@passflow/core 0.2.10 → 0.5.0

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import F from "axios";
 import { v4 as H } from "uuid";
 import { startRegistration as K, startAuthentication as j } from "@simplewebauthn/browser";
-const z = "0.2.10", X = {
+const z = "0.5.0", X = {
   version: z
 }, C = "X-Passflow-Clientid", I = "Authorization", W = "X-Passflow-DeviceId", J = "X-Passflow-DeviceType", Z = X.version, Ne = ["id", "offline", "openid"], Q = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], V = "https://auth.passflow.cloud", Ke = "default", ee = 500, te = 600, re = 100, se = 6e4, G = 30, ie = 3, oe = 30, ne = 200, ae = (i) => {
   const e = [];
@@ -12,8 +12,8 @@ const z = "0.2.10", X = {
       continue;
     const s = { tenant: { id: r.tenant_id, name: r.tenant_name } };
     s.groups = r.groups ? Object.keys(r.groups).map((o) => {
-      const n = r.groups[o] || [];
-      return { group: { id: o, name: r.group_names?.[o] ?? "unknown" }, roles: n };
+      const a = r.groups[o] || [];
+      return { group: { id: o, name: r.group_names?.[o] ?? "unknown" }, roles: a };
     }) : [], s.tenantRoles = s.groups?.find((o) => o.group.id === r.root_group_id), e.push(s);
   }
   return { raw: i, tenants: e };
@@ -62,10 +62,10 @@ function v(i) {
   if (!e) throw new Error("Invalid token string");
   const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = ce(r), o = decodeURIComponent(
     s.split("").map((d) => "%" + ("00" + d.charCodeAt(0).toString(16)).slice(-2)).join("")
-  ), n = JSON.parse(o);
-  return n.membership = n.passflow_tm && n.type !== "invite" ? ae(n.passflow_tm) : void 0, n;
+  ), a = JSON.parse(o);
+  return a.membership = a.passflow_tm && a.type !== "invite" ? ae(a.passflow_tm) : void 0, a;
 }
-var p = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(p || {}), y = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(y || {}), q = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(q || {});
+var p = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(p || {}), m = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(m || {}), q = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(q || {});
 class Y {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
@@ -166,7 +166,7 @@ class Y {
   loadPersistedMode() {
     try {
       const e = this.storageManager.storage.getItem(this.DELIVERY_MODE_KEY);
-      e && Object.values(y).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
+      e && Object.values(m).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
     } catch {
     }
   }
@@ -227,8 +227,8 @@ class $ {
    * In JSON mode: save all tokens (existing behavior)
    */
   saveTokens(e, t) {
-    const { id_token: r, access_token: s, refresh_token: o, scopes: n } = e;
-    t === y.Cookie || t === y.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(p.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(p.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(p.refresh_token), o), n && this.storage.setItem(this.scopes, n.join(",")));
+    const { id_token: r, access_token: s, refresh_token: o, scopes: a } = e;
+    t === m.Cookie || t === m.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(p.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(p.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(p.refresh_token), o), a && this.storage.setItem(this.scopes, a.join(",")));
   }
   getToken(e) {
     const t = this.getKeyForTokenType(e);
@@ -241,7 +241,7 @@ class $ {
    */
   getTokens() {
     const e = this.getDeliveryMode();
-    if (e === y.Cookie || e === y.BFF) {
+    if (e === m.Cookie || e === m.BFF) {
       const r = this.storage.getItem(this.ID_TOKEN_KEY);
       return r ? {
         id_token: r
@@ -324,7 +324,7 @@ class $ {
   getDeliveryMode() {
     try {
       const e = this.storage.getItem(this.DELIVERY_MODE_KEY);
-      if (e && Object.values(y).includes(e))
+      if (e && Object.values(m).includes(e))
         return e;
     } catch {
     }
@@ -416,14 +416,14 @@ class B {
     return H();
   }
 }
-var E = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(E || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorMethodSetupBegin = "/v2/user/2fa/methods/:method/setup/begin", i.TwoFactorMethodSetupConfirm = "/v2/user/2fa/methods/:method/setup/confirm", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i))(c || {}), T = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(T || {});
+var E = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(E || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorMethodSetupBegin = "/v2/user/2fa/methods/:method/setup/begin", i.TwoFactorMethodSetupConfirm = "/v2/user/2fa/methods/:method/setup/confirm", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i.cliAuthStatus = "/cli/auth/status/:sessionId", i.cliAuthComplete = "/cli/auth/complete", i))(c || {}), _ = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(_ || {});
 class u extends Error {
   constructor(e) {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
 var de = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(de || {}), b = /* @__PURE__ */ ((i) => (i.web = "web", i))(b || {});
-function m(i, e) {
+function y(i, e) {
   let t = i;
   return Object.entries(e).forEach(([r, s]) => {
     t = t.replace(`:${r}`, s);
@@ -431,15 +431,15 @@ function m(i, e) {
 }
 var ue = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(ue || {});
 const le = 3, ge = 1e3;
-class _ {
+class w {
   constructor(e, t, r) {
     this.refreshPromise = null, this.isRefreshing = !1, this.origin = typeof window < "u" ? window.location.origin : "", this.defaultHeaders = {
       Accept: "application/json",
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh"];
-    const { url: s, appId: o, keyStoragePrefix: n } = e;
+    const { url: s, appId: o, keyStoragePrefix: a } = e;
     this.url = s || V, this.storageManager = t ?? new $({
-      prefix: n ?? ""
+      prefix: a ?? ""
     }), this.deviceService = r ?? new B(this.storageManager), this.tokenService = new he(this.storageManager), this.tokenDeliveryManager = new Y(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
       ...this.defaultHeaders,
       [C]: o
@@ -552,18 +552,18 @@ class _ {
     const o = t._retryCount || 0;
     if (o >= le)
       return Promise.reject(e);
-    let n = ge * Math.pow(2, o);
+    let a = ge * Math.pow(2, o);
     const d = e.response?.headers?.["retry-after"];
     if (d) {
       const h = Number.parseInt(d, 10);
       if (!Number.isNaN(h))
-        n = h * 1e3;
+        a = h * 1e3;
       else {
         const g = new Date(d);
-        Number.isNaN(g.getTime()) || (n = Math.max(0, g.getTime() - Date.now()));
+        Number.isNaN(g.getTime()) || (a = Math.max(0, g.getTime() - Date.now()));
       }
     }
-    return await new Promise((h) => setTimeout(h, n)), t._retryCount = o + 1, this.instance.request(t);
+    return await new Promise((h) => setTimeout(h, a)), t._retryCount = o + 1, this.instance.request(t);
   }
   // eslint-disable-next-line complexity
