@finueva/auth 0.18.1 → 0.20.0

package/dist/device.js

@@ -178,6 +178,11 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
@@ -198,7 +203,18 @@ const messages = {
 	platform_target_unavailable: "The platform administration target is unavailable.",
 	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
 	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable."
+	identity_authority_unavailable: "Authentication is temporarily unavailable.",
+	two_factor_required: "A second authentication factor is required.",
+	two_factor_code_invalid: "The verification code is invalid.",
+	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
+	two_factor_locked: "Second-factor verification is temporarily locked.",
+	recent_sign_in_required: "A recent sign-in is required.",
+	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
+	recent_authentication_required: "A ready recent-authentication action is required.",
+	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
+	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
+	ceremony_return_refused: "The return address is not registered for this application.",
+	password_sign_in_required: "A password sign-in method is required for this passkey change."
 };
 var AuthError = class extends Error {
 	code;
@@ -327,7 +343,7 @@ function normalizeIdInput(value) {
 	return value;
 }
 function normalizeOrganization(value) {
-	exact(value, [
+	exact$2(value, [
 		"capabilities",
 		"id",
 		"lifecycle",
@@ -337,7 +353,7 @@ function normalizeOrganization(value) {
 		"slug"
 	]);
 	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
-	exact(value.capabilities, [
+	exact$2(value.capabilities, [
 		"readInvitations",
 		"readMembers",
 		"readTeams"
@@ -399,7 +415,7 @@ function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganization(value) {
-	exact(value, [
+	exact$2(value, [
 		"id",
 		"name",
 		"slug"
@@ -419,7 +435,7 @@ function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganizationTeam(value) {
-	exact(value, ["id", "name"]);
+	exact$2(value, ["id", "name"]);
 	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -446,7 +462,7 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 	};
 }
 function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact(value, ["expiresAt", "id"]);
+	exact$2(value, ["expiresAt", "id"]);
 	if (!isId(value.id)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -454,7 +470,7 @@ function normalizeCreatedOrganizationMemberInvitation(value) {
 	};
 }
 function normalizeOrganizations(value) {
-	exact(value, ["nextCursor", "organizations"]);
+	exact$2(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
 		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
@@ -462,11 +478,11 @@ function normalizeOrganizations(value) {
 	};
 }
 function normalizeOrganizationMembers(value) {
-	exact(value, ["members", "nextCursor"]);
+	exact$2(value, ["members", "nextCursor"]);
 	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
 		members: unique(value.members.map((member) => {
-			exact(member, [
+			exact$2(member, [
 				"email",
 				"id",
 				"image",
@@ -495,11 +511,11 @@ function normalizeOrganizationMembers(value) {
 	};
 }
 function normalizeOrganizationTeams(value) {
-	exact(value, ["nextCursor", "teams"]);
+	exact$2(value, ["nextCursor", "teams"]);
 	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
 		teams: unique(value.teams.map((team) => {
-			exact(team, [
+			exact$2(team, [
 				"category",
 				"createdAt",
 				"id",
@@ -517,7 +533,7 @@ function normalizeOrganizationTeams(value) {
 	};
 }
 function normalizeOrganizationTeamMembers(value) {
-	exact(value, ["memberIds", "nextCursor"]);
+	exact$2(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
 		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
@@ -525,7 +541,7 @@ function normalizeOrganizationTeamMembers(value) {
 	};
 }
 function normalizeOrganizationInvitation(value) {
-	exact(value, [
+	exact$2(value, [
 		"createdAt",
 		"email",
 		"expiresAt",
@@ -536,7 +552,7 @@ function normalizeOrganizationInvitation(value) {
 		"teamIds"
