@thunderid/javascript 0.3.0 → 0.3.6

package/dist/cjs/index.cjs

@@ -349,101 +349,91 @@ var ThunderIDAPIError = class extends ThunderIDError {
 };
 
 //#endregion
-//#region src/api/initializeEmbeddedSignInFlow.ts
+//#region src/models/embedded-signin-flow.ts
 /**
-* Sends an authorization request to the specified OAuth2/OIDC authorization endpoint.
+* Status enumeration for ThunderID embedded sign-in flow operations.
 *
-* @param requestConfig - Request configuration object containing URL and payload.
-* @returns A promise that resolves with the authorization response.
-* @throws ThunderIDAPIError when the request fails or URL is invalid.
+* These statuses indicate the current state of the sign-in flow and determine
+* the next action required by the client application. Each status provides
+* specific guidance on how to proceed with the authentication process.
 *
 * @example
 * ```typescript
-* try {
-*   const authResponse = await initializeEmbeddedSignInFlow({
-*     url: "https://localhost:8090/oauth2/authorize",
-*     payload: {
-*       response_type: "code",
-*       client_id: "your-client-id",
-*       redirect_uri: "https://your-app.com/callback",
-*       scope: "openid profile email",
-*       state: "random-state-value",
-*       code_challenge: "your-pkce-challenge",
-*       code_challenge_method: "S256"
-*     }
-*   });
-*   console.log(authResponse);
-* } catch (error) {
-*   if (error instanceof ThunderIDAPIError) {
-*     console.error('Authorization failed:', error.message);
-*   }
+* switch (response.flowStatus) {
+*   case EmbeddedSignInFlowStatus.Incomplete:
+*     // More user input needed - render form components
+*     break;
+*   case EmbeddedSignInFlowStatus.Complete:
+*     // Authentication successful - handle completion
+*     break;
+*   case EmbeddedSignInFlowStatus.Error:
+*     // Authentication failed - show error message
+*     break;
 * }
 * ```
+*
+* @experimental Part of the new ThunderID API
 */
-const initializeEmbeddedSignInFlow = async ({ url, baseUrl, payload,...requestConfig }) => {
-	try {
-		new URL(url ?? baseUrl);
-	} catch (error$1) {
-		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1?.toString()}`, "getSchemas-ValidationError-001", "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
-	}
-	if (!payload) throw new ThunderIDAPIError("Authorization payload is required", "initializeEmbeddedSignInFlow-ValidationError-002", "javascript", 400, "If an authorization payload is not provided, the request cannot be constructed correctly.");
-	const searchParams = new URLSearchParams();
-	Object.entries(payload).forEach(([key, value]) => {
-		if (value !== void 0 && value !== null) searchParams.append(key, String(value));
-	});
-	try {
-		const response = await fetch(url ?? `${baseUrl}/oauth2/authorize`, {
-			...requestConfig,
-			body: searchParams.toString(),
-			headers: {
-				...requestConfig.headers,
-				Accept: "application/json",
-				"Content-Type": "application/x-www-form-urlencoded"
-			},
-			method: requestConfig.method || "POST"
-		});
-		if (!response.ok) throw new ThunderIDAPIError(await response.text(), "initializeEmbeddedSignInFlow-ResponseError-001", "javascript", response.status, response.statusText, "Authorization request failed");
-		return await response.json();
-	} catch (error$1) {
-		if (error$1 instanceof ThunderIDAPIError) throw error$1;
-		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "initializeEmbeddedSignInFlow-NetworkError-001", "javascript", 0, "Network Error");
-	}
-};
-var initializeEmbeddedSignInFlow_default = initializeEmbeddedSignInFlow;
-
-//#endregion
-//#region src/api/executeEmbeddedSignInFlow.ts
-const executeEmbeddedSignInFlow = async ({ url, baseUrl, payload,...requestConfig }) => {
-	try {
-		new URL(url ?? baseUrl);
-	} catch (error$1) {
-		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1?.toString()}`, "executeEmbeddedSignInFlow-ValidationError-001", "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
-	}
-	if (!payload) throw new ThunderIDAPIError("Authorization payload is required", "executeEmbeddedSignInFlow-ValidationError-002", "javascript", 400, "If an authorization payload is not provided, the request cannot be constructed correctly.");
-	try {
-		const response = await fetch(url ?? `${baseUrl}/oauth2/authn`, {
-			...requestConfig,
-			body: JSON.stringify(payload),
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/json",
-				...requestConfig.headers
-			},
-			method: requestConfig.method || "POST"
-		});
-		if (!response.ok) throw new ThunderIDAPIError(await response.text(), "initializeEmbeddedSignInFlow-ResponseError-001", "javascript", response.status, response.statusText, "Authorization request failed");
-		return await response.json();
-	} catch (error$1) {
-		if (error$1 instanceof ThunderIDAPIError) throw error$1;
-		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "executeEmbeddedSignInFlow-NetworkError-001", "javascript", 0, "Network Error");
-	}
-};
-var executeEmbeddedSignInFlow_default = executeEmbeddedSignInFlow;
+let EmbeddedSignInFlowStatus = /* @__PURE__ */ function(EmbeddedSignInFlowStatus$1) {
+	/**
+	* Sign-in flow completed successfully.
+	*
+	* The user has been authenticated and the flow can proceed to
+	* OAuth2 completion or redirection. Check for redirectUrl or
+	* assertion data in the response.
+	*/
+	EmbeddedSignInFlowStatus$1["Complete"] = "COMPLETE";
+	/**
+	* Sign-in flow encountered an error.
+	*
+	* Authentication failed due to invalid credentials, system error,
+	* or other issues. Check error details in the response and handle
+	* appropriately (retry, show error message, etc.).
+	*/
+	EmbeddedSignInFlowStatus$1["Error"] = "ERROR";
+	/**
+	* Sign-in flow requires additional user input.
+	*
+	* More authentication steps are needed. The response will contain
+	* components in data.meta.components that should be rendered to
+	* collect additional user input (e.g., MFA, password, etc.).
+	*/
+	EmbeddedSignInFlowStatus$1["Incomplete"] = "INCOMPLETE";
+	return EmbeddedSignInFlowStatus$1;
+}({});
+/**
+* Type enumeration for ThunderID embedded sign-in flow responses.
+*
+* Determines the nature of the flow response and how the client should
+* handle the returned data. This affects both UI rendering and flow
+* continuation logic.
+*
+* @experimental Part of the new ThunderID API
+*/
+let EmbeddedSignInFlowType = /* @__PURE__ */ function(EmbeddedSignInFlowType$1) {
+	/**
+	* Response requires external redirection.
+	*
+	* Used for social login providers, external identity providers,
+	* or other flows that require navigating to an external URL.
+	* The response will contain redirection information.
+	*/
+	EmbeddedSignInFlowType$1["Redirection"] = "REDIRECTION";
+	/**
+	* Response contains view components for rendering.
+	*
+	* Standard embedded flow response containing UI components
+	* that should be rendered within the current application
+	* context. Most common type for embedded authentication.
+	*/
+	EmbeddedSignInFlowType$1["View"] = "VIEW";
+	return EmbeddedSignInFlowType$1;
+}({});
 
 //#endregion
-//#region src/models/embedded-flow.ts
+//#region src/utils/injectRequestedPermissions.ts
 /**
-* Copyright (c) 2025-2026, WSO2 LLC. (https://www.wso2.com).
+* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
 *
 * WSO2 LLC. licenses this file to you under the Apache License,
 * Version 2.0 (the "License"); you may not use this file except
@@ -459,140 +449,286 @@ var executeEmbeddedSignInFlow_default = executeEmbeddedSignInFlow;
 * specific language governing permissions and limitations
 * under the License.
 */
-let EmbeddedFlowType = /* @__PURE__ */ function(EmbeddedFlowType$1) {
-	EmbeddedFlowType$1["Authentication"] = "AUTHENTICATION";
-	EmbeddedFlowType$1["Recovery"] = "RECOVERY";
-	EmbeddedFlowType$1["Registration"] = "REGISTRATION";
-	EmbeddedFlowType$1["UserOnboarding"] = "USER_ONBOARDING";
-	return EmbeddedFlowType$1;
-}({});
-let EmbeddedFlowStatus = /* @__PURE__ */ function(EmbeddedFlowStatus$1) {
-	EmbeddedFlowStatus$1["Complete"] = "COMPLETE";
-	EmbeddedFlowStatus$1["Incomplete"] = "INCOMPLETE";
-	return EmbeddedFlowStatus$1;
-}({});
-let EmbeddedFlowResponseType = /* @__PURE__ */ function(EmbeddedFlowResponseType$1) {
-	EmbeddedFlowResponseType$1["Redirection"] = "REDIRECTION";
-	EmbeddedFlowResponseType$1["View"] = "VIEW";
-	return EmbeddedFlowResponseType$1;
-}({});
-let EmbeddedFlowComponentType = /* @__PURE__ */ function(EmbeddedFlowComponentType$2) {
-	EmbeddedFlowComponentType$2["Button"] = "BUTTON";
-	EmbeddedFlowComponentType$2["Checkbox"] = "CHECKBOX";
-	EmbeddedFlowComponentType$2["Divider"] = "DIVIDER";
-	EmbeddedFlowComponentType$2["Form"] = "FORM";
-	EmbeddedFlowComponentType$2["Image"] = "IMAGE";
-	EmbeddedFlowComponentType$2["Input"] = "INPUT";
-	EmbeddedFlowComponentType$2["Radio"] = "RADIO";
-	EmbeddedFlowComponentType$2["Select"] = "SELECT";
-	EmbeddedFlowComponentType$2["Typography"] = "TYPOGRAPHY";
-	return EmbeddedFlowComponentType$2;
-}({});
-
-//#endregion
-//#region src/api/executeEmbeddedSignUpFlow.ts
 /**
-* Executes an embedded signup flow by sending a request to the specified flow execution endpoint.
-*
-* @param requestConfig - Request configuration object containing URL and payload.
-* @returns A promise that resolves with the flow execution response.
-* @throws ThunderIDAPIError when the request fails or URL is invalid.
+* Strips the top-level `scopes` field from a payload and injects it as
+* `inputs.requested_permissions` (space-separated string).
 *
-* @example
-* ```typescript
-* try {
-*   const embeddedSignUpResponse = await executeEmbeddedSignUpFlow({
-*     url: "https://localhost:8090/api/server/v1/flow/execute",
-*     payload: {
-*       flowType: "REGISTRATION"
-*     }
-*   });
-*   console.log(embeddedSignUpResponse);
-* } catch (error) {
-*   if (error instanceof ThunderIDAPIError) {
-*     console.error('Embedded SignUp flow execution failed:', error.message);
-*   }
-* }
-* ```
+* The backend reads requested_permissions from UserInputs (the `inputs` map), not a top-level field.
 */
-const executeEmbeddedSignUpFlow = async ({ url, baseUrl, payload,...requestConfig }) => {
-	if (!baseUrl && !url) throw new ThunderIDAPIError("Embedded SignUp flow execution failed: Base URL or URL is not provided.", "javascript-executeEmbeddedSignUpFlow-ValidationError-001", "javascript", 400, "At least one of the baseUrl or url must be provided to execute the embedded sign up flow.");
-	try {
-		new URL(url ?? baseUrl);
-	} catch (error$1) {
-		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1?.toString()}`, "executeEmbeddedSignUpFlow-ValidationError-001", "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
-	}
-	try {
-		const response = await fetch(url ?? `${baseUrl}/api/server/v1/flow/execute`, {
-			...requestConfig,
+const injectRequestedPermissions = (payload) => {
+	const { scopes,...rest } = payload;
+	const normalizedScopes = Array.isArray(scopes) ? scopes.map((s) => String(s).trim()).filter(Boolean).join(" ") : typeof scopes === "string" ? scopes.trim() : "";
+	if (!normalizedScopes) return rest;
+	const existingInputs = rest["inputs"] != null && typeof rest["inputs"] === "object" && !Array.isArray(rest["inputs"]) ? rest["inputs"] : {};
+	return {
+		...rest,
+		inputs: {
+			...existingInputs,
+			requested_permissions: normalizedScopes
+		}
+	};
+};
+var injectRequestedPermissions_default = injectRequestedPermissions;
+
+//#endregion
+//#region src/api/executeEmbeddedSignInFlow.ts
+const executeEmbeddedSignInFlow = async ({ url, baseUrl, payload, authId,...requestConfig }) => {
+	if (!payload) throw new ThunderIDAPIError("Authorization payload is required", "executeEmbeddedSignInFlow-ValidationError-002", "javascript", 400, "If an authorization payload is not provided, the request cannot be constructed correctly.");
+	const endpoint = url ?? `${baseUrl}/flow/execute`;
+	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
+	const isNewFlowStart = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload;
+	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
+	const basePayload = isNewFlowStart ? injectRequestedPermissions_default(cleanPayload) : cleanPayload;
+	const requestPayload = isNewFlowStart || hasOnlyFlowId ? {
+		...basePayload,
+		verbose: true
+	} : basePayload;
+	const response = await fetch(endpoint, {
+		...requestConfig,
+		body: JSON.stringify(requestPayload),
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...requestConfig.headers
+		},
+		method: requestConfig.method || "POST"
+	});
+	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedSignInFlow-ResponseError-001", "javascript", response.status, response.statusText, "Authorization request failed");
+	const flowResponse = await response.json();
+	if (flowResponse.flowStatus === EmbeddedSignInFlowStatus.Complete && flowResponse.assertion && authId) try {
+		const oauth2Response = await fetch(`${baseUrl}/oauth2/auth/callback`, {
 			body: JSON.stringify({
-				...payload ?? {},
-				flowType: EmbeddedFlowType.Registration
+				assertion: flowResponse.assertion,
+				authId
 			}),
+			credentials: "include",
 			headers: {
 				Accept: "application/json",
 				"Content-Type": "application/json",
 				...requestConfig.headers
 			},
-			method: requestConfig.method || "POST"
+			method: "POST"
 		});
-		if (!response.ok) throw new ThunderIDAPIError(await response.text(), "javascript-executeEmbeddedSignUpFlow-ResponseError-100", "javascript", response.status, response.statusText, "Embedded SignUp flow execution failed");
-		return await response.json();
-	} catch (error$1) {
-		if (error$1 instanceof ThunderIDAPIError) throw error$1;
-		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "executeEmbeddedSignUpFlow-NetworkError-001", "javascript", 0, "Network Error");
+		if (!oauth2Response.ok) throw new ThunderIDAPIError(await oauth2Response.text(), "executeEmbeddedSignInFlow-OAuth2Error-002", "javascript", oauth2Response.status, oauth2Response.statusText, "OAuth2 authorization failed");
+		const oauth2Result = await oauth2Response.json();
+		return {
+			flowStatus: flowResponse.flowStatus,
+			redirectUrl: oauth2Result["redirect_uri"]
+		};
+	} catch (authError) {
+		if (authError instanceof ThunderIDAPIError) throw authError;
+		throw new ThunderIDAPIError(authError instanceof Error ? authError.message : "Unknown error", "executeEmbeddedSignInFlow-OAuth2Error-001", "javascript", 500, "Failed to complete OAuth2 authorization after successful embedded sign-in flow.", "OAuth2 authorization failed");
 	}
+	return flowResponse;
 };
-var executeEmbeddedSignUpFlow_default = executeEmbeddedSignUpFlow;
+var executeEmbeddedSignInFlow_default = executeEmbeddedSignInFlow;
 
 //#endregion
-//#region src/api/getUserInfo.ts
+//#region src/models/embedded-signup-flow.ts
 /**
-* Retrieves the user information from the specified OIDC userinfo endpoint.
+* Status enumeration for ThunderID embedded sign-up flow operations.
 *
-* @param requestConfig - Request configuration object.
-* @returns A promise that resolves with the user information.
-* @throw
-*   const userInfo = await getUserInfo({
-*     url: "https://localhost:8090/oauth2/userinfo",
-*   });
-*   console.log(userInfo);
-* } catch (error) {
-*   if (error instanceof ThunderIDAPIError) {
-*     console.error('Failed to get user info:', error.message);
-*   }
+* These statuses indicate the current state of the registration flow and determine
+* the next action required by the client application. Each status provides specific
+* guidance on how to proceed with the user registration process.
