,
+      const i = await this.startPkce(), { challenge_id: n, publicKey: o } = await this.authApi.passkeyAuthenticateStart(
+        i ? { ...e, code_challenge: i.challenge } : e,
         t,
-        i,
+        s,
         !this.appId
-      );
-      return this.handlePendingSecondFactor(a) || "access_token" in a && (await this.processAuthResponse(a, e.scopes), this.subscribeStore.notify(c.SignIn, {
-        tokens: a,
+      ), a = await this.platform.passkeys.startAuthentication(o);
+      if (!a) throw new Error("Passkey authentication was not completed");
+      const h = await this.authApi.passkeyAuthenticateComplete(a, t, n, !this.appId);
+      if (this.handlePendingSecondFactor(h, void 0, i, e.scopes))
+        return h;
+      const u = await this.exchangeCode(h, i);
+      return this.handlePendingSecondFactor(u) || "access_token" in u && (await this.processAuthResponse(u, e.scopes), this.subscribeStore.notify(c.SignIn, {
+        tokens: u,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck()), a;
+      }), await this.submitSessionCheck()), u;
     } catch (i) {
       const n = {
         message: i instanceof Error ? i.message : "Passkey authentication failed",
@@ -2555,9 +2704,9 @@ class Rr {
       }), o = new URLSearchParams(n.callbackHash.replace(/^#/, ""));
       if (this.handlePendingSecondFactor({ tfa_token: o.get("tfa_token") ?? void 0 }))
         return;
-      const a = new URLSearchParams(n.callbackSearch), h = a.get("access_token") || "", p = a.get("refresh_token") || "", m = a.get("id_token") || "", d = {
+      const a = new URLSearchParams(n.callbackSearch), h = a.get("access_token") || "", u = a.get("refresh_token") || "", m = a.get("id_token") || "", d = {
         access_token: h,
-        refresh_token: p || void 0,
+        refresh_token: u || void 0,
         id_token: m || void 0,
         scopes: t
       };
@@ -2568,7 +2717,7 @@ class Rr {
     } catch (n) {
       const o = {
         message: n instanceof Error ? n.message : "Authentication failed",
-        code: n instanceof Be ? "POPUP_CLOSED" : "AUTH_FAILED",
+        code: n instanceof Ge ? "POPUP_CLOSED" : "AUTH_FAILED",
         originalError: n
       };
       this.subscribeStore.notify(c.Error, o);
@@ -2588,8 +2737,8 @@ class Rr {
         appId: n ?? this.appId ?? "",
         redirectto: s ?? this.platform.getCurrentUrl()?.href ?? "",
         scopes: a.join(",")
-      }, p = new URLSearchParams(h);
-      return o.search = p.toString(), o.toString();
+      }, u = new URLSearchParams(h);
+      return o.search = u.toString(), o.toString();
     } catch (t) {
       const s = {
         message: t instanceof Error ? t.message : "Failed to create auth redirect URL",
@@ -2669,7 +2818,7 @@ class Rr {
     }
   }
 }
-class Fr {
+class Nr {
   constructor(e) {
     this.invitationApi = e;
   }
@@ -2714,24 +2863,7 @@ class Fr {
     return this.invitationApi.getInvitationLink(e);
   }
 }
-class Pr {
-  error(e, ...t) {
-    console.error(e, ...t);
-  }
-  warn(e, ...t) {
-    console.warn(e, ...t);
-  }
-  info(e, ...t) {
-    console.info(e, ...t);
-  }
-  debug(e, ...t) {
-    console.debug(e, ...t);
-  }
-}
-function Mr() {
-  return new Pr();
-}
-class Dr {
+class Vr {
   constructor(e) {
     this.data = this.normalize(e);
   }
@@ -2801,9 +2933,9 @@ class Dr {
     return this.data;
   }
 }
-class Ur {
+class Kr {
   constructor(e, t, s) {
-    this.tenantApi = e, this.scopes = t, this.logger = s || Mr();
+    this.tenantApi = e, this.scopes = t, this.logger = s || it();
   }
   /**
    * Handle Passflow API errors
@@ -2812,7 +2944,7 @@ class Ur {
    * @throws Formatted error with Passflow API error details
    */
   handlePassflowError(e, t) {
-    if (K.isAxiosError(e) && e.response?.data) {
+    if (B.isAxiosError(e) && e.response?.data) {
       const s = e.response.data;
       if (typeof s == "object" && s !== null && "error" in s && typeof s.error == "object" && s.error !== null) {
         const i = s.error;
@@ -2873,7 +3005,7 @@ class Ur {
   async getTenantUserMembership(e) {
     try {
       const t = await this.tenantApi.getTenantDetails(e);
-      return new Dr(t);
+      return new Vr(t);
     } catch (t) {
       this.handlePassflowError(t, `Get tenant user membership failed for tenant ID ${e}`);
     }
@@ -3171,7 +3303,7 @@ class Ur {
     }
   }
 }
-class xr {
+class Br {
   constructor(e, t, s, i = Y) {
     this.storageManager = e, this.authApi = t, this.subscribeStore = s, this.platform = i, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.unsubscribeForeground = null, this.unsubscribeUnload = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupLifecycleListeners();
   }
@@ -3270,19 +3402,19 @@ class xr {
     return C(e);
   }
 }
-class Or {
-  constructor(e, t) {
-    this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
-    const s = {
-      onAuthChange: (i, n) => {
-        if (i === c.TwoFactorRequired) {
-          const o = n;
-          this.setPartialAuthState(o.email, o.challengeId, o.tfaToken);
+class Gr {
+  constructor(e, t, s) {
+    this.twoFactorApi = e, this.subscribeStore = t, this.signInCompleter = s, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
+    const i = {
+      onAuthChange: (n, o) => {
+        if (n === c.TwoFactorRequired) {
+          const a = o;
+          this.setPartialAuthState(a.email, a.challengeId, a.tfaToken);
         }
-        (i === c.SignIn || i === c.Register) && this.clearPartialAuthState();
+        (n === c.SignIn || n === c.Register) && this.clearPartialAuthState();
       }
     };
-    this.subscribeStore.subscribe(s, [
+    this.subscribeStore.subscribe(i, [
       c.TwoFactorRequired,
       c.SignIn,
       c.Register
@@ -3328,7 +3460,7 @@ class Or {
    * Returns recovery codes that MUST be displayed to user
    */
   async confirmSetup(e) {
-    if (!J(e, this.totpDigits))
+    if (!Z(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.confirmSetup({ code: e });
@@ -3349,7 +3481,7 @@ class Or {
    * @param options.trustDevice - ask the server to trust this device for later sign-ins
    */
   async verify(e, t) {
-    if (!J(e, this.totpDigits))
+    if (!Z(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     if (this.recoverPartialAuthState(), !this.isVerificationRequired())
       throw new Error("2FA verification expired or not required. User must sign in first.");
@@ -3360,8 +3492,8 @@ class Or {
         code: e,
         tfa_token: this.partialAuthState.tfaToken,
         ...t?.trustDevice ? { trust_device: !0 } : {}
-      });
-      return this.clearPartialAuthState(), this.subscribeStore.notify(c.TwoFactorVerified, { tokens: s }), s;
+      }), i = await this.finishSignIn(s);
+      return this.subscribeStore.notify(c.TwoFactorVerified, { tokens: i }), i;
     } catch (s) {
       this.emitErrorAndThrow(s, "Verify 2FA code");
     }
@@ -3374,19 +3506,21 @@ class Or {
    */
   async useRecoveryCode(e, t) {
     try {
-      const s = Cr(e);
+      const s = Or(e);
       if (!s)
         throw new Error("Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).");
       if (this.recoverPartialAuthState(), !this.isVerificationRequired())
         throw new Error("2FA verification expired or not required. User must sign in first.");
       if (!this.partialAuthState?.tfaToken)
         throw new Error("No TFA token found. User must sign in first.");
-      const i = await this.twoFactorApi.useRecoveryCode({
-        recovery_code: s,
-        tfa_token: this.partialAuthState.tfaToken,
-        ...t?.trustDevice ? { trust_device: !0 } : {}
-      });
-      return this.clearPartialAuthState(), i.remaining_recovery_codes === 0 ? this.subscribeStore.notify(c.TwoFactorRecoveryCodesExhausted, { tokens: i }) : i.remaining_recovery_codes <= 2 && this.subscribeStore.notify(c.TwoFactorRecoveryCodesLow, {
+      const i = await this.finishSignIn(
+        await this.twoFactorApi.useRecoveryCode({
+          recovery_code: s,
+          tfa_token: this.partialAuthState.tfaToken,
+          ...t?.trustDevice ? { trust_device: !0 } : {}
+        })
+      );
+      return i.remaining_recovery_codes === 0 ? this.subscribeStore.notify(c.TwoFactorRecoveryCodesExhausted, { tokens: i }) : i.remaining_recovery_codes <= 2 && this.subscribeStore.notify(c.TwoFactorRecoveryCodesLow, {
         tokens: i,
         remainingCodes: i.remaining_recovery_codes
       }), this.subscribeStore.notify(c.TwoFactorRecoveryUsed, {
@@ -3401,7 +3535,7 @@ class Or {
    * Disable 2FA (requires TOTP verification)
    */
   async disable(e) {
-    if (!J(e, this.totpDigits))
+    if (!Z(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.disable({ code: e });
@@ -3414,7 +3548,7 @@ class Or {
    * Regenerate recovery codes
    */
   async regenerateRecoveryCodes(e) {
-    if (!J(e, this.totpDigits))
+    if (!Z(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.regenerateRecoveryCodes({ code: e }), s = [...t.recovery_codes];
@@ -3452,12 +3586,34 @@ class Or {
    * Called on logout or successful verification
    */
   clearPartialAuthState() {
-    if (this.partialAuthState = void 0, typeof sessionStorage < "u")
+    if (this.partialAuthState = void 0, this.signInCompleter?.forgetPkceSignIn(), typeof sessionStorage < "u")
       try {
         sessionStorage.removeItem(this.SESSION_STORAGE_KEY);
       } catch {
       }
   }
+  /**
+   * Ends the pending sign-in with the second factor's answer. On a PKCE app that
+   * answer is a code, redeemed and replaced by the tokens, so no caller or
+   * subscriber ever gets a code where tokens belong. Tokens are applied once, by
+   * the completer, in the app's delivery mode. The pending state goes only after
+   * that has worked, except when no verifier can ever redeem the code.
+   */
+  async finishSignIn(e) {
+    const { code: t, ...s } = e;
+    if (t && !this.signInCompleter?.hasPendingPkceSignIn()) {
+      this.clearPartialAuthState();
+      const n = new Error("The sign-in answered with a PKCE code, but its verifier is gone");
+      throw n.id = "PKCE_VERIFIER_MISSING", n;
+    }
+    let i = e;
+    if (t && this.signInCompleter) {
+      const n = await this.signInCompleter.completePkceSignIn(t);
+      i = { ...s, ...n };
+    } else
+      await this.signInCompleter?.applyTokens(i);
+    return this.clearPartialAuthState(), i;
+  }
   /**
    * The 2FA token of the sign-in waiting on its second factor, if any.
