@passflow/core 0.21.0 → 0.21.1

package/dist/index.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,s)=>(s=n==null?{}:e(i(n)),o(r||!n||!n.__esModule||!a.call(n,`default`)?t(s,`default`,{value:n,enumerable:!0}):s,n));let c=require("axios");c=s(c,1);let l=require("@simplewebauthn/browser");var u=`0.21.0`,d=`X-Passflow-Clientid`,f=`Authorization`,p=`X-Passflow-DeviceId`,m=`X-Passflow-DeviceType`,h=u,g=[`id`,`offline`,`openid`],_=[`id`,`offline`,`tenant`,`email`,`oidc`,`openid`,`access:tenant:all`],v=`https://auth.passflow.cloud`,y=`default`,b=500,x=600,ee=100,S=6e4,C=30,w=3,T=30,E=200,D=[];for(let e=0;e<256;++e)D.push((e+256).toString(16).slice(1));function te(e,t=0){return(D[e[t+0]]+D[e[t+1]]+D[e[t+2]]+D[e[t+3]]+`-`+D[e[t+4]]+D[e[t+5]]+`-`+D[e[t+6]]+D[e[t+7]]+`-`+D[e[t+8]]+D[e[t+9]]+`-`+D[e[t+10]]+D[e[t+11]]+D[e[t+12]]+D[e[t+13]]+D[e[t+14]]+D[e[t+15]]).toLowerCase()}var O=new Uint8Array(16);function ne(){return crypto.getRandomValues(O)}function re(e,t,n){return!t&&!e&&crypto.randomUUID?crypto.randomUUID():ie(e,t,n)}function ie(e,t,n){e=e||{};let r=e.random??e.rng?.()??ne();if(r.length<16)throw Error(`Random bytes length must be >= 16`);if(r[6]=r[6]&15|64,r[8]=r[8]&63|128,t){if(n=n||0,n<0||n+16>t.length)throw RangeError(`UUID byte range ${n}:${n+15} is out of buffer bounds`);for(let e=0;e<16;++e)t[n+e]=r[e];return t}return te(r)}var ae=e=>{let t=[],n;for(n in e){let r=e[n];if(r===void 0)continue;let i={tenant:{id:r.tenant_id,name:r.tenant_name}};i.groups=r.groups?Object.keys(r.groups).map(e=>{let t=r.groups[e]||[];return{group:{id:e,name:r.group_names?.[e]??`unknown`},roles:t}}):[],i.tenantRoles=i.groups?.find(e=>e.group.id===r.root_group_id),t.push(i)}return{raw:e,tenants:t}};function oe(e){if(typeof window<`u`&&typeof window.atob==`function`)return window.atob(e);if(typeof Buffer<`u`)return Buffer.from(e,`base64`).toString(`utf-8`);throw Error(`No Base64 decoding method available in this environment`)}var k=class{constructor(e){this.storageManager=e}isTokenTypeExpired(e){let t=this.storageManager.getToken(e);if(!t)return!0;let n=j(t);return!n||A(n)}parseTokenType(e){let t=this.storageManager.getToken(e);if(t)return j(t)}};function A(e,t=30){return Math.floor(Date.now()/1e3)+t>e.exp}function j(e){let t=e.split(`.`)[1];if(!t)throw Error(`Invalid token string`);let n=t.replace(/-/g,`+`).replace(/_/g,`/`),r=oe(n+`=`.repeat((4-n.length%4)%4)),i=decodeURIComponent(r.split(``).map(e=>`%`+(`00`+e.charCodeAt(0).toString(16)).slice(-2)).join(``)),a=JSON.parse(i);return a.membership=a.passflow_tm&&a.type!==`invite`?ae(a.passflow_tm):void 0,a}var M=function(e){return e.id_token=`id_token`,e.access_token=`access`,e.refresh_token=`refresh`,e.invite_token=`invite`,e.reset_token=`reset`,e.web_cookie=`web-cookie`,e.management=`management`,e.signin=`signin`,e.actor=`actor`,e.two_factor=`2fa`,e}({}),N=function(e){return e.JsonBody=`json_body`,e.Cookie=`cookie`,e.Mobile=`mobile`,e.BFF=`bff`,e}({}),se=function(e){return e.Unknown=`unknown`,e.Valid=`valid`,e.Invalid=`invalid`,e}({}),ce=class{constructor(e){this.storageManager=e,this.mode=`json_body`,this.sessionState=`unknown`,this.isInitializedFlag=!1,this.STORAGE_PREFIX=`passflow_`,this.DELIVERY_MODE_KEY=`${this.STORAGE_PREFIX}delivery_mode`,this.SESSION_STATE_KEY=`${this.STORAGE_PREFIX}session_state`,this.loadPersistedMode(),this.loadPersistedSessionState()}setMode(e){this.mode=e,this.isInitializedFlag=!0,this.persistMode()}getMode(){return this.mode}isCookieMode(){return this.mode===`cookie`}isJsonMode(){return this.mode===`json_body`}isMobileMode(){return this.mode===`mobile`}isBFFMode(){return this.mode===`bff`}isInitialized(){return this.isInitializedFlag}setSessionValid(){this.sessionState=`valid`,this.persistSessionState()}setSessionInvalid(){this.sessionState=`invalid`,this.persistSessionState()}setSessionUnknown(){this.sessionState=`unknown`,this.persistSessionState()}isSessionValid(){return this.sessionState===`valid`}isSessionUnknown(){return this.sessionState===`unknown`}isSessionInvalid(){return this.sessionState===`invalid`}getSessionState(){return this.sessionState}reset(){this.mode=`json_body`,this.sessionState=`unknown`,this.isInitializedFlag=!1,this.clearPersistedMode(),this.clearPersistedSessionState()}loadPersistedMode(){try{let e=this.storageManager.storage.getItem(this.DELIVERY_MODE_KEY);e&&Object.values(N).includes(e)&&(this.mode=e,this.isInitializedFlag=!0)}catch{}}loadPersistedSessionState(){try{let e=this.storageManager.storage.getItem(this.SESSION_STATE_KEY);e&&Object.values(se).includes(e)&&(this.sessionState=e)}catch{}}persistMode(){try{this.storageManager.storage.setItem(this.DELIVERY_MODE_KEY,this.mode)}catch{}}persistSessionState(){try{this.storageManager.storage.setItem(this.SESSION_STATE_KEY,this.sessionState)}catch{}}clearPersistedMode(){try{this.storageManager.storage.removeItem(this.DELIVERY_MODE_KEY)}catch{}}clearPersistedSessionState(){try{this.storageManager.storage.removeItem(this.SESSION_STATE_KEY)}catch{}}},P=class{constructor({storage:e,prefix:t}={}){this.keyStoragePrefix=``,this.scopes=`${this.keyStoragePrefix}tokens_scopes`,this.deviceId=`${this.keyStoragePrefix}passflowDeviceId`,this.invitationToken=`${this.keyStoragePrefix}passflowInvitationToken`,this.previousRedirectUrl=`${this.keyStoragePrefix}passflowPreviousRedirectUrl`,this.STORAGE_PREFIX=`passflow_`,this.ID_TOKEN_KEY=`${this.STORAGE_PREFIX}id_token`,this.CSRF_TOKEN_KEY=`${this.STORAGE_PREFIX}csrf_token`,this.DELIVERY_MODE_KEY=`${this.STORAGE_PREFIX}delivery_mode`,this.storage=e??localStorage,this.keyStoragePrefix=t?`${t}_`:``}saveTokens(e,t){let{id_token:n,access_token:r,refresh_token:i,scopes:a}=e;t===N.Cookie||t===N.BFF?n&&this.storage.setItem(this.ID_TOKEN_KEY,n):(n&&this.storage.setItem(this.getKeyForTokenType(M.id_token),n),r&&this.storage.setItem(this.getKeyForTokenType(M.access_token),r),i&&this.storage.setItem(this.getKeyForTokenType(M.refresh_token),i),a&&this.storage.setItem(this.scopes,a.join(`,`)))}getToken(e){let t=this.getKeyForTokenType(e);return this.storage.getItem(t)??void 0}getTokens(){let e=this.getDeliveryMode();if(e===N.Cookie||e===N.BFF){let e=this.storage.getItem(this.ID_TOKEN_KEY);return e?{id_token:e}:void 0}let t=this.storage.getItem(this.getKeyForTokenType(M.access_token));if(t)return{access_token:t,id_token:this.storage.getItem(this.getKeyForTokenType(M.id_token))??void 0,refresh_token:this.storage.getItem(this.getKeyForTokenType(M.refresh_token))??void 0,scopes:this.storage.getItem(this.scopes)?.split(`,`)??void 0}}getScopes(){return this.storage.getItem(this.scopes)?.split(`,`)??void 0}hasJsonModeTokens(){return!!this.storage.getItem(this.getKeyForTokenType(M.access_token))}hasCookieModeIdToken(){return!!this.storage.getItem(this.ID_TOKEN_KEY)}deleteToken(e){let t=this.getKeyForTokenType(e);this.storage.removeItem(t)}deleteTokens(){this.storage.removeItem(this.getKeyForTokenType(M.id_token)),this.storage.removeItem(this.getKeyForTokenType(M.access_token)),this.storage.removeItem(this.getKeyForTokenType(M.refresh_token)),this.storage.removeItem(this.scopes),this.clearIdToken(),this.clearDeliveryMode(),this.clearCsrfToken()}getDeviceId(){return this.storage.getItem(this.deviceId)??void 0}setDeviceId(e){this.storage.setItem(this.deviceId,e)}deleteDeviceId(){this.storage.removeItem(this.deviceId)}setInvitationToken(e){this.storage.setItem(this.invitationToken,e)}getInvitationToken(){return this.storage.getItem(this.invitationToken)??void 0}deleteInvitationToken(){this.storage.removeItem(this.invitationToken)}setPreviousRedirectUrl(e){this.storage.setItem(this.previousRedirectUrl,e)}getPreviousRedirectUrl(){return this.storage.getItem(this.previousRedirectUrl)??void 0}deletePreviousRedirectUrl(){this.storage.removeItem(this.previousRedirectUrl)}setDeliveryMode(e){try{this.storage.setItem(this.DELIVERY_MODE_KEY,e)}catch{}}getDeliveryMode(){try{let e=this.storage.getItem(this.DELIVERY_MODE_KEY);if(e&&Object.values(N).includes(e))return e}catch{}}clearDeliveryMode(){try{this.storage.removeItem(this.DELIVERY_MODE_KEY)}catch{}}getIdToken(){try{return this.storage.getItem(this.ID_TOKEN_KEY)??void 0}catch{return}}setIdToken(e){try{this.storage.setItem(this.ID_TOKEN_KEY,e)}catch{}}clearIdToken(){try{this.storage.removeItem(this.ID_TOKEN_KEY)}catch{}}getCsrfToken(){try{return this.storage.getItem(this.CSRF_TOKEN_KEY)??void 0}catch{return}}setCsrfToken(e){try{this.storage.setItem(this.CSRF_TOKEN_KEY,e)}catch{}}clearCsrfToken(){try{this.storage.removeItem(this.CSRF_TOKEN_KEY)}catch{}}tokenKeys(){return[this.getKeyForTokenType(M.id_token),this.getKeyForTokenType(M.access_token),this.getKeyForTokenType(M.refresh_token),this.scopes,this.ID_TOKEN_KEY,this.CSRF_TOKEN_KEY,this.DELIVERY_MODE_KEY]}getKeyForTokenType(e){return`${this.keyStoragePrefix}${e}`}},F=class{constructor(e){this.storageManager=e??new P}getDeviceId(){let e=this.storageManager.getDeviceId();if(!e){let e=this.generateUniqueDeviceId();return this.storageManager.setDeviceId(e),e}return e}generateUniqueDeviceId(){return re()}},I=class extends Error{constructor(e=`Authentication popup was closed`){super(e),this.name=`PopupClosedError`}},le=class{constructor(){this.passkeys={startRegistration:e=>(0,l.startRegistration)({optionsJSON:e}),startAuthentication:e=>(0,l.startAuthentication)({optionsJSON:e})}}get storage(){return typeof localStorage>`u`?{getItem:()=>null,setItem:()=>{},removeItem:()=>{}}:localStorage}get storageSharedAcrossTabs(){try{return typeof localStorage<`u`&&localStorage!==null}catch{return!1}}getCurrentUrl(){return typeof window>`u`?null:{href:window.location.href,origin:window.location.origin,pathname:window.location.pathname,search:window.location.search,hash:window.location.hash,hostname:window.location.hostname}}replaceUrl(e){typeof window<`u`&&window.history.replaceState({},document.title,e)}navigateTo(e){typeof window<`u`&&(window.location.href=e)}onForeground(e){if(typeof document>`u`)return()=>{};let t=()=>{document.hidden||e()};return document.addEventListener(`visibilitychange`,t),()=>document.removeEventListener(`visibilitychange`,t)}onBackground(e){if(typeof document>`u`)return()=>{};let t=()=>{document.hidden&&e()};return document.addEventListener(`visibilitychange`,t),()=>document.removeEventListener(`visibilitychange`,t)}onBeforeUnload(e){return typeof window>`u`?()=>{}:(window.addEventListener(`beforeunload`,e),()=>window.removeEventListener(`beforeunload`,e))}isInForeground(){return typeof document>`u`||!document.hidden}openAuthUrl(e,t={}){let n=t.mode??`popup`;if(n===`redirect`)return window.location.href=e,new Promise(()=>{});if(n===`deeplink`)return Promise.reject(Error(`openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.`));let r=t.width??500,i=t.height??600,a=t.expectedReturnOrigin??window.location.origin,o=window.open(e,`_blank`,`width=${r},height=${i}`);return o?new Promise((e,t)=>{let n=Date.now(),r=setInterval(()=>{if(o.closed)clearInterval(r),t(new I);else if(Date.now()-n>6e4)clearInterval(r),o.close(),t(Error(`Authentication popup timed out`));else try{if(o.location.href.startsWith(a)){let t=o.location.search,n=o.location.hash;clearInterval(r),o.close(),e({callbackSearch:t,callbackHash:n})}}catch{}},100)}):(window.location.href=e,new Promise(()=>{}))}btoa(e){return btoa(e)}atob(e){if(typeof window<`u`&&typeof window.atob==`function`)return window.atob(e);if(typeof Buffer<`u`)return Buffer.from(e,`base64`).toString(`utf-8`);throw Error(`No Base64 decoding method available in this environment`)}cookiesSupported(){if(typeof document>`u`)return!1;try{document.cookie=`passflow_test=1; SameSite=Lax`;let e=document.cookie.indexOf(`passflow_test=1`)!==-1;return document.cookie=`passflow_test=; expires=Thu, 01 Jan 1970 00:00:00 UTC`,e}catch{return!1}}getDeviceType(){return`web`}},L=new le,ue=/^[0-9]+$/,de=Object.freeze({unorderable:!1,zero:!1}),R=e=>ue.test(e)?Number.parseInt(e,10):void 0,z=e=>{if(!e)return de;let t=e.split(/\s+/).filter(e=>e!==``);if(t.length===0)return de;let n=[];for(let e of t){let t=R(e);t!==void 0&&n.push(t)}if(n.length===0)return{raw:e,unorderable:!0,zero:!1};let r=Math.min(...n);return r===0?{raw:e,unorderable:!1,zero:!0}:{level:r,raw:e,unorderable:!1,zero:!1}},fe=e=>z(e).level,pe=`insufficient_user_authentication`,me=`upgrade_required`,he=/([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g,ge=e=>e.replace(/\\(.)/g,`$1`),_e=e=>{let t={};he.lastIndex=0;for(let n of e.matchAll(he)){let e=n[1];if(!e)continue;let r=n[2],i=n[3];t[e.toLowerCase()]=r===void 0?i??``:ge(r)}return t},ve=e=>{if(e==null||e===``)return{kind:`absent`};let t=typeof e==`number`?e:Number.parseInt(String(e),10);return Number.isFinite(t)&&t>0?{kind:`valid`,value:t}:{kind:`invalid`,raw:e}},ye=e=>{let t=ve(e);return t.kind===`valid`?t.value:void 0},be=(e,t)=>{if(!e||!/(^|[\s,])Bearer\b/i.test(e))return;let n=_e(e);if(n.error===`insufficient_user_authentication`)return{acrValues:n.acr_values||void 0,maxAge:ye(n.max_age),status:t}},xe=(e,t)=>{if(!e||typeof e!=`object`)return;let n=e;if(n.error===`upgrade_required`)return{acrValues:typeof n.acr_values==`string`&&n.acr_values?n.acr_values:void 0,maxAge:ye(n.max_age),status:t}},Se=(e,t,n)=>({channel:e,acr:z(t.acrValues),maxAge:ve(n),raw:t.acrValues}),Ce=e=>e?_e(e):{},we=(e,t)=>{let{status:n}=e;if(n!==401&&n!==403)return{diagnostics:[]};let r=t?.requireChallengeChannel===`header`,i=e.getHeader(`www-authenticate`),a=be(i,n),o=r?void 0:xe(e.body,n),s=[],c=(e,t)=>{s.push({status:n,url:``,reason:e,...t?{detail:t}:{}})};if(!a&&!o)return r&&c(`header-required-but-absent`,i?{header:i}:void 0),{diagnostics:s};let l=[];if(a&&l.push(Se(`header`,a,Ce(i).max_age)),o){let t=e.body;l.push(Se(`body`,o,t?.max_age))}let u=e=>e;for(let e of l)e.acr.unorderable&&c(`channels-unorderable`,{[u(e.channel)]:e.raw}),e.acr.zero&&c(`zero-constraint-ignored`,{field:`acr_values`,[u(e.channel)]:e.raw}),e.maxAge.kind===`invalid`&&c(`zero-constraint-ignored`,{field:`max_age`,[u(e.channel)]:String(e.maxAge.raw)});let d=l.filter(e=>e.acr.level!==void 0),f,p;for(let e of d){let t=e.acr.level;f===void 0||t>f?(f=t,p=e.raw):t===f&&e.channel===`header`&&(p=e.raw)}let m;for(let e of l)e.maxAge.kind===`valid`&&(m===void 0||e.maxAge.value<m)&&(m=e.maxAge.value);if(l.length===2){let[e,t]=l,n=e.acr.level!==void 0&&t.acr.level!==void 0&&e.acr.level!==t.acr.level,r=e.maxAge.kind===`valid`&&t.maxAge.kind===`valid`&&e.maxAge.value!==t.maxAge.value;(n||r)&&c(`channels-disagree`,{header:e.raw??t.raw,body:t.raw??e.raw})}return{challenge:{acrValues:p,requiredLevel:f,maxAge:m,status:n,channels:l.map(e=>e.channel)},diagnostics:s}},Te=(e,t,n)=>we({status:e,getHeader:t,body:n}).challenge,Ee=`__passflowUpgradeTransaction`,De=`__passflowUpgradeReplayed`,Oe=(e,t)=>typeof e==`object`&&!!e&&e[t]===!0,ke=e=>({...e??{},[Ee]:!0}),Ae=e=>Oe(e,Ee),je=e=>({...e,[De]:!0}),Me=e=>Oe(e,De),Ne=function(e){return e.GET=`get`,e.POST=`post`,e.PUT=`put`,e.PATCH=`patch`,e.DELETE=`delete`,e}({}),B=function(e){return e.signin=`/auth/login`,e.signup=`/auth/register`,e.pkceExchange=`/auth/pkce_exchange`,e.signInWithProvider=`/auth/federated/start/`,e.passwordless=`/auth/passwordless/start`,e.passwordlessComplete=`/auth/passwordless/complete`,e.logout=`/user/logout`,e.refresh=`/auth/refresh`,e.validateSession=`/user/me`,e.sendPasswordResetEmail=`/auth/password/reset`,e.resetPassword=`/auth/password/change`,e.appSettings=`/app/settings`,e.passkeyRegisterStart=`/auth/passkey/register/start`,e.passkeyRegisterComplete=`/auth/passkey/register/complete`,e.passkeyAuthenticateStart=`/auth/passkey/authenticate/start`,e.passkeyAuthenticateComplete=`/auth/passkey/authenticate/complete`,e.passkeyValidate=`/auth/validate`,e.settingsAll=`/settings`,e.settingsPasswordPolicy=`/settings/password`,e.settingsPasskey=`/settings/passkey`,e.userPasskey=`/user/passkey`,e.addUserPasskey=`/user/passkey/add/start`,e.completeAddUserPasskey=`/user/passkey/add/complete`,e.joinInvitation=`/user/tenant/join`,e.tenantPath=`/user/tenant`,e.invitationsPath=`/user/tenant/:tenantID/invitations`,e.requestInvitation=`/user/invite`,e.invitationDelete=`/user/invite/:invitationID`,e.invitationResend=`/user/invite/:invitationID/resend`,e.invitationGetLink=`/user/invite/:invitationID/link`,e.twoFactor=`/user/2fa`,e.twoFactorStatus=`/user/2fa/status`,e.twoFactorSetupBegin=`/user/2fa/setup/begin`,e.twoFactorSetupConfirm=`/user/2fa/setup/confirm`,e.twoFactorVerify=`/auth/2fa/verify`,e.twoFactorRecovery=`/auth/2fa/recovery`,e.twoFactorRegenerateCodes=`/user/2fa/recovery-codes/regenerate`,e.twoFactorSetupMagicLink=`/auth/2fa-setup`,e.TwoFactorMethodsAvailable=`/v2/user/2fa/methods/available`,e.TwoFactorMethodsRegistered=`/v2/user/2fa/methods`,e.TwoFactorSetupStart=`/v2/user/2fa/setup/start`,e.TwoFactorSetupComplete=`/v2/user/2fa/setup/complete`,e.TwoFactorMethodRemove=`/v2/user/2fa/methods/:id`,e.TwoFactorChallenge=`/v2/auth/2fa/challenge`,e.TwoFactorVerifyV2=`/v2/auth/2fa/verify`,e.TwoFactorAlternative=`/v2/auth/2fa/alternative`,e.TwoFactorTrustedDevices=`/v2/user/2fa/trusted-devices`,e.TwoFactorTrustedDeviceRevoke=`/v2/user/2fa/trusted-devices/:id`,e.cliAuthStatus=`/cli/auth/status/:sessionId`,e.cliAuthComplete=`/cli/auth/complete`,e.upgradeStart=`/auth/upgrade/start`,e}({}),Pe=function(e){return e.passkeyRegisterStart=`/admin/auth/passkey/register/start`,e.passkeyRegisterComplete=`/admin/auth/passkey/register/complete`,e.passkeyAuthenticateStart=`/admin/auth/passkey/authenticate/start`,e.passkeyAuthenticateComplete=`/admin/auth/passkey/authenticate/complete`,e.passkeyValidate=`/admin/auth/validate`,e.logout=`/admin/auth/logout`,e}({}),Fe=e=>{if(!e)return null;try{let t=new URL(e),n=t.pathname.replace(/\/+$/,``);return{origin:t.origin,pathPrefix:n===``?void 0:n}}catch{return null}},V=class extends Error{constructor(e){super(),this.id=e?.id??`unknown`,this.message=e?.message??e??`Something went wrong`,this.status=e?.status??500,this.location=e?.location??`unknown`,this.time=e?.time??new Date().toISOString()}},Ie=function(e){return e.google=`google`,e.facebook=`facebook`,e}({}),Le=function(e){return e.web=`web`,e.ios=`ios`,e.android=`android`,e}({});function Re(e){return e}function H(e,t){let n=e;return Object.entries(t).forEach(([e,t])=>{n=n.replace(`:${e}`,t)}),n}var ze=function(e){return e.Disabled=`disabled`,e.Optional=`optional`,e.Required=`required`,e}({}),Be=3,Ve=1e3,He=e=>t=>{let n=e.headers?.[t]??e.headers?.[t.toLowerCase()];return Array.isArray(n)?n.join(`, `):n},Ue=e=>Te(e.status,He(e),e.data),We=e=>Ue(e)!==void 0,Ge=e=>e?.includes(B.refresh)??!1,Ke=e=>e?.includes(`logout`)??!1,qe=class{get origin(){return this._platform.getCurrentUrl()?.origin??``}constructor(e,t,n){this.defaultHeaders={Accept:`application/json`,"Content-Type":`application/json`},this.nonAccessTokenEndpoints=[`/auth/`,`/settings`,`/settings/`],this.protectedEndpoints=[`logout`,`refresh`,`upgrade`];let{url:r,appId:i,keyStoragePrefix:a}=e;this._platform=e.platform??L,this.url=r||`https://auth.passflow.cloud`,this.upgradeDomain=Fe(r),this.storageManager=t??new P({prefix:a??``}),this.deviceService=n??new F(this.storageManager),this.tokenService=new k(this.storageManager),this.tokenDeliveryManager=new ce(this.storageManager),i&&(this.appId=i,this.defaultHeaders={...this.defaultHeaders,[d]:i});let o=this.deviceService.getDeviceId();this.defaultHeaders={...this.defaultHeaders,[p]:o,[m]:this._platform.getDeviceType()},this.detectCookieSupport(),this.instance=c.default.create({baseURL:this.url,headers:{...this.defaultHeaders}}),this.instance.interceptors.request.use(async e=>{if(this.isNonAuthEndpoint(e.url))return e;if(this.tokenDeliveryManager.isCookieMode()){e.withCredentials=!0;let t=this.storageManager.getCsrfToken();return t&&(e.headers[`X-CSRF-Token`]=t),e}if(Ge(e.url))return e;let t=this.storageManager.getTokens();if(!t?.access_token)return e;let n=t.access_token;if(this.refreshHandler&&t.refresh_token&&!Ke(e.url)){let e=j(t.access_token);if(A(e,30)){let t=!A(e,0);try{n=(await this.refreshHandler({trigger:`pre-request`,allowStale:t}))?.access_token??n}catch(e){if(!t)throw e}}}return e.headers[f]=`Bearer ${n}`,e}),this.instance.interceptors.response.use(e=>e,async e=>{if(e.response?.status===401&&!Ge(e.config?.url)&&!this.isUpgradeTransactionError(e)&&this.tokenDeliveryManager.setSessionInvalid(),e.response&&this.upgradeHandler){let t=Ue(e.response);if(t)try{return await this.upgradeHandler(e,t)}catch(t){if(t!==e)throw t}}return e.response?.status===429?await this.handleRateLimitError(e):this.handleAxiosError(e)})}isUpgradeTransactionError(e){return Ae(e.config)||e.response!==void 0&&We(e.response)}setUpgradeInterceptor(e){this.upgradeHandler=e}setRefreshHandler(e){this.refreshHandler=e}replay(e){return this.instance.request(e)}isProtectedEndpoint(e){return this.protectedEndpoints.some(t=>e?.includes(t))}isNonAuthEndpoint(e){return this.nonAccessTokenEndpoints.some(t=>e?.includes(t))&&!this.isProtectedEndpoint(e)}detectCookieSupport(){if(!this._platform.cookiesSupported()&&this.tokenDeliveryManager.isCookieMode())throw Error(`Passflow SDK: Cookie delivery mode is configured but cookies are not supported in this environment. Use a platform adapter that supports cookies or configure the server to use JSON token delivery.`)}async handleRateLimitError(e){let t=e.config;if(!t||Ge(t.url))return Promise.reject(e);let n=t.method?.toUpperCase();if(![`GET`,`HEAD`,`OPTIONS`].includes(n||``))return Promise.reject(e);let r=t._retryCount||0;if(r>=Be)return Promise.reject(e);let i=Ve*2**r,a=e.response?.headers?.[`retry-after`];if(a){let e=Number.parseInt(a,10);if(!Number.isNaN(e))i=e*1e3;else{let e=new Date(a);Number.isNaN(e.getTime())||(i=Math.max(0,e.getTime()-Date.now()))}}return await new Promise(e=>setTimeout(e,i)),t._retryCount=r+1,this.instance.request(t)}async handleAxiosError(e){if(!e.response)return Promise.reject(e);let t=e.response.status,n=e.response.data;if(`error`in n&&typeof n.error==`object`&&n.error!==null){let{error:e}=n;return Promise.reject(new V(e))}return Promise.reject(new V({id:`error.http.${t}`,message:e.message||`An error occurred`,status:t,location:e.config?.url||`unknown`,time:new Date().toISOString()}))}async send(e,t,n){return(await this.instance.request({method:e,url:t,...n})).data}get(e,t){return this.send(Ne.GET,e,t)}post(e,t,n){return this.send(Ne.POST,e,{data:t,...n})}put(e,t,n){return this.send(Ne.PUT,e,{data:t,...n})}patch(e,t,n){return this.send(Ne.PATCH,e,{data:t,...n})}delete(e,t){return this.send(Ne.DELETE,e,t)}setAppId(e){this.appId=e,this.defaultHeaders={...this.defaultHeaders,[d]:e},this.instance.defaults.headers.common[d]=e}},Je=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getAppSettings(){return this.axiosClient.get(B.appSettings)}},Ye={withCredentials:!0},Xe=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}refreshToken(e,t,n,r){let i={access:n,scopes:t,...r?{upgrade:r}:{}},a={headers:{[f]:`Bearer ${e}`}};return this.axiosClient.post(B.refresh,i,r?ke(a):a)}signIn(e,t,n){let r={...e,device:t,os:n};return this.axiosClient.post(B.signin,r,Ye)}signUp(e){let{create_tenant:t,anonymous:n}=e,r={...e,create_tenant:t??!1,anonymous:n??!1};return this.axiosClient.post(B.signup,r,Ye)}pkceExchange(e,t){return this.axiosClient.post(B.pkceExchange,{authz_code:e,verifier:t},Ye)}passwordlessSignIn(e,t,n){let{create_tenant:r}=e,i={...e,create_tenant:r??!1,device:t,os:n};return this.axiosClient.post(B.passwordless,i)}passwordlessSignInComplete(e){return this.axiosClient.post(B.passwordlessComplete,e,Ye)}logOut(e,t,n=!1){let r=n?void 0:{refresh_token:t,device:e},i=n?Pe.logout:B.logout;return this.axiosClient.post(i,r)}validateSession(){return this.axiosClient.get(B.validateSession)}sendPasswordResetEmail(e){return this.axiosClient.post(B.sendPasswordResetEmail,e)}resetPassword(e,t,n,r){let i={password:e,scopes:t,...r?{code_challenge:r}:{}};return this.axiosClient.post(B.resetPassword,i,{headers:{[f]:`Bearer ${n}`,[d]:void 0}})}passkeyRegisterStart(e,t,n,r=!1){let{create_tenant:i}=e,a={...e,create_tenant:i??!1,device:t,os:n},o=r?Pe.passkeyRegisterStart:B.passkeyRegisterStart;return this.axiosClient.post(o,a)}passkeyRegisterComplete(e,t,n,r=!1){let i={challenge_id:n,device:t,passkey_data:e},a=r?Pe.passkeyRegisterComplete:B.passkeyRegisterComplete;return this.axiosClient.post(a,i,Ye)}passkeyAuthenticateStart(e,t,n,r=!1){let i={...e,user_id:e.user_id??``,device:t,os:n},a=r?Pe.passkeyAuthenticateStart:B.passkeyAuthenticateStart;return this.axiosClient.post(a,i)}passkeyAuthenticateComplete(e,t,n,r=!1){let i={challenge_id:n,device:t,passkey_data:e},a=r?Pe.passkeyAuthenticateComplete:B.passkeyAuthenticateComplete;return this.axiosClient.post(a,i,Ye)}passkeyValidate(e,t,n,r=!1,i){let a={otp:e,device:t,challenge_id:n},o=B.passkeyValidate;!i&&r&&(o=Pe.passkeyValidate);let s=i?{[d]:i}:{};return this.axiosClient.post(o,a,{headers:s})}},Ze=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getCLIAuthStatus(e){let t=H(B.cliAuthStatus,{sessionId:e});return this.axiosClient.get(t)}completeCLIAuth(e){return this.axiosClient.post(B.cliAuthComplete,e)}},Qe=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}requestInviteLink(e){return this.axiosClient.post(B.requestInvitation,e)}getInvitations(e){let t={};e.groupID&&(t.group_id=e.groupID.toString()),e.skip!==void 0&&(t.skip=e.skip.toString()),e.limit!==void 0&&(t.limit=e.limit.toString());let n=H(B.invitationsPath,{tenantID:e.tenantID});return this.axiosClient.get(n,{params:t}).then(e=>({invites:e.invites,nextPageSkip:e.next_page_skip}))}deleteInvitation(e){let t=H(B.invitationDelete,{invitationID:e});return this.axiosClient.delete(t)}resendInvitation(e){let t=H(B.invitationResend,{invitationID:e});return this.axiosClient.post(t,{})}getInvitationLink(e){let t=H(B.invitationGetLink,{invitationID:e});return this.axiosClient.get(t)}},$e=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getSettingsAll(){return this.axiosClient.get(B.settingsAll)}getPasswordPolicySettings(){return this.axiosClient.get(B.settingsPasswordPolicy)}getPasskeySettings(){return this.axiosClient.get(B.settingsPasskey)}},et=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}joinInvitation(e,t){let n={invite_token:e,scopes:t};return this.axiosClient.post(B.joinInvitation,n)}createTenant(e){let t={name:e};return this.axiosClient.post(B.tenantPath,t)}getTenantDetails(e){let t=`${B.tenantPath}/${e}`;return this.axiosClient.get(t)}updateTenant(e,t){let n=`${B.tenantPath}/${e}`,r={name:t};return this.axiosClient.put(n,r)}deleteTenant(e){let t=`${B.tenantPath}/${e}`;return this.axiosClient.delete(t)}getUserTenantMembership(){return this.axiosClient.get(B.tenantPath)}createGroup(e,t){let n=`${B.tenantPath}/${e}/group`,r={name:t};return this.axiosClient.post(n,r)}getGroupInfo(e,t){let n=`${B.tenantPath}/${e}/group/${t}`;return this.axiosClient.get(n)}updateGroup(e,t,n){let r=`${B.tenantPath}/${e}/group/${t}`,i={name:n};return this.axiosClient.put(r,i)}deleteGroup(e,t){let n=`${B.tenantPath}/${e}/group/${t}`;return this.axiosClient.delete(n)}addUserToGroup(e,t,n,r){let i=`${B.tenantPath}/${e}/group/${t}/add`,a={user_id:n,role:r};return this.axiosClient.post(i,a)}removeUserRolesFromGroup(e,t,n,r){let i=`${B.tenantPath}/${e}/group/${t}/remove_roles`,a={user_id:n,roles:r};return this.axiosClient.post(i,a)}changeUserRoles(e,t,n,r){let i=`${B.tenantPath}/${e}/group/${t}/change`,a={user_id:n,roles:r};return this.axiosClient.post(i,a)}deleteUserFromGroup(e,t,n){let r=`${B.tenantPath}/${e}/group/${t}/${n}`;return this.axiosClient.delete(r)}getRolesForTenant(e){let t=`${B.tenantPath}/${e}/role`;return this.axiosClient.get(t)}createRoleForTenant(e,t){let n=`${B.tenantPath}/${e}/role`,r={name:t};return this.axiosClient.post(n,r)}updateRole(e,t,n){let r=`${B.tenantPath}/${e}/role/${t}`,i={name:n};return this.axiosClient.put(r,i)}deleteRole(e,t){let n=`${B.tenantPath}/${e}/role/${t}`;return this.axiosClient.delete(n)}deleteUserFromTenant(e,t){let n=`${B.tenantPath}/${e}/user/${t}`;return this.axiosClient.delete(n)}getGroupInvitations(e,t,n,r){let i=`${B.tenantPath}/${e}/group/${t}/invitations`;return this.axiosClient.get(i,{params:{limit:n,skip:r}})}getTenantInvitations(e,t,n){let r=`${B.tenantPath}/${e}/invitations`;return this.axiosClient.get(r,{params:{limit:t,skip:n}})}invalidateInviteById(e,t,n){let r=`${B.tenantPath}/${e}/group/${t}/invite/${n}`;return this.axiosClient.delete(r)}invalidateInviteByEmail(e,t,n){let r=`${B.tenantPath}/${e}/group/${t}/invite/email/${n}`;return this.axiosClient.delete(r)}},tt=e=>e?{headers:{Authorization:`Bearer ${e}`}}:{},nt=e=>({withCredentials:!0,...tt(e)}),rt=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getStatus(){return this.axiosClient.get(B.twoFactorStatus)}beginSetup(){return this.axiosClient.post(B.twoFactorSetupBegin,{})}confirmSetup(e){return this.axiosClient.post(B.twoFactorSetupConfirm,e)}verify(e){let{tfa_token:t,code:n,trust_device:r}=e;return this.axiosClient.post(B.twoFactorVerify,{code:n,...r?{trust_device:!0}:{}},nt(t))}useRecoveryCode(e){let{tfa_token:t,recovery_code:n,trust_device:r}=e;return this.axiosClient.post(B.twoFactorRecovery,{recovery_code:n,...r?{trust_device:!0}:{}},nt(t))}disable(e){return this.axiosClient.delete(B.twoFactor,{data:e})}regenerateRecoveryCodes(e){return this.axiosClient.post(B.twoFactorRegenerateCodes,e)}validateTwoFactorSetupMagicLink(e){let t=`${B.twoFactorSetupMagicLink}/${e}`;return this.axiosClient.get(t,{transformRequest:[(e,t)=>(t&&delete t.Authorization,e)]}).then(e=>{let t=e;return{success:!0,sessionToken:t.session_token,userId:t.user_id,expiresIn:t.expires_in,appId:t.app_id}}).catch(e=>{if(e.response){let t=e.response.status,n=e.response.data||{},r=e.response.headers?.[`retry-after`]?parseInt(e.response.headers[`retry-after`],10):void 0;return{success:!1,error:{code:n.error||this.mapStatusToErrorCode(t),message:n.message||this.getDefaultErrorMessage(t),retryAfter:r}}}return{success:!1,error:{code:`SERVER_ERROR`,message:e instanceof Error?e.message:`Unable to connect to the server. Please check your connection.`}}})}mapStatusToErrorCode(e){switch(e){case 400:return`INVALID_TOKEN`;case 404:return`REVOKED_TOKEN`;case 410:return`EXPIRED_TOKEN`;case 429:return`RATE_LIMITED`;default:return`SERVER_ERROR`}}getDefaultErrorMessage(e){switch(e){case 400:return`The provided magic link is invalid or malformed.`;case 404:return`This magic link has been revoked or does not exist.`;case 410:return`This magic link has expired. Please request a new one from your administrator.`;case 429:return`Too many validation attempts. Please try again later.`;default:return`An error occurred while validating the magic link.`}}getAvailableMethods(){return this.axiosClient.get(B.TwoFactorMethodsAvailable)}getRegisteredMethods(){return this.axiosClient.get(B.TwoFactorMethodsRegistered)}startMethodSetup(e,t){return this.axiosClient.post(B.TwoFactorSetupStart,{...t,method:e})}completeMethodSetup(e,t){return this.axiosClient.post(B.TwoFactorSetupComplete,{...t,method:e})}removeMethod(e){let t=H(B.TwoFactorMethodRemove,{id:e});return this.axiosClient.delete(t)}requestChallenge(e,t){return this.axiosClient.post(B.TwoFactorChallenge,e,tt(t))}verifyV2(e,t){let{trust_device:n,...r}=e;return this.axiosClient.post(B.TwoFactorVerifyV2,{...r,...n?{trust_device:!0}:{}},nt(t))}switchToAlternative(e,t){return this.axiosClient.post(B.TwoFactorAlternative,e,tt(t))}async getTrustedDevices(){return(await this.axiosClient.get(B.TwoFactorTrustedDevices,{withCredentials:!0}))?.devices??[]}revokeTrustedDevice(e){let t=H(B.TwoFactorTrustedDeviceRevoke,{id:e});return this.axiosClient.delete(t)}},it=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}startUpgrade(e){return this.axiosClient.post(B.upgradeStart,e,ke({}))}},at=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getUserPasskeys(){return this.axiosClient.get(B.userPasskey)}renameUserPasskey(e,t){return this.axiosClient.patch(`${B.userPasskey}/${t}`,{name:e})}deleteUserPasskey(e){return this.axiosClient.delete(`${B.userPasskey}/${e}`)}addUserPasskeyStart({relyingPartyId:e,deviceId:t,os:n,passkeyDisplayName:r,passkeyUsername:i}){let a={passkey_display_name:r,passkey_username:i,relying_party_id:e,deviceId:t,os:n};return this.axiosClient.post(B.addUserPasskey,a)}addUserPasskeyComplete(e,t,n){return this.axiosClient.post(B.completeAddUserPasskey,{challenge_id:n,device:t,passkey_data:e})}},ot=10,st=20,ct=class extends Error{constructor(e){super(`Passflow fetch middleware '${e}' resolved without calling next(). Every registered middleware must delegate exactly once; swallowing a request would drop a caller's fetch inside the Passflow wrapper.`),this.name=`FetchMiddlewareContractError`,this.middlewareName=e}},lt=[],ut=0,dt=!1,ft,pt,mt=(e,t)=>e.priority-t.priority||e.seq-t.seq,ht=()=>typeof globalThis>`u`?void 0:globalThis,gt=async(e,t,n,r)=>{if(t>=e.length){let e=ft;if(!e)throw Error(`Passflow fetch registry: no captured fetch to delegate to.`);return e(n,r)}let i=e[t];if(!i)return gt(e,e.length,n,r);let a=!1,o=await i.middleware((n,r)=>(a=!0,gt(e,t+1,n,r)),n,r);if(!a)throw new ct(i.name);return o},_t=()=>{let e=ht();if(!e||typeof e.fetch!=`function`)return!1;let t=e.fetch.bind(e),n=(e,t)=>gt([...lt].sort(mt),0,e,t);return ft=t,pt=n,e.fetch=n,dt=!0,!0},vt=()=>{let e=ht();e&&pt&&e.fetch===pt&&(ft&&(e.fetch=ft),dt=!1,pt=void 0,ft=void 0)},yt=(e,t)=>{if(!dt&&!_t())return()=>{};let n={middleware:e,name:t.name,priority:t.priority,seq:ut++};lt.push(n);let r=!1;return()=>{r||(r=!0,lt=lt.filter(e=>e!==n),lt.length===0&&vt())}},bt=()=>{let e=ht();return{installed:dt,names:[...lt].sort(mt).map(e=>e.name),foreignPatch:dt&&!!e&&!!pt&&e.fetch!==pt}},U=class e extends Error{constructor(t){super(t.message),this.name=`M2MError`,this.code=t.code,this.status=t.status??400,this.errorUri=t.errorUri,this.rateLimitInfo=t.rateLimitInfo,this.headers=t.headers,this.cause=t.cause,this.timestamp=new Date().toISOString(),Error.captureStackTrace&&Error.captureStackTrace(this,e)}static fromOAuthError(t,n,r){let i=r?e.parseRateLimitHeaders(r):void 0;return new e({code:t.error,message:t.error_description??e.getDefaultMessage(t.error),status:n,errorUri:t.error_uri,rateLimitInfo:i,headers:r})}static fromError(t,n=`server_error`){return new e({code:n,message:t.message||`An unexpected error occurred`,status:500,cause:t})}static parseRateLimitHeaders(e){let t=e[`x-ratelimit-limit`],n=e[`x-ratelimit-remaining`],r=e[`x-ratelimit-reset`]||e[`retry-after`];if(t&&n&&r)return{limit:parseInt(t,10),remaining:parseInt(n,10),reset:parseInt(r,10)}}static getDefaultMessage(e){return{invalid_request:`The request is missing a required parameter or is otherwise malformed.`,invalid_client:`Client authentication failed. Verify your client credentials.`,invalid_grant:`The provided authorization grant is invalid or expired.`,invalid_scope:`The requested scope is invalid, unknown, or exceeds the allowed scopes.`,unauthorized_client:`The client is not authorized to use this grant type.`,unsupported_grant_type:`The authorization grant type is not supported.`,rate_limit_exceeded:`Too many requests. Please retry after the rate limit window resets.`,server_error:`The authorization server encountered an unexpected error.`,temporarily_unavailable:`The authorization server is temporarily unavailable. Please try again later.`}[e]||`An unknown error occurred.`}isRetryable(){return this.code===`server_error`||this.code===`temporarily_unavailable`||this.code===`rate_limit_exceeded`||this.status>=500}getRetryAfter(){if(this.rateLimitInfo?.reset){let e=Math.floor(Date.now()/1e3),t=this.rateLimitInfo.reset-e;return Math.max(t*1e3,1e3)}return 1e3}toJSON(){return{name:this.name,code:this.code,message:this.message,status:this.status,errorUri:this.errorUri,rateLimitInfo:this.rateLimitInfo,timestamp:this.timestamp}}toString(){let e=`M2MError [${this.code}]: ${this.message}`;return this.status&&(e+=` (HTTP ${this.status})`),e}},xt=class extends U{constructor(e,t){super({code:`temporarily_unavailable`,message:e,status:0,cause:t}),this.name=`M2MNetworkError`}},St=class extends U{constructor(e,t){super({code:`invalid_request`,message:e,status:400,cause:t}),this.name=`M2MTokenParseError`}},Ct=class extends U{constructor(e){super({code:`invalid_request`,message:e,status:400}),this.name=`M2MConfigError`}},wt={InvalidRequest:`invalid_request`,InvalidClient:`invalid_client`,InvalidGrant:`invalid_grant`,InvalidScope:`invalid_scope`,UnauthorizedClient:`unauthorized_client`,UnsupportedGrantType:`unsupported_grant_type`,RateLimitExceeded:`rate_limit_exceeded`,ServerError:`server_error`,TemporarilyUnavailable:`temporarily_unavailable`},Tt={TOKEN_ENDPOINT:`/oauth2/token`,TIMEOUT:1e4,RETRIES:3,RETRY_DELAY:1e3,REFRESH_THRESHOLD:30,CONTENT_TYPE:`application/x-www-form-urlencoded`},Et=class{constructor(){this.cache=new Map}get(e){let t=this.cache.get(e);return t?Date.now()>=t.expiresAt?(this.cache.delete(e),Promise.resolve(null)):Promise.resolve(t.token):Promise.resolve(null)}set(e,t,n){return this.cache.set(e,{token:t,expiresAt:Date.now()+n*1e3}),Promise.resolve()}delete(e){return this.cache.delete(e),Promise.resolve()}},Dt={shouldRetry(e,t){return t>=3?!1:e.code===`server_error`||e.code===`temporarily_unavailable`||e.code===`rate_limit_exceeded`||e.status!==void 0&&e.status>=500},getDelay(e){return 2**(e-1)*1e3}},Ot=class{constructor(e){if(!e.url)throw new Ct(`M2M client requires a URL`);if(!e.clientId)throw new Ct(`M2M client requires a clientId`);if(!e.clientSecret)throw new Ct(`M2M client requires a clientSecret`);let t=e.url.replace(/\/$/,``);this.config={url:t,clientId:e.clientId,clientSecret:e.clientSecret,scopes:e.scopes,audience:e.audience,autoRefresh:e.autoRefresh??!1,refreshThreshold:e.refreshThreshold??Tt.REFRESH_THRESHOLD,timeout:e.timeout??Tt.TIMEOUT,retries:e.retries??Tt.RETRIES,retryDelay:e.retryDelay??Tt.RETRY_DELAY,retryStrategy:e.retryStrategy,cache:e.cache,onTokenRequest:e.onTokenRequest,onTokenResponse:e.onTokenResponse,onError:e.onError},this.cache=e.cache??new Et,this.retryStrategy=e.retryStrategy??Dt,this.tokenEndpoint=`${t}${Tt.TOKEN_ENDPOINT}`}getCacheKey(e,t){let n=e?.sort().join(`,`)||``,r=t?.sort().join(`,`)||``;return`m2m:${this.config.clientId}:${n}:${r}`}async getToken(e){let t=e?.scopes??this.config.scopes,n=e?.audience??this.config.audience,r=this.getCacheKey(t,n);if(!e?.forceRefresh){let e=await this.cache.get(r);if(e&&!this.isTokenExpired(e))return e}return this.requestToken(t,n,r)}async getValidToken(){let e=this.config.scopes,t=this.config.audience,n=this.getCacheKey(e,t),r=await this.cache.get(n);if(r){if(this.config.autoRefresh&&this.isTokenExpired(r,this.config.refreshThreshold))return this.requestToken(e,t,n);if(!this.isTokenExpired(r))return r}return this.requestToken(e,t,n)}async requestToken(e,t,n){let r={grant_type:`client_credentials`,client_id:this.config.clientId,client_secret:this.config.clientSecret};e&&e.length>0&&(r.scope=e.join(` `)),t&&t.length>0&&(r.audience=t.join(` `)),this.config.onTokenRequest&&this.config.onTokenRequest({clientId:this.config.clientId,scopes:e??[],audience:t??[],timestamp:new Date().toISOString()});let i=await this.executeWithRetry(()=>this.doTokenRequest(r));return i.issued_at=Math.floor(Date.now()/1e3),n&&await this.cache.set(n,i,i.expires_in),this.config.onTokenResponse&&this.config.onTokenResponse(i),i}async doTokenRequest(e){let t=new URLSearchParams;t.append(`grant_type`,e.grant_type),t.append(`client_id`,e.client_id),t.append(`client_secret`,e.client_secret),e.scope&&t.append(`scope`,e.scope),e.audience&&t.append(`audience`,e.audience);let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeout);try{let e=await fetch(this.tokenEndpoint,{method:`POST`,headers:{"Content-Type":Tt.CONTENT_TYPE,Accept:`application/json`},body:t.toString(),signal:n.signal});clearTimeout(r);let i={};e.headers.forEach((e,t)=>{i[t.toLowerCase()]=e});let a=await e.json();if(!e.ok){let t=U.fromOAuthError({error:a.error||`server_error`,error_description:a.error_description||a.message,error_uri:a.error_uri},e.status,i);throw this.config.onError&&this.config.onError({error:t.code,error_description:t.message}),t}return a}catch(e){throw clearTimeout(r),e instanceof Error&&e.name===`AbortError`?new xt(`Request timed out after ${this.config.timeout}ms`):e instanceof TypeError&&e.message.includes(`fetch`)?new xt(`Network error: ${e.message}`,e):e instanceof U?e:U.fromError(e instanceof Error?e:Error(String(e)))}}async executeWithRetry(e){let t;for(let n=1;n<=this.config.retries;n++)try{return await e()}catch(e){if(!(e instanceof U))throw e;if(t=e,n<this.config.retries&&this.retryStrategy.shouldRetry({code:e.code,status:e.status},n)){let e=this.retryStrategy.getDelay(n);await this.sleep(e);continue}throw e}throw t??new U({code:`server_error`,message:`Request failed after retries`})}sleep(e){return new Promise(t=>setTimeout(t,e))}getCachedToken(){let e=this.cache;if(`cache`in e){let t=this.getCacheKey(this.config.scopes,this.config.audience);return e.cache.get(t)?.token??null}return null}isTokenExpired(e,t=0){if(!e)return!0;let n=Math.floor(Date.now()/1e3);return n>=(e.issued_at??n-e.expires_in)+e.expires_in-t}parseToken(e){try{let t=e.split(`.`);if(t.length!==3)throw new St(`Invalid JWT format: expected 3 parts`);let n=t[1];if(!n)throw new St(`Invalid JWT format: missing payload`);let r=atob(n.replace(/-/g,`+`).replace(/_/g,`/`)),i=JSON.parse(r);return i.scopes&&typeof i.scopes==`string`?i.scopes=i.scopes.split(` `):i.scopes||(i.scopes=[]),i}catch(e){throw e instanceof St?e:new St(`Failed to parse token: ${e instanceof Error?e.message:`Unknown error`}`)}}clearCache(){let e=this.getCacheKey(this.config.scopes,this.config.audience);this.cache.delete(e)}async revokeToken(){let e=this.getCachedToken();if(!e)return;let t=`${this.config.url}/oauth2/revoke`,n=new URLSearchParams;n.append(`token`,e.access_token),n.append(`client_id`,this.config.clientId),n.append(`client_secret`,this.config.clientSecret);try{let e=await fetch(t,{method:`POST`,headers:{"Content-Type":Tt.CONTENT_TYPE},body:n.toString()});if(!e.ok&&e.status!==200){let t=await e.json().catch(()=>({}));throw U.fromOAuthError({error:t.error||`server_error`,error_description:t.error_description||`Token revocation failed`},e.status)}this.clearCache()}catch(e){throw e instanceof U?e:U.fromError(e instanceof Error?e:Error(String(e)))}}get url(){return this.config.url}get clientId(){return this.config.clientId}get scopes(){return this.config.scopes}get audience(){return this.config.audience}},kt=`error`,At=new WeakMap,jt=(e,t)=>{if(typeof t!=`object`&&typeof t!=`function`||t===null)return!0;let n=At.get(e);return n||(n=new WeakSet,At.set(e,n)),!n.has(t)&&(n.add(t),!0)},W=(e,t)=>jt(e,t.originalError)?(e.notify(kt,t),!0):!1,Mt=`passflow-refresh`,Nt=`passflow-refresh-takeover`,Pt=`passflow-auth`,Ft=Object.freeze([1e3,3e3,1e4,3e4,6e4]),It=.2,Lt=6e5,Rt=5e3,G=2e4,zt=2e4,Bt=1e3,Vt=2e3,Ht=1e3,Ut=1e4,Wt=5e3;function Gt(e){let t=e?`:${e}`:``;return{lock:`${Mt}${t}`,takeoverLock:`${Nt}${t}`,channel:`${Pt}${t}`}}function K(e){return typeof e==`string`&&e!==``?e:void 0}function Kt(e){return typeof e==`number`&&Number.isFinite(e)?e:void 0}function qt(e){return typeof e==`object`&&!!e}function Jt(e,t){for(let[n,r]of Object.entries(t))r!==void 0&&(e[n]=r);return e}function Yt(e){if(!qt(e))return null;let t=Array.isArray(e.scopes)?e.scopes.filter(e=>typeof e==`string`):void 0;return Jt({},{access_token:K(e.access_token),refresh_token:K(e.refresh_token),id_token:K(e.id_token),scopes:Array.isArray(e.scopes)&&t?.length===e.scopes.length?t:void 0})}function Xt(e){if(!qt(e))return null;let{kind:t,attempt:n,nextAt:r,strikes:i}=e;return t!