@cauthyhq/node 0.0.0 → 1.1.0

package/dist/index.mjs

@@ -0,0 +1,3421 @@
+// src/cookies.ts
+var PART = 3500;
+function readCookies(header) {
+  const out2 = /* @__PURE__ */ new Map();
+  for (const pair of (header ?? "").split(";")) {
+    const i = pair.indexOf("=");
+    if (i > 0) out2.set(pair.slice(0, i).trim(), pair.slice(i + 1).trim());
+  }
+  return out2;
+}
+function readParts(cookies, name) {
+  let value = "";
+  for (let i = 0; cookies.has(`${name}.${i}`); i++) value += cookies.get(`${name}.${i}`);
+  return value === "" ? null : value;
+}
+function attributes(a) {
+  return `Path=${a.path ?? "/"}; HttpOnly; SameSite=Lax${a.maxAge === void 0 ? "" : `; Max-Age=${a.maxAge}`}${a.secure ? "; Secure" : ""}`;
+}
+function writeCookie(name, value, a) {
+  return `${name}=${value}; ${attributes(a)}`;
+}
+function writeParts(name, value, a, had) {
+  const out2 = [];
+  let n = 0;
+  for (let i = 0; i < value.length; i += PART) out2.push(writeCookie(`${name}.${n++}`, value.slice(i, i + PART), a));
+  for (let i = n; had.has(`${name}.${i}`); i++) out2.push(writeCookie(`${name}.${i}`, "", { ...a, maxAge: 0 }));
+  return out2;
+}
+function clearParts(name, a, had) {
+  const out2 = [];
+  for (let i = 0; had.has(`${name}.${i}`) || i === 0; i++) out2.push(writeCookie(`${name}.${i}`, "", { ...a, maxAge: 0 }));
+  return out2;
+}
+
+// src/seal.ts
+import { CompactEncrypt, compactDecrypt } from "jose";
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+async function keyOf(secret) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(secret)));
+}
+async function seal(value, key) {
+  return new CompactEncrypt(encoder.encode(JSON.stringify(value))).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).encrypt(key);
+}
+async function unseal(sealed, key) {
+  try {
+    const { plaintext } = await compactDecrypt(sealed, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"]
+    });
+    return JSON.parse(decoder.decode(plaintext));
+  } catch {
+    return null;
+  }
+}
+async function unsealAny(sealed, ring) {
+  for (const key of ring) {
+    const value = await unseal(sealed, key);
+    if (value !== null) return value;
+  }
+  return null;
+}
+
+// src/types.ts
+var CauthyConfigError = class extends Error {
+  constructor(message) {
+    super(`@cauthyhq/node: ${message}`);
+    this.name = "CauthyConfigError";
+  }
+};
+
+// src/url.ts
+function withoutTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
+  return s.slice(0, end);
+}
+
+// src/contract.ts
+var STANDARD_VARIABLES = [
+  "CAUTHY_ISSUER",
+  "CAUTHY_CLIENT_ID",
+  "CAUTHY_CLIENT_SECRET",
+  "CAUTHY_SECRET",
+  "CAUTHY_SYSTEM",
+  "CAUTHY_TENANT",
+  "CAUTHY_SYSTEM_KEY",
+  "CAUTHY_SYSTEM_KEY_ID"
+];
+function failClosed(environment) {
+  const set = STANDARD_VARIABLES.filter((name) => (environment?.[name] ?? "") !== "");
+  if (set.length > 0) {
+    throw new CauthyConfigError(`the application runs by contract, and ${set.join(", ")} ${set.length === 1 ? "is" : "are"} also set: remove ` + (set.length === 1 ? "it" : "them") + " from the environment. Everything comes from the contract.");
+  }
+}
+var SLUG = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var NIL_UUID = "00000000-0000-0000-0000-000000000000";
+var text = (v) => typeof v === "string" ? v : "";
+function httpsAddress(raw, what) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new CauthyConfigError(`the contract's ${what} is not an address: ${JSON.stringify(raw)}`);
+  }
+  const local = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && local)) {
+    throw new CauthyConfigError(`the contract's ${what} must be https: ${raw}`);
+  }
+  return u;
+}
+function readContract(options) {
+  const { system } = options;
+  const provider = options.provider ?? "cauthy";
+  if (!SLUG.test(system ?? "")) throw new CauthyConfigError(`contract.system must be the system's id in the graph, e.g. "acme-crm"`);
+  const graph = options.graph && typeof options.graph === "object" && "default" in options.graph && !("edges" in options.graph) ? options.graph.default : options.graph;
+  if (!graph || !Array.isArray(graph.edges) || !Array.isArray(graph.nodes)) {
+    throw new CauthyConfigError("contract.graph is not a context graph: pass the graph.json that `cauthy contracts pull` writes");
+  }
+  const node = (id) => graph.nodes?.find((n) => n.type === "system" && n.id === id);
+  const own = node(system);
+  if (!own) throw new CauthyConfigError(`the graph has no system "${system}"`);
+  const cauthy = node(provider);
+  if (!cauthy) throw new CauthyConfigError(`the graph has no system "${provider}"`);
+  const links = graph.edges.filter((e2) => e2.relation === "links" && e2.from === system && e2.to === provider && e2.sign_in).filter((e2) => options.link === void 0 || e2.link === options.link);
+  if (links.length === 0) {
+    throw new CauthyConfigError(options.link ? `the graph has no link "${options.link}" from ${system} to ${provider} with sign_in` : `no link of the graph signs ${system}'s people in with ${provider}: merge one in the contracts repository, then pull the graph again`);
+  }
+  if (links.length > 1) {
+    throw new CauthyConfigError(`${system} has ${links.length} links to ${provider}: name the one to read (contract.link): ${links.map((l) => text(l.link)).join(", ")}`);
+  }
+  const e = links[0];
+  const link = text(e.link);
+  const named = text(e.identity?.tenant);
+  const pinned = text(e.identity?.tenant_id);
+  if (named === NIL_UUID || pinned === NIL_UUID) throw new CauthyConfigError(`the link ${link} names the nil UUID as its workspace: name the workspace by its slug`);
+  let tenantId;
+  let tenant;
+  if (UUID.test(named)) {
+    if (pinned !== "" && pinned.toLowerCase() !== named.toLowerCase()) {
+      throw new CauthyConfigError(`the link ${link} names the workspace ${named} and its tenant_id ${pinned} does not match: pull the graph again`);
+    }
+    tenantId = named;
+    tenant = text((cauthy.tenants ?? []).find((t) => t.id === named)?.slug);
+    if (tenant === "") throw new CauthyConfigError(`the graph does not name the slug of the workspace ${named} that the link ${link} uses`);
+  } else {
+    if (!SLUG.test(named)) throw new CauthyConfigError(`the link ${link} names no workspace: identity.tenant is a UUID or a slug`);
+    if (!UUID.test(pinned)) {
+      throw new CauthyConfigError(e.identity?.create_tenant === true ? `the link ${link} asks Cauthy for a new workspace "${named}", and the graph has no tenant_id for it yet: once Cauthy has created it and core-contracts lists it, pull the graph again` : `the link ${link} names the workspace "${named}" by its slug, and the graph carries no tenant_id for it: pull the graph again`);
+    }
+    tenantId = pinned;
+    tenant = named;
+  }
+  const issuer = withoutTrailingSlashes(httpsAddress(text(cauthy.url), `address of ${provider}`).href);
+  const signIn = e.sign_in ?? {};
+  const clientId = text(signIn.client_id) || `pact.${link}`;
+  const redirectUris = Array.isArray(signIn.redirect_uris) ? signIn.redirect_uris.map(text).filter(Boolean) : [];
+  if (redirectUris.length === 0) throw new CauthyConfigError(`the link ${link} names no redirect URI`);
+  const proof = text(signIn.system_proof);
+  if (signIn.system_proof !== void 0 && proof !== "off" && proof !== "auto" && proof !== "required") {
+    throw new CauthyConfigError(`the link ${link} has system_proof ${JSON.stringify(signIn.system_proof)}: it is off, auto or required. Update @cauthyhq/node, or pull the graph again`);
+  }
+  const systemProof = proof === "off" || proof === "auto" || proof === "required" ? proof : signIn.require_system_proof === true ? "required" : "off";
+  if (systemProof !== "off" && !e.service) {
+    throw new CauthyConfigError(`the link ${link} asks for the system's proof (${systemProof}) and gives ${system} no identity to make it with: it needs a service block`);
+  }
+  const out2 = {
+    system,
+    link,
+    issuer,
+    tenantId,
+    tenant,
+    clientId,
+    redirectUris,
+    requireSystemProof: systemProof === "required",
+    systemProof,
+    requireVerifiedEmail: signIn.require_verified_email === true,
+    persistentSessions: signIn.persistent_sessions === true
+  };
+  if (e.service) {
+    out2.serviceClientId = text(e.service.client_id) || `pact.${link}.service`;
+    const jwks = text(e.service.jwks_url) || text(own.jwks_url);
+    if (jwks === "") throw new CauthyConfigError(`the link ${link} gives ${system} its own identity, and ${system} names no jwks_url`);
+    out2.jwksUrl = httpsAddress(jwks, "jwks_url").href;
+    out2.jwksPath = new URL(out2.jwksUrl).pathname;
+  }
+  if (text(own.events_url) !== "") out2.eventsUrl = httpsAddress(text(own.events_url), "events_url").href;
+  return out2;
+}
+
+// src/keys.ts
+import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK } from "jose";
+var RETIRE_AFTER_MS = 24 * 60 * 60 * 1e3;
+var FORGET_AFTER_MS = 7 * 24 * 60 * 60 * 1e3;
+var CURRENT_TTL_MS = 5 * 60 * 1e3;
+var JWKS_MAX_AGE_S = 300;
+var SIGN_AFTER_MS = (JWKS_MAX_AGE_S + 60) * 1e3;
+var SETTLING_TTL_MS = 5 * 1e3;
+var newestFirst = (keys2) => [...keys2].sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.kid.localeCompare(a.kid));
+function published(key) {
+  const { kty, n, e } = key.publicJwk;
+  return { kty, n, e, kid: key.kid, alg: "RS256", use: "sig" };
+}
+function pactKeys(store, sealKeys, now = Date.now) {
+  let remembered;
+  let making;
+  async function make(after) {
+    const { publicKey, privateKey } = await generateKeyPair("RS256", { modulusLength: 2048, extractable: true });
+    const publicJwk = await exportJWK(publicKey);
+    const kid = await calculateJwkThumbprint(publicJwk);
+    const at = Math.max(now(), after ? Date.parse(after.createdAt) + 1 : 0);
+    const key = { kid, publicJwk, sealed: await seal(await exportJWK(privateKey), (await sealKeys)[0]), createdAt: new Date(at).toISOString() };
+    if (!after && store.addFirst) await store.addFirst(key);
+    else await store.add(key);
+    return key;
+  }
+  const age = (key) => now() - Date.parse(key.createdAt);
+  function signer(kept) {
+    const ripe = kept.find((k) => age(k) >= SIGN_AFTER_MS);
+    if (!ripe) return { key: kept[kept.length - 1], until: now() + SETTLING_TTL_MS };
+    const until = ripe === kept[0] ? now() + CURRENT_TTL_MS : Math.min(now() + CURRENT_TTL_MS, Date.parse(kept[0].createdAt) + SIGN_AFTER_MS);
+    return { key: ripe, until };
+  }
+  async function open(key) {
+    const ring = await sealKeys;
+    for (let i = 0; i < ring.length; i++) {
+      const jwk = await unseal(key.sealed, ring[i]);
+      if (jwk !== null) return { jwk, fresh: i === 0 };
+    }
+    return null;
+  }
+  async function keptKeys() {
+    const kept = newestFirst(await store.list());
+    if (kept.length > 0) return kept;
+    making ??= make().finally(() => {
+      making = void 0;
+    });
+    await making;
+    const again = newestFirst(await store.list());
+    if (again.length === 0) throw new CauthyConfigError("the key store kept no key: check that it writes");
+    return again;
+  }
+  return {
+    async current() {
+      if (remembered && remembered.until > now()) return remembered;
+      const { key, until } = signer(await keptKeys());
+      if (remembered?.kid === key.kid) {
+        remembered.until = until;
+        return remembered;
+      }
+      const opened = await open(key);
+      if (opened === null) {
+        throw new CauthyConfigError(`the key ${key.kid} cannot be opened with the root key (PACT_ROOT_KEY): if the root key was rotated, set the previous one as PACT_ROOT_KEY_PREVIOUS`);
+      }
+      remembered = { kid: key.kid, privateKey: await importJWK(opened.jwk, "RS256"), until };
+      return remembered;
+    },
+    async published() {
+      const kept = await keptKeys();
+      const out2 = [];
+      for (let i = 0; i < kept.length; i++) {
+        if (i === 0 || now() - Date.parse(kept[i - 1].createdAt) < RETIRE_AFTER_MS) out2.push(published(kept[i]));
+        else if (now() - Date.parse(kept[i - 1].createdAt) > FORGET_AFTER_MS) await store.remove(kept[i].kid);
+      }
+      return { keys: out2 };
+    },
+    async rotate() {
+      const key = await make(newestFirst(await store.list())[0]);
+      remembered = void 0;
+      return key.kid;
+    },
+    async reseal() {
+      let changed = 0;
+      const ring = await sealKeys;
+      for (const key of await store.list()) {
+        const opened = await open(key);
+        if (opened === null || opened.fresh) continue;
+        await store.update({ ...key, sealed: await seal(opened.jwk, ring[0]) });
+        changed++;
+      }
+      return changed;
+    }
+  };
+}
+
+// src/rootkey.ts
+var encoder2 = new TextEncoder();
+var MIN_ROOT_KEY = 32;
+async function derive(root, purpose) {
+  const ikm = await crypto.subtle.importKey("raw", encoder2.encode(root), "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: encoder2.encode(`pact/${purpose}/v1`) },
+    ikm,
+    256
+  );
+  return new Uint8Array(bits);
+}
+function deriveKeys(root, previous) {
+  if (root.length < MIN_ROOT_KEY) {
+    throw new CauthyConfigError(`rootKey (PACT_ROOT_KEY) must be at least ${MIN_ROOT_KEY} characters: 32 random bytes, e.g. openssl rand -base64 32`);
+  }
+  if (previous !== void 0 && previous !== "" && previous.length < MIN_ROOT_KEY) {
+    throw new CauthyConfigError(`the previous root key (PACT_ROOT_KEY_PREVIOUS) must be at least ${MIN_ROOT_KEY} characters`);
+  }
+  const roots = previous && previous !== root ? [root, previous] : [root];
+  const ring = (purpose) => Promise.all(roots.map((r) => derive(r, purpose)));
+  return { seal: ring("seal"), cookie: ring("cookie"), flow: ring("flow") };
+}
+
+// src/deadline.ts
+var DEFAULT_DEADLINE_MS = 5e3;
+var isTimeout = (err) => err?.name === "TimeoutError";
+function deadline(base, ms) {
+  return async (input, init = {}) => {
+    const send = base ?? fetch;
+    const stream = new Headers(init.headers).get("accept")?.includes("text/event-stream") === true;
+    if (!stream) {
+      const limit = AbortSignal.timeout(ms);
+      return send(input, { ...init, signal: init.signal ? anySignal([init.signal, limit]) : limit });
+    }
+    const own = new AbortController();
+    const timer = setTimeout(() => own.abort(new DOMException(`Cauthy did not answer within ${ms} ms`, "TimeoutError")), ms);
+    try {
+      return await send(input, { ...init, signal: init.signal ? anySignal([init.signal, own.signal]) : own.signal });
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+function anySignal(signals) {
+  if (typeof AbortSignal.any === "function") return AbortSignal.any(signals);
+  const controller = new AbortController();
+  for (const signal of signals) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      break;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), { once: true });
+  }
+  return controller.signal;
+}
+
+// src/permissions.ts
+function matches(entry, resource, action) {
+  const i = entry.lastIndexOf(":");
+  if (i < 0) return false;
+  const r = entry.slice(0, i);
+  const a = entry.slice(i + 1);
+  return (r === "*" || r === resource) && (a === "*" || a === action);
+}
+function can(organization, resource, action) {
+  if (!organization?.permissions) return false;
+  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
+  return organization.permissions.some((p) => matches(p, resource, action));
+}
+function definePolicy(given) {
+  const roles = Array.isArray(given) ? given : given.roles;
+  const resources = Array.isArray(given) ? [] : given.catalog ?? [];
+  const entry = (p) => `${p.resource}:${p.action}`;
+  const byName = new Map(roles.map((r) => [r.role, r]));
+  const split = (permission) => {
+    const i = permission.lastIndexOf(":");
+    return i < 0 ? [permission, ""] : [permission.slice(0, i), permission.slice(i + 1)];
+  };
+  return {
+    roles: roles.map((r) => ({
+      role: r.role,
+      ...r.name !== void 0 ? { name: r.name } : {},
+      ...r.description !== void 0 ? { description: r.description } : {},
+      ...r.inherits ? { inherits: [...r.inherits] } : {},
+      ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
+    })),
+    catalog: resources.map((c) => ({
+      resource: c.resource,
+      ...c.description !== void 0 ? { description: c.description } : {},
+      actions: [...c.actions],
+      ...c.attributes ? { attributes: { ...c.attributes } } : {}
+    })),
+    roleNames: roles.map((r) => r.role),
+    permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
+    can(organization, permission) {
+      const [resource, action] = split(permission);
+      return can(organization, resource, action);
+    },
+    hasRole(organization, ...wanted) {
+      return organization != null && wanted.includes(organization.role);
+    },
+    permissionsOf(role) {
+      const seen = /* @__PURE__ */ new Set();
+      const out2 = /* @__PURE__ */ new Set();
+      const walk = (name) => {
+        if (seen.has(name)) return;
+        seen.add(name);
+        const r = byName.get(name);
+        for (const p of r?.permissions ?? []) out2.add(entry(p));
+        for (const parent of r?.inherits ?? []) walk(parent);
+      };
+      walk(role);
+      return [...out2];
+    },
+    // The types did the work; this only hands the question on, as a method of
+    // the asker so it keeps its `this`.
+    check(asker, ...args) {
+      return asker.check(...args);
+    }
+  };
+}
+var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function policySource(system, read) {
+  const roles = Array.isArray(read) ? read : read.roles;
+  const catalog = Array.isArray(read) ? [] : read.catalog ?? [];
+  const text2 = (v) => JSON.stringify(v);
+  const key = (k) => IDENT.test(k) ? k : text2(k);
+  const one = (r, pad) => {
+    const parts = [`role: ${text2(r.role)}`];
+    if (r.name) parts.push(`name: ${text2(r.name)}`);
+    if (r.description) parts.push(`description: ${text2(r.description)}`);
+    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text2).join(", ")}]`);
+    if (r.permissions?.length) {
+      const list = r.permissions.map((p) => `${pad}      { ${[
+        ...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text2(p.kind)}`] : [],
+        `resource: ${text2(p.resource)}`,
+        `action: ${text2(p.action)}`,
+        ...p.condition ? [`condition: ${text2(p.condition)}`] : []
+      ].join(", ")} },`);
+      parts.push(`permissions: [
+${list.join("\n")}
+${pad}    ]`);
+    }
+    return `${pad}  {
+${pad}    ${parts.join(`,
+${pad}    `)},
+${pad}  },`;
+  };
+  const resource = (c) => {
+    const parts = [`resource: ${text2(c.resource)}`];
+    if (c.description) parts.push(`description: ${text2(c.description)}`);
+    parts.push(`actions: [${c.actions.map(text2).join(", ")}]`);
+    const attrs = Object.entries(c.attributes ?? {});
+    if (attrs.length) parts.push(`attributes: { ${attrs.map(([k, v]) => `${key(k)}: ${text2(v)}`).join(", ")} }`);
+    return `    { ${parts.join(", ")} },`;
+  };
+  const head = `// The catalog of roles of ${text2(system)}, as Cauthy has it.
