@passflow/core 0.2.10 → 0.2.11

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import F from "axios";
 import { v4 as H } from "uuid";
 import { startRegistration as K, startAuthentication as j } from "@simplewebauthn/browser";
-const z = "0.2.10", X = {
+const z = "0.2.11", X = {
   version: z
 }, C = "X-Passflow-Clientid", I = "Authorization", W = "X-Passflow-DeviceId", J = "X-Passflow-DeviceType", Z = X.version, Ne = ["id", "offline", "openid"], Q = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], V = "https://auth.passflow.cloud", Ke = "default", ee = 500, te = 600, re = 100, se = 6e4, G = 30, ie = 3, oe = 30, ne = 200, ae = (i) => {
   const e = [];
@@ -12,8 +12,8 @@ const z = "0.2.10", X = {
       continue;
     const s = { tenant: { id: r.tenant_id, name: r.tenant_name } };
     s.groups = r.groups ? Object.keys(r.groups).map((o) => {
-      const n = r.groups[o] || [];
-      return { group: { id: o, name: r.group_names?.[o] ?? "unknown" }, roles: n };
+      const a = r.groups[o] || [];
+      return { group: { id: o, name: r.group_names?.[o] ?? "unknown" }, roles: a };
     }) : [], s.tenantRoles = s.groups?.find((o) => o.group.id === r.root_group_id), e.push(s);
   }
   return { raw: i, tenants: e };
@@ -62,8 +62,8 @@ function v(i) {
   if (!e) throw new Error("Invalid token string");
   const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = ce(r), o = decodeURIComponent(
     s.split("").map((d) => "%" + ("00" + d.charCodeAt(0).toString(16)).slice(-2)).join("")
-  ), n = JSON.parse(o);
-  return n.membership = n.passflow_tm && n.type !== "invite" ? ae(n.passflow_tm) : void 0, n;
+  ), a = JSON.parse(o);
+  return a.membership = a.passflow_tm && a.type !== "invite" ? ae(a.passflow_tm) : void 0, a;
 }
 var p = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(p || {}), y = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(y || {}), q = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(q || {});
 class Y {
@@ -227,8 +227,8 @@ class $ {
    * In JSON mode: save all tokens (existing behavior)
    */
   saveTokens(e, t) {
-    const { id_token: r, access_token: s, refresh_token: o, scopes: n } = e;
-    t === y.Cookie || t === y.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(p.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(p.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(p.refresh_token), o), n && this.storage.setItem(this.scopes, n.join(",")));
+    const { id_token: r, access_token: s, refresh_token: o, scopes: a } = e;
+    t === y.Cookie || t === y.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(p.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(p.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(p.refresh_token), o), a && this.storage.setItem(this.scopes, a.join(",")));
   }
   getToken(e) {
     const t = this.getKeyForTokenType(e);
@@ -437,9 +437,9 @@ class _ {
       Accept: "application/json",
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh"];
-    const { url: s, appId: o, keyStoragePrefix: n } = e;
+    const { url: s, appId: o, keyStoragePrefix: a } = e;
     this.url = s || V, this.storageManager = t ?? new $({
-      prefix: n ?? ""
+      prefix: a ?? ""
     }), this.deviceService = r ?? new B(this.storageManager), this.tokenService = new he(this.storageManager), this.tokenDeliveryManager = new Y(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
       ...this.defaultHeaders,
       [C]: o
@@ -552,18 +552,18 @@ class _ {
     const o = t._retryCount || 0;
     if (o >= le)
       return Promise.reject(e);
-    let n = ge * Math.pow(2, o);
+    let a = ge * Math.pow(2, o);
     const d = e.response?.headers?.["retry-after"];
     if (d) {
       const h = Number.parseInt(d, 10);
       if (!Number.isNaN(h))
-        n = h * 1e3;
+        a = h * 1e3;
       else {
         const g = new Date(d);
-        Number.isNaN(g.getTime()) || (n = Math.max(0, g.getTime() - Date.now()));
+        Number.isNaN(g.getTime()) || (a = Math.max(0, g.getTime() - Date.now()));
       }
     }
-    return await new Promise((h) => setTimeout(h, n)), t._retryCount = o + 1, this.instance.request(t);
+    return await new Promise((h) => setTimeout(h, a)), t._retryCount = o + 1, this.instance.request(t);
   }
   // eslint-disable-next-line complexity
   // biome-ignore lint/suspicious/useAwait: <explanation>
@@ -715,21 +715,21 @@ class fe {
     });
   }
   passkeyRegisterStart(e, t, r, s = !1) {
-    const { create_tenant: o } = e, n = {
+    const { create_tenant: o } = e, a = {
       ...e,
       create_tenant: o ?? !1,
       device: t,
       os: r
     }, d = s ? T.passkeyRegisterStart : c.passkeyRegisterStart;
-    return this.axiosClient.post(d, n);
+    return this.axiosClient.post(d, a);
   }
   passkeyRegisterComplete(e, t, r, s = !1) {
     const o = {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, n = s ? T.passkeyRegisterComplete : c.passkeyRegisterComplete;
-    return this.axiosClient.post(n, o);
+    }, a = s ? T.passkeyRegisterComplete : c.passkeyRegisterComplete;
+    return this.axiosClient.post(a, o);
   }
   passkeyAuthenticateStart(e, t, r, s = !1) {
     const o = {
@@ -737,9 +737,9 @@ class fe {
       user_id: e.user_id ?? "",
       device: t,
       os: r
-    }, n = s ? T.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
+    }, a = s ? T.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
     return this.axiosClient.post(
-      n,
+      a,
       o
     );
   }
@@ -748,11 +748,11 @@ class fe {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, n = s ? T.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
-    return this.axiosClient.post(n, o);