==`transient`&&t!==`auth`||typeof n!=`number`||!Number.isInteger(n)||n<1||Kt(r)===void 0||typeof i!=`number`||!Number.isFinite(i)||i<0?null:Jt({kind:t,attempt:n,nextAt:r,strikes:i},{from:K(e.from),failingSince:Kt(e.failingSince)})}function Zt(e){return Jt({},{fp:K(e.fp),sub:K(e.sub),sid:K(e.sid),iat:Kt(e.iat)})}function Qt(e){if(!qt(e))return null;let t=e;if(t.v!==void 0&&t.v!==1)return null;let n=K(t.tabId);if(!n)return null;switch(t.type){case`tokens-refreshed`:{let e=Yt(t.tokens),r=K(t.from),i=K(t.to);return!e||!r||!i?null:Jt({type:t.type,tabId:n,tokens:e,from:r,to:i},{fromIat:Kt(t.fromIat),fromSid:typeof t.fromSid==`string`?t.fromSid:void 0,sentAt:Kt(t.sentAt)})}case`session-refreshed`:{let e=Kt(t.at);return e===void 0?null:Jt({type:t.type,tabId:n,at:e},{sub:K(t.sub)})}case`still-refreshing`:{let e=t.retry===void 0?null:Xt(t.retry);return e?{type:t.type,tabId:n,retry:e}:{type:t.type,tabId:n}}case`retry-scheduled`:{let e=Xt(t);return e?{type:t.type,tabId:n,message:typeof t.message==`string`?t.message:``,retry:e}:null}case`takeover`:return{type:t.type,tabId:n};case`lock-wanted`:return t.purpose===`commit`||t.purpose===`logout`?{type:t.type,tabId:n,purpose:t.purpose}:null;case`session-ended`:case`signed-out`:return{type:t.type,tabId:n,...Zt(t)};case`rate-limited`:{let e=Kt(t.until);return e===void 0?null:{type:t.type,tabId:n,until:e}}case`refresh-failed`:{let e=K(t.from);return e?{type:t.type,tabId:n,message:typeof t.message==`string`?t.message:``,from:e}:null}default:return null}}function $t(e,t){let n={v:1,tabId:e};if(t.type===`retry-scheduled`){let{retry:e,...r}=t;return Jt(n,{...r,...e})}return Jt(n,{...t})}var en=`[passflow] navigator.locks or BroadcastChannel is unavailable (they need a secure context); each tab refreshes on its own, with the save checks only`,tn={now:()=>Date.now(),random:()=>Math.random(),setTimeout:(e,t)=>{let n=setTimeout(e,t);return n.unref?.(),()=>clearTimeout(n)}};function nn(){let e=globalThis.crypto;return typeof e?.randomUUID==`function`?e.randomUUID():`tab-${Math.random().toString(36).slice(2)}-${Date.now()}`}function rn(e){return e?{now:()=>e.now(),setTimeout:(t,n)=>e.setTimeout(t,n),random:e.random?()=>e.random?.()??Math.random():tn.random}:tn}function an(e){return typeof window<`u`&&typeof document<`u`&&e.getDeviceType()===`web`}function on(e){try{return e.storageSharedAcrossTabs===!0}catch{return!1}}function sn(){try{let e=globalThis.navigator?.locks;return e&&typeof e.request==`function`?e:void 0}catch{return}}function cn(e){return t=>{let n=n=>{let r=n.key;(r==null||e().includes(r))&&t()};return window.addEventListener(`storage`,n),()=>window.removeEventListener(`storage`,n)}}function ln(e){return{transports:null,names:Gt(e),clock:tn,warnOnFirstCycle:!1}}function un(e,t,n,r){let i=Gt(n),a=an(t),o=a?cn(r.tokenKeys):void 0,s=e=>{let t={transports:null,names:i,clock:tn,warnOnFirstCycle:e};return o&&(t.onStorageChange=o),t};if(typeof e==`object`&&e){let t={transports:{locks:e.locks,channel:e.channel,tabId:e.tabId??nn()},names:i,clock:rn(e.clock),warnOnFirstCycle:!1};return e.onStorageChange&&(t.onStorageChange=e.onStorageChange),t}if(e===`none`||!a||!on(t))return s(!1);let c=sn();if(!c||typeof BroadcastChannel!=`function`)return s(!0);let l;try{l=new BroadcastChannel(i.channel)}catch{return s(!0)}let u={transports:{locks:c,channel:l,tabId:nn()},names:i,clock:tn,warnOnFirstCycle:!1};return o&&(u.onStorageChange=o),u}var dn=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_`,fn=32,pn=e=>{let t=``;for(let n=0;n<e.length;n+=3){let r=e[n],i=e[n+1],a=e[n+2];t+=dn.charAt(r>>2),t+=dn.charAt((r&3)<<4|(i??0)>>4),i!==void 0&&(t+=dn.charAt((i&15)<<2|(a??0)>>6)),a!==void 0&&(t+=dn.charAt(a&63))}return t},mn=()=>{let e=globalThis.crypto;if(!e?.subtle)throw Error(`PKCE needs the Web Crypto API, which is available only in a secure context (https or localhost)`);return e},hn=async e=>{let t=await mn().subtle.digest(`SHA-256`,new TextEncoder().encode(e));return pn(new Uint8Array(t))},gn=async()=>{let e=pn(mn().getRandomValues(new Uint8Array(fn)));return{verifier:e,challenge:await hn(e)}},_n=class{error(e,...t){console.error(e,...t)}warn(e,...t){console.warn(e,...t)}info(e,...t){console.info(e,...t)}debug(e,...t){console.debug(e,...t)}};function vn(){return new _n}var yn=Object.freeze([`error.token.invalid.error`,`error.api.token.parse.error`,`error.api.user.blocked`,`error.2fa.required_by_app`,`error.validation.token.invalid.subject`,`error.not.found`]);function bn(e){if(typeof e!=`object`||!e)return;let t=e;return typeof t.get==`function`?t.get(`retry-after`):t[`retry-after`]??t[`Retry-After`]}function xn(e,t){if(typeof e==`number`)return!Number.isFinite(e)||e<0?void 0:Math.min(Lt,Math.floor(e)*1e3);if(typeof e!=`string`)return;let n=e.trim();if(n===``)return;if(/^\d+$/.test(n))return Math.min(Lt,Number.parseInt(n,10)*1e3);if(!/[a-z]/i.test(n))return;let r=Date.parse(n);if(!Number.isNaN(r))return Math.min(Lt,Math.max(0,r-t))}function Sn(e){return typeof e==`number`&&Number.isInteger(e)&&e>=100&&e<=599?e:void 0}function Cn(e){if(typeof e.id==`string`&&e.id!==``)return e.id;let t=e.response?.data;if(typeof t!=`object`||!t)return;let n=t.error;if(typeof n!=`object`||!n)return;let r=n.id;return typeof r==`string`&&r!==``?r:void 0}function wn(e,t=Date.now()){if(typeof e!=`object`||!e)return{kind:`transient`};let n=e,r=Cn(n),i=Sn(n.response?.status)??Sn(n.status),a={};if(i!==void 0&&(a.status=i),r!==void 0&&(a.id=r),r===`error.token.blocked`)return{kind:`blocked`,...a};if(r!==void 0&&yn.includes(r)||i!==void 0&&i>=400&&i<=499&&i!==429)return{kind:`auth`,...a};if(i===void 0)return{kind:`transient`,...a};let o=xn(n.retryAfter??bn(n.response?.headers),t);return o===void 0?{kind:`transient`,...a}:{kind:`transient`,...a,retryAfterMs:o}}function Tn(e,t,n){let r=Ft.length,i=Ft[(Number.isFinite(e)?Math.min(Math.max(Math.floor(e),1),r):1)-1]??Ft[r-1]??6e4,a=Number.isFinite(t)?Math.min(Math.max(t,0),.999):0,o=i+Math.floor(i*It*a);return Math.max(o,n!==void 0&&Number.isFinite(n)?Math.min(Math.max(n,0),Lt):0)}var En={onGranted:()=>!1,onLockLost:()=>void 0,onMessage:()=>void 0};function Dn(e){let{locks:t,channel:n,tabId:r,names:i,clock:a}=e,o=En,s=null,c=null,l=null,u=null,d=null,f=null,p=0,m,h=!1,g=!1,_=e=>{g||n.postMessage($t(r,e))},v=()=>s!==null&&c===null,y=()=>{f?.(),f=null},b=e=>{p=Math.max(p,e),y(),f=a.setTimeout(()=>{f=null,D()},Math.max(0,p-a.now()))},x=()=>{d?.(),d=null},ee=()=>{d=a.setTimeout(()=>{d=null,c&&(h=!1,_(m?{type:`still-refreshing`,retry:m}:{type:`still-refreshing`}),ee())},Rt)},S=()=>{y(),x(),u?.(),u=null;let e=s;s=null,c=null,e&&(e.dead=!0,e.abort.abort());let t=l;l=null,t?.()},C=()=>{x(),c=null,s=null,l=null,o.onLockLost()},w=(e,t)=>{if(e.dead||s!==e||g){t();return}y(),c=e,l=t,h=!1,ee();let n=!1;try{n=o.onGranted()}finally{!n&&c===e&&S()}},T=e=>{if(e.takeover&&(u?.(),u=null),!(e.dead||s!==e))return new Promise(t=>{a.setTimeout(()=>w(e,t),0)})},E=e=>{let n={takeover:e,dead:!1,abort:new AbortController};s=n;let r=e?{steal:!0}:{signal:n.abort.signal};t.request(i.lock,r,()=>T(n)).catch(()=>{n.dead=!0,c===n&&C()})},D=()=>{if(!v())return;let e=s;t.request(i.takeoverLock,{ifAvailable:!0},t=>{if(s===e&&v()){if(t===null)b(a.now()+G);else return _({type:`takeover`}),new Promise(t=>{u=t,e&&(e.dead=!0,e.abort.abort()),E(!0)})}}).catch(()=>{v()&&b(a.now()+G)})},te=e=>{if(g)return;let t=Qt(e.data);if(t&&t.tabId!==r){switch(t.type){case`still-refreshing`:h=!0,v()&&(b(a.now()+G),t.retry&&b(t.retry.nextAt+G));break;case`takeover`:h=!0,v()&&b(a.now()+G);break;case`retry-scheduled`:h=!0,v()&&b(Math.max(a.now(),t.retry.nextAt)+G);break;case`rate-limited`:v()&&b(t.until+G)}o.onMessage(t)}};return n.addEventListener(`message`,te),{coordinated:!0,tabId:r,get waiting(){return v()},get holding(){return c!==null},attach:e=>{o=e},request:e=>{g||s||(p=0,b(Math.max(a.now()+G,e??0)),E(!1))},release:S,post:_,setRetryInfo:e=>{m=e},foreignHolderHeard:()=>h,dispose:()=>{g||(S(),g=!0,n.removeEventListener(`message`,te),n.close())}}}function On(e=`local`){let t=En,n=!1,r=!1,i=0,a=!1,o=()=>{n=!1,r=!1,i+=1};return{coordinated:!1,tabId:e,get waiting(){return n&&!r},get holding(){return r},attach:e=>{t=e},request:()=>{if(a||n)return;n=!0;let e=++i;Promise.resolve().then(()=>{if(a||i!==e||!n)return;r=!0;let s=!1;try{s=t.onGranted()}finally{!s&&i===e&&o()}})},release:o,post:()=>void 0,setRetryInfo:()=>void 0,foreignHolderHeard:()=>!1,dispose:()=>{o(),a=!0}}}var q={unavailable:`error.refresh.unavailable`,authRetry:`error.refresh.auth_retry`,sessionEnded:`error.refresh.session_ended`,signedOut:`error.refresh.signed_out`,successorTimeout:`error.refresh.successor_timeout`,identityChanged:`error.refresh.identity_changed`,disposed:`error.refresh.disposed`},kn={"error.refresh.unavailable":503,"error.refresh.auth_retry":401,"error.refresh.session_ended":401,"error.refresh.signed_out":401,"error.refresh.successor_timeout":401,"error.refresh.identity_changed":401,"error.refresh.disposed":499},An={"error.refresh.unavailable":`Token refresh is unavailable; a retry is scheduled`,"error.refresh.auth_retry":`Token refresh was refused; a retry is scheduled`,"error.refresh.session_ended":`The session has ended`,"error.refresh.signed_out":`Signed out`,"error.refresh.successor_timeout":`The refresh token was already used and no successor arrived`,"error.refresh.identity_changed":`Storage holds another user's tokens`,"error.refresh.disposed":`The Passflow instance was disposed`},J=class extends V{constructor(e,t={}){super({id:e,message:t.message??An[e],status:kn[e],location:`/auth/refresh`,time:new Date().toISOString()}),this.name=`PassflowRefreshError`,t.nextRetryAt!==void 0&&(this.nextRetryAt=t.nextRetryAt),t.cause!==void 0&&(this.cause=t.cause)}},jn=class extends Error{constructor(e,t){super(t??(e===`lock-timeout`?`Step-up commit could not take the refresh lock in time`:`Step-up commit answer arrived after the stored session moved on`)),this.name=`UpgradeCommitInterruptedError`,this.reason=e}};function Mn(e){if(!e)return;let t=3735928559,n=1103547991;for(let r=0;r<e.length;r++){let i=e.charCodeAt(r);t=Math.imul(t^i,2654435761),n=Math.imul(n^i,1597334677)}return t=Math.imul(t^t>>>16,2246822507),t^=Math.imul(n^n>>>13,3266489909),n=Math.imul(n^n>>>16,2246822507),n^=Math.imul(t^t>>>13,3266489909),(4294967296*(2097151&n)+(t>>>0)).toString(16)}function Nn(e){return typeof e==`string`&&e!==``?e:void 0}function Y(e){let t=Mn(e);if(!e||!t)return;let n={};try{let t=j(e);typeof t==`object`&&t&&(n=t)}catch{}let r=typeof n.iat==`number`&&Number.isFinite(n.iat)?n.iat:void 0,i={fp:t},a=Nn(n.sub),o=Nn(n.sid);return a!==void 0&&(i.sub=a),o!==void 0&&(i.sid=o),r!==void 0&&(i.iat=r),i}var Pn=`[passflow] A refresh token carries no iat claim: it is never taken over an ordered one, and cross-tab adoption falls back to fingerprints`;function Fn(e=e=>vn().warn(e)){let t=new Map,n=new Set,r=!1,i=[],a=!1,o=()=>{a||(a=!0,e(Pn))},s=(e,t)=>e.has(t)?!0:e.size>=32?!1:(e.add(t),!0),c=e=>{if(!e)return;if(e.iat===void 0){s(n,e.fp)||(r=!0);return}let i=e.sid??``,a=t.get(i);if((!a||e.iat>a.floor)&&(a={floor:e.iat,atFloor:new Set,full:!1}),t.delete(i),t.set(i,a),t.size>8){let e=t.keys().next().value;e!==void 0&&t.delete(e)}e.iat<a.floor||s(a.atFloor,e.fp)||(a.full=!0)},l=e=>{if(!e)return!1;if(e.iat===void 0)return r||n.has(e.fp);let i=t.get(e.sid??``);return!i||e.iat>i.floor?!1:e.iat<i.floor||i.full||i.atFloor.has(e.fp)},u=(e,t)=>!e.sub||!t.sub||e.sub===t.sub,d=e=>e?i.some(t=>t.fp===e.fp||t.iat!==void 0&&e.iat!==void 0&&u(t,e)&&t.sid===e.sid&&e.iat<t.iat):!1,f=(e,t)=>e.fp===t.fp?!1:e.iat===void 0?(o(),t.iat===void 0&&!l(e)):t.iat===void 0?!0:e.iat===t.iat?e.sid===t.sid&&l(t)&&!l(e):e.iat>t.iat;return{retire:c,isRetired:l,isAfter:f,isForward:(e,t)=>!e||d(e)||l(e)?!1:t?f(e,t):(e.iat===void 0&&o(),!0),end:e=>{let t=i.findIndex(t=>t.fp===e.fp||t.sid!==void 0&&t.sid===e.sid&&u(t,e));if(t!==-1){let n=i[t];if(n?.iat!==void 0&&(e.iat===void 0||n.iat>e.iat))return;i.splice(t,1)}i.push({...e}),i.length>4&&i.shift()},isEnded:d}}var In=class extends Error{constructor(e){super(e===`emptied`?`The shared token storage was emptied`:`The stored refresh token belongs to an ended session`),this.name=`SessionEnded`,this.cause=e}},Ln=class extends Error{constructor(){super(`The shared token storage holds another user's tokens`),this.name=`IdentityChanged`}};function Rn(e){if(e)try{let t=j(e).sub;return typeof t==`string`&&t!==``?t:void 0}catch{return}}function X(e){return Rn(e?.access_token)??Rn(e?.refresh_token)??Rn(e?.id_token)}function zn(e,t){return!t||e.iat===void 0||t.iat===void 0?!1:e.sid===t.sid&&e.iat<t.iat}function Bn(e){return typeof e==`object`&&!!e}function Vn(e){let{storage:t,cache:n,schedule:r}=e,i=e.identity??(()=>void 0),a=e.warn??(e=>vn().warn(e)),o=e.lineage??Fn(a),s=e.onSessionLost,c,l=0,u=[],d=[],f=0,p,m=0,h,g,_,v,y=()=>{let e=t.getTokens(),n=e?.refresh_token;if(!n)return p=l,e;p!==void 0&&(f=Math.max(f,p,m),p=void 0);let r=Mn(n)??``;return r!==c?.fp&&(c={fp:r,seq:l}),e},b=()=>Y(n.getTokens()?.refresh_token),x=()=>i()??X(n.getTokens()),ee=()=>{let e=b();return!e||e.iat===void 0||!x()?!1:!o.isRetired(e)&&!o.isEnded(e)},S=e=>{let t=b();if(!t||t.fp===e.fp||!ee())return!1;let n=x();return!e.sub||n!==e.sub||t.iat===void 0||e.iat===void 0?!1:t.sid!==e.sid||o.isAfter(t,e)},C=e=>{let t=x();return d.some(n=>n.seq>e&&(!n.sub||!t||n.sub===t))},w=()=>{let e=x();for(let t=u.length-1;t>=0;t--){let n=u[t];if(!n||n.seq<=f)break;if(!n.sub||!e||n.sub===e)return n}},T=()=>{if(!ee())return`end`;let e=c?.seq??0,t=w();return C(t?Math.min(e,t.seq):e)?`end`:t?S(t)?`keep`:`end`:s?`wait`:`end`},E=()=>{h?.(),h=void 0},D=(e=!1)=>{let t=T();t===`wait`&&e&&(t=`end`),t!==`wait`&&E(),t===`wait`&&!h&&(h=r(()=>{h=void 0,y()?.refresh_token?k():D(!0)===`end`&&s?.(`emptied`)},Vt));let n=t===`keep`?w():void 0;return n&&(m=Math.max(m,n.seq)),n&&g!==n.fp&&(g=n.fp,a(`[passflow] The shared token storage was emptied by the end of the session of ${n.fp}, a refresh token the ${b()?.fp??`(none)`} this tab holds is ahead of: keeping it. Nothing is refreshed until the storage holds a token again.`)),t},te=e=>e.held!==void 0&&b()?.fp===e.held.cachedFp,O=e=>{let t=b();return!!t&&!o.isRetired(t)&&!o.isEnded(t)&&o.isAfter(t,e)},ne=e=>{if(!O(e))return!1;if(o.isRetired(e))return!0;let t=b();return e.iat!==void 0&&t?.iat!==void 0&&t.sid===e.sid},re=(e,t)=>o.isForward(e,t)?!0:!!e&&!!t&&e.iat!==void 0&&e.sid!==t.sid&&o.isRetired(t)&&!o.isRetired(e)&&!o.isEnded(e),ie=e=>{let t=b();t&&t.fp!==Mn(e.refresh_token)&&o.retire(t),n.setTokensCache(e)},ae=e=>{let t=y(),n=t?.refresh_token;if(n===e.refreshToken)return null;if(!t||!n)return D()===`end`?{kind:`ended`,cause:`emptied`}:{kind:`superseded`,adopted:!1};let r=Rn(t.access_token)??Rn(n);if(e.sub&&r&&e.sub!==r)return{kind:`identity-changed`,saved:!1};let i=Y(n);if(o.isEnded(i))return i&&S(i)?{kind:`superseded`,adopted:!1}:{kind:`ended`,cause:`ended`};o.retire(e.order);let a=b();return re(i,a)||i?.fp===a?.fp&&!o.isRetired(i)?(ie(t),{kind:`superseded`,adopted:!0}):{kind:`superseded`,adopted:!1}},oe=e=>S(e)?{kind:`superseded`,adopted:!1}:{kind:`ended`,cause:`ended`},k=()=>{let t=y();if(!t?.refresh_token){D()===`end`&&s?.(`emptied`);return}E();let n=i(),r=X(t);n&&r&&n!==r?s?.(`identity-changed`):e.onStoredSessionSeen?.()},A=!!s||!!e.onStoredSessionSeen,j=A&&e.onStorageChange?e.onStorageChange(k):void 0,M=A&&e.onWake?e.onWake(k):void 0,N=()=>{let e=y();if(!e?.refresh_token){if(D()===`end`)throw new In(`emptied`);return`held`}let t=n.getTokens();if(e.refresh_token===t?.refresh_token)return`send`;let r=i()??X(t),a=X(e);if(r&&a&&r!==a)throw new Ln;let s=Y(e.refresh_token);if(o.isEnded(s)){if(s&&S(s))return`held`;throw new In(`ended`)}let c=Y(t?.refresh_token);return re(s,c)?(ie(e),`adopted`):s&&c&&s.sid!==c.sid?`send`:s&&O(s)?`held`:`send`},se=e=>{let t=i(),r=Rn(e);if(t&&r&&t!==r)return{kind:`identity-changed`};let a=Y(e)??{fp:e};if(o.isEnded(a))return S(a)?{kind:`superseded`}:{kind:`ended`};if(o.isRetired(a)&&O(a))return{kind:`superseded`};let s={refreshToken:e,order:a},c=t??r??Rn(n.getTokens()?.access_token);return c!==void 0&&(s.sub=c),v&&v.fp===a.fp&&(s.held={cachedFp:v.cachedFp}),{kind:`send`,sent:s}},ce=(e,r)=>{if(o.isEnded(e.order))return oe(e.order);let i=ae(e);if(i)return i;if(!te(e)&&ne(e.order))return o.retire(e.order),a(`[passflow] Refused to save a late refresh result: it rotated ${e.order.fp} into ${Mn(r.refresh_token)??`(no refresh token)`}, but this tab already holds ${b()?.fp??`(none)`}, a later successor of ${e.order.fp}. Neither saved nor adopted.`),{kind:`superseded`,adopted:!1};let s=X(r);if(e.sub&&s&&s!==e.sub)return t.saveTokens(r),{kind:`identity-changed`,saved:!0};let c=Y(r.refresh_token);return c&&(zn(c,e.order)||zn(c,b()))?(a(`[passflow] Refused to save a refresh result older than the token this tab holds: ${e.order.fp} was answered with ${c.fp}. Neither saved nor adopted.`),{kind:`superseded`,adopted:!1}):(o.retire(e.order),t.saveTokens(r),n.setTokensCache(r),{kind:`saved`})},P=(e,t)=>{if(o.isEnded(e.order))return oe(e.order);let n=ae(e);if(n)return n.kind===`identity-changed`?{kind:`identity-changed`}:n;if(o.isRetired(e.order)&&O(e.order))return{kind:`superseded`,adopted:!1};let r=wn(t),i=r.kind===`blocked`||r.kind===`auth`;return te(e)&&i?(o.retire(e.order),_=e.order,{kind:`own`,failure:r,heldRefused:!0}):(r.kind===`blocked`&&(o.retire(e.order),_=e.order),{kind:`own`,failure:r,heldRefused:!1})},F=e=>{if(!Bn(e))return!1;let{from:t,fromIat:r,fromSid:a,to:c,tokens:l}=e;if(typeof t!=`string`||typeof c!=`string`||!Bn(l))return!1;let u=l;if(typeof u.access_token!=`string`||u.access_token===``||typeof u.refresh_token!=`string`||u.refresh_token===``||Mn(u.refresh_token)!==c)return!1;let d=y();if(!d?.refresh_token)return!1;let f=n.getTokens(),p=i()??X(f),m=X(u);if(p&&m&&p!==m)return s?.(`identity-changed`),!1;let h=Y(u.refresh_token),g=Y(f?.refresh_token);g&&g.fp===t&&o.retire(g);let _=()=>{if(t!==c&&typeof r==`number`&&Number.isFinite(r)&&typeof a==`string`){let e={fp:t,iat:r};h?.sub!==void 0&&(e.sub=h.sub),a!==``&&(e.sid=a),o.retire(e)}return!0};return g?.fp===c?_():!o.isForward(h,g)||g?.fp!==t&&Mn(d.refresh_token)!==c?!1:(ie({...u}),_())},I=e=>{if(!e||!_)return!1;let t=_;return e.fp===t.fp||o.isEnded(e)||o.isRetired(e)?!1:e.iat!==void 0&&t.iat!==void 0&&e.sid!==t.sid||o.isAfter(e,t)},le=()=>{let e=b();if(!e)return!1;if(I(e))return!0;let t=y(),r=Y(t?.refresh_token);if(!t||!r||r.fp===e.fp||!I(r)||!re(r,e))return!1;let a=i()??X(n.getTokens()),o=X(t);return a&&o&&a!==o?(s?.(`identity-changed`),!1):(ie(t),!0)},L=e=>{let t=Y(e?.refresh_token),n={},r=i()??X(e);return t?.fp!==void 0&&(n.fp=t.fp),r!==void 0&&(n.sub=r),t?.sid!==void 0&&(n.sid=t.sid),t?.iat!==void 0&&(n.iat=t.iat),n};return{lineage:o,checkStoredBeforeSend:N,beginSend:se,commitSave:ce,judgeFailure:P,adoptTokens:F,adoptSuccessor:le,beginHeldSend:()=>{let e=Y(y()?.refresh_token);if(!e||o.isRetired(e)||o.isEnded(e))return v=void 0,!1;let t=b()?.fp;return v=t===void 0?{fp:e.fp}:{fp:e.fp,cachedFp:t},!0},endHeldSend:()=>{v=void 0},endLineage:e=>o.end(e),endedElsewhere:(e,t)=>{let n=!y()?.refresh_token;l+=1,e===`signed-out`?(d.push(t.sub===void 0?{seq:l}:{sub:t.sub,seq:l}),d.length>4&&d.shift()):t.fp&&(u.push({...t,fp:t.fp,seq:l}),u.length>4&&u.shift()),b()&&n&&D()===`end`&&s?.(`emptied`)},session:()=>L(n.getTokens()),storedSession:()=>L(y()),dropSession:()=>{n.setTokensCache(void 0),n.stopTokenCheck?.()},deleteIfStillDead:e=>{let n=Y(y()?.refresh_token);if(!n)return!1;let r=n.sid===e.sid&&(!n.sub||!e.sub||n.sub===e.sub);return n.fp===e.fp||r&&n.iat!==void 0&&e.iat!==void 0&&n.iat<e.iat?(t.deleteTokens(),!0):!1},stop:()=>{j?.(),M?.(),E()}}}function Hn(){let e,t,n=new Promise((n,r)=>{e=n,t=r});return n.catch(()=>void 0),{promise:n,resolve:e,reject:t}}var Un={strikes:q.sessionEnded,"session-ended":q.sessionEnded,"stored-ended":q.sessionEnded,"signed-out":q.signedOut,emptied:q.signedOut,"signed-out-here":q.signedOut,"successor-timeout":q.successorTimeout,"identity-changed":q.identityChanged,disposed:q.disposed};function Wn(e){throw Error(`Unexpected refresh state: ${JSON.stringify(e)}`)}function Gn(e){if(e===void 0||!Number.isFinite(e))return 3;let t=Math.floor(e);return t>=1?t:3}function Kn(e,t){return e instanceof Error&&e.message?e.message:t}function qn(e){if(typeof e!=`object`||!e)return;let t=e.id;return typeof t==`string`||typeof t==`number`?t:void 0}function Jn(e){let t={};return e?.access_token&&(t.access_token=e.access_token),e?.refresh_token&&(t.refresh_token=e.refresh_token),e?.id_token&&(t.id_token=e.id_token),e?.scopes&&(t.scopes=[...e.scopes]),t}function Yn(e,t){let n={};e.access_token&&(n.access_token=e.access_token),e.refresh_token&&(n.refresh_token=e.refresh_token),e.id_token&&(n.id_token=e.id_token);let r=t?.scopes??e.scopes;return r&&(n.scopes=r),n}function Xn(e){let{emit:t,storage:n,cache:r,transport:i,coordination:a}=e,o=a.clock,s=e.logger??vn(),c=Gn(e.strikes),l=a.transports?Dn({locks:a.transports.locks,channel:a.transports.channel,tabId:a.transports.tabId,names:a.names,clock:o}):On(),u={kind:`idle`},d=0,f=!1,p=!a.warnOnFirstCycle,m=0,h=0,g,_,v,y,b,x,ee,S,C=!1,w=()=>o.now(),T=()=>i.mode(),E=()=>Mn(r.getTokens()?.refresh_token),D=()=>({...r.getTokens()??{}}),te=()=>i.opaqueMarker?i.opaqueMarker():n.getTokens()?.id_token,O=()=>(ee===void 0&&(ee=X(r.getTokens()??n.getTokens())),ee),ne=new Set,re=new Set,ie=e=>()=>{for(let t of Array.from(e))t()},ae=a.onStorageChange?.(ie(ne)),oe=e.platform?.onForeground(ie(re)),k=Vn({storage:n,cache:r,identity:O,schedule:(e,t)=>o.setTimeout(e,t),onStorageChange:e=>(ne.add(e),()=>ne.delete(e)),onWake:e=>(re.add(e),()=>re.delete(e)),onSessionLost:e=>fe(e),onStoredSessionSeen:()=>{u.kind===`blocked-wait`&&ke()},warn:e=>s.warn(e)}),A=e=>({trigger:e,startedAt:w(),plain:Hn(),fresh:[]}),j=e=>e.kind===`idle`||e.kind===`ended`?void 0:e.pending,M=(e,t)=>{if(t===void 0)return e.plain.promise;let n={callTime:t,deferred:Hn()};return e.fresh.push(n),n.deferred.promise},N=(e,t,n=!1)=>{e.plain.resolve(D());for(let r of e.fresh)n||t!==void 0&&t>=r.callTime?r.deferred.resolve(D()):Ie(`refresh-token`,r.callTime).then(r.deferred.resolve,r.deferred.reject);e.fresh=[]},se=(e,t,n)=>{e.plain.reject(t);for(let r of e.fresh)n!==void 0&&n<r.callTime?Ie(`refresh-token`,r.callTime).then(r.deferred.resolve,r.deferred.reject):r.deferred.reject(t);e.fresh=[]},ce=(e,t)=>{if(e){e.plain.reject(t);for(let n of e.fresh)n.deferred.reject(t);e.fresh=[]}},P=(e,n,r,i)=>{let a={message:Kn(r,`Token refresh failed`),originalError:r,operation:e,source:n},o=qn(r);o!==void 0&&(a.code=o),i&&(a.refresh=i),t(`error`,a)},F=(e,t)=>{let n={classification:e,willRetry:t!==void 0,strikes:h,maxStrikes:c};return t!==void 0&&(n.nextRetryAt=t),n},I=(e,n)=>{if(u.kind===`refreshing`&&(u.request.outcome=!0),m=0,h=0,g=void 0,v=void 0,l.setRetryInfo(void 0),r.tokenExpiredFlag!==void 0&&(r.tokenExpiredFlag=!1),r.startTokenCheck?.(),t(`refresh`,{tokens:r.getTokens(),source:e}),t(`token-cache-expired`,{isExpired:!1}),_){let{since:e}=_;_=void 0,t(`refresh:recovered`,{since:e,origin:n})}},le=(e,n,r)=>{if(_)return;_={since:e};let i={since:e,origin:r};n!==void 0&&(i.nextRetryAt=n),t(`refresh:failing`,i)},L=(e,t)=>{let n=r.getTokens(),i=Mn(n?.refresh_token);e.fp&&i&&l.post({type:`tokens-refreshed`,tokens:Jn(n),from:e.fp,...e.iat===void 0?{}:{fromIat:e.iat},fromSid:e.sid??``,to:i,...t===void 0?{}:{sentAt:t}})},ue=()=>{p||(p=!0,s.warn(en))},de=e=>{(e.kind===`backoff`||e.kind===`blocked-wait`)&&e.cancel()},R=(e,n)=>{if(u.kind===`ended`)return;let r=j(u);de(u);let a=k.session(),o=O();switch(d+=1,m=0,h=0,g=void 0,_=void 0,v=void 0,l.setRetryInfo(void 0),C||l.release(),b={...a,cause:e},e!==`disposed`&&k.dropSession(),(e===`strikes`||e===`successor-timeout`)&&T()!==`json`&&i.invalidate(),u={kind:`ended`,cause:e},ce(r,n??new J(Un[e])),e){case`strikes`:t(`session:expired`,{reason:`refresh_failed`,origin:`this-tab`});break;case`session-ended`:case`stored-ended`:t(`session:expired`,{reason:`refresh_failed`,origin:`other-tab`});break;case`signed-out`:case`emptied`:t(`signout`,o===void 0?{origin:`other-tab`}:{origin:`other-tab`,userId:o});break;case`successor-timeout`:t(`session:expired`,{reason:`successor_timeout`,origin:`this-tab`});break;case`identity-changed`:t(`session:expired`,{reason:`identity_changed`,origin:`this-tab`});break;case`signed-out-here`:case`disposed`:break;default:Wn(e)}},z=()=>{if(u.kind!==`ended`||u.cause===`disposed`||f||T()!==`json`)return;let e=n.getTokens(),i=Y(e?.refresh_token);if(!e?.refresh_token||!e.access_token||!i||k.lineage.isEnded(i)||k.lineage.isRetired(i))return;let a=b,o=X(e);if(a&&a.cause!==`successor-timeout`&&(!a.sub||!o||a.sub===o)&&i.sid===a.sid)return;d+=1,m=0,h=0,g=void 0,_=void 0,v=void 0,b=void 0,ee=o;let s={...e};r.setTokensCache(s),r.tokenExpiredFlag!==void 0&&(r.tokenExpiredFlag=!1),r.startTokenCheck?.(),u={kind:`idle`},t(`signin`,{tokens:s,origin:`other-tab`})},fe=e=>{u.kind===`ended`||f||T()===`json`&&(R(e===`emptied`?`emptied`:`identity-changed`),e===`identity-changed`&&z())},pe=e=>{e instanceof Ln?(R(`identity-changed`),z()):e instanceof In?R(e.cause===`emptied`?`emptied`:`stored-ended`):R(`stored-ended`,e)},me=()=>{u={kind:`idle`},C||l.release()},he=e=>!e.from||T()!==`json`||e.from===E()||e.from===Mn(n.getTokens()?.refresh_token),ge=e=>{let t=g;if(!t)return;if(!l.holding){u={kind:`waiting`,pending:e},l.request(t.nextAt+G);return}l.setRetryInfo(t);let n=d,r=t.nextAt;u={kind:`backoff`,pending:e,dueAt:r,cancel:o.setTimeout(()=>{n===d&&_e()},Math.max(0,r-w()))}},_e=()=>{if(u.kind!==`backoff`||C)return;let{pending:e,dueAt:t}=u;!l.holding||l.foreignHolderHeard()||w()-t>2e4?(l.release(),u={kind:`waiting`,pending:e},l.request((g?.nextAt??w())+G)):(u={kind:`waiting`,pending:e},ye()||ve())},ve=()=>{u.kind===`idle`&&l.release()},ye=()=>{if(u.kind!==`waiting`)return!1;let e=u.pending;if(T()!==`json`)return be(e);let t=k.session(),n;try{n=k.checkStoredBeforeSend()}catch(e){return pe(e),!1}if(n===`held`){let t=E();return!v||v.fp!==t||w()-v.at<2e4?(v&&v.fp===t||(v={fp:t,at:w()}),u={kind:`idle`},N(e,void 0,!0),!1):(v={fp:t,at:w()},k.beginHeldSend()?xe(e,`held`):(u={kind:`idle`},N(e,void 0,!0),!1))}if(v=void 0,n===`adopted`){if(I(`adopted`,`other-tab`),L(t),e.fresh.length===0)return u={kind:`idle`},N(e,void 0),!1;e.plain.resolve(D())}return g&&!he(g)&&(g=void 0),g&&g.nextAt>w()?(m=g.attempt,h=g.strikes,g.failingSince!==void 0&&le(g.failingSince,g.nextAt,`other-tab`),ge(e),!0):(g&&(m=g.attempt,h=g.strikes),xe(e,e.trigger===`held`?`refresh-token`:e.trigger))},be=e=>y!==void 0&&y>=e.startedAt?(r.setTokensCache(n.getTokens()),I(`adopted`,`other-tab`),u={kind:`idle`},N(e,y),!1):g&&g.nextAt>w()?(m=g.attempt,h=g.strikes,ge(e),!0):Se(e,e.trigger,void 0,void 0),xe=(e,t)=>{let r=n.getTokens(),i=r?.refresh_token;if(!i)return u={kind:`idle`},N(e,void 0,!0),!1;let a=k.beginSend(i);switch(a.kind){case`superseded`:return k.endHeldSend(),I(`adopted`,`other-tab`),u={kind:`idle`},N(e,void 0),!1;case`ended`:return k.endHeldSend(),R(`stored-ended`),!1;case`identity-changed`:return k.endHeldSend(),R(`identity-changed`),z(),!1;case`send`:return Se(e,t,a.sent,r);default:return Wn(a)}},Se=(e,n,r,a)=>{let o={generation:d,sentAt:w(),trigger:n,settled:Hn()};r?o.sent=r:o.marker=te(),a&&(o.stored=a),u={kind:`refreshing`,pending:e,request:o},l.setRetryInfo(g),t(`refresh:start`,{});let c;try{c=i.send(a?{tokens:a}:{})}catch(e){c=Promise.reject(e)}return c.then(e=>{we(o,e).catch(e=>s.error(`[passflow] Applying a refresh result failed`,e)).finally(()=>o.settled.resolve())},e=>{Te(o,e),o.settled.resolve()}),!0},Ce=e=>!f&&e.generation===d&&u.kind===`refreshing`&&u.request===e,we=async(e,t)=>{if(e.sent?.held&&k.endHeldSend(),!Ce(e)||u.kind!==`refreshing`)return;let{pending:a}=u;if(!e.sent){let o=X({...t.id_token?{id_token:t.id_token}:{}}),s=O();if(o!==void 0&&s!==void 0&&o!==s){let t=new J(q.identityChanged);P(`refresh`,e.trigger,t,F(`auth`)),R(`identity-changed`,t);return}try{await i.applyOpaque(t)}catch(t){Te(e,t);return}if(!Ce(e))return;r.setTokensCache({...n.getTokens()??{},...Yn(t,void 0)}),I(`refresh`,`this-tab`);let c=O();l.post(c===void 0?{type:`session-refreshed`,at:w()}:{type:`session-refreshed`,at:w(),sub:c}),me(),N(a,e.sentAt);return}let o=E(),s=k.commitSave(e.sent,Yn(t,e.stored));switch(s.kind){case`saved`:I(`refresh`,`this-tab`),L(e.sent.order,e.sentAt),me(),N(a,e.sentAt);return;case`superseded`:e.outcome&&E()===o||I(`adopted`,`other-tab`),s.adopted&&L(e.sent.order),me(),N(a,e.sentAt);return;case`ended`:{let t=new J(s.cause===`emptied`?q.signedOut:q.sessionEnded);P(`refresh`,e.trigger,t,F(`auth`)),R(s.cause===`emptied`?`emptied`:`stored-ended`,t);return}case`identity-changed`:{let t=new J(q.identityChanged);P(`refresh`,e.trigger,t,F(`auth`)),R(`identity-changed`,t),z();return}default:Wn(s)}},Te=(e,t)=>{if(e.sent?.held&&k.endHeldSend(),!Ce(e)||u.kind!==`refreshing`)return;let{pending:n}=u,r,i=!1;if(e.sent){let a=E(),o=k.judgeFailure(e.sent,t);switch(o.kind){case`superseded`:e.outcome&&E()===a||I(`adopted`,`other-tab`),me(),N(n,e.sentAt);return;case`ended`:P(`refresh`,e.trigger,t,F(`auth`)),R(o.cause===`emptied`?`emptied`:`stored-ended`,t);return;case`identity-changed`:P(`refresh`,e.trigger,t,F(`auth`)),R(`identity-changed`,t),z();return;case`own`:r=o.failure,i=o.heldRefused;break;default:Wn(o)}}else r=wn(t,w());if(i)P(`refresh`,e.trigger,t,F(r.kind)),I(`adopted`,`other-tab`),me(),N(n,void 0,!0);else switch(r.kind){case`blocked`:P(`refresh`,e.trigger,t,F(`blocked`)),Oe(n,e.sentAt,t,e.marker);return;case`auth`:if(h+=1,m+=1,h>=c){P(`refresh`,e.trigger,t,F(`auth`)),De(e,t);return}Ee(e,n,t,r);return;case`transient`:m+=1,Ee(e,n,t,r);return;default:Wn(r.kind)}},Ee=(e,t,n,r)=>{let i=w()+Tn(m,o.random(),r.retryAfterMs),a=r.kind===`auth`?`auth`:`transient`;P(`refresh`,e.trigger,n,F(a,i)),a===`transient`&&le(w(),i,`this-tab`);let s={kind:a,attempt:m,nextAt:i,strikes:h},c=e.sent?.order.fp;c&&(s.from=c),_&&(s.failingSince=_.since),g=s,l.holding&&l.post({type:`retry-scheduled`,message:Kn(n,`Token refresh failed`),retry:s}),ge(A(`retry`)),se(t,n,e.sentAt)},De=(e,t)=>{let n=e.sent?.sub??O(),r=e.sent?.order,i={};r?.fp&&(i.fp=r.fp),n&&(i.sub=n),r?.sid&&(i.sid=r.sid),r?.iat!==void 0&&(i.iat=r.iat),(i.fp||i.sub)&&l.post({type:`session-ended`,...i}),i.fp&&(x=i.fp,k.endLineage({...i,fp:i.fp})),r&&k.deleteIfStillDead(r),R(`strikes`,t)},Oe=(e,t,n,r)=>{l.release(),s.warn(`[passflow] The refresh token was already used, most likely by another tab; waiting for its successor: ${Kn(n,`blocked`)}`);let i=d,a=w()+zt,c={kind:`blocked-wait`,pending:e,deadline:a,sentAt:t,cancel:()=>void 0,marker:r};if(u=c,ke())return;let f=T()!==`json`&&!l.coordinated&&!e.cookieRetried,p=()=>{i===d&&u===c&&(ke()||(f?(e.cookieRetried=!0,u={kind:`waiting`,pending:e},l.request()):w()>=a?(s.warn(`[passflow] No successor of the used refresh token appeared; ending the session in this tab only.`),R(`successor-timeout`)):c.cancel=o.setTimeout(p,Bt)))};c.cancel=o.setTimeout(p,f?Ht:Bt)},ke=()=>{if(u.kind!==`blocked-wait`)return!1;let e=u;if(T()===`json`){if(!k.adoptSuccessor())return!1}else{let t=y!==void 0&&y>=e.sentAt,i=te(),a=!l.coordinated&&i!==void 0&&i!==e.marker;if(!t&&!a)return!1;r.setTokensCache(n.getTokens())}return u===e&&(e.cancel(),I(`adopted`,`other-tab`),u={kind:`idle`},N(e.pending,void 0,!0),!0)},Ae=e=>{let t=O(),n=!e.sub||!t||e.sub===t;return T()===`json`?!!e.fp&&e.fp===E()&&n:!e.fp&&n},je=(e,t)=>{if(e!==`signed-out`||!t.sub)return!1;let n=O();return n!==void 0&&t.sub===n},Me=(e,t,n)=>{if(u.kind===`ended`||!he(e))return;let r=g?.nextAt;if(g=e,e.failingSince!==void 0&&le(e.failingSince,e.nextAt,`other-tab`),!t||u.kind!==`waiting`)return;let i=new J(e.kind===`transient`?q.unavailable:q.authRetry,{nextRetryAt:e.nextAt,cause:n||void 0}),a=u.pending;u.pending=A(a.trigger),se(a,i,r)},Ne=(e,t)=>{switch(t&&I(`adopted`,`other-tab`),u.kind){case`waiting`:case`backoff`:{let t=u.pending;de(u),me(),N(t,e);return}case`blocked-wait`:{let e=u.pending;u.cancel(),u={kind:`idle`},N(e,void 0,!0);return}case`idle`:case`refreshing`:case`ended`:return;default:Wn(u)}},B=e=>{let t={};e.fp&&(t.fp=e.fp),e.sub&&(t.sub=e.sub),e.sid&&(t.sid=e.sid),e.iat!==void 0&&(t.iat=e.iat);let n=u.kind!==`ended`&&(Ae(t)||je(e.type,t));t.fp&&k.endLineage({...t,fp:t.fp}),n&&R(e.type===`signed-out`?`signed-out`:`session-ended`),k.endedElsewhere(e.type,t)},Pe=e=>{if(!f)switch(e.type){case`tokens-refreshed`:{if(u.kind===`ended`){z();return}if(T()!==`json`)return;let t=E();if(!k.adoptTokens(e))return;let n=E()!==t;if(!n&&u.kind===`idle`)return;g=void 0,Ne(e.sentAt,n);return}case`session-refreshed`:{if(T()===`json`||u.kind===`ended`)return;let t=O();if(e.sub&&t&&e.sub!==t||(y=Math.max(y??0,e.at),u.kind===`refreshing`))return;if(r.setTokensCache(n.getTokens()),g=void 0,u.kind===`blocked-wait`){ke();return}Ne(e.at,!0);return}case`still-refreshing`:e.retry&&Me(e.retry,!1,``),Fe();return;case`retry-scheduled`:Me(e.retry,!0,e.message),Fe();return;case`refresh-failed`:if(u.kind===`ended`||T()!==`json`||e.from!==E()&&e.from!==Mn(n.getTokens()?.refresh_token))return;if(le(w(),void 0,`other-tab`),u.kind===`waiting`){let t=u.pending;u.pending=A(t.trigger),se(t,new J(q.unavailable,{cause:e.message}),void 0)}return;case`lock-wanted`:if(u.kind===`backoff`&&l.holding&&!C){let e=u.pending;u.cancel(),l.release(),u={kind:`waiting`,pending:e},l.request((g?.nextAt??w())+G)}return;case`session-ended`:case`signed-out`:B(e);return;case`takeover`:case`rate-limited`:return;default:Wn(e)}},Fe=()=>{S&&!l.holding&&l.post({type:`lock-wanted`,purpose:S.purpose})};l.attach({onGranted:()=>{if(f)return!1;if(S){let e=S;return S=void 0,e.granted(),!0}return u.kind===`waiting`&&ye()},onLockLost:()=>{if(u.kind===`backoff`){let e=u.pending;u.cancel(),u={kind:`waiting`,pending:e},l.request((g?.nextAt??w())+G)}},onMessage:Pe});let V=()=>{if(f)return;if(u.kind===`ended`){z();return}if(u.kind===`blocked-wait`&&T()!==`json`){ke();return}if(u.kind!==`idle`||T()!==`json`||C)return;let e=k.session();try{if(k.checkStoredBeforeSend()!==`adopted`)return}catch{return}I(`adopted`,`other-tab`),l.coordinated&&L(e)};ne.add(V),re.add(V);let Ie=(e,t)=>{if(f)return Promise.reject(new J(q.disposed));switch(u.kind){case`ended`:return Promise.reject(new J(q.sessionEnded));case`idle`:{let n=A(e);u={kind:`waiting`,pending:n};let r=M(n,t);return l.holding&&!C?ye()||ve():l.request(g?g.nextAt+G:void 0),r}case`waiting`:case`refreshing`:case`backoff`:case`blocked-wait`:return M(u.pending,t);default:return Wn(u)}},Le=e=>{if(f)return Promise.reject(new J(q.disposed));if(ue(),u.kind===`ended`)return Promise.reject(new J(q.sessionEnded));if(T()===`json`&&!r.getTokens()?.refresh_token){let t=n.getTokens();if(!t?.refresh_token){let n=Error(t?`No refresh token found`:`No tokens found`);return P(`refresh`,e.trigger,n),Promise.reject(n)}}return Ie(e.trigger,e.fresh?w():void 0)},Re=e=>{if(f)return Promise.reject(new J(q.disposed));if(u.kind===`ended`)return Promise.resolve(r.getTokens());let t=u.kind===`backoff`||u.kind===`blocked-wait`||g!==void 0&&g.nextAt>w();return e.allowStale&&t?Promise.resolve(r.getTokens()):Le({trigger:e.trigger}).then(()=>r.getTokens())},H=(e,t)=>l.holding?Promise.resolve(`granted`):new Promise(n=>{let r=()=>void 0,i={purpose:e,granted:()=>{r(),n(`granted`)}};S=i,l.post({type:`lock-wanted`,purpose:e}),l.request(),r=o.setTimeout(()=>{S===i&&(S=void 0,u.kind!==`waiting`&&l.release(),n(`timeout`))},Math.max(0,t))}),ze=async e=>{if(u.kind!==`refreshing`)return;let t=u.request.settled.promise;await new Promise(n=>{let r=o.setTimeout(n,Math.max(0,e));t.then(()=>{r(),n()})})},Be=()=>{if(C=!1,!f&&l.holding){if(u.kind===`waiting`)ye()||ve();else if(u.kind===`backoff`){let e=u.pending;u.cancel(),ge(e)}else u.kind===`idle`&&g&&g.nextAt>w()&&he(g)?(m=g.attempt,h=g.strikes,ge(A(`retry`))):u.kind===`idle`&&l.release()}},Ve=async(e,t)=>{if(f)throw new J(q.disposed);ue();let n=w()+Ut;if(await ze(n-w()),(!l.holding||u.kind===`refreshing`)&&(u.kind===`refreshing`?`timeout`:await H(`commit`,n-w()))===`timeout`){let e=new jn(`lock-timeout`);throw P(`upgrade.commit`,`upgrade`,e),e}C=!0;try{return await He(e,t)}finally{Be()}},He=async(e,a)=>{let o,s;if(T()===`json`){let e=k.session();try{k.checkStoredBeforeSend()===`adopted`&&(I(`adopted`,`other-tab`),L(e))}catch{}s=n.getTokens();let t=s?.refresh_token;if(!t){let e=Error(s?`No refresh token found`:`No tokens found`);throw P(`upgrade.commit`,`upgrade`,e),e}let r=k.beginSend(t);o=r.kind===`send`?r.sent:{refreshToken:t,order:Y(t)??{fp:t}}}let c=w();t(`refresh:start`,{});let u;try{u=await i.send(s?{tokens:s,upgrade:e}:{upgrade:e})}catch(e){throw o&&k.judgeFailure(o,e),P(`upgrade.commit`,`upgrade`,e),e}try{i.assertPin(a)}catch(e){throw P(`upgrade.commit`,`upgrade`,e),e}if(!o){await i.applyOpaque(u),r.setTokensCache({...n.getTokens()??{},...Yn(u,void 0)}),Ue(c);let e=O();return l.post(e===void 0?{type:`session-refreshed`,at:w()}:{type:`session-refreshed`,at:w(),sub:e}),D()}let d=k.commitSave(o,Yn(u,s));if(d.kind===`saved`)return Ue(c),L(o.order,c),D();let f=new jn(`superseded`);throw P(`upgrade.commit`,`upgrade`,f),d.kind===`superseded`&&d.adopted&&I(`adopted`,`other-tab`),f},Ue=e=>{if(I(`upgrade`,`this-tab`),u.kind===`waiting`||u.kind===`backoff`||u.kind===`blocked-wait`){let t=u.pending;de(u),u={kind:`idle`},N(t,e)}},We=()=>{let e=k.storedSession(),t=e.fp?e:k.session();(T()===`json`?!t.fp:!t.sub)||t.fp&&t.fp===x||(l.post({type:`signed-out`,...t}),t.fp&&k.endLineage({...t,fp:t.fp}))},Ge=()=>{let e=j(u);ce(e,new J(q.signedOut)),(u.kind===`backoff`||u.kind===`blocked-wait`||u.kind===`waiting`)&&(de(u),u={kind:`idle`})};return{refresh:Le,ensureFresh:Re,commitUpgrade:Ve,signOut:async e=>{if(f)return e(n.getTokens()?.refresh_token);let t=w()+Wt;Ge(),await ze(t-w()),Ge(),l.coordinated&&!l.holding&&await H(`logout`,t-w());try{We(),await e(n.getTokens()?.refresh_token)}finally{u.kind!==`ended`&&R(`signed-out-here`),x=void 0,l.release()}},signOutNow:e=>{if(f)return e(n.getTokens()?.refresh_token);Ge();try{We(),e(n.getTokens()?.refresh_token)}finally{u.kind!==`ended`&&R(`signed-out-here`),x=void 0}},sessionStarted:()=>{if(f)return;let e=j(u);de(u),d+=1,m=0,h=0,g=void 0,_=void 0,v=void 0,b=void 0,x=void 0,ee=void 0,l.setRetryInfo(void 0),u={kind:`idle`},C||l.release(),e&&N(e,void 0,!0)},identity:O,get coordinated(){return l.coordinated},get busy(){return u.kind!==`idle`&&u.kind!==`ended`},get ended(){return u.kind===`ended`},dispose:()=>{if(f)return;let e=j(u);de(u),f=!0,d+=1,u={kind:`ended`,cause:`disposed`},ce(e,new J(q.disposed)),S=void 0,k.stop(),l.dispose(),ae?.(),oe?.()}}}var Z=function(e){return e.SignIn=`signin`,e.SignInStart=`signin:start`,e.Register=`register`,e.RegisterStart=`register:start`,e.SignOut=`signout`,e.SessionRestored=`session:restored`,e.SessionExpired=`session:expired`,e.Error=`error`,e.Refresh=`refresh`,e.RefreshStart=`refresh:start`,e.TokenCacheExpired=`token-cache-expired`,e.TwoFactorRequired=`2fa:required`,e.TwoFactorSetupStarted=`2fa:setup_started`,e.TwoFactorEnabled=`2fa:enabled`,e.TwoFactorDisabled=`2fa:disabled`,e.TwoFactorVerified=`2fa:verified`,e.TwoFactorRecoveryUsed=`2fa:recovery_used`,e.TwoFactorRecoveryCodesLow=`2fa:recovery_low`,e.TwoFactorRecoveryCodesExhausted=`2fa:recovery_exhausted`,e.TwoFactorSetupMagicLinkValidated=`2fa:magic_link_validated`,e.TwoFactorSetupMagicLinkFailed=`2fa:magic_link_failed`,e.TwoFactorChallengeReceived=`two_factor_challenge_received`,e.TwoFactorMethodSwitched=`two_factor_method_switched`,e.TwoFactorDeviceTrusted=`two_factor_device_trusted`,e.RefreshFailing=`refresh:failing`,e.RefreshRecovered=`refresh:recovered`,e}({}),Zn=class{constructor(){this.subscribers=new Map}subscribe(e,t){if(t?.length){let n=new Set(t);this.subscribers.set(e,n)}else this.subscribers.set(e,null)}unsubscribe(e,t){if(!t?.length){this.subscribers.delete(e);return}let n=this.subscribers.get(e);n&&(t.forEach(e=>n.delete(e)),n.size===0&&this.subscribers.delete(e))}notify(e,t){e===`error`&&jt(this,t?.originalError),this.subscribers.forEach((n,r)=>{(!n||n.has(e))&&r.onAuthChange?.(e,t)})}notifyError(e){return W(this,e)}},Q={twoFactorCodeInvalid:`error.api.request.2fa_code.invalid`,challengeInvalid:`error.upgrade.challenge_invalid`,challengeSessionMismatch:`error.upgrade.challenge_session_mismatch`,challengeTooManyAttempts:`error.upgrade.challenge_too_many_attempts`,unsupportedFactor:`error.upgrade.unsupported_factor`,noSession:`error.upgrade.no_session`,unavailable:`error.upgrade.unavailable`,methodNotRegistered:`error.upgrade.method_not_registered`,prepareNotRequired:`error.upgrade.prepare_not_required`,methodNotSupported:`error.2fa.method_not_supported`,twoFactorNotEnabled:`error.2fa.not_enabled`,notImplemented:`error.not.implemented`,tokenInvalid:`error.api.request.token.invalid`},Qn=Object.freeze([Q.twoFactorCodeInvalid,Q.twoFactorNotEnabled,Q.challengeInvalid,Q.challengeSessionMismatch,Q.challengeTooManyAttempts]),$n=Object.freeze([Q.tokenInvalid]),er=Object.freeze([`wrong_code`,`challenge_spent`,`not_registered`,`prepare_not_required`]),tr=e=>er.includes(e),nr={wrong_code:`That code was not accepted. Try again.`,challenge_spent:`That verification challenge is no longer valid. Start again.`,exhausted:`Too many attempts. Try again later.`,attempts_exhausted:`Too many incorrect attempts. Verification was not completed.`,not_registered:`That verification method is not set up for this account.`,prepare_not_required:`This verification method needs no preparation round.`,fatal:`This verification method cannot be used right now.`,unavailable:`Step-up verification is not available on this deployment.`,protocol:`The server returned an unexpected upgrade response.`,network:`The verification request did not reach the server.`,session_changed:`The session ended during verification.`},$=class extends Error{constructor(e){super(e.message||nr[e.kind]),this.name=`UpgradeTransportError`,this.code=`upgrade_transport`,this.kind=e.kind,this.status=e.status,this.errorId=e.errorId,this.retryable=tr(e.kind),e.cause!==void 0&&(this.cause=e.cause)}},rr=Object.freeze([`upgrade_transport`,`upgrade_insufficient`,`upgrade_unavailable`,`upgrade_session_changed`,`upgrade_cancelled`,`upgrade_unsatisfiable`]),ir=e=>typeof e==`object`&&!!e&&typeof e.code==`string`&&rr.includes(e.code),ar=e=>e instanceof $||typeof e==`object`&&!!e&&e.code===`upgrade_transport`,or=e=>{if(typeof e!=`object`||!e)return{hasResponse:!1,message:typeof e==`string`?e:void 0};let t=e,n=t.response,r=n?.data,i=typeof r?.error?.id==`string`?r.error.id:void 0;return{status:typeof t.status==`number`?t.status:typeof n?.status==`number`?n.status:void 0,errorId:typeof t.id==`string`?t.id:i,message:typeof t.message==`string`?t.message:void 0,hasResponse:n!==void 0||typeof t.status==`number`}},sr=(e,t)=>{switch(e){case Q.twoFactorCodeInvalid:return`wrong_code`;case Q.challengeInvalid:case Q.challengeSessionMismatch:return`challenge_spent`;case Q.challengeTooManyAttempts:return`exhausted`;case Q.methodNotRegistered:return`not_registered`;case Q.twoFactorNotEnabled:return t===`refresh`?`session_changed`:`not_registered`;case Q.prepareNotRequired:return`prepare_not_required`;case Q.unavailable:case Q.notImplemented:return`unavailable`;case Q.unsupportedFactor:case Q.noSession:case Q.methodNotSupported:return`fatal`;case Q.tokenInvalid:return t===`refresh`?