+// Written by \`pullPolicy\`: run it again after the catalog
+// changes, and do not edit this file by hand.
+`;
+  if (catalog.length === 0) {
+    return `${head}
+import { definePolicy, type PermissionOf, type RoleOf } from '@cauthyhq/node'
+
+export const policy = definePolicy([
+${roles.map((r) => one(r, "")).join("\n")}
+])
+
+export const { can, hasRole } = policy
+export type Role = RoleOf<typeof policy>
+export type Permission = PermissionOf<typeof policy>
+`;
+  }
+  return `${head}
+import { definePolicy, type CheckOf, type PermissionOf, type RoleOf } from '@cauthyhq/node'
+
+export const policy = definePolicy({
+  catalog: [
+${catalog.map(resource).join("\n")}
+  ],
+  roles: [
+${roles.map((r) => one(r, "  ")).join("\n")}
+  ],
+})
+
+export const { can, hasRole } = policy
+export type Role = RoleOf<typeof policy>
+export type Permission = PermissionOf<typeof policy>
+/** What a check may ask: \`policy.check(auth, request, { organization, ...question })\`. */
+export type Check = CheckOf<typeof policy>
+`;
+}
+function reach(o, doing) {
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const r = {
+    issuer: withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? ""),
+    system: o.system ?? env4("CAUTHY_SYSTEM") ?? "",
+    tenant: o.tenant ?? env4("CAUTHY_TENANT") ?? "",
+    token: o.token ?? env4("CAUTHY_TOKEN") ?? ""
+  };
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: r.issuer, CAUTHY_SYSTEM: r.system, CAUTHY_TENANT: r.tenant, CAUTHY_TOKEN: r.token })) {
+    if (v === "") throw new Error(`@cauthyhq/node: ${name} is required to ${doing}`);
+  }
+  return { ...r, fetch: deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS) };
+}
+async function systemCall(r, method, what, body) {
+  const res = await r.fetch(`${r.issuer}/v1/systems/${encodeURIComponent(r.system)}/${what}`, {
+    ...method === "PUT" ? { method } : {},
+    headers: {
+      authorization: `Bearer ${r.token}`,
+      "x-tenant-key": r.tenant,
+      ...body === void 0 ? { accept: "application/json" } : { "content-type": "application/json" }
+    },
+    ...body === void 0 ? {} : { body: JSON.stringify(body) }
+  });
+  const answer = await res.json().catch(() => null);
+  if (!res.ok) {
+    const verb = method === "GET" ? `refused to give the ${what}` : `refused the ${what}`;
+    throw new Error(`@cauthyhq/node: Cauthy ${verb} (${res.status}): ${answer?.errors?.[0]?.message ?? res.statusText}`);
+  }
+  return answer?.data;
+}
+async function pullPolicy(o = {}) {
+  const data = await systemCall(reach(o, "read a policy"), "GET", "policy");
+  return data?.roles ?? [];
+}
+async function pullCatalog(o = {}) {
+  const data = await systemCall(reach(o, "read a catalog"), "GET", "catalog");
+  return data?.resources ?? [];
+}
+async function pushPolicy(o) {
+  const r = reach(o, "push a policy");
+  if (o.catalog !== void 0) await systemCall(r, "PUT", "catalog", { resources: o.catalog });
+  await systemCall(r, "PUT", "policy", { roles: o.roles });
+}
+async function pushCatalog(o) {
+  const data = await systemCall(reach(o, "push a catalog"), "PUT", "catalog", { resources: o.resources });
+  return data?.resources ?? [];
+}
+function checkWire(q) {
+  return {
+    resource: q.resource,
+    action: q.action,
+    ...q.resourceId !== void 0 ? { resource_id: q.resourceId } : {},
+    ...q.ownerId !== void 0 ? { owner_id: q.ownerId } : {},
+    ...q.attributes !== void 0 ? { attributes: q.attributes } : {}
+  };
+}
+function checkResultOf(d) {
+  const r = d?.rule;
+  const rule = r && typeof r === "object" ? {
+    source: r.source === "exception" ? "exception" : "role",
+    ...r.role ? { role: String(r.role) } : {},
+    kind: String(r.kind ?? "*"),
+    resource: String(r.resource ?? ""),
+    action: String(r.action ?? ""),
+    effect: r.effect === "allow" ? "allow" : "deny",
+    ...r.condition ? { condition: String(r.condition) } : {}
+  } : void 0;
+  return { allowed: d?.allowed === true, reason: String(d?.reason ?? ""), ...rule ? { rule } : {} };
+}
+function organizationIdOf(o) {
+  return typeof o === "string" ? o : typeof o?.id === "string" ? o.id : "";
+}
+
+// src/system.ts
+import { exportJWK as exportJWK2, importJWK as importJWK2, importPKCS8, SignJWT } from "jose";
+
+// src/theme.ts
+var MAX_RADIUS = 40;
+function withoutComments(css) {
+  let out2 = "";
+  let i = 0;
+  for (; ; ) {
+    const open = css.indexOf("/*", i);
+    if (open < 0) return out2 + css.slice(i);
+    out2 += css.slice(i, open);
+    const close = css.indexOf("*/", open + 2);
+    if (close < 0) return out2;
+    i = close + 2;
+  }
+}
+function declarations(css) {
+  const text2 = withoutComments(css);
+  const out2 = [];
+  const within = [];
+  let chunk = "";
+  let quote = "";
+  let depth = 0;
+  const flush = () => {
+    const m = /^\s*(--[\w-]+)\s*:\s*([\s\S]+?)\s*$/.exec(chunk);
+    if (m) out2.push({ name: m[1], value: m[2].replace(/\s+/g, " ").replace(/\s*!important$/, ""), within: [...within] });
+    chunk = "";
+  };
+  for (const ch of text2) {
+    if (quote) {
+      chunk += ch;
+      if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      chunk += ch;
+    } else if (ch === "(") {
+      depth++;
+      chunk += ch;
+    } else if (ch === ")") {
+      depth = Math.max(0, depth - 1);
+      chunk += ch;
+    } else if (ch === "{" && depth === 0) {
+      within.push(chunk.trim().replace(/\s+/g, " "));
+      chunk = "";
+    } else if (ch === "}" && depth === 0) {
+      flush();
+      within.pop();
+    } else if (ch === ";" && depth === 0) {
+      flush();
+    } else {
+      chunk += ch;
+    }
+  }
+  return out2;
+}
+var DARK = /prefers-color-scheme:\s*dark|data-(mode|theme|color-scheme)=["']?dark|\.dark\b/i;
+var LIGHT = /prefers-color-scheme:\s*light|data-(mode|theme|color-scheme)=["']?light|\.light\b/i;
+var NAMED = /data-theme=["']?([\w-]+)/i;
+function applies(d, o) {
+  for (const scope of d.within) {
+    if (o.mode === "light" && DARK.test(scope)) return false;
+    if (o.mode === "dark" && LIGHT.test(scope)) return false;
+    const named = NAMED.exec(scope);
+    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
+    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host|^\.(dark|light)\b/.test(scope)) return false;
+  }
+  return true;
+}
+var TOKEN_CHARS = /^[A-Za-z0-9 #%.,()/'"_+*-]+$/;
+var TOKEN_FUNCS = /* @__PURE__ */ new Set([
+  "var",
+  "calc",
+  "min",
+  "max",
+  "clamp",
+  "rgb",
+  "rgba",
+  "hsl",
+  "hsla",
+  "hwb",
+  "lab",
+  "lch",
+  "oklab",
+  "oklch",
+  "color",
+  "color-mix",
+  "light-dark",
+  "cubic-bezier",
+  "steps",
+  "linear",
+  "linear-gradient",
+  "radial-gradient",
+  "conic-gradient",
+  "repeating-linear-gradient",
+  "repeating-radial-gradient",
+  "drop-shadow",
+  "blur",
+  "translate",
+  "translatex",
+  "translatey",
+  "scale",
+  "rotate"
+]);
+function tokenValue(value) {
+  const v = value.replace(/\s+/g, " ").trim();
+  if (v === "" || v.length > 400 || !TOKEN_CHARS.test(v)) return null;
+  for (const m of v.matchAll(/([A-Za-z-]+)\(/g)) if (!TOKEN_FUNCS.has(m[1].toLowerCase())) return null;
+  if (/^\(|[ ,(]\(/.test(v)) return null;
+  return v;
+}
+var THEME_SELECTOR = /^(?::root|html|body|\[data-(?:theme|mode|color-scheme)(?:=["']?[\w-]+["']?)?\])$/i;
+var isThemeScope = (selectors) => {
+  const parts = selectors.split(/[\s,]+/).filter(Boolean);
+  return parts.length > 0 && parts.every((one) => THEME_SELECTOR.test(one));
+};
+function tokensFromStackmyth(css, options = {}) {
+  const mode = options.mode ?? "light";
+  const all = (Array.isArray(css) ? css : [css]).flatMap(declarations);
+  const named = options.theme ?? all.map((d) => d.within.map((w) => NAMED.exec(w)?.[1]).find((n) => n && !/^(dark|light)$/i.test(n))).find(Boolean);
+  const vars = /* @__PURE__ */ new Map();
+  for (const d of all) {
+    if (!applies(d, { mode, theme: named })) continue;
+    if (!d.within.every((w) => w.startsWith("@") || isThemeScope(w))) continue;
+    vars.set(d.name, d.value);
+  }
+  const inline = (value, depth = 0) => {
+    if (depth > 16) return null;
+    let failed = false;
+    let out2 = value;
+    for (let guard = 0; guard < 64; guard++) {
+      const next = out2.replace(/var\(\s*(--(?!sm-)[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
+        const known = vars.get(name);
+        const got = known !== void 0 ? inline(known, depth + 1) : fallback !== void 0 ? inline(fallback.trim(), depth + 1) : null;
+        if (got === null) failed = true;
+        return got ?? "";
+      });
+      if (failed) return null;
+      if (next === out2) break;
+      out2 = next;
+    }
+    return out2;
+  };
+  const tokens = {};
+  const warnings = [];
+  for (const [name, raw] of vars) {
+    if (!/^--sm-[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) continue;
+    const written = inline(raw);
+    const value = written === null ? null : tokenValue(written);
+    if (value === null) warnings.push(`${name}: "${raw.length > 60 ? raw.slice(0, 57) + "\u2026" : raw}" is not a value Cauthy takes`);
+    else tokens[name] = value;
+  }
+  if (Object.keys(tokens).length === 0) warnings.push("no --sm-* token was found in these stylesheets");
+  return { tokens, warnings };
+}
+function resolve(value, vars, seen = 0) {
+  if (seen > 16) return null;
+  let unresolved = false;
+  let out2 = value;
+  for (let guard = 0; guard < 32 && /var\(/.test(out2); guard++) {
+    out2 = out2.replace(/var\(\s*(--[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
+      const known = vars.get(name);
+      const next = known !== void 0 ? resolve(known, vars, seen + 1) : fallback !== void 0 ? resolve(fallback.trim(), vars, seen + 1) : null;
+      if (next === null) unresolved = true;
+      return next ?? "";
+    });
+    if (unresolved) return null;
+  }
+  return /var\(/.test(out2) ? null : out2.trim();
+}
+var clamp01 = (n) => Math.min(1, Math.max(0, n));
+var hex2 = (n) => Math.round(clamp01(n) * 255).toString(16).padStart(2, "0");
+var gamma = (c) => c <= 31308e-7 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055;
+function out(r, g, b, a = 1) {
+  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`;
+  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1e3) / 1e3})`;
+}
+var alpha = (s) => s === void 0 ? 1 : s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s);
+var KEYWORDS = { white: "#ffffff", black: "#000000" };
+function toColor(value) {
+  const v = value.trim().toLowerCase();
+  if (KEYWORDS[v]) return KEYWORDS[v];
+  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v;
+  let m = /^rgba?\(\s*([\d.]+%?)[\s,]+([\d.]+%?)[\s,]+([\d.]+%?)(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const ch = (s) => s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s) / 255;
+    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]));
+  }
+  m = /^hsla?\(\s*([\d.]+)(?:deg)?[\s,]+([\d.]+)%[\s,]+([\d.]+)%(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const h = (parseFloat(m[1]) % 360 + 360) % 360;
+    const s = parseFloat(m[2]) / 100;
+    const l = parseFloat(m[3]) / 100;
+    const f = (n) => {
+      const k = (n + h / 30) % 12;
+      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1));
+    };
+    return out(f(0), f(8), f(4), alpha(m[4]));
+  }
+  m = /^oklch\(\s*([\d.]+%?)\s+([\d.]+%?)\s+([\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const L = m[1].endsWith("%") ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
+    const C = m[2].endsWith("%") ? parseFloat(m[2]) / 100 * 0.4 : parseFloat(m[2]);
+    const H = parseFloat(m[3]) * Math.PI / 180;
+    const a = C * Math.cos(H);
+    const b = C * Math.sin(H);
+    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3);
+    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3);
+    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3);
+    return out(
+      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),
+      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),
+      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),
+      alpha(m[4])
+    );
+  }
+  return null;
+}
+function toRadius(value) {
+  const m = /^([\d.]+)(px|rem|em)?$/.exec(value.trim());
+  if (!m) return null;
+  const px = parseFloat(m[1]) * (m[2] === "rem" || m[2] === "em" ? 16 : 1);
+  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null;
+}
+function toFont(value) {
+  const v = value.trim();
+  return /^[A-Za-z0-9 ,'"_-]{1,200}$/.test(v) && (v.match(/"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null;
+}
+var COLORS = [
+  ["background", ["--sm-bg-surface", "--sm-surface"]],
+  ["surface", ["--sm-bg-surface-raised", "--sm-surface-raised"]],
+  ["text", ["--sm-text-primary", "--sm-surface-text"]],
+  ["textMuted", ["--sm-text-secondary"]],
+  ["border", ["--sm-border-default", "--sm-surface-border"]],
+  ["primary", ["--sm-primary", "--sm-bg-interactive"]],
+  ["primaryText", ["--sm-primary-text", "--sm-text-inverse"]],
+  ["accent", ["--sm-text-brand", "--sm-border-focus", "--sm-accent"]],
+  ["error", ["--sm-error-soft-text", "--sm-error"]],
+  ["errorBackground", ["--sm-error-soft"]],
+  ["success", ["--sm-success-soft-text", "--sm-success"]],
+  ["successBackground", ["--sm-success-soft"]]
+];
+function themeFromStackmyth(css, options = {}) {
+  const o = { mode: options.mode ?? "light", theme: options.theme };
+  const vars = /* @__PURE__ */ new Map();
+  for (const sheet of Array.isArray(css) ? css : [css]) {
+    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value);
+  }
+  const theme = {};
+  const warnings = [];
+  const read = (tokens, to, what) => {
+    for (const token of tokens) {
+      const raw = vars.get(token);
+      if (raw === void 0) continue;
+      const value = resolve(raw, vars);
+      const got = value === null ? null : to(value);
+      if (got !== null) return got;
+      warnings.push(`${token}: "${raw}" is not ${what} Cauthy can take`);
+    }
+    return void 0;
+  };
+  for (const [field, tokens] of COLORS) {
+    const c = read(tokens, toColor, "a colour");
+    if (c !== void 0) theme[field] = c;
+  }
+  const radius = read(["--sm-radius-container", "--sm-radius-md"], toRadius, "a length");
+  if (radius !== void 0) theme.radius = radius;
+  const button = read(["--sm-radius-interactive", "--sm-radius-sm"], toRadius, "a length");
+  if (button !== void 0) theme.buttonRadius = button;
+  const font = read(["--sm-font-family"], toFont, "a font list");
+  if (font !== void 0) theme.fontFamily = font;
+  if (options.logoUrl) theme.logoUrl = options.logoUrl;
+  if (vars.size === 0) warnings.push("no custom properties were found: is this the stylesheet that declares the --sm-* tokens?");
+  else if (![...vars.keys()].some((k) => k.startsWith("--sm-"))) warnings.push("no --sm-* token was found in these stylesheets");
+  return { theme, warnings };
+}
+function toWire(theme) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    textMuted: "text_muted",
+    border: "border",
+    primary: "primary",
+    primaryText: "primary_text",
+    accent: "accent",
+    error: "error",
+    errorBackground: "error_background",
+    success: "success",
+    successBackground: "success_background",
+    radius: "radius",
+    buttonRadius: "button_radius",
+    fontFamily: "font_family",
+    logoUrl: "logo_url",
+    fonts: "fonts",
+    layout: "layout",
+    panelColors: "panel_colors",
+    panelText: "panel_text",
+    panelIconUrl: "panel_icon_url",
+    texts: "texts",
+    inputBackground: "input_background",
+    inputBorder: "input_border",
+    tokens: "tokens"
+  };
+  const wire = {};
+  for (const [k, v] of Object.entries(theme)) {
+    if (v === void 0 || v === "" || Array.isArray(v) && v.length === 0) continue;
+    wire[names[k]] = v;
+  }
+  return wire;
+}
+function fromWire(wire) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    text_muted: "textMuted",
+    border: "border",
+    primary: "primary",
+    primary_text: "primaryText",
+    accent: "accent",
+    error: "error",
+    error_background: "errorBackground",
+    success: "success",
+    success_background: "successBackground",
+    radius: "radius",
+    button_radius: "buttonRadius",
+    font_family: "fontFamily",
+    logo_url: "logoUrl",
+    fonts: "fonts",
+    layout: "layout",
+    panel_colors: "panelColors",
+    panel_text: "panelText",
+    panel_icon_url: "panelIconUrl",
+    texts: "texts",
+    input_background: "inputBackground",
+    input_border: "inputBorder",
+    tokens: "tokens"
+  };
+  const theme = {};
+  for (const [k, v] of Object.entries(wire ?? {})) if (names[k] && v !== void 0 && v !== null && v !== "") theme[names[k]] = v;
+  return theme;
+}
+async function pushTheme(o) {
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
+  const clientId = o.clientId ?? env4("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`@cauthyhq/node: ${name} is required to push a theme`);
+  }
+  const res = await deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify(toWire(o.theme))
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(`@cauthyhq/node: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  }
+}
+
+// src/system.ts
+var ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var SKEW_MS = 3e4;
+var CauthyApiError = class extends Error {
+  constructor(status, code, message) {
+    super(`@cauthyhq/node: ${message}`);
+    this.status = status;
+    this.code = code;
+    this.name = "CauthyApiError";
+  }
+  status;
+  code;
+};
+function env(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function toOrganization(o) {
+  return {
+    id: o.id,
+    system: o.system,
+    name: o.name,
+    kind: o.kind,
+    externalId: o.external_id,
+    status: o.status,
+    metadata: o.metadata ?? {},
+    members: o.members,
+    createdAt: o.created_at,
+    updatedAt: o.updated_at
+  };
+}
+function toMember(m) {
+  return { userId: m.user_id, email: m.email, name: m.name, status: m.status, role: m.role, ...m.invited === void 0 ? {} : { invited: m.invited } };
+}
+function asJwk(k) {
+  if (typeof k.privateKey !== "string") return k.privateKey;
+  return k.privateKey.includes("BEGIN") ? void 0 : JSON.parse(k.privateKey);
+}
+async function loadKey(k) {
+  const jwk = asJwk(k);
+  return jwk ? importJWK2(jwk, "RS256") : importPKCS8(k.privateKey, "RS256", { extractable: true });
+}
+function createSystem(given = {}) {
+  const issuer = withoutTrailingSlashes(given.issuer ?? env("CAUTHY_ISSUER") ?? "");
+  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET") ?? "";
+  const envKey = env("CAUTHY_SYSTEM_KEY");
+  const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