 	]);
 	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
-	exact(value.inviter, ["membershipId", "name"]);
+	exact$2(value.inviter, ["membershipId", "name"]);
 	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -553,7 +569,7 @@ function normalizeOrganizationInvitation(value) {
 	};
 }
 function normalizeOrganizationInvitations(value) {
-	exact(value, ["invitations", "nextCursor"]);
+	exact$2(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
@@ -561,7 +577,7 @@ function normalizeOrganizationInvitations(value) {
 	};
 }
 function normalizeReceivedInvitation(value) {
-	exact(value, [
+	exact$2(value, [
 		"expiresAt",
 		"id",
 		"inviterName",
@@ -570,7 +586,7 @@ function normalizeReceivedInvitation(value) {
 		"teams"
 	]);
 	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
-	exact(value.organization, [
+	exact$2(value.organization, [
 		"id",
 		"logo",
 		"name",
@@ -587,7 +603,7 @@ function normalizeReceivedInvitation(value) {
 		},
 		role: value.role,
 		teams: unique(value.teams.map((team) => {
-			exact(team, ["id", "name"]);
+			exact$2(team, ["id", "name"]);
 			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
 			return {
 				id: team.id,
@@ -599,7 +615,7 @@ function normalizeReceivedInvitation(value) {
 	};
 }
 function normalizeReceivedInvitations(value) {
-	exact(value, ["invitations", "nextCursor"]);
+	exact$2(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
@@ -657,8 +673,35 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function normalizeOrganizationClosureStartInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "confirmationName,idempotencyKey") throw new TypeError("organization closure input is invalid");
+	if (!boundedString(value.confirmationName, 255)) throw new TypeError("confirmationName is invalid");
+	return {
+		confirmationName: value.confirmationName,
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
+function normalizeOrganizationClosureCancelInput(value) {
+	if (!isObject(value) || Object.keys(value).join(",") !== "idempotencyKey") throw new TypeError("organization closure cancellation input is invalid");
+	return { idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey) };
+}
+function normalizeOrganizationOwnershipTransferInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "expectedActorAuthorityRevision,expectedOutgoingOwnerAuthorityRevision,expectedSuccessorAuthorityRevision,idempotencyKey,outgoingOwnerMembershipId,outgoingOwnerRole,successorMembershipId") throw new TypeError("organization ownership transfer input is invalid");
+	if (!isId(value.outgoingOwnerMembershipId) || !isId(value.successorMembershipId)) throw new TypeError("ownership transfer membership is invalid");
+	if (value.outgoingOwnerMembershipId === value.successorMembershipId) throw new TypeError("ownership transfer memberships must differ");
+	if (value.outgoingOwnerRole !== "admin" && value.outgoingOwnerRole !== "member") throw new TypeError("outgoingOwnerRole is invalid");
+	return {
+		outgoingOwnerMembershipId: value.outgoingOwnerMembershipId,
+		successorMembershipId: value.successorMembershipId,
+		outgoingOwnerRole: value.outgoingOwnerRole,
+		expectedActorAuthorityRevision: normalizeAuthorityRevision(value.expectedActorAuthorityRevision, "expectedActorAuthorityRevision"),
+		expectedOutgoingOwnerAuthorityRevision: normalizeAuthorityRevision(value.expectedOutgoingOwnerAuthorityRevision, "expectedOutgoingOwnerAuthorityRevision", true),
+		expectedSuccessorAuthorityRevision: normalizeAuthorityRevision(value.expectedSuccessorAuthorityRevision, "expectedSuccessorAuthorityRevision", true),
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
 function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact(value, [
+	exact$2(value, [
 		"organizationId",
 		"actor",
 		"target"
@@ -676,7 +719,7 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 	};
 }
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact(value, [
+	exact$2(value, [
 		"memberId",
 		"manualRole",
 		"role",
@@ -691,10 +734,18 @@ function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = fal
