@finueva/auth 0.18.0 → 0.19.0

package/dist/device.js

@@ -198,347 +198,31 @@ const messages = {
 	platform_target_unavailable: "The platform administration target is unavailable.",
 	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
 	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable."
-};
-var AuthError = class extends Error {
-	code;
-	status;
-	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
-		super(messages[code]);
-		this.name = "AuthError";
-		this.code = code;
-		this.status = status;
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-};
-//#endregion
-//#region src/user-api/credential.ts
-function userApiApplication(input) {
-	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
-	return input.applicationId;
-}
-function normalizeUserApiCredential(value, startedAt) {
-	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
-	return {
-		tokenType: "Bearer",
-		token: value.token,
-		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
-	};
-}
-function createUserApiCredentialCache(issue, now) {
-	let generation = 0;
-	let cached;
-	let pending;
-	const copy = (value) => ({
-		...value,
-		expiresAt: new Date(value.expiresAt)
-	});
-	return {
-		hasAuthority: () => Boolean(cached || pending),
-		clear() {
-			generation += 1;
-			cached = void 0;
-			pending = void 0;
-		},
-		async get(input) {
-			const applicationId = userApiApplication(input);
-			if (pending) {
-				if (pending.applicationId !== applicationId) throw new AuthError("state_conflict", 409);
-				return copy(await pending.request);
-			}
-			const startedAt = now();
-			if (!input.forceRefresh && cached?.applicationId === applicationId && cached.expiresAt - startedAt > 12e4) return {
-				tokenType: "Bearer",
-				token: cached.token,
-				expiresAt: new Date(cached.expiresAt)
-			};
-			cached = void 0;
-			const epoch = generation;
-			const request = (async () => {
-				const value = normalizeUserApiCredential(await issue(applicationId), startedAt);
-				if (epoch !== generation) throw new AuthError("state_conflict", 409);
-				if (now() < startedAt || value.expiresAt.getTime() <= now()) throw new AuthError("authentication_required", 401);
-				cached = {
-					applicationId,
-					token: value.token,
-					expiresAt: value.expiresAt.getTime()
-				};
-				return value;
-			})().finally(() => {
-				if (pending?.request === request) pending = void 0;
-			});
-			pending = {
-				applicationId,
-				request
-			};
-			return copy(await request);
-		}
-	};
-}
-//#endregion
-//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
-const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
-const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
-const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
-function jsonParseTransform(key, value) {
-	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
-		warnKeyDropped(key);
-		return;
-	}
-	return value;
-}
-function warnKeyDropped(key) {
-	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
-}
-function destr(value, options = {}) {
-	if (typeof value !== "string") return value;
-	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
-	const _value = value.trim();
-	if (_value.length <= 9) switch (_value.toLowerCase()) {
-		case "true": return true;
-		case "false": return false;
-		case "undefined": return;
-		case "null": return null;
-		case "nan": return NaN;
-		case "infinity": return Number.POSITIVE_INFINITY;
-		case "-infinity": return Number.NEGATIVE_INFINITY;
-	}
-	if (!JsonSigRx.test(value)) {
-		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
-		return value;
-	}
-	try {
-		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
-			if (options.strict) throw new Error("[destr] Possible prototype pollution");
-			return JSON.parse(value, jsonParseTransform);
-		}
-		return JSON.parse(value);
-	} catch (error) {
-		if (options.strict) throw error;
-		return value;
-	}
-}
-//#endregion
-//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
-var FetchError = class extends Error {
-	constructor(message, opts) {
-		super(message, opts);
-		this.name = "FetchError";
-		if (opts?.cause && !this.cause) this.cause = opts.cause;
-	}
-};
-function createFetchError(ctx) {
-	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
-	const method = ctx.request?.method || ctx.options?.method || "GET";
-	const url = ctx.request?.url || String(ctx.request) || "/";
-	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
-	for (const key of [
-		"request",
-		"options",
-		"response"
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx[key];
-	} });
-	for (const [key, refKey] of [
-		["data", "_data"],
-		["status", "status"],
-		["statusCode", "status"],
-		["statusText", "statusText"],
-		["statusMessage", "statusText"]
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx.response && ctx.response[refKey];
-	} });
-	return fetchError;
-}
-const payloadMethods = new Set(Object.freeze([
-	"PATCH",
-	"POST",
-	"PUT",
-	"DELETE"
-]));
-function isPayloadMethod(method = "GET") {
-	return payloadMethods.has(method.toUpperCase());
-}
-function isJSONSerializable(value) {
-	if (value === void 0) return false;
-	const t = typeof value;