+    }, a = s ? T.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
+    return this.axiosClient.post(a, o);
   }
   passkeyValidate(e, t, r, s = !1, o) {
-    const n = {
+    const a = {
       otp: e,
       device: t,
       challenge_id: r
@@ -760,7 +760,7 @@ class fe {
     let d = c.passkeyValidate;
     !o && s && (d = T.passkeyValidate);
     const h = o ? { [C]: o } : {};
-    return this.axiosClient.post(d, n, { headers: h });
+    return this.axiosClient.post(d, a, { headers: h });
   }
 }
 class ke {
@@ -952,8 +952,8 @@ class ye {
    * @param role Role to assign
    */
   addUserToGroup(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/add`, n = { user_id: r, role: s };
-    return this.axiosClient.post(o, n);
+    const o = `${c.tenantPath}/${e}/group/${t}/add`, a = { user_id: r, role: s };
+    return this.axiosClient.post(o, a);
   }
   /**
    * Remove user roles from a group
@@ -963,8 +963,8 @@ class ye {
    * @param roles Roles to remove
    */
   removeUserRolesFromGroup(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/remove_roles`, n = { user_id: r, roles: s };
-    return this.axiosClient.post(o, n);
+    const o = `${c.tenantPath}/${e}/group/${t}/remove_roles`, a = { user_id: r, roles: s };
+    return this.axiosClient.post(o, a);
   }
   /**
    * Change user roles in a group
@@ -974,8 +974,8 @@ class ye {
    * @param roles New roles to assign
    */
   changeUserRoles(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/change`, n = { user_id: r, roles: s };
-    return this.axiosClient.post(o, n);
+    const o = `${c.tenantPath}/${e}/group/${t}/change`, a = { user_id: r, roles: s };
+    return this.axiosClient.post(o, a);
   }
   /**
    * Delete a user from a group
@@ -1197,13 +1197,13 @@ class me {
       };
     }).catch((r) => {
       if (r.response) {
-        const s = r.response.status, o = r.response.data || {}, n = r.response.headers?.["retry-after"] ? parseInt(r.response.headers["retry-after"], 10) : void 0;
+        const s = r.response.status, o = r.response.data || {}, a = r.response.headers?.["retry-after"] ? parseInt(r.response.headers["retry-after"], 10) : void 0;
         return {
           success: !1,
           error: {
             code: o.error || this.mapStatusToErrorCode(s),
             message: o.message || this.getDefaultErrorMessage(s),
-            retryAfter: n
+            retryAfter: a
           }
         };
       }
@@ -1365,14 +1365,14 @@ class Se {
     passkeyDisplayName: s,
     passkeyUsername: o
   }) {
-    const n = {
+    const a = {
       passkey_display_name: s,
       passkey_username: o,
       relying_party_id: e,
       deviceId: t,
       os: r
     };
-    return this.axiosClient.post(c.addUserPasskey, n);
+    return this.axiosClient.post(c.addUserPasskey, a);
   }
   addUserPasskeyComplete(e, t, r) {
     return this.axiosClient.post(c.completeAddUserPasskey, {
@@ -1382,7 +1382,7 @@ class Se {
     });
   }
 }
-var a = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(a || {});
+var n = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.SessionExpired = "session:expired", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(n || {});
 class we {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
@@ -1457,8 +1457,8 @@ function Ee(i) {
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
 class Ie {
-  constructor(e, t, r, s, o, n, d, h, g, f, k, A) {
-    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = d, this.origin = h, this.url = g, this.sessionCallbacks = f, this.appId = k, this.tokenExchangeConfig = A, this.tokenDeliveryManager = new Y(r), A?.enabled && this.tokenDeliveryManager.setMode(y.BFF), this.initializeSession();
+  constructor(e, t, r, s, o, a, d, h, g, f, k, A) {
+    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = a, this.createTenantForNewUser = d, this.origin = h, this.url = g, this.sessionCallbacks = f, this.appId = k, this.tokenExchangeConfig = A, this.tokenDeliveryManager = new Y(r), A?.enabled && this.tokenDeliveryManager.setMode(y.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -1487,7 +1487,7 @@ class Ie {
       return !1;
     try {
       const e = await this.authApi.validateSession();
-      return e.valid ? (this.tokenDeliveryManager.setSessionValid(), e.user && this.subscribeStore.notify(a.SessionRestored, e.user), !0) : (this.tokenDeliveryManager.setSessionInvalid(), !1);
+      return e.valid ? (this.tokenDeliveryManager.setSessionValid(), e.user && this.subscribeStore.notify(n.SessionRestored, e.user), !0) : (this.tokenDeliveryManager.setSessionInvalid(), !1);
     } catch {
       return this.tokenDeliveryManager.setSessionInvalid(), !1;
     }
@@ -1531,7 +1531,7 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
     if ("username" in e && e.username && !_e(e.username)) {
       const s = new Error(
@@ -1541,7 +1541,7 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
     if ("phone" in e && e.phone && !x(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
@@ -1549,18 +1549,18 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
-    this.subscribeStore.notify(a.SignInStart, { email: e.email });
+    this.subscribeStore.notify(n.SignInStart, { email: e.email });
     const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes;
     try {
       const s = await this.authApi.signIn(e, t, r);
-      return "requires_2fa" in s && s.requires_2fa === !0 || "tfa_token" in s && s.tfa_token ? (this.subscribeStore.notify(a.TwoFactorRequired, {
+      return "requires_2fa" in s && s.requires_2fa === !0 || "tfa_token" in s && s.tfa_token ? (this.subscribeStore.notify(n.TwoFactorRequired, {