+*
+* @example
+* ```typescript
+* switch (response.flowStatus) {
+*   case EmbeddedSignUpFlowStatus.Incomplete:
+*     // More user input needed - render registration form components
+*     break;
+*   case EmbeddedSignUpFlowStatus.Complete:
+*     // Registration successful - handle completion
+*     break;
+*   case EmbeddedSignUpFlowStatus.Error:
+*     // Registration failed - show error details
+*     const errorResponse = response as EmbeddedSignUpFlowErrorResponse;
+*     showError(errorResponse.error.description.defaultValue);
+*     break;
 * }
 * ```
+*
+* @experimental Part of the new ThunderID API
 */
-const getUserInfo = async ({ url,...requestConfig }) => {
-	try {
-		new URL(url);
-	} catch (error$1) {
-		throw new ThunderIDAPIError("Invalid endpoint URL provided", "getUserInfo-ValidationError-001", "javascript", 400, "Invalid Request");
-	}
-	try {
-		const response = await fetch(url, {
-			...requestConfig,
+let EmbeddedSignUpFlowStatus = /* @__PURE__ */ function(EmbeddedSignUpFlowStatus$1) {
+	/**
+	* Sign-up flow completed successfully.
+	*
+	* The user has successfully registered and the flow can proceed to
+	* OAuth2 completion or redirection. Check for redirectUrl or assertion
+	* data in the response for next steps.
+	*/
+	EmbeddedSignUpFlowStatus$1["Complete"] = "COMPLETE";
+	/**
+	* Sign-up flow encountered an error and cannot proceed.
+	*
+	* Registration failed due to validation errors, duplicate user,
+	* system errors, or other issues. The response will be of type
+	* `EmbeddedSignUpFlowErrorResponse` containing detailed failure
+	* information that can be displayed to the user.
+	*
+	* @see {@link EmbeddedSignUpFlowErrorResponse} for error response structure
+	*/
+	EmbeddedSignUpFlowStatus$1["Error"] = "ERROR";
+	/**
+	* Sign-up flow requires additional user input.
+	*
+	* More registration steps are needed. The response will contain
+	* components in data.meta.components that should be rendered to
+	* collect additional user information (e.g., profile data, verification).
+	*/
+	EmbeddedSignUpFlowStatus$1["Incomplete"] = "INCOMPLETE";
+	return EmbeddedSignUpFlowStatus$1;
+}({});
+/**
+* Type enumeration for ThunderID embedded sign-up flow responses.
+*
+* Determines the nature of the registration flow response and how the client
+* should handle the returned data. This affects both UI rendering and flow
+* continuation logic during the user registration process.
+*
+* @experimental Part of the new ThunderID API
+*/
+let EmbeddedSignUpFlowType = /* @__PURE__ */ function(EmbeddedSignUpFlowType$1) {
+	/**
+	* Response requires external redirection.
+	*
+	* Used for social registration providers, external identity providers,
+	* or other flows that require navigating to an external URL during
+	* the registration process. The response will contain redirection information.
+	*/
+	EmbeddedSignUpFlowType$1["Redirection"] = "REDIRECTION";
+	/**
+	* Response contains view components for rendering.
+	*
+	* Standard embedded registration flow response containing UI components
+	* that should be rendered within the current application context.
+	* Most common type for embedded user registration.
+	*/
+	EmbeddedSignUpFlowType$1["View"] = "VIEW";
+	return EmbeddedSignUpFlowType$1;
+}({});
+
+//#endregion
+//#region src/api/executeEmbeddedSignUpFlow.ts
+const executeEmbeddedSignUpFlow = async ({ url, baseUrl, payload, authId,...requestConfig }) => {
+	if (!payload) throw new ThunderIDAPIError("Registration payload is required", "executeEmbeddedSignUpFlow-ValidationError-002", "javascript", 400, "If a registration payload is not provided, the request cannot be constructed correctly.");
+	const endpoint = url ?? `${baseUrl}/flow/execute`;
+	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
+	const isNewFlowStart = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload;
+	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
+	const basePayload = isNewFlowStart ? injectRequestedPermissions_default(cleanPayload) : cleanPayload;
+	const requestPayload = isNewFlowStart || hasOnlyFlowId ? {
+		...basePayload,
+		verbose: true
+	} : basePayload;
+	const response = await fetch(endpoint, {
+		...requestConfig,
+		body: JSON.stringify(requestPayload),
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...requestConfig.headers
+		},
+		method: requestConfig.method || "POST"
+	});
+	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedSignUpFlow-ResponseError-001", "javascript", response.status, response.statusText, "Registration request failed");
+	const flowResponse = await response.json();
+	if (flowResponse.flowStatus === EmbeddedSignUpFlowStatus.Complete && flowResponse.assertion && authId) try {
+		const oauth2Response = await fetch(`${baseUrl}/oauth2/auth/callback`, {
+			body: JSON.stringify({
+				assertion: flowResponse.assertion,
+				authId
+			}),
+			credentials: "include",
 			headers: {
 				Accept: "application/json",
 				"Content-Type": "application/json",
 				...requestConfig.headers
 			},
-			method: "GET"
+			method: "POST"
 		});
-		if (!response.ok) throw new ThunderIDAPIError(await response.text(), "getUserInfo-ResponseError-001", "javascript", response.status, response.statusText, "Failed to fetch user info");
-		return await response.json();
-	} catch (error$1) {
-		if (error$1 instanceof ThunderIDAPIError) throw error$1;
-		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "getUserInfo-NetworkError-001", "javascript", 0, "Network Error");
+		if (!oauth2Response.ok) throw new ThunderIDAPIError(await oauth2Response.text(), "executeEmbeddedSignUpFlow-OAuth2Error-002", "javascript", oauth2Response.status, oauth2Response.statusText, "OAuth2 authorization failed");
+		const oauth2Result = await oauth2Response.json();
+		return {
+			flowStatus: flowResponse.flowStatus,
+			redirectUrl: oauth2Result["redirect_uri"]
+		};
+	} catch (authError) {
+		if (authError instanceof ThunderIDAPIError) throw authError;
+		throw new ThunderIDAPIError(authError instanceof Error ? authError.message : "Unknown error", "executeEmbeddedSignUpFlow-OAuth2Error-001", "javascript", 500, "Failed to complete OAuth2 authorization after successful embedded sign-up flow.", "OAuth2 authorization failed");
 	}
+	return flowResponse;
 };
-var getUserInfo_default = getUserInfo;
+var executeEmbeddedSignUpFlow_default = executeEmbeddedSignUpFlow;
 
 //#endregion
-//#region src/utils/processUsername.ts
+//#region src/api/executeEmbeddedRecoveryFlow.ts
 /**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+* Executes an embedded recovery flow by sending a request to the flow execution endpoint.
+*
+* This function handles password-recovery and account-recovery flows driven by the
+* ThunderID server. The server returns UI components for each step (e.g. username
+* collection, OTP verification, password reset) and this function forwards the
+* user's responses back to the server.
+*
+* @param requestConfig - Request configuration containing URL, payload, and optional headers.
+* @returns A promise that resolves with the flow execution response.
+* @throws ThunderIDAPIError when the request fails or a payload is missing.
+*
+* @example
+* ```typescript
+* // Initiate recovery flow
+* const response = await executeEmbeddedRecoveryFlow({
+*   baseUrl: 'https://localhost:8090',
+*   payload: {
+*     flowType: 'RECOVERY',
+*     applicationId: 'my-app-id',
+*   },
+* });
+*
+* // Continue recovery flow with user input
+* const nextResponse = await executeEmbeddedRecoveryFlow({
+*   baseUrl: 'https://localhost:8090',
+*   payload: {
+*     executionId: response.executionId,
+*     action: 'submit',
+*     inputs: { username: 'user@example.com' },
+*     challengeToken: response.challengeToken,
+*   },
+* });
+* ```
+*/
+const executeEmbeddedRecoveryFlow = async ({ url, baseUrl, payload,...requestConfig }) => {
+	if (!payload) throw new ThunderIDAPIError("Recovery payload is required", "executeEmbeddedRecoveryFlow-ValidationError-002", "javascript", 400, "If a recovery payload is not provided, the request cannot be constructed correctly.");
+	const endpoint = url ?? `${baseUrl}/flow/execute`;
+	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
+	const hasOnlyAppIdAndFlowType = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload && Object.keys(cleanPayload).length === 2;
+	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
+	const requestPayload = hasOnlyAppIdAndFlowType || hasOnlyFlowId ? {
+		...cleanPayload,
+		verbose: true
+	} : cleanPayload;
+	const response = await fetch(endpoint, {
+		...requestConfig,
+		body: JSON.stringify(requestPayload),
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...requestConfig.headers
+		},
+		method: requestConfig.method || "POST"
+	});
+	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedRecoveryFlow-ResponseError-001", "javascript", response.status, response.statusText, "Recovery request failed");
+	return await response.json();
+};
+var executeEmbeddedRecoveryFlow_default = executeEmbeddedRecoveryFlow;
+
+//#endregion
+//#region src/models/embedded-flow.ts
+/**
+* Copyright (c) 2025-2026, WSO2 LLC. (https://www.wso2.com).
 *
 * WSO2 LLC. licenses this file to you under the Apache License,
 * Version 2.0 (the "License"); you may not use this file except
@@ -608,174 +744,476 @@ var getUserInfo_default = getUserInfo;
 * specific language governing permissions and limitations
 * under the License.
 */
+let EmbeddedFlowType = /* @__PURE__ */ function(EmbeddedFlowType$1) {
+	EmbeddedFlowType$1["Authentication"] = "AUTHENTICATION";
+	EmbeddedFlowType$1["Recovery"] = "RECOVERY";
+	EmbeddedFlowType$1["Registration"] = "REGISTRATION";
+	EmbeddedFlowType$1["UserOnboarding"] = "USER_ONBOARDING";
+	return EmbeddedFlowType$1;
+}({});
+let EmbeddedFlowResponseType = /* @__PURE__ */ function(EmbeddedFlowResponseType$1) {
+	EmbeddedFlowResponseType$1["Redirection"] = "REDIRECTION";
+	EmbeddedFlowResponseType$1["View"] = "VIEW";
+	return EmbeddedFlowResponseType$1;
+}({});
 /**
-* Regular expression to match userstore prefixes in usernames.
-* Matches patterns like "DEFAULT/", "ASGARDEO_USER/", "PRIMARY/", etc.
-* The pattern matches any uppercase letters, numbers, and underscores followed by a forward slash.
-*/
-const USERSTORE_PREFIX_REGEX = /^[A-Z_][A-Z0-9_]*\//;
-/**
-* Removes userstore prefixes from a username if they exist.
-* This is commonly used to clean usernames returned from SCIM2 endpoints
-* that include userstore prefixes like "DEFAULT/", "ASGARDEO_USER/", "PRIMARY/", etc.
+* Component types supported by the ThunderID embedded flow API.
 *
-* @param username - The username string to process
-* @returns The username without the userstore prefix, or the original username if no prefix exists
+* These types define the different UI components that can be rendered
+* as part of the embedded authentication flows. Each type corresponds
+* to a specific UI element with its own behavior and properties.
 *
 * @example
 * ```typescript
-* const cleanUsername = removeUserstorePrefix("DEFAULT/john.doe");
-* console.log(cleanUsername); // "john.doe"
-*
-* const thunderidUser = removeUserstorePrefix("ASGARDEO_USER/jane.doe");
-* console.log(thunderidUser); // "jane.doe"
-*
-* const primaryUser = removeUserstorePrefix("PRIMARY/admin");
-* console.log(primaryUser); // "admin"
-*
-* const alreadyClean = removeUserstorePrefix("user.name");
-* console.log(alreadyClean); // "user.name"
-*
-* const emptyInput = removeUserstorePrefix("");
-* console.log(emptyInput); // ""
+* // Check component type to render appropriate UI
+* if (component.type === EmbeddedFlowComponentType.TextInput) {
+*   // Render text input field
+* } else if (component.type === EmbeddedFlowComponentType.Action) {
+*   // Render button/action
+* }
 * ```
+*
+* @experimental This API may change in future versions
 */
-const removeUserstorePrefix = (username) => {
-	if (!username) return "";
-	return username.replace(USERSTORE_PREFIX_REGEX, "");
-};
+let EmbeddedFlowComponentType = /* @__PURE__ */ function(EmbeddedFlowComponentType$1) {
+	/** Interactive action component (buttons, links) for user interactions */
+	EmbeddedFlowComponentType$1["Action"] = "ACTION";
+	/** Container block component that groups other components */
+	EmbeddedFlowComponentType$1["Block"] = "BLOCK";
+	/** Consent component for displaying consent purposes and attributes */
+	EmbeddedFlowComponentType$1["Consent"] = "CONSENT";
+	/** Copyable text display component that shows text with a copy-to-clipboard action */
+	EmbeddedFlowComponentType$1["CopyableText"] = "COPYABLE_TEXT";
+	/** Date input field for selecting a calendar date */
+	EmbeddedFlowComponentType$1["DateInput"] = "DATE_INPUT";
+	/** Divider component for visual separation of content */
+	EmbeddedFlowComponentType$1["Divider"] = "DIVIDER";
+	/** Email input field with validation for email addresses. */
+	EmbeddedFlowComponentType$1["EmailInput"] = "EMAIL_INPUT";
+	/** Icon display component for rendering named vector icons */
+	EmbeddedFlowComponentType$1["Icon"] = "ICON";
+	/** Image display component for logos and illustrations */
+	EmbeddedFlowComponentType$1["Image"] = "IMAGE";
+	/** One-time password input field for multi-factor authentication */
+	EmbeddedFlowComponentType$1["OtpInput"] = "OTP_INPUT";
+	/** Organization unit tree picker for selecting an OU */
+	EmbeddedFlowComponentType$1["OuSelect"] = "OU_SELECT";
+	/** Password input field with masking for sensitive data */
+	EmbeddedFlowComponentType$1["PasswordInput"] = "PASSWORD_INPUT";
+	/** Phone number input field with country code support */
+	EmbeddedFlowComponentType$1["PhoneInput"] = "PHONE_INPUT";
+	/** Rich text display component that renders formatted HTML content */
+	EmbeddedFlowComponentType$1["RichText"] = "RICH_TEXT";
+	/** Select/dropdown input component for single choice selection */
+	EmbeddedFlowComponentType$1["Select"] = "SELECT";
+	/** Stack layout component for arranging children in a row or column */
+	EmbeddedFlowComponentType$1["Stack"] = "STACK";
+	/** Text display component for labels, headings, and messages */
+	EmbeddedFlowComponentType$1["Text"] = "TEXT";
+	/** Standard text input field for user data entry */
+	EmbeddedFlowComponentType$1["TextInput"] = "TEXT_INPUT";
+	/** Timer component for displaying a countdown */
+	EmbeddedFlowComponentType$1["Timer"] = "TIMER";
+	/** QR code display component for wallet-based flows (e.g. OpenID4VP) */
+	EmbeddedFlowComponentType$1["QrCode"] = "QR_CODE";
+	return EmbeddedFlowComponentType$1;
+}({});
 /**
-* Processes a user object to remove userstore prefixes from username fields.
-* This is a helper function for processing user objects returned from SCIM2 endpoints.
-* Handles various username field variations: username, userName, and user_name.
-*
-* @param user - The user object to process
-* @returns The user object with processed username fields
-*
-* @example
-* ```typescript
-* const user = { username: "DEFAULT/john.doe", email: "john@example.com" };
-* const processedUser = processUserUsername(user);
-* console.log(processedUser.username); // "john.doe"
+* Action variant types for buttons and interactive elements.
 *
-* const camelCaseUser = { userName: "ASGARDEO_USER/jane.doe", email: "jane@example.com" };
-* const processedCamelCaseUser = processUserUsername(camelCaseUser);
-* console.log(processedCamelCaseUser.userName); // "jane.doe"
+* @experimental This API may change in future versions
+*/
+let EmbeddedFlowActionVariant = /* @__PURE__ */ function(EmbeddedFlowActionVariant$1) {
+	/** Danger action button for destructive operations */
+	EmbeddedFlowActionVariant$1["Danger"] = "DANGER";
+	/** Info action button for informational purposes */
+	EmbeddedFlowActionVariant$1["Info"] = "INFO";
+	/** Link-styled action button */
+	EmbeddedFlowActionVariant$1["Link"] = "LINK";
+	/** Outlined action button for secondary emphasis */
+	EmbeddedFlowActionVariant$1["Outlined"] = "OUTLINED";
+	/** Primary action button with highest visual emphasis */
+	EmbeddedFlowActionVariant$1["Primary"] = "PRIMARY";
+	/** Secondary action button with moderate visual emphasis */
+	EmbeddedFlowActionVariant$1["Secondary"] = "SECONDARY";
+	/** Success action button for positive confirmations */
+	EmbeddedFlowActionVariant$1["Success"] = "SUCCESS";
+	/** Tertiary action button with minimal visual emphasis */
+	EmbeddedFlowActionVariant$1["Tertiary"] = "TERTIARY";
+	/** Warning action button for cautionary actions */
+	EmbeddedFlowActionVariant$1["Warning"] = "WARNING";
+	return EmbeddedFlowActionVariant$1;
+}({});
+/**
+* Text variant types for typography components.
