@auth-link/web 0.0.5 → 1.1.0

package/dist/index.js

@@ -1673,10 +1673,9 @@ function validateTicket(value, expectedMode, trustedOrigin) {
   }
   if (qr.v !== 1 || qr.requestId !== m.requestId || typeof qr.token !== "string" || !token.test(qr.token) || origin.protocol !== "https:" || origin.origin !== qr.origin || origin.origin.length > 512 || origin.username || origin.password || trustedOrigin && origin.origin !== trustedOrigin) fail("UNTRUSTED_QR");
   const displayCode = m.displayCode === void 0 ? void 0 : validateDisplayCode(m.displayCode);
-  if (m.purpose === "confirm" && !displayCode) fail("DYNAMIC_CODE_REQUIRED");
   const expiry = Date.parse(String(m.expiresAt));
   const now = displayCode ? Date.parse(displayCode.serverTime) : Date.now();
-  if (!Number.isFinite(expiry) || expiry > now + 18e4) fail("INVALID_EXPIRY");
+  if (!Number.isFinite(expiry) || expiry > now + 36e4) fail("INVALID_EXPIRY");
   return {
     requestId: m.requestId,
     purpose: m.purpose,
@@ -1728,7 +1727,7 @@ async function limitedJson(response) {
     return fail("INVALID_RESPONSE");
   }
 }
-function createAuthLinkClient(options) {
+function createBackendCall(options) {
   if ("apiKey" in options || "secret" in options) fail("SERVER_SECRET_FORBIDDEN");
   const base = options.baseUrl ?? "/api/authlink";
   const allowedOrigins = new Set(options.allowedBackendOrigins ?? []);
@@ -1793,7 +1792,15 @@ function createAuthLinkClient(options) {
         headers,
         body: JSON.stringify(body)
       });
-      if (!response.ok) fail(response.status === 401 || response.status === 403 ? "CMS_UNAUTHORIZED" : "CMS_REQUEST_FAILED");
+      if (!response.ok) {
+        let code = "";
+        try {
+          code = String(object(await limitedJson(response)).code ?? "").replace(/^AUTHLINK_/, "");
+        } catch {
+        }
+        if (["CONFIRMATION_CODE_INVALID", "CONFIRMATION_CODE_LOCKED", "APPROVAL_REQUIRED", "REQUEST_EXPIRED", "PASSCODE_INVALID", "PASSCODE_USED", "PASSCODE_LOCKED", "OTP_NOT_CONFIGURED"].includes(code)) fail(code);
+        fail(response.status === 401 || response.status === 403 ? "CMS_UNAUTHORIZED" : "CMS_REQUEST_FAILED");
+      }
       return await limitedJson(response);
     } catch (error) {
       if (error instanceof AuthLinkError) throw error;
@@ -1804,14 +1811,19 @@ function createAuthLinkClient(options) {
       signal?.removeEventListener("abort", cancel);
     }
   };
+  return call;
+}
+function createAuthLinkClient(options) {
+  const call = createBackendCall(options);
   return {
     async create(mode, { idempotencyKey, signal }) {
       if (!["bind", "confirm"].includes(mode) || !token.test(idempotencyKey)) fail("INVALID_CREATE_OPTIONS");
       return validateTicket(await call("/requests", { purpose: mode }, signal, idempotencyKey), mode, options.authLinkOrigin);
     },
-    async result(ticket, signal) {
+    async result(ticket, signal, confirmationCode) {
       if (!token.test(ticket.requestId)) fail("INVALID_TICKET");
-      return await call(`/requests/${ticket.requestId}/result`, {}, signal);
+      if (typeof confirmationCode !== "string" || !/^[0-9]{6}$/.test(confirmationCode)) fail("CONFIRMATION_CODE_REQUIRED");
+      return await call(`/requests/${ticket.requestId}/result`, { confirmationCode }, signal);
     }
   };
 }
@@ -1833,116 +1845,117 @@ function abortable(promise, signal) {
 }
 async function observeRequest(input, options) {
   const { client, signal, onUpdate } = options;
-  const interval = options.intervalMs ?? 1500;
   let ticket;
   try {
-    if (interval < 250 || interval > 1e4 || !Number.isFinite(interval)) fail("INVALID_INTERVAL");
     ticket = validateTicket(input, options.expectedMode);
   } catch (error) {
-    if (!signal.aborted) {
-      const e = error instanceof Error ? error : new AuthLinkError("INVALID_TICKET");
-      onUpdate({ ...initialSnapshot(), status: "error", error: e });
-      options.onError?.(e);
-    }
+    if (!signal.aborted) options.onError?.(error);
     return;
   }
-  let frame = ticket.displayCode;
-  let serverAnchor = frame ? Date.parse(frame.serverTime) : Date.now();
-  let monotonicAnchor = performance.now();
-  const serverNow = () => serverAnchor + performance.now() - monotonicAnchor;
   const expiry = Date.parse(ticket.expiresAt);
-  let ended = false;
+  const deadline = performance.now() + Math.max(0, expiry - Date.now());
+  let ended = false, busy = false;
+  let done;
+  const finished = new Promise((resolve) => {
+    done = resolve;
+  });
   const controller = new AbortController();
-  const cancel = () => controller.abort(signal.reason);
-  signal.addEventListener("abort", cancel, { once: true });
-  if (signal.aborted) cancel();
-  let last = initialSnapshot();
-  const update = (value) => {
-    if (signal.aborted) return;
-    if (JSON.stringify(value) !== JSON.stringify(last)) {
-      last = value;
-      onUpdate(value);
-    }
+  const cancel = () => {
+    ended = true;
+    controller.abort();
+    done();
   };
+  signal.addEventListener("abort", cancel, { once: true });
+  let snapshot = initialSnapshot();
+  const remaining = () => Math.max(0, (deadline - performance.now()) / 1e3);
   const tick = () => {
     if (ended || signal.aborted) return;
-    const now = serverNow();
-    if (now >= expiry) {
-      controller.abort(new AuthLinkError("REQUEST_EXPIRED"));
+    if (remaining() <= 0) {
+      ended = true;
+      controller.abort();
+      onUpdate({ ...snapshot, status: "expired", code: null, submitting: false });
+      void Promise.resolve().then(() => options.onExpired?.()).catch(() => options.onError?.(new AuthLinkError("CALLBACK_FAILED")));
+      done();
       return;
     }
-    const codeRemaining = Math.max(0, ((frame ? Date.parse(frame.validUntil) : expiry) - now) / 1e3);
-    options.onCodeTiming?.(codeRemaining * 1e3);
-    update({
+    snapshot = {
+      ...snapshot,
       status: "pending",
-      code: codeRemaining > 0 ? frame?.value ?? ticket.pairingCode : null,
-      secondsRemaining: Math.max(0, Math.ceil((expiry - now) / 1e3)),
-      codeSecondsRemaining: Math.ceil(codeRemaining),
-      error: null
-    });
+      code: ticket.pairingCode,
+      secondsRemaining: Math.ceil(remaining()),
+      codeSecondsRemaining: Math.ceil(remaining()),
+      submitting: busy
+    };
+    onUpdate(snapshot);
   };
-  const timer = setInterval(tick, 200);
-  const finish = (status, result, error) => {
-    if (ended || signal.aborted) return;
-    ended = true;
-    update({ ...last, status, code: null, error: error ?? null });
-    try {
-      let effect = void 0;
-      if (status === "confirmed") effect = options.onConfirmed?.(result);
-      else if (status === "rejected") effect = options.onRejected?.({ status: "rejected", code: "REJECTED", requestId: ticket.requestId, purpose: ticket.purpose });
-      else if (status === "expired") effect = options.onExpired?.();
-      else options.onError?.(error);
-      void Promise.resolve(effect).catch(() => {
-        if (!signal.aborted) options.onError?.(new AuthLinkError("CALLBACK_FAILED"));
-      });
-    } catch {
-      if (status !== "error") options.onError?.(new AuthLinkError("CALLBACK_FAILED"));
+  const submit = async (confirmationCode) => {
+    if (ended || signal.aborted || busy) return;
+    if (!/^[0-9]{6}$/.test(confirmationCode)) {
+      snapshot = { ...snapshot, error: new AuthLinkError("CONFIRMATION_CODE_REQUIRED") };
+      tick();
+      return;
     }
-  };
-  try {
+    if (remaining() <= 0) {
+      tick();
+      return;
+    }
+    busy = true;
+    snapshot = { ...snapshot, error: null };
     tick();
-    for (; ; ) {
-      controller.signal.throwIfAborted();
-      const value = object(await abortable(client.result(ticket, controller.signal), controller.signal));
-      controller.signal.throwIfAborted();
+    try {
+      const value = object(await abortable(client.result(ticket, controller.signal, confirmationCode), controller.signal));
+      if (ended || signal.aborted) return;
       if (value.requestId !== ticket.requestId) fail("REQUEST_MISMATCH");
       if (value.status === "confirmed") {
-        if (!token.test(String(value.verificationId)) || !["device-presence.v1"].includes(String(value.authenticationPolicy)) || value.expiresAt !== ticket.expiresAt || value.purpose !== ticket.purpose || serverNow() >= expiry || "action" in value || "transactionHash" in value) fail("INVALID_CONFIRMATION");
-        finish("confirmed", value);
-        return;
-      }
-      if (value.status === "rejected" || value.status === "expired") {
-        finish(value.status);
-        return;
-      }
-      if (!["new", "pending", "approved", "consumed"].includes(String(value.status))) fail("INVALID_RESPONSE");
-      if (value.displayCode !== void 0) {
-        const nextFrame = validateDisplayCode(value.displayCode);
-        const nextExpiry = Date.parse(nextFrame.validUntil);
-        const currentExpiry = frame ? Date.parse(frame.validUntil) : 0;
-        if (!frame || nextExpiry > currentExpiry) {
-          serverAnchor = Math.max(serverNow(), Date.parse(nextFrame.serverTime));
-          monotonicAnchor = performance.now();
+        if (!token.test(String(value.verificationId)) || value.authenticationPolicy !== "device-presence.v1" || value.expiresAt !== ticket.expiresAt || value.purpose !== ticket.purpose || remaining() <= 0 || "action" in value || "transactionHash" in value) fail("INVALID_CONFIRMATION");
+        ended = true;
+        onUpdate({ ...snapshot, status: "confirmed", code: null, submitting: false });
+        try {
+          await options.onConfirmed?.(value);
+        } catch {
+          options.onError?.(new AuthLinkError("CALLBACK_FAILED"));
         }
-        if (!frame || nextExpiry >= currentExpiry) frame = nextFrame;
+        done();
+      } else if (value.status === "rejected" || value.status === "expired") {
+        ended = true;
+        onUpdate({ ...snapshot, status: value.status, code: null, submitting: false });
+        try {
+          if (value.status === "rejected") await options.onRejected?.({ status: "rejected", code: "REJECTED", requestId: ticket.requestId, purpose: ticket.purpose });
+          else await options.onExpired?.();
+        } catch {
+          options.onError?.(new AuthLinkError("CALLBACK_FAILED"));
+        } finally {
+          done();
+        }
+      } else {
+        fail("CONFIRMATION_NOT_READY");
       }
-      tick();
-      let pause;
-      try {
-        await abortable(new Promise((resolve) => {
-          pause = setTimeout(resolve, interval);
-        }), controller.signal);
-      } finally {
-        clearTimeout(pause);
+    } catch (error) {
+      if (!ended && !signal.aborted) {
+        const raw = error instanceof Error ? error : new AuthLinkError("NETWORK_ERROR");
+        const code = raw.message.replace(/^AUTHLINK_/, "");
+        const failure = ["CONFIRMATION_CODE_LOCKED", "CONFIRMATION_CODE_INVALID", "APPROVAL_REQUIRED", "REQUEST_EXPIRED"].includes(code) ? new AuthLinkError(code) : raw;
+        snapshot = { ...snapshot, error: failure };
+        if (code === "CONFIRMATION_CODE_LOCKED" || code === "REQUEST_EXPIRED") {
+          ended = true;
+          onUpdate({ ...snapshot, code: null, submitting: false, status: code === "REQUEST_EXPIRED" ? "expired" : "error" });
+          if (code === "REQUEST_EXPIRED") void Promise.resolve().then(() => options.onExpired?.()).catch(() => options.onError?.(new AuthLinkError("CALLBACK_FAILED")));
+          else options.onError?.(failure);
+          done();
+        } else options.onError?.(failure);
       }
+    } finally {
+      busy = false;
+      tick();
     }
-  } catch (error) {
-    if (!signal.aborted && !ended) {
-      if (error instanceof AuthLinkError && error.code === "REQUEST_EXPIRED") finish("expired");
-      else finish("error", void 0, error instanceof AuthLinkError ? error : new AuthLinkError("NETWORK_ERROR"));
-    }
+  };
+  tick();
+  options.onReady?.(submit);
+  const timer = setInterval(tick, 1e3);
+  if (signal.aborted) cancel();
+  try {
+    await finished;
   } finally {
-    ended = true;
     clearInterval(timer);
     controller.abort();
     signal.removeEventListener("abort", cancel);
@@ -1954,8 +1967,8 @@ var en_default = {
   bind: "Bind your phone",
   confirm: "Confirm verification",
   scan: "Scan with AuthLink",
-  code: "Matching code",
-  help: "Check that the numbers match in the app, then confirm on your phone.",
+  code: "Matching digits",
+  help: "Approve in the App, then enter its 6-digit confirmation code here.",
   waiting: "Waiting for your phone",
   loading: "Connecting",
   confirmed: "Confirmed",
@@ -1968,7 +1981,16 @@ var en_default = {
   close: "Close",
   cancel: "Cancel",
   autoUpdate: "Code updates automatically every 30 seconds",
-  expiring: "Request expiring soon"
+  expiring: "Request expiring soon",
+  confirmationCode: "App confirmation code",
+  submitCode: "Verify",
+  codeError: "The code could not be verified. Check the code and approval, then retry.",
+  codeLocked: "Too many incorrect codes. Close this window and start a new request.",
+  otpCode: "App verification code",
+  otpHelp: "Open AuthLink and enter this account\u2019s current six-digit code. No approval is needed.",
+  otpWaiting: "Enter the current code",
+  otpError: "Verification failed. Check the account; wait for a new code if already used. After repeated failures, try again later.",
+  otpSetup: "Enable verification codes on this account\u2019s card in the app first."
 };
 