   // biome-ignore lint/suspicious/useAwait: <explanation>
@@ -622,7 +622,7 @@ class _ {
 }
 class pe {
   constructor(e, t, r) {
-    this.axiosClient = new _(e, t, r);
+    this.axiosClient = new w(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -633,7 +633,7 @@ class pe {
 }
 class fe {
   constructor(e, t, r) {
-    this.axiosClient = new _(e, t, r);
+    this.axiosClient = new w(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -690,7 +690,7 @@ class fe {
     );
   }
   logOut(e, t, r = !1) {
-    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? T.logout : c.logout;
+    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? _.logout : c.logout;
     return this.axiosClient.post(o, s);
   }
   validateSession() {
@@ -715,21 +715,21 @@ class fe {
     });
   }
   passkeyRegisterStart(e, t, r, s = !1) {
-    const { create_tenant: o } = e, n = {
+    const { create_tenant: o } = e, a = {
       ...e,
       create_tenant: o ?? !1,
       device: t,
       os: r
-    }, d = s ? T.passkeyRegisterStart : c.passkeyRegisterStart;
-    return this.axiosClient.post(d, n);
+    }, d = s ? _.passkeyRegisterStart : c.passkeyRegisterStart;
+    return this.axiosClient.post(d, a);
   }
   passkeyRegisterComplete(e, t, r, s = !1) {
     const o = {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, n = s ? T.passkeyRegisterComplete : c.passkeyRegisterComplete;
-    return this.axiosClient.post(n, o);
+    }, a = s ? _.passkeyRegisterComplete : c.passkeyRegisterComplete;
+    return this.axiosClient.post(a, o);
   }
   passkeyAuthenticateStart(e, t, r, s = !1) {
     const o = {
@@ -737,9 +737,9 @@ class fe {
       user_id: e.user_id ?? "",
       device: t,
       os: r
-    }, n = s ? T.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
+    }, a = s ? _.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
     return this.axiosClient.post(
-      n,
+      a,
       o
     );
   }
@@ -748,24 +748,39 @@ class fe {
       challenge_id: r,
       device: t,
       passkey_data: e
-    }, n = s ? T.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
-    return this.axiosClient.post(n, o);
+    }, a = s ? _.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
+    return this.axiosClient.post(a, o);
   }
   passkeyValidate(e, t, r, s = !1, o) {
-    const n = {
+    const a = {
       otp: e,
       device: t,
       challenge_id: r
     };
     let d = c.passkeyValidate;
-    !o && s && (d = T.passkeyValidate);
+    !o && s && (d = _.passkeyValidate);
     const h = o ? { [C]: o } : {};
-    return this.axiosClient.post(d, n, { headers: h });
+    return this.axiosClient.post(d, a, { headers: h });
+  }
+}
+class Ve {
+  constructor(e, t, r) {
+    this.axiosClient = new w(e, t, r);
+  }
+  setAppId(e) {
+    this.axiosClient.setAppId(e);
+  }
+  getCLIAuthStatus(e) {
+    const t = y(c.cliAuthStatus, { sessionId: e });
+    return this.axiosClient.get(t);
+  }
+  completeCLIAuth(e) {
+    return this.axiosClient.post(c.cliAuthComplete, e);
   }
 }
 class ke {
   constructor(e, t, r) {
-    this.axiosClient = new _(e, t, r);
+    this.axiosClient = new w(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -789,7 +804,7 @@ class ke {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const r = m(c.invitationsPath, {
+    const r = y(c.invitationsPath, {
       tenantID: e.tenantID
     });
     return this.axiosClient.get(r, { params: t }).then((s) => ({
@@ -803,7 +818,7 @@ class ke {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = m(c.invitationDelete, {
+    const t = y(c.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -814,7 +829,7 @@ class ke {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = m(c.invitationResend, {
+    const t = y(c.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -825,7 +840,7 @@ class ke {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = m(c.invitationGetLink, {
+    const t = y(c.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
@@ -833,7 +848,7 @@ class ke {
 }
 class ve {
   constructor(e, t, r) {
-    this.axiosClient = new _(e, t, r);
+    this.axiosClient = new w(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -850,7 +865,7 @@ class ve {
 }
 class ye {
   constructor(e, t, r) {
-    this.axiosClient = new _(e, t, r);
+    this.axiosClient = new w(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -952,8 +967,8 @@ class ye {
    * @param role Role to assign
    */
   addUserToGroup(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/add`, n = { user_id: r, role: s };
-    return this.axiosClient.post(o, n);
+    const o = `${c.tenantPath}/${e}/group/${t}/add`, a = { user_id: r, role: s };
+    return this.axiosClient.post(o, a);
   }
   /**
    * Remove user roles from a group
@@ -963,8 +978,8 @@ class ye {
    * @param roles Roles to remove
    */
   removeUserRolesFromGroup(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/remove_roles`, n = { user_id: r, roles: s };
-    return this.axiosClient.post(o, n);
+    const o = `${c.tenantPath}/${e}/group/${t}/remove_roles`, a = { user_id: r, roles: s };
+    return this.axiosClient.post(o, a);
   }
   /**
    * Change user roles in a group
@@ -974,8 +989,8 @@ class ye {
    * @param roles New roles to assign
    */
   changeUserRoles(e, t, r, s) {
-    const o = `${c.tenantPath}/${e}/group/${t}/change`, n = { user_id: r, roles: s };
-    return this.axiosClient.post(o, n);
+    const o = `${c.tenantPath}/${e}/group/${t}/change`, a = { user_id: r, roles: s };
+    return this.axiosClient.post(o, a);
   }
   /**
    * Delete a user from a group
@@ -1083,7 +1098,7 @@ class ye {
 }
 class me {
   constructor(e, t, r) {
-    this.axiosClient = new _(e, t, r);
+    this.axiosClient = new w(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1197,13 +1212,13 @@ class me {
       };
     }).catch((r) => {
       if (r.response) {
-        const s = r.response.status, o = r.response.data || {}, n = r.response.headers?.["retry-after"] ? parseInt(r.response.headers["retry-after"], 10) : void 0;
+        const s = r.response.status, o = r.response.data || {}, a = r.response.headers?.["retry-after"] ? parseInt(r.response.headers["retry-after"], 10) : void 0;
         return {
           success: !1,
           error: {
             code: o.error || this.mapStatusToErrorCode(s),
             message: o.message || this.getDefaultErrorMessage(s),
-            retryAfter: n
+            retryAfter: a
           }
         };
       }
@@ -1272,7 +1287,7 @@ class me {
    * POST /v2/user/2fa/methods/:method/setup/begin
    */
   beginMethodSetup(e) {
-    const t = m(c.TwoFactorMethodSetupBegin, { method: e });
+    const t = y(c.TwoFactorMethodSetupBegin, { method: e });
     return this.axiosClient.post(t, {});
   }
   /**
@@ -1280,7 +1295,7 @@ class me {
    * POST /v2/user/2fa/methods/:method/setup/confirm
    */
   confirmMethodSetup(e, t) {
-    const r = m(c.TwoFactorMethodSetupConfirm, { method: e });
+    const r = y(c.TwoFactorMethodSetupConfirm, { method: e });