    */
@@ -3639,12 +3795,15 @@ class Or {
   async verifyV2(e) {
     try {
       const t = await this.twoFactorApi.verifyV2(e, this.pendingTfaToken());
-      return t.success && (this.clearPartialAuthState(), this.subscribeStore.notify(c.TwoFactorVerified, {
+      if (!t.success)
+        return t;
+      const s = await this.finishSignIn(t);
+      return this.subscribeStore.notify(c.TwoFactorVerified, {
         tokens: {
-          access_token: t.access_token,
-          refresh_token: t.refresh_token
+          access_token: s.access_token,
+          refresh_token: s.refresh_token
         }
-      }), t.device_trusted && this.subscribeStore.notify(c.TwoFactorDeviceTrusted, {})), t;
+      }), s.device_trusted && this.subscribeStore.notify(c.TwoFactorDeviceTrusted, {}), s;
     } catch (t) {
       this.emitErrorAndThrow(t, "Verify 2FA challenge");
     }
@@ -3687,7 +3846,7 @@ class Or {
     }
   }
 }
-class Lr {
+class jr {
   constructor(e, t, s = Y) {
     this.userAPI = e, this.deviceService = t, this.platform = s;
   }
@@ -3739,74 +3898,74 @@ class Lr {
     return await this.userAPI.addUserPasskeyComplete(h, i, o);
   }
 }
-class U extends Error {
+class x extends Error {
   constructor(e, t, s = !1) {
     super(t), this.name = "UpgradeFactorError", this.factor = e, this.cancelled = s;
   }
 }
-const et = (r, e) => {
+const nt = (r, e) => {
   const t = e?.trim();
   if (!t)
-    throw new U(r, "A verification code is required");
+    throw new x(r, "A verification code is required");
   return t;
-}, $r = {
+}, Hr = {
   type: "totp",
   requiresPrepare: !1,
   input: "code",
-  assert: async ({ code: r }) => ({ code: et("totp", r) })
-}, qr = {
+  assert: async ({ code: r }) => ({ code: nt("totp", r) })
+}, zr = {
   type: "recovery_codes",
   requiresPrepare: !1,
   input: "code",
-  assert: async ({ code: r }) => ({ code: et("recovery_codes", r) })
-}, Nr = {
+  assert: async ({ code: r }) => ({ code: nt("recovery_codes", r) })
+}, Yr = {
   type: "passkey",
   requiresPrepare: !0,
   input: "none",
   assert: async ({ prepared: r, platform: e }) => {
     if (!r?.webauthn)
-      throw new U("passkey", "The upgrade challenge carried no WebAuthn options");
+      throw new x("passkey", "The upgrade challenge carried no WebAuthn options");
     const t = e.passkeys;
     if (!t)
-      throw new U("passkey", "This platform does not support passkeys");
+      throw new x("passkey", "This platform does not support passkeys");
     let s;
     try {
       s = await t.startAuthentication(r.webauthn);
     } catch (i) {
-      throw new U("passkey", i?.message || "Passkey verification was cancelled", !0);
+      throw new x("passkey", i?.message || "Passkey verification was cancelled", !0);
     }
     if (!s)
-      throw new U("passkey", "Passkey verification was cancelled", !0);
+      throw new x("passkey", "Passkey verification was cancelled", !0);
     return { challenge_id: r.challengeId, credential: s };
   }
-}, Se = Object.freeze([
-  $r,
-  Nr,
-  qr
-]), Vr = (r = Se) => new Map(r.map((e) => [e.type, e])), Br = 3, Kr = {
+}, Te = Object.freeze([
+  Hr,
+  Yr,
+  zr
+]), Wr = (r = Te) => new Map(r.map((e) => [e.type, e])), Xr = 3, Jr = {
   passkey: 0,
   totp: 1,
   email_otp: 2,
   sms_otp: 3,
   recovery_codes: 9
-}, jr = (r) => r.requiredLevel ?? Vt(r.acrValues), Re = (r, e) => {
-  const t = Kr[r.type] ?? 5, s = e !== void 0 && e >= Br, i = r.type === "passkey";
+}, Zr = (r) => r.requiredLevel ?? Ht(r.acrValues), Fe = (r, e) => {
+  const t = Jr[r.type] ?? 5, s = e !== void 0 && e >= Xr, i = r.type === "passkey";
   return (s && !i ? 100 : 0) + t;
-}, Gr = (r, e) => {
-  const t = jr(e);
-  return [...r].sort((s, i) => Re(s, t) - Re(i, t));
+}, Qr = (r, e) => {
+  const t = Zr(e);
+  return [...r].sort((s, i) => Fe(s, t) - Fe(i, t));
 };
-class O extends Error {
+class L extends Error {
   constructor(e) {
     super("Upgrade authentication was cancelled"), this.code = "upgrade_cancelled", this.name = "UpgradeCancelledError", e !== void 0 && (this.cause = e);
   }
 }
-class ee extends Error {
+class te extends Error {
   constructor(e = "No available authentication factor can satisfy this challenge") {
     super(e), this.code = "upgrade_unsatisfiable", this.name = "UpgradeUnsatisfiableError";
   }
 }
-const Hr = 4, zr = 3e4, Yr = () => {
+const es = 4, ts = 3e4, rs = () => {
   let r = () => {
   }, e = () => {
   };
@@ -3817,7 +3976,7 @@ const Hr = 4, zr = 3e4, Yr = () => {
   acrValues: r.acrValues,
   level: r.requiredLevel,
   maxAge: r.maxAge
-}), Wr = (r, e) => e.level === void 0 ? !0 : r.level === void 0 ? !1 : r.level >= e.level, Xr = (r, e) => {
+}), ss = (r, e) => e.level === void 0 ? !0 : r.level === void 0 ? !1 : r.level >= e.level, is = (r, e) => {
   const t = r.requiredLevel === void 0 ? e.requiredLevel : e.requiredLevel === void 0 ? r.requiredLevel : Math.max(r.requiredLevel, e.requiredLevel), s = t === void 0 ? r.acrValues ?? e.acrValues : t === r.requiredLevel ? r.acrValues : e.acrValues, i = r.maxAge === void 0 ? e.maxAge : e.maxAge === void 0 ? r.maxAge : Math.min(r.maxAge, e.maxAge), n = Array.from(/* @__PURE__ */ new Set([...r.channels ?? [], ...e.channels ?? []]));
   return {
     acrValues: s,
@@ -3826,13 +3985,13 @@ const Hr = 4, zr = 3e4, Yr = () => {
     status: r.status,
     ...n.length > 0 ? { channels: n } : {}
   };
-}, Jr = (r, e) => {
+}, ns = (r, e) => {
   const t = e.requiredLevel !== void 0 && (r.requiredLevel === void 0 || e.requiredLevel > r.requiredLevel), s = e.maxAge !== void 0 && (r.maxAge === void 0 || e.maxAge < r.maxAge);
   return t || s;
 };
-class Zr {
+class os {
   constructor(e) {
-    this.state = "idle", this.inFlight = null, this.requirement = null, this.selected = null, this.rankedRequirement = null, this.registrations = [], this.proof = null, this.pruned = /* @__PURE__ */ new Set(), this.openPrompt = null, this.transport = e.transport, this.prompt = e.prompt, this.platform = e.platform, this.available = e.factors ?? Se, this.registry = Vr(this.available), this.maxAttempts = e.maxAttempts ?? Hr, this.readObtainedBar = e.readObtainedBar, this.onFlightSettled = e.onFlightSettled, this.settleTimeoutMs = e.replaySettleTimeoutMs ?? zr;
+    this.state = "idle", this.inFlight = null, this.requirement = null, this.selected = null, this.rankedRequirement = null, this.registrations = [], this.proof = null, this.pruned = /* @__PURE__ */ new Set(), this.openPrompt = null, this.transport = e.transport, this.prompt = e.prompt, this.platform = e.platform, this.available = e.factors ?? Te, this.registry = Wr(this.available), this.maxAttempts = e.maxAttempts ?? es, this.readObtainedBar = e.readObtainedBar, this.onFlightSettled = e.onFlightSettled, this.settleTimeoutMs = e.replaySettleTimeoutMs ?? ts;
   }
   /** The current lifecycle state. Read-only. */
   get currentState() {
@@ -3871,7 +4030,7 @@ class Zr {
     const s = t.kind === "imperative" && t.requested !== void 0, n = {
       demanded: t.kind === "imperative" && t.requested ? t.requested : H(e),
       statedBar: s,
-      settlement: Yr(),
+      settlement: rs(),
       reported: !1,
       entry: {
         ...t,
@@ -3899,13 +4058,13 @@ class Zr {
       this.requirement = e;
       return;
     }
-    const s = Jr(t, e);
-    this.requirement = Xr(t, e), s && this.state === "collecting" && this.selected === null && this.openPrompt?.onRequirementRaised?.({ challenge: this.requirement, factors: this.offeredFactors() });
+    const s = ns(t, e);
+    this.requirement = is(t, e), s && this.state === "collecting" && this.selected === null && this.openPrompt?.onRequirementRaised?.({ challenge: this.requirement, factors: this.offeredFactors() });
   }
   /** The factors to offer right now: ranked for the merged bar, minus what the server refused. */
   offeredFactors() {
     const e = this.available.filter((s) => !this.pruned.has(s.type)), t = this.requirement;
-    return t ? Gr(e, t) : e;
+    return t ? Qr(e, t) : e;
   }
   /** The waiter's inbound edge. Idempotent — a second call is ignored. */
   receiveReport(e, t) {
@@ -3973,8 +4132,8 @@ class Zr {
    */
   release(e, t) {
     if (e.entry.kind === "imperative") {
-      if (e.statedBar && !Wr(t, e.demanded)) {
-        this.receiveReport(e, { outcome: "insufficient", obtained: t, required: e.demanded }), e.settlement.reject(new j(t, e.demanded));
+      if (e.statedBar && !ss(t, e.demanded)) {
+        this.receiveReport(e, { outcome: "insufficient", obtained: t, required: e.demanded }), e.settlement.reject(new G(t, e.demanded));
         return;
       }
       this.receiveReport(e, { outcome: "replayed", obtained: t }), e.settlement.resolve({ waiter: e.entry, obtained: t });
@@ -4049,26 +4208,26 @@ class Zr {
     for (let t = 0; t < this.maxAttempts; t++) {
       const s = this.offeredFactors();
       if (s.length === 0)
-        return { status: "failed", reason: new ee() };
+        return { status: "failed", reason: new te() };
       const i = this.requirement;
       let n;
       try {
         n = await this.collect(i, s, e);
       } catch (a) {
-        return { status: "failed", reason: new O(a) };
+        return { status: "failed", reason: new L(a) };
       }
       if (n.type === "cancel")
-        return { status: "failed", reason: new O() };
+        return { status: "failed", reason: new L() };
       const o = this.registry.get(n.factor);
       if (!o) {
-        e = new ee(`Unknown authentication factor: ${n.factor}`), this.state = "collecting", this.selected = null;
+        e = new te(`Unknown authentication factor: ${n.factor}`), this.state = "collecting", this.selected = null;
         continue;
       }
       try {
         return await this.proveAndCommit(o, n.code), { status: "proven", obtained: this.readObtainedBar?.() ?? H(this.rankedRequirement ?? i) };
       } catch (a) {
-        if (a instanceof U && a.cancelled)
-          return { status: "failed", reason: new O() };
+        if (a instanceof x && a.cancelled)
+          return { status: "failed", reason: new L() };
