@passflow/core 0.2.8 → 0.2.10

package/dist/index.mjs

@@ -1,20 +1,20 @@
-import D from "axios";
+import F from "axios";
 import { v4 as H } from "uuid";
 import { startRegistration as K, startAuthentication as j } from "@simplewebauthn/browser";
-const z = "0.2.8", X = {
+const z = "0.2.10", X = {
   version: z
-}, C = "X-Passflow-Clientid", _ = "Authorization", W = "X-Passflow-DeviceId", J = "X-Passflow-DeviceType", Z = X.version, Ne = ["id", "offline", "openid"], Q = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], G = "https://auth.passflow.cloud", Ke = "default", ee = 500, te = 600, se = 100, re = 6e4, V = 30, ie = 3, ne = 30, oe = 200, ae = (i) => {
+}, C = "X-Passflow-Clientid", I = "Authorization", W = "X-Passflow-DeviceId", J = "X-Passflow-DeviceType", Z = X.version, Ne = ["id", "offline", "openid"], Q = ["id", "offline", "tenant", "email", "oidc", "openid", "access:tenant:all"], V = "https://auth.passflow.cloud", Ke = "default", ee = 500, te = 600, re = 100, se = 6e4, G = 30, ie = 3, oe = 30, ne = 200, ae = (i) => {
   const e = [];
   let t;
   for (t in i) {
-    const s = i[t];
-    if (s === void 0)
+    const r = i[t];
+    if (r === void 0)
       continue;
-    const r = { tenant: { id: s.tenant_id, name: s.tenant_name } };
-    r.groups = s.groups ? Object.keys(s.groups).map((n) => {
-      const o = s.groups[n] || [];
-      return { group: { id: n, name: s.group_names?.[n] ?? "unknown" }, roles: o };
-    }) : [], r.tenantRoles = r.groups?.find((n) => n.group.id === s.root_group_id), e.push(r);
+    const s = { tenant: { id: r.tenant_id, name: r.tenant_name } };
+    s.groups = r.groups ? Object.keys(r.groups).map((o) => {
+      const n = r.groups[o] || [];
+      return { group: { id: o, name: r.group_names?.[o] ?? "unknown" }, roles: n };
+    }) : [], s.tenantRoles = s.groups?.find((o) => o.group.id === r.root_group_id), e.push(s);
   }
   return { raw: i, tenants: e };
 };
@@ -38,8 +38,8 @@ class he {
   isTokenTypeExpired(e) {
     const t = this.storageManager.getToken(e);
     if (!t) return !0;
-    const s = y(t);
-    return s ? m(s) : !0;
+    const r = v(t);
+    return r ? S(r) : !0;
   }
   /**
    * Parse token from storage by type.
@@ -51,21 +51,21 @@ class he {
   parseTokenType(e) {
     const t = this.storageManager.getToken(e);
     if (t)
-      return y(t);
+      return v(t);
   }
 }
-function m(i, e = V) {
+function S(i, e = G) {
   return Math.floor(Date.now() / 1e3) + e > i.exp;
 }
-function y(i) {
+function v(i) {
   const e = i.split(".")[1];
   if (!e) throw new Error("Invalid token string");
-  const t = e.replace(/-/g, "+").replace(/_/g, "/"), s = t + "=".repeat((4 - t.length % 4) % 4), r = ce(s), n = decodeURIComponent(
-    r.split("").map((d) => "%" + ("00" + d.charCodeAt(0).toString(16)).slice(-2)).join("")
-  ), o = JSON.parse(n);
-  return o.membership = o.passflow_tm && o.type !== "invite" ? ae(o.passflow_tm) : void 0, o;
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), r = t + "=".repeat((4 - t.length % 4) % 4), s = ce(r), o = decodeURIComponent(
+    s.split("").map((d) => "%" + ("00" + d.charCodeAt(0).toString(16)).slice(-2)).join("")
+  ), n = JSON.parse(o);
+  return n.membership = n.passflow_tm && n.type !== "invite" ? ae(n.passflow_tm) : void 0, n;
 }
-var k = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(k || {}), v = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(v || {}), q = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(q || {});
+var p = /* @__PURE__ */ ((i) => (i.id_token = "id_token", i.access_token = "access", i.refresh_token = "refresh", i.invite_token = "invite", i.reset_token = "reset", i.web_cookie = "web-cookie", i.management = "management", i.signin = "signin", i.actor = "actor", i.two_factor = "2fa", i))(p || {}), y = /* @__PURE__ */ ((i) => (i.JsonBody = "json_body", i.Cookie = "cookie", i.Mobile = "mobile", i.BFF = "bff", i))(y || {}), q = /* @__PURE__ */ ((i) => (i.Unknown = "unknown", i.Valid = "valid", i.Invalid = "invalid", i))(q || {});
 class Y {
   constructor(e) {
     this.storageManager = e, this.mode = "json_body", this.sessionState = "unknown", this.isInitializedFlag = !1, this.STORAGE_PREFIX = "passflow_", this.DELIVERY_MODE_KEY = `${this.STORAGE_PREFIX}delivery_mode`, this.SESSION_STATE_KEY = `${this.STORAGE_PREFIX}session_state`, this.loadPersistedMode(), this.loadPersistedSessionState();
@@ -166,7 +166,7 @@ class Y {
   loadPersistedMode() {
     try {
       const e = this.storageManager.storage.getItem(this.DELIVERY_MODE_KEY);
-      e && Object.values(v).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
+      e && Object.values(y).includes(e) && (this.mode = e, this.isInitializedFlag = !0);
     } catch {
     }
   }
@@ -227,8 +227,8 @@ class $ {
    * In JSON mode: save all tokens (existing behavior)
    */
   saveTokens(e, t) {
-    const { id_token: s, access_token: r, refresh_token: n, scopes: o } = e;
-    t === v.Cookie || t === v.BFF ? s && this.storage.setItem(this.ID_TOKEN_KEY, s) : (s && this.storage.setItem(this.getKeyForTokenType(k.id_token), s), r && this.storage.setItem(this.getKeyForTokenType(k.access_token), r), n && this.storage.setItem(this.getKeyForTokenType(k.refresh_token), n), o && this.storage.setItem(this.scopes, o.join(",")));
+    const { id_token: r, access_token: s, refresh_token: o, scopes: n } = e;
+    t === y.Cookie || t === y.BFF ? r && this.storage.setItem(this.ID_TOKEN_KEY, r) : (r && this.storage.setItem(this.getKeyForTokenType(p.id_token), r), s && this.storage.setItem(this.getKeyForTokenType(p.access_token), s), o && this.storage.setItem(this.getKeyForTokenType(p.refresh_token), o), n && this.storage.setItem(this.scopes, n.join(",")));
   }
   getToken(e) {
     const t = this.getKeyForTokenType(e);
@@ -241,31 +241,45 @@ class $ {
    */
   getTokens() {
     const e = this.getDeliveryMode();
-    if (e === v.Cookie || e === v.BFF) {
-      const s = this.storage.getItem(this.ID_TOKEN_KEY);
-      return s ? {
-        id_token: s
+    if (e === y.Cookie || e === y.BFF) {
+      const r = this.storage.getItem(this.ID_TOKEN_KEY);
+      return r ? {
+        id_token: r
         // access_token and refresh_token are in HttpOnly cookies, not localStorage
       } : void 0;
     }
-    const t = this.storage.getItem(this.getKeyForTokenType(k.access_token));
+    const t = this.storage.getItem(this.getKeyForTokenType(p.access_token));
     if (t)
       return {
         access_token: t,
-        id_token: this.storage.getItem(this.getKeyForTokenType(k.id_token)) ?? void 0,
-        refresh_token: this.storage.getItem(this.getKeyForTokenType(k.refresh_token)) ?? void 0,
+        id_token: this.storage.getItem(this.getKeyForTokenType(p.id_token)) ?? void 0,
+        refresh_token: this.storage.getItem(this.getKeyForTokenType(p.refresh_token)) ?? void 0,
         scopes: this.storage.getItem(this.scopes)?.split(",") ?? void 0
       };
   }
   getScopes() {
     return this.storage.getItem(this.scopes)?.split(",") ?? void 0;
   }
+  /**
+   * Check if JSON mode tokens exist in storage (ignores delivery mode)
+   * Used to detect stale state where delivery_mode is set but JSON tokens exist
+   */
+  hasJsonModeTokens() {
+    return !!this.storage.getItem(this.getKeyForTokenType(p.access_token));
+  }
+  /**
+   * Check if cookie mode ID token exists in storage
+   * Used to detect legitimate cookie/BFF mode sessions
+   */
+  hasCookieModeIdToken() {
+    return !!this.storage.getItem(this.ID_TOKEN_KEY);
+  }
   deleteToken(e) {
     const t = this.getKeyForTokenType(e);
     this.storage.removeItem(t);
   }
   deleteTokens() {
-    this.storage.removeItem(this.getKeyForTokenType(k.id_token)), this.storage.removeItem(this.getKeyForTokenType(k.access_token)), this.storage.removeItem(this.getKeyForTokenType(k.refresh_token)), this.storage.removeItem(this.scopes), this.clearIdToken();
+    this.storage.removeItem(this.getKeyForTokenType(p.id_token)), this.storage.removeItem(this.getKeyForTokenType(p.access_token)), this.storage.removeItem(this.getKeyForTokenType(p.refresh_token)), this.storage.removeItem(this.scopes), this.clearIdToken(), this.clearDeliveryMode(), this.clearCsrfToken();
   }
   getDeviceId() {
     return this.storage.getItem(this.deviceId) ?? void 0;
@@ -310,7 +324,7 @@ class $ {
   getDeliveryMode() {
     try {
       const e = this.storage.getItem(this.DELIVERY_MODE_KEY);
-      if (e && Object.values(v).includes(e))
+      if (e && Object.values(y).includes(e))
         return e;
     } catch {
     }
@@ -402,82 +416,82 @@ class B {
     return H();
   }
 }
-var E = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(E || {}), h = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i))(h || {}), w = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(w || {});
+var E = /* @__PURE__ */ ((i) => (i.GET = "get", i.POST = "post", i.PUT = "put", i.PATCH = "patch", i.DELETE = "delete", i))(E || {}), c = /* @__PURE__ */ ((i) => (i.signin = "/auth/login", i.signup = "/auth/register", i.signInWithProvider = "/auth/federated/start/", i.passwordless = "/auth/passwordless/start", i.passwordlessComplete = "/auth/passwordless/complete", i.logout = "/user/logout", i.refresh = "/auth/refresh", i.validateSession = "/user/me", i.sendPasswordResetEmail = "/auth/password/reset", i.resetPassword = "/auth/password/change", i.appSettings = "/app/settings", i.passkeyRegisterStart = "/auth/passkey/register/start", i.passkeyRegisterComplete = "/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/auth/passkey/authenticate/complete", i.passkeyValidate = "/auth/validate", i.settingsAll = "/settings", i.settingsPasswordPolicy = "/settings/password", i.settingsPasskey = "/settings/passkey", i.userPasskey = "/user/passkey", i.addUserPasskey = "/user/passkey/add/start", i.completeAddUserPasskey = "/user/passkey/add/complete", i.joinInvitation = "/user/tenant/join", i.tenantPath = "/user/tenant", i.invitationsPath = "/user/tenant/:tenantID/invitations", i.requestInvitation = "/user/invite", i.invitationDelete = "/user/invite/:invitationID", i.invitationResend = "/user/invite/:invitationID/resend", i.invitationGetLink = "/user/invite/:invitationID/link", i.twoFactor = "/user/2fa", i.twoFactorStatus = "/user/2fa/status", i.twoFactorSetupBegin = "/user/2fa/setup/begin", i.twoFactorSetupConfirm = "/user/2fa/setup/confirm", i.twoFactorVerify = "/auth/2fa/verify", i.twoFactorRecovery = "/auth/2fa/recovery", i.twoFactorRegenerateCodes = "/user/2fa/recovery-codes/regenerate", i.twoFactorSetupMagicLink = "/auth/2fa-setup", i.TwoFactorMethodsAvailable = "/v2/user/2fa/methods/available", i.TwoFactorMethodsRegistered = "/v2/user/2fa/methods", i.TwoFactorMethodSetupBegin = "/v2/user/2fa/methods/:method/setup/begin", i.TwoFactorMethodSetupConfirm = "/v2/user/2fa/methods/:method/setup/confirm", i.TwoFactorMethodRemove = "/v2/user/2fa/methods/:id", i.TwoFactorChallenge = "/v2/auth/2fa/challenge", i.TwoFactorVerifyV2 = "/v2/auth/2fa/verify", i.TwoFactorAlternative = "/v2/auth/2fa/alternative", i.TwoFactorTrustedDevices = "/v2/user/2fa/trusted-devices", i.TwoFactorTrustedDeviceRevoke = "/v2/user/2fa/trusted-devices/:id", i))(c || {}), T = /* @__PURE__ */ ((i) => (i.passkeyRegisterStart = "/admin/auth/passkey/register/start", i.passkeyRegisterComplete = "/admin/auth/passkey/register/complete", i.passkeyAuthenticateStart = "/admin/auth/passkey/authenticate/start", i.passkeyAuthenticateComplete = "/admin/auth/passkey/authenticate/complete", i.passkeyValidate = "/admin/auth/validate", i.logout = "/admin/auth/logout", i))(T || {});
 class u extends Error {
   constructor(e) {
     super(), this.id = e?.id ?? "unknown", this.message = e?.message ?? e ?? "Something went wrong", this.status = e?.status ?? 500, this.location = e?.location ?? "unknown", this.time = e?.time ?? (/* @__PURE__ */ new Date()).toISOString();
   }
 }
-var de = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(de || {}), I = /* @__PURE__ */ ((i) => (i.web = "web", i))(I || {});
-function A(i, e) {
+var de = /* @__PURE__ */ ((i) => (i.google = "google", i.facebook = "facebook", i))(de || {}), b = /* @__PURE__ */ ((i) => (i.web = "web", i))(b || {});
+function m(i, e) {
   let t = i;
-  return Object.entries(e).forEach(([s, r]) => {
-    t = t.replace(`:${s}`, r);
+  return Object.entries(e).forEach(([r, s]) => {
+    t = t.replace(`:${r}`, s);
   }), t;
 }
 var ue = /* @__PURE__ */ ((i) => (i.Disabled = "disabled", i.Optional = "optional", i.Required = "required", i))(ue || {});
 const le = 3, ge = 1e3;
-class T {
-  constructor(e, t, s) {
+class _ {
+  constructor(e, t, r) {
     this.refreshPromise = null, this.isRefreshing = !1, this.origin = typeof window < "u" ? window.location.origin : "", this.defaultHeaders = {
       Accept: "application/json",
       "Content-Type": "application/json"
     }, this.nonAccessTokenEndpoints = ["/auth/", "/settings", "/settings/"], this.protectedEndpoints = ["logout", "refresh"];
-    const { url: r, appId: n, keyStoragePrefix: o } = e;
-    this.url = r || G, this.storageManager = t ?? new $({
-      prefix: o ?? ""
-    }), this.deviceService = s ?? new B(this.storageManager), this.tokenService = new he(this.storageManager), this.tokenDeliveryManager = new Y(this.storageManager), n && (this.appId = n, this.defaultHeaders = {
+    const { url: s, appId: o, keyStoragePrefix: n } = e;
+    this.url = s || V, this.storageManager = t ?? new $({
+      prefix: n ?? ""
+    }), this.deviceService = r ?? new B(this.storageManager), this.tokenService = new he(this.storageManager), this.tokenDeliveryManager = new Y(this.storageManager), o && (this.appId = o, this.defaultHeaders = {
