@thunderid/javascript 0.11.1 → 0.11.3

package/dist/edge/index.js

@@ -14,23 +14,6 @@ var __export = (all) => {
 //#endregion
 //#region src/constants/TokenConstants.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Constants related to OIDC token management and storage.
 * This object contains configuration values and storage keys
 * used in token validation and management processes.
@@ -59,30 +42,14 @@ const TokenConstants = {
 		"ML-DSA-65",
 		"ML-DSA-87"
 	] },
-	Storage: { StorageKeys: { REFRESH_TOKEN_TIMER: "refresh_token_timer" } }
+	Storage: { StorageKeys: { REFRESH_TOKEN_TIMER: "refresh_token_timer" } },
+	Lifecycle: { CLIENT_CREDENTIALS_REFRESH_MARGIN_MS: 3e4 }
 };
 var TokenConstants_default = TokenConstants;
 
 //#endregion
 //#region src/errors/exception.ts
 /**
-* Copyright (c) 2020, WSO2 LLC. (https://www.wso2.com). All Rights Reserved.
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * @deprecated Use `ThunderIDRuntimeError` for runtime errors and `ThunderIDAPIError` for API errors.
 */
 var ThunderIDAuthException = class extends Error {
@@ -170,23 +137,6 @@ var IsomorphicCrypto = class {
 //#endregion
 //#region src/errors/ThunderIDError.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Base class for all ThunderID errors. This class extends the native Error class
 * and adds support for error codes and proper stack traces. Each error is prefixed
 * with a lightning emoji and the SDK name for easy identification.
@@ -235,23 +185,6 @@ var ThunderIDError = class ThunderIDError extends Error {
 //#endregion
 //#region src/utils/parseApiErrorMessage.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Attempts to extract a human-readable message from a structured API error response body.
 *
 * The backend returns errors in the following form:
@@ -414,23 +347,6 @@ let EmbeddedSignInFlowType = /* @__PURE__ */ function(EmbeddedSignInFlowType$1)
 //#endregion
 //#region src/utils/injectRequestedPermissions.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Strips the top-level `scopes` field from a payload and injects it as
 * `inputs.requested_permissions` (space-separated string).
 *
@@ -452,175 +368,512 @@ const injectRequestedPermissions = (payload) => {
 var injectRequestedPermissions_default = injectRequestedPermissions;
 
 //#endregion
-//#region src/api/executeEmbeddedSignInFlow.ts
-const executeEmbeddedSignInFlow = async ({ url, baseUrl, payload, authId, flowSecret,...requestConfig }) => {
-	if (!payload) throw new ThunderIDAPIError("Authorization payload is required", "executeEmbeddedSignInFlow-ValidationError-002", "javascript", 400, "If an authorization payload is not provided, the request cannot be constructed correctly.");
-	const endpoint = url ?? `${baseUrl}/flow/execute`;
-	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
-	const isNewFlowStart = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload;
-	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
-	const basePayload = isNewFlowStart ? injectRequestedPermissions_default(cleanPayload) : cleanPayload;
-	const requestPayload = isNewFlowStart || hasOnlyFlowId ? {
-		...basePayload,
-		verbose: true
-	} : basePayload;
-	const response = await fetch(endpoint, {
-		...requestConfig,
-		body: JSON.stringify(requestPayload),
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json",
-			...isNewFlowStart && flowSecret ? { "Flow-Secret": flowSecret } : {},
-			...requestConfig.headers
-		},
-		method: requestConfig.method || "POST"
-	});
-	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedSignInFlow-ResponseError-001", "javascript", response.status, response.statusText, "Authorization request failed");
-	const flowResponse = await response.json();
-	if (flowResponse.flowStatus === EmbeddedSignInFlowStatus.Complete && flowResponse.assertion && authId) try {
-		const oauth2Response = await fetch(`${baseUrl}/oauth2/auth/callback`, {
-			body: JSON.stringify({
-				assertion: flowResponse.assertion,
-				authId
-			}),
-			credentials: "include",
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/json",
-				...requestConfig.headers
-			},
-			method: "POST"
-		});
-		if (!oauth2Response.ok) throw new ThunderIDAPIError(await oauth2Response.text(), "executeEmbeddedSignInFlow-OAuth2Error-002", "javascript", oauth2Response.status, oauth2Response.statusText, "OAuth2 authorization failed");
-		const oauth2Result = await oauth2Response.json();
-		return {
-			flowStatus: flowResponse.flowStatus,
-			redirectUrl: oauth2Result["redirect_uri"]
-		};
-	} catch (authError) {
-		if (authError instanceof ThunderIDAPIError) throw authError;
-		throw new ThunderIDAPIError(authError instanceof Error ? authError.message : "Unknown error", "executeEmbeddedSignInFlow-OAuth2Error-001", "javascript", 500, "Failed to complete OAuth2 authorization after successful embedded sign-in flow.", "OAuth2 authorization failed");
-	}
-	return flowResponse;
+//#region src/utils/logger.ts
+const PREFIX = "⚡ ThunderID";
+/**
+* Default logger configuration
+*/
+const DEFAULT_CONFIG$1 = {
+	level: "info",
+	prefix: `${PREFIX}`,
+	showLevel: true,
+	timestamps: true
 };
-var executeEmbeddedSignInFlow_default = executeEmbeddedSignInFlow;
-
-//#endregion
-//#region src/models/embedded-signup-flow.ts
 /**
-* Status enumeration for ThunderID embedded sign-up flow operations.
-*
-* These statuses indicate the current state of the registration flow and determine
-* the next action required by the client application. Each status provides specific
-* guidance on how to proceed with the user registration process.
-*
-* @example
-* ```typescript
-* switch (response.flowStatus) {
-*   case EmbeddedSignUpFlowStatus.Incomplete:
-*     // More user input needed - render registration form components
-*     break;
-*   case EmbeddedSignUpFlowStatus.Complete:
-*     // Registration successful - handle completion
-*     break;
-*   case EmbeddedSignUpFlowStatus.Error:
-*     // Registration failed - show error details
-*     const errorResponse = response as EmbeddedSignUpFlowErrorResponse;
-*     showError(errorResponse.error.description.defaultValue);
-*     break;
-* }
-* ```
-*
-* @experimental Part of the new ThunderID API
+* Environment detection utilities
 */
-let EmbeddedSignUpFlowStatus = /* @__PURE__ */ function(EmbeddedSignUpFlowStatus$1) {
+const isBrowser = () => typeof window !== "undefined" && typeof window.document !== "undefined";
+const isNode = () => typeof process !== "undefined" && void 0;
+/**
+* Color codes for terminal output (Node.js)
+*/
+const COLORS = {
+	blue: "\x1B[34m",
+	bright: "\x1B[1m",
+	cyan: "\x1B[36m",
+	dim: "\x1B[2m",
+	gray: "\x1B[90m",
+	green: "\x1B[32m",
+	magenta: "\x1B[35m",
+	red: "\x1B[31m",
+	reset: "\x1B[0m",
+	white: "\x1B[37m",
+	yellow: "\x1B[33m"
+};
+/**
+* Browser console styling
+*/
+const BROWSER_STYLES = {
+	debug: "color: #6b7280; font-weight: normal;",
+	error: "color: #dc2626; font-weight: bold;",
+	info: "color: #2563eb; font-weight: bold;",
+	prefix: "color: #7c3aed; font-weight: bold;",
+	timestamp: "color: #6b7280; font-size: 0.9em;",
+	warn: "color: #d97706; font-weight: bold;"
+};
+const LOG_LEVEL_ORDER = {
+	debug: 0,
+	error: 3,
+	info: 1,
+	warn: 2
+};
+/**
+* Universal logger class that works in both browser and Node.js environments
+*/
+var Logger = class Logger {
+	config;
+	constructor(config = {}) {
+		this.config = {
+			...DEFAULT_CONFIG$1,
+			...config
+		};
+	}
 	/**
-	* Sign-up flow completed successfully.
-	*
-	* The user has successfully registered and the flow can proceed to
-	* OAuth2 completion or redirection. Check for redirectUrl or assertion
-	* data in the response for next steps.
+	* Update logger configuration
 	*/
-	EmbeddedSignUpFlowStatus$1["Complete"] = "COMPLETE";
+	configure(config) {
+		this.config = {
+			...this.config,
+			...config
+		};
+	}
 	/**
-	* Sign-up flow encountered an error and cannot proceed.
-	*
-	* Registration failed due to validation errors, duplicate user,
-	* system errors, or other issues. The response will be of type
-	* `EmbeddedSignUpFlowErrorResponse` containing detailed failure
-	* information that can be displayed to the user.
-	*
-	* @see {@link EmbeddedSignUpFlowErrorResponse} for error response structure
+	* Get current configuration
 	*/
-	EmbeddedSignUpFlowStatus$1["Error"] = "ERROR";
+	getConfig() {
+		return { ...this.config };
+	}
 	/**
-	* Sign-up flow requires additional user input.
