postex-auth-sdk-stage 1.3.2 → 2.0.0

package/dist/postex-auth-sdk-stage.es.js

@@ -16,22 +16,22 @@ function y(a) {
     n += String.fromCharCode(e[t]);
   return btoa(n);
 }
-function k(a) {
+function m(a) {
   if (typeof a != "string" || !a)
     throw new Error("Invalid base64: expected non-empty string");
   const e = a.replace(/\s/g, "").replace(/-/g, "+").replace(/_/g, "/"), n = e.length % 4, t = n > 0 ? e + "=".repeat(4 - n) : e;
   try {
-    const r = atob(t), s = new Uint8Array(r.length);
-    for (let o = 0; o < r.length; o++)
-      s[o] = r.charCodeAt(o);
-    return s.buffer;
+    const s = atob(t), r = new Uint8Array(s.length);
+    for (let o = 0; o < s.length; o++)
+      r[o] = s.charCodeAt(o);
+    return r.buffer;
   } catch {
     throw new Error(
       "Invalid base64: string is not correctly encoded. Check challenge/credentialId from server."
     );
   }
 }
-function m(a) {
+function w(a) {
   return y(a).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 function J(a) {
@@ -48,7 +48,7 @@ function L(a) {
 function M(a) {
   if (!a || typeof a != "string")
     throw new Error("Invalid input: expected non-empty string");
-  return J(a) ? L(a) : k(a);
+  return J(a) ? L(a) : m(a);
 }
 function _(a) {
   return new TextEncoder().encode(a).buffer;
@@ -56,53 +56,53 @@ function _(a) {
 function W(a) {
   return String.fromCharCode(...a);
 }
-const H = "xpay_webauthn", Y = 1, u = "passkey_data", S = "passkey_email", E = "passkey_mobile_number";
+const H = "xpay_webauthn", Y = 1, l = "passkey_data", S = "passkey_email", x = "passkey_mobile_number";
 function h() {
   return new Promise((a, e) => {
     const n = indexedDB.open(H, Y);
     n.onerror = () => e(n.error), n.onsuccess = () => a(n.result), n.onupgradeneeded = () => {
       const t = n.result;
-      t.objectStoreNames.contains(u) || t.createObjectStore(u);
+      t.objectStoreNames.contains(l) || t.createObjectStore(l);
     };
   });
 }
-async function F() {
+async function z() {
   try {
     const a = await h();
     return new Promise((e, n) => {
-      const t = a.transaction(u, "readonly"), s = t.objectStore(u).get(S);
-      s.onerror = () => n(s.error), s.onsuccess = () => e(s.result ?? null), t.oncomplete = () => a.close();
+      const t = a.transaction(l, "readonly"), r = t.objectStore(l).get(S);
+      r.onerror = () => n(r.error), r.onsuccess = () => e(r.result ?? null), t.oncomplete = () => a.close();
     });
   } catch {
     return null;
   }
 }
-async function G(a) {
+async function F(a) {
   try {
     const e = await h();
     return new Promise((n, t) => {
-      const r = e.transaction(u, "readwrite"), o = r.objectStore(u).put(a, S);
-      o.onerror = () => t(o.error), o.onsuccess = () => n(), r.oncomplete = () => e.close();
+      const s = e.transaction(l, "readwrite"), o = s.objectStore(l).put(a, S);
+      o.onerror = () => t(o.error), o.onsuccess = () => n(), s.oncomplete = () => e.close();
     });
   } catch {
   }
 }
-async function V() {
+async function G() {
   try {
     const a = await h();
     return new Promise((e, n) => {
-      const t = a.transaction(u, "readwrite"), s = t.objectStore(u).delete(S);
-      s.onerror = () => n(s.error), s.onsuccess = () => e(), t.oncomplete = () => a.close();
+      const t = a.transaction(l, "readwrite"), r = t.objectStore(l).delete(S);
+      r.onerror = () => n(r.error), r.onsuccess = () => e(), t.oncomplete = () => a.close();
     });
   } catch {
   }
 }
-async function z() {
+async function V() {
   try {
     const a = await h();
     return new Promise((e, n) => {
-      const t = a.transaction(u, "readonly"), s = t.objectStore(u).get(E);
-      s.onerror = () => n(s.error), s.onsuccess = () => e(s.result ?? null), t.oncomplete = () => a.close();
+      const t = a.transaction(l, "readonly"), r = t.objectStore(l).get(x);
