@authyon/auth 0.2.0-beta.12 → 0.2.0-beta.15

package/README.md

@@ -273,6 +273,29 @@ Métodos de sessão/auth ficam soltos no client; os que giram em torno de um rec
 | `sso.startUrl(provider, params)` | monta a URL de `GET /auth/sso/{provider}/start` (não faz a chamada — navegue até ela) |
 | `sso.exchange(code)`             | `POST /auth/sso/exchange`                                                             |
 
+### `authyon.security` (aprovação com OTP/passkey)
+
+`security.approvals`: o cliente aprova o que o seu backend pediu
+(`@authyon/server` → `security.approvals.create`, com um `payload` livre) usando o código
+do app autenticador ou a passkey. Para só validar um código, use `security.otp.check` no
+`@authyon/server`. Guia completo: [`docs/security-otp-approvals.md`](../../docs/security-otp-approvals.md).
+
+```ts
+const pending = await authyon.security.approvals.get(approvalId);
+// mostre pending.payload ao cliente
+await authyon.security.approvals.confirm(approvalId, {
+  method: "authenticator",
+  code: "123456",
+});
+```
+
+| Método                                   | Endpoint                                          |
+| ---------------------------------------- | ------------------------------------------------- |
+| `security.approvals.get(id)`             | `GET /auth/authorizations/{id}`                   |
+| `security.approvals.webauthnOptions(id)` | `POST /auth/authorizations/{id}/webauthn/options` |
+| `security.approvals.confirm(id, input?)` | `POST /auth/authorizations/{id}/confirm`          |
+| `security.approvals.reject(id)`          | `POST /auth/authorizations/{id}/reject`           |
+
 ## Invalidação de token
 
 - **Sessão atual**: `logout()` revoga o refresh token atual; `logout({ everywhere: true })` revoga todos os refresh tokens do usuário.

package/dist/{ability-B1TiHFWa.d.cts → ability-5_xXXbDF.d.cts}

@@ -1,3 +1,58 @@
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
+/** Evidence of how the customer proved their identity when approving. */
+interface ApprovalAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
+    id: string;
+    status: ApprovalStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Present once approved. */
+    assurance?: ApprovalAssurance | null;
+}
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
+    };
+};
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
 interface HttpAdapterRequest {
     url: string;
     method: string;
@@ -55,6 +110,30 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves it.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
+}
+
 interface PaginationOptions {
     skip?: number;
     take?: number;
@@ -518,6 +597,13 @@ declare class AuthyonClient {
             assertionStart: (challengeToken: string) => Promise<WebAuthnCeremonyStart>;
         };
     };
+    /**
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    readonly security: SubjectSecurity;
     /**
      * POST /auth/introspect — lightweight token introspection (RFC 7662).
      *
@@ -642,4 +728,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { createAuthyonAbility as $, AuthyonClient as A, type Role as B, type CreateOrganizationInput as C, type SessionControllerOptions as D, type SessionInfo as E, FetchHttpAdapter as F, type SessionSnapshot as G, type HttpAdapter as H, type IntrospectResult as I, type SessionSnapshotListener as J, type SessionStatus as K, LoggingHttpAdapter as L, type SsoProvider as M, type TwoFactorChallenge as N, type Organization as O, type Paged as P, type TwoFactorMethod as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type TwoFactorStatus as U, type User as V, type ValidateResult as W, type VerifyTwoFactorInput as X, type WebAuthnAssertion as Y, type WebAuthnCeremonyStart as Z, type WebAuthnCredential as _, type HttpLoggerOptions as a, createAuthyonRules as a0, createClient as a1, hasPermission as a2, hasPermissionGroup as a3, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type PermissionGroup as z };
+export { type TwoFactorMethod as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmApprovalInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type SubjectApprovals as Y, type SubjectSecurity as Z, type TwoFactorChallenge as _, type HttpLoggerOptions as a, type TwoFactorStatus as a0, type User as a1, type ValidateResult as a2, type VerifyTwoFactorInput as a3, type WebAuthnAssertion as a4, type WebAuthnCeremonyStart as a5, type WebAuthnCredential as a6, createAuthyonAbility as a7, createAuthyonRules as a8, createClient as a9, hasPermission as aa, hasPermissionGroup as ab, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type Approval as h, type ApprovalAssurance as i, type ApprovalPayload as j, type ApprovalStatus as k, type ApprovalWebAuthnOptions as l, type AuthEvent as m, type AuthState as n, type AuthStateListener as o, type AuthenticatorSetup as p, AuthyonAbility as q, AuthyonAbilityBuilder as r, type AuthyonAbilityOptions as s, type AuthyonClientOptions as t, type AuthyonPermissionSource as u, AuthyonSessionController as v, type CreateOrganizationInput as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };

package/dist/{ability-B1TiHFWa.d.ts → ability-5_xXXbDF.d.ts}

@@ -1,3 +1,58 @@
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
+/** Evidence of how the customer proved their identity when approving. */
+interface ApprovalAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
+    id: string;
+    status: ApprovalStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Present once approved. */
+    assurance?: ApprovalAssurance | null;
+}
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
+    };
+};
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
 interface HttpAdapterRequest {
     url: string;
     method: string;
@@ -55,6 +110,30 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves it.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
+}
+
 interface PaginationOptions {
     skip?: number;
     take?: number;
@@ -518,6 +597,13 @@ declare class AuthyonClient {
             assertionStart: (challengeToken: string) => Promise<WebAuthnCeremonyStart>;
         };
     };
+    /**
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    readonly security: SubjectSecurity;
     /**
      * POST /auth/introspect — lightweight token introspection (RFC 7662).
      *
@@ -642,4 +728,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { createAuthyonAbility as $, AuthyonClient as A, type Role as B, type CreateOrganizationInput as C, type SessionControllerOptions as D, type SessionInfo as E, FetchHttpAdapter as F, type SessionSnapshot as G, type HttpAdapter as H, type IntrospectResult as I, type SessionSnapshotListener as J, type SessionStatus as K, LoggingHttpAdapter as L, type SsoProvider as M, type TwoFactorChallenge as N, type Organization as O, type Paged as P, type TwoFactorMethod as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type TwoFactorStatus as U, type User as V, type ValidateResult as W, type VerifyTwoFactorInput as X, type WebAuthnAssertion as Y, type WebAuthnCeremonyStart as Z, type WebAuthnCredential as _, type HttpLoggerOptions as a, createAuthyonRules as a0, createClient as a1, hasPermission as a2, hasPermissionGroup as a3, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type PermissionGroup as z };
+export { type TwoFactorMethod as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmApprovalInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type SubjectApprovals as Y, type SubjectSecurity as Z, type TwoFactorChallenge as _, type HttpLoggerOptions as a, type TwoFactorStatus as a0, type User as a1, type ValidateResult as a2, type VerifyTwoFactorInput as a3, type WebAuthnAssertion as a4, type WebAuthnCeremonyStart as a5, type WebAuthnCredential as a6, createAuthyonAbility as a7, createAuthyonRules as a8, createClient as a9, hasPermission as aa, hasPermissionGroup as ab, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type Approval as h, type ApprovalAssurance as i, type ApprovalPayload as j, type ApprovalStatus as k, type ApprovalWebAuthnOptions as l, type AuthEvent as m, type AuthState as n, type AuthStateListener as o, type AuthenticatorSetup as p, AuthyonAbility as q, AuthyonAbilityBuilder as r, type AuthyonAbilityOptions as s, type AuthyonClientOptions as t, type AuthyonPermissionSource as u, AuthyonSessionController as v, type CreateOrganizationInput as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };

package/dist/index.cjs

@@ -40,6 +40,23 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// ../../internal/core/security/approvals.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: an approval id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+function subjectSecurity(request) {
+  return {
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
+  };
+}
+
 // ../../internal/core/errors/authyonError.ts
 var ErrorCodes = {
   Unknown: "unknown",
@@ -52,16 +69,44 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -111,6 +156,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -204,14 +250,14 @@ var DEFAULT_BASE_URL = "https://api.authyon.com";
 var DEFAULT_EXPIRY_SKEW_MS = 3e4;
 
 // ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
+function appendQuery(path2, params) {
+  if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
     if (value2 !== void 0) query.set(key, String(value2));
   }
   const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+  return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
 }
 