 *
-* const snakeCaseUser = { user_name: "PRIMARY/admin", email: "admin@example.com" };
-* const processedSnakeCaseUser = processUserUsername(snakeCaseUser);
-* console.log(processedSnakeCaseUser.user_name); // "admin"
-* ```
+* @experimental This API may change in future versions
 */
-const processUsername = (user) => {
-	if (!user) return user;
-	const processedUser = { ...user };
-	if (processedUser.username) processedUser.username = removeUserstorePrefix(processedUser.username);
-	if (processedUser.userName) processedUser.userName = removeUserstorePrefix(processedUser.userName);
-	if (processedUser.user_name) processedUser.user_name = removeUserstorePrefix(processedUser.user_name);
-	return processedUser;
-};
-var processUsername_default = processUsername;
+let EmbeddedFlowTextVariant = /* @__PURE__ */ function(EmbeddedFlowTextVariant$1) {
+	/** Primary body text for main content */
+	EmbeddedFlowTextVariant$1["Body1"] = "BODY_1";
+	/** Secondary body text for supplementary content */
+	EmbeddedFlowTextVariant$1["Body2"] = "BODY_2";
+	/** Text styled for button labels */
+	EmbeddedFlowTextVariant$1["ButtonText"] = "BUTTON_TEXT";
+	/** Small caption text for annotations and descriptions */
+	EmbeddedFlowTextVariant$1["Caption"] = "CAPTION";
+	/** Largest heading level for main titles */
+	EmbeddedFlowTextVariant$1["Heading1"] = "HEADING_1";
+	/** Second level heading for major sections */
+	EmbeddedFlowTextVariant$1["Heading2"] = "HEADING_2";
+	/** Third level heading for subsections */
+	EmbeddedFlowTextVariant$1["Heading3"] = "HEADING_3";
+	/** Fourth level heading for minor sections */
+	EmbeddedFlowTextVariant$1["Heading4"] = "HEADING_4";
+	/** Fifth level heading for detailed sections */
+	EmbeddedFlowTextVariant$1["Heading5"] = "HEADING_5";
+	/** Smallest heading level for fine-grained sections */
+	EmbeddedFlowTextVariant$1["Heading6"] = "HEADING_6";
+	/** Overline text for labels and categories */
+	EmbeddedFlowTextVariant$1["Overline"] = "OVERLINE";
+	/** Primary subtitle text with larger emphasis */
+	EmbeddedFlowTextVariant$1["Subtitle1"] = "SUBTITLE_1";
+	/** Secondary subtitle text with moderate emphasis */
+	EmbeddedFlowTextVariant$1["Subtitle2"] = "SUBTITLE_2";
+	return EmbeddedFlowTextVariant$1;
+}({});
+/**
+* Event types for action components.
+*
+* @experimental This API may change in future versions
+*/
+let EmbeddedFlowEventType = /* @__PURE__ */ function(EmbeddedFlowEventType$1) {
+	/** Navigate back to the previous step */
+	EmbeddedFlowEventType$1["Back"] = "BACK";
+	/** Cancel the current operation */
+	EmbeddedFlowEventType$1["Cancel"] = "CANCEL";
+	/** Navigate to a different flow step or page */
+	EmbeddedFlowEventType$1["Navigate"] = "NAVIGATE";
+	/** Reset form fields to initial state */
+	EmbeddedFlowEventType$1["Reset"] = "RESET";
+	/** Submit form data to the server */
+	EmbeddedFlowEventType$1["Submit"] = "SUBMIT";
+	/** Trigger an action or event */
+	EmbeddedFlowEventType$1["Trigger"] = "TRIGGER";
+	return EmbeddedFlowEventType$1;
+}({});
 
 //#endregion
-//#region src/api/getScim2Me.ts
+//#region src/api/executeEmbeddedUserOnboardingFlow.ts
 /**
-* Retrieves the user profile information from the specified SCIM2 /Me endpoint.
+* Executes an embedded user onboarding flow by sending a request to the flow execution endpoint.
+*
+* This function handles both:
+* - Admin flow: Initiates onboarding, collects user details, generates invite link
+* - End-user flow: Validates invite token and allows password setting
+*
+* @param requestConfig - Request configuration object containing URL, payload, and optional auth token.
+* @returns A promise that resolves with the flow execution response.
+* @throws ThunderIDAPIError when the request fails or URL is invalid.
 *
-* @param config - Request configuration object.
-* @returns A promise that resolves with the user profile information.
 * @example
 * ```typescript
-* // Using default fetch
-* try {
-*   const userProfile = await getScim2Me({
-*     url: "https://localhost:8090/scim2/Me",
-*   });
-*   console.log(userProfile);
-* } catch (error) {
-*   if (error instanceof ThunderIDAPIError) {
-*     console.error('Failed to get user profile:', error.message);
+* // Admin initiating user onboarding (requires auth token)
+* const response = await executeEmbeddedUserOnboardingFlow({
+*   baseUrl: "https://api.thunder.io",
+*   payload: {
+*     flowType: "USER_ONBOARDING"
+*   },
+*   headers: {
+*     Authorization: `Bearer ${accessToken}`
 *   }
-* }
+* });
+*
+* // End-user accepting invite (no auth required)
+* const response = await executeEmbeddedUserOnboardingFlow({
+*   baseUrl: "https://api.thunder.io",
+*   payload: {
+*     executionId: "flow-id-from-url",
+*     inputs: { inviteToken: "token-from-url" }
+*   }
+* });
 * ```
+*/
+const executeEmbeddedUserOnboardingFlow = async ({ url, baseUrl, payload,...requestConfig }) => {
+	if (!payload) throw new ThunderIDAPIError("User onboarding payload is required", "executeEmbeddedUserOnboardingFlow-ValidationError-002", "javascript", 400, "If a user onboarding payload is not provided, the request cannot be constructed correctly.");
+	const endpoint = url ?? `${baseUrl}/flow/execute`;
+	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
+	const hasOnlyFlowType = typeof cleanPayload === "object" && cleanPayload !== null && "flowType" in cleanPayload && Object.keys(cleanPayload).length === 1;
+	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
+	const hasFlowIdWithInputs = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && "inputs" in cleanPayload;
+	const requestPayload = hasOnlyFlowType || hasOnlyFlowId || hasFlowIdWithInputs ? {
+		...cleanPayload,
+		verbose: true
+	} : cleanPayload;
+	if ("flowType" in requestPayload && requestPayload["flowType"] !== EmbeddedFlowType.UserOnboarding) requestPayload["flowType"] = EmbeddedFlowType.UserOnboarding;
+	const response = await fetch(endpoint, {
+		...requestConfig,
+		body: JSON.stringify(requestPayload),
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...requestConfig.headers
+		},
+		method: requestConfig.method || "POST"
+	});
+	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedUserOnboardingFlow-ResponseError-001", "javascript", response.status, response.statusText, "User onboarding request failed");
+	return await response.json();
+};
+var executeEmbeddedUserOnboardingFlow_default = executeEmbeddedUserOnboardingFlow;
+
+//#endregion
+//#region src/api/getFlowMeta.ts
+/**
+* Fetches aggregated flow metadata from the `GET /flow/meta` endpoint.
+*
+* The response includes:
+* - Application or OU details depending on the `type` parameter
+* - Resolved design configuration (theme and layout)
+* - i18n translations filtered by `language` and `namespace`
+* - Registration flow enablement status
+*
+* @param config - Request configuration including `baseUrl`/`url`, and optional
+*                 `type`, `id`, `language`, and `namespace` filters. When `type`
+*                 and `id` are omitted the server returns i18n-only metadata.
+* @returns A promise that resolves to the {@link FlowMetadataResponse}.
+*
+* @throws {ThunderIDAPIError} When the server returns a non-OK response.
 *
 * @example
 * ```typescript
-* // Using custom fetcher (e.g., axios-based httpClient)
-* try {
-*   const userProfile = await getScim2Me({
-*     url: "https://localhost:8090/scim2/Me",
-*     fetcher: async (url, config) => {
-*       const response = await httpClient({
-*         url,
-*         method: config.method,
-*         headers: config.headers,
-*         ...config
-*       });
-*       // Convert axios-like response to fetch-like Response
-*       return {
-*         ok: response.status >= 200 && response.status < 300,
-*         status: response.status,
-*         statusText: response.statusText,
-*         json: () => Promise.resolve(response.data),
-*         text: () => Promise.resolve(typeof response.data === 'string' ? response.data : JSON.stringify(response.data))
-*       } as Response;
-*     }
-*   });
-*   console.log(userProfile);
-* } catch (error) {
-*   if (error instanceof ThunderIDAPIError) {
-*     console.error('Failed to get user profile:', error.message);
-*   }
-* }
+* import getFlowMeta from './api/getFlowMeta';
+* import { FlowMetaType } from './models/flow-meta';
+*
+* const meta = await getFlowMeta({
+*   baseUrl: 'https://localhost:8090',
+*   type: FlowMetaType.App,
+*   id: '60a9b38b-6eba-9f9e-55f9-267067de4680',
+*   language: 'en',
+*   namespace: 'auth',
+* });
+*
+* console.log(meta.application?.name);
+* console.log(meta.i18n.translations);
 * ```
+*
+* @experimental This function targets the ThunderID V2 platform API
 */
-const getScim2Me = async ({ url, baseUrl, fetcher,...requestConfig }) => {
-	try {
-		new URL(url ?? baseUrl);
-	} catch (error$1) {
-		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1?.toString()}`, "getScim2Me-ValidationError-001", "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
-	}
-	const fetchFn = fetcher || fetch;
-	const resolvedUrl = url ?? `${baseUrl}/scim2/Me`;
-	const requestInit = {
+const getFlowMeta = async ({ url, baseUrl, type, id, language, namespace,...requestConfig }) => {
+	const queryParams = new URLSearchParams({
+		...id ? { id } : {},
+		...type ? { type } : {},
+		...language ? { language } : {},
+		...namespace ? { namespace } : {}
+	});
+	const endpoint = `${url ?? `${baseUrl}/flow/meta`}?${queryParams.toString()}`;
+	const response = await fetch(endpoint, {
 		...requestConfig,
 		headers: {
 			Accept: "application/json",
-			"Content-Type": "application/scim+json",
 			...requestConfig.headers
 		},
 		method: "GET"
-	};
-	try {
-		const response = await fetchFn(resolvedUrl, requestInit);
-		if (!response?.ok) throw new ThunderIDAPIError(await response.text(), "getScim2Me-ResponseError-001", "javascript", response.status, response.statusText, "Failed to fetch user profile");
-		return processUsername_default(await response.json());
-	} catch (error$1) {
-		if (error$1 instanceof ThunderIDAPIError) throw error$1;
-		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "getScim2Me-NetworkError-001", "javascript", 0, "Network Error");
-	}
+	});
+	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "getFlowMeta-ResponseError-001", "javascript", response.status, response.statusText, "Flow metadata request failed");
+	return await response.json();
 };
-var getScim2Me_default = getScim2Me;
+var getFlowMeta_default = getFlowMeta;
 
 //#endregion
-//#region src/api/getSchemas.ts
+//#region src/api/getOrganizationUnitChildren.ts
 /**
-* Retrieves the SCIM2 schemas from the specified endpoint.
+* Retrieves the child organization units of a given parent OU.
+*
+* @param config - Request configuration including `baseUrl`/`url`, `organizationUnitId`,
+*                 and optional `limit`/`offset` pagination parameters.
+* @returns A promise that resolves with the paginated list of child organization units.
+*
+* @throws {ThunderIDAPIError} When the server returns a non-OK response.
 *
-* @param config - Request configuration object.
-* @returns A promise that resolves with the SCIM2 schemas information.
 * @example
 * ```typescript
-* // Using default fetch
-* try {
-*   const schemas = await getSchemas({
-*     url: "https://localhost:8090/scim2/Schemas",
+* const children = await getOrganizationUnitChildren({
+*   baseUrl: 'https://localhost:8090',
+*   organizationUnitId: '0d5e071b-d3d3-475d-b3c6-1a20ee2fa9b1',
+*   limit: 10,
+*   offset: 0,
+* });
+* console.log(children.organizationUnits);
+* ```
+*
+* @experimental This function targets the ThunderID V2 platform API
+*/
+const getOrganizationUnitChildren = async ({ url, baseUrl, organizationUnitId, limit = 10, offset = 0,...requestConfig }) => {
+	if (!organizationUnitId) throw new ThunderIDAPIError("Organization Unit ID is required", "getOrganizationUnitChildren-ValidationError-001", "javascript", 400, "If an organization unit ID is not provided, the request cannot be constructed correctly.");
+	const queryParams = new URLSearchParams({
+		limit: String(limit),
+		offset: String(offset)
+	});
+	const endpoint = url ?? `${baseUrl}/organization-units/${organizationUnitId}/ous?${queryParams.toString()}`;
+	const response = await fetch(endpoint, {
+		...requestConfig,
+		headers: {
+			Accept: "application/json",
+			...requestConfig.headers
+		},
+		method: "GET"
+	});
+	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "getOrganizationUnitChildren-ResponseError-001", "javascript", response.status, response.statusText, "Failed to fetch organization unit children");
+	return await response.json();
+};
+var getOrganizationUnitChildren_default = getOrganizationUnitChildren;
+
+//#endregion
+//#region src/api/getUserInfo.ts
+/**
+* Retrieves the user information from the specified OIDC userinfo endpoint.
+*
+* @param requestConfig - Request configuration object.
+* @returns A promise that resolves with the user information.
+* @throw
+*   const userInfo = await getUserInfo({
+*     url: "https://localhost:8090/oauth2/userinfo",
 *   });
-*   console.log(schemas);
+*   console.log(userInfo);
 * } catch (error) {
 *   if (error instanceof ThunderIDAPIError) {
-*     console.error('Failed to get schemas:', error.message);
+*     console.error('Failed to get user info:', error.message);
+*   }
+* }
+* ```
+*/
+const getUserInfo = async ({ url,...requestConfig }) => {
+	try {
+		new URL(url);
+	} catch (error$1) {
+		throw new ThunderIDAPIError("Invalid endpoint URL provided", "getUserInfo-ValidationError-001", "javascript", 400, "Invalid Request");
+	}
+	try {
+		const response = await fetch(url, {
+			...requestConfig,
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				...requestConfig.headers
+			},
+			method: "GET"
+		});
+		if (!response.ok) throw new ThunderIDAPIError(await response.text(), "getUserInfo-ResponseError-001", "javascript", response.status, response.statusText, "Failed to fetch user info");
+		return await response.json();
+	} catch (error$1) {
+		if (error$1 instanceof ThunderIDAPIError) throw error$1;
+		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "getUserInfo-NetworkError-001", "javascript", 0, "Network Error");
+	}
+};
+var getUserInfo_default = getUserInfo;
+
+//#endregion
+//#region src/utils/processUsername.ts
+/**
+* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+*
+* WSO2 LLC. licenses this file to you under the Apache License,
+* Version 2.0 (the "License"); you may not use this file except
+* in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing,
+* software distributed under the License is distributed on an
+* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+* KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations
+* under the License.
+*/
+/**
+* Regular expression to match userstore prefixes in usernames.
+* Matches patterns like "DEFAULT/", "ASGARDEO_USER/", "PRIMARY/", etc.
+* The pattern matches any uppercase letters, numbers, and underscores followed by a forward slash.
+*/
+const USERSTORE_PREFIX_REGEX = /^[A-Z_][A-Z0-9_]*\//;
+/**
+* Removes userstore prefixes from a username if they exist.
+* This is commonly used to clean usernames returned from SCIM2 endpoints
+* that include userstore prefixes like "DEFAULT/", "ASGARDEO_USER/", "PRIMARY/", etc.
+*
+* @param username - The username string to process
+* @returns The username without the userstore prefix, or the original username if no prefix exists
+*
+* @example
+* ```typescript
+* const cleanUsername = removeUserstorePrefix("DEFAULT/john.doe");
+* console.log(cleanUsername); // "john.doe"
+*
+* const thunderidUser = removeUserstorePrefix("ASGARDEO_USER/jane.doe");
+* console.log(thunderidUser); // "jane.doe"
+*
+* const primaryUser = removeUserstorePrefix("PRIMARY/admin");
+* console.log(primaryUser); // "admin"
+*
+* const alreadyClean = removeUserstorePrefix("user.name");
+* console.log(alreadyClean); // "user.name"
+*
+* const emptyInput = removeUserstorePrefix("");
+* console.log(emptyInput); // ""
+* ```
+*/
+const removeUserstorePrefix = (username) => {
+	if (!username) return "";
+	return username.replace(USERSTORE_PREFIX_REGEX, "");
+};
+/**
+* Processes a user object to remove userstore prefixes from username fields.
+* This is a helper function for processing user objects returned from SCIM2 endpoints.