       ...this.defaultHeaders,
-      [C]: n
+      [C]: o
     });
     const d = this.deviceService.getDeviceId();
     this.defaultHeaders = {
       ...this.defaultHeaders,
       [W]: d,
       [J]: "web"
-    }, this.detectCookieSupport(), this.instance = D.create({
+    }, this.detectCookieSupport(), this.instance = F.create({
       baseURL: this.url,
       headers: { ...this.defaultHeaders }
-    }), this.instance.interceptors.request.use(async (c) => {
-      if (this.isNonAuthEndpoint(c.url))
-        return c;
+    }), this.instance.interceptors.request.use(async (h) => {
+      if (this.isNonAuthEndpoint(h.url))
+        return h;
       if (this.tokenDeliveryManager.isCookieMode()) {
-        c.withCredentials = !0;
-        const p = this.storageManager.getCsrfToken();
-        return p && (c.headers["X-CSRF-Token"] = p), c;
+        h.withCredentials = !0;
+        const f = this.storageManager.getCsrfToken();
+        return f && (h.headers["X-CSRF-Token"] = f), h;
       }
-      if (c.url?.includes("refresh")) {
+      if (h.url?.includes("refresh")) {
         if (this.isRefreshing) {
-          const p = new AbortController();
-          return p.abort(), c.signal = p.signal, c;
+          const f = new AbortController();
+          return f.abort(), h.signal = f.signal, h;
         }
-        return c;
+        return h;
       }
       const g = this.storageManager.getTokens();
       if (g?.access_token) {
-        const p = y(g.access_token);
-        if (m(p, V) && g.refresh_token)
+        const f = v(g.access_token);
+        if (S(f, G) && g.refresh_token)
           try {
             if (this.refreshPromise) {
-              const f = await this.refreshPromise;
-              return f?.data?.access_token && (c.headers[_] = `Bearer ${f.data.access_token}`), c;
+              const k = await this.refreshPromise;
+              return k?.data?.access_token && (h.headers[I] = `Bearer ${k.data.access_token}`), h;
             }
             this.refreshPromise = this.refreshTokens();
             try {
-              const f = await this.refreshPromise;
-              return f?.data?.access_token && (c.headers[_] = `Bearer ${f.data.access_token}`), c;
+              const k = await this.refreshPromise;
+              return k?.data?.access_token && (h.headers[I] = `Bearer ${k.data.access_token}`), h;
             } finally {
               this.refreshPromise = null;
             }
-          } catch (f) {
-            return this.refreshPromise = null, this.isRefreshing = !1, this.storageManager.deleteTokens(), Promise.reject(f);
+          } catch (k) {
+            return this.refreshPromise = null, this.isRefreshing = !1, this.storageManager.deleteTokens(), Promise.reject(k);
           }
-        return c.headers[_] = `Bearer ${g.access_token}`, c;
+        return h.headers[I] = `Bearer ${g.access_token}`, h;
       }
-      return c;
+      return h;
     }), this.instance.interceptors.response.use(
-      (c) => c,
-      async (c) => (c.response?.status === 401 && this.tokenDeliveryManager.setSessionInvalid(), c.response?.status === 429 ? await this.handleRateLimitError(c) : this.handleAxiosError(c))
+      (h) => h,
+      async (h) => (h.response?.status === 401 && this.tokenDeliveryManager.setSessionInvalid(), h.response?.status === 429 ? await this.handleRateLimitError(h) : this.handleAxiosError(h))
     );
   }
   isProtectedEndpoint(e) {
@@ -506,7 +520,7 @@ class T {
   async refreshTokens() {
     if (this.tokenDeliveryManager.isCookieMode()) {
       const e = await this.instance.post(
-        h.refresh,
+        c.refresh,
         {},
         // Empty body
         { withCredentials: !0 }
@@ -517,49 +531,49 @@ class T {
       if (!e?.refresh_token)
         throw new Error("No refresh token available");
       this.isRefreshing = !0;
-      const s = {
+      const r = {
         refresh_token: e.refresh_token,
         scopes: t
-      }, r = await this.instance.post(h.refresh, s, {
+      }, s = await this.instance.post(c.refresh, r, {
         headers: {
-          [_]: `Bearer ${e.refresh_token}`
+          [I]: `Bearer ${e.refresh_token}`
         }
       });
-      return r.data && this.storageManager.saveTokens(r.data), this.isRefreshing = !1, r;
+      return s.data && this.storageManager.saveTokens(s.data), this.isRefreshing = !1, s;
     }
   }
   async handleRateLimitError(e) {
     const t = e.config;
     if (!t)
       return Promise.reject(e);
-    const s = t.method?.toUpperCase();
-    if (!["GET", "HEAD", "OPTIONS"].includes(s || ""))
+    const r = t.method?.toUpperCase();
+    if (!["GET", "HEAD", "OPTIONS"].includes(r || ""))
       return Promise.reject(e);
-    const n = t._retryCount || 0;
-    if (n >= le)
+    const o = t._retryCount || 0;
+    if (o >= le)
       return Promise.reject(e);
-    let o = ge * Math.pow(2, n);
+    let n = ge * Math.pow(2, o);
     const d = e.response?.headers?.["retry-after"];
     if (d) {
-      const c = Number.parseInt(d, 10);
-      if (!Number.isNaN(c))
-        o = c * 1e3;
+      const h = Number.parseInt(d, 10);
+      if (!Number.isNaN(h))
+        n = h * 1e3;
       else {
         const g = new Date(d);
-        Number.isNaN(g.getTime()) || (o = Math.max(0, g.getTime() - Date.now()));
+        Number.isNaN(g.getTime()) || (n = Math.max(0, g.getTime() - Date.now()));
       }
     }
-    return await new Promise((c) => setTimeout(c, o)), t._retryCount = n + 1, this.instance.request(t);
+    return await new Promise((h) => setTimeout(h, n)), t._retryCount = o + 1, this.instance.request(t);
   }
   // eslint-disable-next-line complexity
   // biome-ignore lint/suspicious/useAwait: <explanation>
   async handleAxiosError(e) {
     if (!e.response)
       return Promise.reject(e);
-    const t = e.response.status, s = e.response.data;
-    if ("error" in s && typeof s.error == "object" && s.error !== null) {
-      const { error: r } = s;
-      return Promise.reject(new u(r));
+    const t = e.response.status, r = e.response.data;
+    if ("error" in r && typeof r.error == "object" && r.error !== null) {
+      const { error: s } = r;
+      return Promise.reject(new u(s));
     }
     return Promise.reject(
       new u({
@@ -571,24 +585,24 @@ class T {
       })
     );
   }
-  async send(e, t, s) {
+  async send(e, t, r) {
     return (await this.instance.request({
       method: e,
       url: t,
-      ...s
+      ...r
     })).data;
   }
   get(e, t) {
     return this.send(E.GET, e, t);
   }
-  post(e, t, s) {
-    return this.send(E.POST, e, { data: t, ...s });
+  post(e, t, r) {
+    return this.send(E.POST, e, { data: t, ...r });
   }
-  put(e, t, s) {
-    return this.send(E.PUT, e, { data: t, ...s });
+  put(e, t, r) {
+    return this.send(E.PUT, e, { data: t, ...r });
   }
-  patch(e, t, s) {
-    return this.send(E.PATCH, e, { data: t, ...s });
+  patch(e, t, r) {
+    return this.send(E.PATCH, e, { data: t, ...r });
   }
   delete(e, t) {
     return this.send(E.DELETE, e, t);
@@ -607,151 +621,151 @@ class T {
   }
 }
 class pe {
-  constructor(e, t, s) {
-    this.axiosClient = new T(e, t, s);
+  constructor(e, t, r) {
+    this.axiosClient = new _(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
   }
   getAppSettings() {
-    return this.axiosClient.get(h.appSettings);
+    return this.axiosClient.get(c.appSettings);
   }
 }
 class fe {
-  constructor(e, t, s) {
-    this.axiosClient = new T(e, t, s);
+  constructor(e, t, r) {
+    this.axiosClient = new _(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
   }
-  refreshToken(e, t, s) {
-    const r = {
-      access: s,
+  refreshToken(e, t, r) {
+    const s = {
+      access: r,
       scopes: t
     };
-    return this.axiosClient.post(h.refresh, r, {
+    return this.axiosClient.post(c.refresh, s, {
       headers: {
-        [_]: `Bearer ${e}`
+        [I]: `Bearer ${e}`
       }
     });
   }
-  signIn(e, t, s) {
-    const r = {
+  signIn(e, t, r) {
+    const s = {
       ...e,
       device: t,
-      os: s
+      os: r
     };
     return this.axiosClient.post(
-      h.signin,
-      r
+      c.signin,
+      s
     );
   }
   signUp(e) {
-    const { create_tenant: t, anonymous: s } = e, r = {
+    const { create_tenant: t, anonymous: r } = e, s = {
       ...e,
       create_tenant: t ?? !1,
-      anonymous: s ?? !1
+      anonymous: r ?? !1
     };
     return this.axiosClient.post(
-      h.signup,
-      r
+      c.signup,
+      s
     );
   }
-  passwordlessSignIn(e, t, s) {
-    const { create_tenant: r } = e, n = {
+  passwordlessSignIn(e, t, r) {
+    const { create_tenant: s } = e, o = {
       ...e,
-      create_tenant: r ?? !1,
+      create_tenant: s ?? !1,
       device: t,
-      os: s
+      os: r
     };
     return this.axiosClient.post(
-      h.passwordless,
-      n
+      c.passwordless,
+      o
     );
   }
   passwordlessSignInComplete(e) {
     return this.axiosClient.post(
-      h.passwordlessComplete,
+      c.passwordlessComplete,
       e
     );
   }
-  logOut(e, t, s = !1) {
-    const r = s ? void 0 : { refresh_token: t, device: e }, n = s ? w.logout : h.logout;
-    return this.axiosClient.post(n, r);
+  logOut(e, t, r = !1) {
+    const s = r ? void 0 : { refresh_token: t, device: e }, o = r ? T.logout : c.logout;
+    return this.axiosClient.post(o, s);
   }
   validateSession() {
-    return this.axiosClient.get(h.validateSession);
+    return this.axiosClient.get(c.validateSession);
   }
   sendPasswordResetEmail(e) {
     return this.axiosClient.post(
-      h.sendPasswordResetEmail,
+      c.sendPasswordResetEmail,
       e
     );
   }
-  resetPassword(e, t, s) {
-    const r = {
+  resetPassword(e, t, r) {
+    const s = {
       password: e,
       scopes: t
     };
-    return this.axiosClient.post(h.resetPassword, r, {
+    return this.axiosClient.post(c.resetPassword, s, {
       headers: {
-        [_]: `Bearer ${s}`,
+        [I]: `Bearer ${r}`,
         [C]: void 0
       }
     });
   }
-  passkeyRegisterStart(e, t, s, r = !1) {
-    const { create_tenant: n } = e, o = {
+  passkeyRegisterStart(e, t, r, s = !1) {
+    const { create_tenant: o } = e, n = {
       ...e,
-      create_tenant: n ?? !1,
+      create_tenant: o ?? !1,
       device: t,
-      os: s
-    }, d = r ? w.passkeyRegisterStart : h.passkeyRegisterStart;
-    return this.axiosClient.post(d, o);
+      os: r
+    }, d = s ? T.passkeyRegisterStart : c.passkeyRegisterStart;
+    return this.axiosClient.post(d, n);
   }
-  passkeyRegisterComplete(e, t, s, r = !1) {
-    const n = {
-      challenge_id: s,
+  passkeyRegisterComplete(e, t, r, s = !1) {
+    const o = {
+      challenge_id: r,
       device: t,
       passkey_data: e
-    }, o = r ? w.passkeyRegisterComplete : h.passkeyRegisterComplete;
-    return this.axiosClient.post(o, n);
+    }, n = s ? T.passkeyRegisterComplete : c.passkeyRegisterComplete;
+    return this.axiosClient.post(n, o);
   }
-  passkeyAuthenticateStart(e, t, s, r = !1) {
-    const n = {
+  passkeyAuthenticateStart(e, t, r, s = !1) {
+    const o = {
       ...e,
       user_id: e.user_id ?? "",
       device: t,
-      os: s
-    }, o = r ? w.passkeyAuthenticateStart : h.passkeyAuthenticateStart;
+      os: r
+    }, n = s ? T.passkeyAuthenticateStart : c.passkeyAuthenticateStart;
     return this.axiosClient.post(
-      o,
-      n
+      n,
+      o
     );
   }
-  passkeyAuthenticateComplete(e, t, s, r = !1) {
-    const n = {
-      challenge_id: s,
+  passkeyAuthenticateComplete(e, t, r, s = !1) {
+    const o = {
+      challenge_id: r,
       device: t,
       passkey_data: e
-    }, o = r ? w.passkeyAuthenticateComplete : h.passkeyAuthenticateComplete;
-    return this.axiosClient.post(o, n);
+    }, n = s ? T.passkeyAuthenticateComplete : c.passkeyAuthenticateComplete;
+    return this.axiosClient.post(n, o);
   }
-  passkeyValidate(e, t, s, r = !1, n) {
-    const o = {
+  passkeyValidate(e, t, r, s = !1, o) {
+    const n = {
       otp: e,
       device: t,
-      challenge_id: s
+      challenge_id: r
     };
-    let d = h.passkeyValidate;
-    !n && r && (d = w.passkeyValidate);
-    const c = n ? { [C]: n } : {};
-    return this.axiosClient.post(d, o, { headers: c });
+    let d = c.passkeyValidate;
+    !o && s && (d = T.passkeyValidate);
+    const h = o ? { [C]: o } : {};
+    return this.axiosClient.post(d, n, { headers: h });
   }
 }
 class ke {
-  constructor(e, t, s) {
-    this.axiosClient = new T(e, t, s);
+  constructor(e, t, r) {
+    this.axiosClient = new _(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -763,7 +777,7 @@ class ke {
    */
   requestInviteLink(e) {
     return this.axiosClient.post(
-      h.requestInvitation,
+      c.requestInvitation,
       e
     );
   }
@@ -775,12 +789,12 @@ class ke {
   getInvitations(e) {
     const t = {};
     e.groupID && (t.group_id = e.groupID.toString()), e.skip !== void 0 && (t.skip = e.skip.toString()), e.limit !== void 0 && (t.limit = e.limit.toString());
-    const s = A(h.invitationsPath, {
+    const r = m(c.invitationsPath, {
       tenantID: e.tenantID
     });
-    return this.axiosClient.get(s, { params: t }).then((r) => ({
-      invites: r.invites,
-      nextPageSkip: r.next_page_skip
+    return this.axiosClient.get(r, { params: t }).then((s) => ({
+      invites: s.invites,
+      nextPageSkip: s.next_page_skip
     }));
   }
   /**
@@ -789,7 +803,7 @@ class ke {
    * @returns Promise with success response
    */
   deleteInvitation(e) {
-    const t = A(h.invitationDelete, {