+  const ownSystem = given.system ?? env("CAUTHY_SYSTEM") ?? "";
+  const acceptInviteUrl = given.acceptInviteUrl ?? env("CAUTHY_ACCEPT_INVITE_URL") ?? "";
+  const inviteHeaders = /^https?:\/\//.test(acceptInviteUrl) ? { "x-cauthy-client-id": clientId, "x-cauthy-link-to": acceptInviteUrl } : {};
+  const timeoutMs = given.timeoutMs ?? 2e3;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new CauthyConfigError("timeoutMs must be a positive number of milliseconds");
+  const limited = deadline(given.fetch, timeoutMs);
+  const doFetch = async (input, init) => {
+    try {
+      return await limited(input, init);
+    } catch (err) {
+      if (isTimeout(err)) throw new CauthyApiError(503, "unavailable", `Cauthy did not answer within ${timeoutMs} ms`);
+      throw err;
+    }
+  };
+  const tokenEndpoint = `${issuer}/v1/oauth/token`;
+  function configured() {
+    if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address");
+    if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
+    if (given.keys) {
+      if (!given.keysClientId) throw new CauthyConfigError("the contract gives the system no identity of its own: its link needs a service block");
+      return;
+    }
+    if (key ? key.keyId === "" : clientSecret === "") {
+      throw new CauthyConfigError(key ? "the key needs its id (CAUTHY_SYSTEM_KEY_ID)" : "to act on its own the application needs its secret (CAUTHY_CLIENT_SECRET) or a key (CAUTHY_SYSTEM_KEY)");
+    }
+  }
+  let imported;
+  const signingKey = () => imported ??= loadKey(key);
+  async function fail(res, what) {
+    const body = await res.json().catch(() => null);
+    const first = body?.errors?.[0];
+    const code = typeof body?.error === "string" ? body.error : first?.code;
+    const message = typeof body?.error === "string" ? body.error_description : first?.message;
+    throw new CauthyApiError(res.status, code ?? "error", `Cauthy refused ${what} (${res.status}): ${message ?? res.statusText}`);
+  }
+  let held;
+  let asking;
+  async function ask() {
+    configured();
+    const self = given.keys ? given.keysClientId : key?.clientId || clientId;
+    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: self });
+    if (given.keys || key) {
+      const signer = given.keys ? await given.keys.current() : { kid: key.keyId, privateKey: await signingKey() };
+      const assertion = await new SignJWT({}).setProtectedHeader({ alg: "RS256", kid: signer.kid }).setIssuer(self).setSubject(self).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(signer.privateKey);
+      form.set("client_assertion_type", ASSERTION_TYPE);
+      form.set("client_assertion", assertion);
+    } else {
+      form.set("client_secret", clientSecret);
+    }
+    const res = await doFetch(tokenEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form });
+    if (!res.ok) await fail(res, "the application's own token");
+    const t = await res.json();
+    held = { value: t.access_token, until: Date.now() + t.expires_in * 1e3 - SKEW_MS };
+    return t.access_token;
+  }
+  function token() {
+    if (held && Date.now() < held.until) return Promise.resolve(held.value);
+    return asking ??= ask().finally(() => {
+      asking = void 0;
+    });
+  }
+  async function call(method, path, body, extra = {}) {
+    const send = async () => doFetch(`${issuer}${path}`, {
+      method,
+      headers: { authorization: `Bearer ${await token()}`, ...extra, ...body === void 0 ? {} : { "content-type": "application/json" } },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    let res = await send();
+    if (res.status === 401 && held) {
+      held = void 0;
+      res = await send();
+    }
+    if (!res.ok) await fail(res, `${method} ${path}`);
+    return res.status === 204 ? void 0 : res.json();
+  }
+  const data = async (method, path, body, extra) => (await call(method, path, body, extra))?.data;
+  const id = encodeURIComponent;
+  return {
+    token,
+    request: data,
+    organizations: {
+      async list(query = {}) {
+        const q = new URLSearchParams();
+        for (const [k, v] of Object.entries(query)) if (v !== void 0) q.set(k, String(v));
+        const out2 = await call("GET", `/v1/organizations${q.size ? `?${q}` : ""}`);
+        return { items: out2.data.map(toOrganization), total: out2.total_count };
+      },
+      async create(input) {
+        return toOrganization(await data(
+          "POST",
+          "/v1/organizations",
+          { name: input.name, kind: input.kind, external_id: input.externalId, metadata: input.metadata }
+        ));
+      },
+      async get(orgId) {
+        return toOrganization(await data("GET", `/v1/organizations/${id(orgId)}`));
+      },
+      async update(orgId, patch) {
+        return toOrganization(await data("PATCH", `/v1/organizations/${id(orgId)}`, patch));
+      },
+      async remove(orgId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}`);
+      }
+    },
+    members: {
+      async list(orgId) {
+        return (await data("GET", `/v1/organizations/${id(orgId)}/members`)).map(toMember);
+      },
+      async add(orgId, m) {
+        return toMember(await data(
+          "POST",
+          `/v1/organizations/${id(orgId)}/members`,
+          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId, only_new: m.onlyNew !== false },
+          inviteHeaders
+        ));
+      },
+      async setRole(orgId, userId, role) {
+        return toMember(await data("PUT", `/v1/organizations/${id(orgId)}/members/${id(userId)}`, { role }));
+      },
+      async remove(orgId, userId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}/members/${id(userId)}`);
+      }
+    },
+    async invite(person) {
+      const u = await data("POST", "/v1/users", { ...person, client_id: clientId }, inviteHeaders);
+      return { id: u.id, email: u.email };
+    },
+    theme: {
+      async get(of = clientId) {
+        return fromWire(await data("GET", `/v1/oauth/clients/${id(of)}/theme`));
+      }
+    },
+    policy: {
+      async get(system) {
+        return (await data("GET", `/v1/systems/${id(system)}/policy`)).roles ?? [];
+      }
+    },
+    catalog: {
+      async get(system) {
+        return (await data("GET", `/v1/systems/${id(system)}/catalog`)).resources ?? [];
+      },
+      async set(system, resources) {
+        return (await data("PUT", `/v1/systems/${id(system)}/catalog`, { resources })).resources ?? [];
+      }
+    },
+    async check(q) {
+      const system = q.system ?? ownSystem;
+      if (system === "") throw new CauthyConfigError("name the system to check in (system, or CAUTHY_SYSTEM)");
+      return checkResultOf(await data("POST", `/v1/systems/${id(system)}/check`, { organization_id: q.organizationId, user_id: q.userId, ...checkWire(q) }));
+    },
+    async publicJwks() {
+      if (given.keys) return given.keys.published();
+      if (!key) return { keys: [] };
+      const { kty, n, e } = asJwk(key) ?? await exportJWK2(await signingKey());
+      return { keys: [{ kty, n, e, kid: key.keyId, alg: "RS256", use: "sig" }] };
+    }
+  };
+}
+
+// src/validate.ts
+var MIN_PASSWORD = 12;
+var MAX_PASSWORD = 128;
+var FLOOR_PASSWORD = 8;
+var MAX_NAME = 120;
+var CLASSES = ["lowercase", "uppercase", "digit", "symbol"];
+var DEFAULT_PASSWORD_POLICY = Object.freeze({ min: MIN_PASSWORD, max: MAX_PASSWORD, requires: [], min_classes: 0, reject_breached: false });
+var int = (v, fallback) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : fallback;
+function passwordPolicyOf(raw) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  const min = Math.min(Math.max(int(r.min ?? r.min_length, MIN_PASSWORD) || MIN_PASSWORD, FLOOR_PASSWORD), MAX_PASSWORD);
+  const max = Math.max(Math.min(int(r.max ?? r.max_length, MAX_PASSWORD) || MAX_PASSWORD, MAX_PASSWORD), min);
+  const asked = Array.isArray(r.requires) ? r.requires : [];
+  return {
+    min,
+    max,
+    requires: CLASSES.filter((c) => asked.includes(c)),
+    min_classes: Math.min(Math.max(int(r.min_classes ?? r.minClasses, 0), 0), CLASSES.length),
+    reject_breached: (r.reject_breached ?? r.rejectBreached) === true
+  };
+}
+function utf8Length(v) {
+  let n = 0;
+  for (const ch of v) {
+    const c = ch.codePointAt(0);
+    n += c < 128 ? 1 : c < 2048 ? 2 : c < 65536 ? 3 : 4;
+  }
+  return n;
+}
+function classesOf(v) {
+  const has = /* @__PURE__ */ new Set();
+  for (const ch of v) {
+    if (new RegExp("\\p{Ll}", "u").test(ch)) has.add("lowercase");
+    else if (new RegExp("\\p{Lu}", "u").test(ch)) has.add("uppercase");
+    else if (new RegExp("\\p{Nd}", "u").test(ch)) has.add("digit");
+    else if (!new RegExp("\\p{L}", "u").test(ch)) has.add("symbol");
+  }
+  return has;
+}
+function passwordProblems(value, policy = DEFAULT_PASSWORD_POLICY) {
+  const p = passwordPolicyOf(policy);
+  const out2 = [];
+  const length = utf8Length(value);
+  if (length < p.min) out2.push("too_short");
+  if (length > p.max) out2.push("too_long");
+  const has = classesOf(value);
+  for (const c of p.requires) if (!has.has(c)) out2.push(`needs_${c}`);
+  if (p.min_classes > 0 && CLASSES.filter((c) => has.has(c)).length < p.min_classes) out2.push("needs_classes");
+  return out2;
+}
+var RULES = {
+  en: {
+    between: "Between {min} and {max} characters.",
+    requires: "Include {kinds}.",
+    and: "and",
+    classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+    breached: "Passwords found in known data breaches are not accepted.",
+    kinds: { lowercase: "a lowercase letter", uppercase: "an uppercase letter", digit: "a digit", symbol: "a symbol" },
+    reasons: {
+      too_short: "Use at least {min} characters.",
+      too_long: "Use at most {max} characters.",
+      needs_lowercase: "Include a lowercase letter.",
+      needs_uppercase: "Include an uppercase letter.",
+      needs_digit: "Include a digit.",
+      needs_symbol: "Include a symbol.",
+      needs_classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+      breached: "This password appears in a known data breach. Choose a different one."
+    }
+  },
+  es: {
+    between: "Entre {min} y {max} caracteres.",
+    requires: "Incluye {kinds}.",
+    and: "y",
+    classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+    breached: "No se aceptan contrase\xF1as que aparecen en filtraciones de datos conocidas.",
+    kinds: { lowercase: "una min\xFAscula", uppercase: "una may\xFAscula", digit: "un n\xFAmero", symbol: "un s\xEDmbolo" },
+    reasons: {
+      too_short: "Usa al menos {min} caracteres.",
+      too_long: "Usa como m\xE1ximo {max} caracteres.",
+      needs_lowercase: "Incluye una min\xFAscula.",
+      needs_uppercase: "Incluye una may\xFAscula.",
+      needs_digit: "Incluye un n\xFAmero.",
+      needs_symbol: "Incluye un s\xEDmbolo.",
+      needs_classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+      breached: "Esta contrase\xF1a aparece en una filtraci\xF3n de datos conocida. Elige otra."
+    }
+  }
+};
+var fill = (s, p) => s.replace("{min}", String(p.min)).replace("{max}", String(p.max)).replace("{n}", String(p.min_classes));
+function describePasswordPolicy(policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const parts = [fill(t.between, p)];
+  if (p.requires.length > 0) {
+    const kinds = p.requires.map((c) => t.kinds[c]);
+    const listed = kinds.length === 1 ? kinds[0] : `${kinds.slice(0, -1).join(", ")} ${t.and} ${kinds[kinds.length - 1]}`;
+    parts.push(t.requires.replace("{kinds}", listed));
+  }
+  if (p.min_classes > 0) parts.push(fill(t.classes, p));
+  if (p.reject_breached) parts.push(t.breached);
+  return parts.join(" ");
+}
+function explainPasswordProblems(reasons, policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const said = reasons.filter((r) => r in t.reasons).map((r) => fill(t.reasons[r], p));
+  return said.length > 0 ? said.join(" ") : describePasswordPolicy(p, locale);
+}
+var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function checkEmail(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "email", code: "required", message: "Enter your email address." };
+  if (v.length > 254 || !EMAIL.test(v)) return { field: "email", code: "invalid_email", message: "That does not look like an email address." };
+  return null;
+}
+function checkPassword(value) {
+  if (typeof value !== "string" || value === "") return { field: "password", code: "required", message: "Enter your password." };
+  if (value.length > MAX_PASSWORD) return { field: "password", code: "too_long", message: "That password is too long." };
+  return null;
+}
+function checkNewPassword(value, policy) {
+  if (typeof value !== "string" || value === "") return { field: "password", code: "required", message: "Enter your password." };
+  const p = policy ? passwordPolicyOf(policy) : DEFAULT_PASSWORD_POLICY;
+  const reasons = passwordProblems(value, p);
+  if (reasons.length === 0) return null;
+  return { field: "password", code: reasons[0], message: explainPasswordProblems(reasons, p) };
+}
+function checkName(value) {
+  if (value === void 0 || value === null || value === "") return null;
+  if (typeof value !== "string" || value.trim().length > MAX_NAME) return { field: "name", code: "too_long", message: `Use at most ${MAX_NAME} characters.` };
+  return null;
+}
+var MAX_ORGANIZATION = 120;
+function checkOrganization(value, required = false) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return required ? { field: "organization", code: "required", message: "Enter your company's name." } : null;
+  if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
+function checkCode(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "code", code: "required", message: "Enter the code." };
+  if (v.length > 40) return { field: "code", code: "too_long", message: "That is not a code." };
+  return null;
+}
+function firstProblem(...checks) {
+  return checks.find((c) => c !== null) ?? null;
+}
+
+// src/webhook.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var CauthyWebhookError = class extends Error {
+  constructor(reason) {
+    super(`@cauthyhq/node: webhook refused: ${reason}`);
+    this.reason = reason;
+    this.name = "CauthyWebhookError";
+  }
+  reason;
+};
+function memoryReplayStore(now = Date.now) {
+  const seen = /* @__PURE__ */ new Map();
+  return {
+    async claim(key, until) {
+      const t = now();
+      if (seen.size > 1e4) {
+        for (const [k, u] of seen) if (u <= t) seen.delete(k);
+      }
+      const held = seen.get(key);
+      if (held !== void 0 && held > t) return false;
+      seen.set(key, until.getTime());
+      return true;
+    }
+  };
+}
+var keys = /* @__PURE__ */ new Map();
+function keysOf(issuer) {
+  let set = keys.get(issuer);
+  if (set === void 0) {
+    set = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 3e4 });
+    keys.set(issuer, set);
+  }
+  return set;
+}
+var hex = (s) => typeof s === "string" && s !== "" ? s : void 0;
+async function verifyWebhook(request, options = {}) {
+  const env4 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
+  const issuer = withoutTrailingSlashes(options.issuer ?? env4 ?? "");
+  if (issuer === "") throw new CauthyWebhookError("issuer (CAUTHY_ISSUER) is not set");
+  const signature = request.headers.get("x-cauthy-signature-jwt");
+  if (!signature) throw new CauthyWebhookError("no signature");
+  const raw = new Uint8Array(await request.arrayBuffer());
+  const audience = options.url ?? request.url.split("?")[0];
+  let claims;
+  try {
+    const verified = await jwtVerify(signature, options.jwks ?? keysOf(issuer), {
+      algorithms: ["RS256"],
+      audience,
+      typ: "cauthy-webhook+jwt",
+      requiredClaims: ["exp", "iat", "jti", "body_sha256"],
+      currentDate: options.now,
+      clockTolerance: 30
+    });
+    claims = verified.payload;
+  } catch (err) {
+    throw new CauthyWebhookError(err instanceof Error ? err.message : "bad signature");
+  }
+  if (claims.iss !== issuer && claims.domain_iss !== issuer) {
+    throw new CauthyWebhookError('unexpected "iss" claim value');
+  }
+  const now = Math.floor((options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+  if (typeof claims.iat !== "number" || claims.iat > now + 30) throw new CauthyWebhookError("signed in the future");
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", raw));
+  let b64 = "";
+  for (const b of digest) b64 += String.fromCharCode(b);
+  const hash = btoa(b64).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  if (hash !== claims.body_sha256) throw new CauthyWebhookError("the body is not the one that was signed");
+  let body;
+  try {
+    body = JSON.parse(new TextDecoder().decode(raw));
+  } catch {
+    throw new CauthyWebhookError("the body is not JSON");
+  }
+  if (body.id !== claims.jti || body.event !== claims.evt || body.tenant_id !== claims.tid) {
+    throw new CauthyWebhookError("the body and its signature disagree");
+  }
+  if (options.replay) {
+    const exp = typeof claims.exp === "number" ? claims.exp : now + 300;
+    if (!await options.replay.claim(`${String(claims.jti)}:${String(claims.iat)}`, new Date(exp * 1e3))) {
+      throw new CauthyWebhookError("this delivery was already taken");
+    }
+  }
+  const inner = body.data ?? {};
+  return {
+    id: String(body.id),
+    type: String(body.event),
+    tenantId: String(body.tenant_id),
+    createdAt: String(inner.created_at ?? body.created_at ?? ""),
+    ...hex(inner.user_id) ? { userId: inner.user_id } : {},
+    ...hex(inner.actor_id) ? { actorId: inner.actor_id } : {},
+    data: inner.data ?? {}
+  };
+}
+
+// src/protocol.ts
+var PROTOCOL_VERSION = "1";
+var SIGN_IN_ROUTES = /* @__PURE__ */ new Set([
+  "/sign-in/email",
+  "/sign-in/mfa",
+  "/sign-in/mfa/send",
+  "/sign-in/mfa/email",
+  "/sign-in/mfa/push",
+  "/sign-in/mfa/push/finish",
+  "/sign-up/email",
+  "/invitation/accept",
+  "/sign-in/magic-link",
+  "/sign-in/email-code",
+  "/sign-in/magic-link/verify",
+  "/sign-in/passkey/begin",
+  "/sign-in/passkey/finish",
+  "/sign-in/google-one-tap/begin",
+  "/sign-in/google-one-tap",
+  "/sign-in/anonymous",
+  "/me/upgrade"
+]);
+function nextOf(route, status) {
+  switch (status) {
+    case "signed_in":
+      return "done";
+    case "mfa_required":
+      return "mfa";
+    case "verification_required":
+      return "verify_email";
+    // A code went out: the second step's, or the one that comes with a sign-in link.
+    case "sent":
+      return route.startsWith("/sign-in/mfa") ? "mfa" : "code";
+    // A ceremony began: the page shows Google's prompt and posts what it gives, or runs the passkey's.
