@authyon/server 0.2.0-beta.11 → 0.2.0-beta.14

package/dist/{authyonServerClient-D-DxoL30.d.ts → authyonServerClient-DmNnjw4z.d.ts}

@@ -253,6 +253,8 @@ interface CreateUserInput {
     email: string;
     username: string;
     password: string;
+    /** Values for custom user fields configured in the environment. */
+    customFields?: Record<string, unknown>;
     emailConfirmed?: boolean;
     roles?: string[];
     /** Tenants (organizations) to add the user to on creation. */
@@ -399,14 +401,6 @@ type CreateCredentialInput = CredentialPermissionsInput & {
     description?: string;
     lifetimeDays?: number | null;
 };
-interface CredentialScope {
-    workspaceId: string;
-    environmentId: string;
-    tenantId?: string;
-}
-interface TenantManagementScope extends CredentialScope {
-    tenantId: string;
-}
 interface CredentialCreator {
     id: string | null;
     type: string;
@@ -422,64 +416,6 @@ interface CredentialDetail extends TenantCredentialSummary {
     lifetimeSeconds: number | null;
     accessTokenLifetimeSeconds: number;
 }
-type WorkspaceRole = "admin" | "auditor";
-interface WorkspaceMember {
-    memberId: string | null;
-    userId: string;
-    email: string;
-    name: string;
-    role: string;
-    isOwner: boolean;
-    isSelf: boolean;
-    invitedByName: string | null;
-    joinedAt: string;
-    lastLoginAt: string | null;
-}
-interface WorkspaceInvite {
-    id: string;
-    email: string;
-    role: string;
-    invitedByName: string | null;
-    createdAt: string;
-    expiresAt: string;
-}
-interface WorkspaceTeam {
-    workspaceId: string;
-    workspaceName: string;
-    callerRole: string;
-    canManage: boolean;
-    members: WorkspaceMember[];
-    pendingInvites: WorkspaceInvite[];
-}
-interface InviteWorkspaceMemberInput {
-    email: string;
-    role: WorkspaceRole;
-}
-interface WorkspaceInviteIssued {
-    inviteId: string;
-    email: string;
-    role: string;
-    /** Sensitive bearer link returned at issuance. Do not log or persist in public storage. */
-    acceptUrl: string;
-    expiresAt: string;
-}
-interface WorkspaceInvitePreview {
-    workspaceName: string;
-    email: string;
-    role: string;
-    expiresAt: string;
-    requiresRegistration: boolean;
-}
-interface WorkspaceInviteAccepted {
-    workspaceId: string;
-    workspaceName: string;
-    role: string;
-    accountCreated: boolean;
-}
-interface AcceptWorkspaceInviteInput {
-    name?: string;
-    password?: string;
-}
 interface InviteTenantMemberInput {
     email: string;
     roles?: string[];
@@ -506,51 +442,107 @@ interface JsonRequestOptions {
 
