@finueva/auth 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,4 +1,4 @@
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -205,7 +205,7 @@ let onMount = ($store, initialize) => {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/equality.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/equality.mjs
 function isPlainObject$1(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const prototype = Object.getPrototypeOf(value);
@@ -233,7 +233,7 @@ function withEquality(store, isEqual) {
 	});
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = new Set();
@@ -262,7 +262,7 @@ function getGlobalFocusManager() {
 	return globalThis[kFocusManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = new Set();
@@ -294,7 +294,7 @@ function getGlobalOnlineManager() {
 	return globalThis[kOnlineManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -363,7 +363,7 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 const FOCUS_REFETCH_RATE_LIMIT_SECONDS = 5;
 function createSessionRefreshManager(opts) {
@@ -660,7 +660,7 @@ var BetterAuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/utils/url.mjs
 const SLASH_CHAR_CODE = "/".charCodeAt(0);
 function trimTrailingSlashes(value) {
 	let end = value.length;
@@ -754,7 +754,7 @@ function isSafeUrlScheme(value) {
 	return !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
@@ -769,7 +769,7 @@ const redirectPlugin = {
 	} }
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/session-atom.mjs
 const isServer = () => typeof window === "undefined";
 function normalizeSessionResponse(res) {
 	if (typeof res === "object" && res !== null && "data" in res && "error" in res) return res;
@@ -1417,7 +1417,7 @@ var betterFetch = async (url, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -1515,7 +1515,7 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
@@ -1533,7 +1533,7 @@ function toKebabCase(input) {
 	return splitWords(input).map((word) => word.toLowerCase()).join("-");
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -1602,7 +1602,7 @@ function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomLis
 	return createProxy();
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@0.29.2__vitest@4.1.10/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_95de1d9b4b5221fcaa380f950243e93e/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient$1(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -1615,7 +1615,7 @@ function createAuthClient$1(options) {
 	}, $fetch, pluginPathMethods, pluginsAtoms, atomListeners);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chiballc+utils@2.2.22_magic-string@0.30.21_magicast@0.5.3_rolldown@1.2.0_vite@7.3.6_@t_bb8aca60aa14bf30011cd038d243a4ee/node_modules/@chiballc/utils/dist/index.mjs
+//#region ../../node_modules/.pnpm/@chiballc+utils@2.2.22_magic-string@0.30.21_magicast@0.5.3_rolldown@1.2.0_vite@7.3.6_@t_7ea103523467af2ecb75df55c94dbb80/node_modules/@chiballc/utils/dist/index.mjs
 function isPromise(arg) {
 	return arg && typeof arg.then === "function";
 }
@@ -1861,7 +1861,12 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
@@ -2189,6 +2194,37 @@ function normalizeDriveCredential(value, now) {
 		expiresAt: new Date(now + value.expiresIn * 1e3)
 	};
 }
+function normalizeOrganizations(value) {
+	if (!Array.isArray(value) || value.length >= 100) throw authorityUnavailable();
+	const seen = new Set();
+	return value.map((organization) => {
+		if (!isObject(organization) || !isId(organization.id) || seen.has(organization.id) || typeof organization.name !== "string" || organization.name.length < 1 || typeof organization.slug !== "string" || organization.slug.length < 1) throw authorityUnavailable();
+		seen.add(organization.id);
+		return {
+			id: organization.id,