+    case "started":
+      return route === "/sign-in/google-one-tap/begin" ? "one_tap" : "passkey";
+    default:
+      return void 0;
+  }
+}
+async function finish(res, route, cacheable = false) {
+  const headers = new Headers();
+  res.headers.forEach((value, name) => {
+    if (name !== "set-cookie") headers.set(name, value);
+  });
+  for (const cookie of res.headers.getSetCookie()) headers.append("set-cookie", cookie);
+  headers.set("cauthy-protocol", PROTOCOL_VERSION);
+  if (!cacheable && !(headers.get("cache-control") ?? "").includes("no-store")) headers.set("cache-control", "no-store");
+  let body = res.body;
+  if (route !== null && SIGN_IN_ROUTES.has(route) && res.ok && (headers.get("content-type") ?? "").startsWith("application/json")) {
+    const text2 = await res.text();
+    body = text2;
+    try {
+      const parsed = JSON.parse(text2);
+      const next = nextOf(route, parsed?.status);
+      if (parsed !== null && next !== void 0) body = JSON.stringify({ ...parsed, next });
+    } catch {
+    }
+    headers.delete("content-length");
+  }
+  return new Response(body, { status: res.status, statusText: res.statusText, headers });
+}
+
+// src/verify.ts
+import { compactVerify, createLocalJWKSet } from "jose";
+
+// src/json.ts
+var SPACE = /* @__PURE__ */ new Set([" ", "	", "\n", "\r"]);
+var LIMIT = 2n ** 53n;
+function parseStrict(text2, integerMembers = []) {
+  let i = 0;
+  let depth = 0;
+  const fail = (what) => {
+    throw new SyntaxError(`${what} at ${i}`);
+  };
+  const skip = () => {
+    while (i < text2.length && SPACE.has(text2[i])) i++;
+  };
+  const value = (integer = false) => {
+    skip();
+    const c = text2[i];
+    if (c === "{") return object();
+    if (c === "[") return array();
+    if (c === '"') return string();
+    if (c === "-" || c >= "0" && c <= "9") return number(integer);
+    for (const [word, v] of [["true", true], ["false", false], ["null", null]]) {
+      if (text2.startsWith(word, i)) {
+        i += word.length;
+        return v;
+      }
+    }
+    return fail("unexpected character");
+  };
+  const string = () => {
+    const start = i;
+    i++;
+    while (i < text2.length && text2[i] !== '"') i += text2[i] === "\\" ? 2 : 1;
+    if (text2[i] !== '"') fail("unterminated string");
+    i++;
+    return JSON.parse(text2.slice(start, i));
+  };
+  const number = (integer) => {
+    const m = /^-?(0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?/.exec(text2.slice(i));
+    if (!m) return fail("bad number");
+    i += m[0].length;
+    if (integer && (m[2] !== void 0 || m[3] !== void 0)) return Number.NaN;
+    if (m[2] === void 0 && m[3] === void 0) {
+      const big = BigInt(m[0]);
+      if (big > LIMIT || big < -LIMIT) return Number.NaN;
+    }
+    return Number(m[0]);
+  };
+  const array = () => {
+    i++;
+    depth++;
+    const out2 = [];
+    skip();
+    if (text2[i] === "]") {
+      i++;
+      depth--;
+      return out2;
+    }
+    for (; ; ) {
+      out2.push(value());
+      skip();
+      if (text2[i] === ",") i++;
+      else if (text2[i] === "]") {
+        i++;
+        depth--;
+        return out2;
+      } else fail("expected , or ]");
+    }
+  };
+  const object = () => {
+    i++;
+    depth++;
+    const out2 = {};
+    const seen = /* @__PURE__ */ new Set();
+    skip();
+    if (text2[i] === "}") {
+      i++;
+      depth--;
+      return out2;
+    }
+    for (; ; ) {
+      skip();
+      if (text2[i] !== '"') fail("expected a name");
+      const name = string();
+      if (seen.has(name)) fail(`repeated name ${JSON.stringify(name)}`);
+      seen.add(name);
+      skip();
+      if (text2[i] !== ":") fail("expected :");
+      i++;
+      Object.defineProperty(out2, name, { value: value(depth === 1 && integerMembers.includes(name)), enumerable: true, writable: true, configurable: true });
+      skip();
+      if (text2[i] === ",") i++;
+      else if (text2[i] === "}") {
+        i++;
+        depth--;
+        return out2;
+      } else fail("expected , or }");
+    }
+  };
+  const result = value();
+  skip();
+  if (i < text2.length) fail("trailing characters");
+  return result;
+}
+
+// src/verify.ts
+var CauthyUnavailableError = class extends Error {
+  constructor(detail) {
+    super(`@cauthyhq/node: Cauthy's keys are unavailable: ${detail}`);
+    this.name = "CauthyUnavailableError";
+  }
+};
+var CauthyTokenError = class extends Error {
+  constructor(reason, detail) {
+    super(`@cauthyhq/node: token refused: ${reason}${detail ? ` (${detail})` : ""}`);
+    this.reason = reason;
+    this.detail = detail;
+    this.name = "CauthyTokenError";
+  }
+  reason;
+  detail;
+};
+var MAX_TOKEN_BYTES = 8192;
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var NIL_UUID2 = "00000000-0000-0000-0000-000000000000";
+var SEGMENT = /^[A-Za-z0-9_-]+$/;
+var MAX_KEYS_BYTES = 64 * 1024;
+var KEYS_TIMEOUT_MS = 5e3;
+var KEYS_COOLDOWN_MS = 3e4;
+var KEYS_DEFAULT_TTL_S = 300;
+var KEYS_MIN_TTL_S = 60;
+var KEYS_MAX_TTL_S = 3600;
+function remoteKeys(issuer, fetchKeys = fetch) {
+  let set;
+  let startedAt = 0;
+  let expiresAt = 0;
+  let inflight;
+  const load = async () => {
+    startedAt = Date.now();
+    try {
+      const res = await fetchKeys(`${issuer}/.well-known/jwks.json`, { redirect: "manual", signal: AbortSignal.timeout(KEYS_TIMEOUT_MS), headers: { accept: "application/json" } });
+      if (res.status !== 200) throw new Error(`answered ${res.status}`);
+      const bytes = await readCapped(res, MAX_KEYS_BYTES);
+      const parsed = JSON.parse(new TextDecoder().decode(bytes));
+      if (!parsed || !Array.isArray(parsed.keys)) throw new Error("not a key set");
+      const seen = /* @__PURE__ */ new Set();
+      for (const k of parsed.keys) {
+        const usable = k?.kty === "RSA" && (k.use === void 0 || k.use === "sig") && (k.alg === void 0 || k.alg === "RS256");
+        if (!usable || typeof k.kid !== "string") continue;
+        if (seen.has(k.kid)) throw new Error(`two usable keys share the kid ${JSON.stringify(k.kid)}`);
+        seen.add(k.kid);
+      }
+      set = createLocalJWKSet(parsed);
+      const maxAge = /max-age=(\d+)/.exec(res.headers.get("cache-control") ?? "");
+      const ttl = Math.max(KEYS_MIN_TTL_S, Math.min(maxAge ? Number(maxAge[1]) : KEYS_DEFAULT_TTL_S, KEYS_MAX_TTL_S));
+      expiresAt = Date.now() + ttl * 1e3;
+    } catch (err) {
+      if (set === void 0) throw new CauthyUnavailableError(err instanceof Error ? err.message : "unreachable");
+      expiresAt = Math.max(expiresAt, Date.now() + KEYS_COOLDOWN_MS);
+    }
+  };
+  const refresh = () => {
+    inflight ??= load().finally(() => {
+      inflight = void 0;
+    });
+    return inflight;
+  };
+  return async (header, token) => {
+    if (set === void 0 || Date.now() >= expiresAt) await refresh();
+    try {
+      return await set(header, token);
+    } catch (err) {
+      const unknown = err?.code === "ERR_JWKS_NO_MATCHING_KEY";
+      if (unknown && Date.now() - startedAt >= KEYS_COOLDOWN_MS) {
+        await refresh();
+        return set(header, token);
+      }
+      throw err;
+    }
+  };
+}
+async function readCapped(res, max) {
+  const reader = res.body?.getReader();
+  if (!reader) return new Uint8Array();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.length;
+    if (size > max) {
+      await reader.cancel();
+      throw new Error(`over ${max} bytes`);
+    }
+    chunks.push(value);
+  }
+  const out2 = new Uint8Array(size);
+  let at = 0;
+  for (const c of chunks) {
+    out2.set(c, at);
+    at += c.length;
+  }
+  return out2;
+}
+var published2 = /* @__PURE__ */ new Map();
+var withFetch = /* @__PURE__ */ new WeakMap();
+function remoteKeysFor(issuer, fetchKeys) {
+  let byIssuer = withFetch.get(fetchKeys);
+  if (!byIssuer) withFetch.set(fetchKeys, byIssuer = /* @__PURE__ */ new Map());
+  let set = byIssuer.get(issuer);
+  if (!set) byIssuer.set(issuer, set = remoteKeys(issuer, fetchKeys));
+  return set;
+}
+function keysOf2(issuer) {
+  let set = published2.get(issuer);
+  if (set === void 0) {
+    set = remoteKeys(issuer);
+    published2.set(issuer, set);
+  }
+  return set;
+}
+function env2(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function bearer(from) {
+  if (typeof from === "string") return from.replace(/^Bearer\s+/i, "");
+  const header = (from instanceof Headers ? from : from.headers).get("authorization") ?? "";
+  return /^Bearer\s+/i.test(header) ? header.replace(/^Bearer\s+/i, "").trim() : "";
+}
+function issuerAddress(value, what) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new CauthyConfigError(`${what} must be an https address, e.g. https://id.example.com`);
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname.endsWith(".localhost") || url.hostname.endsWith(".test");
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) throw new CauthyConfigError(`${what} must be https (http only for localhost, *.localhost and *.test)`);
+  if (url.search !== "" || url.hash !== "") throw new CauthyConfigError(`${what} must have no query or fragment`);
+  return withoutTrailingSlashes(value);
+}
+var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function decodeJson(segment) {
+  const padded = segment.replace(/-/g, "+").replace(/_/g, "/");
+  return parseStrict(Buffer.from(padded, "base64").toString("utf8"));
+}
+function createTokenVerifier(options = {}) {
+  const issuerGiven = options.issuer ?? env2("CAUTHY_ISSUER") ?? "";
+  if (issuerGiven === "") throw new CauthyConfigError("issuer (CAUTHY_ISSUER) is not set");
+  const issuer = issuerAddress(issuerGiven, "issuer");
+  const issuers = [issuer, ...(options.issuers ?? []).map((i) => issuerAddress(i, "issuers"))];
+  const audience = options.audience ?? env2("CAUTHY_AUDIENCE") ?? "";
+  if (audience === "") throw new CauthyConfigError("audience (CAUTHY_AUDIENCE) is not set: without it a token issued for another application would be accepted");
+  const tenant = options.tenantId ?? env2("CAUTHY_TENANT_ID") ?? "";
+  if (tenant === "") throw new CauthyConfigError("tenantId (CAUTHY_TENANT_ID) is not set: without it a token of another workspace would be accepted");
+  if (!UUID2.test(tenant) || tenant === NIL_UUID2) throw new CauthyConfigError("tenantId must be the workspace's id, a lowercase UUID that is not the nil UUID");
+  const leeway = options.leeway ?? 30;
+  if (!Number.isFinite(leeway) || leeway < 0 || leeway > 60) throw new CauthyConfigError("leeway must be 0 to 60 seconds");
+  return async (from) => {
+    const token = bearer(from);
+    if (token === "") throw new CauthyTokenError("no_token");
+    if (Buffer.byteLength(token) > MAX_TOKEN_BYTES) throw new CauthyTokenError("too_large");
+    const parts = token.split(".");
+    if (parts.length !== 3 || !parts.every((p) => SEGMENT.test(p) || p === "")) throw new CauthyTokenError("malformed", "not three base64url segments");
+    let header;
+    try {
+      header = decodeJson(parts[0]);
+    } catch {
+      throw new CauthyTokenError("malformed", "the header is not JSON");
+    }
+    if (!isObject(header)) throw new CauthyTokenError("malformed", "the header is not an object");
+    if (header.alg !== "RS256") throw new CauthyTokenError("alg_not_allowed");
+    if ("crit" in header) throw new CauthyTokenError("unsupported_header");
+    if ("typ" in header && !(typeof header.typ === "string" && ["jwt", "at+jwt"].includes(header.typ.toLowerCase()))) {
+      throw new CauthyTokenError("unsupported_header", "typ");
+    }
+    if (typeof header.kid !== "string" || header.kid === "") throw new CauthyTokenError("missing_kid");
+    let payloadBytes;
+    try {
+      const verified = await compactVerify(token, options.jwks ?? (options.fetch ? remoteKeysFor(issuer, options.fetch) : keysOf2(issuer)), { algorithms: ["RS256"] });
+      payloadBytes = verified.payload;
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ERR_JWKS_NO_MATCHING_KEY") throw new CauthyTokenError("unknown_kid");
+      if (code === "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") throw new CauthyTokenError("bad_signature");
+      if (err instanceof TypeError && /2048/.test(err.message)) throw new CauthyTokenError("weak_key");
+      if (code === "ERR_JWS_INVALID") throw new CauthyTokenError("malformed", err instanceof Error ? err.message : void 0);
+      if (err instanceof CauthyUnavailableError) throw err;
+      throw new CauthyTokenError("bad_signature", err instanceof Error ? err.message : void 0);
+    }
+    let claims;
+    try {
+      claims = parseStrict(new TextDecoder().decode(payloadBytes), ["exp", "iat", "nbf"]);
+    } catch {
+      throw new CauthyTokenError("malformed", "the payload is not JSON");
+    }
+    if (!isObject(claims)) throw new CauthyTokenError("malformed", "the payload is not an object");
+    for (const name of ["iss", "sub", "aud", "exp", "iat", "tid"]) {
+      if (claims[name] === void 0) throw new CauthyTokenError("missing_claim", name);
+    }
+    const bad = (name) => {
+      throw new CauthyTokenError("invalid_claim", name);
+    };
+    if (typeof claims.iss !== "string") bad("iss");
+    if (typeof claims.sub !== "string" || !UUID2.test(claims.sub)) bad("sub");
+    if (typeof claims.tid !== "string" || !UUID2.test(claims.tid)) bad("tid");
+    const aud = claims.aud;
+    if (!(typeof aud === "string" || Array.isArray(aud) && aud.length > 0 && aud.every((a) => typeof a === "string"))) bad("aud");
+    for (const name of ["exp", "iat", "nbf"]) if (claims[name] !== void 0 && !Number.isInteger(claims[name])) bad(name);
+    if (claims.roles !== void 0 && claims.roles !== null && !(Array.isArray(claims.roles) && claims.roles.every((r) => typeof r === "string"))) bad("roles");
+    if (claims.email !== void 0 && typeof claims.email !== "string") bad("email");
+    for (const name of ["email_verified", "anon"]) if (claims[name] !== void 0 && typeof claims[name] !== "boolean") bad(name);
+    for (const name of ["token_use", "azp"]) if (claims[name] !== void 0 && typeof claims[name] !== "string") bad(name);
+    if (!issuers.includes(claims.iss)) throw new CauthyTokenError("wrong_issuer");
+    if (!(Array.isArray(aud) ? aud.includes(audience) : aud === audience)) throw new CauthyTokenError("wrong_audience");
+    const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
+    if (now >= claims.exp + leeway) throw new CauthyTokenError("expired");
+    if (claims.nbf !== void 0 && now < claims.nbf - leeway) throw new CauthyTokenError("not_yet_valid");
+    if (now < claims.iat - leeway) throw new CauthyTokenError("issued_in_future");
+    if (claims.tid !== tenant) throw new CauthyTokenError("wrong_tenant");
+    if ("sys" in claims && !options.allowSystem) throw new CauthyTokenError("system_token");
+    if ("token_use" in claims && !options.allowClientTokens) throw new CauthyTokenError("client_token");
+    if (claims.anon === true && !options.allowAnonymous) throw new CauthyTokenError("anonymous_token");
+    if (options.clientId && typeof claims.azp === "string" && claims.azp !== "" && claims.azp !== options.clientId) throw new CauthyTokenError("wrong_client");
+    return {
+      userId: claims.sub,
+      tenantId: claims.tid,
+      ...typeof claims.email === "string" && claims.email !== "" ? { email: claims.email } : {},
+      ...typeof claims.email_verified === "boolean" ? { emailVerified: claims.email_verified } : {},
+      roles: Array.isArray(claims.roles) ? claims.roles : [],
+      ...typeof claims.sys === "string" && claims.sys !== "" ? { system: claims.sys } : {},
+      ...claims.anon === true ? { anonymous: true } : {},
+      ...typeof claims.azp === "string" && claims.azp !== "" ? { authorizedParty: claims.azp } : {},
+      ...typeof claims.client_id === "string" && claims.client_id !== "" ? { clientId: claims.client_id } : {},
+      expiresAt: new Date(claims.exp * 1e3).toISOString(),
+      token
+    };
+  };
+}
+async function verifyToken(from, options = {}) {
+  return createTokenVerifier(options)(from);
+}
+
+// src/deprecate.ts
+var told = /* @__PURE__ */ new Set();
+function deprecated(what, instead) {
+  if (told.has(what)) return;
+  told.add(what);
+  const message = `@cauthyhq/node: ${what} is deprecated and leaves in 2.0. ${instead}`;
+  if (typeof process !== "undefined" && typeof process.emitWarning === "function") {
+    process.emitWarning(message, { type: "DeprecationWarning", code: "CAUTHY_DEPRECATED" });
+  } else {
+    console.warn(message);
+  }
+}
+
+// src/mount.ts
+async function checkMount(basePath, target) {
+  const origin = typeof target === "string" ? withoutTrailingSlashes(target) : "http://localhost";
+  if (!/^https?:\/\/[^/\s]+$/.test(origin)) {
+    throw new CauthyConfigError(`checkMount needs the application's origin, e.g. http://localhost:3000, not ${JSON.stringify(target)}`);
+  }
+  const send = typeof target === "string" ? (r) => fetch(r, { redirect: "manual" }) : target;
+  const probes = [
+    new Request(`${origin}${basePath}/session`, { headers: { accept: "application/json" } }),
+    new Request(`${origin}${basePath}/cauthy-mount-check`),
+    new Request(`${origin}${basePath}/sign-out`, { method: "POST", headers: { origin, "content-type": "application/json", "x-cauthy-request": "1" }, body: "{}" })
+  ];
+  for (const probe of probes) {
+    const what = `${probe.method} ${new URL(probe.url).pathname}`;
+    let res;
+    try {
+      res = await send(probe);
+    } catch (err) {
+      throw new CauthyConfigError(typeof target === "string" ? `could not reach ${what} to check where the handler is mounted: ${err.message}` : `the handler threw on ${what}: ${err.message}`);
+    }
+    await res.body?.cancel();
+    if (res.headers.get("cauthy-protocol") !== PROTOCOL_VERSION) {
+      if (res.status >= 300 && res.status < 400) {
+        throw new CauthyConfigError(`${what}: the mount redirects (${res.status} to ${res.headers.get("location") ?? "nowhere"}): a proxy rule, a trailing-slash or HTTPS redirect sits in front of ${basePath}. Cauthy is not what answers.`);
+      }
+      if (res.status >= 500) {
+        throw new CauthyConfigError(`${what} answered ${res.status} without Cauthy-Protocol: ${PROTOCOL_VERSION}: the application crashed before or instead of the handler. Look at its log.`);
+      }
+      throw new CauthyConfigError(`${what} answered ${res.status} without Cauthy-Protocol: ${PROTOCOL_VERSION}: something other than this handler answers under ${basePath}. Move that route, mount Cauthy before it, or give Cauthy another basePath.`);
+    }
+  }
+}
+
+// src/cauthy.ts
+var PERSISTENT_SECONDS = 30 * 86400;
+var FLOW_SECONDS = 3600;
+var AGAIN_SECONDS = 120;
+var SKEW_SECONDS = 30;
+var ORGANIZATIONS_TTL_MS = 6e4;
+var LOOK_TTL_MS = 6e4;
+var PROVIDER_ID = /^(custom:)?[a-z0-9_-]{1,40}$/;
+function providerIn(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return "";
+  }
+}
+function env3(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function hostOf(origin) {
+  try {
+    return new URL(origin).hostname;
+  } catch {
+    return void 0;
+  }
+}
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function random(bytes = 32) {
+  return b64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function localPath(candidate, fallback) {
+  if (!candidate || !candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) return fallback;
+  if (/[\u0000-\u001f\u007f]/.test(candidate)) return fallback;
+  try {
+    if (new URL(candidate, "http://x").origin !== "http://x") return fallback;
+  } catch {
+    return fallback;
+  }
+  return candidate;
+}
+function json(body, status = 200, headers) {
+  const h = headers ?? new Headers();
+  h.set("content-type", "application/json; charset=utf-8");
+  h.set("cache-control", "no-store");
+  return new Response(JSON.stringify(body), { status, headers: h });
+}
+function redirect(location, cookies = []) {
+  const h = new Headers({ location, "cache-control": "no-store" });
+  for (const c of cookies) h.append("set-cookie", c);
+  return new Response(null, { status: 302, headers: h });
+}
+function conditionalOf(c) {
+  return { resource: String(c?.resource ?? ""), action: String(c?.action ?? ""), effect: c?.effect === "deny" ? "deny" : "allow" };
+}
+function byContract(given) {
+  failClosed(typeof process !== "undefined" ? process.env : void 0);
+  for (const [name, value] of [