+* Handles various username field variations: username, userName, and user_name.
+*
+* @param user - The user object to process
+* @returns The user object with processed username fields
+*
+* @example
+* ```typescript
+* const user = { username: "DEFAULT/john.doe", email: "john@example.com" };
+* const processedUser = processUserUsername(user);
+* console.log(processedUser.username); // "john.doe"
+*
+* const camelCaseUser = { userName: "ASGARDEO_USER/jane.doe", email: "jane@example.com" };
+* const processedCamelCaseUser = processUserUsername(camelCaseUser);
+* console.log(processedCamelCaseUser.userName); // "jane.doe"
+*
+* const snakeCaseUser = { user_name: "PRIMARY/admin", email: "admin@example.com" };
+* const processedSnakeCaseUser = processUserUsername(snakeCaseUser);
+* console.log(processedSnakeCaseUser.user_name); // "admin"
+* ```
+*/
+const processUsername = (user) => {
+	if (!user) return user;
+	const processedUser = { ...user };
+	if (processedUser.username) processedUser.username = removeUserstorePrefix(processedUser.username);
+	if (processedUser.userName) processedUser.userName = removeUserstorePrefix(processedUser.userName);
+	if (processedUser.user_name) processedUser.user_name = removeUserstorePrefix(processedUser.user_name);
+	return processedUser;
+};
+var processUsername_default = processUsername;
+
+//#endregion
+//#region src/api/getScim2Me.ts
+/**
+* Retrieves the user profile information from the specified SCIM2 /Me endpoint.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the user profile information.
+* @example
+* ```typescript
+* // Using default fetch
+* try {
+*   const userProfile = await getScim2Me({
+*     url: "https://localhost:8090/scim2/Me",
+*   });
+*   console.log(userProfile);
+* } catch (error) {
+*   if (error instanceof ThunderIDAPIError) {
+*     console.error('Failed to get user profile:', error.message);
 *   }
 * }
 * ```
@@ -784,8 +1222,8 @@ var getScim2Me_default = getScim2Me;
 * ```typescript
 * // Using custom fetcher (e.g., axios-based httpClient)
 * try {
-*   const schemas = await getSchemas({
-*     url: "https://localhost:8090/scim2/Schemas",
+*   const userProfile = await getScim2Me({
+*     url: "https://localhost:8090/scim2/Me",
 *     fetcher: async (url, config) => {
 *       const response = await httpClient({
 *         url,
@@ -803,63 +1241,60 @@ var getScim2Me_default = getScim2Me;
 *       } as Response;
 *     }
 *   });
-*   console.log(schemas);
+*   console.log(userProfile);
 * } catch (error) {
 *   if (error instanceof ThunderIDAPIError) {
-*     console.error('Failed to get schemas:', error.message);
+*     console.error('Failed to get user profile:', error.message);
 *   }
 * }
 * ```
 */
-const getSchemas = async ({ url, baseUrl, fetcher,...requestConfig }) => {
+const getScim2Me = async ({ url, baseUrl, fetcher,...requestConfig }) => {
 	try {
 		new URL(url ?? baseUrl);
 	} catch (error$1) {
-		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1?.toString()}`, "getSchemas-ValidationError-001", "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
+		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1?.toString()}`, "getScim2Me-ValidationError-001", "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
 	}
 	const fetchFn = fetcher || fetch;
-	const resolvedUrl = url ?? `${baseUrl}/scim2/Schemas`;
+	const resolvedUrl = url ?? `${baseUrl}/scim2/Me`;
 	const requestInit = {
 		...requestConfig,
 		headers: {
 			Accept: "application/json",
-			"Content-Type": "application/json",
+			"Content-Type": "application/scim+json",
 			...requestConfig.headers
 		},
 		method: "GET"
 	};
 	try {
 		const response = await fetchFn(resolvedUrl, requestInit);
-		if (!response?.ok) throw new ThunderIDAPIError(await response.text(), "getSchemas-ResponseError-001", "javascript", response.status, response.statusText, "Failed to fetch SCIM2 schemas");
-		return await response.json();
+		if (!response?.ok) throw new ThunderIDAPIError(await response.text(), "getScim2Me-ResponseError-001", "javascript", response.status, response.statusText, "Failed to fetch user profile");
+		return processUsername_default(await response.json());
 	} catch (error$1) {
 		if (error$1 instanceof ThunderIDAPIError) throw error$1;
-		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "getSchemas-NetworkError-001", "javascript", 0, "Network Error");
+		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "getScim2Me-NetworkError-001", "javascript", 0, "Network Error");
 	}
 };
-var getSchemas_default = getSchemas;
+var getScim2Me_default = getScim2Me;
 
 //#endregion
-//#region src/api/getAllOrganizations.ts
+//#region src/api/getSchemas.ts
 /**
-* Retrieves all organizations with pagination support.
+* Retrieves the SCIM2 schemas from the specified endpoint.
 *
-* @param config - Configuration object containing baseUrl, optional query parameters, and request config.
-* @returns A promise that resolves with the paginated organizations information.
+* @param config - Request configuration object.
+* @returns A promise that resolves with the SCIM2 schemas information.
 * @example
 * ```typescript
 * // Using default fetch
 * try {
-*   const response = await getAllOrganizations({
-*     baseUrl: "https://localhost:8090",
-*     filter: "",
-*     limit: 10,
-*     recursive: false
+*   const schemas = await getSchemas({
+*     url: "https://localhost:8090/scim2/Schemas",
 *   });
-*   console.log(response.organizations);
+*   console.log(schemas);
 * } catch (error) {
 *   if (error instanceof ThunderIDAPIError) {
-*     console.error('Failed to get organizations:', error.message);
+*     console.error('Failed to get schemas:', error.message);
 *   }
 * }
 * ```
@@ -868,11 +1303,8 @@ var getSchemas_default = getSchemas;
 * ```typescript
 * // Using custom fetcher (e.g., axios-based httpClient)
 * try {
-*   const response = await getAllOrganizations({
-*     baseUrl: "https://localhost:8090",
-*     filter: "",
-*     limit: 10,
-*     recursive: false,
+*   const schemas = await getSchemas({
+*     url: "https://localhost:8090/scim2/Schemas",
 *     fetcher: async (url, config) => {
 *       const response = await httpClient({
 *         url,
@@ -890,43 +1322,130 @@ var getSchemas_default = getSchemas;
 *       } as Response;
 *     }
 *   });
-*   console.log(response.organizations);
+*   console.log(schemas);
 * } catch (error) {
 *   if (error instanceof ThunderIDAPIError) {
-*     console.error('Failed to get organizations:', error.message);
+*     console.error('Failed to get schemas:', error.message);
 *   }
 * }
 * ```
 */
-const getAllOrganizations = async ({ baseUrl, filter = "", limit = 10, recursive = false, fetcher,...requestConfig }) => {
+const getSchemas = async ({ url, baseUrl, fetcher,...requestConfig }) => {
 	try {
-		new URL(baseUrl);
+		new URL(url ?? baseUrl);
 	} catch (error$1) {
-		throw new ThunderIDAPIError(`Invalid base URL provided. ${error$1?.toString()}`, "getAllOrganizations-ValidationError-001", "javascript", 400, "The provided `baseUrl` does not adhere to the URL schema.");
+		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1?.toString()}`, "getSchemas-ValidationError-001", "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
 	}
-	const queryParams = new URLSearchParams(Object.fromEntries(Object.entries({
-		filter,
-		limit: limit.toString(),
-		recursive: recursive.toString()
-	}).filter(([, value]) => Boolean(value))));
 	const fetchFn = fetcher || fetch;
-	const resolvedUrl = `${baseUrl}/api/server/v1/organizations?${queryParams.toString()}`;
+	const resolvedUrl = url ?? `${baseUrl}/scim2/Schemas`;
 	const requestInit = {
 		...requestConfig,
 		headers: {
-			...requestConfig.headers,
 			Accept: "application/json",
-			"Content-Type": "application/json"
+			"Content-Type": "application/json",
+			...requestConfig.headers
 		},
 		method: "GET"
 	};
 	try {
 		const response = await fetchFn(resolvedUrl, requestInit);
-		if (!response?.ok) throw new ThunderIDAPIError(await response.text(), "getAllOrganizations-ResponseError-001", "javascript", response.status, response.statusText, "Failed to get organizations");
-		const data = await response.json();
-		return {
-			hasMore: data.hasMore,
-			nextCursor: data.nextCursor,
+		if (!response?.ok) throw new ThunderIDAPIError(await response.text(), "getSchemas-ResponseError-001", "javascript", response.status, response.statusText, "Failed to fetch SCIM2 schemas");
+		return await response.json();
+	} catch (error$1) {
+		if (error$1 instanceof ThunderIDAPIError) throw error$1;
+		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "getSchemas-NetworkError-001", "javascript", 0, "Network Error");
+	}
+};
+var getSchemas_default = getSchemas;
+
+//#endregion
+//#region src/api/getAllOrganizations.ts
+/**
+* Retrieves all organizations with pagination support.
+*
+* @param config - Configuration object containing baseUrl, optional query parameters, and request config.
+* @returns A promise that resolves with the paginated organizations information.
+* @example
+* ```typescript
+* // Using default fetch
+* try {
+*   const response = await getAllOrganizations({
+*     baseUrl: "https://localhost:8090",
+*     filter: "",
+*     limit: 10,
+*     recursive: false
+*   });
+*   console.log(response.organizations);
+* } catch (error) {
+*   if (error instanceof ThunderIDAPIError) {
+*     console.error('Failed to get organizations:', error.message);
+*   }
+* }
+* ```
+*
+* @example
+* ```typescript
+* // Using custom fetcher (e.g., axios-based httpClient)
+* try {
+*   const response = await getAllOrganizations({
+*     baseUrl: "https://localhost:8090",
+*     filter: "",
+*     limit: 10,
+*     recursive: false,
+*     fetcher: async (url, config) => {
+*       const response = await httpClient({
+*         url,
+*         method: config.method,
+*         headers: config.headers,
+*         ...config
+*       });
+*       // Convert axios-like response to fetch-like Response
+*       return {
+*         ok: response.status >= 200 && response.status < 300,
+*         status: response.status,
+*         statusText: response.statusText,
+*         json: () => Promise.resolve(response.data),
+*         text: () => Promise.resolve(typeof response.data === 'string' ? response.data : JSON.stringify(response.data))
+*       } as Response;
+*     }
+*   });
+*   console.log(response.organizations);
+* } catch (error) {
+*   if (error instanceof ThunderIDAPIError) {
+*     console.error('Failed to get organizations:', error.message);
+*   }
+* }
+* ```
+*/
+const getAllOrganizations = async ({ baseUrl, filter = "", limit = 10, recursive = false, fetcher,...requestConfig }) => {
+	try {
+		new URL(baseUrl);
+	} catch (error$1) {
+		throw new ThunderIDAPIError(`Invalid base URL provided. ${error$1?.toString()}`, "getAllOrganizations-ValidationError-001", "javascript", 400, "The provided `baseUrl` does not adhere to the URL schema.");
+	}
+	const queryParams = new URLSearchParams(Object.fromEntries(Object.entries({
+		filter,
+		limit: limit.toString(),
+		recursive: recursive.toString()
+	}).filter(([, value]) => Boolean(value))));
+	const fetchFn = fetcher || fetch;
+	const resolvedUrl = `${baseUrl}/api/server/v1/organizations?${queryParams.toString()}`;
+	const requestInit = {
+		...requestConfig,
+		headers: {
+			...requestConfig.headers,
+			Accept: "application/json",
+			"Content-Type": "application/json"
+		},
+		method: "GET"
+	};
+	try {
+		const response = await fetchFn(resolvedUrl, requestInit);
+		if (!response?.ok) throw new ThunderIDAPIError(await response.text(), "getAllOrganizations-ResponseError-001", "javascript", response.status, response.statusText, "Failed to get organizations");
+		const data = await response.json();
+		return {
+			hasMore: data.hasMore,
+			nextCursor: data.nextCursor,
 			organizations: data.organizations || [],
 			totalCount: data.totalCount
 		};
@@ -1468,42 +1987,6 @@ const updateMeProfile = async ({ url, baseUrl, payload, fetcher,...requestConfig
 };
 var updateMeProfile_default = updateMeProfile;
 
-//#endregion
-//#region src/models/platforms.ts
-/**
-* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
-* Enumeration of supported identity platforms.
-*
-* - `ThunderID`: Represents the ThunderID identity platform.
-* - `IdentityServer`: Represents WSO2 Identity Server (on-prem or custom domains).
-* - `Unknown`: Used when the platform cannot be determined from the configuration.
-*/
-let Platform = /* @__PURE__ */ function(Platform$1) {
-	/** ThunderID identity platform */
-	Platform$1["ThunderID"] = "THUNDERID";
-	/** WSO2 Identity Server (on-prem or custom domains) */
-	Platform$1["IdentityServer"] = "IDENTITY_SERVER";
-	/** Unknown or unsupported platform */
-	Platform$1["Unknown"] = "UNKNOWN";
-	return Platform$1;
-}({});
-
 //#endregion
 //#region src/utils/logger.ts
 const PREFIX = "⚡ ThunderID";
@@ -1810,114 +2293,6 @@ const createPackageComponentLogger = (packageName, component) => {
 	return createPackageLogger(packageName).child(component);
 };
 
-//#endregion
-//#region src/errors/ThunderIDRuntimeError.ts
-/**
-* Base class for all runtime errors in ThunderID. This class extends ThunderIDError
-* and adds support for additional error details. Use this class for errors that occur
-* during runtime execution that are not related to API calls.
-*
-* @example
-* ```typescript
-* throw new ThunderIDRuntimeError(
-*   "Failed to parse configuration",
-*   "CONFIG_PARSE_ERROR",
-*   { invalidField: "redirectUri" }
-* );
-* ```
-*/
-var ThunderIDRuntimeError = class extends ThunderIDError {
-	/**
-	* Creates an instance of ThunderIDRuntimeError.
-	*
-	* @param message - Human-readable description of the error
-	* @param code - A unique error code that identifies the error type
-	* @param details - Additional details about the error that might be helpful for debugging
-	* @param origin - Optional. The SDK origin (e.g. 'react', 'vue'). Defaults to generic 'ThunderID'
-	* @constructor
-	*/
-	constructor(message, code, origin, details) {
-		super(message, code, origin);
-		this.details = details;
-		Object.defineProperty(this, "name", {
-			configurable: true,
-			value: "ThunderIDRuntimeError",
-			writable: true
-		});
-	}
-	/**
-	* Returns a string representation of the runtime error
-	* @returns Formatted error string with name, code, details, and message
-	*/
-	toString() {
-		const details = this.details ? `\nDetails: ${JSON.stringify(this.details, null, 2)}` : "";
-		return `[${this.name}] (code="${this.code}")${details}\nMessage: ${this.message}`;
-	}
-};
-
-//#endregion
-//#region src/utils/isRecognizedBaseUrlPattern.ts
-/**
-* Utility to determine if sensible ThunderID fallbacks can be used based on the given base URL.
-*
-* This checks if the URL follows the standard ThunderID pattern: /t/{orgHandle}
-* Returns true if sensible fallbacks (like deriving organization handle, tenant, etc.) can be used, false otherwise.
-*
-* @param baseUrl - The base URL of the ThunderID identity server (string or undefined)
-* @returns boolean - true if sensible fallbacks can be used, false otherwise
-*
-* @example
-* isRecognizedBaseUrlPattern('https://localhost:8090/t/dxlab'); // true
-* isRecognizedBaseUrlPattern('https://custom.example.com/auth'); // false
-*/
-const isRecognizedBaseUrlPattern = (baseUrl) => {
-	if (!baseUrl) throw new ThunderIDRuntimeError("Base URL is required to derive if the `baseUrl` is recognized.", "isRecognizedBaseUrlPattern-ValidationError-001", "javascript", "A valid base URL must be provided to derive if the `baseUrl` is recognized to use the sensible fallbacks.");
-	let parsedUrl;
-	try {
-		parsedUrl = new URL(baseUrl);
-	} catch (error$1) {
-		throw new ThunderIDRuntimeError(`Invalid base URL format: ${baseUrl}`, "isRecognizedBaseUrlPattern-ValidationError-002", "javascript", "The provided base URL does not conform to valid URL syntax.");
-	}
-	const pathSegments = parsedUrl.pathname?.split("/")?.filter((segment) => segment?.length > 0);
-	if (pathSegments.length < 2 || pathSegments[0] !== "t") {
-		logger_default.warn("[isRecognizedBaseUrlPattern] The provided base URL does not follow the expected URL pattern (/t/{orgHandle}).");
-		return false;
-	}
-	return true;
-};
-var isRecognizedBaseUrlPattern_default = isRecognizedBaseUrlPattern;
-
-//#endregion
-//#region src/utils/identifyPlatform.ts
-/**
-* Identifies the platform based on the given base URL.