 // src/locales/zh-CN.json
@@ -1976,8 +1998,8 @@ var zh_CN_default = {
   bind: "\u7ED1\u5B9A\u624B\u673A",
   confirm: "\u786E\u8BA4\u8EAB\u4EFD\u9A8C\u8BC1",
   scan: "\u4F7F\u7528 AuthLink \u626B\u63CF\u4E8C\u7EF4\u7801",
-  code: "\u52A8\u6001\u6838\u5BF9\u7801",
-  help: "\u6838\u5BF9 App \u4E2D\u7684\u6570\u5B57\u4E00\u81F4\u540E\uFF0C\u5728\u624B\u673A\u4E0A\u786E\u8BA4\u3002",
+  code: "\u6838\u5BF9\u6570\u5B57",
+  help: "\u5728 App \u6838\u5BF9\u5E76\u6279\u51C6\u540E\uFF0C\u5C06 App \u663E\u793A\u7684 6 \u4F4D\u786E\u8BA4\u7801\u8F93\u5165\u4E0B\u65B9\u3002",
   waiting: "\u7B49\u5F85\u624B\u673A\u786E\u8BA4",
   loading: "\u6B63\u5728\u8FDE\u63A5",
   confirmed: "\u5DF2\u786E\u8BA4",
@@ -1990,7 +2012,16 @@ var zh_CN_default = {
   close: "\u5173\u95ED",
   cancel: "\u53D6\u6D88",
   autoUpdate: "\u6838\u5BF9\u7801\u6BCF 30 \u79D2\u81EA\u52A8\u66F4\u65B0",
-  expiring: "\u8BF7\u6C42\u5373\u5C06\u8FC7\u671F"
+  expiring: "\u8BF7\u6C42\u5373\u5C06\u8FC7\u671F",
+  confirmationCode: "App \u786E\u8BA4\u7801",
+  submitCode: "\u63D0\u4EA4\u9A8C\u8BC1",
+  codeError: "\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF0C\u8BF7\u68C0\u67E5\u786E\u8BA4\u7801\u548C\u624B\u673A\u6279\u51C6\u72B6\u6001\u540E\u91CD\u8BD5\u3002",
+  codeLocked: "\u786E\u8BA4\u7801\u8F93\u5165\u9519\u8BEF\u6B21\u6570\u8FC7\u591A\uFF0C\u8BF7\u5173\u95ED\u7A97\u53E3\u540E\u91CD\u65B0\u53D1\u8D77\u8BF7\u6C42\u3002",
+  otpCode: "App \u52A8\u6001\u7801",
+  otpHelp: "\u6253\u5F00 AuthLink\uFF0C\u8F93\u5165\u8BE5\u8D26\u53F7\u5F53\u524D\u7684\u516D\u4F4D\u52A8\u6001\u7801\uFF0C\u65E0\u9700\u6279\u51C6\u8BF7\u6C42\u3002",
+  otpWaiting: "\u8BF7\u8F93\u5165\u5F53\u524D\u52A8\u6001\u7801",
+  otpError: "\u9A8C\u8BC1\u672A\u901A\u8FC7\u3002\u8BF7\u6838\u5BF9\u8D26\u53F7\uFF1B\u5DF2\u4F7F\u7528\u7684\u7801\u9700\u7B49\u5F85\u66F4\u65B0\uFF0C\u591A\u6B21\u5931\u8D25\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002",
+  otpSetup: "\u8BF7\u5148\u5728 App \u7684\u8D26\u53F7\u5361\u7247\u4E2D\u542F\u7528\u52A8\u6001\u7801\u3002"
 };
 