-	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
-	if (t !== "object") return false;
-	if (Array.isArray(value)) return true;
-	if (value.buffer) return false;
-	if (value instanceof FormData || value instanceof URLSearchParams) return false;
-	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
-}
-const textTypes = new Set([
-	"image/svg",
-	"application/xml",
-	"application/xhtml",
-	"application/html"
-]);
-const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
-function detectResponseType(_contentType = "") {
-	if (!_contentType) return "json";
-	const contentType = _contentType.split(";").shift() || "";
-	if (JSON_RE.test(contentType)) return "json";
-	if (contentType === "text/event-stream") return "stream";
-	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
-	return "blob";
-}
-function resolveFetchOptions(request, input, defaults, Headers) {
-	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
-	let query;
-	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
-		...defaults?.params,
-		...defaults?.query,
-		...input?.params,
-		...input?.query
-	};
-	return {
-		...defaults,
-		...input,
-		query,
-		params: query,
-		headers
-	};
-}
-function mergeHeaders(input, defaults, Headers) {
-	if (!defaults) return new Headers(input);
-	const headers = new Headers(defaults);
-	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
-	return headers;
-}
-async function callHooks(context, hooks) {
-	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
-	else await hooks(context);
-}
-const retryStatusCodes = new Set([
-	408,
-	409,
-	425,
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-const nullBodyResponses = new Set([
-	101,
-	204,
-	205,
-	304
-]);
-function createFetch(globalOptions = {}) {
-	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
-	async function onError(context) {
-		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
-		if (context.options.retry !== false && !isAbort) {
-			let retries;
-			if (typeof context.options.retry === "number") retries = context.options.retry;
-			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
-			const responseCode = context.response && context.response.status || 500;
-			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
-				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
-				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
-				return $fetchRaw(context.request, {
-					...context.options,
-					retry: retries - 1
-				});
-			}
-		}
-		const error = createFetchError(context);
-		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
-		throw error;
-	}
-	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
-		const context = {
-			request: _request,
-			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
-			response: void 0,
-			error: void 0
-		};
-		if (context.options.method) context.options.method = context.options.method.toUpperCase();
-		if (context.options.onRequest) {
-			await callHooks(context, context.options.onRequest);
-			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
-		}
-		if (typeof context.request === "string") {
-			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
-			if (context.options.query) {
-				context.request = withQuery(context.request, context.options.query);
-				delete context.options.query;
-			}
-			if ("query" in context.options) delete context.options.query;
-			if ("params" in context.options) delete context.options.params;
-		}
-		if (context.options.body && isPayloadMethod(context.options.method)) {
-			if (isJSONSerializable(context.options.body)) {
-				const contentType = context.options.headers.get("content-type");
-				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
-				if (!contentType) context.options.headers.set("content-type", "application/json");
-				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
-			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
-				if (!("duplex" in context.options)) context.options.duplex = "half";
-			}
-		}
-		let abortTimeout;
-		if (!context.options.signal && context.options.timeout) {
-			const controller = new AbortController();
-			abortTimeout = setTimeout(() => {
-				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
-				error.name = "TimeoutError";
-				error.code = 23;
-				controller.abort(error);
-			}, context.options.timeout);
-			context.options.signal = controller.signal;
-		}
-		try {
-			context.response = await fetch(context.request, context.options);
-		} catch (error) {
-			context.error = error;
-			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
-			return await onError(context);
-		} finally {
-			if (abortTimeout) clearTimeout(abortTimeout);
-		}
-		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
-			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
-			switch (responseType) {
-				case "json": {
-					const data = await context.response.text();
-					const parseFunction = context.options.parseResponse || destr;
-					context.response._data = parseFunction(data);
-					break;
-				}
-				case "stream":
-					context.response._data = context.response.body || context.response._bodyInit;
-					break;