         const h = this.classifyProofFailure(a);
         if (h)
           return { status: "failed", reason: h };
@@ -4097,12 +4256,12 @@ class Zr {
   }
   /** Maps a proof failure to a terminal reason, or `undefined` when the user may retry. */
   classifyProofFailure(e) {
-    if (e instanceof j || e instanceof G || e instanceof $)
+    if (e instanceof G || e instanceof j || e instanceof q)
       return e;
     if (e instanceof _)
       switch (e.kind) {
         case "unavailable":
-          return new G(e.message);
+          return new j(e.message);
         case "exhausted":
         case "attempts_exhausted":
         case "fatal":
@@ -4110,7 +4269,7 @@ class Zr {
         case "network":
           return e;
         case "session_changed":
-          return new $(e.message);
+          return new q(e.message);
         default:
           return;
       }
@@ -4121,14 +4280,14 @@ class Zr {
     await this.transport.commit(e.type, i);
   }
 }
-const tt = "https://passflow-relative.invalid", Qr = () => {
+const ot = "https://passflow-relative.invalid", as = () => {
   const r = globalThis, e = r.document?.baseURI;
   if (typeof e == "string" && e !== "")
     return e;
   const t = r.location?.href;
-  return typeof t == "string" && t !== "" && t !== "about:blank" ? t : tt;
-}, Fe = (r, e = Qr()) => {
-  const t = e === tt;
+  return typeof t == "string" && t !== "" && t !== "about:blank" ? t : ot;
+}, Me = (r, e = as()) => {
+  const t = e === ot;
   let s;
   try {
     s = new URL(e).origin;
@@ -4153,32 +4312,32 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     relativeToBase: s !== void 0 && i.origin === s,
     sentinelBase: t
   };
-}, ae = (r, e) => typeof e == "string" ? [r.toLowerCase(), e] : void 0, es = (r) => {
+}, he = (r, e) => typeof e == "string" ? [r.toLowerCase(), e] : void 0, cs = (r) => {
   const e = [];
   if (r == null)
     return Object.freeze(e);
   const t = r;
   if (typeof t.forEach == "function" && typeof t.entries == "function")
     return r.forEach((s, i) => {
-      const n = ae(i, s);
+      const n = he(i, s);
       n && e.push(n);
     }), Object.freeze(e);
   if (Array.isArray(r)) {
     for (const s of r)
       if (Array.isArray(s) && s.length >= 2) {
-        const i = ae(String(s[0]), s[1]);
+        const i = he(String(s[0]), s[1]);
         i && e.push(i);
       }
     return Object.freeze(e);
   }
   if (typeof r == "object")
     for (const [s, i] of Object.entries(r)) {
-      const n = Array.isArray(i) ? i.join(", ") : i, o = ae(s, n);
+      const n = Array.isArray(i) ? i.join(", ") : i, o = he(s, n);
       o && e.push(o);
     }
   return Object.freeze(e);
-}, rt = (r) => {
-  const e = r.base === void 0 ? Fe(r.url) : Fe(r.url, r.base), t = {
+}, at = (r) => {
+  const e = r.base === void 0 ? Me(r.url) : Me(r.url, r.base), t = {
     raw: r.url,
     href: e.href,
     dispatchUrl: e.sentinelBase || !e.resolved ? r.url : e.href,
@@ -4187,25 +4346,25 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     resolved: e.resolved,
     relativeToBase: e.relativeToBase,
     method: (r.method ?? "GET").toUpperCase(),
-    headers: es(r.headers),
+    headers: cs(r.headers),
     bodyKind: r.bodyKind,
     ..."body" in r ? { body: r.body } : {}
   };
   return Object.freeze(t);
-}, st = (r, e) => {
+}, ct = (r, e) => {
   if (!e || e.from === e.to)
     return r;
   let t = !1;
   const s = r.map(([i, n]) => i === "authorization" && n === e.from ? (t = !0, [i, e.to]) : [i, n]);
   return t ? Object.freeze(s) : r;
-}, it = (r) => {
+}, ht = (r) => {
   const e = {};
   for (const [t, s] of r)
     e[t] = s;
   return e;
-}, ts = new Set(
-  Se.filter((r) => !r.requiresPrepare).map((r) => r.type)
-), rs = (r) => {
+}, hs = new Set(
+  Te.filter((r) => !r.requiresPrepare).map((r) => r.type)
+), ds = (r) => {
   if (!r || typeof r != "object" || !r.challenge_id || !r.expires_at)
     throw new _({
       kind: "protocol",
@@ -4218,16 +4377,16 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     webauthn: r.webauthn,
     codeSentTo: r.code_sent_to
   };
-}, Pe = (r) => Qe(r) && !kr(r), ss = (r) => ({
+}, Ue = (r) => st(r) && !Ar(r), ls = (r) => ({
   async prepare(e) {
-    if (!ts.has(e))
+    if (!hs.has(e))
       try {
         const t = r.relyingPartyId?.(), s = await r.startUpgrade(t ? { method: e, relying_party_id: t } : { method: e });
-        return rs(s);
+        return ds(s);
       } catch (t) {
-        if (Pe(t))
+        if (Ue(t))
           throw t;
-        const s = Ce(t, "start");
+        const s = Pe(t, "start");
         if (s.kind === "prepare_not_required")
           return;
         throw s;
@@ -4240,42 +4399,42 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     try {
       await r.commitRefresh({ type: e, assertion: t });
     } catch (i) {
-      if (Pe(i))
+      if (Ue(i))
         throw i;
-      const n = Ce(i, "refresh");
-      throw n.status === 401 && Tr(n) && r.markSessionInvalid?.(), n;
+      const n = Pe(i, "refresh");
+      throw n.status === 401 && Fr(n) && r.markSessionInvalid?.(), n;
     }
   }
-}), nt = (r) => typeof r == "function" ? r() : r, Me = (r) => {
+}), dt = (r) => typeof r == "function" ? r() : r, De = (r) => {
   try {
     return new URL(r);
   } catch {
     return;
   }
-}, fe = (r, e) => {
+}, ve = (r, e) => {
   if (!e || e === "/")
     return !0;
   const t = e.replace(/\/+$/, "");
   return r === t || r.startsWith(`${t}/`);
-}, is = (r, e) => !e || r.origin === void 0 ? !1 : r.origin === e.origin && fe(r.pathname, e.pathPrefix), ns = (r, e) => {
+}, us = (r, e) => !e || r.origin === void 0 ? !1 : r.origin === e.origin && ve(r.pathname, e.pathPrefix), ps = (r, e) => {
   for (const t of e) {
     if (t === "")
       continue;
     if (t.startsWith("/")) {
-      if (r.relativeToBase && fe(r.pathname, t))
+      if (r.relativeToBase && ve(r.pathname, t))
         return !0;
       continue;
     }
-    const s = Me(t) ?? Me(`https://${t}`);
-    if (!(!s || r.origin === void 0) && r.origin === s.origin && fe(r.pathname, s.pathname))
+    const s = De(t) ?? De(`https://${t}`);
+    if (!(!s || r.origin === void 0) && r.origin === s.origin && ve(r.pathname, s.pathname))
       return !0;
   }
   return !1;
-}, De = (r, e, t) => is(r, e.passflow) || ns(r, e.backend) ? t ? t(r.href) !== !1 : !0 : !1, ot = (r) => {
+}, xe = (r, e, t) => us(r, e.passflow) || ps(r, e.backend) ? t ? t(r.href) !== !1 : !0 : !1, lt = (r) => {
   const e = r.detail, t = e?.message ?? `[passflow] upgrade challenge not actioned: ${r.reason}`;
   console.warn(t, { status: r.status, url: r.url, reason: r.reason, detail: e });
-}, os = (r, e) => {
-  const t = e.onUpgradeDiagnostic ?? ot;
+}, fs = (r, e) => {
+  const t = e.onUpgradeDiagnostic ?? lt;
   return (s, i) => {
     t({
       status: r.status,
@@ -4284,12 +4443,12 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
       detail: { method: r.request.method, ...i ?? {} }
     });
   };
-}, ge = (r, e, t) => {
-  const s = t.onUpgradeDiagnostic ?? ot;
+}, me = (r, e, t) => {
+  const s = t.onUpgradeDiagnostic ?? lt;
   for (const i of r)
     s({ ...i, url: e.request.href, detail: { method: e.request.method, ...i.detail ?? {} } });
-}, as = /\bjson\b/i, ve = async (r, e) => {
-  const t = e.requireChallengeChannel === "header", s = r.getHeader("content-type") ?? "", i = !t && as.test(s);
+}, gs = /\bjson\b/i, ye = async (r, e) => {
+  const t = e.requireChallengeChannel === "header", s = r.getHeader("content-type") ?? "", i = !t && gs.test(s);
   let n;
   if (i)
     try {
@@ -4298,23 +4457,23 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
       n = void 0;
     }
   const o = i ? { status: r.status, getHeader: (a) => r.getHeader(a) ?? void 0, body: n } : { status: r.status, getHeader: (a) => r.getHeader(a) ?? void 0 };
-  return we(o, { requireChallengeChannel: e.requireChallengeChannel });
-}, cs = (r) => we(
+  return be(o, { requireChallengeChannel: e.requireChallengeChannel });
+}, vs = (r) => be(
   { status: r.status, getHeader: (e) => r.getHeader(e) ?? void 0 },
   { requireChallengeChannel: "header" }
-).challenge, hs = (r, e) => e.passflow === null ? `[passflow] a 401/403 from ${r} carried an upgrade challenge, but no Passflow endpoint is configured — set \`url\` on the Passflow config.` : `[passflow] a 401/403 from ${r} carried an upgrade challenge, but that URL is not covered by the provider's \`backend\` prop — add it there to enable step-up for this API.`, ds = (r, e) => r instanceof O ? { kind: "cancelled" } : r instanceof ee ? { kind: "unsatisfiable" } : r instanceof G ? { kind: "unavailable" } : r instanceof $ ? { kind: "session-changed" } : r instanceof j ? { kind: "insufficient", obtained: r.obtained, required: r.required } : r instanceof _ ? r.kind === "exhausted" || r.kind === "attempts_exhausted" ? { kind: "exhausted", error: r } : r.kind === "unavailable" ? { kind: "unavailable" } : r.kind === "session_changed" ? { kind: "session-changed" } : { kind: "transport-failure", status: r.status, retryable: r.retryable, error: r } : {
+).challenge, ms = (r, e) => e.passflow === null ? `[passflow] a 401/403 from ${r} carried an upgrade challenge, but no Passflow endpoint is configured — set \`url\` on the Passflow config.` : `[passflow] a 401/403 from ${r} carried an upgrade challenge, but that URL is not covered by the provider's \`backend\` prop — add it there to enable step-up for this API.`, ys = (r, e) => r instanceof L ? { kind: "cancelled" } : r instanceof te ? { kind: "unsatisfiable" } : r instanceof j ? { kind: "unavailable" } : r instanceof q ? { kind: "session-changed" } : r instanceof G ? { kind: "insufficient", obtained: r.obtained, required: r.required } : r instanceof _ ? r.kind === "exhausted" || r.kind === "attempts_exhausted" ? { kind: "exhausted", error: r } : r.kind === "unavailable" ? { kind: "unavailable" } : r.kind === "session_changed" ? { kind: "session-changed" } : { kind: "transport-failure", status: r.status, retryable: r.retryable, error: r } : {
   kind: "transport-failure",
   retryable: !1,