+    const t = m(c.invitationDelete, {
       invitationID: e
     });
     return this.axiosClient.delete(t);
@@ -800,7 +814,7 @@ class ke {
    * @returns Promise with success response
    */
   resendInvitation(e) {
-    const t = A(h.invitationResend, {
+    const t = m(c.invitationResend, {
       invitationID: e
     });
     return this.axiosClient.post(t, {});
@@ -811,44 +825,44 @@ class ke {
    * @returns Promise with the link
    */
   getInvitationLink(e) {
-    const t = A(h.invitationGetLink, {
+    const t = m(c.invitationGetLink, {
       invitationID: e
     });
     return this.axiosClient.get(t);
   }
 }
-class ye {
-  constructor(e, t, s) {
-    this.axiosClient = new T(e, t, s);
+class ve {
+  constructor(e, t, r) {
+    this.axiosClient = new _(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
   }
   getSettingsAll() {
-    return this.axiosClient.get(h.settingsAll);
+    return this.axiosClient.get(c.settingsAll);
   }
   getPasswordPolicySettings() {
-    return this.axiosClient.get(h.settingsPasswordPolicy);
+    return this.axiosClient.get(c.settingsPasswordPolicy);
   }
   getPasskeySettings() {
-    return this.axiosClient.get(h.settingsPasskey);
+    return this.axiosClient.get(c.settingsPasskey);
   }
 }
-class ve {
-  constructor(e, t, s) {
-    this.axiosClient = new T(e, t, s);
+class ye {
+  constructor(e, t, r) {
+    this.axiosClient = new _(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
   }
   joinInvitation(e, t) {
-    const s = {
+    const r = {
       invite_token: e,
       scopes: t
     };
     return this.axiosClient.post(
-      h.joinInvitation,
-      s
+      c.joinInvitation,
+      r
     );
   }
   createTenant(e) {
@@ -856,7 +870,7 @@ class ve {
       name: e
     };
     return this.axiosClient.post(
-      h.tenantPath,
+      c.tenantPath,
       t
     );
   }
@@ -866,7 +880,7 @@ class ve {
    * @param tenantId Tenant ID
    */
   getTenantDetails(e) {
-    const t = `${h.tenantPath}/${e}`;
+    const t = `${c.tenantPath}/${e}`;
     return this.axiosClient.get(t);
   }
   /**
@@ -875,22 +889,22 @@ class ve {
    * @param name New tenant name
    */
   updateTenant(e, t) {
-    const s = `${h.tenantPath}/${e}`, r = { name: t };
-    return this.axiosClient.put(s, r);
+    const r = `${c.tenantPath}/${e}`, s = { name: t };
+    return this.axiosClient.put(r, s);
   }
   /**
    * Delete a tenant
    * @param tenantId Tenant ID
    */
   deleteTenant(e) {
-    const t = `${h.tenantPath}/${e}`;
+    const t = `${c.tenantPath}/${e}`;
     return this.axiosClient.delete(t);
   }
   /**
    * Get user's tenant memberships
    */
   getUserTenantMembership() {
-    return this.axiosClient.get(h.tenantPath);
+    return this.axiosClient.get(c.tenantPath);
   }
   // 2. Group Management
   /**
@@ -899,8 +913,8 @@ class ve {
    * @param name Group name
    */
   createGroup(e, t) {
-    const s = `${h.tenantPath}/${e}/group`, r = { name: t };
-    return this.axiosClient.post(s, r);
+    const r = `${c.tenantPath}/${e}/group`, s = { name: t };
+    return this.axiosClient.post(r, s);
   }
   /**
    * Get group information
@@ -908,8 +922,8 @@ class ve {
    * @param groupId Group ID
    */
   getGroupInfo(e, t) {
-    const s = `${h.tenantPath}/${e}/group/${t}`;
-    return this.axiosClient.get(s);
+    const r = `${c.tenantPath}/${e}/group/${t}`;
+    return this.axiosClient.get(r);
   }
   /**
    * Update a group
@@ -917,9 +931,9 @@ class ve {
    * @param groupId Group ID
    * @param name New group name
    */
-  updateGroup(e, t, s) {
-    const r = `${h.tenantPath}/${e}/group/${t}`, n = { name: s };
-    return this.axiosClient.put(r, n);
+  updateGroup(e, t, r) {
+    const s = `${c.tenantPath}/${e}/group/${t}`, o = { name: r };
+    return this.axiosClient.put(s, o);
   }
   /**
    * Delete a group
@@ -927,8 +941,8 @@ class ve {
    * @param groupId Group ID
    */
   deleteGroup(e, t) {
-    const s = `${h.tenantPath}/${e}/group/${t}`;
-    return this.axiosClient.delete(s);
+    const r = `${c.tenantPath}/${e}/group/${t}`;
+    return this.axiosClient.delete(r);
   }
   /**
    * Add a user to a group
@@ -937,9 +951,9 @@ class ve {
    * @param userId User ID
    * @param role Role to assign
    */
-  addUserToGroup(e, t, s, r) {
-    const n = `${h.tenantPath}/${e}/group/${t}/add`, o = { user_id: s, role: r };
-    return this.axiosClient.post(n, o);
+  addUserToGroup(e, t, r, s) {
+    const o = `${c.tenantPath}/${e}/group/${t}/add`, n = { user_id: r, role: s };
+    return this.axiosClient.post(o, n);
   }
   /**
    * Remove user roles from a group
@@ -948,9 +962,9 @@ class ve {
    * @param userId User ID
    * @param roles Roles to remove
    */
-  removeUserRolesFromGroup(e, t, s, r) {
-    const n = `${h.tenantPath}/${e}/group/${t}/remove_roles`, o = { user_id: s, roles: r };
-    return this.axiosClient.post(n, o);
+  removeUserRolesFromGroup(e, t, r, s) {
+    const o = `${c.tenantPath}/${e}/group/${t}/remove_roles`, n = { user_id: r, roles: s };
+    return this.axiosClient.post(o, n);
   }
   /**
    * Change user roles in a group
@@ -959,9 +973,9 @@ class ve {
    * @param userId User ID
    * @param roles New roles to assign
    */
-  changeUserRoles(e, t, s, r) {
-    const n = `${h.tenantPath}/${e}/group/${t}/change`, o = { user_id: s, roles: r };
-    return this.axiosClient.post(n, o);
+  changeUserRoles(e, t, r, s) {
+    const o = `${c.tenantPath}/${e}/group/${t}/change`, n = { user_id: r, roles: s };
+    return this.axiosClient.post(o, n);
   }
   /**
    * Delete a user from a group
@@ -969,9 +983,9 @@ class ve {
    * @param groupId Group ID
    * @param userId User ID
    */
-  deleteUserFromGroup(e, t, s) {
-    const r = `${h.tenantPath}/${e}/group/${t}/${s}`;
-    return this.axiosClient.delete(r);
+  deleteUserFromGroup(e, t, r) {
+    const s = `${c.tenantPath}/${e}/group/${t}/${r}`;
+    return this.axiosClient.delete(s);
   }
   // 3. Role Management
   /**
@@ -979,7 +993,7 @@ class ve {
    * @param tenantId Tenant ID
    */
   getRolesForTenant(e) {
-    const t = `${h.tenantPath}/${e}/role`;
+    const t = `${c.tenantPath}/${e}/role`;
     return this.axiosClient.get(t);
   }
   /**
@@ -988,8 +1002,8 @@ class ve {
    * @param name Role name
    */
   createRoleForTenant(e, t) {
-    const s = `${h.tenantPath}/${e}/role`, r = { name: t };
-    return this.axiosClient.post(s, r);
+    const r = `${c.tenantPath}/${e}/role`, s = { name: t };
+    return this.axiosClient.post(r, s);
   }
   /**
    * Update a role
@@ -997,9 +1011,9 @@ class ve {
    * @param roleId Role ID
    * @param name New role name
    */
-  updateRole(e, t, s) {
-    const r = `${h.tenantPath}/${e}/role/${t}`, n = { name: s };
-    return this.axiosClient.put(r, n);
+  updateRole(e, t, r) {
+    const s = `${c.tenantPath}/${e}/role/${t}`, o = { name: r };
+    return this.axiosClient.put(s, o);
   }
   /**
    * Delete a role
@@ -1007,8 +1021,8 @@ class ve {
    * @param roleId Role ID
    */
   deleteRole(e, t) {
-    const s = `${h.tenantPath}/${e}/role/${t}`;
-    return this.axiosClient.delete(s);
+    const r = `${c.tenantPath}/${e}/role/${t}`;
+    return this.axiosClient.delete(r);
   }
   // 4. User Management in Tenants
   /**
@@ -1017,8 +1031,8 @@ class ve {
    * @param userId User ID
    */
   deleteUserFromTenant(e, t) {
-    const s = `${h.tenantPath}/${e}/user/${t}`;
-    return this.axiosClient.delete(s);
+    const r = `${c.tenantPath}/${e}/user/${t}`;
+    return this.axiosClient.delete(r);
   }
   // 5. Invitation Management
   /**
@@ -1028,10 +1042,10 @@ class ve {
    * @param limit Maximum number of invitations to return
    * @param skip Number of invitations to skip
    */
-  getGroupInvitations(e, t, s, r) {
-    const n = `${h.tenantPath}/${e}/group/${t}/invitations`;
-    return this.axiosClient.get(n, {
-      params: { limit: s, skip: r }
+  getGroupInvitations(e, t, r, s) {
+    const o = `${c.tenantPath}/${e}/group/${t}/invitations`;
+    return this.axiosClient.get(o, {
+      params: { limit: r, skip: s }
     });
   }
   /**
@@ -1040,10 +1054,10 @@ class ve {
    * @param limit Maximum number of invitations to return
    * @param skip Number of invitations to skip
    */
-  getTenantInvitations(e, t, s) {
-    const r = `${h.tenantPath}/${e}/invitations`;
-    return this.axiosClient.get(r, {
-      params: { limit: t, skip: s }
+  getTenantInvitations(e, t, r) {
+    const s = `${c.tenantPath}/${e}/invitations`;
+    return this.axiosClient.get(s, {
+      params: { limit: t, skip: r }
     });
   }
   /**
@@ -1052,9 +1066,9 @@ class ve {
    * @param groupId Group ID
    * @param inviteId Invitation ID
    */
-  invalidateInviteById(e, t, s) {
-    const r = `${h.tenantPath}/${e}/group/${t}/invite/${s}`;
-    return this.axiosClient.delete(r);
+  invalidateInviteById(e, t, r) {
+    const s = `${c.tenantPath}/${e}/group/${t}/invite/${r}`;
+    return this.axiosClient.delete(s);
   }
   /**
    * Invalidate an invitation by email
@@ -1062,14 +1076,14 @@ class ve {
    * @param groupId Group ID
    * @param email Email address
    */
-  invalidateInviteByEmail(e, t, s) {
-    const r = `${h.tenantPath}/${e}/group/${t}/invite/email/${s}`;
-    return this.axiosClient.delete(r);
+  invalidateInviteByEmail(e, t, r) {
+    const s = `${c.tenantPath}/${e}/group/${t}/invite/email/${r}`;
+    return this.axiosClient.delete(s);
   }
 }
 class me {
-  constructor(e, t, s) {
-    this.axiosClient = new T(e, t, s);
+  constructor(e, t, r) {
+    this.axiosClient = new _(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
@@ -1079,7 +1093,7 @@ class me {
    * GET /user/2fa/status
    */
   getStatus() {
-    return this.axiosClient.get(h.twoFactorStatus);
+    return this.axiosClient.get(c.twoFactorStatus);
   }
   /**
    * Begin 2FA setup process
@@ -1087,7 +1101,7 @@ class me {
    * Returns secret and QR code for authenticator app
    */
   beginSetup() {
-    return this.axiosClient.post(h.twoFactorSetupBegin, {});
+    return this.axiosClient.post(c.twoFactorSetupBegin, {});
   }
   /**
    * Confirm 2FA setup with TOTP code
@@ -1096,7 +1110,7 @@ class me {
    */
   confirmSetup(e) {
     return this.axiosClient.post(
-      h.twoFactorSetupConfirm,
+      c.twoFactorSetupConfirm,
       e
     );
   }
@@ -1106,10 +1120,10 @@ class me {
    * Uses tfa_token as Bearer token for authentication
    */
   verify(e) {
-    const { tfa_token: t, code: s } = e;
+    const { tfa_token: t, code: r } = e;
     return this.axiosClient.post(
-      h.twoFactorVerify,
-      { code: s },
+      c.twoFactorVerify,
+      { code: r },
       {
         headers: {
           Authorization: `Bearer ${t}`
@@ -1123,10 +1137,10 @@ class me {
    * Uses tfa_token as Bearer token for authentication
    */
   useRecoveryCode(e) {
-    const { tfa_token: t, recovery_code: s } = e;
+    const { tfa_token: t, recovery_code: r } = e;
     return this.axiosClient.post(
-      h.twoFactorRecovery,
-      { recovery_code: s },
+      c.twoFactorRecovery,
+      { recovery_code: r },
       {
         headers: {
           Authorization: `Bearer ${t}`
@@ -1139,7 +1153,7 @@ class me {
    * DELETE /user/2fa
    */
   disable(e) {
-    return this.axiosClient.delete(h.twoFactor, { data: e });
+    return this.axiosClient.delete(c.twoFactor, { data: e });
   }
   /**
    * Regenerate recovery codes
@@ -1147,7 +1161,7 @@ class me {
    */
   regenerateRecoveryCodes(e) {
     return this.axiosClient.post(
-      h.twoFactorRegenerateCodes,
+      c.twoFactorRegenerateCodes,
       e
     );
   }
@@ -1166,30 +1180,30 @@ class me {
    * @returns Validation response with scoped session token or error
    */
   validateTwoFactorSetupMagicLink(e) {
-    const t = `${h.twoFactorSetupMagicLink}/${e}`;
+    const t = `${c.twoFactorSetupMagicLink}/${e}`;
     return this.axiosClient.get(t, {
       // Override default auth headers (this is a public endpoint)
       transformRequest: [
-        (s, r) => (r && delete r.Authorization, s)
+        (r, s) => (s && delete s.Authorization, r)
       ]
-    }).then((s) => {
-      const r = s;
+    }).then((r) => {
+      const s = r;
       return {
         success: !0,
-        sessionToken: r.session_token,
-        userId: r.user_id,
-        expiresIn: r.expires_in,
-        appId: r.app_id
+        sessionToken: s.session_token,
+        userId: s.user_id,
+        expiresIn: s.expires_in,
+        appId: s.app_id
       };
-    }).catch((s) => {
-      if (s.response) {
-        const r = s.response.status, n = s.response.data || {}, o = s.response.headers?.["retry-after"] ? parseInt(s.response.headers["retry-after"], 10) : void 0;
+    }).catch((r) => {
+      if (r.response) {
+        const s = r.response.status, o = r.response.data || {}, n = r.response.headers?.["retry-after"] ? parseInt(r.response.headers["retry-after"], 10) : void 0;
         return {
           success: !1,
           error: {
-            code: n.error || this.mapStatusToErrorCode(r),
-            message: n.message || this.getDefaultErrorMessage(r),
-            retryAfter: o
+            code: o.error || this.mapStatusToErrorCode(s),
+            message: o.message || this.getDefaultErrorMessage(s),
+            retryAfter: n
           }
         };
       }
@@ -1197,7 +1211,7 @@ class me {
         success: !1,
         error: {
           code: "SERVER_ERROR",
-          message: s instanceof Error ? s.message : "Unable to connect to the server. Please check your connection."
+          message: r instanceof Error ? r.message : "Unable to connect to the server. Please check your connection."