 		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
 	};
 }
+function normalizeAuthorityRevision(value, name, incremented = false) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER - (incremented ? 1 : 0)) throw new TypeError(`${name} is invalid`);
+	return value;
+}
 function normalizeAuthorityResultRevision(value) {
 	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
 	return value;
 }
+function normalizeAuthorityIdempotencyKey(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value)) throw new TypeError("idempotencyKey is invalid");
+	return value;
+}
 function mapError(code, status) {
 	if (code === "authentication_required") return {
 		code,
@@ -769,7 +820,7 @@ function normalizeProfileImage(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
-function exact(value, keys) {
+function exact$2(value, keys) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
 function boundedString(value, maximum) {
@@ -1230,6 +1281,237 @@ async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
 	}
 }
 //#endregion
+//#region src/two-factor.ts
+function isTwoFactorChallenge(value) {
+	return isObject(value) && value.twoFactorRedirect === true;
+}
+function normalizeTwoFactorStatus(value) {
+	if (value === null) throw new AuthError("authentication_required", 401);
+	if (!isObject(value) || !isObject(value.user) || typeof value.user.twoFactorEnabled !== "boolean") throw authorityUnavailable();
+	return { enabled: value.user.twoFactorEnabled };
+}
+//#endregion
+//#region src/sessions.ts
+const idPattern$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const MAX_SESSIONS = 50;
+const itemKeys$1 = [
+	"createdAt",
+	"current",
+	"expiresAt",
+	"id",
+	"ipAddress",
+	"updatedAt",
+	"userAgent"
+];
+function exact$1(value, keys) {
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function date$1(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable();
+	return parsed;
+}
+function text(value, maximum) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length === 0 || value.length > maximum || /[^\x20-\x7e]/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeSessionId(value) {
+	if (typeof value !== "string" || !idPattern$1.test(value)) throw new TypeError("sessionId is invalid");
+	return value;
+}
+function normalizeSessionSummary(value) {
+	if (!exact$1(value, itemKeys$1) || typeof value.id !== "string" || !idPattern$1.test(value.id)) throw authorityUnavailable();
+	if (typeof value.current !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		current: value.current,
+		createdAt: date$1(value.createdAt),
+		updatedAt: date$1(value.updatedAt),
+		expiresAt: date$1(value.expiresAt),
+		userAgent: text(value.userAgent, 512),
+		ipAddress: text(value.ipAddress, 64)
+	};
+}
+function normalizeSessionInventory(value) {
+	if (!exact$1(value, ["sessions", "truncated"]) || !Array.isArray(value.sessions) || value.sessions.length > MAX_SESSIONS || typeof value.truncated !== "boolean") throw authorityUnavailable();
+	const sessions = value.sessions.map(normalizeSessionSummary);
+	if (new Set(sessions.map((session) => session.id)).size !== sessions.length) throw authorityUnavailable();
+	if (sessions.filter((session) => session.current).length !== 1) throw authorityUnavailable();
+	return {
+		sessions,
+		truncated: value.truncated
+	};
+}
+function normalizeSessionRevocation(value) {
+	if (!exact$1(value, ["status"]) || value.status !== "revoked") throw authorityUnavailable();
+}
+function normalizeOtherSessionRevocation(value) {
+	if (!exact$1(value, ["revoked"]) || !Number.isSafeInteger(value.revoked) || value.revoked < 0) throw authorityUnavailable();
+	return { revoked: value.revoked };
+}
+function fromSessionInventoryError(_value, status, retryAfter) {
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404 || status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+//#endregion
+//#region src/passkeys.ts
+const idPattern = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const MAX_PASSKEYS = 50;