-				default: context.response._data = await context.response[responseType]();
-			}
-		}
-		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
-		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
-			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
-			return await onError(context);
-		}
-		return context.response;
-	};
-	const $fetch = async function $fetch2(request, options) {
-		return (await $fetchRaw(request, options))._data;
-	};
-	$fetch.raw = $fetchRaw;
-	$fetch.native = (...args) => fetch(...args);
-	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
-		...globalOptions,
-		...customGlobalOptions,
-		defaults: {
-			...globalOptions.defaults,
-			...customGlobalOptions.defaults,
-			...defaultOptions
-		}
-	});
-	return $fetch;
-}
+	identity_authority_unavailable: "Authentication is temporarily unavailable.",
+	two_factor_required: "A second authentication factor is required.",
+	two_factor_code_invalid: "The verification code is invalid.",
+	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
+	two_factor_locked: "Second-factor verification is temporarily locked.",
+	recent_sign_in_required: "A recent sign-in is required.",
+	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
+	recent_authentication_required: "A ready recent-authentication action is required.",
+	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
+	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
+	ceremony_return_refused: "The return address is not registered for this application.",
+	password_sign_in_required: "A password sign-in method is required for this passkey change."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	constructor(code, status, retryAfterSeconds) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
 //#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
@@ -654,7 +338,7 @@ function normalizeIdInput(value) {
 	return value;
 }
 function normalizeOrganization(value) {
-	exact(value, [
+	exact$2(value, [
 		"capabilities",
 		"id",
 		"lifecycle",
@@ -664,7 +348,7 @@ function normalizeOrganization(value) {
 		"slug"
 	]);
 	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
-	exact(value.capabilities, [
+	exact$2(value.capabilities, [
 		"readInvitations",
 		"readMembers",
 		"readTeams"
@@ -726,7 +410,7 @@ function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganization(value) {
-	exact(value, [
+	exact$2(value, [
 		"id",
 		"name",
 		"slug"
@@ -746,7 +430,7 @@ function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganizationTeam(value) {
-	exact(value, ["id", "name"]);
+	exact$2(value, ["id", "name"]);
 	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -773,7 +457,7 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 	};
 }
 function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact(value, ["expiresAt", "id"]);
+	exact$2(value, ["expiresAt", "id"]);
 	if (!isId(value.id)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -781,7 +465,7 @@ function normalizeCreatedOrganizationMemberInvitation(value) {
 	};
 }
 function normalizeOrganizations(value) {
-	exact(value, ["nextCursor", "organizations"]);
+	exact$2(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
 		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
@@ -789,11 +473,11 @@ function normalizeOrganizations(value) {
 	};
 }
 function normalizeOrganizationMembers(value) {
-	exact(value, ["members", "nextCursor"]);
+	exact$2(value, ["members", "nextCursor"]);
 	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
 		members: unique(value.members.map((member) => {
-			exact(member, [
+			exact$2(member, [
 				"email",
 				"id",
 				"image",
@@ -822,11 +506,11 @@ function normalizeOrganizationMembers(value) {
 	};
 }
 function normalizeOrganizationTeams(value) {
-	exact(value, ["nextCursor", "teams"]);
+	exact$2(value, ["nextCursor", "teams"]);
 	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
 		teams: unique(value.teams.map((team) => {
-			exact(team, [
+			exact$2(team, [
 				"category",
 				"createdAt",
 				"id",
@@ -844,7 +528,7 @@ function normalizeOrganizationTeams(value) {
 	};
 }
 function normalizeOrganizationTeamMembers(value) {
-	exact(value, ["memberIds", "nextCursor"]);
+	exact$2(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
 		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
@@ -852,7 +536,7 @@ function normalizeOrganizationTeamMembers(value) {
 	};
 }
 function normalizeOrganizationInvitation(value) {
-	exact(value, [
+	exact$2(value, [
 		"createdAt",
 		"email",
 		"expiresAt",
@@ -863,7 +547,7 @@ function normalizeOrganizationInvitation(value) {
 		"teamIds"
 	]);
 	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
-	exact(value.inviter, ["membershipId", "name"]);
+	exact$2(value.inviter, ["membershipId", "name"]);
 	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -880,7 +564,7 @@ function normalizeOrganizationInvitation(value) {
 	};
 }
 function normalizeOrganizationInvitations(value) {
-	exact(value, ["invitations", "nextCursor"]);
+	exact$2(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
@@ -888,7 +572,7 @@ function normalizeOrganizationInvitations(value) {
 	};
 }
 function normalizeReceivedInvitation(value) {