   error: r instanceof Error ? r : new Error(String(r))
-}, ls = async (r, e, t, s) => {
+}, ks = async (r, e, t, s) => {
   if (r.status !== 401 && r.status !== 403)
     return { kind: "replayed", response: r };
-  const { challenge: i, diagnostics: n } = await ve(r, e);
-  if (ge(n, r, e), !i)
+  const { challenge: i, diagnostics: n } = await ye(r, e);
+  if (me(n, r, e), !i)
     return { kind: "replayed", response: r };
   const o = H(i);
   return s("elevated-insufficient", { obtained: t, required: o }), { kind: "insufficient", obtained: t, required: o, response: r };
-}, us = async (r, e) => {
+}, ws = async (r, e) => {
   if (!e)
     return { aborted: !1, value: await r };
   if (e.aborted)
@@ -4330,32 +4489,32 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
   } finally {
     t && e.removeEventListener?.("abort", t);
   }
-}, at = async (r, e) => {
+}, ut = async (r, e) => {
   if (r.status !== 401 && r.status !== 403)
     return { kind: "not-a-challenge" };
   if (r.markers.upgradeTransaction)
     return { kind: "not-a-challenge" };
-  const t = os(r, e);
+  const t = fs(r, e);
   if (r.markers.replayed) {
-    if (!De(r.request, e.scope, e.shouldIntercept))
+    if (!xe(r.request, e.scope, e.shouldIntercept))
       return { kind: "not-a-challenge" };
-    const { challenge: y, diagnostics: I } = await ve(r, e);
-    if (ge(I, r, e), !y)
+    const { challenge: y, diagnostics: I } = await ye(r, e);
+    if (me(I, r, e), !y)
       return { kind: "not-a-challenge" };
-    const W = e.readObtainedBar?.() ?? {}, _e = H(y);
-    return t("elevated-insufficient", { obtained: W, required: _e }), { kind: "insufficient", obtained: W, required: _e, response: r };
+    const W = e.readObtainedBar?.() ?? {}, Ie = H(y);
+    return t("elevated-insufficient", { obtained: W, required: Ie }), { kind: "insufficient", obtained: W, required: Ie, response: r };
   }
-  if (!De(r.request, e.scope, e.shouldIntercept))
-    return cs(r) ? (t("challenge-out-of-scope", {
+  if (!xe(r.request, e.scope, e.shouldIntercept))
+    return vs(r) ? (t("challenge-out-of-scope", {
       header: r.getHeader("www-authenticate") ?? void 0,
-      message: hs(r.request.href, e.scope)
+      message: ms(r.request.href, e.scope)
     }), { kind: "out-of-scope" }) : { kind: "not-a-challenge" };
-  const { challenge: s, diagnostics: i } = await ve(r, e);
-  if (ge(i, r, e), !s) {
-    const u = r.getHeader("www-authenticate");
+  const { challenge: s, diagnostics: i } = await ye(r, e);
+  if (me(i, r, e), !s) {
+    const p = r.getHeader("www-authenticate");
     return e.requireChallengeChannel !== "header" && t("no-channel", {
-      ...u ? { header: u } : {},
-      message: r.responseType === "cors" && !u ? `[passflow] a cross-origin ${r.status} from ${r.request.href} carried no readable challenge: \`WWW-Authenticate\` is not CORS-safelisted, so add \`Access-Control-Expose-Headers: WWW-Authenticate\` on that server, or have it emit the \`upgrade_required\` JSON body.` : `[passflow] a ${r.status} from ${r.request.href} carried no upgrade challenge on either channel; treated as an ordinary ${r.status}.`
+      ...p ? { header: p } : {},
+      message: r.responseType === "cors" && !p ? `[passflow] a cross-origin ${r.status} from ${r.request.href} carried no readable challenge: \`WWW-Authenticate\` is not CORS-safelisted, so add \`Access-Control-Expose-Headers: WWW-Authenticate\` on that server, or have it emit the \`upgrade_required\` JSON body.` : `[passflow] a ${r.status} from ${r.request.href} carried no upgrade challenge on either channel; treated as an ordinary ${r.status}.`
     }), { kind: "not-a-challenge" };
   }
   if (r.replayable === !1)
@@ -4365,45 +4524,45 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
   const n = e.authorizationSwap?.(), o = { kind: "request", url: r.request.href, method: r.request.method };
   let a, h;
   try {
-    a = Promise.resolve(e.elevate(s, o)), h = await us(a, r.signal);
-  } catch (u) {
-    return ds(u);
+    a = Promise.resolve(e.elevate(s, o)), h = await ws(a, r.signal);
+  } catch (p) {
+    return ys(p);
   }
   if (h.aborted)
     return a?.then(
-      (u) => u?.waiter.report({ outcome: "failed" }),
+      (p) => p?.waiter.report({ outcome: "failed" }),
       () => {
       }
     ), { kind: "aborted", reason: h.reason };
-  const p = h.value;
+  const u = h.value;
   if (r.signal?.aborted)
-    return p?.waiter.report({ outcome: "failed" }), { kind: "aborted", reason: r.signal.reason };
-  const m = p?.obtained ?? e.readObtainedBar?.() ?? H(s), d = e.authorizationSwap?.(), g = d ? { from: n?.from ?? d.from, to: d.to } : void 0;
+    return u?.waiter.report({ outcome: "failed" }), { kind: "aborted", reason: r.signal.reason };
+  const m = u?.obtained ?? e.readObtainedBar?.() ?? H(s), d = e.authorizationSwap?.(), g = d ? { from: n?.from ?? d.from, to: d.to } : void 0;
   r.markers.replayed = !0;
   let f;
   try {
     f = await r.replay(g ? { authorizationSwap: g } : void 0);
-  } catch (u) {
-    if (u instanceof j)
-      return p?.waiter.report({ outcome: "insufficient", obtained: u.obtained, required: u.required }), r.signal?.aborted ? { kind: "aborted", reason: r.signal.reason } : { kind: "insufficient", obtained: u.obtained, required: u.required };
-    if (p?.waiter.report({ outcome: "failed" }), r.signal?.aborted)
+  } catch (p) {
+    if (p instanceof G)
+      return u?.waiter.report({ outcome: "insufficient", obtained: p.obtained, required: p.required }), r.signal?.aborted ? { kind: "aborted", reason: r.signal.reason } : { kind: "insufficient", obtained: p.obtained, required: p.required };
+    if (u?.waiter.report({ outcome: "failed" }), r.signal?.aborted)
       return { kind: "aborted", reason: r.signal.reason };
-    throw u;
+    throw p;
   }
-  const v = await ls(f, e, m, t);
-  return v.kind === "insufficient" ? p?.waiter.report({ outcome: "insufficient", obtained: v.obtained, required: v.required }) : p?.waiter.report({ outcome: "replayed", obtained: m }), v;
-}, ps = (r) => {
+  const v = await ks(f, e, m, t);
+  return v.kind === "insufficient" ? u?.waiter.report({ outcome: "insufficient", obtained: v.obtained, required: v.required }) : u?.waiter.report({ outcome: "replayed", obtained: m }), v;
+}, Ss = (r) => {
   switch (r.kind) {
     case "cancelled":
-      return new O();
+      return new L();
     case "unsatisfiable":
-      return new ee();
+      return new te();
     case "unavailable":
-      return new G();
+      return new j();
     case "session-changed":
-      return new $();
+      return new q();
     case "insufficient":
-      return new j(r.obtained, r.required);
+      return new G(r.obtained, r.required);
     case "exhausted":
       return r.error;
     case "transport-failure":
@@ -4411,7 +4570,7 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     default:
       return;
   }
-}, fs = (r, e, t) => {
+}, bs = (r, e, t) => {
   switch (r.kind) {
     case "replayed":
       return { settle: "resolve", value: r.response.raw };
@@ -4422,47 +4581,47 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     case "aborted":
       return { settle: "reject", error: r.reason };
     case "cancelled":
-      return t.onCancel === "reject" ? { settle: "reject", error: new O() } : { settle: "resolve", value: ce(e, r) };
+      return t.onCancel === "reject" ? { settle: "reject", error: new L() } : { settle: "resolve", value: de(e, r) };
     case "insufficient":
-      return { settle: "resolve", value: ce(r.response?.raw ?? e, r) };
+      return { settle: "resolve", value: de(r.response?.raw ?? e, r) };
     default:
-      return { settle: "resolve", value: ce(e, r) };
+      return { settle: "resolve", value: de(e, r) };
   }
-}, gs = (r, e) => {
+}, Ts = (r, e) => {
   switch (r.kind) {
     case "replayed":
       return r.response.rejected ? { settle: "reject", error: r.response.raw ?? e } : { settle: "resolve", value: r.response.raw };
     case "aborted":
       return { settle: "reject", error: r.reason };
     default:
-      return { settle: "reject", error: ps(r) ?? e };
+      return { settle: "reject", error: Ss(r) ?? e };
   }
-}, ct = /* @__PURE__ */ new WeakSet(), ht = /* @__PURE__ */ new WeakSet(), dt = /* @__PURE__ */ new WeakSet(), lt = /* @__PURE__ */ new WeakSet(), ut = /* @__PURE__ */ new WeakSet(), pt = /* @__PURE__ */ new WeakSet(), ft = /* @__PURE__ */ new WeakSet(), ce = (r, e) => {
+}, pt = /* @__PURE__ */ new WeakSet(), ft = /* @__PURE__ */ new WeakSet(), gt = /* @__PURE__ */ new WeakSet(), vt = /* @__PURE__ */ new WeakSet(), mt = /* @__PURE__ */ new WeakSet(), yt = /* @__PURE__ */ new WeakSet(), kt = /* @__PURE__ */ new WeakSet(), de = (r, e) => {
   switch (e.kind) {
     case "cancelled":
-      ct.add(r);
+      pt.add(r);
       break;
     case "exhausted":
-      ht.add(r);
+      ft.add(r);
       break;
     case "insufficient":
-      dt.add(r);
+      gt.add(r);
       break;
     case "unsatisfiable":
-      lt.add(r);
+      vt.add(r);
       break;
     case "unavailable":
-      ut.add(r);
+      mt.add(r);
       break;
     case "session-changed":
-      pt.add(r);
+      yt.add(r);
       break;
     case "transport-failure":
-      ft.add(r);
+      kt.add(r);
       break;
   }
   return r;
-}, Js = (r) => ct.has(r), Zs = (r) => ht.has(r), Qs = (r) => dt.has(r), ei = (r) => lt.has(r), ti = (r) => ut.has(r), ri = (r) => pt.has(r), si = (r) => ft.has(r), vs = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]), re = (r) => typeof r == "object" && r !== null && typeof r.url == "string" && typeof r.clone == "function" && "method" in r, ms = (r) => typeof r == "string" ? r : re(r) ? r.url : String(r), ys = (r, e) => (e?.method ?? (re(r) ? r.method : void 0) ?? "GET").toUpperCase(), ks = (r) => r == null ? "none" : typeof r == "string" ? "reusable" : typeof r.getReader == "function" ? "one-shot" : "reusable", ws = (r) => {