`session_changed`:`fatal`;default:return}},cr=(e,t)=>e===void 0?`network`:e===501?`unavailable`:e===400?`fatal`:e===401||e===403?t===`start`?`challenge_spent`:`session_changed`:e>=500?`network`:`fatal`,lr=(e,t)=>{if(e instanceof $)return e;let n=or(e);return n.hasResponse?new $({kind:sr(n.errorId,t)??cr(n.status,t),message:n.message,status:n.status,errorId:n.errorId,cause:e}):new $({kind:`network`,message:n.message,cause:e})},ur=e=>e.errorId!==void 0&&Qn.includes(e.errorId),dr=e=>e.errorId!==void 0&&$n.includes(e.errorId),fr=class extends Error{constructor(e,t,n){super(n??`The session was elevated, but this action requires a higher assurance level`),this.name=`UpgradeInsufficientError`,this.code=`upgrade_insufficient`,this.obtained=e,this.required=t}},pr=class extends Error{constructor(e=`Step-up verification is not available on this deployment`){super(e),this.name=`UpgradeUnavailableError`,this.code=`upgrade_unavailable`}},mr=class extends Error{constructor(e=`The session changed during verification`){super(e),this.name=`UpgradeSessionChangedError`,this.code=`upgrade_session_changed`}},hr=e=>{if(e&&typeof e.sub==`string`&&e.sub!==``)return typeof e.sid==`string`&&e.sid!==``?{sub:e.sub,sid:e.sid}:{sub:e.sub}},gr=(e,t)=>!t||t.sub!==e.sub?!1:e.sid!==void 0&&t.sid!==void 0?e.sid===t.sid:!0;function _r(e){if(!e||typeof e!=`string`)return!1;let t=e.split(`.`);if(t.length!==3)return!1;let n=/^[A-Za-z0-9_-]+$/;return t.every(e=>n.test(e)&&e.length>0)}function vr(e){return e.replace(/<[^>]*>/g,``).substring(0,200)}function yr(e){if(!e||typeof e!=`string`)return!1;let t=e.trim();return t.length!==0&&/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)}function br(e){if(!e||typeof e!=`string`)return!1;let t=e.trim();return/^\+[1-9]\d{1,14}$/.test(t)}function xr(e){if(!e||typeof e!=`string`)return!1;let t=e.trim();return t.length<3||t.length>30?!1:/^[a-zA-Z0-9_-]+$/.test(t)}function Sr(e,t=6){return!e||typeof e!=`string`?!1:(t===8?/^\d{8}$/:/^\d{6}$/).test(e)}function Cr(e){if(!e||typeof e!=`string`)return null;let t=e.toUpperCase().replace(/\s+/g,``);return/^[A-Z0-9-]{4,16}$/.test(t)?t:null}var wr=`passflow_2fa_pkce`,Tr=3e5,Er=class{constructor(e,t,n,r,i,a,o,s,c,l,u,d=L,f,p={coordination:ln()}){this.authApi=e,this.deviceService=t,this.storageManager=n,this.subscribeStore=r,this.tokenCacheService=i,this.scopes=a,this.createTenantForNewUser=o,this.url=s,this.sessionCallbacks=c,this.appId=l,this.platform=d,this.readPkceEnabled=f,this.tokenExchangeConfig=u,this.tokenDeliveryManager=new ce(n),u?.enabled&&this.tokenDeliveryManager.setMode(N.BFF),this.refresh=Xn({emit:this.createRefreshEmit(),storage:n,cache:i,transport:this.createRefreshTransport(),coordination:p.coordination,platform:d,...p.strikes===void 0?{}:{strikes:p.strikes},logger:vn()}),this.initializeSession()}async initializeSession(){(this.tokenDeliveryManager.isCookieMode()||this.tokenDeliveryManager.isBFFMode())&&await this.restoreSession()}async restoreSession(){if(this.tokenDeliveryManager.isBFFMode()&&this.tokenExchangeConfig?.statusUrl)try{let e=await fetch(this.tokenExchangeConfig.statusUrl,{method:`GET`,credentials:`include`});return e.ok&&(await e.json()).authenticated?(this.tokenDeliveryManager.setSessionValid(),!0):(this.tokenDeliveryManager.setSessionInvalid(),!1)}catch{return this.tokenDeliveryManager.setSessionInvalid(),!1}if(!this.tokenDeliveryManager.isCookieMode())return!1;try{let e=await this.authApi.validateSession();return e.valid?(this.tokenDeliveryManager.setSessionValid(),e.user&&this.subscribeStore.notify(Z.SessionRestored,e.user),!0):(this.tokenDeliveryManager.setSessionInvalid(),!1)}catch{return this.tokenDeliveryManager.setSessionInvalid(),!1}}async processAuthResponse(e,t){await this.applyAuthResponse(e,t),this.refresh.sessionStarted()}async applyAuthResponse(e,t){if(e.code&&!e.access_token)throw Error(`A PKCE authorization code was not exchanged, so there are no tokens to apply`);this.tokenExchangeConfig?.enabled||`token_delivery`in e&&e.token_delivery&&this.tokenDeliveryManager.setMode(e.token_delivery),this.tokenDeliveryManager.setSessionValid(),this.tokenDeliveryManager.isBFFMode()&&this.tokenExchangeConfig?.callbackUrl&&await this.forwardTokensToBFF(e),e.scopes=t,this.storageManager.saveTokens(e,this.tokenDeliveryManager.getMode()),this.tokenCacheService.setTokensCache(e),e.csrf_token&&this.storageManager.setCsrfToken(e.csrf_token)}handlePendingSecondFactor(e,t,n,r){return e.requires_2fa!==!0&&!e.tfa_token?!1:(n?this.rememberPkceSignIn(n.verifier,r):this.forgetPkceSignIn(),this.subscribeStore.notify(Z.TwoFactorRequired,{email:t||``,challengeId:e.challenge_id||``,tfaToken:e.tfa_token||``}),!0)}rememberPkceSignIn(e,t){if(this.pendingPkce={verifier:e,scopes:t,expiresAt:Date.now()+Tr},typeof sessionStorage<`u`)try{sessionStorage.setItem(wr,JSON.stringify(this.pendingPkce))}catch{}}readPendingPkce(){if(!this.pendingPkce&&typeof sessionStorage<`u`)try{let e=sessionStorage.getItem(wr);this.pendingPkce=e?JSON.parse(e):void 0}catch{this.pendingPkce=void 0}return this.pendingPkce&&Date.now()>=this.pendingPkce.expiresAt&&this.forgetPkceSignIn(),this.pendingPkce}hasPendingPkceSignIn(){return this.readPendingPkce()!==void 0}forgetPkceSignIn(){if(this.pendingPkce=void 0,typeof sessionStorage<`u`)try{sessionStorage.removeItem(wr)}catch{}}async startPkce(){let e=!1;try{e=await this.readPkceEnabled?.()??!1}catch(e){vn().warn(`Passflow: could not read the app settings, so this sign-in sends no PKCE challenge`,e);return}return e?gn():void 0}async exchangeCode(e,t){return!e.code||!t?e:await this.authApi.pkceExchange(e.code,t.verifier)}async completePkceSignIn(e){let t=this.readPendingPkce();if(!t)throw Error(`The sign-in answered with a PKCE code, but its verifier is gone`);let n=await this.authApi.pkceExchange(e,t.verifier);return await this.processAuthResponse(n,t.scopes??this.scopes),n}async applyTokens(e){let t=e;(t.access_token||t.id_token||t.token_delivery)&&await this.processAuthResponse(t,t.scopes??this.readPendingPkce()?.scopes??this.scopes)}async forwardTokensToBFF(e){if(!this.tokenExchangeConfig?.callbackUrl)return;let t=await fetch(this.tokenExchangeConfig.callbackUrl,{method:`POST`,credentials:`include`,headers:{"Content-Type":`application/json`},body:JSON.stringify({access_token:e.access_token,refresh_token:e.refresh_token,id_token:e.id_token,expires_in:e.expires_in})});if(!t.ok)throw Error(`BFF token storage failed: ${t.status}`)}async signIn(e){if(`email`in e&&e.email&&!yr(e.email)){let e=Error(`Invalid email format`),t={operation:`sign-in`,message:`Invalid email format`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}if(`username`in e&&e.username&&!xr(e.username)){let e=Error(`Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens`),t={operation:`sign-in`,message:`Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}if(`phone`in e&&e.phone&&!br(e.phone)){let e=Error(`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`),t={operation:`sign-in`,message:`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}this.subscribeStore.notify(Z.SignInStart,{email:e.email});let t=this.deviceService.getDeviceId(),n=Re(this.platform.getDeviceType());e.scopes=e.scopes??this.scopes;try{let r=await this.startPkce(),i=await this.authApi.signIn(r?{...e,code_challenge:r.challenge}:e,t,n);if(this.handlePendingSecondFactor(i,e.email,r,e.scopes))return i;let a=await this.exchangeCode(i,r);return this.handlePendingSecondFactor(a,e.email)||(await this.processAuthResponse(a,e.scopes),this.subscribeStore.notify(Z.SignIn,{tokens:a,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),a}catch(e){let t={operation:`sign-in`,message:e instanceof Error?e.message:`Sign in failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async signUp(e){if(e.user.email&&!yr(e.user.email)){let e=Error(`Invalid email format`),t={operation:`sign-up`,message:`Invalid email format`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}if(e.user.phone_number&&!br(e.user.phone_number)){let e=Error(`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`),t={operation:`sign-up`,message:`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}this.subscribeStore.notify(Z.RegisterStart,{email:e.user.email}),e.scopes=e.scopes??this.scopes,e.create_tenant=this.createTenantForNewUser;try{let t=await this.startPkce(),n=await this.authApi.signUp(t?{...e,code_challenge:t.challenge}:e);if(this.handlePendingSecondFactor(n,e.user.email,t,e.scopes))return n;let r=await this.exchangeCode(n,t);return this.handlePendingSecondFactor(r,e.user.email)||(await this.processAuthResponse(r,e.scopes),this.subscribeStore.notify(Z.Register,{tokens:r,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),r}catch(e){let t={operation:`sign-up`,message:e instanceof Error?e.message:`Sign up failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async passwordlessSignIn(e){if(e.email&&!yr(e.email)){let e=Error(`Invalid email format`),t={operation:`passwordless.start`,message:`Invalid email format`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}if(e.phone&&!br(e.phone)){let e=Error(`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`),t={operation:`passwordless.start`,message:`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}this.subscribeStore.notify(Z.SignInStart,{email:e.email}),e.scopes=e.scopes??this.scopes;let t=this.deviceService.getDeviceId(),n=Re(this.platform.getDeviceType());try{return await this.authApi.passwordlessSignIn(e,t,n)}catch(e){let t={operation:`passwordless.start`,message:e instanceof Error?e.message:`Failed to send passwordless sign-in link`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async passwordlessSignInComplete(e){this.subscribeStore.notify(Z.SignInStart,{}),e.scopes=e.scopes??this.scopes,e.device=this.deviceService.getDeviceId();try{let t=await this.authApi.passwordlessSignInComplete(e);return this.handlePendingSecondFactor(t)||(await this.processAuthResponse(t,e.scopes),this.subscribeStore.notify(Z.SignIn,{tokens:t,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),t}catch(e){let t={operation:`passwordless.complete`,message:e instanceof Error?e.message:`Passwordless sign in failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async logOut(){let e=this.refresh.identity();return await this.refresh.signOut(async e=>{await this.callLogoutApi(e),this.forgetPkceSignIn(),this.clearLocalSession()}),e}resetSession(){let e=this.refresh.identity();return this.refresh.signOutNow(()=>this.clearLocalSession()),e}async callLogoutApi(e){if(this.tokenDeliveryManager.isBFFMode()&&this.tokenExchangeConfig?.logoutUrl){try{await fetch(this.tokenExchangeConfig.logoutUrl,{method:`POST`,credentials:`include`})}catch{}return}let t=e??this.storageManager.getToken(M.refresh_token),n=this.storageManager.getDeviceId();try{if((await this.authApi.logOut(n,t,!this.appId)).status!==`ok`)throw Error(`Logout failed`)}catch{}}clearLocalSession(){this.storageManager.deleteTokens(),this.storageManager.clearIdToken(),this.storageManager.clearCsrfToken(),this.tokenDeliveryManager.reset(),this.tokenCacheService.setTokensCache(void 0),this.tokenCacheService.stopTokenCheck?.()}readSessionPin(){try{let e=this.storageManager.getToken(M.access_token);return e?hr(j(e)):void 0}catch{return}}assertSessionPin(e){if(e&&!gr(e,this.readSessionPin()))throw console.warn(`[passflow] the session or user changed while a step-up upgrade was in flight; the elevated tokens were discarded and the live session was left untouched.`),new mr(`The session changed during verification, so the elevated tokens were discarded`)}refreshMode(){return this.tokenDeliveryManager.isBFFMode()&&this.tokenExchangeConfig?.refreshUrl?`bff`:this.tokenDeliveryManager.isCookieMode()?`cookie`:`json`}createRefreshEmit(){return(e,t)=>{let n=this.subscribeStore;switch(e){case`refresh`:{let{tokens:e,source:r}=t;n.notify(Z.Refresh,{tokens:e,parsedTokens:this.tokenCacheService.getParsedTokens(),source:r});return}case`signin`:{let{tokens:e,origin:r}=t;n.notify(Z.SignIn,{tokens:e,parsedTokens:this.tokenCacheService.getParsedTokens(),origin:r});return}case`error`:W(n,t);return;case`refresh:start`:n.notify(Z.RefreshStart,{});return;case`token-cache-expired`:n.notify(Z.TokenCacheExpired,t);return;case`refresh:failing`:n.notify(Z.RefreshFailing,t);return;case`refresh:recovered`:n.notify(Z.RefreshRecovered,t);return;case`session:expired`:n.notify(Z.SessionExpired,t);return;case`signout`:n.notify(Z.SignOut,t);return;default:vn().warn(`[passflow] Unknown refresh event: ${String(e)}`)}}}createRefreshTransport(){return{mode:()=>this.refreshMode(),send:async({tokens:e,upgrade:t})=>{let n=this.refreshMode();if(n===`bff`)return await this.sendBffRefresh();if(n===`cookie`)return t?await this.authApi.refreshToken(``,this.scopes,void 0,t):await this.authApi.refreshToken(``,this.scopes);let r=e?.refresh_token??``,i=e?.scopes??this.scopes,a=e?.access_token;return t?await this.authApi.refreshToken(r,i,a,t):await this.authApi.refreshToken(r,i,a)},applyOpaque:async e=>{this.tokenDeliveryManager.setSessionValid(),this.tokenDeliveryManager.isBFFMode()?(e.id_token&&this.storageManager.setIdToken(e.id_token),e.csrf_token&&this.storageManager.setCsrfToken(e.csrf_token)):await this.applyAuthResponse(e,this.scopes)},invalidate:()=>{this.tokenDeliveryManager.setSessionInvalid(),this.storageManager.clearIdToken(),this.storageManager.clearCsrfToken()},assertPin:e=>this.assertSessionPin(e),opaqueMarker:()=>{let e=this.storageManager.getIdToken(),t=this.storageManager.getCsrfToken();return e===void 0&&t===void 0?void 0:`${e??``}\n${t??``}`}}}async sendBffRefresh(){let e=this.tokenExchangeConfig?.refreshUrl??``,t=await fetch(e,{method:`POST`,credentials:`include`});if(!t.ok){let n,r;try{let e=await t.json();typeof e?.error?.id==`string`&&(n=e.error.id),typeof e?.error?.message==`string`&&(r=e.error.message)}catch{}throw new V({id:n??`error.http.${t.status}`,message:r??`BFF token refresh failed`,status:t.status,location:e,time:new Date().toISOString()})}return await t.json()}async refreshToken(e,t){if(e&&this.tokenDeliveryManager.isBFFMode())throw new $({kind:`unavailable`,message:`Step-up verification cannot be committed through a BFF refresh endpoint`});if(e)return await this.refresh.commitUpgrade(e,t);if(this.refreshMode()===`json`&&!this.refresh.ended){let e=this.storageManager.getTokens();if(!e?.refresh_token){let t=Error(e?`No refresh token found`:`No tokens found`);throw W(this.subscribeStore,{operation:`refresh`,source:`refresh-token`,message:t.message,originalError:t}),t}}return await this.refresh.refresh({trigger:`refresh-token`,fresh:!0})}async sendPasswordResetEmail(e){try{return await this.authApi.sendPasswordResetEmail(e)}catch(e){let t={operation:`password-reset.send`,message:e instanceof Error?e.message:`Failed to send password reset email`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async resetPassword(e,t){this.subscribeStore.notify(Z.SignInStart,{});let n=new URLSearchParams(this.platform.getCurrentUrl()?.search??``).get(`token`)??void 0,r=t??this.scopes;try{let t=await this.startPkce(),i=t?await this.authApi.resetPassword(e,r,n,t.challenge):await this.authApi.resetPassword(e,r,n);if(this.handlePendingSecondFactor(i,void 0,t,r))return i;let a=await this.exchangeCode(i,t);if(this.handlePendingSecondFactor(a))return a;let o=i.redirect_url?{...a,redirect_url:i.redirect_url}:a;return await this.processAuthResponse(o,r),this.subscribeStore.notify(Z.SignIn,{tokens:o,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck(),o}catch(e){let t={operation:`password-reset.complete`,message:e instanceof Error?e.message:`Password reset failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async passkeyRegister(e){if(!this.platform.passkeys)throw Error(`Passkeys are not supported on this platform`);this.subscribeStore.notify(Z.RegisterStart,{});let t=this.deviceService.getDeviceId(),n=Re(this.platform.getDeviceType());e.scopes=e.scopes??this.scopes,e.create_tenant=this.createTenantForNewUser;try{let r=await this.startPkce(),{challenge_id:i,publicKey:a}=await this.authApi.passkeyRegisterStart(r?{...e,code_challenge:r.challenge}:e,t,n,!this.appId);a.user.id=this.platform.btoa(a.user.id);let o=await this.platform.passkeys.startRegistration(a);if(!o)throw Error(`Passkey registration was not completed`);let s=await this.authApi.passkeyRegisterComplete(o,t,i,!this.appId);if(this.handlePendingSecondFactor(s,void 0,r,e.scopes))return s;let c=await this.exchangeCode(s,r);return this.handlePendingSecondFactor(c)||(await this.processAuthResponse(c,e.scopes),this.subscribeStore.notify(Z.Register,{tokens:c,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),c}catch(e){let t={operation:`passkey.register`,message:e instanceof Error?e.message:`Passkey registration failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async passkeyAuthenticate(e){if(!this.platform.passkeys)throw Error(`Passkeys are not supported on this platform`);this.subscribeStore.notify(Z.SignInStart,{});let t=this.deviceService.getDeviceId(),n=Re(this.platform.getDeviceType());e.scopes=e.scopes??this.scopes;try{let r=await this.startPkce(),{challenge_id:i,publicKey:a}=await this.authApi.passkeyAuthenticateStart(r?{...e,code_challenge:r.challenge}:e,t,n,!this.appId),o=await this.platform.passkeys.startAuthentication(a);if(!o)throw Error(`Passkey authentication was not completed`);let s=await this.authApi.passkeyAuthenticateComplete(o,t,i,!this.appId);if(this.handlePendingSecondFactor(s,void 0,r,e.scopes))return s;let c=await this.exchangeCode(s,r);return this.handlePendingSecondFactor(c)||`access_token`in c&&(await this.processAuthResponse(c,e.scopes),this.subscribeStore.notify(Z.SignIn,{tokens:c,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),c}catch(e){let t={operation:`passkey.authenticate`,message:e instanceof Error?e.message:`Passkey authentication failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}createFederatedAuthUrl(e){let t=`/auth/federated/start/${e.provider}`;if(!this.appId)throw Error(`AppId is required for federated auth`);let n={scopes:(e.scopes??this.scopes).join(` `),redirect_url:e.redirect_url??this.platform.getCurrentUrl()?.origin??``,appId:this.appId,...e.invite_token?{invite_token:e.invite_token}:{},...e.create_tenant?{create_tenant:e.create_tenant.toString()}:{},...e.device?{device:e.device}:{}},r=new URL(t,this.url);return r.search=new URLSearchParams(n).toString(),r.toString()}async federatedAuthWithPopup(e){this.subscribeStore.notify(Z.SignInStart,{provider:e.provider});let t=e.scopes??this.scopes,n=this.deviceService.getDeviceId(),r=this.createFederatedAuthUrl({...e,scopes:t,device:n});try{let e=await this.platform.openAuthUrl(r,{mode:`popup`,expectedReturnOrigin:this.platform.getCurrentUrl()?.origin??``}),n=new URLSearchParams(e.callbackHash.replace(/^#/,``));if(this.handlePendingSecondFactor({tfa_token:n.get(`tfa_token`)??void 0}))return;let i=new URLSearchParams(e.callbackSearch),a=i.get(`access_token`)||``,o=i.get(`refresh_token`)||``,s=i.get(`id_token`)||``,c={access_token:a,refresh_token:o||void 0,id_token:s||void 0,scopes:t};await this.processAuthResponse(c,t),this.subscribeStore.notify(Z.SignIn,{tokens:c,parsedTokens:this.tokenCacheService.getParsedTokens()}),this.platform.navigateTo(this.platform.getCurrentUrl()?.origin??``)}catch(e){let t={operation:`federated.popup`,message:e instanceof Error?e.message:`Authentication failed`,code:e instanceof I?`POPUP_CLOSED`:`AUTH_FAILED`,originalError:e};W(this.subscribeStore,t)}}federatedAuthWithRedirect(e){this.subscribeStore.notify(Z.SignInStart,{provider:e.provider});let t=e.scopes??this.scopes,n=this.deviceService.getDeviceId(),r=this.createFederatedAuthUrl({...e,scopes:t,device:n});this.platform.navigateTo(r)}authRedirectUrl(e={}){try{let{url:t,redirectUrl:n,scopes:r,appId:i}=e??{},a=new URL(t??this.url);a.pathname=(a.pathname.endsWith(`/`)?a.pathname:a.pathname+`/`)+`web`;let o=r??this.scopes,s={appId:i??this.appId??``,redirectto:n??this.platform.getCurrentUrl()?.href??``,scopes:o.join(`,`)};return a.search=new URLSearchParams(s).toString(),a.toString()}catch(e){let t={operation:`auth-redirect.url`,message:e instanceof Error?e.message:`Failed to create auth redirect URL`,originalError:e};throw W(this.subscribeStore,t),e}}authRedirect(e={}){try{this.platform.navigateTo(this.authRedirectUrl(e))}catch(e){let t={operation:`auth-redirect`,message:e instanceof Error?e.message:`Failed to redirect to auth page`,originalError:e};throw W(this.subscribeStore,t),e}}isAuthenticated(e){try{if(this.tokenDeliveryManager.isCookieMode()||this.tokenDeliveryManager.isBFFMode()){let t=!!e?.id_token||!!this.storageManager.getIdToken(),n=this.tokenDeliveryManager.isSessionValid(),r=this.tokenDeliveryManager.isSessionUnknown();return t&&(n||r)}return!e||!e.access_token?!1:!A(e.access_token)||e.refresh_token!==void 0&&!A(e.refresh_token)}catch(e){let t={operation:`auth.is-authenticated`,message:e instanceof Error?e.message:`Failed to check authentication status`,originalError:e};return W(this.subscribeStore,t),!1}}async submitSessionCheck(e=!1){let t,n;try{t=await this.getTokens(e),n=this.tokenCacheService.getParsedTokens()}catch(e){let n={operation:`session.check`,message:e instanceof Error||e instanceof V?e.message:`Session check failed`,originalError:e};W(this.subscribeStore,n),t=void 0}return t&&this.sessionCallbacks.createSession&&await this.sessionCallbacks.createSession({tokens:t,parsedTokens:n}),!t&&this.sessionCallbacks.expiredSession&&await this.sessionCallbacks.expiredSession(),t}async refreshForSession(){try{await this.refresh.refresh({trigger:`session`})}catch{}return this.tokenCacheService.getTokens()}async getTokens(e){try{if(this.tokenDeliveryManager.isCookieMode()||this.tokenDeliveryManager.isBFFMode()){let t=this.storageManager.getTokens();return t?.id_token?this.tokenDeliveryManager.isSessionInvalid()&&e?await this.refreshForSession():t:void 0}let t=this.storageManager.getTokens();return!t||!t.access_token?void 0:A(j(t.access_token))?e?await this.refreshForSession():void 0:t}catch(e){let t={operation:`tokens.get`,message:e instanceof Error?e.message:`Failed to get tokens`,originalError:e};W(this.subscribeStore,t);return}}},Dr=class{constructor(e){this.invitationApi=e}requestInviteLink(e){return this.invitationApi.requestInviteLink(e)}getInvitations(e){return this.invitationApi.getInvitations(e)}deleteInvitation(e){return this.invitationApi.deleteInvitation(e)}resendInvitation(e){return this.invitationApi.resendInvitation(e)}getInvitationLink(e){return this.invitationApi.getInvitationLink(e)}},Or=class{constructor(e){this.data=this.normalize(e)}normalize(e){let t=new Map,n=new Map,r=new Map,i=[];return e.groups?.forEach(e=>{n.set(e.id,{id:e.id,name:e.name,default:e.default??!1,updated_at:e.updated_at,created_at:e.created_at})}),e.roles?.forEach(e=>{r.set(e.id,{id:e.id,tenant_id:e.tenant_id,name:e.name})}),e.users_in_groups?.forEach(e=>{let r=e.user;r&&!t.has(r.id)&&t.set(r.id,{id:r.id,name:r.name??null,email:r.email??null,phone:r.phone??null}),r&&e.group_id&&n.has(e.group_id)&&i.push({userId:r.id,groupId:e.group_id,roleIds:e.roles?.map(e=>e.id)??[]})}),{tenant_id:e.tenant_id,tenant_name:e.tenant_name,users:Array.from(t.values()),groups:Array.from(n.values()),roles:Array.from(r.values()),memberships:i,usersById:t,groupsById:n,rolesById:r}}getUsersInGroup(e){return this.data.memberships.filter(t=>t.groupId===e).map(e=>this.data.usersById.get(e.userId)).filter(e=>e!==void 0)}getGroupsForUser(e){return this.data.memberships.filter(t=>t.userId===e).map(e=>this.data.groupsById.get(e.groupId)).filter(e=>e!==void 0)}getUserRolesInGroup(e,t){let n=this.data.memberships.find(n=>n.userId===e&&n.groupId===t);return n?n.roleIds.map(e=>this.data.rolesById.get(e)).filter(e=>e!==void 0):[]}getData(){return this.data}},kr=class{constructor(e,t,n){this.tenantApi=e,this.scopes=t,this.logger=n||vn()}handlePassflowError(e,t){if(c.default.isAxiosError(e)&&e.response?.data){let n=e.response.data;if(typeof n==`object`&&n&&`error`in n&&typeof n.error==`object`&&n.error!==null){let e=n.error;throw this.logger.error(`${t}: ${e.id} - ${e.message} (Status: ${e.status})`),Error(`Passflow API Error: ${e.id} - ${e.message} (Status: ${e.status})`)}}throw this.logger.error(`${t}:`,e),e instanceof Error?e:Error(String(e))}async joinInvitation(e,t){try{let n=t??this.scopes;return await this.tenantApi.joinInvitation(e,n)}catch(e){this.handlePassflowError(e,`Join invitation failed`)}}async createTenant(e){try{return await this.tenantApi.createTenant(e)}catch(e){this.handlePassflowError(e,`Tenant creation failed`)}}async getTenantDetails(e){try{return await this.tenantApi.getTenantDetails(e)}catch(t){this.handlePassflowError(t,`Get tenant details failed for tenant ID ${e}`)}}async getTenantUserMembership(e){try{return new Or(await this.tenantApi.getTenantDetails(e))}catch(t){this.handlePassflowError(t,`Get tenant user membership failed for tenant ID ${e}`)}}async updateTenant(e,t){try{return await this.tenantApi.updateTenant(e,t)}catch(t){this.handlePassflowError(t,`Update tenant failed for tenant ID ${e}`)}}async deleteTenant(e){try{return await this.tenantApi.deleteTenant(e)}catch(t){this.handlePassflowError(t,`Delete tenant failed for tenant ID ${e}`)}}async getUserTenantMembership(){try{return await this.tenantApi.getUserTenantMembership()}catch(e){this.handlePassflowError(e,`Get user tenant memberships failed`)}}async createGroup(e,t){try{return await this.tenantApi.createGroup(e,t)}catch(t){this.handlePassflowError(t,`Group creation failed for tenant ID ${e}`)}}async getGroupInfo(e,t){try{return await this.tenantApi.getGroupInfo(e,t)}catch(n){this.handlePassflowError(n,`Get group info failed for tenant ID ${e}, group ID ${t}`)}}async updateGroup(e,t,n){try{return await this.tenantApi.updateGroup(e,t,n)}catch(n){this.handlePassflowError(n,`Update group failed for tenant ID ${e}, group ID ${t}`)}}async deleteGroup(e,t){try{return await this.tenantApi.deleteGroup(e,t)}catch(n){this.handlePassflowError(n,`Delete group failed for tenant ID ${e}, group ID ${t}`)}}async addUserToGroup(e,t,n,r){try{return await this.tenantApi.addUserToGroup(e,t,n,r)}catch(r){this.handlePassflowError(r,`Add user to group failed for tenant ID ${e}, group ID ${t}, user ID ${n}`)}}async removeUserRolesFromGroup(e,t,n,r){try{return await this.tenantApi.removeUserRolesFromGroup(e,t,n,r)}catch(r){this.handlePassflowError(r,`Remove user roles from group failed for tenant ID ${e}, group ID ${t}, user ID ${n}`)}}async changeUserRoles(e,t,n,r){try{return await this.tenantApi.changeUserRoles(e,t,n,r)}catch(r){this.handlePassflowError(r,`Change user roles failed for tenant ID ${e}, group ID ${t}, user ID ${n}`)}}async deleteUserFromGroup(e,t,n){try{return await this.tenantApi.deleteUserFromGroup(e,t,n)}catch(r){this.handlePassflowError(r,`Delete user from group failed for tenant ID ${e}, group ID ${t}, user ID ${n}`)}}async getRolesForTenant(e){try{return await this.tenantApi.getRolesForTenant(e)}catch(t){this.handlePassflowError(t,`Get roles for tenant failed for tenant ID ${e}`)}}async createRoleForTenant(e,t){try{return await this.tenantApi.createRoleForTenant(e,t)}catch(t){this.handlePassflowError(t,`Create role for tenant failed for tenant ID ${e}`)}}async updateRole(e,t,n){try{return await this.tenantApi.updateRole(e,t,n)}catch(n){this.handlePassflowError(n,`Update role failed for tenant ID ${e}, role ID ${t}`)}}async deleteRole(e,t){try{return await this.tenantApi.deleteRole(e,t)}catch(n){this.handlePassflowError(n,`Delete role failed for tenant ID ${e}, role ID ${t}`)}}async deleteUserFromTenant(e,t){try{return await this.tenantApi.deleteUserFromTenant(e,t)}catch(n){this.handlePassflowError(n,`Delete user from tenant failed for tenant ID ${e}, user ID ${t}`)}}async getGroupInvitations(e,t,n,r){try{return await this.tenantApi.getGroupInvitations(e,t,n,r)}catch(n){this.handlePassflowError(n,`Get group invitations failed for tenant ID ${e}, group ID ${t}`)}}async getTenantInvitations(e,t,n){try{return await this.tenantApi.getTenantInvitations(e,t,n)}catch(t){this.handlePassflowError(t,`Get tenant invitations failed for tenant ID ${e}`)}}async invalidateInviteById(e,t,n){try{return await this.tenantApi.invalidateInviteById(e,t,n)}catch(r){this.handlePassflowError(r,`Invalidate invite by ID failed for tenant ID ${e}, group ID ${t}, invite ID ${n}`)}}async invalidateInviteByEmail(e,t,n){try{return await this.tenantApi.invalidateInviteByEmail(e,t,n)}catch(r){this.handlePassflowError(r,`Invalidate invite by email failed for tenant ID ${e}, group ID ${t}, email ${n}`)}}},Ar=class{constructor(e,t,n,r=L){this.storageManager=e,this.subscribeStore=n,this.platform=r,this.checkInterval=null,this.CHECK_INTERVAL=6e4,this.unsubscribeForeground=null,this.unsubscribeUnload=null,this.tokenExpiredFlag=!1,this.storageManager=e,this.setupLifecycleListeners()}get isRefreshing(){return this.refreshController?.busy??!1}attachRefreshController(e){this.refreshController=e}initialize(){try{let e=this.storageManager.getTokens();if(!e)return;if(!e.access_token){this.setTokensCache(e),this.startTokenCheck();return}A(j(e.access_token))?(this.tokenExpiredFlag=!0,this.stopTokenCheck(),this.subscribeStore.notify(Z.TokenCacheExpired,{isExpired:!0})):(this.setTokensCache(e),this.startTokenCheck())}catch(e){let t={operation:`tokens.load`,message:e instanceof Error?e.message:`Failed to get tokens`,originalError:e};W(this.subscribeStore,t),this.setTokensCache(void 0)}}startTokenCheck(){this.checkInterval&&clearInterval(this.checkInterval),this.tokenExpiredFlag||(this.setupLifecycleListeners(),this.checkInterval=setInterval(()=>{this.platform.isInForeground()&&(this.isRefreshing||this.tokenExpiredFlag||this.isExpired()&&!this.tokenExpiredFlag&&(this.tokenExpiredFlag=!0,this.subscribeStore.notify(Z.TokenCacheExpired,{isExpired:!0}),this.stopTokenCheck()))},this.CHECK_INTERVAL))}setupLifecycleListeners(){this.unsubscribeForeground&&(this.unsubscribeForeground(),this.unsubscribeForeground=null),this.unsubscribeForeground=this.platform.onForeground(()=>{this.checkInterval&&!this.isRefreshing&&!this.tokenExpiredFlag&&this.isExpired()&&(this.tokenExpiredFlag=!0,this.subscribeStore.notify(Z.TokenCacheExpired,{isExpired:!0}),this.stopTokenCheck())}),this.unsubscribeUnload||(this.unsubscribeUnload=this.platform.onBeforeUnload(()=>{this.destroy()}))}stopTokenCheck(){this.checkInterval&&(clearInterval(this.checkInterval),this.checkInterval=null),this.unsubscribeForeground&&(this.unsubscribeForeground(),this.unsubscribeForeground=null)}destroy(){this.stopTokenCheck(),this.unsubscribeUnload&&(this.unsubscribeUnload(),this.unsubscribeUnload=null)}setTokensCache(e){this.tokensCache=e,this.parsedTokensCache=e?{access_token:e.access_token?j(e.access_token):void 0,id_token:e.id_token?j(e.id_token):void 0,refresh_token:e.refresh_token?j(e.refresh_token):void 0,scopes:e.scopes}:void 0}getTokens(){return this.tokensCache}async getTokensWithRefresh(){try{if(!this.tokensCache||!this.tokensCache.access_token)return this.tokensCache;if(A(j(this.tokensCache.access_token))&&this.refreshController)try{await this.refreshController.refresh({trigger:`token-check`})}catch{}return this.tokensCache}catch(e){let t={operation:`tokens.get`,message:e instanceof Error?e.message:`Failed to get tokens`,originalError:e};W(this.subscribeStore,t);return}}getParsedTokens(){return this.parsedTokensCache}isExpired(){return this.tokensCache?this.tokensCache.access_token?A(j(this.tokensCache.access_token)):!1:!0}},jr=class{constructor(e,t,n){this.twoFactorApi=e,this.subscribeStore=t,this.signInCompleter=n,this.PARTIAL_AUTH_TIMEOUT_MS=3e5,this.SESSION_STORAGE_KEY=`passflow_2fa_challenge`,this.totpDigits=6,this.subscribeStore.subscribe({onAuthChange:(e,t)=>{if(e===Z.TwoFactorRequired){let e=t;this.setPartialAuthState(e.email,e.challengeId,e.tfaToken)}(e===Z.SignIn||e===Z.Register)&&this.clearPartialAuthState()}},[Z.TwoFactorRequired,Z.SignIn,Z.Register])}emitErrorAndThrow(e,t,n){let r=e,i={operation:t,message:e instanceof Error?e.message:`${n} failed`,originalError:e,code:r?.id||void 0};throw W(this.subscribeStore,i),e}async getStatus(){try{let e=await this.twoFactorApi.getStatus();return e.totp_digits&&(this.totpDigits=e.totp_digits),e}catch(e){this.emitErrorAndThrow(e,`2fa.status`,`Get 2FA status`)}}async beginSetup(){try{let e=await this.twoFactorApi.beginSetup();return e.totp_digits&&(this.totpDigits=e.totp_digits),this.subscribeStore.notify(Z.TwoFactorSetupStarted,{secret:e.secret}),e}catch(e){this.emitErrorAndThrow(e,`2fa.setup.begin`,`Begin 2FA setup`)}}async confirmSetup(e){if(!Sr(e,this.totpDigits))throw Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);try{let t=await this.twoFactorApi.confirmSetup({code:e});return this.subscribeStore.notify(Z.TwoFactorEnabled,{recoveryCodes:t.recovery_codes,clearRecoveryCodes:()=>{t.recovery_codes.length=0}}),t}catch(e){this.emitErrorAndThrow(e,`2fa.setup.confirm`,`Confirm 2FA setup`)}}async verify(e,t){if(!Sr(e,this.totpDigits))throw Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);if(this.recoverPartialAuthState(),!this.isVerificationRequired())throw Error(`2FA verification expired or not required. User must sign in first.`);if(!this.partialAuthState?.tfaToken)throw Error(`No TFA token found. User must sign in first.`);try{let n=await this.twoFactorApi.verify({code:e,tfa_token:this.partialAuthState.tfaToken,...t?.trustDevice?{trust_device:!0}:{}}),r=await this.finishSignIn(n);return this.subscribeStore.notify(Z.TwoFactorVerified,{tokens:r}),r}catch(e){this.emitErrorAndThrow(e,`2fa.verify`,`Verify 2FA code`)}}async useRecoveryCode(e,t){try{let n=Cr(e);if(!n)throw Error(`Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).`);if(this.recoverPartialAuthState(),!this.isVerificationRequired())throw Error(`2FA verification expired or not required. User must sign in first.`);if(!this.partialAuthState?.tfaToken)throw Error(`No TFA token found. User must sign in first.`);let r=await this.finishSignIn(await this.twoFactorApi.useRecoveryCode({recovery_code:n,tfa_token:this.partialAuthState.tfaToken,...t?.trustDevice?{trust_device:!0}:{}}));return r.remaining_recovery_codes===0?this.subscribeStore.notify(Z.TwoFactorRecoveryCodesExhausted,{tokens:r}):r.remaining_recovery_codes<=2&&this.subscribeStore.notify(Z.TwoFactorRecoveryCodesLow,{tokens:r,remainingCodes:r.remaining_recovery_codes}),this.subscribeStore.notify(Z.TwoFactorRecoveryUsed,{tokens:r,remainingCodes:r.remaining_recovery_codes}),this.subscribeStore.notify(Z.TwoFactorVerified,{tokens:r}),r}catch(e){this.emitErrorAndThrow(e,`2fa.recovery.use`,`Use recovery code`)}}async disable(e){if(!Sr(e,this.totpDigits))throw Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);try{let t=await this.twoFactorApi.disable({code:e});return this.subscribeStore.notify(Z.TwoFactorDisabled,{}),t}catch(e){this.emitErrorAndThrow(e,`2fa.disable`,`Disable 2FA`)}}async regenerateRecoveryCodes(e){if(!Sr(e,this.totpDigits))throw Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);try{let t=await this.twoFactorApi.regenerateRecoveryCodes({code:e}),n=[...t.recovery_codes];return t.recovery_codes=[],t.recovery_codes=n,t}catch(e){this.emitErrorAndThrow(e,`2fa.recovery.regenerate`,`Regenerate recovery codes`)}}isVerificationRequired(){return this.recoverPartialAuthState(),this.partialAuthState?Date.now()>this.partialAuthState.expiresAt?(this.clearPartialAuthState(),!1):!0:!1}setPartialAuthState(e,t,n){if(this.partialAuthState={email:e,challengeId:t,tfaToken:n,timestamp:Date.now(),expiresAt:Date.now()+this.PARTIAL_AUTH_TIMEOUT_MS},typeof sessionStorage<`u`)try{sessionStorage.setItem(this.SESSION_STORAGE_KEY,JSON.stringify(this.partialAuthState))}catch{}}clearPartialAuthState(){if(this.partialAuthState=void 0,this.signInCompleter?.forgetPkceSignIn(),typeof sessionStorage<`u`)try{sessionStorage.removeItem(this.SESSION_STORAGE_KEY)}catch{}}async finishSignIn(e){let{code:t,...n}=e;if(t&&!this.signInCompleter?.hasPendingPkceSignIn()){this.clearPartialAuthState();let e=Error(`The sign-in answered with a PKCE code, but its verifier is gone`);throw e.id=`PKCE_VERIFIER_MISSING`,e}let r=e;if(t&&this.signInCompleter){let e=await this.signInCompleter.completePkceSignIn(t);r={...n,...e}}else await this.signInCompleter?.applyTokens(r);return this.clearPartialAuthState(),r}pendingTfaToken(){return this.isVerificationRequired()&&this.partialAuthState?.tfaToken||void 0}recoverPartialAuthState(){if(!this.partialAuthState&&typeof sessionStorage<`u`)try{let e=sessionStorage.getItem(this.SESSION_STORAGE_KEY);if(!e)return;let t=JSON.parse(e);Date.now()<t.expiresAt?this.partialAuthState=t:sessionStorage.removeItem(this.SESSION_STORAGE_KEY)}catch{try{sessionStorage.removeItem(this.SESSION_STORAGE_KEY)}catch{}}}async validateTwoFactorSetupMagicLink(e){let t=await this.twoFactorApi.validateTwoFactorSetupMagicLink(e);return t.success&&t.sessionToken&&t.userId?(this.magicLinkSession={sessionToken:t.sessionToken,userId:t.userId,appId:t.appId,scope:`2fa_setup`,timestamp:Date.now(),expiresAt:Date.now()+(t.expiresIn||3600)*1e3},this.subscribeStore.notify(Z.TwoFactorSetupMagicLinkValidated,{userId:t.userId,appId:t.appId,expiresIn:t.expiresIn||3600,sessionToken:t.sessionToken})):t.error&&this.subscribeStore.notify(Z.TwoFactorSetupMagicLinkFailed,{error:t.error}),t}getMagicLinkSession(){return this.magicLinkSession?Date.now()>this.magicLinkSession.expiresAt?(this.clearMagicLinkSession(),null):this.magicLinkSession:null}clearMagicLinkSession(){this.magicLinkSession=void 0}hasMagicLinkSession(){return this.getMagicLinkSession()!==null}getMagicLinkSessionToken(){return this.getMagicLinkSession()?.sessionToken||null}getTotpDigits(){return this.totpDigits}async getAvailableMethods(){try{return await this.twoFactorApi.getAvailableMethods()}catch(e){this.emitErrorAndThrow(e,`2fa.methods.available`,`Get available 2FA methods`)}}async getRegisteredMethods(){try{return await this.twoFactorApi.getRegisteredMethods()}catch(e){this.emitErrorAndThrow(e,`2fa.methods.registered`,`Get registered 2FA methods`)}}async startMethodSetup(e,t){try{let n=await this.twoFactorApi.startMethodSetup(e,t);return this.subscribeStore.notify(Z.TwoFactorSetupStarted,{secret:``,method:e}),n}catch(e){this.emitErrorAndThrow(e,`2fa.method.setup.start`,`Start 2FA method setup`)}}async completeMethodSetup(e,t){try{let n=await this.twoFactorApi.completeMethodSetup(e,t);return this.subscribeStore.notify(Z.TwoFactorEnabled,{recoveryCodes:[],clearRecoveryCodes:()=>{}}),n}catch(e){this.emitErrorAndThrow(e,`2fa.method.setup.complete`,`Complete 2FA method setup`)}}async removeMethod(e){try{await this.twoFactorApi.removeMethod(e)}catch(e){this.emitErrorAndThrow(e,`2fa.method.remove`,`Remove 2FA method`)}}async requestChallenge(e){try{let t=await this.twoFactorApi.requestChallenge(e,this.pendingTfaToken());return this.subscribeStore.notify(Z.TwoFactorChallengeReceived,{challengeId:t.challenge_id,method:t.method,alternativeMethods:t.alternative_methods}),t}catch(e){this.emitErrorAndThrow(e,`2fa.challenge.request`,`Request 2FA challenge`)}}async verifyV2(e){try{let t=await this.twoFactorApi.verifyV2(e,this.pendingTfaToken());if(!t.success)return t;let n=await this.finishSignIn(t);return this.subscribeStore.notify(Z.TwoFactorVerified,{tokens:{access_token:n.access_token,refresh_token:n.refresh_token}}),n.device_trusted&&this.subscribeStore.notify(Z.TwoFactorDeviceTrusted,{}),n}catch(e){this.emitErrorAndThrow(e,`2fa.challenge.verify`,`Verify 2FA challenge`)}}async switchToAlternative(e){try{let t=await this.twoFactorApi.switchToAlternative(e,this.pendingTfaToken());return this.subscribeStore.notify(Z.TwoFactorMethodSwitched,{challengeId:t.challenge_id,method:t.method,alternativeMethods:t.alternative_methods}),t}catch(e){this.emitErrorAndThrow(e,`2fa.method.switch`,`Switch to alternative 2FA method`)}}async getTrustedDevices(){try{return await this.twoFactorApi.getTrustedDevices()}catch(e){this.emitErrorAndThrow(e,`2fa.trusted-devices.list`,`Get trusted devices`)}}async revokeTrustedDevice(e){try{await this.twoFactorApi.revokeTrustedDevice(e)}catch(e){this.emitErrorAndThrow(e,`2fa.trusted-devices.revoke`,`Revoke trusted device`)}}},Mr=class{constructor(e,t,n=L){this.userAPI=e,this.deviceService=t,this.platform=n}getUserPasskeys(){return this.userAPI.getUserPasskeys()}renameUserPasskey(e,t){return this.userAPI.renameUserPasskey(e,t)}deleteUserPasskey(e){return this.userAPI.deleteUserPasskey(e)}async addUserPasskey({relyingPartyId:e,passkeyUsername:t,passkeyDisplayName:n}={}){if(!this.platform.passkeys)throw Error(`Passkeys are not supported on this platform`);let r=this.deviceService.getDeviceId(),i=Re(this.platform.getDeviceType()),{challenge_id:a,publicKey:o}=await this.userAPI.addUserPasskeyStart({relyingPartyId:(e||this.platform.getCurrentUrl()?.hostname)??``,deviceId:r,os:i,passkeyDisplayName:n,passkeyUsername:t});o.user.id=this.platform.btoa(o.user.id);let s=await this.platform.passkeys.startRegistration(o);if(!s)throw Error(`Passkey registration was not completed`);return await this.userAPI.addUserPasskeyComplete(s,r,a)}},Nr=class extends Error{constructor(e,t,n=!1){super(t),this.name=`UpgradeFactorError`,this.factor=e,this.cancelled=n}},Pr=(e,t)=>{let n=t?.trim();if(!n)throw new Nr(e,`A verification code is required`);return n},Fr={type:`totp`,requiresPrepare:!1,input:`code`,assert:async({code:e})=>({code:Pr(`totp`,e)})},Ir={type:`recovery_codes`,requiresPrepare:!1,input:`code`,assert:async({code:e})=>({code:Pr(`recovery_codes`,e)})},Lr={type:`passkey`,requiresPrepare:!0,input:`none`,assert:async({prepared:e,platform:t})=>{if(!e?.webauthn)throw new Nr(`passkey`,`The upgrade challenge carried no WebAuthn options`);let n=t.passkeys;if(!n)throw new Nr(`passkey`,`This platform does not support passkeys`);let r;try{r=await n.startAuthentication(e.webauthn)}catch(e){throw new Nr(`passkey`,e?.message||`Passkey verification was cancelled`,!0)}if(!r)throw new Nr(`passkey`,`Passkey verification was cancelled`,!0);return{challenge_id:e.challengeId,credential:r}}},Rr=Object.freeze([Fr,Lr,Ir]),zr=(e=Rr)=>new Map(e.map(e=>[e.type,e])),Br=3,Vr={passkey:0,totp:1,email_otp:2,sms_otp:3,recovery_codes:9},Hr=e=>e.requiredLevel??fe(e.acrValues),Ur=(e,t)=>{let n=Vr[e.type]??5,r=t!==void 0&&t>=Br,i=e.type===`passkey`;return(r&&!i?100:0)+n},Wr=(e,t)=>{let n=Hr(t);return[...e].sort((e,t)=>Ur(e,n)-Ur(t,n))},Gr=class extends Error{constructor(e){super(`Upgrade authentication was cancelled`),this.code=`upgrade_cancelled`,this.name=`UpgradeCancelledError`,e!==void 0&&(this.cause=e)}},Kr=class extends Error{constructor(e=`No available authentication factor can satisfy this challenge`){super(e),this.code=`upgrade_unsatisfiable`,this.name=`UpgradeUnsatisfiableError`}},qr=4,Jr=3e4,Yr=()=>{let e=()=>void 0,t=()=>void 0;return{promise:new Promise((n,r)=>{e=n,t=r}),resolve:e,reject:t}},Xr=e=>({acrValues:e.acrValues,level:e.requiredLevel,maxAge:e.maxAge}),Zr=(e,t)=>t.level===void 0||e.level!==void 0&&e.level>=t.level,Qr=(e,t)=>{let n=e.requiredLevel===void 0?t.requiredLevel:t.requiredLevel===void 0?e.requiredLevel:Math.max(e.requiredLevel,t.requiredLevel),r=n===void 0?e.acrValues??t.acrValues:n===e.requiredLevel?e.acrValues:t.acrValues,i=e.maxAge===void 0?t.maxAge:t.maxAge===void 0?e.maxAge:Math.min(e.maxAge,t.maxAge),a=Array.from(new Set([...e.channels??