-	exact(value, [
+	exact$2(value, [
 		"expiresAt",
 		"id",
 		"inviterName",
@@ -897,7 +581,7 @@ function normalizeReceivedInvitation(value) {
 		"teams"
 	]);
 	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
-	exact(value.organization, [
+	exact$2(value.organization, [
 		"id",
 		"logo",
 		"name",
@@ -914,7 +598,7 @@ function normalizeReceivedInvitation(value) {
 		},
 		role: value.role,
 		teams: unique(value.teams.map((team) => {
-			exact(team, ["id", "name"]);
+			exact$2(team, ["id", "name"]);
 			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
 			return {
 				id: team.id,
@@ -926,7 +610,7 @@ function normalizeReceivedInvitation(value) {
 	};
 }
 function normalizeReceivedInvitations(value) {
-	exact(value, ["invitations", "nextCursor"]);
+	exact$2(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
@@ -984,8 +668,35 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function normalizeOrganizationClosureStartInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "confirmationName,idempotencyKey") throw new TypeError("organization closure input is invalid");
+	if (!boundedString(value.confirmationName, 255)) throw new TypeError("confirmationName is invalid");
+	return {
+		confirmationName: value.confirmationName,
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
+function normalizeOrganizationClosureCancelInput(value) {
+	if (!isObject(value) || Object.keys(value).join(",") !== "idempotencyKey") throw new TypeError("organization closure cancellation input is invalid");
+	return { idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey) };
+}
+function normalizeOrganizationOwnershipTransferInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "expectedActorAuthorityRevision,expectedOutgoingOwnerAuthorityRevision,expectedSuccessorAuthorityRevision,idempotencyKey,outgoingOwnerMembershipId,outgoingOwnerRole,successorMembershipId") throw new TypeError("organization ownership transfer input is invalid");
+	if (!isId(value.outgoingOwnerMembershipId) || !isId(value.successorMembershipId)) throw new TypeError("ownership transfer membership is invalid");
+	if (value.outgoingOwnerMembershipId === value.successorMembershipId) throw new TypeError("ownership transfer memberships must differ");
+	if (value.outgoingOwnerRole !== "admin" && value.outgoingOwnerRole !== "member") throw new TypeError("outgoingOwnerRole is invalid");
+	return {
+		outgoingOwnerMembershipId: value.outgoingOwnerMembershipId,
+		successorMembershipId: value.successorMembershipId,
+		outgoingOwnerRole: value.outgoingOwnerRole,
+		expectedActorAuthorityRevision: normalizeAuthorityRevision(value.expectedActorAuthorityRevision, "expectedActorAuthorityRevision"),
+		expectedOutgoingOwnerAuthorityRevision: normalizeAuthorityRevision(value.expectedOutgoingOwnerAuthorityRevision, "expectedOutgoingOwnerAuthorityRevision", true),
+		expectedSuccessorAuthorityRevision: normalizeAuthorityRevision(value.expectedSuccessorAuthorityRevision, "expectedSuccessorAuthorityRevision", true),
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
 function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact(value, [
+	exact$2(value, [
 		"organizationId",
 		"actor",
 		"target"
@@ -1003,7 +714,7 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 	};
 }
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact(value, [
+	exact$2(value, [
 		"memberId",
 		"manualRole",
 		"role",
@@ -1018,10 +729,18 @@ function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = fal
 		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
 	};
 }
+function normalizeAuthorityRevision(value, name, incremented = false) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER - (incremented ? 1 : 0)) throw new TypeError(`${name} is invalid`);
+	return value;
+}
 function normalizeAuthorityResultRevision(value) {
 	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
 	return value;
 }
+function normalizeAuthorityIdempotencyKey(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value)) throw new TypeError("idempotencyKey is invalid");
+	return value;
+}
 function mapError(code, status) {
 	if (code === "authentication_required") return {
 		code,
@@ -1096,7 +815,7 @@ function normalizeProfileImage(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
-function exact(value, keys) {
+function exact$2(value, keys) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
 function boundedString(value, maximum) {
@@ -1132,12 +851,361 @@ function normalizeResponseId(value) {
 	if (!isId(value)) throw authorityUnavailable();
 	return value;
 }
-function unique(items, key) {
-	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
-	return items;
+function unique(items, key) {
+	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
+	return items;
+}
+function credentialSessionId(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return void 0;
+	try {
+		const base64 = parts[1].replaceAll("-", "+").replaceAll("_", "/");
+		const decoded = atob(base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "="));
+		const payload = JSON.parse(decoded);
+		return isObject(payload) && typeof payload.sid === "string" && payload.sid.length > 0 ? payload.sid : void 0;