+}, ni = (r) => pt.has(r), oi = (r) => ft.has(r), ai = (r) => gt.has(r), ci = (r) => vt.has(r), hi = (r) => mt.has(r), di = (r) => yt.has(r), li = (r) => kt.has(r), _s = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]), se = (r) => typeof r == "object" && r !== null && typeof r.url == "string" && typeof r.clone == "function" && "method" in r, Es = (r) => typeof r == "string" ? r : se(r) ? r.url : String(r), Is = (r, e) => (e?.method ?? (se(r) ? r.method : void 0) ?? "GET").toUpperCase(), As = (r) => r == null ? "none" : typeof r == "string" ? "reusable" : typeof r.getReader == "function" ? "one-shot" : "reusable", Cs = (r) => {
   if (typeof r == "string")
     return r.length;
   const e = r;
@@ -4470,7 +4629,7 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     return e.size;
   if (typeof e?.byteLength == "number")
     return e.byteLength;
-}, Q = (r, e, t) => r === void 0 || r === "always" ? !0 : r === "idempotent-only" ? vs.has(e.method) : typeof r == "function" ? r(e) : !(r.maxBodyBytes !== void 0 && t !== void 0 && t > r.maxBodyBytes), N = (r, e, t, s, i) => ({
+}, ee = (r, e, t) => r === void 0 || r === "always" ? !0 : r === "idempotent-only" ? _s.has(e.method) : typeof r == "function" ? r(e) : !(r.maxBodyBytes !== void 0 && t !== void 0 && t > r.maxBodyBytes), N = (r, e, t, s, i) => ({
   replayable: !1,
   bodyKind: r,
   reason: e,
@@ -4478,12 +4637,12 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
   forwardInit: i,
   snapshot: s,
   replay: () => Promise.reject(new Error(`This request cannot be replayed: ${e}`))
-}), gt = (r, e) => it(st(r.headers, e?.authorizationSwap)), he = (r) => {
+}), wt = (r, e) => ht(ct(r.headers, e?.authorizationSwap)), le = (r) => {
   if (!r || !("headers" in r))
     return r;
   const { headers: e, ...t } = r;
   return t;
-}, Ss = (r, e) => e && "headers" in e && e.headers !== void 0 ? e.headers : re(r) ? r.headers : void 0, bs = (r) => {
+}, Rs = (r, e) => e && "headers" in e && e.headers !== void 0 ? e.headers : se(r) ? r.headers : void 0, Ps = (r) => {
   if (r === null || typeof r == "string")
     return r;
   if (typeof FormData < "u" && r instanceof FormData) {
@@ -4493,12 +4652,12 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     return e;
   }
   return typeof URLSearchParams < "u" && r instanceof URLSearchParams ? new URLSearchParams(r) : r instanceof ArrayBuffer ? r.slice(0) : ArrayBuffer.isView(r) ? new Uint8Array(r.buffer, r.byteOffset, r.byteLength).slice() : r;
-}, Ue = (r, e, t) => new Request(r, { headers: gt(e, t) }), Ts = (r, e, t) => {
-  const s = ms(r), i = ys(r, e), n = Ss(r, e), o = (d, g) => rt({ url: s, method: i, headers: n, bodyKind: d, ...g === void 0 ? {} : { body: g } });
-  if (re(r)) {
+}, Oe = (r, e, t) => new Request(r, { headers: wt(e, t) }), Fs = (r, e, t) => {
+  const s = Es(r), i = Is(r, e), n = Rs(r, e), o = (d, g) => at({ url: s, method: i, headers: n, bodyKind: d, ...g === void 0 ? {} : { body: g } });
+  if (se(r)) {
     if (r.body === null || r.body === void 0) {
       const v = o("none");
-      return Q(t, { url: s, method: i, bodyKind: "none" }) ? {
+      return ee(t, { url: s, method: i, bodyKind: "none" }) ? {
         replayable: !0,
         bodyKind: "none",
         forwardInput: r,
@@ -4507,11 +4666,11 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
         // The snapshot's effective header set is applied to the `Request` and
         // `init.headers` is dropped, so `fetch` has only one set to choose
         // from. See `replayHeaders` for why that matters.
-        replay: (y, I) => y(Ue(r, v, I), he(e))
+        replay: (y, I) => y(Oe(r, v, I), le(e))
       } : N("none", "the replay policy refused this request", r, v, e);
     }
     const d = o("request-clone");
-    if (!Q(t, { url: s, method: i, bodyKind: "request-clone" }))
+    if (!ee(t, { url: s, method: i, bodyKind: "request-clone" }))
       return N("request-clone", "the replay policy refused this request", r, d, e);
     let f;
     try {
@@ -4525,15 +4684,15 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
       forwardInput: r,
       forwardInit: e,
       snapshot: d,
-      replay: (v, u) => v(Ue(f, d, u), he(e))
+      replay: (v, p) => v(Oe(f, d, p), le(e))
     };
   }
-  const a = ks(e?.body);
+  const a = As(e?.body);
   if (a === "one-shot")
     return N("one-shot", "a streaming request body is consumed by the first send", r, o("one-shot"), e);
-  if (!Q(t, { url: s, method: i, bodyKind: a }, ws(e?.body)))
+  if (!ee(t, { url: s, method: i, bodyKind: a }, Cs(e?.body)))
     return N(a, "the replay policy refused this request", r, o(a), e);
-  const p = e && "body" in e ? bs(e.body ?? null) : void 0, m = o(a, p);
+  const u = e && "body" in e ? Ps(e.body ?? null) : void 0, m = o(a, u);
   return {
     replayable: !0,
     bodyKind: a,
@@ -4558,22 +4717,22 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     // unchanged, so an abort during the replay behaves identically to an abort
     // during the original.
     replay: (d, g) => d(m.dispatchUrl, {
-      ...he(e),
-      ...p === void 0 ? {} : { body: p },
-      headers: gt(m, g),
+      ...le(e),
+      ...u === void 0 ? {} : { body: u },
+      headers: wt(m, g),
       method: m.method
     })
   };
-}, se = (r) => typeof r == "object" && r !== null, _s = (r) => (e) => {
-  if (!se(r))
+}, ie = (r) => typeof r == "object" && r !== null, Ms = (r) => (e) => {
+  if (!ie(r))
     return;
   const s = r[e] ?? r[e.toLowerCase()] ?? (typeof r.get == "function" ? r.get(e) : void 0);
   return Array.isArray(s) ? s.join(", ") : typeof s == "string" ? s : void 0;
-}, Es = (r) => {
+}, Us = (r) => {
   const e = r?.url ?? "", t = r?.baseURL;
   return !t || /^([a-z][a-z\d+\-.]*:)?\/\//i.test(e) ? e : `${t.replace(/\/+$/, "")}/${e.replace(/^\/+/, "")}`;
-}, Is = (r) => (r?.method ?? "GET").toUpperCase(), As = (r) => r == null ? "none" : se(r) && (typeof r.pipe == "function" || typeof r.getReader == "function") ? "one-shot" : "reusable", Cs = (r, e, t) => {
-  const s = it(st(e.headers, t?.authorizationSwap)), i = e.dispatchUrl === e.href && e.resolved;
+}, Ds = (r) => (r?.method ?? "GET").toUpperCase(), xs = (r) => r == null ? "none" : ie(r) && (typeof r.pipe == "function" || typeof r.getReader == "function") ? "one-shot" : "reusable", Os = (r, e, t) => {
+  const s = ht(ct(e.headers, t?.authorizationSwap)), i = e.dispatchUrl === e.href && e.resolved;
   return {
     ...r,
     ...i ? { baseURL: void 0 } : {},
@@ -4582,56 +4741,56 @@ const tt = "https://passflow-relative.invalid", Qr = () => {
     headers: s,
     ..."body" in e ? { data: e.body } : {}
   };
-}, me = (r, e, t, s, i, n) => {
-  const o = e ?? r?.config, a = As(o?.data), h = n ?? rt({
-    url: Es(o),
-    method: Is(o),
+}, ke = (r, e, t, s, i, n) => {
+  const o = e ?? r?.config, a = xs(o?.data), h = n ?? at({
+    url: Us(o),
+    method: Ds(o),
     headers: o?.headers,
     bodyKind: a,
     body: o?.data
-  }), p = { url: h.href, method: h.method, bodyKind: a }, m = a !== "one-shot" && Q(i.replay, p);
+  }), u = { url: h.href, method: h.method, bodyKind: a }, m = a !== "one-shot" && ee(i.replay, u);
   return {
     status: r?.status ?? 0,
-    getHeader: _s(r?.headers),
+    getHeader: Ms(r?.headers),
     // Pre-read by axios into `data`; nothing is consumed by reading it again,
     // and the core still decides whether reading it is in scope.
     readBody: async () => r?.data,
     request: h,
     replay: async (d) => {
-      const g = Wt(Cs(o ?? {}, h, d));
+      const g = er(Os(o ?? {}, h, d));
       try {
         const f = await s(g);
-        return me(f, f?.config ?? g, f, s, i, h);
+        return ke(f, f?.config ?? g, f, s, i, h);
       } catch (f) {
-        const v = se(f) ? f : {};
-        if (!v.response || typeof v.response.status != "number" || Qe(f))
+        const v = ie(f) ? f : {};
+        if (!v.response || typeof v.response.status != "number" || st(f))
           throw f;
-        return { ...me(v.response, v.config ?? g, f, s, i, h), rejected: !0 };
+        return { ...ke(v.response, v.config ?? g, f, s, i, h), rejected: !0 };
       }
     },
     markers: {
-      ...Xe(o) ? { upgradeTransaction: !0 } : {},
-      ...Xt(o) ? { replayed: !0 } : {}
+      ...Ze(o) ? { upgradeTransaction: !0 } : {},
+      ...tr(o) ? { replayed: !0 } : {}
     },
     raw: t,
     replayable: m,
     replayUnsupportedReason: a === "one-shot" ? "a streaming request body is consumed by the first send" : "the replay policy refused this request",
     signal: o?.signal
   };
-}, vt = (r, e) => async (t) => {
-  const s = nt(r), i = se(t) ? t : {}, n = me(i.response, i.config, i.response, e, s), o = await at(n, s), a = gs(o, t);
+}, St = (r, e) => async (t) => {
+  const s = dt(r), i = ie(t) ? t : {}, n = ke(i.response, i.config, i.response, e, s), o = await ut(n, s), a = Ts(o, t);
   if (a.settle === "reject")
     throw a.error;
   return a.value;
-}, Rs = (r, e, t) => {
-  const s = r.request, i = typeof s == "function" ? (a) => s.call(r, a) : () => Promise.reject(new Error("Passflow: this client exposes no request() to replay through.")), n = r.interceptors.response.use(void 0, vt(e, i));
+}, Ls = (r, e, t) => {
+  const s = r.request, i = typeof s == "function" ? (a) => s.call(r, a) : () => Promise.reject(new Error("Passflow: this client exposes no request() to replay through.")), n = r.interceptors.response.use(void 0, St(e, i));
   let o = !1;
   return () => {
     o || (o = !0, r.interceptors.response.eject(n));
   };
 };
-let de = 0;
-const Fs = (r, e) => {
+let ue = 0;
+const $s = (r, e) => {
   const t = e?.signal ?? (typeof r == "object" && r !== null ? r.signal : void 0) ?? void 0;
   if (t)
     return {
@@ -4646,9 +4805,9 @@ const Fs = (r, e) => {
         removeEventListener: (s, i) => t.removeEventListener(s, i)
       } : {}
     };
-}, Ps = (r) => (e) => r.headers?.get(e), mt = (r, e, t, s, i) => ({
+}, qs = (r) => (e) => r.headers?.get(e), bt = (r, e, t, s, i) => ({
   status: r.status,
-  getHeader: Ps(r),
+  getHeader: qs(r),
   // A CLONE, always. The response the caller receives must still have an unread
   // body, and the core calls this only when the scope and the channel policy
   // both permit a body read.