[],...t.channels??[]]));return{acrValues:r,requiredLevel:n,maxAge:i,status:e.status,...a.length>0?{channels:a}:{}}},$r=(e,t)=>{let n=t.requiredLevel!==void 0&&(e.requiredLevel===void 0||t.requiredLevel>e.requiredLevel),r=t.maxAge!==void 0&&(e.maxAge===void 0||t.maxAge<e.maxAge);return n||r},ei=class{constructor(e){this.state=`idle`,this.inFlight=null,this.requirement=null,this.selected=null,this.rankedRequirement=null,this.registrations=[],this.proof=null,this.pruned=new Set,this.openPrompt=null,this.transport=e.transport,this.prompt=e.prompt,this.platform=e.platform,this.available=e.factors??Rr,this.registry=zr(this.available),this.maxAttempts=e.maxAttempts??qr,this.readObtainedBar=e.readObtainedBar,this.onFlightSettled=e.onFlightSettled,this.settleTimeoutMs=e.replaySettleTimeoutMs??Jr}get currentState(){return this.state}get active(){return this.inFlight!==null}elevate(e,t={kind:`imperative`}){let n=this.register(e,t);if(this.state===`idle`)this.state=`collecting`,this.requirement=e,this.inFlight=this.runFlight();else{this.join(e);let t=this.proof;t?.status===`proven`?this.release(n,t.obtained):t?.status===`failed`&&(this.receiveReport(n,{outcome:`failed`}),n.settlement.reject(t.reason))}return n.settlement.promise}register(e,t){let n=t.kind===`imperative`&&t.requested!==void 0,r={demanded:t.kind===`imperative`&&t.requested?t.requested:Xr(e),statedBar:n,settlement:Yr(),reported:!1,entry:{...t,outcome:`pending`,report:e=>this.receiveReport(r,e)}};return this.registrations.push(r),r}join(e){let t=this.requirement;if(!t){this.requirement=e;return}let n=$r(t,e);this.requirement=Qr(t,e),n&&this.state===`collecting`&&this.selected===null&&this.openPrompt?.onRequirementRaised?.({challenge:this.requirement,factors:this.offeredFactors()})}offeredFactors(){let e=this.available.filter(e=>!this.pruned.has(e.type)),t=this.requirement;return t?Wr(e,t):e}receiveReport(e,t){e.reported||(e.reported=!0,e.entry.outcome=t.outcome,t.obtained&&(e.entry.obtained=t.obtained),t.required&&(e.entry.required=t.required),this.notifyReportsSettled())}notifyReportsSettled(){if(!this.reportsSettled||this.registrations.some(e=>!e.reported))return;let e=this.reportsSettled;this.reportsSettled=void 0,e()}async runFlight(){let e;try{e=await this.prove()}catch(t){e={status:`failed`,reason:t instanceof Error?t:Error(String(t))}}if(this.proof=e,e.status===`failed`)for(let t of this.registrations)this.receiveReport(t,{outcome:`failed`}),t.settlement.reject(e.reason);else{this.state=`replaying`;for(let t of this.registrations)this.release(t,e.obtained);await this.awaitReports()}this.state=`settling`;let t=this.summarise(e);try{this.onFlightSettled?.(t)}catch{}this.state=`done`,this.inFlight=null,this.requirement=null,this.selected=null,this.rankedRequirement=null,this.registrations=[],this.proof=null,this.pruned=new Set,this.openPrompt=null,this.reportsSettled=void 0,this.state=`idle`}release(e,t){if(e.entry.kind===`imperative`){if(e.statedBar&&!Zr(t,e.demanded)){this.receiveReport(e,{outcome:`insufficient`,obtained:t,required:e.demanded}),e.settlement.reject(new fr(t,e.demanded));return}this.receiveReport(e,{outcome:`replayed`,obtained:t}),e.settlement.resolve({waiter:e.entry,obtained:t})}else e.settlement.resolve({waiter:e.entry,obtained:t})}awaitReports(){return this.registrations.some(e=>!e.reported)?new Promise(e=>{let t=setTimeout(()=>{this.reportsSettled=void 0;for(let e of this.registrations)e.reported||(e.reported=!0,e.entry.outcome=`failed`);e()},this.settleTimeoutMs);this.reportsSettled=()=>{clearTimeout(t),e()}}):Promise.resolve()}summarise(e){let t=this.registrations.map(e=>({...e.entry.kind===`request`?{url:e.entry.url,method:e.entry.method}:{},outcome:e.entry.outcome,...e.entry.obtained?{obtained:e.entry.obtained}:{},...e.entry.required?{required:e.entry.required}:{}}));if(e.status===`failed`)return{proof:e,waiters:t,terminal:`failed`,error:e.reason};let n;for(let e of t){if(e.outcome!==`insufficient`)continue;let t=e.required?.level??0;(!n||t>(n.required?.level??0))&&(n=e)}return n?{proof:e,waiters:t,terminal:`insufficient`,insufficient:{obtained:n.obtained??e.obtained,required:n.required??{}}}:t.some(e=>e.outcome===`failed`||e.outcome===`pending`)?{proof:e,waiters:t,terminal:`failed`}:{proof:e,waiters:t,terminal:`success`}}async prove(){let e;for(let t=0;t<this.maxAttempts;t++){let t=this.offeredFactors();if(t.length===0)return{status:`failed`,reason:new Kr};let n=this.requirement,r;try{r=await this.collect(n,t,e)}catch(e){return{status:`failed`,reason:new Gr(e)}}if(r.type===`cancel`)return{status:`failed`,reason:new Gr};let i=this.registry.get(r.factor);if(!i)e=new Kr(`Unknown authentication factor: ${r.factor}`),this.state=`collecting`,this.selected=null;else try{return await this.proveAndCommit(i,r.code),{status:`proven`,obtained:this.readObtainedBar?.()??Xr(this.rankedRequirement??n)}}catch(t){if(t instanceof Nr&&t.cancelled)return{status:`failed`,reason:new Gr};let n=this.classifyProofFailure(t);if(n)return{status:`failed`,reason:n};t instanceof $&&t.kind===`not_registered`&&this.pruned.add(i.type),e=t,this.state=`collecting`,this.selected=null}}return{status:`failed`,reason:new $({kind:`attempts_exhausted`,...e?{cause:e}:{}})}}collect(e,t,n){let r={challenge:e,factors:t,...n?{previousError:n}:{},onFactorSelected:e=>{this.state===`collecting`&&(this.state=`proving`),this.selected=e,this.rankedRequirement=this.requirement}};return this.openPrompt=r,this.prompt(r)}classifyProofFailure(e){if(e instanceof fr||e instanceof pr||e instanceof mr)return e;if(e instanceof $)switch(e.kind){case`unavailable`:return new pr(e.message);case`exhausted`:case`attempts_exhausted`:case`fatal`:case`protocol`:case`network`:return e;case`session_changed`:return new mr(e.message);default:return}}async proveAndCommit(e,t){let n=e.requiresPrepare?await this.transport.prepare(e.type):void 0,r=await e.assert({code:t,prepared:n,platform:this.platform});await this.transport.commit(e.type,r)}},ti=e=>typeof e==`function`?e():e,ni=e=>{try{return new URL(e)}catch{return}},ri=(e,t)=>{if(!t||t===`/`)return!0;let n=t.replace(/\/+$/,``);return e===n||e.startsWith(`${n}/`)},ii=(e,t)=>!t||e.origin===void 0?!1:e.origin===t.origin&&ri(e.pathname,t.pathPrefix),ai=(e,t)=>{for(let n of t){if(n===``)continue;if(n.startsWith(`/`)){if(e.relativeToBase&&ri(e.pathname,n))return!0;continue}let t=ni(n)??ni(`https://${n}`);if(t&&e.origin!==void 0&&e.origin===t.origin&&ri(e.pathname,t.pathname))return!0}return!1},oi=(e,t,n)=>ii(e,t.passflow)||ai(e,t.backend)?!n||n(e.href)!==!1:!1,si=e=>{let t=e.detail,n=t?.message??`[passflow] upgrade challenge not actioned: ${e.reason}`;console.warn(n,{status:e.status,url:e.url,reason:e.reason,detail:t})},ci=(e,t)=>{let n=t.onUpgradeDiagnostic??si;return(t,r)=>{n({status:e.status,url:e.request.href,reason:t,detail:{method:e.request.method,...r??{}}})}},li=(e,t,n)=>{let r=n.onUpgradeDiagnostic??si;for(let n of e)r({...n,url:t.request.href,detail:{method:t.request.method,...n.detail??{}}})},ui=/\bjson\b/i,di=async(e,t)=>{let n=t.requireChallengeChannel===`header`,r=e.getHeader(`content-type`)??``,i=!n&&ui.test(r),a;if(i)try{a=await e.readBody()}catch{a=void 0}return we(i?{status:e.status,getHeader:t=>e.getHeader(t)??void 0,body:a}:{status:e.status,getHeader:t=>e.getHeader(t)??void 0},{requireChallengeChannel:t.requireChallengeChannel})},fi=e=>we({status:e.status,getHeader:t=>e.getHeader(t)??void 0},{requireChallengeChannel:`header`}).challenge,pi=(e,t)=>t.passflow===null?`[passflow] a 401/403 from ${e} carried an upgrade challenge, but no Passflow endpoint is configured — set \`url\` on the Passflow config.`:`[passflow] a 401/403 from ${e} carried an upgrade challenge, but that URL is not covered by the provider's \`backend\` prop — add it there to enable step-up for this API.`,mi=(e,t)=>e instanceof Gr?{kind:`cancelled`}:e instanceof Kr?{kind:`unsatisfiable`}:e instanceof pr?{kind:`unavailable`}:e instanceof mr?{kind:`session-changed`}:e instanceof fr?{kind:`insufficient`,obtained:e.obtained,required:e.required}:e instanceof $?e.kind===`exhausted`||e.kind===`attempts_exhausted`?{kind:`exhausted`,error:e}:e.kind===`unavailable`?{kind:`unavailable`}:e.kind===`session_changed`?{kind:`session-changed`}:{kind:`transport-failure`,status:e.status,retryable:e.retryable,error:e}:{kind:`transport-failure`,retryable:!1,error:e instanceof Error?e:Error(String(e))},hi=async(e,t,n,r)=>{if(e.status!==401&&e.status!==403)return{kind:`replayed`,response:e};let{challenge:i,diagnostics:a}=await di(e,t);if(li(a,e,t),!i)return{kind:`replayed`,response:e};let o=Xr(i);return r(`elevated-insufficient`,{obtained:n,required:o}),{kind:`insufficient`,obtained:n,required:o,response:e}},gi=async(e,t)=>{if(!t)return{aborted:!1,value:await e};if(t.aborted)return{aborted:!0,reason:t.reason};if(typeof t.addEventListener!=`function`)return{aborted:!1,value:await e};let n,r=new Promise(e=>{n=()=>e({aborted:!0,reason:t.reason}),t.addEventListener?.(`abort`,n)});try{return await Promise.race([e.then(e=>({aborted:!1,value:e})),r])}finally{n&&t.removeEventListener?.(`abort`,n)}},_i=async(e,t)=>{if(e.status!==401&&e.status!==403||e.markers.upgradeTransaction)return{kind:`not-a-challenge`};let n=ci(e,t);if(e.markers.replayed){if(!oi(e.request,t.scope,t.shouldIntercept))return{kind:`not-a-challenge`};let{challenge:r,diagnostics:i}=await di(e,t);if(li(i,e,t),!r)return{kind:`not-a-challenge`};let a=t.readObtainedBar?.()??{},o=Xr(r);return n(`elevated-insufficient`,{obtained:a,required:o}),{kind:`insufficient`,obtained:a,required:o,response:e}}if(!oi(e.request,t.scope,t.shouldIntercept))return fi(e)?(n(`challenge-out-of-scope`,{header:e.getHeader(`www-authenticate`)??void 0,message:pi(e.request.href,t.scope)}),{kind:`out-of-scope`}):{kind:`not-a-challenge`};let{challenge:r,diagnostics:i}=await di(e,t);if(li(i,e,t),!r){let r=e.getHeader(`www-authenticate`);return t.requireChallengeChannel!==`header`&&n(`no-channel`,{...r?{header:r}:{},message:e.responseType===`cors`&&!r?`[passflow] a cross-origin ${e.status} from ${e.request.href} carried no readable challenge: \`WWW-Authenticate\` is not CORS-safelisted, so add \`Access-Control-Expose-Headers: WWW-Authenticate\` on that server, or have it emit the \`upgrade_required\` JSON body.`:`[passflow] a ${e.status} from ${e.request.href} carried no upgrade challenge on either channel; treated as an ordinary ${e.status}.`}),{kind:`not-a-challenge`}}if(e.replayable===!1)return n(`replay-unsupported`,{message:`[passflow] a ${e.status} from ${e.request.href} carried an upgrade challenge, but the request cannot be replayed (${e.replayUnsupportedReason??`unsupported body`}), so no prompt was opened.`}),{kind:`replay-unsupported`};let a=t.authorizationSwap?.(),o={kind:`request`,url:e.request.href,method:e.request.method},s,c;try{s=Promise.resolve(t.elevate(r,o)),c=await gi(s,e.signal)}catch(e){return mi(e,void 0)}if(c.aborted)return s?.then(e=>e?.waiter.report({outcome:`failed`}),()=>{}),{kind:`aborted`,reason:c.reason};let l=c.value;if(e.signal?.aborted)return l?.waiter.report({outcome:`failed`}),{kind:`aborted`,reason:e.signal.reason};let u=l?.obtained??t.readObtainedBar?.()??Xr(r),d=t.authorizationSwap?.(),f=d?{from:a?.from??d.from,to:d.to}:void 0;e.markers.replayed=!0;let p;try{p=await e.replay(f?{authorizationSwap:f}:void 0)}catch(t){if(t instanceof fr)return l?.waiter.report({outcome:`insufficient`,obtained:t.obtained,required:t.required}),e.signal?.aborted?{kind:`aborted`,reason:e.signal.reason}:{kind:`insufficient`,obtained:t.obtained,required:t.required};if(l?.waiter.report({outcome:`failed`}),e.signal?.aborted)return{kind:`aborted`,reason:e.signal.reason};throw t}let m=await hi(p,t,u,n);return m.kind===`insufficient`?l?.waiter.report({outcome:`insufficient`,obtained:m.obtained,required:m.required}):l?.waiter.report({outcome:`replayed`,obtained:u}),m},vi=e=>{switch(e.kind){case`cancelled`:return new Gr;case`unsatisfiable`:return new Kr;case`unavailable`:return new pr;case`session-changed`:return new mr;case`insufficient`:return new fr(e.obtained,e.required);case`exhausted`:return e.error;case`transport-failure`:return e.error;default:return}},yi=(e,t,n)=>{switch(e.kind){case`replayed`:return{settle:`resolve`,value:e.response.raw};case`not-a-challenge`:case`out-of-scope`:case`replay-unsupported`:return{settle:`resolve`,value:t};case`aborted`:return{settle:`reject`,error:e.reason};case`cancelled`:return n.onCancel===`reject`?{settle:`reject`,error:new Gr}:{settle:`resolve`,value:Oi(t,e)};case`insufficient`:return{settle:`resolve`,value:Oi(e.response?.raw??t,e)};default:return{settle:`resolve`,value:Oi(t,e)}}},bi=(e,t)=>{switch(e.kind){case`replayed`:return e.response.rejected?{settle:`reject`,error:e.response.raw??t}:{settle:`resolve`,value:e.response.raw};case`aborted`:return{settle:`reject`,error:e.reason};default:return{settle:`reject`,error:vi(e)??t}}},xi=new WeakSet,Si=new WeakSet,Ci=new WeakSet,wi=new WeakSet,Ti=new WeakSet,Ei=new WeakSet,Di=new WeakSet,Oi=(e,t)=>{switch(t.kind){case`cancelled`:xi.add(e);break;case`exhausted`:Si.add(e);break;case`insufficient`:Ci.add(e);break;case`unsatisfiable`:wi.add(e);break;case`unavailable`:Ti.add(e);break;case`session-changed`:Ei.add(e);break;case`transport-failure`:Di.add(e)}return e},ki=e=>xi.has(e),Ai=e=>Si.has(e),ji=e=>Ci.has(e),Mi=e=>wi.has(e),Ni=e=>Ti.has(e),Pi=e=>Ei.has(e),Fi=e=>Di.has(e),Ii=`https://passflow-relative.invalid`,Li=()=>{let e=globalThis,t=e.document?.baseURI;if(typeof t==`string`&&t!==``)return t;let n=e.location?.href;return typeof n==`string`&&n!==``&&n!==`about:blank`?n:Ii},Ri=(e,t=Li())=>{let n=t===Ii,r;try{r=new URL(t).origin}catch{r=void 0}let i;try{i=new URL(e,t)}catch{i=void 0}return i?{href:i.href,origin:i.origin,pathname:i.pathname,resolved:!0,relativeToBase:r!==void 0&&i.origin===r,sentinelBase:n}:{href:e,pathname:e.split(/[?#]/)[0]??e,resolved:!1,relativeToBase:!1,sentinelBase:n}},zi=(e,t)=>typeof t==`string`?[e.toLowerCase(),t]:void 0,Bi=e=>{let t=[];if(e==null)return Object.freeze(t);let n=e;if(typeof n.forEach==`function`&&typeof n.entries==`function`)return e.forEach((e,n)=>{let r=zi(n,e);r&&t.push(r)}),Object.freeze(t);if(Array.isArray(e)){for(let n of e)if(Array.isArray(n)&&n.length>=2){let e=zi(String(n[0]),n[1]);e&&t.push(e)}return Object.freeze(t)}if(typeof e==`object`)for(let[n,r]of Object.entries(e)){let e=zi(n,Array.isArray(r)?r.join(`, `):r);e&&t.push(e)}return Object.freeze(t)},Vi=e=>{let t=e.base===void 0?Ri(e.url):Ri(e.url,e.base),n={raw:e.url,href:t.href,dispatchUrl:t.sentinelBase||!t.resolved?e.url:t.href,...t.origin===void 0?{}:{origin:t.origin},pathname:t.pathname,resolved:t.resolved,relativeToBase:t.relativeToBase,method:(e.method??`GET`).toUpperCase(),headers:Bi(e.headers),bodyKind:e.bodyKind,...`body`in e?{body:e.body}:{}};return Object.freeze(n)},Hi=(e,t)=>{if(!t||t.from===t.to)return e;let n=!1,r=e.map(([e,r])=>e===`authorization`&&r===t.from?(n=!0,[e,t.to]):[e,r]);return n?Object.freeze(r):e},Ui=e=>{let t={};for(let[n,r]of e)t[n]=r;return t},Wi=new Set([`GET`,`HEAD`,`OPTIONS`]),Gi=e=>typeof e==`object`&&!!e&&typeof e.url==`string`&&typeof e.clone==`function`&&`method`in e,Ki=e=>typeof e==`string`?e:Gi(e)?e.url:String(e),qi=(e,t)=>(t?.method??(Gi(e)?e.method:void 0)??`GET`).toUpperCase(),Ji=e=>e==null?`none`:typeof e==`string`?`reusable`:typeof e.getReader==`function`?`one-shot`:`reusable`,Yi=e=>{if(typeof e==`string`)return e.length;let t=e;if(typeof t?.size==`number`)return t.size;if(typeof t?.byteLength==`number`)return t.byteLength},Xi=(e,t,n)=>e===void 0||e===`always`?!0:e===`idempotent-only`?Wi.has(t.method):typeof e==`function`?e(t):!(e.maxBodyBytes!==void 0&&n!==void 0&&n>e.maxBodyBytes),Zi=(e,t,n,r,i)=>({replayable:!1,bodyKind:e,reason:t,forwardInput:n,forwardInit:i,snapshot:r,replay:()=>Promise.reject(Error(`This request cannot be replayed: ${t}`))}),Qi=(e,t)=>Ui(Hi(e.headers,t?.authorizationSwap)),$i=e=>{if(!e||!(`headers`in e))return e;let{headers:t,...n}=e;return n},ea=(e,t)=>t&&`headers`in t&&t.headers!==void 0?t.headers:Gi(e)?e.headers:void 0,ta=e=>{if(e===null||typeof e==`string`)return e;if(typeof FormData<`u`&&e instanceof FormData){let t=new FormData;for(let[n,r]of e)t.append(n,r);return t}return typeof URLSearchParams<`u`&&e instanceof URLSearchParams?new URLSearchParams(e):e instanceof ArrayBuffer?e.slice(0):ArrayBuffer.isView(e)?new Uint8Array(e.buffer,e.byteOffset,e.byteLength).slice():e},na=(e,t,n)=>new Request(e,{headers:Qi(t,n)}),ra=(e,t,n)=>{let r=Ki(e),i=qi(e,t),a=ea(e,t),o=(e,t)=>Vi({url:r,method:i,headers:a,bodyKind:e,...t===void 0?{}:{body:t}});if(Gi(e)){if(e.body===null||e.body===void 0){let a=o(`none`);return Xi(n,{url:r,method:i,bodyKind:`none`})?{replayable:!0,bodyKind:`none`,forwardInput:e,forwardInit:t,snapshot:a,replay:(n,r)=>n(na(e,a,r),$i(t))}:Zi(`none`,`the replay policy refused this request`,e,a,t)}let a=o(`request-clone`);if(!Xi(n,{url:r,method:i,bodyKind:`request-clone`}))return Zi(`request-clone`,`the replay policy refused this request`,e,a,t);let s;try{s=e.clone()}catch{return Zi(`one-shot`,`the Request body was already consumed and cannot be cloned`,e,a,t)}return{replayable:!0,bodyKind:`request-clone`,forwardInput:e,forwardInit:t,snapshot:a,replay:(e,n)=>e(na(s,a,n),$i(t))}}let s=Ji(t?.body);if(s===`one-shot`)return Zi(`one-shot`,`a streaming request body is consumed by the first send`,e,o(`one-shot`),t);if(!Xi(n,{url:r,method:i,bodyKind:s},Yi(t?.body)))return Zi(s,`the replay policy refused this request`,e,o(s),t);let c=t&&`body`in t?ta(t.body??null):void 0,l=o(s,c);return{replayable:!0,bodyKind:s,forwardInput:e,forwardInit:t,snapshot:l,replay:(e,n)=>e(l.dispatchUrl,{...$i(t),...c===void 0?{}:{body:c},headers:Qi(l,n),method:l.method})}},ia=e=>typeof e==`object`&&!!e,aa=e=>t=>{if(!ia(e))return;let n=e[t]??e[t.toLowerCase()]??(typeof e.get==`function`?e.get(t):void 0);return Array.isArray(n)?n.join(`, `):typeof n==`string`?n:void 0},oa=e=>{let t=e?.url??``,n=e?.baseURL;return!n||/^([a-z][a-z\d+\-.]*:)?\/\//i.test(t)?t:`${n.replace(/\/+$/,``)}/${t.replace(/^\/+/,``)}`},sa=e=>(e?.method??`GET`).toUpperCase(),ca=e=>e==null?`none`:ia(e)&&(typeof e.pipe==`function`||typeof e.getReader==`function`)?`one-shot`:`reusable`,la=(e,t,n)=>{let r=Ui(Hi(t.headers,n?.authorizationSwap)),i=t.dispatchUrl===t.href&&t.resolved;return{...e,...i?{baseURL:void 0}:{},url:t.dispatchUrl,method:t.method,headers:r,...`body`in t?{data:t.body}:{}}},ua=(e,t,n,r,i,a)=>{let o=t??e?.config,s=ca(o?.data),c=a??Vi({url:oa(o),method:sa(o),headers:o?.headers,bodyKind:s,body:o?.data}),l={url:c.href,method:c.method,bodyKind:s},u=s!==`one-shot`&&Xi(i.replay,l);return{status:e?.status??0,getHeader:aa(e?.headers),readBody:async()=>e?.data,request:c,replay:async e=>{let t=je(la(o??{},c,e));try{let e=await r(t);return ua(e,e?.config??t,e,r,i,c)}catch(e){let n=ia(e)?e:{};if(!n.response||typeof n.response.status!=`number`||ir(e))throw e;return{...ua(n.response,n.config??t,e,r,i,c),rejected:!0}}},markers:{...Ae(o)?{upgradeTransaction:!0}:{},...Me(o)?{replayed:!0}:{}},raw:n,replayable:u,replayUnsupportedReason:s===`one-shot`?`a streaming request body is consumed by the first send`:`the replay policy refused this request`,signal:o?.signal}},da=(e,t)=>async n=>{let r=ti(e),i=ia(n)?n:{},a=bi(await _i(ua(i.response,i.config,i.response,t,r),r),n);if(a.settle===`reject`)throw a.error;return a.value},fa=(e,t,n)=>{let r=e.request,i=n??(typeof r==`function`?t=>r.call(e,t):()=>Promise.reject(Error(`Passflow: this client exposes no request() to replay through.`))),a=e.interceptors.response.use(void 0,da(t,i)),o=!1;return()=>{o||(o=!0,e.interceptors.response.eject(a))}},pa=(e,t)=>{let n=c.default.create(e);return t(n),n},ma=0,ha=(e,t)=>{let n=t?.signal??(typeof e==`object`&&e?e.signal:void 0)??void 0;if(n)return{get aborted(){return n.aborted},get reason(){return n.reason},...typeof n.addEventListener==`function`?{addEventListener:(e,t)=>n.addEventListener(e,t),removeEventListener:(e,t)=>n.removeEventListener(e,t)}:{}}},ga=e=>t=>e.headers?.get(t),_a=(e,t,n,r,i)=>({status:e.status,getHeader:ga(e),readBody:()=>e.clone().json(),request:t.snapshot,replay:async e=>_a(await t.replay(n,e),t,n,r,i),markers:r,raw:e,replayable:t.replayable,replayUnsupportedReason:t.reason,signal:i,responseType:e.type}),va=(e,t)=>{let n=(t,n)=>{ma+=1;try{return e(t,n)}finally{--ma}};return async(e,r)=>{if(ma>0)return n(e,r);let i=ti(t),a=ra(e,r,i.replay),o=await n(a.forwardInput,a.forwardInit),s=yi(await _i(_a(o,a,n,{},ha(e,r)),i),o,i);if(s.settle===`reject`)throw s.error;return s.value}},ya=new Set(Rr.filter(e=>!e.requiresPrepare).map(e=>e.type)),ba=e=>{if(!e||typeof e!=`object`||!e.challenge_id||!e.expires_at)throw new $({kind:`protocol`,message:`The upgrade start response is missing challenge_id or expires_at`});return{challengeId:e.challenge_id,method:e.method,expiresAt:e.expires_at,webauthn:e.webauthn,codeSentTo:e.code_sent_to}},xa=e=>ir(e)&&!ar(e),Sa=e=>({async prepare(t){if(!ya.has(t))try{let n=e.relyingPartyId?.();return ba(await e.startUpgrade(n?{method:t,relying_party_id:n}:{method:t}))}catch(e){if(xa(e))throw e;let t=lr(e,`start`);if(t.kind===`prepare_not_required`)return;throw t}},async commit(t,n){let r=e.canCommit();if(!r.ok)throw new $({kind:`unavailable`,message:r.reason});try{await e.commitRefresh({type:t,assertion:n})}catch(t){if(xa(t))throw t;let n=lr(t,`refresh`);throw n.status===401&&dr(n)&&e.markSessionInvalid?.(),n}}}),Ca=e=>e===void 0?[]:(Array.isArray(e)?e:[e]).filter(e=>e!==``),wa=e=>{let t,n=e=>e!==void 0&&t===e,r=r=>{let i=()=>{if(!n(r()))throw new $({kind:`session_changed`})};return Sa({...e,relyingPartyId:()=>t?.options.relyingPartyId??e.relyingPartyId?.(),startUpgrade:t=>(i(),e.startUpgrade(t)),commitRefresh:t=>(i(),e.commitRefresh(t,r()?.pin)),...e.markSessionInvalid?{markSessionInvalid:()=>{n(r())&&e.markSessionInvalid?.()}}:{}})},i=(t,n)=>{let i={},a={controller:new ei({transport:r(()=>i.current),prompt:t.prompt,platform:e.platform,factors:t.factors??e.factors,...t.maxAttempts===void 0?{}:{maxAttempts:t.maxAttempts},...e.readObtainedBar?{readObtainedBar:e.readObtainedBar}:{},...t.onFlightSettled?{onFlightSettled:t.onFlightSettled}:{}}),options:t,scope:{passflow:e.passflowDomain,backend:Ca(t.backend)},generation:n};return i.current=a,a},a=async(r,i)=>{let a=t;if(!a)throw new pr(`Step-up verification is not enabled on this Passflow instance`);a.controller.active||(a.pin=e.readSessionPin?.());let o=await a.controller.elevate(r,i);if(!n(a))throw new mr;return o},o=()=>{let n=t,r=n?.scope??{passflow:e.passflowDomain,backend:[]},i=n?.options;return{elevate:a,scope:r,...i?.requireChallengeChannel?{requireChallengeChannel:i.requireChallengeChannel}:{},...i?.shouldIntercept?{shouldIntercept:i.shouldIntercept}:{},...i?.replay===void 0?{}:{replay:i.replay},...i?.onCancel?{onCancel:i.onCancel}:{},...e.authorizationSwap?{authorizationSwap:e.authorizationSwap}:{},...i?.onUpgradeDiagnostic?{onUpgradeDiagnostic:i.onUpgradeDiagnostic}:{},...e.readObtainedBar?{readObtainedBar:e.readObtainedBar}:{}}},s;return Object.defineProperties(async e=>{let t=e?.acrValues===void 0?void 0:z(e.acrValues).level,n={status:401,...e?.acrValues===void 0?{}:{acrValues:e.acrValues},...t===void 0?{}:{requiredLevel:t},...e?.maxAge===void 0?{}:{maxAge:e.maxAge}},r=e?.acrValues!==void 0||e?.maxAge!==void 0,i={...e?.acrValues===void 0?{}:{acrValues:e.acrValues},...t===void 0?{}:{level:t},...e?.maxAge===void 0?{}:{maxAge:e.maxAge}},o=(await a(n,{kind:`imperative`,...r?{requested:i}:{}})).obtained.acrValues;return{status:`elevated`,...o===void 0?{}:{acr:o}}},{enable:{value:n=>{s?.(),t=i(n,0);let r=[];if(e.attachInternalSeam){let t=e.attachInternalSeam;t(e=>da(o,e)),r.push(()=>t(void 0))}n.interceptFetch&&r.push(yt((e,t,n)=>va(e,o)(t,n),{priority:20,name:`passflow-upgrade`})),e.onSessionChange&&r.push(e.onSessionChange(()=>{let e=t;e&&(t=i(e.options,e.generation+1))}));let a=!1;return s=()=>{if(!a){a=!0;for(let e of r)e();t=void 0,s=void 0}},s},enumerable:!0},enabled:{enumerable:!0,get(){return t!==void 0&&e.canCommit().ok}},elevate:{enumerable:!0,value:(e,t)=>a(e,t??{kind:`imperative`})},withAuth:{enumerable:!0,value:e=>{if(e)return va(e,o);let t=typeof globalThis>`u`?void 0:globalThis;if(!t||typeof t.fetch!=`function`)throw Error(`Passflow: withAuth() needs a fetch to wrap — this runtime has none.`);return va(t.fetch.bind(t),o)}},attachAuth:{enumerable:!0,value:e=>fa(e,o)}})},Ta,Ea=class{get origin(){return this.platform.getCurrentUrl()?.origin??``}constructor(e){this.doRefreshTokens=!1,this.session=async({createSession:e,expiredSession:t,doRefresh:n=!1})=>{this.createSessionCallback=e,this.expiredSessionCallback=t,this.doRefreshTokens=n,await this.submitSessionCheck()};let{url:t,appId:n,scopes:r}=e;this.url=t||`https://auth.passflow.cloud`,this.appId=n,this.platform=e.platform??L,this.storageManager=new P({prefix:e.keyStoragePrefix??``,storage:this.platform.storage}),this.deviceService=new F(this.storageManager),this.authApi=new Xe(e,this.storageManager,this.deviceService),this.appApi=new Je(e,this.storageManager,this.deviceService),this.userApi=new at(e,this.storageManager,this.deviceService),this.settingApi=new $e(e,this.storageManager,this.deviceService),this.tenantApi=new et(e,this.storageManager,this.deviceService),this.invitationApi=new Qe(e,this.storageManager,this.deviceService),this.twoFactorApi=new rt(e,this.storageManager,this.deviceService),this.upgradeApi=new it(e,this.storageManager,this.deviceService),this.upgradeDomain=Fe(e.url),this.subscribeStore=new Zn,this.tokenCacheService=new Ar(this.storageManager,this.authApi,this.subscribeStore,this.platform),this.scopes=r??_,this.createTenantForNewUser=e.createTenantForNewUser??!1;let i=un(e.refreshCoordination,this.platform,e.keyStoragePrefix,{tokenKeys:()=>this.storageManager.tokenKeys()});this.authService=new Er(this.authApi,this.deviceService,this.storageManager,this.subscribeStore,this.tokenCacheService,this.scopes,this.createTenantForNewUser,this.url,{createSession:this.createSessionCallback,expiredSession:this.expiredSessionCallback},this.appId??``,e.tokenExchange,this.platform,()=>this.readPkceEnabled(),{coordination:i,...e.refreshStrikes===void 0?{}:{strikes:e.refreshStrikes}}),this.tokenCacheService.attachRefreshController(this.authService.refresh);for(let e of this.axiosClients())e.setRefreshHandler(e=>this.authService.refresh.ensureFresh(e));this.userService=new Mr(this.userApi,this.deviceService,this.platform),this.tenantService=new kr(this.tenantApi,this.scopes),this.tenant=this.tenantService,this.invitationService=new Dr(this.invitationApi),this.twoFactorService=new jr(this.twoFactorApi,this.subscribeStore,this.authService),this.twoFactor=this.twoFactorService,this.upgrade=wa({startUpgrade:e=>this.upgradeApi.startUpgrade(e),commitRefresh:async(e,t)=>{await this.authService.refreshToken(e,t)},readSessionPin:()=>this.authService.readSessionPin(),canCommit:()=>this.authService.tokenDeliveryManager.isBFFMode()?{ok:!1,reason:`Step-up verification cannot be committed through a BFF refresh endpoint`}:{ok:!0},markSessionInvalid:()=>this.authService.tokenDeliveryManager.setSessionInvalid(),platform:this.platform,passflowDomain:this.upgradeDomain,...e.upgrade?.factors?{factors:e.upgrade.factors}:{},...e.upgrade?.relyingPartyId?{relyingPartyId:()=>e.upgrade?.relyingPartyId}:{},readObtainedBar:()=>this.readAssuranceBar(),authorizationSwap:()=>{let e=this.storageManager.getToken(M.access_token);return e?{from:`Bearer ${e}`,to:`Bearer ${e}`}:void 0},attachInternalSeam:e=>this.attachUpgradeSeam(e),onSessionChange:e=>this.subscribeToSessionChange(e)}),e.parseQueryParams&&this.checkAndSetTokens(),this.setTokensToCacheFromLocalStorage()}readPkceEnabled(){if(!this.appId)return Promise.resolve(!1);if(!this.pkceEnabledRead){let e=this.appApi.getAppSettings().then(e=>e.pkce_enabled);this.pkceEnabledRead=e,e.catch(()=>{this.pkceEnabledRead===e&&(this.pkceEnabledRead=void 0)})}return this.pkceEnabledRead}setAppId(e){this.appId=e,this.pkceEnabledRead=void 0,this.authApi.setAppId(e),this.appApi.setAppId(e),this.userApi.setAppId(e),this.settingApi.setAppId(e),this.tenantApi.setAppId(e),this.invitationApi.setAppId(e),this.twoFactorApi.setAppId(e),this.upgradeApi.setAppId(e),this.authService}withAuth(e){return this.upgrade.withAuth(e)}attachAuth(e){return this.upgrade.attachAuth(e)}createClient(e){return pa(e,e=>this.upgrade.attachAuth(e))}readAssuranceBar(){let e=this.storageManager.getToken(M.access_token);if(e)try{let t=j(e),n=typeof t.acr==`string`?t.acr:void 0;if(!n)return;let r=z(n).level;return r===void 0?{acrValues:n}:{acrValues:n,level:r}}catch{return}}axiosClients(){return[this.authApi.axiosClient,this.appApi.axiosClient,this.userApi.axiosClient,this.settingApi.axiosClient,this.tenantApi.axiosClient,this.invitationApi.axiosClient,this.twoFactorApi.axiosClient,this.upgradeApi.axiosClient]}attachUpgradeSeam(e){for(let t of this.axiosClients()){if(!e){t.setUpgradeInterceptor(void 0);continue}let n=e(e=>t.replay(e));t.setUpgradeInterceptor(n)}}subscribeToSessionChange(e){let t={onAuthChange:()=>e()};return this.subscribeStore.subscribe(t,[Z.SignIn,Z.SignOut]),()=>this.subscribeStore.unsubscribe(t)}async submitSessionCheck(){let e,t;try{e=await this.authService.getTokens(this.doRefreshTokens),t=this.tokenCacheService.getParsedTokens()}catch(t){let n={operation:`session.check`,message:t instanceof Error||t instanceof V?t.message:`Session check failed`,originalError:t};W(this.subscribeStore,n),e=void 0}e&&this.createSessionCallback&&await this.createSessionCallback({tokens:e,parsedTokens:t}),!e&&this.expiredSessionCallback&&await this.expiredSessionCallback()}subscribe(e,t){this.subscribeStore.subscribe(e,t),this.tokenCacheService.initialize()}unsubscribe(e,t){this.subscribeStore.unsubscribe(e,t)}handleTokensRedirect(){return this.checkAndSetTokens()}checkAndSetTokens(){let e=this.platform.getCurrentUrl(),t=new URLSearchParams(e?.search??``),n=!1;if(!t.get(`access_token`)&&e?.hash){let r=new URLSearchParams(e.hash.substring(1));r.get(`access_token`)&&(t=r,n=!0)}if(!t.get(`access_token`)&&this.adoptTwoFactorTokenFromUrl(e)){this.error=void 0;return}let r=t.get(`access_token`),i=t.get(`refresh_token`),a=t.get(`id_token`),o=t.get(`scopes`)?.split(`,`)??this.scopes,s;if(r){if(!_r(r)){W(this.subscribeStore,{operation:`tokens.from-url`,message:`Invalid access token format received`,code:`INVALID_TOKEN_FORMAT`}),this.cleanupUrlParams(n,e);return}if(i&&!_r(i)){W(this.subscribeStore,{operation:`tokens.from-url`,message:`Invalid refresh token format received`,code:`INVALID_TOKEN_FORMAT`}),this.cleanupUrlParams(n,e);return}if(a&&!_r(a)){W(this.subscribeStore,{operation:`tokens.from-url`,message:`Invalid ID token format received`,code:`INVALID_TOKEN_FORMAT`}),this.cleanupUrlParams(n,e);return}return s={access_token:r,refresh_token:i??void 0,id_token:a??void 0,scopes:o},this.storageManager.clearDeliveryMode(),this.storageManager.saveTokens(s),this.tokenCacheService.setTokensCache(s),this.authService.refresh.sessionStarted(),this.subscribeStore.notify(Z.SignIn,{tokens:s,parsedTokens:this.getParsedTokens()}),this.submitSessionCheck(),this.cleanupUrlParams(n,e),this.error=void 0,s}this.error=this.checkErrorsFromURL()}adoptTwoFactorTokenFromUrl(e){if(!e?.hash)return!1;let t=new URLSearchParams(e.hash.substring(1)),n=t.get(`tfa_token`);if(!n)return!1;t.delete(`tfa_token`);let r=t.toString();return this.platform.replaceUrl(e.pathname+e.search+(r?`#${r}`:``)),_r(n)?(this.subscribeStore.notify(Z.TwoFactorRequired,{email:``,challengeId:``,tfaToken:n}),!0):(W(this.subscribeStore,{operation:`tokens.from-url`,message:`Invalid 2FA token format received`,code:`INVALID_TOKEN_FORMAT`}),!0)}checkErrorsFromURL(){let e=new URLSearchParams(this.platform.getCurrentUrl()?.search??``).get(`error`);if(e){let t=vr(e);return Error(t)}}cleanupUrlParams(e=!1,t=null){let n=t??this.platform.getCurrentUrl();if(n){if(e)this.platform.replaceUrl(n.pathname+n.search);else{let e=new URLSearchParams(n.search);e.delete(`access_token`),e.delete(`refresh_token`),e.delete(`id_token`),e.delete(`client_challenge`),e.size>0?this.platform.replaceUrl(`${n.pathname}?${e.toString()}`):this.platform.replaceUrl(n.pathname)}}}setTokensToCacheFromLocalStorage(){let e=this.storageManager.getTokens();if(!e?.access_token&&this.storageManager.getDeliveryMode()){if(e?.id_token&&this.storageManager.hasCookieModeIdToken()){this.tokenCacheService.setTokensCache(e);return}if(this.storageManager.hasJsonModeTokens())this.storageManager.clearDeliveryMode(),e=this.storageManager.getTokens();else{this.storageManager.deleteTokens();return}}e&&this.tokenCacheService.setTokensCache(e)}getCachedTokens(){return this.tokenCacheService.getTokens()}getTokensWithRefresh(){return this.tokenCacheService.getTokensWithRefresh()}getParsedTokens(){return this.tokenCacheService.getParsedTokens()}areTokensExpired(){return this.tokenCacheService.isExpired()}isAuthenticated(){let e=this.getDeliveryMode();if(e===N.Cookie||e===N.BFF)return this.authService.isAuthenticated(this.tokenCacheService.getParsedTokens()??{});let t=this.storageManager.getTokens();if(!t||!t.access_token)return!1;let n=this.tokenCacheService.getParsedTokens();return n?this.authService.isAuthenticated(n):!1}async signIn(e){return await this.authService.signIn(e)}async signUp(e){return await this.authService.signUp(e)}passwordlessSignIn(e){return this.authService.passwordlessSignIn(e)}async passwordlessSignInComplete(e){return await this.authService.passwordlessSignInComplete(e)}handleError(e,t,n){let r={operation:t,message:e instanceof Error?e.message:`${n} failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,r),e}async logOut(){try{let e=await this.authService.logOut();this.twoFactorService.clearPartialAuthState(),this.notifySignedOut(e),await this.submitSessionCheck()}catch(e){this.handleError(e,`log-out`,`Log out`)}}federatedAuthWithPopup(e){this.authService.federatedAuthWithPopup(e)}federatedAuthWithRedirect(e){this.authService.federatedAuthWithRedirect(e)}reset(e){if(this.notifySignedOut(this.authService.resetSession()),e){this.error=Error(e);let t={operation:`reset`,message:e,code:`RESET_ERROR`};throw W(this.subscribeStore,t),this.error}}notifySignedOut(e){this.subscribeStore.notify(Z.SignOut,e===void 0?{origin:`this-tab`}:{origin:`this-tab`,userId:e})}dispose(){this.authService.refresh.dispose(),this.tokenCacheService.destroy()}async refreshToken(){return await this.authService.refreshToken()}sendPasswordResetEmail(e){return this.authService.sendPasswordResetEmail(e)}async resetPassword(e,t){return await this.authService.resetPassword(e,t)}async getAppSettings(){try{return await this.appApi.getAppSettings()}catch(e){this.handleError(e,`settings.app`,`Get app settings`)}}async getSettingsAll(){try{return await this.settingApi.getSettingsAll()}catch(e){this.handleError(e,`settings.all`,`Get all settings`)}}async getPasswordPolicySettings(){try{return await this.settingApi.getPasswordPolicySettings()}catch(e){this.handleError(e,`settings.password-policy`,`Get password policy settings`)}}async getPasskeySettings(){try{return await this.settingApi.getPasskeySettings()}catch(e){this.handleError(e,`settings.passkey`,`Get passkey settings`)}}async passkeyRegister(e){return await this.authService.passkeyRegister(e)}async passkeyAuthenticate(e){return await this.authService.passkeyAuthenticate(e)}setTokens(e){let t=this.getDeliveryMode(),n=t===N.Cookie||t===N.BFF;this.storageManager.saveTokens(e,n?t:void 0),this.tokenCacheService.setTokensCache(e),this.authService.refresh.sessionStarted(),this.subscribeStore.notify(Z.SignIn,{tokens:e,parsedTokens:this.tokenCacheService.getParsedTokens()})}async getTokens(e=!1){return await this.authService.getTokens(e)}getToken(e){return this.storageManager.getToken(e)}async getUserPasskeys(){try{return await this.userService.getUserPasskeys()}catch(e){this.handleError(e,`passkey.list`,`Get user passkeys`)}}async renameUserPasskey(e,t){try{return await this.userService.renameUserPasskey(e,t)}catch(e){this.handleError(e,`passkey.rename`,`Rename user passkey`)}}async deleteUserPasskey(e){try{return await this.userService.deleteUserPasskey(e)}catch(e){this.handleError(e,`passkey.delete`,`Delete user passkey`)}}async addUserPasskey(e){try{return await this.userService.addUserPasskey(e)}catch(e){this.handleError(e,`passkey.add`,`Add user passkey`)}}async joinInvitation(e,t){try{let n=await this.tenant.joinInvitation(e,t);return n.scopes=t??this.scopes,await this.authService.applyTokens(n),n}catch(e){this.handleError(e,`invitation.join`,`Join invitation`)}}async createTenant(e,t){try{let n=await this.tenant.createTenant(e);return t&&await this.refreshToken(),n}catch(e){this.handleError(e,`tenant.create`,`Create tenant`)}}async requestInviteLink(e){try{return e.send_to_email===void 0&&(e.send_to_email=!0),await this.invitationService.requestInviteLink(e)}catch(e){this.handleError(e,`invitation.request-link`,`Request invite link`)}}async getInvitations(e){try{return await this.invitationService.getInvitations(e)}catch(e){this.handleError(e,`invitation.list`,`Get invitations`)}}async deleteInvitation(e){try{return await this.invitationService.deleteInvitation(e)}catch(e){this.handleError(e,`invitation.delete`,`Delete invitation`)}}async resendInvitation(e){try{return await this.invitationService.resendInvitation(e)}catch(e){this.handleError(e,`invitation.resend`,`Resend invitation`)}}async getInvitationLink(e){try{return await this.invitationService.getInvitationLink(e)}catch(e){this.handleError(e,`invitation.get-link`,`Get invitation link`)}}authRedirectUrl(e={}){return this.authService.authRedirectUrl(e)}authRedirect(e={}){this.authService.authRedirect(e)}getDeliveryMode(){return this.authService.tokenDeliveryManager.getMode()}async restoreSession(){return await this.authService.restoreSession()}async getTwoFactorStatus(){try{return await this.twoFactorService.getStatus()}catch(e){this.handleError(e,`2fa.status`,`Get 2FA status`)}}async beginTwoFactorSetup(){try{return await this.twoFactorService.beginSetup()}catch(e){this.handleError(e,`2fa.setup.begin`,`Begin 2FA setup`)}}async confirmTwoFactorSetup(e){try{return await this.twoFactorService.confirmSetup(e)}catch(e){this.handleError(e,`2fa.setup.confirm`,`Confirm 2FA setup`)}}async verifyTwoFactor(e,t){try{let n=await this.twoFactorService.verify(e,t);return this.subscribeStore.notify(Z.SignIn,{tokens:n,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck(),n}catch(e){this.handleError(e,`2fa.verify`,`Verify 2FA`)}}async useTwoFactorRecoveryCode(e,t){try{let n=await this.twoFactorService.useRecoveryCode(e,t);return this.subscribeStore.notify(Z.SignIn,{tokens:n,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck(),n}catch(e){this.handleError(e,`2fa.recovery.use`,`Use 2FA recovery code`)}}async disableTwoFactor(e){try{return await this.twoFactorService.disable(e)}catch(e){this.handleError(e,`2fa.disable`,`Disable 2FA`)}}async regenerateTwoFactorRecoveryCodes(e){try{return await this.twoFactorService.regenerateRecoveryCodes(e)}catch(e){this.handleError(e,`2fa.recovery.regenerate`,`Regenerate 2FA recovery codes`)}}async getTrustedDevices(){try{return await this.twoFactorService.getTrustedDevices()}catch(e){this.handleError(e,`2fa.trusted-devices.list`,`Get trusted devices`)}}async revokeTrustedDevice(e){try{await this.twoFactorService.revokeTrustedDevice(e)}catch(e){this.handleError(e,`2fa.trusted-devices.revoke`,`Revoke trusted device`)}}isTwoFactorVerificationRequired(){return this.twoFactorService.isVerificationRequired()}getTotpDigits(){return this.twoFactorService.getTotpDigits()}async validateTwoFactorSetupMagicLink(e){return await this.twoFactorService.validateTwoFactorSetupMagicLink(e)}getMagicLinkSession(){return this.twoFactorService.getMagicLinkSession()}hasMagicLinkSession(){return this.twoFactorService.hasMagicLinkSession()}clearMagicLinkSession(){this.twoFactorService.clearMagicLinkSession()}};Ta=Ea,Ta.version=h,exports.APP_ID_HEADER_KEY=d,exports.AUTHORIZATION_HEADER_KEY=f,exports.AppAPI=Je,exports.AuthAPI=Xe,exports.AuthService=Er,exports.CLIAuthAPI=Ze,exports.DEFAULT_GROUP_NAME=y,exports.DEFAULT_SCOPES=_,exports.DEFAULT_UPGRADE_FACTORS=Rr,exports.DEVICE_ID_HEADER_KEY=p,exports.DEVICE_TYPE_HEADER_KEY=m,exports.ERROR_MESSAGE_MAX_LENGTH=E,exports.FETCH_PRIORITY_OIDC=ot,exports.FETCH_PRIORITY_UPGRADE=st,exports.FetchMiddlewareContractError=ct,exports.INSUFFICIENT_USER_AUTHENTICATION=pe,exports.InvitationAPI=Qe,exports.InvitationService=Dr,exports.M2MClient=Ot,exports.M2MConfigError=Ct,exports.M2MError=U,exports.M2MErrorCodes=wt,exports.M2MNetworkError=xt,exports.M2MTokenParseError=St,exports.M2M_DEFAULTS=Tt,exports.MINIMAL_DEFAULT_SCOPES=g,exports.OS=Le,exports.PASSFLOW_CLOUD_URL=v,exports.POPUP_HEIGHT=x,exports.POPUP_POLL_INTERVAL_MS=ee,exports.POPUP_TIMEOUT_MS=S,exports.POPUP_WIDTH=b,exports.Passflow=Ea,exports.PassflowAdminEndpointPaths=Pe,exports.PassflowEndpointPaths=B,exports.PassflowError=V,exports.PassflowEvent=Z,exports.PassflowRefreshError=J,exports.PopupClosedError=I,exports.Providers=Ie,exports.RECOVERABLE_COMMIT_ERROR_IDS=Qn,exports.REFRESH_AUTH_FAILURE_IDS=yn,exports.RefreshErrorId=q,exports.RequestMethod=Ne,exports.SDK_VERSION=h,exports.SESSION_INVALIDATING_COMMIT_ERROR_IDS=$n,exports.SessionState=se,exports.SettingAPI=$e,exports.TOKEN_EXPIRY_BUFFER_SECONDS=C,exports.TenantAPI=et,exports.TenantService=kr,exports.TenantUserMembership=Or,exports.TokenCacheService=Ar,exports.TokenDeliveryMode=N,exports.TokenType=M,exports.TwoFactorApiClient=rt,exports.TwoFactorPolicy=ze,exports.TwoFactorService=jr,exports.UPGRADE_REQUIRED=me,exports.USERNAME_MAX_LENGTH=T,exports.USERNAME_MIN_LENGTH=w,exports.UpgradeAPI=it,exports.UpgradeCancelledError=Gr,exports.UpgradeCommitInterruptedError=jn,exports.UpgradeController=ei,exports.UpgradeErrorIds=Q,exports.UpgradeFactorError=Nr,exports.UpgradeInsufficientError=fr,exports.UpgradeSessionChangedError=mr,exports.UpgradeTransportError=$,exports.UpgradeUnavailableError=pr,exports.UpgradeUnsatisfiableError=Kr,exports.UserAPI=at,exports.UserService=Mr,exports.WebAdapter=le,exports.classifyUpgradeError=lr,exports.factorRegistry=zr,exports.fetchRegistryState=bt,exports.getOSFromDeviceType=Re,exports.invalidatesSessionOnCommit=dr,exports.isRecoverableCommitFailure=ur,exports.isRetryableUpgradeKind=tr,exports.isTokenExpired=A,exports.isUpgradeCancelled=ki,exports.isUpgradeExhausted=Ai,exports.isUpgradeInsufficient=ji,exports.isUpgradeSessionChanged=Pi,exports.isUpgradeTransportError=ar,exports.isUpgradeTransportFailure=Fi,exports.isUpgradeUnavailable=Ni,exports.isUpgradeUnsatisfiable=Mi,exports.isValidEmail=yr,exports.isValidJWTFormat=_r,exports.isValidPhoneNumber=br,exports.isValidUsername=xr,exports.parseChallengeBody=xe,exports.parseChallengeHeader=be,exports.parseToken=j,exports.parseUpgradeChallenge=Te,exports.passkeyFactor=Lr,exports.pathWithParams=H,exports.recoveryCodesFactor=Ir,exports.registerFetchMiddleware=yt,exports.requiredAcrLevel=fe,exports.resolveUpgradeDomain=Fe,exports.sanitizeErrorMessage=vr,exports.selectFactors=Wr,exports.totpFactor=Fr,exports.webAdapter=L;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,s)=>(s=n==null?{}:e(i(n)),o(r||!n||!n.