@authyon/server 0.2.0-beta.12 → 0.2.0-beta.15

package/dist/{authyonServerClient-t82mwTws.d.ts → authyonServerClient-DQzhfaja.d.ts}

@@ -401,14 +401,6 @@ type CreateCredentialInput = CredentialPermissionsInput & {
     description?: string;
     lifetimeDays?: number | null;
 };
-interface CredentialScope {
-    workspaceId: string;
-    environmentId: string;
-    tenantId?: string;
-}
-interface TenantManagementScope extends CredentialScope {
-    tenantId: string;
-}
 interface CredentialCreator {
     id: string | null;
     type: string;
@@ -424,64 +416,6 @@ interface CredentialDetail extends TenantCredentialSummary {
     lifetimeSeconds: number | null;
     accessTokenLifetimeSeconds: number;
 }
-type WorkspaceRole = "admin" | "auditor";
-interface WorkspaceMember {
-    memberId: string | null;
-    userId: string;
-    email: string;
-    name: string;
-    role: string;
-    isOwner: boolean;
-    isSelf: boolean;
-    invitedByName: string | null;
-    joinedAt: string;
-    lastLoginAt: string | null;
-}
-interface WorkspaceInvite {
-    id: string;
-    email: string;
-    role: string;
-    invitedByName: string | null;
-    createdAt: string;
-    expiresAt: string;
-}
-interface WorkspaceTeam {
-    workspaceId: string;
-    workspaceName: string;
-    callerRole: string;
-    canManage: boolean;
-    members: WorkspaceMember[];
-    pendingInvites: WorkspaceInvite[];
-}
-interface InviteWorkspaceMemberInput {
-    email: string;
-    role: WorkspaceRole;
-}
-interface WorkspaceInviteIssued {
-    inviteId: string;
-    email: string;
-    role: string;
-    /** Sensitive bearer link returned at issuance. Do not log or persist in public storage. */
-    acceptUrl: string;
-    expiresAt: string;
-}
-interface WorkspaceInvitePreview {
-    workspaceName: string;
-    email: string;
-    role: string;
-    expiresAt: string;
-    requiresRegistration: boolean;
-}
-interface WorkspaceInviteAccepted {
-    workspaceId: string;
-    workspaceName: string;
-    role: string;
-    accountCreated: boolean;
-}
-interface AcceptWorkspaceInviteInput {
-    name?: string;
-    password?: string;
-}
 interface InviteTenantMemberInput {
     email: string;
     roles?: string[];
@@ -508,51 +442,95 @@ interface JsonRequestOptions {
 