-	*
-	* More registration steps are needed. The response will contain
-	* components in data.meta.components that should be rendered to
-	* collect additional user information (e.g., profile data, verification).
+	* Check if a log level should be output
 	*/
-	EmbeddedSignUpFlowStatus$1["Incomplete"] = "INCOMPLETE";
-	return EmbeddedSignUpFlowStatus$1;
-}({});
-/**
-* Type enumeration for ThunderID embedded sign-up flow responses.
-*
-* Determines the nature of the registration flow response and how the client
-* should handle the returned data. This affects both UI rendering and flow
-* continuation logic during the user registration process.
-*
-* @experimental Part of the new ThunderID API
-*/
-let EmbeddedSignUpFlowType = /* @__PURE__ */ function(EmbeddedSignUpFlowType$1) {
+	shouldLog(level) {
+		return LOG_LEVEL_ORDER[level] >= LOG_LEVEL_ORDER[this.config.level];
+	}
 	/**
-	* Response requires external redirection.
-	*
-	* Used for social registration providers, external identity providers,
-	* or other flows that require navigating to an external URL during
-	* the registration process. The response will contain redirection information.
+	* Get timestamp string
 	*/
-	EmbeddedSignUpFlowType$1["Redirection"] = "REDIRECTION";
+	static getTimestamp() {
+		return (/* @__PURE__ */ new Date()).toISOString();
+	}
 	/**
-	* Response contains view components for rendering.
-	*
-	* Standard embedded registration flow response containing UI components
-	* that should be rendered within the current application context.
-	* Most common type for embedded user registration.
+	* Get log level string
 	*/
-	EmbeddedSignUpFlowType$1["View"] = "VIEW";
-	return EmbeddedSignUpFlowType$1;
-}({});
-
-//#endregion
-//#region src/api/executeEmbeddedSignUpFlow.ts
-const executeEmbeddedSignUpFlow = async ({ url, baseUrl, payload, authId,...requestConfig }) => {
-	if (!payload) throw new ThunderIDAPIError("Registration payload is required", "executeEmbeddedSignUpFlow-ValidationError-002", "javascript", 400, "If a registration payload is not provided, the request cannot be constructed correctly.");
-	const endpoint = url ?? `${baseUrl}/flow/execute`;
-	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
-	const isNewFlowStart = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload;
-	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
-	const basePayload = isNewFlowStart ? injectRequestedPermissions_default(cleanPayload) : cleanPayload;
-	const requestPayload = isNewFlowStart || hasOnlyFlowId ? {
-		...basePayload,
-		verbose: true
-	} : basePayload;
-	const response = await fetch(endpoint, {
-		...requestConfig,
-		body: JSON.stringify(requestPayload),
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json",
-			...requestConfig.headers
-		},
-		method: requestConfig.method || "POST"
-	});
-	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedSignUpFlow-ResponseError-001", "javascript", response.status, response.statusText, "Registration request failed");
-	const flowResponse = await response.json();
-	if (flowResponse.flowStatus === EmbeddedSignUpFlowStatus.Complete && flowResponse.assertion && authId) try {
-		const oauth2Response = await fetch(`${baseUrl}/oauth2/auth/callback`, {
-			body: JSON.stringify({
-				assertion: flowResponse.assertion,
+	static getLevelString(level) {
+		switch (level) {
+			case "debug": return "DEBUG";
+			case "info": return "INFO";
+			case "warn": return "WARN";
+			case "error": return "ERROR";
+			default: return "UNKNOWN";
+		}
+	}
+	/**
+	* Format message for Node.js terminal
+	*/
+	formatForNode(level, message) {
+		const parts = [];
+		if (this.config.timestamps) parts.push(`${COLORS.gray}[${Logger.getTimestamp()}]${COLORS.reset}`);
+		if (this.config.prefix) parts.push(`${COLORS.magenta}${this.config.prefix}${COLORS.reset}`);
+		if (this.config.showLevel) {
+			const levelStr = Logger.getLevelString(level);
+			let coloredLevel;
+			switch (level) {
+				case "debug":
+					coloredLevel = `${COLORS.gray}[${levelStr}]${COLORS.reset}`;
+					break;
+				case "info":
+					coloredLevel = `${COLORS.blue}[${levelStr}]${COLORS.reset}`;
+					break;
+				case "warn":
+					coloredLevel = `${COLORS.yellow}[${levelStr}]${COLORS.reset}`;
+					break;
+				case "error":
+					coloredLevel = `${COLORS.red}[${levelStr}]${COLORS.reset}`;
+					break;
+				default: coloredLevel = `[${levelStr}]`;
+			}
+			parts.push(coloredLevel);
+		}
+		parts.push(message);
+		return parts.join(" ");
+	}
+	/**
+	* Log message using appropriate method
+	*/
+	logMessage(level, message, ...args) {
+		if (!this.shouldLog(level)) return;
+		if (this.config.formatter) {
+			this.config.formatter(level, message, ...args);
+			return;
+		}
+		if (isBrowser()) this.logToBrowser(level, message, ...args);
+		else if (isNode()) this.logToNode(level, message, ...args);
+		else console.log(message, ...args);
+	}
+	/**
+	* Log to browser console with styling
+	*/
+	logToBrowser(level, message, ...args) {
+		const parts = [];
+		const styles = [];
+		if (this.config.timestamps) {
+			parts.push(`%c[${Logger.getTimestamp()}]`);
+			styles.push(BROWSER_STYLES.timestamp);
+		}
+		if (this.config.prefix) {
+			parts.push(`%c${this.config.prefix}`);
+			styles.push(BROWSER_STYLES.prefix);
+		}
+		if (this.config.showLevel) {
+			const levelStr = Logger.getLevelString(level);
+			parts.push(`%c[${levelStr}]`);
+			switch (level) {
+				case "debug":
+					styles.push(BROWSER_STYLES.debug);
+					break;
+				case "info":
+					styles.push(BROWSER_STYLES.info);
+					break;
+				case "warn":
+					styles.push(BROWSER_STYLES.warn);
+					break;
+				case "error":
+					styles.push(BROWSER_STYLES.error);
+					break;
+				default: styles.push("");
+			}
+		}
+		parts.push(`%c${message}`);
+		styles.push("color: inherit; font-weight: normal;");
+		const formattedMessage = parts.join(" ");
+		switch (level) {
+			case "debug":
+				console.debug(formattedMessage, ...styles, ...args);
+				break;
+			case "info":
+				console.info(formattedMessage, ...styles, ...args);
+				break;
+			case "warn":
+				console.warn(formattedMessage, ...styles, ...args);
+				break;
+			case "error":
+				console.error(formattedMessage, ...styles, ...args);
+				break;
+			default: console.log(formattedMessage, ...styles, ...args);
+		}
+	}
+	/**
+	* Log to Node.js console
+	*/
+	logToNode(level, message, ...args) {
+		const formattedMessage = this.formatForNode(level, message);
+		switch (level) {
+			case "debug":
+				console.debug(formattedMessage, ...args);
+				break;
+			case "info":
+				console.info(formattedMessage, ...args);
+				break;
+			case "warn":
+				console.warn(formattedMessage, ...args);
+				break;
+			case "error":
+				console.error(formattedMessage, ...args);
+				break;
+			default: console.log(formattedMessage, ...args);
+		}
+	}
+	/**
+	* Log debug message
+	*/
+	debug(message, ...args) {
+		this.logMessage("debug", message, ...args);
+	}
+	/**
+	* Log info message
+	*/
+	info(message, ...args) {
+		this.logMessage("info", message, ...args);
+	}
+	/**
+	* Log warning message
+	*/
+	warn(message, ...args) {
+		this.logMessage("warn", message, ...args);
+	}
+	/**
+	* Log error message
+	*/
+	error(message, ...args) {
+		this.logMessage("error", message, ...args);
+	}
+	/**
+	* Create a child logger with additional prefix
+	*/
+	child(prefix) {
+		const childPrefix = this.config.prefix ? `${this.config.prefix} - ${prefix}` : prefix;
+		return new Logger({
+			...this.config,
+			prefix: childPrefix
+		});
+	}
+	/**
+	* Set log level
+	*/
+	setLevel(level) {
+		this.config.level = level;
+	}
+	/**
+	* Get current log level
+	*/
+	getLevel() {
+		return this.config.level;
+	}
+};
+/**
+* Default logger instance
+*/
+const logger = new Logger();
+/**
+* Create a new logger instance with custom configuration
+*/
+const createLogger = (config) => new Logger(config);
+/**
+* Default export - global logger instance
+*/
+var logger_default = logger;
+/**
+* Named exports for convenience
+*/
+const debug = (message, ...args) => logger.debug(message, ...args);
+const info = (message, ...args) => logger.info(message, ...args);
+const warn = (message, ...args) => logger.warn(message, ...args);
+const error = (message, ...args) => logger.error(message, ...args);
+/**
+* Configure the default logger
+*/
+const configure = (config) => logger.configure(config);
+/**
+* Create component-specific loggers
+*/
+const createComponentLogger = (component) => logger.child(component);
+/**
+* Create package-specific logger
+*/
+const createPackageLogger = (packageName) => createLogger({
+	level: "info",
+	prefix: `${PREFIX} - ${packageName}`,
+	showLevel: true,
+	timestamps: true
+});
+/**
+* Create package component logger (package + component)
+*/
+const createPackageComponentLogger = (packageName, component) => {
+	return createPackageLogger(packageName).child(component);
+};
+
+//#endregion
+//#region src/api/executeEmbeddedSignInFlow.ts
+const readErrorAssertion = (body) => {
+	try {
+		return JSON.parse(body).errorAssertion;
+	} catch {
+		return;
+	}
+};
+const postAuthCallback = async (baseUrl, body, headers) => {