         }
       };
     });
@@ -1236,53 +1250,139 @@ class me {
         return "An error occurred while validating the magic link.";
     }
   }
+  // ============================================
+  // v2 Multi-Method 2FA API Methods
+  // ============================================
+  /**
+   * Get available 2FA methods for current user
+   * GET /v2/user/2fa/methods/available
+   */
+  getAvailableMethods() {
+    return this.axiosClient.get(c.TwoFactorMethodsAvailable);
+  }
+  /**
+   * Get registered 2FA methods for current user
+   * GET /v2/user/2fa/methods
+   */
+  getRegisteredMethods() {
+    return this.axiosClient.get(c.TwoFactorMethodsRegistered);
+  }
+  /**
+   * Begin 2FA method setup
+   * POST /v2/user/2fa/methods/:method/setup/begin
+   */
+  beginMethodSetup(e) {
+    const t = m(c.TwoFactorMethodSetupBegin, { method: e });
+    return this.axiosClient.post(t, {});
+  }
+  /**
+   * Confirm 2FA method setup
+   * POST /v2/user/2fa/methods/:method/setup/confirm
+   */
+  confirmMethodSetup(e, t) {
+    const r = m(c.TwoFactorMethodSetupConfirm, { method: e });
+    return this.axiosClient.post(r, t);
+  }
+  /**
+   * Remove registered 2FA method
+   * DELETE /v2/user/2fa/methods/:id
+   */
+  removeMethod(e) {
+    const t = m(c.TwoFactorMethodRemove, { id: e });
+    return this.axiosClient.delete(t);
+  }
+  /**
+   * Request 2FA challenge during login
+   * POST /v2/auth/2fa/challenge
+   */
+  requestChallenge(e) {
+    return this.axiosClient.post(
+      c.TwoFactorChallenge,
+      e
+    );
+  }
+  /**
+   * Verify 2FA challenge (v2)
+   * POST /v2/auth/2fa/verify
+   */
+  verifyV2(e) {
+    return this.axiosClient.post(
+      c.TwoFactorVerifyV2,
+      e
+    );
+  }
+  /**
+   * Switch to alternative 2FA method during challenge
+   * POST /v2/auth/2fa/alternative
+   */
+  switchToAlternative(e) {
+    return this.axiosClient.post(
+      c.TwoFactorAlternative,
+      e
+    );
+  }
+  /**
+   * Get trusted devices
+   * GET /v2/user/2fa/trusted-devices
+   */
+  getTrustedDevices() {
+    return this.axiosClient.get(c.TwoFactorTrustedDevices);
+  }
+  /**
+   * Revoke trusted device
+   * DELETE /v2/user/2fa/trusted-devices/:id
+   */
+  revokeTrustedDevice(e) {
+    const t = m(c.TwoFactorTrustedDeviceRevoke, { id: e });
+    return this.axiosClient.delete(t);
+  }
 }
 class Se {
-  constructor(e, t, s) {
-    this.axiosClient = new T(e, t, s);
+  constructor(e, t, r) {
+    this.axiosClient = new _(e, t, r);
   }
   setAppId(e) {
     this.axiosClient.setAppId(e);
   }
   getUserPasskeys() {
-    return this.axiosClient.get(h.userPasskey);
+    return this.axiosClient.get(c.userPasskey);
   }
   renameUserPasskey(e, t) {
     return this.axiosClient.patch(
-      `${h.userPasskey}/${t}`,
+      `${c.userPasskey}/${t}`,
       {
         name: e
       }
     );
   }
   deleteUserPasskey(e) {
-    return this.axiosClient.delete(`${h.userPasskey}/${e}`);
+    return this.axiosClient.delete(`${c.userPasskey}/${e}`);
   }
   addUserPasskeyStart({
     relyingPartyId: e,
     deviceId: t,
-    os: s,
-    passkeyDisplayName: r,
-    passkeyUsername: n
+    os: r,
+    passkeyDisplayName: s,
+    passkeyUsername: o
   }) {
-    const o = {
-      passkey_display_name: r,
-      passkey_username: n,
+    const n = {
+      passkey_display_name: s,
+      passkey_username: o,
       relying_party_id: e,
       deviceId: t,
-      os: s
+      os: r
     };
-    return this.axiosClient.post(h.addUserPasskey, o);
+    return this.axiosClient.post(c.addUserPasskey, n);
   }
-  addUserPasskeyComplete(e, t, s) {
-    return this.axiosClient.post(h.completeAddUserPasskey, {
-      challenge_id: s,
+  addUserPasskeyComplete(e, t, r) {
+    return this.axiosClient.post(c.completeAddUserPasskey, {
+      challenge_id: r,
       device: t,
       passkey_data: e
     });
   }
 }
-var a = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i))(a || {});
+var a = /* @__PURE__ */ ((i) => (i.SignIn = "signin", i.SignInStart = "signin:start", i.Register = "register", i.RegisterStart = "register:start", i.SignOut = "signout", i.SessionRestored = "session:restored", i.Error = "error", i.Refresh = "refresh", i.RefreshStart = "refresh:start", i.TokenCacheExpired = "token-cache-expired", i.TwoFactorRequired = "2fa:required", i.TwoFactorSetupStarted = "2fa:setup_started", i.TwoFactorEnabled = "2fa:enabled", i.TwoFactorDisabled = "2fa:disabled", i.TwoFactorVerified = "2fa:verified", i.TwoFactorRecoveryUsed = "2fa:recovery_used", i.TwoFactorRecoveryCodesLow = "2fa:recovery_low", i.TwoFactorRecoveryCodesExhausted = "2fa:recovery_exhausted", i.TwoFactorSetupMagicLinkValidated = "2fa:magic_link_validated", i.TwoFactorSetupMagicLinkFailed = "2fa:magic_link_failed", i.TwoFactorChallengeReceived = "two_factor_challenge_received", i.TwoFactorMethodSwitched = "two_factor_method_switched", i.TwoFactorDeviceTrusted = "two_factor_device_trusted", i))(a || {});
 class we {
   constructor() {
     this.subscribers = /* @__PURE__ */ new Map();
@@ -1294,8 +1394,8 @@ class we {
    */
   subscribe(e, t) {
     if (t?.length) {
-      const s = new Set(t);
-      this.subscribers.set(e, s);
+      const r = new Set(t);
+      this.subscribers.set(e, r);
     } else
       this.subscribers.set(e, null);
   }
@@ -1309,8 +1409,8 @@ class we {
       this.subscribers.delete(e);
       return;
     }
-    const s = this.subscribers.get(e);
-    s && (t.forEach((r) => s.delete(r)), s.size === 0 && this.subscribers.delete(e));
+    const r = this.subscribers.get(e);
+    r && (t.forEach((s) => r.delete(s)), r.size === 0 && this.subscribers.delete(e));
   }
   /**
    * Notify subscribers of an event
@@ -1318,22 +1418,22 @@ class we {
    * @param payload Event-specific payload data
    */
   notify(e, t) {
-    this.subscribers.forEach((s, r) => {
-      (!s || s.has(e)) && r.onAuthChange?.(e, t);
+    this.subscribers.forEach((r, s) => {
+      (!r || r.has(e)) && s.onAuthChange?.(e, t);
     });
   }
 }
-function M(i) {
+function D(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.split(".");
   if (e.length !== 3) return !1;
   const t = /^[A-Za-z0-9_-]+$/;
-  return e.every((s) => t.test(s) && s.length > 0);
+  return e.every((r) => t.test(r) && r.length > 0);
 }
 function Te(i) {
-  return i.replace(/<[^>]*>/g, "").substring(0, oe);
+  return i.replace(/<[^>]*>/g, "").substring(0, ne);
 }
-function F(i) {
+function P(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
   return e.length === 0 ? !1 : /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
@@ -1343,22 +1443,22 @@ function x(i) {
   const e = i.trim();
   return /^\+[1-9]\d{1,14}$/.test(e);
 }
-function Ee(i) {
+function _e(i) {
   if (!i || typeof i != "string") return !1;
   const e = i.trim();
-  return e.length < ie || e.length > ne ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
+  return e.length < ie || e.length > oe ? !1 : /^[a-zA-Z0-9_-]+$/.test(e);
 }
 function R(i, e = 6) {
   return !i || typeof i != "string" ? !1 : (e === 8 ? /^\d{8}$/ : /^\d{6}$/).test(i);
 }
-function _e(i) {
+function Ee(i) {
   if (!i || typeof i != "string") return null;
   const e = i.toUpperCase().replace(/\s+/g, "");
   return /^[A-Z0-9-]{4,16}$/.test(e) ? e : null;
 }
 class Ie {
-  constructor(e, t, s, r, n, o, d, c, g, p, f, b) {
-    this.authApi = e, this.deviceService = t, this.storageManager = s, this.subscribeStore = r, this.tokenCacheService = n, this.scopes = o, this.createTenantForNewUser = d, this.origin = c, this.url = g, this.sessionCallbacks = p, this.appId = f, this.tokenExchangeConfig = b, this.tokenDeliveryManager = new Y(s), b?.enabled && this.tokenDeliveryManager.setMode(v.BFF), this.initializeSession();
+  constructor(e, t, r, s, o, n, d, h, g, f, k, A) {
+    this.authApi = e, this.deviceService = t, this.storageManager = r, this.subscribeStore = s, this.tokenCacheService = o, this.scopes = n, this.createTenantForNewUser = d, this.origin = h, this.url = g, this.sessionCallbacks = f, this.appId = k, this.tokenExchangeConfig = A, this.tokenDeliveryManager = new Y(r), A?.enabled && this.tokenDeliveryManager.setMode(y.BFF), this.initializeSession();
   }
   /**
    * Initialize session state on page load for cookie/BFF mode
@@ -1425,70 +1525,70 @@ class Ie {
       throw new Error(`BFF token storage failed: ${t.status}`);
   }
   async signIn(e) {
-    if ("email" in e && e.email && !F(e.email)) {
-      const r = new Error("Invalid email format"), n = {
+    if ("email" in e && e.email && !P(e.email)) {
+      const s = new Error("Invalid email format"), o = {
         message: "Invalid email format",
-        originalError: r,
+        originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
-    if ("username" in e && e.username && !Ee(e.username)) {
-      const r = new Error(
+    if ("username" in e && e.username && !_e(e.username)) {
+      const s = new Error(
         "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens"
-      ), n = {
+      ), o = {
         message: "Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens",
-        originalError: r,
+        originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
     if ("phone" in e && e.phone && !x(e.phone)) {
-      const r = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), n = {
+      const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
-        originalError: r,
+        originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
     this.subscribeStore.notify(a.SignInStart, { email: e.email });
-    const t = this.deviceService.getDeviceId(), s = I.web;
+    const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const r = await this.authApi.signIn(e, t, s);
-      return "requires_2fa" in r && r.requires_2fa === !0 || "tfa_token" in r && r.tfa_token ? (this.subscribeStore.notify(a.TwoFactorRequired, {
+      const s = await this.authApi.signIn(e, t, r);
+      return "requires_2fa" in s && s.requires_2fa === !0 || "tfa_token" in s && s.tfa_token ? (this.subscribeStore.notify(a.TwoFactorRequired, {
         email: e.email || "",
-        challengeId: r.challenge_id || "",
-        tfaToken: r.tfa_token || ""
-      }), r) : (await this.processAuthResponse(r, e.scopes), this.subscribeStore.notify(a.SignIn, {
-        tokens: r,
+        challengeId: s.challenge_id || "",
+        tfaToken: s.tfa_token || ""
+      }), s) : (await this.processAuthResponse(s, e.scopes), this.subscribeStore.notify(a.SignIn, {
+        tokens: s,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), r);
-    } catch (r) {
-      const n = {
-        message: r instanceof Error ? r.message : "Sign in failed",
-        originalError: r,
-        code: r instanceof u ? r.id : void 0
+      }), await this.submitSessionCheck(), s);
+    } catch (s) {
+      const o = {
+        message: s instanceof Error ? s.message : "Sign in failed",
+        originalError: s,
+        code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
   }
   async signUp(e) {
-    if (e.user.email && !F(e.user.email)) {
-      const t = new Error("Invalid email format"), s = {
+    if (e.user.email && !P(e.user.email)) {
+      const t = new Error("Invalid email format"), r = {
         message: "Invalid email format",
         originalError: t,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, s), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
     if (e.user.phone_number && !x(e.user.phone_number)) {
-      const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), s = {
+      const t = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), r = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
         originalError: t,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, s), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
     this.subscribeStore.notify(a.RegisterStart, { email: e.user.email }), e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
@@ -1498,42 +1598,42 @@ class Ie {
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
     } catch (t) {
-      const s = {
+      const r = {
         message: t instanceof Error ? t.message : "Sign up failed",
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, s), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   async passwordlessSignIn(e) {
-    if (e.email && !F(e.email)) {
-      const r = new Error("Invalid email format"), n = {
+    if (e.email && !P(e.email)) {
+      const s = new Error("Invalid email format"), o = {
         message: "Invalid email format",
-        originalError: r,
+        originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
     if (e.phone && !x(e.phone)) {
-      const r = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), n = {
+      const s = new Error("Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)"), o = {
         message: "Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)",
-        originalError: r,
+        originalError: s,
         code: "VALIDATION_ERROR"
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
     this.subscribeStore.notify(a.SignInStart, { email: e.email }), e.scopes = e.scopes ?? this.scopes;
-    const t = this.deviceService.getDeviceId(), s = I.web;
+    const t = this.deviceService.getDeviceId(), r = b.web;
     try {
-      return await this.authApi.passwordlessSignIn(e, t, s);
-    } catch (r) {
-      const n = {
-        message: r instanceof Error ? r.message : "Failed to send passwordless sign-in link",
-        originalError: r,
-        code: r instanceof u ? r.id : void 0
+      return await this.authApi.passwordlessSignIn(e, t, r);
+    } catch (s) {
+      const o = {
+        message: s instanceof Error ? s.message : "Failed to send passwordless sign-in link",
+        originalError: s,
+        code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
   }
   async passwordlessSignInComplete(e) {
@@ -1545,12 +1645,12 @@ class Ie {
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), t;
     } catch (t) {
-      const s = {
+      const r = {
         message: t instanceof Error ? t.message : "Passwordless sign in failed",
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, s), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   async logOut() {
@@ -1564,7 +1664,7 @@ class Ie {
       } catch {
       }
     else {
-      const e = this.storageManager.getToken(k.refresh_token), t = this.storageManager.getDeviceId();
+      const e = this.storageManager.getToken(p.refresh_token), t = this.storageManager.getDeviceId();
       try {
         if ((await this.authApi.logOut(t, e, !this.appId)).status !== "ok")
           throw new Error("Logout failed");
@@ -1576,253 +1676,253 @@ class Ie {
   async refreshToken() {
     if (this.subscribeStore.notify(a.RefreshStart, {}), this.tokenDeliveryManager.isBFFMode() && this.tokenExchangeConfig?.refreshUrl)
       try {
-        const s = await fetch(this.tokenExchangeConfig.refreshUrl, {
+        const r = await fetch(this.tokenExchangeConfig.refreshUrl, {
           method: "POST",
           credentials: "include"
           // Include httpOnly cookies
         });
-        if (!s.ok)
+        if (!r.ok)
           throw this.tokenDeliveryManager.setSessionInvalid(), new Error("BFF token refresh failed");
-        const r = await s.json();
-        return this.tokenDeliveryManager.setSessionValid(), r.id_token && this.storageManager.setIdToken(r.id_token), this.subscribeStore.notify(a.Refresh, {
-          tokens: r,
+        const s = await r.json();
+        return this.tokenDeliveryManager.setSessionValid(), s.id_token && this.storageManager.setIdToken(s.id_token), this.subscribeStore.notify(a.Refresh, {
+          tokens: s,
           parsedTokens: this.tokenCacheService.getParsedTokens()
-        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, r;
-      } catch (s) {
+        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, s;
+      } catch (r) {
         this.tokenDeliveryManager.setSessionInvalid();
-        const r = {
-          message: s instanceof Error ? s.message : "Token refresh failed",
-          originalError: s
+        const s = {
+          message: r instanceof Error ? r.message : "Token refresh failed",
+          originalError: r
         };
-        throw this.subscribeStore.notify(a.Error, r), s;
+        throw this.subscribeStore.notify(a.Error, s), r;
       }
     if (this.tokenDeliveryManager.isCookieMode())
       try {
-        const s = await this.authApi.refreshToken("", this.scopes);
-        return this.tokenDeliveryManager.setSessionValid(), await this.processAuthResponse(s, this.scopes), this.subscribeStore.notify(a.Refresh, {
-          tokens: s,
+        const r = await this.authApi.refreshToken("", this.scopes);
+        return this.tokenDeliveryManager.setSessionValid(), await this.processAuthResponse(r, this.scopes), this.subscribeStore.notify(a.Refresh, {
+          tokens: r,
           parsedTokens: this.tokenCacheService.getParsedTokens()
-        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, s;
-      } catch (s) {
+        }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, r;
+      } catch (r) {
         this.tokenDeliveryManager.setSessionInvalid();
-        const r = {
-          message: s instanceof Error ? s.message : "Token refresh failed",
-          originalError: s,
-          code: s instanceof u ? s.id : void 0
+        const s = {
+          message: r instanceof Error ? r.message : "Token refresh failed",
+          originalError: r,
+          code: r instanceof u ? r.id : void 0
         };
-        throw this.subscribeStore.notify(a.Error, r), s;
+        throw this.subscribeStore.notify(a.Error, s), r;
       }
     const e = this.storageManager.getTokens();
     if (e) {
       if (!e?.refresh_token) {
-        const s = new Error("No refresh token found"), r = {
+        const r = new Error("No refresh token found"), s = {
           message: "No refresh token found",
-          originalError: s
+          originalError: r
         };
-        throw this.subscribeStore.notify(a.Error, r), s;
+        throw this.subscribeStore.notify(a.Error, s), r;
       }
     } else {
-      const s = new Error("No tokens found"), r = {
+      const r = new Error("No tokens found"), s = {
         message: "No tokens found",
-        originalError: s
+        originalError: r
       };
-      throw this.subscribeStore.notify(a.Error, r), s;