+    ["clientId", given.clientId],
+    ["clientSecret", given.clientSecret],
+    ["secret", given.secret],
+    ["system", given.system],
+    ["tenant", given.tenant],
+    ["systemKey", given.systemKey]
+  ]) {
+    if (value !== void 0) throw new CauthyConfigError(`with a contract, ${name} comes from the contract: do not pass it`);
+  }
+  const contract = readContract(given.contract);
+  const root = given.rootKey ?? env3("PACT_ROOT_KEY") ?? "";
+  if (root === "") throw new CauthyConfigError("rootKey (PACT_ROOT_KEY) is required with a contract: 32 random bytes, e.g. openssl rand -base64 32");
+  if (contract.serviceClientId && !given.keys) {
+    throw new CauthyConfigError(`the link ${contract.link} gives ${contract.system} its own identity: pass keys, where its key is kept (@cauthyhq/node/keys)`);
+  }
+  return { contract, root, previous: given.rootKeyPrevious ?? env3("PACT_ROOT_KEY_PREVIOUS") };
+}
+var toldOfHeader = false;
+function createCauthy(given = {}) {
+  const pacted = given.contract ? byContract(given) : void 0;
+  const contract = pacted?.contract;
+  const issuer = withoutTrailingSlashes(given.issuer ?? contract?.issuer ?? env3("CAUTHY_ISSUER") ?? "");
+  const clientId = contract?.clientId ?? given.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = contract ? void 0 : given.clientSecret ?? env3("CAUTHY_CLIENT_SECRET");
+  const secret = contract ? "" : given.secret ?? env3("CAUTHY_SECRET") ?? "";
+  const system = contract?.system ?? given.system ?? env3("CAUTHY_SYSTEM") ?? "";
+  const tenant = contract?.tenant ?? given.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
+  if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
+  if (!contract && secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  const derived = pacted ? deriveKeys(pacted.root, pacted.previous) : void 0;
+  const single = derived ? void 0 : keyOf(secret).then((k) => [k]);
+  const cookieKeys = derived?.cookie ?? single;
+  const flowKeys = derived?.flow ?? single;
+  const ownKeys = derived && given.keys ? pactKeys(given.keys, derived.seal) : void 0;
+  const baseURL = given.baseURL ?? env3("CAUTHY_BASE_URL");
+  if (baseURL !== void 0 && baseURL !== "" && !/^https?:\/\/[^/]+\/*$/.test(baseURL)) {
+    throw new CauthyConfigError("baseURL (CAUTHY_BASE_URL) must be the application's public origin, e.g. https://app.example.com");
+  }
+  const basePath = "/" + (given.basePath ?? "/api/auth").replace(/^\/+|\/+$/g, "");
+  const requestHeader = given.requestHeader ?? "required";
+  if (requestHeader !== "required" && requestHeader !== "warn") throw new CauthyConfigError("requestHeader must be 'required' or 'warn'");
+  const afterSignIn = localPath(given.afterSignIn, "/");
+  const afterSignOut = localPath(given.afterSignOut, "/");
+  const cookieName = given.cookieName ?? "cauthy_session";
+  const flowCookie = `${cookieName}_flow`;
+  const againCookie = `${cookieName}_again`;
+  const stepCookie = `${cookieName}_step`;
+  const systemTimeout = given.timeouts?.system ?? 2e3;
+  const requestTimeout = given.timeouts?.request ?? 5e3;
+  for (const [name, ms] of [["system", systemTimeout], ["request", requestTimeout]]) {
+    if (!Number.isFinite(ms) || ms <= 0) throw new CauthyConfigError(`timeouts.${name} must be a positive number of milliseconds`);
+  }
+  const doFetch = deadline(given.fetch, requestTimeout);
+  const iconOf = iconFor(issuer);
+  const pages = {
+    signIn: given.pages?.signIn ? localPath(given.pages.signIn, "/") : void 0,
+    resetPassword: given.pages?.resetPassword ? localPath(given.pages.resetPassword, "/") : void 0,
+    verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0,
+    acceptInvite: given.pages?.acceptInvite ? localPath(given.pages.acceptInvite, "/") : void 0
+  };
+  const acceptInviteUrl = baseURL && pages.acceptInvite ? `${withoutTrailingSlashes(baseURL)}${pages.acceptInvite}` : void 0;
+  const ownSystem = createSystem({
+    issuer,
+    clientId,
+    clientSecret,
+    key: given.systemKey,
+    system: system || void 0,
+    acceptInviteUrl,
+    fetch: given.fetch,
+    timeoutMs: systemTimeout,
+    ...ownKeys ? { keys: ownKeys, keysClientId: contract?.serviceClientId } : {}
+  });
+  const originOf = (request) => {
+    if (baseURL) return withoutTrailingSlashes(baseURL);
+    const url = new URL(request.url);
+    const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+    return proto === "https" || proto === "http" ? `${proto}://${url.host}` : url.origin;
+  };
+  const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
+  async function token(form, proof = {}) {
+    const body2 = new URLSearchParams({ client_id: clientId, ...form });
+    if (clientSecret) body2.set("client_secret", clientSecret);
+    try {
+      const res = await doFetch(`${issuer}/v1/oauth/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", ...proof },
+        body: body2
+      });
+      if (res.ok) return { ok: true, body: await res.json() };
+      const why = await res.json().catch(() => null);
+      return { ok: false, ended: res.status >= 400 && res.status < 500, ...typeof why?.error === "string" ? { code: why.error } : {} };
+    } catch {
+      return { ok: false, ended: false };
+    }
+  }
+  async function userinfo(accessToken) {
+    try {
+      const res = await doFetch(`${issuer}/v1/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}` } });
+      if (!res.ok) return null;
+      const b = await res.json();
+      return {
+        tid: String(b.tid ?? ""),
+        roles: Array.isArray(b.roles) ? b.roles.filter((r) => typeof r === "string") : [],
+        u: {
+          id: String(b.sub ?? ""),
+          email: String(b.email ?? ""),
+          name: String(b.name ?? ""),
+          emailVerified: b.email_verified === true,
+          restricted: b.restricted === true,
+          ...typeof b.email_verify_by === "string" ? { emailVerifyBy: b.email_verify_by } : {},
+          ...typeof b.locale === "string" && b.locale !== "" ? { locale: b.locale } : {},
+          ...b.anonymous === true ? { isAnonymous: true } : {}
+        }
+      };
+    } catch {
+      return null;
+    }
+  }
+  const kindOf = (body2, was) => (typeof body2?.persistent === "boolean" ? body2.persistent : was?.p === 1) ? { p: 1 } : {};
+  async function revoke(refreshToken) {
+    const form = new URLSearchParams({ client_id: clientId, token: refreshToken });
+    if (clientSecret) form.set("client_secret", clientSecret);
+    await doFetch(`${issuer}/v1/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form }).catch(() => void 0);
+  }
+  const unverified = (u) => contract?.requireVerifiedEmail === true && !u.emailVerified;
+  async function stored(body2, was) {
+    if (typeof body2?.access_token !== "string" || typeof body2?.refresh_token !== "string") return null;
+    const who = await userinfo(body2.access_token);
+    if (who === null || who.u.id === "") return null;
+    if (unverified(who.u)) {
+      await revoke(body2.refresh_token);
+      throw new CauthyApiError(403, "email_not_confirmed", "Confirm your email address first.");
+    }
+    const lifetime = typeof body2.expires_in === "number" && body2.expires_in > 0 ? body2.expires_in : 300;
+    return { at: body2.access_token, rt: body2.refresh_token, exp: Math.floor(Date.now() / 1e3) + lifetime, ...who, ...kindOf(body2, was) };
+  }
+  function toSession(s) {
+    return { user: s.u, tenantId: s.tid, roles: s.roles, accessToken: s.at, expiresAt: new Date(s.exp * 1e3).toISOString() };
+  }
+  async function read(request) {
+    const had = readCookies(request.headers.get("cookie"));
+    const raw = readParts(had, cookieName);
+    if (raw === null) return { had, value: null, present: false };
+    const value = await unsealAny(raw, await cookieKeys);
+    const sound = value !== null && typeof value.at === "string" && typeof value.rt === "string" && typeof value.exp === "number";
+    return { had, value: sound ? value : null, present: true };
+  }
+  async function write(request, s, had) {
+    return writeParts(cookieName, await seal(s, (await cookieKeys)[0]), attrs(request, s.p === 1 ? PERSISTENT_SECONDS : void 0), had);
+  }
+  const fresh = (s) => s.exp - Date.now() / 1e3 > SKEW_SECONDS;
+  const renewing = /* @__PURE__ */ new Map();
+  function renew(was) {
+    let running = renewing.get(was.rt);
+    if (running === void 0) {
+      const rt = was.rt;
+      running = (async () => {
+        const res = await token({ grant_type: "refresh_token", refresh_token: rt });
+        if (!res.ok) return res.ended ? "ended" : "unreachable";
+        let next;
+        try {
+          next = await stored(res.body, was);
+        } catch (err) {
+          if (err instanceof CauthyApiError && err.code === "email_not_confirmed") return "ended";
+          throw err;
+        }
+        if (next !== null) return next;
+        if (typeof res.body?.access_token !== "string" || typeof res.body?.refresh_token !== "string") return "unreachable";
+        const lifetime = typeof res.body.expires_in === "number" && res.body.expires_in > 0 ? res.body.expires_in : 300;
+        const { p: _, ...rest } = was;
+        return { ...rest, at: res.body.access_token, rt: res.body.refresh_token, exp: Math.floor(Date.now() / 1e3) + lifetime, ...kindOf(res.body, was) };
+      })();
+      renewing.set(rt, running);
+      void running.then((result) => {
+        if (result === "unreachable") return renewing.delete(rt);
+        const timer = setTimeout(() => renewing.delete(rt), 5e3);
+        timer.unref?.();
+      });
+    }
+    return running;
+  }
+  async function resolve2(request) {
+    const { had, value, present } = await read(request);
+    if (value === null) {
+      return { session: null, status: "unauthenticated", cookies: present ? clearParts(cookieName, attrs(request, 0), had) : [] };
+    }
+    if (unverified(value.u)) return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };
+    if (fresh(value)) return { session: toSession(value), status: "authenticated", cookies: [] };
+    const renewed = await renew(value);
+    if (renewed === "ended") {
+      return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };
+    }
+    if (renewed === "unreachable") return { session: null, status: "expired", cookies: [] };
+    return { session: toSession(renewed), status: "authenticated", cookies: await write(request, renewed, had) };
+  }
+  async function getSession(request, responseHeaders) {
+    if (responseHeaders === void 0) {
+      const { value } = await read(request);
+      return value !== null && fresh(value) && !unverified(value.u) ? toSession(value) : null;
+    }
+    const r = await resolve2(request);
+    for (const c of r.cookies) responseHeaders.append("set-cookie", c);
+    return r.session;
+  }
+  async function status(request) {
+    const { value } = await read(request);
+    if (value === null || unverified(value.u)) return "unauthenticated";
+    return fresh(value) ? "authenticated" : "expired";
+  }
+  const orgCache = /* @__PURE__ */ new Map();
+  async function organizations(session) {
+    const hit = orgCache.get(session.accessToken);
+    if (hit && Date.now() - hit.at < ORGANIZATIONS_TTL_MS) return hit.value;
+    const url = `${issuer}/v1/oauth/organizations${system ? `?system=${encodeURIComponent(system)}` : ""}`;
+    const res = await doFetch(url, { headers: { authorization: `Bearer ${session.accessToken}` } });
+    if (!res.ok) throw new Error(`@cauthyhq/node: reading organizations: ${res.status}`);
+    const body2 = await res.json();
+    const value = (body2.data ?? []).map(
+      (o) => ({
+        id: String(o.id),
+        system: String(o.system ?? ""),
+        name: String(o.name ?? ""),
+        kind: String(o.kind ?? ""),
+        role: String(o.role ?? ""),
+        metadata: o.metadata ?? {},
+        ...o.external_id ? { externalId: String(o.external_id) } : {},
+        ...Array.isArray(o.permissions) ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [], conditional: Array.isArray(o.conditional) ? o.conditional.map(conditionalOf) : [] } : {}
+      })
+    );
+    if (orgCache.size > 5e3) orgCache.clear();
+    orgCache.set(session.accessToken, { at: Date.now(), value });
+    return value;
+  }
+  async function decide(token2, question) {
+    const org = organizationIdOf(question.organization);
+    if (org === "") return { allowed: false, reason: "no organization named" };
+    const res = await doFetch(`${issuer}/v1/oauth/organizations/${encodeURIComponent(org)}/check`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token2}`, "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(checkWire(question))
+    }).catch(() => null);
+    if (res === null) throw new CauthyApiError(503, "unavailable", "Cauthy could not be reached to check a permission");
+    const body2 = await res.json().catch(() => null);
+    if (res.ok) return checkResultOf(body2?.data);
+    const first = body2?.errors?.[0];
+    if (res.status === 401 || res.status === 403 || res.status === 404) {
+      return { allowed: false, reason: first?.message ?? (res.status === 401 ? "not signed in" : res.status === 404 ? "not a member of the organization" : "refused") };
+    }
+    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused to check a permission (${res.status}): ${first?.message ?? res.statusText}`);
+  }
+  async function check(who, question) {
+    const session = "accessToken" in who ? who : await getSession(who);
+    if (!session) return { allowed: false, reason: "not signed in" };
+    return decide(session.accessToken, question);
+  }
+  const forgetting = (fn) => async (...args) => {
+    const out2 = await fn(...args);
+    orgCache.clear();
+    return out2;
+  };
+  const systemThatRefreshes = {
+    ...ownSystem,
+    organizations: {
+      ...ownSystem.organizations,
+      update: forgetting(ownSystem.organizations.update),
+      remove: forgetting(ownSystem.organizations.remove)
+    },
+    members: {
+      ...ownSystem.members,
+      add: forgetting(ownSystem.members.add),
+      setRole: forgetting(ownSystem.members.setRole),
+      remove: forgetting(ownSystem.members.remove)
+    }
+  };
+  async function toPublic(session) {
+    let orgs = [];
+    try {
+      orgs = await organizations(session);
+    } catch {
+    }
+    return { user: session.user, tenantId: session.tenantId, roles: session.roles, organizations: orgs, expiresAt: session.expiresAt };
+  }
+  const urls = {
+    signIn: (returnTo) => `${basePath}/login${returnTo ? `?return_to=${encodeURIComponent(returnTo)}` : ""}`,
+    signOut: () => `${basePath}/logout`,
+    account: (returnTo) => `${basePath}/account${returnTo ? `?return_to=${encodeURIComponent(returnTo)}` : ""}`,
+    session: `${basePath}/session`
+  };
+  async function login(request, url) {
+    const flow = { state: random(), verifier: random(48), returnTo: localPath(url.searchParams.get("return_to"), afterSignIn) };
+    const challenge = b64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(flow.verifier))));
+    const q = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: `${originOf(request)}${basePath}/callback`,
+      response_type: "code",
+      state: flow.state,
+      code_challenge: challenge,
+      code_challenge_method: "S256"
+    });
+    const prompt = url.searchParams.get("prompt");
+    if (prompt === "login" || prompt === "none") q.set("prompt", prompt);
+    const locale = url.searchParams.get("locale") ?? url.searchParams.get("ui_locales");
+    if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set("ui_locales", locale);
+    let passkey = "";
+    if (url.searchParams.get("method") === "passkey") {
+      q.set("method", "passkey");
+      passkey = "#passkey";
+    }
+    return redirect(`${issuer}/v1/oauth/authorize?${q}${passkey}`, [
+      writeCookie(flowCookie, await seal(flow, (await flowKeys)[0]), attrs(request, FLOW_SECONDS))
+    ]);
+  }
+  function failed(request, reason) {
+    const h = new Headers({ "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" });
+    h.append("set-cookie", writeCookie(flowCookie, "", attrs(request, 0)));
+    h.append("set-cookie", writeCookie(againCookie, "", attrs(request, 0)));
+    return new Response(`Sign-in could not be completed (${reason}). Go back and try again.`, { status: 400, headers: h });
+  }
+  async function callback(request, url) {
+    const had = readCookies(request.headers.get("cookie"));
+    const sealed = had.get(flowCookie);
+    const flow = sealed ? await unsealAny(sealed, await flowKeys) : null;
+    if (flow === null || url.searchParams.get("state") !== flow.state) {
+      if (had.get(againCookie) === void 0) {
+        const back = flow?.returnTo ?? afterSignIn;
+        return redirect(`${basePath}/login?return_to=${encodeURIComponent(back)}`, [writeCookie(againCookie, "1", attrs(request, AGAIN_SECONDS))]);
+      }
+      return failed(request, "state_mismatch");
+    }
+    const error = url.searchParams.get("error");
+    if (error !== null) {
+      if (error === "login_required") return redirect(flow.returnTo, [writeCookie(flowCookie, "", attrs(request, 0))]);
+      if (error === "access_denied") {
+        const back = pages.signIn ?? flow.returnTo;
+        return redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=cancelled`, [writeCookie(flowCookie, "", attrs(request, 0))]);
+      }
+      return failed(request, error.slice(0, 60));
+    }
+    const code = url.searchParams.get("code");
+    if (!code) return failed(request, "no_code");
+    const res = await token({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: `${originOf(request)}${basePath}/callback`,
+      code_verifier: flow.verifier
+    }, await passedOn(request));
+    const unconfirmed = () => {
+      const page = pages.signIn ?? "/";
+      return redirect(
+        `${page}${page.includes("?") ? "&" : "?"}auth_error=email_not_confirmed`,
+        [writeCookie(flowCookie, "", attrs(request, 0)), writeCookie(againCookie, "", attrs(request, 0))]
+      );
+    };
+    if (!res.ok && res.code === "email_not_confirmed") return unconfirmed();
+    let s;
+    try {
+      s = res.ok ? await stored(res.body) : null;
+    } catch (err) {
+      if (!(err instanceof CauthyApiError && err.code === "email_not_confirmed")) throw err;
+      return unconfirmed();
+    }
+    if (s === null) return failed(request, "exchange_failed");
+    return redirect(flow.returnTo, [...await write(request, s, had), writeCookie(flowCookie, "", attrs(request, 0)), writeCookie(againCookie, "", attrs(request, 0))]);
+  }
+  async function logout(request) {
+    const { had, value } = await read(request);
+    if (value !== null) {
+      const body2 = new URLSearchParams({ client_id: clientId, token: value.rt });
+      if (clientSecret) body2.set("client_secret", clientSecret);
+      await doFetch(`${issuer}/v1/oauth/revoke`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: body2
+      }).catch(() => void 0);
+      orgCache.delete(value.at);
+    }
+    const q = new URLSearchParams({ client_id: clientId, post_logout_redirect_uri: `${originOf(request)}${afterSignOut}` });
+    return redirect(`${issuer}/v1/oauth/logout?${q}`, clearParts(cookieName, attrs(request, 0), had));
+  }
+  const STEP_SECONDS = 600;
+  const PASSKEY_SECONDS = 300;
+  const factorsOf = (d) => ({
+    totp: d?.totp === true,
+    phone: d?.phone ? { number: String(d.phone.number ?? ""), channel: String(d.phone.channel ?? "sms") } : null,
+    phoneChannels: Array.isArray(d?.phone_channels) ? d.phone_channels.map(String) : []
+  });
+  const isCredential = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.id === "string" && typeof v.response === "object";
+  const passkeyOf = (d) => ({
+    id: String(d?.id ?? ""),
+    name: String(d?.nickname ?? ""),
+    kind: ["security_key", "synced", "device"].includes(d?.kind) ? d.kind : "unknown",
+    createdAt: String(d?.created_at ?? ""),
+    lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null
+  });
+  const UUID3 = /^[0-9a-f-]{36}$/i;
+  const seatOf = (d) => ({
+    id: String(d?.id ?? ""),
+    system: String(d?.system ?? ""),
+    name: String(d?.name ?? ""),
+    kind: String(d?.kind ?? ""),
+    role: String(d?.role ?? ""),
+    // A Cauthy from before a power says nothing of it: then it is not given.