 // ../../internal/core/http/httpAdapter.ts
@@ -280,7 +326,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -310,12 +355,12 @@ function createSharedTransport(options) {
   const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
   return {
     baseUrl,
-    async request(path, init) {
+    async request(path2, init) {
       const controller = new AbortController();
       const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
       try {
         return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
+          url: `${baseUrl}${path2}`,
           method: init.method ?? "GET",
           headers: normalizeHeaders(init.headers),
           body: init.body,
@@ -373,11 +418,11 @@ var JsonHttpClient = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async send(path, options = {}) {
+  async send(path2, options = {}) {
     const headers = { ...options.headers };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     try {
-      return await this.transport.request(appendQuery(path, options.query), {
+      return await this.transport.request(appendQuery(path2, options.query), {
         method: options.method ?? "GET",
         headers,
         body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
@@ -391,7 +436,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));
@@ -399,8 +446,8 @@ var JsonHttpClient = class {
     if (response.status === 204) return void 0;
     return await response.json();
   }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+  async request(path2, options = {}) {
+    return this.parse(await this.send(path2, options));
   }
 };
 
@@ -638,6 +685,16 @@ var AuthyonClient = class {
         })
       }
     };
+    // ── Security (customer side) ─────────────────────────────────────────────
+    /**
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    this.security = subjectSecurity(
+      (path2, options) => this.request(path2, { ...options, bearer: true })
+    );
     if (!options.envKey)
       throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
     this.envKey = options.envKey;
@@ -751,7 +808,7 @@ var AuthyonClient = class {
     }
   }
   // ── HTTP core ────────────────────────────────────────────────────────────
-  async request(path, options = {}, isRetry = false) {
+  async request(path2, options = {}, isRetry = false) {
     const headers = {
       "X-Authyon-Environment": this.envKey,
       ...clientIpHeaders({ clientIp: this.clientIp }),
@@ -766,7 +823,7 @@ var AuthyonClient = class {
         });
       headers.Authorization = `Bearer ${token}`;
     }
-    const response = await this.http.send(path, { ...options, headers });
+    const response = await this.http.send(path2, { ...options, headers });
     if (response.status === 401 && options.bearer && this.autoRefresh && !isRetry && this.getSession()) {
       try {
         await this.refresh();
@@ -774,7 +831,7 @@ var AuthyonClient = class {
         this.clearSession();
         return this.http.parse(response);
       }
-      return this.request(path, options, true);
+      return this.request(path2, options, true);
     }
     return this.http.parse(response);
   }
@@ -1193,18 +1250,18 @@ function matchesField(pattern, field) {
   return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
 }
 function matchesConditions(subject, conditions) {
-  return Object.entries(conditions).every(([path, expected]) => {
-    if (path === "$and" && Array.isArray(expected)) {
+  return Object.entries(conditions).every(([path2, expected]) => {
+    if (path2 === "$and" && Array.isArray(expected)) {
       return expected.every(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    if (path === "$or" && Array.isArray(expected)) {
+    if (path2 === "$or" && Array.isArray(expected)) {
       return expected.some(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    return matchesValue(readPath(subject, path), expected);
+    return matchesValue(readPath(subject, path2), expected);
   });
 }
 function matchesValue(actual, expected) {
@@ -1236,8 +1293,8 @@ function matchesValue(actual, expected) {
     }
   });
 }
-function readPath(value, path) {
-  return path.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
+function readPath(value, path2) {
+  return path2.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
 }
 function defaultSubjectType(subject) {
   const explicit = subject.__type ?? subject.type ?? subject.kind;