+      throw this.subscribeStore.notify(a.Error, s), r;
     }
     const t = e?.scopes ?? this.scopes;
     try {
-      const s = await this.authApi.refreshToken(e?.refresh_token ?? "", t, e?.access_token);
-      return s.scopes = t, this.storageManager.saveTokens(s), this.tokenCacheService.setTokensCache(s), this.subscribeStore.notify(a.Refresh, {
-        tokens: s,
+      const r = await this.authApi.refreshToken(e?.refresh_token ?? "", t, e?.access_token);
+      return r.scopes = t, this.storageManager.saveTokens(r), this.tokenCacheService.setTokensCache(r), this.subscribeStore.notify(a.Refresh, {
+        tokens: r,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, this.tokenCacheService.startTokenCheck(), s;
-    } catch (s) {
-      const r = {
-        message: s instanceof Error ? s.message : "Token refresh failed",
-        originalError: s,
-        code: s instanceof u ? s.id : void 0,
-        details: D.isAxiosError(s) && s.response ? {
-          status: s.response.status,
-          data: s.response.data
+      }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenCacheService.isRefreshing = !1, this.tokenCacheService.tokenExpiredFlag = !1, this.tokenCacheService.startTokenCheck(), r;
+    } catch (r) {
+      const s = {
+        message: r instanceof Error ? r.message : "Token refresh failed",
+        originalError: r,
+        code: r instanceof u ? r.id : void 0,
+        details: F.isAxiosError(r) && r.response ? {
+          status: r.response.status,
+          data: r.response.data
         } : void 0
       };
-      throw this.subscribeStore.notify(a.Error, r), s instanceof u ? s : D.isAxiosError(s) && s.response && s.response?.status >= 400 && s.response?.status < 500 ? new Error(`Getting unknown error message from server with code:${s.response.status}`) : s;
+      throw this.subscribeStore.notify(a.Error, s), r instanceof u ? r : F.isAxiosError(r) && r.response && r.response?.status >= 400 && r.response?.status < 500 ? new Error(`Getting unknown error message from server with code:${r.response.status}`) : r;
     }
   }
   async sendPasswordResetEmail(e) {
     try {
       return await this.authApi.sendPasswordResetEmail(e);
     } catch (t) {
-      const s = {
+      const r = {
         message: t instanceof Error ? t.message : "Failed to send password reset email",
         originalError: t,
         code: t instanceof u ? t.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, s), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   async resetPassword(e, t) {
     this.subscribeStore.notify(a.SignInStart, {});
-    const r = new URLSearchParams(window.location.search).get("token") ?? void 0, n = t ?? this.scopes;
+    const s = new URLSearchParams(window.location.search).get("token") ?? void 0, o = t ?? this.scopes;
     try {
-      const o = await this.authApi.resetPassword(e, n, r);
-      return await this.processAuthResponse(o, n), this.subscribeStore.notify(a.SignIn, {
-        tokens: o,
+      const n = await this.authApi.resetPassword(e, o, s);
+      return await this.processAuthResponse(n, o), this.subscribeStore.notify(a.SignIn, {
+        tokens: n,
         parsedTokens: this.tokenCacheService.getParsedTokens()
-      }), await this.submitSessionCheck(), o;
-    } catch (o) {
+      }), await this.submitSessionCheck(), n;
+    } catch (n) {
       const d = {
-        message: o instanceof Error ? o.message : "Password reset failed",
-        originalError: o,
-        code: o instanceof u ? o.id : void 0
+        message: n instanceof Error ? n.message : "Password reset failed",
+        originalError: n,
+        code: n instanceof u ? n.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, d), o;
+      throw this.subscribeStore.notify(a.Error, d), n;
     }
   }
   async passkeyRegister(e) {
     this.subscribeStore.notify(a.RegisterStart, {});
-    const t = this.deviceService.getDeviceId(), s = I.web;
+    const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes, e.create_tenant = this.createTenantForNewUser;
     try {
-      const { challenge_id: r, publicKey: n } = await this.authApi.passkeyRegisterStart(e, t, s, !this.appId);
-      n.user.id = btoa(n.user.id);
-      const o = await K({
-        optionsJSON: n
+      const { challenge_id: s, publicKey: o } = await this.authApi.passkeyRegisterStart(e, t, r, !this.appId);
+      o.user.id = btoa(o.user.id);
+      const n = await K({
+        optionsJSON: o
       }), d = await this.authApi.passkeyRegisterComplete(
-        o,
+        n,
         t,
-        r,
+        s,
         !this.appId
       );
       return await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(a.Register, {
         tokens: d,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck(), d;
-    } catch (r) {
-      const n = {
-        message: r instanceof Error ? r.message : "Passkey registration failed",
-        originalError: r,
-        code: r instanceof u ? r.id : void 0
+    } catch (s) {
+      const o = {
+        message: s instanceof Error ? s.message : "Passkey registration failed",
+        originalError: s,
+        code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
   }
   async passkeyAuthenticate(e) {
     this.subscribeStore.notify(a.SignInStart, {});
-    const t = this.deviceService.getDeviceId(), s = I.web;
+    const t = this.deviceService.getDeviceId(), r = b.web;
     e.scopes = e.scopes ?? this.scopes;
     try {
-      const { challenge_id: r, publicKey: n } = await this.authApi.passkeyAuthenticateStart(e, t, s, !this.appId), o = await j({
-        optionsJSON: n
+      const { challenge_id: s, publicKey: o } = await this.authApi.passkeyAuthenticateStart(e, t, r, !this.appId), n = await j({
+        optionsJSON: o
       }), d = await this.authApi.passkeyAuthenticateComplete(
-        o,
+        n,
         t,
-        r,
+        s,
         !this.appId
       );
       return "access_token" in d && (await this.processAuthResponse(d, e.scopes), this.subscribeStore.notify(a.SignIn, {
         tokens: d,
         parsedTokens: this.tokenCacheService.getParsedTokens()
       }), await this.submitSessionCheck()), d;
-    } catch (r) {
-      const n = {
-        message: r instanceof Error ? r.message : "Passkey authentication failed",
-        originalError: r,
-        code: r instanceof u ? r.id : void 0
+    } catch (s) {
+      const o = {
+        message: s instanceof Error ? s.message : "Passkey authentication failed",
+        originalError: s,
+        code: s instanceof u ? s.id : void 0
       };
-      throw this.subscribeStore.notify(a.Error, n), r;
+      throw this.subscribeStore.notify(a.Error, o), s;
     }
   }
   createFederatedAuthUrl(e) {
     const t = `/auth/federated/start/${e.provider}`;
     if (!this.appId) throw new Error("AppId is required for federated auth");
-    const r = {
+    const s = {
       scopes: (e.scopes ?? this.scopes).join(" "),
       redirect_url: e.redirect_url ?? this.origin,
       appId: this.appId,
       ...e.invite_token ? { invite_token: e.invite_token } : {},
       ...e.create_tenant ? { create_tenant: e.create_tenant.toString() } : {},
       ...e.device ? { device: e.device } : {}
-    }, n = new URL(t, this.url), o = new URLSearchParams(r);
-    return n.search = o.toString(), n.toString();
+    }, o = new URL(t, this.url), n = new URLSearchParams(s);
+    return o.search = n.toString(), o.toString();
   }
   federatedAuthWithPopup(e) {
     this.subscribeStore.notify(a.SignInStart, { provider: e.provider });
-    const t = e.scopes ?? this.scopes, s = this.deviceService.getDeviceId(), r = this.createFederatedAuthUrl({ ...e, scopes: t, device: s }), n = window.open(r, "_blank", `width=${ee},height=${te}`);
-    if (!n) {
+    const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r }), o = window.open(s, "_blank", `width=${ee},height=${te}`);
+    if (!o) {
       this.federatedAuthWithRedirect(e);
       return;
     }
-    const o = Date.now(), d = setInterval(() => {
-      if (n.closed) {
+    const n = Date.now(), d = setInterval(() => {
+      if (o.closed) {
         clearInterval(d);
-        const c = {
+        const h = {
           message: "Authentication popup was closed",
           code: "POPUP_CLOSED"
         };
-        this.subscribeStore.notify(a.Error, c);
+        this.subscribeStore.notify(a.Error, h);
         return;
       }
-      if (Date.now() - o > re) {
-        clearInterval(d), n.close();
-        const c = {
+      if (Date.now() - n > se) {
+        clearInterval(d), o.close();
+        const h = {
           message: "Authentication popup timed out",
           code: "POPUP_TIMEOUT"
         };
-        this.subscribeStore.notify(a.Error, c);
+        this.subscribeStore.notify(a.Error, h);
         return;
       }
       try {
-        if (n.location.href.startsWith(this.origin)) {
-          const c = new URLSearchParams(n.location.search), g = c.get("access_token") || "", p = c.get("refresh_token") || "", f = c.get("id_token") || "", b = {
+        if (o.location.href.startsWith(this.origin)) {
+          const h = new URLSearchParams(o.location.search), g = h.get("access_token") || "", f = h.get("refresh_token") || "", k = h.get("id_token") || "", A = {
             access_token: g,
-            refresh_token: p || void 0,
-            id_token: f || void 0,
+            refresh_token: f || void 0,
+            id_token: k || void 0,
             scopes: t
           };
-          this.processAuthResponse(b, t).then(() => {
+          this.processAuthResponse(A, t).then(() => {
             this.subscribeStore.notify(a.SignIn, {
-              tokens: b,
+              tokens: A,
               parsedTokens: this.tokenCacheService.getParsedTokens()
             }), window.location.href = `${this.origin}`;
-          }), clearInterval(d), n.close();
+          }), clearInterval(d), o.close();
         }
       } catch {
       }
-    }, se);
+    }, re);
   }
   federatedAuthWithRedirect(e) {
     this.subscribeStore.notify(a.SignInStart, { provider: e.provider });
-    const t = e.scopes ?? this.scopes, s = this.deviceService.getDeviceId(), r = this.createFederatedAuthUrl({ ...e, scopes: t, device: s });
-    window.location.href = r;
+    const t = e.scopes ?? this.scopes, r = this.deviceService.getDeviceId(), s = this.createFederatedAuthUrl({ ...e, scopes: t, device: r });
+    window.location.href = s;
   }
   // Helper methods for authentication UI redirect
   authRedirectUrl(e = {}) {
     try {
-      const { url: t, redirectUrl: s, scopes: r, appId: n } = e ?? {}, o = new URL(t ?? this.url);
-      o.pathname = (o.pathname.endsWith("/") ? o.pathname : o.pathname + "/") + "web";
-      const d = r ?? this.scopes, c = {
-        appId: n ?? this.appId ?? "",
-        redirectto: s ?? window.location.href,
+      const { url: t, redirectUrl: r, scopes: s, appId: o } = e ?? {}, n = new URL(t ?? this.url);
+      n.pathname = (n.pathname.endsWith("/") ? n.pathname : n.pathname + "/") + "web";
+      const d = s ?? this.scopes, h = {
+        appId: o ?? this.appId ?? "",
+        redirectto: r ?? window.location.href,
         scopes: d.join(",")
-      }, g = new URLSearchParams(c);
-      return o.search = g.toString(), o.toString();
+      }, g = new URLSearchParams(h);
+      return n.search = g.toString(), n.toString();
     } catch (t) {
-      const s = {
+      const r = {
         message: t instanceof Error ? t.message : "Failed to create auth redirect URL",
         originalError: t
       };
-      throw this.subscribeStore.notify(a.Error, s), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   authRedirect(e = {}) {
     try {
       window.location.href = this.authRedirectUrl(e);
     } catch (t) {
-      const s = {
+      const r = {
         message: t instanceof Error ? t.message : "Failed to redirect to auth page",
         originalError: t
       };
-      throw this.subscribeStore.notify(a.Error, s), t;
+      throw this.subscribeStore.notify(a.Error, r), t;
     }
   }
   /**
@@ -1832,33 +1932,33 @@ class Ie {
   isAuthenticated(e) {
     try {
       if (this.tokenDeliveryManager.isCookieMode() || this.tokenDeliveryManager.isBFFMode()) {
-        const t = !!e?.id_token || !!this.storageManager.getIdToken(), s = this.tokenDeliveryManager.isSessionValid(), r = this.tokenDeliveryManager.isSessionUnknown();
-        return t && (s || r);
+        const t = !!e?.id_token || !!this.storageManager.getIdToken(), r = this.tokenDeliveryManager.isSessionValid(), s = this.tokenDeliveryManager.isSessionUnknown();
+        return t && (r || s);
       }
-      return !e || !e.access_token ? !1 : !m(e.access_token) || e.refresh_token !== void 0 && !m(e.refresh_token);
+      return !e || !e.access_token ? !1 : !S(e.access_token) || e.refresh_token !== void 0 && !S(e.refresh_token);
     } catch (t) {
-      const s = {
+      const r = {
         message: t instanceof Error ? t.message : "Failed to check authentication status",
         originalError: t
       };
-      return this.subscribeStore.notify(a.Error, s), !1;
+      return this.subscribeStore.notify(a.Error, r), !1;
     }
   }
   /**
    * Handle session check and callbacks
    */
   async submitSessionCheck(e = !1) {
-    let t, s;
+    let t, r;
     try {
-      t = await this.getTokens(e), s = this.tokenCacheService.getParsedTokens();
-    } catch (r) {
-      const n = {
-        message: r instanceof Error || r instanceof u ? r.message : "Session check failed",
-        originalError: r
+      t = await this.getTokens(e), r = this.tokenCacheService.getParsedTokens();
+    } catch (s) {
+      const o = {
+        message: s instanceof Error || s instanceof u ? s.message : "Session check failed",
+        originalError: s
       };
-      this.subscribeStore.notify(a.Error, n), t = void 0;
+      this.subscribeStore.notify(a.Error, o), t = void 0;
     }
-    return t && this.sessionCallbacks.createSession && await this.sessionCallbacks.createSession({ tokens: t, parsedTokens: s }), !t && this.sessionCallbacks.expiredSession && await this.sessionCallbacks.expiredSession(), t;
+    return t && this.sessionCallbacks.createSession && await this.sessionCallbacks.createSession({ tokens: t, parsedTokens: r }), !t && this.sessionCallbacks.expiredSession && await this.sessionCallbacks.expiredSession(), t;
   }
   /**
    * Get tokens and refresh if needed
@@ -1868,19 +1968,19 @@ class Ie {
   async getTokens(e) {
     try {
       if (this.tokenDeliveryManager.isCookieMode() || this.tokenDeliveryManager.isBFFMode()) {
-        const r = this.storageManager.getTokens();
-        return r?.id_token ? this.tokenDeliveryManager.isSessionInvalid() && e ? await this.refreshToken() : r : void 0;
+        const s = this.storageManager.getTokens();
+        return s?.id_token ? this.tokenDeliveryManager.isSessionInvalid() && e ? await this.refreshToken() : s : void 0;
       }
       const t = this.storageManager.getTokens();
       if (!t || !t.access_token) return;
-      const s = y(t.access_token);
-      return m(s) ? e ? await this.refreshToken() : void 0 : t;
+      const r = v(t.access_token);
+      return S(r) ? e ? await this.refreshToken() : void 0 : t;
     } catch (t) {
-      const s = {
+      const r = {
         message: t instanceof Error ? t.message : "Failed to get tokens",
         originalError: t
       };
-      this.subscribeStore.notify(a.Error, s);
+      this.subscribeStore.notify(a.Error, r);
       return;
     }
   }
@@ -1930,7 +2030,7 @@ class be {
     return this.invitationApi.getInvitationLink(e);
   }
 }
-class Ce {
+class Ae {
   error(e, ...t) {
     console.error(e, ...t);
   }
@@ -1944,51 +2044,51 @@ class Ce {
     console.debug(e, ...t);
   }
 }
-function Ae() {
-  return new Ce();
+function Ce() {
+  return new Ae();
 }
 class Re {
   constructor(e) {
     this.data = this.normalize(e);
   }
   normalize(e) {
-    const t = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), n = [];
-    return e.groups?.forEach((o) => {
-      s.set(o.id, {
-        id: o.id,
-        name: o.name,
-        default: o.default ?? !1,
-        updated_at: o.updated_at,
-        created_at: o.created_at
+    const t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), o = [];
+    return e.groups?.forEach((n) => {
+      r.set(n.id, {
+        id: n.id,
+        name: n.name,
+        default: n.default ?? !1,
+        updated_at: n.updated_at,
+        created_at: n.created_at
       });
-    }), e.roles?.forEach((o) => {
-      r.set(o.id, {
-        id: o.id,
-        tenant_id: o.tenant_id,
-        name: o.name
+    }), e.roles?.forEach((n) => {
+      s.set(n.id, {
+        id: n.id,
+        tenant_id: n.tenant_id,
+        name: n.name
       });
-    }), e.users_in_groups?.forEach((o) => {
-      const d = o.user;
+    }), e.users_in_groups?.forEach((n) => {
+      const d = n.user;
       d && !t.has(d.id) && t.set(d.id, {
         id: d.id,
         name: d.name ?? null,
         email: d.email ?? null,
         phone: d.phone ?? null
-      }), d && o.group_id && s.has(o.group_id) && n.push({
+      }), d && n.group_id && r.has(n.group_id) && o.push({
         userId: d.id,
-        groupId: o.group_id,
-        roleIds: o.roles?.map((c) => c.id) ?? []
+        groupId: n.group_id,
+        roleIds: n.roles?.map((h) => h.id) ?? []
       });
     }), {
       tenant_id: e.tenant_id,
       tenant_name: e.tenant_name,
       users: Array.from(t.values()),
-      groups: Array.from(s.values()),
-      roles: Array.from(r.values()),
-      memberships: n,
+      groups: Array.from(r.values()),
+      roles: Array.from(s.values()),
+      memberships: o,
       usersById: t,
-      groupsById: s,
-      rolesById: r
+      groupsById: r,
+      rolesById: s
     };
   }
   /**
@@ -2007,8 +2107,8 @@ class Re {
    * Returns all roles that the specified user has in the specified group.
    */
   getUserRolesInGroup(e, t) {
-    const s = this.data.memberships.find((r) => r.userId === e && r.groupId === t);
-    return s ? s.roleIds.map((r) => this.data.rolesById.get(r)).filter((r) => r !== void 0) : [];
+    const r = this.data.memberships.find((s) => s.userId === e && s.groupId === t);
+    return r ? r.roleIds.map((s) => this.data.rolesById.get(s)).filter((s) => s !== void 0) : [];
   }
   /**
    * Returns the full TenantData object.