__esModule||!a.call(n,`default`)?t(s,`default`,{value:n,enumerable:!0}):s,n));let c=require("axios");c=s(c,1);let l=require("@simplewebauthn/browser");var u=`0.21.1`,d=`X-Passflow-Clientid`,f=`Authorization`,p=`X-Passflow-DeviceId`,m=`X-Passflow-DeviceType`,h=u,g=[`id`,`offline`,`openid`],_=[`id`,`offline`,`tenant`,`email`,`oidc`,`openid`,`access:tenant:all`],v=`https://auth.passflow.cloud`,y=`default`,b=500,x=600,ee=100,S=6e4,C=30,w=3,T=30,E=200,D=[];for(let e=0;e<256;++e)D.push((e+256).toString(16).slice(1));function te(e,t=0){return(D[e[t+0]]+D[e[t+1]]+D[e[t+2]]+D[e[t+3]]+`-`+D[e[t+4]]+D[e[t+5]]+`-`+D[e[t+6]]+D[e[t+7]]+`-`+D[e[t+8]]+D[e[t+9]]+`-`+D[e[t+10]]+D[e[t+11]]+D[e[t+12]]+D[e[t+13]]+D[e[t+14]]+D[e[t+15]]).toLowerCase()}var O=new Uint8Array(16);function ne(){return crypto.getRandomValues(O)}function re(e,t,n){return!t&&!e&&crypto.randomUUID?crypto.randomUUID():ie(e,t,n)}function ie(e,t,n){e=e||{};let r=e.random??e.rng?.()??ne();if(r.length<16)throw Error(`Random bytes length must be >= 16`);if(r[6]=r[6]&15|64,r[8]=r[8]&63|128,t){if(n=n||0,n<0||n+16>t.length)throw RangeError(`UUID byte range ${n}:${n+15} is out of buffer bounds`);for(let e=0;e<16;++e)t[n+e]=r[e];return t}return te(r)}var ae=e=>{let t=[],n;for(n in e){let r=e[n];if(r===void 0)continue;let i={tenant:{id:r.tenant_id,name:r.tenant_name}};i.groups=r.groups?Object.keys(r.groups).map(e=>{let t=r.groups[e]||[];return{group:{id:e,name:r.group_names?.[e]??`unknown`},roles:t}}):[],i.tenantRoles=i.groups?.find(e=>e.group.id===r.root_group_id),t.push(i)}return{raw:e,tenants:t}};function oe(e){if(typeof window<`u`&&typeof window.atob==`function`)return window.atob(e);if(typeof Buffer<`u`)return Buffer.from(e,`base64`).toString(`utf-8`);throw Error(`No Base64 decoding method available in this environment`)}var k=class{constructor(e){this.storageManager=e}isTokenTypeExpired(e){let t=this.storageManager.getToken(e);if(!t)return!0;let n=j(t);return!n||A(n)}parseTokenType(e){let t=this.storageManager.getToken(e);if(t)return j(t)}};function A(e,t=30){return Math.floor(Date.now()/1e3)+t>e.exp}function j(e){let t=e.split(`.`)[1];if(!t)throw Error(`Invalid token string`);let n=t.replace(/-/g,`+`).replace(/_/g,`/`),r=oe(n+`=`.repeat((4-n.length%4)%4)),i=decodeURIComponent(r.split(``).map(e=>`%`+(`00`+e.charCodeAt(0).toString(16)).slice(-2)).join(``)),a=JSON.parse(i);return a.membership=a.passflow_tm&&a.type!==`invite`?ae(a.passflow_tm):void 0,a}var M=function(e){return e.id_token=`id_token`,e.access_token=`access`,e.refresh_token=`refresh`,e.invite_token=`invite`,e.reset_token=`reset`,e.web_cookie=`web-cookie`,e.management=`management`,e.signin=`signin`,e.actor=`actor`,e.two_factor=`2fa`,e}({}),N=function(e){return e.JsonBody=`json_body`,e.Cookie=`cookie`,e.Mobile=`mobile`,e.BFF=`bff`,e}({}),se=function(e){return e.Unknown=`unknown`,e.Valid=`valid`,e.Invalid=`invalid`,e}({}),ce=class{constructor(e){this.storageManager=e,this.mode=`json_body`,this.sessionState=`unknown`,this.isInitializedFlag=!1,this.STORAGE_PREFIX=`passflow_`,this.DELIVERY_MODE_KEY=`${this.STORAGE_PREFIX}delivery_mode`,this.SESSION_STATE_KEY=`${this.STORAGE_PREFIX}session_state`,this.loadPersistedMode(),this.loadPersistedSessionState()}setMode(e){this.mode=e,this.isInitializedFlag=!0,this.persistMode()}getMode(){return this.mode}isCookieMode(){return this.mode===`cookie`}isJsonMode(){return this.mode===`json_body`}isMobileMode(){return this.mode===`mobile`}isBFFMode(){return this.mode===`bff`}isInitialized(){return this.isInitializedFlag}setSessionValid(){this.sessionState=`valid`,this.persistSessionState()}setSessionInvalid(){this.sessionState=`invalid`,this.persistSessionState()}setSessionUnknown(){this.sessionState=`unknown`,this.persistSessionState()}isSessionValid(){return this.sessionState===`valid`}isSessionUnknown(){return this.sessionState===`unknown`}isSessionInvalid(){return this.sessionState===`invalid`}getSessionState(){return this.sessionState}reset(){this.mode=`json_body`,this.sessionState=`unknown`,this.isInitializedFlag=!1,this.clearPersistedMode(),this.clearPersistedSessionState()}loadPersistedMode(){try{let e=this.storageManager.storage.getItem(this.DELIVERY_MODE_KEY);e&&Object.values(N).includes(e)&&(this.mode=e,this.isInitializedFlag=!0)}catch{}}loadPersistedSessionState(){try{let e=this.storageManager.storage.getItem(this.SESSION_STATE_KEY);e&&Object.values(se).includes(e)&&(this.sessionState=e)}catch{}}persistMode(){try{this.storageManager.storage.setItem(this.DELIVERY_MODE_KEY,this.mode)}catch{}}persistSessionState(){try{this.storageManager.storage.setItem(this.SESSION_STATE_KEY,this.sessionState)}catch{}}clearPersistedMode(){try{this.storageManager.storage.removeItem(this.DELIVERY_MODE_KEY)}catch{}}clearPersistedSessionState(){try{this.storageManager.storage.removeItem(this.SESSION_STATE_KEY)}catch{}}},P=class{constructor({storage:e,prefix:t}={}){this.keyStoragePrefix=``,this.scopes=`${this.keyStoragePrefix}tokens_scopes`,this.deviceId=`${this.keyStoragePrefix}passflowDeviceId`,this.invitationToken=`${this.keyStoragePrefix}passflowInvitationToken`,this.previousRedirectUrl=`${this.keyStoragePrefix}passflowPreviousRedirectUrl`,this.STORAGE_PREFIX=`passflow_`,this.ID_TOKEN_KEY=`${this.STORAGE_PREFIX}id_token`,this.CSRF_TOKEN_KEY=`${this.STORAGE_PREFIX}csrf_token`,this.DELIVERY_MODE_KEY=`${this.STORAGE_PREFIX}delivery_mode`,this.storage=e??localStorage,this.keyStoragePrefix=t?`${t}_`:``}saveTokens(e,t){let{id_token:n,access_token:r,refresh_token:i,scopes:a}=e;t===N.Cookie||t===N.BFF?n&&this.storage.setItem(this.ID_TOKEN_KEY,n):(n&&this.storage.setItem(this.getKeyForTokenType(M.id_token),n),r&&this.storage.setItem(this.getKeyForTokenType(M.access_token),r),i&&this.storage.setItem(this.getKeyForTokenType(M.refresh_token),i),a&&this.storage.setItem(this.scopes,a.join(`,`)))}getToken(e){let t=this.getKeyForTokenType(e);return this.storage.getItem(t)??void 0}getTokens(){let e=this.getDeliveryMode();if(e===N.Cookie||e===N.BFF){let e=this.storage.getItem(this.ID_TOKEN_KEY);return e?{id_token:e}:void 0}let t=this.storage.getItem(this.getKeyForTokenType(M.access_token));if(t)return{access_token:t,id_token:this.storage.getItem(this.getKeyForTokenType(M.id_token))??void 0,refresh_token:this.storage.getItem(this.getKeyForTokenType(M.refresh_token))??void 0,scopes:this.storage.getItem(this.scopes)?.split(`,`)??void 0}}getScopes(){return this.storage.getItem(this.scopes)?.split(`,`)??void 0}hasJsonModeTokens(){return!!this.storage.getItem(this.getKeyForTokenType(M.access_token))}hasCookieModeIdToken(){return!!this.storage.getItem(this.ID_TOKEN_KEY)}deleteToken(e){let t=this.getKeyForTokenType(e);this.storage.removeItem(t)}deleteTokens(){this.storage.removeItem(this.getKeyForTokenType(M.id_token)),this.storage.removeItem(this.getKeyForTokenType(M.access_token)),this.storage.removeItem(this.getKeyForTokenType(M.refresh_token)),this.storage.removeItem(this.scopes),this.clearIdToken(),this.clearDeliveryMode(),this.clearCsrfToken()}getDeviceId(){return this.storage.getItem(this.deviceId)??void 0}setDeviceId(e){this.storage.setItem(this.deviceId,e)}deleteDeviceId(){this.storage.removeItem(this.deviceId)}setInvitationToken(e){this.storage.setItem(this.invitationToken,e)}getInvitationToken(){return this.storage.getItem(this.invitationToken)??void 0}deleteInvitationToken(){this.storage.removeItem(this.invitationToken)}setPreviousRedirectUrl(e){this.storage.setItem(this.previousRedirectUrl,e)}getPreviousRedirectUrl(){return this.storage.getItem(this.previousRedirectUrl)??void 0}deletePreviousRedirectUrl(){this.storage.removeItem(this.previousRedirectUrl)}setDeliveryMode(e){try{this.storage.setItem(this.DELIVERY_MODE_KEY,e)}catch{}}getDeliveryMode(){try{let e=this.storage.getItem(this.DELIVERY_MODE_KEY);if(e&&Object.values(N).includes(e))return e}catch{}}clearDeliveryMode(){try{this.storage.removeItem(this.DELIVERY_MODE_KEY)}catch{}}getIdToken(){try{return this.storage.getItem(this.ID_TOKEN_KEY)??void 0}catch{return}}setIdToken(e){try{this.storage.setItem(this.ID_TOKEN_KEY,e)}catch{}}clearIdToken(){try{this.storage.removeItem(this.ID_TOKEN_KEY)}catch{}}getCsrfToken(){try{return this.storage.getItem(this.CSRF_TOKEN_KEY)??void 0}catch{return}}setCsrfToken(e){try{this.storage.setItem(this.CSRF_TOKEN_KEY,e)}catch{}}clearCsrfToken(){try{this.storage.removeItem(this.CSRF_TOKEN_KEY)}catch{}}tokenKeys(){return[this.getKeyForTokenType(M.id_token),this.getKeyForTokenType(M.access_token),this.getKeyForTokenType(M.refresh_token),this.scopes,this.ID_TOKEN_KEY,this.CSRF_TOKEN_KEY,this.DELIVERY_MODE_KEY]}getKeyForTokenType(e){return`${this.keyStoragePrefix}${e}`}},F=class{constructor(e){this.storageManager=e??new P}getDeviceId(){let e=this.storageManager.getDeviceId();if(!e){let e=this.generateUniqueDeviceId();return this.storageManager.setDeviceId(e),e}return e}generateUniqueDeviceId(){return re()}},I=class extends Error{constructor(e=`Authentication popup was closed`){super(e),this.name=`PopupClosedError`}},le=class{constructor(){this.passkeys={startRegistration:e=>(0,l.startRegistration)({optionsJSON:e}),startAuthentication:e=>(0,l.startAuthentication)({optionsJSON:e})}}get storage(){return typeof localStorage>`u`?{getItem:()=>null,setItem:()=>{},removeItem:()=>{}}:localStorage}get storageSharedAcrossTabs(){try{return typeof localStorage<`u`&&localStorage!==null}catch{return!1}}getCurrentUrl(){return typeof window>`u`?null:{href:window.location.href,origin:window.location.origin,pathname:window.location.pathname,search:window.location.search,hash:window.location.hash,hostname:window.location.hostname}}replaceUrl(e){typeof window<`u`&&window.history.replaceState({},document.title,e)}navigateTo(e){typeof window<`u`&&(window.location.href=e)}onForeground(e){if(typeof document>`u`)return()=>{};let t=()=>{document.hidden||e()};return document.addEventListener(`visibilitychange`,t),()=>document.removeEventListener(`visibilitychange`,t)}onBackground(e){if(typeof document>`u`)return()=>{};let t=()=>{document.hidden&&e()};return document.addEventListener(`visibilitychange`,t),()=>document.removeEventListener(`visibilitychange`,t)}onBeforeUnload(e){return typeof window>`u`?()=>{}:(window.addEventListener(`beforeunload`,e),()=>window.removeEventListener(`beforeunload`,e))}isInForeground(){return typeof document>`u`||!document.hidden}openAuthUrl(e,t={}){let n=t.mode??`popup`;if(n===`redirect`)return window.location.href=e,new Promise(()=>{});if(n===`deeplink`)return Promise.reject(Error(`openAuthUrl: "deeplink" mode is not supported on web. Use "popup" or "redirect" instead, or provide a native platform adapter.`));let r=t.width??500,i=t.height??600,a=t.expectedReturnOrigin??window.location.origin,o=window.open(e,`_blank`,`width=${r},height=${i}`);return o?new Promise((e,t)=>{let n=Date.now(),r=setInterval(()=>{if(o.closed)clearInterval(r),t(new I);else if(Date.now()-n>6e4)clearInterval(r),o.close(),t(Error(`Authentication popup timed out`));else try{if(o.location.href.startsWith(a)){let t=o.location.search,n=o.location.hash;clearInterval(r),o.close(),e({callbackSearch:t,callbackHash:n})}}catch{}},100)}):(window.location.href=e,new Promise(()=>{}))}btoa(e){return btoa(e)}atob(e){if(typeof window<`u`&&typeof window.atob==`function`)return window.atob(e);if(typeof Buffer<`u`)return Buffer.from(e,`base64`).toString(`utf-8`);throw Error(`No Base64 decoding method available in this environment`)}cookiesSupported(){if(typeof document>`u`)return!1;try{document.cookie=`passflow_test=1; SameSite=Lax`;let e=document.cookie.indexOf(`passflow_test=1`)!==-1;return document.cookie=`passflow_test=; expires=Thu, 01 Jan 1970 00:00:00 UTC`,e}catch{return!1}}getDeviceType(){return`web`}},L=new le,ue=/^[0-9]+$/,de=Object.freeze({unorderable:!1,zero:!1}),R=e=>ue.test(e)?Number.parseInt(e,10):void 0,z=e=>{if(!e)return de;let t=e.split(/\s+/).filter(e=>e!==``);if(t.length===0)return de;let n=[];for(let e of t){let t=R(e);t!==void 0&&n.push(t)}if(n.length===0)return{raw:e,unorderable:!0,zero:!1};let r=Math.min(...n);return r===0?{raw:e,unorderable:!1,zero:!0}:{level:r,raw:e,unorderable:!1,zero:!1}},fe=e=>z(e).level,pe=`insufficient_user_authentication`,me=`upgrade_required`,he=/([A-Za-z0-9!#$%&'*+\-.^_`|~]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))/g,ge=e=>e.replace(/\\(.)/g,`$1`),_e=e=>{let t={};he.lastIndex=0;for(let n of e.matchAll(he)){let e=n[1];if(!e)continue;let r=n[2],i=n[3];t[e.toLowerCase()]=r===void 0?i??``:ge(r)}return t},ve=e=>{if(e==null||e===``)return{kind:`absent`};let t=typeof e==`number`?e:Number.parseInt(String(e),10);return Number.isFinite(t)&&t>0?{kind:`valid`,value:t}:{kind:`invalid`,raw:e}},ye=e=>{let t=ve(e);return t.kind===`valid`?t.value:void 0},be=(e,t)=>{if(!e||!/(^|[\s,])Bearer\b/i.test(e))return;let n=_e(e);if(n.error===`insufficient_user_authentication`)return{acrValues:n.acr_values||void 0,maxAge:ye(n.max_age),status:t}},xe=(e,t)=>{if(!e||typeof e!=`object`)return;let n=e;if(n.error===`upgrade_required`)return{acrValues:typeof n.acr_values==`string`&&n.acr_values?n.acr_values:void 0,maxAge:ye(n.max_age),status:t}},Se=(e,t,n)=>({channel:e,acr:z(t.acrValues),maxAge:ve(n),raw:t.acrValues}),Ce=e=>e?_e(e):{},we=(e,t)=>{let{status:n}=e;if(n!==401&&n!==403)return{diagnostics:[]};let r=t?.requireChallengeChannel===`header`,i=e.getHeader(`www-authenticate`),a=be(i,n),o=r?void 0:xe(e.body,n),s=[],c=(e,t)=>{s.push({status:n,url:``,reason:e,...t?{detail:t}:{}})};if(!a&&!o)return r&&c(`header-required-but-absent`,i?{header:i}:void 0),{diagnostics:s};let l=[];if(a&&l.push(Se(`header`,a,Ce(i).max_age)),o){let t=e.body;l.push(Se(`body`,o,t?.max_age))}let u=e=>e;for(let e of l)e.acr.unorderable&&c(`channels-unorderable`,{[u(e.channel)]:e.raw}),e.acr.zero&&c(`zero-constraint-ignored`,{field:`acr_values`,[u(e.channel)]:e.raw}),e.maxAge.kind===`invalid`&&c(`zero-constraint-ignored`,{field:`max_age`,[u(e.channel)]:String(e.maxAge.raw)});let d=l.filter(e=>e.acr.level!==void 0),f,p;for(let e of d){let t=e.acr.level;f===void 0||t>f?(f=t,p=e.raw):t===f&&e.channel===`header`&&(p=e.raw)}let m;for(let e of l)e.maxAge.kind===`valid`&&(m===void 0||e.maxAge.value<m)&&(m=e.maxAge.value);if(l.length===2){let[e,t]=l,n=e.acr.level!==void 0&&t.acr.level!==void 0&&e.acr.level!==t.acr.level,r=e.maxAge.kind===`valid`&&t.maxAge.kind===`valid`&&e.maxAge.value!==t.maxAge.value;(n||r)&&c(`channels-disagree`,{header:e.raw??t.raw,body:t.raw??e.raw})}return{challenge:{acrValues:p,requiredLevel:f,maxAge:m,status:n,channels:l.map(e=>e.channel)},diagnostics:s}},Te=(e,t,n)=>we({status:e,getHeader:t,body:n}).challenge,Ee=`__passflowUpgradeTransaction`,De=`__passflowUpgradeReplayed`,Oe=(e,t)=>typeof e==`object`&&!!e&&e[t]===!0,ke=e=>({...e??{},[Ee]:!0}),Ae=e=>Oe(e,Ee),je=e=>({...e,[De]:!0}),Me=e=>Oe(e,De),Ne=function(e){return e.GET=`get`,e.POST=`post`,e.PUT=`put`,e.PATCH=`patch`,e.DELETE=`delete`,e}({}),B=function(e){return e.signin=`/auth/login`,e.signup=`/auth/register`,e.pkceExchange=`/auth/pkce_exchange`,e.signInWithProvider=`/auth/federated/start/`,e.passwordless=`/auth/passwordless/start`,e.passwordlessComplete=`/auth/passwordless/complete`,e.logout=`/user/logout`,e.refresh=`/auth/refresh`,e.validateSession=`/user/me`,e.sendPasswordResetEmail=`/auth/password/reset`,e.resetPassword=`/auth/password/change`,e.appSettings=`/app/settings`,e.passkeyRegisterStart=`/auth/passkey/register/start`,e.passkeyRegisterComplete=`/auth/passkey/register/complete`,e.passkeyAuthenticateStart=`/auth/passkey/authenticate/start`,e.passkeyAuthenticateComplete=`/auth/passkey/authenticate/complete`,e.passkeyValidate=`/auth/validate`,e.settingsAll=`/settings`,e.settingsPasswordPolicy=`/settings/password`,e.settingsPasskey=`/settings/passkey`,e.userPasskey=`/user/passkey`,e.addUserPasskey=`/user/passkey/add/start`,e.completeAddUserPasskey=`/user/passkey/add/complete`,e.joinInvitation=`/user/tenant/join`,e.tenantPath=`/user/tenant`,e.invitationsPath=`/user/tenant/:tenantID/invitations`,e.requestInvitation=`/user/invite`,e.invitationDelete=`/user/invite/:invitationID`,e.invitationResend=`/user/invite/:invitationID/resend`,e.invitationGetLink=`/user/invite/:invitationID/link`,e.twoFactor=`/user/2fa`,e.twoFactorStatus=`/user/2fa/status`,e.twoFactorSetupBegin=`/user/2fa/setup/begin`,e.twoFactorSetupConfirm=`/user/2fa/setup/confirm`,e.twoFactorVerify=`/auth/2fa/verify`,e.twoFactorRecovery=`/auth/2fa/recovery`,e.twoFactorRegenerateCodes=`/user/2fa/recovery-codes/regenerate`,e.twoFactorSetupMagicLink=`/auth/2fa-setup`,e.TwoFactorMethodsAvailable=`/v2/user/2fa/methods/available`,e.TwoFactorMethodsRegistered=`/v2/user/2fa/methods`,e.TwoFactorSetupStart=`/v2/user/2fa/setup/start`,e.TwoFactorSetupComplete=`/v2/user/2fa/setup/complete`,e.TwoFactorMethodRemove=`/v2/user/2fa/methods/:id`,e.TwoFactorChallenge=`/v2/auth/2fa/challenge`,e.TwoFactorVerifyV2=`/v2/auth/2fa/verify`,e.TwoFactorAlternative=`/v2/auth/2fa/alternative`,e.TwoFactorTrustedDevices=`/v2/user/2fa/trusted-devices`,e.TwoFactorTrustedDeviceRevoke=`/v2/user/2fa/trusted-devices/:id`,e.cliAuthStatus=`/cli/auth/status/:sessionId`,e.cliAuthComplete=`/cli/auth/complete`,e.upgradeStart=`/auth/upgrade/start`,e}({}),Pe=function(e){return e.passkeyRegisterStart=`/admin/auth/passkey/register/start`,e.passkeyRegisterComplete=`/admin/auth/passkey/register/complete`,e.passkeyAuthenticateStart=`/admin/auth/passkey/authenticate/start`,e.passkeyAuthenticateComplete=`/admin/auth/passkey/authenticate/complete`,e.passkeyValidate=`/admin/auth/validate`,e.logout=`/admin/auth/logout`,e}({}),Fe=e=>{if(!e)return null;try{let t=new URL(e),n=t.pathname.replace(/\/+$/,``);return{origin:t.origin,pathPrefix:n===``?void 0:n}}catch{return null}},V=class extends Error{constructor(e){super(),this.id=e?.id??`unknown`,this.message=e?.message??e??`Something went wrong`,this.status=e?.status??500,this.location=e?.location??`unknown`,this.time=e?.time??new Date().toISOString()}},Ie=function(e){return e.google=`google`,e.facebook=`facebook`,e}({}),Le=function(e){return e.web=`web`,e.ios=`ios`,e.android=`android`,e}({});function Re(e){return e}function H(e,t){let n=e;return Object.entries(t).forEach(([e,t])=>{n=n.replace(`:${e}`,t)}),n}var ze=function(e){return e.Disabled=`disabled`,e.Optional=`optional`,e.Required=`required`,e}({}),Be=3,Ve=1e3,He=e=>t=>{let n=e.headers?.[t]??e.headers?.[t.toLowerCase()];return Array.isArray(n)?n.join(`, `):n},Ue=e=>Te(e.status,He(e),e.data),We=e=>Ue(e)!==void 0,Ge=e=>e?.includes(B.refresh)??!1,Ke=e=>e?.includes(`logout`)??!1,qe=class{get origin(){return this._platform.getCurrentUrl()?.origin??``}constructor(e,t,n){this.defaultHeaders={Accept:`application/json`,"Content-Type":`application/json`},this.nonAccessTokenEndpoints=[`/auth/`,`/settings`,`/settings/`],this.protectedEndpoints=[`logout`,`refresh`,`upgrade`];let{url:r,appId:i,keyStoragePrefix:a}=e;this._platform=e.platform??L,this.url=r||`https://auth.passflow.cloud`,this.upgradeDomain=Fe(r),this.storageManager=t??new P({prefix:a??``}),this.deviceService=n??new F(this.storageManager),this.tokenService=new k(this.storageManager),this.tokenDeliveryManager=new ce(this.storageManager),i&&(this.appId=i,this.defaultHeaders={...this.defaultHeaders,[d]:i});let o=this.deviceService.getDeviceId();this.defaultHeaders={...this.defaultHeaders,[p]:o,[m]:this._platform.getDeviceType()},this.detectCookieSupport(),this.instance=c.default.create({baseURL:this.url,headers:{...this.defaultHeaders}}),this.instance.interceptors.request.use(async e=>{if(this.isNonAuthEndpoint(e.url))return e;if(this.tokenDeliveryManager.isCookieMode()){e.withCredentials=!0;let t=this.storageManager.getCsrfToken();return t&&(e.headers[`X-CSRF-Token`]=t),e}if(Ge(e.url))return e;let t=this.storageManager.getTokens();if(!t?.access_token)return e;let n=t.access_token;if(this.refreshHandler&&t.refresh_token&&!Ke(e.url)){let e=j(t.access_token);if(A(e,30)){let t=!A(e,0);try{n=(await this.refreshHandler({trigger:`pre-request`,allowStale:t}))?.access_token??n}catch(e){if(!t)throw e}}}return e.headers[f]=`Bearer ${n}`,e}),this.instance.interceptors.response.use(e=>e,async e=>{if(e.response?.status===401&&!Ge(e.config?.url)&&!this.isUpgradeTransactionError(e)&&this.tokenDeliveryManager.setSessionInvalid(),e.response&&this.upgradeHandler){let t=Ue(e.response);if(t)try{return await this.upgradeHandler(e,t)}catch(t){if(t!==e)throw t}}return e.response?.status===429?await this.handleRateLimitError(e):this.handleAxiosError(e)})}isUpgradeTransactionError(e){return Ae(e.config)||e.response!==void 0&&We(e.response)}setUpgradeInterceptor(e){this.upgradeHandler=e}setRefreshHandler(e){this.refreshHandler=e}replay(e){return this.instance.request(e)}isProtectedEndpoint(e){return this.protectedEndpoints.some(t=>e?.includes(t))}isNonAuthEndpoint(e){return this.nonAccessTokenEndpoints.some(t=>e?.includes(t))&&!this.isProtectedEndpoint(e)}detectCookieSupport(){if(!this._platform.cookiesSupported()&&this.tokenDeliveryManager.isCookieMode())throw Error(`Passflow SDK: Cookie delivery mode is configured but cookies are not supported in this environment. Use a platform adapter that supports cookies or configure the server to use JSON token delivery.`)}async handleRateLimitError(e){let t=e.config;if(!t||Ge(t.url))return Promise.reject(e);let n=t.method?.toUpperCase();if(![`GET`,`HEAD`,`OPTIONS`].includes(n||``))return Promise.reject(e);let r=t._retryCount||0;if(r>=Be)return Promise.reject(e);let i=Ve*2**r,a=e.response?.headers?.[`retry-after`];if(a){let e=Number.parseInt(a,10);if(!Number.isNaN(e))i=e*1e3;else{let e=new Date(a);Number.isNaN(e.getTime())||(i=Math.max(0,e.getTime()-Date.now()))}}return await new Promise(e=>setTimeout(e,i)),t._retryCount=r+1,this.instance.request(t)}async handleAxiosError(e){if(!e.response)return Promise.reject(e);let t=e.response.status,n=e.response.data;if(`error`in n&&typeof n.error==`object`&&n.error!==null){let{error:e}=n;return Promise.reject(new V(e))}return Promise.reject(new V({id:`error.http.${t}`,message:e.message||`An error occurred`,status:t,location:e.config?.url||`unknown`,time:new Date().toISOString()}))}async send(e,t,n){return(await this.instance.request({method:e,url:t,...n})).data}get(e,t){return this.send(Ne.GET,e,t)}post(e,t,n){return this.send(Ne.POST,e,{data:t,...n})}put(e,t,n){return this.send(Ne.PUT,e,{data:t,...n})}patch(e,t,n){return this.send(Ne.PATCH,e,{data:t,...n})}delete(e,t){return this.send(Ne.DELETE,e,t)}setAppId(e){this.appId=e,this.defaultHeaders={...this.defaultHeaders,[d]:e},this.instance.defaults.headers.common[d]=e}},Je=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getAppSettings(){return this.axiosClient.get(B.appSettings)}},Ye={withCredentials:!0},Xe=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}refreshToken(e,t,n,r){let i={access:n,scopes:t,...r?{upgrade:r}:{}},a={headers:{[f]:`Bearer ${e}`}};return this.axiosClient.post(B.refresh,i,r?ke(a):a)}signIn(e,t,n){let r={...e,device:t,os:n};return this.axiosClient.post(B.signin,r,Ye)}signUp(e){let{create_tenant:t,anonymous:n}=e,r={...e,create_tenant:t??!1,anonymous:n??!1};return this.axiosClient.post(B.signup,r,Ye)}pkceExchange(e,t){return this.axiosClient.post(B.pkceExchange,{authz_code:e,verifier:t},Ye)}passwordlessSignIn(e,t,n){let{create_tenant:r}=e,i={...e,create_tenant:r??!1,device:t,os:n};return this.axiosClient.post(B.passwordless,i)}passwordlessSignInComplete(e){return this.axiosClient.post(B.passwordlessComplete,e,Ye)}logOut(e,t,n=!1){let r=n?void 0:{refresh_token:t,device:e},i=n?Pe.logout:B.logout;return this.axiosClient.post(i,r)}validateSession(){return this.axiosClient.get(B.validateSession)}sendPasswordResetEmail(e){return this.axiosClient.post(B.sendPasswordResetEmail,e)}resetPassword(e,t,n,r){let i={password:e,scopes:t,...r?{code_challenge:r}:{}};return this.axiosClient.post(B.resetPassword,i,{headers:{[f]:`Bearer ${n}`,[d]:void 0}})}passkeyRegisterStart(e,t,n,r=!1){let{create_tenant:i}=e,a={...e,create_tenant:i??!1,device:t,os:n},o=r?Pe.passkeyRegisterStart:B.passkeyRegisterStart;return this.axiosClient.post(o,a)}passkeyRegisterComplete(e,t,n,r=!1){let i={challenge_id:n,device:t,passkey_data:e},a=r?Pe.passkeyRegisterComplete:B.passkeyRegisterComplete;return this.axiosClient.post(a,i,Ye)}passkeyAuthenticateStart(e,t,n,r=!1){let i={...e,user_id:e.user_id??``,device:t,os:n},a=r?Pe.passkeyAuthenticateStart:B.passkeyAuthenticateStart;return this.axiosClient.post(a,i)}passkeyAuthenticateComplete(e,t,n,r=!1){let i={challenge_id:n,device:t,passkey_data:e},a=r?Pe.passkeyAuthenticateComplete:B.passkeyAuthenticateComplete;return this.axiosClient.post(a,i,Ye)}passkeyValidate(e,t,n,r=!1,i){let a={otp:e,device:t,challenge_id:n},o=B.passkeyValidate;!i&&r&&(o=Pe.passkeyValidate);let s=i?{[d]:i}:{};return this.axiosClient.post(o,a,{headers:s})}},Ze=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getCLIAuthStatus(e){let t=H(B.cliAuthStatus,{sessionId:e});return this.axiosClient.get(t)}completeCLIAuth(e){return this.axiosClient.post(B.cliAuthComplete,e)}},Qe=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}requestInviteLink(e){return this.axiosClient.post(B.requestInvitation,e)}getInvitations(e){let t={};e.groupID&&(t.group_id=e.groupID.toString()),e.skip!==void 0&&(t.skip=e.skip.toString()),e.limit!==void 0&&(t.limit=e.limit.toString());let n=H(B.invitationsPath,{tenantID:e.tenantID});return this.axiosClient.get(n,{params:t}).then(e=>({invites:e.invites,nextPageSkip:e.next_page_skip}))}deleteInvitation(e){let t=H(B.invitationDelete,{invitationID:e});return this.axiosClient.delete(t)}resendInvitation(e){let t=H(B.invitationResend,{invitationID:e});return this.axiosClient.post(t,{})}getInvitationLink(e){let t=H(B.invitationGetLink,{invitationID:e});return this.axiosClient.get(t)}},$e=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getSettingsAll(){return this.axiosClient.get(B.settingsAll)}getPasswordPolicySettings(){return this.axiosClient.get(B.settingsPasswordPolicy)}getPasskeySettings(){return this.axiosClient.get(B.settingsPasskey)}},et=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}joinInvitation(e,t){let n={invite_token:e,scopes:t};return this.axiosClient.post(B.joinInvitation,n)}createTenant(e){let t={name:e};return this.axiosClient.post(B.tenantPath,t)}getTenantDetails(e){let t=`${B.tenantPath}/${e}`;return this.axiosClient.get(t)}updateTenant(e,t){let n=`${B.tenantPath}/${e}`,r={name:t};return this.axiosClient.put(n,r)}deleteTenant(e){let t=`${B.tenantPath}/${e}`;return this.axiosClient.delete(t)}getUserTenantMembership(){return this.axiosClient.get(B.tenantPath)}createGroup(e,t){let n=`${B.tenantPath}/${e}/group`,r={name:t};return this.axiosClient.post(n,r)}getGroupInfo(e,t){let n=`${B.tenantPath}/${e}/group/${t}`;return this.axiosClient.get(n)}updateGroup(e,t,n){let r=`${B.tenantPath}/${e}/group/${t}`,i={name:n};return this.axiosClient.put(r,i)}deleteGroup(e,t){let n=`${B.tenantPath}/${e}/group/${t}`;return this.axiosClient.delete(n)}addUserToGroup(e,t,n,r){let i=`${B.tenantPath}/${e}/group/${t}/add`,a={user_id:n,role:r};return this.axiosClient.post(i,a)}removeUserRolesFromGroup(e,t,n,r){let i=`${B.tenantPath}/${e}/group/${t}/remove_roles`,a={user_id:n,roles:r};return this.axiosClient.post(i,a)}changeUserRoles(e,t,n,r){let i=`${B.tenantPath}/${e}/group/${t}/change`,a={user_id:n,roles:r};return this.axiosClient.post(i,a)}deleteUserFromGroup(e,t,n){let r=`${B.tenantPath}/${e}/group/${t}/${n}`;return this.axiosClient.delete(r)}getRolesForTenant(e){let t=`${B.tenantPath}/${e}/role`;return this.axiosClient.get(t)}createRoleForTenant(e,t){let n=`${B.tenantPath}/${e}/role`,r={name:t};return this.axiosClient.post(n,r)}updateRole(e,t,n){let r=`${B.tenantPath}/${e}/role/${t}`,i={name:n};return this.axiosClient.put(r,i)}deleteRole(e,t){let n=`${B.tenantPath}/${e}/role/${t}`;return this.axiosClient.delete(n)}deleteUserFromTenant(e,t){let n=`${B.tenantPath}/${e}/user/${t}`;return this.axiosClient.delete(n)}getGroupInvitations(e,t,n,r){let i=`${B.tenantPath}/${e}/group/${t}/invitations`;return this.axiosClient.get(i,{params:{limit:n,skip:r}})}getTenantInvitations(e,t,n){let r=`${B.tenantPath}/${e}/invitations`;return this.axiosClient.get(r,{params:{limit:t,skip:n}})}invalidateInviteById(e,t,n){let r=`${B.tenantPath}/${e}/group/${t}/invite/${n}`;return this.axiosClient.delete(r)}invalidateInviteByEmail(e,t,n){let r=`${B.tenantPath}/${e}/group/${t}/invite/email/${n}`;return this.axiosClient.delete(r)}},tt=e=>e?{headers:{Authorization:`Bearer ${e}`}}:{},nt=e=>({withCredentials:!0,...tt(e)}),rt=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getStatus(){return this.axiosClient.get(B.twoFactorStatus)}beginSetup(){return this.axiosClient.post(B.twoFactorSetupBegin,{})}confirmSetup(e){return this.axiosClient.post(B.twoFactorSetupConfirm,e)}verify(e){let{tfa_token:t,code:n,trust_device:r}=e;return this.axiosClient.post(B.twoFactorVerify,{code:n,...r?{trust_device:!0}:{}},nt(t))}useRecoveryCode(e){let{tfa_token:t,recovery_code:n,trust_device:r}=e;return this.axiosClient.post(B.twoFactorRecovery,{recovery_code:n,...r?{trust_device:!0}:{}},nt(t))}disable(e){return this.axiosClient.delete(B.twoFactor,{data:e})}regenerateRecoveryCodes(e){return this.axiosClient.post(B.twoFactorRegenerateCodes,e)}validateTwoFactorSetupMagicLink(e){let t=`${B.twoFactorSetupMagicLink}/${e}`;return this.axiosClient.get(t,{transformRequest:[(e,t)=>(t&&delete t.Authorization,e)]}).then(e=>{let t=e;return{success:!0,sessionToken:t.session_token,userId:t.user_id,expiresIn:t.expires_in,appId:t.app_id}}).catch(e=>{if(e.response){let t=e.response.status,n=e.response.data||{},r=e.response.headers?.[`retry-after`]?parseInt(e.response.headers[`retry-after`],10):void 0;return{success:!1,error:{code:n.error||this.mapStatusToErrorCode(t),message:n.message||this.getDefaultErrorMessage(t),retryAfter:r}}}return{success:!1,error:{code:`SERVER_ERROR`,message:e instanceof Error?e.message:`Unable to connect to the server. Please check your connection.`}}})}mapStatusToErrorCode(e){switch(e){case 400:return`INVALID_TOKEN`;case 404:return`REVOKED_TOKEN`;case 410:return`EXPIRED_TOKEN`;case 429:return`RATE_LIMITED`;default:return`SERVER_ERROR`}}getDefaultErrorMessage(e){switch(e){case 400:return`The provided magic link is invalid or malformed.`;case 404:return`This magic link has been revoked or does not exist.`;case 410:return`This magic link has expired. Please request a new one from your administrator.`;case 429:return`Too many validation attempts. Please try again later.`;default:return`An error occurred while validating the magic link.`}}getAvailableMethods(){return this.axiosClient.get(B.TwoFactorMethodsAvailable)}getRegisteredMethods(){return this.axiosClient.get(B.TwoFactorMethodsRegistered)}startMethodSetup(e,t){return this.axiosClient.post(B.TwoFactorSetupStart,{...t,method:e})}completeMethodSetup(e,t){return this.axiosClient.post(B.TwoFactorSetupComplete,{...t,method:e})}removeMethod(e){let t=H(B.TwoFactorMethodRemove,{id:e});return this.axiosClient.delete(t)}requestChallenge(e,t){return this.axiosClient.post(B.TwoFactorChallenge,e,tt(t))}verifyV2(e,t){let{trust_device:n,...r}=e;return this.axiosClient.post(B.TwoFactorVerifyV2,{...r,...n?{trust_device:!0}:{}},nt(t))}switchToAlternative(e,t){return this.axiosClient.post(B.TwoFactorAlternative,e,tt(t))}async getTrustedDevices(){return(await this.axiosClient.get(B.TwoFactorTrustedDevices,{withCredentials:!0}))?.devices??[]}revokeTrustedDevice(e){let t=H(B.TwoFactorTrustedDeviceRevoke,{id:e});return this.axiosClient.delete(t)}},it=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}startUpgrade(e){return this.axiosClient.post(B.upgradeStart,e,ke({}))}},at=class{constructor(e,t,n){this.axiosClient=new qe(e,t,n)}setAppId(e){this.axiosClient.setAppId(e)}getUserPasskeys(){return this.axiosClient.get(B.userPasskey)}renameUserPasskey(e,t){return this.axiosClient.patch(`${B.userPasskey}/${t}`,{name:e})}deleteUserPasskey(e){return this.axiosClient.delete(`${B.userPasskey}/${e}`)}addUserPasskeyStart({relyingPartyId:e,deviceId:t,os:n,passkeyDisplayName:r,passkeyUsername:i}){let a={passkey_display_name:r,passkey_username:i,relying_party_id:e,deviceId:t,os:n};return this.axiosClient.post(B.addUserPasskey,a)}addUserPasskeyComplete(e,t,n){return this.axiosClient.post(B.completeAddUserPasskey,{challenge_id:n,device:t,passkey_data:e})}},ot=10,st=20,ct=class extends Error{constructor(e){super(`Passflow fetch middleware '${e}' resolved without calling next(). Every registered middleware must delegate exactly once; swallowing a request would drop a caller's fetch inside the Passflow wrapper.`),this.name=`FetchMiddlewareContractError`,this.middlewareName=e}},lt=[],ut=0,dt=!1,ft,pt,mt=(e,t)=>e.priority-t.priority||e.seq-t.seq,ht=()=>typeof globalThis>`u`?void 0:globalThis,gt=async(e,t,n,r)=>{if(t>=e.length){let e=ft;if(!e)throw Error(`Passflow fetch registry: no captured fetch to delegate to.`);return e(n,r)}let i=e[t];if(!i)return gt(e,e.length,n,r);let a=!1,o=await i.middleware((n,r)=>(a=!0,gt(e,t+1,n,r)),n,r);if(!a)throw new ct(i.name);return o},_t=()=>{let e=ht();if(!e||typeof e.fetch!=`function`)return!1;let t=e.fetch.bind(e),n=(e,t)=>gt([...lt].sort(mt),0,e,t);return ft=t,pt=n,e.fetch=n,dt=!0,!0},vt=()=>{let e=ht();e&&pt&&e.fetch===pt&&(ft&&(e.fetch=ft),dt=!1,pt=void 0,ft=void 0)},yt=(e,t)=>{if(!dt&&!_t())return()=>{};let n={middleware:e,name:t.name,priority:t.priority,seq:ut++};lt.push(n);let r=!1;return()=>{r||(r=!0,lt=lt.filter(e=>e!==n),lt.length===0&&vt())}},bt=()=>{let e=ht();return{installed:dt,names:[...lt].sort(mt).map(e=>e.name),foreignPatch:dt&&!!e&&!!pt&&e.fetch!==pt}},U=class e extends Error{constructor(t){super(t.message),this.name=`M2MError`,this.code=t.code,this.status=t.status??400,this.errorUri=t.errorUri,this.rateLimitInfo=t.rateLimitInfo,this.headers=t.headers,this.cause=t.cause,this.timestamp=new Date().toISOString(),Error.captureStackTrace&&Error.captureStackTrace(this,e)}static fromOAuthError(t,n,r){let i=r?e.parseRateLimitHeaders(r):void 0;return new e({code:t.error,message:t.error_description??e.getDefaultMessage(t.error),status:n,errorUri:t.error_uri,rateLimitInfo:i,headers:r})}static fromError(t,n=`server_error`){return new e({code:n,message:t.message||`An unexpected error occurred`,status:500,cause:t})}static parseRateLimitHeaders(e){let t=e[`x-ratelimit-limit`],n=e[`x-ratelimit-remaining`],r=e[`x-ratelimit-reset`]||e[`retry-after`];if(t&&n&&r)return{limit:parseInt(t,10),remaining:parseInt(n,10),reset:parseInt(r,10)}}static getDefaultMessage(e){return{invalid_request:`The request is missing a required parameter or is otherwise malformed.`,invalid_client:`Client authentication failed. Verify your client credentials.`,invalid_grant:`The provided authorization grant is invalid or expired.`,invalid_scope:`The requested scope is invalid, unknown, or exceeds the allowed scopes.`,unauthorized_client:`The client is not authorized to use this grant type.`,unsupported_grant_type:`The authorization grant type is not supported.`,rate_limit_exceeded:`Too many requests. Please retry after the rate limit window resets.`,server_error:`The authorization server encountered an unexpected error.`,temporarily_unavailable:`The authorization server is temporarily unavailable. Please try again later.`}[e]||`An unknown error occurred.`}isRetryable(){return this.code===`server_error`||this.code===`temporarily_unavailable`||this.code===`rate_limit_exceeded`||this.status>=500}getRetryAfter(){if(this.rateLimitInfo?.reset){let e=Math.floor(Date.now()/1e3),t=this.rateLimitInfo.reset-e;return Math.max(t*1e3,1e3)}return 1e3}toJSON(){return{name:this.name,code:this.code,message:this.message,status:this.status,errorUri:this.errorUri,rateLimitInfo:this.rateLimitInfo,timestamp:this.timestamp}}toString(){let e=`M2MError [${this.code}]: ${this.message}`;return this.status&&(e+=` (HTTP ${this.status})`),e}},xt=class extends U{constructor(e,t){super({code:`temporarily_unavailable`,message:e,status:0,cause:t}),this.name=`M2MNetworkError`}},St=class extends U{constructor(e,t){super({code:`invalid_request`,message:e,status:400,cause:t}),this.name=`M2MTokenParseError`}},Ct=class extends U{constructor(e){super({code:`invalid_request`,message:e,status:400}),this.name=`M2MConfigError`}},wt={InvalidRequest:`invalid_request`,InvalidClient:`invalid_client`,InvalidGrant:`invalid_grant`,InvalidScope:`invalid_scope`,UnauthorizedClient:`unauthorized_client`,UnsupportedGrantType:`unsupported_grant_type`,RateLimitExceeded:`rate_limit_exceeded`,ServerError:`server_error`,TemporarilyUnavailable:`temporarily_unavailable`},Tt={TOKEN_ENDPOINT:`/oauth2/token`,TIMEOUT:1e4,RETRIES:3,RETRY_DELAY:1e3,REFRESH_THRESHOLD:30,CONTENT_TYPE:`application/x-www-form-urlencoded`},Et=class{constructor(){this.cache=new Map}get(e){let t=this.cache.get(e);return t?Date.now()>=t.expiresAt?(this.cache.delete(e),Promise.resolve(null)):Promise.resolve(t.token):Promise.resolve(null)}set(e,t,n){return this.cache.set(e,{token:t,expiresAt:Date.now()+n*1e3}),Promise.resolve()}delete(e){return this.cache.delete(e),Promise.resolve()}},Dt={shouldRetry(e,t){return t>=3?!1:e.code===`server_error`||e.code===`temporarily_unavailable`||e.code===`rate_limit_exceeded`||e.status!==void 0&&e.status>=500},getDelay(e){return 2**(e-1)*1e3}},Ot=class{constructor(e){if(!e.url)throw new Ct(`M2M client requires a URL`);if(!e.clientId)throw new Ct(`M2M client requires a clientId`);if(!e.clientSecret)throw new Ct(`M2M client requires a clientSecret`);let t=e.url.replace(/\/$/,``);this.config={url:t,clientId:e.clientId,clientSecret:e.clientSecret,scopes:e.scopes,audience:e.audience,autoRefresh:e.autoRefresh??!1,refreshThreshold:e.refreshThreshold??Tt.REFRESH_THRESHOLD,timeout:e.timeout??Tt.TIMEOUT,retries:e.retries??Tt.RETRIES,retryDelay:e.retryDelay??Tt.RETRY_DELAY,retryStrategy:e.retryStrategy,cache:e.cache,onTokenRequest:e.onTokenRequest,onTokenResponse:e.onTokenResponse,onError:e.onError},this.cache=e.cache??new Et,this.retryStrategy=e.retryStrategy??Dt,this.tokenEndpoint=`${t}${Tt.TOKEN_ENDPOINT}`}getCacheKey(e,t){let n=e?.sort().join(`,`)||``,r=t?.sort().join(`,`)||``;return`m2m:${this.config.clientId}:${n}:${r}`}async getToken(e){let t=e?.scopes??this.config.scopes,n=e?.audience??this.config.audience,r=this.getCacheKey(t,n);if(!e?.forceRefresh){let e=await this.cache.get(r);if(e&&!this.isTokenExpired(e))return e}return this.requestToken(t,n,r)}async getValidToken(){let e=this.config.scopes,t=this.config.audience,n=this.getCacheKey(e,t),r=await this.cache.get(n);if(r){if(this.config.autoRefresh&&this.isTokenExpired(r,this.config.refreshThreshold))return this.requestToken(e,t,n);if(!this.isTokenExpired(r))return r}return this.requestToken(e,t,n)}async requestToken(e,t,n){let r={grant_type:`client_credentials`,client_id:this.config.clientId,client_secret:this.config.clientSecret};e&&e.length>0&&(r.scope=e.join(` `)),t&&t.length>0&&(r.audience=t.join(` `)),this.config.onTokenRequest&&this.config.onTokenRequest({clientId:this.config.clientId,scopes:e??[],audience:t??[],timestamp:new Date().toISOString()});let i=await this.executeWithRetry(()=>this.doTokenRequest(r));return i.issued_at=Math.floor(Date.now()/1e3),n&&await this.cache.set(n,i,i.expires_in),this.config.onTokenResponse&&this.config.onTokenResponse(i),i}async doTokenRequest(e){let t=new URLSearchParams;t.append(`grant_type`,e.grant_type),t.append(`client_id`,e.client_id),t.append(`client_secret`,e.client_secret),e.scope&&t.append(`scope`,e.scope),e.audience&&t.append(`audience`,e.audience);let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeout);try{let e=await fetch(this.tokenEndpoint,{method:`POST`,headers:{"Content-Type":Tt.CONTENT_TYPE,Accept:`application/json`},body:t.toString(),signal:n.signal});clearTimeout(r);let i={};e.headers.forEach((e,t)=>{i[t.toLowerCase()]=e});let a=await e.json();if(!e.ok){let t=U.fromOAuthError({error:a.error||`server_error`,error_description:a.error_description||a.message,error_uri:a.error_uri},e.status,i);throw this.config.onError&&this.config.onError({error:t.code,error_description:t.message}),t}return a}catch(e){throw clearTimeout(r),e instanceof Error&&e.name===`AbortError`?new xt(`Request timed out after ${this.config.timeout}ms`):e instanceof TypeError&&e.message.includes(`fetch`)?new xt(`Network error: ${e.message}`,e):e instanceof U?e:U.fromError(e instanceof Error?e:Error(String(e)))}}async executeWithRetry(e){let t;for(let n=1;n<=this.config.retries;n++)try{return await e()}catch(e){if(!(e instanceof U))throw e;if(t=e,n<this.config.retries&&this.retryStrategy.shouldRetry({code:e.code,status:e.status},n)){let e=this.retryStrategy.getDelay(n);await this.sleep(e);continue}throw e}throw t??new U({code:`server_error`,message:`Request failed after retries`})}sleep(e){return new Promise(t=>setTimeout(t,e))}getCachedToken(){let e=this.cache;if(`cache`in e){let t=this.getCacheKey(this.config.scopes,this.config.audience);return e.cache.get(t)?.token??null}return null}isTokenExpired(e,t=0){if(!e)return!0;let n=Math.floor(Date.now()/1e3);return n>=(e.issued_at??n-e.expires_in)+e.expires_in-t}parseToken(e){try{let t=e.split(`.`);if(t.length!==3)throw new St(`Invalid JWT format: expected 3 parts`);let n=t[1];if(!n)throw new St(`Invalid JWT format: missing payload`);let r=atob(n.replace(/-/g,`+`).replace(/_/g,`/`)),i=JSON.parse(r);return i.scopes&&typeof i.scopes==`string`?i.scopes=i.scopes.split(` `):i.scopes||(i.scopes=[]),i}catch(e){throw e instanceof St?e:new St(`Failed to parse token: ${e instanceof Error?e.message:`Unknown error`}`)}}clearCache(){let e=this.getCacheKey(this.config.scopes,this.config.audience);this.cache.delete(e)}async revokeToken(){let e=this.getCachedToken();if(!e)return;let t=`${this.config.url}/oauth2/revoke`,n=new URLSearchParams;n.append(`token`,e.access_token),n.append(`client_id`,this.config.clientId),n.append(`client_secret`,this.config.clientSecret);try{let e=await fetch(t,{method:`POST`,headers:{"Content-Type":Tt.CONTENT_TYPE},body:n.toString()});if(!e.ok&&e.status!==200){let t=await e.json().catch(()=>({}));throw U.fromOAuthError({error:t.error||`server_error`,error_description:t.error_description||`Token revocation failed`},e.status)}this.clearCache()}catch(e){throw e instanceof U?e:U.fromError(e instanceof Error?e:Error(String(e)))}}get url(){return this.config.url}get clientId(){return this.config.clientId}get scopes(){return this.config.scopes}get audience(){return this.config.audience}},kt=`error`,At=new WeakMap,jt=(e,t)=>{if(typeof t!=`object`&&typeof t!=`function`||t===null)return!0;let n=At.get(e);return n||(n=new WeakSet,At.set(e,n)),!n.has(t)&&(n.add(t),!0)},W=(e,t)=>jt(e,t.originalError)?(e.notify(kt,t),!0):!1,Mt=`passflow-refresh`,Nt=`passflow-refresh-takeover`,Pt=`passflow-auth`,Ft=Object.freeze([1e3,3e3,1e4,3e4,6e4]),It=.2,Lt=6e5,Rt=5e3,G=2e4,zt=2e4,Bt=1e3,Vt=2e3,Ht=1e3,Ut=1e4,Wt=5e3;function Gt(e){let t=e?`:${e}`:``;return{lock:`${Mt}${t}`,takeoverLock:`${Nt}${t}`,channel:`${Pt}${t}`}}function K(e){return typeof e==`string`&&e!==``?e:void 0}function Kt(e){return typeof e==`number`&&Number.isFinite(e)?e:void 0}function qt(e){return typeof e==`object`&&!!e}function Jt(e,t){for(let[n,r]of Object.entries(t))r!==void 0&&(e[n]=r);return e}function Yt(e){if(!qt(e))return null;let t=Array.isArray(e.scopes)?e.scopes.filter(e=>typeof e==`string`):void 0;return Jt({},{access_token:K(e.access_token),refresh_token:K(e.refresh_token),id_token:K(e.id_token),scopes:Array.isArray(e.scopes)&&t?.length===e.scopes.length?t:void 0})}function Xt(e){if(!qt(e))return null;let{kind:t,attempt:n,nextAt:r,strikes:i}=e;return t!