+    can: {
+      readMembers: d?.can?.read_members === true,
+      manageMembers: d?.can?.manage_members === true,
+      removeMembers: d?.can?.remove_members === true,
+      update: d?.can?.update === true,
+      archive: d?.can?.archive === true,
+      delete: d?.can?.delete === true
+    }
+  });
+  const orgMemberOf = (d) => ({
+    userId: String(d?.user_id ?? ""),
+    email: String(d?.email ?? ""),
+    name: String(d?.name ?? ""),
+    role: String(d?.role ?? ""),
+    status: String(d?.status ?? ""),
+    invited: d?.invited === true,
+    manager: d?.manager === true,
+    you: d?.you === true,
+    since: String(d?.since ?? "")
+  });
+  const orgRoleOf = (d) => ({
+    role: String(d?.role ?? ""),
+    name: String(d?.name ?? ""),
+    description: String(d?.description ?? ""),
+    manager: d?.manager === true
+  });
+  const agentOf = (d) => ({
+    id: String(d?.id ?? ""),
+    name: String(d?.agent?.name ?? ""),
+    redirectHost: String(d?.agent?.redirect_host ?? ""),
+    resource: { name: String(d?.resource?.name ?? ""), uri: String(d?.resource?.uri ?? "") },
+    scopes: Array.isArray(d?.scopes) ? d.scopes.map((s) => ({ name: String(s?.name ?? ""), description: String(s?.description ?? "") })) : [],
+    connectedAt: String(d?.created_at ?? ""),
+    lastUsedAt: String(d?.last_used_at ?? "")
+  });
+  const wants = (v) => v === true || v === "1" || v === "on" || v === "true";
+  const problem = (status2, code, message, field, headers, reasons) => json({ error: { code, message, ...field ? { field } : {}, ...reasons && reasons.length > 0 ? { reasons } : {} } }, status2, headers);
+  const invalid = (p) => problem(400, p.code, p.message, p.field);
+  let explained = false;
+  function withoutRequestHeader(request, route) {
+    if (request.headers.get("x-cauthy-request") === "1") return null;
+    if (requestHeader === "warn") {
+      if (!toldOfHeader) {
+        toldOfHeader = true;
+        console.warn(`@cauthyhq/node: POST ${basePath}${route} arrived without X-Cauthy-Request: 1 and was let through (requestHeader: 'warn'). Update the browser to cauthy-auth 0.43 or @cauthyhq/js, then remove requestHeader.`);
+      }
+      return null;
+    }
+    return problem(403, "csrf_required", "This request did not come from this application's own client.");
+  }
+  function ownRequest(request) {
+    const origin = request.headers.get("origin");
+    if (origin !== null) {
+      const own = originOf(request);
+      if (origin === own || origin === new URL(request.url).origin) return true;
+      if (!explained && hostOf(origin) === new URL(own).hostname) {
+        explained = true;
+        console.warn(`@cauthyhq/node: refused a request from ${origin} as cross_site: this application sees itself as ${own}. Behind a proxy? Set CAUTHY_BASE_URL (or baseURL) to the public origin.`);
+      }
+      return false;
+    }
+    return (request.headers.get("sec-fetch-site") ?? "same-origin") === "same-origin";
+  }
+  async function body(request) {
+    if (!(request.headers.get("content-type") ?? "").includes("application/json")) return null;
+    try {
+      const b = await request.json();
+      return typeof b === "object" && b !== null && !Array.isArray(b) ? b : null;
+    } catch {
+      return null;
+    }
+  }
+  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").map((a) => a.trim()).reverse().find((a) => a !== "" && !ownNetwork(a)));
+  let noProofUntil = 0;
+  async function passedOn(request) {
+    if (Date.now() < noProofUntil) return {};
+    const ip = clientIp(request);
+    try {
+      const proof = { "x-cauthy-system-token": await ownSystem.token(), "x-cauthy-app-origin": originOf(request) };
+      return ip ? { ...proof, "x-cauthy-client-ip": ip } : proof;
+    } catch {
+      noProofUntil = Date.now() + 3e4;
+      return {};
+    }
+  }
+  async function ask(request, method, path, payload, page, bearer2, remember = false) {
+    try {
+      const res = await doFetch(`${issuer}${path}`, {
+        method,
+        headers: {
+          "x-tenant-key": tenant,
+          accept: "application/json",
+          // A link Cauthy mails opens the application's page for it when it
+          // has one; otherwise Cauthy's own. Either way in the reader's language.
+          ...page ? { "x-cauthy-link-to": `${originOf(request)}${page}` } : { "x-cauthy-links": "hosted" },
+          // Whose request it is: what Cauthy mails goes in this application's
+          // name, under its logo.
+          ...clientId ? { "x-cauthy-client-id": clientId } : {},
+          ...await passedOn(request),
+          ...bearer2 ? { authorization: `Bearer ${bearer2}` } : {},
+          // The person asked to stay signed in: Cauthy keeps the session long if the client allows it.
+          ...remember ? { "x-cauthy-remember": "1" } : {},
+          // The answer to the workspace's Turnstile challenge, from the
+          // person's browser: Cauthy checks it at the doors that ask for it.
+          ...request.headers.get("x-cauthy-captcha") ? { "x-captcha-token": request.headers.get("x-cauthy-captcha") } : {},
+          ...request.headers.get("accept-language") ? { "accept-language": request.headers.get("accept-language") } : {},
+          // The language the application says its person reads, over the browser's.
+          ...request.headers.get("x-cauthy-locale") ? { "x-cauthy-locale": request.headers.get("x-cauthy-locale") } : {},
+          ...request.headers.get("user-agent") ? { "user-agent": request.headers.get("user-agent") } : {},
+          ...payload === void 0 ? {} : { "content-type": "application/json" }
+        },
+        body: payload === void 0 ? void 0 : JSON.stringify(payload)
+      });
+      const b = res.status === 204 || res.status === 202 ? null : await res.json().catch(() => null);
+      if (res.ok) return { status: res.status, data: b?.data ?? b };
+      const first = b?.errors?.[0];
+      const reasons = Array.isArray(first?.meta?.reasons) ? first.meta.reasons.map(String) : void 0;
+      return { status: res.status, data: null, error: { code: String(first?.code ?? "error"), message: String(first?.message ?? "The request could not be completed."), ...reasons ? { reasons } : {} } };
+    } catch {
+      return { status: 503, data: null, error: { code: "unavailable", message: "Sign-in is unavailable right now. Try again in a moment." } };
+    }
+  }
+  const accountOf = (d) => ({
+    id: String(d?.id ?? ""),
+    email: String(d?.email ?? ""),
+    name: String(d?.name ?? ""),
+    emailVerified: d?.email_verified === true,
+    hasPassword: d?.has_password === true,
+    mfaEnabled: d?.mfa_enabled === true
+  });
+  async function signedInAs(request) {
+    const r = await resolve2(request);
+    const headers = new Headers();
+    for (const c of r.cookies) headers.append("set-cookie", c);
+    if (r.session === null) return { response: problem(401, "unauthenticated", "Sign in first.", void 0, headers) };
+    return { token: r.session.accessToken, kept: r.cookies.length === 0 ? (await read(request)).value : null, headers };
+  }
+  async function signedIn(request, tokens, extra = [], more = {}, was) {
+    const s = await stored(tokens, was);
+    if (s === null) return problem(502, "unavailable", "Sign-in is unavailable right now. Try again in a moment.");
+    const h = new Headers();
+    for (const c of [...await write(request, s, readCookies(request.headers.get("cookie"))), ...extra]) h.append("set-cookie", c);
+    return json({ status: "signed_in", session: await toPublic(toSession(s)), ...more }, 200, h);
+  }
+  async function loggedIn(request, data, remember = false) {
+    if (data?.mfa_required === true) {
+      const step = { kind: "mfa", token: String(data.mfa_token ?? ""), returnTo: afterSignIn, ...remember ? { remember } : {} };
+      const how = data.mfa_method === "email" ? { method: "email" } : {};
+      return json({ status: "mfa_required", ...how }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS)) }));
+    }
+    return signedIn(request, data);
+  }
+  let lookCache = null;
+  let policyCache = null;
+  const keepPolicy = (settings) => {
+    policyCache = { until: Date.now() + LOOK_TTL_MS, policy: settings.error || !settings.data?.password_policy ? null : passwordPolicyOf(settings.data.password_policy) };
+    return policyCache.policy;
+  };
+  async function workspacePolicy(request) {
+    if (policyCache !== null && policyCache.until >= Date.now()) return policyCache.policy;
+    return keepPolicy(await ask(request, "GET", "/v1/auth/settings"));
+  }
+  async function newPasswordProblem(request, value) {
+    const policy = await workspacePolicy(request);
+    return checkNewPassword(value, policy ?? { min: 8, max: 128, requires: [], min_classes: 0, reject_breached: false });
+  }
+  async function ownRoute(request, url, route) {
+    const post = request.method === "POST";
+    const own = [
+      "/sign-in/email",
+      "/sign-in/mfa",
+      "/sign-up/email",
+      "/forgot-password",
+      "/reset-password",
+      "/verify-email",
+      "/sign-in/magic-link",
+      "/sign-in/magic-link/verify",
+      "/sign-in/email-code",
+      "/me",
+      "/me/password",
+      "/me/mfa/setup",
+      "/me/mfa/verify",
+      "/me/mfa/disable",
+      "/me/mfa/recovery-codes",
+      "/me/mfa/factors",
+      "/me/mfa/phone",
+      "/me/mfa/phone/verify",
+      "/me/mfa/phone/remove",
+      "/sign-in/mfa/methods",
+      "/sign-in/mfa/send",
+      "/sign-in/mfa/email",
+      "/sign-in/mfa/push",
+      "/sign-in/mfa/push/events",
+      "/sign-in/mfa/push/finish",
+      "/me/sessions",
+      "/me/sessions/end",
+      "/me/legal",
+      "/me/legal/accept",
+      "/me/email",
+      "/me/identities",
+      "/me/identities/unlink",
+      "/sign-out",
+      "/methods",
+      "/look",
+      "/sign-in/passkey/begin",
+      "/sign-in/passkey/finish",
+      "/sign-in/google-one-tap/begin",
+      "/sign-in/google-one-tap",
+      "/me/passkeys",
+      "/me/passkeys/add/begin",
+      "/me/passkeys/add/finish",
+      "/me/passkeys/remove",
+      "/me/agents",
+      "/me/agents/disconnect",
+      "/sign-in/anonymous",
+      "/me/upgrade",
+      "/me/organizations",
+      "/me/organizations/members",
+      "/me/organizations/roles",
+      "/me/organizations/members/add",
+      "/me/organizations/members/role",
+      "/me/organizations/members/remove",
+      "/me/organizations/members/invite",
+      "/me/organizations/rename",
+      "/me/organizations/archive",
+      "/me/organizations/delete",
+      "/invitation",
+      "/invitation/accept"
+    ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/") || route.startsWith("/me/upgrade/social/") || route === "/sign-in/sso" || route === "/sign-in/sso/discover" || route === "/sso/callback";
+    if (!own) return null;
+    if (post) {
+      const refused = withoutRequestHeader(request, route);
+      if (refused) return refused;
+    }
+    if (route === "/sign-in/anonymous" || route === "/me/upgrade") deprecated(`POST ${route}`, "Guest sessions leave the auth-bff protocol in version 2.");
+    if (route.startsWith("/me/upgrade/social/")) deprecated("GET /me/upgrade/social/{provider}", "Guest sessions leave the auth-bff protocol in version 2.");
+    if (tenant === "") {
+      return problem(500, "not_configured", "@cauthyhq/node: tenant (CAUTHY_TENANT) is required for the application's own sign-in screens");
+    }
+    if (route === "/look" && !post) {
+      if (lookCache === null || lookCache.until < Date.now()) {
+        const res = await ask(request, "GET", `/v1/auth/look/${encodeURIComponent(clientId)}`);
+        lookCache = { until: Date.now() + LOOK_TTL_MS, look: res.error ? {} : res.data ?? {} };
+      }
+      return json(lookCache.look);
+    }
+    if (route === "/methods" && !post) {
+      const [providers, settings, place, sso] = await Promise.all([
+        ask(request, "GET", "/v1/auth/social/providers"),
+        ask(request, "GET", "/v1/auth/settings"),
+        ask(request, "GET", `/v1/auth/webauthn/place?origin=${encodeURIComponent(originOf(request))}`),
+        ask(request, "GET", "/v1/auth/sso/connections")
+      ]);
+      const list = Array.isArray(providers.data) ? providers.data : [];
+      const password = keepPolicy(settings);
+      const passkeys = settings.data?.allow_passkeys !== false;
+      const here = passkeys && place.data?.here === true;
+      return json({
+        providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? ""), ...iconOf(p) })).filter((p) => p.id !== ""),
+        // Whether the workspace signs people in with a password at all. A
+        // Cauthy from before the setting says nothing of it: then it does.
+        passwordSignIn: settings.data?.allow_password !== false,
+        // The workspace's switch, and how the application's own system takes sign-ups.
+        signUp: settings.data?.allow_signup !== false && settings.data?.signup?.mode !== "invite_only",
+        // The application's system makes an organization per sign-up: the form asks the company's name.
+        ...settings.data?.signup?.organization?.ask === true ? { organization: { ask: true, required: settings.data.signup.organization.required === true } } : {},
+        // Whether the person may ask to stay signed in: the client's choice in Cauthy.
+        ...typeof settings.data?.persistent_sessions === "boolean" ? { persistentSessions: settings.data.persistent_sessions } : {},
+        // A sign-in link needs a page of the application to open.
+        magicLink: settings.data?.allow_magic_link === true && pages.signIn !== void 0,
+        passkey: passkeys && (place.error ? true : here || place.data?.on_cauthy === true),
+        passkeyHere: here,
+        passkeyOnCauthy: passkeys && (place.error ? true : place.data?.on_cauthy === true),
+        // A company's sign-in, found by the person's work address.
+        sso: Array.isArray(sso.data) && sso.data.some((c) => c?.discoverable === true),
+        // The terms a sign-up accepts and the consents it answers, when the workspace asks any.
+        ...settings.data?.legal ? { legal: legalOf(settings.data.legal) } : {},
+        ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {},
+        // What a new password must be: for the form to say it and check it.