@@ -2017,9 +2117,9 @@ class Re {
     return this.data;
   }
 }
-class Pe {
-  constructor(e, t, s) {
-    this.tenantApi = e, this.scopes = t, this.logger = s || Ae();
+class Me {
+  constructor(e, t, r) {
+    this.tenantApi = e, this.scopes = t, this.logger = r || Ce();
   }
   /**
    * Handle Passflow API errors
@@ -2028,11 +2128,11 @@ class Pe {
    * @throws Formatted error with Passflow API error details
    */
   handlePassflowError(e, t) {
-    if (D.isAxiosError(e) && e.response?.data) {
-      const s = e.response.data;
-      if (typeof s == "object" && s !== null && "error" in s && typeof s.error == "object" && s.error !== null) {
-        const r = s.error;
-        throw this.logger.error(`${t}: ${r.id} - ${r.message} (Status: ${r.status})`), new Error(`Passflow API Error: ${r.id} - ${r.message} (Status: ${r.status})`);
+    if (F.isAxiosError(e) && e.response?.data) {
+      const r = e.response.data;
+      if (typeof r == "object" && r !== null && "error" in r && typeof r.error == "object" && r.error !== null) {
+        const s = r.error;
+        throw this.logger.error(`${t}: ${s.id} - ${s.message} (Status: ${s.status})`), new Error(`Passflow API Error: ${s.id} - ${s.message} (Status: ${s.status})`);
       }
     }
     throw this.logger.error(`${t}:`, e), e instanceof Error ? e : new Error(String(e));
@@ -2045,10 +2145,10 @@ class Pe {
    */
   async joinInvitation(e, t) {
     try {
-      const s = t ?? this.scopes;
-      return await this.tenantApi.joinInvitation(e, s);
-    } catch (s) {
-      this.handlePassflowError(s, "Join invitation failed");
+      const r = t ?? this.scopes;
+      return await this.tenantApi.joinInvitation(e, r);
+    } catch (r) {
+      this.handlePassflowError(r, "Join invitation failed");
     }
   }
   /**
@@ -2103,8 +2203,8 @@ class Pe {
   async updateTenant(e, t) {
     try {
       return await this.tenantApi.updateTenant(e, t);
-    } catch (s) {
-      this.handlePassflowError(s, `Update tenant failed for tenant ID ${e}`);
+    } catch (r) {
+      this.handlePassflowError(r, `Update tenant failed for tenant ID ${e}`);
     }
   }
   /**
@@ -2140,8 +2240,8 @@ class Pe {
   async createGroup(e, t) {
     try {
       return await this.tenantApi.createGroup(e, t);
-    } catch (s) {
-      this.handlePassflowError(s, `Group creation failed for tenant ID ${e}`);
+    } catch (r) {
+      this.handlePassflowError(r, `Group creation failed for tenant ID ${e}`);
     }
   }
   /**
@@ -2153,8 +2253,8 @@ class Pe {
   async getGroupInfo(e, t) {
     try {
       return await this.tenantApi.getGroupInfo(e, t);
-    } catch (s) {
-      this.handlePassflowError(s, `Get group info failed for tenant ID ${e}, group ID ${t}`);
+    } catch (r) {
+      this.handlePassflowError(r, `Get group info failed for tenant ID ${e}, group ID ${t}`);
     }
   }
   /**
@@ -2164,11 +2264,11 @@ class Pe {
    * @param name New group name
    * @returns Promise with group response
    */
-  async updateGroup(e, t, s) {
+  async updateGroup(e, t, r) {
     try {
-      return await this.tenantApi.updateGroup(e, t, s);
-    } catch (r) {
-      this.handlePassflowError(r, `Update group failed for tenant ID ${e}, group ID ${t}`);
+      return await this.tenantApi.updateGroup(e, t, r);
+    } catch (s) {
+      this.handlePassflowError(s, `Update group failed for tenant ID ${e}, group ID ${t}`);
     }
   }
   /**
@@ -2180,8 +2280,8 @@ class Pe {
   async deleteGroup(e, t) {
     try {
       return await this.tenantApi.deleteGroup(e, t);
-    } catch (s) {
-      this.handlePassflowError(s, `Delete group failed for tenant ID ${e}, group ID ${t}`);
+    } catch (r) {
+      this.handlePassflowError(r, `Delete group failed for tenant ID ${e}, group ID ${t}`);
     }
   }
   /**
@@ -2192,13 +2292,13 @@ class Pe {
    * @param role Role to assign
    * @returns Promise with status response
    */
-  async addUserToGroup(e, t, s, r) {
+  async addUserToGroup(e, t, r, s) {
     try {
-      return await this.tenantApi.addUserToGroup(e, t, s, r);
-    } catch (n) {
+      return await this.tenantApi.addUserToGroup(e, t, r, s);
+    } catch (o) {
       this.handlePassflowError(
-        n,
-        `Add user to group failed for tenant ID ${e}, group ID ${t}, user ID ${s}`
+        o,
+        `Add user to group failed for tenant ID ${e}, group ID ${t}, user ID ${r}`
       );
     }
   }
@@ -2210,13 +2310,13 @@ class Pe {
    * @param roles Roles to remove
    * @returns Promise with status response
    */
-  async removeUserRolesFromGroup(e, t, s, r) {
+  async removeUserRolesFromGroup(e, t, r, s) {
     try {
-      return await this.tenantApi.removeUserRolesFromGroup(e, t, s, r);
-    } catch (n) {
+      return await this.tenantApi.removeUserRolesFromGroup(e, t, r, s);
+    } catch (o) {
       this.handlePassflowError(
-        n,
-        `Remove user roles from group failed for tenant ID ${e}, group ID ${t}, user ID ${s}`
+        o,
+        `Remove user roles from group failed for tenant ID ${e}, group ID ${t}, user ID ${r}`
       );
     }
   }
@@ -2228,13 +2328,13 @@ class Pe {
    * @param roles New roles to assign
    * @returns Promise with status response
    */
-  async changeUserRoles(e, t, s, r) {
+  async changeUserRoles(e, t, r, s) {
     try {
-      return await this.tenantApi.changeUserRoles(e, t, s, r);
-    } catch (n) {
+      return await this.tenantApi.changeUserRoles(e, t, r, s);
+    } catch (o) {
       this.handlePassflowError(
-        n,
-        `Change user roles failed for tenant ID ${e}, group ID ${t}, user ID ${s}`
+        o,
+        `Change user roles failed for tenant ID ${e}, group ID ${t}, user ID ${r}`
       );
     }
   }
@@ -2245,13 +2345,13 @@ class Pe {
    * @param userId User ID
    * @returns Promise with status response
    */
-  async deleteUserFromGroup(e, t, s) {
+  async deleteUserFromGroup(e, t, r) {
     try {
-      return await this.tenantApi.deleteUserFromGroup(e, t, s);
-    } catch (r) {
+      return await this.tenantApi.deleteUserFromGroup(e, t, r);
+    } catch (s) {
       this.handlePassflowError(
-        r,
-        `Delete user from group failed for tenant ID ${e}, group ID ${t}, user ID ${s}`
+        s,
+        `Delete user from group failed for tenant ID ${e}, group ID ${t}, user ID ${r}`
       );
     }
   }
@@ -2277,8 +2377,8 @@ class Pe {
   async createRoleForTenant(e, t) {
     try {
       return await this.tenantApi.createRoleForTenant(e, t);
-    } catch (s) {
-      this.handlePassflowError(s, `Create role for tenant failed for tenant ID ${e}`);
+    } catch (r) {
+      this.handlePassflowError(r, `Create role for tenant failed for tenant ID ${e}`);
     }
   }
   /**
@@ -2288,11 +2388,11 @@ class Pe {
    * @param name New role name
    * @returns Promise with role response
    */
-  async updateRole(e, t, s) {
+  async updateRole(e, t, r) {
     try {
-      return await this.tenantApi.updateRole(e, t, s);
-    } catch (r) {
-      this.handlePassflowError(r, `Update role failed for tenant ID ${e}, role ID ${t}`);
+      return await this.tenantApi.updateRole(e, t, r);
+    } catch (s) {
+      this.handlePassflowError(s, `Update role failed for tenant ID ${e}, role ID ${t}`);
     }
   }
   /**
@@ -2304,8 +2404,8 @@ class Pe {
   async deleteRole(e, t) {
     try {
       return await this.tenantApi.deleteRole(e, t);
-    } catch (s) {
-      this.handlePassflowError(s, `Delete role failed for tenant ID ${e}, role ID ${t}`);
+    } catch (r) {
+      this.handlePassflowError(r, `Delete role failed for tenant ID ${e}, role ID ${t}`);
     }
   }
   // 4. User Management in Tenants
@@ -2318,8 +2418,8 @@ class Pe {
   async deleteUserFromTenant(e, t) {
     try {
       return await this.tenantApi.deleteUserFromTenant(e, t);
-    } catch (s) {
-      this.handlePassflowError(s, `Delete user from tenant failed for tenant ID ${e}, user ID ${t}`);
+    } catch (r) {
+      this.handlePassflowError(r, `Delete user from tenant failed for tenant ID ${e}, user ID ${t}`);
     }
   }
   // 5. Invitation Management
@@ -2331,11 +2431,11 @@ class Pe {
    * @param skip Number of invitations to skip
    * @returns Promise with invitations response
    */
-  async getGroupInvitations(e, t, s, r) {
+  async getGroupInvitations(e, t, r, s) {
     try {
-      return await this.tenantApi.getGroupInvitations(e, t, s, r);
-    } catch (n) {
-      this.handlePassflowError(n, `Get group invitations failed for tenant ID ${e}, group ID ${t}`);
+      return await this.tenantApi.getGroupInvitations(e, t, r, s);
+    } catch (o) {
+      this.handlePassflowError(o, `Get group invitations failed for tenant ID ${e}, group ID ${t}`);
     }
   }
   /**
@@ -2345,11 +2445,11 @@ class Pe {
    * @param skip Number of invitations to skip
    * @returns Promise with invitations response
    */
-  async getTenantInvitations(e, t, s) {
+  async getTenantInvitations(e, t, r) {
     try {
-      return await this.tenantApi.getTenantInvitations(e, t, s);
-    } catch (r) {
-      this.handlePassflowError(r, `Get tenant invitations failed for tenant ID ${e}`);
+      return await this.tenantApi.getTenantInvitations(e, t, r);
+    } catch (s) {
+      this.handlePassflowError(s, `Get tenant invitations failed for tenant ID ${e}`);
     }
   }
   /**
@@ -2359,13 +2459,13 @@ class Pe {
    * @param inviteId Invitation ID
    * @returns Promise with empty record
    */
-  async invalidateInviteById(e, t, s) {
+  async invalidateInviteById(e, t, r) {
     try {
-      return await this.tenantApi.invalidateInviteById(e, t, s);
-    } catch (r) {
+      return await this.tenantApi.invalidateInviteById(e, t, r);
+    } catch (s) {
       this.handlePassflowError(
-        r,
-        `Invalidate invite by ID failed for tenant ID ${e}, group ID ${t}, invite ID ${s}`
+        s,
+        `Invalidate invite by ID failed for tenant ID ${e}, group ID ${t}, invite ID ${r}`
       );
     }
   }
@@ -2376,20 +2476,20 @@ class Pe {
    * @param email Email address
    * @returns Promise with empty record
    */
-  async invalidateInviteByEmail(e, t, s) {
+  async invalidateInviteByEmail(e, t, r) {
     try {
-      return await this.tenantApi.invalidateInviteByEmail(e, t, s);
-    } catch (r) {
+      return await this.tenantApi.invalidateInviteByEmail(e, t, r);
+    } catch (s) {
       this.handlePassflowError(
-        r,
-        `Invalidate invite by email failed for tenant ID ${e}, group ID ${t}, email ${s}`
+        s,
+        `Invalidate invite by email failed for tenant ID ${e}, group ID ${t}, email ${r}`
       );
     }
   }
 }
-class De {
-  constructor(e, t, s) {
-    this.storageManager = e, this.authApi = t, this.subscribeStore = s, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.visibilityChangeHandler = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupPageUnloadHandler();
+class Fe {
+  constructor(e, t, r) {
+    this.storageManager = e, this.authApi = t, this.subscribeStore = r, this.checkInterval = null, this.CHECK_INTERVAL = 6e4, this.visibilityChangeHandler = null, this.isRefreshing = !1, this.tokenExpiredFlag = !1, this.storageManager = e, this.authApi = t, this.setupPageUnloadHandler();
   }
   initialize() {
     try {
@@ -2402,8 +2502,8 @@ class De {
         this.setTokensCache(e), this.startTokenCheck();
         return;
       }
-      const t = y(e.access_token);
-      m(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
+      const t = v(e.access_token);
+      S(t) ? (this.tokenExpiredFlag = !0, this.stopTokenCheck(), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !0 })) : (this.setTokensCache(e), this.startTokenCheck());
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
@@ -2419,11 +2519,11 @@ class De {
         const t = await this.authApi.refreshToken(e?.refresh_token ?? "", e.scopes ?? [], e.access_token);
         this.setTokensCache(t), this.subscribeStore.notify(a.Refresh, { tokens: t, parsedTokens: this.getParsedTokens() }), this.subscribeStore.notify(a.TokenCacheExpired, { isExpired: !1 }), this.tokenExpiredFlag = !1, this.startTokenCheck();
       } catch (t) {
-        const s = {
+        const r = {
           message: t instanceof Error ? t.message : "Failed to get tokens",
           originalError: t
         };
-        this.subscribeStore.notify(a.Error, s), this.setTokensCache(void 0);
+        this.subscribeStore.notify(a.Error, r), this.setTokensCache(void 0);
       } finally {
         this.isRefreshing = !1;
       }
@@ -2455,9 +2555,9 @@ class De {
   }
   setTokensCache(e) {
     this.tokensCache = e, e ? this.parsedTokensCache = {
-      access_token: e.access_token ? y(e.access_token) : void 0,
-      id_token: e.id_token ? y(e.id_token) : void 0,
-      refresh_token: e.refresh_token ? y(e.refresh_token) : void 0,
+      access_token: e.access_token ? v(e.access_token) : void 0,
+      id_token: e.id_token ? v(e.id_token) : void 0,
+      refresh_token: e.refresh_token ? v(e.refresh_token) : void 0,
       scopes: e.scopes
     } : this.parsedTokensCache = void 0;
   }
@@ -2469,8 +2569,8 @@ class De {
       if (!this.tokensCache) return this.tokensCache;
       if (!this.tokensCache.access_token)
         return this.tokensCache;
-      const e = y(this.tokensCache.access_token);
-      return m(e) && !this.tokenExpiredFlag ? (await this.refreshTokensCache(this.tokensCache), this.tokensCache) : this.tokensCache;
+      const e = v(this.tokensCache.access_token);
+      return S(e) && !this.tokenExpiredFlag ? (await this.refreshTokensCache(this.tokensCache), this.tokensCache) : this.tokensCache;
     } catch (e) {
       const t = {
         message: e instanceof Error ? e.message : "Failed to get tokens",
@@ -2487,34 +2587,34 @@ class De {
     if (!this.tokensCache) return !0;
     if (!this.tokensCache.access_token)
       return !1;
-    const e = y(this.tokensCache.access_token);
-    return m(e);
+    const e = v(this.tokensCache.access_token);
+    return S(e);
   }
 }
-class Me {
+class De {
   constructor(e, t) {
     this.twoFactorApi = e, this.subscribeStore = t, this.PARTIAL_AUTH_TIMEOUT_MS = 300 * 1e3, this.SESSION_STORAGE_KEY = "passflow_2fa_challenge", this.totpDigits = 6;
-    const s = {
-      onAuthChange: (r, n) => {
-        if (r === a.TwoFactorRequired) {
-          const o = n;
-          this.setPartialAuthState(o.email, o.challengeId, o.tfaToken);
+    const r = {
+      onAuthChange: (s, o) => {
+        if (s === a.TwoFactorRequired) {
+          const n = o;
+          this.setPartialAuthState(n.email, n.challengeId, n.tfaToken);
         }
       }
     };
-    this.subscribeStore.subscribe(s, [a.TwoFactorRequired]);
+    this.subscribeStore.subscribe(r, [a.TwoFactorRequired]);
   }
   /**
    * Emit error event and throw the error
    * Helper method to ensure errors are properly emitted to subscribers
    */
   emitErrorAndThrow(e, t) {
-    const s = e, r = {
+    const r = e, s = {
       message: e instanceof Error ? e.message : `${t} failed`,
       originalError: e,
-      code: s?.id || void 0
+      code: r?.id || void 0
     };
-    throw this.subscribeStore.notify(a.Error, r), e;
+    throw this.subscribeStore.notify(a.Error, s), e;
   }
   /**
    * Get 2FA enrollment status for current user
@@ -2585,24 +2685,24 @@ class Me {
    */
   async useRecoveryCode(e) {
     try {
-      const t = _e(e);
+      const t = Ee(e);
       if (!t)