@@ -4661,7 +4820,7 @@ const Fs = (r, e) => {
   request: e.snapshot,
   replay: async (n) => {
     const o = await e.replay(t, n);
-    return mt(o, e, t, s, i);
+    return bt(o, e, t, s, i);
   },
   markers: s,
   raw: r,
@@ -4669,89 +4828,89 @@ const Fs = (r, e) => {
   replayUnsupportedReason: e.reason,
   signal: i,
   responseType: r.type
-}), le = (r, e) => {
+}), pe = (r, e) => {
   const t = (s, i) => {
-    de += 1;
+    ue += 1;
     try {
       return r(s, i);
     } finally {
-      de -= 1;
+      ue -= 1;
     }
   };
   return async (s, i) => {
-    if (de > 0)
+    if (ue > 0)
       return t(s, i);
-    const n = nt(e), o = Ts(s, i, n.replay), a = await t(o.forwardInput, o.forwardInit), h = mt(a, o, t, {}, Fs(s, i)), p = await at(h, n), m = fs(p, a, n);
+    const n = dt(e), o = Fs(s, i, n.replay), a = await t(o.forwardInput, o.forwardInit), h = bt(a, o, t, {}, $s(s, i)), u = await ut(h, n), m = bs(u, a, n);
     if (m.settle === "reject")
       throw m.error;
     return m.value;
   };
-}, Ms = (r, e) => {
-  const t = K.create(r);
+}, Ns = (r, e) => {
+  const t = B.create(r);
   return e(t), t;
-}, ii = 10, Ds = 20;
-class Us extends Error {
+}, ui = 10, Vs = 20;
+class Ks extends Error {
   constructor(e) {
     super(
       `Passflow fetch middleware '${e}' resolved without calling next(). Every registered middleware must delegate exactly once; swallowing a request would drop a caller's fetch inside the Passflow wrapper.`
     ), this.name = "FetchMiddlewareContractError", this.middlewareName = e;
   }
 }
-let x = [], xs = 0, z = !1, B, L;
-const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof globalThis > "u" ? void 0 : globalThis, ye = async (r, e, t, s) => {
+let O = [], Bs = 0, z = !1, K, $;
+const Tt = (r, e) => r.priority - e.priority || r.seq - e.seq, _e = () => typeof globalThis > "u" ? void 0 : globalThis, we = async (r, e, t, s) => {
   if (e >= r.length) {
-    const h = B;
+    const h = K;
     if (!h)
       throw new Error("Passflow fetch registry: no captured fetch to delegate to.");
     return h(t, s);
   }
   const i = r[e];
   if (!i)
-    return ye(r, r.length, t, s);
+    return we(r, r.length, t, s);
   let n = !1;
-  const o = (h, p) => (n = !0, ye(r, e + 1, h, p)), a = await i.middleware(o, t, s);
+  const o = (h, u) => (n = !0, we(r, e + 1, h, u)), a = await i.middleware(o, t, s);
   if (!n)
-    throw new Us(i.name);
+    throw new Ks(i.name);
   return a;
-}, Os = () => {
-  const r = be();
+}, Gs = () => {
+  const r = _e();
   if (!r || typeof r.fetch != "function")
     return !1;
-  const e = r.fetch.bind(r), t = (s, i) => ye([...x].sort(yt), 0, s, i);
-  return B = e, L = t, r.fetch = t, z = !0, !0;
-}, Ls = () => {
-  const r = be();
-  !r || !L || r.fetch === L && (B && (r.fetch = B), z = !1, L = void 0, B = void 0);
-}, $s = (r, e) => {
-  if (!z && !Os())
+  const e = r.fetch.bind(r), t = (s, i) => we([...O].sort(Tt), 0, s, i);
+  return K = e, $ = t, r.fetch = t, z = !0, !0;
+}, js = () => {
+  const r = _e();
+  !r || !$ || r.fetch === $ && (K && (r.fetch = K), z = !1, $ = void 0, K = void 0);
+}, Hs = (r, e) => {
+  if (!z && !Gs())
     return () => {
     };
   const t = {
     middleware: r,
     name: e.name,
     priority: e.priority,
-    seq: xs++
+    seq: Bs++
   };
-  x.push(t);
+  O.push(t);
   let s = !1;
   return () => {
-    s || (s = !0, x = x.filter((i) => i !== t), x.length === 0 && Ls());
+    s || (s = !0, O = O.filter((i) => i !== t), O.length === 0 && js());
   };
-}, ni = () => {
-  const r = be();
+}, pi = () => {
+  const r = _e();
   return {
     installed: z,
-    names: [...x].sort(yt).map((e) => e.name),
-    foreignPatch: z && !!r && !!L && r.fetch !== L
+    names: [...O].sort(Tt).map((e) => e.name),
+    foreignPatch: z && !!r && !!$ && r.fetch !== $
   };
-}, qs = (r) => r === void 0 ? [] : (Array.isArray(r) ? r : [r]).filter((e) => e !== ""), Ns = (r) => {
+}, zs = (r) => r === void 0 ? [] : (Array.isArray(r) ? r : [r]).filter((e) => e !== ""), Ys = (r) => {
   let e;
   const t = (d) => d !== void 0 && e === d, s = (d) => {
     const g = () => {
       if (!t(d()))
         throw new _({ kind: "session_changed" });
     };
-    return ss({
+    return ls({
       ...r,
       relyingPartyId: () => e?.options.relyingPartyId ?? r.relyingPartyId?.(),
       startUpgrade: (f) => (g(), r.startUpgrade(f)),
@@ -4763,8 +4922,8 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
       } : {}
     });
   }, i = (d, g) => {
-    const f = {}, u = {
-      controller: new Zr({
+    const f = {}, p = {
+      controller: new os({
         transport: s(() => f.current),
         prompt: d.prompt,
         platform: r.platform,
@@ -4774,18 +4933,18 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
         ...d.onFlightSettled ? { onFlightSettled: d.onFlightSettled } : {}
       }),
       options: d,
-      scope: { passflow: r.passflowDomain, backend: qs(d.backend) },
+      scope: { passflow: r.passflowDomain, backend: zs(d.backend) },
       generation: g
     };
-    return f.current = u, u;
+    return f.current = p, p;
   }, n = async (d, g) => {
     const f = e;
     if (!f)
-      throw new G("Step-up verification is not enabled on this Passflow instance");
+      throw new j("Step-up verification is not enabled on this Passflow instance");
     f.controller.active || (f.pin = r.readSessionPin?.());
     const v = await f.controller.elevate(d, g);
     if (!t(f))
-      throw new $();
+      throw new q();
     return v;
   }, o = () => {
     const d = e, g = d?.scope ?? { passflow: r.passflowDomain, backend: [] }, f = d?.options;
@@ -4803,16 +4962,16 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
   };
   let a;
   return Object.defineProperties(async (d) => {
-    const g = d?.acrValues === void 0 ? void 0 : te(d.acrValues).level, f = {
+    const g = d?.acrValues === void 0 ? void 0 : re(d.acrValues).level, f = {
       status: 401,
       ...d?.acrValues === void 0 ? {} : { acrValues: d.acrValues },
       ...g === void 0 ? {} : { requiredLevel: g },
       ...d?.maxAge === void 0 ? {} : { maxAge: d.maxAge }
-    }, v = d?.acrValues !== void 0 || d?.maxAge !== void 0, u = {
+    }, v = d?.acrValues !== void 0 || d?.maxAge !== void 0, p = {
       ...d?.acrValues === void 0 ? {} : { acrValues: d.acrValues },
       ...g === void 0 ? {} : { level: g },
       ...d?.maxAge === void 0 ? {} : { maxAge: d.maxAge }
-    }, I = (await n(f, { kind: "imperative", ...v ? { requested: u } : {} })).obtained.acrValues;
+    }, I = (await n(f, { kind: "imperative", ...v ? { requested: p } : {} })).obtained.acrValues;
     return { status: "elevated", ...I === void 0 ? {} : { acr: I } };
   }, {
     enable: { value: (d) => {
@@ -4820,11 +4979,11 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
       const g = [];
       if (r.attachInternalSeam) {
         const v = r.attachInternalSeam;
-        v((u) => vt(o, u)), g.push(() => v(void 0));
+        v((p) => St(o, p)), g.push(() => v(void 0));
       }
       d.interceptFetch && g.push(
-        $s((v, u, y) => le(v, o)(u, y), {
-          priority: Ds,
+        Hs((v, p, y) => pe(v, o)(p, y), {
+          priority: Vs,
           name: "passflow-upgrade"
         })
       ), r.onSessionChange && g.push(
@@ -4857,19 +5016,19 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
       enumerable: !0,
       value: (d) => {
         if (d)
-          return le(d, o);
+          return pe(d, o);
         const g = typeof globalThis > "u" ? void 0 : globalThis;
         if (!g || typeof g.fetch != "function")
           throw new Error("Passflow: withAuth() needs a fetch to wrap — this runtime has none.");
-        return le(g.fetch.bind(g), o);
+        return pe(g.fetch.bind(g), o);
       }
     },
     attachAuth: {
       enumerable: !0,
-      value: (d) => Rs(d, o)
+      value: (d) => Ls(d, o)
     }
   });
-}, Te = class Te {
+}, Ee = class Ee {
   constructor(e) {
     this.doRefreshTokens = !1, this.session = async ({
       createSession: n,
@@ -4879,10 +5038,10 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
       this.createSessionCallback = n, this.expiredSessionCallback = o, this.doRefreshTokens = a, await this.submitSessionCheck();
     };
     const { url: t, appId: s, scopes: i } = e;
-    this.url = t || Le, this.appId = s, this.platform = e.platform ?? Y, this.storageManager = new ke({
+    this.url = t || qe, this.appId = s, this.platform = e.platform ?? Y, this.storageManager = new Se({
       prefix: e.keyStoragePrefix ?? "",
       storage: this.platform.storage
-    }), this.deviceService = new Ve(this.storageManager), this.authApi = new nr(e, this.storageManager, this.deviceService), this.appApi = new ir(e, this.storageManager, this.deviceService), this.userApi = new lr(e, this.storageManager, this.deviceService), this.settingApi = new ar(e, this.storageManager, this.deviceService), this.tenantApi = new cr(e, this.storageManager, this.deviceService), this.invitationApi = new or(e, this.storageManager, this.deviceService), this.twoFactorApi = new hr(e, this.storageManager, this.deviceService), this.upgradeApi = new dr(e, this.storageManager, this.deviceService), this.upgradeDomain = Je(e.url), this.subscribeStore = new ur(), this.tokenCacheService = new xr(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = i ?? At, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Rr(
+    }), this.deviceService = new Be(this.storageManager), this.authApi = new dr(e, this.storageManager, this.deviceService), this.appApi = new hr(e, this.storageManager, this.deviceService), this.userApi = new vr(e, this.storageManager, this.deviceService), this.settingApi = new ur(e, this.storageManager, this.deviceService), this.tenantApi = new pr(e, this.storageManager, this.deviceService), this.invitationApi = new lr(e, this.storageManager, this.deviceService), this.twoFactorApi = new fr(e, this.storageManager, this.deviceService), this.upgradeApi = new gr(e, this.storageManager, this.deviceService), this.upgradeDomain = Qe(e.url), this.subscribeStore = new wr(), this.tokenCacheService = new Br(this.storageManager, this.authApi, this.subscribeStore, this.platform), this.scopes = i ?? Mt, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new qr(
       this.authApi,
       this.deviceService,
       this.storageManager,
@@ -4897,8 +5056,9 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
       },
       this.appId ?? "",
       e.tokenExchange,
-      this.platform
-    ), this.userService = new Lr(this.userApi, this.deviceService, this.platform), this.tenantService = new Ur(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Fr(this.invitationApi), this.twoFactorService = new Or(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, this.upgrade = Ns({
+      this.platform,
+      () => this.readPkceEnabled()
+    ), this.userService = new jr(this.userApi, this.deviceService, this.platform), this.tenantService = new Kr(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new Nr(this.invitationApi), this.twoFactorService = new Gr(this.twoFactorApi, this.subscribeStore, this.authService), this.twoFactor = this.twoFactorService, this.upgrade = Ys({
       // The prepare round. The commit round is `/auth/refresh`, which must go
       // through AuthService: it is the only path that STORES the rotated tokens,
       // so posting directly would elevate the session on the server and leave
@@ -4933,6 +5093,22 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
   get origin() {
     return this.platform.getCurrentUrl()?.origin ?? "";
   }
+  /**
+   * Whether the current app wants PKCE. A sign-in asks before a passkey ceremony,
+   * where a round-trip eats into the browser's user-gesture window, so the answer
+   * is kept for the appId. A failed read is not kept: the next sign-in asks again.