==`transient`&&t!==`auth`||typeof n!=`number`||!Number.isInteger(n)||n<1||Kt(r)===void 0||typeof i!=`number`||!Number.isFinite(i)||i<0?null:Jt({kind:t,attempt:n,nextAt:r,strikes:i},{from:K(e.from),failingSince:Kt(e.failingSince)})}function Zt(e){return Jt({},{fp:K(e.fp),sub:K(e.sub),sid:K(e.sid),iat:Kt(e.iat)})}function Qt(e){if(!qt(e))return null;let t=e;if(t.v!==void 0&&t.v!==1)return null;let n=K(t.tabId);if(!n)return null;switch(t.type){case`tokens-refreshed`:{let e=Yt(t.tokens),r=K(t.from),i=K(t.to);return!e||!r||!i?null:Jt({type:t.type,tabId:n,tokens:e,from:r,to:i},{fromIat:Kt(t.fromIat),fromSid:typeof t.fromSid==`string`?t.fromSid:void 0,sentAt:Kt(t.sentAt)})}case`session-refreshed`:{let e=Kt(t.at);return e===void 0?null:Jt({type:t.type,tabId:n,at:e},{sub:K(t.sub)})}case`still-refreshing`:{let e=t.retry===void 0?null:Xt(t.retry);return e?{type:t.type,tabId:n,retry:e}:{type:t.type,tabId:n}}case`retry-scheduled`:{let e=Xt(t);return e?{type:t.type,tabId:n,message:typeof t.message==`string`?t.message:``,retry:e}:null}case`takeover`:return{type:t.type,tabId:n};case`lock-wanted`:return t.purpose===`commit`||t.purpose===`logout`?{type:t.type,tabId:n,purpose:t.purpose}:null;case`session-ended`:case`signed-out`:return{type:t.type,tabId:n,...Zt(t)};case`rate-limited`:{let e=Kt(t.until);return e===void 0?null:{type:t.type,tabId:n,until:e}}case`refresh-failed`:{let e=K(t.from);return e?{type:t.type,tabId:n,message:typeof t.message==`string`?t.message:``,from:e}:null}default:return null}}function $t(e,t){let n={v:1,tabId:e};if(t.type===`retry-scheduled`){let{retry:e,...r}=t;return Jt(n,{...r,...e})}return Jt(n,{...t})}var en=`[passflow] navigator.locks or BroadcastChannel is unavailable (they need a secure context); each tab refreshes on its own, with the save checks only`,tn={now:()=>Date.now(),random:()=>Math.random(),setTimeout:(e,t)=>{let n=setTimeout(e,t);return n.unref?.(),()=>clearTimeout(n)}};function nn(){let e=globalThis.crypto;return typeof e?.randomUUID==`function`?e.randomUUID():`tab-${Math.random().toString(36).slice(2)}-${Date.now()}`}function rn(e){return e?{now:()=>e.now(),setTimeout:(t,n)=>e.setTimeout(t,n),random:e.random?()=>e.random?.()??Math.random():tn.random}:tn}function an(e){return typeof window<`u`&&typeof document<`u`&&e.getDeviceType()===`web`}function on(e){try{return e.storageSharedAcrossTabs===!0}catch{return!1}}function sn(){try{let e=globalThis.navigator?.locks;return e&&typeof e.request==`function`?e:void 0}catch{return}}function cn(e){return t=>{let n=n=>{let r=n.key;(r==null||e().includes(r))&&t()};return window.addEventListener(`storage`,n),()=>window.removeEventListener(`storage`,n)}}function ln(e){return{transports:null,names:Gt(e),clock:tn,warnOnFirstCycle:!1}}function un(e,t,n,r){let i=Gt(n),a=an(t),o=a?cn(r.tokenKeys):void 0,s=e=>{let t={transports:null,names:i,clock:tn,warnOnFirstCycle:e};return o&&(t.onStorageChange=o),t};if(typeof e==`object`&&e){let t={transports:{locks:e.locks,channel:e.channel,tabId:e.tabId??nn()},names:i,clock:rn(e.clock),warnOnFirstCycle:!1};return e.onStorageChange&&(t.onStorageChange=e.onStorageChange),t}if(e===`none`||!a||!on(t))return s(!1);let c=sn();if(!c||typeof BroadcastChannel!=`function`)return s(!0);let l;try{l=new BroadcastChannel(i.channel)}catch{return s(!0)}let u={transports:{locks:c,channel:l,tabId:nn()},names:i,clock:tn,warnOnFirstCycle:!1};return o&&(u.onStorageChange=o),u}var dn=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_`,fn=32,pn=e=>{let t=``;for(let n=0;n<e.length;n+=3){let r=e[n],i=e[n+1],a=e[n+2];t+=dn.charAt(r>>2),t+=dn.charAt((r&3)<<4|(i??0)>>4),i!==void 0&&(t+=dn.charAt((i&15)<<2|(a??0)>>6)),a!==void 0&&(t+=dn.charAt(a&63))}return t},mn=()=>{let e=globalThis.crypto;if(!e?.subtle)throw Error(`PKCE needs the Web Crypto API, which is available only in a secure context (https or localhost)`);return e},hn=async e=>{let t=await mn().subtle.digest(`SHA-256`,new TextEncoder().encode(e));return pn(new Uint8Array(t))},gn=async()=>{let e=pn(mn().getRandomValues(new Uint8Array(fn)));return{verifier:e,challenge:await hn(e)}},_n=class{error(e,...t){console.error(e,...t)}warn(e,...t){console.warn(e,...t)}info(e,...t){console.info(e,...t)}debug(e,...t){console.debug(e,...t)}};function vn(){return new _n}var yn=Object.freeze([`error.token.invalid.error`,`error.api.token.parse.error`,`error.api.user.blocked`,`error.2fa.required_by_app`,`error.validation.token.invalid.subject`,`error.not.found`]);function bn(e){if(typeof e!=`object`||!e)return;let t=e;return typeof t.get==`function`?t.get(`retry-after`):t[`retry-after`]??t[`Retry-After`]}function xn(e,t){if(typeof e==`number`)return!Number.isFinite(e)||e<0?void 0:Math.min(Lt,Math.floor(e)*1e3);if(typeof e!=`string`)return;let n=e.trim();if(n===``)return;if(/^\d+$/.test(n))return Math.min(Lt,Number.parseInt(n,10)*1e3);if(!/[a-z]/i.test(n))return;let r=Date.parse(n);if(!Number.isNaN(r))return Math.min(Lt,Math.max(0,r-t))}function Sn(e){return typeof e==`number`&&Number.isInteger(e)&&e>=100&&e<=599?e:void 0}function Cn(e){if(typeof e.id==`string`&&e.id!==``)return e.id;let t=e.response?.data;if(typeof t!=`object`||!t)return;let n=t.error;if(typeof n!=`object`||!n)return;let r=n.id;return typeof r==`string`&&r!==``?r:void 0}function wn(e,t=Date.now()){if(typeof e!=`object`||!e)return{kind:`transient`};let n=e,r=Cn(n),i=Sn(n.response?.status)??Sn(n.status),a={};if(i!==void 0&&(a.status=i),r!==void 0&&(a.id=r),r===`error.token.blocked`)return{kind:`blocked`,...a};if(r!==void 0&&yn.includes(r)||i!==void 0&&i>=400&&i<=499&&i!==429)return{kind:`auth`,...a};if(i===void 0)return{kind:`transient`,...a};let o=xn(n.retryAfter??bn(n.response?.headers),t);return o===void 0?{kind:`transient`,...a}:{kind:`transient`,...a,retryAfterMs:o}}function Tn(e,t,n){let r=Ft.length,i=Ft[(Number.isFinite(e)?Math.min(Math.max(Math.floor(e),1),r):1)-1]??Ft[r-1]??6e4,a=Number.isFinite(t)?Math.min(Math.max(t,0),.999):0,o=i+Math.floor(i*It*a);return Math.max(o,n!==void 0&&Number.isFinite(n)?Math.min(Math.max(n,0),Lt):0)}var En={onGranted:()=>!1,onLockLost:()=>void 0,onMessage:()=>void 0};function Dn(e){let{locks:t,channel:n,tabId:r,names:i,clock:a}=e,o=En,s=null,c=null,l=null,u=null,d=null,f=null,p=0,m,h=!1,g=!1,_=e=>{g||n.postMessage($t(r,e))},v=()=>s!==null&&c===null,y=()=>{f?.(),f=null},b=e=>{p=Math.max(p,e),y(),f=a.setTimeout(()=>{f=null,D()},Math.max(0,p-a.now()))},x=()=>{d?.(),d=null},ee=()=>{d=a.setTimeout(()=>{d=null,c&&(h=!1,_(m?{type:`still-refreshing`,retry:m}:{type:`still-refreshing`}),ee())},Rt)},S=()=>{y(),x(),u?.(),u=null;let e=s;s=null,c=null,e&&(e.dead=!0,e.abort.abort());let t=l;l=null,t?.()},C=()=>{x(),c=null,s=null,l=null,o.onLockLost()},w=(e,t)=>{if(e.dead||s!==e||g){t();return}y(),c=e,l=t,h=!1,ee();let n=!1;try{n=o.onGranted()}finally{!n&&c===e&&S()}},T=e=>{if(e.takeover&&(u?.(),u=null),!(e.dead||s!==e))return new Promise(t=>{a.setTimeout(()=>w(e,t),0)})},E=e=>{let n={takeover:e,dead:!1,abort:new AbortController};s=n;let r=e?{steal:!0}:{signal:n.abort.signal};t.request(i.lock,r,()=>T(n)).catch(()=>{n.dead=!0,c===n&&C()})},D=()=>{if(!v())return;let e=s;t.request(i.takeoverLock,{ifAvailable:!0},t=>{if(s===e&&v()){if(t===null)b(a.now()+G);else return _({type:`takeover`}),new Promise(t=>{u=t,e&&(e.dead=!0,e.abort.abort()),E(!0)})}}).catch(()=>{v()&&b(a.now()+G)})},te=e=>{if(g)return;let t=Qt(e.data);if(t&&t.tabId!==r){switch(t.type){case`still-refreshing`:h=!0,v()&&(b(a.now()+G),t.retry&&b(t.retry.nextAt+G));break;case`takeover`:h=!0,v()&&b(a.now()+G);break;case`retry-scheduled`:h=!0,v()&&b(Math.max(a.now(),t.retry.nextAt)+G);break;case`rate-limited`:v()&&b(t.until+G)}o.onMessage(t)}};return n.addEventListener(`message`,te),{coordinated:!0,tabId:r,get waiting(){return v()},get holding(){return c!==null},attach:e=>{o=e},request:e=>{g||s||(p=0,b(Math.max(a.now()+G,e??0)),E(!1))},release:S,post:_,setRetryInfo:e=>{m=e},foreignHolderHeard:()=>h,dispose:()=>{g||(S(),g=!0,n.removeEventListener(`message`,te),n.close())}}}function On(e=`local`){let t=En,n=!1,r=!1,i=0,a=!1,o=()=>{n=!1,r=!1,i+=1};return{coordinated:!1,tabId:e,get waiting(){return n&&!r},get holding(){return r},attach:e=>{t=e},request:()=>{if(a||n)return;n=!0;let e=++i;Promise.resolve().then(()=>{if(a||i!==e||!n)return;r=!0;let s=!1;try{s=t.onGranted()}finally{!s&&i===e&&o()}})},release:o,post:()=>void 0,setRetryInfo:()=>void 0,foreignHolderHeard:()=>!1,dispose:()=>{o(),a=!0}}}var q={unavailable:`error.refresh.unavailable`,authRetry:`error.refresh.auth_retry`,sessionEnded:`error.refresh.session_ended`,signedOut:`error.refresh.signed_out`,successorTimeout:`error.refresh.successor_timeout`,identityChanged:`error.refresh.identity_changed`,disposed:`error.refresh.disposed`},kn={"error.refresh.unavailable":503,"error.refresh.auth_retry":401,"error.refresh.session_ended":401,"error.refresh.signed_out":401,"error.refresh.successor_timeout":401,"error.refresh.identity_changed":401,"error.refresh.disposed":499},An={"error.refresh.unavailable":`Token refresh is unavailable; a retry is scheduled`,"error.refresh.auth_retry":`Token refresh was refused; a retry is scheduled`,"error.refresh.session_ended":`The session has ended`,"error.refresh.signed_out":`Signed out`,"error.refresh.successor_timeout":`The refresh token was already used and no successor arrived`,"error.refresh.identity_changed":`Storage holds another user's tokens`,"error.refresh.disposed":`The Passflow instance was disposed`},J=class extends V{constructor(e,t={}){super({id:e,message:t.message??An[e],status:kn[e],location:`/auth/refresh`,time:new Date().toISOString()}),this.name=`PassflowRefreshError`,t.nextRetryAt!==void 0&&(this.nextRetryAt=t.nextRetryAt),t.cause!==void 0&&(this.cause=t.cause)}},jn=class extends Error{constructor(e,t){super(t??(e===`lock-timeout`?`Step-up commit could not take the refresh lock in time`:`Step-up commit answer arrived after the stored session moved on`)),this.name=`UpgradeCommitInterruptedError`,this.reason=e}};function Mn(e){if(!e)return;let t=3735928559,n=1103547991;for(let r=0;r<e.length;r++){let i=e.charCodeAt(r);t=Math.imul(t^i,2654435761),n=Math.imul(n^i,1597334677)}return t=Math.imul(t^t>>>16,2246822507),t^=Math.imul(n^n>>>13,3266489909),n=Math.imul(n^n>>>16,2246822507),n^=Math.imul(t^t>>>13,3266489909),(4294967296*(2097151&n)+(t>>>0)).toString(16)}function Nn(e){return typeof e==`string`&&e!==``?e:void 0}function Y(e){let t=Mn(e);if(!e||!t)return;let n={};try{let t=j(e);typeof t==`object`&&t&&(n=t)}catch{}let r=typeof n.iat==`number`&&Number.isFinite(n.iat)?n.iat:void 0,i={fp:t},a=Nn(n.sub),o=Nn(n.sid);return a!==void 0&&(i.sub=a),o!==void 0&&(i.sid=o),r!==void 0&&(i.iat=r),i}var Pn=`[passflow] A refresh token carries no iat claim: it is never taken over an ordered one, and cross-tab adoption falls back to fingerprints`;function Fn(e=e=>vn().warn(e)){let t=new Map,n=new Set,r=!1,i=[],a=!1,o=()=>{a||(a=!0,e(Pn))},s=(e,t)=>e.has(t)?!0:e.size>=32?!1:(e.add(t),!0),c=e=>{if(!e)return;if(e.iat===void 0){s(n,e.fp)||(r=!0);return}let i=e.sid??``,a=t.get(i);if((!a||e.iat>a.floor)&&(a={floor:e.iat,atFloor:new Set,full:!1}),t.delete(i),t.set(i,a),t.size>8){let e=t.keys().next().value;e!==void 0&&t.delete(e)}e.iat<a.floor||s(a.atFloor,e.fp)||(a.full=!0)},l=e=>{if(!e)return!1;if(e.iat===void 0)return r||n.has(e.fp);let i=t.get(e.sid??``);return!i||e.iat>i.floor?!1:e.iat<i.floor||i.full||i.atFloor.has(e.fp)},u=(e,t)=>!e.sub||!t.sub||e.sub===t.sub,d=e=>e?i.some(t=>t.fp===e.fp||t.iat!==void 0&&e.iat!==void 0&&u(t,e)&&t.sid===e.sid&&e.iat<t.iat):!1,f=(e,t)=>e.fp===t.fp?!1:e.iat===void 0?(o(),t.iat===void 0&&!l(e)):t.iat===void 0?!0:e.iat===t.iat?e.sid===t.sid&&l(t)&&!l(e):e.iat>t.iat;return{retire:c,isRetired:l,isAfter:f,isForward:(e,t)=>!e||d(e)||l(e)?!1:t?f(e,t):(e.iat===void 0&&o(),!0),end:e=>{let t=i.findIndex(t=>t.fp===e.fp||t.sid!==void 0&&t.sid===e.sid&&u(t,e));if(t!==-1){let n=i[t];if(n?.iat!==void 0&&(e.iat===void 0||n.iat>e.iat))return;i.splice(t,1)}i.push({...e}),i.length>4&&i.shift()},isEnded:d}}var In=class extends Error{constructor(e){super(e===`emptied`?`The shared token storage was emptied`:`The stored refresh token belongs to an ended session`),this.name=`SessionEnded`,this.cause=e}},Ln=class extends Error{constructor(){super(`The shared token storage holds another user's tokens`),this.name=`IdentityChanged`}};function Rn(e){if(e)try{let t=j(e).sub;return typeof t==`string`&&t!==``?t:void 0}catch{return}}function X(e){return Rn(e?.access_token)??Rn(e?.refresh_token)??Rn(e?.id_token)}function zn(e,t){return!t||e.iat===void 0||t.iat===void 0?!1:e.sid===t.sid&&e.iat<t.iat}function Bn(e){return typeof e==`object`&&!!e}function Vn(e){let{storage:t,cache:n,schedule:r}=e,i=e.identity??(()=>void 0),a=e.warn??(e=>vn().warn(e)),o=e.lineage??Fn(a),s=e.onSessionLost,c,l=0,u=[],d=[],f=0,p,m=0,h,g,_,v,y=()=>{let e=t.getTokens(),n=e?.refresh_token;if(!n)return p=l,e;p!==void 0&&(f=Math.max(f,p,m),p=void 0);let r=Mn(n)??``;return r!==c?.fp&&(c={fp:r,seq:l}),e},b=()=>Y(n.getTokens()?.refresh_token),x=()=>i()??X(n.getTokens()),ee=()=>{let e=b();return!e||e.iat===void 0||!x()?!1:!o.isRetired(e)&&!o.isEnded(e)},S=e=>{let t=b();if(!t||t.fp===e.fp||!ee())return!1;let n=x();return!e.sub||n!==e.sub||t.iat===void 0||e.iat===void 0?!1:t.sid!==e.sid||o.isAfter(t,e)},C=e=>{let t=x();return d.some(n=>n.seq>e&&(!n.sub||!t||n.sub===t))},w=()=>{let e=x();for(let t=u.length-1;t>=0;t--){let n=u[t];if(!n||n.seq<=f)break;if(!n.sub||!e||n.sub===e)return n}},T=()=>{if(!ee())return`end`;let e=c?.seq??0,t=w();return C(t?Math.min(e,t.seq):e)?`end`:t?S(t)?`keep`:`end`:s?`wait`:`end`},E=()=>{h?.(),h=void 0},D=(e=!1)=>{let t=T();t===`wait`&&e&&(t=`end`),t!==`wait`&&E(),t===`wait`&&!h&&(h=r(()=>{h=void 0,y()?.refresh_token?k():D(!0)===`end`&&s?.(`emptied`)},Vt));let n=t===`keep`?w():void 0;return n&&(m=Math.max(m,n.seq)),n&&g!==n.fp&&(g=n.fp,a(`[passflow] The shared token storage was emptied by the end of the session of ${n.fp}, a refresh token the ${b()?.fp??`(none)`} this tab holds is ahead of: keeping it. Nothing is refreshed until the storage holds a token again.`)),t},te=e=>e.held!==void 0&&b()?.fp===e.held.cachedFp,O=e=>{let t=b();return!!t&&!o.isRetired(t)&&!o.isEnded(t)&&o.isAfter(t,e)},ne=e=>{if(!O(e))return!1;if(o.isRetired(e))return!0;let t=b();return e.iat!==void 0&&t?.iat!==void 0&&t.sid===e.sid},re=(e,t)=>o.isForward(e,t)?!0:!!e&&!!t&&e.iat!==void 0&&e.sid!==t.sid&&o.isRetired(t)&&!o.isRetired(e)&&!o.isEnded(e),ie=e=>{let t=b();t&&t.fp!==Mn(e.refresh_token)&&o.retire(t),n.setTokensCache(e)},ae=e=>{let t=y(),n=t?.refresh_token;if(n===e.refreshToken)return null;if(!t||!n)return D()===`end`?{kind:`ended`,cause:`emptied`}:{kind:`superseded`,adopted:!1};let r=Rn(t.access_token)??Rn(n);if(e.sub&&r&&e.sub!==r)return{kind:`identity-changed`,saved:!1};let i=Y(n);if(o.isEnded(i))return i&&S(i)?{kind:`superseded`,adopted:!1}:{kind:`ended`,cause:`ended`};o.retire(e.order);let a=b();return re(i,a)||i?.fp===a?.fp&&!o.isRetired(i)?(ie(t),{kind:`superseded`,adopted:!0}):{kind:`superseded`,adopted:!1}},oe=e=>S(e)?{kind:`superseded`,adopted:!1}:{kind:`ended`,cause:`ended`},k=()=>{let t=y();if(!t?.refresh_token){D()===`end`&&s?.(`emptied`);return}E();let n=i(),r=X(t);n&&r&&n!==r?s?.(`identity-changed`):e.onStoredSessionSeen?.()},A=!!s||!!e.onStoredSessionSeen,j=A&&e.onStorageChange?e.onStorageChange(k):void 0,M=A&&e.onWake?e.onWake(k):void 0,N=()=>{let e=y();if(!e?.refresh_token){if(D()===`end`)throw new In(`emptied`);return`held`}let t=n.getTokens();if(e.refresh_token===t?.refresh_token)return`send`;let r=i()??X(t),a=X(e);if(r&&a&&r!==a)throw new Ln;let s=Y(e.refresh_token);if(o.isEnded(s)){if(s&&S(s))return`held`;throw new In(`ended`)}let c=Y(t?.refresh_token);return re(s,c)?(ie(e),`adopted`):s&&c&&s.sid!==c.sid?`send`:s&&O(s)?`held`:`send`},se=e=>{let t=i(),r=Rn(e);if(t&&r&&t!==r)return{kind:`identity-changed`};let a=Y(e)??{fp:e};if(o.isEnded(a))return S(a)?{kind:`superseded`}:{kind:`ended`};if(o.isRetired(a)&&O(a))return{kind:`superseded`};let s={refreshToken:e,order:a},c=t??r??Rn(n.getTokens()?.access_token);return c!==void 0&&(s.sub=c),v&&v.fp===a.fp&&(s.held={cachedFp:v.cachedFp}),{kind:`send`,sent:s}},ce=(e,r)=>{if(o.isEnded(e.order))return oe(e.order);let i=ae(e);if(i)return i;if(!te(e)&&ne(e.order))return o.retire(e.order),a(`[passflow] Refused to save a late refresh result: it rotated ${e.order.fp} into ${Mn(r.refresh_token)??`(no refresh token)`}, but this tab already holds ${b()?.fp??`(none)`}, a later successor of ${e.order.fp}. Neither saved nor adopted.`),{kind:`superseded`,adopted:!1};let s=X(r);if(e.sub&&s&&s!==e.sub)return t.saveTokens(r),{kind:`identity-changed`,saved:!0};let c=Y(r.refresh_token);return c&&(zn(c,e.order)||zn(c,b()))?(a(`[passflow] Refused to save a refresh result older than the token this tab holds: ${e.order.fp} was answered with ${c.fp}. Neither saved nor adopted.`),{kind:`superseded`,adopted:!1}):(o.retire(e.order),t.saveTokens(r),n.setTokensCache(r),{kind:`saved`})},P=(e,t)=>{if(o.isEnded(e.order))return oe(e.order);let n=ae(e);if(n)return n.kind===`identity-changed`?{kind:`identity-changed`}:n;if(o.isRetired(e.order)&&O(e.order))return{kind:`superseded`,adopted:!1};let r=wn(t),i=r.kind===`blocked`||r.kind===`auth`;return te(e)&&i?(o.retire(e.order),_=e.order,{kind:`own`,failure:r,heldRefused:!0}):(r.kind===`blocked`&&(o.retire(e.order),_=e.order),{kind:`own`,failure:r,heldRefused:!1})},F=e=>{if(!Bn(e))return!1;let{from:t,fromIat:r,fromSid:a,to:c,tokens:l}=e;if(typeof t!=`string`||typeof c!=`string`||!Bn(l))return!1;let u=l;if(typeof u.access_token!=`string`||u.access_token===``||typeof u.refresh_token!=`string`||u.refresh_token===``||Mn(u.refresh_token)!==c)return!1;let d=y();if(!d?.refresh_token)return!1;let f=n.getTokens(),p=i()??X(f),m=X(u);if(p&&m&&p!==m)return s?.(`identity-changed`),!1;let h=Y(u.refresh_token),g=Y(f?.refresh_token);g&&g.fp===t&&o.retire(g);let _=()=>{if(t!==c&&typeof r==`number`&&Number.isFinite(r)&&typeof a==`string`){let e={fp:t,iat:r};h?.sub!==void 0&&(e.sub=h.sub),a!==``&&(e.sid=a),o.retire(e)}return!0};return g?.fp===c?_():!o.isForward(h,g)||g?.fp!==t&&Mn(d.refresh_token)!==c?!1:(ie({...u}),_())},I=e=>{if(!e||!_)return!1;let t=_;return e.fp===t.fp||o.isEnded(e)||o.isRetired(e)?!1:e.iat!==void 0&&t.iat!==void 0&&e.sid!==t.sid||o.isAfter(e,t)},le=()=>{let e=b();if(!e)return!1;if(I(e))return!0;let t=y(),r=Y(t?.refresh_token);if(!t||!r||r.fp===e.fp||!I(r)||!re(r,e))return!1;let a=i()??X(n.getTokens()),o=X(t);return a&&o&&a!==o?(s?.(`identity-changed`),!1):(ie(t),!0)},L=e=>{let t=Y(e?.refresh_token),n={},r=i()??X(e);return t?.fp!==void 0&&(n.fp=t.fp),r!==void 0&&(n.sub=r),t?.sid!==void 0&&(n.sid=t.sid),t?.iat!==void 0&&(n.iat=t.iat),n};return{lineage:o,checkStoredBeforeSend:N,beginSend:se,commitSave:ce,judgeFailure:P,adoptTokens:F,adoptSuccessor:le,beginHeldSend:()=>{let e=Y(y()?.refresh_token);if(!e||o.isRetired(e)||o.isEnded(e))return v=void 0,!1;let t=b()?.fp;return v=t===void 0?{fp:e.fp}:{fp:e.fp,cachedFp:t},!0},endHeldSend:()=>{v=void 0},endLineage:e=>o.end(e),endedElsewhere:(e,t)=>{let n=!y()?.refresh_token;l+=1,e===`signed-out`?(d.push(t.sub===void 0?{seq:l}:{sub:t.sub,seq:l}),d.length>4&&d.shift()):t.fp&&(u.push({...t,fp:t.fp,seq:l}),u.length>4&&u.shift()),b()&&n&&D()===`end`&&s?.(`emptied`)},session:()=>L(n.getTokens()),storedSession:()=>L(y()),dropSession:()=>{n.setTokensCache(void 0),n.stopTokenCheck?.()},deleteIfStillDead:e=>{let n=Y(y()?.refresh_token);if(!n)return!1;let r=n.sid===e.sid&&(!n.sub||!e.sub||n.sub===e.sub);return n.fp===e.fp||r&&n.iat!==void 0&&e.iat!==void 0&&n.iat<e.iat?(t.deleteTokens(),!0):!1},stop:()=>{j?.(),M?.(),E()}}}function Hn(){let e,t,n=new Promise((n,r)=>{e=n,t=r});return n.catch(()=>void 0),{promise:n,resolve:e,reject:t}}var Un={strikes:q.sessionEnded,"session-ended":q.sessionEnded,"stored-ended":q.sessionEnded,"signed-out":q.signedOut,emptied:q.signedOut,"signed-out-here":q.signedOut,"successor-timeout":q.successorTimeout,"identity-changed":q.identityChanged,disposed:q.disposed};function Wn(e){throw Error(`Unexpected refresh state: ${JSON.stringify(e)}`)}function Gn(e){if(e===void 0||!Number.isFinite(e))return 3;let t=Math.floor(e);return t>=1?t:3}function Kn(e,t){return e instanceof Error&&e.message?e.message:t}function qn(e){if(typeof e!=`object`||!e)return;let t=e.id;return typeof t==`string`||typeof t==`number`?t:void 0}function Jn(e){let t={};return e?.access_token&&(t.access_token=e.access_token),e?.refresh_token&&(t.refresh_token=e.refresh_token),e?.id_token&&(t.id_token=e.id_token),e?.scopes&&(t.scopes=[...e.scopes]),t}function Yn(e,t){let n={};e.access_token&&(n.access_token=e.access_token),e.refresh_token&&(n.refresh_token=e.refresh_token),e.id_token&&(n.id_token=e.id_token);let r=t?.scopes??e.scopes;return r&&(n.scopes=r),n}function Xn(e){let{emit:t,storage:n,cache:r,transport:i,coordination:a}=e,o=a.clock,s=e.logger??vn(),c=Gn(e.strikes),l=a.transports?Dn({locks:a.transports.locks,channel:a.transports.channel,tabId:a.transports.tabId,names:a.names,clock:o}):On(),u={kind:`idle`},d=0,f=!1,p=!a.warnOnFirstCycle,m=0,h=0,g,_,v,y,b,x,ee,S,C=!1,w=()=>o.now(),T=()=>i.mode(),E=()=>Mn(r.getTokens()?.refresh_token),D=()=>({...r.getTokens()??{}}),te=()=>i.opaqueMarker?i.opaqueMarker():n.getTokens()?.id_token,O=()=>(ee===void 0&&(ee=X(r.getTokens()??n.getTokens())),ee),ne=new Set,re=new Set,ie=e=>()=>{for(let t of Array.from(e))t()},ae=a.onStorageChange?.(ie(ne)),oe=e.platform?.onForeground(ie(re)),k=Vn({storage:n,cache:r,identity:O,schedule:(e,t)=>o.setTimeout(e,t),onStorageChange:e=>(ne.add(e),()=>ne.delete(e)),onWake:e=>(re.add(e),()=>re.delete(e)),onSessionLost:e=>fe(e),onStoredSessionSeen:()=>{u.kind===`blocked-wait`&&ke()},warn:e=>s.warn(e)}),A=e=>({trigger:e,startedAt:w(),plain:Hn(),fresh:[]}),j=e=>e.kind===`idle`||e.kind===`ended`?void 0:e.pending,M=(e,t)=>{if(t===void 0)return e.plain.promise;let n={callTime:t,deferred:Hn()};return e.fresh.push(n),n.deferred.promise},N=(e,t,n=!1)=>{e.plain.resolve(D());for(let r of e.fresh)n||t!==void 0&&t>=r.callTime?r.deferred.resolve(D()):Ie(`refresh-token`,r.callTime).then(r.deferred.resolve,r.deferred.reject);e.fresh=[]},se=(e,t,n)=>{e.plain.reject(t);for(let r of e.fresh)n!==void 0&&n<r.callTime?Ie(`refresh-token`,r.callTime).then(r.deferred.resolve,r.deferred.reject):r.deferred.reject(t);e.fresh=[]},ce=(e,t)=>{if(e){e.plain.reject(t);for(let n of e.fresh)n.deferred.reject(t);e.fresh=[]}},P=(e,n,r,i)=>{let a={message:Kn(r,`Token refresh failed`),originalError:r,operation:e,source:n},o=qn(r);o!==void 0&&(a.code=o),i&&(a.refresh=i),t(`error`,a)},F=(e,t)=>{let n={classification:e,willRetry:t!==void 0,strikes:h,maxStrikes:c};return t!==void 0&&(n.nextRetryAt=t),n},I=(e,n)=>{if(u.kind===`refreshing`&&(u.request.outcome=!0),m=0,h=0,g=void 0,v=void 0,l.setRetryInfo(void 0),r.tokenExpiredFlag!==void 0&&(r.tokenExpiredFlag=!1),r.startTokenCheck?.(),t(`refresh`,{tokens:r.getTokens(),source:e}),t(`token-cache-expired`,{isExpired:!1}),_){let{since:e}=_;_=void 0,t(`refresh:recovered`,{since:e,origin:n})}},le=(e,n,r)=>{if(_)return;_={since:e};let i={since:e,origin:r};n!==void 0&&(i.nextRetryAt=n),t(`refresh:failing`,i)},L=(e,t)=>{let n=r.getTokens(),i=Mn(n?.refresh_token);e.fp&&i&&l.post({type:`tokens-refreshed`,tokens:Jn(n),from:e.fp,...e.iat===void 0?{}:{fromIat:e.iat},fromSid:e.sid??``,to:i,...t===void 0?{}:{sentAt:t}})},ue=()=>{p||(p=!0,s.warn(en))},de=e=>{(e.kind===`backoff`||e.kind===`blocked-wait`)&&e.cancel()},R=(e,n)=>{if(u.kind===`ended`)return;let r=j(u);de(u);let a=k.session(),o=O();switch(d+=1,m=0,h=0,g=void 0,_=void 0,v=void 0,l.setRetryInfo(void 0),C||l.release(),b={...a,cause:e},e!==`disposed`&&k.dropSession(),(e===`strikes`||e===`successor-timeout`)&&T()!==`json`&&i.invalidate(),u={kind:`ended`,cause:e},ce(r,n??new J(Un[e])),e){case`strikes`:t(`session:expired`,{reason:`refresh_failed`,origin:`this-tab`});break;case`session-ended`:case`stored-ended`:t(`session:expired`,{reason:`refresh_failed`,origin:`other-tab`});break;case`signed-out`:case`emptied`:t(`signout`,o===void 0?{origin:`other-tab`}:{origin:`other-tab`,userId:o});break;case`successor-timeout`:t(`session:expired`,{reason:`successor_timeout`,origin:`this-tab`});break;case`identity-changed`:t(`session:expired`,{reason:`identity_changed`,origin:`this-tab`});break;case`signed-out-here`:case`disposed`:break;default:Wn(e)}},z=()=>{if(u.kind!==`ended`||u.cause===`disposed`||f||T()!==`json`)return;let e=n.getTokens(),i=Y(e?.refresh_token);if(!e?.refresh_token||!e.access_token||!i||k.lineage.isEnded(i)||k.lineage.isRetired(i))return;let a=b,o=X(e);if(a&&a.cause!==`successor-timeout`&&(!a.sub||!o||a.sub===o)&&i.sid===a.sid)return;d+=1,m=0,h=0,g=void 0,_=void 0,v=void 0,b=void 0,ee=o;let s={...e};r.setTokensCache(s),r.tokenExpiredFlag!==void 0&&(r.tokenExpiredFlag=!1),r.startTokenCheck?.(),u={kind:`idle`},t(`signin`,{tokens:s,origin:`other-tab`})},fe=e=>{u.kind===`ended`||f||T()===`json`&&(R(e===`emptied`?`emptied`:`identity-changed`),e===`identity-changed`&&z())},pe=e=>{e instanceof Ln?(R(`identity-changed`),z()):e instanceof In?R(e.cause===`emptied`?`emptied`:`stored-ended`):R(`stored-ended`,e)},me=()=>{u={kind:`idle`},C||l.release()},he=e=>!e.from||T()!==`json`||e.from===E()||e.from===Mn(n.getTokens()?.refresh_token),ge=e=>{let t=g;if(!t)return;if(!l.holding){u={kind:`waiting`,pending:e},l.request(t.nextAt+G);return}l.setRetryInfo(t);let n=d,r=t.nextAt;u={kind:`backoff`,pending:e,dueAt:r,cancel:o.setTimeout(()=>{n===d&&_e()},Math.max(0,r-w()))}},_e=()=>{if(u.kind!==`backoff`||C)return;let{pending:e,dueAt:t}=u;!l.holding||l.foreignHolderHeard()||w()-t>2e4?(l.release(),u={kind:`waiting`,pending:e},l.request((g?.nextAt??w())+G)):(u={kind:`waiting`,pending:e},ye()||ve())},ve=()=>{u.kind===`idle`&&l.release()},ye=()=>{if(u.kind!==`waiting`)return!1;let e=u.pending;if(T()!==`json`)return be(e);let t=k.session(),n;try{n=k.checkStoredBeforeSend()}catch(e){return pe(e),!1}if(n===`held`){let t=E();return!v||v.fp!==t||w()-v.at<2e4?(v&&v.fp===t||(v={fp:t,at:w()}),u={kind:`idle`},N(e,void 0,!0),!1):(v={fp:t,at:w()},k.beginHeldSend()?xe(e,`held`):(u={kind:`idle`},N(e,void 0,!0),!1))}if(v=void 0,n===`adopted`){if(I(`adopted`,`other-tab`),L(t),e.fresh.length===0)return u={kind:`idle`},N(e,void 0),!1;e.plain.resolve(D())}return g&&!he(g)&&(g=void 0),g&&g.nextAt>w()?(m=g.attempt,h=g.strikes,g.failingSince!==void 0&&le(g.failingSince,g.nextAt,`other-tab`),ge(e),!0):(g&&(m=g.attempt,h=g.strikes),xe(e,e.trigger===`held`?`refresh-token`:e.trigger))},be=e=>y!==void 0&&y>=e.startedAt?(r.setTokensCache(n.getTokens()),I(`adopted`,`other-tab`),u={kind:`idle`},N(e,y),!1):g&&g.nextAt>w()?(m=g.attempt,h=g.strikes,ge(e),!0):Se(e,e.trigger,void 0,void 0),xe=(e,t)=>{let r=n.getTokens(),i=r?.refresh_token;if(!i)return u={kind:`idle`},N(e,void 0,!0),!1;let a=k.beginSend(i);switch(a.kind){case`superseded`:return k.endHeldSend(),I(`adopted`,`other-tab`),u={kind:`idle`},N(e,void 0),!1;case`ended`:return k.endHeldSend(),R(`stored-ended`),!1;case`identity-changed`:return k.endHeldSend(),R(`identity-changed`),z(),!1;case`send`:return Se(e,t,a.sent,r);default:return Wn(a)}},Se=(e,n,r,a)=>{let o={generation:d,sentAt:w(),trigger:n,settled:Hn()};r?o.sent=r:o.marker=te(),a&&(o.stored=a),u={kind:`refreshing`,pending:e,request:o},l.setRetryInfo(g),t(`refresh:start`,{});let c;try{c=i.send(a?{tokens:a}:{})}catch(e){c=Promise.reject(e)}return c.then(e=>{we(o,e).catch(e=>s.error(`[passflow] Applying a refresh result failed`,e)).finally(()=>o.settled.resolve())},e=>{Te(o,e),o.settled.resolve()}),!0},Ce=e=>!f&&e.generation===d&&u.kind===`refreshing`&&u.request===e,we=async(e,t)=>{if(e.sent?.held&&k.endHeldSend(),!Ce(e)||u.kind!==`refreshing`)return;let{pending:a}=u;if(!e.sent){let o=X({...t.id_token?{id_token:t.id_token}:{}}),s=O();if(o!==void 0&&s!==void 0&&o!==s){let t=new J(q.identityChanged);P(`refresh`,e.trigger,t,F(`auth`)),R(`identity-changed`,t);return}try{await i.applyOpaque(t)}catch(t){Te(e,t);return}if(!Ce(e))return;r.setTokensCache({...n.getTokens()??{},...Yn(t,void 0)}),I(`refresh`,`this-tab`);let c=O();l.post(c===void 0?{type:`session-refreshed`,at:w()}:{type:`session-refreshed`,at:w(),sub:c}),me(),N(a,e.sentAt);return}let o=E(),s=k.commitSave(e.sent,Yn(t,e.stored));switch(s.kind){case`saved`:I(`refresh`,`this-tab`),L(e.sent.order,e.sentAt),me(),N(a,e.sentAt);return;case`superseded`:e.outcome&&E()===o||I(`adopted`,`other-tab`),s.adopted&&L(e.sent.order),me(),N(a,e.sentAt);return;case`ended`:{let t=new J(s.cause===`emptied`?q.signedOut:q.sessionEnded);P(`refresh`,e.trigger,t,F(`auth`)),R(s.cause===`emptied`?`emptied`:`stored-ended`,t);return}case`identity-changed`:{let t=new J(q.identityChanged);P(`refresh`,e.trigger,t,F(`auth`)),R(`identity-changed`,t),z();return}default:Wn(s)}},Te=(e,t)=>{if(e.sent?.held&&k.endHeldSend(),!Ce(e)||u.kind!==`refreshing`)return;let{pending:n}=u,r,i=!1;if(e.sent){let a=E(),o=k.judgeFailure(e.sent,t);switch(o.kind){case`superseded`:e.outcome&&E()===a||I(`adopted`,`other-tab`),me(),N(n,e.sentAt);return;case`ended`:P(`refresh`,e.trigger,t,F(`auth`)),R(o.cause===`emptied`?`emptied`:`stored-ended`,t);return;case`identity-changed`:P(`refresh`,e.trigger,t,F(`auth`)),R(`identity-changed`,t),z();return;case`own`:r=o.failure,i=o.heldRefused;break;default:Wn(o)}}else r=wn(t,w());if(i)P(`refresh`,e.trigger,t,F(r.kind)),I(`adopted`,`other-tab`),me(),N(n,void 0,!0);else switch(r.kind){case`blocked`:P(`refresh`,e.trigger,t,F(`blocked`)),Oe(n,e.sentAt,t,e.marker);return;case`auth`:if(h+=1,m+=1,h>=c){P(`refresh`,e.trigger,t,F(`auth`)),De(e,t);return}Ee(e,n,t,r);return;case`transient`:m+=1,Ee(e,n,t,r);return;default:Wn(r.kind)}},Ee=(e,t,n,r)=>{let i=w()+Tn(m,o.random(),r.retryAfterMs),a=r.kind===`auth`?`auth`:`transient`;P(`refresh`,e.trigger,n,F(a,i)),a===`transient`&&le(w(),i,`this-tab`);let s={kind:a,attempt:m,nextAt:i,strikes:h},c=e.sent?.order.fp;c&&(s.from=c),_&&(s.failingSince=_.since),g=s,l.holding&&l.post({type:`retry-scheduled`,message:Kn(n,`Token refresh failed`),retry:s}),ge(A(`retry`)),se(t,n,e.sentAt)},De=(e,t)=>{let n=e.sent?.sub??O(),r=e.sent?.order,i={};r?.fp&&(i.fp=r.fp),n&&(i.sub=n),r?.sid&&(i.sid=r.sid),r?.iat!==void 0&&(i.iat=r.iat),(i.fp||i.sub)&&l.post({type:`session-ended`,...i}),i.fp&&(x=i.fp,k.endLineage({...i,fp:i.fp})),r&&k.deleteIfStillDead(r),R(`strikes`,t)},Oe=(e,t,n,r)=>{l.release(),s.warn(`[passflow] The refresh token was already used, most likely by another tab; waiting for its successor: ${Kn(n,`blocked`)}`);let i=d,a=w()+zt,c={kind:`blocked-wait`,pending:e,deadline:a,sentAt:t,cancel:()=>void 0,marker:r};if(u=c,ke())return;let f=T()!==`json`&&!l.coordinated&&!e.cookieRetried,p=()=>{i===d&&u===c&&(ke()||(f?(e.cookieRetried=!0,u={kind:`waiting`,pending:e},l.request()):w()>=a?(s.warn(`[passflow] No successor of the used refresh token appeared; ending the session in this tab only.`),R(`successor-timeout`)):c.cancel=o.setTimeout(p,Bt)))};c.cancel=o.setTimeout(p,f?Ht:Bt)},ke=()=>{if(u.kind!==`blocked-wait`)return!1;let e=u;if(T()===`json`){if(!k.adoptSuccessor())return!1}else{let t=y!==void 0&&y>=e.sentAt,i=te(),a=!l.coordinated&&i!==void 0&&i!==e.marker;if(!t&&!a)return!1;r.setTokensCache(n.getTokens())}return u===e&&(e.cancel(),I(`adopted`,`other-tab`),u={kind:`idle`},N(e.pending,void 0,!0),!0)},Ae=e=>{let t=O(),n=!e.sub||!t||e.sub===t;return T()===`json`?!!e.fp&&e.fp===E()&&n:!e.fp&&n},je=(e,t)=>{if(e!==`signed-out`||!t.sub)return!1;let n=O();return n!==void 0&&t.sub===n},Me=(e,t,n)=>{if(u.kind===`ended`||!he(e))return;let r=g?.nextAt;if(g=e,e.failingSince!==void 0&&le(e.failingSince,e.nextAt,`other-tab`),!t||u.kind!==`waiting`)return;let i=new J(e.kind===`transient`?q.unavailable:q.authRetry,{nextRetryAt:e.nextAt,cause:n||void 0}),a=u.pending;u.pending=A(a.trigger),se(a,i,r)},Ne=(e,t)=>{switch(t&&I(`adopted`,`other-tab`),u.kind){case`waiting`:case`backoff`:{let t=u.pending;de(u),me(),N(t,e);return}case`blocked-wait`:{let e=u.pending;u.cancel(),u={kind:`idle`},N(e,void 0,!0);return}case`idle`:case`refreshing`:case`ended`:return;default:Wn(u)}},B=e=>{let t={};e.fp&&(t.fp=e.fp),e.sub&&(t.sub=e.sub),e.sid&&(t.sid=e.sid),e.iat!==void 0&&(t.iat=e.iat);let n=u.kind!==`ended`&&(Ae(t)||je(e.type,t));t.fp&&k.endLineage({...t,fp:t.fp}),n&&R(e.type===`signed-out`?`signed-out`:`session-ended`),k.endedElsewhere(e.type,t)},Pe=e=>{if(!f)switch(e.type){case`tokens-refreshed`:{if(u.kind===`ended`){z();return}if(T()!==`json`)return;let t=E();if(!k.adoptTokens(e))return;let n=E()!==t;if(!n&&u.kind===`idle`)return;g=void 0,Ne(e.sentAt,n);return}case`session-refreshed`:{if(T()===`json`||u.kind===`ended`)return;let t=O();if(e.sub&&t&&e.sub!==t||(y=Math.max(y??0,e.at),u.kind===`refreshing`))return;if(r.setTokensCache(n.getTokens()),g=void 0,u.kind===`blocked-wait`){ke();return}Ne(e.at,!0);return}case`still-refreshing`:e.retry&&Me(e.retry,!1,``),Fe();return;case`retry-scheduled`:Me(e.retry,!0,e.message),Fe();return;case`refresh-failed`:if(u.kind===`ended`||T()!==`json`||e.from!==E()&&e.from!==Mn(n.getTokens()?.refresh_token))return;if(le(w(),void 0,`other-tab`),u.kind===`waiting`){let t=u.pending;u.pending=A(t.trigger),se(t,new J(q.unavailable,{cause:e.message}),void 0)}return;case`lock-wanted`:if(u.kind===`backoff`&&l.holding&&!C){let e=u.pending;u.cancel(),l.release(),u={kind:`waiting`,pending:e},l.request((g?.nextAt??w())+G)}return;case`session-ended`:case`signed-out`:B(e);return;case`takeover`:case`rate-limited`:return;default:Wn(e)}},Fe=()=>{S&&!l.holding&&l.post({type:`lock-wanted`,purpose:S.purpose})};l.attach({onGranted:()=>{if(f)return!1;if(S){let e=S;return S=void 0,e.granted(),!0}return u.kind===`waiting`&&ye()},onLockLost:()=>{if(u.kind===`backoff`){let e=u.pending;u.cancel(),u={kind:`waiting`,pending:e},l.request((g?.nextAt??w())+G)}},onMessage:Pe});let V=()=>{if(f)return;if(u.kind===`ended`){z();return}if(u.kind===`blocked-wait`&&T()!==`json`){ke();return}if(u.kind!==`idle`||T()!==`json`||C)return;let e=k.session();try{if(k.checkStoredBeforeSend()!==`adopted`)return}catch{return}I(`adopted`,`other-tab`),l.coordinated&&L(e)};ne.add(V),re.add(V);let Ie=(e,t)=>{if(f)return Promise.reject(new J(q.disposed));switch(u.kind){case`ended`:return Promise.reject(new J(q.sessionEnded));case`idle`:{let n=A(e);u={kind:`waiting`,pending:n};let r=M(n,t);return l.holding&&!C?ye()||ve():l.request(g?g.nextAt+G:void 0),r}case`waiting`:case`refreshing`:case`backoff`:case`blocked-wait`:return M(u.pending,t);default:return Wn(u)}},Le=e=>{if(f)return Promise.reject(new J(q.disposed));if(ue(),u.kind===`ended`)return Promise.reject(new J(q.sessionEnded));if(T()===`json`&&!r.getTokens()?.refresh_token){let t=n.getTokens();if(!t?.refresh_token){let n=Error(t?`No refresh token found`:`No tokens found`);return P(`refresh`,e.trigger,n),Promise.reject(n)}}return Ie(e.trigger,e.fresh?w():void 0)},Re=e=>{if(f)return Promise.reject(new J(q.disposed));if(u.kind===`ended`)return Promise.resolve(r.getTokens());let t=u.kind===`backoff`||u.kind===`blocked-wait`||g!==void 0&&g.nextAt>w();return e.allowStale&&t?Promise.resolve(r.getTokens()):Le({trigger:e.trigger}).then(()=>r.getTokens())},H=(e,t)=>l.holding?Promise.resolve(`granted`):new Promise(n=>{let r=()=>void 0,i={purpose:e,granted:()=>{r(),n(`granted`)}};S=i,l.post({type:`lock-wanted`,purpose:e}),l.request(),r=o.setTimeout(()=>{S===i&&(S=void 0,u.kind!==`waiting`&&l.release(),n(`timeout`))},Math.max(0,t))}),ze=async e=>{if(u.kind!==`refreshing`)return;let t=u.request.settled.promise;await new Promise(n=>{let r=o.setTimeout(n,Math.max(0,e));t.then(()=>{r(),n()})})},Be=()=>{if(C=!1,!f&&l.holding){if(u.kind===`waiting`)ye()||ve();else if(u.kind===`backoff`){let e=u.pending;u.cancel(),ge(e)}else u.kind===`idle`&&g&&g.nextAt>w()&&he(g)?(m=g.attempt,h=g.strikes,ge(A(`retry`))):u.kind===`idle`&&l.release()}},Ve=async(e,t)=>{if(f)throw new J(q.disposed);ue();let n=w()+Ut;if(await ze(n-w()),(!l.holding||u.kind===`refreshing`)&&(u.kind===`refreshing`?`timeout`:await H(`commit`,n-w()))===`timeout`){let e=new jn(`lock-timeout`);throw P(`upgrade.commit`,`upgrade`,e),e}C=!0;try{return await He(e,t)}finally{Be()}},He=async(e,a)=>{let o,s;if(T()===`json`){let e=k.session();try{k.checkStoredBeforeSend()===`adopted`&&(I(`adopted`,`other-tab`),L(e))}catch{}s=n.getTokens();let t=s?.refresh_token;if(!t){let e=Error(s?`No refresh token found`:`No tokens found`);throw P(`upgrade.commit`,`upgrade`,e),e}let r=k.beginSend(t);o=r.kind===`send`?r.sent:{refreshToken:t,order:Y(t)??{fp:t}}}let c=w();t(`refresh:start`,{});let u;try{u=await i.send(s?{tokens:s,upgrade:e}:{upgrade:e})}catch(e){throw o&&k.judgeFailure(o,e),P(`upgrade.commit`,`upgrade`,e),e}try{i.assertPin(a)}catch(e){throw P(`upgrade.commit`,`upgrade`,e),e}if(!o){await i.applyOpaque(u),r.setTokensCache({...n.getTokens()??{},...Yn(u,void 0)}),Ue(c);let e=O();return l.post(e===void 0?{type:`session-refreshed`,at:w()}:{type:`session-refreshed`,at:w(),sub:e}),D()}let d=k.commitSave(o,Yn(u,s));if(d.kind===`saved`)return Ue(c),L(o.order,c),D();let f=new jn(`superseded`);throw P(`upgrade.commit`,`upgrade`,f),d.kind===`superseded`&&d.adopted&&I(`adopted`,`other-tab`),f},Ue=e=>{if(I(`upgrade`,`this-tab`),u.kind===`waiting`||u.kind===`backoff`||u.kind===`blocked-wait`){let t=u.pending;de(u),u={kind:`idle`},N(t,e)}},We=()=>{let e=k.storedSession(),t=e.fp?e:k.session();(T()===`json`?!t.fp:!t.sub)||t.fp&&t.fp===x||(l.post({type:`signed-out`,...t}),t.fp&&k.endLineage({...t,fp:t.fp}))},Ge=()=>{let e=j(u);ce(e,new J(q.signedOut)),(u.kind===`backoff`||u.kind===`blocked-wait`||u.kind===`waiting`)&&(de(u),u={kind:`idle`})};return{refresh:Le,ensureFresh:Re,commitUpgrade:Ve,signOut:async e=>{if(f)return e(n.getTokens()?.refresh_token);let t=w()+Wt;Ge(),await ze(t-w()),Ge(),l.coordinated&&!l.holding&&await H(`logout`,t-w());try{We(),await e(n.getTokens()?.refresh_token)}finally{u.kind!==`ended`&&R(`signed-out-here`),x=void 0,l.release()}},signOutNow:e=>{if(f)return e(n.getTokens()?.refresh_token);Ge();try{We(),e(n.getTokens()?.refresh_token)}finally{u.kind!==`ended`&&R(`signed-out-here`),x=void 0}},sessionStarted:()=>{if(f)return;let e=j(u);de(u),d+=1,m=0,h=0,g=void 0,_=void 0,v=void 0,b=void 0,x=void 0,ee=void 0,l.setRetryInfo(void 0),u={kind:`idle`},C||l.release(),e&&N(e,void 0,!0)},identity:O,get coordinated(){return l.coordinated},get busy(){return u.kind!==`idle`&&u.kind!==`ended`},get ended(){return u.kind===`ended`},dispose:()=>{if(f)return;let e=j(u);de(u),f=!0,d+=1,u={kind:`ended`,cause:`disposed`},ce(e,new J(q.disposed)),S=void 0,k.stop(),l.dispose(),ae?.(),oe?.()}}}var Z=function(e){return e.SignIn=`signin`,e.SignInStart=`signin:start`,e.Register=`register`,e.RegisterStart=`register:start`,e.SignOut=`signout`,e.SessionRestored=`session:restored`,e.SessionExpired=`session:expired`,e.Error=`error`,e.Refresh=`refresh`,e.RefreshStart=`refresh:start`,e.TokenCacheExpired=`token-cache-expired`,e.TwoFactorRequired=`2fa:required`,e.TwoFactorSetupStarted=`2fa:setup_started`,e.TwoFactorEnabled=`2fa:enabled`,e.TwoFactorDisabled=`2fa:disabled`,e.TwoFactorVerified=`2fa:verified`,e.TwoFactorRecoveryUsed=`2fa:recovery_used`,e.TwoFactorRecoveryCodesLow=`2fa:recovery_low`,e.TwoFactorRecoveryCodesExhausted=`2fa:recovery_exhausted`,e.TwoFactorSetupMagicLinkValidated=`2fa:magic_link_validated`,e.TwoFactorSetupMagicLinkFailed=`2fa:magic_link_failed`,e.TwoFactorChallengeReceived=`two_factor_challenge_received`,e.TwoFactorMethodSwitched=`two_factor_method_switched`,e.TwoFactorDeviceTrusted=`two_factor_device_trusted`,e.RefreshFailing=`refresh:failing`,e.RefreshRecovered=`refresh:recovered`,e}({}),Zn=class{constructor(){this.subscribers=new Map}subscribe(e,t){if(t?.length){let n=new Set(t);this.subscribers.set(e,n)}else this.subscribers.set(e,null)}unsubscribe(e,t){if(!t?.length){this.subscribers.delete(e);return}let n=this.subscribers.get(e);n&&(t.forEach(e=>n.delete(e)),n.size===0&&this.subscribers.delete(e))}notify(e,t){e===`error`&&jt(this,t?.originalError),this.subscribers.forEach((n,r)=>{(!n||n.has(e))&&r.onAuthChange?.(e,t)})}notifyError(e){return W(this,e)}},Q={twoFactorCodeInvalid:`error.api.request.2fa_code.invalid`,challengeInvalid:`error.upgrade.challenge_invalid`,challengeSessionMismatch:`error.upgrade.challenge_session_mismatch`,challengeTooManyAttempts:`error.upgrade.challenge_too_many_attempts`,unsupportedFactor:`error.upgrade.unsupported_factor`,noSession:`error.upgrade.no_session`,unavailable:`error.upgrade.unavailable`,methodNotRegistered:`error.upgrade.method_not_registered`,prepareNotRequired:`error.upgrade.prepare_not_required`,methodNotSupported:`error.2fa.method_not_supported`,twoFactorNotEnabled:`error.2fa.not_enabled`,notImplemented:`error.not.implemented`,tokenInvalid:`error.api.request.token.invalid`},Qn=Object.freeze([Q.twoFactorCodeInvalid,Q.twoFactorNotEnabled,Q.challengeInvalid,Q.challengeSessionMismatch,Q.challengeTooManyAttempts]),$n=Object.freeze([Q.tokenInvalid]),er=Object.freeze([`wrong_code`,`challenge_spent`,`not_registered`,`prepare_not_required`]),tr=e=>er.includes(e),nr={wrong_code:`That code was not accepted. Try again.`,challenge_spent:`That verification challenge is no longer valid. Start again.`,exhausted:`Too many attempts. Try again later.`,attempts_exhausted:`Too many incorrect attempts. Verification was not completed.`,not_registered:`That verification method is not set up for this account.`,prepare_not_required:`This verification method needs no preparation round.`,fatal:`This verification method cannot be used right now.`,unavailable:`Step-up verification is not available on this deployment.`,protocol:`The server returned an unexpected upgrade response.`,network:`The verification request did not reach the server.`,session_changed:`The session ended during verification.`},$=class extends Error{constructor(e){super(e.message||nr[e.kind]),this.name=`UpgradeTransportError`,this.code=`upgrade_transport`,this.kind=e.kind,this.status=e.status,this.errorId=e.errorId,this.retryable=tr(e.kind),e.cause!==void 0&&(this.cause=e.cause)}},rr=Object.freeze([`upgrade_transport`,`upgrade_insufficient`,`upgrade_unavailable`,`upgrade_session_changed`,`upgrade_cancelled`,`upgrade_unsatisfiable`]),ir=e=>typeof e==`object`&&!!e&&typeof e.code==`string`&&rr.includes(e.code),ar=e=>e instanceof $||typeof e==`object`&&!!e&&e.code===`upgrade_transport`,or=e=>{if(typeof e!=`object`||!e)return{hasResponse:!1,message:typeof e==`string`?e:void 0};let t=e,n=t.response,r=n?.data,i=typeof r?.error?.id==`string`?r.error.id:void 0;return{status:typeof t.status==`number`?t.status:typeof n?.status==`number`?n.status:void 0,errorId:typeof t.id==`string`?t.id:i,message:typeof t.message==`string`?t.message:void 0,hasResponse:n!==void 0||typeof t.status==`number`}},sr=(e,t)=>{switch(e){case Q.twoFactorCodeInvalid:return`wrong_code`;case Q.challengeInvalid:case Q.challengeSessionMismatch:return`challenge_spent`;case Q.challengeTooManyAttempts:return`exhausted`;case Q.methodNotRegistered:return`not_registered`;case Q.twoFactorNotEnabled:return t===`refresh`?`session_changed`:`not_registered`;case Q.prepareNotRequired:return`prepare_not_required`;case Q.unavailable:case Q.notImplemented:return`unavailable`;case Q.unsupportedFactor:case Q.noSession:case Q.methodNotSupported:return`fatal`;case Q.tokenInvalid:return t===`refresh`?`session_changed`:`fatal`;default:return}},cr=(e,t)=>e===void 0?