+	const oauth2Response = await fetch(`${baseUrl}/oauth2/auth/callback`, {
+		body: JSON.stringify(body),
+		credentials: "include",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...headers
+		},
+		method: "POST"
+	});
+	if (!oauth2Response.ok) {
+		const oauth2ErrorText = await oauth2Response.text();
+		logger_default.error(`OAuth2 authorization failed. The callback responded ${oauth2Response.status} ${oauth2Response.statusText}:`, oauth2ErrorText);
+		throw new ThunderIDAPIError("OAuth2 authorization failed", "executeEmbeddedSignInFlow-OAuth2Error-002", "javascript", oauth2Response.status, oauth2Response.statusText);
+	}
+	return oauth2Response.json();
+};
+const relayFailure = async (baseUrl, authId, errorAssertion, headers, flowResponse) => {
+	const oauth2Result = await postAuthCallback(baseUrl, {
+		assertion: errorAssertion,
+		authId
+	}, headers);
+	return {
+		...flowResponse,
+		flowStatus: EmbeddedSignInFlowStatus.Error,
+		redirectUrl: oauth2Result["redirect_uri"]
+	};
+};
+const executeEmbeddedSignInFlow = async ({ url, baseUrl, payload, authId, flowSecret,...requestConfig }) => {
+	if (!payload) throw new ThunderIDAPIError("Authorization payload is required", "executeEmbeddedSignInFlow-ValidationError-002", "javascript", 400, "If an authorization payload is not provided, the request cannot be constructed correctly.");
+	const endpoint = url ?? `${baseUrl}/flow/execute`;
+	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
+	const isNewFlowStart = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload;
+	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
+	const basePayload = isNewFlowStart ? injectRequestedPermissions_default(cleanPayload) : cleanPayload;
+	const requestPayload = isNewFlowStart || hasOnlyFlowId ? {
+		...basePayload,
+		verbose: true
+	} : basePayload;
+	const response = await fetch(endpoint, {
+		...requestConfig,
+		body: JSON.stringify(requestPayload),
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...isNewFlowStart && flowSecret ? { "Flow-Secret": flowSecret } : {},
+			...requestConfig.headers
+		},
+		method: requestConfig.method || "POST"
+	});
+	if (!response.ok) {
+		const errorText = await response.text();
+		const errorAssertion = readErrorAssertion(errorText);
+		if (authId && errorAssertion) return await relayFailure(baseUrl, authId, errorAssertion, requestConfig.headers);
+		throw new ThunderIDAPIError(errorText, "executeEmbeddedSignInFlow-ResponseError-001", "javascript", response.status, response.statusText, "Authorization request failed");
+	}
+	const flowResponse = await response.json();
+	if (flowResponse.flowStatus === EmbeddedSignInFlowStatus.Complete && flowResponse.assertion && authId) try {
+		const oauth2Result = await postAuthCallback(baseUrl, {
+			assertion: flowResponse.assertion,
+			authId
+		}, requestConfig.headers);
+		return {
+			flowStatus: flowResponse.flowStatus,
+			redirectUrl: oauth2Result["redirect_uri"]
+		};
+	} catch (authError) {
+		if (authError instanceof ThunderIDAPIError) throw authError;
+		throw new ThunderIDAPIError(authError instanceof Error ? authError.message : "Unknown error", "executeEmbeddedSignInFlow-OAuth2Error-001", "javascript", 500, "Failed to complete OAuth2 authorization after successful embedded sign-in flow.", "OAuth2 authorization failed");
+	}
+	if (flowResponse.flowStatus === EmbeddedSignInFlowStatus.Error && flowResponse.errorAssertion && authId) return relayFailure(baseUrl, authId, flowResponse.errorAssertion, requestConfig.headers, flowResponse);
+	return flowResponse;
+};
+var executeEmbeddedSignInFlow_default = executeEmbeddedSignInFlow;
+
+//#endregion
+//#region src/models/embedded-signup-flow.ts
+/**
+* Status enumeration for ThunderID embedded sign-up flow operations.
+*
+* These statuses indicate the current state of the registration flow and determine
+* the next action required by the client application. Each status provides specific
+* guidance on how to proceed with the user registration process.
+*
+* @example
+* ```typescript
+* switch (response.flowStatus) {
+*   case EmbeddedSignUpFlowStatus.Incomplete:
+*     // More user input needed - render registration form components
+*     break;
+*   case EmbeddedSignUpFlowStatus.Complete:
+*     // Registration successful - handle completion
+*     break;
+*   case EmbeddedSignUpFlowStatus.Error:
+*     // Registration failed - show error details
+*     const errorResponse = response as EmbeddedSignUpFlowErrorResponse;
+*     showError(errorResponse.error.description.defaultValue);
+*     break;
+* }
+* ```
+*
+* @experimental Part of the new ThunderID API
+*/
+let EmbeddedSignUpFlowStatus = /* @__PURE__ */ function(EmbeddedSignUpFlowStatus$1) {
+	/**
+	* Sign-up flow completed successfully.
+	*
+	* The user has successfully registered and the flow can proceed to
+	* OAuth2 completion or redirection. Check for redirectUrl or assertion
+	* data in the response for next steps.
+	*/
+	EmbeddedSignUpFlowStatus$1["Complete"] = "COMPLETE";
+	/**
+	* Sign-up flow encountered an error and cannot proceed.
+	*
+	* Registration failed due to validation errors, duplicate user,
+	* system errors, or other issues. The response will be of type
+	* `EmbeddedSignUpFlowErrorResponse` containing detailed failure
+	* information that can be displayed to the user.
+	*
+	* @see {@link EmbeddedSignUpFlowErrorResponse} for error response structure
+	*/
+	EmbeddedSignUpFlowStatus$1["Error"] = "ERROR";
+	/**
+	* Sign-up flow requires additional user input.
+	*
+	* More registration steps are needed. The response will contain
+	* components in data.meta.components that should be rendered to
+	* collect additional user information (e.g., profile data, verification).
+	*/
+	EmbeddedSignUpFlowStatus$1["Incomplete"] = "INCOMPLETE";
+	return EmbeddedSignUpFlowStatus$1;
+}({});
+/**
+* Type enumeration for ThunderID embedded sign-up flow responses.
+*
+* Determines the nature of the registration flow response and how the client
+* should handle the returned data. This affects both UI rendering and flow
+* continuation logic during the user registration process.
+*
+* @experimental Part of the new ThunderID API
+*/
+let EmbeddedSignUpFlowType = /* @__PURE__ */ function(EmbeddedSignUpFlowType$1) {
+	/**
+	* Response requires external redirection.
+	*
+	* Used for social registration providers, external identity providers,
+	* or other flows that require navigating to an external URL during
+	* the registration process. The response will contain redirection information.
+	*/
+	EmbeddedSignUpFlowType$1["Redirection"] = "REDIRECTION";
+	/**
+	* Response contains view components for rendering.
+	*
+	* Standard embedded registration flow response containing UI components
+	* that should be rendered within the current application context.
+	* Most common type for embedded user registration.
+	*/
+	EmbeddedSignUpFlowType$1["View"] = "VIEW";
+	return EmbeddedSignUpFlowType$1;
+}({});
+
+//#endregion
+//#region src/api/executeEmbeddedSignUpFlow.ts
+const executeEmbeddedSignUpFlow = async ({ url, baseUrl, payload, authId,...requestConfig }) => {
+	if (!payload) throw new ThunderIDAPIError("Registration payload is required", "executeEmbeddedSignUpFlow-ValidationError-002", "javascript", 400, "If a registration payload is not provided, the request cannot be constructed correctly.");
+	const endpoint = url ?? `${baseUrl}/flow/execute`;
+	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
+	const isNewFlowStart = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload;
+	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
+	const basePayload = isNewFlowStart ? injectRequestedPermissions_default(cleanPayload) : cleanPayload;
+	const requestPayload = isNewFlowStart || hasOnlyFlowId ? {
+		...basePayload,
+		verbose: true
+	} : basePayload;
+	const response = await fetch(endpoint, {
+		...requestConfig,
+		body: JSON.stringify(requestPayload),
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...requestConfig.headers
+		},
+		method: requestConfig.method || "POST"
+	});
+	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedSignUpFlow-ResponseError-001", "javascript", response.status, response.statusText, "Registration request failed");
+	const flowResponse = await response.json();
+	if (flowResponse.flowStatus === EmbeddedSignUpFlowStatus.Complete && flowResponse.assertion && authId) try {
+		const oauth2Response = await fetch(`${baseUrl}/oauth2/auth/callback`, {
+			body: JSON.stringify({
+				assertion: flowResponse.assertion,
 				authId
 			}),
 			credentials: "include",
@@ -709,23 +962,6 @@ var executeEmbeddedRecoveryFlow_default = executeEmbeddedRecoveryFlow;
 
 //#endregion
 //#region src/models/embedded-flow.ts
-/**
-* Copyright (c) 2025-2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
 let EmbeddedFlowType = /* @__PURE__ */ function(EmbeddedFlowType$1) {
 	EmbeddedFlowType$1["Authentication"] = "AUTHENTICATION";
 	EmbeddedFlowType$1["Recovery"] = "RECOVERY";
@@ -1090,23 +1326,6 @@ var getUserInfo_default = getUserInfo;
 //#endregion
 //#region src/utils/processUsername.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Regular expression to match userstore prefixes in usernames.