 type ManagementRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
 
-/** Platform user administration. Never falls back to an environment machine token. */
-declare class PlatformScopedClient {
-    #private;
-    /** @hidden */
-    constructor(request: ManagementRequest, token: AccessTokenSource);
-    readonly credentials: {
-        list: (scope: CredentialScope, options?: CredentialListOptions) => Promise<Paged<TenantCredentialSummary>>;
-        get: (scope: CredentialScope, credentialId: string) => Promise<CredentialDetail>;
-        create: (scope: CredentialScope, input: CreateCredentialInput) => Promise<TenantCredentialIssued>;
-        updatePermissions: (scope: CredentialScope, credentialId: string, input: CredentialPermissionsInput) => Promise<void>;
-        updateScopes: (scope: CredentialScope, credentialId: string, scopes: readonly string[]) => Promise<void>;
-        /** Returns a new secret once. API may require an explicit step-up first. */
-        rotate: (scope: CredentialScope, credentialId: string) => Promise<TenantCredentialIssued>;
-        revoke: (scope: CredentialScope, credentialId: string) => Promise<void>;
-    };
-    readonly workspaces: {
-        team: (workspaceId: string) => Promise<WorkspaceTeam>;
-        members: {
-            invite: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
-            /** memberId comes from team.members; it is not the platform userId. */
-            remove: (workspaceId: string, memberId: string) => Promise<void>;
-            changeRole: (workspaceId: string, memberId: string, role: WorkspaceRole) => Promise<void>;
-        };
-        invites: {
-            create: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
-            revoke: (workspaceId: string, inviteId: string) => Promise<void>;
-        };
-    };
-    readonly tenants: {
-        members: {
-            list: (scope: TenantManagementScope, options?: PaginationOptions) => Promise<EnvironmentUser[]>;
-            add: (scope: TenantManagementScope, userId: string, roles?: string[]) => Promise<void>;
-            remove: (scope: TenantManagementScope, userId: string) => Promise<void>;
-        };
-    };
-    readonly auth: {
-        /** Explicitly confirms the current platform session; passwords are not retained. */
-        stepUp: (currentPassword: string) => Promise<void>;
+/** Lifecycle of a transaction-bound financial authorization. */
+type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * The transaction the customer approves. The API hashes a canonical form of
+ * these fields; `consume()` must resend exactly the same values (amount is
+ * normalized to four decimal places, metadata keys are sorted).
+ */
+interface FinancialTransaction {
+    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
+    action: string;
+    /** Positive amount, up to 15 integer digits and 4 decimal places. */
+    amount: number;
+    /** ISO 4217 currency code, e.g. `"BRL"`. */
+    currency: string;
+    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
+    beneficiary: string;
+    /** Optional JSON object bound into the hash (max 16 KiB). */
+    metadata?: Record<string, unknown>;
+}
+/** Evidence of how the customer proved their identity when approving. */
+interface FinancialAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+interface FinancialAuthorization {
+    id: string;
+    status: FinancialAuthorizationStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    action: string;
+    amount: number;
+    currency: string;
+    beneficiary: string;
+    /** SHA-256 (hex) of the canonical transaction. */
+    transactionHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Full canonical transaction — returned only to the customer (subject) view. */
+    transaction?: FinancialTransaction | null;
+    /** Present once approved. */
+    assurance?: FinancialAssurance | null;
+}
+/** Inline second factor sent with `confirm()`. */
+type ConfirmFinancialAuthorizationInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
     };
+};
+/** Passkey assertion options for approving one authorization. */
+interface FinancialWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
 }
+
+/** Sends a request already authenticated as the customer (end-user bearer). */
+type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
+/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
+declare function subjectFinancialAuthorizations(request: SubjectRequest): {
+    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
+    get: (id: string) => Promise<FinancialAuthorization>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
+    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
+    reject: (id: string) => Promise<FinancialAuthorization>;
+};
+
 /** End-user operations require a user token and the environment publishable key. */
 declare class UserScopedClient {
     #private;
     /** @hidden */
     constructor(request: ManagementRequest, token: AccessTokenSource);
+    /**
+     * Customer-side approval of a financial authorization, for backends (BFF)
+     * that hold the customer's access token: `get`, `webauthnOptions`,
+     * `confirm`, `reject`.
+     */
+    readonly financialAuthorizations: ReturnType<typeof subjectFinancialAuthorizations>;
     readonly tenants: {
         members: {
             list: (tenantId: string, options?: PaginationOptions) => Promise<TenantMemberPage>;
@@ -560,13 +552,29 @@ declare class UserScopedClient {
         };
     };
 }
-/** Anonymous invite endpoints: the invitation token itself authorizes these requests. */
-declare class WorkspaceInvitesClient {
-    #private;
-    /** @hidden */
-    constructor(request: ManagementRequest);
-    preview(token: string): Promise<WorkspaceInvitePreview>;
-    accept(token: string, input?: AcceptWorkspaceInviteInput): Promise<WorkspaceInviteAccepted>;
+
+/** POST /env/authorizations — a transaction awaiting the customer's approval. */
+interface CreateFinancialAuthorizationInput extends FinancialTransaction {
+    /** Environment user who must approve. */
+    subjectId: string;
+    /** Restrict approval to a session in this tenant. */
+    tenantId?: string;
+    /** Lifetime in seconds, clamped to 60–600. Default 300. */
+    expiresInSeconds?: number;
+    /**
+     * Sent as the `Idempotency-Key` header (max 128 chars). Retrying with the
+     * same key and transaction returns the same authorization; the same key
+     * with a different transaction fails with `idempotency_conflict`.
+     */
+    idempotencyKey: string;
+}
+/** POST /env/authorizations/{id}/consume — single-use redemption result. */
+interface ConsumedFinancialAuthorization {
+    id: string;
+    status: "consumed";
+    consumedAt: string;
+    transactionHash: string;
+    assurance: FinancialAssurance | null;
 }
 
 interface ClientRequestContext {
@@ -680,11 +688,8 @@ declare class AuthyonServerClient {
      * "the token's tenant" rather than one you pass by id.
      */
     tenant(credentials: ClientCredentials): TenantScopedClient;
-    /** Uses only the supplied platform-user access token. */
-    platform(token: AccessTokenSource): PlatformScopedClient;
     /** Uses an end-user token; the configured environment key selects the environment. */
     user(token: AccessTokenSource): UserScopedClient;
-    readonly workspaceInvites: WorkspaceInvitesClient;
     readonly environment: {
         users: {
             /** GET /env/users — paginated list of users in the environment. */
@@ -814,6 +819,27 @@ declare class AuthyonServerClient {
             /** GET /permissions/reserved — reserved permission names you can't redefine. */
             reserved: () => Promise<ReservedPermissions>;
         };
+        /**
+         * Transaction-bound step-up for financial operations. The environment
+         * credential needs the `authyon:financial:authorize` scope.
+         *
+         * 1. `create()` the authorization for the transaction and the customer.
+         * 2. The customer approves it with their authenticator code or passkey
+         *    (`@authyon/auth` → `financialAuthorizations.confirm`).
+         * 3. `consume()` it with the same transaction right before executing it.
+         */
+        financialAuthorizations: {
+            /** POST /env/authorizations — registers a transaction awaiting the customer's approval. */
+            create: (input: CreateFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
+            /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+            get: (id: string) => Promise<FinancialAuthorization>;
+            /**
+             * POST /env/authorizations/{id}/consume — redeems an approved
+             * authorization exactly once. Resend the same transaction given to
+             * `create()`; any difference fails with `transaction_mismatch`.
+             */
+            consume: (id: string, transaction: FinancialTransaction) => Promise<ConsumedFinancialAuthorization>;
+        };
         audit: {
             /** GET /env/audit — paginated list of the environment's audit events. */
             list: (params?: PaginationOptions) => Promise<Paged<AuditEvent>>;
@@ -895,4 +921,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type TenantMemberPage as $, AuthyonServerClient as A, type Organization as B, type ClientCredentials as C, type PaginationOptions as D, type EnvironmentUser as E, FetchHttpAdapter as F, type Permission as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type PermissionsByRole as K, LoggingHttpAdapter as L, PlatformScopedClient as M, type Role as N, type OpenIdConfiguration as O, type Paged as P, type RoleGrant as Q, type ReservedPermissions as R, type RoleInput as S, type RoleList as T, type RolePermissions as U, type SafeJwtAlgorithm as V, type TenantClientValidationResult as W, type TenantCredentialIssued as X, type TenantCredentialSummary as Y, type TenantManagementScope as Z, type TenantMember as _, type HttpLoggerOptions as a, type TenantMembership as a0, TenantScopedClient as a1, type TokenResult as a2, TokenVerificationError as a3, type TokenVerificationErrorCode as a4, type UpdateOrganizationInput as a5, type User as a6, UserScopedClient as a7, type ValidateResult as a8, type VerifiedAccessToken as a9, type WorkspaceInvite as aa, type WorkspaceInviteAccepted as ab, type WorkspaceInviteIssued as ac, type WorkspaceInvitePreview as ad, WorkspaceInvitesClient as ae, type WorkspaceMember as af, type WorkspaceRole as ag, type WorkspaceTeam as ah, createClient as ai, normalizeClientIp as aj, type AcceptWorkspaceInviteInput as b, type AccessTokenSource as c, type AuditEvent as d, type AuthyonJwksDiscoveryOptions as e, type AuthyonJwtClaims as f, type AuthyonServerClientOptions as g, type ClientRequestContext as h, type CreateCredentialInput as i, type CreateOrganizationInput as j, type CreatePermissionInput as k, type CreateTenantCredentialInput as l, type CreateUserInput as m, type CredentialCreator as n, type CredentialDetail as o, type CredentialListOptions as p, type CredentialPermissionsInput as q, type CredentialScope as r, type HttpAdapterRequest as s, type HttpLogEvent as t, type HttpLogger as u, type InviteTenantMemberInput as v, type InviteWorkspaceMemberInput as w, JwksTokenVerifier as x, type JwksTokenVerifierOptions as y, type LoginActivity as z };