         email: e.email || "",
         challengeId: s.challenge_id || "",
         tfaToken: s.tfa_token || ""
-      }), s) : (await this.processAuthResponse(s, e.scopes), this.subscribeStore.notify(a.SignIn, {
+      }), s) : (await this.processAuthResponse(s, e.scopes), this.subscribeStore.notify(n.SignIn, {
         tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), s);
@@ -1570,7 +1570,7 @@ class Ie {
         originalError: s,
         code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
   }
   async signUp(e) {
@@ -1580,7 +1580,7 @@ class Ie {
         originalError: t,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
     if (e.user.phone_number && !x(e.user.phone_number)) {
       const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), r = {
@@ -1588,12 +1588,12 @@ class Ie {
         originalError: t,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
-    this.subscribeStore.notify(a.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
+    this.subscribeStore.notify(n.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
       const t = await this.authApi.signUp(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(a.Register, {
+      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(n.Register, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -1603,7 +1603,7 @@ class Ie {
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   async passwordlessSignIn(e) {
@@ -1613,7 +1613,7 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
     if (e.phone && !x(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
@@ -1621,9 +1621,9 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
-    this.subscribeStore.notify(a.SignInStart, { email: e.email }), e.scopes = e.scopes ?? this.scopes;
+    this.subscribeStore.notify(n.SignInStart, { email: e.email }), e.scopes = e.scopes ?? this.scopes;
     const t = this.deviceService.getDeviceId(), r = b.web;
     try {
       return await this.authApi.passwordlessSignIn(e, t, r);
@@ -1633,14 +1633,14 @@ class Ie {
         originalError: s,
         code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
   }
   async passwordlessSignInComplete(e) {
-    this.subscribeStore.notify(a.SignInStart, {}), e.scopes = e.scopes ?? this.scopes, e.device = this.deviceService.getDeviceId();
+    this.subscribeStore.notify(n.SignInStart, {}), e.scopes = e.scopes ?? this.scopes, e.device = this.deviceService.getDeviceId();
     try {
       const t = await this.authApi.passwordlessSignInComplete(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(a.SignIn, {
+      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(n.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -1650,7 +1650,7 @@ class Ie {
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   async logOut() {
@@ -1671,10 +1671,10 @@ class Ie {
       } catch {
       }
     }
-    this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(a.SignOut, {});
+    this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(n.SignOut, {});
   }
   async refreshToken() {
-    if (this.subscribeStore.notify(a.RefreshStart, {}), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.refreshUrl)
+    if (this.subscribeStore.notify(n.RefreshStart, {}), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.refreshUrl)
       try {
         const r = await fetch(this.tokenExchangeConfig.refreshUrl, {
           method: "POST",
@@ -1684,25 +1684,25 @@ class Ie {
         if (!r.ok)
           throw this.tokenDeliveryManager.setSessionInvalid(), new Error("BFF token refresh failed");
         const s = await r.json();
-        return this.tokenDeliveryManager.setSessionValid(), s.id_token && this.storageManager.setIdToken(s.id_token), this.subscribeStore.notify(a.Refresh, {
+        return this.tokenDeliveryManager.setSessionValid(), s.id_token && this.storageManager.setIdToken(s.id_token), this.subscribeStore.notify(n.Refresh, {
           tokens: s,
           parsedTokens: this.tokenCacheService.getParsedTokens()
-        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, s;
+        }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, s;
       } catch (r) {
         this.tokenDeliveryManager.setSessionInvalid();
         const s = {
           message: r instanceof Error ? r.message : "Token refresh failed",
           originalError: r
         };
-        throw this.subscribeStore.notify(a.Error, s), r;
+        throw this.subscribeStore.notify(n.Error, s), r;
       }
     if (this.tokenDeliveryManager.isCookieMode())
       try {
         const r = await this.authApi.refreshToken("", this.scopes);
-        return this.tokenDeliveryManager.setSessionValid(), await this.processAuthResponse(r, this.scopes), this.subscribeStore.notify(a.Refresh, {
+        return this.tokenDeliveryManager.setSessionValid(), await this.processAuthResponse(r, this.scopes), this.subscribeStore.notify(n.Refresh, {
           tokens: r,
           parsedTokens: this.tokenCacheService.getParsedTokens()
-        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, r;
+        }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, r;
       } catch (r) {
         this.tokenDeliveryManager.setSessionInvalid();
         const s = {
@@ -1710,7 +1710,7 @@ class Ie {
           originalError: r,
           code: r instanceof u ? r.id : void 0
         };
-        throw this.subscribeStore.notify(a.Error, s), r;
+        throw this.subscribeStore.notify(n.Error, s), r;
       }
     const e = this.storageManager.getTokens();
     if (e) {
@@ -1719,22 +1719,22 @@ class Ie {
           message: "No refresh token found",
           originalError: r
         };