-*
-* If the URL is recognized and matches the ThunderID domain, returns Platform.ThunderID.
-* Otherwise, returns Platform.IdentityServer.
-*
-* @param baseUrl - The base URL to check
-* @returns Platform enum value
-*/
-const identifyPlatform = (config) => {
-	const { baseUrl } = config;
-	try {
-		if (isRecognizedBaseUrlPattern_default(baseUrl)) {
-			try {
-				const url = new URL(baseUrl);
-				if (/\.thunderid\.io$/i.test(url.hostname) || /thunderid\.io$/i.test(url.hostname)) return Platform.ThunderID;
-			} catch {
-				logger_default.debug(`[identifyPlatform] Could not identify platform from the base URL: ${baseUrl}. Defaulting to WSO2 Identity Server as the platform.`);
-			}
-			return Platform.IdentityServer;
-		}
-		return Platform.Unknown;
-	} catch (error$1) {
-		logger_default.debug(`[identifyPlatform] Error identifying platform from base URL: ${baseUrl}. Error: ${error$1.message}`);
-		return Platform.Unknown;
-	}
-};
-var identifyPlatform_default = identifyPlatform;
-
 //#endregion
 //#region src/api/getBrandingPreference.ts
 /**
@@ -1998,575 +2373,28 @@ const getBrandingPreference = async ({ baseUrl, locale, name, type, fetcher,...r
 			...requestConfig.headers
 		},
 		method: "GET"
-	};
-	try {
-		const response = await fetchFn(resolvedUrl, requestInit);
-		if (!response?.ok) {
-			const errorText = await response.text();
-			const platform = identifyPlatform_default({ baseUrl });
-			let errorDescription;
-			try {
-				const errorBody = JSON.parse(errorText);
-				errorDescription = errorBody?.description || errorBody?.message || errorText;
-			} catch {
-				errorDescription = errorText;
-			}
-			let platformConsoleGuidance;
-			if (platform === Platform.ThunderID) platformConsoleGuidance = "configure branding preferences in the ThunderID console";
-			else if (platform === Platform.IdentityServer) platformConsoleGuidance = "configure branding preferences in the WSO2 Identity Server console";
-			else platformConsoleGuidance = "configure branding preferences in the platform console";
-			logger_default.warn(`[BrandingError] ${errorDescription} To resolve this issue, please ${platformConsoleGuidance}. If you want to suppress this warning and stop fetching branding preferences, set \`<ThunderIDProvider>\` -> \`preferences\` -> \`theme\` -> \`inheritFromBranding\` to false.`);
-			throw new ThunderIDAPIError(errorText, "getBrandingPreference-ResponseError-001", "javascript", response.status, response.statusText, "Failed to get branding preference");
-		}
-		return await response.json();
-	} catch (error$1) {
-		if (error$1 instanceof ThunderIDAPIError) throw error$1;
-		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "getBrandingPreference-NetworkError-001", "javascript", 0, "Network Error");
-	}
-};
-var getBrandingPreference_default = getBrandingPreference;
-
-//#endregion
-//#region src/models/v2/embedded-signin-flow-v2.ts
-/**
-* Status enumeration for ThunderID embedded sign-in flow operations.
-*
-* These statuses indicate the current state of the sign-in flow and determine
-* the next action required by the client application. Each status provides
-* specific guidance on how to proceed with the authentication process.
-*
-* @example
-* ```typescript
-* switch (response.flowStatus) {
-*   case EmbeddedSignInFlowStatus.Incomplete:
-*     // More user input needed - render form components
-*     break;
-*   case EmbeddedSignInFlowStatus.Complete:
-*     // Authentication successful - handle completion
-*     break;
-*   case EmbeddedSignInFlowStatus.Error:
-*     // Authentication failed - show error message
-*     break;
-* }
-* ```
-*
-* @experimental Part of the new ThunderID API
-*/
-let EmbeddedSignInFlowStatus$1 = /* @__PURE__ */ function(EmbeddedSignInFlowStatus$2) {
-	/**
-	* Sign-in flow completed successfully.
-	*
-	* The user has been authenticated and the flow can proceed to
-	* OAuth2 completion or redirection. Check for redirectUrl or
-	* assertion data in the response.
-	*/
-	EmbeddedSignInFlowStatus$2["Complete"] = "COMPLETE";
-	/**
-	* Sign-in flow encountered an error.
-	*
-	* Authentication failed due to invalid credentials, system error,
-	* or other issues. Check error details in the response and handle
-	* appropriately (retry, show error message, etc.).
-	*/
-	EmbeddedSignInFlowStatus$2["Error"] = "ERROR";
-	/**
-	* Sign-in flow requires additional user input.
-	*
-	* More authentication steps are needed. The response will contain
-	* components in data.meta.components that should be rendered to
-	* collect additional user input (e.g., MFA, password, etc.).
-	*/
-	EmbeddedSignInFlowStatus$2["Incomplete"] = "INCOMPLETE";
-	return EmbeddedSignInFlowStatus$2;
-}({});
-/**
-* Type enumeration for ThunderID embedded sign-in flow responses.
-*
-* Determines the nature of the flow response and how the client should
-* handle the returned data. This affects both UI rendering and flow
-* continuation logic.
-*
-* @experimental Part of the new ThunderID API
-*/
-let EmbeddedSignInFlowType$1 = /* @__PURE__ */ function(EmbeddedSignInFlowType$2) {
-	/**
-	* Response requires external redirection.
-	*
-	* Used for social login providers, external identity providers,
-	* or other flows that require navigating to an external URL.
-	* The response will contain redirection information.
-	*/
-	EmbeddedSignInFlowType$2["Redirection"] = "REDIRECTION";
-	/**
-	* Response contains view components for rendering.
-	*
-	* Standard embedded flow response containing UI components
-	* that should be rendered within the current application
-	* context. Most common type for embedded authentication.
-	*/
-	EmbeddedSignInFlowType$2["View"] = "VIEW";
-	return EmbeddedSignInFlowType$2;
-}({});
-
-//#endregion
-//#region src/utils/v2/injectRequestedPermissions.ts
-/**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-*
-* WSO2 LLC. licenses this file to you under the Apache License,
-* Version 2.0 (the "License"); you may not use this file except
-* in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied. See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*/
-/**
-* Strips the top-level `scopes` field from a payload and injects it as
-* `inputs.requested_permissions` (space-separated string).
-*
-* The backend reads requested_permissions from UserInputs (the `inputs` map), not a top-level field.
-*/
-const injectRequestedPermissions = (payload) => {
-	const { scopes,...rest } = payload;
-	const normalizedScopes = Array.isArray(scopes) ? scopes.map((s) => String(s).trim()).filter(Boolean).join(" ") : typeof scopes === "string" ? scopes.trim() : "";
-	if (!normalizedScopes) return rest;
-	const existingInputs = rest["inputs"] != null && typeof rest["inputs"] === "object" && !Array.isArray(rest["inputs"]) ? rest["inputs"] : {};
-	return {
-		...rest,
-		inputs: {
-			...existingInputs,
-			requested_permissions: normalizedScopes
-		}
-	};
-};
-var injectRequestedPermissions_default = injectRequestedPermissions;
-
-//#endregion
-//#region src/api/v2/executeEmbeddedSignInFlowV2.ts
-const executeEmbeddedSignInFlowV2 = async ({ url, baseUrl, payload, authId,...requestConfig }) => {
-	if (!payload) throw new ThunderIDAPIError("Authorization payload is required", "executeEmbeddedSignInFlow-ValidationError-002", "javascript", 400, "If an authorization payload is not provided, the request cannot be constructed correctly.");
-	const endpoint = url ?? `${baseUrl}/flow/execute`;
-	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
-	const isNewFlowStart = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload;
-	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
-	const basePayload = isNewFlowStart ? injectRequestedPermissions_default(cleanPayload) : cleanPayload;
-	const requestPayload = isNewFlowStart || hasOnlyFlowId ? {
-		...basePayload,
-		verbose: true
-	} : basePayload;
-	const response = await fetch(endpoint, {
-		...requestConfig,
-		body: JSON.stringify(requestPayload),
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json",
-			...requestConfig.headers
-		},
-		method: requestConfig.method || "POST"
-	});
-	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedSignInFlow-ResponseError-001", "javascript", response.status, response.statusText, "Authorization request failed");
-	const flowResponse = await response.json();
-	if (flowResponse.flowStatus === EmbeddedSignInFlowStatus$1.Complete && flowResponse.assertion && authId) try {
-		const oauth2Response = await fetch(`${baseUrl}/oauth2/auth/callback`, {
-			body: JSON.stringify({
-				assertion: flowResponse.assertion,
-				authId
-			}),
-			credentials: "include",
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/json",
-				...requestConfig.headers
-			},
-			method: "POST"
-		});
-		if (!oauth2Response.ok) throw new ThunderIDAPIError(await oauth2Response.text(), "executeEmbeddedSignInFlow-OAuth2Error-002", "javascript", oauth2Response.status, oauth2Response.statusText, "OAuth2 authorization failed");
-		const oauth2Result = await oauth2Response.json();
-		return {
-			flowStatus: flowResponse.flowStatus,
-			redirectUrl: oauth2Result["redirect_uri"]
-		};
-	} catch (authError) {
-		if (authError instanceof ThunderIDAPIError) throw authError;
-		throw new ThunderIDAPIError(authError instanceof Error ? authError.message : "Unknown error", "executeEmbeddedSignInFlow-OAuth2Error-001", "javascript", 500, "Failed to complete OAuth2 authorization after successful embedded sign-in flow.", "OAuth2 authorization failed");
-	}
-	return flowResponse;
-};
-var executeEmbeddedSignInFlowV2_default = executeEmbeddedSignInFlowV2;
-
-//#endregion
-//#region src/models/v2/embedded-signup-flow-v2.ts
-/**
-* Status enumeration for ThunderID embedded sign-up flow operations.
-*
-* These statuses indicate the current state of the registration flow and determine
-* the next action required by the client application. Each status provides specific
-* guidance on how to proceed with the user registration process.
-*
-* @example
-* ```typescript
-* switch (response.flowStatus) {
-*   case EmbeddedSignUpFlowStatus.Incomplete:
-*     // More user input needed - render registration form components
-*     break;
-*   case EmbeddedSignUpFlowStatus.Complete:
-*     // Registration successful - handle completion
-*     break;
-*   case EmbeddedSignUpFlowStatus.Error:
-*     // Registration failed - show error details
-*     const errorResponse = response as EmbeddedSignUpFlowErrorResponse;
-*     showError(errorResponse.error.description.defaultValue);
-*     break;
-* }
-* ```
-*
-* @experimental Part of the new ThunderID API
-*/
-let EmbeddedSignUpFlowStatus = /* @__PURE__ */ function(EmbeddedSignUpFlowStatus$1) {
-	/**
-	* Sign-up flow completed successfully.
-	*
-	* The user has successfully registered and the flow can proceed to
-	* OAuth2 completion or redirection. Check for redirectUrl or assertion
-	* data in the response for next steps.
-	*/
-	EmbeddedSignUpFlowStatus$1["Complete"] = "COMPLETE";
-	/**
-	* Sign-up flow encountered an error and cannot proceed.
-	*
-	* Registration failed due to validation errors, duplicate user,
-	* system errors, or other issues. The response will be of type
-	* `EmbeddedSignUpFlowErrorResponse` containing detailed failure
-	* information that can be displayed to the user.
-	*
-	* @see {@link EmbeddedSignUpFlowErrorResponse} for error response structure
-	*/
-	EmbeddedSignUpFlowStatus$1["Error"] = "ERROR";
-	/**
-	* Sign-up flow requires additional user input.
-	*
-	* More registration steps are needed. The response will contain
-	* components in data.meta.components that should be rendered to
-	* collect additional user information (e.g., profile data, verification).
-	*/
-	EmbeddedSignUpFlowStatus$1["Incomplete"] = "INCOMPLETE";
-	return EmbeddedSignUpFlowStatus$1;
-}({});
-/**
-* Type enumeration for ThunderID embedded sign-up flow responses.
-*
-* Determines the nature of the registration flow response and how the client
-* should handle the returned data. This affects both UI rendering and flow
-* continuation logic during the user registration process.
-*
-* @experimental Part of the new ThunderID API
-*/
-let EmbeddedSignUpFlowType = /* @__PURE__ */ function(EmbeddedSignUpFlowType$1) {
-	/**
-	* Response requires external redirection.
-	*
-	* Used for social registration providers, external identity providers,
-	* or other flows that require navigating to an external URL during
-	* the registration process. The response will contain redirection information.
-	*/
-	EmbeddedSignUpFlowType$1["Redirection"] = "REDIRECTION";
-	/**
-	* Response contains view components for rendering.
-	*
-	* Standard embedded registration flow response containing UI components
-	* that should be rendered within the current application context.
-	* Most common type for embedded user registration.
-	*/
-	EmbeddedSignUpFlowType$1["View"] = "VIEW";
-	return EmbeddedSignUpFlowType$1;
-}({});
-
-//#endregion
-//#region src/api/v2/executeEmbeddedSignUpFlowV2.ts
-const executeEmbeddedSignUpFlowV2 = async ({ url, baseUrl, payload, authId,...requestConfig }) => {
-	if (!payload) throw new ThunderIDAPIError("Registration payload is required", "executeEmbeddedSignUpFlow-ValidationError-002", "javascript", 400, "If a registration payload is not provided, the request cannot be constructed correctly.");
-	const endpoint = url ?? `${baseUrl}/flow/execute`;
-	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
-	const isNewFlowStart = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload;
-	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
-	const basePayload = isNewFlowStart ? injectRequestedPermissions_default(cleanPayload) : cleanPayload;
-	const requestPayload = isNewFlowStart || hasOnlyFlowId ? {
-		...basePayload,
-		verbose: true
-	} : basePayload;
-	const response = await fetch(endpoint, {
-		...requestConfig,
-		body: JSON.stringify(requestPayload),
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json",
-			...requestConfig.headers
-		},
-		method: requestConfig.method || "POST"
-	});
-	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedSignUpFlow-ResponseError-001", "javascript", response.status, response.statusText, "Registration request failed");
-	const flowResponse = await response.json();
-	if (flowResponse.flowStatus === EmbeddedSignUpFlowStatus.Complete && flowResponse.assertion && authId) try {
-		const oauth2Response = await fetch(`${baseUrl}/oauth2/auth/callback`, {
-			body: JSON.stringify({
-				assertion: flowResponse.assertion,
-				authId
-			}),
-			credentials: "include",
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/json",
-				...requestConfig.headers
-			},
-			method: "POST"
-		});
-		if (!oauth2Response.ok) throw new ThunderIDAPIError(await oauth2Response.text(), "executeEmbeddedSignUpFlow-OAuth2Error-002", "javascript", oauth2Response.status, oauth2Response.statusText, "OAuth2 authorization failed");
-		const oauth2Result = await oauth2Response.json();
-		return {
-			flowStatus: flowResponse.flowStatus,
-			redirectUrl: oauth2Result["redirect_uri"]
-		};
-	} catch (authError) {
-		if (authError instanceof ThunderIDAPIError) throw authError;
-		throw new ThunderIDAPIError(authError instanceof Error ? authError.message : "Unknown error", "executeEmbeddedSignUpFlow-OAuth2Error-001", "javascript", 500, "Failed to complete OAuth2 authorization after successful embedded sign-up flow.", "OAuth2 authorization failed");
-	}
-	return flowResponse;
-};
-var executeEmbeddedSignUpFlowV2_default = executeEmbeddedSignUpFlowV2;
-
-//#endregion
-//#region src/api/v2/executeEmbeddedRecoveryFlowV2.ts
-/**
-* Executes an embedded recovery flow by sending a request to the flow execution endpoint.
-*
-* This function handles password-recovery and account-recovery flows driven by the
-* ThunderID server. The server returns UI components for each step (e.g. username
-* collection, OTP verification, password reset) and this function forwards the
-* user's responses back to the server.
-*
-* @param requestConfig - Request configuration containing URL, payload, and optional headers.
-* @returns A promise that resolves with the flow execution response.
-* @throws ThunderIDAPIError when the request fails or a payload is missing.