 * Matches patterns like "DEFAULT/", "ASGARDEO_USER/", "PRIMARY/", etc.
 * The pattern matches any uppercase letters, numbers, and underscores followed by a forward slash.
@@ -1341,23 +1560,6 @@ var updateMeProfile_default = updateMeProfile;
 //#endregion
 //#region src/constants/ApplicationNativeAuthenticationConstants.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Constants representing Application Native Authentication related configurations and constants.
 */
 const ApplicationNativeAuthenticationConstants = { SupportedAuthenticators: {
@@ -1381,23 +1583,6 @@ var ApplicationNativeAuthenticationConstants_default = ApplicationNativeAuthenti
 //#endregion
 //#region src/constants/ScopeConstants.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Constants for OAuth 2.0 and OpenID Connect scopes.
 * These scopes define the level of access that the client application
 * is requesting from the authorization server.
@@ -1443,23 +1628,6 @@ var OIDCRequestConstants_default = OIDCRequestConstants;
 //#endregion
 //#region src/constants/VendorConstants.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Constants for vendor-specific configurations.
 * By default, the vendor is inferred as ThunderID.
 *
@@ -1561,23 +1729,6 @@ let EmbeddedRecoveryFlowType = /* @__PURE__ */ function(EmbeddedRecoveryFlowType
 //#endregion
 //#region src/models/flow-meta.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * The type of entity to retrieve flow metadata for.
 *
 * @example
@@ -1601,33 +1752,15 @@ let FlowMetaType = /* @__PURE__ */ function(FlowMetaType$1) {
 
 //#endregion
 //#region src/models/flow.ts
-/**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
 let FlowMode = /* @__PURE__ */ function(FlowMode$1) {
 	/**
 	* This mode is suitable for embedded sign-in, sign-up, etc. flows where the authentication
 	* UIs are rendered within the application.
-	* @see {@link https://is.docs.wso2.com/en/7.1.0/references/app-native-authentication/}
 	*/
 	FlowMode$1["Embedded"] = "DIRECT";
 	/**
 	* Traditional redirect based sign-in, sign-up, etc. flows where the authentication
-	* UIs are from a external Identity Provider (ex: WSO2 Identity Server or ThunderID).
+	* UIs are from a external Identity Provider (ex: ThunderID).
 	*/
 	FlowMode$1["Redirect"] = "REDIRECTION";
 	return FlowMode$1;
@@ -1635,23 +1768,6 @@ let FlowMode = /* @__PURE__ */ function(FlowMode$1) {
 
 //#endregion
 //#region src/models/field.ts
-/**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
 let FieldType = /* @__PURE__ */ function(FieldType$1) {
 	FieldType$1["Checkbox"] = "CHECKBOX";
 	FieldType$1["Date"] = "DATE";
@@ -1671,23 +1787,6 @@ let FieldType = /* @__PURE__ */ function(FieldType$1) {
 //#endregion
 //#region src/constants/OIDCDiscoveryConstants.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Constants related to OpenID Connect (OIDC) metadata and endpoints.
 * This object contains all the standard OIDC endpoints and storage keys
 * used throughout the application for authentication and authorization.
@@ -1699,511 +1798,171 @@ let FieldType = /* @__PURE__ */ function(FieldType$1) {
 *
 * @example
 * ```typescript
-* // Using an endpoint
-* const authEndpoint = OIDCDiscoveryConstants.Endpoints.AUTHORIZATION;
-*
-* // Using a storage key
-* const tokenKey = OIDCDiscoveryConstants.Storage.StorageKeys.Endpoints.TOKEN;
-* ```
-*/
-const OIDCDiscoveryConstants = {
-	Endpoints: {
-		AUTHORIZATION: "/oauth2/authorize",
-		END_SESSION: "/oauth2/logout",
-		ISSUER: "/oauth2/token",
-		JWKS: "/oauth2/jwks",
-		REVOCATION: "/oauth2/revoke",
-		SESSION_IFRAME: "/oidc/checksession",
-		TOKEN: "/oauth2/token",
-		USERINFO: "/oauth2/userinfo"
-	},
-	Storage: { StorageKeys: {
-		Endpoints: {
-			AUTHORIZATION: "authorization_endpoint",
-			END_SESSION: "end_session_endpoint",
-			ISSUER: "issuer",
-			JWKS: "jwks_uri",
-			REVOCATION: "revocation_endpoint",
-			SESSION_IFRAME: "check_session_iframe",
-			TOKEN: "token_endpoint",
-			USERINFO: "userinfo_endpoint"
-		},
-		OPENID_PROVIDER_CONFIG_INITIATED: "op_config_initiated"
-	} }
-};
-var OIDCDiscoveryConstants_default = OIDCDiscoveryConstants;
-
-//#endregion
-//#region src/constants/PKCEConstants.ts
-/**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
-* Constants related to Proof Key for Code Exchange (PKCE) implementation.
-* This object contains all the necessary constants for implementing PKCE
-* flow in the OAuth 2.0 authorization code grant.
-*
-* @remarks
-* PKCE is an extension to the authorization code flow to prevent CSRF and
-* authorization code injection attacks. The constants are organized into
-* storage-related sections for managing PKCE state.
-*
-* @example
-* ```typescript
-* // Using storage keys
-* const codeVerifierKey = PKCEConstants.Storage.StorageKeys.CODE_VERIFIER;
-* const separator = PKCEConstants.Storage.StorageKeys.SEPARATOR;
-* ```
-*/
-const PKCEConstants = {
-	DEFAULT_CODE_CHALLENGE_METHOD: "S256",
-	Storage: { StorageKeys: {
-		CODE_VERIFIER: "pkce_code_verifier",
-		SEPARATOR: "#"
-	} }
-};
-var PKCEConstants_default = PKCEConstants;
-
-//#endregion
-//#region src/DefaultCacheStore.ts
-/**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-var DefaultCacheStore = class {
-	cache;
-	constructor() {
-		this.cache = /* @__PURE__ */ new Map();
-	}
-	get length() {
-		return this.cache.size;
-	}
-	getItem(key) {
-		return this.cache.get(key) ?? null;
-	}
-	setItem(key, value) {
-		this.cache.set(key, value);
-	}
-	removeItem(key) {
-		this.cache.delete(key);
-	}
-	clear() {
-		this.cache.clear();
-	}
-	key(index) {
-		return Array.from(this.cache.keys())[index] ?? null;
-	}
-	async setData(key, value) {
-		this.cache.set(key, value);
-	}
-	async getData(key) {
-		return this.cache.get(key) ?? "{}";
-	}
-	async removeData(key) {
-		this.cache.delete(key);
-	}
-};
-
-//#endregion
-//#region src/DefaultCrypto.ts
-/**
-* Default implementation of the Crypto interface using the 'jose' library
-* and the native Web Crypto API.
-*/
-var DefaultCrypto = class {
-	base64URLDecode(value) {
-		const decodedArray = jose.base64url.decode(value);
-		return new TextDecoder().decode(decodedArray);
-	}
-	base64URLEncode(value) {
-		return jose.base64url.encode(value);
-	}
-	generateRandomBytes(length) {
-		return crypto.getRandomValues(new Uint8Array(length));
-	}
-	async hashSha256(data) {
-		const dataBuffer = new TextEncoder().encode(data);
-		const hashBuffer = await crypto.subtle.digest("SHA-256", dataBuffer);
-		return new Uint8Array(hashBuffer);
-	}
-	async verifyJwt(idToken, jwk, algorithms, clientId, issuer, subject, clockTolerance, validateJwtIssuer = true) {
-		const key = await jose.importJWK(jwk);
-		await jose.jwtVerify(idToken, key, {
-			algorithms,
-			audience: [clientId],
-			clockTolerance,
-			issuer: validateJwtIssuer ? issuer : void 0,
-			subject
-		});
-		return true;
-	}
-};
-
-//#endregion
-//#region src/models/store.ts
-/**
-* Enum representing different types of data stores used in the application.