+      r.onerror = () => n(r.error), r.onsuccess = () => e(r.result ?? null), t.oncomplete = () => a.close();
     });
   } catch {
     return null;
@@ -112,8 +112,8 @@ async function X(a) {
   try {
     const e = await h();
     return new Promise((n, t) => {
-      const r = e.transaction(u, "readwrite"), o = r.objectStore(u).put(a, E);
-      o.onerror = () => t(o.error), o.onsuccess = () => n(), r.oncomplete = () => e.close();
+      const s = e.transaction(l, "readwrite"), o = s.objectStore(l).put(a, x);
+      o.onerror = () => t(o.error), o.onsuccess = () => n(), s.oncomplete = () => e.close();
     });
   } catch {
   }
@@ -122,13 +122,13 @@ async function Q() {
   try {
     const a = await h();
     return new Promise((e, n) => {
-      const t = a.transaction(u, "readwrite"), s = t.objectStore(u).delete(E);
-      s.onerror = () => n(s.error), s.onsuccess = () => e(), t.oncomplete = () => a.close();
+      const t = a.transaction(l, "readwrite"), r = t.objectStore(l).delete(x);
+      r.onerror = () => n(r.error), r.onsuccess = () => e(), t.oncomplete = () => a.close();
     });
   } catch {
   }
 }
-const x = "dpop_private_key", I = "dpop_public_key_jwk";
+const E = "dpop_private_key", I = "dpop_public_key_jwk";
 function D(a) {
   return {
     kty: "EC",
@@ -147,14 +147,14 @@ async function q(a) {
     "SHA-256",
     new TextEncoder().encode(e)
   );
-  return m(n);
+  return w(n);
 }
 async function B(a) {
   try {
     const e = await h();
     return new Promise((n, t) => {
-      const r = e.transaction(u, "readwrite"), o = r.objectStore(u).put(a, x);
-      o.onerror = () => t(o.error), o.onsuccess = () => n(), r.oncomplete = () => e.close();
+      const s = e.transaction(l, "readwrite"), o = s.objectStore(l).put(a, E);
+      o.onerror = () => t(o.error), o.onsuccess = () => n(), s.oncomplete = () => e.close();
     });
   } catch (e) {
     console.error("Failed to store DPoP private key:", e);
@@ -164,8 +164,8 @@ async function Z(a) {
   try {
     const e = await h();
     return new Promise((n, t) => {
-      const r = e.transaction(u, "readwrite"), o = r.objectStore(u).put(a, I);
-      o.onerror = () => t(o.error), o.onsuccess = () => n(), r.oncomplete = () => e.close();
+      const s = e.transaction(l, "readwrite"), o = s.objectStore(l).put(a, I);
+      o.onerror = () => t(o.error), o.onsuccess = () => n(), s.oncomplete = () => e.close();
     });
   } catch (e) {
     console.error("Failed to store DPoP public key JWK:", e);
@@ -175,8 +175,8 @@ async function A() {
   try {
     const a = await h();
     return new Promise((e, n) => {
-      const t = a.transaction(u, "readonly"), s = t.objectStore(u).get(x);
-      s.onerror = () => n(s.error), s.onsuccess = () => e(s.result ?? null), t.oncomplete = () => a.close();
+      const t = a.transaction(l, "readonly"), r = t.objectStore(l).get(E);
+      r.onerror = () => n(r.error), r.onsuccess = () => e(r.result ?? null), t.oncomplete = () => a.close();
     });
   } catch {
     return null;
@@ -186,8 +186,8 @@ async function R() {
   try {
     const a = await h();
     return new Promise((e, n) => {
-      const t = a.transaction(u, "readonly"), s = t.objectStore(u).get(I);
-      s.onerror = () => n(s.error), s.onsuccess = () => e(s.result ?? null), t.oncomplete = () => a.close();
+      const t = a.transaction(l, "readonly"), r = t.objectStore(l).get(I);
+      r.onerror = () => n(r.error), r.onsuccess = () => e(r.result ?? null), t.oncomplete = () => a.close();
     });
   } catch {
     return null;
@@ -197,8 +197,8 @@ async function N() {
   try {
     const a = await h();
     return new Promise((e, n) => {
-      const t = a.transaction(u, "readwrite"), r = t.objectStore(u);
-      r.delete(x), r.delete(I), t.onerror = () => n(t.error), t.oncomplete = () => {
+      const t = a.transaction(l, "readwrite"), s = t.objectStore(l);
+      s.delete(E), s.delete(I), t.onerror = () => n(t.error), t.oncomplete = () => {