 // src/locales/zh-TW.json
@@ -1998,8 +2029,8 @@ var zh_TW_default = {
   bind: "\u7D81\u5B9A\u624B\u6A5F",
   confirm: "\u78BA\u8A8D\u8EAB\u5206\u9A57\u8B49",
   scan: "\u4F7F\u7528 AuthLink \u6383\u63CF QR \u78BC",
-  code: "\u52D5\u614B\u6838\u5C0D\u78BC",
-  help: "\u6838\u5C0D App \u4E2D\u7684\u6578\u5B57\u4E00\u81F4\u5F8C\uFF0C\u5728\u624B\u6A5F\u4E0A\u78BA\u8A8D\u3002",
+  code: "\u6838\u5C0D\u6578\u5B57",
+  help: "\u5728 App \u6838\u5C0D\u4E26\u6279\u51C6\u5F8C\uFF0C\u5C07 App \u986F\u793A\u7684 6 \u4F4D\u78BA\u8A8D\u78BC\u8F38\u5165\u4E0B\u65B9\u3002",
   waiting: "\u7B49\u5F85\u624B\u6A5F\u78BA\u8A8D",
   loading: "\u6B63\u5728\u9023\u7DDA",
   confirmed: "\u5DF2\u78BA\u8A8D",
@@ -2012,7 +2043,16 @@ var zh_TW_default = {
   close: "\u95DC\u9589",
   cancel: "\u53D6\u6D88",
   autoUpdate: "\u6838\u5C0D\u78BC\u6BCF 30 \u79D2\u81EA\u52D5\u66F4\u65B0",
-  expiring: "\u8ACB\u6C42\u5373\u5C07\u5230\u671F"
+  expiring: "\u8ACB\u6C42\u5373\u5C07\u5230\u671F",
+  confirmationCode: "App \u78BA\u8A8D\u78BC",
+  submitCode: "\u63D0\u4EA4\u9A57\u8B49",
+  codeError: "\u9A57\u8B49\u672A\u901A\u904E\uFF0C\u8ACB\u6AA2\u67E5\u78BA\u8A8D\u78BC\u53CA\u624B\u6A5F\u6279\u51C6\u72C0\u614B\u5F8C\u91CD\u8A66\u3002",
+  codeLocked: "\u78BA\u8A8D\u78BC\u8F38\u5165\u932F\u8AA4\u6B21\u6578\u904E\u591A\uFF0C\u8ACB\u95DC\u9589\u8996\u7A97\u5F8C\u91CD\u65B0\u767C\u8D77\u8ACB\u6C42\u3002",
+  otpCode: "App \u52D5\u614B\u78BC",
+  otpHelp: "\u958B\u555F AuthLink\uFF0C\u8F38\u5165\u6B64\u5E33\u865F\u76EE\u524D\u7684\u516D\u4F4D\u52D5\u614B\u78BC\uFF0C\u7121\u9700\u6279\u51C6\u8ACB\u6C42\u3002",
+  otpWaiting: "\u8ACB\u8F38\u5165\u76EE\u524D\u7684\u52D5\u614B\u78BC",
+  otpError: "\u9A57\u8B49\u672A\u901A\u904E\u3002\u8ACB\u6838\u5C0D\u5E33\u865F\uFF1B\u5DF2\u4F7F\u7528\u7684\u78BC\u9700\u7B49\u5F85\u66F4\u65B0\uFF0C\u591A\u6B21\u5931\u6557\u8ACB\u7A0D\u5F8C\u91CD\u8A66\u3002",
+  otpSetup: "\u8ACB\u5148\u5728 App \u7684\u5E33\u865F\u5361\u7247\u4E2D\u555F\u7528\u52D5\u614B\u78BC\u3002"
 };
 
 // src/locales/ja.json
@@ -2020,8 +2060,8 @@ var ja_default = {
   bind: "\u30B9\u30DE\u30FC\u30C8\u30D5\u30A9\u30F3\u3092\u767B\u9332",
   confirm: "\u672C\u4EBA\u78BA\u8A8D",
   scan: "AuthLink \u3067 QR \u30B3\u30FC\u30C9\u3092\u30B9\u30AD\u30E3\u30F3",
-  code: "\u7167\u5408\u30B3\u30FC\u30C9",
-  help: "\u30A2\u30D7\u30EA\u306E\u6570\u5B57\u304C\u4E00\u81F4\u3059\u308B\u3053\u3068\u3092\u78BA\u8A8D\u3057\u3001\u30B9\u30DE\u30FC\u30C8\u30D5\u30A9\u30F3\u3067\u627F\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  code: "\u7167\u5408\u7528\u306E\u6570\u5B57",
+  help: "App \u3067\u627F\u8A8D\u3057\u305F\u5F8C\u3001\u8868\u793A\u3055\u308C\u305F6\u6841\u306E\u78BA\u8A8D\u30B3\u30FC\u30C9\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   waiting: "\u30B9\u30DE\u30FC\u30C8\u30D5\u30A9\u30F3\u306E\u78BA\u8A8D\u3092\u5F85\u3063\u3066\u3044\u307E\u3059",
   loading: "\u63A5\u7D9A\u4E2D",
   confirmed: "\u78BA\u8A8D\u6E08\u307F",
@@ -2034,7 +2074,16 @@ var ja_default = {
   close: "\u9589\u3058\u308B",
   cancel: "\u30AD\u30E3\u30F3\u30BB\u30EB",
   autoUpdate: "\u7167\u5408\u30B3\u30FC\u30C9\u306F30\u79D2\u3054\u3068\u306B\u81EA\u52D5\u66F4\u65B0",
-  expiring: "\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u6709\u52B9\u671F\u9650\u304C\u307E\u3082\u306A\u304F\u5207\u308C\u307E\u3059"
+  expiring: "\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u6709\u52B9\u671F\u9650\u304C\u307E\u3082\u306A\u304F\u5207\u308C\u307E\u3059",
+  confirmationCode: "App \u306E\u78BA\u8A8D\u30B3\u30FC\u30C9",
+  submitCode: "\u78BA\u8A8D\u3059\u308B",
+  codeError: "\u78BA\u8A8D\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\u3002\u30B3\u30FC\u30C9\u3068\u627F\u8A8D\u72B6\u6CC1\u3092\u78BA\u8A8D\u3057\u3066\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  codeLocked: "\u30B3\u30FC\u30C9\u306E\u8AA4\u5165\u529B\u304C\u591A\u3059\u304E\u307E\u3059\u3002\u753B\u9762\u3092\u9589\u3058\u3001\u65B0\u3057\u3044\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u958B\u59CB\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  otpCode: "\u30A2\u30D7\u30EA\u306E\u8A8D\u8A3C\u30B3\u30FC\u30C9",
+  otpHelp: "AuthLink \u3092\u958B\u304D\u3001\u3053\u306E\u30A2\u30AB\u30A6\u30F3\u30C8\u306E\u73FE\u5728\u306E6\u6841\u30B3\u30FC\u30C9\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u627F\u8A8D\u64CD\u4F5C\u306F\u4E0D\u8981\u3067\u3059\u3002",
+  otpWaiting: "\u73FE\u5728\u306E\u30B3\u30FC\u30C9\u3092\u5165\u529B",
+  otpError: "\u8A8D\u8A3C\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\u3002\u30A2\u30AB\u30A6\u30F3\u30C8\u3092\u78BA\u8A8D\u3057\u3001\u4F7F\u7528\u6E08\u307F\u306A\u3089\u6B21\u306E\u30B3\u30FC\u30C9\u3092\u5F85\u3063\u3066\u304F\u3060\u3055\u3044\u3002\u5931\u6557\u304C\u7D9A\u304F\u5834\u5408\u306F\u6642\u9593\u3092\u304A\u3044\u3066\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  otpSetup: "\u5148\u306B\u30A2\u30D7\u30EA\u306E\u30A2\u30AB\u30A6\u30F3\u30C8\u753B\u9762\u3067\u8A8D\u8A3C\u30B3\u30FC\u30C9\u3092\u6709\u52B9\u306B\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
 };
 