     return this.axiosClient.post(r, t);
   }
   /**
@@ -1288,7 +1303,7 @@ class me {
    * DELETE /v2/user/2fa/methods/:id
    */
   removeMethod(e) {
-    const t = m(c.TwoFactorMethodRemove, { id: e });
+    const t = y(c.TwoFactorMethodRemove, { id: e });
     return this.axiosClient.delete(t);
   }
   /**
@@ -1333,13 +1348,13 @@ class me {
    * DELETE /v2/user/2fa/trusted-devices/:id
    */
   revokeTrustedDevice(e) {
-    const t = m(c.TwoFactorTrustedDeviceRevoke, { id: e });
+    const t = y(c.TwoFactorTrustedDeviceRevoke, { id: e });
     return this.axiosClient.delete(t);
   }
 }
 class Se {
   constructor(e, t, r) {
-    this.axiosClient = new _(e, t, r);
+    this.axiosClient = new w(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1365,14 +1380,14 @@ class Se {
     passkeyDisplayName: s,
     passkeyUsername: o
   }) {
-    const n = {
+    const a = {
       passkey_display_name: s,
       passkey_username: o,
       relying_party_id: e,
       deviceId: t,
       os: r
     };
-    return this.axiosClient.post(c.addUserPasskey, n);
+    return this.axiosClient.post(c.addUserPasskey, a);
   }
   addUserPasskeyComplete(e, t, r) {
     return this.axiosClient.post(c.completeAddUserPasskey, {
@@ -1382,7 +1397,7 @@ class Se {
     });
   }
 }
-var a = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(a || {});
+var n = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.SessionExpired = "session:expired", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(n || {});
 class we {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
@@ -1457,8 +1472,8 @@ function Ee(i) {
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
 class Ie {
-  constructor(e, t, r, s, o, n, d, h, g, f, k, A) {
-    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = d, this.origin = h, this.url = g, this.sessionCallbacks = f, this.appId = k, this.tokenExchangeConfig = A, this.tokenDeliveryManager = new Y(r), A?.enabled && this.tokenDeliveryManager.setMode(y.BFF), this.initializeSession();
+  constructor(e, t, r, s, o, a, d, h, g, f, k, A) {
+    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = a, this.createTenantForNewUser = d, this.origin = h, this.url = g, this.sessionCallbacks = f, this.appId = k, this.tokenExchangeConfig = A, this.tokenDeliveryManager = new Y(r), A?.enabled && this.tokenDeliveryManager.setMode(m.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -1487,7 +1502,7 @@ class Ie {
       return !1;
     try {
       const e = await this.authApi.validateSession();
-      return e.valid ? (this.tokenDeliveryManager.setSessionValid(), e.user && this.subscribeStore.notify(a.SessionRestored, e.user), !0) : (this.tokenDeliveryManager.setSessionInvalid(), !1);
+      return e.valid ? (this.tokenDeliveryManager.setSessionValid(), e.user && this.subscribeStore.notify(n.SessionRestored, e.user), !0) : (this.tokenDeliveryManager.setSessionInvalid(), !1);
     } catch {
       return this.tokenDeliveryManager.setSessionInvalid(), !1;
     }
@@ -1531,7 +1546,7 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
     if ("username" in e && e.username && !_e(e.username)) {
       const s = new Error(
@@ -1541,7 +1556,7 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
     if ("phone" in e && e.phone && !x(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
@@ -1549,18 +1564,18 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
-    this.subscribeStore.notify(a.SignInStart, { email: e.email });
+    this.subscribeStore.notify(n.SignInStart, { email: e.email });
     const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes;
     try {
       const s = await this.authApi.signIn(e, t, r);
-      return "requires_2fa" in s && s.requires_2fa === !0 || "tfa_token" in s && s.tfa_token ? (this.subscribeStore.notify(a.TwoFactorRequired, {
+      return "requires_2fa" in s && s.requires_2fa === !0 || "tfa_token" in s && s.tfa_token ? (this.subscribeStore.notify(n.TwoFactorRequired, {
         email: e.email || "",
         challengeId: s.challenge_id || "",
         tfaToken: s.tfa_token || ""
-      }), s) : (await this.processAuthResponse(s, e.scopes), this.subscribeStore.notify(a.SignIn, {
+      }), s) : (await this.processAuthResponse(s, e.scopes), this.subscribeStore.notify(n.SignIn, {
         tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), s);
@@ -1570,7 +1585,7 @@ class Ie {
         originalError: s,
         code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
   }
   async signUp(e) {
@@ -1580,7 +1595,7 @@ class Ie {
         originalError: t,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
     if (e.user.phone_number && !x(e.user.phone_number)) {
       const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), r = {
@@ -1588,12 +1603,12 @@ class Ie {
         originalError: t,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
-    this.subscribeStore.notify(a.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
+    this.subscribeStore.notify(n.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
       const t = await this.authApi.signUp(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(a.Register, {
+      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(n.Register, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -1603,7 +1618,7 @@ class Ie {
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   async passwordlessSignIn(e) {
@@ -1613,7 +1628,7 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
     if (e.phone && !x(e.phone)) {
       const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
@@ -1621,9 +1636,9 @@ class Ie {
         originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
-    this.subscribeStore.notify(a.SignInStart, { email: e.email }), e.scopes = e.scopes ?? this.scopes;
+    this.subscribeStore.notify(n.SignInStart, { email: e.email }), e.scopes = e.scopes ?? this.scopes;
     const t = this.deviceService.getDeviceId(), r = b.web;
     try {
       return await this.authApi.passwordlessSignIn(e, t, r);
@@ -1633,14 +1648,14 @@ class Ie {
         originalError: s,
         code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
   }
   async passwordlessSignInComplete(e) {
-    this.subscribeStore.notify(a.SignInStart, {}), e.scopes = e.scopes ?? this.scopes, e.device = this.deviceService.getDeviceId();
+    this.subscribeStore.notify(n.SignInStart, {}), e.scopes = e.scopes ?? this.scopes, e.device = this.deviceService.getDeviceId();
     try {
       const t = await this.authApi.passwordlessSignInComplete(e);
-      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(a.SignIn, {
+      return await this.processAuthResponse(t, e.scopes), this.subscribeStore.notify(n.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -1650,7 +1665,7 @@ class Ie {
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   async logOut() {
@@ -1671,10 +1686,10 @@ class Ie {
       } catch {
       }
     }
-    this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(a.SignOut, {});