         a.close(), e();
       };
     });
@@ -217,41 +217,41 @@ async function g() {
   ), e = await crypto.subtle.exportKey("jwk", a.publicKey), n = D(e), t = await q(n);
   return await B(a.privateKey), await Z(n), { publicKey: n, thumbprint: t };
 }
-async function w(a, e, n) {
+async function k(a, e, n) {
   try {
-    const t = await A(), r = await R();
-    if (!t || !r) return null;
-    const s = {
+    const t = await A(), s = await R();
+    if (!t || !s) return null;
+    const r = {
       typ: "dpop+jwt",
       alg: "ES256",
-      jwk: r
+      jwk: s
       // Public key in JWK format
     }, o = new URL(
       e,
       typeof window < "u" ? window.location.origin : void 0
-    ), c = `${o.origin}${o.pathname}`, d = {
+    ), i = `${o.origin}${o.pathname}`, u = {
       jti: crypto.randomUUID(),
       htm: a.toUpperCase(),
-      htu: c,
+      htu: i,
       iat: Math.floor(Date.now() / 1e3)
     };
     if (n) {
       const P = new TextEncoder().encode(n), $ = await crypto.subtle.digest("SHA-256", P);
-      d.ath = m($);
+      u.ath = w($);
     }
-    const l = m(
-      new TextEncoder().encode(JSON.stringify(s)).buffer
-    ), i = m(
-      new TextEncoder().encode(JSON.stringify(d)).buffer
-    ), p = `${l}.${i}`, f = await crypto.subtle.sign(
+    const d = w(
+      new TextEncoder().encode(JSON.stringify(r)).buffer
+    ), c = w(
+      new TextEncoder().encode(JSON.stringify(u)).buffer
+    ), p = `${d}.${c}`, f = await crypto.subtle.sign(
       {
         name: "ECDSA",
         hash: { name: "SHA-256" }
       },
       t,
       new TextEncoder().encode(p)
-    ), b = m(f);
-    return `${l}.${i}.${b}`;
+    ), b = w(f);
+    return `${d}.${c}.${b}`;
   } catch (t) {
     return console.error("Failed to generate DPoP proof:", t), null;
   }
@@ -263,15 +263,15 @@ const te = B, U = {
   isWebAuthnSupported: K,
   isConditionalUISupported: j,
   arrayBufferToBase64: y,
-  base64ToArrayBuffer: k,
-  arrayBufferToBase64url: m,
+  base64ToArrayBuffer: m,
+  arrayBufferToBase64url: w,
   base64urlToArrayBuffer: M,
   stringToArrayBuffer: _,
   uint8ArrayToString: W,
-  getPasskeyEmail: F,
-  setPasskeyEmail: G,
-  clearPasskeyEmail: V,
-  getPasskeyMobileNumber: z,
+  getPasskeyEmail: z,
+  setPasskeyEmail: F,
+  clearPasskeyEmail: G,
+  getPasskeyMobileNumber: V,
   setPasskeyMobileNumber: X,
   clearPasskeyMobileNumber: Q,
   toMinimalJWK: D,
@@ -280,14 +280,14 @@ const te = B, U = {
   getDPoPPublicKeyJWK: R,
   clearDPoPKey: N,
   generateDPoPKeyPair: g,
-  generateDPoPProof: w,
+  generateDPoPProof: k,
   isDPoPEnabled: ee,
   storeDPoPKey: te
 };
 typeof window < "u" && (window.WebAuthn = U);
 const ne = typeof window < "u" ? window : globalThis;
 ne.WebAuthn = U;
-const T = "postex-auth-token", se = "postexglobal", re = {
+const T = "postex-auth-token", re = "postexglobal", se = {
   xstak: "https://auth-stage.xstak.com/public/v1",
   postex: "https://auth-stage.postex.pk/public/v1",
   callcourier: "https://auth-stage.callcourier.com.pk/public/v1",
@@ -299,14 +299,14 @@ class oe extends Error {
     super(t ?? `Request failed with status ${e}`), this.response = { status: e, data: n }, this.name = "AuthSDKFetchError";
   }
 }
-const O = "auth_sdk_id_token", v = "auth_sdk_refresh_token";
+const v = "auth_sdk_id_token", O = "auth_sdk_refresh_token";
 class C {
   constructor(e) {
     this.config = e;
   }
   getBaseUrl() {
-    const e = this.config.appId ?? se;
-    return re[e];
+    const e = this.config.appId ?? re;
+    return se[e];
   }
   normalizeAuthIdentifier(e) {
     return typeof e == "string" ? { email: e } : {
@@ -314,14 +314,24 @@ class C {
       mobileNumber: e.mobileNumber
     };
   }
+  extractRealm(e, n) {
+    return (n?.realm ?? (e && typeof e != "string" ? e.realm : void 0))?.trim() || void 0;
+  }
+  buildAuthRequestBody(e, n) {