 type ManagementRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
 
-/** Platform user administration. Never falls back to an environment machine token. */
-declare class PlatformScopedClient {
-    #private;
-    /** @hidden */
-    constructor(request: ManagementRequest, token: AccessTokenSource);
-    readonly credentials: {
-        list: (scope: CredentialScope, options?: CredentialListOptions) => Promise<Paged<TenantCredentialSummary>>;
-        get: (scope: CredentialScope, credentialId: string) => Promise<CredentialDetail>;
-        create: (scope: CredentialScope, input: CreateCredentialInput) => Promise<TenantCredentialIssued>;
-        updatePermissions: (scope: CredentialScope, credentialId: string, input: CredentialPermissionsInput) => Promise<void>;
-        updateScopes: (scope: CredentialScope, credentialId: string, scopes: readonly string[]) => Promise<void>;
-        /** Returns a new secret once. API may require an explicit step-up first. */
-        rotate: (scope: CredentialScope, credentialId: string) => Promise<TenantCredentialIssued>;
-        revoke: (scope: CredentialScope, credentialId: string) => Promise<void>;
-    };
-    readonly workspaces: {
-        team: (workspaceId: string) => Promise<WorkspaceTeam>;
-        members: {
-            invite: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
-            /** memberId comes from team.members; it is not the platform userId. */
-            remove: (workspaceId: string, memberId: string) => Promise<void>;
-            changeRole: (workspaceId: string, memberId: string, role: WorkspaceRole) => Promise<void>;
-        };
-        invites: {
-            create: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
-            revoke: (workspaceId: string, inviteId: string) => Promise<void>;
-        };
-    };
-    readonly tenants: {
-        members: {
-            list: (scope: TenantManagementScope, options?: PaginationOptions) => Promise<EnvironmentUser[]>;
-            add: (scope: TenantManagementScope, userId: string, roles?: string[]) => Promise<void>;
-            remove: (scope: TenantManagementScope, userId: string) => Promise<void>;
-        };
-    };
-    readonly auth: {
-        /** Explicitly confirms the current platform session; passwords are not retained. */
-        stepUp: (currentPassword: string) => Promise<void>;
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
+/** Evidence of how the customer proved their identity when approving. */
+interface ApprovalAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
+    id: string;
+    status: ApprovalStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Present once approved. */
+    assurance?: ApprovalAssurance | null;
+}
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
     };
+};
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves it.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
 }
+
 /** End-user operations require a user token and the environment publishable key. */
 declare class UserScopedClient {
     #private;
     /** @hidden */
     constructor(request: ManagementRequest, token: AccessTokenSource);
+    /**
+     * The customer's side of `security.approvals`, for backends (BFF) that hold
+     * the customer's access token: `get`, `webauthnOptions`, `confirm`, `reject`.
+     */
+    readonly security: SubjectSecurity;
     readonly tenants: {
         members: {
             list: (tenantId: string, options?: PaginationOptions) => Promise<TenantMemberPage>;
@@ -562,14 +540,55 @@ declare class UserScopedClient {
         };
     };
 }
-/** Anonymous invite endpoints: the invitation token itself authorizes these requests. */
-declare class WorkspaceInvitesClient {
-    #private;
-    /** @hidden */
-    constructor(request: ManagementRequest);
-    preview(token: string): Promise<WorkspaceInvitePreview>;
-    accept(token: string, input?: AcceptWorkspaceInviteInput): Promise<WorkspaceInviteAccepted>;
+
+/** `security.approvals.create()` — something awaiting the customer's approval. */
+interface CreateApprovalInput {
+    /** Environment user who must approve. */
+    subjectId: string;
+    /** Any JSON object (up to 16 KiB) describing what is being approved. Default `{}`. */
+    payload?: ApprovalPayload;
+    /** Restrict approval to a session in this tenant. */
+    tenantId?: string;
+    /** Lifetime in seconds, clamped to 60–600. Default 300. */
+    expiresInSeconds?: number;
+    /**
+     * Optional. Sent as the `Idempotency-Key` header (max 128 chars): retrying
+     * with the same key and payload returns the same approval; the same key
+     * with a different payload fails with `idempotency_conflict`.
+     */
+    idempotencyKey?: string;
 }
+/** `security.approvals.consume()` — single-use redemption result. */
+interface ConsumedApproval {
+    id: string;
+    status: "consumed";
+    consumedAt: string;
+    /** The approved payload — execute exactly this. */
+    payload: ApprovalPayload;
+    payloadHash: string;
+    assurance: ApprovalAssurance | null;
+}
+/** `security.otp.check()` result. */
+type OtpCheckResult = {
+    valid: true;
+    userId: string;
+    /** Always `"otp"` (authenticator app). */
+    method: string;
+    verifiedAt: string;
+} | {
+    valid: false;
+    /**
+     * Wrong codes left before the first consequence: the sign-out (3 in a
+     * row) or the 15-minute lock (5). `0` when the user was just signed out.
+     */
+    attemptsRemaining: number;
+    /**
+     * True when this was the 3rd wrong code in a row (counted across login
+     * 2FA, `security.otp.check` and `security.approvals.confirm`): every
+     * session of the user was ended and they must sign in again.
+     */
+    sessionsRevoked?: boolean;
+};
 