+			name: organization.name,
+			slug: organization.slug
+		};
+	});
+}
+function normalizeInvitationInput(value) {
+	if (!isObject(value) || Object.keys(value).length !== 1 || !isId(value.invitationId)) throw new AuthError("invalid_invitation", 422);
+	return { invitationId: value.invitationId };
+}
+function normalizeInvitationAcceptance(value, invitationId) {
+	if (!isObject(value) || !isObject(value.invitation) || !isObject(value.member) || value.invitation.id !== invitationId || value.invitation.status !== "accepted" || !isId(value.invitation.organizationId) || value.member.organizationId !== value.invitation.organizationId) throw authorityUnavailable();
+	return { organizationId: value.invitation.organizationId };
+}
+function normalizeWorkspaceSelection(value) {
+	if (!isObject(value)) throw new AuthError("invalid_workspace_selection", 422);
+	const keys = Object.keys(value);
+	if (value.type === "personal" && keys.length === 1 && keys[0] === "type") return { type: "personal" };
+	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id.test(value.organizationId)) return {
+		type: "organization",
+		organizationId: value.organizationId
+	};
+	throw new AuthError("invalid_workspace_selection", 422);
+}
 function fromAuthorityError(value, fallbackStatus, retryAfter) {
 	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
 	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
@@ -2196,6 +2232,23 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 function authorityUnavailable() {
 	return new AuthError("identity_authority_unavailable", 503);
 }
+function fromOrganizationListError(error) {
+	if (error instanceof AuthError && error.status === 401) return new AuthError("authentication_required", 401);
+	if (error instanceof AuthError) return error;
+	return authorityUnavailable();
+}
+function fromInvitationAuthorityError(value, status) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (status === 403 && code === "YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION") return new AuthError("invitation_recipient_mismatch", 403);
+	if (status === 403 && code === "EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION") return new AuthError("email_verification_required", 403);
+	if (status === 400 && (code === "INVITATION_NOT_FOUND" || code === "ORGANIZATION_NOT_FOUND" || code === "TEAM_NOT_FOUND")) return new AuthError("invitation_unavailable", 409);
+	return authorityUnavailable();
+}
+function fromInvitationError(error) {
+	return error instanceof AuthError ? error : authorityUnavailable();
+}
 function mapError(code, status) {
 	if (code === "authentication_required") return {
 		code,
@@ -2209,6 +2262,10 @@ function mapError(code, status) {
 		code,
 		status: 422
 	};
+	if (code === "organization_context_too_large") return {
+		code,
+		status: 422
+	};
 	if (code === "credential_rate_limited") return {
 		code,
 		status: 429
@@ -2261,6 +2318,9 @@ function isObject(value) {
 //#region src/http.ts
 const MAX_RESPONSE_BYTES = 64 * 1024;
 async function requestJson(url, options) {
+	return (await requestJsonResponse(url, options)).value;
+}
+async function requestJsonResponse(url, options) {
 	let response;
 	try {
 		response = await createFetch({ fetch: options.fetch }).raw(url, {
@@ -2271,6 +2331,7 @@ async function requestJson(url, options) {
 			retry: 0,
 			timeout: options.timeoutMs,
 			redirect: "manual",
+			signal: options.signal,
 			responseType: "stream",
 			ignoreResponseError: true
 		});
@@ -2281,9 +2342,12 @@ async function requestJson(url, options) {
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
 		const body = contentType === "application/json" ? await readJson(response) : void 0;
 		await response.body?.cancel();