 // src/locales/bn.json
@@ -2043,7 +2092,7 @@ var bn_default = {
   confirm: "\u09AF\u09BE\u099A\u09BE\u0987\u0995\u09B0\u09A3 \u09A8\u09BF\u09B6\u09CD\u099A\u09BF\u09A4 \u0995\u09B0\u09C1\u09A8",
   scan: "AuthLink \u09A6\u09BF\u09AF\u09BC\u09C7 \u09B8\u09CD\u0995\u09CD\u09AF\u09BE\u09A8 \u0995\u09B0\u09C1\u09A8",
   code: "\u09AE\u09BF\u09B2\u09BF\u09AF\u09BC\u09C7 \u09A6\u09C7\u0996\u09BE\u09B0 \u0995\u09CB\u09A1",
-  help: "\u0985\u09CD\u09AF\u09BE\u09AA\u09C7\u09B0 \u09B8\u0982\u0996\u09CD\u09AF\u09BE\u0997\u09C1\u09B2\u09CB \u09AE\u09BF\u09B2\u09C7 \u0997\u09C7\u09B2\u09C7 \u09AB\u09CB\u09A8\u09C7 \u09A8\u09BF\u09B6\u09CD\u099A\u09BF\u09A4 \u0995\u09B0\u09C1\u09A8\u0964",
+  help: "\u0985\u09CD\u09AF\u09BE\u09AA\u09C7 \u0985\u09A8\u09C1\u09AE\u09CB\u09A6\u09A8 \u09A6\u09BF\u09A8, \u09A4\u09BE\u09B0\u09AA\u09B0 \u098F\u0996\u09BE\u09A8\u09C7 \u09EC \u09B8\u0982\u0996\u09CD\u09AF\u09BE\u09B0 \u09A8\u09BF\u09B6\u09CD\u099A\u09BF\u09A4\u0995\u09B0\u09A3 \u0995\u09CB\u09A1 \u09B2\u09BF\u0996\u09C1\u09A8\u0964",
   waiting: "\u09AB\u09CB\u09A8\u09C7 \u09A8\u09BF\u09B6\u09CD\u099A\u09BF\u09A4\u0995\u09B0\u09A3\u09C7\u09B0 \u0985\u09AA\u09C7\u0995\u09CD\u09B7\u09BE\u09AF\u09BC",
   loading: "\u09B8\u0982\u09AF\u09CB\u0997 \u0995\u09B0\u09BE \u09B9\u099A\u09CD\u099B\u09C7",
   confirmed: "\u09A8\u09BF\u09B6\u09CD\u099A\u09BF\u09A4 \u09B9\u09AF\u09BC\u09C7\u099B\u09C7",
@@ -2056,7 +2105,16 @@ var bn_default = {
   close: "\u09AC\u09A8\u09CD\u09A7 \u0995\u09B0\u09C1\u09A8",
   cancel: "\u09AC\u09BE\u09A4\u09BF\u09B2",
   autoUpdate: "\u0995\u09CB\u09A1 \u09AA\u09CD\u09B0\u09A4\u09BF \u09E9\u09E6 \u09B8\u09C7\u0995\u09C7\u09A8\u09CD\u09A1\u09C7 \u09B8\u09CD\u09AC\u09AF\u09BC\u0982\u0995\u09CD\u09B0\u09BF\u09AF\u09BC\u09AD\u09BE\u09AC\u09C7 \u09AC\u09A6\u09B2\u09BE\u09AF\u09BC",
-  expiring: "\u0985\u09A8\u09C1\u09B0\u09CB\u09A7\u09C7\u09B0 \u09AE\u09C7\u09AF\u09BC\u09BE\u09A6 \u09B6\u09C0\u0998\u09CD\u09B0\u0987 \u09B6\u09C7\u09B7 \u09B9\u09AC\u09C7"
+  expiring: "\u0985\u09A8\u09C1\u09B0\u09CB\u09A7\u09C7\u09B0 \u09AE\u09C7\u09AF\u09BC\u09BE\u09A6 \u09B6\u09C0\u0998\u09CD\u09B0\u0987 \u09B6\u09C7\u09B7 \u09B9\u09AC\u09C7",
+  confirmationCode: "\u0985\u09CD\u09AF\u09BE\u09AA\u09C7\u09B0 \u09A8\u09BF\u09B6\u09CD\u099A\u09BF\u09A4\u0995\u09B0\u09A3 \u0995\u09CB\u09A1",
+  submitCode: "\u09AF\u09BE\u099A\u09BE\u0987 \u0995\u09B0\u09C1\u09A8",
+  codeError: "\u09AF\u09BE\u099A\u09BE\u0987 \u0995\u09B0\u09BE \u09AF\u09BE\u09AF\u09BC\u09A8\u09BF\u0964 \u0995\u09CB\u09A1 \u0993 \u0985\u09A8\u09C1\u09AE\u09CB\u09A6\u09A8 \u09AA\u09B0\u09C0\u0995\u09CD\u09B7\u09BE \u0995\u09B0\u09C7 \u0986\u09AC\u09BE\u09B0 \u099A\u09C7\u09B7\u09CD\u099F\u09BE \u0995\u09B0\u09C1\u09A8\u0964",
+  codeLocked: "\u0985\u09A8\u09C7\u0995\u09AC\u09BE\u09B0 \u09AD\u09C1\u09B2 \u0995\u09CB\u09A1 \u09A6\u09C7\u0993\u09AF\u09BC\u09BE \u09B9\u09AF\u09BC\u09C7\u099B\u09C7\u0964 \u0989\u0987\u09A8\u09CD\u09A1\u09CB \u09AC\u09A8\u09CD\u09A7 \u0995\u09B0\u09C7 \u09A8\u09A4\u09C1\u09A8 \u0985\u09A8\u09C1\u09B0\u09CB\u09A7 \u09B6\u09C1\u09B0\u09C1 \u0995\u09B0\u09C1\u09A8\u0964",
+  otpCode: "\u0985\u09CD\u09AF\u09BE\u09AA\u09C7\u09B0 \u0995\u09CB\u09A1",
+  otpHelp: "AuthLink \u0996\u09C1\u09B2\u09C7 \u098F\u0987 \u0985\u09CD\u09AF\u09BE\u0995\u09BE\u0989\u09A8\u09CD\u099F\u09C7\u09B0 \u09AC\u09B0\u09CD\u09A4\u09AE\u09BE\u09A8 \u099B\u09AF\u09BC \u0985\u0999\u09CD\u0995\u09C7\u09B0 \u0995\u09CB\u09A1 \u09B2\u09BF\u0996\u09C1\u09A8\u0964 \u0985\u09A8\u09C1\u09B0\u09CB\u09A7 \u0985\u09A8\u09C1\u09AE\u09CB\u09A6\u09A8\u09C7\u09B0 \u09AA\u09CD\u09B0\u09AF\u09BC\u09CB\u099C\u09A8 \u09A8\u09C7\u0987\u0964",
+  otpWaiting: "\u09AC\u09B0\u09CD\u09A4\u09AE\u09BE\u09A8 \u0995\u09CB\u09A1 \u09B2\u09BF\u0996\u09C1\u09A8",
+  otpError: "\u09AF\u09BE\u099A\u09BE\u0987 \u09AC\u09CD\u09AF\u09B0\u09CD\u09A5\u0964 \u0985\u09CD\u09AF\u09BE\u0995\u09BE\u0989\u09A8\u09CD\u099F \u09AA\u09B0\u09C0\u0995\u09CD\u09B7\u09BE \u0995\u09B0\u09C1\u09A8 \u098F\u09AC\u0982 \u09AC\u09CD\u09AF\u09AC\u09B9\u09C3\u09A4 \u0995\u09CB\u09A1 \u09B9\u09B2\u09C7 \u09A8\u09A4\u09C1\u09A8 \u0995\u09CB\u09A1\u09C7\u09B0 \u099C\u09A8\u09CD\u09AF \u0985\u09AA\u09C7\u0995\u09CD\u09B7\u09BE \u0995\u09B0\u09C1\u09A8\u0964 \u09AC\u09BE\u09B0\u09AC\u09BE\u09B0 \u09AC\u09CD\u09AF\u09B0\u09CD\u09A5 \u09B9\u09B2\u09C7 \u09AA\u09B0\u09C7 \u099A\u09C7\u09B7\u09CD\u099F\u09BE \u0995\u09B0\u09C1\u09A8\u0964",
+  otpSetup: "\u09AA\u09CD\u09B0\u09A5\u09AE\u09C7 \u0985\u09CD\u09AF\u09BE\u09AA\u09C7 \u098F\u0987 \u0985\u09CD\u09AF\u09BE\u0995\u09BE\u0989\u09A8\u09CD\u099F\u09C7\u09B0 \u0995\u09BE\u09B0\u09CD\u09A1\u09C7 \u0995\u09CB\u09A1 \u099A\u09BE\u09B2\u09C1 \u0995\u09B0\u09C1\u09A8\u0964"
 };
 
 // src/locales/es.json
@@ -2065,7 +2123,7 @@ var es_default = {
   confirm: "Confirma la verificaci\xF3n",
   scan: "Escanea con AuthLink",
   code: "C\xF3digo de comparaci\xF3n",
-  help: "Comprueba que los n\xFAmeros coincidan en la aplicaci\xF3n y confirma en tu tel\xE9fono.",
+  help: "Aprueba en la app e introduce aqu\xED su c\xF3digo de 6 d\xEDgitos.",
   waiting: "Esperando la confirmaci\xF3n del tel\xE9fono",
   loading: "Conectando",
   confirmed: "Confirmado",
@@ -2078,7 +2136,16 @@ var es_default = {
   close: "Cerrar",
   cancel: "Cancelar",
   autoUpdate: "El c\xF3digo se actualiza autom\xE1ticamente cada 30 segundos",
-  expiring: "La solicitud est\xE1 por caducar"
+  expiring: "La solicitud est\xE1 por caducar",
+  confirmationCode: "C\xF3digo de confirmaci\xF3n de la app",
+  submitCode: "Verificar",
+  codeError: "No se pudo verificar. Revisa el c\xF3digo y la aprobaci\xF3n.",
+  codeLocked: "Demasiados c\xF3digos incorrectos. Cierra la ventana e inicia una nueva solicitud.",
+  otpCode: "C\xF3digo de la app",
+  otpHelp: "Abre AuthLink e introduce el c\xF3digo actual de seis d\xEDgitos de esta cuenta. No hace falta aprobar una solicitud.",
+  otpWaiting: "Introduce el c\xF3digo actual",
+  otpError: "No se pudo verificar. Comprueba la cuenta y espera un c\xF3digo nuevo si ya lo usaste. Si fallas varias veces, int\xE9ntalo m\xE1s tarde.",
+  otpSetup: "Activa primero los c\xF3digos en la tarjeta de esta cuenta en la app."
 };
 
 // src/locales/fil.json
@@ -2087,7 +2154,7 @@ var fil_default = {
   confirm: "Kumpirmahin ang pagpapatunay",
   scan: "Mag-scan gamit ang AuthLink",
   code: "Code na paghahambingin",
-  help: "Tiyaking magkapareho ang mga numero sa app, pagkatapos ay kumpirmahin sa iyong telepono.",
+  help: "Aprubahan sa app, saka ilagay dito ang 6-digit na confirmation code.",
   waiting: "Hinihintay ang kumpirmasyon sa telepono",
   loading: "Kumokonekta",
   confirmed: "Nakumpirma",
@@ -2100,7 +2167,16 @@ var fil_default = {
   close: "Isara",
   cancel: "Kanselahin",
   autoUpdate: "Awtomatikong nagbabago ang code kada 30 segundo",
-  expiring: "Malapit nang mag-expire ang kahilingan"
+  expiring: "Malapit nang mag-expire ang kahilingan",
+  confirmationCode: "Confirmation code ng app",
+  submitCode: "I-verify",
+  codeError: "Hindi ma-verify. Suriin ang code at pag-apruba at subukan muli.",
+  codeLocked: "Masyadong maraming maling code. Isara ang window at magsimula ng bagong request.",
+  otpCode: "Code ng app",
+  otpHelp: "Buksan ang AuthLink at ilagay ang kasalukuyang anim na digit na code ng account na ito. Hindi kailangang aprubahan ang request.",
+  otpWaiting: "Ilagay ang kasalukuyang code",
+  otpError: "Hindi napatunayan. Tingnan ang account at maghintay ng bagong code kung nagamit na. Subukang muli mamaya kung maraming maling pagtatangka.",
+  otpSetup: "Paganahin muna ang mga code sa card ng account na ito sa app."
 };
 
