@authyon/auth 0.2.0-beta.12 → 0.2.0-beta.14

package/README.md

@@ -273,6 +273,27 @@ Métodos de sessão/auth ficam soltos no client; os que giram em torno de um rec
 | `sso.startUrl(provider, params)` | monta a URL de `GET /auth/sso/{provider}/start` (não faz a chamada — navegue até ela) |
 | `sso.exchange(code)`             | `POST /auth/sso/exchange`                                                             |
 
+### `authyon.financialAuthorizations` (confirmação de transações)
+
+O cliente aprova uma transação criada pelo seu backend com o código do app autenticador
+ou a passkey. Guia completo: [`docs/financialStepUp.md`](../../docs/financialStepUp.md).
+
+```ts
+const pending = await authyon.financialAuthorizations.get(authorizationId);
+// mostre pending.amount, pending.currency e pending.beneficiary ao cliente
+await authyon.financialAuthorizations.confirm(authorizationId, {
+  method: "authenticator",
+  code: "123456",
+});
+```
+
+| Método                                        | Endpoint                                          |
+| --------------------------------------------- | ------------------------------------------------- |
+| `financialAuthorizations.get(id)`             | `GET /auth/authorizations/{id}`                   |
+| `financialAuthorizations.webauthnOptions(id)` | `POST /auth/authorizations/{id}/webauthn/options` |
+| `financialAuthorizations.confirm(id, input?)` | `POST /auth/authorizations/{id}/confirm`          |
+| `financialAuthorizations.reject(id)`          | `POST /auth/authorizations/{id}/reject`           |
+
 ## Invalidação de token
 
 - **Sessão atual**: `logout()` revoga o refresh token atual; `logout({ everywhere: true })` revoga todos os refresh tokens do usuário.

package/dist/{ability-B1TiHFWa.d.cts → ability-DbnbsQEX.d.cts}

@@ -1,3 +1,74 @@
+/** Lifecycle of a transaction-bound financial authorization. */
+type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * The transaction the customer approves. The API hashes a canonical form of
+ * these fields; `consume()` must resend exactly the same values (amount is
+ * normalized to four decimal places, metadata keys are sorted).
+ */
+interface FinancialTransaction {
+    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
+    action: string;
+    /** Positive amount, up to 15 integer digits and 4 decimal places. */
+    amount: number;
+    /** ISO 4217 currency code, e.g. `"BRL"`. */
+    currency: string;
+    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
+    beneficiary: string;
+    /** Optional JSON object bound into the hash (max 16 KiB). */
+    metadata?: Record<string, unknown>;
+}
+/** Evidence of how the customer proved their identity when approving. */
+interface FinancialAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+interface FinancialAuthorization {
+    id: string;
+    status: FinancialAuthorizationStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    action: string;
+    amount: number;
+    currency: string;
+    beneficiary: string;
+    /** SHA-256 (hex) of the canonical transaction. */
+    transactionHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Full canonical transaction — returned only to the customer (subject) view. */
+    transaction?: FinancialTransaction | null;
+    /** Present once approved. */
+    assurance?: FinancialAssurance | null;
+}
+/** Inline second factor sent with `confirm()`. */
+type ConfirmFinancialAuthorizationInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
+    };
+};
+/** Passkey assertion options for approving one authorization. */
+interface FinancialWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
+type QueryParams = object;
+
 interface HttpAdapterRequest {
     url: string;
     method: string;
@@ -55,6 +126,36 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+interface JsonRequestOptions {
+    method?: HttpMethod;
+    body?: unknown;
+    query?: QueryParams;
+    headers?: Record<string, string>;
+}
+
+/** Sends a request already authenticated as the customer (end-user bearer). */
+type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
+/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
+declare function subjectFinancialAuthorizations(request: SubjectRequest): {
+    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
+    get: (id: string) => Promise<FinancialAuthorization>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
+    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
+    reject: (id: string) => Promise<FinancialAuthorization>;
+};
+type SubjectFinancialAuthorizations = ReturnType<typeof subjectFinancialAuthorizations>;
+
 interface PaginationOptions {
     skip?: number;
     take?: number;
@@ -518,6 +619,13 @@ declare class AuthyonClient {
             assertionStart: (challengeToken: string) => Promise<WebAuthnCeremonyStart>;
         };
     };
+    /**
+     * Transaction-bound approvals created by your backend
+     * (`@authyon/server` → `environment.financialAuthorizations.create`).
+     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    readonly financialAuthorizations: SubjectFinancialAuthorizations;
     /**
      * POST /auth/introspect — lightweight token introspection (RFC 7662).
      *
@@ -642,4 +750,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { createAuthyonAbility as $, AuthyonClient as A, type Role as B, type CreateOrganizationInput as C, type SessionControllerOptions as D, type SessionInfo as E, FetchHttpAdapter as F, type SessionSnapshot as G, type HttpAdapter as H, type IntrospectResult as I, type SessionSnapshotListener as J, type SessionStatus as K, LoggingHttpAdapter as L, type SsoProvider as M, type TwoFactorChallenge as N, type Organization as O, type Paged as P, type TwoFactorMethod as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type TwoFactorStatus as U, type User as V, type ValidateResult as W, type VerifyTwoFactorInput as X, type WebAuthnAssertion as Y, type WebAuthnCeremonyStart as Z, type WebAuthnCredential as _, type HttpLoggerOptions as a, createAuthyonRules as a0, createClient as a1, hasPermission as a2, hasPermissionGroup as a3, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type PermissionGroup as z };
+export { type User as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmFinancialAuthorizationInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type TwoFactorChallenge as Y, type TwoFactorMethod as Z, type TwoFactorStatus as _, type HttpLoggerOptions as a, type ValidateResult as a0, type VerifyTwoFactorInput as a1, type WebAuthnAssertion as a2, type WebAuthnCeremonyStart as a3, type WebAuthnCredential as a4, createAuthyonAbility as a5, createAuthyonRules as a6, createClient as a7, hasPermission as a8, hasPermissionGroup as a9, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type CreateOrganizationInput as r, type FinancialAssurance as s, type FinancialAuthorization as t, type FinancialAuthorizationStatus as u, type FinancialTransaction as v, type FinancialWebAuthnOptions as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };

package/dist/{ability-B1TiHFWa.d.ts → ability-DbnbsQEX.d.ts}

@@ -1,3 +1,74 @@
+/** Lifecycle of a transaction-bound financial authorization. */
+type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * The transaction the customer approves. The API hashes a canonical form of
+ * these fields; `consume()` must resend exactly the same values (amount is
+ * normalized to four decimal places, metadata keys are sorted).
+ */
+interface FinancialTransaction {
+    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
+    action: string;
+    /** Positive amount, up to 15 integer digits and 4 decimal places. */
+    amount: number;
+    /** ISO 4217 currency code, e.g. `"BRL"`. */
+    currency: string;
+    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
+    beneficiary: string;
+    /** Optional JSON object bound into the hash (max 16 KiB). */
+    metadata?: Record<string, unknown>;
+}
+/** Evidence of how the customer proved their identity when approving. */
+interface FinancialAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+interface FinancialAuthorization {
+    id: string;
+    status: FinancialAuthorizationStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    action: string;
+    amount: number;
+    currency: string;
+    beneficiary: string;
+    /** SHA-256 (hex) of the canonical transaction. */
+    transactionHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Full canonical transaction — returned only to the customer (subject) view. */
+    transaction?: FinancialTransaction | null;
+    /** Present once approved. */
+    assurance?: FinancialAssurance | null;
+}
+/** Inline second factor sent with `confirm()`. */
+type ConfirmFinancialAuthorizationInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
+    };
+};
+/** Passkey assertion options for approving one authorization. */
+interface FinancialWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
+type QueryParams = object;
+
 interface HttpAdapterRequest {
     url: string;
     method: string;
@@ -55,6 +126,36 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+interface JsonRequestOptions {
+    method?: HttpMethod;
+    body?: unknown;
+    query?: QueryParams;
+    headers?: Record<string, string>;
+}
+
+/** Sends a request already authenticated as the customer (end-user bearer). */
+type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
+/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
+declare function subjectFinancialAuthorizations(request: SubjectRequest): {
+    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
+    get: (id: string) => Promise<FinancialAuthorization>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
+    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
+    reject: (id: string) => Promise<FinancialAuthorization>;
+};
+type SubjectFinancialAuthorizations = ReturnType<typeof subjectFinancialAuthorizations>;
+
 interface PaginationOptions {
     skip?: number;
     take?: number;
@@ -518,6 +619,13 @@ declare class AuthyonClient {
             assertionStart: (challengeToken: string) => Promise<WebAuthnCeremonyStart>;
         };
     };
+    /**
+     * Transaction-bound approvals created by your backend
+     * (`@authyon/server` → `environment.financialAuthorizations.create`).
+     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    readonly financialAuthorizations: SubjectFinancialAuthorizations;
     /**
      * POST /auth/introspect — lightweight token introspection (RFC 7662).
      *
@@ -642,4 +750,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { createAuthyonAbility as $, AuthyonClient as A, type Role as B, type CreateOrganizationInput as C, type SessionControllerOptions as D, type SessionInfo as E, FetchHttpAdapter as F, type SessionSnapshot as G, type HttpAdapter as H, type IntrospectResult as I, type SessionSnapshotListener as J, type SessionStatus as K, LoggingHttpAdapter as L, type SsoProvider as M, type TwoFactorChallenge as N, type Organization as O, type Paged as P, type TwoFactorMethod as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type TwoFactorStatus as U, type User as V, type ValidateResult as W, type VerifyTwoFactorInput as X, type WebAuthnAssertion as Y, type WebAuthnCeremonyStart as Z, type WebAuthnCredential as _, type HttpLoggerOptions as a, createAuthyonRules as a0, createClient as a1, hasPermission as a2, hasPermissionGroup as a3, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type PermissionGroup as z };
+export { type User as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmFinancialAuthorizationInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type TwoFactorChallenge as Y, type TwoFactorMethod as Z, type TwoFactorStatus as _, type HttpLoggerOptions as a, type ValidateResult as a0, type VerifyTwoFactorInput as a1, type WebAuthnAssertion as a2, type WebAuthnCeremonyStart as a3, type WebAuthnCredential as a4, createAuthyonAbility as a5, createAuthyonRules as a6, createClient as a7, hasPermission as a8, hasPermissionGroup as a9, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type CreateOrganizationInput as r, type FinancialAssurance as s, type FinancialAuthorization as t, type FinancialAuthorizationStatus as u, type FinancialTransaction as v, type FinancialWebAuthnOptions as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };

package/dist/index.cjs

@@ -40,6 +40,32 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: a financial authorization id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+function subjectFinancialAuthorizations(request) {
+  return {
+    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
+    get: (id) => request(path(id)),
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
+    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
+    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+  };
+}
+
 // ../../internal/core/errors/authyonError.ts
 var ErrorCodes = {
   Unknown: "unknown",
@@ -52,16 +78,37 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidAuthorizationState: "invalid_authorization_state",
+  TransactionMismatch: "transaction_mismatch",
+  AuthorizationNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -111,6 +158,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -204,14 +252,14 @@ var DEFAULT_BASE_URL = "https://api.authyon.com";
 var DEFAULT_EXPIRY_SKEW_MS = 3e4;
 
 // ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
+function appendQuery(path2, params) {
+  if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
     if (value2 !== void 0) query.set(key, String(value2));
   }
   const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+  return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
 }
 
 // ../../internal/core/http/httpAdapter.ts
@@ -280,7 +328,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -310,12 +357,12 @@ function createSharedTransport(options) {
   const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
   return {
     baseUrl,
-    async request(path, init) {
+    async request(path2, init) {
       const controller = new AbortController();
       const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
       try {
         return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
+          url: `${baseUrl}${path2}`,
           method: init.method ?? "GET",
           headers: normalizeHeaders(init.headers),
           body: init.body,
@@ -373,11 +420,11 @@ var JsonHttpClient = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async send(path, options = {}) {
+  async send(path2, options = {}) {
     const headers = { ...options.headers };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     try {
-      return await this.transport.request(appendQuery(path, options.query), {
+      return await this.transport.request(appendQuery(path2, options.query), {
         method: options.method ?? "GET",
         headers,
         body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
@@ -391,7 +438,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));
@@ -399,8 +448,8 @@ var JsonHttpClient = class {
     if (response.status === 204) return void 0;
     return await response.json();
   }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+  async request(path2, options = {}) {
+    return this.parse(await this.send(path2, options));
   }
 };
 