+        ...password ? { password } : {}
+      });
+    }
+    if (route === "/invitation" && !post) {
+      const token2 = (url.searchParams.get("token") ?? "").trim();
+      if (token2 === "" || token2.length > 512) return problem(422, "invalid_token", "This invitation is not valid, or it has expired.");
+      const res = await ask(request, "GET", `/v1/auth/invitation?token=${encodeURIComponent(token2)}`);
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      const organization = typeof res.data?.organization === "string" && res.data.organization !== "" ? { organization: res.data.organization } : {};
+      return json({ status: "ok", invitation: { email: String(res.data?.email ?? ""), workspace: String(res.data?.workspace ?? ""), ...organization } });
+    }
+    if (route === "/sign-in/sso" && !post) {
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
+      const email = (url.searchParams.get("email") ?? "").trim();
+      const connection = (url.searchParams.get("connection") ?? "").trim();
+      if (email === "" && connection === "") return failed2("sso_not_found");
+      const verifier = random(48);
+      const challenge = b64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+      const callback2 = `${basePath}/sso/callback`;
+      const remember = wants(url.searchParams.get("remember"));
+      const started = await ask(request, "POST", "/v1/auth/sso/start", {
+        ...connection ? { connection } : { email },
+        redirect_uri: `${originOf(request)}${callback2}`,
+        code_challenge: challenge
+      }, callback2, void 0, remember);
+      if (started.error || typeof started.data?.redirect_url !== "string") return failed2(started.error?.code ?? "sso_unavailable");
+      const step = { kind: "sso", token: verifier, returnTo, ...remember ? { remember } : {} };
+      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))]);
+    }
+    if (route === "/sso/callback" && !post) {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+      const clear = writeCookie(stepCookie, "", attrs(request, 0));
+      const back = step?.returnTo ?? afterSignIn;
+      const failedTo = (code2) => redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code2)}`, [clear]);
+      if (step === null || step.kind !== "sso") return failedTo("state_mismatch");
+      const refused = url.searchParams.get("error");
+      if (refused) return failedTo(refused);
+      const code = url.searchParams.get("code");
+      if (!code) return failedTo("sso_failed");
+      const done = await ask(request, "POST", "/v1/auth/sso/token", { code, redirect_uri: `${originOf(request)}${basePath}/sso/callback`, code_verifier: step.token }, void 0, void 0, step.remember === true);
+      if (done.error) return failedTo(done.error.code);
+      const s = await stored(done.data);
+      if (s === null) return failedTo("unavailable");
+      return redirect(back, [...await write(request, s, readCookies(request.headers.get("cookie"))), clear]);
+    }
+    if (route.startsWith("/sign-in/social/") && !post) {
+      const provider = providerIn(route.slice("/sign-in/social/".length));
+      if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const callback2 = `${basePath}/callback/${provider}`;
+      const remember = wants(url.searchParams.get("remember"));
+      const started = await ask(request, "GET", `/v1/auth/social/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback2}`)}`, void 0, callback2, void 0, remember);
+      if (started.error || typeof started.data?.redirect_url !== "string") {
+        return redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(started.error?.code ?? "provider_unavailable")}`);
+      }
+      const step = { kind: "social", token: String(started.data.state ?? ""), provider, returnTo, ...remember ? { remember } : {} };
+      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))]);
+    }
+    if (route.startsWith("/callback/") && !post) {
+      const provider = providerIn(route.slice("/callback/".length));
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+      const clear = writeCookie(stepCookie, "", attrs(request, 0));
+      const back = step?.returnTo ?? afterSignIn;
+      const failedTo = (code2) => redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code2)}`, [clear]);
+      if (step === null || step.kind !== "social" && step.kind !== "link" && step.kind !== "upgrade" || step.provider !== provider || url.searchParams.get("state") !== step.token) return failedTo("state_mismatch");
+      const code = url.searchParams.get("code");
+      if (!code) return failedTo(url.searchParams.get("error") === "access_denied" ? "cancelled" : "provider_refused");
+      const q = new URLSearchParams({ code, state: step.token, redirect_uri: `${originOf(request)}${basePath}/callback/${provider}` });
+      if (step.kind === "upgrade") {
+        const mine = await signedInAs(request);
+        if ("response" in mine) return failedTo("unauthenticated");
+        const done2 = await ask(request, "GET", `/v1/auth/anonymous/upgrade/${provider}/callback?${q}`, void 0, void 0, mine.token);
+        if (done2.error) return failedTo(done2.error.code);
+        const s2 = await stored(done2.data, (await read(request)).value ?? void 0);
+        if (s2 === null) return failedTo("unavailable");
+        return redirect(back, [...await write(request, s2, readCookies(request.headers.get("cookie"))), clear]);
+      }
+      if (step.kind === "link") {
+        const mine = await signedInAs(request);
+        if ("response" in mine) return failedTo("unauthenticated");
+        const linked = await ask(request, "GET", `/v1/auth/identities/${provider}/link/callback?${q}`, void 0, void 0, mine.token);
+        if (linked.error) return failedTo(linked.error.code);
+        const h = new Headers(mine.headers);
+        h.append("set-cookie", clear);
+        return redirect(`${back}${back.includes("?") ? "&" : "?"}linked=${encodeURIComponent(provider)}`, [...h.getSetCookie()]);
+      }
+      const done = await ask(request, "GET", `/v1/auth/social/${provider}/callback?${q}`, void 0, void 0, void 0, step.remember === true);
+      if (done.error) return failedTo(done.error.code);
+      const s = await stored(done.data);
+      if (s === null) return failedTo("unavailable");
+      return redirect(back, [...await write(request, s, readCookies(request.headers.get("cookie"))), clear]);
+    }
+    if (route.startsWith("/me/upgrade/social/") && !post) {
+      const provider = providerIn(route.slice("/me/upgrade/social/".length));
+      if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
+      const mine = await signedInAs(request);
+      if ("response" in mine) return failed2("unauthenticated");
+      const callback2 = `${basePath}/callback/${provider}`;
+      const started = await ask(request, "GET", `/v1/auth/anonymous/upgrade/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback2}`)}`, void 0, callback2, mine.token);
+      if (started.error || typeof started.data?.redirect_url !== "string") return failed2(started.error?.code ?? "provider_unavailable");
+      const step = { kind: "upgrade", token: String(started.data.state ?? ""), provider, returnTo };
+      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))]);
+    }
+    if (route.startsWith("/me/identities/link/") && !post) {
+      const provider = providerIn(route.slice("/me/identities/link/".length));
+      if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
+      const mine = await signedInAs(request);
+      if ("response" in mine) return failed2("unauthenticated");
+      const callback2 = `${basePath}/callback/${provider}`;
+      const started = await ask(request, "GET", `/v1/auth/identities/${provider}/link?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback2}`)}`, void 0, callback2, mine.token);
+      if (started.error || typeof started.data?.redirect_url !== "string") return failed2(started.error?.code ?? "provider_unavailable");
+      const step = { kind: "link", token: String(started.data.state ?? ""), provider, returnTo };
+      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))]);
+    }
+    if (route === "/me/identities" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/identities", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      return json({ identities: list.map((x) => ({ provider: String(x.provider ?? ""), email: String(x.email ?? ""), name: String(x.name ?? ""), linkedAt: String(x.linked_at ?? "") })) }, 200, mine.headers);
+    }
+    if (route === "/me/passkeys" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/webauthn/credentials", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      return json({ passkeys: list.map(passkeyOf) }, 200, mine.headers);
+    }
+    if (route === "/me/agents" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/me/agents", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      return json({ agents: list.map(agentOf) }, 200, mine.headers);
+    }
+    if ((route === "/me/organizations" || route === "/me/organizations/members" || route === "/me/organizations/roles") && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      let path = "/v1/auth/me/organizations";
+      if (route !== "/me/organizations") {
+        const id = url.searchParams.get("id") ?? "";
+        if (!UUID3.test(id)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        path += `/${id}/${route.endsWith("/roles") ? "roles" : "members"}`;
+      } else if (url.searchParams.get("system")) {
+        path += `?system=${encodeURIComponent(url.searchParams.get("system"))}`;
+      }
+      const res = await ask(request, "GET", path, void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      if (route === "/me/organizations") return json({ organizations: list.map(seatOf) }, 200, mine.headers);
+      if (route === "/me/organizations/roles") return json({ roles: list.map(orgRoleOf) }, 200, mine.headers);
+      return json({ members: list.map(orgMemberOf) }, 200, mine.headers);
+    }
+    if (route === "/me/mfa/factors" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/mfa/factors", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      return json(factorsOf(res.data), 200, mine.headers);
+    }
+    if ((route === "/me" || route === "/me/sessions" || route === "/me/legal") && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", route === "/me" ? "/v1/auth/me" : route === "/me/legal" ? "/v1/auth/me/legal" : "/v1/auth/me/sessions", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      if (route === "/me/legal") {
+        const list = Array.isArray(res.data?.pending) ? res.data.pending : [];
+        return json({ pending: list.map((d) => ({ kind: String(d.kind ?? ""), version: String(d.version ?? ""), url: String(d.url ?? "") })) }, 200, mine.headers);
+      }
+      if (route === "/me/sessions") {
+        const list = Array.isArray(res.data) ? res.data : [];
+        return json({ sessions: list.map((x) => ({ device: String(x.device ?? ""), ip: String(x.ip ?? ""), createdAt: String(x.created_at ?? ""), expiresAt: String(x.expires_at ?? "") })) }, 200, mine.headers);
+      }
+      return json({ account: accountOf(res.data) }, 200, mine.headers);
+    }
+    if (route === "/sign-in/mfa/push/events" && !post) {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      let upstream;
+      try {
+        upstream = await doFetch(`${issuer}/v1/auth/mfa/push/events`, {
+          headers: { "x-tenant-key": tenant, "x-mfa-token": step.token, accept: "text/event-stream" },
+          signal: request.signal
+        });
+      } catch {
+        return problem(503, "unavailable", "Cauthy could not be reached.");
+      }
+      if (!upstream.ok || !upstream.body) {
+        const b2 = await upstream.json().catch(() => null);
+        return problem(upstream.status, String(b2?.errors?.[0]?.code ?? "error"), String(b2?.errors?.[0]?.message ?? "The request could not be completed."));
+      }
+      return new Response(upstream.body, {
+        status: 200,
+        headers: { "content-type": "text/event-stream", "cache-control": "no-cache, no-store", "x-accel-buffering": "no" }
+      });
+    }
+    if (!post) return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
+    if (!ownRequest(request)) return problem(403, "cross_site", "This request did not come from this application.");
+    if (route === "/sign-out") {
+      const { had, value } = await read(request);
+      if (value !== null) {
+        const form = new URLSearchParams({ client_id: clientId, token: value.rt });
+        if (clientSecret) form.set("client_secret", clientSecret);
+        await doFetch(`${issuer}/v1/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form }).catch(() => void 0);
+        orgCache.delete(value.at);
+      }
+      const h = new Headers();
+      for (const c of clearParts(cookieName, attrs(request, 0), had)) h.append("set-cookie", c);
+      return json({ status: "signed_out" }, 200, h);
+    }
+    const b = await body(request);
+    if (b === null) return problem(400, "bad_request", "Send the form as JSON.");
+    if (route === "/sign-in/sso/discover") {
+      const bad = checkEmail(b.email);
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/sso/discover", { email: String(b.email).trim() });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      const c = res.data?.connection;
+      return json(c ? { status: "found", connection: { id: String(c.slug ?? ""), name: String(c.display_name ?? ""), enforced: c.enforced === true } } : { status: "none" });
+    }
+    if (route === "/sign-in/anonymous") {
+      if (!post) return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
+      const res = await ask(request, "POST", "/v1/auth/anonymous", {});
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data);
+    }
+    if (route === "/sign-in/email") {
+      const bad = firstProblem(checkEmail(b.email), checkPassword(b.password));
+      if (bad) return invalid(bad);
+      const remember = wants(b.remember);
+      const res = await ask(request, "POST", "/v1/auth/login", { email: String(b.email).trim(), password: b.password }, void 0, void 0, remember);
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return loggedIn(request, res.data, remember);
+    }
+    if (route === "/sign-in/mfa") {
+      const bad = checkCode(b.code);
+      if (bad) return invalid(bad);
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      const res = await ask(request, "POST", "/v1/auth/mfa/challenge", { mfa_token: step.token, code: String(b.code).trim() }, void 0, void 0, step.remember === true);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
+      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
+    }
+    if (route === "/sign-in/mfa/push" || route === "/sign-in/mfa/push/finish") {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      if (route === "/sign-in/mfa/push") {
+        const res2 = await ask(request, "POST", "/v1/auth/mfa/push", { mfa_token: step.token }, void 0, void 0, step.remember === true);
+        if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
+        return json({ status: "sent", number: Number(res2.data?.number ?? 0) });
+      }
+      const res = await ask(request, "POST", "/v1/auth/mfa/challenge", { mfa_token: step.token, push: true }, void 0, void 0, step.remember === true);
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
+    }
+    if (route === "/sign-in/mfa/methods" || route === "/sign-in/mfa/send" || route === "/sign-in/mfa/email") {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      if (route === "/sign-in/mfa/methods") {
+        const res2 = await ask(request, "POST", "/v1/auth/mfa/methods", { mfa_token: step.token }, void 0, void 0, step.remember === true);
+        if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
+        const p = res2.data?.phone;
+        const push = res2.data?.push;
+        const mail = res2.data?.email;
+        return json({
+          status: "ok",
+          totp: res2.data?.totp === true,
+          phone: p ? { number: String(p.number ?? ""), channel: String(p.channel ?? "sms") } : null,
+          push: push ? { devices: Number(push.devices ?? 0) } : null,
+          email: mail ? { to: String(mail.to ?? "") } : null
+        });
+      }
+      if (route === "/sign-in/mfa/email") {
+        const res2 = await ask(request, "POST", "/v1/auth/mfa/email", { mfa_token: step.token }, void 0, void 0, step.remember === true);
+        if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
+        return json({ status: "sent", sentTo: String(res2.data?.sent_to ?? "") });
+      }
+      const res = await ask(request, "POST", "/v1/auth/mfa/send", { mfa_token: step.token }, void 0, void 0, step.remember === true);
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "sms") });
+    }
+    if (route === "/sign-up/email") {
+      const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password), checkOrganization(b.organization));
+      if (bad) return invalid(bad);
+      const email = String(b.email).trim();
+      const organization = typeof b.organization === "string" && b.organization.trim() !== "" ? { organization: { name: b.organization.trim() } } : {};
+      const legal = { ...b.acceptLegal === true ? { accept_legal: true } : {}, ...b.consents && typeof b.consents === "object" ? { consents: b.consents } : {} };
+      const made = await ask(request, "POST", "/v1/auth/register", { email, password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "", ...organization, ...legal }, pages.verifyEmail);
+      if (made.error) return problem(made.status, made.error.code, made.error.message, made.error.code === "weak_password" ? "password" : void 0, void 0, made.error.reasons);
+      if (made.data?.verification_required === true) return json({ status: "verification_required", email });
+      const res = await ask(request, "POST", "/v1/auth/login", { email, password: b.password });
+      if (res.error || res.data?.mfa_required === true) return json({ status: "verification_required", email });
+      return signedIn(request, res.data);
+    }
+    if (route === "/forgot-password") {
+      const bad = checkEmail(b.email);
+      if (bad) return invalid(bad);
+      await ask(request, "POST", "/v1/auth/password/reset", { email: String(b.email).trim() }, pages.resetPassword);
+      return json({ status: "sent" });
+    }
+    if (route.startsWith("/me")) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const as = (path, payload, method = "POST") => ask(request, method, path, payload, void 0, mine.token);
+      const refused = (res, field) => problem(res.status, res.error.code, res.error.message, field, mine.headers, res.error.reasons);
+      const password = typeof b.password === "string" ? b.password : "";
+      if (route === "/me") {
+        const bad = checkName(b.name);
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/me", { name: typeof b.name === "string" ? b.name.trim() : "" }, "PATCH");
+        if (res.error) return refused(res, "name");
+        const h = mine.headers;
+        if (mine.kept !== null) {
+          const again = await stored({ access_token: mine.kept.at, refresh_token: mine.kept.rt, expires_in: Math.max(1, mine.kept.exp - Math.floor(Date.now() / 1e3)) }, mine.kept);
+          if (again !== null) for (const c of await write(request, again, readCookies(request.headers.get("cookie")))) h.append("set-cookie", c);
+        }
+        return json({ status: "saved", account: accountOf(res.data) }, 200, h);
+      }
+      if (route === "/me/legal/accept") {
+        const kinds = Array.isArray(b.kinds) ? b.kinds.filter((k) => typeof k === "string") : [];
+        const res = await as("/v1/auth/me/legal/accept", { kinds });
+        if (res.error) return refused(res);
+        return json({ status: "accepted" }, 200, mine.headers);
+      }
+      if (route === "/me/password") {
+        const bad = await newPasswordProblem(request, b.newPassword);
+        if (bad) return problem(400, bad.code, bad.message, "newPassword");
+        const res = await as("/v1/auth/me/password", { current_password: password, new_password: b.newPassword });
+        if (res.error) return refused(res, res.error.code === "wrong_password" ? "password" : res.error.code === "weak_password" ? "newPassword" : void 0);
+        const next = await stored(res.data, (await read(request)).value ?? void 0);
+        const h = new Headers();
+        const had = readCookies(request.headers.get("cookie"));
+        for (const c of next !== null ? await write(request, next, had) : clearParts(cookieName, attrs(request, 0), had)) h.append("set-cookie", c);
+        return json({ status: "changed", signedIn: next !== null }, 200, h);
+      }
+      if (route === "/me/mfa/setup") {
+        const res = await as("/v1/auth/mfa/setup", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        const qr = String(res.data?.qr ?? "");
+        return json({ status: "started", secret: String(res.data?.secret ?? ""), otpauthUri: String(res.data?.otpauth_uri ?? ""), qr: qr.startsWith("data:image/png;base64,") ? qr : "" }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/verify") {
+        const bad = checkCode(b.code);
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/mfa/verify", { code: String(b.code).trim() });
+        if (res.error) return refused(res, "code");
+        return json({ status: "enabled", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/phone") {
+        const res = await as("/v1/auth/mfa/phone", { phone: typeof b.phone === "string" ? b.phone : "", channel: typeof b.channel === "string" ? b.channel : "sms", password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : res.error.code === "validation_error" ? "phone" : void 0);
+        return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "") }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/phone/verify") {
+        const bad = checkCode(b.code);
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/mfa/phone/verify", { code: String(b.code).trim() });
+        if (res.error) return refused(res, "code");
+        return json({ status: "enabled", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/phone/remove") {
+        const res = await as("/v1/auth/mfa/phone/remove", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        return json({ status: "removed" }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/disable") {
+        const res = await as("/v1/auth/me/mfa/disable", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        return json({ status: "disabled" }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/recovery-codes") {
+        const res = await as("/v1/auth/me/mfa/recovery-codes", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        return json({ status: "renewed", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
+      }
+      if (route === "/me/email") {
+        const bad = checkEmail(b.email);
+        if (bad) return invalid(bad);
+        const email = String(b.email).trim();
+        const res = await as("/v1/auth/me/email", { email, password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : ["invalid_email", "email_unchanged", "email_taken"].includes(res.error.code) ? "email" : void 0);
+        return json({ status: "sent", email }, 200, mine.headers);
+      }
+      if (route === "/me/identities/unlink") {
+        const provider = typeof b.provider === "string" ? b.provider : "";
+        if (!PROVIDER_ID.test(provider)) return problem(400, "invalid_provider", "Say which provider to unlink.", "provider", mine.headers);
+        const res = await as(`/v1/auth/identities/${provider}`, void 0, "DELETE");
+        if (res.error) return refused(res);
+        return json({ status: "unlinked", provider }, 200, mine.headers);
+      }
+      if (route === "/me/passkeys/add/begin") {
+        const kind = b.kind === "device" || b.kind === "security_key" ? b.kind : "";