+    const t = this.normalizeAuthIdentifier(e), s = this.extractRealm(e, n);
+    return {
+      ...t,
+      ...s ? { realm: s } : {}
+    };
+  }
   buildUrl(e, n) {
-    const t = this.getBaseUrl().replace(/\/$/, ""), r = e.startsWith("/") ? e : `/${e}`, s = `${t}${r}`;
-    if (!n || Object.keys(n).length === 0) return s;
+    const t = this.getBaseUrl().replace(/\/$/, ""), s = e.startsWith("/") ? e : `/${e}`, r = `${t}${s}`;
+    if (!n || Object.keys(n).length === 0) return r;
     const o = new URLSearchParams(n).toString();
-    return `${s}?${o}`;
+    return `${r}?${o}`;
   }
   async request(e, n, t) {
-    const r = this.buildUrl(n, t?.params), s = {
+    const s = this.buildUrl(n, t?.params), r = {
       "Content-Type": "application/json",
       Accept: "application/json",
       "X-API-Key": this.config.apiKey ?? "",
@@ -329,22 +339,22 @@ class C {
     }, o = {
       method: e,
       credentials: "include",
-      headers: s
+      headers: r
     };
     t?.body !== void 0 && t?.body !== null && (o.body = JSON.stringify(t.body));
-    const c = await fetch(r, o);
-    if (!c.ok) {
-      let i;
+    const i = await fetch(s, o);
+    if (!i.ok) {
+      let c;
       try {
-        const p = await c.text();
-        i = p ? JSON.parse(p) : void 0;
+        const p = await i.text();
+        c = p ? JSON.parse(p) : void 0;
       } catch {
-        i = void 0;
+        c = void 0;
       }
-      throw c.status === 401 && await this.clearTokens(), new oe(c.status, i);
+      throw i.status === 401 && await this.clearTokens(), new oe(i.status, c);
     }
-    const d = await c.text();
-    return { data: d ? JSON.parse(d) : {} };
+    const u = await i.text();
+    return { data: u ? JSON.parse(u) : {} };
   }
   /**
    * Returns auth headers (Authorization + DPoP) for the given request.
@@ -355,35 +365,35 @@ class C {
   async getRequestAuthHeaders(e, n) {
     const t = localStorage.getItem(T);
     if (!t) return {};
-    const r = n.startsWith("http") ? n : `${this.getBaseUrl()}${n}`, s = await w(
+    const s = n.startsWith("http") ? n : `${this.getBaseUrl()}${n}`, r = await k(
       e.toUpperCase(),
-      r,
+      s,
       t
     ), o = {
       Authorization: `Bearer ${t}`
     };
-    return s && (o.DPoP = s), o;
+    return r && (o.DPoP = r), o;
   }
   /**
    * GET /auth/status - Check if client has trusted device session and what auth method is available.
    * Returns no_session | session_found | webauthn_ready per PostEx Auth BFF spec.
    */
-  async getStatus(e) {
-    const n = {};
-    typeof e == "string" ? n.email = e : (e.email && (n.email = e.email), e.mobileNumber && (n.mobileNumber = e.mobileNumber));
-    const t = await this.request("GET", "/auth/status", {
-      params: n
+  async getStatus(e, n) {
+    const t = this.normalizeAuthIdentifier(e), s = this.extractRealm(e, n), r = {};
+    t.email && (r.email = t.email), t.mobileNumber && (r.mobileNumber = t.mobileNumber), s && (r.realm = s);
+    const o = await this.request("GET", "/auth/status", {
+      params: r
     });
-    return t.data.data ?? t.data;
+    return o.data.data ?? o.data;
   }
   /**
    * POST /auth/initiate - Unified entry: returns webauthn_challenge or otp_sent.
    * Sets auth_session cookie when otp_sent.
    */
-  async initiateAuth(e) {
-    const n = this.normalizeAuthIdentifier(e), t = await this.request("POST", "/auth/initiate", {
-      body: n
-    }), r = t.data.data ?? t.data;
+  async initiateAuth(e, n) {
+    const t = this.buildAuthRequestBody(e, n), s = await this.request("POST", "/auth/initiate", {
+      body: t
+    }), r = s.data.data ?? s.data;
     return {
       status: r.status,
       challenge: r.challenge,
@@ -395,17 +405,17 @@ class C {
    * POST /otp/initiate - Direct OTP initiation using email or mobile number.
    * Requires at least one identifier: email or mobileNumber.