-        throw this.subscribeStore.notify(a.Error, s), r;
+        throw this.subscribeStore.notify(n.Error, s), r;
       }
     } else {
       const r = new Error("No tokens found"), s = {
         message: "No tokens found",
         originalError: r
       };
-      throw this.subscribeStore.notify(a.Error, s), r;
+      throw this.subscribeStore.notify(n.Error, s), r;
     }
     const t = e?.scopes ?? this.scopes;
     try {
       const r = await this.authApi.refreshToken(e?.refresh_token ?? "", t, e?.access_token);
-      return r.scopes = t, this.storageManager.saveTokens(r), this.tokenCacheService.setTokensCache(r), this.subscribeStore.notify(a.Refresh, {
+      return r.scopes = t, this.storageManager.saveTokens(r), this.tokenCacheService.setTokensCache(r), this.subscribeStore.notify(n.Refresh, {
         tokens: r,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, this.tokenCacheService.startTokenCheck(), r;
+      }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, this.tokenCacheService.startTokenCheck(), r;
     } catch (r) {
       const s = {
         message: r instanceof Error ? r.message : "Token refresh failed",
@@ -1745,7 +1745,9 @@ class Ie {
           data: r.response.data
         } : void 0
       };
-      throw this.subscribeStore.notify(a.Error, s), r instanceof u ? r : F.isAxiosError(r) && r.response && r.response?.status >= 400 && r.response?.status < 500 ? new Error(`Getting unknown error message from server with code:${r.response.status}`) : r;
+      this.subscribeStore.notify(n.Error, s);
+      const o = F.isAxiosError(r) && r.response?.status && r.response.status >= 400 && r.response.status < 500;
+      throw o && (this.tokenCacheService.tokenExpiredFlag = !0, this.tokenCacheService.setTokensCache(void 0), this.storageManager.deleteTokens(), this.subscribeStore.notify(n.SessionExpired, { reason: "refresh_failed" })), r instanceof u ? r : o ? new Error(`Getting unknown error message from server with code:${r.response?.status}`) : r;
     }
   }
   async sendPasswordResetEmail(e) {
@@ -1757,43 +1759,43 @@ class Ie {
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   async resetPassword(e, t) {
-    this.subscribeStore.notify(a.SignInStart, {});
+    this.subscribeStore.notify(n.SignInStart, {});
     const s = new URLSearchParams(window.location.search).get("token") ?? void 0, o = t ?? this.scopes;
     try {
-      const n = await this.authApi.resetPassword(e, o, s);
-      return await this.processAuthResponse(n, o), this.subscribeStore.notify(a.SignIn, {
-        tokens: n,
+      const a = await this.authApi.resetPassword(e, o, s);
+      return await this.processAuthResponse(a, o), this.subscribeStore.notify(n.SignIn, {
+        tokens: a,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), n;
-    } catch (n) {
+      }), await this.submitSessionCheck(), a;
+    } catch (a) {
       const d = {
-        message: n instanceof Error ? n.message : "Password reset failed",
-        originalError: n,
-        code: n instanceof u ? n.id : void 0
+        message: a instanceof Error ? a.message : "Password reset failed",
+        originalError: a,
+        code: a instanceof u ? a.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, d), n;
+      throw this.subscribeStore.notify(n.Error, d), a;
     }
   }
   async passkeyRegister(e) {
-    this.subscribeStore.notify(a.RegisterStart, {});
+    this.subscribeStore.notify(n.RegisterStart, {});
     const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
       const { challenge_id: s, publicKey: o } = await this.authApi.passkeyRegisterStart(e, t, r, !this.appId);
       o.user.id = btoa(o.user.id);
-      const n = await K({
+      const a = await K({
         optionsJSON: o
       }), d = await this.authApi.passkeyRegisterComplete(
-        n,
+        a,
         t,
         s,
         !this.appId
       );
-      return await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(a.Register, {
+      return await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(n.Register, {
         tokens: d,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), d;
@@ -1803,23 +1805,23 @@ class Ie {
         originalError: s,
         code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
   }
   async passkeyAuthenticate(e) {
-    this.subscribeStore.notify(a.SignInStart, {});
+    this.subscribeStore.notify(n.SignInStart, {});
     const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const { challenge_id: s, publicKey: o } = await this.authApi.passkeyAuthenticateStart(e, t, r, !this.appId), n = await j({
+      const { challenge_id: s, publicKey: o } = await this.authApi.passkeyAuthenticateStart(e, t, r, !this.appId), a = await j({
         optionsJSON: o
       }), d = await this.authApi.passkeyAuthenticateComplete(
-        n,
+        a,
         t,
         s,
         !this.appId
       );
-      return "access_token" in d && (await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(a.SignIn, {
+      return "access_token" in d && (await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(n.SignIn, {
         tokens: d,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck()), d;
@@ -1829,7 +1831,7 @@ class Ie {
         originalError: s,
         code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
   }
   createFederatedAuthUrl(e) {
@@ -1842,33 +1844,33 @@ class Ie {
       ...e.invite_token ? { invite_token: e.invite_token } : {},
       ...e.create_tenant ? { create_tenant: e.create_tenant.toString() } : {},
       ...e.device ? { device: e.device } : {}
-    }, o = new URL(t, this.url), n = new URLSearchParams(s);