+const MAX_RETURN_BYTES = 2048;
+const PASSKEY_NAME_MAX_LENGTH = 64;
+const itemKeys = [
+	"backedUp",
+	"createdAt",
+	"deviceType",
+	"id",
+	"name"
+];
+function exact(value, keys) {
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function date(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable();
+	return parsed;
+}
+function returnInput(value) {
+	if (!isObject(value)) throw new TypeError("ceremony input is invalid");
+	const { applicationId, returnTo } = value;
+	if (typeof applicationId !== "string" || !idPattern.test(applicationId)) throw new TypeError("applicationId is invalid");
+	if (typeof returnTo !== "string" || new TextEncoder().encode(returnTo).byteLength > MAX_RETURN_BYTES || !URL.canParse(returnTo) || new URL(returnTo).toString() !== returnTo) throw new TypeError("returnTo is invalid");
+	return {
+		applicationId,
+		returnTo
+	};
+}
+function normalizeCeremonyHandoffInput(value) {
+	const base = returnInput(value);
+	const input = value;
+	switch (input.purpose) {
+		case "passkey_enrollment": return {
+			purpose: input.purpose,
+			...base
+		};
+		case "passkey_removal": return {
+			purpose: input.purpose,
+			...base,
+			passkeyId: normalizePasskeyId(input.passkeyId)
+		};
+		case "recent_authentication": {
+			const request = input.request;
+			if (!isObject(request)) throw new TypeError("request is invalid");
+			const organizationId = normalizeIdInput(request.organizationId);
+			if (request.action === "organization_ownership_transfer") {
+				const { action: _action, organizationId: _organizationId, ...transfer } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationOwnershipTransferInput(transfer)
+					}
+				};
+			}
+			if (request.action === "organization_closure_start") {
+				const { action: _action, organizationId: _organizationId, ...closure } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationClosureStartInput(closure)
+					}
+				};
+			}
+			if (request.action === "organization_closure_cancel") {
+				const { action: _action, organizationId: _organizationId, ...closure } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationClosureCancelInput(closure)
+					}
+				};
+			}
+			throw new TypeError("request action is invalid");
+		}
+		default: throw new TypeError("purpose is invalid");
+	}
+}
+function normalizeCeremonyHandoff(value) {
+	if (!exact(value, ["expiresAt", "url"]) || typeof value.url !== "string") throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value.url);
+	} catch {
+		throw authorityUnavailable();
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost");
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/api/v1/auth/ceremony/start" || url.search || !/^#code=[A-Za-z0-9_-]{43}$/.test(url.hash)) throw authorityUnavailable();
+	return {
+		url: url.toString(),
+		expiresAt: date(value.expiresAt)
+	};
+}
+function normalizePasskeyId(value) {
+	if (typeof value !== "string" || !idPattern.test(value)) throw new TypeError("passkeyId is invalid");
+	return value;
+}
+function normalizePasskeyName(value) {
+	if (typeof value !== "string") throw new TypeError("name is invalid");
+	const name = value.trim();
+	if (!name || name.length > PASSKEY_NAME_MAX_LENGTH || /[\p{Cc}\p{Cf}]/u.test(name)) throw new TypeError("name is invalid");
+	return name;
+}
+function normalizePasskeySummary(value) {
+	if (!exact(value, itemKeys) || typeof value.id !== "string" || !idPattern.test(value.id)) throw authorityUnavailable();
+	if (value.name !== null && (typeof value.name !== "string" || value.name.length > PASSKEY_NAME_MAX_LENGTH)) throw authorityUnavailable();
+	if (value.deviceType !== "singleDevice" && value.deviceType !== "multiDevice") throw authorityUnavailable();
+	if (typeof value.backedUp !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		createdAt: value.createdAt === null ? null : date(value.createdAt),
+		deviceType: value.deviceType,
+		backedUp: value.backedUp
+	};
+}
+function normalizePasskeyInventory(value) {