-*/
-let Stores = /* @__PURE__ */ function(Stores$1) {
-	/**
-	* Store for configuration data that defines the application's behavior and settings.
-	*/
-	Stores$1["ConfigData"] = "config_data";
-	/**
-	* Store for OpenID Connect provider metadata, including endpoints and configuration.
-	*/
-	Stores$1["OIDCProviderMetaData"] = "oidc_provider_meta_data";
-	/**
-	* Store for persisted data that needs to be retained across sessions and application restarts.
-	*/
-	Stores$1["PersistedData"] = "persisted_data";
-	/**
-	* Store for user session-related data like tokens and authentication state.
-	*/
-	Stores$1["SessionData"] = "session_data";
-	/**
-	* Store for temporary data that needs to persist only for a short duration.
-	*/
-	Stores$1["TemporaryData"] = "temporary_data";
-	/**
-	* Store for data that leverages local storage if available, falling back to the configured storage.
-	*/
-	Stores$1["HybridData"] = "hybrid_data";
-	return Stores$1;
-}({});
-
-//#endregion
-//#region src/utils/logger.ts
-const PREFIX = "⚡ ThunderID";
-/**
-* Default logger configuration
-*/
-const DEFAULT_CONFIG$1 = {
-	level: "info",
-	prefix: `${PREFIX}`,
-	showLevel: true,
-	timestamps: true
-};
-/**
-* Environment detection utilities
-*/
-const isBrowser = () => typeof window !== "undefined" && typeof window.document !== "undefined";
-const isNode = () => typeof process !== "undefined" && void 0;
-/**
-* Color codes for terminal output (Node.js)
-*/
-const COLORS = {
-	blue: "\x1B[34m",
-	bright: "\x1B[1m",
-	cyan: "\x1B[36m",
-	dim: "\x1B[2m",
-	gray: "\x1B[90m",
-	green: "\x1B[32m",
-	magenta: "\x1B[35m",
-	red: "\x1B[31m",
-	reset: "\x1B[0m",
-	white: "\x1B[37m",
-	yellow: "\x1B[33m"
-};
-/**
-* Browser console styling
+* // Using an endpoint
+* const authEndpoint = OIDCDiscoveryConstants.Endpoints.AUTHORIZATION;
+*
+* // Using a storage key
+* const tokenKey = OIDCDiscoveryConstants.Storage.StorageKeys.Endpoints.TOKEN;
+* ```
 */
-const BROWSER_STYLES = {
-	debug: "color: #6b7280; font-weight: normal;",
-	error: "color: #dc2626; font-weight: bold;",
-	info: "color: #2563eb; font-weight: bold;",
-	prefix: "color: #7c3aed; font-weight: bold;",
-	timestamp: "color: #6b7280; font-size: 0.9em;",
-	warn: "color: #d97706; font-weight: bold;"
-};
-const LOG_LEVEL_ORDER = {
-	debug: 0,
-	error: 3,
-	info: 1,
-	warn: 2
+const OIDCDiscoveryConstants = {
+	Endpoints: {
+		AUTHORIZATION: "/oauth2/authorize",
+		END_SESSION: "/oauth2/logout",
+		ISSUER: "/oauth2/token",
+		JWKS: "/oauth2/jwks",
+		REVOCATION: "/oauth2/revoke",
+		SESSION_IFRAME: "/oidc/checksession",
+		TOKEN: "/oauth2/token",
+		USERINFO: "/oauth2/userinfo"
+	},
+	Storage: { StorageKeys: {
+		Endpoints: {
+			AUTHORIZATION: "authorization_endpoint",
+			END_SESSION: "end_session_endpoint",
+			ISSUER: "issuer",
+			JWKS: "jwks_uri",
+			REVOCATION: "revocation_endpoint",
+			SESSION_IFRAME: "check_session_iframe",
+			TOKEN: "token_endpoint",
+			USERINFO: "userinfo_endpoint"
+		},
+		OPENID_PROVIDER_CONFIG_INITIATED: "op_config_initiated"
+	} }
 };
+var OIDCDiscoveryConstants_default = OIDCDiscoveryConstants;
+
+//#endregion
+//#region src/constants/PKCEConstants.ts
 /**
-* Universal logger class that works in both browser and Node.js environments
+* Constants related to Proof Key for Code Exchange (PKCE) implementation.
+* This object contains all the necessary constants for implementing PKCE
+* flow in the OAuth 2.0 authorization code grant.
+*
+* @remarks
+* PKCE is an extension to the authorization code flow to prevent CSRF and
+* authorization code injection attacks. The constants are organized into
+* storage-related sections for managing PKCE state.
+*
+* @example
+* ```typescript
+* // Using storage keys
+* const codeVerifierKey = PKCEConstants.Storage.StorageKeys.CODE_VERIFIER;
+* const separator = PKCEConstants.Storage.StorageKeys.SEPARATOR;
+* ```
 */
-var Logger = class Logger {
-	config;
-	constructor(config = {}) {
-		this.config = {
-			...DEFAULT_CONFIG$1,
-			...config
-		};
+const PKCEConstants = {
+	DEFAULT_CODE_CHALLENGE_METHOD: "S256",
+	Storage: { StorageKeys: {
+		CODE_VERIFIER: "pkce_code_verifier",
+		SEPARATOR: "#"
+	} }
+};
+var PKCEConstants_default = PKCEConstants;
+
+//#endregion
+//#region src/DefaultCacheStore.ts
+var DefaultCacheStore = class {
+	cache;
+	constructor() {
+		this.cache = /* @__PURE__ */ new Map();
 	}
-	/**
-	* Update logger configuration
-	*/
-	configure(config) {
-		this.config = {
-			...this.config,
-			...config
-		};
+	get length() {
+		return this.cache.size;
 	}
-	/**
-	* Get current configuration
-	*/
-	getConfig() {
-		return { ...this.config };
+	getItem(key) {
+		return this.cache.get(key) ?? null;
 	}
-	/**
-	* Check if a log level should be output
-	*/
-	shouldLog(level) {
-		return LOG_LEVEL_ORDER[level] >= LOG_LEVEL_ORDER[this.config.level];
+	setItem(key, value) {
+		this.cache.set(key, value);
 	}
-	/**
-	* Get timestamp string
-	*/
-	static getTimestamp() {
-		return (/* @__PURE__ */ new Date()).toISOString();
+	removeItem(key) {
+		this.cache.delete(key);
 	}
-	/**
-	* Get log level string
-	*/
-	static getLevelString(level) {
-		switch (level) {
-			case "debug": return "DEBUG";
-			case "info": return "INFO";
-			case "warn": return "WARN";
-			case "error": return "ERROR";
-			default: return "UNKNOWN";
-		}
+	clear() {
+		this.cache.clear();
 	}
-	/**
-	* Format message for Node.js terminal
-	*/
-	formatForNode(level, message) {
-		const parts = [];
-		if (this.config.timestamps) parts.push(`${COLORS.gray}[${Logger.getTimestamp()}]${COLORS.reset}`);
-		if (this.config.prefix) parts.push(`${COLORS.magenta}${this.config.prefix}${COLORS.reset}`);
-		if (this.config.showLevel) {
-			const levelStr = Logger.getLevelString(level);
-			let coloredLevel;
-			switch (level) {
-				case "debug":
-					coloredLevel = `${COLORS.gray}[${levelStr}]${COLORS.reset}`;
-					break;
-				case "info":
-					coloredLevel = `${COLORS.blue}[${levelStr}]${COLORS.reset}`;
-					break;
-				case "warn":
-					coloredLevel = `${COLORS.yellow}[${levelStr}]${COLORS.reset}`;
-					break;
-				case "error":
-					coloredLevel = `${COLORS.red}[${levelStr}]${COLORS.reset}`;
-					break;
-				default: coloredLevel = `[${levelStr}]`;
-			}
-			parts.push(coloredLevel);
-		}
-		parts.push(message);
-		return parts.join(" ");
+	key(index) {
+		return Array.from(this.cache.keys())[index] ?? null;
 	}
-	/**
-	* Log message using appropriate method
-	*/
-	logMessage(level, message, ...args) {
-		if (!this.shouldLog(level)) return;
-		if (this.config.formatter) {
-			this.config.formatter(level, message, ...args);
-			return;
-		}
-		if (isBrowser()) this.logToBrowser(level, message, ...args);
-		else if (isNode()) this.logToNode(level, message, ...args);
-		else console.log(message, ...args);
+	async setData(key, value) {
+		this.cache.set(key, value);
 	}
-	/**
-	* Log to browser console with styling
-	*/
-	logToBrowser(level, message, ...args) {
-		const parts = [];
-		const styles = [];
-		if (this.config.timestamps) {
-			parts.push(`%c[${Logger.getTimestamp()}]`);
-			styles.push(BROWSER_STYLES.timestamp);
-		}
-		if (this.config.prefix) {
-			parts.push(`%c${this.config.prefix}`);
-			styles.push(BROWSER_STYLES.prefix);
-		}
-		if (this.config.showLevel) {
-			const levelStr = Logger.getLevelString(level);
-			parts.push(`%c[${levelStr}]`);
-			switch (level) {
-				case "debug":
-					styles.push(BROWSER_STYLES.debug);
-					break;
-				case "info":
-					styles.push(BROWSER_STYLES.info);
-					break;
-				case "warn":
-					styles.push(BROWSER_STYLES.warn);
-					break;
-				case "error":
-					styles.push(BROWSER_STYLES.error);
-					break;
-				default: styles.push("");
-			}
-		}
-		parts.push(`%c${message}`);
-		styles.push("color: inherit; font-weight: normal;");
-		const formattedMessage = parts.join(" ");
-		switch (level) {
-			case "debug":
-				console.debug(formattedMessage, ...styles, ...args);
-				break;
-			case "info":
-				console.info(formattedMessage, ...styles, ...args);
-				break;
-			case "warn":
-				console.warn(formattedMessage, ...styles, ...args);
-				break;
-			case "error":
-				console.error(formattedMessage, ...styles, ...args);
-				break;
-			default: console.log(formattedMessage, ...styles, ...args);
-		}
+	async getData(key) {
+		return this.cache.get(key) ?? "{}";
 	}
-	/**
-	* Log to Node.js console
-	*/
-	logToNode(level, message, ...args) {
-		const formattedMessage = this.formatForNode(level, message);
-		switch (level) {
-			case "debug":
-				console.debug(formattedMessage, ...args);
-				break;
-			case "info":
-				console.info(formattedMessage, ...args);
-				break;
-			case "warn":
-				console.warn(formattedMessage, ...args);
-				break;
-			case "error":
-				console.error(formattedMessage, ...args);
-				break;
-			default: console.log(formattedMessage, ...args);
-		}
+	async removeData(key) {
+		this.cache.delete(key);
+	}
+};
+
+//#endregion
+//#region src/DefaultCrypto.ts
+/**
+* Default implementation of the Crypto interface using the 'jose' library
+* and the native Web Crypto API.