-*
-* @example
-* ```typescript
-* // Initiate recovery flow
-* const response = await executeEmbeddedRecoveryFlowV2({
-*   baseUrl: 'https://localhost:8090',
-*   payload: {
-*     flowType: 'RECOVERY',
-*     applicationId: 'my-app-id',
-*   },
-* });
-*
-* // Continue recovery flow with user input
-* const nextResponse = await executeEmbeddedRecoveryFlowV2({
-*   baseUrl: 'https://localhost:8090',
-*   payload: {
-*     executionId: response.executionId,
-*     action: 'submit',
-*     inputs: { username: 'user@example.com' },
-*     challengeToken: response.challengeToken,
-*   },
-* });
-* ```
-*/
-const executeEmbeddedRecoveryFlowV2 = async ({ url, baseUrl, payload,...requestConfig }) => {
-	if (!payload) throw new ThunderIDAPIError("Recovery payload is required", "executeEmbeddedRecoveryFlow-ValidationError-002", "javascript", 400, "If a recovery payload is not provided, the request cannot be constructed correctly.");
-	const endpoint = url ?? `${baseUrl}/flow/execute`;
-	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
-	const hasOnlyAppIdAndFlowType = typeof cleanPayload === "object" && cleanPayload !== null && "applicationId" in cleanPayload && "flowType" in cleanPayload && Object.keys(cleanPayload).length === 2;
-	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
-	const requestPayload = hasOnlyAppIdAndFlowType || hasOnlyFlowId ? {
-		...cleanPayload,
-		verbose: true
-	} : cleanPayload;
-	const response = await fetch(endpoint, {
-		...requestConfig,
-		body: JSON.stringify(requestPayload),
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json",
-			...requestConfig.headers
-		},
-		method: requestConfig.method || "POST"
-	});
-	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedRecoveryFlow-ResponseError-001", "javascript", response.status, response.statusText, "Recovery request failed");
-	return await response.json();
-};
-var executeEmbeddedRecoveryFlowV2_default = executeEmbeddedRecoveryFlowV2;
-
-//#endregion
-//#region src/api/v2/executeEmbeddedUserOnboardingFlowV2.ts
-/**
-* Executes an embedded user onboarding flow by sending a request to the flow execution endpoint.
-*
-* This function handles both:
-* - Admin flow: Initiates onboarding, collects user details, generates invite link
-* - End-user flow: Validates invite token and allows password setting
-*
-* @param requestConfig - Request configuration object containing URL, payload, and optional auth token.
-* @returns A promise that resolves with the flow execution response.
-* @throws ThunderIDAPIError when the request fails or URL is invalid.
-*
-* @example
-* ```typescript
-* // Admin initiating user onboarding (requires auth token)
-* const response = await executeEmbeddedUserOnboardingFlowV2({
-*   baseUrl: "https://api.thunder.io",
-*   payload: {
-*     flowType: "USER_ONBOARDING"
-*   },
-*   headers: {
-*     Authorization: `Bearer ${accessToken}`
-*   }
-* });
-*
-* // End-user accepting invite (no auth required)
-* const response = await executeEmbeddedUserOnboardingFlowV2({
-*   baseUrl: "https://api.thunder.io",
-*   payload: {
-*     executionId: "flow-id-from-url",
-*     inputs: { inviteToken: "token-from-url" }
-*   }
-* });
-* ```
-*/
-const executeEmbeddedUserOnboardingFlowV2 = async ({ url, baseUrl, payload,...requestConfig }) => {
-	if (!payload) throw new ThunderIDAPIError("User onboarding payload is required", "executeEmbeddedUserOnboardingFlow-ValidationError-002", "javascript", 400, "If a user onboarding payload is not provided, the request cannot be constructed correctly.");
-	const endpoint = url ?? `${baseUrl}/flow/execute`;
-	const cleanPayload = typeof payload === "object" && payload !== null ? Object.fromEntries(Object.entries(payload).filter(([key]) => key !== "verbose")) : payload;
-	const hasOnlyFlowType = typeof cleanPayload === "object" && cleanPayload !== null && "flowType" in cleanPayload && Object.keys(cleanPayload).length === 1;
-	const hasOnlyFlowId = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && Object.keys(cleanPayload).length === 1;
-	const hasFlowIdWithInputs = typeof cleanPayload === "object" && cleanPayload !== null && "executionId" in cleanPayload && "inputs" in cleanPayload;
-	const requestPayload = hasOnlyFlowType || hasOnlyFlowId || hasFlowIdWithInputs ? {
-		...cleanPayload,
-		verbose: true
-	} : cleanPayload;
-	if ("flowType" in requestPayload && requestPayload["flowType"] !== EmbeddedFlowType.UserOnboarding) requestPayload["flowType"] = EmbeddedFlowType.UserOnboarding;
-	const response = await fetch(endpoint, {
-		...requestConfig,
-		body: JSON.stringify(requestPayload),
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json",
-			...requestConfig.headers
-		},
-		method: requestConfig.method || "POST"
-	});
-	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "executeEmbeddedUserOnboardingFlow-ResponseError-001", "javascript", response.status, response.statusText, "User onboarding request failed");
-	return await response.json();
-};
-var executeEmbeddedUserOnboardingFlowV2_default = executeEmbeddedUserOnboardingFlowV2;
-
-//#endregion
-//#region src/api/v2/getFlowMetaV2.ts
-/**
-* Fetches aggregated flow metadata from the `GET /flow/meta` endpoint.
-*
-* The response includes:
-* - Application or OU details depending on the `type` parameter
-* - Resolved design configuration (theme and layout)
-* - i18n translations filtered by `language` and `namespace`
-* - Registration flow enablement status
-*
-* @param config - Request configuration including `baseUrl`/`url`, and optional
-*                 `type`, `id`, `language`, and `namespace` filters. When `type`
-*                 and `id` are omitted the server returns i18n-only metadata.
-* @returns A promise that resolves to the {@link FlowMetadataResponse}.
-*
-* @throws {ThunderIDAPIError} When the server returns a non-OK response.
-*
-* @example
-* ```typescript
-* import getFlowMetaV2 from './api/v2/getFlowMetaV2';
-* import { FlowMetaType } from './models/v2/flow-meta-v2';
-*
-* const meta = await getFlowMetaV2({
-*   baseUrl: 'https://localhost:8090',
-*   type: FlowMetaType.App,
-*   id: '60a9b38b-6eba-9f9e-55f9-267067de4680',
-*   language: 'en',
-*   namespace: 'auth',
-* });
-*
-* console.log(meta.application?.name);
-* console.log(meta.i18n.translations);
-* ```
-*
-* @experimental This function targets the ThunderID V2 platform API
-*/
-const getFlowMetaV2 = async ({ url, baseUrl, type, id, language, namespace,...requestConfig }) => {
-	const queryParams = new URLSearchParams({
-		...id ? { id } : {},
-		...type ? { type } : {},
-		...language ? { language } : {},
-		...namespace ? { namespace } : {}
-	});
-	const endpoint = `${url ?? `${baseUrl}/flow/meta`}?${queryParams.toString()}`;
-	const response = await fetch(endpoint, {
-		...requestConfig,
-		headers: {
-			Accept: "application/json",
-			...requestConfig.headers
-		},
-		method: "GET"
-	});
-	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "getFlowMetaV2-ResponseError-001", "javascript", response.status, response.statusText, "Flow metadata request failed");
-	return await response.json();
-};
-var getFlowMetaV2_default = getFlowMetaV2;
-
-//#endregion
-//#region src/api/v2/getOrganizationUnitChildren.ts
-/**
-* Retrieves the child organization units of a given parent OU.
-*
-* @param config - Request configuration including `baseUrl`/`url`, `organizationUnitId`,
-*                 and optional `limit`/`offset` pagination parameters.
-* @returns A promise that resolves with the paginated list of child organization units.
-*
-* @throws {ThunderIDAPIError} When the server returns a non-OK response.
-*
-* @example
-* ```typescript
-* const children = await getOrganizationUnitChildren({
-*   baseUrl: 'https://localhost:8090',
-*   organizationUnitId: '0d5e071b-d3d3-475d-b3c6-1a20ee2fa9b1',
-*   limit: 10,
-*   offset: 0,
-* });
-* console.log(children.organizationUnits);
-* ```
-*
-* @experimental This function targets the ThunderID V2 platform API
-*/
-const getOrganizationUnitChildren = async ({ url, baseUrl, organizationUnitId, limit = 10, offset = 0,...requestConfig }) => {
-	if (!organizationUnitId) throw new ThunderIDAPIError("Organization Unit ID is required", "getOrganizationUnitChildren-ValidationError-001", "javascript", 400, "If an organization unit ID is not provided, the request cannot be constructed correctly.");
-	const queryParams = new URLSearchParams({
-		limit: String(limit),
-		offset: String(offset)
-	});
-	const endpoint = url ?? `${baseUrl}/organization-units/${organizationUnitId}/ous?${queryParams.toString()}`;
-	const response = await fetch(endpoint, {
-		...requestConfig,
-		headers: {
-			Accept: "application/json",
-			...requestConfig.headers
-		},
-		method: "GET"
-	});
-	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "getOrganizationUnitChildren-ResponseError-001", "javascript", response.status, response.statusText, "Failed to fetch organization unit children");
-	return await response.json();
+	};
+	try {
+		const response = await fetchFn(resolvedUrl, requestInit);
+		if (!response?.ok) {
+			const errorText = await response.text();
+			let errorDescription;
+			try {
+				const errorBody = JSON.parse(errorText);
+				errorDescription = errorBody?.description || errorBody?.message || errorText;
+			} catch {
+				errorDescription = errorText;
+			}
+			logger_default.warn(`[BrandingError] ${errorDescription} To resolve this issue, please configure branding preferences in the ThunderID console. If you want to suppress this warning and stop fetching branding preferences, set \`<ThunderIDProvider>\` -> \`preferences\` -> \`theme\` -> \`inheritFromBranding\` to false.`);
+			throw new ThunderIDAPIError(errorText, "getBrandingPreference-ResponseError-001", "javascript", response.status, response.statusText, "Failed to get branding preference");
+		}
+		return await response.json();
+	} catch (error$1) {
+		if (error$1 instanceof ThunderIDAPIError) throw error$1;
+		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "getBrandingPreference-NetworkError-001", "javascript", 0, "Network Error");
+	}
 };
-var getOrganizationUnitChildren_default = getOrganizationUnitChildren;
+var getBrandingPreference_default = getBrandingPreference;
 
 //#endregion
 //#region src/constants/ApplicationNativeAuthenticationConstants.ts
@@ -2708,198 +2536,52 @@ const VendorConstants = { VENDOR_PREFIX: "thunderid" };
 var VendorConstants_default = VendorConstants;
 
 //#endregion
-//#region src/models/embedded-signin-flow.ts
-let EmbeddedSignInFlowStatus = /* @__PURE__ */ function(EmbeddedSignInFlowStatus$2) {
-	EmbeddedSignInFlowStatus$2["FailCompleted"] = "FAIL_COMPLETED";
-	EmbeddedSignInFlowStatus$2["FailIncomplete"] = "FAIL_INCOMPLETE";
-	EmbeddedSignInFlowStatus$2["Incomplete"] = "INCOMPLETE";
-	EmbeddedSignInFlowStatus$2["SuccessCompleted"] = "SUCCESS_COMPLETED";
-	return EmbeddedSignInFlowStatus$2;
-}({});
-let EmbeddedSignInFlowType = /* @__PURE__ */ function(EmbeddedSignInFlowType$2) {
-	EmbeddedSignInFlowType$2["Authentication"] = "AUTHENTICATION";
-	return EmbeddedSignInFlowType$2;
-}({});
-let EmbeddedSignInFlowStepType = /* @__PURE__ */ function(EmbeddedSignInFlowStepType$1) {
-	EmbeddedSignInFlowStepType$1["AuthenticatorPrompt"] = "AUTHENTICATOR_PROMPT";
-	EmbeddedSignInFlowStepType$1["MultiOptionsPrompt"] = "MULTI_OPTIONS_PROMPT";
-	return EmbeddedSignInFlowStepType$1;
-}({});
-let EmbeddedSignInFlowAuthenticatorParamType = /* @__PURE__ */ function(EmbeddedSignInFlowAuthenticatorParamType$1) {
-	EmbeddedSignInFlowAuthenticatorParamType$1["Integer"] = "INTEGER";
-	EmbeddedSignInFlowAuthenticatorParamType$1["MultiValued"] = "MULTI_VALUED";
-	EmbeddedSignInFlowAuthenticatorParamType$1["String"] = "STRING";
-	return EmbeddedSignInFlowAuthenticatorParamType$1;
-}({});
-let EmbeddedSignInFlowAuthenticatorExtendedParamType = /* @__PURE__ */ function(EmbeddedSignInFlowAuthenticatorExtendedParamType$1) {
-	EmbeddedSignInFlowAuthenticatorExtendedParamType$1["Otp"] = "OTPCode";
-	return EmbeddedSignInFlowAuthenticatorExtendedParamType$1;
-}({});
-let EmbeddedSignInFlowAuthenticatorKnownIdPType = /* @__PURE__ */ function(EmbeddedSignInFlowAuthenticatorKnownIdPType$1) {
-	EmbeddedSignInFlowAuthenticatorKnownIdPType$1["Local"] = "LOCAL";
-	return EmbeddedSignInFlowAuthenticatorKnownIdPType$1;
-}({});
-let EmbeddedSignInFlowAuthenticatorPromptType = /* @__PURE__ */ function(EmbeddedSignInFlowAuthenticatorPromptType$1) {
-	/**
-	* Prompt for internal system use, such as API keys or tokens.
-	*/
-	EmbeddedSignInFlowAuthenticatorPromptType$1["InternalPrompt"] = "INTERNAL_PROMPT";
-	/**
-	* Prompt for redirection to another page or service.
-	*/
-	EmbeddedSignInFlowAuthenticatorPromptType$1["RedirectionPrompt"] = "REDIRECTION_PROMPT";
-	/**
-	* Prompt for user input, typically for username/password or similar credentials.
-	*/
-	EmbeddedSignInFlowAuthenticatorPromptType$1["UserPrompt"] = "USER_PROMPT";
-	return EmbeddedSignInFlowAuthenticatorPromptType$1;
-}({});
-
-//#endregion
-//#region src/models/v2/embedded-flow-v2.ts
+//#region src/errors/ThunderIDRuntimeError.ts
 /**
-* Component types supported by the ThunderID embedded flow API.
-*
-* These types define the different UI components that can be rendered
-* as part of the embedded authentication flows. Each type corresponds
-* to a specific UI element with its own behavior and properties.
+* Base class for all runtime errors in ThunderID. This class extends ThunderIDError
+* and adds support for additional error details. Use this class for errors that occur
+* during runtime execution that are not related to API calls.
 *
 * @example
 * ```typescript
-* // Check component type to render appropriate UI
-* if (component.type === EmbeddedFlowComponentType.TextInput) {
-*   // Render text input field
-* } else if (component.type === EmbeddedFlowComponentType.Action) {
-*   // Render button/action
-* }
+* throw new ThunderIDRuntimeError(
+*   "Failed to parse configuration",
+*   "CONFIG_PARSE_ERROR",
+*   { invalidField: "redirectUri" }
+* );
 * ```
-*
-* @experimental This API may change in future versions
-*/
-let EmbeddedFlowComponentType$1 = /* @__PURE__ */ function(EmbeddedFlowComponentType$2) {
-	/** Interactive action component (buttons, links) for user interactions */
-	EmbeddedFlowComponentType$2["Action"] = "ACTION";
-	/** Container block component that groups other components */
-	EmbeddedFlowComponentType$2["Block"] = "BLOCK";
-	/** Consent component for displaying consent purposes and attributes */
-	EmbeddedFlowComponentType$2["Consent"] = "CONSENT";
-	/** Copyable text display component that shows text with a copy-to-clipboard action */
-	EmbeddedFlowComponentType$2["CopyableText"] = "COPYABLE_TEXT";
-	/** Divider component for visual separation of content */
-	EmbeddedFlowComponentType$2["Divider"] = "DIVIDER";
-	/** Email input field with validation for email addresses. */
-	EmbeddedFlowComponentType$2["EmailInput"] = "EMAIL_INPUT";
-	/** Icon display component for rendering named vector icons */
-	EmbeddedFlowComponentType$2["Icon"] = "ICON";
-	/** Image display component for logos and illustrations */
-	EmbeddedFlowComponentType$2["Image"] = "IMAGE";
-	/** One-time password input field for multi-factor authentication */
-	EmbeddedFlowComponentType$2["OtpInput"] = "OTP_INPUT";
-	/** Organization unit tree picker for selecting an OU */
-	EmbeddedFlowComponentType$2["OuSelect"] = "OU_SELECT";
-	/** Password input field with masking for sensitive data */
-	EmbeddedFlowComponentType$2["PasswordInput"] = "PASSWORD_INPUT";
-	/** Phone number input field with country code support */
-	EmbeddedFlowComponentType$2["PhoneInput"] = "PHONE_INPUT";
-	/** Rich text display component that renders formatted HTML content */
-	EmbeddedFlowComponentType$2["RichText"] = "RICH_TEXT";
-	/** Select/dropdown input component for single choice selection */
-	EmbeddedFlowComponentType$2["Select"] = "SELECT";
-	/** Stack layout component for arranging children in a row or column */
-	EmbeddedFlowComponentType$2["Stack"] = "STACK";
-	/** Text display component for labels, headings, and messages */
-	EmbeddedFlowComponentType$2["Text"] = "TEXT";
-	/** Standard text input field for user data entry */
-	EmbeddedFlowComponentType$2["TextInput"] = "TEXT_INPUT";
-	/** Timer component for displaying a countdown */
-	EmbeddedFlowComponentType$2["Timer"] = "TIMER";
-	/** QR code display component for wallet-based flows (e.g. OpenID4VP) */
-	EmbeddedFlowComponentType$2["QrCode"] = "QR_CODE";
-	return EmbeddedFlowComponentType$2;
-}({});
-/**
-* Action variant types for buttons and interactive elements.