-		throw fromAuthorityError(body, response.status, response.headers.get("retry-after"));
+		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
-	return readJson(response);
+	return {
+		value: await readJson(response),
+		headers: response.headers
+	};
 }
 async function readJson(response) {
 	const length = response.headers.get("content-length");
@@ -2322,6 +2386,685 @@ async function readJson(response) {
 	}
 }
 //#endregion
+//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/dist/shared/unstorage.zVDD2mZo.mjs
+function wrapToPromise(value) {
+	if (!value || typeof value.then !== "function") return Promise.resolve(value);
+	return value;
+}
+function asyncCall(function_, ...arguments_) {
+	try {
+		return wrapToPromise(function_(...arguments_));
+	} catch (error) {
+		return Promise.reject(error);
+	}
+}
+function isPrimitive(value) {
+	const type = typeof value;
+	return value === null || type !== "object" && type !== "function";
+}
+function isPureObject(value) {
+	const proto = Object.getPrototypeOf(value);
+	return !proto || proto.isPrototypeOf(Object);
+}
+function stringify(value) {
+	if (isPrimitive(value)) return String(value);
+	if (isPureObject(value) || Array.isArray(value)) return JSON.stringify(value);
+	if (typeof value.toJSON === "function") return stringify(value.toJSON());
+	throw new Error("[unstorage] Cannot stringify value!");
+}
+const BASE64_PREFIX = "base64:";
+function serializeRaw(value) {
+	if (typeof value === "string") return value;
+	return BASE64_PREFIX + base64Encode(value);
+}
+function deserializeRaw(value) {
+	if (typeof value !== "string") return value;
+	if (!value.startsWith(BASE64_PREFIX)) return value;
+	return base64Decode(value.slice(7));
+}
+function base64Decode(input) {
+	if (globalThis.Buffer) return Buffer.from(input, "base64");
+	return Uint8Array.from(globalThis.atob(input), (c) => c.codePointAt(0));
+}
+function base64Encode(input) {
+	if (globalThis.Buffer) return Buffer.from(input).toString("base64");
+	return globalThis.btoa(String.fromCodePoint(...input));
+}
+function normalizeKey$1(key) {
+	if (!key) return "";
+	return key.split("?")[0]?.replace(/[/\\]/g, ":").replace(/:+/g, ":").replace(/^:|:$/g, "") || "";
+}
+function joinKeys(...keys) {
+	return normalizeKey$1(keys.join(":"));
+}
+function normalizeBaseKey(base) {
+	base = normalizeKey$1(base);
+	return base ? base + ":" : "";
+}
+function filterKeyByDepth(key, depth) {
+	if (depth === void 0) return true;
+	let substrCount = 0;
+	let index = key.indexOf(":");
+	while (index > -1) {
+		substrCount++;
+		index = key.indexOf(":", index + 1);
+	}
+	return substrCount <= depth;
+}
+function filterKeyByBase(key, base) {
+	if (base) return key.startsWith(base) && key[key.length - 1] !== "$";
+	return key[key.length - 1] !== "$";
+}
+//#endregion
+//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/dist/index.mjs
+function defineDriver$1(factory) {
+	return factory;
+}
+const DRIVER_NAME$3 = "memory";
+const memory = defineDriver$1(() => {
+	const data = new Map();
+	return {
+		name: DRIVER_NAME$3,
+		getInstance: () => data,
+		hasItem(key) {
+			return data.has(key);
+		},
+		getItem(key) {
+			return data.get(key) ?? null;
+		},
+		getItemRaw(key) {
+			return data.get(key) ?? null;
+		},
+		setItem(key, value) {
+			data.set(key, value);
+		},
+		setItemRaw(key, value) {
+			data.set(key, value);
+		},
+		removeItem(key) {
+			data.delete(key);
+		},
+		getKeys() {
+			return [...data.keys()];
+		},
+		clear() {
+			data.clear();
+		},
+		dispose() {
+			data.clear();
+		}
+	};
+});
+function createStorage(options = {}) {
+	const context = {
+		mounts: { "": options.driver || memory() },
+		mountpoints: [""],
+		watching: false,