-    return o.search = n.toString(), o.toString();
+    }, o = new URL(t, this.url), a = new URLSearchParams(s);
+    return o.search = a.toString(), o.toString();
   }
   federatedAuthWithPopup(e) {
-    this.subscribeStore.notify(a.SignInStart, { provider: e.provider });
+    this.subscribeStore.notify(n.SignInStart, { provider: e.provider });
     const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r }), o = window.open(s, "_blank", `width=${ee},height=${te}`);
     if (!o) {
       this.federatedAuthWithRedirect(e);
       return;
     }
-    const n = Date.now(), d = setInterval(() => {
+    const a = Date.now(), d = setInterval(() => {
       if (o.closed) {
         clearInterval(d);
         const h = {
           message: "Authentication popup was closed",
           code: "POPUP_CLOSED"
         };
-        this.subscribeStore.notify(a.Error, h);
+        this.subscribeStore.notify(n.Error, h);
         return;
       }
-      if (Date.now() - n > se) {
+      if (Date.now() - a > se) {
         clearInterval(d), o.close();
         const h = {
           message: "Authentication popup timed out",
           code: "POPUP_TIMEOUT"
         };
-        this.subscribeStore.notify(a.Error, h);
+        this.subscribeStore.notify(n.Error, h);
         return;
       }
       try {
@@ -1880,7 +1882,7 @@ class Ie {
             scopes: t
           };
           this.processAuthResponse(A, t).then(() => {
-            this.subscribeStore.notify(a.SignIn, {
+            this.subscribeStore.notify(n.SignIn, {
               tokens: A,
               parsedTokens: this.tokenCacheService.getParsedTokens()
             }), window.location.href = `${this.origin}`;
@@ -1891,27 +1893,27 @@ class Ie {
     }, re);
   }
   federatedAuthWithRedirect(e) {
-    this.subscribeStore.notify(a.SignInStart, { provider: e.provider });
+    this.subscribeStore.notify(n.SignInStart, { provider: e.provider });
     const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r });
     window.location.href = s;
   }
   // Helper methods for authentication UI redirect
   authRedirectUrl(e = {}) {
     try {
-      const { url: t, redirectUrl: r, scopes: s, appId: o } = e ?? {}, n = new URL(t ?? this.url);
-      n.pathname = (n.pathname.endsWith("/") ? n.pathname : n.pathname + "/") + "web";
+      const { url: t, redirectUrl: r, scopes: s, appId: o } = e ?? {}, a = new URL(t ?? this.url);
+      a.pathname = (a.pathname.endsWith("/") ? a.pathname : a.pathname + "/") + "web";
       const d = s ?? this.scopes, h = {
         appId: o ?? this.appId ?? "",
         redirectto: r ?? window.location.href,
         scopes: d.join(",")
       }, g = new URLSearchParams(h);
-      return n.search = g.toString(), n.toString();
+      return a.search = g.toString(), a.toString();
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to create auth redirect URL",
         originalError: t
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   authRedirect(e = {}) {
@@ -1922,7 +1924,7 @@ class Ie {
         message: t instanceof Error ? t.message : "Failed to redirect to auth page",
         originalError: t
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   /**
@@ -1941,7 +1943,7 @@ class Ie {
         message: t instanceof Error ? t.message : "Failed to check authentication status",
         originalError: t
       };
-      return this.subscribeStore.notify(a.Error, r), !1;
+      return this.subscribeStore.notify(n.Error, r), !1;
     }
   }
   /**
@@ -1956,7 +1958,7 @@ class Ie {
         message: s instanceof Error || s instanceof u ? s.message : "Session check failed",
         originalError: s
       };
-      this.subscribeStore.notify(a.Error, o), t = void 0;
+      this.subscribeStore.notify(n.Error, o), t = void 0;
     }
     return t && this.sessionCallbacks.createSession && await this.sessionCallbacks.createSession({ tokens: t, parsedTokens: r }), !t && this.sessionCallbacks.expiredSession && await this.sessionCallbacks.expiredSession(), t;
   }
@@ -1980,7 +1982,7 @@ class Ie {
         message: t instanceof Error ? t.message : "Failed to get tokens",
         originalError: t
       };
-      this.subscribeStore.notify(a.Error, r);
+      this.subscribeStore.notify(n.Error, r);
       return;
     }
   }
@@ -2053,31 +2055,31 @@ class Re {
   }
   normalize(e) {
     const t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), o = [];
-    return e.groups?.forEach((n) => {
-      r.set(n.id, {
-        id: n.id,
-        name: n.name,
-        default: n.default ?? !1,
-        updated_at: n.updated_at,
-        created_at: n.created_at
+    return e.groups?.forEach((a) => {
+      r.set(a.id, {
+        id: a.id,
+        name: a.name,
+        default: a.default ?? !1,
+        updated_at: a.updated_at,
+        created_at: a.created_at
       });
-    }), e.roles?.forEach((n) => {
-      s.set(n.id, {
-        id: n.id,
-        tenant_id: n.tenant_id,
-        name: n.name
+    }), e.roles?.forEach((a) => {
+      s.set(a.id, {
+        id: a.id,
+        tenant_id: a.tenant_id,
+        name: a.name
       });
-    }), e.users_in_groups?.forEach((n) => {
-      const d = n.user;
+    }), e.users_in_groups?.forEach((a) => {
+      const d = a.user;
       d && !t.has(d.id) && t.set(d.id, {
         id: d.id,
         name: d.name ?? null,
         email: d.email ?? null,
         phone: d.phone ?? null
-      }), d && n.group_id && r.has(n.group_id) && o.push({
+      }), d && a.group_id && r.has(a.group_id) && o.push({
         userId: d.id,
-        groupId: n.group_id,
-        roleIds: n.roles?.map((h) => h.id) ?? []
+        groupId: a.group_id,