@@ -638,6 +687,16 @@ var AuthyonClient = class {
         })
       }
     };
+    // ── Financial step-up (customer side) ────────────────────────────────────
+    /**
+     * Transaction-bound approvals created by your backend
+     * (`@authyon/server` → `environment.financialAuthorizations.create`).
+     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    this.financialAuthorizations = subjectFinancialAuthorizations(
+      (path2, options) => this.request(path2, { ...options, bearer: true })
+    );
     if (!options.envKey)
       throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
     this.envKey = options.envKey;
@@ -751,7 +810,7 @@ var AuthyonClient = class {
     }
   }
   // ── HTTP core ────────────────────────────────────────────────────────────
-  async request(path, options = {}, isRetry = false) {
+  async request(path2, options = {}, isRetry = false) {
     const headers = {
       "X-Authyon-Environment": this.envKey,
       ...clientIpHeaders({ clientIp: this.clientIp }),
@@ -766,7 +825,7 @@ var AuthyonClient = class {
         });
       headers.Authorization = `Bearer ${token}`;
     }
-    const response = await this.http.send(path, { ...options, headers });
+    const response = await this.http.send(path2, { ...options, headers });
     if (response.status === 401 && options.bearer && this.autoRefresh && !isRetry && this.getSession()) {
       try {
         await this.refresh();
@@ -774,7 +833,7 @@ var AuthyonClient = class {
         this.clearSession();
         return this.http.parse(response);
       }
-      return this.request(path, options, true);
+      return this.request(path2, options, true);
     }
     return this.http.parse(response);
   }
@@ -1193,18 +1252,18 @@ function matchesField(pattern, field) {
   return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
 }
 function matchesConditions(subject, conditions) {
-  return Object.entries(conditions).every(([path, expected]) => {
-    if (path === "$and" && Array.isArray(expected)) {
+  return Object.entries(conditions).every(([path2, expected]) => {
+    if (path2 === "$and" && Array.isArray(expected)) {
       return expected.every(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    if (path === "$or" && Array.isArray(expected)) {
+    if (path2 === "$or" && Array.isArray(expected)) {
       return expected.some(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    return matchesValue(readPath(subject, path), expected);
+    return matchesValue(readPath(subject, path2), expected);
   });
 }
 function matchesValue(actual, expected) {
@@ -1236,8 +1295,8 @@ function matchesValue(actual, expected) {
     }
   });
 }
-function readPath(value, path) {
-  return path.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
+function readPath(value, path2) {
+  return path2.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
 }
 function defaultSubjectType(subject) {
   const explicit = subject.__type ?? subject.type ?? subject.kind;