+		watchListeners: [],
+		unwatch: {}
+	};
+	const getMount = (key) => {
+		for (const base of context.mountpoints) if (key.startsWith(base)) return {
+			base,
+			relativeKey: key.slice(base.length),
+			driver: context.mounts[base]
+		};
+		return {
+			base: "",
+			relativeKey: key,
+			driver: context.mounts[""]
+		};
+	};
+	const getMounts = (base, includeParent) => {
+		return context.mountpoints.filter((mountpoint) => mountpoint.startsWith(base) || includeParent && base.startsWith(mountpoint)).map((mountpoint) => ({
+			relativeBase: base.length > mountpoint.length ? base.slice(mountpoint.length) : void 0,
+			mountpoint,
+			driver: context.mounts[mountpoint]
+		}));
+	};
+	const onChange = (event, key) => {
+		if (!context.watching) return;
+		key = normalizeKey$1(key);
+		for (const listener of context.watchListeners) listener(event, key);
+	};
+	const startWatch = async () => {
+		if (context.watching) return;
+		context.watching = true;
+		for (const mountpoint in context.mounts) context.unwatch[mountpoint] = await watch(context.mounts[mountpoint], onChange, mountpoint);
+	};
+	const stopWatch = async () => {
+		if (!context.watching) return;
+		for (const mountpoint in context.unwatch) await context.unwatch[mountpoint]();
+		context.unwatch = {};
+		context.watching = false;
+	};
+	const runBatch = (items, commonOptions, cb) => {
+		const batches = new Map();
+		const getBatch = (mount) => {
+			let batch = batches.get(mount.base);
+			if (!batch) {
+				batch = {
+					driver: mount.driver,
+					base: mount.base,
+					items: []
+				};
+				batches.set(mount.base, batch);
+			}
+			return batch;
+		};
+		for (const item of items) {
+			const isStringItem = typeof item === "string";
+			const key = normalizeKey$1(isStringItem ? item : item.key);
+			const value = isStringItem ? void 0 : item.value;
+			const options2 = isStringItem || !item.options ? commonOptions : {
+				...commonOptions,
+				...item.options
+			};
+			const mount = getMount(key);
+			getBatch(mount).items.push({
+				key,
+				value,
+				relativeKey: mount.relativeKey,
+				options: options2
+			});
+		}
+		return Promise.all([...batches.values()].map((batch) => cb(batch))).then((r) => r.flat());
+	};
+	const storage = {
+		hasItem(key, opts = {}) {
+			key = normalizeKey$1(key);
+			const { relativeKey, driver } = getMount(key);
+			return asyncCall(driver.hasItem, relativeKey, opts);
+		},
+		getItem(key, opts = {}) {
+			key = normalizeKey$1(key);
+			const { relativeKey, driver } = getMount(key);
+			return asyncCall(driver.getItem, relativeKey, opts).then((value) => destr(value));
+		},
+		getItems(items, commonOptions = {}) {
+			return runBatch(items, commonOptions, (batch) => {
+				if (batch.driver.getItems) return asyncCall(batch.driver.getItems, batch.items.map((item) => ({
+					key: item.relativeKey,
+					options: item.options
+				})), commonOptions).then((r) => r.map((item) => ({
+					key: joinKeys(batch.base, item.key),
+					value: destr(item.value)
+				})));
+				return Promise.all(batch.items.map((item) => {
+					return asyncCall(batch.driver.getItem, item.relativeKey, item.options).then((value) => ({
+						key: item.key,
+						value: destr(value)
+					}));
+				}));
+			});
+		},
+		getItemRaw(key, opts = {}) {
+			key = normalizeKey$1(key);
+			const { relativeKey, driver } = getMount(key);
+			if (driver.getItemRaw) return asyncCall(driver.getItemRaw, relativeKey, opts);
+			return asyncCall(driver.getItem, relativeKey, opts).then((value) => deserializeRaw(value));
+		},
+		async setItem(key, value, opts = {}) {
+			if (value === void 0) return storage.removeItem(key);
+			key = normalizeKey$1(key);
+			const { relativeKey, driver } = getMount(key);