package/dist/index.d.cts

@@ -1,19 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-B1TiHFWa.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, z as PermissionGroup, R as RegisterInput, B as Role, S as Session, D as SessionControllerOptions, E as SessionInfo, G as SessionSnapshot, J as SessionSnapshotListener, K as SessionStatus, M as SsoProvider, N as TwoFactorChallenge, Q as TwoFactorMethod, U as TwoFactorStatus, V as User, W as ValidateResult, X as VerifyTwoFactorInput, Y as WebAuthnAssertion, Z as WebAuthnCeremonyStart, _ as WebAuthnCredential, $ as createAuthyonAbility, a0 as createAuthyonRules, a1 as createClient, a2 as hasPermission, a3 as hasPermissionGroup } from './ability-B1TiHFWa.cjs';
-
-/** Builds an Authyon browser client through explicit, progressive configuration. */
-declare class AuthyonClientBuilder {
-    private readonly options;
-    constructor(envKey: string);
-    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
-    withStorage(storage: TokenStorage): this;
-    withAutomaticRefresh(enabled?: boolean): this;
-    withClientIp(clientIp: string): this;
-    withTimeout(timeoutMs: number): this;
-    withHttpAdapter(httpAdapter: HttpAdapter): this;
-    withHttpLogger(httpLogger: HttpLoggerOptions): this;
-    build(): AuthyonClient;
-}
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-5_xXXbDF.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as Approval, i as ApprovalAssurance, j as ApprovalPayload, k as ApprovalStatus, l as ApprovalWebAuthnOptions, m as AuthEvent, n as AuthState, o as AuthStateListener, p as AuthenticatorSetup, q as AuthyonAbility, r as AuthyonAbilityBuilder, s as AuthyonAbilityOptions, t as AuthyonClientOptions, u as AuthyonPermissionSource, v as AuthyonSessionController, C as ConfirmApprovalInput, w as CreateOrganizationInput, F as FetchHttpAdapter, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as SubjectApprovals, Z as SubjectSecurity, _ as TwoFactorChallenge, $ as TwoFactorMethod, a0 as TwoFactorStatus, a1 as User, a2 as ValidateResult, a3 as VerifyTwoFactorInput, a4 as WebAuthnAssertion, a5 as WebAuthnCeremonyStart, a6 as WebAuthnCredential, a7 as createAuthyonAbility, a8 as createAuthyonRules, a9 as createClient, aa as hasPermission, ab as hasPermissionGroup } from './ability-5_xXXbDF.cjs';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -27,6 +13,21 @@ declare const ErrorCodes: {
     readonly PasswordWeak: "user.password_weak";
     readonly PasswordPwned: "user.password_pwned";
     readonly RateLimited: "rate_limited";
+    readonly StepUpRequired: "step_up_required";
+    readonly InvalidSecondFactorCode: "invalid_code";
+    readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
+    readonly MethodNotEnrolled: "method_not_enrolled";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
+    readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";
@@ -38,6 +39,14 @@ interface AuthyonErrorInterpretation {
     retryAfter?: number;
     requestId?: string;
 }
+/** Error body as sent by the API: RFC 7807, or OAuth-style `error`/`error_description`. */
+type AuthyonErrorBody = Partial<{
+    title: string;
+    detail: string;
+    code: string;
+    error: string;
+    error_description: string;
+}> & Record<string, unknown>;
 /** Shared RFC 7807 error implementation used by both public SDKs. */
 declare class AuthyonError extends Error {
     readonly status: number;
@@ -47,11 +56,13 @@ declare class AuthyonError extends Error {
     readonly requestId?: string;
     readonly retryAfter?: number;
     readonly cause?: unknown;
-    constructor(status: number, body: Partial<{
-        title: string;
-        detail: string;
-        code: string;
-    }>, options?: {
+    /**
+     * Extra fields from the error body beyond code/title/detail — e.g.
+     * `attemptsRemaining` on `invalid_code` or `requiredMethods` on
+     * `step_up_required`. Not included in {@link toJSON}.
+     */
+    readonly extensions: Readonly<Record<string, unknown>>;
+    constructor(status: number, body: AuthyonErrorBody, options?: {
         requestId?: string;
         retryAfter?: number;
         cause?: unknown;
@@ -67,10 +78,24 @@ declare class AuthyonError extends Error {
     toJSON(): Record<string, unknown>;
 }
 
+/** Builds an Authyon browser client through explicit, progressive configuration. */
+declare class AuthyonClientBuilder {
+    private readonly options;
+    constructor(envKey: string);
+    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
+    withStorage(storage: TokenStorage): this;
+    withAutomaticRefresh(enabled?: boolean): this;
+    withClientIp(clientIp: string): this;
+    withTimeout(timeoutMs: number): this;
+    withHttpAdapter(httpAdapter: HttpAdapter): this;
+    withHttpLogger(httpLogger: HttpLoggerOptions): this;
+    build(): AuthyonClient;
+}
+
 /** Keeps the session in memory only (lost on page reload). */
 declare function createMemoryStorage(): TokenStorage;
 /** Persists the session in `localStorage` under a namespaced key. */
 declare function createLocalStorage(key?: string): TokenStorage;
 declare function createDefaultStorage(): TokenStorage;
 