+*/
+var DefaultCrypto = class {
+	base64URLDecode(value) {
+		const decodedArray = jose.base64url.decode(value);
+		return new TextDecoder().decode(decodedArray);
 	}
-	/**
-	* Log debug message
-	*/
-	debug(message, ...args) {
-		this.logMessage("debug", message, ...args);
+	base64URLEncode(value) {
+		return jose.base64url.encode(value);
+	}
+	generateRandomBytes(length) {
+		return crypto.getRandomValues(new Uint8Array(length));
+	}
+	async hashSha256(data) {
+		const dataBuffer = new TextEncoder().encode(data);
+		const hashBuffer = await crypto.subtle.digest("SHA-256", dataBuffer);
+		return new Uint8Array(hashBuffer);
+	}
+	async verifyJwt(idToken, jwk, algorithms, clientId, issuer, subject, clockTolerance, validateJwtIssuer = true) {
+		const key = await jose.importJWK(jwk);
+		await jose.jwtVerify(idToken, key, {
+			algorithms,
+			audience: [clientId],
+			clockTolerance,
+			issuer: validateJwtIssuer ? issuer : void 0,
+			subject
+		});
+		return true;
 	}
+};
+
+//#endregion
+//#region src/models/store.ts
+/**
+* Enum representing different types of data stores used in the application.
+*/
+let Stores = /* @__PURE__ */ function(Stores$1) {
 	/**
-	* Log info message
+	* Store for configuration data that defines the application's behavior and settings.
 	*/
-	info(message, ...args) {
-		this.logMessage("info", message, ...args);
-	}
+	Stores$1["ConfigData"] = "config_data";
 	/**
-	* Log warning message
+	* Store for OpenID Connect provider metadata, including endpoints and configuration.
 	*/
-	warn(message, ...args) {
-		this.logMessage("warn", message, ...args);
-	}
+	Stores$1["OIDCProviderMetaData"] = "oidc_provider_meta_data";
 	/**
-	* Log error message
+	* Store for persisted data that needs to be retained across sessions and application restarts.
 	*/
-	error(message, ...args) {
-		this.logMessage("error", message, ...args);
-	}
+	Stores$1["PersistedData"] = "persisted_data";
 	/**
-	* Create a child logger with additional prefix
+	* Store for user session-related data like tokens and authentication state.
 	*/
-	child(prefix) {
-		const childPrefix = this.config.prefix ? `${this.config.prefix} - ${prefix}` : prefix;
-		return new Logger({
-			...this.config,
-			prefix: childPrefix
-		});
-	}
+	Stores$1["SessionData"] = "session_data";
 	/**
-	* Set log level
+	* Store for temporary data that needs to persist only for a short duration.
 	*/
-	setLevel(level) {
-		this.config.level = level;
-	}
+	Stores$1["TemporaryData"] = "temporary_data";
 	/**
-	* Get current log level
+	* Store for data that leverages local storage if available, falling back to the configured storage.
 	*/
-	getLevel() {
-		return this.config.level;
-	}
-};
-/**
-* Default logger instance
-*/
-const logger = new Logger();
-/**
-* Create a new logger instance with custom configuration
-*/
-const createLogger = (config) => new Logger(config);
-/**
-* Default export - global logger instance
-*/
-var logger_default = logger;
-/**
-* Named exports for convenience
-*/
-const debug = (message, ...args) => logger.debug(message, ...args);
-const info = (message, ...args) => logger.info(message, ...args);
-const warn = (message, ...args) => logger.warn(message, ...args);
-const error = (message, ...args) => logger.error(message, ...args);
-/**
-* Configure the default logger
-*/
-const configure = (config) => logger.configure(config);
-/**
-* Create component-specific loggers
-*/
-const createComponentLogger = (component) => logger.child(component);
-/**
-* Create package-specific logger
-*/
-const createPackageLogger = (packageName) => createLogger({
-	level: "info",
-	prefix: `${PREFIX} - ${packageName}`,
-	showLevel: true,
-	timestamps: true
-});
-/**
-* Create package component logger (package + component)
-*/
-const createPackageComponentLogger = (packageName, component) => {
-	return createPackageLogger(packageName).child(component);
-};
+	Stores$1["HybridData"] = "hybrid_data";
+	return Stores$1;
+}({});
 
 //#endregion
 //#region src/StorageManager.ts
@@ -2526,24 +2285,43 @@ const processOpenIDScopes = (scopes) => {
 var processOpenIDScopes_default = processOpenIDScopes;
 
 //#endregion
-//#region src/constants/TokenExchangeConstants.ts
+//#region src/utils/resolveResourceEndpoint.ts
+/**
+* The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
+* endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.
+*/
+const RESOURCE_ENDPOINT_KEYS = [
+	"flowExecute",
+	"flowMeta",
+	"usersMe"
+];
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+* Resolves the absolute `url` to use for a resource-server endpoint, honoring (in order of
+* precedence) an explicit per-call URL, then a `config.endpoints` override.
 *
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
+* Returns `undefined` when neither is set, so the calling API function falls back to deriving the
+* endpoint from `baseUrl` (i.e. `${baseUrl}/flow/execute`) exactly as before. Callers should keep
+* passing `baseUrl` alongside the resolved `url` to preserve that fallback.
 *
-*     http://www.apache.org/licenses/LICENSE-2.0
+* @param key - The resource endpoint to resolve.
+* @param config - The client config carrying optional `endpoints` overrides.
+* @param explicitUrl - An explicit URL provided by the immediate caller; takes highest precedence.
+* @returns The resolved override URL, or `undefined` to defer to `baseUrl`-based resolution.
 *
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
+* @example
+* ```typescript
+* const response = await executeEmbeddedUserOnboardingFlow({
+*   baseUrl: config.baseUrl,
+*   url: resolveResourceEndpoint('flowExecute', config),
+*   payload,
+* });
+* ```
 */
+const resolveResourceEndpoint = (key, config, explicitUrl) => explicitUrl ?? config?.endpoints?.[key] ?? void 0;
+var resolveResourceEndpoint_default = resolveResourceEndpoint;
+
+//#endregion
+//#region src/constants/TokenExchangeConstants.ts
 /**
 * Constants for OAuth 2.0 Token Exchange operations.
 * This object contains placeholders used in token exchange requests
@@ -2595,6 +2373,25 @@ var AuthenticationHelper = class {
 		this.cryptoHelper = cryptoHelperInstance;
 	}
 	/**
+	* Maps the config-defined OIDC endpoint overrides to their discovery-metadata form.
+	*
+	* Endpoint names are converted from camelCase to snake_case, and resource-server endpoints
+	* (`RESOURCE_ENDPOINT_KEYS`) are excluded — those are resolved separately via
+	* `resolveResourceEndpoint` and must not leak into the OIDC provider metadata.
+	*
+	* @param configData - The resolved auth client config.
+	* @returns A snake_cased map of the OIDC endpoint overrides (empty when none are configured).