+			if (!driver.setItem) return;
+			await asyncCall(driver.setItem, relativeKey, stringify(value), opts);
+			if (!driver.watch) onChange("update", key);
+		},
+		async setItems(items, commonOptions) {
+			await runBatch(items, commonOptions, async (batch) => {
+				if (batch.driver.setItems) return asyncCall(batch.driver.setItems, batch.items.map((item) => ({
+					key: item.relativeKey,
+					value: stringify(item.value),
+					options: item.options
+				})), commonOptions);
+				if (!batch.driver.setItem) return;
+				await Promise.all(batch.items.map((item) => {
+					return asyncCall(batch.driver.setItem, item.relativeKey, stringify(item.value), item.options);
+				}));
+			});
+		},
+		async setItemRaw(key, value, opts = {}) {
+			if (value === void 0) return storage.removeItem(key, opts);
+			key = normalizeKey$1(key);
+			const { relativeKey, driver } = getMount(key);
+			if (driver.setItemRaw) await asyncCall(driver.setItemRaw, relativeKey, value, opts);
+			else if (driver.setItem) await asyncCall(driver.setItem, relativeKey, serializeRaw(value), opts);
+			else return;
+			if (!driver.watch) onChange("update", key);
+		},
+		async removeItem(key, opts = {}) {
+			if (typeof opts === "boolean") opts = { removeMeta: opts };
+			key = normalizeKey$1(key);
+			const { relativeKey, driver } = getMount(key);
+			if (!driver.removeItem) return;
+			await asyncCall(driver.removeItem, relativeKey, opts);
+			if (opts.removeMeta || opts.removeMata) await asyncCall(driver.removeItem, relativeKey + "$", opts);
+			if (!driver.watch) onChange("remove", key);
+		},
+		async getMeta(key, opts = {}) {
+			if (typeof opts === "boolean") opts = { nativeOnly: opts };
+			key = normalizeKey$1(key);
+			const { relativeKey, driver } = getMount(key);
+			const meta = Object.create(null);
+			if (driver.getMeta) Object.assign(meta, await asyncCall(driver.getMeta, relativeKey, opts));
+			if (!opts.nativeOnly) {
+				const value = await asyncCall(driver.getItem, relativeKey + "$", opts).then((value_) => destr(value_));
+				if (value && typeof value === "object") {
+					if (typeof value.atime === "string") value.atime = new Date(value.atime);
+					if (typeof value.mtime === "string") value.mtime = new Date(value.mtime);
+					Object.assign(meta, value);
+				}
+			}
+			return meta;
+		},
+		setMeta(key, value, opts = {}) {
+			return this.setItem(key + "$", value, opts);
+		},
+		removeMeta(key, opts = {}) {
+			return this.removeItem(key + "$", opts);
+		},
+		async getKeys(base, opts = {}) {
+			base = normalizeBaseKey(base);
+			const mounts = getMounts(base, true);
+			let maskedMounts = [];
+			const allKeys = [];
+			let allMountsSupportMaxDepth = true;
+			for (const mount of mounts) {
+				if (!mount.driver.flags?.maxDepth) allMountsSupportMaxDepth = false;
+				const rawKeys = await asyncCall(mount.driver.getKeys, mount.relativeBase, opts);
+				for (const key of rawKeys) {
+					const fullKey = mount.mountpoint + normalizeKey$1(key);
+					if (!maskedMounts.some((p) => fullKey.startsWith(p))) allKeys.push(fullKey);
+				}
+				maskedMounts = [mount.mountpoint, ...maskedMounts.filter((p) => !p.startsWith(mount.mountpoint))];
+			}
+			const shouldFilterByDepth = opts.maxDepth !== void 0 && !allMountsSupportMaxDepth;
+			return allKeys.filter((key) => (!shouldFilterByDepth || filterKeyByDepth(key, opts.maxDepth)) && filterKeyByBase(key, base));
+		},
+		async clear(base, opts = {}) {
+			base = normalizeBaseKey(base);
+			await Promise.all(getMounts(base, false).map(async (m) => {
+				if (m.driver.clear) return asyncCall(m.driver.clear, m.relativeBase, opts);
+				if (m.driver.removeItem) {
+					const keys = await m.driver.getKeys(m.relativeBase || "", opts);