 interface ClientRequestContext {
     /** Real end-user IP, resolved only from infrastructure trusted by the application. */
@@ -682,11 +701,8 @@ declare class AuthyonServerClient {
      * "the token's tenant" rather than one you pass by id.
      */
     tenant(credentials: ClientCredentials): TenantScopedClient;
-    /** Uses only the supplied platform-user access token. */
-    platform(token: AccessTokenSource): PlatformScopedClient;
     /** Uses an end-user token; the configured environment key selects the environment. */
     user(token: AccessTokenSource): UserScopedClient;
-    readonly workspaceInvites: WorkspaceInvitesClient;
     readonly environment: {
         users: {
             /** GET /env/users — paginated list of users in the environment. */
@@ -823,6 +839,38 @@ declare class AuthyonServerClient {
             loginActivity: (params?: PaginationOptions) => Promise<Paged<LoginActivity>>;
         };
     };
+    readonly security: {
+        otp: {
+            /**
+             * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+             * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+             * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+             * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+             * minutes (`rate_limited`).
+             */
+            check: (userId: string, code: string) => Promise<OtpCheckResult>;
+        };
+        /**
+         * The customer approves a payload with their authenticator code or
+         * passkey, once.
+         *
+         * 1. `create()` the approval with the payload and the customer.
+         * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+         * 3. `consume()` it right before executing, and execute the returned payload.
+         */
+        approvals: {
+            /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
+            create: (input: CreateApprovalInput) => Promise<Approval>;
+            /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+            get: (id: string) => Promise<Approval>;
+            /**
+             * POST /env/authorizations/{id}/consume — redeems an approved approval
+             * exactly once and returns the approved payload. Pass `payload` to have
+             * the API check it matches (`payload_mismatch` otherwise).
+             */
+            consume: (id: string, payload?: ApprovalPayload) => Promise<ConsumedApproval>;
+        };
+    };
     readonly permissions: {
         /** POST /users/{userId}/permissions — grant a permission directly to a user. */
         grant: (userId: string, permission: string) => Promise<void>;
@@ -897,4 +945,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type TenantMemberPage as $, AuthyonServerClient as A, type Organization as B, type ClientCredentials as C, type PaginationOptions as D, type EnvironmentUser as E, FetchHttpAdapter as F, type Permission as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type PermissionsByRole as K, LoggingHttpAdapter as L, PlatformScopedClient as M, type Role as N, type OpenIdConfiguration as O, type Paged as P, type RoleGrant as Q, type ReservedPermissions as R, type RoleInput as S, type RoleList as T, type RolePermissions as U, type SafeJwtAlgorithm as V, type TenantClientValidationResult as W, type TenantCredentialIssued as X, type TenantCredentialSummary as Y, type TenantManagementScope as Z, type TenantMember as _, type HttpLoggerOptions as a, type TenantMembership as a0, TenantScopedClient as a1, type TokenResult as a2, TokenVerificationError as a3, type TokenVerificationErrorCode as a4, type UpdateOrganizationInput as a5, type User as a6, UserScopedClient as a7, type ValidateResult as a8, type VerifiedAccessToken as a9, type WorkspaceInvite as aa, type WorkspaceInviteAccepted as ab, type WorkspaceInviteIssued as ac, type WorkspaceInvitePreview as ad, WorkspaceInvitesClient as ae, type WorkspaceMember as af, type WorkspaceRole as ag, type WorkspaceTeam as ah, createClient as ai, normalizeClientIp as aj, type AcceptWorkspaceInviteInput as b, type AccessTokenSource as c, type AuditEvent as d, type AuthyonJwksDiscoveryOptions as e, type AuthyonJwtClaims as f, type AuthyonServerClientOptions as g, type ClientRequestContext as h, type CreateCredentialInput as i, type CreateOrganizationInput as j, type CreatePermissionInput as k, type CreateTenantCredentialInput as l, type CreateUserInput as m, type CredentialCreator as n, type CredentialDetail as o, type CredentialListOptions as p, type CredentialPermissionsInput as q, type CredentialScope as r, type HttpAdapterRequest as s, type HttpLogEvent as t, type HttpLogger as u, type InviteTenantMemberInput as v, type InviteWorkspaceMemberInput as w, JwksTokenVerifier as x, type JwksTokenVerifierOptions as y, type LoginActivity as z };
+export { type SubjectApprovals as $, AuthyonServerClient as A, type HttpLogger as B, type ClientCredentials as C, type InviteTenantMemberInput as D, type EnvironmentUser as E, FetchHttpAdapter as F, JwksTokenVerifier as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type JwksTokenVerifierOptions as K, LoggingHttpAdapter as L, type LoginActivity as M, type Organization as N, type OpenIdConfiguration as O, type OtpCheckResult as P, type Paged as Q, type PaginationOptions as R, type Permission as S, type PermissionsByRole as T, type ReservedPermissions as U, type Role as V, type RoleGrant as W, type RoleInput as X, type RoleList as Y, type RolePermissions as Z, type SafeJwtAlgorithm as _, type HttpLoggerOptions as a, type SubjectSecurity as a0, type TenantClientValidationResult as a1, type TenantCredentialIssued as a2, type TenantCredentialSummary as a3, type TenantMember as a4, type TenantMemberPage as a5, type TenantMembership as a6, TenantScopedClient as a7, type TokenResult as a8, TokenVerificationError as a9, type TokenVerificationErrorCode as aa, type UpdateOrganizationInput as ab, type User as ac, UserScopedClient as ad, type ValidateResult as ae, type VerifiedAccessToken as af, createClient as ag, normalizeClientIp as ah, type AccessTokenSource as b, type Approval as c, type ApprovalAssurance as d, type ApprovalPayload as e, type ApprovalStatus as f, type ApprovalWebAuthnOptions as g, type AuditEvent as h, type AuthyonJwksDiscoveryOptions as i, type AuthyonJwtClaims as j, type AuthyonServerClientOptions as k, type ClientRequestContext as l, type ConfirmApprovalInput as m, type ConsumedApproval as n, type CreateApprovalInput as o, type CreateCredentialInput as p, type CreateOrganizationInput as q, type CreatePermissionInput as r, type CreateTenantCredentialInput as s, type CreateUserInput as t, type CredentialCreator as u, type CredentialDetail as v, type CredentialListOptions as w, type CredentialPermissionsInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };

package/dist/bff.cjs

@@ -51,16 +51,44 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -110,6 +138,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -778,7 +807,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -889,7 +917,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));

package/dist/bff.d.cts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.cjs';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.js';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.js

@@ -3,7 +3,7 @@ import {
   DEFAULT_BASE_URL,
   JsonHttpClient,
   createSharedTransport
-} from "./chunk-56H66KLG.js";
+} from "./chunk-WPPEV5BA.js";
 import "./chunk-77J4NURK.js";
 
 // src/bff/contracts.ts

package/dist/{chunk-56H66KLG.js → chunk-WPPEV5BA.js}

@@ -10,16 +10,44 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -69,6 +97,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -172,7 +201,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -298,7 +326,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));