+	*/
+	mapConfiguredOidcEndpoints(configData) {
+		const endpoints = {};
+		if (!configData.endpoints) return endpoints;
+		Object.keys(configData.endpoints).filter((endpointName) => !RESOURCE_ENDPOINT_KEYS.includes(endpointName)).forEach((endpointName) => {
+			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+			endpoints[snakeCasedName] = configData.endpoints ? configData.endpoints[endpointName] : "";
+		});
+		return endpoints;
+	}
+	/**
 	* Merges explicit endpoint overrides from config into the discovery response.
 	* Config-defined endpoint names (camelCase) are converted to snake_case before merging.
 	*
@@ -2602,15 +2399,10 @@ var AuthenticationHelper = class {
 	* @returns The discovery response with any config-specified endpoint overrides applied.
 	*/
 	async resolveEndpoints(response) {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
 		return {
 			...response,
-			...oidcProviderMetaData
+			...this.mapConfiguredOidcEndpoints(configData)
 		};
 	}
 	/**
@@ -2621,7 +2413,6 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When required endpoints are absent from the config.
 	*/
 	async resolveEndpointsExplicitly() {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
 		const requiredEndpoints = [
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.AUTHORIZATION,
@@ -2636,11 +2427,7 @@ var AuthenticationHelper = class {
 		if (!(configData.endpoints ? requiredEndpoints.every((reqEndpointName) => configData.endpoints ? Object.keys(configData.endpoints).some((endpointName) => {
 			return endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`) === reqEndpointName;
 		}) : false) : false)) throw new ThunderIDAuthException("JS-AUTH_HELPER-REE-NF01", "Required endpoints missing", "Some or all of the required endpoints are missing in the object passed to the `endpoints` attribute of the`AuthConfig` object.");
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
-		return { ...oidcProviderMetaData };
+		return { ...this.mapConfiguredOidcEndpoints(configData) };
 	}
 	/**
 	* Derives OIDC endpoint URLs from the configured `baseUrl`.
@@ -2651,14 +2438,10 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When `baseUrl` is not defined in the config.
 	*/
 	async resolveEndpointsByBaseURL() {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
 		const { baseUrl } = configData;
 		if (!baseUrl) throw new ThunderIDAuthException("JS-AUTH_HELPER_REBO-NF01", "Base URL not defined.", "Base URL is not defined in AuthClient config.");
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
+		const oidcProviderMetaData = this.mapConfiguredOidcEndpoints(configData);
 		const endpointKeys = OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints;
 		const endpointPaths = OIDCDiscoveryConstants_default.Endpoints;
 		return {
@@ -2814,23 +2597,6 @@ var base64Encode_default = base64Encode;
 //#endregion
 //#region src/utils/deepMerge.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Checks if a value is a plain object (not an array, function, date, etc.)
 *
 * @param value - The value to check
@@ -3086,8 +2852,18 @@ var ThunderIDJavaScriptClient = class {
 		return createdAt + parseInt(expiresInString, 10) * 1e3 > (/* @__PURE__ */ new Date()).getTime();
 	}
 	async getAccessToken(sessionId) {
+		if ((await this.configProvider()).grantType === "client_credentials") {
+			const sessionData = await this.storageManager.getSessionData(sessionId);
+			if (sessionData?.access_token && this.isCachedTokenStillValid(sessionData)) return sessionData.access_token;
+			return (await this.requestClientCredentialsToken(sessionId)).accessToken;
+		}
 		return (await this.storageManager.getSessionData(sessionId))?.access_token;
 	}
+	isCachedTokenStillValid(sessionData) {
+		if (!sessionData.created_at || !sessionData.expires_in) return false;
+		const expiresInMs = parseInt(sessionData.expires_in, 10) * 1e3;
+		return sessionData.created_at + expiresInMs - TokenConstants_default.Lifecycle.CLIENT_CREDENTIALS_REFRESH_MARGIN_MS > Date.now();
+	}
 	clearSession(sessionId) {
 		this.authHelper.clearSession(sessionId);
 	}
@@ -3360,6 +3136,56 @@ var ThunderIDJavaScriptClient = class {
 		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
+	/**
+	* Requests a machine-to-machine access token via the `client_credentials` grant
+	* (RFC 6749 §4.4) and caches it under the given session key. Unlike the user-facing
+	* flows, there's no id_token or refresh_token: the service authenticates as itself.
+	*/
+	async requestClientCredentialsToken(sessionId) {
+		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
+		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
+		const configData = await this.configProvider();
+		if (!tokenEndpoint || tokenEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NF01", "Token endpoint not found.", "No token endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the token endpoint passed to the SDK is empty.");
+		const body = new URLSearchParams();
+		body.set("grant_type", "client_credentials");
+		body.set("client_id", configData.clientId ?? "");
+		const hasSecret = Boolean(configData.clientSecret && configData.clientSecret.trim().length > 0);
+		const tokenEndpointAuthMethod = configData.tokenRequest?.authMethod ?? "client_secret_basic";
+		if (hasSecret && tokenEndpointAuthMethod === "client_secret_post") body.set("client_secret", configData.clientSecret);
+		const scope = Array.isArray(configData.scopes) ? configData.scopes.join(" ") : configData.scopes;
+		if (scope) body.set("scope", scope);
+		if (configData.tokenRequest?.params) Object.entries(configData.tokenRequest.params).forEach(([key, value]) => {
+			body.set(key, value);
+		});
+		const tokenRequestHeaders = {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded"
+		};
+		if (hasSecret && tokenEndpointAuthMethod === "client_secret_basic") tokenRequestHeaders["Authorization"] = `Basic ${base64Encode_default(`${encodeURIComponent(configData.clientId)}:${encodeURIComponent(configData.clientSecret)}`)}`;
+		let tokenResponse;
+		try {
+			tokenResponse = await fetch(tokenEndpoint, {
+				body,
+				headers: tokenRequestHeaders,
+				method: "POST"
+			});
+		} catch (error$1) {
+			throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NE02", "Requesting client credentials token failed.", error$1 ?? "The request to get the client credentials access token failed.");
+		}
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		const parsedResponse = await tokenResponse.json();
+		parsedResponse.created_at = (/* @__PURE__ */ new Date()).getTime();
+		await this.storageManager.setSessionData(parsedResponse, sessionId);
+		return {
+			accessToken: parsedResponse.access_token,
+			createdAt: parsedResponse.created_at,
+			expiresIn: parsedResponse.expires_in,
+			idToken: parsedResponse.id_token ?? "",
+			refreshToken: parsedResponse.refresh_token ?? "",
+			scope: parsedResponse.scope,
+			tokenType: parsedResponse.token_type
+		};
+	}
 	async revokeAccessToken(userId) {
 		const revokeTokenEndpoint = (await this.oidcProviderMetaDataProvider()).revocation_endpoint;
 		const configData = await this.configProvider();
@@ -3994,23 +3820,6 @@ var createTheme_default = createTheme;
 //#endregion
 //#region src/utils/arrayBufferToBase64url.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Converts an ArrayBuffer to a base64url encoded string.
 *
 * Base64url encoding is a URL-safe variant of base64 encoding that:
@@ -4050,23 +3859,6 @@ var arrayBufferToBase64url_default = arrayBufferToBase64url;
 //#endregion
 //#region src/utils/base64urlToArrayBuffer.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Converts a base64url encoded string back to an ArrayBuffer.
 *
 * This function performs the inverse operation of base64url encoding by:
@@ -4115,23 +3907,6 @@ var base64urlToArrayBuffer_default = base64urlToArrayBuffer;
 //#endregion
 //#region src/utils/bem.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Creates a BEM-style class name by combining a base class with element and/or modifier
 *
 * @param baseClass - The base CSS class string (usually from emotion's css function)
@@ -4169,23 +3944,6 @@ var bem_default = bem;
 //#endregion
 //#region src/utils/formatDate.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Formats a date string to a human-readable format.
 *
 * @param dateString - The date string to format (optional)
@@ -4336,23 +4094,6 @@ var getRedirectBasedSignUpUrl_default = getRedirectBasedSignUpUrl;
 //#endregion
 //#region src/utils/isEmpty.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Checks if a value is considered empty.
 *
 * A value is considered empty if it is:
@@ -4392,23 +4133,6 @@ var isEmpty_default = isEmpty;
 
 //#endregion
 //#region src/utils/isEmojiUri.ts
-/**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
 const EMOJI_URI_SCHEME = "emoji:";
 /**
 * Checks whether a given URI uses the `emoji:` scheme (e.g. `"emoji:🐯"`).
@@ -4449,23 +4173,6 @@ var extractEmojiFromUri_default = extractEmojiFromUri;
 //#endregion
 //#region src/utils/set.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Sets the value at path of object. If a portion of path doesn't exist,
 * it's created. Arrays are created for missing index properties while
 * objects are created for all other missing properties.
@@ -4495,23 +4202,6 @@ var set_default = set;
 //#endregion
 //#region src/utils/get.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Gets the value at path of object. If the resolved value is undefined,
 * the defaultValue is returned in its place.