    */
-  async initiateOTP(e) {
-    const n = this.normalizeAuthIdentifier(e), t = n.email?.trim(), r = n.mobileNumber?.trim();
-    if (!t && !r)
+  async initiateOTP(e, n) {
+    const t = this.normalizeAuthIdentifier(e), s = this.extractRealm(e, n), r = t.email?.trim(), o = t.mobileNumber?.trim();
+    if (!r && !o)
       throw new Error("Either mobileNumber or email is required");
-    const s = {};
-    t && (s.email = t), r && (s.mobileNumber = r);
-    const c = (await this.request("POST", "/otp/initiate", {
-      body: s
+    const i = {};
+    r && (i.email = r), o && (i.mobileNumber = o), s && (i.realm = s);
+    const d = (await this.request("POST", "/otp/initiate", {
+      body: i
     })).data;
     return {
-      message: c.message ?? c.data?.message
+      message: d.message ?? d.data?.message
     };
   }
   /**
@@ -414,28 +424,28 @@ class C {
    */
   async verifyOTP(e) {
     await g();
-    const n = await w(
+    const n = await k(
       "POST",
       `${this.getBaseUrl()}/otp/verify`
     ), t = await this.request("POST", "/otp/verify", {
       body: { otp: e },
       headers: n ? { DPoP: n } : {}
-    }), r = t.data.data ?? t.data, s = r.AuthenticationResult ?? r, o = s.access_token ?? s.accessToken ?? s.AccessToken, c = s.refresh_token ?? s.refreshToken ?? s.RefreshToken, d = s.id_token ?? s.idToken ?? s.IdToken, l = s.expires_in ?? s.expiresIn ?? s.ExpiresIn ?? 3600, i = s.token_type ?? s.tokenType ?? s.TokenType ?? "Bearer";
+    }), s = t.data.data ?? t.data, r = s.AuthenticationResult ?? s, o = r.access_token ?? r.accessToken ?? r.AccessToken, i = r.refresh_token ?? r.refreshToken ?? r.RefreshToken, u = r.id_token ?? r.idToken ?? r.IdToken, d = r.expires_in ?? r.expiresIn ?? r.ExpiresIn ?? 3600, c = r.token_type ?? r.tokenType ?? r.TokenType ?? "Bearer";
     return o && await this.storeTokens({
       accessToken: o,
-      refreshToken: c ?? "",
-      idToken: d ?? "",
-      expiresIn: l ?? 3600,
-      tokenType: i ?? "Bearer"
+      refreshToken: i ?? "",
+      idToken: u ?? "",
+      expiresIn: d ?? 3600,
+      tokenType: c ?? "Bearer"
     }), {
       access_token: o,
-      refresh_token: c ?? "",
-      id_token: d ?? "",
-      expires_in: l,
-      token_type: i,
-      verified: s.verified ?? s.Verified ?? !0,
-      email: s.email ?? s.Email ?? "",
-      ...s
+      refresh_token: i ?? "",
+      id_token: u ?? "",
+      expires_in: d,
+      token_type: c,
+      verified: r.verified,
+      email: r.email ?? r.Email ?? "",
+      ...r
     };
   }
   /**
@@ -445,7 +455,7 @@ class C {
   async resendOTP() {
     const e = await this.request("POST", "/otp/resend", {}), n = e.data.data ?? e.data;
     return {
-      success: n.success ?? !0,
+      success: n.success,
       message: n.message,
       ...n
     };
@@ -459,26 +469,26 @@ class C {
     otp: n
   }) {
     await g();
-    const t = await w(
+    const t = await k(
       "POST",
       `${this.getBaseUrl()}/otp/signup/verify`
-    ), r = await this.request("POST", "/otp/signup/verify", {
+    ), s = await this.request("POST", "/otp/signup/verify", {
       body: { mobileNumber: e, otp: n },
       headers: t ? { DPoP: t } : {}
-    }), s = r.data.data ?? r.data, o = s.AuthenticationResult ?? s, c = o.access_token ?? o.accessToken ?? o.AccessToken, d = o.refresh_token ?? o.refreshToken ?? o.RefreshToken, l = o.id_token ?? o.idToken ?? o.IdToken, i = o.expires_in ?? o.expiresIn ?? o.ExpiresIn ?? 3600, p = o.token_type ?? o.tokenType ?? o.TokenType ?? "Bearer";
-    return c && await this.storeTokens({
-      accessToken: c,
-      refreshToken: d ?? "",
-      idToken: l ?? "",
-      expiresIn: i ?? 3600,
+    }), r = s.data.data ?? s.data, o = r.AuthenticationResult ?? r, i = o.access_token ?? o.accessToken ?? o.AccessToken, u = o.refresh_token ?? o.refreshToken ?? o.RefreshToken, d = o.id_token ?? o.idToken ?? o.IdToken, c = o.expires_in ?? o.expiresIn ?? o.ExpiresIn ?? 3600, p = o.token_type ?? o.tokenType ?? o.TokenType ?? "Bearer";
+    return i && await this.storeTokens({