+        roleIds: a.roles?.map((h) => h.id) ?? []
       });
     }), {
       tenant_id: e.tenant_id,
@@ -2503,39 +2505,39 @@ class Fe {
         return;
       }
       const t = v(e.access_token);
-      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
+      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
         originalError: e
       };
-      this.subscribeStore.notify(a.Error, t), this.setTokensCache(void 0);
+      this.subscribeStore.notify(n.Error, t), this.setTokensCache(void 0);
     }
   }
   async refreshTokensCache(e) {
     if (!this.isRefreshing)
       try {
-        this.isRefreshing = !0, this.subscribeStore.notify(a.RefreshStart, {});
+        this.isRefreshing = !0, this.subscribeStore.notify(n.RefreshStart, {});
         const t = await this.authApi.refreshToken(e?.refresh_token ?? "", e.scopes ?? [], e.access_token);
-        this.setTokensCache(t), this.subscribeStore.notify(a.Refresh, { tokens: t, parsedTokens: this.getParsedTokens() }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenExpiredFlag = !1, this.startTokenCheck();
+        this.setTokensCache(t), this.subscribeStore.notify(n.Refresh, { tokens: t, parsedTokens: this.getParsedTokens() }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenExpiredFlag = !1, this.startTokenCheck();
       } catch (t) {
         const r = {
           message: t instanceof Error ? t.message : "Failed to get tokens",
           originalError: t
         };
-        this.subscribeStore.notify(a.Error, r), this.setTokensCache(void 0);
+        this.subscribeStore.notify(n.Error, r), this.tokenExpiredFlag = !0, this.setTokensCache(void 0), this.stopTokenCheck(), this.storageManager.deleteTokens(), this.subscribeStore.notify(n.SessionExpired, { reason: "refresh_failed" });
       } finally {
         this.isRefreshing = !1;
       }
   }
   startTokenCheck() {
     this.checkInterval && clearInterval(this.checkInterval), !this.tokenExpiredFlag && (this.setupVisibilityListener(), this.checkInterval = setInterval(() => {
-      typeof document < "u" && document.hidden || this.isRefreshing || this.tokenExpiredFlag || this.isExpired() && !this.tokenExpiredFlag && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
+      typeof document < "u" && document.hidden || this.isRefreshing || this.tokenExpiredFlag || this.isExpired() && !this.tokenExpiredFlag && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
     }, this.CHECK_INTERVAL));
   }
   setupVisibilityListener() {
     typeof document > "u" || (this.visibilityChangeHandler && document.removeEventListener("visibilitychange", this.visibilityChangeHandler), this.visibilityChangeHandler = () => {
-      !document.hidden && this.checkInterval && !this.isRefreshing && !this.tokenExpiredFlag && this.isExpired() && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
+      !document.hidden && this.checkInterval && !this.isRefreshing && !this.tokenExpiredFlag && this.isExpired() && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
     }, document.addEventListener("visibilitychange", this.visibilityChangeHandler));
   }
   setupPageUnloadHandler() {
@@ -2576,7 +2578,7 @@ class Fe {
         message: e instanceof Error ? e.message : "Failed to get tokens",
         originalError: e
       };
-      this.subscribeStore.notify(a.Error, t);
+      this.subscribeStore.notify(n.Error, t);
       return;
     }
   }
@@ -2596,13 +2598,13 @@ class De {
     this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
     const r = {
       onAuthChange: (s, o) => {
-        if (s === a.TwoFactorRequired) {
-          const n = o;
-          this.setPartialAuthState(n.email, n.challengeId, n.tfaToken);
+        if (s === n.TwoFactorRequired) {
+          const a = o;
+          this.setPartialAuthState(a.email, a.challengeId, a.tfaToken);
         }
       }
     };
-    this.subscribeStore.subscribe(r, [a.TwoFactorRequired]);
+    this.subscribeStore.subscribe(r, [n.TwoFactorRequired]);
   }
   /**
    * Emit error event and throw the error
@@ -2614,7 +2616,7 @@ class De {
       originalError: e,
       code: r?.id || void 0
     };
-    throw this.subscribeStore.notify(a.Error, s), e;
+    throw this.subscribeStore.notify(n.Error, s), e;
   }
   /**
    * Get 2FA enrollment status for current user
@@ -2634,7 +2636,7 @@ class De {
   async beginSetup() {
     try {
       const e = await this.twoFactorApi.beginSetup();
-      return e.totp_digits && (this.totpDigits = e.totp_digits), this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: e.secret }), e;
+      return e.totp_digits && (this.totpDigits = e.totp_digits), this.subscribeStore.notify(n.TwoFactorSetupStarted, { secret: e.secret }), e;
     } catch (e) {
       this.emitErrorAndThrow(e, "Begin 2FA setup");
     }
@@ -2648,7 +2650,7 @@ class De {
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.confirmSetup({ code: e });
-      return this.subscribeStore.notify(a.TwoFactorEnabled, {
+      return this.subscribeStore.notify(n.TwoFactorEnabled, {
         recoveryCodes: t.recovery_codes,
         clearRecoveryCodes: () => {
           t.recovery_codes.length = 0;
@@ -2674,7 +2676,7 @@ class De {
         code: e,
         tfa_token: this.partialAuthState.tfaToken
       });
-      return this.clearPartialAuthState(), this.subscribeStore.notify(a.TwoFactorVerified, { tokens: t }), t;
+      return this.clearPartialAuthState(), this.subscribeStore.notify(n.TwoFactorVerified, { tokens: t }), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Verify 2FA code");
     }
@@ -2696,13 +2698,13 @@ class De {
         recovery_code: t,
         tfa_token: this.partialAuthState.tfaToken