+   */
+  readPkceEnabled() {
+    if (!this.appId)
+      return Promise.resolve(!1);
+    if (!this.pkceEnabledRead) {
+      const e = this.appApi.getAppSettings().then((t) => t.pkce_enabled);
+      this.pkceEnabledRead = e, e.catch(() => {
+        this.pkceEnabledRead === e && (this.pkceEnabledRead = void 0);
+      });
+    }
+    return this.pkceEnabledRead;
+  }
   /**
    * Update the appId and propagate it to all API clients.
    * This ensures that all future API requests use the new appId in their headers.
@@ -4946,7 +5122,7 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
    * ```
    */
   setAppId(e) {
-    this.appId = e, this.authApi.setAppId(e), this.appApi.setAppId(e), this.userApi.setAppId(e), this.settingApi.setAppId(e), this.tenantApi.setAppId(e), this.invitationApi.setAppId(e), this.twoFactorApi.setAppId(e), this.upgradeApi.setAppId(e), this.authService;
+    this.appId = e, this.pkceEnabledRead = void 0, this.authApi.setAppId(e), this.appApi.setAppId(e), this.userApi.setAppId(e), this.settingApi.setAppId(e), this.tenantApi.setAppId(e), this.invitationApi.setAppId(e), this.twoFactorApi.setAppId(e), this.upgradeApi.setAppId(e), this.authService;
   }
   /**
    * Wraps a `fetch`, returning a new function with step-up handling attached.
@@ -5006,7 +5182,7 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
    * ```
    */
   createClient(e) {
-    return Ms(e, (t) => this.upgrade.attachAuth(t));
+    return Ns(e, (t) => this.upgrade.attachAuth(t));
   }
   /**
    * The assurance bar the session currently holds, read from the `acr` claim of
@@ -5023,7 +5199,7 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
         const t = T(e), s = typeof t.acr == "string" ? t.acr : void 0;
         if (!s)
           return;
-        const i = te(s).level;
+        const i = re(s).level;
         return i === void 0 ? { acrValues: s } : { acrValues: s, level: i };
       } catch {
         return;
@@ -5162,8 +5338,8 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
     const e = this.platform.getCurrentUrl();
     let t = new URLSearchParams(e?.search ?? ""), s = !1;
     if (!t.get("access_token") && e?.hash) {
-      const p = new URLSearchParams(e.hash.substring(1));
-      p.get("access_token") && (t = p, s = !0);
+      const u = new URLSearchParams(e.hash.substring(1));
+      u.get("access_token") && (t = u, s = !0);
     }
     if (!t.get("access_token") && this.adoptTwoFactorTokenFromUrl(e)) {
       this.error = void 0;
@@ -5172,28 +5348,28 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
     const i = t.get("access_token"), n = t.get("refresh_token"), o = t.get("id_token"), a = t.get("scopes")?.split(",") ?? this.scopes;
     let h;
     if (i) {
-      if (!X(i)) {
-        const p = {
+      if (!J(i)) {
+        const u = {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(c.Error, p), this.cleanupUrlParams(s, e);
+        this.subscribeStore.notify(c.Error, u), this.cleanupUrlParams(s, e);
         return;
       }
-      if (n && !X(n)) {
-        const p = {
+      if (n && !J(n)) {
+        const u = {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(c.Error, p), this.cleanupUrlParams(s, e);
+        this.subscribeStore.notify(c.Error, u), this.cleanupUrlParams(s, e);
         return;
       }
-      if (o && !X(o)) {
-        const p = {
+      if (o && !J(o)) {
+        const u = {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(c.Error, p), this.cleanupUrlParams(s, e);
+        this.subscribeStore.notify(c.Error, u), this.cleanupUrlParams(s, e);
         return;
       }
       return h = {
@@ -5218,7 +5394,7 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
     if (!s) return !1;
     t.delete("tfa_token");
     const i = t.toString();
-    if (this.platform.replaceUrl(e.pathname + e.search + (i ? `#${i}` : "")), !X(s)) {
+    if (this.platform.replaceUrl(e.pathname + e.search + (i ? `#${i}` : "")), !J(s)) {
       const n = {
         message: "Invalid 2FA token format received",
         code: "INVALID_TOKEN_FORMAT"
@@ -5230,7 +5406,7 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
   checkErrorsFromURL() {
     const t = new URLSearchParams(this.platform.getCurrentUrl()?.search ?? "").get("error");
     if (t) {
-      const s = Ir(t);
+      const s = Dr(t);
       return new Error(s);
     }
   }
@@ -5933,7 +6109,7 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
   async joinInvitation(e, t) {
     try {
       const s = await this.tenant.joinInvitation(e, t);
-      return s.scopes = t ?? this.scopes, this.storageManager.saveTokens(s), this.tokenCacheService.setTokensCache(s), s;
+      return s.scopes = t ?? this.scopes, await this.authService.applyTokens(s), s;
     } catch (s) {
       this.handleError(s, "Join invitation");
     }
@@ -6227,7 +6403,7 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
   async verifyTwoFactor(e, t) {
     try {
       const s = await this.twoFactorService.verify(e, t);
-      return this.storageManager.saveTokens(s), this.tokenCacheService.setTokensCache(s), this.subscribeStore.notify(c.SignIn, {
+      return this.subscribeStore.notify(c.SignIn, {
         tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), s;
@@ -6255,7 +6431,7 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
   async useTwoFactorRecoveryCode(e, t) {
     try {
       const s = await this.twoFactorService.useRecoveryCode(e, t);
-      return this.storageManager.saveTokens(s), this.tokenCacheService.setTokensCache(s), this.subscribeStore.notify(c.SignIn, {
+      return this.subscribeStore.notify(c.SignIn, {
         tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), s;
@@ -6456,8 +6632,8 @@ const yt = (r, e) => r.priority - e.priority || r.seq - e.seq, be = () => typeof
     this.twoFactorService.clearMagicLinkSession();
   }
 };
-Te.version = It;
-let xe = Te;
+Ee.version = Ft;
+let Le = Ee;
 class S extends Error {
   constructor(e) {
     super(e.message), this.name = "M2MError", this.code = e.code, this.status = e.status ?? 400, this.errorUri = e.errorUri, this.rateLimitInfo = e.rateLimitInfo, this.headers = e.headers, this.cause = e.cause, this.timestamp = (/* @__PURE__ */ new Date()).toISOString(), Error.captureStackTrace && Error.captureStackTrace(this, S);
@@ -6553,7 +6729,7 @@ class S extends Error {
     return this.status && (e += ` (HTTP ${this.status})`), e;
   }
 }
-class Oe extends S {
+class $e extends S {
   constructor(e, t) {
     super({
       code: "temporarily_unavailable",
@@ -6563,7 +6739,7 @@ class Oe extends S {
     }), this.name = "M2MNetworkError";
   }
 }
-class Z extends S {
+class Q extends S {
   constructor(e, t) {
     super({
       code: "invalid_request",
@@ -6573,7 +6749,7 @@ class Z extends S {
     }), this.name = "M2MTokenParseError";
   }
 }
-class ue extends S {
+class fe extends S {
   constructor(e) {
     super({
       code: "invalid_request",
@@ -6582,7 +6758,7 @@ class ue extends S {
     }), this.name = "M2MConfigError";
   }
 }
-const oi = {
+const fi = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -6606,7 +6782,7 @@ const oi = {
   /** Content-Type for token requests */
   CONTENT_TYPE: "application/x-www-form-urlencoded"
 };
-class Vs {
+class Ws {
   constructor() {
     this.cache = /* @__PURE__ */ new Map();
   }
@@ -6624,7 +6800,7 @@ class Vs {
     return this.cache.delete(e), Promise.resolve();
   }
 }
-const Bs = {
+const Xs = {
   shouldRetry(r, e) {
     return e >= 3 ? !1 : r.code === "server_error" || r.code === "temporarily_unavailable" || r.code === "rate_limit_exceeded" || r.status !== void 0 && r.status >= 500;
   },
@@ -6632,7 +6808,7 @@ const Bs = {
     return Math.pow(2, r - 1) * 1e3;
   }
 };
-class ai {
+class gi {
   /**
    * Create a new M2M client
    *
@@ -6650,11 +6826,11 @@ class ai {
    */
   constructor(e) {
     if (!e.url)
-      throw new ue("M2M client requires a URL");
+      throw new fe("M2M client requires a URL");
     if (!e.clientId)
-      throw new ue("M2M client requires a clientId");