`network`:e===501?`unavailable`:e===400?`fatal`:e===401||e===403?t===`start`?`challenge_spent`:`session_changed`:e>=500?`network`:`fatal`,lr=(e,t)=>{if(e instanceof $)return e;let n=or(e);return n.hasResponse?new $({kind:sr(n.errorId,t)??cr(n.status,t),message:n.message,status:n.status,errorId:n.errorId,cause:e}):new $({kind:`network`,message:n.message,cause:e})},ur=e=>e.errorId!==void 0&&Qn.includes(e.errorId),dr=e=>e.errorId!==void 0&&$n.includes(e.errorId),fr=class extends Error{constructor(e,t,n){super(n??`The session was elevated, but this action requires a higher assurance level`),this.name=`UpgradeInsufficientError`,this.code=`upgrade_insufficient`,this.obtained=e,this.required=t}},pr=class extends Error{constructor(e=`Step-up verification is not available on this deployment`){super(e),this.name=`UpgradeUnavailableError`,this.code=`upgrade_unavailable`}},mr=class extends Error{constructor(e=`The session changed during verification`){super(e),this.name=`UpgradeSessionChangedError`,this.code=`upgrade_session_changed`}},hr=e=>{if(e&&typeof e.sub==`string`&&e.sub!==``)return typeof e.sid==`string`&&e.sid!==``?{sub:e.sub,sid:e.sid}:{sub:e.sub}},gr=(e,t)=>!t||t.sub!==e.sub?!1:e.sid!==void 0&&t.sid!==void 0?e.sid===t.sid:!0;function _r(e){if(!e||typeof e!=`string`)return!1;let t=e.split(`.`);if(t.length!==3)return!1;let n=/^[A-Za-z0-9_-]+$/;return t.every(e=>n.test(e)&&e.length>0)}function vr(e){return e.replace(/<[^>]*>/g,``).substring(0,200)}function yr(e){if(!e||typeof e!=`string`)return!1;let t=e.trim();return t.length!==0&&/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)}function br(e){if(!e||typeof e!=`string`)return!1;let t=e.trim();return/^\+[1-9]\d{1,14}$/.test(t)}function xr(e){if(!e||typeof e!=`string`)return!1;let t=e.trim();return t.length<3||t.length>30?!1:/^[a-zA-Z0-9_-]+$/.test(t)}function Sr(e,t=6){return!e||typeof e!=`string`?!1:(t===8?/^\d{8}$/:/^\d{6}$/).test(e)}function Cr(e){if(!e||typeof e!=`string`)return null;let t=e.toUpperCase().replace(/\s+/g,``);return/^[A-Z0-9-]{4,16}$/.test(t)?t:null}var wr=`passflow_2fa_pkce`,Tr=3e5,Er=class{constructor(e,t,n,r,i,a,o,s,c,l,u,d=L,f,p={coordination:ln()}){this.authApi=e,this.deviceService=t,this.storageManager=n,this.subscribeStore=r,this.tokenCacheService=i,this.scopes=a,this.createTenantForNewUser=o,this.url=s,this.sessionCallbacks=c,this.appId=l,this.platform=d,this.readPkceEnabled=f,this.tokenExchangeConfig=u,this.tokenDeliveryManager=new ce(n),u?.enabled&&this.tokenDeliveryManager.setMode(N.BFF),this.refresh=Xn({emit:this.createRefreshEmit(),storage:n,cache:i,transport:this.createRefreshTransport(),coordination:p.coordination,platform:d,...p.strikes===void 0?{}:{strikes:p.strikes},logger:vn()}),this.initializeSession()}async initializeSession(){(this.tokenDeliveryManager.isCookieMode()||this.tokenDeliveryManager.isBFFMode())&&await this.restoreSession()}async restoreSession(){if(this.tokenDeliveryManager.isBFFMode()&&this.tokenExchangeConfig?.statusUrl)try{let e=await fetch(this.tokenExchangeConfig.statusUrl,{method:`GET`,credentials:`include`});return e.ok&&(await e.json()).authenticated?(this.tokenDeliveryManager.setSessionValid(),!0):(this.tokenDeliveryManager.setSessionInvalid(),!1)}catch{return this.tokenDeliveryManager.setSessionInvalid(),!1}if(!this.tokenDeliveryManager.isCookieMode())return!1;try{let e=await this.authApi.validateSession();return e.valid?(this.tokenDeliveryManager.setSessionValid(),e.user&&this.subscribeStore.notify(Z.SessionRestored,e.user),!0):(this.tokenDeliveryManager.setSessionInvalid(),!1)}catch{return this.tokenDeliveryManager.setSessionInvalid(),!1}}async processAuthResponse(e,t){await this.applyAuthResponse(e,t),this.refresh.sessionStarted()}async applyAuthResponse(e,t){if(e.code&&!e.access_token)throw Error(`A PKCE authorization code was not exchanged, so there are no tokens to apply`);this.tokenExchangeConfig?.enabled||`token_delivery`in e&&e.token_delivery&&this.tokenDeliveryManager.setMode(e.token_delivery),this.tokenDeliveryManager.setSessionValid(),this.tokenDeliveryManager.isBFFMode()&&this.tokenExchangeConfig?.callbackUrl&&await this.forwardTokensToBFF(e),e.scopes=t,this.storageManager.saveTokens(e,this.tokenDeliveryManager.getMode()),this.tokenCacheService.setTokensCache(e),e.csrf_token&&this.storageManager.setCsrfToken(e.csrf_token)}handlePendingSecondFactor(e,t,n,r){return e.requires_2fa!==!0&&!e.tfa_token?!1:(n?this.rememberPkceSignIn(n.verifier,r):this.forgetPkceSignIn(),this.subscribeStore.notify(Z.TwoFactorRequired,{email:t||``,challengeId:e.challenge_id||``,tfaToken:e.tfa_token||``}),!0)}rememberPkceSignIn(e,t){if(this.pendingPkce={verifier:e,scopes:t,expiresAt:Date.now()+Tr},typeof sessionStorage<`u`)try{sessionStorage.setItem(wr,JSON.stringify(this.pendingPkce))}catch{}}readPendingPkce(){if(!this.pendingPkce&&typeof sessionStorage<`u`)try{let e=sessionStorage.getItem(wr);this.pendingPkce=e?JSON.parse(e):void 0}catch{this.pendingPkce=void 0}return this.pendingPkce&&Date.now()>=this.pendingPkce.expiresAt&&this.forgetPkceSignIn(),this.pendingPkce}hasPendingPkceSignIn(){return this.readPendingPkce()!==void 0}forgetPkceSignIn(){if(this.pendingPkce=void 0,typeof sessionStorage<`u`)try{sessionStorage.removeItem(wr)}catch{}}async startPkce(){let e=!1;try{e=await this.readPkceEnabled?.()??!1}catch(e){vn().warn(`Passflow: could not read the app settings, so this sign-in sends no PKCE challenge`,e);return}return e?gn():void 0}async exchangeCode(e,t){return!e.code||!t?e:await this.authApi.pkceExchange(e.code,t.verifier)}async completePkceSignIn(e){let t=this.readPendingPkce();if(!t)throw Error(`The sign-in answered with a PKCE code, but its verifier is gone`);let n=await this.authApi.pkceExchange(e,t.verifier);return await this.processAuthResponse(n,t.scopes??this.scopes),n}async applyTokens(e){let t=e;(t.access_token||t.id_token||t.token_delivery)&&await this.processAuthResponse(t,t.scopes??this.readPendingPkce()?.scopes??this.scopes)}async forwardTokensToBFF(e){if(!this.tokenExchangeConfig?.callbackUrl)return;let t=await fetch(this.tokenExchangeConfig.callbackUrl,{method:`POST`,credentials:`include`,headers:{"Content-Type":`application/json`},body:JSON.stringify({access_token:e.access_token,refresh_token:e.refresh_token,id_token:e.id_token,expires_in:e.expires_in})});if(!t.ok)throw Error(`BFF token storage failed: ${t.status}`)}async signIn(e){if(`email`in e&&e.email&&!yr(e.email)){let e=Error(`Invalid email format`),t={operation:`sign-in`,message:`Invalid email format`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}if(`username`in e&&e.username&&!xr(e.username)){let e=Error(`Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens`),t={operation:`sign-in`,message:`Invalid username format. Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}if(`phone`in e&&e.phone&&!br(e.phone)){let e=Error(`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`),t={operation:`sign-in`,message:`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}this.subscribeStore.notify(Z.SignInStart,{email:e.email});let t=this.deviceService.getDeviceId(),n=Re(this.platform.getDeviceType());e.scopes=e.scopes??this.scopes;try{let r=await this.startPkce(),i=await this.authApi.signIn(r?{...e,code_challenge:r.challenge}:e,t,n);if(this.handlePendingSecondFactor(i,e.email,r,e.scopes))return i;let a=await this.exchangeCode(i,r);return this.handlePendingSecondFactor(a,e.email)||(await this.processAuthResponse(a,e.scopes),this.subscribeStore.notify(Z.SignIn,{tokens:a,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),a}catch(e){let t={operation:`sign-in`,message:e instanceof Error?e.message:`Sign in failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async signUp(e){if(e.user.email&&!yr(e.user.email)){let e=Error(`Invalid email format`),t={operation:`sign-up`,message:`Invalid email format`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}if(e.user.phone_number&&!br(e.user.phone_number)){let e=Error(`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`),t={operation:`sign-up`,message:`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}this.subscribeStore.notify(Z.RegisterStart,{email:e.user.email}),e.scopes=e.scopes??this.scopes,e.create_tenant=this.createTenantForNewUser;try{let t=await this.startPkce(),n=await this.authApi.signUp(t?{...e,code_challenge:t.challenge}:e);if(this.handlePendingSecondFactor(n,e.user.email,t,e.scopes))return n;let r=await this.exchangeCode(n,t);return this.handlePendingSecondFactor(r,e.user.email)||(await this.processAuthResponse(r,e.scopes),this.subscribeStore.notify(Z.Register,{tokens:r,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),r}catch(e){let t={operation:`sign-up`,message:e instanceof Error?e.message:`Sign up failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async passwordlessSignIn(e){if(e.email&&!yr(e.email)){let e=Error(`Invalid email format`),t={operation:`passwordless.start`,message:`Invalid email format`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}if(e.phone&&!br(e.phone)){let e=Error(`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`),t={operation:`passwordless.start`,message:`Invalid phone number format. Phone must be in E.164 format (e.g., +12345678901)`,originalError:e,code:`VALIDATION_ERROR`};throw W(this.subscribeStore,t),e}this.subscribeStore.notify(Z.SignInStart,{email:e.email}),e.scopes=e.scopes??this.scopes;let t=this.deviceService.getDeviceId(),n=Re(this.platform.getDeviceType());try{return await this.authApi.passwordlessSignIn(e,t,n)}catch(e){let t={operation:`passwordless.start`,message:e instanceof Error?e.message:`Failed to send passwordless sign-in link`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async passwordlessSignInComplete(e){this.subscribeStore.notify(Z.SignInStart,{}),e.scopes=e.scopes??this.scopes,e.device=this.deviceService.getDeviceId();try{let t=await this.authApi.passwordlessSignInComplete(e);return this.handlePendingSecondFactor(t)||(await this.processAuthResponse(t,e.scopes),this.subscribeStore.notify(Z.SignIn,{tokens:t,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),t}catch(e){let t={operation:`passwordless.complete`,message:e instanceof Error?e.message:`Passwordless sign in failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async logOut(){let e=this.refresh.identity();return await this.refresh.signOut(async e=>{await this.callLogoutApi(e),this.forgetPkceSignIn(),this.clearLocalSession()}),e}resetSession(){let e=this.refresh.identity();return this.refresh.signOutNow(()=>this.clearLocalSession()),e}async callLogoutApi(e){if(this.tokenDeliveryManager.isBFFMode()&&this.tokenExchangeConfig?.logoutUrl){try{await fetch(this.tokenExchangeConfig.logoutUrl,{method:`POST`,credentials:`include`})}catch{}return}let t=e??this.storageManager.getToken(M.refresh_token),n=this.storageManager.getDeviceId();try{if((await this.authApi.logOut(n,t,!this.appId)).status!==`ok`)throw Error(`Logout failed`)}catch{}}clearLocalSession(){this.storageManager.deleteTokens(),this.storageManager.clearIdToken(),this.storageManager.clearCsrfToken(),this.tokenDeliveryManager.reset(),this.tokenCacheService.setTokensCache(void 0),this.tokenCacheService.stopTokenCheck?.()}readSessionPin(){try{let e=this.storageManager.getToken(M.access_token);return e?hr(j(e)):void 0}catch{return}}assertSessionPin(e){if(e&&!gr(e,this.readSessionPin()))throw console.warn(`[passflow] the session or user changed while a step-up upgrade was in flight; the elevated tokens were discarded and the live session was left untouched.`),new mr(`The session changed during verification, so the elevated tokens were discarded`)}refreshMode(){return this.tokenDeliveryManager.isBFFMode()&&this.tokenExchangeConfig?.refreshUrl?`bff`:this.tokenDeliveryManager.isCookieMode()?`cookie`:`json`}createRefreshEmit(){return(e,t)=>{let n=this.subscribeStore;switch(e){case`refresh`:{let{tokens:e,source:r}=t;n.notify(Z.Refresh,{tokens:e,parsedTokens:this.tokenCacheService.getParsedTokens(),source:r});return}case`signin`:{let{tokens:e,origin:r}=t;n.notify(Z.SignIn,{tokens:e,parsedTokens:this.tokenCacheService.getParsedTokens(),origin:r});return}case`error`:W(n,t);return;case`refresh:start`:n.notify(Z.RefreshStart,{});return;case`token-cache-expired`:n.notify(Z.TokenCacheExpired,t);return;case`refresh:failing`:n.notify(Z.RefreshFailing,t);return;case`refresh:recovered`:n.notify(Z.RefreshRecovered,t);return;case`session:expired`:n.notify(Z.SessionExpired,t);return;case`signout`:n.notify(Z.SignOut,t);return;default:vn().warn(`[passflow] Unknown refresh event: ${String(e)}`)}}}createRefreshTransport(){return{mode:()=>this.refreshMode(),send:async({tokens:e,upgrade:t})=>{let n=this.refreshMode();if(n===`bff`)return await this.sendBffRefresh();if(n===`cookie`)return t?await this.authApi.refreshToken(``,this.scopes,void 0,t):await this.authApi.refreshToken(``,this.scopes);let r=e?.refresh_token??``,i=e?.scopes??this.scopes,a=e?.access_token;return t?await this.authApi.refreshToken(r,i,a,t):await this.authApi.refreshToken(r,i,a)},applyOpaque:async e=>{this.tokenDeliveryManager.setSessionValid(),this.tokenDeliveryManager.isBFFMode()?(e.id_token&&this.storageManager.setIdToken(e.id_token),e.csrf_token&&this.storageManager.setCsrfToken(e.csrf_token)):await this.applyAuthResponse(e,this.scopes)},invalidate:()=>{this.tokenDeliveryManager.setSessionInvalid(),this.storageManager.clearIdToken(),this.storageManager.clearCsrfToken()},assertPin:e=>this.assertSessionPin(e),opaqueMarker:()=>{let e=this.storageManager.getIdToken(),t=this.storageManager.getCsrfToken();return e===void 0&&t===void 0?void 0:`${e??``}\n${t??``}`}}}async sendBffRefresh(){let e=this.tokenExchangeConfig?.refreshUrl??``,t=await fetch(e,{method:`POST`,credentials:`include`});if(!t.ok){let n,r;try{let e=await t.json();typeof e?.error?.id==`string`&&(n=e.error.id),typeof e?.error?.message==`string`&&(r=e.error.message)}catch{}throw new V({id:n??`error.http.${t.status}`,message:r??`BFF token refresh failed`,status:t.status,location:e,time:new Date().toISOString()})}return await t.json()}async refreshToken(e,t){if(e&&this.tokenDeliveryManager.isBFFMode())throw new $({kind:`unavailable`,message:`Step-up verification cannot be committed through a BFF refresh endpoint`});if(e)return await this.refresh.commitUpgrade(e,t);if(this.refreshMode()===`json`&&!this.refresh.ended){let e=this.storageManager.getTokens();if(!e?.refresh_token){let t=Error(e?`No refresh token found`:`No tokens found`);throw W(this.subscribeStore,{operation:`refresh`,source:`refresh-token`,message:t.message,originalError:t}),t}}return await this.refresh.refresh({trigger:`refresh-token`,fresh:!0})}async sendPasswordResetEmail(e){try{return await this.authApi.sendPasswordResetEmail(e)}catch(e){let t={operation:`password-reset.send`,message:e instanceof Error?e.message:`Failed to send password reset email`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async resetPassword(e,t){this.subscribeStore.notify(Z.SignInStart,{});let n=new URLSearchParams(this.platform.getCurrentUrl()?.search??``).get(`token`)??void 0,r=t??this.scopes;try{let t=await this.startPkce(),i=t?await this.authApi.resetPassword(e,r,n,t.challenge):await this.authApi.resetPassword(e,r,n);if(this.handlePendingSecondFactor(i,void 0,t,r))return i;let a=await this.exchangeCode(i,t);if(this.handlePendingSecondFactor(a))return a;let o=i.redirect_url?{...a,redirect_url:i.redirect_url}:a;return await this.processAuthResponse(o,r),this.subscribeStore.notify(Z.SignIn,{tokens:o,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck(),o}catch(e){let t={operation:`password-reset.complete`,message:e instanceof Error?e.message:`Password reset failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async passkeyRegister(e){if(!this.platform.passkeys)throw Error(`Passkeys are not supported on this platform`);this.subscribeStore.notify(Z.RegisterStart,{});let t=this.deviceService.getDeviceId(),n=Re(this.platform.getDeviceType());e.scopes=e.scopes??this.scopes,e.create_tenant=this.createTenantForNewUser;try{let r=await this.startPkce(),{challenge_id:i,publicKey:a}=await this.authApi.passkeyRegisterStart(r?{...e,code_challenge:r.challenge}:e,t,n,!this.appId);a.user.id=this.platform.btoa(a.user.id);let o=await this.platform.passkeys.startRegistration(a);if(!o)throw Error(`Passkey registration was not completed`);let s=await this.authApi.passkeyRegisterComplete(o,t,i,!this.appId);if(this.handlePendingSecondFactor(s,void 0,r,e.scopes))return s;let c=await this.exchangeCode(s,r);return this.handlePendingSecondFactor(c)||(await this.processAuthResponse(c,e.scopes),this.subscribeStore.notify(Z.Register,{tokens:c,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),c}catch(e){let t={operation:`passkey.register`,message:e instanceof Error?e.message:`Passkey registration failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}async passkeyAuthenticate(e){if(!this.platform.passkeys)throw Error(`Passkeys are not supported on this platform`);this.subscribeStore.notify(Z.SignInStart,{});let t=this.deviceService.getDeviceId(),n=Re(this.platform.getDeviceType());e.scopes=e.scopes??this.scopes;try{let r=await this.startPkce(),{challenge_id:i,publicKey:a}=await this.authApi.passkeyAuthenticateStart(r?{...e,code_challenge:r.challenge}:e,t,n,!this.appId),o=await this.platform.passkeys.startAuthentication(a);if(!o)throw Error(`Passkey authentication was not completed`);let s=await this.authApi.passkeyAuthenticateComplete(o,t,i,!this.appId);if(this.handlePendingSecondFactor(s,void 0,r,e.scopes))return s;let c=await this.exchangeCode(s,r);return this.handlePendingSecondFactor(c)||`access_token`in c&&(await this.processAuthResponse(c,e.scopes),this.subscribeStore.notify(Z.SignIn,{tokens:c,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck()),c}catch(e){let t={operation:`passkey.authenticate`,message:e instanceof Error?e.message:`Passkey authentication failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,t),e}}createFederatedAuthUrl(e){let t=`/auth/federated/start/${e.provider}`;if(!this.appId)throw Error(`AppId is required for federated auth`);let n={scopes:(e.scopes??this.scopes).join(` `),redirect_url:e.redirect_url??this.platform.getCurrentUrl()?.origin??``,appId:this.appId,...e.invite_token?{invite_token:e.invite_token}:{},...e.create_tenant?{create_tenant:e.create_tenant.toString()}:{},...e.device?{device:e.device}:{}},r=new URL(t,this.url);return r.search=new URLSearchParams(n).toString(),r.toString()}async federatedAuthWithPopup(e){this.subscribeStore.notify(Z.SignInStart,{provider:e.provider});let t=e.scopes??this.scopes,n=this.deviceService.getDeviceId(),r=this.createFederatedAuthUrl({...e,scopes:t,device:n});try{let e=await this.platform.openAuthUrl(r,{mode:`popup`,expectedReturnOrigin:this.platform.getCurrentUrl()?.origin??``}),n=new URLSearchParams(e.callbackHash.replace(/^#/,``));if(this.handlePendingSecondFactor({tfa_token:n.get(`tfa_token`)??void 0}))return;let i=new URLSearchParams(e.callbackSearch),a=i.get(`access_token`)||``,o=i.get(`refresh_token`)||``,s=i.get(`id_token`)||``,c={access_token:a,refresh_token:o||void 0,id_token:s||void 0,scopes:t};await this.processAuthResponse(c,t),this.subscribeStore.notify(Z.SignIn,{tokens:c,parsedTokens:this.tokenCacheService.getParsedTokens()}),this.platform.navigateTo(this.platform.getCurrentUrl()?.origin??``)}catch(e){let t={operation:`federated.popup`,message:e instanceof Error?e.message:`Authentication failed`,code:e instanceof I?`POPUP_CLOSED`:`AUTH_FAILED`,originalError:e};W(this.subscribeStore,t)}}federatedAuthWithRedirect(e){this.subscribeStore.notify(Z.SignInStart,{provider:e.provider});let t=e.scopes??this.scopes,n=this.deviceService.getDeviceId(),r=this.createFederatedAuthUrl({...e,scopes:t,device:n});this.platform.navigateTo(r)}authRedirectUrl(e={}){try{let{url:t,redirectUrl:n,scopes:r,appId:i}=e??{},a=new URL(t??this.url);a.pathname=(a.pathname.endsWith(`/`)?a.pathname:a.pathname+`/`)+`web`;let o=r??this.scopes,s={appId:i??this.appId??``,redirectto:n??this.platform.getCurrentUrl()?.href??``,scopes:o.join(`,`)};return a.search=new URLSearchParams(s).toString(),a.toString()}catch(e){let t={operation:`auth-redirect.url`,message:e instanceof Error?e.message:`Failed to create auth redirect URL`,originalError:e};throw W(this.subscribeStore,t),e}}authRedirect(e={}){try{this.platform.navigateTo(this.authRedirectUrl(e))}catch(e){let t={operation:`auth-redirect`,message:e instanceof Error?e.message:`Failed to redirect to auth page`,originalError:e};throw W(this.subscribeStore,t),e}}isAuthenticated(e){try{if(this.tokenDeliveryManager.isCookieMode()||this.tokenDeliveryManager.isBFFMode()){let t=!!e?.id_token||!!this.storageManager.getIdToken(),n=this.tokenDeliveryManager.isSessionValid(),r=this.tokenDeliveryManager.isSessionUnknown();return t&&(n||r)}return!e||!e.access_token?!1:!A(e.access_token)||e.refresh_token!==void 0&&!A(e.refresh_token)}catch(e){let t={operation:`auth.is-authenticated`,message:e instanceof Error?e.message:`Failed to check authentication status`,originalError:e};return W(this.subscribeStore,t),!1}}async submitSessionCheck(e=!1){let t,n;try{t=await this.getTokens(e),n=this.tokenCacheService.getParsedTokens()}catch(e){let n={operation:`session.check`,message:e instanceof Error||e instanceof V?e.message:`Session check failed`,originalError:e};W(this.subscribeStore,n),t=void 0}return t&&this.sessionCallbacks.createSession&&await this.sessionCallbacks.createSession({tokens:t,parsedTokens:n}),!t&&this.sessionCallbacks.expiredSession&&await this.sessionCallbacks.expiredSession(),t}async refreshForSession(){try{await this.refresh.refresh({trigger:`session`})}catch{}return this.tokenCacheService.getTokens()}async getTokens(e){try{if(this.tokenDeliveryManager.isCookieMode()||this.tokenDeliveryManager.isBFFMode()){let t=this.storageManager.getTokens();return t?.id_token?this.tokenDeliveryManager.isSessionInvalid()&&e?await this.refreshForSession():t:void 0}let t=this.storageManager.getTokens();return!t||!t.access_token?void 0:A(j(t.access_token))?e?await this.refreshForSession():void 0:t}catch(e){let t={operation:`tokens.get`,message:e instanceof Error?e.message:`Failed to get tokens`,originalError:e};W(this.subscribeStore,t);return}}},Dr=class{constructor(e){this.invitationApi=e}requestInviteLink(e){return this.invitationApi.requestInviteLink(e)}getInvitations(e){return this.invitationApi.getInvitations(e)}deleteInvitation(e){return this.invitationApi.deleteInvitation(e)}resendInvitation(e){return this.invitationApi.resendInvitation(e)}getInvitationLink(e){return this.invitationApi.getInvitationLink(e)}},Or=class{constructor(e){this.data=this.normalize(e)}normalize(e){let t=new Map,n=new Map,r=new Map,i=[];return e.groups?.forEach(e=>{n.set(e.id,{id:e.id,name:e.name,default:e.default??!1,updated_at:e.updated_at,created_at:e.created_at})}),e.roles?.forEach(e=>{r.set(e.id,{id:e.id,tenant_id:e.tenant_id,name:e.name})}),e.users_in_groups?.forEach(e=>{let r=e.user;r&&!t.has(r.id)&&t.set(r.id,{id:r.id,name:r.name??null,email:r.email??null,phone:r.phone??null}),r&&e.group_id&&n.has(e.group_id)&&i.push({userId:r.id,groupId:e.group_id,roleIds:e.roles?.map(e=>e.id)??[]})}),{tenant_id:e.tenant_id,tenant_name:e.tenant_name,users:Array.from(t.values()),groups:Array.from(n.values()),roles:Array.from(r.values()),memberships:i,usersById:t,groupsById:n,rolesById:r}}getUsersInGroup(e){return this.data.memberships.filter(t=>t.groupId===e).map(e=>this.data.usersById.get(e.userId)).filter(e=>e!==void 0)}getGroupsForUser(e){return this.data.memberships.filter(t=>t.userId===e).map(e=>this.data.groupsById.get(e.groupId)).filter(e=>e!==void 0)}getUserRolesInGroup(e,t){let n=this.data.memberships.find(n=>n.userId===e&&n.groupId===t);return n?n.roleIds.map(e=>this.data.rolesById.get(e)).filter(e=>e!==void 0):[]}getData(){return this.data}},kr=class{constructor(e,t,n){this.tenantApi=e,this.scopes=t,this.logger=n||vn()}handlePassflowError(e,t){if(c.default.isAxiosError(e)&&e.response?.data){let n=e.response.data;if(typeof n==`object`&&n&&`error`in n&&typeof n.error==`object`&&n.error!==null){let e=n.error;throw this.logger.error(`${t}: ${e.id} - ${e.message} (Status: ${e.status})`),Error(`Passflow API Error: ${e.id} - ${e.message} (Status: ${e.status})`)}}throw this.logger.error(`${t}:`,e),e instanceof Error?e:Error(String(e))}async joinInvitation(e,t){try{let n=t??this.scopes;return await this.tenantApi.joinInvitation(e,n)}catch(e){this.handlePassflowError(e,`Join invitation failed`)}}async createTenant(e){try{return await this.tenantApi.createTenant(e)}catch(e){this.handlePassflowError(e,`Tenant creation failed`)}}async getTenantDetails(e){try{return await this.tenantApi.getTenantDetails(e)}catch(t){this.handlePassflowError(t,`Get tenant details failed for tenant ID ${e}`)}}async getTenantUserMembership(e){try{return new Or(await this.tenantApi.getTenantDetails(e))}catch(t){this.handlePassflowError(t,`Get tenant user membership failed for tenant ID ${e}`)}}async updateTenant(e,t){try{return await this.tenantApi.updateTenant(e,t)}catch(t){this.handlePassflowError(t,`Update tenant failed for tenant ID ${e}`)}}async deleteTenant(e){try{return await this.tenantApi.deleteTenant(e)}catch(t){this.handlePassflowError(t,`Delete tenant failed for tenant ID ${e}`)}}async getUserTenantMembership(){try{return await this.tenantApi.getUserTenantMembership()}catch(e){this.handlePassflowError(e,`Get user tenant memberships failed`)}}async createGroup(e,t){try{return await this.tenantApi.createGroup(e,t)}catch(t){this.handlePassflowError(t,`Group creation failed for tenant ID ${e}`)}}async getGroupInfo(e,t){try{return await this.tenantApi.getGroupInfo(e,t)}catch(n){this.handlePassflowError(n,`Get group info failed for tenant ID ${e}, group ID ${t}`)}}async updateGroup(e,t,n){try{return await this.tenantApi.updateGroup(e,t,n)}catch(n){this.handlePassflowError(n,`Update group failed for tenant ID ${e}, group ID ${t}`)}}async deleteGroup(e,t){try{return await this.tenantApi.deleteGroup(e,t)}catch(n){this.handlePassflowError(n,`Delete group failed for tenant ID ${e}, group ID ${t}`)}}async addUserToGroup(e,t,n,r){try{return await this.tenantApi.addUserToGroup(e,t,n,r)}catch(r){this.handlePassflowError(r,`Add user to group failed for tenant ID ${e}, group ID ${t}, user ID ${n}`)}}async removeUserRolesFromGroup(e,t,n,r){try{return await this.tenantApi.removeUserRolesFromGroup(e,t,n,r)}catch(r){this.handlePassflowError(r,`Remove user roles from group failed for tenant ID ${e}, group ID ${t}, user ID ${n}`)}}async changeUserRoles(e,t,n,r){try{return await this.tenantApi.changeUserRoles(e,t,n,r)}catch(r){this.handlePassflowError(r,`Change user roles failed for tenant ID ${e}, group ID ${t}, user ID ${n}`)}}async deleteUserFromGroup(e,t,n){try{return await this.tenantApi.deleteUserFromGroup(e,t,n)}catch(r){this.handlePassflowError(r,`Delete user from group failed for tenant ID ${e}, group ID ${t}, user ID ${n}`)}}async getRolesForTenant(e){try{return await this.tenantApi.getRolesForTenant(e)}catch(t){this.handlePassflowError(t,`Get roles for tenant failed for tenant ID ${e}`)}}async createRoleForTenant(e,t){try{return await this.tenantApi.createRoleForTenant(e,t)}catch(t){this.handlePassflowError(t,`Create role for tenant failed for tenant ID ${e}`)}}async updateRole(e,t,n){try{return await this.tenantApi.updateRole(e,t,n)}catch(n){this.handlePassflowError(n,`Update role failed for tenant ID ${e}, role ID ${t}`)}}async deleteRole(e,t){try{return await this.tenantApi.deleteRole(e,t)}catch(n){this.handlePassflowError(n,`Delete role failed for tenant ID ${e}, role ID ${t}`)}}async deleteUserFromTenant(e,t){try{return await this.tenantApi.deleteUserFromTenant(e,t)}catch(n){this.handlePassflowError(n,`Delete user from tenant failed for tenant ID ${e}, user ID ${t}`)}}async getGroupInvitations(e,t,n,r){try{return await this.tenantApi.getGroupInvitations(e,t,n,r)}catch(n){this.handlePassflowError(n,`Get group invitations failed for tenant ID ${e}, group ID ${t}`)}}async getTenantInvitations(e,t,n){try{return await this.tenantApi.getTenantInvitations(e,t,n)}catch(t){this.handlePassflowError(t,`Get tenant invitations failed for tenant ID ${e}`)}}async invalidateInviteById(e,t,n){try{return await this.tenantApi.invalidateInviteById(e,t,n)}catch(r){this.handlePassflowError(r,`Invalidate invite by ID failed for tenant ID ${e}, group ID ${t}, invite ID ${n}`)}}async invalidateInviteByEmail(e,t,n){try{return await this.tenantApi.invalidateInviteByEmail(e,t,n)}catch(r){this.handlePassflowError(r,`Invalidate invite by email failed for tenant ID ${e}, group ID ${t}, email ${n}`)}}},Ar=class{constructor(e,t,n,r=L){this.storageManager=e,this.subscribeStore=n,this.platform=r,this.checkInterval=null,this.CHECK_INTERVAL=6e4,this.unsubscribeForeground=null,this.unsubscribeUnload=null,this.tokenExpiredFlag=!1,this.storageManager=e,this.setupLifecycleListeners()}get isRefreshing(){return this.refreshController?.busy??!1}attachRefreshController(e){this.refreshController=e}initialize(){try{let e=this.tokensCache,t=e??this.storageManager.getTokens();if(!t)return;if(!t.access_token){e||this.setTokensCache(t),this.startTokenCheck();return}A(j(t.access_token))?(this.stopTokenCheck(),this.tokenExpiredFlag||(this.tokenExpiredFlag=!0,this.subscribeStore.notify(Z.TokenCacheExpired,{isExpired:!0}))):(e||this.setTokensCache(t),this.startTokenCheck())}catch(e){let t={operation:`tokens.load`,message:e instanceof Error?e.message:`Failed to get tokens`,originalError:e};W(this.subscribeStore,t),this.setTokensCache(void 0)}}startTokenCheck(){this.checkInterval&&clearInterval(this.checkInterval),this.tokenExpiredFlag||(this.setupLifecycleListeners(),this.checkInterval=setInterval(()=>{this.platform.isInForeground()&&(this.isRefreshing||this.tokenExpiredFlag||this.isExpired()&&!this.tokenExpiredFlag&&(this.tokenExpiredFlag=!0,this.subscribeStore.notify(Z.TokenCacheExpired,{isExpired:!0}),this.stopTokenCheck()))},this.CHECK_INTERVAL))}setupLifecycleListeners(){this.unsubscribeForeground&&(this.unsubscribeForeground(),this.unsubscribeForeground=null),this.unsubscribeForeground=this.platform.onForeground(()=>{this.checkInterval&&!this.isRefreshing&&!this.tokenExpiredFlag&&this.isExpired()&&(this.tokenExpiredFlag=!0,this.subscribeStore.notify(Z.TokenCacheExpired,{isExpired:!0}),this.stopTokenCheck())}),this.unsubscribeUnload||(this.unsubscribeUnload=this.platform.onBeforeUnload(()=>{this.destroy()}))}stopTokenCheck(){this.checkInterval&&(clearInterval(this.checkInterval),this.checkInterval=null),this.unsubscribeForeground&&(this.unsubscribeForeground(),this.unsubscribeForeground=null)}destroy(){this.stopTokenCheck(),this.unsubscribeUnload&&(this.unsubscribeUnload(),this.unsubscribeUnload=null)}setTokensCache(e){this.tokensCache=e,this.parsedTokensCache=e?{access_token:e.access_token?j(e.access_token):void 0,id_token:e.id_token?j(e.id_token):void 0,refresh_token:e.refresh_token?j(e.refresh_token):void 0,scopes:e.scopes}:void 0}getTokens(){return this.tokensCache}async getTokensWithRefresh(){try{if(!this.tokensCache||!this.tokensCache.access_token)return this.tokensCache;if(A(j(this.tokensCache.access_token))&&this.refreshController)try{await this.refreshController.refresh({trigger:`token-check`})}catch{}return this.tokensCache}catch(e){let t={operation:`tokens.get`,message:e instanceof Error?e.message:`Failed to get tokens`,originalError:e};W(this.subscribeStore,t);return}}getParsedTokens(){return this.parsedTokensCache}isExpired(){return this.tokensCache?this.tokensCache.access_token?A(j(this.tokensCache.access_token)):!1:!0}},jr=class{constructor(e,t,n){this.twoFactorApi=e,this.subscribeStore=t,this.signInCompleter=n,this.PARTIAL_AUTH_TIMEOUT_MS=3e5,this.SESSION_STORAGE_KEY=`passflow_2fa_challenge`,this.totpDigits=6,this.subscribeStore.subscribe({onAuthChange:(e,t)=>{if(e===Z.TwoFactorRequired){let e=t;this.setPartialAuthState(e.email,e.challengeId,e.tfaToken)}(e===Z.SignIn||e===Z.Register)&&this.clearPartialAuthState()}},[Z.TwoFactorRequired,Z.SignIn,Z.Register])}emitErrorAndThrow(e,t,n){let r=e,i={operation:t,message:e instanceof Error?e.message:`${n} failed`,originalError:e,code:r?.id||void 0};throw W(this.subscribeStore,i),e}async getStatus(){try{let e=await this.twoFactorApi.getStatus();return e.totp_digits&&(this.totpDigits=e.totp_digits),e}catch(e){this.emitErrorAndThrow(e,`2fa.status`,`Get 2FA status`)}}async beginSetup(){try{let e=await this.twoFactorApi.beginSetup();return e.totp_digits&&(this.totpDigits=e.totp_digits),this.subscribeStore.notify(Z.TwoFactorSetupStarted,{secret:e.secret}),e}catch(e){this.emitErrorAndThrow(e,`2fa.setup.begin`,`Begin 2FA setup`)}}async confirmSetup(e){if(!Sr(e,this.totpDigits))throw Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);try{let t=await this.twoFactorApi.confirmSetup({code:e});return this.subscribeStore.notify(Z.TwoFactorEnabled,{recoveryCodes:t.recovery_codes,clearRecoveryCodes:()=>{t.recovery_codes.length=0}}),t}catch(e){this.emitErrorAndThrow(e,`2fa.setup.confirm`,`Confirm 2FA setup`)}}async verify(e,t){if(!Sr(e,this.totpDigits))throw Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);if(this.recoverPartialAuthState(),!this.isVerificationRequired())throw Error(`2FA verification expired or not required. User must sign in first.`);if(!this.partialAuthState?.tfaToken)throw Error(`No TFA token found. User must sign in first.`);try{let n=await this.twoFactorApi.verify({code:e,tfa_token:this.partialAuthState.tfaToken,...t?.trustDevice?{trust_device:!0}:{}}),r=await this.finishSignIn(n);return this.subscribeStore.notify(Z.TwoFactorVerified,{tokens:r}),r}catch(e){this.emitErrorAndThrow(e,`2fa.verify`,`Verify 2FA code`)}}async useRecoveryCode(e,t){try{let n=Cr(e);if(!n)throw Error(`Invalid recovery code format. Expected format: XXXX-XXXX or XXXXXXXX (alphanumeric).`);if(this.recoverPartialAuthState(),!this.isVerificationRequired())throw Error(`2FA verification expired or not required. User must sign in first.`);if(!this.partialAuthState?.tfaToken)throw Error(`No TFA token found. User must sign in first.`);let r=await this.finishSignIn(await this.twoFactorApi.useRecoveryCode({recovery_code:n,tfa_token:this.partialAuthState.tfaToken,...t?.trustDevice?{trust_device:!0}:{}}));return r.remaining_recovery_codes===0?this.subscribeStore.notify(Z.TwoFactorRecoveryCodesExhausted,{tokens:r}):r.remaining_recovery_codes<=2&&this.subscribeStore.notify(Z.TwoFactorRecoveryCodesLow,{tokens:r,remainingCodes:r.remaining_recovery_codes}),this.subscribeStore.notify(Z.TwoFactorRecoveryUsed,{tokens:r,remainingCodes:r.remaining_recovery_codes}),this.subscribeStore.notify(Z.TwoFactorVerified,{tokens:r}),r}catch(e){this.emitErrorAndThrow(e,`2fa.recovery.use`,`Use recovery code`)}}async disable(e){if(!Sr(e,this.totpDigits))throw Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);try{let t=await this.twoFactorApi.disable({code:e});return this.subscribeStore.notify(Z.TwoFactorDisabled,{}),t}catch(e){this.emitErrorAndThrow(e,`2fa.disable`,`Disable 2FA`)}}async regenerateRecoveryCodes(e){if(!Sr(e,this.totpDigits))throw Error(`Invalid TOTP code format. Code must be exactly ${this.totpDigits} digits.`);try{let t=await this.twoFactorApi.regenerateRecoveryCodes({code:e}),n=[...t.recovery_codes];return t.recovery_codes=[],t.recovery_codes=n,t}catch(e){this.emitErrorAndThrow(e,`2fa.recovery.regenerate`,`Regenerate recovery codes`)}}isVerificationRequired(){return this.recoverPartialAuthState(),this.partialAuthState?Date.now()>this.partialAuthState.expiresAt?(this.clearPartialAuthState(),!1):!0:!1}setPartialAuthState(e,t,n){if(this.partialAuthState={email:e,challengeId:t,tfaToken:n,timestamp:Date.now(),expiresAt:Date.now()+this.PARTIAL_AUTH_TIMEOUT_MS},typeof sessionStorage<`u`)try{sessionStorage.setItem(this.SESSION_STORAGE_KEY,JSON.stringify(this.partialAuthState))}catch{}}clearPartialAuthState(){if(this.partialAuthState=void 0,this.signInCompleter?.forgetPkceSignIn(),typeof sessionStorage<`u`)try{sessionStorage.removeItem(this.SESSION_STORAGE_KEY)}catch{}}async finishSignIn(e){let{code:t,...n}=e;if(t&&!this.signInCompleter?.hasPendingPkceSignIn()){this.clearPartialAuthState();let e=Error(`The sign-in answered with a PKCE code, but its verifier is gone`);throw e.id=`PKCE_VERIFIER_MISSING`,e}let r=e;if(t&&this.signInCompleter){let e=await this.signInCompleter.completePkceSignIn(t);r={...n,...e}}else await this.signInCompleter?.applyTokens(r);return this.clearPartialAuthState(),r}pendingTfaToken(){return this.isVerificationRequired()&&this.partialAuthState?.tfaToken||void 0}recoverPartialAuthState(){if(!this.partialAuthState&&typeof sessionStorage<`u`)try{let e=sessionStorage.getItem(this.SESSION_STORAGE_KEY);if(!e)return;let t=JSON.parse(e);Date.now()<t.expiresAt?this.partialAuthState=t:sessionStorage.removeItem(this.SESSION_STORAGE_KEY)}catch{try{sessionStorage.removeItem(this.SESSION_STORAGE_KEY)}catch{}}}async validateTwoFactorSetupMagicLink(e){let t=await this.twoFactorApi.validateTwoFactorSetupMagicLink(e);return t.success&&t.sessionToken&&t.userId?(this.magicLinkSession={sessionToken:t.sessionToken,userId:t.userId,appId:t.appId,scope:`2fa_setup`,timestamp:Date.now(),expiresAt:Date.now()+(t.expiresIn||3600)*1e3},this.subscribeStore.notify(Z.TwoFactorSetupMagicLinkValidated,{userId:t.userId,appId:t.appId,expiresIn:t.expiresIn||3600,sessionToken:t.sessionToken})):t.error&&this.subscribeStore.notify(Z.TwoFactorSetupMagicLinkFailed,{error:t.error}),t}getMagicLinkSession(){return this.magicLinkSession?Date.now()>this.magicLinkSession.expiresAt?(this.clearMagicLinkSession(),null):this.magicLinkSession:null}clearMagicLinkSession(){this.magicLinkSession=void 0}hasMagicLinkSession(){return this.getMagicLinkSession()!==null}getMagicLinkSessionToken(){return this.getMagicLinkSession()?.sessionToken||null}getTotpDigits(){return this.totpDigits}async getAvailableMethods(){try{return await this.twoFactorApi.getAvailableMethods()}catch(e){this.emitErrorAndThrow(e,`2fa.methods.available`,`Get available 2FA methods`)}}async getRegisteredMethods(){try{return await this.twoFactorApi.getRegisteredMethods()}catch(e){this.emitErrorAndThrow(e,`2fa.methods.registered`,`Get registered 2FA methods`)}}async startMethodSetup(e,t){try{let n=await this.twoFactorApi.startMethodSetup(e,t);return this.subscribeStore.notify(Z.TwoFactorSetupStarted,{secret:``,method:e}),n}catch(e){this.emitErrorAndThrow(e,`2fa.method.setup.start`,`Start 2FA method setup`)}}async completeMethodSetup(e,t){try{let n=await this.twoFactorApi.completeMethodSetup(e,t);return this.subscribeStore.notify(Z.TwoFactorEnabled,{recoveryCodes:[],clearRecoveryCodes:()=>{}}),n}catch(e){this.emitErrorAndThrow(e,`2fa.method.setup.complete`,`Complete 2FA method setup`)}}async removeMethod(e){try{await this.twoFactorApi.removeMethod(e)}catch(e){this.emitErrorAndThrow(e,`2fa.method.remove`,`Remove 2FA method`)}}async requestChallenge(e){try{let t=await this.twoFactorApi.requestChallenge(e,this.pendingTfaToken());return this.subscribeStore.notify(Z.TwoFactorChallengeReceived,{challengeId:t.challenge_id,method:t.method,alternativeMethods:t.alternative_methods}),t}catch(e){this.emitErrorAndThrow(e,`2fa.challenge.request`,`Request 2FA challenge`)}}async verifyV2(e){try{let t=await this.twoFactorApi.verifyV2(e,this.pendingTfaToken());if(!t.success)return t;let n=await this.finishSignIn(t);return this.subscribeStore.notify(Z.TwoFactorVerified,{tokens:{access_token:n.access_token,refresh_token:n.refresh_token}}),n.device_trusted&&this.subscribeStore.notify(Z.TwoFactorDeviceTrusted,{}),n}catch(e){this.emitErrorAndThrow(e,`2fa.challenge.verify`,`Verify 2FA challenge`)}}async switchToAlternative(e){try{let t=await this.twoFactorApi.switchToAlternative(e,this.pendingTfaToken());return this.subscribeStore.notify(Z.TwoFactorMethodSwitched,{challengeId:t.challenge_id,method:t.method,alternativeMethods:t.alternative_methods}),t}catch(e){this.emitErrorAndThrow(e,`2fa.method.switch`,`Switch to alternative 2FA method`)}}async getTrustedDevices(){try{return await this.twoFactorApi.getTrustedDevices()}catch(e){this.emitErrorAndThrow(e,`2fa.trusted-devices.list`,`Get trusted devices`)}}async revokeTrustedDevice(e){try{await this.twoFactorApi.revokeTrustedDevice(e)}catch(e){this.emitErrorAndThrow(e,`2fa.trusted-devices.revoke`,`Revoke trusted device`)}}},Mr=class{constructor(e,t,n=L){this.userAPI=e,this.deviceService=t,this.platform=n}getUserPasskeys(){return this.userAPI.getUserPasskeys()}renameUserPasskey(e,t){return this.userAPI.renameUserPasskey(e,t)}deleteUserPasskey(e){return this.userAPI.deleteUserPasskey(e)}async addUserPasskey({relyingPartyId:e,passkeyUsername:t,passkeyDisplayName:n}={}){if(!this.platform.passkeys)throw Error(`Passkeys are not supported on this platform`);let r=this.deviceService.getDeviceId(),i=Re(this.platform.getDeviceType()),{challenge_id:a,publicKey:o}=await this.userAPI.addUserPasskeyStart({relyingPartyId:(e||this.platform.getCurrentUrl()?.hostname)??``,deviceId:r,os:i,passkeyDisplayName:n,passkeyUsername:t});o.user.id=this.platform.btoa(o.user.id);let s=await this.platform.passkeys.startRegistration(o);if(!s)throw Error(`Passkey registration was not completed`);return await this.userAPI.addUserPasskeyComplete(s,r,a)}},Nr=class extends Error{constructor(e,t,n=!1){super(t),this.name=`UpgradeFactorError`,this.factor=e,this.cancelled=n}},Pr=(e,t)=>{let n=t?.trim();if(!n)throw new Nr(e,`A verification code is required`);return n},Fr={type:`totp`,requiresPrepare:!1,input:`code`,assert:async({code:e})=>({code:Pr(`totp`,e)})},Ir={type:`recovery_codes`,requiresPrepare:!1,input:`code`,assert:async({code:e})=>({code:Pr(`recovery_codes`,e)})},Lr={type:`passkey`,requiresPrepare:!0,input:`none`,assert:async({prepared:e,platform:t})=>{if(!e?.webauthn)throw new Nr(`passkey`,`The upgrade challenge carried no WebAuthn options`);let n=t.passkeys;if(!n)throw new Nr(`passkey`,`This platform does not support passkeys`);let r;try{r=await n.startAuthentication(e.webauthn)}catch(e){throw new Nr(`passkey`,e?.message||`Passkey verification was cancelled`,!0)}if(!r)throw new Nr(`passkey`,`Passkey verification was cancelled`,!0);return{challenge_id:e.challengeId,credential:r}}},Rr=Object.freeze([Fr,Lr,Ir]),zr=(e=Rr)=>new Map(e.map(e=>[e.type,e])),Br=3,Vr={passkey:0,totp:1,email_otp:2,sms_otp:3,recovery_codes:9},Hr=e=>e.requiredLevel??fe(e.acrValues),Ur=(e,t)=>{let n=Vr[e.type]??5,r=t!==void 0&&t>=Br,i=e.type===`passkey`;return(r&&!i?100:0)+n},Wr=(e,t)=>{let n=Hr(t);return[...e].sort((e,t)=>Ur(e,n)-Ur(t,n))},Gr=class extends Error{constructor(e){super(`Upgrade authentication was cancelled`),this.code=`upgrade_cancelled`,this.name=`UpgradeCancelledError`,e!==void 0&&(this.cause=e)}},Kr=class extends Error{constructor(e=`No available authentication factor can satisfy this challenge`){super(e),this.code=`upgrade_unsatisfiable`,this.name=`UpgradeUnsatisfiableError`}},qr=4,Jr=3e4,Yr=()=>{let e=()=>void 0,t=()=>void 0;return{promise:new Promise((n,r)=>{e=n,t=r}),resolve:e,reject:t}},Xr=e=>({acrValues:e.acrValues,level:e.requiredLevel,maxAge:e.maxAge}),Zr=(e,t)=>t.level===void 0||e.level!==void 0&&e.level>=t.level,Qr=(e,t)=>{let n=e.requiredLevel===void 0?t.requiredLevel:t.requiredLevel===void 0?e.requiredLevel:Math.max(e.requiredLevel,t.requiredLevel),r=n===void 0?e.acrValues??t.acrValues:n===e.requiredLevel?e.acrValues:t.acrValues,i=e.maxAge===void 0?t.maxAge:t.maxAge===void 0?e.maxAge:Math.min(e.maxAge,t.maxAge),a=Array.from(new Set([...e.channels??