       });
-      return this.clearPartialAuthState(), r.remaining_recovery_codes === 0 ? this.subscribeStore.notify(a.TwoFactorRecoveryCodesExhausted, { tokens: r }) : r.remaining_recovery_codes <= 2 && this.subscribeStore.notify(a.TwoFactorRecoveryCodesLow, {
+      return this.clearPartialAuthState(), r.remaining_recovery_codes === 0 ? this.subscribeStore.notify(n.TwoFactorRecoveryCodesExhausted, { tokens: r }) : r.remaining_recovery_codes <= 2 && this.subscribeStore.notify(n.TwoFactorRecoveryCodesLow, {
         tokens: r,
         remainingCodes: r.remaining_recovery_codes
-      }), this.subscribeStore.notify(a.TwoFactorRecoveryUsed, {
+      }), this.subscribeStore.notify(n.TwoFactorRecoveryUsed, {
         tokens: r,
         remainingCodes: r.remaining_recovery_codes
-      }), this.subscribeStore.notify(a.TwoFactorVerified, { tokens: r }), r;
+      }), this.subscribeStore.notify(n.TwoFactorVerified, { tokens: r }), r;
     } catch (t) {
       this.emitErrorAndThrow(t, "Use recovery code");
     }
@@ -2715,7 +2717,7 @@ class De {
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.disable({ code: e });
-      return this.subscribeStore.notify(a.TwoFactorDisabled, {}), t;
+      return this.subscribeStore.notify(n.TwoFactorDisabled, {}), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Disable 2FA");
     }
@@ -2815,12 +2817,12 @@ class De {
       scope: "2fa_setup",
       timestamp: Date.now(),
       expiresAt: Date.now() + (t.expiresIn || 3600) * 1e3
-    }, this.subscribeStore.notify(a.TwoFactorSetupMagicLinkValidated, {
+    }, this.subscribeStore.notify(n.TwoFactorSetupMagicLinkValidated, {
       userId: t.userId,
       appId: t.appId,
       expiresIn: t.expiresIn || 3600,
       sessionToken: t.sessionToken
-    })) : t.error && this.subscribeStore.notify(a.TwoFactorSetupMagicLinkFailed, {
+    })) : t.error && this.subscribeStore.notify(n.TwoFactorSetupMagicLinkFailed, {
       error: t.error
     }), t;
   }
@@ -2891,7 +2893,7 @@ class De {
   async beginMethodSetup(e) {
     try {
       const t = await this.twoFactorApi.beginMethodSetup(e);
-      return this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: "", method: e }), t;
+      return this.subscribeStore.notify(n.TwoFactorSetupStarted, { secret: "", method: e }), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Begin 2FA method setup");
     }
@@ -2902,7 +2904,7 @@ class De {
   async confirmMethodSetup(e, t) {
     try {
       const r = await this.twoFactorApi.confirmMethodSetup(e, t);
-      return this.subscribeStore.notify(a.TwoFactorEnabled, {
+      return this.subscribeStore.notify(n.TwoFactorEnabled, {
         recoveryCodes: [],
         clearRecoveryCodes: () => {
         }
@@ -2927,7 +2929,7 @@ class De {
   async requestChallenge(e) {
     try {
       const t = await this.twoFactorApi.requestChallenge(e);
-      return this.subscribeStore.notify(a.TwoFactorChallengeReceived, {
+      return this.subscribeStore.notify(n.TwoFactorChallengeReceived, {
         challengeId: t.challenge_id,
         method: t.method,
         alternativeMethods: t.alternative_methods
@@ -2942,12 +2944,12 @@ class De {
   async verifyV2(e) {
     try {
       const t = await this.twoFactorApi.verifyV2(e);
-      return t.success && (this.subscribeStore.notify(a.TwoFactorVerified, {
+      return t.success && (this.subscribeStore.notify(n.TwoFactorVerified, {
         tokens: {
           access_token: t.access_token,
           refresh_token: t.refresh_token
         }
-      }), t.device_trusted && this.subscribeStore.notify(a.TwoFactorDeviceTrusted, {})), t;
+      }), t.device_trusted && this.subscribeStore.notify(n.TwoFactorDeviceTrusted, {})), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Verify 2FA challenge");
     }
@@ -2958,7 +2960,7 @@ class De {
   async switchToAlternative(e) {
     try {
       const t = await this.twoFactorApi.switchToAlternative(e);
-      return this.subscribeStore.notify(a.TwoFactorMethodSwitched, {
+      return this.subscribeStore.notify(n.TwoFactorMethodSwitched, {
         challengeId: t.challenge_id,
         method: t.method,
         alternativeMethods: t.alternative_methods
@@ -3026,7 +3028,7 @@ class Pe {
     passkeyUsername: t,
     passkeyDisplayName: r
   } = {}) {
-    const s = this.deviceService.getDeviceId(), o = b.web, { challenge_id: n, publicKey: d } = await this.userAPI.addUserPasskeyStart({
+    const s = this.deviceService.getDeviceId(), o = b.web, { challenge_id: a, publicKey: d } = await this.userAPI.addUserPasskeyStart({
       relyingPartyId: e || window?.location?.hostname,
       deviceId: s,
       os: o,
@@ -3035,17 +3037,17 @@ class Pe {
     });
     d.user.id = btoa(d.user.id);
     const h = await K({ optionsJSON: d });
-    return await this.userAPI.addUserPasskeyComplete(h, s, n);
+    return await this.userAPI.addUserPasskeyComplete(h, s, a);
   }
 }
 const O = class O {
   constructor(e) {
     this.doRefreshTokens = !1, this.origin = window.location.origin, this.session = async ({
       createSession: o,
-      expiredSession: n,
+      expiredSession: a,
       doRefresh: d = !1
     }) => {
-      this.createSessionCallback = o, this.expiredSessionCallback = n, this.doRefreshTokens = d, await this.submitSessionCheck();
+      this.createSessionCallback = o, this.expiredSessionCallback = a, this.doRefreshTokens = d, await this.submitSessionCheck();
     };
     const { url: t, appId: r, scopes: s } = e;
     this.url = t || V, this.appId = r, this.storageManager = new $({
@@ -3092,7 +3094,7 @@ const O = class O {
         message: r instanceof Error || r instanceof u ? r.message : "Session check failed",