+      accessToken: i,
+      refreshToken: u ?? "",
+      idToken: d ?? "",
+      expiresIn: c ?? 3600,
       tokenType: p ?? "Bearer"
     }), {
-      access_token: c,
-      refresh_token: d ?? "",
-      id_token: l ?? "",
-      expires_in: i,
+      access_token: i,
+      refresh_token: u ?? "",
+      id_token: d ?? "",
+      expires_in: c,
       token_type: p,
-      verified: o.verified ?? o.Verified ?? !0,
+      verified: o.verified,
       email: o.email ?? o.Email ?? "",
       ...o
     };
@@ -492,11 +502,11 @@ class C {
   }) {
     const t = await this.request("POST", "/otp/signup/resend", {
       body: { email: n, mobileNumber: e }
-    }), r = t.data.data ?? t.data;
+    }), s = t.data.data ?? t.data;
     return {
-      success: r.success ?? !0,
-      message: r.message,
-      ...r
+      success: s.success,
+      message: s.message,
+      ...s
     };
   }
   /**
@@ -520,20 +530,20 @@ class C {
       {
         body: {}
       }
-    ), n = e.data.data ?? e.data, t = n.AuthenticationResult ?? n, r = t.access_token ?? t.accessToken ?? t.AccessToken, s = t.refresh_token ?? t.refreshToken ?? t.RefreshToken, o = t.id_token ?? t.idToken ?? t.IdToken, c = t.expires_in ?? t.expiresIn ?? t.ExpiresIn ?? 3600, d = t.token_type ?? t.tokenType ?? t.TokenType ?? "Bearer";
-    return r && await this.storeTokens({
-      accessToken: r,
-      refreshToken: s ?? "",
+    ), n = e.data.data ?? e.data, t = n.AuthenticationResult ?? n, s = t.access_token ?? t.accessToken ?? t.AccessToken, r = t.refresh_token ?? t.refreshToken ?? t.RefreshToken, o = t.id_token ?? t.idToken ?? t.IdToken, i = t.expires_in ?? t.expiresIn ?? t.ExpiresIn ?? 3600, u = t.token_type ?? t.tokenType ?? t.TokenType ?? "Bearer";
+    return s && await this.storeTokens({
+      accessToken: s,
+      refreshToken: r ?? "",
       idToken: o ?? "",
-      expiresIn: c ?? 3600,
-      tokenType: d ?? "Bearer"
+      expiresIn: i ?? 3600,
+      tokenType: u ?? "Bearer"
     }), {
-      access_token: r,
-      refresh_token: s ?? "",
+      access_token: s,
+      refresh_token: r ?? "",
       id_token: o ?? "",
-      expires_in: c,
-      token_type: d,
-      verified: t.verified ?? t.Verified ?? !0,
+      expires_in: i,
+      token_type: u,
+      verified: t.verified,
       email: t.email ?? t.Email ?? "",
       ...t
     };
@@ -553,23 +563,23 @@ class C {
     let t;
     if (n?.user?.id)
       try {
-        t = k(n.user.id);
+        t = m(n.user.id);
       } catch {
         t = _(n.user.id);
       }
     else
       t = _(e);
-    const r = (n.pubKeyCredParams ?? [
+    const s = (n.pubKeyCredParams ?? [
       { type: "public-key", alg: -7 },
       { type: "public-key", alg: -257 }
     ]).map((f) => ({
       type: "public-key",
       alg: f.alg
-    })), s = n.excludeCredentials?.map((f) => ({
+    })), r = n.excludeCredentials?.map((f) => ({
       type: "public-key",
-      id: k(f.id)
+      id: m(f)
     })), o = {
-      challenge: k(n.challenge),
+      challenge: m(n.challenge),
       rp: {
         name: n.rp?.name ?? "XPay",
         id: n.rp?.id ?? window.location.hostname
@@ -579,8 +589,8 @@ class C {
         name: n.user?.name ?? e,
         displayName: n.user?.displayName ?? e
       },
-      pubKeyCredParams: r,
-      excludeCredentials: s,
+      pubKeyCredParams: s,
+      excludeCredentials: r,
       timeout: n.timeout ?? 6e4,
       attestation: "direct",
       authenticatorSelection: {
@@ -588,26 +598,26 @@ class C {
         userVerification: "required",
         authenticatorAttachment: "platform"
       }
-    }, c = await navigator.credentials.create({
+    }, i = await navigator.credentials.create({
       publicKey: o
     });
-    if (!c) throw new Error("Credential creation failed");
-    const d = c.response, l = {
-      clientDataJSON: y(d.clientDataJSON),
-      attestationObject: y(d.attestationObject),
-      rawId: y(c.rawId)
+    if (!i) throw new Error("Credential creation failed");
+    const u = i.response, d = {