+	if (!exact(value, ["passkeys", "truncated"]) || !Array.isArray(value.passkeys) || value.passkeys.length > MAX_PASSKEYS || typeof value.truncated !== "boolean") throw authorityUnavailable();
+	const passkeys = value.passkeys.map(normalizePasskeySummary);
+	if (new Set(passkeys.map((passkey) => passkey.id)).size !== passkeys.length) throw authorityUnavailable();
+	return {
+		passkeys,
+		truncated: value.truncated
+	};
+}
+function normalizePasskeyRename(value) {
+	if (!exact(value, ["status"]) || value.status !== "renamed") throw authorityUnavailable();
+}
+function fromCeremonyHandoffError(value, status, retryAfter) {
+	const code = isObject(value) ? value.code : void 0;
+	if (status === 400 && code === "RETURN_ADDRESS_REFUSED") return new AuthError("ceremony_return_refused", 400);
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404) return new AuthError("state_conflict", 409);
+	if (status === 409 && code === "PASSWORD_REQUIRED") return new AuthError("password_sign_in_required", 409);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+//#endregion
 //#region src/device.ts
 const DEVICE_SCOPE = "openid";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
@@ -1438,6 +1720,34 @@ function createDeviceAuth(options) {
 			mapError: fromAccountAuthorityError
 		});
 	}
+	async function sessionInventoryRequest(method, path, normalize) {
+		const current = await readToken();
+		if (!current) throw new AuthError("authentication_required", 401);
+		return normalize((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/sessions", path), {
+			fetch: requestFetch,
+			timeoutMs,
+			method,
+			credentials: "omit",
+			headers: { authorization: `Bearer ${current.accessToken}` },
+			mapError: fromSessionInventoryError
+		})).value);
+	}
+	async function ceremonyRequest(method, path, body, normalize) {
+		const current = await readToken();
+		if (!current) throw new AuthError("authentication_required", 401);
+		return normalize((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
+			fetch: requestFetch,
+			timeoutMs,
+			method,
+			credentials: "omit",
+			headers: {
+				authorization: `Bearer ${current.accessToken}`,
+				...body ? { "content-type": "application/json" } : {}
+			},
+			...body ? { body } : {},
+			mapError: fromCeremonyHandoffError
+		})).value);
+	}
 	async function revoke(path) {
 		const current = await readToken();
 		if (!current) return;
@@ -1840,9 +2150,60 @@ function createDeviceAuth(options) {
 			}
 			return serializeAuthority(async () => {
 				const previous = await readToken();
-				return replaceIssuedResponse((await accountRequest("sign-in/email", body)).value, previous);
+				const response = await accountRequest("sign-in/email", body);
+				if (isTwoFactorChallenge(response.value)) throw new AuthError("two_factor_required", 401);
+				return replaceIssuedResponse(response.value, previous);
 			}, true);
 		},
+		listSessions() {
+			return serializeAuthority(() => sessionInventoryRequest("GET", "", normalizeSessionInventory));
+		},
+		revokeSession(sessionId) {
+			let id;
+			try {
+				id = normalizeSessionId(sessionId);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				await sessionInventoryRequest("POST", `${id}/revoke`, normalizeSessionRevocation);
+			});
+		},
+		revokeOtherSessions() {
+			return serializeAuthority(() => sessionInventoryRequest("POST", "revoke-others", normalizeOtherSessionRevocation));
+		},
+		createCeremonyHandoff(input) {
+			let body;
+			try {
+				body = normalizeCeremonyHandoffInput(input);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(() => ceremonyRequest("POST", "ceremony-handoffs", body, normalizeCeremonyHandoff));
+		},
+		listPasskeys() {
+			return serializeAuthority(() => ceremonyRequest("GET", "passkeys", void 0, normalizePasskeyInventory));
+		},
+		renamePasskey(passkeyId, name) {
+			let path;
+			let body;
+			try {
+				path = `passkeys/${normalizePasskeyId(passkeyId)}/name`;
+				body = { name: normalizePasskeyName(name) };
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				await ceremonyRequest("POST", path, body, normalizePasskeyRename);
+			});
+		},