 // src/locales/hi.json
@@ -2109,7 +2185,7 @@ var hi_default = {
   confirm: "\u0938\u0924\u094D\u092F\u093E\u092A\u0928 \u0915\u0940 \u092A\u0941\u0937\u094D\u091F\u093F \u0915\u0930\u0947\u0902",
   scan: "AuthLink \u0938\u0947 \u0938\u094D\u0915\u0948\u0928 \u0915\u0930\u0947\u0902",
   code: "\u092E\u093F\u0932\u093E\u0928 \u0915\u094B\u0921",
-  help: "\u0910\u092A \u092E\u0947\u0902 \u0938\u0902\u0916\u094D\u092F\u093E\u0913\u0902 \u0915\u093E \u092E\u093F\u0932\u093E\u0928 \u0915\u0930\u0947\u0902, \u092B\u093F\u0930 \u0905\u092A\u0928\u0947 \u092B\u093C\u094B\u0928 \u092A\u0930 \u092A\u0941\u0937\u094D\u091F\u093F \u0915\u0930\u0947\u0902\u0964",
+  help: "\u0910\u092A \u092E\u0947\u0902 \u0938\u094D\u0935\u0940\u0915\u0943\u0924\u093F \u0926\u0947\u0902, \u092B\u093F\u0930 \u092F\u0939\u093E\u0901 6 \u0905\u0902\u0915\u094B\u0902 \u0915\u093E \u092A\u0941\u0937\u094D\u091F\u093F \u0915\u094B\u0921 \u0926\u0930\u094D\u091C \u0915\u0930\u0947\u0902\u0964",
   waiting: "\u092B\u093C\u094B\u0928 \u092A\u0930 \u092A\u0941\u0937\u094D\u091F\u093F \u0915\u0940 \u092A\u094D\u0930\u0924\u0940\u0915\u094D\u0937\u093E \u0939\u0948",
   loading: "\u0915\u0928\u0947\u0915\u094D\u091F \u0939\u094B \u0930\u0939\u093E \u0939\u0948",
   confirmed: "\u092A\u0941\u0937\u094D\u091F\u093F \u0939\u094B \u0917\u0908",
@@ -2122,7 +2198,16 @@ var hi_default = {
   close: "\u092C\u0902\u0926 \u0915\u0930\u0947\u0902",
   cancel: "\u0930\u0926\u094D\u0926 \u0915\u0930\u0947\u0902",
   autoUpdate: "\u0915\u094B\u0921 \u0939\u0930 30 \u0938\u0947\u0915\u0902\u0921 \u092E\u0947\u0902 \u0905\u092A\u0928\u0947 \u0906\u092A \u092C\u0926\u0932\u0924\u093E \u0939\u0948",
-  expiring: "\u0905\u0928\u0941\u0930\u094B\u0927 \u0915\u0940 \u0938\u092E\u092F-\u0938\u0940\u092E\u093E \u0938\u092E\u093E\u092A\u094D\u0924 \u0939\u094B\u0928\u0947 \u0935\u093E\u0932\u0940 \u0939\u0948"
+  expiring: "\u0905\u0928\u0941\u0930\u094B\u0927 \u0915\u0940 \u0938\u092E\u092F-\u0938\u0940\u092E\u093E \u0938\u092E\u093E\u092A\u094D\u0924 \u0939\u094B\u0928\u0947 \u0935\u093E\u0932\u0940 \u0939\u0948",
+  confirmationCode: "\u0910\u092A \u0915\u093E \u092A\u0941\u0937\u094D\u091F\u093F \u0915\u094B\u0921",
+  submitCode: "\u0938\u0924\u094D\u092F\u093E\u092A\u093F\u0924 \u0915\u0930\u0947\u0902",
+  codeError: "\u0938\u0924\u094D\u092F\u093E\u092A\u0928 \u0935\u093F\u092B\u0932 \u0930\u0939\u093E\u0964 \u0915\u094B\u0921 \u0914\u0930 \u0938\u094D\u0935\u0940\u0915\u0943\u0924\u093F \u091C\u093E\u0901\u091A\u0915\u0930 \u092A\u0941\u0928\u0903 \u092A\u094D\u0930\u092F\u093E\u0938 \u0915\u0930\u0947\u0902\u0964",
+  codeLocked: "\u092C\u0939\u0941\u0924 \u0905\u0927\u093F\u0915 \u0917\u0932\u0924 \u0915\u094B\u0921\u0964 \u0935\u093F\u0902\u0921\u094B \u092C\u0902\u0926 \u0915\u0930\u0915\u0947 \u0928\u092F\u093E \u0905\u0928\u0941\u0930\u094B\u0927 \u0936\u0941\u0930\u0942 \u0915\u0930\u0947\u0902\u0964",
+  otpCode: "\u0910\u092A \u0915\u093E \u0915\u094B\u0921",
+  otpHelp: "AuthLink \u0916\u094B\u0932\u0947\u0902 \u0914\u0930 \u0907\u0938 \u0916\u093E\u0924\u0947 \u0915\u093E \u0935\u0930\u094D\u0924\u092E\u093E\u0928 \u091B\u0939 \u0905\u0902\u0915\u094B\u0902 \u0915\u093E \u0915\u094B\u0921 \u0926\u0930\u094D\u091C \u0915\u0930\u0947\u0902\u0964 \u0905\u0928\u0941\u0930\u094B\u0927 \u0938\u094D\u0935\u0940\u0915\u0943\u0924 \u0915\u0930\u0928\u0947 \u0915\u0940 \u0906\u0935\u0936\u094D\u092F\u0915\u0924\u093E \u0928\u0939\u0940\u0902 \u0939\u0948\u0964",
+  otpWaiting: "\u0935\u0930\u094D\u0924\u092E\u093E\u0928 \u0915\u094B\u0921 \u0926\u0930\u094D\u091C \u0915\u0930\u0947\u0902",
+  otpError: "\u0938\u0924\u094D\u092F\u093E\u092A\u0928 \u0905\u0938\u092B\u0932\u0964 \u0916\u093E\u0924\u093E \u091C\u093E\u0901\u091A\u0947\u0902 \u0914\u0930 \u0909\u092A\u092F\u094B\u0917 \u0939\u094B \u091A\u0941\u0915\u093E \u0939\u094B \u0924\u094B \u0928\u090F \u0915\u094B\u0921 \u0915\u0940 \u092A\u094D\u0930\u0924\u0940\u0915\u094D\u0937\u093E \u0915\u0930\u0947\u0902\u0964 \u092C\u093E\u0930-\u092C\u093E\u0930 \u0905\u0938\u092B\u0932 \u0939\u094B\u0928\u0947 \u092A\u0930 \u092C\u093E\u0926 \u092E\u0947\u0902 \u092A\u094D\u0930\u092F\u093E\u0938 \u0915\u0930\u0947\u0902\u0964",
+  otpSetup: "\u092A\u0939\u0932\u0947 \u0910\u092A \u092E\u0947\u0902 \u0907\u0938 \u0916\u093E\u0924\u0947 \u0915\u0947 \u0915\u093E\u0930\u094D\u0921 \u092A\u0930 \u0915\u094B\u0921 \u0938\u0915\u094D\u0937\u092E \u0915\u0930\u0947\u0902\u0964"
 };
 
 // src/locales/id.json
@@ -2131,7 +2216,7 @@ var id_default = {
   confirm: "Konfirmasi verifikasi",
   scan: "Pindai dengan AuthLink",
   code: "Kode pencocokan",
-  help: "Pastikan angka di aplikasi cocok, lalu konfirmasi di ponsel Anda.",
+  help: "Setujui di aplikasi, lalu masukkan kode konfirmasi 6 digit di sini.",
   waiting: "Menunggu konfirmasi dari ponsel",
   loading: "Menghubungkan",
   confirmed: "Dikonfirmasi",
@@ -2144,7 +2229,16 @@ var id_default = {
   close: "Tutup",
   cancel: "Batal",
   autoUpdate: "Kode diperbarui otomatis setiap 30 detik",
-  expiring: "Permintaan akan segera kedaluwarsa"
+  expiring: "Permintaan akan segera kedaluwarsa",
+  confirmationCode: "Kode konfirmasi aplikasi",
+  submitCode: "Verifikasi",
+  codeError: "Verifikasi gagal. Periksa kode dan persetujuan, lalu coba lagi.",
+  codeLocked: "Terlalu banyak kode salah. Tutup jendela dan mulai permintaan baru.",
+  otpCode: "Kode aplikasi",
+  otpHelp: "Buka AuthLink dan masukkan kode enam digit terkini untuk akun ini. Tidak perlu menyetujui permintaan.",
+  otpWaiting: "Masukkan kode terkini",
+  otpError: "Verifikasi gagal. Periksa akun dan tunggu kode baru jika sudah digunakan. Setelah beberapa kegagalan, coba lagi nanti.",
+  otpSetup: "Aktifkan kode di kartu akun ini dalam aplikasi terlebih dahulu."
 };
 