+        const res = await as("/v1/auth/webauthn/register/begin", { password, ...kind ? { kind } : {} });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        const step = { kind: "enrol", token: String(res.data?.session_id ?? ""), returnTo: afterSignIn };
+        const h = new Headers(mine.headers);
+        h.append("set-cookie", writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, PASSKEY_SECONDS)));
+        return json({ status: "started", options: res.data?.options?.publicKey ?? res.data?.options ?? null }, 200, h);
+      }
+      if (route === "/me/passkeys/add/finish") {
+        const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+        const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+        if (step === null || step.kind !== "enrol") return problem(400, "step_expired", "Start adding the passkey again: it was asked for too long ago.", void 0, mine.headers);
+        if (!isCredential(b.credential)) return problem(400, "bad_request", "Send the passkey the browser made.", void 0, mine.headers);
+        const name = typeof b.name === "string" ? b.name.trim().slice(0, 60) : "";
+        const res = await as("/v1/auth/webauthn/register/finish", { session_id: step.token, nickname: name, credential: b.credential });
+        const h = new Headers(mine.headers);
+        h.append("set-cookie", writeCookie(stepCookie, "", attrs(request, 0)));
+        if (res.error) return problem(res.status, res.error.code === "attestation_invalid" ? "passkey_failed" : res.error.code, res.error.code === "attestation_invalid" ? "The passkey could not be added. Try again." : res.error.message, void 0, h);
+        return json({ status: "added", passkey: passkeyOf(res.data) }, 200, h);
+      }
+      if (route === "/me/passkeys/remove") {
+        const id = typeof b.id === "string" ? b.id : "";
+        if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, "invalid_passkey", "Say which passkey to remove.", void 0, mine.headers);
+        const res = await as(`/v1/auth/webauthn/credentials/${id}`, void 0, "DELETE");
+        if (res.error) return refused(res);
+        return json({ status: "removed", id }, 200, mine.headers);
+      }
+      if (route === "/me/upgrade") {
+        const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password));
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/anonymous/upgrade", { email: String(b.email).trim(), password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "" });
+        if (res.error) return refused(res, res.error.code === "weak_password" ? "password" : "email");
+        return signedIn(request, res.data, [], {}, (await read(request)).value ?? void 0);
+      }
+      if (route === "/me/organizations/rename" || route === "/me/organizations/archive" || route === "/me/organizations/delete") {
+        const org = typeof b.organizationId === "string" ? b.organizationId : "";
+        if (!UUID3.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        const path = `/v1/auth/me/organizations/${org}`;
+        if (route === "/me/organizations/rename") {
+          const bad = checkOrganizationName(b.name);
+          if (bad) return invalid(bad);
+          const res2 = await as(path, { name: String(b.name).trim() }, "PATCH");
+          if (res2.error) return refused(res2, res2.error.code === "validation_error" ? "name" : void 0);
+          orgCache.delete(mine.token);
+          return json({ status: "renamed", organization: seatOf(res2.data) }, 200, mine.headers);
+        }
+        const res = route === "/me/organizations/archive" ? await as(`${path}/archive`) : await as(path, void 0, "DELETE");
+        if (res.error) return refused(res);
+        orgCache.delete(mine.token);
+        return json({ status: route === "/me/organizations/archive" ? "archived" : "deleted", organizationId: org }, 200, mine.headers);
+      }
+      if (route.startsWith("/me/organizations/members/")) {
+        const org = typeof b.organizationId === "string" ? b.organizationId : "";
+        if (!UUID3.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        const base = `/v1/auth/me/organizations/${org}/members`;
+        if (route === "/me/organizations/members/add") {
+          const bad = checkEmail(b.email);
+          if (bad) return invalid(bad);
+          const role = typeof b.role === "string" ? b.role : "";
+          if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
+          const res = await ask(request, "POST", base, {
+            email: String(b.email).trim(),
+            role,
+            name: typeof b.name === "string" ? b.name.trim() : "",
+            client_id: clientId,
+            only_new: true,
+            ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {}
+          }, pages.acceptInvite, mine.token);
+          if (res.error?.code === "already_member") res.error.code = "member_exists";
+          if (res.error) return refused(res, res.error.code === "unknown_role" ? "role" : "email");
+          return json({ status: "added", member: orgMemberOf(res.data) }, 200, mine.headers);
+        }
+        const user = typeof b.userId === "string" ? b.userId : "";
+        if (!UUID3.test(user)) return problem(400, "invalid_member", "Say which member.", void 0, mine.headers);
+        if (route === "/me/organizations/members/role") {
+          const role = typeof b.role === "string" ? b.role : "";
+          if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
+          const res = await as(`${base}/${user}`, { role }, "PUT");
+          if (res.error) return refused(res, "role");
+          return json({ status: "changed", userId: user, role }, 200, mine.headers);
+        }
+        if (route === "/me/organizations/members/remove") {
+          const res = await as(`${base}/${user}`, void 0, "DELETE");
+          if (res.error) return refused(res);
+          orgCache.delete(mine.token);
+          return json({ status: "removed", userId: user }, 200, mine.headers);
+        }
+        if (route === "/me/organizations/members/invite") {
+          const res = await ask(request, "POST", `${base}/${user}/invite`, { client_id: clientId, ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} }, pages.acceptInvite, mine.token);
+          if (res.error) return refused(res);
+          return json({ status: "sent", userId: user }, 200, mine.headers);
+        }
+      }
+      if (route === "/me/agents/disconnect") {
+        const id = typeof b.id === "string" ? b.id : "";
+        if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, "invalid_agent", "Say which agent to disconnect.", void 0, mine.headers);
+        const res = await as(`/v1/auth/me/agents/${id}`, void 0, "DELETE");
+        if (res.error) return refused(res);
+        return json({ status: "disconnected", id }, 200, mine.headers);
+      }
+      if (route === "/me/sessions/end") {
+        const res = await as("/v1/auth/me/sessions", void 0, "DELETE");
+        if (res.error) return refused(res);
+        const h = new Headers();
+        for (const c of clearParts(cookieName, attrs(request, 0), readCookies(request.headers.get("cookie")))) h.append("set-cookie", c);
+        orgCache.delete(mine.token);
+        return json({ status: "signed_out" }, 200, h);
+      }
+      return null;
+    }
+    const isToken = (v) => typeof v === "string" && v !== "" && v.length <= 512;
+    const badLink = () => problem(422, "invalid_token", "This link is not valid, or it has expired.");
+    if (route === "/reset-password") {
+      if (!isToken(b.token)) return badLink();
+      const bad = await newPasswordProblem(request, b.password);
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/password/change", { token: String(b.token), new_password: b.password });
+      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0, void 0, res.error.reasons);
+      return json({ status: "changed" });
+    }
+    if (route === "/verify-email") {
+      if (!isToken(b.token)) return badLink();
+      const res = await ask(request, "POST", "/v1/auth/email/verify", { token: String(b.token) });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      if (res.data?.access_token) return signedIn(request, res.data);
+      return json({ status: "verified" });
+    }
+    if (route === "/invitation/accept") {
+      if (!isToken(b.token)) return problem(422, "invalid_token", "This invitation is not valid, or it has expired.");
+      const bad = await newPasswordProblem(request, b.password);
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/invitation/accept", { token: String(b.token), password: b.password });
+      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0, void 0, res.error.reasons);
+      return loggedIn(request, res.data);
+    }
+    if (route === "/sign-in/passkey/begin") {
+      const email = typeof b.email === "string" && checkEmail(b.email) === null ? b.email.trim() : "";
+      const remember = wants(b.remember);
+      const res = await ask(request, "POST", "/v1/auth/webauthn/login/begin", email !== "" ? { email } : {}, void 0, void 0, remember);
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      const step = { kind: "passkey", token: String(res.data?.session_id ?? ""), returnTo: afterSignIn, ...remember ? { remember } : {} };
+      return json(
+        { status: "started", options: res.data?.options?.publicKey ?? res.data?.options ?? null },
+        200,
+        new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, PASSKEY_SECONDS)) })
+      );
+    }
+    if (route === "/sign-in/passkey/finish") {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+      if (step === null || step.kind !== "passkey") return problem(400, "step_expired", "Try the passkey again: it was asked for too long ago.");
+      if (!isCredential(b.credential)) return problem(400, "bad_request", "Send the passkey the browser answered with.");
+      const res = await ask(request, "POST", "/v1/auth/webauthn/login/finish", { session_id: step.token, credential: b.credential }, void 0, void 0, step.remember === true || wants(b.remember));
+      const clear = writeCookie(stepCookie, "", attrs(request, 0));
+      if (res.error) {
+        const failed2 = ["assertion_invalid", "session_expired", "clone_detected", "not_found"].includes(res.error.code);
+        return problem(res.status, failed2 ? "passkey_failed" : res.error.code, failed2 ? "The passkey sign-in could not be completed. Try again, or sign in another way." : res.error.message, void 0, new Headers({ "set-cookie": clear }));
+      }
+      return signedIn(request, res.data, [clear]);
+    }
+    if (route === "/sign-in/google-one-tap/begin") {
+      const res = await ask(request, "POST", "/v1/auth/google/one-tap/begin", {});
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return json({ status: "started", clientId: String(res.data?.client_id ?? ""), nonce: String(res.data?.nonce ?? "") });
+    }
+    if (route === "/sign-in/google-one-tap") {
+      if (typeof b.credential !== "string" || b.credential === "") return problem(400, "bad_request", "Send the credential Google gave the page.");
+      const res = await ask(request, "POST", "/v1/auth/google/one-tap", { credential: b.credential }, void 0, void 0, wants(b.remember));
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data);
+    }
+    if (route === "/sign-in/magic-link") {
+      const bad = checkEmail(b.email);
+      if (bad) return invalid(bad);
+      if (pages.signIn === void 0) return problem(500, "not_configured", "@cauthyhq/node: pages.signIn is required for sign-in links: it is the page the link opens");
+      const email = String(b.email).trim();
+      const back = typeof b.returnTo === "string" ? localPath(b.returnTo, afterSignIn) : afterSignIn;
+      const remember = wants(b.remember);
+      const query = [...back === afterSignIn ? [] : [`return_to=${encodeURIComponent(back)}`], ...remember ? ["remember=1"] : []].join("&");
+      const page = query === "" ? pages.signIn : `${pages.signIn}${pages.signIn.includes("?") ? "&" : "?"}${query}`;
+      await ask(request, "POST", "/v1/auth/magic-link/request", { email, ...b.create === true ? { create_account: true } : {} }, page);
+      const step = { kind: "code", token: email, returnTo: back, ...remember ? { remember } : {} };
+      return json({ status: "sent" }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS)) }));
+    }
+    if (route === "/sign-in/email-code") {
+      const bad = checkCode(b.code);
+      if (bad) return invalid(bad);
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unsealAny(sealed, await flowKeys) : null;
+      if (step === null || step.kind !== "code") return problem(400, "step_expired", "Ask for a new link: this one was asked for too long ago.");
+      const res = await ask(request, "POST", "/v1/auth/magic-link/verify-code", { email: step.token, code: String(b.code).trim() }, void 0, void 0, step.remember === true);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
+      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))], { returnTo: step.returnTo });
+    }
+    if (route === "/sign-in/magic-link/verify") {
+      if (!isToken(b.token)) return badLink();
+      const res = await ask(request, "POST", "/v1/auth/magic-link/verify", { token: String(b.token) }, void 0, void 0, wants(b.remember));
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data);
+    }
+    return null;
+  }
+  async function handler(request) {
+    const url = new URL(request.url);
+    const inside = url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);
+    const route = inside ? withoutTrailingSlashes(url.pathname.slice(basePath.length)) || "/" : null;
+    const published3 = pact !== void 0 && url.pathname === contract?.jwksPath && (request.method === "GET" || request.method === "HEAD");
+    try {
+      return finish(await serve(request), route, published3);
+    } catch (err) {
+      if (!(err instanceof CauthyApiError && err.code === "email_not_confirmed")) throw err;
+      const wantsPage = request.method === "GET" && (request.headers.get("sec-fetch-mode") ?? "navigate") === "navigate";
+      return finish(wantsPage ? new Response("Sign-in refused (email_not_confirmed). Confirm your email address first.", { status: 403, headers: { "content-type": "text/plain; charset=utf-8" } }) : problem(403, "email_not_confirmed", "Confirm your email address first."), route);
+    }
+  }
+  async function serve(request) {
+    const url = new URL(request.url);
+    if (pact && url.pathname === contract?.jwksPath && (request.method === "GET" || request.method === "HEAD")) return pact.jwks();
+    if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) return new Response("Not found", { status: 404 });
+    const route = withoutTrailingSlashes(url.pathname.slice(basePath.length)) || "/";
+    const get = request.method === "GET" || request.method === "HEAD";
+    const mine = await ownRoute(request, url, route);
+    if (mine !== null) return mine;
+    if (route === "/me/organizations/check") return checkRoute(request);
+    if (route === "/login" && get) return login(request, url);
+    if (route === "/callback" && get) return callback(request, url);
+    if (route === "/logout" && (get || request.method === "POST")) return logout(request);
+    if (route === "/session" && get) {
+      const r = await resolve2(request);
+      const h = new Headers();
+      for (const c of r.cookies) h.append("set-cookie", c);
+      return json({ session: r.session ? await toPublic(r.session) : null, status: r.status }, 200, h);
+    }
+    if (route === "/refresh" && get) {
+      const r = await resolve2(request);
+      const back = localPath(url.searchParams.get("return_to"), afterSignIn);
+      if (r.status === "unauthenticated") return redirect(urls.signIn(back), r.cookies);
+      if (r.status === "expired") return new Response("Sign-in is unavailable right now. Try again in a moment.", { status: 503 });
+      return redirect(back, r.cookies);
+    }
+    if (route === "/account" && get) {
+      const q = new URLSearchParams({ client_id: clientId });
+      const back = localPath(url.searchParams.get("return_to"), "");
+      if (back !== "") q.set("return_to", `${originOf(request)}${back}`);
+      const locale = url.searchParams.get("locale");
+      if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set("ui_locales", locale);
+      return redirect(`${issuer}/v1/oauth/account?${q}`);
+    }
+    return new Response("Not found", { status: 404 });
+  }
+  async function checkRoute(request) {
+    if (request.method !== "POST") return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
+    const refused = withoutRequestHeader(request, "/me/organizations/check");
+    if (refused) return refused;
+    if (!ownRequest(request)) return problem(403, "cross_site", "This request did not come from this application.");
+    const b = await body(request);
+    if (b === null) return problem(400, "bad_request", "Send the question as JSON.");
+    const asker = await signedInAs(request);
+    if ("response" in asker) return asker.response;
+    const org = typeof b.organizationId === "string" ? b.organizationId : "";
+    if (!UUID3.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, asker.headers);
+    const named = (v) => typeof v === "string" && v !== "" && v.length <= 200;
+    if (!named(b.resource) || !named(b.action)) return problem(400, "bad_request", "Say which resource and action.", void 0, asker.headers);
+    const attributes2 = b.attributes;
+    if (attributes2 !== void 0 && (typeof attributes2 !== "object" || attributes2 === null || Array.isArray(attributes2))) {
+      return problem(400, "bad_request", "The attributes are an object.", void 0, asker.headers);
+    }
+    try {
+      const r = await decide(asker.token, {
+        organization: org,
+        resource: b.resource,
+        action: b.action,
+        ...attributes2 !== void 0 ? { attributes: attributes2 } : {},
+        ...typeof b.resourceId === "string" ? { resourceId: b.resourceId } : {},
+        ...typeof b.ownerId === "string" ? { ownerId: b.ownerId } : {}
+      });
+      return json({ status: "decided", ...r }, 200, asker.headers);
+    } catch (e) {
+      const err = e instanceof CauthyApiError ? e : new CauthyApiError(503, "unavailable", "Cauthy could not be reached.");
+      return problem(err.status, err.code, err.message.replace(/^@cauthyhq\/node: /, ""), void 0, asker.headers);
+    }
+  }
+  async function protect(request) {
+    const read1 = await read(request);
+    const value = read1.value !== null && unverified(read1.value.u) ? null : read1.value;
+    if (value !== null && fresh(value)) return { session: toSession(value) };
+    const url = new URL(request.url);
+    const state = value === null ? "none" : "expired";
+    const page = request.method === "GET" && (request.headers.get("sec-fetch-mode") ?? "navigate") === "navigate" && (request.headers.get("accept") ?? "text/html").includes("text/html");
+    if (!page) {
+      return { response: json({ error: "unauthenticated", session: state }, 401, new Headers({ "x-cauthy-session": state })) };
+    }
+    const back = url.pathname + url.search;
+    const to = value === null ? urls.signIn(back) : `${basePath}/refresh?return_to=${encodeURIComponent(back)}`;
+    return { response: redirect(to) };
+  }
+  const replay = given.webhookReplay ?? memoryReplayStore();
+  const tokenVerifier = (o = {}) => {
+    if (contract && o.clientId !== void 0 && o.clientId !== contract.clientId) {
+      throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`);
+    }
+    return createTokenVerifier({
+      issuer,
+      tenantId: contract?.tenantId ?? given.tenantId,
+      audience: given.audience,
+      fetch: given.fetch,
+      ...contract ? { clientId: contract.clientId } : {},
+      ...o
+    });
+  };
+  const webhook = (request, o = {}) => verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now, replay });
+  const pact = contract && ownKeys ? {
+    contract,
+    keys: ownKeys,
+    async jwks() {
+      return new Response(JSON.stringify(await ownKeys.published()), {
+        headers: { "content-type": "application/json; charset=utf-8", "cache-control": `public, max-age=${JWKS_MAX_AGE_S}` }
+      });
+    },
+    status: () => ownSystem.request("GET", `/v1/pact/status?system=${encodeURIComponent(contract.system)}`)
+  } : void 0;
+  return {
+    handler,
+    checkMount: (target) => checkMount(basePath, target),
+    webhook,
+    tokenVerifier,
+    verifyToken: async (from, o) => tokenVerifier(o)(from),
+    system: systemThatRefreshes,
+    getSession,
+    status,
+    resolve: resolve2,
+    protect,
+    organizations,
+    check,
+    toPublic,
+    urls,
+    ...pact ? { pact } : {},
+    options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName }
+  };
+}
+function iconFor(issuer) {
+  return (p) => {
+    const raw = typeof p?.icon_url === "string" ? p.icon_url.trim() : "";
+    if (raw === "") return {};
+    try {
+      const url = new URL(raw.startsWith("/") && !raw.startsWith("//") ? `${issuer}${raw}` : raw);
+      return url.protocol === "https:" || url.protocol === "http:" ? { iconUrl: url.href } : {};
+    } catch {
+      return {};
+    }
+  };
+}
+function legalOf(raw) {
+  const documents = Array.isArray(raw?.documents) ? raw.documents : [];
+  const purposes = Array.isArray(raw?.consent_purposes) ? raw.consent_purposes : [];
+  return {
+    documents: documents.map((d) => ({ kind: String(d.kind ?? ""), version: String(d.version ?? ""), url: String(d.url ?? "") })),
+    consentPurposes: purposes.map((p) => ({ key: String(p.key ?? ""), label: String(p.label ?? ""), required: p.required === true }))
+  };
+}
+function ownNetwork(address) {
+  const a = address.toLowerCase();
+  return /^(127\.|10\.|192\.168\.|169\.254\.|0\.)/.test(a) || /^172\.(1[6-9]|2\d|3[01])\./.test(a) || a === "::1" || /^f[cd]/.test(a) || /^fe[89ab]/.test(a) || a.startsWith("::ffff:127.") || a === "localhost";
+}
+
+// src/connect.ts
+function sessionSecret() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function connectSystem(o) {
+  deprecated("connectSystem", "Connect a system with the cauthy CLI: npx cauthy init.");
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
+  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`@cauthyhq/node: ${name} is required to connect a system`);
+  }
+  const res = await deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS)(`${issuer}/v1/connect`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify({
+      system: o.system,
+      app_url: o.appUrl,
+      name: o.name,
+      callback_path: o.callbackPath,
+      events_url: o.eventsUrl,
+      events: o.events,
+      jwks_uri: o.jwksUri
+    })
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.data) {
+    const why = (body?.errors ?? []).map((e) => e.message).filter(Boolean).join("; ") || res.statusText;
+    throw new Error(`@cauthyhq/node: Cauthy did not connect the system (${res.status}): ${why}`);
+  }
+  const d = body.data;
+  return {
+    system: d.system,
+    clientId: d.client.client_id,
+    clientSecret: d.client_secret,
+    redirectUris: d.client.redirect_uris,
+    webhook: d.webhook,
+    env: { ...d.env, CAUTHY_SECRET: sessionSecret() }
+  };
+}
+export {
+  CauthyApiError,
+  CauthyConfigError,
+  CauthyTokenError,
+  CauthyUnavailableError,
+  CauthyWebhookError,
+  DEFAULT_PASSWORD_POLICY,
+  MIN_PASSWORD,
+  PROTOCOL_VERSION,
+  STANDARD_VARIABLES,
+  can,
+  checkCode,
+  checkEmail,
+  checkName,
+  checkNewPassword,
+  checkPassword,
+  connectSystem,
+  createCauthy,
+  createSystem,
+  createTokenVerifier,
+  definePolicy,
+  describePasswordPolicy,
+  explainPasswordProblems,
+  failClosed,
+  memoryReplayStore,
+  passwordPolicyOf,
+  passwordProblems,
+  policySource,
+  pullCatalog,
+  pullPolicy,
+  pushCatalog,
+  pushPolicy,
+  pushTheme,
+  readContract,
+  remoteKeys,
+  themeFromStackmyth,
+  tokensFromStackmyth,
+  verifyToken,
+  verifyWebhook
+};
+//# sourceMappingURL=index.mjs.map