+    this.storageManager.deleteTokens(), this.storageManager.clearIdToken(), this.storageManager.clearCsrfToken(), this.tokenDeliveryManager.reset(), this.subscribeStore.notify(n.SignOut, {});
   }
   async refreshToken() {
-    if (this.subscribeStore.notify(a.RefreshStart, {}), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.refreshUrl)
+    if (this.subscribeStore.notify(n.RefreshStart, {}), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.refreshUrl)
       try {
         const r = await fetch(this.tokenExchangeConfig.refreshUrl, {
           method: "POST",
@@ -1684,25 +1699,25 @@ class Ie {
         if (!r.ok)
           throw this.tokenDeliveryManager.setSessionInvalid(), new Error("BFF token refresh failed");
         const s = await r.json();
-        return this.tokenDeliveryManager.setSessionValid(), s.id_token && this.storageManager.setIdToken(s.id_token), this.subscribeStore.notify(a.Refresh, {
+        return this.tokenDeliveryManager.setSessionValid(), s.id_token && this.storageManager.setIdToken(s.id_token), this.subscribeStore.notify(n.Refresh, {
           tokens: s,
           parsedTokens: this.tokenCacheService.getParsedTokens()
-        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, s;
+        }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, s;
       } catch (r) {
         this.tokenDeliveryManager.setSessionInvalid();
         const s = {
           message: r instanceof Error ? r.message : "Token refresh failed",
           originalError: r
         };
-        throw this.subscribeStore.notify(a.Error, s), r;
+        throw this.subscribeStore.notify(n.Error, s), r;
       }
     if (this.tokenDeliveryManager.isCookieMode())
       try {
         const r = await this.authApi.refreshToken("", this.scopes);
-        return this.tokenDeliveryManager.setSessionValid(), await this.processAuthResponse(r, this.scopes), this.subscribeStore.notify(a.Refresh, {
+        return this.tokenDeliveryManager.setSessionValid(), await this.processAuthResponse(r, this.scopes), this.subscribeStore.notify(n.Refresh, {
           tokens: r,
           parsedTokens: this.tokenCacheService.getParsedTokens()
-        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, r;
+        }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, r;
       } catch (r) {
         this.tokenDeliveryManager.setSessionInvalid();
         const s = {
@@ -1710,7 +1725,7 @@ class Ie {
           originalError: r,
           code: r instanceof u ? r.id : void 0
         };
-        throw this.subscribeStore.notify(a.Error, s), r;
+        throw this.subscribeStore.notify(n.Error, s), r;
       }
     const e = this.storageManager.getTokens();
     if (e) {
@@ -1719,22 +1734,22 @@ class Ie {
           message: "No refresh token found",
           originalError: r
         };
-        throw this.subscribeStore.notify(a.Error, s), r;
+        throw this.subscribeStore.notify(n.Error, s), r;
       }
     } else {
       const r = new Error("No tokens found"), s = {
         message: "No tokens found",
         originalError: r
       };
-      throw this.subscribeStore.notify(a.Error, s), r;
+      throw this.subscribeStore.notify(n.Error, s), r;
     }
     const t = e?.scopes ?? this.scopes;
     try {
       const r = await this.authApi.refreshToken(e?.refresh_token ?? "", t, e?.access_token);
-      return r.scopes = t, this.storageManager.saveTokens(r), this.tokenCacheService.setTokensCache(r), this.subscribeStore.notify(a.Refresh, {
+      return r.scopes = t, this.storageManager.saveTokens(r), this.tokenCacheService.setTokensCache(r), this.subscribeStore.notify(n.Refresh, {
         tokens: r,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, this.tokenCacheService.startTokenCheck(), r;
+      }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, this.tokenCacheService.startTokenCheck(), r;
     } catch (r) {
       const s = {
         message: r instanceof Error ? r.message : "Token refresh failed",
@@ -1745,7 +1760,9 @@ class Ie {
           data: r.response.data
         } : void 0
       };
-      throw this.subscribeStore.notify(a.Error, s), r instanceof u ? r : F.isAxiosError(r) && r.response && r.response?.status >= 400 && r.response?.status < 500 ? new Error(`Getting unknown error message from server with code:${r.response.status}`) : r;
+      this.subscribeStore.notify(n.Error, s);
+      const o = F.isAxiosError(r) && r.response?.status && r.response.status >= 400 && r.response.status < 500;
+      throw o && (this.tokenCacheService.tokenExpiredFlag = !0, this.tokenCacheService.setTokensCache(void 0), this.storageManager.deleteTokens(), this.subscribeStore.notify(n.SessionExpired, { reason: "refresh_failed" })), r instanceof u ? r : o ? new Error(`Getting unknown error message from server with code:${r.response?.status}`) : r;
     }
   }
   async sendPasswordResetEmail(e) {
@@ -1757,43 +1774,43 @@ class Ie {
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   async resetPassword(e, t) {
-    this.subscribeStore.notify(a.SignInStart, {});
+    this.subscribeStore.notify(n.SignInStart, {});
     const s = new URLSearchParams(window.location.search).get("token") ?? void 0, o = t ?? this.scopes;
     try {
-      const n = await this.authApi.resetPassword(e, o, s);
-      return await this.processAuthResponse(n, o), this.subscribeStore.notify(a.SignIn, {
-        tokens: n,
+      const a = await this.authApi.resetPassword(e, o, s);
+      return await this.processAuthResponse(a, o), this.subscribeStore.notify(n.SignIn, {
+        tokens: a,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), n;
-    } catch (n) {
+      }), await this.submitSessionCheck(), a;
+    } catch (a) {
       const d = {
-        message: n instanceof Error ? n.message : "Password reset failed",
-        originalError: n,
-        code: n instanceof u ? n.id : void 0
+        message: a instanceof Error ? a.message : "Password reset failed",
+        originalError: a,
+        code: a instanceof u ? a.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, d), n;
+      throw this.subscribeStore.notify(n.Error, d), a;
     }
   }
   async passkeyRegister(e) {
-    this.subscribeStore.notify(a.RegisterStart, {});
+    this.subscribeStore.notify(n.RegisterStart, {});
     const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
       const { challenge_id: s, publicKey: o } = await this.authApi.passkeyRegisterStart(e, t, r, !this.appId);
       o.user.id = btoa(o.user.id);
-      const n = await K({
+      const a = await K({
         optionsJSON: o
       }), d = await this.authApi.passkeyRegisterComplete(
-        n,
+        a,
         t,
         s,
         !this.appId
       );
-      return await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(a.Register, {
+      return await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(n.Register, {
         tokens: d,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), d;
@@ -1803,23 +1820,23 @@ class Ie {
         originalError: s,
         code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