+      clientDataJSON: y(u.clientDataJSON),
+      attestationObject: y(u.attestationObject),
+      rawId: y(i.rawId)
     };
-    if (!l.rawId) throw new Error("Raw ID is required");
+    if (!d.rawId) throw new Error("Raw ID is required");
     await g();
-    const i = await w(
+    const c = await k(
       "POST",
       `${this.getBaseUrl()}/webauthn/register/challenge`
     ), p = await this.request(
       "POST",
       "/webauthn/register/challenge",
       {
-        body: l,
-        headers: i ? { DPoP: i } : {}
+        body: d,
+        headers: c ? { DPoP: c } : {}
       }
     );
     return p.data.data ?? p.data;
@@ -620,65 +630,65 @@ class C {
     rp: n,
     credentialIds: t
   }) {
-    const r = await navigator.credentials.get({
+    const s = await navigator.credentials.get({
       publicKey: {
-        challenge: k(e),
+        challenge: m(e),
         rpId: n?.host ?? void 0,
         allowCredentials: t.map((P) => ({
           type: "public-key",
-          id: k(P),
+          id: m(P),
           transports: ["internal"]
         })),
         timeout: 6e4,
         userVerification: "required"
       }
     });
-    if (!r) throw new Error("Authentication failed");
-    const s = r.response, o = {
-      clientDataJSON: y(s.clientDataJSON),
+    if (!s) throw new Error("Authentication failed");
+    const r = s.response, o = {
+      clientDataJSON: y(r.clientDataJSON),
       authenticatorData: y(
-        s.authenticatorData
+        r.authenticatorData
       ),
-      signature: y(s.signature),
-      rawId: y(r.rawId),
-      userHandle: s.userHandle ? y(s.userHandle) : ""
+      signature: y(r.signature),
+      rawId: y(s.rawId),
+      userHandle: r.userHandle ? y(r.userHandle) : ""
     };
     await g();
-    const c = await w(
+    const i = await k(
       "POST",
       `${this.getBaseUrl()}/webauthn/authenticate/challenge`
-    ), d = await this.request(
+    ), u = await this.request(
       "POST",
       "/webauthn/authenticate/challenge",
       {
         body: o,
-        headers: c ? { DPoP: c } : {}
+        headers: i ? { DPoP: i } : {}
       }
-    ), l = d.data.data ?? d.data, i = l.AuthenticationResult ?? l, p = i.AccessToken ?? i.accessToken ?? i.access_token, f = i.RefreshToken ?? i.refreshToken ?? i.refresh_token, b = i.IdToken ?? i.idToken ?? i.id_token;
+    ), d = u.data.data ?? u.data, c = d.AuthenticationResult ?? d, p = c.AccessToken ?? c.accessToken ?? c.access_token, f = c.RefreshToken ?? c.refreshToken ?? c.refresh_token, b = c.IdToken ?? c.idToken ?? c.id_token;
     return p && await this.storeTokens({
       accessToken: p,
       refreshToken: f ?? "",
       idToken: b ?? "",
-      expiresIn: i.expiresIn ?? i.ExpiresIn ?? 3600,
-      tokenType: i.tokenType ?? i.token_type ?? "Bearer"
+      expiresIn: c.expiresIn ?? c.ExpiresIn ?? 3600,
+      tokenType: c.tokenType ?? c.token_type ?? "Bearer"
     }), {
       access_token: p,
       refresh_token: f ?? "",
       id_token: b,
-      email: i.email,
-      name: i.name ?? i.userName,
-      expiresIn: i.expiresIn ?? i.ExpiresIn,
-      tokenType: i.tokenType ?? i.token_type,
-      ...i
+      email: c.email,
+      name: c.name ?? c.userName,
+      expiresIn: c.expiresIn ?? c.ExpiresIn,
+      tokenType: c.tokenType ?? c.token_type,
+      ...c
     };
   }
   /**
    * GET /webauthn/credentials/:username - Get user's passkey status.
    */
   async getPasskeyStatus(e) {
-    const t = `/webauthn/credentials/${encodeURIComponent(e)}`, r = await this.signRequest("GET", t), s = await this.request("GET", t, {
-      headers: r.headers
-    }), o = s.data.data ?? s.data;
+    const t = `/webauthn/credentials/${encodeURIComponent(e)}`, s = await this.signRequest("GET", t), r = await this.request("GET", t, {
+      headers: s.headers
+    }), o = r.data.data ?? r.data;
     return {
       ...o,
       hasCredentials: !!(o.hasCredentials ?? o.credentialId)
@@ -688,58 +698,58 @@ class C {
    * DELETE /webauthn/credentials/:username - Remove passkey.