 * Similar to Lodash's get() function
@@ -4531,23 +4221,6 @@ var get_default = get;
 //#endregion
 //#region src/utils/startCase.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com). All Rights Reserved.
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Converts the first character of `string` to upper case.
 *
 * @param string - The string to convert.
@@ -4572,23 +4245,6 @@ var startCase_default = startCase;
 //#endregion
 //#region src/utils/removeTrailingSlash.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Removes a trailing slash from a path string if it exists.
 *
 * @param path - The string path to process
@@ -4641,23 +4297,6 @@ function resolveMeta(path, meta) {
 //#endregion
 //#region src/utils/parseFlowTemplateLiteral.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Regular expression to detect a flow template literal wrapped in double braces.
 * Matches patterns like `{{ t(key) }}`, `{{ meta(key) }}`, etc.
 *
@@ -4774,23 +4413,6 @@ function resolveFlowTemplateLiterals(text, { t, meta }) {
 //#endregion
 //#region src/utils/countryCodeToFlagEmoji.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Converts a two-letter ISO 3166-1 alpha-2 country code to a flag emoji using
 * Unicode Regional Indicator Symbols (U+1F1E6–U+1F1FF).
 *
@@ -4804,23 +4426,6 @@ function countryCodeToFlagEmoji(countryCode) {
 //#endregion
 //#region src/utils/resolveLocaleDisplayName.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
 * Resolves a BCP 47 locale tag to a human-readable display name using the
 * `Intl.DisplayNames` API.
 *
@@ -4992,7 +4597,7 @@ var buildValidatorFromRules_default = buildValidatorFromRules;
 * ```typescript
 * // Usage with clsx
 * clsx(withVendorCSSClassPrefix('sign-in-button'), className)
-* // Result: "wso2-sign-in-button"
+* // Result: "thunderid-sign-in-button"
 * ```
 */
 const withVendorCSSClassPrefix = (className) => `${VendorConstants_default.VENDOR_PREFIX}-${className}`;
@@ -6100,4 +5705,4 @@ const normalizeTranslations = (translations) => {
 var normalizeTranslations_default = normalizeTranslations;
 
 //#endregion
-export { ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants, AuthenticationHelper_default as AuthenticationHelper, DEFAULT_THEME, DEFAULT_VALIDATION_MESSAGE_KEYS, EMOJI_URI_SCHEME, EmbeddedFlowActionVariant, EmbeddedFlowComponentType, EmbeddedFlowEventType, EmbeddedFlowResponseType, EmbeddedFlowTextVariant, EmbeddedFlowType, EmbeddedRecoveryFlowStatus, EmbeddedRecoveryFlowType, EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, EmbeddedSignUpFlowStatus, EmbeddedSignUpFlowType, FieldType, FlowMetaType, FlowMode, HttpClient, IsomorphicCrypto, OIDCRequestConstants_default as OIDCRequestConstants, StorageManager_default as StorageManager, ThunderIDAPIError, ThunderIDAuthException, ThunderIDError, ThunderIDJavaScriptClient_default as ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants_default as TokenConstants, TranslationBundleConstants_default as TranslationBundleConstants, VendorConstants_default as VendorConstants, arrayBufferToBase64url_default as arrayBufferToBase64url, base64urlToArrayBuffer_default as base64urlToArrayBuffer, bem_default as bem, buildValidatorFromRules_default as buildValidatorFromRules, configure as configureLogger, countryCodeToFlagEmoji, createComponentLogger, createLogger, createPackageComponentLogger, createPackageLogger, createTheme_default as createTheme, debug, deepMerge_default as deepMerge, error, evaluateValidationRule_default as evaluateValidationRule, executeEmbeddedRecoveryFlow_default as executeEmbeddedRecoveryFlow, executeEmbeddedSignInFlow_default as executeEmbeddedSignInFlow, executeEmbeddedSignUpFlow_default as executeEmbeddedSignUpFlow, executeEmbeddedUserOnboardingFlow_default as executeEmbeddedUserOnboardingFlow, extractEmojiFromUri_default as extractEmojiFromUri, extractPkceStorageKeyFromState_default as extractPkceStorageKeyFromState, extractUserClaimsFromIdToken_default as extractUserClaimsFromIdToken, formatDate_default as formatDate, generateFlattenedUserProfile_default as generateFlattenedUserProfile, get_default as get, getDefaultI18nBundles_default as getDefaultI18nBundles, getFlowMeta_default as getFlowMeta, getLatestStateParam_default as getLatestStateParam, getOrganizationUnitChildren_default as getOrganizationUnitChildren, getRedirectBasedSignUpUrl_default as getRedirectBasedSignUpUrl, getUserInfo_default as getUserInfo, getUsersMe_default as getUsersMe, getVendorPrefix_default as getVendorPrefix, info, isEmojiUri_default as isEmojiUri, isEmpty_default as isEmpty, isRecognizedBaseUrlPattern_default as isRecognizedBaseUrlPattern, logger_default as logger, normalizeTranslations_default as normalizeTranslations, processOpenIDScopes_default as processOpenIDScopes, processUsername_default as processUsername, removeTrailingSlash_default as removeTrailingSlash, resolveFieldName_default as resolveFieldName, resolveFlowTemplateLiterals, resolveLocaleDisplayName, resolveLocaleEmoji_default as resolveLocaleEmoji, resolveMeta, set_default as set, startCase_default as startCase, updateMeProfile_default as updateMeProfile, warn, withVendorCSSClassPrefix_default as withVendorCSSClassPrefix };
+export { ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants, AuthenticationHelper_default as AuthenticationHelper, DEFAULT_THEME, DEFAULT_VALIDATION_MESSAGE_KEYS, EMOJI_URI_SCHEME, EmbeddedFlowActionVariant, EmbeddedFlowComponentType, EmbeddedFlowEventType, EmbeddedFlowResponseType, EmbeddedFlowTextVariant, EmbeddedFlowType, EmbeddedRecoveryFlowStatus, EmbeddedRecoveryFlowType, EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, EmbeddedSignUpFlowStatus, EmbeddedSignUpFlowType, FieldType, FlowMetaType, FlowMode, HttpClient, IsomorphicCrypto, OIDCRequestConstants_default as OIDCRequestConstants, StorageManager_default as StorageManager, ThunderIDAPIError, ThunderIDAuthException, ThunderIDError, ThunderIDJavaScriptClient_default as ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants_default as TokenConstants, TranslationBundleConstants_default as TranslationBundleConstants, VendorConstants_default as VendorConstants, arrayBufferToBase64url_default as arrayBufferToBase64url, base64urlToArrayBuffer_default as base64urlToArrayBuffer, bem_default as bem, buildValidatorFromRules_default as buildValidatorFromRules, configure as configureLogger, countryCodeToFlagEmoji, createComponentLogger, createLogger, createPackageComponentLogger, createPackageLogger, createTheme_default as createTheme, debug, deepMerge_default as deepMerge, error, evaluateValidationRule_default as evaluateValidationRule, executeEmbeddedRecoveryFlow_default as executeEmbeddedRecoveryFlow, executeEmbeddedSignInFlow_default as executeEmbeddedSignInFlow, executeEmbeddedSignUpFlow_default as executeEmbeddedSignUpFlow, executeEmbeddedUserOnboardingFlow_default as executeEmbeddedUserOnboardingFlow, extractEmojiFromUri_default as extractEmojiFromUri, extractPkceStorageKeyFromState_default as extractPkceStorageKeyFromState, extractUserClaimsFromIdToken_default as extractUserClaimsFromIdToken, formatDate_default as formatDate, generateFlattenedUserProfile_default as generateFlattenedUserProfile, get_default as get, getDefaultI18nBundles_default as getDefaultI18nBundles, getFlowMeta_default as getFlowMeta, getLatestStateParam_default as getLatestStateParam, getOrganizationUnitChildren_default as getOrganizationUnitChildren, getRedirectBasedSignUpUrl_default as getRedirectBasedSignUpUrl, getUserInfo_default as getUserInfo, getUsersMe_default as getUsersMe, getVendorPrefix_default as getVendorPrefix, info, isEmojiUri_default as isEmojiUri, isEmpty_default as isEmpty, isRecognizedBaseUrlPattern_default as isRecognizedBaseUrlPattern, logger_default as logger, normalizeTranslations_default as normalizeTranslations, processOpenIDScopes_default as processOpenIDScopes, processUsername_default as processUsername, removeTrailingSlash_default as removeTrailingSlash, resolveFieldName_default as resolveFieldName, resolveFlowTemplateLiterals, resolveLocaleDisplayName, resolveLocaleEmoji_default as resolveLocaleEmoji, resolveMeta, resolveResourceEndpoint_default as resolveResourceEndpoint, set_default as set, startCase_default as startCase, updateMeProfile_default as updateMeProfile, warn, withVendorCSSClassPrefix_default as withVendorCSSClassPrefix };