   }
   async passkeyAuthenticate(e) {
-    this.subscribeStore.notify(a.SignInStart, {});
+    this.subscribeStore.notify(n.SignInStart, {});
     const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const { challenge_id: s, publicKey: o } = await this.authApi.passkeyAuthenticateStart(e, t, r, !this.appId), n = await j({
+      const { challenge_id: s, publicKey: o } = await this.authApi.passkeyAuthenticateStart(e, t, r, !this.appId), a = await j({
         optionsJSON: o
       }), d = await this.authApi.passkeyAuthenticateComplete(
-        n,
+        a,
         t,
         s,
         !this.appId
       );
-      return "access_token" in d && (await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(a.SignIn, {
+      return "access_token" in d && (await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(n.SignIn, {
         tokens: d,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck()), d;
@@ -1829,7 +1846,7 @@ class Ie {
         originalError: s,
         code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, o), s;
+      throw this.subscribeStore.notify(n.Error, o), s;
     }
   }
   createFederatedAuthUrl(e) {
@@ -1842,33 +1859,33 @@ class Ie {
       ...e.invite_token ? { invite_token: e.invite_token } : {},
       ...e.create_tenant ? { create_tenant: e.create_tenant.toString() } : {},
       ...e.device ? { device: e.device } : {}
-    }, o = new URL(t, this.url), n = new URLSearchParams(s);
-    return o.search = n.toString(), o.toString();
+    }, o = new URL(t, this.url), a = new URLSearchParams(s);
+    return o.search = a.toString(), o.toString();
   }
   federatedAuthWithPopup(e) {
-    this.subscribeStore.notify(a.SignInStart, { provider: e.provider });
+    this.subscribeStore.notify(n.SignInStart, { provider: e.provider });
     const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r }), o = window.open(s, "_blank", `width=${ee},height=${te}`);
     if (!o) {
       this.federatedAuthWithRedirect(e);
       return;
     }
-    const n = Date.now(), d = setInterval(() => {
+    const a = Date.now(), d = setInterval(() => {
       if (o.closed) {
         clearInterval(d);
         const h = {
           message: "Authentication popup was closed",
           code: "POPUP_CLOSED"
         };
-        this.subscribeStore.notify(a.Error, h);
+        this.subscribeStore.notify(n.Error, h);
         return;
       }
-      if (Date.now() - n > se) {
+      if (Date.now() - a > se) {
         clearInterval(d), o.close();
         const h = {
           message: "Authentication popup timed out",
           code: "POPUP_TIMEOUT"
         };
-        this.subscribeStore.notify(a.Error, h);
+        this.subscribeStore.notify(n.Error, h);
         return;
       }
       try {
@@ -1880,7 +1897,7 @@ class Ie {
             scopes: t
           };
           this.processAuthResponse(A, t).then(() => {
-            this.subscribeStore.notify(a.SignIn, {
+            this.subscribeStore.notify(n.SignIn, {
               tokens: A,
               parsedTokens: this.tokenCacheService.getParsedTokens()
             }), window.location.href = `${this.origin}`;
@@ -1891,27 +1908,27 @@ class Ie {
     }, re);
   }
   federatedAuthWithRedirect(e) {
-    this.subscribeStore.notify(a.SignInStart, { provider: e.provider });
+    this.subscribeStore.notify(n.SignInStart, { provider: e.provider });
     const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r });
     window.location.href = s;
   }
   // Helper methods for authentication UI redirect
   authRedirectUrl(e = {}) {
     try {
-      const { url: t, redirectUrl: r, scopes: s, appId: o } = e ?? {}, n = new URL(t ?? this.url);
-      n.pathname = (n.pathname.endsWith("/") ? n.pathname : n.pathname + "/") + "web";
+      const { url: t, redirectUrl: r, scopes: s, appId: o } = e ?? {}, a = new URL(t ?? this.url);
+      a.pathname = (a.pathname.endsWith("/") ? a.pathname : a.pathname + "/") + "web";
       const d = s ?? this.scopes, h = {
         appId: o ?? this.appId ?? "",
         redirectto: r ?? window.location.href,
         scopes: d.join(",")
       }, g = new URLSearchParams(h);
-      return n.search = g.toString(), n.toString();
+      return a.search = g.toString(), a.toString();
     } catch (t) {
       const r = {
         message: t instanceof Error ? t.message : "Failed to create auth redirect URL",
         originalError: t
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   authRedirect(e = {}) {
@@ -1922,7 +1939,7 @@ class Ie {
         message: t instanceof Error ? t.message : "Failed to redirect to auth page",
         originalError: t
       };
-      throw this.subscribeStore.notify(a.Error, r), t;
+      throw this.subscribeStore.notify(n.Error, r), t;
     }
   }
   /**
@@ -1941,7 +1958,7 @@ class Ie {
         message: t instanceof Error ? t.message : "Failed to check authentication status",
         originalError: t
       };
-      return this.subscribeStore.notify(a.Error, r), !1;
+      return this.subscribeStore.notify(n.Error, r), !1;
     }
   }
   /**
@@ -1956,7 +1973,7 @@ class Ie {
         message: s instanceof Error || s instanceof u ? s.message : "Session check failed",
         originalError: s
       };
-      this.subscribeStore.notify(a.Error, o), t = void 0;
+      this.subscribeStore.notify(n.Error, o), t = void 0;
     }
     return t && this.sessionCallbacks.createSession && await this.sessionCallbacks.createSession({ tokens: t, parsedTokens: r }), !t && this.sessionCallbacks.expiredSession && await this.sessionCallbacks.expiredSession(), t;
   }
@@ -1980,7 +1997,7 @@ class Ie {
         message: t instanceof Error ? t.message : "Failed to get tokens",
         originalError: t
       };
-      this.subscribeStore.notify(a.Error, r);
+      this.subscribeStore.notify(n.Error, r);
       return;
     }
   }
@@ -2053,31 +2070,31 @@ class Re {
   }
   normalize(e) {
     const t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), o = [];
-    return e.groups?.forEach((n) => {
-      r.set(n.id, {
-        id: n.id,
-        name: n.name,
-        default: n.default ?? !1,
-        updated_at: n.updated_at,
-        created_at: n.created_at
+    return e.groups?.forEach((a) => {
+      r.set(a.id, {
+        id: a.id,
+        name: a.name,
+        default: a.default ?? !1,
+        updated_at: a.updated_at,
+        created_at: a.created_at
       });
-    }), e.roles?.forEach((n) => {
-      s.set(n.id, {
-        id: n.id,
-        tenant_id: n.tenant_id,
-        name: n.name
+    }), e.roles?.forEach((a) => {
+      s.set(a.id, {
+        id: a.id,
+        tenant_id: a.tenant_id,
+        name: a.name
       });
-    }), e.users_in_groups?.forEach((n) => {
-      const d = n.user;
+    }), e.users_in_groups?.forEach((a) => {
+      const d = a.user;
       d && !t.has(d.id) && t.set(d.id, {
         id: d.id,
         name: d.name ?? null,
         email: d.email ?? null,
         phone: d.phone ?? null
-      }), d && n.group_id && r.has(n.group_id) && o.push({