    */
   async removePasskey(e) {
-    const t = `/webauthn/credentials/${encodeURIComponent(e)}`, r = await this.signRequest("DELETE", t);
+    const t = `/webauthn/credentials/${encodeURIComponent(e)}`, s = await this.signRequest("DELETE", t);
     await this.request("DELETE", t, {
-      headers: r.headers
+      headers: s.headers
     });
   }
   /**
    * Signs a request with DPoP and Authorization headers (internal use).
    */
   async signRequest(e, n, t = {}) {
-    const r = n.startsWith("http") ? n : `${this.getBaseUrl()}${n}`, s = await this.getRequestAuthHeaders(e, r);
-    return { ...t, headers: { ...t.headers, ...s } };
+    const s = n.startsWith("http") ? n : `${this.getBaseUrl()}${n}`, r = await this.getRequestAuthHeaders(e, s);
+    return { ...t, headers: { ...t.headers, ...r } };
   }
   /**
    * Replaces native fetch or Axios with a DPoP-signed version.
    */
   async authenticatedFetch(e, n) {
-    const t = typeof e == "string" ? e : e instanceof URL ? e.toString() : e.url, r = n?.method || "GET", s = await this.signRequest(r, t, {
+    const t = typeof e == "string" ? e : e instanceof URL ? e.toString() : e.url, s = n?.method || "GET", r = await this.signRequest(s, t, {
       headers: n?.headers
     });
-    return fetch(e, { ...n, headers: s.headers });
+    return fetch(e, { ...n, headers: r.headers });
   }
   /**
    * Store tokens from /webauthn/authenticate (per spec: sessionStorage preferred).
    */
   async storeTokens(e) {
-    localStorage.setItem(T, e.accessToken), e.refreshToken && localStorage.setItem(v, e.refreshToken), e.idToken && localStorage.setItem(O, e.idToken);
+    localStorage.setItem(T, e.accessToken), e.refreshToken && localStorage.setItem(O, e.refreshToken), e.idToken && localStorage.setItem(v, e.idToken);
   }
   /**
    * Clear stored tokens (call on logout).
    */
   async clearTokens() {
-    localStorage.removeItem(T), localStorage.removeItem(O), localStorage.removeItem(v);
+    localStorage.removeItem(T), localStorage.removeItem(v), localStorage.removeItem(O);
   }
   /**
    * POST /auth/refresh - Refresh access token using server-stored refresh token.
    * Requires trusted device cookie (td). Refresh token is stored server-side.
    * Rate limit: 10 requests per minute.
    */
-  async refreshToken() {
-    const e = await this.request("POST", "/auth/refresh", {
-      body: {}
-    }), n = e.data.data ?? e.data, t = n.access_token, r = n.id_token ?? "", s = n.token_type ?? "Bearer", o = n.expires_in ?? 3600;
-    return t && await this.storeTokens({
-      accessToken: t,
-      idToken: r,
-      expiresIn: o,
-      tokenType: s
+  async refreshToken(e) {
+    const n = this.extractRealm(void 0, e), t = await this.request("POST", "/auth/refresh", {
+      body: n ? { realm: n } : {}
+    }), s = t.data.data ?? t.data, r = s.access_token, o = s.id_token ?? "", i = s.token_type ?? "Bearer", u = s.expires_in ?? 3600;
+    return r && await this.storeTokens({
+      accessToken: r,
+      idToken: o,
+      expiresIn: u,
+      tokenType: i
     }), {
-      access_token: t,
-      id_token: r,
-      token_type: s,
-      expires_in: o
+      access_token: r,
+      id_token: o,
+      token_type: i,
+      expires_in: u
     };
   }
   /**
@@ -765,23 +775,23 @@ export {
   C as AuthSDK,
   oe as AuthSDKFetchError,
   y as arrayBufferToBase64,
-  m as arrayBufferToBase64url,
-  k as base64ToArrayBuffer,
+  w as arrayBufferToBase64url,
+  m as base64ToArrayBuffer,
   M as base64urlToArrayBuffer,
   q as calculateThumbprint,
   N as clearDPoPKey,
-  V as clearPasskeyEmail,
+  G as clearPasskeyEmail,
   Q as clearPasskeyMobileNumber,
   g as generateDPoPKeyPair,
-  w as generateDPoPProof,
+  k as generateDPoPProof,
   A as getDPoPKey,
   R as getDPoPPublicKeyJWK,
-  F as getPasskeyEmail,
-  z as getPasskeyMobileNumber,
+  z as getPasskeyEmail,
+  V as getPasskeyMobileNumber,
   j as isConditionalUISupported,
   ee as isDPoPEnabled,
   K as isWebAuthnSupported,
-  G as setPasskeyEmail,
+  F as setPasskeyEmail,
   X as setPasskeyMobileNumber,
   te as storeDPoPKey,
   _ as stringToArrayBuffer,