 // src/locales/ms.json
@@ -2153,7 +2247,7 @@ var ms_default = {
   confirm: "Sahkan pengesahan",
   scan: "Imbas dengan AuthLink",
   code: "Kod padanan",
-  help: "Pastikan nombor dalam aplikasi sepadan, kemudian sahkan pada telefon anda.",
+  help: "Luluskan dalam aplikasi, kemudian masukkan kod pengesahan 6 digit di sini.",
   waiting: "Menunggu pengesahan daripada telefon",
   loading: "Sedang menyambung",
   confirmed: "Disahkan",
@@ -2166,7 +2260,16 @@ var ms_default = {
   close: "Tutup",
   cancel: "Batal",
   autoUpdate: "Kod dikemas kini secara automatik setiap 30 saat",
-  expiring: "Permintaan akan tamat tempoh tidak lama lagi"
+  expiring: "Permintaan akan tamat tempoh tidak lama lagi",
+  confirmationCode: "Kod pengesahan aplikasi",
+  submitCode: "Sahkan",
+  codeError: "Pengesahan gagal. Semak kod dan kelulusan, kemudian cuba lagi.",
+  codeLocked: "Terlalu banyak kod salah. Tutup tetingkap dan mulakan permintaan baharu.",
+  otpCode: "Kod aplikasi",
+  otpHelp: "Buka AuthLink dan masukkan kod enam digit semasa untuk akaun ini. Tiada kelulusan permintaan diperlukan.",
+  otpWaiting: "Masukkan kod semasa",
+  otpError: "Pengesahan gagal. Semak akaun dan tunggu kod baharu jika sudah digunakan. Selepas beberapa kegagalan, cuba lagi kemudian.",
+  otpSetup: "Aktifkan kod pada kad akaun ini dalam aplikasi dahulu."
 };
 
 // src/locales/pt.json
@@ -2175,7 +2278,7 @@ var pt_default = {
   confirm: "Confirme a verifica\xE7\xE3o",
   scan: "Escaneie com o AuthLink",
   code: "C\xF3digo de compara\xE7\xE3o",
-  help: "Confira se os n\xFAmeros no aplicativo coincidem e confirme no celular.",
+  help: "Aprove no app e digite aqui o c\xF3digo de 6 d\xEDgitos.",
   waiting: "Aguardando confirma\xE7\xE3o no celular",
   loading: "Conectando",
   confirmed: "Confirmado",
@@ -2188,7 +2291,16 @@ var pt_default = {
   close: "Fechar",
   cancel: "Cancelar",
   autoUpdate: "O c\xF3digo \xE9 atualizado automaticamente a cada 30 segundos",
-  expiring: "A solicita\xE7\xE3o est\xE1 prestes a expirar"
+  expiring: "A solicita\xE7\xE3o est\xE1 prestes a expirar",
+  confirmationCode: "C\xF3digo de confirma\xE7\xE3o do app",
+  submitCode: "Verificar",
+  codeError: "N\xE3o foi poss\xEDvel verificar. Confira o c\xF3digo e a aprova\xE7\xE3o.",
+  codeLocked: "Muitos c\xF3digos incorretos. Feche a janela e inicie uma nova solicita\xE7\xE3o.",
+  otpCode: "C\xF3digo do aplicativo",
+  otpHelp: "Abra o AuthLink e digite o c\xF3digo atual de seis d\xEDgitos desta conta. N\xE3o \xE9 necess\xE1rio aprovar uma solicita\xE7\xE3o.",
+  otpWaiting: "Digite o c\xF3digo atual",
+  otpError: "Falha na verifica\xE7\xE3o. Confira a conta e aguarde um novo c\xF3digo se j\xE1 o usou. Ap\xF3s v\xE1rias falhas, tente mais tarde.",
+  otpSetup: "Ative primeiro os c\xF3digos no cart\xE3o desta conta no aplicativo."
 };
 
 // src/locales/th.json
@@ -2197,7 +2309,7 @@ var th_default = {
   confirm: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E01\u0E32\u0E23\u0E15\u0E23\u0E27\u0E08\u0E2A\u0E2D\u0E1A",
   scan: "\u0E2A\u0E41\u0E01\u0E19\u0E14\u0E49\u0E27\u0E22 AuthLink",
   code: "\u0E23\u0E2B\u0E31\u0E2A\u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A\u0E40\u0E1B\u0E23\u0E35\u0E22\u0E1A\u0E40\u0E17\u0E35\u0E22\u0E1A",
-  help: "\u0E15\u0E23\u0E27\u0E08\u0E2A\u0E2D\u0E1A\u0E27\u0E48\u0E32\u0E15\u0E31\u0E27\u0E40\u0E25\u0E02\u0E43\u0E19\u0E41\u0E2D\u0E1B\u0E15\u0E23\u0E07\u0E01\u0E31\u0E19 \u0E41\u0E25\u0E49\u0E27\u0E08\u0E36\u0E07\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E1A\u0E19\u0E42\u0E17\u0E23\u0E28\u0E31\u0E1E\u0E17\u0E4C\u0E02\u0E2D\u0E07\u0E04\u0E38\u0E13",
+  help: "\u0E2D\u0E19\u0E38\u0E21\u0E31\u0E15\u0E34\u0E43\u0E19\u0E41\u0E2D\u0E1B \u0E41\u0E25\u0E49\u0E27\u0E01\u0E23\u0E2D\u0E01\u0E23\u0E2B\u0E31\u0E2A\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19 6 \u0E2B\u0E25\u0E31\u0E01\u0E17\u0E35\u0E48\u0E19\u0E35\u0E48",
   waiting: "\u0E01\u0E33\u0E25\u0E31\u0E07\u0E23\u0E2D\u0E01\u0E32\u0E23\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E08\u0E32\u0E01\u0E42\u0E17\u0E23\u0E28\u0E31\u0E1E\u0E17\u0E4C",
   loading: "\u0E01\u0E33\u0E25\u0E31\u0E07\u0E40\u0E0A\u0E37\u0E48\u0E2D\u0E21\u0E15\u0E48\u0E2D",
   confirmed: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E41\u0E25\u0E49\u0E27",
@@ -2210,7 +2322,16 @@ var th_default = {
   close: "\u0E1B\u0E34\u0E14",
   cancel: "\u0E22\u0E01\u0E40\u0E25\u0E34\u0E01",
   autoUpdate: "\u0E23\u0E2B\u0E31\u0E2A\u0E08\u0E30\u0E2D\u0E31\u0E1B\u0E40\u0E14\u0E15\u0E2D\u0E31\u0E15\u0E42\u0E19\u0E21\u0E31\u0E15\u0E34\u0E17\u0E38\u0E01 30 \u0E27\u0E34\u0E19\u0E32\u0E17\u0E35",
-  expiring: "\u0E04\u0E33\u0E02\u0E2D\u0E43\u0E01\u0E25\u0E49\u0E2B\u0E21\u0E14\u0E2D\u0E32\u0E22\u0E38"
+  expiring: "\u0E04\u0E33\u0E02\u0E2D\u0E43\u0E01\u0E25\u0E49\u0E2B\u0E21\u0E14\u0E2D\u0E32\u0E22\u0E38",
+  confirmationCode: "\u0E23\u0E2B\u0E31\u0E2A\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E08\u0E32\u0E01\u0E41\u0E2D\u0E1B",
+  submitCode: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19",
+  codeError: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E44\u0E21\u0E48\u0E2A\u0E33\u0E40\u0E23\u0E47\u0E08 \u0E15\u0E23\u0E27\u0E08\u0E2A\u0E2D\u0E1A\u0E23\u0E2B\u0E31\u0E2A\u0E41\u0E25\u0E30\u0E01\u0E32\u0E23\u0E2D\u0E19\u0E38\u0E21\u0E31\u0E15\u0E34\u0E41\u0E25\u0E49\u0E27\u0E25\u0E2D\u0E07\u0E2D\u0E35\u0E01\u0E04\u0E23\u0E31\u0E49\u0E07",
+  codeLocked: "\u0E01\u0E23\u0E2D\u0E01\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E34\u0E14\u0E2B\u0E25\u0E32\u0E22\u0E04\u0E23\u0E31\u0E49\u0E07\u0E40\u0E01\u0E34\u0E19\u0E44\u0E1B \u0E42\u0E1B\u0E23\u0E14\u0E1B\u0E34\u0E14\u0E2B\u0E19\u0E49\u0E32\u0E15\u0E48\u0E32\u0E07\u0E41\u0E25\u0E49\u0E27\u0E40\u0E23\u0E34\u0E48\u0E21\u0E04\u0E33\u0E02\u0E2D\u0E43\u0E2B\u0E21\u0E48",
+  otpCode: "\u0E23\u0E2B\u0E31\u0E2A\u0E08\u0E32\u0E01\u0E41\u0E2D\u0E1B",
+  otpHelp: "\u0E40\u0E1B\u0E34\u0E14 AuthLink \u0E41\u0E25\u0E30\u0E01\u0E23\u0E2D\u0E01\u0E23\u0E2B\u0E31\u0E2A\u0E2B\u0E01\u0E2B\u0E25\u0E31\u0E01\u0E1B\u0E31\u0E08\u0E08\u0E38\u0E1A\u0E31\u0E19\u0E02\u0E2D\u0E07\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E19\u0E35\u0E49 \u0E44\u0E21\u0E48\u0E15\u0E49\u0E2D\u0E07\u0E2D\u0E19\u0E38\u0E21\u0E31\u0E15\u0E34\u0E04\u0E33\u0E02\u0E2D",
+  otpWaiting: "\u0E01\u0E23\u0E2D\u0E01\u0E23\u0E2B\u0E31\u0E2A\u0E1B\u0E31\u0E08\u0E08\u0E38\u0E1A\u0E31\u0E19",
+  otpError: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E44\u0E21\u0E48\u0E2A\u0E33\u0E40\u0E23\u0E47\u0E08 \u0E42\u0E1B\u0E23\u0E14\u0E15\u0E23\u0E27\u0E08\u0E2A\u0E2D\u0E1A\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E41\u0E25\u0E30\u0E23\u0E2D\u0E23\u0E2B\u0E31\u0E2A\u0E43\u0E2B\u0E21\u0E48\u0E2B\u0E32\u0E01\u0E43\u0E0A\u0E49\u0E44\u0E1B\u0E41\u0E25\u0E49\u0E27 \u0E2B\u0E32\u0E01\u0E1C\u0E34\u0E14\u0E2B\u0E25\u0E32\u0E22\u0E04\u0E23\u0E31\u0E49\u0E07\u0E43\u0E2B\u0E49\u0E25\u0E2D\u0E07\u0E43\u0E2B\u0E21\u0E48\u0E20\u0E32\u0E22\u0E2B\u0E25\u0E31\u0E07",
+  otpSetup: "\u0E40\u0E1B\u0E34\u0E14\u0E43\u0E0A\u0E49\u0E23\u0E2B\u0E31\u0E2A\u0E1A\u0E19\u0E01\u0E32\u0E23\u0E4C\u0E14\u0E1A\u0E31\u0E0D\u0E0A\u0E35\u0E19\u0E35\u0E49\u0E43\u0E19\u0E41\u0E2D\u0E1B\u0E01\u0E48\u0E2D\u0E19"
 };
 