+					return Promise.all(keys.map((key) => m.driver.removeItem(key, opts)));
+				}
+			}));
+		},
+		async dispose() {
+			await Promise.all(Object.values(context.mounts).map((driver) => dispose(driver)));
+		},
+		async watch(callback) {
+			await startWatch();
+			context.watchListeners.push(callback);
+			return async () => {
+				context.watchListeners = context.watchListeners.filter((listener) => listener !== callback);
+				if (context.watchListeners.length === 0) await stopWatch();
+			};
+		},
+		async unwatch() {
+			context.watchListeners = [];
+			await stopWatch();
+		},
+		mount(base, driver) {
+			base = normalizeBaseKey(base);
+			if (base && context.mounts[base]) throw new Error(`already mounted at ${base}`);
+			if (base) {
+				context.mountpoints.push(base);
+				context.mountpoints.sort((a, b) => b.length - a.length);
+			}
+			context.mounts[base] = driver;
+			if (context.watching) Promise.resolve(watch(driver, onChange, base)).then((unwatcher) => {
+				context.unwatch[base] = unwatcher;
+			}).catch(console.error);
+			return storage;
+		},
+		async unmount(base, _dispose = true) {
+			base = normalizeBaseKey(base);
+			if (!base || !context.mounts[base]) return;
+			if (context.watching && base in context.unwatch) {
+				context.unwatch[base]?.();
+				delete context.unwatch[base];
+			}
+			if (_dispose) await dispose(context.mounts[base]);
+			context.mountpoints = context.mountpoints.filter((key) => key !== base);
+			delete context.mounts[base];
+		},
+		getMount(key = "") {
+			key = normalizeKey$1(key) + ":";
+			const m = getMount(key);
+			return {
+				driver: m.driver,
+				base: m.base
+			};
+		},
+		getMounts(base = "", opts = {}) {
+			base = normalizeKey$1(base);
+			return getMounts(base, opts.parents).map((m) => ({
+				driver: m.driver,
+				base: m.mountpoint
+			}));
+		},
+		keys: (base, opts = {}) => storage.getKeys(base, opts),
+		get: (key, opts = {}) => storage.getItem(key, opts),
+		set: (key, value, opts = {}) => storage.setItem(key, value, opts),
+		has: (key, opts = {}) => storage.hasItem(key, opts),
+		del: (key, opts = {}) => storage.removeItem(key, opts),
+		remove: (key, opts = {}) => storage.removeItem(key, opts)
+	};
+	return storage;
+}
+function watch(driver, onChange, base) {
+	return driver.watch ? driver.watch((event, key) => onChange(event, base + key)) : () => {};
+}
+async function dispose(driver) {
+	if (typeof driver.dispose === "function") await asyncCall(driver.dispose);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/drivers/utils/index.mjs
+function defineDriver(factory) {
+	return factory;
+}
+function normalizeKey(key, sep = ":") {
+	if (!key) return "";
+	return key.replace(/[:/\\]/g, sep).replace(/^[:/\\]|[:/\\]$/g, "");
+}
+function createError(driver, message, opts) {
+	const err = new Error(`[unstorage] [${driver}] ${message}`, opts);
+	if (Error.captureStackTrace) Error.captureStackTrace(err, createError);
+	return err;
+}
+function createRequiredError(driver, name) {
+	if (Array.isArray(name)) return createError(driver, `Missing some of the required options ${name.map((n) => "`" + n + "`").join(", ")}`);
+	return createError(driver, `Missing required option \`${name}\`.`);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/drivers/localstorage.mjs
+const DRIVER_NAME$2 = "localstorage";
+var localstorage_default = defineDriver((opts = {}) => {
+	const storage = opts.storage || opts.localStorage || opts.sessionStorage || (opts.window || globalThis.window)?.[opts.windowKey || "localStorage"];
+	if (!storage) throw createRequiredError(DRIVER_NAME$2, "localStorage");
+	const base = opts.base ? normalizeKey(opts.base) : "";
+	const r = (key) => (base ? `${base}:` : "") + key;