         originalError: r
       };
-      this.subscribeStore.notify(a.Error, s), e = void 0;
+      this.subscribeStore.notify(n.Error, s), e = void 0;
     }
     e && this.createSessionCallback && await this.createSessionCallback({ tokens: e, parsedTokens: t }), !e && this.expiredSessionCallback && await this.expiredSessionCallback();
   }
@@ -3170,7 +3172,7 @@ const O = class O {
       const h = new URLSearchParams(window.location.hash.substring(1));
       h.get("access_token") && (e = h, t = !0);
     }
-    const r = e.get("access_token"), s = e.get("refresh_token"), o = e.get("id_token"), n = e.get("scopes")?.split(",") ?? this.scopes;
+    const r = e.get("access_token"), s = e.get("refresh_token"), o = e.get("id_token"), a = e.get("scopes")?.split(",") ?? this.scopes;
     let d;
     if (r) {
       if (!D(r)) {
@@ -3178,7 +3180,7 @@ const O = class O {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
         return;
       }
       if (s && !D(s)) {
@@ -3186,7 +3188,7 @@ const O = class O {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
         return;
       }
       if (o && !D(o)) {
@@ -3194,15 +3196,15 @@ const O = class O {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
         return;
       }
       return d = {
         access_token: r,
         refresh_token: s ?? void 0,
         id_token: o ?? void 0,
-        scopes: n
-      }, this.storageManager.clearDeliveryMode(), this.storageManager.saveTokens(d), this.tokenCacheService.setTokensCache(d), this.subscribeStore.notify(a.SignIn, { tokens: d, parsedTokens: this.getParsedTokens() }), this.submitSessionCheck(), this.cleanupUrlParams(t), this.error = void 0, d;
+        scopes: a
+      }, this.storageManager.clearDeliveryMode(), this.storageManager.saveTokens(d), this.tokenCacheService.setTokensCache(d), this.subscribeStore.notify(n.SignIn, { tokens: d, parsedTokens: this.getParsedTokens() }), this.submitSessionCheck(), this.cleanupUrlParams(t), this.error = void 0, d;
     } else
       this.error = this.checkErrorsFromURL();
   }
@@ -3437,7 +3439,7 @@ const O = class O {
       originalError: e,
       code: e instanceof u ? e.id : void 0
     };
-    throw this.subscribeStore.notify(a.Error, r), e;
+    throw this.subscribeStore.notify(n.Error, r), e;
   }
   /**
    * Sign out the current user and clear all tokens.
@@ -3458,7 +3460,7 @@ const O = class O {
    */
   async logOut() {
     try {
-      await this.authService.logOut(), this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.twoFactorService.clearPartialAuthState(), await this.submitSessionCheck(), this.subscribeStore.notify(a.SignOut, {});
+      await this.authService.logOut(), this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.twoFactorService.clearPartialAuthState(), await this.submitSessionCheck(), this.subscribeStore.notify(n.SignOut, {});
     } catch (e) {
       this.handleError(e, "Log out");
     }
@@ -3528,13 +3530,13 @@ const O = class O {
    * ```
    */
   reset(e) {
-    if (this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.subscribeStore.notify(a.SignOut, {}), e) {
+    if (this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.subscribeStore.notify(n.SignOut, {}), e) {
       this.error = new Error(e);
       const t = {
         message: e,
         code: "RESET_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, t), this.error;
+      throw this.subscribeStore.notify(n.Error, t), this.error;
     }
   }
   /**
@@ -3561,7 +3563,7 @@ const O = class O {
     try {
       return await this.authService.refreshToken();
     } catch (e) {
-      throw e instanceof u || this.subscribeStore.notify(a.Error, {
+      throw e instanceof u || this.subscribeStore.notify(n.Error, {
         message: "Failed to refresh token",
         originalError: e
       }), e;
@@ -3766,7 +3768,7 @@ const O = class O {
    * ```
    */
   setTokens(e) {
-    this.storageManager.saveTokens(e), this.tokenCacheService.setTokensCache(e), this.subscribeStore.notify(a.SignIn, {
+    this.storageManager.saveTokens(e), this.tokenCacheService.setTokensCache(e), this.subscribeStore.notify(n.SignIn, {
       tokens: e,
       parsedTokens: this.tokenCacheService.getParsedTokens()
     });
@@ -4202,7 +4204,7 @@ const O = class O {
   async verifyTwoFactor(e) {
     try {
       const t = await this.twoFactorService.verify(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(a.SignIn, {
+      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(n.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -4229,7 +4231,7 @@ const O = class O {
   async useTwoFactorRecoveryCode(e) {
     try {
       const t = await this.twoFactorService.useRecoveryCode(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(a.SignIn, {
+      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(n.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -4705,9 +4707,9 @@ class Ge {
         signal: r.signal
       });
       clearTimeout(s);
-      const n = {};
+      const a = {};
       o.headers.forEach((h, g) => {
-        n[g.toLowerCase()] = h;
+        a[g.toLowerCase()] = h;
       });
       const d = await o.json();
       if (!o.ok) {
@@ -4718,7 +4720,7 @@ class Ge {
             error_uri: d.error_uri
           },
           o.status,
-          n
+          a
         );
         throw this.config.onError && this.config.onError({
           error: h.code,
@@ -4945,7 +4947,7 @@ export {
   T as PassflowAdminEndpointPaths,
   c as PassflowEndpointPaths,
   u as PassflowError,
-  a as PassflowEvent,
+  n as PassflowEvent,
   de as Providers,
   E as RequestMethod,
   Z as SDK_VERSION,