 // src/locales/vi.json
@@ -2219,7 +2340,7 @@ var vi_default = {
   confirm: "X\xE1c nh\u1EADn x\xE1c th\u1EF1c",
   scan: "Qu\xE9t b\u1EB1ng AuthLink",
   code: "M\xE3 \u0111\u1ED1i chi\u1EBFu",
-  help: "Ki\u1EC3m tra c\xE1c ch\u1EEF s\u1ED1 trong \u1EE9ng d\u1EE5ng c\xF3 kh\u1EDBp kh\xF4ng, r\u1ED3i x\xE1c nh\u1EADn tr\xEAn \u0111i\u1EC7n tho\u1EA1i.",
+  help: "Ph\xEA duy\u1EC7t trong \u1EE9ng d\u1EE5ng r\u1ED3i nh\u1EADp m\xE3 x\xE1c nh\u1EADn 6 ch\u1EEF s\u1ED1 t\u1EA1i \u0111\xE2y.",
   waiting: "\u0110ang ch\u1EDD x\xE1c nh\u1EADn t\u1EEB \u0111i\u1EC7n tho\u1EA1i",
   loading: "\u0110ang k\u1EBFt n\u1ED1i",
   confirmed: "\u0110\xE3 x\xE1c nh\u1EADn",
@@ -2232,7 +2353,16 @@ var vi_default = {
   close: "\u0110\xF3ng",
   cancel: "H\u1EE7y",
   autoUpdate: "M\xE3 t\u1EF1 \u0111\u1ED9ng c\u1EADp nh\u1EADt m\u1ED7i 30 gi\xE2y",
-  expiring: "Y\xEAu c\u1EA7u s\u1EAFp h\u1EBFt h\u1EA1n"
+  expiring: "Y\xEAu c\u1EA7u s\u1EAFp h\u1EBFt h\u1EA1n",
+  confirmationCode: "M\xE3 x\xE1c nh\u1EADn trong \u1EE9ng d\u1EE5ng",
+  submitCode: "X\xE1c minh",
+  codeError: "Kh\xF4ng th\u1EC3 x\xE1c minh. Ki\u1EC3m tra m\xE3 v\xE0 tr\u1EA1ng th\xE1i ph\xEA duy\u1EC7t r\u1ED3i th\u1EED l\u1EA1i.",
+  codeLocked: "Nh\u1EADp sai m\xE3 qu\xE1 nhi\u1EC1u l\u1EA7n. \u0110\xF3ng c\u1EEDa s\u1ED5 v\xE0 t\u1EA1o y\xEAu c\u1EA7u m\u1EDBi.",
+  otpCode: "M\xE3 \u1EE9ng d\u1EE5ng",
+  otpHelp: "M\u1EDF AuthLink v\xE0 nh\u1EADp m\xE3 s\xE1u ch\u1EEF s\u1ED1 hi\u1EC7n t\u1EA1i c\u1EE7a t\xE0i kho\u1EA3n n\xE0y. Kh\xF4ng c\u1EA7n ph\xEA duy\u1EC7t y\xEAu c\u1EA7u.",
+  otpWaiting: "Nh\u1EADp m\xE3 hi\u1EC7n t\u1EA1i",
+  otpError: "X\xE1c minh th\u1EA5t b\u1EA1i. Ki\u1EC3m tra t\xE0i kho\u1EA3n v\xE0 ch\u1EDD m\xE3 m\u1EDBi n\u1EBFu \u0111\xE3 d\xF9ng. N\u1EBFu sai nhi\u1EC1u l\u1EA7n, h\xE3y th\u1EED l\u1EA1i sau.",
+  otpSetup: "Tr\u01B0\u1EDBc ti\xEAn h\xE3y b\u1EADt m\xE3 tr\xEAn th\u1EBB t\xE0i kho\u1EA3n n\xE0y trong \u1EE9ng d\u1EE5ng."
 };
 