+      }), d && a.group_id && r.has(a.group_id) && o.push({
         userId: d.id,
-        groupId: n.group_id,
-        roleIds: n.roles?.map((h) => h.id) ?? []
+        groupId: a.group_id,
+        roleIds: a.roles?.map((h) => h.id) ?? []
       });
     }), {
       tenant_id: e.tenant_id,
@@ -2503,39 +2520,39 @@ class Fe {
         return;
       }
       const t = v(e.access_token);
-      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
+      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
         originalError: e
       };
-      this.subscribeStore.notify(a.Error, t), this.setTokensCache(void 0);
+      this.subscribeStore.notify(n.Error, t), this.setTokensCache(void 0);
     }
   }
   async refreshTokensCache(e) {
     if (!this.isRefreshing)
       try {
-        this.isRefreshing = !0, this.subscribeStore.notify(a.RefreshStart, {});
+        this.isRefreshing = !0, this.subscribeStore.notify(n.RefreshStart, {});
         const t = await this.authApi.refreshToken(e?.refresh_token ?? "", e.scopes ?? [], e.access_token);
-        this.setTokensCache(t), this.subscribeStore.notify(a.Refresh, { tokens: t, parsedTokens: this.getParsedTokens() }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenExpiredFlag = !1, this.startTokenCheck();
+        this.setTokensCache(t), this.subscribeStore.notify(n.Refresh, { tokens: t, parsedTokens: this.getParsedTokens() }), this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !1 }), this.tokenExpiredFlag = !1, this.startTokenCheck();
       } catch (t) {
         const r = {
           message: t instanceof Error ? t.message : "Failed to get tokens",
           originalError: t
         };
-        this.subscribeStore.notify(a.Error, r), this.setTokensCache(void 0);
+        this.subscribeStore.notify(n.Error, r), this.tokenExpiredFlag = !0, this.setTokensCache(void 0), this.stopTokenCheck(), this.storageManager.deleteTokens(), this.subscribeStore.notify(n.SessionExpired, { reason: "refresh_failed" });
       } finally {
         this.isRefreshing = !1;
       }
   }
   startTokenCheck() {
     this.checkInterval && clearInterval(this.checkInterval), !this.tokenExpiredFlag && (this.setupVisibilityListener(), this.checkInterval = setInterval(() => {
-      typeof document < "u" && document.hidden || this.isRefreshing || this.tokenExpiredFlag || this.isExpired() && !this.tokenExpiredFlag && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
+      typeof document < "u" && document.hidden || this.isRefreshing || this.tokenExpiredFlag || this.isExpired() && !this.tokenExpiredFlag && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
     }, this.CHECK_INTERVAL));
   }
   setupVisibilityListener() {
     typeof document > "u" || (this.visibilityChangeHandler && document.removeEventListener("visibilitychange", this.visibilityChangeHandler), this.visibilityChangeHandler = () => {
-      !document.hidden && this.checkInterval && !this.isRefreshing && !this.tokenExpiredFlag && this.isExpired() && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
+      !document.hidden && this.checkInterval && !this.isRefreshing && !this.tokenExpiredFlag && this.isExpired() && (this.tokenExpiredFlag = !0, this.subscribeStore.notify(n.TokenCacheExpired, { isExpired: !0 }), this.stopTokenCheck());
     }, document.addEventListener("visibilitychange", this.visibilityChangeHandler));
   }
   setupPageUnloadHandler() {
@@ -2576,7 +2593,7 @@ class Fe {
         message: e instanceof Error ? e.message : "Failed to get tokens",
         originalError: e
       };
-      this.subscribeStore.notify(a.Error, t);
+      this.subscribeStore.notify(n.Error, t);
       return;
     }
   }
@@ -2596,13 +2613,13 @@ class De {
     this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
     const r = {
       onAuthChange: (s, o) => {
-        if (s === a.TwoFactorRequired) {
-          const n = o;
-          this.setPartialAuthState(n.email, n.challengeId, n.tfaToken);
+        if (s === n.TwoFactorRequired) {
+          const a = o;
+          this.setPartialAuthState(a.email, a.challengeId, a.tfaToken);
         }
       }
     };
-    this.subscribeStore.subscribe(r, [a.TwoFactorRequired]);
+    this.subscribeStore.subscribe(r, [n.TwoFactorRequired]);
   }
   /**
    * Emit error event and throw the error
@@ -2614,7 +2631,7 @@ class De {
       originalError: e,
       code: r?.id || void 0
     };
-    throw this.subscribeStore.notify(a.Error, s), e;
+    throw this.subscribeStore.notify(n.Error, s), e;
   }
   /**
    * Get 2FA enrollment status for current user
@@ -2634,7 +2651,7 @@ class De {
   async beginSetup() {
     try {
       const e = await this.twoFactorApi.beginSetup();
-      return e.totp_digits && (this.totpDigits = e.totp_digits), this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: e.secret }), e;
+      return e.totp_digits && (this.totpDigits = e.totp_digits), this.subscribeStore.notify(n.TwoFactorSetupStarted, { secret: e.secret }), e;
     } catch (e) {
       this.emitErrorAndThrow(e, "Begin 2FA setup");
     }
@@ -2648,7 +2665,7 @@ class De {
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.confirmSetup({ code: e });
-      return this.subscribeStore.notify(a.TwoFactorEnabled, {
+      return this.subscribeStore.notify(n.TwoFactorEnabled, {
         recoveryCodes: t.recovery_codes,
         clearRecoveryCodes: () => {
           t.recovery_codes.length = 0;
@@ -2674,7 +2691,7 @@ class De {
         code: e,
         tfa_token: this.partialAuthState.tfaToken
       });
-      return this.clearPartialAuthState(), this.subscribeStore.notify(a.TwoFactorVerified, { tokens: t }), t;
+      return this.clearPartialAuthState(), this.subscribeStore.notify(n.TwoFactorVerified, { tokens: t }), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Verify 2FA code");
     }
@@ -2696,13 +2713,13 @@ class De {
         recovery_code: t,
         tfa_token: this.partialAuthState.tfaToken
       });
-      return this.clearPartialAuthState(), r.remaining_recovery_codes === 0 ? this.subscribeStore.notify(a.TwoFactorRecoveryCodesExhausted, { tokens: r }) : r.remaining_recovery_codes <= 2 && this.subscribeStore.notify(a.TwoFactorRecoveryCodesLow, {
+      return this.clearPartialAuthState(), r.remaining_recovery_codes === 0 ? this.subscribeStore.notify(n.TwoFactorRecoveryCodesExhausted, { tokens: r }) : r.remaining_recovery_codes <= 2 && this.subscribeStore.notify(n.TwoFactorRecoveryCodesLow, {
         tokens: r,
         remainingCodes: r.remaining_recovery_codes
-      }), this.subscribeStore.notify(a.TwoFactorRecoveryUsed, {
+      }), this.subscribeStore.notify(n.TwoFactorRecoveryUsed, {
         tokens: r,
         remainingCodes: r.remaining_recovery_codes
-      }), this.subscribeStore.notify(a.TwoFactorVerified, { tokens: r }), r;
+      }), this.subscribeStore.notify(n.TwoFactorVerified, { tokens: r }), r;
     } catch (t) {
       this.emitErrorAndThrow(t, "Use recovery code");
     }
@@ -2715,7 +2732,7 @@ class De {