         throw new Error("Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).");
       if (this.recoverPartialAuthState(), !this.isVerificationRequired())
         throw new Error("2FA verification expired or not required. User must sign in first.");
       if (!this.partialAuthState?.tfaToken)
         throw new Error("No TFA token found. User must sign in first.");
-      const s = await this.twoFactorApi.useRecoveryCode({
+      const r = await this.twoFactorApi.useRecoveryCode({
         recovery_code: t,
         tfa_token: this.partialAuthState.tfaToken
       });
-      return this.clearPartialAuthState(), s.remaining_recovery_codes === 0 ? this.subscribeStore.notify(a.TwoFactorRecoveryCodesExhausted, { tokens: s }) : s.remaining_recovery_codes <= 2 && this.subscribeStore.notify(a.TwoFactorRecoveryCodesLow, {
-        tokens: s,
-        remainingCodes: s.remaining_recovery_codes
+      return this.clearPartialAuthState(), r.remaining_recovery_codes === 0 ? this.subscribeStore.notify(a.TwoFactorRecoveryCodesExhausted, { tokens: r }) : r.remaining_recovery_codes <= 2 && this.subscribeStore.notify(a.TwoFactorRecoveryCodesLow, {
+        tokens: r,
+        remainingCodes: r.remaining_recovery_codes
       }), this.subscribeStore.notify(a.TwoFactorRecoveryUsed, {
-        tokens: s,
-        remainingCodes: s.remaining_recovery_codes
-      }), this.subscribeStore.notify(a.TwoFactorVerified, { tokens: s }), s;
+        tokens: r,
+        remainingCodes: r.remaining_recovery_codes
+      }), this.subscribeStore.notify(a.TwoFactorVerified, { tokens: r }), r;
     } catch (t) {
       this.emitErrorAndThrow(t, "Use recovery code");
     }
@@ -2627,8 +2727,8 @@ class Me {
     if (!R(e, this.totpDigits))
       throw new Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);
     try {
-      const t = await this.twoFactorApi.regenerateRecoveryCodes({ code: e }), s = [...t.recovery_codes];
-      return t.recovery_codes = [], t.recovery_codes = s, t;
+      const t = await this.twoFactorApi.regenerateRecoveryCodes({ code: e }), r = [...t.recovery_codes];
+      return t.recovery_codes = [], t.recovery_codes = r, t;
     } catch (t) {
       this.emitErrorAndThrow(t, "Regenerate recovery codes");
     }
@@ -2644,11 +2744,11 @@ class Me {
    * Set partial auth state when login requires 2FA
    * Called internally via event listener when AuthService emits TwoFactorRequired
    */
-  setPartialAuthState(e, t, s) {
+  setPartialAuthState(e, t, r) {
     if (this.partialAuthState = {
       email: e,
       challengeId: t,
-      tfaToken: s,
+      tfaToken: r,
       timestamp: Date.now(),
       expiresAt: Date.now() + this.PARTIAL_AUTH_TIMEOUT_MS
     }, typeof sessionStorage < "u")
@@ -2762,8 +2862,133 @@ class Me {
   getTotpDigits() {
     return this.totpDigits;
   }
+  // ============================================
+  // v2 Multi-Method 2FA Service Methods
+  // ============================================
+  /**
+   * Get available 2FA methods for current user
+   */
+  async getAvailableMethods() {
+    try {
+      return await this.twoFactorApi.getAvailableMethods();
+    } catch (e) {
+      this.emitErrorAndThrow(e, "Get available 2FA methods");
+    }
+  }
+  /**
+   * Get registered 2FA methods for current user
+   */
+  async getRegisteredMethods() {
+    try {
+      return await this.twoFactorApi.getRegisteredMethods();
+    } catch (e) {
+      this.emitErrorAndThrow(e, "Get registered 2FA methods");
+    }
+  }
+  /**
+   * Begin 2FA method setup
+   */
+  async beginMethodSetup(e) {
+    try {
+      const t = await this.twoFactorApi.beginMethodSetup(e);
+      return this.subscribeStore.notify(a.TwoFactorSetupStarted, { secret: "", method: e }), t;
+    } catch (t) {
+      this.emitErrorAndThrow(t, "Begin 2FA method setup");
+    }
+  }
+  /**
+   * Confirm 2FA method setup
+   */
+  async confirmMethodSetup(e, t) {
+    try {
+      const r = await this.twoFactorApi.confirmMethodSetup(e, t);
+      return this.subscribeStore.notify(a.TwoFactorEnabled, {
+        recoveryCodes: [],
+        clearRecoveryCodes: () => {
+        }
+      }), r;
+    } catch (r) {
+      this.emitErrorAndThrow(r, "Confirm 2FA method setup");
+    }
+  }
+  /**
+   * Remove registered 2FA method
+   */
+  async removeMethod(e) {
+    try {
+      await this.twoFactorApi.removeMethod(e);
+    } catch (t) {
+      this.emitErrorAndThrow(t, "Remove 2FA method");
+    }
+  }
+  /**
+   * Request 2FA challenge during login
+   */
+  async requestChallenge(e) {
+    try {
+      const t = await this.twoFactorApi.requestChallenge(e);
+      return this.subscribeStore.notify(a.TwoFactorChallengeReceived, {
+        challengeId: t.challenge_id,
+        method: t.method,
+        alternativeMethods: t.alternative_methods
+      }), t;
+    } catch (t) {
+      this.emitErrorAndThrow(t, "Request 2FA challenge");
+    }
+  }
+  /**
+   * Verify 2FA challenge (v2)
+   */
+  async verifyV2(e) {
+    try {
+      const t = await this.twoFactorApi.verifyV2(e);
+      return t.success && (this.subscribeStore.notify(a.TwoFactorVerified, {
+        tokens: {
+          access_token: t.access_token,
+          refresh_token: t.refresh_token
+        }
+      }), t.device_trusted && this.subscribeStore.notify(a.TwoFactorDeviceTrusted, {})), t;
+    } catch (t) {
+      this.emitErrorAndThrow(t, "Verify 2FA challenge");
+    }
+  }
+  /**
+   * Switch to alternative 2FA method during challenge
+   */
+  async switchToAlternative(e) {
+    try {
+      const t = await this.twoFactorApi.switchToAlternative(e);
+      return this.subscribeStore.notify(a.TwoFactorMethodSwitched, {
+        challengeId: t.challenge_id,
+        method: t.method,
+        alternativeMethods: t.alternative_methods
+      }), t;
+    } catch (t) {
+      this.emitErrorAndThrow(t, "Switch to alternative 2FA method");
+    }
+  }
+  /**
+   * Get trusted devices
+   */
+  async getTrustedDevices() {
+    try {
+      return await this.twoFactorApi.getTrustedDevices();
+    } catch (e) {
+      this.emitErrorAndThrow(e, "Get trusted devices");
+    }
+  }
+  /**
+   * Revoke trusted device
+   */
+  async revokeTrustedDevice(e) {
+    try {
+      await this.twoFactorApi.revokeTrustedDevice(e);
+    } catch (t) {
+      this.emitErrorAndThrow(t, "Revoke trusted device");
+    }
+  }
 }
-class Fe {
+class Pe {
   constructor(e, t) {
     this.userAPI = e, this.deviceService = t;
   }
@@ -2799,33 +3024,33 @@ class Fe {
   async addUserPasskey({
     relyingPartyId: e,
     passkeyUsername: t,
-    passkeyDisplayName: s
+    passkeyDisplayName: r
   } = {}) {
-    const r = this.deviceService.getDeviceId(), n = I.web, { challenge_id: o, publicKey: d } = await this.userAPI.addUserPasskeyStart({
+    const s = this.deviceService.getDeviceId(), o = b.web, { challenge_id: n, publicKey: d } = await this.userAPI.addUserPasskeyStart({
       relyingPartyId: e || window?.location?.hostname,
-      deviceId: r,
-      os: n,
-      passkeyDisplayName: s,
+      deviceId: s,
+      os: o,
+      passkeyDisplayName: r,
       passkeyUsername: t
     });
     d.user.id = btoa(d.user.id);
-    const c = await K({ optionsJSON: d });
-    return await this.userAPI.addUserPasskeyComplete(c, r, o);
+    const h = await K({ optionsJSON: d });
+    return await this.userAPI.addUserPasskeyComplete(h, s, n);
   }
 }
 const O = class O {
   constructor(e) {
     this.doRefreshTokens = !1, this.origin = window.location.origin, this.session = async ({
-      createSession: n,
-      expiredSession: o,
+      createSession: o,
+      expiredSession: n,
       doRefresh: d = !1
     }) => {
-      this.createSessionCallback = n, this.expiredSessionCallback = o, this.doRefreshTokens = d, await this.submitSessionCheck();
+      this.createSessionCallback = o, this.expiredSessionCallback = n, this.doRefreshTokens = d, await this.submitSessionCheck();
     };
-    const { url: t, appId: s, scopes: r } = e;
-    this.url = t || G, this.appId = s, this.storageManager = new $({
+    const { url: t, appId: r, scopes: s } = e;
+    this.url = t || V, this.appId = r, this.storageManager = new $({
       prefix: e.keyStoragePrefix ?? ""
-    }), this.deviceService = new B(this.storageManager), this.authApi = new fe(e, this.storageManager, this.deviceService), this.appApi = new pe(e, this.storageManager, this.deviceService), this.userApi = new Se(e, this.storageManager, this.deviceService), this.settingApi = new ye(e, this.storageManager, this.deviceService), this.tenantApi = new ve(e, this.storageManager, this.deviceService), this.invitationApi = new ke(e, this.storageManager, this.deviceService), this.twoFactorApi = new me(e, this.storageManager, this.deviceService), this.subscribeStore = new we(), this.tokenCacheService = new De(this.storageManager, this.authApi, this.subscribeStore), this.scopes = r ?? Q, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ie(
+    }), this.deviceService = new B(this.storageManager), this.authApi = new fe(e, this.storageManager, this.deviceService), this.appApi = new pe(e, this.storageManager, this.deviceService), this.userApi = new Se(e, this.storageManager, this.deviceService), this.settingApi = new ve(e, this.storageManager, this.deviceService), this.tenantApi = new ye(e, this.storageManager, this.deviceService), this.invitationApi = new ke(e, this.storageManager, this.deviceService), this.twoFactorApi = new me(e, this.storageManager, this.deviceService), this.subscribeStore = new we(), this.tokenCacheService = new Fe(this.storageManager, this.authApi, this.subscribeStore), this.scopes = s ?? Q, this.createTenantForNewUser = e.createTenantForNewUser ?? !1, this.authService = new Ie(
       this.authApi,
       this.deviceService,
       this.storageManager,
@@ -2841,7 +3066,7 @@ const O = class O {
       },
       this.appId ?? "",
       e.tokenExchange
-    ), this.userService = new Fe(this.userApi, this.deviceService), this.tenantService = new Pe(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new be(this.invitationApi), this.twoFactorService = new Me(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
+    ), this.userService = new Pe(this.userApi, this.deviceService), this.tenantService = new Me(this.tenantApi, this.scopes), this.tenant = this.tenantService, this.invitationService = new be(this.invitationApi), this.twoFactorService = new De(this.twoFactorApi, this.subscribeStore), this.twoFactor = this.twoFactorService, e.parseQueryParams && this.checkAndSetTokens(), this.setTokensToCacheFromLocalStorage();
   }
   /**
    * Update the appId and propagate it to all API clients.
@@ -2862,12 +3087,12 @@ const O = class O {
     let e, t;
     try {
       e = await this.authService.getTokens(this.doRefreshTokens), t = this.tokenCacheService.getParsedTokens();
-    } catch (s) {
-      const r = {
-        message: s instanceof Error || s instanceof u ? s.message : "Session check failed",
-        originalError: s
+    } catch (r) {
+      const s = {
+        message: r instanceof Error || r instanceof u ? r.message : "Session check failed",
+        originalError: r
       };
-      this.subscribeStore.notify(a.Error, r), e = void 0;
+      this.subscribeStore.notify(a.Error, s), e = void 0;
     }
     e && this.createSessionCallback && await this.createSessionCallback({ tokens: e, parsedTokens: t }), !e && this.expiredSessionCallback && await this.expiredSessionCallback();
   }
@@ -2942,50 +3167,50 @@ const O = class O {
   checkAndSetTokens() {
     let e = new URLSearchParams(window.location.search), t = !1;
     if (!e.get("access_token") && window.location.hash) {
-      const c = new URLSearchParams(window.location.hash.substring(1));
-      c.get("access_token") && (e = c, t = !0);
+      const h = new URLSearchParams(window.location.hash.substring(1));
+      h.get("access_token") && (e = h, t = !0);
     }
-    const s = e.get("access_token"), r = e.get("refresh_token"), n = e.get("id_token"), o = e.get("scopes")?.split(",") ?? this.scopes;
+    const r = e.get("access_token"), s = e.get("refresh_token"), o = e.get("id_token"), n = e.get("scopes")?.split(",") ?? this.scopes;
     let d;
-    if (s) {
-      if (!M(s)) {
-        const c = {
+    if (r) {
+      if (!D(r)) {
+        const h = {
           message: "Invalid access token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, c), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
         return;
       }
-      if (r && !M(r)) {
-        const c = {
+      if (s && !D(s)) {
+        const h = {
           message: "Invalid refresh token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, c), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
         return;
       }
-      if (n && !M(n)) {
-        const c = {
+      if (o && !D(o)) {
+        const h = {
           message: "Invalid ID token format received",
           code: "INVALID_TOKEN_FORMAT"
         };
-        this.subscribeStore.notify(a.Error, c), this.cleanupUrlParams(t);
+        this.subscribeStore.notify(a.Error, h), this.cleanupUrlParams(t);
         return;
       }
       return d = {
-        access_token: s,
-        refresh_token: r ?? void 0,
-        id_token: n ?? void 0,
-        scopes: o
-      }, this.storageManager.saveTokens(d), this.tokenCacheService.setTokensCache(d), this.subscribeStore.notify(a.SignIn, { tokens: d, parsedTokens: this.getParsedTokens() }), this.submitSessionCheck(), this.cleanupUrlParams(t), this.error = void 0, d;
+        access_token: r,
+        refresh_token: s ?? void 0,
+        id_token: o ?? void 0,
+        scopes: n
+      }, this.storageManager.clearDeliveryMode(), this.storageManager.saveTokens(d), this.tokenCacheService.setTokensCache(d), this.subscribeStore.notify(a.SignIn, { tokens: d, parsedTokens: this.getParsedTokens() }), this.submitSessionCheck(), this.cleanupUrlParams(t), this.error = void 0, d;
     } else
       this.error = this.checkErrorsFromURL();
   }
   checkErrorsFromURL() {
     const t = new URLSearchParams(window.location.search).get("error");
     if (t) {
-      const s = Te(t);
-      return new Error(s);
+      const r = Te(t);
+      return new Error(r);
     }
   }
   cleanupUrlParams(e = !1) {
@@ -2997,7 +3222,19 @@ const O = class O {
     }
   }
   setTokensToCacheFromLocalStorage() {
-    const e = this.storageManager.getTokens();
+    let e = this.storageManager.getTokens();
+    if (!e?.access_token && this.storageManager.getDeliveryMode()) {
+      if (e?.id_token && this.storageManager.hasCookieModeIdToken()) {
+        this.tokenCacheService.setTokensCache(e);
+        return;
+      }
+      if (this.storageManager.hasJsonModeTokens())
+        this.storageManager.clearDeliveryMode(), e = this.storageManager.getTokens();
+      else {
+        this.storageManager.deleteTokens();
+        return;
+      }
+    }
     e && this.tokenCacheService.setTokensCache(e);
   }
   /**
@@ -3195,12 +3432,12 @@ const O = class O {
    * @throws The original error after handling
    */
   handleError(e, t) {
-    const s = {
+    const r = {
       message: e instanceof Error ? e.message : `${t} failed`,
       originalError: e,
       code: e instanceof u ? e.id : void 0
     };
-    throw this.subscribeStore.notify(a.Error, s), e;
+    throw this.subscribeStore.notify(a.Error, r), e;
   }
   /**
    * Sign out the current user and clear all tokens.
@@ -3611,8 +3848,8 @@ const O = class O {
   async renameUserPasskey(e, t) {
     try {
       return await this.userService.renameUserPasskey(e, t);
-    } catch (s) {
-      this.handleError(s, "Rename user passkey");
+    } catch (r) {
+      this.handleError(r, "Rename user passkey");
     }
   }
   /**
@@ -3672,10 +3909,10 @@ const O = class O {
    */
   async joinInvitation(e, t) {
     try {
-      const s = await this.tenant.joinInvitation(e, t);
-      return s.scopes = t ?? this.scopes, this.storageManager.saveTokens(s), this.tokenCacheService.setTokensCache(s), s;
-    } catch (s) {
-      this.handleError(s, "Join invitation");
+      const r = await this.tenant.joinInvitation(e, t);
+      return r.scopes = t ?? this.scopes, this.storageManager.saveTokens(r), this.tokenCacheService.setTokensCache(r), r;
+    } catch (r) {
+      this.handleError(r, "Join invitation");
     }
   }
   /**
@@ -3686,10 +3923,10 @@ const O = class O {
    */
   async createTenant(e, t) {
     try {
-      const s = await this.tenant.createTenant(e);
-      return t && await this.refreshToken(), s;
-    } catch (s) {
-      this.handleError(s, "Create tenant");
+      const r = await this.tenant.createTenant(e);
+      return t && await this.refreshToken(), r;
+    } catch (r) {
+      this.handleError(r, "Create tenant");
     }
   }
   // Invitation methods delegated to InvitationService
@@ -4163,15 +4400,15 @@ class l extends Error {
   /**
    * Create an M2MError from an OAuth 2.0 error response
    */
-  static fromOAuthError(e, t, s) {
-    const r = s ? l.parseRateLimitHeaders(s) : void 0;
+  static fromOAuthError(e, t, r) {
+    const s = r ? l.parseRateLimitHeaders(r) : void 0;
     return new l({
       code: e.error,
       message: e.error_description ?? l.getDefaultMessage(e.error),
       status: t,
       errorUri: e.error_uri,
-      rateLimitInfo: r,
-      headers: s
+      rateLimitInfo: s,
+      headers: r
     });
   }
   /**
@@ -4189,12 +4426,12 @@ class l extends Error {
    * Parse rate limit headers from response
    */
   static parseRateLimitHeaders(e) {
-    const t = e["x-ratelimit-limit"], s = e["x-ratelimit-remaining"], r = e["x-ratelimit-reset"] || e["retry-after"];
-    if (t && s && r)
+    const t = e["x-ratelimit-limit"], r = e["x-ratelimit-remaining"], s = e["x-ratelimit-reset"] || e["retry-after"];
+    if (t && r && s)
       return {
         limit: parseInt(t, 10),
-        remaining: parseInt(s, 10),
-        reset: parseInt(r, 10)
+        remaining: parseInt(r, 10),
+        reset: parseInt(s, 10)
       };
   }
   /**
@@ -4261,7 +4498,7 @@ class N extends l {
     }), this.name = "M2MNetworkError";
   }
 }
-class P extends l {
+class M extends l {
   constructor(e, t) {
     super({
       code: "invalid_request",
@@ -4280,7 +4517,7 @@ class U extends l {
     }), this.name = "M2MConfigError";
   }
 }
-const Ge = {
+const Ve = {
   InvalidRequest: "invalid_request",
   InvalidClient: "invalid_client",
   InvalidGrant: "invalid_grant",
@@ -4290,7 +4527,7 @@ const Ge = {
   RateLimitExceeded: "rate_limit_exceeded",
   ServerError: "server_error",
   TemporarilyUnavailable: "temporarily_unavailable"
-}, S = {
+}, w = {
   /** Default token endpoint path */
   TOKEN_ENDPOINT: "/oauth2/token",
   /** Default request timeout in milliseconds */
@@ -4312,10 +4549,10 @@ class xe {
     const t = this.cache.get(e);
     return t ? Date.now() >= t.expiresAt ? (this.cache.delete(e), Promise.resolve(null)) : Promise.resolve(t.token) : Promise.resolve(null);
   }
-  set(e, t, s) {
+  set(e, t, r) {
     return this.cache.set(e, {
       token: t,
-      expiresAt: Date.now() + s * 1e3
+      expiresAt: Date.now() + r * 1e3
     }), Promise.resolve();
   }
   delete(e) {
@@ -4330,7 +4567,7 @@ const Ue = {
     return Math.pow(2, i - 1) * 1e3;
   }
 };
-class Ve {
+class Ge {
   /**
    * Create a new M2M client
    *
@@ -4361,23 +4598,23 @@ class Ve {
       scopes: e.scopes,
       audience: e.audience,
       autoRefresh: e.autoRefresh ?? !1,
-      refreshThreshold: e.refreshThreshold ?? S.REFRESH_THRESHOLD,
-      timeout: e.timeout ?? S.TIMEOUT,
-      retries: e.retries ?? S.RETRIES,
-      retryDelay: e.retryDelay ?? S.RETRY_DELAY,
+      refreshThreshold: e.refreshThreshold ?? w.REFRESH_THRESHOLD,
+      timeout: e.timeout ?? w.TIMEOUT,
+      retries: e.retries ?? w.RETRIES,
+      retryDelay: e.retryDelay ?? w.RETRY_DELAY,
       retryStrategy: e.retryStrategy,
       cache: e.cache,
       onTokenRequest: e.onTokenRequest,
       onTokenResponse: e.onTokenResponse,
       onError: e.onError
-    }, this.cache = e.cache ?? new xe(), this.retryStrategy = e.retryStrategy ?? Ue, this.tokenEndpoint = `${t}${S.TOKEN_ENDPOINT}`;
+    }, this.cache = e.cache ?? new xe(), this.retryStrategy = e.retryStrategy ?? Ue, this.tokenEndpoint = `${t}${w.TOKEN_ENDPOINT}`;
   }
   /**
    * Get the cache key for this client
    */
   getCacheKey(e, t) {
-    const s = e?.sort().join(",") || "", r = t?.sort().join(",") || "";
-    return `m2m:${this.config.clientId}:${s}:${r}`;
+    const r = e?.sort().join(",") || "", s = t?.sort().join(",") || "";
+    return `m2m:${this.config.clientId}:${r}:${s}`;
   }
   /**
    * Request an access token from the authorization server
@@ -4399,13 +4636,13 @@ class Ve {
    * ```
    */
   async getToken(e) {
-    const t = e?.scopes ?? this.config.scopes, s = e?.audience ?? this.config.audience, r = this.getCacheKey(t, s);
+    const t = e?.scopes ?? this.config.scopes, r = e?.audience ?? this.config.audience, s = this.getCacheKey(t, r);
     if (!e?.forceRefresh) {
-      const n = await this.cache.get(r);
-      if (n && !this.isTokenExpired(n))
-        return n;
+      const o = await this.cache.get(s);
+      if (o && !this.isTokenExpired(o))
+        return o;
     }
-    return this.requestToken(t, s, r);
+    return this.requestToken(t, r, s);
   }
   /**
    * Get a valid token, automatically refreshing if needed
@@ -4423,32 +4660,32 @@ class Ve {
    * ```
    */
   async getValidToken() {
-    const e = this.config.scopes, t = this.config.audience, s = this.getCacheKey(e, t), r = await this.cache.get(s);
-    if (r) {
-      if (this.config.autoRefresh && this.isTokenExpired(r, this.config.refreshThreshold))
-        return this.requestToken(e, t, s);
-      if (!this.isTokenExpired(r))
-        return r;
+    const e = this.config.scopes, t = this.config.audience, r = this.getCacheKey(e, t), s = await this.cache.get(r);
+    if (s) {
+      if (this.config.autoRefresh && this.isTokenExpired(s, this.config.refreshThreshold))
+        return this.requestToken(e, t, r);
+      if (!this.isTokenExpired(s))
+        return s;
     }
-    return this.requestToken(e, t, s);
+    return this.requestToken(e, t, r);
   }
   /**
    * Request a new token from the authorization server
    */
-  async requestToken(e, t, s) {
-    const r = {
+  async requestToken(e, t, r) {
+    const s = {
       grant_type: "client_credentials",
       client_id: this.config.clientId,
       client_secret: this.config.clientSecret
     };
-    e && e.length > 0 && (r.scope = e.join(" ")), t && t.length > 0 && (r.audience = t.join(" ")), this.config.onTokenRequest && this.config.onTokenRequest({
+    e && e.length > 0 && (s.scope = e.join(" ")), t && t.length > 0 && (s.audience = t.join(" ")), this.config.onTokenRequest && this.config.onTokenRequest({
       clientId: this.config.clientId,
       scopes: e ?? [],
       audience: t ?? [],
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
-    const n = await this.executeWithRetry(() => this.doTokenRequest(r));
-    return n.issued_at = Math.floor(Date.now() / 1e3), s && await this.cache.set(s, n, n.expires_in), this.config.onTokenResponse && this.config.onTokenResponse(n), n;
+    const o = await this.executeWithRetry(() => this.doTokenRequest(s));
+    return o.issued_at = Math.floor(Date.now() / 1e3), r && await this.cache.set(r, o, o.expires_in), this.config.onTokenResponse && this.config.onTokenResponse(o), o;
   }
   /**
    * Execute the actual HTTP request to the token endpoint
@@ -4456,41 +4693,41 @@ class Ve {
   async doTokenRequest(e) {
     const t = new URLSearchParams();
     t.append("grant_type", e.grant_type), t.append("client_id", e.client_id), t.append("client_secret", e.client_secret), e.scope && t.append("scope", e.scope), e.audience && t.append("audience", e.audience);
-    const s = new AbortController(), r = setTimeout(() => s.abort(), this.config.timeout);
+    const r = new AbortController(), s = setTimeout(() => r.abort(), this.config.timeout);
     try {
-      const n = await fetch(this.tokenEndpoint, {
+      const o = await fetch(this.tokenEndpoint, {
         method: "POST",
         headers: {
-          "Content-Type": S.CONTENT_TYPE,
+          "Content-Type": w.CONTENT_TYPE,
           Accept: "application/json"
         },
         body: t.toString(),
-        signal: s.signal
+        signal: r.signal
       });
-      clearTimeout(r);
-      const o = {};
-      n.headers.forEach((c, g) => {
-        o[g.toLowerCase()] = c;
+      clearTimeout(s);
+      const n = {};
+      o.headers.forEach((h, g) => {
+        n[g.toLowerCase()] = h;
       });
-      const d = await n.json();
-      if (!n.ok) {
-        const c = l.fromOAuthError(
+      const d = await o.json();
+      if (!o.ok) {
+        const h = l.fromOAuthError(
           {
             error: d.error || "server_error",
             error_description: d.error_description || d.message,
             error_uri: d.error_uri
           },
-          n.status,
-          o
+          o.status,
+          n
         );
         throw this.config.onError && this.config.onError({
-          error: c.code,
-          error_description: c.message
-        }), c;
+          error: h.code,
+          error_description: h.message
+        }), h;
       }
       return d;
-    } catch (n) {
-      throw clearTimeout(r), n instanceof Error && n.name === "AbortError" ? new N(`Request timed out after ${this.config.timeout}ms`) : n instanceof TypeError && n.message.includes("fetch") ? new N(`Network error: ${n.message}`, n) : n instanceof l ? n : l.fromError(n instanceof Error ? n : new Error(String(n)));
+    } catch (o) {
+      throw clearTimeout(s), o instanceof Error && o.name === "AbortError" ? new N(`Request timed out after ${this.config.timeout}ms`) : o instanceof TypeError && o.message.includes("fetch") ? new N(`Network error: ${o.message}`, o) : o instanceof l ? o : l.fromError(o instanceof Error ? o : new Error(String(o)));
     }
   }
   /**
@@ -4498,18 +4735,18 @@ class Ve {
    */
   async executeWithRetry(e) {
     let t;
-    for (let s = 1; s <= this.config.retries; s++)
+    for (let r = 1; r <= this.config.retries; r++)
       try {
         return await e();
-      } catch (r) {
-        if (!(r instanceof l))
-          throw r;
-        if (t = r, s < this.config.retries && this.retryStrategy.shouldRetry({ code: r.code, status: r.status }, s)) {
-          const n = this.retryStrategy.getDelay(s);
-          await this.sleep(n);
+      } catch (s) {
+        if (!(s instanceof l))
+          throw s;
+        if (t = s, r < this.config.retries && this.retryStrategy.shouldRetry({ code: s.code, status: s.status }, r)) {
+          const o = this.retryStrategy.getDelay(r);
+          await this.sleep(o);
           continue;
         }
-        throw r;
+        throw s;
       }
     throw t ?? new l({ code: "server_error", message: "Request failed after retries" });
   }
@@ -4563,8 +4800,8 @@ class Ve {
    */
   isTokenExpired(e, t = 0) {
     if (!e) return !0;
-    const s = Math.floor(Date.now() / 1e3), n = (e.issued_at ?? s - e.expires_in) + e.expires_in;
-    return s >= n - t;
+    const r = Math.floor(Date.now() / 1e3), o = (e.issued_at ?? r - e.expires_in) + e.expires_in;
+    return r >= o - t;
   }
   /**
    * Parse token claims from a JWT access token
@@ -4585,14 +4822,14 @@ class Ve {
     try {
       const t = e.split(".");
       if (t.length !== 3)
-        throw new P("Invalid JWT format: expected 3 parts");
-      const s = t[1];
-      if (!s)
-        throw new P("Invalid JWT format: missing payload");
-      const r = atob(s.replace(/-/g, "+").replace(/_/g, "/")), n = JSON.parse(r);
-      return n.scopes && typeof n.scopes == "string" ? n.scopes = n.scopes.split(" ") : n.scopes || (n.scopes = []), n;
+        throw new M("Invalid JWT format: expected 3 parts");
+      const r = t[1];
+      if (!r)
+        throw new M("Invalid JWT format: missing payload");
+      const s = atob(r.replace(/-/g, "+").replace(/_/g, "/")), o = JSON.parse(s);
+      return o.scopes && typeof o.scopes == "string" ? o.scopes = o.scopes.split(" ") : o.scopes || (o.scopes = []), o;
     } catch (t) {
-      throw t instanceof P ? t : new P(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
+      throw t instanceof M ? t : new M(`Failed to parse token: ${t instanceof Error ? t.message : "Unknown error"}`);
     }
   }
   /**
@@ -4627,29 +4864,29 @@ class Ve {
     const e = this.getCachedToken();
     if (!e)
       return;
-    const t = `${this.config.url}/oauth2/revoke`, s = new URLSearchParams();
-    s.append("token", e.access_token), s.append("client_id", this.config.clientId), s.append("client_secret", this.config.clientSecret);
+    const t = `${this.config.url}/oauth2/revoke`, r = new URLSearchParams();
+    r.append("token", e.access_token), r.append("client_id", this.config.clientId), r.append("client_secret", this.config.clientSecret);
     try {
-      const r = await fetch(t, {
+      const s = await fetch(t, {
         method: "POST",
         headers: {
-          "Content-Type": S.CONTENT_TYPE
+          "Content-Type": w.CONTENT_TYPE
         },
-        body: s.toString()
+        body: r.toString()
       });
-      if (!r.ok && r.status !== 200) {
-        const n = await r.json().catch(() => ({}));
+      if (!s.ok && s.status !== 200) {
+        const o = await s.json().catch(() => ({}));
         throw l.fromOAuthError(
           {
-            error: n.error || "server_error",
-            error_description: n.error_description || "Token revocation failed"
+            error: o.error || "server_error",
+            error_description: o.error_description || "Token revocation failed"
           },
-          r.status
+          s.status
         );
       }
       this.clearCache();
-    } catch (r) {
-      throw r instanceof l ? r : l.fromError(r instanceof Error ? r : new Error(String(r)));
+    } catch (s) {
+      throw s instanceof l ? s : l.fromError(s instanceof Error ? s : new Error(String(s)));
     }
   }
   /**
@@ -4679,7 +4916,7 @@ class Ve {
 }
 export {
   C as APP_ID_HEADER_KEY,
-  _ as AUTHORIZATION_HEADER_KEY,
+  I as AUTHORIZATION_HEADER_KEY,
   pe as AppAPI,
   fe as AuthAPI,
   Ie as AuthService,
@@ -4687,54 +4924,54 @@ export {
   Q as DEFAULT_SCOPES,
   W as DEVICE_ID_HEADER_KEY,
   J as DEVICE_TYPE_HEADER_KEY,
-  oe as ERROR_MESSAGE_MAX_LENGTH,
+  ne as ERROR_MESSAGE_MAX_LENGTH,
   ke as InvitationAPI,
   be as InvitationService,
-  Ve as M2MClient,
+  Ge as M2MClient,
   U as M2MConfigError,
   l as M2MError,
-  Ge as M2MErrorCodes,
+  Ve as M2MErrorCodes,
   N as M2MNetworkError,
-  P as M2MTokenParseError,
-  S as M2M_DEFAULTS,
+  M as M2MTokenParseError,
+  w as M2M_DEFAULTS,
   Ne as MINIMAL_DEFAULT_SCOPES,
-  I as OS,
-  G as PASSFLOW_CLOUD_URL,
+  b as OS,
+  V as PASSFLOW_CLOUD_URL,
   te as POPUP_HEIGHT,
-  se as POPUP_POLL_INTERVAL_MS,
-  re as POPUP_TIMEOUT_MS,
+  re as POPUP_POLL_INTERVAL_MS,
+  se as POPUP_TIMEOUT_MS,
   ee as POPUP_WIDTH,
   L as Passflow,
-  w as PassflowAdminEndpointPaths,
-  h as PassflowEndpointPaths,
+  T as PassflowAdminEndpointPaths,
+  c as PassflowEndpointPaths,
   u as PassflowError,
   a as PassflowEvent,
   de as Providers,
   E as RequestMethod,
   Z as SDK_VERSION,
   q as SessionState,
-  ye as SettingAPI,
-  V as TOKEN_EXPIRY_BUFFER_SECONDS,
-  ve as TenantAPI,
-  Pe as TenantService,
+  ve as SettingAPI,
+  G as TOKEN_EXPIRY_BUFFER_SECONDS,
+  ye as TenantAPI,
+  Me as TenantService,
   Re as TenantUserMembership,
-  De as TokenCacheService,
-  v as TokenDeliveryMode,
-  k as TokenType,
+  Fe as TokenCacheService,
+  y as TokenDeliveryMode,
+  p as TokenType,
   me as TwoFactorApiClient,
   ue as TwoFactorPolicy,
-  Me as TwoFactorService,
-  ne as USERNAME_MAX_LENGTH,
+  De as TwoFactorService,
+  oe as USERNAME_MAX_LENGTH,
   ie as USERNAME_MIN_LENGTH,
   Se as UserAPI,
-  Fe as UserService,
-  m as isTokenExpired,
-  F as isValidEmail,
-  M as isValidJWTFormat,
+  Pe as UserService,
+  S as isTokenExpired,
+  P as isValidEmail,
+  D as isValidJWTFormat,
   x as isValidPhoneNumber,
-  Ee as isValidUsername,
-  y as parseToken,
-  A as pathWithParams,
+  _e as isValidUsername,
+  v as parseToken,
+  m as pathWithParams,
   Te as sanitizeErrorMessage
 };
 //# sourceMappingURL=index.mjs.map