package/dist/index.d.cts

@@ -1,19 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-B1TiHFWa.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, z as PermissionGroup, R as RegisterInput, B as Role, S as Session, D as SessionControllerOptions, E as SessionInfo, G as SessionSnapshot, J as SessionSnapshotListener, K as SessionStatus, M as SsoProvider, N as TwoFactorChallenge, Q as TwoFactorMethod, U as TwoFactorStatus, V as User, W as ValidateResult, X as VerifyTwoFactorInput, Y as WebAuthnAssertion, Z as WebAuthnCeremonyStart, _ as WebAuthnCredential, $ as createAuthyonAbility, a0 as createAuthyonRules, a1 as createClient, a2 as hasPermission, a3 as hasPermissionGroup } from './ability-B1TiHFWa.cjs';
-
-/** Builds an Authyon browser client through explicit, progressive configuration. */
-declare class AuthyonClientBuilder {
-    private readonly options;
-    constructor(envKey: string);
-    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
-    withStorage(storage: TokenStorage): this;
-    withAutomaticRefresh(enabled?: boolean): this;
-    withClientIp(clientIp: string): this;
-    withTimeout(timeoutMs: number): this;
-    withHttpAdapter(httpAdapter: HttpAdapter): this;
-    withHttpLogger(httpLogger: HttpLoggerOptions): this;
-    build(): AuthyonClient;
-}
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-DbnbsQEX.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as ConfirmFinancialAuthorizationInput, r as CreateOrganizationInput, F as FetchHttpAdapter, s as FinancialAssurance, t as FinancialAuthorization, u as FinancialAuthorizationStatus, v as FinancialTransaction, w as FinancialWebAuthnOptions, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as TwoFactorChallenge, Z as TwoFactorMethod, _ as TwoFactorStatus, $ as User, a0 as ValidateResult, a1 as VerifyTwoFactorInput, a2 as WebAuthnAssertion, a3 as WebAuthnCeremonyStart, a4 as WebAuthnCredential, a5 as createAuthyonAbility, a6 as createAuthyonRules, a7 as createClient, a8 as hasPermission, a9 as hasPermissionGroup } from './ability-DbnbsQEX.cjs';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -27,6 +13,14 @@ declare const ErrorCodes: {
     readonly PasswordWeak: "user.password_weak";
     readonly PasswordPwned: "user.password_pwned";
     readonly RateLimited: "rate_limited";
+    readonly StepUpRequired: "step_up_required";
+    readonly InvalidSecondFactorCode: "invalid_code";
+    readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
+    readonly MethodNotEnrolled: "method_not_enrolled";
+    readonly InvalidAuthorizationState: "invalid_authorization_state";
+    readonly TransactionMismatch: "transaction_mismatch";
+    readonly AuthorizationNotConsumable: "authorization_not_consumable";
+    readonly IdempotencyConflict: "idempotency_conflict";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";
@@ -38,6 +32,14 @@ interface AuthyonErrorInterpretation {
     retryAfter?: number;
     requestId?: string;
 }
+/** Error body as sent by the API: RFC 7807, or OAuth-style `error`/`error_description`. */
+type AuthyonErrorBody = Partial<{
+    title: string;
+    detail: string;
+    code: string;
+    error: string;
+    error_description: string;
+}> & Record<string, unknown>;
 /** Shared RFC 7807 error implementation used by both public SDKs. */
 declare class AuthyonError extends Error {
     readonly status: number;
@@ -47,11 +49,13 @@ declare class AuthyonError extends Error {
     readonly requestId?: string;
     readonly retryAfter?: number;
     readonly cause?: unknown;
-    constructor(status: number, body: Partial<{
-        title: string;
-        detail: string;
-        code: string;
-    }>, options?: {
+    /**
+     * Extra fields from the error body beyond code/title/detail — e.g.
+     * `attemptsRemaining` on `invalid_code` or `requiredMethods` on
+     * `step_up_required`. Not included in {@link toJSON}.
+     */
+    readonly extensions: Readonly<Record<string, unknown>>;
+    constructor(status: number, body: AuthyonErrorBody, options?: {
         requestId?: string;
         retryAfter?: number;
         cause?: unknown;
@@ -67,10 +71,24 @@ declare class AuthyonError extends Error {
     toJSON(): Record<string, unknown>;
 }
 
+/** Builds an Authyon browser client through explicit, progressive configuration. */
+declare class AuthyonClientBuilder {
+    private readonly options;
+    constructor(envKey: string);
+    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
+    withStorage(storage: TokenStorage): this;
+    withAutomaticRefresh(enabled?: boolean): this;
+    withClientIp(clientIp: string): this;
+    withTimeout(timeoutMs: number): this;
+    withHttpAdapter(httpAdapter: HttpAdapter): this;
+    withHttpLogger(httpLogger: HttpLoggerOptions): this;
+    build(): AuthyonClient;
+}
+
 /** Keeps the session in memory only (lost on page reload). */
 declare function createMemoryStorage(): TokenStorage;
 /** Persists the session in `localStorage` under a namespaced key. */
 declare function createLocalStorage(key?: string): TokenStorage;
 declare function createDefaultStorage(): TokenStorage;
 
-export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };
+export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };

package/dist/index.d.ts

@@ -1,19 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-B1TiHFWa.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, z as PermissionGroup, R as RegisterInput, B as Role, S as Session, D as SessionControllerOptions, E as SessionInfo, G as SessionSnapshot, J as SessionSnapshotListener, K as SessionStatus, M as SsoProvider, N as TwoFactorChallenge, Q as TwoFactorMethod, U as TwoFactorStatus, V as User, W as ValidateResult, X as VerifyTwoFactorInput, Y as WebAuthnAssertion, Z as WebAuthnCeremonyStart, _ as WebAuthnCredential, $ as createAuthyonAbility, a0 as createAuthyonRules, a1 as createClient, a2 as hasPermission, a3 as hasPermissionGroup } from './ability-B1TiHFWa.js';
-
-/** Builds an Authyon browser client through explicit, progressive configuration. */
-declare class AuthyonClientBuilder {
-    private readonly options;
-    constructor(envKey: string);
-    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
-    withStorage(storage: TokenStorage): this;
-    withAutomaticRefresh(enabled?: boolean): this;
-    withClientIp(clientIp: string): this;
-    withTimeout(timeoutMs: number): this;
-    withHttpAdapter(httpAdapter: HttpAdapter): this;
-    withHttpLogger(httpLogger: HttpLoggerOptions): this;
-    build(): AuthyonClient;
-}
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-DbnbsQEX.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as ConfirmFinancialAuthorizationInput, r as CreateOrganizationInput, F as FetchHttpAdapter, s as FinancialAssurance, t as FinancialAuthorization, u as FinancialAuthorizationStatus, v as FinancialTransaction, w as FinancialWebAuthnOptions, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as TwoFactorChallenge, Z as TwoFactorMethod, _ as TwoFactorStatus, $ as User, a0 as ValidateResult, a1 as VerifyTwoFactorInput, a2 as WebAuthnAssertion, a3 as WebAuthnCeremonyStart, a4 as WebAuthnCredential, a5 as createAuthyonAbility, a6 as createAuthyonRules, a7 as createClient, a8 as hasPermission, a9 as hasPermissionGroup } from './ability-DbnbsQEX.js';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -27,6 +13,14 @@ declare const ErrorCodes: {
     readonly PasswordWeak: "user.password_weak";
     readonly PasswordPwned: "user.password_pwned";
     readonly RateLimited: "rate_limited";
+    readonly StepUpRequired: "step_up_required";
+    readonly InvalidSecondFactorCode: "invalid_code";
+    readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
+    readonly MethodNotEnrolled: "method_not_enrolled";
+    readonly InvalidAuthorizationState: "invalid_authorization_state";
+    readonly TransactionMismatch: "transaction_mismatch";
+    readonly AuthorizationNotConsumable: "authorization_not_consumable";
+    readonly IdempotencyConflict: "idempotency_conflict";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";
@@ -38,6 +32,14 @@ interface AuthyonErrorInterpretation {
     retryAfter?: number;
     requestId?: string;
 }
+/** Error body as sent by the API: RFC 7807, or OAuth-style `error`/`error_description`. */
+type AuthyonErrorBody = Partial<{
+    title: string;
+    detail: string;
+    code: string;
+    error: string;
+    error_description: string;
+}> & Record<string, unknown>;
 /** Shared RFC 7807 error implementation used by both public SDKs. */
 declare class AuthyonError extends Error {
     readonly status: number;
@@ -47,11 +49,13 @@ declare class AuthyonError extends Error {
     readonly requestId?: string;
     readonly retryAfter?: number;
     readonly cause?: unknown;
-    constructor(status: number, body: Partial<{
-        title: string;
-        detail: string;
-        code: string;
-    }>, options?: {
+    /**
+     * Extra fields from the error body beyond code/title/detail — e.g.
+     * `attemptsRemaining` on `invalid_code` or `requiredMethods` on
+     * `step_up_required`. Not included in {@link toJSON}.
+     */
+    readonly extensions: Readonly<Record<string, unknown>>;
+    constructor(status: number, body: AuthyonErrorBody, options?: {
         requestId?: string;
         retryAfter?: number;
         cause?: unknown;
@@ -67,10 +71,24 @@ declare class AuthyonError extends Error {
     toJSON(): Record<string, unknown>;
 }
 
+/** Builds an Authyon browser client through explicit, progressive configuration. */
+declare class AuthyonClientBuilder {
+    private readonly options;
+    constructor(envKey: string);
+    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
+    withStorage(storage: TokenStorage): this;
+    withAutomaticRefresh(enabled?: boolean): this;
+    withClientIp(clientIp: string): this;
+    withTimeout(timeoutMs: number): this;
+    withHttpAdapter(httpAdapter: HttpAdapter): this;
+    withHttpLogger(httpLogger: HttpLoggerOptions): this;
+    build(): AuthyonClient;
+}
+
 /** Keeps the session in memory only (lost on page reload). */
 declare function createMemoryStorage(): TokenStorage;
 /** Persists the session in `localStorage` under a namespaced key. */
 declare function createLocalStorage(key?: string): TokenStorage;
 declare function createDefaultStorage(): TokenStorage;
 
-export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };
+export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };

package/dist/index.js

@@ -8,6 +8,32 @@ import {
   hasPermissionGroup
 } from "./chunk-3XJY6BCI.js";
 
+// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: a financial authorization id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+function subjectFinancialAuthorizations(request) {
+  return {
+    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
+    get: (id) => request(path(id)),
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
+    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
+    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+  };
+}
+
 // ../../internal/core/errors/authyonError.ts
 var ErrorCodes = {
   Unknown: "unknown",
@@ -20,16 +46,37 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidAuthorizationState: "invalid_authorization_state",
+  TransactionMismatch: "transaction_mismatch",
+  AuthorizationNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -79,6 +126,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -172,14 +220,14 @@ var DEFAULT_BASE_URL = "https://api.authyon.com";
 var DEFAULT_EXPIRY_SKEW_MS = 3e4;
 
 // ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
+function appendQuery(path2, params) {
+  if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
     if (value2 !== void 0) query.set(key, String(value2));
   }
   const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+  return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
 }
 
 // ../../internal/core/http/httpAdapter.ts
@@ -248,7 +296,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -278,12 +325,12 @@ function createSharedTransport(options) {
   const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
   return {
     baseUrl,
-    async request(path, init) {
+    async request(path2, init) {
       const controller = new AbortController();
       const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
       try {
         return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
+          url: `${baseUrl}${path2}`,
           method: init.method ?? "GET",
           headers: normalizeHeaders(init.headers),
           body: init.body,
@@ -341,11 +388,11 @@ var JsonHttpClient = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async send(path, options = {}) {
+  async send(path2, options = {}) {
     const headers = { ...options.headers };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     try {
-      return await this.transport.request(appendQuery(path, options.query), {
+      return await this.transport.request(appendQuery(path2, options.query), {
         method: options.method ?? "GET",
         headers,
         body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
@@ -359,7 +406,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));
@@ -367,8 +416,8 @@ var JsonHttpClient = class {
     if (response.status === 204) return void 0;
     return await response.json();
   }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+  async request(path2, options = {}) {
+    return this.parse(await this.send(path2, options));
   }
 };
 
@@ -606,6 +655,16 @@ var AuthyonClient = class {
         })
       }
     };
+    // ── Financial step-up (customer side) ────────────────────────────────────
+    /**
+     * Transaction-bound approvals created by your backend
+     * (`@authyon/server` → `environment.financialAuthorizations.create`).
+     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    this.financialAuthorizations = subjectFinancialAuthorizations(
+      (path2, options) => this.request(path2, { ...options, bearer: true })
+    );
     if (!options.envKey)
       throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
     this.envKey = options.envKey;
@@ -719,7 +778,7 @@ var AuthyonClient = class {
     }
   }
   // ── HTTP core ────────────────────────────────────────────────────────────
-  async request(path, options = {}, isRetry = false) {
+  async request(path2, options = {}, isRetry = false) {
     const headers = {
       "X-Authyon-Environment": this.envKey,
       ...clientIpHeaders({ clientIp: this.clientIp }),
@@ -734,7 +793,7 @@ var AuthyonClient = class {
         });
       headers.Authorization = `Bearer ${token}`;
     }
-    const response = await this.http.send(path, { ...options, headers });
+    const response = await this.http.send(path2, { ...options, headers });
     if (response.status === 401 && options.bearer && this.autoRefresh && !isRetry && this.getSession()) {
       try {
         await this.refresh();
@@ -742,7 +801,7 @@ var AuthyonClient = class {
         this.clearSession();
         return this.http.parse(response);
       }
-      return this.request(path, options, true);
+      return this.request(path2, options, true);
     }
     return this.http.parse(response);
   }

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { V as User, D as SessionControllerOptions, A as AuthyonClient, G as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-B1TiHFWa.cjs';
-export { q as AuthyonSessionController, J as SessionSnapshotListener, K as SessionStatus } from '../ability-B1TiHFWa.cjs';
+import { $ as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-DbnbsQEX.cjs';
+export { q as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-DbnbsQEX.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { V as User, D as SessionControllerOptions, A as AuthyonClient, G as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-B1TiHFWa.js';
-export { q as AuthyonSessionController, J as SessionSnapshotListener, K as SessionStatus } from '../ability-B1TiHFWa.js';
+import { $ as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-DbnbsQEX.js';
+export { q as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-DbnbsQEX.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.2.0-beta.12",
+  "version": "0.2.0-beta.14",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",