-*
-* @experimental This API may change in future versions
-*/
-let EmbeddedFlowActionVariant = /* @__PURE__ */ function(EmbeddedFlowActionVariant$1) {
-	/** Danger action button for destructive operations */
-	EmbeddedFlowActionVariant$1["Danger"] = "DANGER";
-	/** Info action button for informational purposes */
-	EmbeddedFlowActionVariant$1["Info"] = "INFO";
-	/** Link-styled action button */
-	EmbeddedFlowActionVariant$1["Link"] = "LINK";
-	/** Outlined action button for secondary emphasis */
-	EmbeddedFlowActionVariant$1["Outlined"] = "OUTLINED";
-	/** Primary action button with highest visual emphasis */
-	EmbeddedFlowActionVariant$1["Primary"] = "PRIMARY";
-	/** Secondary action button with moderate visual emphasis */
-	EmbeddedFlowActionVariant$1["Secondary"] = "SECONDARY";
-	/** Success action button for positive confirmations */
-	EmbeddedFlowActionVariant$1["Success"] = "SUCCESS";
-	/** Tertiary action button with minimal visual emphasis */
-	EmbeddedFlowActionVariant$1["Tertiary"] = "TERTIARY";
-	/** Warning action button for cautionary actions */
-	EmbeddedFlowActionVariant$1["Warning"] = "WARNING";
-	return EmbeddedFlowActionVariant$1;
-}({});
-/**
-* Text variant types for typography components.
-*
-* @experimental This API may change in future versions
-*/
-let EmbeddedFlowTextVariant = /* @__PURE__ */ function(EmbeddedFlowTextVariant$1) {
-	/** Primary body text for main content */
-	EmbeddedFlowTextVariant$1["Body1"] = "BODY_1";
-	/** Secondary body text for supplementary content */
-	EmbeddedFlowTextVariant$1["Body2"] = "BODY_2";
-	/** Text styled for button labels */
-	EmbeddedFlowTextVariant$1["ButtonText"] = "BUTTON_TEXT";
-	/** Small caption text for annotations and descriptions */
-	EmbeddedFlowTextVariant$1["Caption"] = "CAPTION";
-	/** Largest heading level for main titles */
-	EmbeddedFlowTextVariant$1["Heading1"] = "HEADING_1";
-	/** Second level heading for major sections */
-	EmbeddedFlowTextVariant$1["Heading2"] = "HEADING_2";
-	/** Third level heading for subsections */
-	EmbeddedFlowTextVariant$1["Heading3"] = "HEADING_3";
-	/** Fourth level heading for minor sections */
-	EmbeddedFlowTextVariant$1["Heading4"] = "HEADING_4";
-	/** Fifth level heading for detailed sections */
-	EmbeddedFlowTextVariant$1["Heading5"] = "HEADING_5";
-	/** Smallest heading level for fine-grained sections */
-	EmbeddedFlowTextVariant$1["Heading6"] = "HEADING_6";
-	/** Overline text for labels and categories */
-	EmbeddedFlowTextVariant$1["Overline"] = "OVERLINE";
-	/** Primary subtitle text with larger emphasis */
-	EmbeddedFlowTextVariant$1["Subtitle1"] = "SUBTITLE_1";
-	/** Secondary subtitle text with moderate emphasis */
-	EmbeddedFlowTextVariant$1["Subtitle2"] = "SUBTITLE_2";
-	return EmbeddedFlowTextVariant$1;
-}({});
-/**
-* Event types for action components.
-*
-* @experimental This API may change in future versions
 */
-let EmbeddedFlowEventType = /* @__PURE__ */ function(EmbeddedFlowEventType$1) {
-	/** Navigate back to the previous step */
-	EmbeddedFlowEventType$1["Back"] = "BACK";
-	/** Cancel the current operation */
-	EmbeddedFlowEventType$1["Cancel"] = "CANCEL";
-	/** Navigate to a different flow step or page */
-	EmbeddedFlowEventType$1["Navigate"] = "NAVIGATE";
-	/** Reset form fields to initial state */
-	EmbeddedFlowEventType$1["Reset"] = "RESET";
-	/** Submit form data to the server */
-	EmbeddedFlowEventType$1["Submit"] = "SUBMIT";
-	/** Trigger an action or event */
-	EmbeddedFlowEventType$1["Trigger"] = "TRIGGER";
-	return EmbeddedFlowEventType$1;
-}({});
+var ThunderIDRuntimeError = class extends ThunderIDError {
+	/**
+	* Creates an instance of ThunderIDRuntimeError.
+	*
+	* @param message - Human-readable description of the error
+	* @param code - A unique error code that identifies the error type
+	* @param details - Additional details about the error that might be helpful for debugging
+	* @param origin - Optional. The SDK origin (e.g. 'react', 'vue'). Defaults to generic 'ThunderID'
+	* @constructor
+	*/
+	constructor(message, code, origin, details) {
+		super(message, code, origin);
+		this.details = details;
+		Object.defineProperty(this, "name", {
+			configurable: true,
+			value: "ThunderIDRuntimeError",
+			writable: true
+		});
+	}
+	/**
+	* Returns a string representation of the runtime error
+	* @returns Formatted error string with name, code, details, and message
+	*/
+	toString() {
+		const details = this.details ? `\nDetails: ${JSON.stringify(this.details, null, 2)}` : "";
+		return `[${this.name}] (code="${this.code}")${details}\nMessage: ${this.message}`;
+	}
+};
 
 //#endregion
-//#region src/models/v2/embedded-recovery-flow-v2.ts
+//#region src/models/embedded-recovery-flow.ts
 /**
 * Status enumeration for the embedded recovery flow operations.
 *
@@ -2940,7 +2622,7 @@ let EmbeddedRecoveryFlowType = /* @__PURE__ */ function(EmbeddedRecoveryFlowType
 }({});
 
 //#endregion
-//#region src/models/v2/flow-meta-v2.ts
+//#region src/models/flow-meta.ts
 /**
 * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
 *
@@ -3266,13 +2948,6 @@ var DefaultCrypto = class {
 	}
 };
 
-//#endregion
-//#region src/models/agent.ts
-let AgentConfig;
-(function(_AgentConfig) {
-	_AgentConfig.DEFAULT_AUTHENTICATOR_NAME = "Username & Password";
-})(AgentConfig || (AgentConfig = {}));
-
 //#endregion
 //#region src/models/store.ts
 /**
@@ -4244,10 +3919,10 @@ var ThunderIDJavaScriptClient = class {
 	signInSilently(_options) {
 		throw new Error("Method not implemented.");
 	}
-	signUp(_optionsOrPayload) {
+	signUp(_options) {
 		throw new Error("Method not implemented.");
 	}
-	recover(_payload) {
+	recover() {
 		throw new Error("Method not implemented.");
 	}
 	switchOrganization(_organization, _sessionId) {
@@ -4617,40 +4292,11 @@ var ThunderIDJavaScriptClient = class {
 		const error$1 = Boolean(url.searchParams.get("error"));
 		return stateParam ? stateParam === OIDCRequestConstants_default.Params.SIGN_OUT_SUCCESS && error$1 : false;
 	}
-	async getAgentToken(agentConfig) {
-		const authorizeURL = new URL(await this.getSignInUrl({ response_mode: "direct" }));
-		const authorizeResponse = await initializeEmbeddedSignInFlow_default({
-			payload: Object.fromEntries(authorizeURL.searchParams.entries()),
-			url: `${authorizeURL.origin}${authorizeURL.pathname}`
-		});
-		const authenticatorName = agentConfig.authenticatorName ?? AgentConfig.DEFAULT_AUTHENTICATOR_NAME;
-		const targetAuthenticator = authorizeResponse.nextStep.authenticators.find((auth) => auth.authenticator === authenticatorName);
-		if (!targetAuthenticator) throw new Error(`Authenticator '${authenticatorName}' not found among authentication steps.`);
-		const authnResponse = await executeEmbeddedSignInFlow_default({
-			baseUrl: this.baseURL,
-			payload: {
-				flowId: authorizeResponse.flowId,
-				selectedAuthenticator: {
-					authenticatorId: targetAuthenticator.authenticatorId,
-					params: {
-						password: agentConfig.agentSecret,
-						username: agentConfig.agentID
-					}
-				}
-			}
-		});
-		if (authnResponse.flowStatus !== EmbeddedSignInFlowStatus.SuccessCompleted) throw new Error("Agent authentication failed.");
-		return this.requestAccessToken(authnResponse.authData["code"], authnResponse.authData["session_state"], authnResponse.authData["state"]);
-	}
 	async getOBOSignInURL(agentConfig) {
 		const authURL = await this.getSignInUrl({ requested_actor: agentConfig.agentID });
 		if (authURL) return authURL.toString();
 		throw new Error("Could not build Authorize URL");
 	}
-	async getOBOToken(agentConfig, authCodeResponse) {
-		const agentToken = await this.getAgentToken(agentConfig);
-		return this.requestAccessToken(authCodeResponse.code, authCodeResponse.session_state, authCodeResponse.state, void 0, { params: { actor_token: agentToken.accessToken } });
-	}
 };
 var ThunderIDJavaScriptClient_default = ThunderIDJavaScriptClient;
 
@@ -5369,6 +5015,38 @@ const deriveOrganizationHandleFromBaseUrl = (baseUrl) => {
 };
 var deriveOrganizationHandleFromBaseUrl_default = deriveOrganizationHandleFromBaseUrl;
 
+//#endregion
+//#region src/utils/isRecognizedBaseUrlPattern.ts
+/**
+* Utility to determine if sensible ThunderID fallbacks can be used based on the given base URL.
+*
+* This checks if the URL follows the standard ThunderID pattern: /t/{orgHandle}
+* Returns true if sensible fallbacks (like deriving organization handle, tenant, etc.) can be used, false otherwise.
+*
+* @param baseUrl - The base URL of the ThunderID identity server (string or undefined)
+* @returns boolean - true if sensible fallbacks can be used, false otherwise
+*
+* @example
+* isRecognizedBaseUrlPattern('https://localhost:8090/t/dxlab'); // true
+* isRecognizedBaseUrlPattern('https://custom.example.com/auth'); // false
+*/
+const isRecognizedBaseUrlPattern = (baseUrl) => {
+	if (!baseUrl) throw new ThunderIDRuntimeError("Base URL is required to derive if the `baseUrl` is recognized.", "isRecognizedBaseUrlPattern-ValidationError-001", "javascript", "A valid base URL must be provided to derive if the `baseUrl` is recognized to use the sensible fallbacks.");
+	let parsedUrl;
+	try {
+		parsedUrl = new URL(baseUrl);
+	} catch (error$1) {
+		throw new ThunderIDRuntimeError(`Invalid base URL format: ${baseUrl}`, "isRecognizedBaseUrlPattern-ValidationError-002", "javascript", "The provided base URL does not conform to valid URL syntax.");
+	}
+	const pathSegments = parsedUrl.pathname?.split("/")?.filter((segment) => segment?.length > 0);
+	if (pathSegments.length < 2 || pathSegments[0] !== "t") {
+		logger_default.warn("[isRecognizedBaseUrlPattern] The provided base URL does not follow the expected URL pattern (/t/{orgHandle}).");
+		return false;
+	}
+	return true;
+};
+var isRecognizedBaseUrlPattern_default = isRecognizedBaseUrlPattern;
+
 //#endregion
 //#region src/utils/flattenUserSchema.ts
 /**
@@ -5717,14 +5395,14 @@ var generateFlattenedUserProfile_default = generateFlattenedUserProfile;
 * If the baseUrl is recognized (standard ThunderID pattern), constructs the sign-up URL.
 * Otherwise, returns an empty string.
 *
-* @param baseUrl - The base URL of the ThunderID identity server (string or undefined)
+* @param config - The ThunderID client configuration
 * @returns The sign-up URL if baseUrl is recognized, otherwise an empty string
 */
 const getRedirectBasedSignUpUrl = (config) => {
 	const { baseUrl } = config;
 	if (!isRecognizedBaseUrlPattern_default(baseUrl)) return "";
 	let signUpBaseUrl = baseUrl;
-	if (identifyPlatform_default(config) === Platform.ThunderID) try {
+	try {
 		const url$1 = new URL(baseUrl);
 		if (/([a-z0-9-]+\.)*api\.thunderid\.io$/i.test(url$1.hostname)) {
 			url$1.hostname = url$1.hostname.replace("api.", "accounts.");
@@ -5742,7 +5420,7 @@ const getRedirectBasedSignUpUrl = (config) => {
 var getRedirectBasedSignUpUrl_default = getRedirectBasedSignUpUrl;
 
 //#endregion
-//#region src/utils/v2/isEmojiUri.ts
+//#region src/utils/isEmojiUri.ts
 /**
 * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
 *
@@ -5778,7 +5456,7 @@ const isEmojiUri = (uri) => typeof uri === "string" && uri.startsWith(EMOJI_URI_
 var isEmojiUri_default = isEmojiUri;
 
 //#endregion
-//#region src/utils/v2/extractEmojiFromUri.ts
+//#region src/utils/extractEmojiFromUri.ts
 /**
 * Extracts the emoji character from an `emoji:` URI.
 *
@@ -5831,18 +5509,6 @@ var extractEmojiFromUri_default = extractEmojiFromUri;
 const removeTrailingSlash = (path) => path.endsWith("/") ? path.slice(0, -1) : path;
 var removeTrailingSlash_default = removeTrailingSlash;
 
-//#endregion
-//#region src/utils/resolveFieldType.ts
-const resolveFieldType = (field) => {
-	if (field.type === EmbeddedSignInFlowAuthenticatorParamType.String) {
-		if (field.param === EmbeddedSignInFlowAuthenticatorExtendedParamType.Otp) return FieldType.Otp;
-		if (field?.confidential) return FieldType.Password;
-		return FieldType.Text;
-	}
-	throw new ThunderIDRuntimeError(`Field type is not supported: ${field.type}`, "resolveFieldType-Invalid-001", "javascript", "The provided field type is not supported. Please check the field configuration.");
-};
-var resolveFieldType_default = resolveFieldType;
-
 //#endregion
 //#region src/utils/resolveFieldName.ts
 const resolveFieldName = (field) => {
@@ -5852,7 +5518,7 @@ const resolveFieldName = (field) => {
 var resolveFieldName_default = resolveFieldName;
 
 //#endregion
-//#region src/utils/v2/resolveMeta.ts
+//#region src/utils/resolveMeta.ts
 /**
 * Resolves a dot-path expression against a FlowMetadataResponse object.
 *
@@ -5879,7 +5545,7 @@ function resolveMeta(path, meta) {
 }
 
 //#endregion
-//#region src/utils/v2/parseFlowTemplateLiteral.ts
+//#region src/utils/parseFlowTemplateLiteral.ts
 /**
 * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
 *
@@ -5975,7 +5641,7 @@ function parseFlowTemplateLiteral(content) {
 }
 
 //#endregion
-//#region src/utils/v2/resolveFlowTemplateLiterals.ts
+//#region src/utils/resolveFlowTemplateLiterals.ts
 /**
 * Global version of {@link FLOW_TEMPLATE_LITERAL_REGEX} for use with `String.prototype.replace`.
 */
@@ -6012,7 +5678,7 @@ function resolveFlowTemplateLiterals(text, { t, meta }) {
 }
 
 //#endregion
-//#region src/utils/v2/countryCodeToFlagEmoji.ts
+//#region src/utils/countryCodeToFlagEmoji.ts
 /**
 * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
 *
@@ -6042,7 +5708,7 @@ function countryCodeToFlagEmoji(countryCode) {
 }
 
 //#endregion
-//#region src/utils/v2/resolveLocaleDisplayName.ts
+//#region src/utils/resolveLocaleDisplayName.ts
 /**
 * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
 *
@@ -6080,7 +5746,7 @@ function resolveLocaleDisplayName(locale, displayLocale) {
 }
 
 //#endregion
-//#region src/utils/v2/resolveLocaleEmoji.ts
+//#region src/utils/resolveLocaleEmoji.ts
 /**
 * Maps BCP 47 language subtags to ISO 3166-1 alpha-2 country codes used for
 * flag emoji resolution when no country subtag is present in the locale.