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
       const t = await this.twoFactorApi.disable({ code: e });
-      return this.subscribeStore.notify(a.TwoFactorDisabled, {}), t;
+      return this.subscribeStore.notify(n.TwoFactorDisabled, {}), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Disable 2FA");
     }
@@ -2815,12 +2832,12 @@ class De {
       scope: "2fa_setup",
       timestamp: Date.now(),
       expiresAt: Date.now() + (t.expiresIn || 3600) * 1e3
-    }, this.subscribeStore.notify(a.TwoFactorSetupMagicLinkValidated, {
+    }, this.subscribeStore.notify(n.TwoFactorSetupMagicLinkValidated, {
       userId: t.userId,
       appId: t.appId,
       expiresIn: t.expiresIn || 3600,
       sessionToken: t.sessionToken
-    })) : t.error && this.subscribeStore.notify(a.TwoFactorSetupMagicLinkFailed, {
+    })) : t.error && this.subscribeStore.notify(n.TwoFactorSetupMagicLinkFailed, {
       error: t.error
     }), t;
   }
@@ -2891,7 +2908,7 @@ class De {
   async beginMethodSetup(e) {
     try {
       const t = await this.twoFactorApi.beginMethodSetup(e);
-      return this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: "", method: e }), t;
+      return this.subscribeStore.notify(n.TwoFactorSetupStarted, { secret: "", method: e }), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Begin 2FA method setup");
     }
@@ -2902,7 +2919,7 @@ class De {
   async confirmMethodSetup(e, t) {
     try {
       const r = await this.twoFactorApi.confirmMethodSetup(e, t);
-      return this.subscribeStore.notify(a.TwoFactorEnabled, {
+      return this.subscribeStore.notify(n.TwoFactorEnabled, {
         recoveryCodes: [],
         clearRecoveryCodes: () => {
         }
@@ -2927,7 +2944,7 @@ class De {
   async requestChallenge(e) {
     try {
       const t = await this.twoFactorApi.requestChallenge(e);
-      return this.subscribeStore.notify(a.TwoFactorChallengeReceived, {
+      return this.subscribeStore.notify(n.TwoFactorChallengeReceived, {
         challengeId: t.challenge_id,
         method: t.method,
         alternativeMethods: t.alternative_methods
@@ -2942,12 +2959,12 @@ class De {
   async verifyV2(e) {
     try {
       const t = await this.twoFactorApi.verifyV2(e);
-      return t.success && (this.subscribeStore.notify(a.TwoFactorVerified, {
+      return t.success && (this.subscribeStore.notify(n.TwoFactorVerified, {
         tokens: {
           access_token: t.access_token,
           refresh_token: t.refresh_token
         }
-      }), t.device_trusted && this.subscribeStore.notify(a.TwoFactorDeviceTrusted, {})), t;
+      }), t.device_trusted && this.subscribeStore.notify(n.TwoFactorDeviceTrusted, {})), t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Verify 2FA challenge");
     }
@@ -2958,7 +2975,7 @@ class De {
   async switchToAlternative(e) {
     try {
       const t = await this.twoFactorApi.switchToAlternative(e);
-      return this.subscribeStore.notify(a.TwoFactorMethodSwitched, {
+      return this.subscribeStore.notify(n.TwoFactorMethodSwitched, {
         challengeId: t.challenge_id,
         method: t.method,
         alternativeMethods: t.alternative_methods
@@ -3026,7 +3043,7 @@ class Pe {
     passkeyUsername: t,
     passkeyDisplayName: r
   } = {}) {
-    const s = this.deviceService.getDeviceId(), o = b.web, { challenge_id: n, publicKey: d } = await this.userAPI.addUserPasskeyStart({
+    const s = this.deviceService.getDeviceId(), o = b.web, { challenge_id: a, publicKey: d } = await this.userAPI.addUserPasskeyStart({
       relyingPartyId: e || window?.location?.hostname,
       deviceId: s,
       os: o,
@@ -3035,17 +3052,17 @@ class Pe {
     });
     d.user.id = btoa(d.user.id);
     const h = await K({ optionsJSON: d });
-    return await this.userAPI.addUserPasskeyComplete(h, s, n);
+    return await this.userAPI.addUserPasskeyComplete(h, s, a);
   }
 }
 const O = class O {
   constructor(e) {
     this.doRefreshTokens = !1, this.origin = window.location.origin, this.session = async ({
       createSession: o,
-      expiredSession: n,
+      expiredSession: a,
       doRefresh: d = !1
     }) => {
-      this.createSessionCallback = o, this.expiredSessionCallback = n, this.doRefreshTokens = d, await this.submitSessionCheck();
+      this.createSessionCallback = o, this.expiredSessionCallback = a, this.doRefreshTokens = d, await this.submitSessionCheck();
     };
     const { url: t, appId: r, scopes: s } = e;
     this.url = t || V, this.appId = r, this.storageManager = new $({
@@ -3092,7 +3109,7 @@ const O = class O {
         message: r instanceof Error || r instanceof u ? r.message : "Session check failed",
         originalError: r
       };
-      this.subscribeStore.notify(a.Error, s), e = void 0;
+      this.subscribeStore.notify(n.Error, s), e = void 0;
     }
     e && this.createSessionCallback && await this.createSessionCallback({ tokens: e, parsedTokens: t }), !e && this.expiredSessionCallback && await this.expiredSessionCallback();
   }
@@ -3170,7 +3187,7 @@ const O = class O {
       const h = new URLSearchParams(window.location.hash.substring(1));
       h.get("access_token") && (e = h, t = !0);
     }
-    const r = e.get("access_token"), s = e.get("refresh_token"), o = e.get("id_token"), n = e.get("scopes")?.split(",") ?? this.scopes;
+    const r = e.get("access_token"), s = e.get("refresh_token"), o = e.get("id_token"), a = e.get("scopes")?.split(",") ?? this.scopes;
     let d;
     if (r) {
       if (!D(r)) {
@@ -3178,7 +3195,7 @@ const O = class O {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
         return;
       }
       if (s && !D(s)) {
@@ -3186,7 +3203,7 @@ const O = class O {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
         return;
       }
       if (o && !D(o)) {
@@ -3194,15 +3211,15 @@ const O = class O {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(n.Error, h), this.cleanupUrlParams(t);
         return;
       }
       return d = {
         access_token: r,
         refresh_token: s ?? void 0,
         id_token: o ?? void 0,
-        scopes: n
-      }, this.storageManager.clearDeliveryMode(), this.storageManager.saveTokens(d), this.tokenCacheService.setTokensCache(d), this.subscribeStore.notify(a.SignIn, { tokens: d, parsedTokens: this.getParsedTokens() }), this.submitSessionCheck(), this.cleanupUrlParams(t), this.error = void 0, d;
+        scopes: a
+      }, this.storageManager.clearDeliveryMode(), this.storageManager.saveTokens(d), this.tokenCacheService.setTokensCache(d), this.subscribeStore.notify(n.SignIn, { tokens: d, parsedTokens: this.getParsedTokens() }), this.submitSessionCheck(), this.cleanupUrlParams(t), this.error = void 0, d;
     } else
       this.error = this.checkErrorsFromURL();
   }
@@ -3437,7 +3454,7 @@ const O = class O {
       originalError: e,
       code: e instanceof u ? e.id : void 0
     };
-    throw this.subscribeStore.notify(a.Error, r), e;
+    throw this.subscribeStore.notify(n.Error, r), e;
   }
   /**
    * Sign out the current user and clear all tokens.
@@ -3458,7 +3475,7 @@ const O = class O {
    */
   async logOut() {
     try {
-      await this.authService.logOut(), this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.twoFactorService.clearPartialAuthState(), await this.submitSessionCheck(), this.subscribeStore.notify(a.SignOut, {});
+      await this.authService.logOut(), this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.twoFactorService.clearPartialAuthState(), await this.submitSessionCheck(), this.subscribeStore.notify(n.SignOut, {});
     } catch (e) {
       this.handleError(e, "Log out");
     }
@@ -3528,13 +3545,13 @@ const O = class O {
    * ```
    */
   reset(e) {
-    if (this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.subscribeStore.notify(a.SignOut, {}), e) {
+    if (this.storageManager.deleteTokens(), this.tokenCacheService.setTokensCache(void 0), this.subscribeStore.notify(n.SignOut, {}), e) {
       this.error = new Error(e);
       const t = {
         message: e,
         code: "RESET_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, t), this.error;
+      throw this.subscribeStore.notify(n.Error, t), this.error;
     }
   }
   /**
@@ -3561,7 +3578,7 @@ const O = class O {
     try {
       return await this.authService.refreshToken();
     } catch (e) {
-      throw e instanceof u || this.subscribeStore.notify(a.Error, {
+      throw e instanceof u || this.subscribeStore.notify(n.Error, {
         message: "Failed to refresh token",
         originalError: e
       }), e;
@@ -3766,7 +3783,7 @@ const O = class O {
    * ```
    */
   setTokens(e) {
-    this.storageManager.saveTokens(e), this.tokenCacheService.setTokensCache(e), this.subscribeStore.notify(a.SignIn, {
+    this.storageManager.saveTokens(e), this.tokenCacheService.setTokensCache(e), this.subscribeStore.notify(n.SignIn, {
       tokens: e,
       parsedTokens: this.tokenCacheService.getParsedTokens()
     });
@@ -4202,7 +4219,7 @@ const O = class O {
   async verifyTwoFactor(e) {
     try {
       const t = await this.twoFactorService.verify(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(a.SignIn, {
+      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(n.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -4229,7 +4246,7 @@ const O = class O {
   async useTwoFactorRecoveryCode(e) {
     try {
       const t = await this.twoFactorService.useRecoveryCode(e);
-      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(a.SignIn, {
+      return this.storageManager.saveTokens(t), this.tokenCacheService.setTokensCache(t), this.subscribeStore.notify(n.SignIn, {
         tokens: t,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
@@ -4517,7 +4534,7 @@ class U extends l {
     }), this.name = "M2MConfigError";
   }
 }
-const Ve = {
+const Ge = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -4527,7 +4544,7 @@ const Ve = {
   RateLimitExceeded: "rate_limit_exceeded",
   ServerError: "server_error",
   TemporarilyUnavailable: "temporarily_unavailable"
-}, w = {
+}, T = {
   /** Default token endpoint path */
   TOKEN_ENDPOINT: "/oauth2/token",
   /** Default request timeout in milliseconds */
@@ -4567,7 +4584,7 @@ const Ue = {
     return Math.pow(2, i - 1) * 1e3;
   }
 };
-class Ge {
+class qe {
   /**
    * Create a new M2M client
    *
@@ -4598,16 +4615,16 @@ class Ge {
       scopes: e.scopes,
       audience: e.audience,
       autoRefresh: e.autoRefresh ?? !1,
-      refreshThreshold: e.refreshThreshold ?? w.REFRESH_THRESHOLD,
-      timeout: e.timeout ?? w.TIMEOUT,
-      retries: e.retries ?? w.RETRIES,
-      retryDelay: e.retryDelay ?? w.RETRY_DELAY,
+      refreshThreshold: e.refreshThreshold ?? T.REFRESH_THRESHOLD,
+      timeout: e.timeout ?? T.TIMEOUT,
+      retries: e.retries ?? T.RETRIES,
+      retryDelay: e.retryDelay ?? T.RETRY_DELAY,
       retryStrategy: e.retryStrategy,
       cache: e.cache,
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new xe(), this.retryStrategy = e.retryStrategy ?? Ue, this.tokenEndpoint = `${t}${w.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new xe(), this.retryStrategy = e.retryStrategy ?? Ue, this.tokenEndpoint = `${t}${T.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
@@ -4698,16 +4715,16 @@ class Ge {
       const o = await fetch(this.tokenEndpoint, {
         method: "POST",
         headers: {
-          "Content-Type": w.CONTENT_TYPE,
+          "Content-Type": T.CONTENT_TYPE,
           Accept: "application/json"
         },
         body: t.toString(),
         signal: r.signal
       });
       clearTimeout(s);
-      const n = {};
+      const a = {};
       o.headers.forEach((h, g) => {
-        n[g.toLowerCase()] = h;
+        a[g.toLowerCase()] = h;
       });
       const d = await o.json();
       if (!o.ok) {
@@ -4718,7 +4735,7 @@ class Ge {
             error_uri: d.error_uri
           },
           o.status,
-          n
+          a
         );
         throw this.config.onError && this.config.onError({
           error: h.code,
@@ -4870,7 +4887,7 @@ class Ge {
       const s = await fetch(t, {
         method: "POST",
         headers: {
-          "Content-Type": w.CONTENT_TYPE
+          "Content-Type": T.CONTENT_TYPE
         },
         body: r.toString()
       });
@@ -4920,6 +4937,7 @@ export {
   pe as AppAPI,
   fe as AuthAPI,
   Ie as AuthService,
+  Ve as CLIAuthAPI,
   Ke as DEFAULT_GROUP_NAME,
   Q as DEFAULT_SCOPES,
   W as DEVICE_ID_HEADER_KEY,
@@ -4927,13 +4945,13 @@ export {
   ne as ERROR_MESSAGE_MAX_LENGTH,
   ke as InvitationAPI,
   be as InvitationService,
-  Ge as M2MClient,
+  qe as M2MClient,
   U as M2MConfigError,
   l as M2MError,
-  Ve as M2MErrorCodes,
+  Ge as M2MErrorCodes,
   N as M2MNetworkError,
   M as M2MTokenParseError,
-  w as M2M_DEFAULTS,
+  T as M2M_DEFAULTS,
   Ne as MINIMAL_DEFAULT_SCOPES,
   b as OS,
   V as PASSFLOW_CLOUD_URL,
@@ -4942,10 +4960,10 @@ export {
   se as POPUP_TIMEOUT_MS,
   ee as POPUP_WIDTH,
   L as Passflow,
-  T as PassflowAdminEndpointPaths,
+  _ as PassflowAdminEndpointPaths,
   c as PassflowEndpointPaths,
   u as PassflowError,
-  a as PassflowEvent,
+  n as PassflowEvent,
   de as Providers,
   E as RequestMethod,
   Z as SDK_VERSION,
@@ -4956,7 +4974,7 @@ export {
   Me as TenantService,
   Re as TenantUserMembership,
   Fe as TokenCacheService,
-  y as TokenDeliveryMode,
+  m as TokenDeliveryMode,
   p as TokenType,
   me as TwoFactorApiClient,
   ue as TwoFactorPolicy,
@@ -4971,7 +4989,7 @@ export {
   x as isValidPhoneNumber,
   _e as isValidUsername,
   v as parseToken,
-  m as pathWithParams,
+  y as pathWithParams,
   Te as sanitizeErrorMessage
 };
 //# sourceMappingURL=index.mjs.map