+		getTwoFactorStatus() {
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				return normalizeTwoFactorStatus((await authenticated("get-session", current)).value);
+			});
+		},
 		signInWithSocialIdToken(input) {
 			let body;
 			try {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as AuthError, A as OrganizationTeamPage, B as ReceivedOrganizationInvitation, C as OrganizationMemberAuthority, D as OrganizationTeam, E as OrganizationPageInput, F as PlatformRoleApplied, G as SendVerificationEmailInput, H as RecentAuthenticationStatus, I as PlatformRoleApproval, J as SocialIdTokenProvider, K as SignInInput, L as PlatformRoleChangeRecentAuthenticationInput, M as PersonalWorkspaceSelection, N as PlatformBootstrapRoleChangeInput, O as OrganizationTeamDisplay, P as PlatformRole, Q as WorkspaceSelection, R as PlatformRoleFirstApproval, S as OrganizationMember, T as OrganizationPage, U as RemovedOrganizationMember, V as ReceivedOrganizationInvitationPage, W as ResentOrganizationInvitation, X as UpdateOrganizationTeamDisplayInput, Y as UpdateOrganizationDisplayInput, Z as UpdateProfileInput, _ as InvitationAcceptance, a as AuthPersistenceDriver, b as OrganizationInvitation, c as AuthUser, d as CreatedOrganization, et as AuthErrorCode, f as CreatedOrganizationMemberInvitation, g as FinuevaAuthClient, h as DriveCredentialInput, i as AuthPersistence, j as OrganizationWorkspaceSelection, k as OrganizationTeamMemberPage, l as CanceledOrganizationInvitation, m as DriveCredential, n as AuthClientOptions, nt as UserApiCredential, o as AuthSession, p as CreatedOrganizationTeam, q as SocialIdTokenInput, r as AuthOrganization, rt as UserApiCredentialInput, s as AuthState, t as AcceptInvitationInput, tt as AuthErrorStatus, u as CreateOrganizationMemberInvitationInput, v as OrganizationDeparture, w as OrganizationMemberPage, x as OrganizationInvitationPage, y as OrganizationDisplay, z as PlatformStatus } from "./types-CrdIcEJ3.js";
+import { $ as PlatformBootstrapRoleChangeInput, A as FinuevaAuthClient, At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, Ct as TwoFactorEnrollment, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, E as DepartedOrganizationMemberPage, Et as UpdateOrganizationDisplayInput, F as OrganizationClosureStartInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, N as OrganizationClosure, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, P as OrganizationClosureCancelInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, St as SuspendedOrganizationMemberStatus, T as DepartedOrganizationMember, Tt as TwoFactorStepUpInput, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, Y as OrganizationWorkspaceSelection, Z as PasskeySummary, _ as ClosingOrganization, _t as SignInInput, a as AuthPersistence, at as PlatformStatus, b as CreatedOrganization, bt as SuspendedOrganizationMember, c as AuthSessionInventory, ct as RecentAuthenticationStatus, d as AuthUser, dt as ResentOrganizationInvitation, et as PlatformRole, f as CanceledOrganizationInvitation, ft as RestoredOrganizationMember, g as CeremonyReturnInput, gt as SendVerificationEmailInput, h as CeremonyRecentAuthenticationRequest, ht as ScimCredentialState, i as AuthOrganization, it as PlatformRoleFirstApproval, j as InvitationAcceptance, jt as AuthErrorCode, k as EnterpriseConnection, kt as WorkspaceSelection, l as AuthSessionSummary, lt as RemovedOrganizationMember, m as CeremonyHandoffInput, mt as ScimCredentialIssuance, n as AddedOrganizationTeamMember, nt as PlatformRoleApproval, o as AuthPersistenceDriver, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, pt as RotateScimCredentialInput, q as OrganizationTeamMemberPage, r as AuthClientOptions, rt as PlatformRoleChangeRecentAuthenticationInput, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, tt as PlatformRoleApplied, u as AuthState, ut as RemovedOrganizationTeamMember, v as ClosingOrganizationList, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, xt as SuspendedOrganizationMemberPage, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };