@finueva/auth 0.32.0 → 0.34.0

package/dist/device.js

@@ -1,3 +1,182 @@
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	invalid_auth_input: "The authentication input is invalid.",
+	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
+	password_reset_invalid: "The password reset request is invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_request: "The request is invalid.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	recipient_unavailable: "The recipient is unavailable.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable.",
+	two_factor_required: "A second authentication factor is required.",
+	two_factor_code_invalid: "The verification code is invalid.",
+	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
+	two_factor_locked: "Second-factor verification is temporarily locked.",
+	recent_sign_in_required: "A recent sign-in is required.",
+	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
+	recent_authentication_required: "A ready recent-authentication action is required.",
+	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
+	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
+	ceremony_return_refused: "The return address is not registered for this application.",
+	password_sign_in_required: "A password sign-in method is required for this passkey change.",
+	account_deletion_pending: "This account is scheduled for deletion.",
+	account_restore_unavailable: "The restore ticket or link is used or expired, or the account is not scheduled for deletion."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	accountDeletion;
+	constructor(code, status, retryAfterSeconds, details) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+		if (details?.accountDeletion) this.accountDeletion = details.accountDeletion;
+	}
+};
+//#endregion
+//#region src/account-deletion.ts
+function isObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function authorityUnavailable$1() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+const idPattern$2 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const tokenPattern = /^[A-Za-z0-9_-]{43}$(?![\s\S])/;
+const idempotencyPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$(?![\s\S])/;
+const MAX_SOLE_ORGANIZATIONS = 20;
+const MAX_BLOCKING_ORGANIZATIONS = 100;
+const organizationBlockers = new Set(["owner_with_members", "enterprise_connection"]);
+const accountBlockers = new Set(["managed_account", "platform_role"]);
+const stepUps = new Set([
+	"recent_sign_in",
+	"password",
+	"sign_in_again"
+]);
+function exact$3(value, keys) {
+	return isObject$1(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
+}
+function isoDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable$1();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable$1();
+	return parsed;
+}
+function organization(value, keys) {
+	if (!exact$3(value, keys) || typeof value.id !== "string" || !idPattern$2.test(value.id) || typeof value.name !== "string" || value.name.length === 0 || value.name.length > 255 || value.slug !== null && (typeof value.slug !== "string" || value.slug.length === 0 || value.slug.length > 255)) throw authorityUnavailable$1();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
+function normalizeAccountDeletionStartRequest(value) {
+	if (!isObject$1(value) || typeof value.idempotencyKey !== "string" || !idempotencyPattern.test(value.idempotencyKey)) throw new TypeError("idempotencyKey is invalid");
+	const ids = value.soleOrganizationIds;
+	if (!Array.isArray(ids) || ids.length > MAX_SOLE_ORGANIZATIONS || !ids.every((id) => {
+		return typeof id === "string" && idPattern$2.test(id);
+	})) throw new TypeError("soleOrganizationIds is invalid");
+	return {
+		idempotencyKey: value.idempotencyKey,
+		soleOrganizationIds: [...ids]
+	};
+}
+function normalizeAccountDeletionEligibility(value) {
+	if (!exact$3(value, [
+		"accountBlocker",
+		"blockingOrganizations",
+		"deleteAfter",
+		"eligible",
+		"soleOrganizations",
+		"stepUp"
+	]) || typeof value.eligible !== "boolean" || value.accountBlocker !== null && !accountBlockers.has(value.accountBlocker) || !Array.isArray(value.blockingOrganizations) || value.blockingOrganizations.length > MAX_BLOCKING_ORGANIZATIONS || !Array.isArray(value.soleOrganizations) || value.soleOrganizations.length > MAX_SOLE_ORGANIZATIONS || !stepUps.has(value.stepUp)) throw authorityUnavailable$1();
+	const blockingOrganizations = value.blockingOrganizations.map((entry) => {
+		const summary = organization(entry, [
+			"id",
+			"name",
+			"reason",
+			"slug"
+		]);
+		const reason = entry.reason;
+		if (!organizationBlockers.has(reason)) throw authorityUnavailable$1();
+		return {
+			...summary,
+			reason
+		};
+	});
+	return {
+		eligible: value.eligible,
+		accountBlocker: value.accountBlocker,
+		blockingOrganizations,
+		soleOrganizations: value.soleOrganizations.map((entry) => {
+			return organization(entry, [
+				"id",
+				"name",
+				"slug"
+			]);
+		}),
+		stepUp: value.stepUp,
+		deleteAfter: isoDate(value.deleteAfter)
+	};
+}
+function normalizeAccountDeletionRestoreInput(value) {
+	if (exact$3(value, ["restoreTicket"]) && typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket)) return { restoreTicket: value.restoreTicket };
+	if (exact$3(value, ["restoreLinkToken"]) && typeof value.restoreLinkToken === "string" && tokenPattern.test(value.restoreLinkToken)) return { restoreLinkToken: value.restoreLinkToken };
+	throw new TypeError("restore input is invalid");
+}
+function normalizeAccountDeletionRestore(value) {
+	if (!exact$3(value, ["status"]) || value.status !== "restored") throw authorityUnavailable$1();
+}
+function accountDeletionPending(value, status) {
+	if (status !== 403 || !isObject$1(value) || value.code !== "ACCOUNT_DELETION_PENDING") return null;
+	let deleteAfter;
+	try {
+		deleteAfter = isoDate(value.deleteAfter);
+	} catch {
+		return null;
+	}
+	const restoreTicket = typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket) ? value.restoreTicket : null;
+	return {
+		deleteAfter,
+		restoreTicket
+	};
+}
+function fromAccountDeletionError(value, status) {
+	const code = isObject$1(value) ? value.code : void 0;
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404 && code === "RESTORE_UNAVAILABLE") return new AuthError("account_restore_unavailable", 404);
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	return authorityUnavailable$1();
+}
 String.fromCharCode;
 const HASH_RE = /#/g;
 const AMPERSAND_RE = /&/g;
@@ -173,69 +352,11 @@ function stringifyParsedURL(parsed) {
 	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
 }
 //#endregion
-//#region src/errors.ts
-const messages = {
-	invalid_credentials: "The credentials are invalid.",
-	invalid_auth_input: "The authentication input is invalid.",
-	account_conflict: "The account is not available.",
-	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
-	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
-	google_recovery_not_required: "Google account recovery is not required.",
-	google_recovery_invalid: "The Google account recovery request is invalid.",
-	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
-	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
-	password_reset_invalid: "The password reset request is invalid.",
-	authentication_required: "Authentication is required.",
-	request_origin_denied: "The request origin is not allowed.",
-	invalid_request: "The request is invalid.",
-	invalid_invitation: "The invitation is invalid.",
-	invitation_unavailable: "The invitation is not available.",
-	recipient_unavailable: "The recipient is unavailable.",
-	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
-	invitation_recovery_required: "Invitation administration requires separate recovery.",
-	membership_removal_recovery_required: "Membership removal requires separate recovery.",
-	email_verification_required: "Email verification is required.",
-	invalid_workspace_selection: "The workspace selection is invalid.",
-	organization_context_too_large: "The organization context is too large.",
-	credential_rate_limited: "Credential requests are temporarily limited.",
-	auth_request_rate_limited: "Authentication requests are temporarily limited.",
-	organization_slug_unavailable: "The organization address is unavailable.",
-	state_conflict: "The authentication state conflicts with the request.",
-	access_denied: "Access is denied.",
-	platform_target_unavailable: "The platform administration target is unavailable.",
-	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
-	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable.",
-	two_factor_required: "A second authentication factor is required.",
-	two_factor_code_invalid: "The verification code is invalid.",
-	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
-	two_factor_locked: "Second-factor verification is temporarily locked.",
-	recent_sign_in_required: "A recent sign-in is required.",
-	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
-	recent_authentication_required: "A ready recent-authentication action is required.",
-	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
-	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
-	ceremony_return_refused: "The return address is not registered for this application.",
-	password_sign_in_required: "A password sign-in method is required for this passkey change."
-};
-var AuthError = class extends Error {
-	code;
-	status;
-	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
-		super(messages[code]);
-		this.name = "AuthError";
-		this.code = code;
-		this.status = status;
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-};
-//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
-const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+const MAX_SOCIAL_ID_TOKEN_BYTES = 16384;
 function normalizeEmail(value) {
 	if (typeof value !== "string") throw new TypeError("email is invalid");
 	const normalized = value.trim().toLowerCase();
@@ -249,7 +370,9 @@ function normalizePassword(value, name = "password", minLength = 8) {
 function normalizeSocialIdTokenInput(value) {
 	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
 	const keys = Object.keys(value);
-	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
+	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => {
+		return key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp";
+	}) || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
 	return {
 		provider: value.provider,
 		idToken: value.idToken,
@@ -276,13 +399,23 @@ function normalizeName(value) {
 function normalizeProfileInput(value) {
 	if (!isObject(value)) throw new TypeError("profile input is invalid");
 	const keys = Object.keys(value);
-	if (keys.length === 0 || keys.length > 2 || keys.some((key) => key !== "name" && key !== "image") || value.name === void 0 && value.image === void 0) throw new TypeError("profile input is invalid");
+	if (keys.length === 0 || keys.length > 2 || keys.some((key) => {
+		return key !== "name" && key !== "image";
+	}) || value.name === void 0 && value.image === void 0) throw new TypeError("profile input is invalid");
 	const result = {};
 	if (value.name !== void 0) result.name = normalizeName(value.name);
 	if (value.image !== void 0) result.image = value.image === null ? null : normalizeProfileImage(value.image);
 	return result;
 }
-function normalizeOrigin(value, name) {
+function isPrivateIpv4(hostname) {
+	const parts = hostname.split(".").map(Number);
+	if (parts.length !== 4 || parts.some((part) => {
+		return !Number.isInteger(part) || part < 0 || part > 255;
+	})) return false;
+	const [first, second] = parts;
+	return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+}
+function normalizeOrigin(value, name, allowPrivateNetwork = false) {
 	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	let url;
 	try {
@@ -291,7 +424,7 @@ function normalizeOrigin(value, name) {
 		throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	}
 	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
-	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	if (url.protocol !== "https:" && !((local || allowPrivateNetwork && isPrivateIpv4(url.hostname)) && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	return url.origin;
 }
 function normalizeTimeout(value) {
@@ -318,7 +451,7 @@ function normalizeSession(value) {
 	};
 }
 function normalizeDriveCredential(value, now) {
-	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
+	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16384) throw authorityUnavailable();
 	return {
 		tokenType: "Bearer",
 		token: value.token,
@@ -327,7 +460,9 @@ function normalizeDriveCredential(value, now) {
 }
 function normalizeOrganizationPageInput(value) {
 	if (value === void 0) return new URLSearchParams();
-	if (!isObject(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
+	if (!isObject(value) || Object.keys(value).some((key) => {
+		return key !== "limit" && key !== "cursor";
+	})) throw new AuthError("invalid_request", 400);
 	const input = value;
 	const query = new URLSearchParams();
 	if (input.limit !== void 0) {
@@ -342,17 +477,23 @@ function normalizeOrganizationPageInput(value) {
 }
 function normalizeOrganizationMemberPageInput(value) {
 	if (value === void 0) return new URLSearchParams();
-	if (!isObject(value) || Object.keys(value).some((key) => ![
-		"limit",
-		"cursor",
-		"search"
-	].includes(key))) throw new AuthError("invalid_request", 400);
+	if (!isObject(value) || Object.keys(value).some((key) => {
+		return ![
+			"limit",
+			"cursor",
+			"search"
+		].includes(key);
+	})) throw new AuthError("invalid_request", 400);
 	const { search, ...page } = value;
 	const query = normalizeOrganizationPageInput(page);
 	if (search !== void 0) {
 		if (typeof search !== "string") throw new AuthError("invalid_request", 400);
-		const prefix = search.trim().replace(/[A-Z]/g, (character) => character.toLowerCase());
-		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new AuthError("invalid_request", 400);
+		const prefix = search.trim().replace(/[A-Z]/g, (character) => {
+			return character.toLowerCase();
+		});
+		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => {
+			return character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127;
+		})) throw new AuthError("invalid_request", 400);
 		query.set("search", prefix);
 	}
 	return query;
@@ -472,7 +613,9 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 		throw new AuthError("invalid_request", 400);
 	}
 	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
-	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	const teamIds = value.teamIds?.map((teamId) => {
+		return normalizeIdInput(teamId);
+	});
 	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
 	return {
 		email: normalizedEmail,
@@ -492,7 +635,9 @@ function normalizeOrganizations(value) {
 	exact$2(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
-		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
+		organizations: unique(value.organizations.map(normalizeOrganization), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -513,7 +658,11 @@ function normalizeOrganizationMembers(value) {
 				"userId"
 			]);
 			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
-			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
+			const teamIds = unique(member.teamIds.map((teamId) => {
+				return normalizeResponseId(teamId);
+			}), (item) => {
+				return item;
+			});
 			return {
 				id: member.id,
 				userId: member.userId,
@@ -525,7 +674,9 @@ function normalizeOrganizationMembers(value) {
 				joinedAt: responseDate(member.joinedAt),
 				teamIds
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -547,7 +698,9 @@ function normalizeOrganizationTeams(value) {
 				category: team.category,
 				createdAt: responseDate(team.createdAt)
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -555,7 +708,11 @@ function normalizeOrganizationTeamMembers(value) {
 	exact$2(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
-		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
+		memberIds: unique(value.memberIds.map((item) => {
+			return normalizeResponseId(item);
+		}), (item) => {
+			return item;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -577,7 +734,9 @@ function normalizeOrganizationInvitation(value) {
 		id: value.id,
 		email: value.email,
 		role: value.role,
-		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
+		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => {
+			return item;
+		}),
 		inviter: {
 			membershipId: value.inviter.membershipId,
 			name: value.inviter.name
@@ -591,7 +750,9 @@ function normalizeOrganizationInvitations(value) {
 	exact$2(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
-		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
+		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -628,7 +789,9 @@ function normalizeReceivedInvitation(value) {
 				id: team.id,
 				name: team.name
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		inviterName: value.inviterName,
 		expiresAt: responseDate(value.expiresAt)
 	};
@@ -637,7 +800,9 @@ function normalizeReceivedInvitations(value) {
 	exact$2(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
-		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
+		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -657,6 +822,8 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 }
 function fromAccountAuthorityError(value, status, retryAfter) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	const pendingDeletion = accountDeletionPending(value, status);
+	if (pendingDeletion) return new AuthError("account_deletion_pending", 403, void 0, { accountDeletion: pendingDeletion });
 	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
 	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
 	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
@@ -859,7 +1026,7 @@ function mapError(code, status) {
 	};
 }
 function parseRetryAfter(value) {
-	if (!value || !/^\d+$/.test(value)) return void 0;
+	if (!value || !/^\d+$/.test(value)) return;
 	const seconds = Number(value);
 	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
 }
@@ -924,7 +1091,7 @@ function unique(items, key) {
 }
 function credentialSessionId(token) {
 	const parts = token.split(".");
-	if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return void 0;
+	if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return;
 	try {
 		const base64 = parts[1].replaceAll("-", "+").replaceAll("_", "/");
 		const decoded = atob(base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "="));
@@ -944,23 +1111,27 @@ function userApiApplication(input) {
 	return input.applicationId;
 }
 function normalizeUserApiCredential(value, startedAt) {
-	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
 	return {
 		tokenType: "Bearer",
 		token: value.token,
 		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
 	};
 }
-function createUserApiCredentialCache(issue, now, currentSessionId = () => void 0) {
+function createUserApiCredentialCache(issue, now, currentSessionId = () => {}) {
 	let generation = 0;
 	let cached;
 	let pending;
-	const copy = (value) => ({
-		...value,
-		expiresAt: new Date(value.expiresAt)
-	});
+	const copy = (value) => {
+		return {
+			...value,
+			expiresAt: new Date(value.expiresAt)
+		};
+	};
 	return {
-		hasAuthority: () => Boolean(cached || pending),
+		hasAuthority: () => {
+			return Boolean(cached || pending);
+		},
 		retainSession(sessionId) {
 			if (cached?.sessionId === sessionId && !pending) return;
 			generation += 1;
@@ -1144,8 +1315,10 @@ function mergeHeaders(input, defaults, Headers) {
 	return headers;
 }
 async function callHooks(context, hooks) {
-	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
-	else await hooks(context);
+	if (hooks) {
+		if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+		else await hooks(context);
+	}
 }
 const retryStatusCodes = new Set([
 	408,
@@ -1276,7 +1449,7 @@ function createFetch(globalOptions = {}) {
 }
 //#endregion
 //#region src/http.ts
-const MAX_RESPONSE_BYTES = 64 * 1024;
+const MAX_RESPONSE_BYTES = 65536;
 async function requestJsonResponse(url, options) {
 	let response;
 	try {
@@ -1299,7 +1472,7 @@ async function requestJsonResponse(url, options) {
 	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
 		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes, options.signal) : void 0;
-		response.body?.cancel().catch(() => void 0);
+		response.body?.cancel().catch(() => {});
 		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
 	return {
@@ -1310,17 +1483,17 @@ async function requestJsonResponse(url, options) {
 async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 	const length = response.headers.get("content-length");
 	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
-		response.body?.cancel().catch(() => void 0);
+		response.body?.cancel().catch(() => {});
 		throw authorityUnavailable();
 	}
 	if (!response.body) throw authorityUnavailable();
 	if (signal?.aborted) {
-		response.body.cancel().catch(() => void 0);
+		response.body.cancel().catch(() => {});
 		throw authorityUnavailable();
 	}
 	const reader = response.body.getReader();
 	const cancel = () => {
-		reader.cancel().catch(() => void 0);
+		reader.cancel().catch(() => {});
 	};
 	signal?.addEventListener("abort", cancel, { once: true });
 	const chunks = [];
@@ -1335,7 +1508,7 @@ async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 			chunks.push(value);
 		}
 	} catch (error) {
-		reader.cancel().catch(() => void 0);
+		reader.cancel().catch(() => {});
 		throw error;
 	} finally {
 		signal?.removeEventListener("abort", cancel);
@@ -1377,7 +1550,9 @@ const itemKeys$1 = [
 	"userAgent"
 ];
 function exact$1(value, keys) {
-	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function date$1(value) {
 	if (typeof value !== "string") throw authorityUnavailable();
@@ -1410,8 +1585,12 @@ function normalizeSessionSummary(value) {
 function normalizeSessionInventory(value) {
 	if (!exact$1(value, ["sessions", "truncated"]) || !Array.isArray(value.sessions) || value.sessions.length > MAX_SESSIONS || typeof value.truncated !== "boolean") throw authorityUnavailable();
 	const sessions = value.sessions.map(normalizeSessionSummary);
-	if (new Set(sessions.map((session) => session.id)).size !== sessions.length) throw authorityUnavailable();
-	if (sessions.filter((session) => session.current).length !== 1) throw authorityUnavailable();
+	if (new Set(sessions.map((session) => {
+		return session.id;
+	})).size !== sessions.length) throw authorityUnavailable();
+	if (sessions.filter((session) => {
+		return session.current;
+	}).length !== 1) throw authorityUnavailable();
 	return {
 		sessions,
 		truncated: value.truncated
@@ -1446,7 +1625,9 @@ const itemKeys = [
 	"name"
 ];
 function exact(value, keys) {
-	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function date(value) {
 	if (typeof value !== "string") throw authorityUnavailable();
@@ -1519,6 +1700,11 @@ function normalizeCeremonyHandoffInput(value) {
 			}
 			throw new TypeError("request action is invalid");
 		}
+		case "user_closure": return {
+			purpose: input.purpose,
+			...base,
+			request: normalizeAccountDeletionStartRequest(input.request)
+		};
 		default: throw new TypeError("purpose is invalid");
 	}
 }
@@ -1563,7 +1749,9 @@ function normalizePasskeySummary(value) {
 function normalizePasskeyInventory(value) {
 	if (!exact(value, ["passkeys", "truncated"]) || !Array.isArray(value.passkeys) || value.passkeys.length > MAX_PASSKEYS || typeof value.truncated !== "boolean") throw authorityUnavailable();
 	const passkeys = value.passkeys.map(normalizePasskeySummary);
-	if (new Set(passkeys.map((passkey) => passkey.id)).size !== passkeys.length) throw authorityUnavailable();
+	if (new Set(passkeys.map((passkey) => {
+		return passkey.id;
+	})).size !== passkeys.length) throw authorityUnavailable();
 	return {
 		passkeys,
 		truncated: value.truncated
@@ -1580,6 +1768,7 @@ function fromCeremonyHandoffError(value, status, retryAfter) {
 	if (status === 403) return new AuthError("request_origin_denied", 403);
 	if (status === 404) return new AuthError("state_conflict", 409);
 	if (status === 409 && code === "PASSWORD_REQUIRED") return new AuthError("password_sign_in_required", 409);
+	if (status === 409 && code === "RECENT_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	return authorityUnavailable();
@@ -1588,9 +1777,9 @@ function fromCeremonyHandoffError(value, status, retryAfter) {
 //#region src/device.ts
 const DEVICE_SCOPE = "openid";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const MAX_TOKEN_BYTES = 16 * 1024 - 7;
-const MAX_POLLING_MS = 900 * 1e3;
-const REFRESH_WINDOW_MS = 120 * 1e3;
+const MAX_TOKEN_BYTES = 16377;
+const MAX_POLLING_MS = 9e5;
+const REFRESH_WINDOW_MS = 12e4;
 const errorMessages = {
 	device_access_denied: "Device authorization was denied.",
 	device_authorization_cancelled: "Device authorization was cancelled.",
@@ -1615,7 +1804,7 @@ function createDeviceAuth(options) {
 	if (typeof requestFetch !== "function") throw new TypeError("fetch is required");
 	const now = options.now ?? Date.now;
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
-	const maxPollingMs = options.maxPollingMs ?? 600 * 1e3;
+	const maxPollingMs = options.maxPollingMs ?? 6e5;
 	if (!Number.isSafeInteger(maxPollingMs) || maxPollingMs < 1 || maxPollingMs > MAX_POLLING_MS) throw new TypeError("maxPollingMs must be an integer from 1 to 900000");
 	let token = null;
 	let hydrated = false;
@@ -1629,10 +1818,12 @@ function createDeviceAuth(options) {
 	let persistenceTail = Promise.resolve();
 	let persistencePending = 0;
 	const userApiCredentials = createUserApiCredentialCache(async (applicationId) => {
-		const authority = await serializeAuthority(async () => ({
-			current: await readToken(),
-			generation: authorityGeneration
-		}));
+		const authority = await serializeAuthority(async () => {
+			return {
+				current: await readToken(),
+				generation: authorityGeneration
+			};
+		});
 		if (!authority.current) throw new AuthError("authentication_required", 401);
 		const response = await authenticated("user-api-credential", authority.current, { applicationId });
 		if (authority.generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
@@ -1651,7 +1842,7 @@ function createDeviceAuth(options) {
 			return operation();
 		};
 		const request = authorityTail.then(guardedOperation, guardedOperation);
-		authorityTail = request.then(() => void 0, () => void 0);
+		authorityTail = request.then(() => {}, () => {});
 		return request;
 	}
 	async function readToken() {
@@ -1671,16 +1862,22 @@ function createDeviceAuth(options) {
 	}
 	async function hydrate() {
 		try {
-			const persisted = options.persistence ? await persistenceCall((signal) => options.persistence.read(signal)) : null;
+			const persisted = options.persistence ? await persistenceCall((signal) => {
+				return options.persistence.read(signal);
+			}) : null;
 			let loaded;
 			try {
 				loaded = normalizeToken(persisted, now());
 			} catch {
 				token = null;
-				if (options.persistence && persisted !== null) await persistenceCall((signal) => options.persistence.delete(signal)).catch(() => void 0);
+				if (options.persistence && persisted !== null) await persistenceCall((signal) => {
+					return options.persistence.delete(signal);
+				}).catch(() => {});
 				throw unavailable();
 			}
-			if (options.persistence && persisted !== null && !loaded) await persistenceCall((signal) => options.persistence.delete(signal));
+			if (options.persistence && persisted !== null && !loaded) await persistenceCall((signal) => {
+				return options.persistence.delete(signal);
+			});
 			token = loaded;
 		} catch (error) {
 			token = null;
@@ -1703,7 +1900,9 @@ function createDeviceAuth(options) {
 					scope: DEVICE_SCOPE
 				},
 				signal: requestOptions.signal,
-				mapError: () => invalid()
+				mapError: () => {
+					return invalid();
+				}
 			})).value, now());
 		} catch (error) {
 			if (requestOptions.signal?.aborted) throw cancelled();
@@ -1760,7 +1959,7 @@ function createDeviceAuth(options) {
 				next = normalizeTokenResponse(response.value, now());
 			} catch {
 				if (recoverableAccessToken) await revokeToken(recoverableAccessToken);
-				await clearToken().catch(() => void 0);
+				await clearToken().catch(() => {});
 				throw unavailable();
 			}
 			try {
@@ -1821,6 +2020,22 @@ function createDeviceAuth(options) {
 			mapError: fromCeremonyHandoffError
 		})).value);
 	}
+	async function accountDeletionRequest(method, path, body, normalize, bearer) {
+		const current = bearer ? await readToken() : void 0;
+		if (bearer && !current) throw new AuthError("authentication_required", 401);
+		return normalize((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/user/closure", path), {
+			fetch: requestFetch,
+			timeoutMs,
+			method,
+			credentials: "omit",
+			headers: {
+				...current ? { authorization: `Bearer ${current.accessToken}` } : {},
+				...body ? { "content-type": "application/json" } : {}
+			},
+			...body ? { body } : {},
+			mapError: fromAccountDeletionError
+		})).value);
+	}
 	async function revoke(path) {
 		const current = await readToken();
 		if (!current) return;
@@ -1844,7 +2059,9 @@ function createDeviceAuth(options) {
 	}
 	async function replaceToken(next) {
 		try {
-			if (options.persistence) await persistenceCall((signal) => options.persistence.replace(copyToken(next), signal));
+			if (options.persistence) await persistenceCall((signal) => {
+				return options.persistence.replace(copyToken(next), signal);
+			});
 		} catch {
 			throw unavailable();
 		}
@@ -1896,7 +2113,7 @@ function createDeviceAuth(options) {
 			credentials: "omit",
 			headers: { authorization: `Bearer ${accessToken}` },
 			body: { token: accessToken }
-		}).catch(() => void 0);
+		}).catch(() => {});
 	}
 	async function clearToken() {
 		token = null;
@@ -1928,7 +2145,7 @@ function createDeviceAuth(options) {
 		hydrated = true;
 		authorityGeneration += 1;
 		clearCredential();
-		await removePersisted().catch(() => void 0);
+		await removePersisted().catch(() => {});
 	}
 	async function accountRequest(path, body, mapError = fromAccountAuthorityError) {
 		clearCredential();
@@ -1965,7 +2182,7 @@ function createDeviceAuth(options) {
 			hydrated = true;
 			authorityGeneration += 1;
 			clearCredential();
-			await removePersisted().catch(() => void 0);
+			await removePersisted().catch(() => {});
 			throw unavailable();
 		}
 		return session;
@@ -1981,13 +2198,15 @@ function createDeviceAuth(options) {
 			credentials: "omit",
 			headers: { authorization: `Bearer ${current.accessToken}` },
 			mapError: fromOrganizationReadAuthorityError,
-			maxResponseBytes: 256 * 1024
+			maxResponseBytes: 262144
 		})).value);
 	}
 	async function removePersisted() {
 		if (!options.persistence) return;
 		try {
-			await persistenceCall((signal) => options.persistence.delete(signal));
+			await persistenceCall((signal) => {
+				return options.persistence.delete(signal);
+			});
 		} catch {
 			throw unavailable();
 		}
@@ -2005,14 +2224,28 @@ function createDeviceAuth(options) {
 			} catch (error) {
 				return Promise.reject(error);
 			}
-			return serializeAuthority(() => pollForToken(snapshot, signal), true);
+			return serializeAuthority(() => {
+				return pollForToken(snapshot, signal);
+			}, true);
+		},
+		getToken: () => {
+			return serializeAuthority(async () => {
+				return copyTokenOrNull(await readToken());
+			});
+		},
+		getSession: () => {
+			return serializeAuthority(getSession, true);
+		},
+		listOrganizations: (input) => {
+			return serializeAuthority(() => {
+				return organizationRead("", input, normalizeOrganizations);
+			});
 		},
-		getToken: () => serializeAuthority(async () => copyTokenOrNull(await readToken())),
-		getSession: () => serializeAuthority(getSession, true),
-		listOrganizations: (input) => serializeAuthority(() => organizationRead("", input, normalizeOrganizations)),
 		getOrganization(organizationId) {
 			try {
-				return serializeAuthority(() => organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization));
+				return serializeAuthority(() => {
+					return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
+				});
 			} catch (error) {
 				return Promise.reject(error);
 			}
@@ -2020,12 +2253,22 @@ function createDeviceAuth(options) {
 		async getOrganizationMemberAuthority(organizationId, memberId) {
 			const organization = normalizeIdInput(organizationId);
 			const member = normalizeIdInput(memberId);
-			return serializeAuthority(() => organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member)));
+			return serializeAuthority(() => {
+				return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => {
+					return normalizeOrganizationMemberAuthority(value, organization, member);
+				});
+			});
 		},
 		async getOrganizationMemberAuthorityV2(organizationId, memberId) {
 			const organization = normalizeIdInput(organizationId);
 			const member = normalizeIdInput(memberId);
-			return serializeAuthority(() => organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthorityV2(value, organization, member), () => new URLSearchParams({ version: "2" })));
+			return serializeAuthority(() => {
+				return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => {
+					return normalizeOrganizationMemberAuthorityV2(value, organization, member);
+				}, () => {
+					return new URLSearchParams({ version: "2" });
+				});
+			});
 		},
 		createOrganization(name, slug, idempotencyKey) {
 			let body;
@@ -2159,43 +2402,59 @@ function createDeviceAuth(options) {
 		},
 		listOrganizationMembers(organizationId, input) {
 			try {
-				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers, normalizeOrganizationMemberPageInput));
+				return serializeAuthority(() => {
+					return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers, normalizeOrganizationMemberPageInput);
+				});
 			} catch (error) {
 				return Promise.reject(error);
 			}
 		},
 		listOrganizationTeams(organizationId, input) {
 			try {
-				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/teams`, input, normalizeOrganizationTeams));
+				return serializeAuthority(() => {
+					return organizationRead(`${normalizeIdInput(organizationId)}/teams`, input, normalizeOrganizationTeams);
+				});
 			} catch (error) {
 				return Promise.reject(error);
 			}
 		},
 		listOrganizationTeamMembers(organizationId, teamId, input) {
 			try {
-				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/teams/${normalizeIdInput(teamId)}/members`, input, normalizeOrganizationTeamMembers));
+				return serializeAuthority(() => {
+					return organizationRead(`${normalizeIdInput(organizationId)}/teams/${normalizeIdInput(teamId)}/members`, input, normalizeOrganizationTeamMembers);
+				});
 			} catch (error) {
 				return Promise.reject(error);
 			}
 		},
 		listOrganizationInvitations(organizationId, input) {
 			try {
-				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/invitations`, input, normalizeOrganizationInvitations));
+				return serializeAuthority(() => {
+					return organizationRead(`${normalizeIdInput(organizationId)}/invitations`, input, normalizeOrganizationInvitations);
+				});
 			} catch (error) {
 				return Promise.reject(error);
 			}
 		},
 		getOrganizationInvitation(organizationId, invitationId) {
 			try {
-				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeOrganizationInvitation));
+				return serializeAuthority(() => {
+					return organizationRead(`${normalizeIdInput(organizationId)}/invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeOrganizationInvitation);
+				});
 			} catch (error) {
 				return Promise.reject(error);
 			}
 		},
-		listReceivedInvitations: (input) => serializeAuthority(() => organizationRead("received-invitations", input, normalizeReceivedInvitations)),
+		listReceivedInvitations: (input) => {
+			return serializeAuthority(() => {
+				return organizationRead("received-invitations", input, normalizeReceivedInvitations);
+			});
+		},
 		getReceivedInvitation(invitationId) {
 			try {
-				return serializeAuthority(() => organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation));
+				return serializeAuthority(() => {
+					return organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation);
+				});
 			} catch (error) {
 				return Promise.reject(error);
 			}
@@ -2234,7 +2493,9 @@ function createDeviceAuth(options) {
 			}, true);
 		},
 		listSessions() {
-			return serializeAuthority(() => sessionInventoryRequest("GET", "", normalizeSessionInventory));
+			return serializeAuthority(() => {
+				return sessionInventoryRequest("GET", "", normalizeSessionInventory);
+			});
 		},
 		revokeSession(sessionId) {
 			let id;
@@ -2248,7 +2509,9 @@ function createDeviceAuth(options) {
 			});
 		},
 		revokeOtherSessions() {
-			return serializeAuthority(() => sessionInventoryRequest("POST", "revoke-others", normalizeOtherSessionRevocation));
+			return serializeAuthority(() => {
+				return sessionInventoryRequest("POST", "revoke-others", normalizeOtherSessionRevocation);
+			});
 		},
 		createCeremonyHandoff(input) {
 			let body;
@@ -2257,10 +2520,22 @@ function createDeviceAuth(options) {
 			} catch (error) {
 				return Promise.reject(error);
 			}
-			return serializeAuthority(() => ceremonyRequest("POST", "ceremony-handoffs", body, normalizeCeremonyHandoff));
+			return serializeAuthority(() => {
+				return ceremonyRequest("POST", "ceremony-handoffs", body, normalizeCeremonyHandoff);
+			});
+		},
+		getAccountDeletionEligibility() {
+			return serializeAuthority(() => {
+				return accountDeletionRequest("GET", "eligibility", void 0, normalizeAccountDeletionEligibility, true);
+			});
+		},
+		async restoreAccount(input) {
+			await accountDeletionRequest("POST", "restore", normalizeAccountDeletionRestoreInput(input), normalizeAccountDeletionRestore, false);
 		},
 		listPasskeys() {
-			return serializeAuthority(() => ceremonyRequest("GET", "passkeys", void 0, normalizePasskeyInventory));
+			return serializeAuthority(() => {
+				return ceremonyRequest("GET", "passkeys", void 0, normalizePasskeyInventory);
+			});
 		},
 		renamePasskey(passkeyId, name) {
 			let path;
@@ -2432,15 +2707,25 @@ function createDeviceAuth(options) {
 			};
 			return request;
 		},
-		revokeCurrentDevice: () => serializeAuthority(() => revoke("revoke-session"), true),
-		revokeAllSessions: () => serializeAuthority(() => revoke("revoke-sessions"), true)
+		revokeCurrentDevice: () => {
+			return serializeAuthority(() => {
+				return revoke("revoke-session");
+			}, true);
+		},
+		revokeAllSessions: () => {
+			return serializeAuthority(() => {
+				return revoke("revoke-sessions");
+			}, true);
+		}
 	};
 	async function persistenceCall(operation) {
 		const operationTimeoutMs = Math.min(timeoutMs, 1e3);
 		persistencePending += 1;
 		const settledRequest = persistenceTail.then(async () => {
 			const controller = new AbortController();
-			const timer = setTimeout(() => controller.abort(), operationTimeoutMs);
+			const timer = setTimeout(() => {
+				return controller.abort();
+			}, operationTimeoutMs);
 			try {
 				return await operation(controller.signal);
 			} finally {
@@ -2449,13 +2734,15 @@ function createDeviceAuth(options) {
 		}).finally(() => {
 			persistencePending -= 1;
 		});
-		persistenceTail = settledRequest.then(() => void 0, () => void 0);
+		persistenceTail = settledRequest.then(() => {}, () => {});
 		let publicTimer;
 		try {
 			return await Promise.race([settledRequest.catch(() => {
 				throw unavailable();
 			}), new Promise((_, reject) => {
-				publicTimer = setTimeout(() => reject(unavailable()), operationTimeoutMs);
+				publicTimer = setTimeout(() => {
+					return reject(unavailable());
+				}, operationTimeoutMs);
 			})]);
 		} finally {
 			if (publicTimer) clearTimeout(publicTimer);
@@ -2466,8 +2753,10 @@ function copyTokenOrNull(value) {
 	return value ? copyToken(value) : null;
 }
 function normalizePollSignal(value) {
-	if (value === void 0) return void 0;
-	if (!isObject(value) || Object.keys(value).some((key) => key !== "signal") || value.signal !== void 0 && !(value.signal instanceof AbortSignal)) throw new TypeError("poll options are invalid");
+	if (value === void 0) return;
+	if (!isObject(value) || Object.keys(value).some((key) => {
+		return key !== "signal";
+	}) || value.signal !== void 0 && !(value.signal instanceof AbortSignal)) throw new TypeError("poll options are invalid");
 	return value.signal;
 }
 var DeviceProtocolError = class extends Error {
@@ -2500,7 +2789,7 @@ function normalizeAuthorizationInput(value, currentTime) {
 	};
 }
 function normalizeTokenResponse(value, currentTime) {
-	if (!isObject(value) || !boundedSecret(value.access_token) || value.token_type !== "Bearer" || value.scope !== DEVICE_SCOPE || !Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 744 * 60 * 60) throw unavailable();
+	if (!isObject(value) || !boundedSecret(value.access_token) || value.token_type !== "Bearer" || value.scope !== DEVICE_SCOPE || !Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 2678400) throw unavailable();
 	return {
 		accessToken: value.access_token,
 		tokenType: "Bearer",