[],...t.channels??[]]));return{acrValues:r,requiredLevel:n,maxAge:i,status:e.status,...a.length>0?{channels:a}:{}}},$r=(e,t)=>{let n=t.requiredLevel!==void 0&&(e.requiredLevel===void 0||t.requiredLevel>e.requiredLevel),r=t.maxAge!==void 0&&(e.maxAge===void 0||t.maxAge<e.maxAge);return n||r},ei=class{constructor(e){this.state=`idle`,this.inFlight=null,this.requirement=null,this.selected=null,this.rankedRequirement=null,this.registrations=[],this.proof=null,this.pruned=new Set,this.openPrompt=null,this.transport=e.transport,this.prompt=e.prompt,this.platform=e.platform,this.available=e.factors??Rr,this.registry=zr(this.available),this.maxAttempts=e.maxAttempts??qr,this.readObtainedBar=e.readObtainedBar,this.onFlightSettled=e.onFlightSettled,this.settleTimeoutMs=e.replaySettleTimeoutMs??Jr}get currentState(){return this.state}get active(){return this.inFlight!==null}elevate(e,t={kind:`imperative`}){let n=this.register(e,t);if(this.state===`idle`)this.state=`collecting`,this.requirement=e,this.inFlight=this.runFlight();else{this.join(e);let t=this.proof;t?.status===`proven`?this.release(n,t.obtained):t?.status===`failed`&&(this.receiveReport(n,{outcome:`failed`}),n.settlement.reject(t.reason))}return n.settlement.promise}register(e,t){let n=t.kind===`imperative`&&t.requested!==void 0,r={demanded:t.kind===`imperative`&&t.requested?t.requested:Xr(e),statedBar:n,settlement:Yr(),reported:!1,entry:{...t,outcome:`pending`,report:e=>this.receiveReport(r,e)}};return this.registrations.push(r),r}join(e){let t=this.requirement;if(!t){this.requirement=e;return}let n=$r(t,e);this.requirement=Qr(t,e),n&&this.state===`collecting`&&this.selected===null&&this.openPrompt?.onRequirementRaised?.({challenge:this.requirement,factors:this.offeredFactors()})}offeredFactors(){let e=this.available.filter(e=>!this.pruned.has(e.type)),t=this.requirement;return t?Wr(e,t):e}receiveReport(e,t){e.reported||(e.reported=!0,e.entry.outcome=t.outcome,t.obtained&&(e.entry.obtained=t.obtained),t.required&&(e.entry.required=t.required),this.notifyReportsSettled())}notifyReportsSettled(){if(!this.reportsSettled||this.registrations.some(e=>!e.reported))return;let e=this.reportsSettled;this.reportsSettled=void 0,e()}async runFlight(){let e;try{e=await this.prove()}catch(t){e={status:`failed`,reason:t instanceof Error?t:Error(String(t))}}if(this.proof=e,e.status===`failed`)for(let t of this.registrations)this.receiveReport(t,{outcome:`failed`}),t.settlement.reject(e.reason);else{this.state=`replaying`;for(let t of this.registrations)this.release(t,e.obtained);await this.awaitReports()}this.state=`settling`;let t=this.summarise(e);try{this.onFlightSettled?.(t)}catch{}this.state=`done`,this.inFlight=null,this.requirement=null,this.selected=null,this.rankedRequirement=null,this.registrations=[],this.proof=null,this.pruned=new Set,this.openPrompt=null,this.reportsSettled=void 0,this.state=`idle`}release(e,t){if(e.entry.kind===`imperative`){if(e.statedBar&&!Zr(t,e.demanded)){this.receiveReport(e,{outcome:`insufficient`,obtained:t,required:e.demanded}),e.settlement.reject(new fr(t,e.demanded));return}this.receiveReport(e,{outcome:`replayed`,obtained:t}),e.settlement.resolve({waiter:e.entry,obtained:t})}else e.settlement.resolve({waiter:e.entry,obtained:t})}awaitReports(){return this.registrations.some(e=>!e.reported)?new Promise(e=>{let t=setTimeout(()=>{this.reportsSettled=void 0;for(let e of this.registrations)e.reported||(e.reported=!0,e.entry.outcome=`failed`);e()},this.settleTimeoutMs);this.reportsSettled=()=>{clearTimeout(t),e()}}):Promise.resolve()}summarise(e){let t=this.registrations.map(e=>({...e.entry.kind===`request`?{url:e.entry.url,method:e.entry.method}:{},outcome:e.entry.outcome,...e.entry.obtained?{obtained:e.entry.obtained}:{},...e.entry.required?{required:e.entry.required}:{}}));if(e.status===`failed`)return{proof:e,waiters:t,terminal:`failed`,error:e.reason};let n;for(let e of t){if(e.outcome!==`insufficient`)continue;let t=e.required?.level??0;(!n||t>(n.required?.level??0))&&(n=e)}return n?{proof:e,waiters:t,terminal:`insufficient`,insufficient:{obtained:n.obtained??e.obtained,required:n.required??{}}}:t.some(e=>e.outcome===`failed`||e.outcome===`pending`)?{proof:e,waiters:t,terminal:`failed`}:{proof:e,waiters:t,terminal:`success`}}async prove(){let e;for(let t=0;t<this.maxAttempts;t++){let t=this.offeredFactors();if(t.length===0)return{status:`failed`,reason:new Kr};let n=this.requirement,r;try{r=await this.collect(n,t,e)}catch(e){return{status:`failed`,reason:new Gr(e)}}if(r.type===`cancel`)return{status:`failed`,reason:new Gr};let i=this.registry.get(r.factor);if(!i)e=new Kr(`Unknown authentication factor: ${r.factor}`),this.state=`collecting`,this.selected=null;else try{return await this.proveAndCommit(i,r.code),{status:`proven`,obtained:this.readObtainedBar?.()??Xr(this.rankedRequirement??n)}}catch(t){if(t instanceof Nr&&t.cancelled)return{status:`failed`,reason:new Gr};let n=this.classifyProofFailure(t);if(n)return{status:`failed`,reason:n};t instanceof $&&t.kind===`not_registered`&&this.pruned.add(i.type),e=t,this.state=`collecting`,this.selected=null}}return{status:`failed`,reason:new $({kind:`attempts_exhausted`,...e?{cause:e}:{}})}}collect(e,t,n){let r={challenge:e,factors:t,...n?{previousError:n}:{},onFactorSelected:e=>{this.state===`collecting`&&(this.state=`proving`),this.selected=e,this.rankedRequirement=this.requirement}};return this.openPrompt=r,this.prompt(r)}classifyProofFailure(e){if(e instanceof fr||e instanceof pr||e instanceof mr)return e;if(e instanceof $)switch(e.kind){case`unavailable`:return new pr(e.message);case`exhausted`:case`attempts_exhausted`:case`fatal`:case`protocol`:case`network`:return e;case`session_changed`:return new mr(e.message);default:return}}async proveAndCommit(e,t){let n=e.requiresPrepare?await this.transport.prepare(e.type):void 0,r=await e.assert({code:t,prepared:n,platform:this.platform});await this.transport.commit(e.type,r)}},ti=e=>typeof e==`function`?e():e,ni=e=>{try{return new URL(e)}catch{return}},ri=(e,t)=>{if(!t||t===`/`)return!0;let n=t.replace(/\/+$/,``);return e===n||e.startsWith(`${n}/`)},ii=(e,t)=>!t||e.origin===void 0?!1:e.origin===t.origin&&ri(e.pathname,t.pathPrefix),ai=(e,t)=>{for(let n of t){if(n===``)continue;if(n.startsWith(`/`)){if(e.relativeToBase&&ri(e.pathname,n))return!0;continue}let t=ni(n)??ni(`https://${n}`);if(t&&e.origin!==void 0&&e.origin===t.origin&&ri(e.pathname,t.pathname))return!0}return!1},oi=(e,t,n)=>ii(e,t.passflow)||ai(e,t.backend)?!n||n(e.href)!==!1:!1,si=e=>{let t=e.detail,n=t?.message??`[passflow] upgrade challenge not actioned: ${e.reason}`;console.warn(n,{status:e.status,url:e.url,reason:e.reason,detail:t})},ci=(e,t)=>{let n=t.onUpgradeDiagnostic??si;return(t,r)=>{n({status:e.status,url:e.request.href,reason:t,detail:{method:e.request.method,...r??{}}})}},li=(e,t,n)=>{let r=n.onUpgradeDiagnostic??si;for(let n of e)r({...n,url:t.request.href,detail:{method:t.request.method,...n.detail??{}}})},ui=/\bjson\b/i,di=async(e,t)=>{let n=t.requireChallengeChannel===`header`,r=e.getHeader(`content-type`)??``,i=!n&&ui.test(r),a;if(i)try{a=await e.readBody()}catch{a=void 0}return we(i?{status:e.status,getHeader:t=>e.getHeader(t)??void 0,body:a}:{status:e.status,getHeader:t=>e.getHeader(t)??void 0},{requireChallengeChannel:t.requireChallengeChannel})},fi=e=>we({status:e.status,getHeader:t=>e.getHeader(t)??void 0},{requireChallengeChannel:`header`}).challenge,pi=(e,t)=>t.passflow===null?`[passflow] a 401/403 from ${e} carried an upgrade challenge, but no Passflow endpoint is configured — set \`url\` on the Passflow config.`:`[passflow] a 401/403 from ${e} carried an upgrade challenge, but that URL is not covered by the provider's \`backend\` prop — add it there to enable step-up for this API.`,mi=(e,t)=>e instanceof Gr?{kind:`cancelled`}:e instanceof Kr?{kind:`unsatisfiable`}:e instanceof pr?{kind:`unavailable`}:e instanceof mr?{kind:`session-changed`}:e instanceof fr?{kind:`insufficient`,obtained:e.obtained,required:e.required}:e instanceof $?e.kind===`exhausted`||e.kind===`attempts_exhausted`?{kind:`exhausted`,error:e}:e.kind===`unavailable`?{kind:`unavailable`}:e.kind===`session_changed`?{kind:`session-changed`}:{kind:`transport-failure`,status:e.status,retryable:e.retryable,error:e}:{kind:`transport-failure`,retryable:!1,error:e instanceof Error?e:Error(String(e))},hi=async(e,t,n,r)=>{if(e.status!==401&&e.status!==403)return{kind:`replayed`,response:e};let{challenge:i,diagnostics:a}=await di(e,t);if(li(a,e,t),!i)return{kind:`replayed`,response:e};let o=Xr(i);return r(`elevated-insufficient`,{obtained:n,required:o}),{kind:`insufficient`,obtained:n,required:o,response:e}},gi=async(e,t)=>{if(!t)return{aborted:!1,value:await e};if(t.aborted)return{aborted:!0,reason:t.reason};if(typeof t.addEventListener!=`function`)return{aborted:!1,value:await e};let n,r=new Promise(e=>{n=()=>e({aborted:!0,reason:t.reason}),t.addEventListener?.(`abort`,n)});try{return await Promise.race([e.then(e=>({aborted:!1,value:e})),r])}finally{n&&t.removeEventListener?.(`abort`,n)}},_i=async(e,t)=>{if(e.status!==401&&e.status!==403||e.markers.upgradeTransaction)return{kind:`not-a-challenge`};let n=ci(e,t);if(e.markers.replayed){if(!oi(e.request,t.scope,t.shouldIntercept))return{kind:`not-a-challenge`};let{challenge:r,diagnostics:i}=await di(e,t);if(li(i,e,t),!r)return{kind:`not-a-challenge`};let a=t.readObtainedBar?.()??{},o=Xr(r);return n(`elevated-insufficient`,{obtained:a,required:o}),{kind:`insufficient`,obtained:a,required:o,response:e}}if(!oi(e.request,t.scope,t.shouldIntercept))return fi(e)?(n(`challenge-out-of-scope`,{header:e.getHeader(`www-authenticate`)??void 0,message:pi(e.request.href,t.scope)}),{kind:`out-of-scope`}):{kind:`not-a-challenge`};let{challenge:r,diagnostics:i}=await di(e,t);if(li(i,e,t),!r){let r=e.getHeader(`www-authenticate`);return t.requireChallengeChannel!==`header`&&n(`no-channel`,{...r?{header:r}:{},message:e.responseType===`cors`&&!r?`[passflow] a cross-origin ${e.status} from ${e.request.href} carried no readable challenge: \`WWW-Authenticate\` is not CORS-safelisted, so add \`Access-Control-Expose-Headers: WWW-Authenticate\` on that server, or have it emit the \`upgrade_required\` JSON body.`:`[passflow] a ${e.status} from ${e.request.href} carried no upgrade challenge on either channel; treated as an ordinary ${e.status}.`}),{kind:`not-a-challenge`}}if(e.replayable===!1)return n(`replay-unsupported`,{message:`[passflow] a ${e.status} from ${e.request.href} carried an upgrade challenge, but the request cannot be replayed (${e.replayUnsupportedReason??`unsupported body`}), so no prompt was opened.`}),{kind:`replay-unsupported`};let a=t.authorizationSwap?.(),o={kind:`request`,url:e.request.href,method:e.request.method},s,c;try{s=Promise.resolve(t.elevate(r,o)),c=await gi(s,e.signal)}catch(e){return mi(e,void 0)}if(c.aborted)return s?.then(e=>e?.waiter.report({outcome:`failed`}),()=>{}),{kind:`aborted`,reason:c.reason};let l=c.value;if(e.signal?.aborted)return l?.waiter.report({outcome:`failed`}),{kind:`aborted`,reason:e.signal.reason};let u=l?.obtained??t.readObtainedBar?.()??Xr(r),d=t.authorizationSwap?.(),f=d?{from:a?.from??d.from,to:d.to}:void 0;e.markers.replayed=!0;let p;try{p=await e.replay(f?{authorizationSwap:f}:void 0)}catch(t){if(t instanceof fr)return l?.waiter.report({outcome:`insufficient`,obtained:t.obtained,required:t.required}),e.signal?.aborted?{kind:`aborted`,reason:e.signal.reason}:{kind:`insufficient`,obtained:t.obtained,required:t.required};if(l?.waiter.report({outcome:`failed`}),e.signal?.aborted)return{kind:`aborted`,reason:e.signal.reason};throw t}let m=await hi(p,t,u,n);return m.kind===`insufficient`?l?.waiter.report({outcome:`insufficient`,obtained:m.obtained,required:m.required}):l?.waiter.report({outcome:`replayed`,obtained:u}),m},vi=e=>{switch(e.kind){case`cancelled`:return new Gr;case`unsatisfiable`:return new Kr;case`unavailable`:return new pr;case`session-changed`:return new mr;case`insufficient`:return new fr(e.obtained,e.required);case`exhausted`:return e.error;case`transport-failure`:return e.error;default:return}},yi=(e,t,n)=>{switch(e.kind){case`replayed`:return{settle:`resolve`,value:e.response.raw};case`not-a-challenge`:case`out-of-scope`:case`replay-unsupported`:return{settle:`resolve`,value:t};case`aborted`:return{settle:`reject`,error:e.reason};case`cancelled`:return n.onCancel===`reject`?{settle:`reject`,error:new Gr}:{settle:`resolve`,value:Oi(t,e)};case`insufficient`:return{settle:`resolve`,value:Oi(e.response?.raw??t,e)};default:return{settle:`resolve`,value:Oi(t,e)}}},bi=(e,t)=>{switch(e.kind){case`replayed`:return e.response.rejected?{settle:`reject`,error:e.response.raw??t}:{settle:`resolve`,value:e.response.raw};case`aborted`:return{settle:`reject`,error:e.reason};default:return{settle:`reject`,error:vi(e)??t}}},xi=new WeakSet,Si=new WeakSet,Ci=new WeakSet,wi=new WeakSet,Ti=new WeakSet,Ei=new WeakSet,Di=new WeakSet,Oi=(e,t)=>{switch(t.kind){case`cancelled`:xi.add(e);break;case`exhausted`:Si.add(e);break;case`insufficient`:Ci.add(e);break;case`unsatisfiable`:wi.add(e);break;case`unavailable`:Ti.add(e);break;case`session-changed`:Ei.add(e);break;case`transport-failure`:Di.add(e)}return e},ki=e=>xi.has(e),Ai=e=>Si.has(e),ji=e=>Ci.has(e),Mi=e=>wi.has(e),Ni=e=>Ti.has(e),Pi=e=>Ei.has(e),Fi=e=>Di.has(e),Ii=`https://passflow-relative.invalid`,Li=()=>{let e=globalThis,t=e.document?.baseURI;if(typeof t==`string`&&t!==``)return t;let n=e.location?.href;return typeof n==`string`&&n!==``&&n!==`about:blank`?n:Ii},Ri=(e,t=Li())=>{let n=t===Ii,r;try{r=new URL(t).origin}catch{r=void 0}let i;try{i=new URL(e,t)}catch{i=void 0}return i?{href:i.href,origin:i.origin,pathname:i.pathname,resolved:!0,relativeToBase:r!==void 0&&i.origin===r,sentinelBase:n}:{href:e,pathname:e.split(/[?#]/)[0]??e,resolved:!1,relativeToBase:!1,sentinelBase:n}},zi=(e,t)=>typeof t==`string`?[e.toLowerCase(),t]:void 0,Bi=e=>{let t=[];if(e==null)return Object.freeze(t);let n=e;if(typeof n.forEach==`function`&&typeof n.entries==`function`)return e.forEach((e,n)=>{let r=zi(n,e);r&&t.push(r)}),Object.freeze(t);if(Array.isArray(e)){for(let n of e)if(Array.isArray(n)&&n.length>=2){let e=zi(String(n[0]),n[1]);e&&t.push(e)}return Object.freeze(t)}if(typeof e==`object`)for(let[n,r]of Object.entries(e)){let e=zi(n,Array.isArray(r)?r.join(`, `):r);e&&t.push(e)}return Object.freeze(t)},Vi=e=>{let t=e.base===void 0?Ri(e.url):Ri(e.url,e.base),n={raw:e.url,href:t.href,dispatchUrl:t.sentinelBase||!t.resolved?e.url:t.href,...t.origin===void 0?{}:{origin:t.origin},pathname:t.pathname,resolved:t.resolved,relativeToBase:t.relativeToBase,method:(e.method??`GET`).toUpperCase(),headers:Bi(e.headers),bodyKind:e.bodyKind,...`body`in e?{body:e.body}:{}};return Object.freeze(n)},Hi=(e,t)=>{if(!t||t.from===t.to)return e;let n=!1,r=e.map(([e,r])=>e===`authorization`&&r===t.from?(n=!0,[e,t.to]):[e,r]);return n?Object.freeze(r):e},Ui=e=>{let t={};for(let[n,r]of e)t[n]=r;return t},Wi=new Set([`GET`,`HEAD`,`OPTIONS`]),Gi=e=>typeof e==`object`&&!!e&&typeof e.url==`string`&&typeof e.clone==`function`&&`method`in e,Ki=e=>typeof e==`string`?e:Gi(e)?e.url:String(e),qi=(e,t)=>(t?.method??(Gi(e)?e.method:void 0)??`GET`).toUpperCase(),Ji=e=>e==null?`none`:typeof e==`string`?`reusable`:typeof e.getReader==`function`?`one-shot`:`reusable`,Yi=e=>{if(typeof e==`string`)return e.length;let t=e;if(typeof t?.size==`number`)return t.size;if(typeof t?.byteLength==`number`)return t.byteLength},Xi=(e,t,n)=>e===void 0||e===`always`?!0:e===`idempotent-only`?Wi.has(t.method):typeof e==`function`?e(t):!(e.maxBodyBytes!==void 0&&n!==void 0&&n>e.maxBodyBytes),Zi=(e,t,n,r,i)=>({replayable:!1,bodyKind:e,reason:t,forwardInput:n,forwardInit:i,snapshot:r,replay:()=>Promise.reject(Error(`This request cannot be replayed: ${t}`))}),Qi=(e,t)=>Ui(Hi(e.headers,t?.authorizationSwap)),$i=e=>{if(!e||!(`headers`in e))return e;let{headers:t,...n}=e;return n},ea=(e,t)=>t&&`headers`in t&&t.headers!==void 0?t.headers:Gi(e)?e.headers:void 0,ta=e=>{if(e===null||typeof e==`string`)return e;if(typeof FormData<`u`&&e instanceof FormData){let t=new FormData;for(let[n,r]of e)t.append(n,r);return t}return typeof URLSearchParams<`u`&&e instanceof URLSearchParams?new URLSearchParams(e):e instanceof ArrayBuffer?e.slice(0):ArrayBuffer.isView(e)?new Uint8Array(e.buffer,e.byteOffset,e.byteLength).slice():e},na=(e,t,n)=>new Request(e,{headers:Qi(t,n)}),ra=(e,t,n)=>{let r=Ki(e),i=qi(e,t),a=ea(e,t),o=(e,t)=>Vi({url:r,method:i,headers:a,bodyKind:e,...t===void 0?{}:{body:t}});if(Gi(e)){if(e.body===null||e.body===void 0){let a=o(`none`);return Xi(n,{url:r,method:i,bodyKind:`none`})?{replayable:!0,bodyKind:`none`,forwardInput:e,forwardInit:t,snapshot:a,replay:(n,r)=>n(na(e,a,r),$i(t))}:Zi(`none`,`the replay policy refused this request`,e,a,t)}let a=o(`request-clone`);if(!Xi(n,{url:r,method:i,bodyKind:`request-clone`}))return Zi(`request-clone`,`the replay policy refused this request`,e,a,t);let s;try{s=e.clone()}catch{return Zi(`one-shot`,`the Request body was already consumed and cannot be cloned`,e,a,t)}return{replayable:!0,bodyKind:`request-clone`,forwardInput:e,forwardInit:t,snapshot:a,replay:(e,n)=>e(na(s,a,n),$i(t))}}let s=Ji(t?.body);if(s===`one-shot`)return Zi(`one-shot`,`a streaming request body is consumed by the first send`,e,o(`one-shot`),t);if(!Xi(n,{url:r,method:i,bodyKind:s},Yi(t?.body)))return Zi(s,`the replay policy refused this request`,e,o(s),t);let c=t&&`body`in t?ta(t.body??null):void 0,l=o(s,c);return{replayable:!0,bodyKind:s,forwardInput:e,forwardInit:t,snapshot:l,replay:(e,n)=>e(l.dispatchUrl,{...$i(t),...c===void 0?{}:{body:c},headers:Qi(l,n),method:l.method})}},ia=e=>typeof e==`object`&&!!e,aa=e=>t=>{if(!ia(e))return;let n=e[t]??e[t.toLowerCase()]??(typeof e.get==`function`?e.get(t):void 0);return Array.isArray(n)?n.join(`, `):typeof n==`string`?n:void 0},oa=e=>{let t=e?.url??``,n=e?.baseURL;return!n||/^([a-z][a-z\d+\-.]*:)?\/\//i.test(t)?t:`${n.replace(/\/+$/,``)}/${t.replace(/^\/+/,``)}`},sa=e=>(e?.method??`GET`).toUpperCase(),ca=e=>e==null?`none`:ia(e)&&(typeof e.pipe==`function`||typeof e.getReader==`function`)?`one-shot`:`reusable`,la=(e,t,n)=>{let r=Ui(Hi(t.headers,n?.authorizationSwap)),i=t.dispatchUrl===t.href&&t.resolved;return{...e,...i?{baseURL:void 0}:{},url:t.dispatchUrl,method:t.method,headers:r,...`body`in t?{data:t.body}:{}}},ua=(e,t,n,r,i,a)=>{let o=t??e?.config,s=ca(o?.data),c=a??Vi({url:oa(o),method:sa(o),headers:o?.headers,bodyKind:s,body:o?.data}),l={url:c.href,method:c.method,bodyKind:s},u=s!==`one-shot`&&Xi(i.replay,l);return{status:e?.status??0,getHeader:aa(e?.headers),readBody:async()=>e?.data,request:c,replay:async e=>{let t=je(la(o??{},c,e));try{let e=await r(t);return ua(e,e?.config??t,e,r,i,c)}catch(e){let n=ia(e)?e:{};if(!n.response||typeof n.response.status!=`number`||ir(e))throw e;return{...ua(n.response,n.config??t,e,r,i,c),rejected:!0}}},markers:{...Ae(o)?{upgradeTransaction:!0}:{},...Me(o)?{replayed:!0}:{}},raw:n,replayable:u,replayUnsupportedReason:s===`one-shot`?`a streaming request body is consumed by the first send`:`the replay policy refused this request`,signal:o?.signal}},da=(e,t)=>async n=>{let r=ti(e),i=ia(n)?n:{},a=bi(await _i(ua(i.response,i.config,i.response,t,r),r),n);if(a.settle===`reject`)throw a.error;return a.value},fa=(e,t,n)=>{let r=e.request,i=n??(typeof r==`function`?t=>r.call(e,t):()=>Promise.reject(Error(`Passflow: this client exposes no request() to replay through.`))),a=e.interceptors.response.use(void 0,da(t,i)),o=!1;return()=>{o||(o=!0,e.interceptors.response.eject(a))}},pa=(e,t)=>{let n=c.default.create(e);return t(n),n},ma=0,ha=(e,t)=>{let n=t?.signal??(typeof e==`object`&&e?e.signal:void 0)??void 0;if(n)return{get aborted(){return n.aborted},get reason(){return n.reason},...typeof n.addEventListener==`function`?{addEventListener:(e,t)=>n.addEventListener(e,t),removeEventListener:(e,t)=>n.removeEventListener(e,t)}:{}}},ga=e=>t=>e.headers?.get(t),_a=(e,t,n,r,i)=>({status:e.status,getHeader:ga(e),readBody:()=>e.clone().json(),request:t.snapshot,replay:async e=>_a(await t.replay(n,e),t,n,r,i),markers:r,raw:e,replayable:t.replayable,replayUnsupportedReason:t.reason,signal:i,responseType:e.type}),va=(e,t)=>{let n=(t,n)=>{ma+=1;try{return e(t,n)}finally{--ma}};return async(e,r)=>{if(ma>0)return n(e,r);let i=ti(t),a=ra(e,r,i.replay),o=await n(a.forwardInput,a.forwardInit),s=yi(await _i(_a(o,a,n,{},ha(e,r)),i),o,i);if(s.settle===`reject`)throw s.error;return s.value}},ya=new Set(Rr.filter(e=>!e.requiresPrepare).map(e=>e.type)),ba=e=>{if(!e||typeof e!=`object`||!e.challenge_id||!e.expires_at)throw new $({kind:`protocol`,message:`The upgrade start response is missing challenge_id or expires_at`});return{challengeId:e.challenge_id,method:e.method,expiresAt:e.expires_at,webauthn:e.webauthn,codeSentTo:e.code_sent_to}},xa=e=>ir(e)&&!ar(e),Sa=e=>({async prepare(t){if(!ya.has(t))try{let n=e.relyingPartyId?.();return ba(await e.startUpgrade(n?{method:t,relying_party_id:n}:{method:t}))}catch(e){if(xa(e))throw e;let t=lr(e,`start`);if(t.kind===`prepare_not_required`)return;throw t}},async commit(t,n){let r=e.canCommit();if(!r.ok)throw new $({kind:`unavailable`,message:r.reason});try{await e.commitRefresh({type:t,assertion:n})}catch(t){if(xa(t))throw t;let n=lr(t,`refresh`);throw n.status===401&&dr(n)&&e.markSessionInvalid?.(),n}}}),Ca=e=>e===void 0?[]:(Array.isArray(e)?e:[e]).filter(e=>e!==``),wa=e=>{let t,n=e=>e!==void 0&&t===e,r=r=>{let i=()=>{if(!n(r()))throw new $({kind:`session_changed`})};return Sa({...e,relyingPartyId:()=>t?.options.relyingPartyId??e.relyingPartyId?.(),startUpgrade:t=>(i(),e.startUpgrade(t)),commitRefresh:t=>(i(),e.commitRefresh(t,r()?.pin)),...e.markSessionInvalid?{markSessionInvalid:()=>{n(r())&&e.markSessionInvalid?.()}}:{}})},i=(t,n)=>{let i={},a={controller:new ei({transport:r(()=>i.current),prompt:t.prompt,platform:e.platform,factors:t.factors??e.factors,...t.maxAttempts===void 0?{}:{maxAttempts:t.maxAttempts},...e.readObtainedBar?{readObtainedBar:e.readObtainedBar}:{},...t.onFlightSettled?{onFlightSettled:t.onFlightSettled}:{}}),options:t,scope:{passflow:e.passflowDomain,backend:Ca(t.backend)},generation:n};return i.current=a,a},a=async(r,i)=>{let a=t;if(!a)throw new pr(`Step-up verification is not enabled on this Passflow instance`);a.controller.active||(a.pin=e.readSessionPin?.());let o=await a.controller.elevate(r,i);if(!n(a))throw new mr;return o},o=()=>{let n=t,r=n?.scope??{passflow:e.passflowDomain,backend:[]},i=n?.options;return{elevate:a,scope:r,...i?.requireChallengeChannel?{requireChallengeChannel:i.requireChallengeChannel}:{},...i?.shouldIntercept?{shouldIntercept:i.shouldIntercept}:{},...i?.replay===void 0?{}:{replay:i.replay},...i?.onCancel?{onCancel:i.onCancel}:{},...e.authorizationSwap?{authorizationSwap:e.authorizationSwap}:{},...i?.onUpgradeDiagnostic?{onUpgradeDiagnostic:i.onUpgradeDiagnostic}:{},...e.readObtainedBar?{readObtainedBar:e.readObtainedBar}:{}}},s;return Object.defineProperties(async e=>{let t=e?.acrValues===void 0?void 0:z(e.acrValues).level,n={status:401,...e?.acrValues===void 0?{}:{acrValues:e.acrValues},...t===void 0?{}:{requiredLevel:t},...e?.maxAge===void 0?{}:{maxAge:e.maxAge}},r=e?.acrValues!==void 0||e?.maxAge!==void 0,i={...e?.acrValues===void 0?{}:{acrValues:e.acrValues},...t===void 0?{}:{level:t},...e?.maxAge===void 0?{}:{maxAge:e.maxAge}},o=(await a(n,{kind:`imperative`,...r?{requested:i}:{}})).obtained.acrValues;return{status:`elevated`,...o===void 0?{}:{acr:o}}},{enable:{value:n=>{s?.(),t=i(n,0);let r=[];if(e.attachInternalSeam){let t=e.attachInternalSeam;t(e=>da(o,e)),r.push(()=>t(void 0))}n.interceptFetch&&r.push(yt((e,t,n)=>va(e,o)(t,n),{priority:20,name:`passflow-upgrade`})),e.onSessionChange&&r.push(e.onSessionChange(()=>{let e=t;e&&(t=i(e.options,e.generation+1))}));let a=!1;return s=()=>{if(!a){a=!0;for(let e of r)e();t=void 0,s=void 0}},s},enumerable:!0},enabled:{enumerable:!0,get(){return t!==void 0&&e.canCommit().ok}},elevate:{enumerable:!0,value:(e,t)=>a(e,t??{kind:`imperative`})},withAuth:{enumerable:!0,value:e=>{if(e)return va(e,o);let t=typeof globalThis>`u`?void 0:globalThis;if(!t||typeof t.fetch!=`function`)throw Error(`Passflow: withAuth() needs a fetch to wrap — this runtime has none.`);return va(t.fetch.bind(t),o)}},attachAuth:{enumerable:!0,value:e=>fa(e,o)}})},Ta,Ea=class{get origin(){return this.platform.getCurrentUrl()?.origin??``}constructor(e){this.doRefreshTokens=!1,this.session=async({createSession:e,expiredSession:t,doRefresh:n=!1})=>{this.createSessionCallback=e,this.expiredSessionCallback=t,this.doRefreshTokens=n,await this.submitSessionCheck()};let{url:t,appId:n,scopes:r}=e;this.url=t||`https://auth.passflow.cloud`,this.appId=n,this.platform=e.platform??L,this.storageManager=new P({prefix:e.keyStoragePrefix??``,storage:this.platform.storage}),this.deviceService=new F(this.storageManager),this.authApi=new Xe(e,this.storageManager,this.deviceService),this.appApi=new Je(e,this.storageManager,this.deviceService),this.userApi=new at(e,this.storageManager,this.deviceService),this.settingApi=new $e(e,this.storageManager,this.deviceService),this.tenantApi=new et(e,this.storageManager,this.deviceService),this.invitationApi=new Qe(e,this.storageManager,this.deviceService),this.twoFactorApi=new rt(e,this.storageManager,this.deviceService),this.upgradeApi=new it(e,this.storageManager,this.deviceService),this.upgradeDomain=Fe(e.url),this.subscribeStore=new Zn,this.tokenCacheService=new Ar(this.storageManager,this.authApi,this.subscribeStore,this.platform),this.scopes=r??_,this.createTenantForNewUser=e.createTenantForNewUser??!1;let i=un(e.refreshCoordination,this.platform,e.keyStoragePrefix,{tokenKeys:()=>this.storageManager.tokenKeys()});this.authService=new Er(this.authApi,this.deviceService,this.storageManager,this.subscribeStore,this.tokenCacheService,this.scopes,this.createTenantForNewUser,this.url,{createSession:this.createSessionCallback,expiredSession:this.expiredSessionCallback},this.appId??``,e.tokenExchange,this.platform,()=>this.readPkceEnabled(),{coordination:i,...e.refreshStrikes===void 0?{}:{strikes:e.refreshStrikes}}),this.tokenCacheService.attachRefreshController(this.authService.refresh);for(let e of this.axiosClients())e.setRefreshHandler(e=>this.authService.refresh.ensureFresh(e));this.userService=new Mr(this.userApi,this.deviceService,this.platform),this.tenantService=new kr(this.tenantApi,this.scopes),this.tenant=this.tenantService,this.invitationService=new Dr(this.invitationApi),this.twoFactorService=new jr(this.twoFactorApi,this.subscribeStore,this.authService),this.twoFactor=this.twoFactorService,this.upgrade=wa({startUpgrade:e=>this.upgradeApi.startUpgrade(e),commitRefresh:async(e,t)=>{await this.authService.refreshToken(e,t)},readSessionPin:()=>this.authService.readSessionPin(),canCommit:()=>this.authService.tokenDeliveryManager.isBFFMode()?{ok:!1,reason:`Step-up verification cannot be committed through a BFF refresh endpoint`}:{ok:!0},markSessionInvalid:()=>this.authService.tokenDeliveryManager.setSessionInvalid(),platform:this.platform,passflowDomain:this.upgradeDomain,...e.upgrade?.factors?{factors:e.upgrade.factors}:{},...e.upgrade?.relyingPartyId?{relyingPartyId:()=>e.upgrade?.relyingPartyId}:{},readObtainedBar:()=>this.readAssuranceBar(),authorizationSwap:()=>{let e=this.storageManager.getToken(M.access_token);return e?{from:`Bearer ${e}`,to:`Bearer ${e}`}:void 0},attachInternalSeam:e=>this.attachUpgradeSeam(e),onSessionChange:e=>this.subscribeToSessionChange(e)}),e.parseQueryParams&&this.checkAndSetTokens(),this.setTokensToCacheFromLocalStorage()}readPkceEnabled(){if(!this.appId)return Promise.resolve(!1);if(!this.pkceEnabledRead){let e=this.appApi.getAppSettings().then(e=>e.pkce_enabled);this.pkceEnabledRead=e,e.catch(()=>{this.pkceEnabledRead===e&&(this.pkceEnabledRead=void 0)})}return this.pkceEnabledRead}setAppId(e){this.appId=e,this.pkceEnabledRead=void 0,this.authApi.setAppId(e),this.appApi.setAppId(e),this.userApi.setAppId(e),this.settingApi.setAppId(e),this.tenantApi.setAppId(e),this.invitationApi.setAppId(e),this.twoFactorApi.setAppId(e),this.upgradeApi.setAppId(e),this.authService}withAuth(e){return this.upgrade.withAuth(e)}attachAuth(e){return this.upgrade.attachAuth(e)}createClient(e){return pa(e,e=>this.upgrade.attachAuth(e))}readAssuranceBar(){let e=this.storageManager.getToken(M.access_token);if(e)try{let t=j(e),n=typeof t.acr==`string`?t.acr:void 0;if(!n)return;let r=z(n).level;return r===void 0?{acrValues:n}:{acrValues:n,level:r}}catch{return}}axiosClients(){return[this.authApi.axiosClient,this.appApi.axiosClient,this.userApi.axiosClient,this.settingApi.axiosClient,this.tenantApi.axiosClient,this.invitationApi.axiosClient,this.twoFactorApi.axiosClient,this.upgradeApi.axiosClient]}attachUpgradeSeam(e){for(let t of this.axiosClients()){if(!e){t.setUpgradeInterceptor(void 0);continue}let n=e(e=>t.replay(e));t.setUpgradeInterceptor(n)}}subscribeToSessionChange(e){let t={onAuthChange:()=>e()};return this.subscribeStore.subscribe(t,[Z.SignIn,Z.SignOut]),()=>this.subscribeStore.unsubscribe(t)}async submitSessionCheck(){let e,t;try{e=await this.authService.getTokens(this.doRefreshTokens),t=this.tokenCacheService.getParsedTokens()}catch(t){let n={operation:`session.check`,message:t instanceof Error||t instanceof V?t.message:`Session check failed`,originalError:t};W(this.subscribeStore,n),e=void 0}e&&this.createSessionCallback&&await this.createSessionCallback({tokens:e,parsedTokens:t}),!e&&this.expiredSessionCallback&&await this.expiredSessionCallback()}subscribe(e,t){this.subscribeStore.subscribe(e,t),this.tokenCacheService.initialize()}unsubscribe(e,t){this.subscribeStore.unsubscribe(e,t)}handleTokensRedirect(){return this.checkAndSetTokens()}checkAndSetTokens(){let e=this.platform.getCurrentUrl(),t=new URLSearchParams(e?.search??``),n=!1;if(!t.get(`access_token`)&&e?.hash){let r=new URLSearchParams(e.hash.substring(1));r.get(`access_token`)&&(t=r,n=!0)}if(!t.get(`access_token`)&&this.adoptTwoFactorTokenFromUrl(e)){this.error=void 0;return}let r=t.get(`access_token`),i=t.get(`refresh_token`),a=t.get(`id_token`),o=t.get(`scopes`)?.split(`,`)??this.scopes,s;if(r){if(!_r(r)){W(this.subscribeStore,{operation:`tokens.from-url`,message:`Invalid access token format received`,code:`INVALID_TOKEN_FORMAT`}),this.cleanupUrlParams(n,e);return}if(i&&!_r(i)){W(this.subscribeStore,{operation:`tokens.from-url`,message:`Invalid refresh token format received`,code:`INVALID_TOKEN_FORMAT`}),this.cleanupUrlParams(n,e);return}if(a&&!_r(a)){W(this.subscribeStore,{operation:`tokens.from-url`,message:`Invalid ID token format received`,code:`INVALID_TOKEN_FORMAT`}),this.cleanupUrlParams(n,e);return}return s={access_token:r,refresh_token:i??void 0,id_token:a??void 0,scopes:o},this.storageManager.clearDeliveryMode(),this.storageManager.saveTokens(s),this.tokenCacheService.setTokensCache(s),this.authService.refresh.sessionStarted(),this.subscribeStore.notify(Z.SignIn,{tokens:s,parsedTokens:this.getParsedTokens()}),this.submitSessionCheck(),this.cleanupUrlParams(n,e),this.error=void 0,s}this.error=this.checkErrorsFromURL()}adoptTwoFactorTokenFromUrl(e){if(!e?.hash)return!1;let t=new URLSearchParams(e.hash.substring(1)),n=t.get(`tfa_token`);if(!n)return!1;t.delete(`tfa_token`);let r=t.toString();return this.platform.replaceUrl(e.pathname+e.search+(r?`#${r}`:``)),_r(n)?(this.subscribeStore.notify(Z.TwoFactorRequired,{email:``,challengeId:``,tfaToken:n}),!0):(W(this.subscribeStore,{operation:`tokens.from-url`,message:`Invalid 2FA token format received`,code:`INVALID_TOKEN_FORMAT`}),!0)}checkErrorsFromURL(){let e=new URLSearchParams(this.platform.getCurrentUrl()?.search??``).get(`error`);if(e){let t=vr(e);return Error(t)}}cleanupUrlParams(e=!1,t=null){let n=t??this.platform.getCurrentUrl();if(n){if(e)this.platform.replaceUrl(n.pathname+n.search);else{let e=new URLSearchParams(n.search);e.delete(`access_token`),e.delete(`refresh_token`),e.delete(`id_token`),e.delete(`client_challenge`),e.size>0?this.platform.replaceUrl(`${n.pathname}?${e.toString()}`):this.platform.replaceUrl(n.pathname)}}}setTokensToCacheFromLocalStorage(){let e=this.storageManager.getTokens();if(!e?.access_token&&this.storageManager.getDeliveryMode()){if(e?.id_token&&this.storageManager.hasCookieModeIdToken()){this.tokenCacheService.setTokensCache(e);return}if(this.storageManager.hasJsonModeTokens())this.storageManager.clearDeliveryMode(),e=this.storageManager.getTokens();else{this.storageManager.deleteTokens();return}}e&&this.tokenCacheService.setTokensCache(e)}getCachedTokens(){return this.tokenCacheService.getTokens()}getTokensWithRefresh(){return this.tokenCacheService.getTokensWithRefresh()}getParsedTokens(){return this.tokenCacheService.getParsedTokens()}areTokensExpired(){return this.tokenCacheService.isExpired()}isAuthenticated(){let e=this.getDeliveryMode();if(e===N.Cookie||e===N.BFF)return this.authService.isAuthenticated(this.tokenCacheService.getParsedTokens()??{});let t=this.storageManager.getTokens();if(!t||!t.access_token)return!1;let n=this.tokenCacheService.getParsedTokens();return n?this.authService.isAuthenticated(n):!1}async signIn(e){return await this.authService.signIn(e)}async signUp(e){return await this.authService.signUp(e)}passwordlessSignIn(e){return this.authService.passwordlessSignIn(e)}async passwordlessSignInComplete(e){return await this.authService.passwordlessSignInComplete(e)}handleError(e,t,n){let r={operation:t,message:e instanceof Error?e.message:`${n} failed`,originalError:e,code:e instanceof V?e.id:void 0};throw W(this.subscribeStore,r),e}async logOut(){try{let e=await this.authService.logOut();this.twoFactorService.clearPartialAuthState(),this.notifySignedOut(e),await this.submitSessionCheck()}catch(e){this.handleError(e,`log-out`,`Log out`)}}federatedAuthWithPopup(e){this.authService.federatedAuthWithPopup(e)}federatedAuthWithRedirect(e){this.authService.federatedAuthWithRedirect(e)}reset(e){if(this.notifySignedOut(this.authService.resetSession()),e){this.error=Error(e);let t={operation:`reset`,message:e,code:`RESET_ERROR`};throw W(this.subscribeStore,t),this.error}}notifySignedOut(e){this.subscribeStore.notify(Z.SignOut,e===void 0?{origin:`this-tab`}:{origin:`this-tab`,userId:e})}dispose(){this.authService.refresh.dispose(),this.tokenCacheService.destroy()}async refreshToken(){return await this.authService.refreshToken()}sendPasswordResetEmail(e){return this.authService.sendPasswordResetEmail(e)}async resetPassword(e,t){return await this.authService.resetPassword(e,t)}async getAppSettings(){try{return await this.appApi.getAppSettings()}catch(e){this.handleError(e,`settings.app`,`Get app settings`)}}async getSettingsAll(){try{return await this.settingApi.getSettingsAll()}catch(e){this.handleError(e,`settings.all`,`Get all settings`)}}async getPasswordPolicySettings(){try{return await this.settingApi.getPasswordPolicySettings()}catch(e){this.handleError(e,`settings.password-policy`,`Get password policy settings`)}}async getPasskeySettings(){try{return await this.settingApi.getPasskeySettings()}catch(e){this.handleError(e,`settings.passkey`,`Get passkey settings`)}}async passkeyRegister(e){return await this.authService.passkeyRegister(e)}async passkeyAuthenticate(e){return await this.authService.passkeyAuthenticate(e)}setTokens(e){let t=this.getDeliveryMode(),n=t===N.Cookie||t===N.BFF;this.storageManager.saveTokens(e,n?t:void 0),this.tokenCacheService.setTokensCache(e),this.authService.refresh.sessionStarted(),this.subscribeStore.notify(Z.SignIn,{tokens:e,parsedTokens:this.tokenCacheService.getParsedTokens()})}async getTokens(e=!1){return await this.authService.getTokens(e)}getToken(e){return this.storageManager.getToken(e)}async getUserPasskeys(){try{return await this.userService.getUserPasskeys()}catch(e){this.handleError(e,`passkey.list`,`Get user passkeys`)}}async renameUserPasskey(e,t){try{return await this.userService.renameUserPasskey(e,t)}catch(e){this.handleError(e,`passkey.rename`,`Rename user passkey`)}}async deleteUserPasskey(e){try{return await this.userService.deleteUserPasskey(e)}catch(e){this.handleError(e,`passkey.delete`,`Delete user passkey`)}}async addUserPasskey(e){try{return await this.userService.addUserPasskey(e)}catch(e){this.handleError(e,`passkey.add`,`Add user passkey`)}}async joinInvitation(e,t){try{let n=await this.tenant.joinInvitation(e,t);return n.scopes=t??this.scopes,await this.authService.applyTokens(n),n}catch(e){this.handleError(e,`invitation.join`,`Join invitation`)}}async createTenant(e,t){try{let n=await this.tenant.createTenant(e);return t&&await this.refreshToken(),n}catch(e){this.handleError(e,`tenant.create`,`Create tenant`)}}async requestInviteLink(e){try{return e.send_to_email===void 0&&(e.send_to_email=!0),await this.invitationService.requestInviteLink(e)}catch(e){this.handleError(e,`invitation.request-link`,`Request invite link`)}}async getInvitations(e){try{return await this.invitationService.getInvitations(e)}catch(e){this.handleError(e,`invitation.list`,`Get invitations`)}}async deleteInvitation(e){try{return await this.invitationService.deleteInvitation(e)}catch(e){this.handleError(e,`invitation.delete`,`Delete invitation`)}}async resendInvitation(e){try{return await this.invitationService.resendInvitation(e)}catch(e){this.handleError(e,`invitation.resend`,`Resend invitation`)}}async getInvitationLink(e){try{return await this.invitationService.getInvitationLink(e)}catch(e){this.handleError(e,`invitation.get-link`,`Get invitation link`)}}authRedirectUrl(e={}){return this.authService.authRedirectUrl(e)}authRedirect(e={}){this.authService.authRedirect(e)}getDeliveryMode(){return this.authService.tokenDeliveryManager.getMode()}async restoreSession(){return await this.authService.restoreSession()}async getTwoFactorStatus(){try{return await this.twoFactorService.getStatus()}catch(e){this.handleError(e,`2fa.status`,`Get 2FA status`)}}async beginTwoFactorSetup(){try{return await this.twoFactorService.beginSetup()}catch(e){this.handleError(e,`2fa.setup.begin`,`Begin 2FA setup`)}}async confirmTwoFactorSetup(e){try{return await this.twoFactorService.confirmSetup(e)}catch(e){this.handleError(e,`2fa.setup.confirm`,`Confirm 2FA setup`)}}async verifyTwoFactor(e,t){try{let n=await this.twoFactorService.verify(e,t);return this.subscribeStore.notify(Z.SignIn,{tokens:n,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck(),n}catch(e){this.handleError(e,`2fa.verify`,`Verify 2FA`)}}async useTwoFactorRecoveryCode(e,t){try{let n=await this.twoFactorService.useRecoveryCode(e,t);return this.subscribeStore.notify(Z.SignIn,{tokens:n,parsedTokens:this.tokenCacheService.getParsedTokens()}),await this.submitSessionCheck(),n}catch(e){this.handleError(e,`2fa.recovery.use`,`Use 2FA recovery code`)}}async disableTwoFactor(e){try{return await this.twoFactorService.disable(e)}catch(e){this.handleError(e,`2fa.disable`,`Disable 2FA`)}}async regenerateTwoFactorRecoveryCodes(e){try{return await this.twoFactorService.regenerateRecoveryCodes(e)}catch(e){this.handleError(e,`2fa.recovery.regenerate`,`Regenerate 2FA recovery codes`)}}async getTrustedDevices(){try{return await this.twoFactorService.getTrustedDevices()}catch(e){this.handleError(e,`2fa.trusted-devices.list`,`Get trusted devices`)}}async revokeTrustedDevice(e){try{await this.twoFactorService.revokeTrustedDevice(e)}catch(e){this.handleError(e,`2fa.trusted-devices.revoke`,`Revoke trusted device`)}}isTwoFactorVerificationRequired(){return this.twoFactorService.isVerificationRequired()}getTotpDigits(){return this.twoFactorService.getTotpDigits()}async validateTwoFactorSetupMagicLink(e){return await this.twoFactorService.validateTwoFactorSetupMagicLink(e)}getMagicLinkSession(){return this.twoFactorService.getMagicLinkSession()}hasMagicLinkSession(){return this.twoFactorService.hasMagicLinkSession()}clearMagicLinkSession(){this.twoFactorService.clearMagicLinkSession()}};Ta=Ea,Ta.version=h,exports.APP_ID_HEADER_KEY=d,exports.AUTHORIZATION_HEADER_KEY=f,exports.AppAPI=Je,exports.AuthAPI=Xe,exports.AuthService=Er,exports.CLIAuthAPI=Ze,exports.DEFAULT_GROUP_NAME=y,exports.DEFAULT_SCOPES=_,exports.DEFAULT_UPGRADE_FACTORS=Rr,exports.DEVICE_ID_HEADER_KEY=p,exports.DEVICE_TYPE_HEADER_KEY=m,exports.ERROR_MESSAGE_MAX_LENGTH=E,exports.FETCH_PRIORITY_OIDC=ot,exports.FETCH_PRIORITY_UPGRADE=st,exports.FetchMiddlewareContractError=ct,exports.INSUFFICIENT_USER_AUTHENTICATION=pe,exports.InvitationAPI=Qe,exports.InvitationService=Dr,exports.M2MClient=Ot,exports.M2MConfigError=Ct,exports.M2MError=U,exports.M2MErrorCodes=wt,exports.M2MNetworkError=xt,exports.M2MTokenParseError=St,exports.M2M_DEFAULTS=Tt,exports.MINIMAL_DEFAULT_SCOPES=g,exports.OS=Le,exports.PASSFLOW_CLOUD_URL=v,exports.POPUP_HEIGHT=x,exports.POPUP_POLL_INTERVAL_MS=ee,exports.POPUP_TIMEOUT_MS=S,exports.POPUP_WIDTH=b,exports.Passflow=Ea,exports.PassflowAdminEndpointPaths=Pe,exports.PassflowEndpointPaths=B,exports.PassflowError=V,exports.PassflowEvent=Z,exports.PassflowRefreshError=J,exports.PopupClosedError=I,exports.Providers=Ie,exports.RECOVERABLE_COMMIT_ERROR_IDS=Qn,exports.REFRESH_AUTH_FAILURE_IDS=yn,exports.RefreshErrorId=q,exports.RequestMethod=Ne,exports.SDK_VERSION=h,exports.SESSION_INVALIDATING_COMMIT_ERROR_IDS=$n,exports.SessionState=se,exports.SettingAPI=$e,exports.TOKEN_EXPIRY_BUFFER_SECONDS=C,exports.TenantAPI=et,exports.TenantService=kr,exports.TenantUserMembership=Or,exports.TokenCacheService=Ar,exports.TokenDeliveryMode=N,exports.TokenType=M,exports.TwoFactorApiClient=rt,exports.TwoFactorPolicy=ze,exports.TwoFactorService=jr,exports.UPGRADE_REQUIRED=me,exports.USERNAME_MAX_LENGTH=T,exports.USERNAME_MIN_LENGTH=w,exports.UpgradeAPI=it,exports.UpgradeCancelledError=Gr,exports.UpgradeCommitInterruptedError=jn,exports.UpgradeController=ei,exports.UpgradeErrorIds=Q,exports.UpgradeFactorError=Nr,exports.UpgradeInsufficientError=fr,exports.UpgradeSessionChangedError=mr,exports.UpgradeTransportError=$,exports.UpgradeUnavailableError=pr,exports.UpgradeUnsatisfiableError=Kr,exports.UserAPI=at,exports.UserService=Mr,exports.WebAdapter=le,exports.classifyUpgradeError=lr,exports.factorRegistry=zr,exports.fetchRegistryState=bt,exports.getOSFromDeviceType=Re,exports.invalidatesSessionOnCommit=dr,exports.isRecoverableCommitFailure=ur,exports.isRetryableUpgradeKind=tr,exports.isTokenExpired=A,exports.isUpgradeCancelled=ki,exports.isUpgradeExhausted=Ai,exports.isUpgradeInsufficient=ji,exports.isUpgradeSessionChanged=Pi,exports.isUpgradeTransportError=ar,exports.isUpgradeTransportFailure=Fi,exports.isUpgradeUnavailable=Ni,exports.isUpgradeUnsatisfiable=Mi,exports.isValidEmail=yr,exports.isValidJWTFormat=_r,exports.isValidPhoneNumber=br,exports.isValidUsername=xr,exports.parseChallengeBody=xe,exports.parseChallengeHeader=be,exports.parseToken=j,exports.parseUpgradeChallenge=Te,exports.passkeyFactor=Lr,exports.pathWithParams=H,exports.recoveryCodesFactor=Ir,exports.registerFetchMiddleware=yt,exports.requiredAcrLevel=fe,exports.resolveUpgradeDomain=Fe,exports.sanitizeErrorMessage=vr,exports.selectFactors=Wr,exports.totpFactor=Fr,exports.webAdapter=L;
 //# sourceMappingURL=index.cjs.map