+      throw new fe("M2M client requires a clientId");
     if (!e.clientSecret)
-      throw new ue("M2M client requires a clientSecret");
+      throw new fe("M2M client requires a clientSecret");
     const t = e.url.replace(/\/$/, "");
     this.config = {
       url: t,
@@ -6672,7 +6848,7 @@ class ai {
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new Vs(), this.retryStrategy = e.retryStrategy ?? Bs, this.tokenEndpoint = `${t}${R.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new Ws(), this.retryStrategy = e.retryStrategy ?? Xs, this.tokenEndpoint = `${t}${R.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
@@ -6771,8 +6947,8 @@ class ai {
       });
       clearTimeout(i);
       const o = {};
-      n.headers.forEach((h, p) => {
-        o[p.toLowerCase()] = h;
+      n.headers.forEach((h, u) => {
+        o[u.toLowerCase()] = h;
       });
       const a = await n.json();
       if (!n.ok) {
@@ -6792,7 +6968,7 @@ class ai {
       }
       return a;
     } catch (n) {
-      throw clearTimeout(i), n instanceof Error && n.name === "AbortError" ? new Oe(`Request timed out after ${this.config.timeout}ms`) : n instanceof TypeError && n.message.includes("fetch") ? new Oe(`Network error: ${n.message}`, n) : n instanceof S ? n : S.fromError(n instanceof Error ? n : new Error(String(n)));
+      throw clearTimeout(i), n instanceof Error && n.name === "AbortError" ? new $e(`Request timed out after ${this.config.timeout}ms`) : n instanceof TypeError && n.message.includes("fetch") ? new $e(`Network error: ${n.message}`, n) : n instanceof S ? n : S.fromError(n instanceof Error ? n : new Error(String(n)));
     }
   }
   /**
@@ -6887,14 +7063,14 @@ class ai {
     try {
       const t = e.split(".");
       if (t.length !== 3)
-        throw new Z("Invalid JWT format: expected 3 parts");
+        throw new Q("Invalid JWT format: expected 3 parts");
       const s = t[1];
       if (!s)
-        throw new Z("Invalid JWT format: missing payload");
+        throw new Q("Invalid JWT format: missing payload");
       const i = atob(s.replace(/-/g, "+").replace(/_/g, "/")), n = JSON.parse(i);
       return n.scopes && typeof n.scopes == "string" ? n.scopes = n.scopes.split(" ") : n.scopes || (n.scopes = []), n;
     } catch (t) {
-      throw t instanceof Z ? t : new Z(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
+      throw t instanceof Q ? t : new Q(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
     }
   }
   /**
@@ -6982,108 +7158,108 @@ class ai {
 export {
   V as APP_ID_HEADER_KEY,
   D as AUTHORIZATION_HEADER_KEY,
-  ir as AppAPI,
-  nr as AuthAPI,
-  Rr as AuthService,
-  Ws as CLIAuthAPI,
-  zs as DEFAULT_GROUP_NAME,
-  At as DEFAULT_SCOPES,
-  Se as DEFAULT_UPGRADE_FACTORS,
-  _t as DEVICE_ID_HEADER_KEY,
-  Et as DEVICE_TYPE_HEADER_KEY,
-  Ut as ERROR_MESSAGE_MAX_LENGTH,
-  ii as FETCH_PRIORITY_OIDC,
-  Ds as FETCH_PRIORITY_UPGRADE,
-  Us as FetchMiddlewareContractError,
-  Bt as INSUFFICIENT_USER_AUTHENTICATION,
-  or as InvitationAPI,
-  Fr as InvitationService,
-  ai as M2MClient,
-  ue as M2MConfigError,
+  hr as AppAPI,
+  dr as AuthAPI,
+  qr as AuthService,
+  si as CLIAuthAPI,
+  ti as DEFAULT_GROUP_NAME,
+  Mt as DEFAULT_SCOPES,
+  Te as DEFAULT_UPGRADE_FACTORS,
+  Rt as DEVICE_ID_HEADER_KEY,
+  Pt as DEVICE_TYPE_HEADER_KEY,
+  qt as ERROR_MESSAGE_MAX_LENGTH,
+  ui as FETCH_PRIORITY_OIDC,
+  Vs as FETCH_PRIORITY_UPGRADE,
+  Ks as FetchMiddlewareContractError,
+  zt as INSUFFICIENT_USER_AUTHENTICATION,
+  lr as InvitationAPI,
+  Nr as InvitationService,
+  gi as M2MClient,
+  fe as M2MConfigError,
   S as M2MError,
-  oi as M2MErrorCodes,
-  Oe as M2MNetworkError,
-  Z as M2MTokenParseError,
+  fi as M2MErrorCodes,
+  $e as M2MNetworkError,
+  Q as M2MTokenParseError,
   R as M2M_DEFAULTS,
-  Hs as MINIMAL_DEFAULT_SCOPES,
-  Zt as OS,
-  Le as PASSFLOW_CLOUD_URL,
-  Rt as POPUP_HEIGHT,
-  Ft as POPUP_POLL_INTERVAL_MS,
-  Pt as POPUP_TIMEOUT_MS,
-  Ct as POPUP_WIDTH,
-  xe as Passflow,
-  F as PassflowAdminEndpointPaths,
+  ei as MINIMAL_DEFAULT_SCOPES,
+  sr as OS,
+  qe as PASSFLOW_CLOUD_URL,
+  Dt as POPUP_HEIGHT,
+  xt as POPUP_POLL_INTERVAL_MS,
+  Ot as POPUP_TIMEOUT_MS,
+  Ut as POPUP_WIDTH,
+  Le as Passflow,
+  P as PassflowAdminEndpointPaths,
   l as PassflowEndpointPaths,
   w as PassflowError,
   c as PassflowEvent,
-  Be as PopupClosedError,
-  Jt as Providers,
-  pr as RECOVERABLE_COMMIT_ERROR_IDS,
-  M as RequestMethod,
-  It as SDK_VERSION,
-  fr as SESSION_INVALIDATING_COMMIT_ERROR_IDS,
-  qe as SessionState,
-  ar as SettingAPI,
-  $e as TOKEN_EXPIRY_BUFFER_SECONDS,
-  cr as TenantAPI,
-  Ur as TenantService,
-  Dr as TenantUserMembership,
-  xr as TokenCacheService,
+  Ge as PopupClosedError,
+  rr as Providers,
+  Sr as RECOVERABLE_COMMIT_ERROR_IDS,
+  U as RequestMethod,
+  Ft as SDK_VERSION,
+  br as SESSION_INVALIDATING_COMMIT_ERROR_IDS,
+  Ve as SessionState,
+  ur as SettingAPI,
+  Ne as TOKEN_EXPIRY_BUFFER_SECONDS,
+  pr as TenantAPI,
+  Kr as TenantService,
+  Vr as TenantUserMembership,
+  Br as TokenCacheService,
   A as TokenDeliveryMode,
   b as TokenType,
-  hr as TwoFactorApiClient,
-  Qt as TwoFactorPolicy,
-  Or as TwoFactorService,
-  Kt as UPGRADE_REQUIRED,
-  Dt as USERNAME_MAX_LENGTH,
-  Mt as USERNAME_MIN_LENGTH,
-  dr as UpgradeAPI,
-  O as UpgradeCancelledError,
-  Zr as UpgradeController,
+  fr as TwoFactorApiClient,
+  ir as TwoFactorPolicy,
+  Gr as TwoFactorService,
+  Yt as UPGRADE_REQUIRED,
+  $t as USERNAME_MAX_LENGTH,
+  Lt as USERNAME_MIN_LENGTH,
+  gr as UpgradeAPI,
+  L as UpgradeCancelledError,
+  os as UpgradeController,
   k as UpgradeErrorIds,
-  U as UpgradeFactorError,
-  j as UpgradeInsufficientError,
-  $ as UpgradeSessionChangedError,
+  x as UpgradeFactorError,
+  G as UpgradeInsufficientError,
+  q as UpgradeSessionChangedError,
   _ as UpgradeTransportError,
-  G as UpgradeUnavailableError,
-  ee as UpgradeUnsatisfiableError,
-  lr as UserAPI,
-  Lr as UserService,
-  $t as WebAdapter,
-  Ce as classifyUpgradeError,
-  Vr as factorRegistry,
-  ni as fetchRegistryState,
-  Ys as getOSFromDeviceType,
-  Tr as invalidatesSessionOnCommit,
-  Xs as isRecoverableCommitFailure,
-  vr as isRetryableUpgradeKind,
+  j as UpgradeUnavailableError,
+  te as UpgradeUnsatisfiableError,
+  vr as UserAPI,
+  jr as UserService,
+  Bt as WebAdapter,
+  Pe as classifyUpgradeError,
+  Wr as factorRegistry,
+  pi as fetchRegistryState,
+  ri as getOSFromDeviceType,
+  Fr as invalidatesSessionOnCommit,
+  ii as isRecoverableCommitFailure,
+  _r as isRetryableUpgradeKind,
   C as isTokenExpired,
-  Js as isUpgradeCancelled,
-  Zs as isUpgradeExhausted,
-  Qs as isUpgradeInsufficient,
-  ri as isUpgradeSessionChanged,
-  kr as isUpgradeTransportError,
-  si as isUpgradeTransportFailure,
-  ti as isUpgradeUnavailable,
-  ei as isUpgradeUnsatisfiable,
-  ne as isValidEmail,
-  X as isValidJWTFormat,
-  oe as isValidPhoneNumber,
-  Ar as isValidUsername,
-  Ht as parseChallengeBody,
-  Gt as parseChallengeHeader,
+  ni as isUpgradeCancelled,
+  oi as isUpgradeExhausted,
+  ai as isUpgradeInsufficient,
+  di as isUpgradeSessionChanged,
+  Ar as isUpgradeTransportError,
+  li as isUpgradeTransportFailure,
+  hi as isUpgradeUnavailable,
+  ci as isUpgradeUnsatisfiable,
+  oe as isValidEmail,
+  J as isValidJWTFormat,
+  ae as isValidPhoneNumber,
+  xr as isValidUsername,
+  Jt as parseChallengeBody,
+  Xt as parseChallengeHeader,
   T as parseToken,
-  Yt as parseUpgradeChallenge,
-  Nr as passkeyFactor,
-  P as pathWithParams,
-  qr as recoveryCodesFactor,
-  $s as registerFetchMiddleware,
-  Vt as requiredAcrLevel,
-  Je as resolveUpgradeDomain,
-  Ir as sanitizeErrorMessage,
-  Gr as selectFactors,
-  $r as totpFactor,
+  Qt as parseUpgradeChallenge,
+  Yr as passkeyFactor,
+  F as pathWithParams,
+  zr as recoveryCodesFactor,
+  Hs as registerFetchMiddleware,
+  Ht as requiredAcrLevel,
+  Qe as resolveUpgradeDomain,
+  Dr as sanitizeErrorMessage,
+  Qr as selectFactors,
+  Hr as totpFactor,
   Y as webAdapter
 };
 //# sourceMappingURL=index.mjs.map