+	} catch {
+		return;
+	}
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/user-api/credential.ts
+function userApiApplication(input) {
+	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
+	return input.applicationId;
+}
+function normalizeUserApiCredential(value, startedAt) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
+	};
+}
+function createUserApiCredentialCache(issue, now, currentSessionId = () => void 0) {
+	let generation = 0;
+	let cached;
+	let pending;
+	const copy = (value) => ({
+		...value,
+		expiresAt: new Date(value.expiresAt)
+	});
+	return {
+		hasAuthority: () => Boolean(cached || pending),
+		retainSession(sessionId) {
+			if (cached?.sessionId === sessionId && !pending) return;
+			generation += 1;
+			cached = void 0;
+			pending = void 0;
+		},
+		clear() {
+			generation += 1;
+			cached = void 0;
+			pending = void 0;
+		},
+		async get(input) {
+			const applicationId = userApiApplication(input);
+			if (pending) {
+				if (pending.applicationId !== applicationId) throw new AuthError("state_conflict", 409);
+				return copy(await pending.request);
+			}
+			const startedAt = now();
+			if (!input.forceRefresh && cached?.applicationId === applicationId && cached.expiresAt - startedAt > 12e4) return {
+				tokenType: "Bearer",
+				token: cached.token,
+				expiresAt: new Date(cached.expiresAt)
+			};
+			cached = void 0;
+			const epoch = generation;
+			const request = (async () => {
+				const value = normalizeUserApiCredential(await issue(applicationId), startedAt);
+				if (epoch !== generation) throw new AuthError("state_conflict", 409);
+				if (now() < startedAt || value.expiresAt.getTime() <= now()) throw new AuthError("authentication_required", 401);
+				const sessionId = credentialSessionId(value.token);
+				const observed = currentSessionId();
+				if (observed !== void 0 && sessionId !== void 0 && sessionId !== observed) throw new AuthError("authentication_required", 401);
+				cached = {
+					applicationId,
+					token: value.token,
+					expiresAt: value.expiresAt.getTime(),
+					sessionId
+				};
+				return value;
+			})().finally(() => {
+				if (pending?.request === request) pending = void 0;
+			});
+			pending = {
+				applicationId,
+				request
+			};
+			return copy(await request);
+		}
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
+}
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
+}
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
+var FetchError = class extends Error {
+	constructor(message, opts) {
+		super(message, opts);
+		this.name = "FetchError";
+		if (opts?.cause && !this.cause) this.cause = opts.cause;
+	}
+};
+function createFetchError(ctx) {
+	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
+	const method = ctx.request?.method || ctx.options?.method || "GET";
+	const url = ctx.request?.url || String(ctx.request) || "/";
+	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
+	for (const key of [
+		"request",
+		"options",
+		"response"
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx[key];
+	} });
+	for (const [key, refKey] of [
+		["data", "_data"],
+		["status", "status"],
+		["statusCode", "status"],
+		["statusText", "statusText"],
+		["statusMessage", "statusText"]
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx.response && ctx.response[refKey];
+	} });
+	return fetchError;
+}
+const payloadMethods = new Set(Object.freeze([
+	"PATCH",
+	"POST",
+	"PUT",
+	"DELETE"
+]));
+function isPayloadMethod(method = "GET") {
+	return payloadMethods.has(method.toUpperCase());
+}
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	if (value instanceof FormData || value instanceof URLSearchParams) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
+}
+const textTypes = new Set([
+	"image/svg",
+	"application/xml",
+	"application/xhtml",
+	"application/html"
+]);
+const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(_contentType = "") {
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (contentType === "text/event-stream") return "stream";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
+}
+function resolveFetchOptions(request, input, defaults, Headers) {
+	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
+	let query;
+	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
+		...defaults?.params,
+		...defaults?.query,
+		...input?.params,
+		...input?.query
+	};
+	return {
+		...defaults,
+		...input,
+		query,
+		params: query,
+		headers
+	};
+}
+function mergeHeaders(input, defaults, Headers) {
+	if (!defaults) return new Headers(input);
+	const headers = new Headers(defaults);
+	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
+	return headers;
+}
+async function callHooks(context, hooks) {
+	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+	else await hooks(context);
 }
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+const retryStatusCodes = new Set([
+	408,
+	409,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const nullBodyResponses = new Set([
+	101,
+	204,
+	205,
+	304
+]);
+function createFetch(globalOptions = {}) {
+	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
+	async function onError(context) {
+		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
+		if (context.options.retry !== false && !isAbort) {
+			let retries;
+			if (typeof context.options.retry === "number") retries = context.options.retry;
+			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
+			const responseCode = context.response && context.response.status || 500;
+			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
+				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
+				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
+				return $fetchRaw(context.request, {
+					...context.options,
+					retry: retries - 1
+				});
+			}
+		}
+		const error = createFetchError(context);
+		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
+		throw error;
+	}
+	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
+		const context = {
+			request: _request,
+			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
+			response: void 0,
+			error: void 0
+		};
+		if (context.options.method) context.options.method = context.options.method.toUpperCase();
+		if (context.options.onRequest) {
+			await callHooks(context, context.options.onRequest);
+			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
+		}
+		if (typeof context.request === "string") {
+			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
+			if (context.options.query) {
+				context.request = withQuery(context.request, context.options.query);
+				delete context.options.query;
+			}
+			if ("query" in context.options) delete context.options.query;
+			if ("params" in context.options) delete context.options.params;
+		}
+		if (context.options.body && isPayloadMethod(context.options.method)) {
+			if (isJSONSerializable(context.options.body)) {
+				const contentType = context.options.headers.get("content-type");
+				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
+				if (!contentType) context.options.headers.set("content-type", "application/json");
+				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
+			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
+				if (!("duplex" in context.options)) context.options.duplex = "half";
+			}
+		}
+		let abortTimeout;
+		if (!context.options.signal && context.options.timeout) {
+			const controller = new AbortController();
+			abortTimeout = setTimeout(() => {
+				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
+				error.name = "TimeoutError";
+				error.code = 23;
+				controller.abort(error);
+			}, context.options.timeout);
+			context.options.signal = controller.signal;
+		}
+		try {
+			context.response = await fetch(context.request, context.options);
+		} catch (error) {
+			context.error = error;
+			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
+			return await onError(context);
+		} finally {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
+			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
+			switch (responseType) {
+				case "json": {
+					const data = await context.response.text();
+					const parseFunction = context.options.parseResponse || destr;
+					context.response._data = parseFunction(data);
+					break;
+				}
+				case "stream":
+					context.response._data = context.response.body || context.response._bodyInit;
+					break;
+				default: context.response._data = await context.response[responseType]();
+			}
+		}
+		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
+		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
+			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
+			return await onError(context);
+		}
+		return context.response;
+	};
+	const $fetch = async function $fetch2(request, options) {
+		return (await $fetchRaw(request, options))._data;
+	};
+	$fetch.raw = $fetchRaw;
+	$fetch.native = (...args) => fetch(...args);
+	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
+		...globalOptions,
+		...customGlobalOptions,
+		defaults: {
+			...globalOptions.defaults,
+			...customGlobalOptions.defaults,
+			...defaultOptions
+		}
+	});
+	return $fetch;
 }
 //#endregion
 //#region src/http.ts
@@ -1208,6 +1276,237 @@ async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
 	}
 }
 //#endregion
+//#region src/two-factor.ts
+function isTwoFactorChallenge(value) {
+	return isObject(value) && value.twoFactorRedirect === true;
+}
+function normalizeTwoFactorStatus(value) {
+	if (value === null) throw new AuthError("authentication_required", 401);
+	if (!isObject(value) || !isObject(value.user) || typeof value.user.twoFactorEnabled !== "boolean") throw authorityUnavailable();
+	return { enabled: value.user.twoFactorEnabled };
+}
+//#endregion
+//#region src/sessions.ts
+const idPattern$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const MAX_SESSIONS = 50;
+const itemKeys$1 = [
+	"createdAt",
+	"current",
+	"expiresAt",
+	"id",
+	"ipAddress",
+	"updatedAt",
+	"userAgent"
+];
+function exact$1(value, keys) {
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function date$1(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable();
+	return parsed;
+}
+function text(value, maximum) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length === 0 || value.length > maximum || /[^\x20-\x7e]/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeSessionId(value) {
+	if (typeof value !== "string" || !idPattern$1.test(value)) throw new TypeError("sessionId is invalid");
+	return value;
+}
+function normalizeSessionSummary(value) {
+	if (!exact$1(value, itemKeys$1) || typeof value.id !== "string" || !idPattern$1.test(value.id)) throw authorityUnavailable();
+	if (typeof value.current !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		current: value.current,
+		createdAt: date$1(value.createdAt),
+		updatedAt: date$1(value.updatedAt),
+		expiresAt: date$1(value.expiresAt),
+		userAgent: text(value.userAgent, 512),
+		ipAddress: text(value.ipAddress, 64)
+	};
+}
+function normalizeSessionInventory(value) {
+	if (!exact$1(value, ["sessions", "truncated"]) || !Array.isArray(value.sessions) || value.sessions.length > MAX_SESSIONS || typeof value.truncated !== "boolean") throw authorityUnavailable();
+	const sessions = value.sessions.map(normalizeSessionSummary);
+	if (new Set(sessions.map((session) => session.id)).size !== sessions.length) throw authorityUnavailable();
+	if (sessions.filter((session) => session.current).length !== 1) throw authorityUnavailable();
+	return {
+		sessions,
+		truncated: value.truncated
+	};
+}
+function normalizeSessionRevocation(value) {
+	if (!exact$1(value, ["status"]) || value.status !== "revoked") throw authorityUnavailable();
+}
+function normalizeOtherSessionRevocation(value) {
+	if (!exact$1(value, ["revoked"]) || !Number.isSafeInteger(value.revoked) || value.revoked < 0) throw authorityUnavailable();
+	return { revoked: value.revoked };
+}
+function fromSessionInventoryError(_value, status, retryAfter) {
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404 || status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+//#endregion
+//#region src/passkeys.ts
+const idPattern = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const MAX_PASSKEYS = 50;
+const MAX_RETURN_BYTES = 2048;
+const PASSKEY_NAME_MAX_LENGTH = 64;
+const itemKeys = [
+	"backedUp",
+	"createdAt",
+	"deviceType",
+	"id",
+	"name"
+];
+function exact(value, keys) {
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function date(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable();
+	return parsed;
+}
+function returnInput(value) {
+	if (!isObject(value)) throw new TypeError("ceremony input is invalid");
+	const { applicationId, returnTo } = value;
+	if (typeof applicationId !== "string" || !idPattern.test(applicationId)) throw new TypeError("applicationId is invalid");
+	if (typeof returnTo !== "string" || new TextEncoder().encode(returnTo).byteLength > MAX_RETURN_BYTES || !URL.canParse(returnTo) || new URL(returnTo).toString() !== returnTo) throw new TypeError("returnTo is invalid");
+	return {
+		applicationId,
+		returnTo
+	};
+}
+function normalizeCeremonyHandoffInput(value) {
+	const base = returnInput(value);
+	const input = value;
+	switch (input.purpose) {
+		case "passkey_enrollment": return {
+			purpose: input.purpose,
+			...base
+		};
+		case "passkey_removal": return {
+			purpose: input.purpose,
+			...base,
+			passkeyId: normalizePasskeyId(input.passkeyId)
+		};
+		case "recent_authentication": {
+			const request = input.request;
+			if (!isObject(request)) throw new TypeError("request is invalid");
+			const organizationId = normalizeIdInput(request.organizationId);
+			if (request.action === "organization_ownership_transfer") {
+				const { action: _action, organizationId: _organizationId, ...transfer } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationOwnershipTransferInput(transfer)
+					}
+				};
+			}
+			if (request.action === "organization_closure_start") {
+				const { action: _action, organizationId: _organizationId, ...closure } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationClosureStartInput(closure)
+					}
+				};
+			}
+			if (request.action === "organization_closure_cancel") {
+				const { action: _action, organizationId: _organizationId, ...closure } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationClosureCancelInput(closure)
+					}
+				};
+			}
+			throw new TypeError("request action is invalid");
+		}
+		default: throw new TypeError("purpose is invalid");
+	}
+}
+function normalizeCeremonyHandoff(value) {
+	if (!exact(value, ["expiresAt", "url"]) || typeof value.url !== "string") throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value.url);
+	} catch {
+		throw authorityUnavailable();
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost");
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/api/v1/auth/ceremony/start" || url.search || !/^#code=[A-Za-z0-9_-]{43}$/.test(url.hash)) throw authorityUnavailable();
+	return {
+		url: url.toString(),
+		expiresAt: date(value.expiresAt)
+	};
+}
+function normalizePasskeyId(value) {
+	if (typeof value !== "string" || !idPattern.test(value)) throw new TypeError("passkeyId is invalid");
+	return value;
+}
+function normalizePasskeyName(value) {
+	if (typeof value !== "string") throw new TypeError("name is invalid");
+	const name = value.trim();
+	if (!name || name.length > PASSKEY_NAME_MAX_LENGTH || /[\p{Cc}\p{Cf}]/u.test(name)) throw new TypeError("name is invalid");
+	return name;
+}
+function normalizePasskeySummary(value) {
+	if (!exact(value, itemKeys) || typeof value.id !== "string" || !idPattern.test(value.id)) throw authorityUnavailable();
+	if (value.name !== null && (typeof value.name !== "string" || value.name.length > PASSKEY_NAME_MAX_LENGTH)) throw authorityUnavailable();
+	if (value.deviceType !== "singleDevice" && value.deviceType !== "multiDevice") throw authorityUnavailable();
+	if (typeof value.backedUp !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		createdAt: value.createdAt === null ? null : date(value.createdAt),
+		deviceType: value.deviceType,
+		backedUp: value.backedUp
+	};
+}
+function normalizePasskeyInventory(value) {
+	if (!exact(value, ["passkeys", "truncated"]) || !Array.isArray(value.passkeys) || value.passkeys.length > MAX_PASSKEYS || typeof value.truncated !== "boolean") throw authorityUnavailable();
+	const passkeys = value.passkeys.map(normalizePasskeySummary);
+	if (new Set(passkeys.map((passkey) => passkey.id)).size !== passkeys.length) throw authorityUnavailable();
+	return {
+		passkeys,
+		truncated: value.truncated
+	};
+}
+function normalizePasskeyRename(value) {
+	if (!exact(value, ["status"]) || value.status !== "renamed") throw authorityUnavailable();
+}
+function fromCeremonyHandoffError(value, status, retryAfter) {
+	const code = isObject(value) ? value.code : void 0;
+	if (status === 400 && code === "RETURN_ADDRESS_REFUSED") return new AuthError("ceremony_return_refused", 400);
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404) return new AuthError("state_conflict", 409);
+	if (status === 409 && code === "PASSWORD_REQUIRED") return new AuthError("password_sign_in_required", 409);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+//#endregion
 //#region src/device.ts
 const DEVICE_SCOPE = "openid";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
@@ -1416,6 +1715,34 @@ function createDeviceAuth(options) {
 			mapError: fromAccountAuthorityError
 		});
 	}
+	async function sessionInventoryRequest(method, path, normalize) {
+		const current = await readToken();
+		if (!current) throw new AuthError("authentication_required", 401);
+		return normalize((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/sessions", path), {
+			fetch: requestFetch,
+			timeoutMs,
+			method,
+			credentials: "omit",
+			headers: { authorization: `Bearer ${current.accessToken}` },
+			mapError: fromSessionInventoryError
+		})).value);
+	}
+	async function ceremonyRequest(method, path, body, normalize) {
+		const current = await readToken();
+		if (!current) throw new AuthError("authentication_required", 401);
+		return normalize((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
+			fetch: requestFetch,
+			timeoutMs,
+			method,
+			credentials: "omit",
+			headers: {
+				authorization: `Bearer ${current.accessToken}`,
+				...body ? { "content-type": "application/json" } : {}
+			},
+			...body ? { body } : {},
+			mapError: fromCeremonyHandoffError
+		})).value);
+	}
 	async function revoke(path) {
 		const current = await readToken();
 		if (!current) return;
@@ -1818,9 +2145,60 @@ function createDeviceAuth(options) {
 			}
 			return serializeAuthority(async () => {
 				const previous = await readToken();
-				return replaceIssuedResponse((await accountRequest("sign-in/email", body)).value, previous);
+				const response = await accountRequest("sign-in/email", body);
+				if (isTwoFactorChallenge(response.value)) throw new AuthError("two_factor_required", 401);
+				return replaceIssuedResponse(response.value, previous);
 			}, true);
 		},
+		listSessions() {
+			return serializeAuthority(() => sessionInventoryRequest("GET", "", normalizeSessionInventory));
+		},
+		revokeSession(sessionId) {
+			let id;
+			try {
+				id = normalizeSessionId(sessionId);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				await sessionInventoryRequest("POST", `${id}/revoke`, normalizeSessionRevocation);
+			});
+		},
+		revokeOtherSessions() {
+			return serializeAuthority(() => sessionInventoryRequest("POST", "revoke-others", normalizeOtherSessionRevocation));
+		},
+		createCeremonyHandoff(input) {
+			let body;
+			try {
+				body = normalizeCeremonyHandoffInput(input);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(() => ceremonyRequest("POST", "ceremony-handoffs", body, normalizeCeremonyHandoff));
+		},
+		listPasskeys() {
+			return serializeAuthority(() => ceremonyRequest("GET", "passkeys", void 0, normalizePasskeyInventory));
+		},
+		renamePasskey(passkeyId, name) {
+			let path;
+			let body;
+			try {
+				path = `passkeys/${normalizePasskeyId(passkeyId)}/name`;
+				body = { name: normalizePasskeyName(name) };
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				await ceremonyRequest("POST", path, body, normalizePasskeyRename);
+			});
+		},
+		getTwoFactorStatus() {
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				return normalizeTwoFactorStatus((await authenticated("get-session", current)).value);
+			});
+		},
 		signInWithSocialIdToken(input) {
 			let body;
 			try {