 // src/i18n.ts
@@ -2270,7 +2400,7 @@ function widgetView(options) {
   const locale = resolveLocale(options.locale), variant = resolveVariant(options.variant);
   const l = getMessages(locale);
   const pending = s.status === "pending", hasQr = pending && (mode === "bind" || Boolean(options.showQr)) && Boolean(options.qr);
-  const status = { idle: l.loading, pending: l.waiting, confirmed: l.confirmed, rejected: l.rejected, expired: l.expired, error: l.error }[s.status];
+  const status = { idle: l.loading, pending: options.passcodeMode ? l.otpWaiting : l.waiting, confirmed: l.confirmed, rejected: l.rejected, expired: l.expired, error: l.error }[s.status];
   const expiring = pending && s.secondsRemaining <= 30;
   const expiryTime = `00:${String(Math.max(0, Math.ceil(s.secondsRemaining))).padStart(2, "0")}`;
   const statusNode = () => node(
@@ -2299,50 +2429,52 @@ function widgetView(options) {
       node("img", { class: "authlink-qr", src: options.qr, alt: l.scan, width: 240, height: 240 }),
       node("figcaption", { class: "authlink-qr-caption" }, l.scan)
     )] : [];
-    const seconds = Math.max(0, Math.min(30, s.codeSecondsRemaining));
-    const code = node(
-      "output",
-      {
-        class: "authlink-code",
-        "aria-label": s.code ? `${l.code}: ${s.code.split("").join(" ")}` : l.updating,
-        "aria-live": "polite",
-        "data-testid": "authlink-code"
-      },
-      node("span", { class: "authlink-code-group" }, s.code?.slice(0, 3) ?? "---"),
-      node("span", { class: "authlink-code-group" }, s.code?.slice(3) ?? "---")
-    );
-    const panel = node(
-      "div",
-      { class: "authlink-code-panel" },
-      node("div", { class: "authlink-code-values" }, node("div", { class: "authlink-code-label" }, l.code), code),
+    const detail = [
+      node("p", { class: "authlink-help" }, options.passcodeMode ? l.otpHelp : l.help),
       node(
-        "div",
-        {
-          class: "authlink-progress",
-          role: "progressbar",
-          "aria-valuemin": 0,
-          "aria-valuemax": 30,
-          "aria-valuenow": seconds,
-          "aria-label": l.autoUpdate
-        },
-        node("span", { class: "authlink-progress-fill", "aria-hidden": "true", style: `transform:scaleX(${seconds / 30})` })
+        "form",
+        { class: "authlink-code-form", onSubmit: (event) => {
+          event.preventDefault();
+          const input = event.currentTarget.querySelector("input");
+          if (input) void options.submitCode?.(input.value);
+        } },
+        node("label", { for: "authlink-confirmation-code" }, options.passcodeMode ? l.otpCode : l.confirmationCode),
+        node("input", {
+          id: "authlink-confirmation-code",
+          name: options.passcodeMode ? "passcode" : "confirmationCode",
+          type: "text",
+          inputmode: "numeric",
+          autocomplete: "one-time-code",
+          pattern: "[0-9]{6}",
+          maxlength: 6,
+          minlength: 6,
+          required: true,
+          "data-authlink-focus": "confirmation-code",
+          value: options.inputCode ?? "",
+          onInput: (event) => options.setCode?.(event.target.value)
+        }),
+        node(
+          "button",
+          { type: "submit", class: "authlink-button", ...s.submitting ? { disabled: true } : {} },
+          s.submitting ? l.loading : l.submitCode
+        )
       ),
-      node("p", { class: "authlink-code-caption" }, s.code ? l.autoUpdate : l.updating)
-    );
-    const detail = [panel, node("p", { class: "authlink-help" }, l.help)];
+      ...s.error ? [node("p", { class: "authlink-input-error", role: "alert" }, options.passcodeMode ? s.error.message === "OTP_NOT_CONFIGURED" ? l.otpSetup : l.otpError : l.codeError)] : []
+    ];
     children.push(node("div", { class: "authlink-body" }, ...qr, node("div", { class: "authlink-details" }, ...detail)));
     if (variant === "A") children.push(node("div", { class: "authlink-footer" }, statusNode()));
     if (variant === "B") children.push(node("div", { class: "authlink-footer" }, statusNode(), ...cancel()));
     if (variant === "C") children.push(node("div", { class: "authlink-footer" }, statusNode(), ...cancel()));
   } else {
     children.push(statusNode());
-    if (s.status === "error") children.push(node("button", {
+    if (s.error?.message === "CONFIRMATION_CODE_LOCKED") children.push(node("p", { class: "authlink-input-error", role: "alert" }, l.codeLocked));
+    if (s.status === "error" && s.error?.message !== "CONFIRMATION_CODE_LOCKED") children.push(node("button", {
       type: "button",
       class: "authlink-button",
       "data-authlink-focus": "retry",
       onClick: retry
     }, l.retry));
-    if (refresh && ["expired", "rejected"].includes(s.status)) children.push(node("button", {
+    if (refresh && ["expired", "rejected", "error"].includes(s.status)) children.push(node("button", {
       type: "button",
       class: "authlink-button",
       "data-authlink-focus": "refresh",
@@ -2365,7 +2497,7 @@ function element(value, svg = false) {
   svg ||= value.tag === "svg";
   const result = svg ? document.createElementNS("http://www.w3.org/2000/svg", value.tag) : document.createElement(value.tag);
   for (const [key, v] of Object.entries(value.props)) {
-    if (key === "onClick" && typeof v === "function") result.addEventListener("click", v);
+    if (key.startsWith("on") && typeof v === "function") result.addEventListener(key.slice(2).toLowerCase(), v);
     else if (v !== void 0 && v !== null) result.setAttribute(key, String(v));
   }
   result.append(...value.children.map((child) => element(child, svg)));
@@ -2399,6 +2531,8 @@ function openAuthLink(options) {
   dialog.append(header, content);
   let locale = options.locale, variant = resolveVariant(options.variant), snapshot = initialSnapshot(), closed = false;
   let abort;
+  let inputCode = "";
+  let submitCode;
   const image = qrImage(ticket);
   let progressFill, progressFrame, progressDeadline = 0;
   const motion = window.matchMedia?.("(prefers-reduced-motion: reduce)");
@@ -2438,6 +2572,11 @@ function openAuthLink(options) {
       snapshot,
       qr: image,
       showQr: options.showQr,
+      inputCode,
+      setCode: (code) => {
+        inputCode = code;
+      },
+      submitCode: (code) => submitCode?.(code) ?? Promise.resolve(),
       retry,
       refresh: options.onRefresh,
       close: () => dispose(true)
@@ -2456,6 +2595,9 @@ function openAuthLink(options) {
       oldProgress.setAttribute("aria-label", nextProgress.getAttribute("aria-label"));
       nextProgress.replaceWith(oldProgress);
     }
+    const oldInput = content.querySelector("input[name=confirmationCode]");
+    const nextInput = next.querySelector("input[name=confirmationCode]");
+    if (oldInput && nextInput) nextInput.replaceWith(oldInput);
     content.replaceChildren(next);
     progressFill = content.querySelector(".authlink-progress-fill") ?? void 0;
     drawProgress();
@@ -2497,6 +2639,9 @@ function openAuthLink(options) {
       intervalMs: options.intervalMs,
       expectedMode: mode,
       signal: abort.signal,
+      onReady: (submit) => {
+        submitCode = submit;
+      },
       onCodeTiming: syncProgress,
       onUpdate: (value) => {
         snapshot = value;
@@ -2556,14 +2701,183 @@ function openAuthLink(options) {
 }
 var openAuthLinkBind = (options) => openAuthLink({ ...options, mode: "bind" });
 var openAuthLinkConfirm = (options) => openAuthLink({ ...options, mode: "confirm" });
+
+// src/passcode.ts
+function validateOTPResult(value) {
+  if (!value || typeof value !== "object") throw new AuthLinkError("INVALID_RESPONSE");
+  const result = value;
+  const expiry = typeof result.expiresAt === "string" ? Date.parse(result.expiresAt) : NaN;
+  if (result.status !== "confirmed" || result.authenticationPolicy !== "device-totp.v1" || typeof result.verificationId !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(result.verificationId) || !Number.isFinite(expiry) || expiry <= Date.now() || expiry > Date.now() + 9e4 || "requestId" in result || "state" in result || "businessId" in result) throw new AuthLinkError("INVALID_CONFIRMATION");
+  return result;
+}
+function createPasscodeClient(options) {
+  const call = createBackendCall(options);
+  return {
+    async verify(passcode, signal) {
+      if (!/^[0-9]{6}$/.test(passcode)) throw new AuthLinkError("PASSCODE_INVALID");
+      return validateOTPResult(await call("/auth", { passcode }, signal));
+    }
+  };
+}
+function openPasscode(options) {
+  if (typeof document === "undefined" || !document.body) throw new AuthLinkError("BROWSER_REQUIRED");
+  const deadline = Date.parse(options.expiresAt);
+  if (!Number.isFinite(deadline) || deadline <= Date.now() || deadline > Date.now() + 3e5) throw new AuthLinkError("INVALID_EXPIRY");
+  const previousFocus = document.activeElement instanceof HTMLElement ? document.activeElement : null;
+  const dialog = document.createElement("dialog");
+  if (typeof dialog.showModal !== "function") throw new AuthLinkError("DIALOG_UNSUPPORTED");
+  dialog.className = "authlink-dialog";
+  dialog.setAttribute("aria-modal", "true");
+  const header = document.createElement("div");
+  header.className = "authlink-header";
+  const brand = document.createElement("span");
+  brand.className = "authlink-brand";
+  brand.textContent = "AuthLink";
+  const close = document.createElement("button");
+  close.type = "button";
+  close.className = "authlink-close";
+  const icon = document.createElement("span");
+  icon.className = "authlink-close-icon";
+  icon.setAttribute("aria-hidden", "true");
+  close.append(icon);
+  const content = document.createElement("div");
+  content.className = "authlink-modal-content";
+  header.append(brand, close);
+  dialog.append(header, content);
+  let locale = options.locale, variant = resolveVariant(options.variant), closed = false, busy = false, code = "", error;
+  const mode = options.bindingQr ? "bind" : "confirm";
+  let image;
+  if (options.bindingQr) {
+    let payload;
+    try {
+      payload = JSON.parse(options.bindingQr);
+    } catch {
+      throw new AuthLinkError("INVALID_TICKET");
+    }
+    image = qrImage(validateTicket({ requestId: payload.requestId, purpose: "bind", qr: options.bindingQr, pairingCode: "000000", expiresAt: options.expiresAt }, "bind", options.authLinkOrigin));
+  }
+  const abort = new AbortController();
+  let timer;
+  const dispose = (notify) => {
+    if (closed) return;
+    closed = true;
+    abort.abort();
+    clearInterval(timer);
+    dialog.remove();
+    previousFocus?.focus();
+    if (notify) options.onClose?.();
+  };
+  const render = () => {
+    if (closed) return;
+    const l = getMessages(locale);
+    dialog.lang = resolveLocale(locale);
+    dialog.dataset.variant = variant;
+    dialog.dataset.mode = mode;
+    dialog.dataset.hasQr = String(Boolean(image));
+    dialog.setAttribute("aria-label", l[mode]);
+    close.setAttribute("aria-label", l.close);
+    const focused = content.contains(document.activeElement);
+    const remaining = Math.max(0, Math.ceil((deadline - Date.now()) / 1e3));
+    const snapshot = { status: remaining ? "pending" : "expired", code: null, secondsRemaining: remaining, codeSecondsRemaining: remaining, submitting: busy, error: error ?? null };
+    content.replaceChildren(element(widgetView({
+      mode,
+      locale,
+      variant,
+      passcodeMode: true,
+      snapshot,
+      qr: image,
+      showQr: Boolean(image),
+      inputCode: code,
+      setCode: (value) => {
+        code = value;
+      },
+      submitCode: submit,
+      retry: () => {
+        error = void 0;
+        render();
+      },
+      close: () => dispose(true)
+    })));
+    if (focused) content.querySelector("input")?.focus();
+  };
+  const submit = async (value) => {
+    if (closed || busy) return;
+    if (Date.now() >= deadline) {
+      render();
+      return;
+    }
+    if (!/^[0-9]{6}$/.test(value)) {
+      error = new AuthLinkError("PASSCODE_INVALID");
+      render();
+      return;
+    }
+    code = value;
+    busy = true;
+    error = void 0;
+    render();
+    try {
+      const result = validateOTPResult(await options.client.verify(value, abort.signal));
+      if (closed || abort.signal.aborted || Date.now() >= deadline) return;
+      try {
+        await options.onVerified?.(result);
+      } catch {
+        options.onError?.(new AuthLinkError("CALLBACK_FAILED"));
+      }
+      dispose(false);
+    } catch (cause) {
+      if (!closed && !abort.signal.aborted) {
+        error = cause instanceof Error ? cause : new AuthLinkError("NETWORK_ERROR");
+        options.onError?.(error);
+      }
+    } finally {
+      busy = false;
+      render();
+    }
+  };
+  close.addEventListener("click", () => dispose(true));
+  dialog.addEventListener("cancel", (event) => {
+    event.preventDefault();
+    dispose(true);
+  });
+  document.body.append(dialog);
+  render();
+  dialog.showModal();
+  content.querySelector("input")?.focus();
+  timer = setInterval(() => {
+    if (closed) return;
+    if (Date.now() >= deadline) {
+      render();
+      clearInterval(timer);
+      void Promise.resolve(options.onExpired?.()).catch(() => options.onError?.(new AuthLinkError("CALLBACK_FAILED")));
+    }
+  }, 1e3);
+  return {
+    close: () => dispose(true),
+    destroy: () => dispose(false),
+    setLocale: (value) => {
+      locale = value;
+      render();
+    },
+    setVariant: (value) => {
+      variant = resolveVariant(value);
+      render();
+    },
+    retry: () => {
+      error = void 0;
+      render();
+    }
+  };
+}
 export {
   AuthLinkError,
   createAuthLinkClient,
+  createPasscodeClient,
   initialSnapshot,
   observeRequest,
   openAuthLink,
   openAuthLinkBind,
   openAuthLinkConfirm,
+  openPasscode,
   qrImage,
   requestKey,
   supportedLocales,