-export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };
+export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };

package/dist/index.d.ts

@@ -1,19 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-B1TiHFWa.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, z as PermissionGroup, R as RegisterInput, B as Role, S as Session, D as SessionControllerOptions, E as SessionInfo, G as SessionSnapshot, J as SessionSnapshotListener, K as SessionStatus, M as SsoProvider, N as TwoFactorChallenge, Q as TwoFactorMethod, U as TwoFactorStatus, V as User, W as ValidateResult, X as VerifyTwoFactorInput, Y as WebAuthnAssertion, Z as WebAuthnCeremonyStart, _ as WebAuthnCredential, $ as createAuthyonAbility, a0 as createAuthyonRules, a1 as createClient, a2 as hasPermission, a3 as hasPermissionGroup } from './ability-B1TiHFWa.js';
-
-/** Builds an Authyon browser client through explicit, progressive configuration. */
-declare class AuthyonClientBuilder {
-    private readonly options;
-    constructor(envKey: string);
-    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
-    withStorage(storage: TokenStorage): this;
-    withAutomaticRefresh(enabled?: boolean): this;
-    withClientIp(clientIp: string): this;
-    withTimeout(timeoutMs: number): this;
-    withHttpAdapter(httpAdapter: HttpAdapter): this;
-    withHttpLogger(httpLogger: HttpLoggerOptions): this;
-    build(): AuthyonClient;
-}
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-5_xXXbDF.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as Approval, i as ApprovalAssurance, j as ApprovalPayload, k as ApprovalStatus, l as ApprovalWebAuthnOptions, m as AuthEvent, n as AuthState, o as AuthStateListener, p as AuthenticatorSetup, q as AuthyonAbility, r as AuthyonAbilityBuilder, s as AuthyonAbilityOptions, t as AuthyonClientOptions, u as AuthyonPermissionSource, v as AuthyonSessionController, C as ConfirmApprovalInput, w as CreateOrganizationInput, F as FetchHttpAdapter, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as SubjectApprovals, Z as SubjectSecurity, _ as TwoFactorChallenge, $ as TwoFactorMethod, a0 as TwoFactorStatus, a1 as User, a2 as ValidateResult, a3 as VerifyTwoFactorInput, a4 as WebAuthnAssertion, a5 as WebAuthnCeremonyStart, a6 as WebAuthnCredential, a7 as createAuthyonAbility, a8 as createAuthyonRules, a9 as createClient, aa as hasPermission, ab as hasPermissionGroup } from './ability-5_xXXbDF.js';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -27,6 +13,21 @@ declare const ErrorCodes: {
     readonly PasswordWeak: "user.password_weak";
     readonly PasswordPwned: "user.password_pwned";
     readonly RateLimited: "rate_limited";
+    readonly StepUpRequired: "step_up_required";
+    readonly InvalidSecondFactorCode: "invalid_code";
+    readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
+    readonly MethodNotEnrolled: "method_not_enrolled";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
+    readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";
@@ -38,6 +39,14 @@ interface AuthyonErrorInterpretation {
     retryAfter?: number;
     requestId?: string;
 }
+/** Error body as sent by the API: RFC 7807, or OAuth-style `error`/`error_description`. */
+type AuthyonErrorBody = Partial<{
+    title: string;
+    detail: string;
+    code: string;
+    error: string;
+    error_description: string;
+}> & Record<string, unknown>;
 /** Shared RFC 7807 error implementation used by both public SDKs. */
 declare class AuthyonError extends Error {
     readonly status: number;
@@ -47,11 +56,13 @@ declare class AuthyonError extends Error {
     readonly requestId?: string;
     readonly retryAfter?: number;
     readonly cause?: unknown;
-    constructor(status: number, body: Partial<{
-        title: string;
-        detail: string;
-        code: string;
-    }>, options?: {
+    /**
+     * Extra fields from the error body beyond code/title/detail — e.g.
+     * `attemptsRemaining` on `invalid_code` or `requiredMethods` on
+     * `step_up_required`. Not included in {@link toJSON}.
+     */
+    readonly extensions: Readonly<Record<string, unknown>>;
+    constructor(status: number, body: AuthyonErrorBody, options?: {
         requestId?: string;
         retryAfter?: number;
         cause?: unknown;
@@ -67,10 +78,24 @@ declare class AuthyonError extends Error {
     toJSON(): Record<string, unknown>;
 }
 
+/** Builds an Authyon browser client through explicit, progressive configuration. */
+declare class AuthyonClientBuilder {
+    private readonly options;
+    constructor(envKey: string);
+    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
+    withStorage(storage: TokenStorage): this;
+    withAutomaticRefresh(enabled?: boolean): this;
+    withClientIp(clientIp: string): this;
+    withTimeout(timeoutMs: number): this;
+    withHttpAdapter(httpAdapter: HttpAdapter): this;
+    withHttpLogger(httpLogger: HttpLoggerOptions): this;
+    build(): AuthyonClient;
+}
+
 /** Keeps the session in memory only (lost on page reload). */
 declare function createMemoryStorage(): TokenStorage;
 /** Persists the session in `localStorage` under a namespaced key. */
 declare function createLocalStorage(key?: string): TokenStorage;
 declare function createDefaultStorage(): TokenStorage;
 