+export { type TenantCredentialIssued as $, AuthyonServerClient as A, type HttpLogger as B, type ClientCredentials as C, type InviteTenantMemberInput as D, type EnvironmentUser as E, FetchHttpAdapter as F, JwksTokenVerifier as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type JwksTokenVerifierOptions as K, LoggingHttpAdapter as L, type LoginActivity as M, type Organization as N, type OpenIdConfiguration as O, type Paged as P, type PaginationOptions as Q, type Permission as R, type PermissionsByRole as S, type ReservedPermissions as T, type Role as U, type RoleGrant as V, type RoleInput as W, type RoleList as X, type RolePermissions as Y, type SafeJwtAlgorithm as Z, type TenantClientValidationResult as _, type HttpLoggerOptions as a, type TenantCredentialSummary as a0, type TenantMember as a1, type TenantMemberPage as a2, type TenantMembership as a3, TenantScopedClient as a4, type TokenResult as a5, TokenVerificationError as a6, type TokenVerificationErrorCode as a7, type UpdateOrganizationInput as a8, type User as a9, UserScopedClient as aa, type ValidateResult as ab, type VerifiedAccessToken as ac, createClient as ad, normalizeClientIp as ae, type AccessTokenSource as b, type AuditEvent as c, type AuthyonJwksDiscoveryOptions as d, type AuthyonJwtClaims as e, type AuthyonServerClientOptions as f, type ClientRequestContext as g, type ConfirmFinancialAuthorizationInput as h, type ConsumedFinancialAuthorization as i, type CreateCredentialInput as j, type CreateFinancialAuthorizationInput as k, type CreateOrganizationInput as l, type CreatePermissionInput as m, type CreateTenantCredentialInput as n, type CreateUserInput as o, type CredentialCreator as p, type CredentialDetail as q, type CredentialListOptions as r, type CredentialPermissionsInput as s, type FinancialAssurance as t, type FinancialAuthorization as u, type FinancialAuthorizationStatus as v, type FinancialTransaction as w, type FinancialWebAuthnOptions as x, type HttpAdapterRequest as y, type HttpLogEvent as z };

package/dist/bff.cjs

@@ -51,16 +51,37 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidAuthorizationState: "invalid_authorization_state",
+  TransactionMismatch: "transaction_mismatch",
+  AuthorizationNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -110,6 +131,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -778,7 +800,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -889,7 +910,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));

package/dist/bff.d.cts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D-DxoL30.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.cjs';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D-DxoL30.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.js';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.js

@@ -3,7 +3,7 @@ import {
   DEFAULT_BASE_URL,
   JsonHttpClient,
   createSharedTransport
-} from "./chunk-56H66KLG.js";
+} from "./chunk-TWUVXZOT.js";
 import "./chunk-77J4NURK.js";
 
 // src/bff/contracts.ts

package/dist/{chunk-56H66KLG.js → chunk-TWUVXZOT.js}

@@ -10,16 +10,37 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidAuthorizationState: "invalid_authorization_state",
+  TransactionMismatch: "transaction_mismatch",
+  AuthorizationNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -69,6 +90,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -172,7 +194,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -298,7 +319,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));