@@ -6145,6 +5811,81 @@ function resolveLocaleEmoji(locale) {
 }
 var resolveLocaleEmoji_default = resolveLocaleEmoji;
 
+//#endregion
+//#region src/utils/evaluateValidationRule.ts
+/**
+* Default i18n fallback keys returned when a `ValidationRule.message` is not provided.
+* Match the server-side defaults so a flow author who omits `message` sees the same
+* string regardless of whether the rule was evaluated client-side or server-side.
+*/
+const DEFAULT_VALIDATION_MESSAGE_KEYS = {
+	regex: "validation.pattern.invalid",
+	minLength: "validation.minLength.invalid",
+	maxLength: "validation.maxLength.invalid"
+};
+/**
+* Evaluates a single validation rule against the given input value.
+*
+* Returns `null` when the rule passes, or the rule's `message` (or the default
+* fallback key if `message` is absent) when it fails.
+*
+* Behavior notes:
+* - **regex**: an invalid regex pattern (one that cannot be compiled) is treated as
+*   **passing** on the client. This is lenient — the server is authoritative and
+*   will still enforce the rule if it can compile the pattern. Failing closed in the
+*   SDK risks denial-of-service for misconfigured flows.
+* - **minLength / maxLength**: compared against `value.length`. A non-numeric `value`
+*   on the rule is treated as the rule passing.
+* - Unknown rule types are treated as passing (forward compatibility with future types).
+*/
+const evaluateValidationRule = (rule, value) => {
+	const fail = () => rule.message ?? DEFAULT_VALIDATION_MESSAGE_KEYS[rule.type];
+	switch (rule.type) {
+		case "regex": {
+			if (typeof rule.value !== "string" || rule.value === "") return null;
+			let re;
+			try {
+				re = new RegExp(rule.value);
+			} catch {
+				return null;
+			}
+			return re.test(value) ? null : fail();
+		}
+		case "minLength":
+			if (typeof rule.value !== "number" || Number.isNaN(rule.value)) return null;
+			return value.length >= rule.value ? null : fail();
+		case "maxLength":
+			if (typeof rule.value !== "number" || Number.isNaN(rule.value)) return null;
+			return value.length <= rule.value ? null : fail();
+		default: return null;
+	}
+};
+var evaluateValidationRule_default = evaluateValidationRule;
+
+//#endregion
+//#region src/utils/buildValidatorFromRules.ts
+/**
+* Composes an array of `ValidationRule`s into a single validator function suitable for
+* `useForm`'s `FormField.validator` slot.
+*
+* The composed validator evaluates rules in declaration order and returns the **first**
+* failing rule's message — matching the SDK's render-prop shape of a single string per
+* field. When all rules pass it returns `null`.
+*
+* Returns `null` when no rules are supplied so callers can compose conditionally.
+*/
+const buildValidatorFromRules = (rules) => {
+	if (!rules || rules.length === 0) return null;
+	return (value) => {
+		for (const rule of rules) {
+			const message = evaluateValidationRule_default(rule, value);
+			if (message !== null) return message;
+		}
+		return null;
+	};
+};
+var buildValidatorFromRules_default = buildValidatorFromRules;
+
 //#endregion
 //#region src/utils/withVendorCSSClassPrefix.ts
 /**
@@ -6446,6 +6187,9 @@ const en_US = {
 		"elements.fields.organization.select.label": "Select Organization",
 		"elements.fields.organization.select.placeholder": "Choose an organization",
 		"validations.required.field.error": "This field is required",
+		"validation.pattern.invalid": "This value does not match the required format.",
+		"validation.minLength.invalid": "This value is too short.",
+		"validation.maxLength.invalid": "This value is too long.",
 		"signin.heading": "Sign In",
 		"signin.subheading": "Welcome back! Please sign in to continue.",
 		"signup.heading": "Sign Up",
@@ -6556,6 +6300,9 @@ const fr_FR = {
 		"elements.fields.organization.select.label": "Sélectionner l'organisation",
 		"elements.fields.organization.select.placeholder": "Choisissez une organisation",
 		"validations.required.field.error": "Ce champ est obligatoire",
+		"validation.pattern.invalid": "Cette valeur ne correspond pas au format requis.",
+		"validation.minLength.invalid": "Cette valeur est trop courte.",
+		"validation.maxLength.invalid": "Cette valeur est trop longue.",
 		"signin.heading": "Se connecter",
 		"signin.subheading": "Entrez vos identifiants pour continuer.",
 		"signup.heading": "S'inscrire",
@@ -6666,6 +6413,9 @@ const te_IN = {
 		"elements.fields.organization.select.label": "ఆర్గనైజేషన్‌ను ఎంచుకోండి",
 		"elements.fields.organization.select.placeholder": "సంస్థను ఎంచుకోండి",
 		"validations.required.field.error": "ఈ ఫీల్డ్ అవసరం",
+		"validation.pattern.invalid": "ఈ విలువ అవసరమైన ఆకృతికి సరిపోలడం లేదు.",
+		"validation.minLength.invalid": "ఈ విలువ చాలా చిన్నది.",
+		"validation.maxLength.invalid": "ఈ విలువ చాలా పెద్దది.",
 		"signin.heading": "సైన్ ఇన్ చేయండి",
 		"signin.subheading": "కొనసాగించడానికి మీ వివరాలు ఇవ్వండి.",
 		"signup.heading": "సైన్ అప్ చేయండి",
@@ -6776,6 +6526,9 @@ const hi_IN = {
 		"elements.fields.organization.select.label": "संगठन चुनें",
 		"elements.fields.organization.select.placeholder": "एक संगठन चुनें",
 		"validations.required.field.error": "यह फील्ड आवश्यक है",
+		"validation.pattern.invalid": "यह मान आवश्यक प्रारूप से मेल नहीं खाता।",
+		"validation.minLength.invalid": "यह मान बहुत छोटा है।",
+		"validation.maxLength.invalid": "यह मान बहुत लंबा है।",
 		"signin.heading": "साइन इन",
 		"signin.subheading": "जारी रखने के लिए अपनी प्रमाणिक जानकारी दर्ज करें।",
 		"signup.heading": "साइन अप",
@@ -6886,6 +6639,9 @@ const pt_BR = {
 		"elements.fields.organization.select.label": "Selecionar Organização",
 		"elements.fields.organization.select.placeholder": "Selecione uma organização",
 		"validations.required.field.error": "Este campo é obrigatório",
+		"validation.pattern.invalid": "Este valor não corresponde ao formato necessário.",
+		"validation.minLength.invalid": "Este valor é muito curto.",
+		"validation.maxLength.invalid": "Este valor é muito longo.",
 		"signin.heading": "Entrar",
 		"signin.subheading": "Digite suas credencias para continuar.",
 		"signup.heading": "Cadastra-se",
@@ -6996,6 +6752,9 @@ const pt_PT = {
 		"elements.fields.organization.select.label": "Selecionar Organização",
 		"elements.fields.organization.select.placeholder": "Selecione uma organização",
 		"validations.required.field.error": "Este campo é obrigatório",
+		"validation.pattern.invalid": "Este valor não corresponde ao formato necessário.",
+		"validation.minLength.invalid": "Este valor é demasiado curto.",
+		"validation.maxLength.invalid": "Este valor é demasiado longo.",
 		"signin.heading": "Iniciar Sessão",
 		"signin.subheading": "Introduza as suas credenciais para continuar.",
 		"signup.heading": "Registar-se",
@@ -7106,6 +6865,9 @@ const ta_IN = {
 		"elements.fields.organization.select.label": "அமைப்பை தேர்ந்தெடு",
 		"elements.fields.organization.select.placeholder": "அமைப்பை தெரிந்தெடுக்கவும்",
 		"validations.required.field.error": "இந்த புலம் தேவை",
+		"validation.pattern.invalid": "இந்த மதிப்பு தேவையான வடிவத்துடன் பொருந்தவில்லை.",
+		"validation.minLength.invalid": "இந்த மதிப்பு மிகவும் குறுகியது.",
+		"validation.maxLength.invalid": "இந்த மதிப்பு மிகவும் நீளமானது.",
 		"signin.heading": "உள்நுழை",
 		"signin.subheading": "தொடர உங்கள் சான்றுகளை உள்ளிடவும்.",
 		"signup.heading": "பதிவு செய்",
@@ -7216,6 +6978,9 @@ const si_LK = {
 		"elements.fields.organization.select.label": "සංවිධානය තෝරන්න",
 		"elements.fields.organization.select.placeholder": "සංවිධානයක් සැළුම් කරන්න",
 		"validations.required.field.error": "මෙම ක්ෂේත්‍රය අවශ්‍යයි",
+		"validation.pattern.invalid": "මෙම අගය අවශ්‍ය ආකෘතියට නොගැලපේ.",
+		"validation.minLength.invalid": "මෙම අගය ඉතා කෙටියි.",
+		"validation.maxLength.invalid": "මෙම අගය ඉතා දිගයි.",
 		"signin.heading": "ලොග් වෙන්න",
 		"signin.subheading": "ඉදිරියට යාමට ඔබේ සත්‍යාපන තොරතුරු ඇතුළත් කරන්න.",
 		"signup.heading": "ලියාපදිංචි වන්න",
@@ -7374,34 +7139,26 @@ var normalizeTranslations_default = normalizeTranslations;
 exports.ApplicationNativeAuthenticationConstants = ApplicationNativeAuthenticationConstants_default;
 exports.AuthenticationHelper = AuthenticationHelper_default;
 exports.DEFAULT_THEME = DEFAULT_THEME;
+exports.DEFAULT_VALIDATION_MESSAGE_KEYS = DEFAULT_VALIDATION_MESSAGE_KEYS;
 exports.EMOJI_URI_SCHEME = EMOJI_URI_SCHEME;
-exports.EmbeddedFlowActionVariantV2 = EmbeddedFlowActionVariant;
+exports.EmbeddedFlowActionVariant = EmbeddedFlowActionVariant;
 exports.EmbeddedFlowComponentType = EmbeddedFlowComponentType;
-exports.EmbeddedFlowComponentTypeV2 = EmbeddedFlowComponentType$1;
-exports.EmbeddedFlowEventTypeV2 = EmbeddedFlowEventType;
+exports.EmbeddedFlowEventType = EmbeddedFlowEventType;
 exports.EmbeddedFlowResponseType = EmbeddedFlowResponseType;
-exports.EmbeddedFlowStatus = EmbeddedFlowStatus;
-exports.EmbeddedFlowTextVariantV2 = EmbeddedFlowTextVariant;
+exports.EmbeddedFlowTextVariant = EmbeddedFlowTextVariant;
 exports.EmbeddedFlowType = EmbeddedFlowType;
-exports.EmbeddedRecoveryFlowStatusV2 = EmbeddedRecoveryFlowStatus;
-exports.EmbeddedRecoveryFlowTypeV2 = EmbeddedRecoveryFlowType;
-exports.EmbeddedSignInFlowAuthenticatorKnownIdPType = EmbeddedSignInFlowAuthenticatorKnownIdPType;
-exports.EmbeddedSignInFlowAuthenticatorParamType = EmbeddedSignInFlowAuthenticatorParamType;
-exports.EmbeddedSignInFlowAuthenticatorPromptType = EmbeddedSignInFlowAuthenticatorPromptType;
+exports.EmbeddedRecoveryFlowStatus = EmbeddedRecoveryFlowStatus;
+exports.EmbeddedRecoveryFlowType = EmbeddedRecoveryFlowType;
 exports.EmbeddedSignInFlowStatus = EmbeddedSignInFlowStatus;
-exports.EmbeddedSignInFlowStatusV2 = EmbeddedSignInFlowStatus$1;
-exports.EmbeddedSignInFlowStepType = EmbeddedSignInFlowStepType;
 exports.EmbeddedSignInFlowType = EmbeddedSignInFlowType;
-exports.EmbeddedSignInFlowTypeV2 = EmbeddedSignInFlowType$1;
-exports.EmbeddedSignUpFlowStatusV2 = EmbeddedSignUpFlowStatus;
-exports.EmbeddedSignUpFlowTypeV2 = EmbeddedSignUpFlowType;
+exports.EmbeddedSignUpFlowStatus = EmbeddedSignUpFlowStatus;
+exports.EmbeddedSignUpFlowType = EmbeddedSignUpFlowType;
 exports.FieldType = FieldType;
 exports.FlowMetaType = FlowMetaType;
 exports.FlowMode = FlowMode;
 exports.HttpClient = HttpClient;
 exports.IsomorphicCrypto = IsomorphicCrypto;
 exports.OIDCRequestConstants = OIDCRequestConstants_default;
-exports.Platform = Platform;
 exports.StorageManager = StorageManager_default;
 exports.ThunderIDAPIError = ThunderIDAPIError;
 exports.ThunderIDAuthException = ThunderIDAuthException;
@@ -7415,6 +7172,7 @@ exports.WellKnownSchemaIds = WellKnownSchemaIds;
 exports.arrayBufferToBase64url = arrayBufferToBase64url_default;
 exports.base64urlToArrayBuffer = base64urlToArrayBuffer_default;
 exports.bem = bem_default;
+exports.buildValidatorFromRules = buildValidatorFromRules_default;
 exports.configureLogger = configure;
 exports.countryCodeToFlagEmoji = countryCodeToFlagEmoji;
 exports.createComponentLogger = createComponentLogger;
@@ -7428,12 +7186,11 @@ exports.debug = debug;
 exports.deepMerge = deepMerge_default;
 exports.deriveOrganizationHandleFromBaseUrl = deriveOrganizationHandleFromBaseUrl_default;
 exports.error = error;
-exports.executeEmbeddedRecoveryFlowV2 = executeEmbeddedRecoveryFlowV2_default;
+exports.evaluateValidationRule = evaluateValidationRule_default;
+exports.executeEmbeddedRecoveryFlow = executeEmbeddedRecoveryFlow_default;
 exports.executeEmbeddedSignInFlow = executeEmbeddedSignInFlow_default;
-exports.executeEmbeddedSignInFlowV2 = executeEmbeddedSignInFlowV2_default;
 exports.executeEmbeddedSignUpFlow = executeEmbeddedSignUpFlow_default;
-exports.executeEmbeddedSignUpFlowV2 = executeEmbeddedSignUpFlowV2_default;
-exports.executeEmbeddedUserOnboardingFlowV2 = executeEmbeddedUserOnboardingFlowV2_default;
+exports.executeEmbeddedUserOnboardingFlow = executeEmbeddedUserOnboardingFlow_default;
 exports.extractEmojiFromUri = extractEmojiFromUri_default;
 exports.extractPkceStorageKeyFromState = extractPkceStorageKeyFromState_default;
 exports.extractUserClaimsFromIdToken = extractUserClaimsFromIdToken_default;
@@ -7445,7 +7202,7 @@ exports.get = get_default;
 exports.getAllOrganizations = getAllOrganizations_default;
 exports.getBrandingPreference = getBrandingPreference_default;
 exports.getDefaultI18nBundles = getDefaultI18nBundles_default;
-exports.getFlowMetaV2 = getFlowMetaV2_default;
+exports.getFlowMeta = getFlowMeta_default;
 exports.getLatestStateParam = getLatestStateParam_default;
 exports.getMeOrganizations = getMeOrganizations_default;
 exports.getOrganization = getOrganization_default;
@@ -7454,9 +7211,7 @@ exports.getRedirectBasedSignUpUrl = getRedirectBasedSignUpUrl_default;
 exports.getSchemas = getSchemas_default;
 exports.getScim2Me = getScim2Me_default;
 exports.getUserInfo = getUserInfo_default;
-exports.identifyPlatform = identifyPlatform_default;
 exports.info = info;
-exports.initializeEmbeddedSignInFlow = initializeEmbeddedSignInFlow_default;
 exports.isEmojiUri = isEmojiUri_default;
 exports.isEmpty = isEmpty_default;
 exports.isRecognizedBaseUrlPattern = isRecognizedBaseUrlPattern_default;
@@ -7466,7 +7221,6 @@ exports.processOpenIDScopes = processOpenIDScopes_default;
 exports.processUsername = processUsername_default;
 exports.removeTrailingSlash = removeTrailingSlash_default;
 exports.resolveFieldName = resolveFieldName_default;
-exports.resolveFieldType = resolveFieldType_default;
 exports.resolveFlowTemplateLiterals = resolveFlowTemplateLiterals;
 exports.resolveLocaleDisplayName = resolveLocaleDisplayName;
 exports.resolveLocaleEmoji = resolveLocaleEmoji_default;