-export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };
+export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };

package/dist/index.js

@@ -8,6 +8,23 @@ import {
   hasPermissionGroup
 } from "./chunk-3XJY6BCI.js";
 
+// ../../internal/core/security/approvals.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: an approval id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+function subjectSecurity(request) {
+  return {
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
+  };
+}
+
 // ../../internal/core/errors/authyonError.ts
 var ErrorCodes = {
   Unknown: "unknown",
@@ -20,16 +37,44 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -79,6 +124,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -172,14 +218,14 @@ var DEFAULT_BASE_URL = "https://api.authyon.com";
 var DEFAULT_EXPIRY_SKEW_MS = 3e4;
 
 // ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
+function appendQuery(path2, params) {
+  if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
     if (value2 !== void 0) query.set(key, String(value2));
   }
   const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+  return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
 }
 
 // ../../internal/core/http/httpAdapter.ts
@@ -248,7 +294,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -278,12 +323,12 @@ function createSharedTransport(options) {
   const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
   return {
     baseUrl,
-    async request(path, init) {
+    async request(path2, init) {
       const controller = new AbortController();
       const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
       try {
         return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
+          url: `${baseUrl}${path2}`,
           method: init.method ?? "GET",
           headers: normalizeHeaders(init.headers),
           body: init.body,
@@ -341,11 +386,11 @@ var JsonHttpClient = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async send(path, options = {}) {
+  async send(path2, options = {}) {
     const headers = { ...options.headers };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     try {
-      return await this.transport.request(appendQuery(path, options.query), {
+      return await this.transport.request(appendQuery(path2, options.query), {
         method: options.method ?? "GET",
         headers,
         body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
@@ -359,7 +404,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));
@@ -367,8 +414,8 @@ var JsonHttpClient = class {
     if (response.status === 204) return void 0;
     return await response.json();
   }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+  async request(path2, options = {}) {
+    return this.parse(await this.send(path2, options));
   }
 };
 
@@ -606,6 +653,16 @@ var AuthyonClient = class {
         })
       }
     };
+    // ── Security (customer side) ─────────────────────────────────────────────
+    /**
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    this.security = subjectSecurity(
+      (path2, options) => this.request(path2, { ...options, bearer: true })
+    );
     if (!options.envKey)
       throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
     this.envKey = options.envKey;
@@ -719,7 +776,7 @@ var AuthyonClient = class {
     }
   }
   // ── HTTP core ────────────────────────────────────────────────────────────
-  async request(path, options = {}, isRetry = false) {
+  async request(path2, options = {}, isRetry = false) {
     const headers = {
       "X-Authyon-Environment": this.envKey,
       ...clientIpHeaders({ clientIp: this.clientIp }),
@@ -734,7 +791,7 @@ var AuthyonClient = class {
         });
       headers.Authorization = `Bearer ${token}`;
     }
-    const response = await this.http.send(path, { ...options, headers });
+    const response = await this.http.send(path2, { ...options, headers });
     if (response.status === 401 && options.bearer && this.autoRefresh && !isRetry && this.getSession()) {
       try {
         await this.refresh();
@@ -742,7 +799,7 @@ var AuthyonClient = class {
         this.clearSession();
         return this.http.parse(response);
       }
-      return this.request(path, options, true);
+      return this.request(path2, options, true);
     }
     return this.http.parse(response);
   }

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { V as User, D as SessionControllerOptions, A as AuthyonClient, G as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-B1TiHFWa.cjs';
-export { q as AuthyonSessionController, J as SessionSnapshotListener, K as SessionStatus } from '../ability-B1TiHFWa.cjs';
+import { a1 as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, s as AuthyonAbilityOptions, q as AuthyonAbility } from '../ability-5_xXXbDF.cjs';
+export { v as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-5_xXXbDF.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { V as User, D as SessionControllerOptions, A as AuthyonClient, G as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-B1TiHFWa.js';
-export { q as AuthyonSessionController, J as SessionSnapshotListener, K as SessionStatus } from '../ability-B1TiHFWa.js';
+import { a1 as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, s as AuthyonAbilityOptions, q as AuthyonAbility } from '../ability-5_xXXbDF.js';
+export { v as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-5_xXXbDF.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.2.0-beta.12",
+  "version": "0.2.0-beta.15",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",