+	let _storageListener;
+	const _unwatch = () => {
+		if (_storageListener) opts.window?.removeEventListener("storage", _storageListener);
+		_storageListener = void 0;
+	};
+	return {
+		name: DRIVER_NAME$2,
+		options: opts,
+		getInstance: () => storage,
+		hasItem(key) {
+			return Object.prototype.hasOwnProperty.call(storage, r(key));
+		},
+		getItem(key) {
+			return storage.getItem(r(key));
+		},
+		setItem(key, value) {
+			return storage.setItem(r(key), value);
+		},
+		removeItem(key) {
+			return storage.removeItem(r(key));
+		},
+		getKeys() {
+			const allKeys = Object.keys(storage);
+			return base ? allKeys.filter((key) => key.startsWith(`${base}:`)).map((key) => key.slice(base.length + 1)) : allKeys;
+		},
+		clear(prefix) {
+			const _base = [base, prefix].filter(Boolean).join(":");
+			if (_base) {
+				for (const key of Object.keys(storage)) if (key.startsWith(`${_base}:`)) storage?.removeItem(key);
+			} else storage.clear();
+		},
+		dispose() {
+			if (opts.window && _storageListener) opts.window.removeEventListener("storage", _storageListener);
+		},
+		watch(callback) {
+			if (!opts.window) return _unwatch;
+			_storageListener = (ev) => {
+				if (ev.key) callback(ev.newValue ? "update" : "remove", ev.key);
+			};
+			opts.window.addEventListener("storage", _storageListener);
+			return _unwatch;
+		}
+	};
+});
+//#endregion
+//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/drivers/memory.mjs
+const DRIVER_NAME$1 = "memory";
+var memory_default = defineDriver(() => {
+	const data = new Map();
+	return {
+		name: DRIVER_NAME$1,
+		getInstance: () => data,
+		hasItem(key) {
+			return data.has(key);
+		},
+		getItem(key) {
+			return data.get(key) ?? null;
+		},
+		getItemRaw(key) {
+			return data.get(key) ?? null;
+		},
+		setItem(key, value) {
+			data.set(key, value);
+		},
+		setItemRaw(key, value) {
+			data.set(key, value);
+		},
+		removeItem(key) {
+			data.delete(key);
+		},
+		getKeys() {
+			return [...data.keys()];
+		},
+		clear() {
+			data.clear();
+		},
+		dispose() {
+			data.clear();
+		}
+	};
+});
+//#endregion
+//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/drivers/session-storage.mjs
+const DRIVER_NAME = "session-storage";
+var session_storage_default = defineDriver((opts = {}) => {
+	return {
+		...localstorage_default({
+			windowKey: "sessionStorage",
+			...opts
+		}),
+		name: DRIVER_NAME
+	};
+});
+//#endregion
+//#region src/persistence.ts
+const KEY = "finueva-auth:session:v1";
+const MAX_SNAPSHOT_BYTES = 16 * 1024;
+const MAX_FUTURE_SKEW_MS = 300 * 1e3;
+function createSessionPersistence(persistence, authOrigin, now, timeoutMs) {
+	const storage = createStorage({ driver: guardRawValues(selectDriver(persistence)) });
+	let enabled = true;
+	let generation = 0;
+	let queue = Promise.resolve();
+	const operationTimeoutMs = Math.min(timeoutMs, 1e3);
+	function cleanup() {
+		return Promise.resolve().then(() => storage.removeItem(KEY));
+	}
+	async function finishesWithin(work) {
+		let timeout;
+		try {
+			await Promise.race([work, new Promise((_, reject) => {
+				timeout = setTimeout(() => reject(new Error("persistence timeout")), operationTimeoutMs);
+			})]);
+			return true;
+		} catch {
+			return false;
+		} finally {
+			if (timeout) clearTimeout(timeout);
+		}
+	}
+	function schedule(operation) {
+		const operationGeneration = ++generation;
+		queue = queue.then(async () => {
+			if (!enabled || operationGeneration !== generation) return;
+			const isCurrent = () => enabled && operationGeneration === generation;
+			const work = Promise.resolve().then(() => operation(isCurrent));
+			if (!await finishesWithin(work)) {
+				enabled = false;
+				finishesWithin(cleanup());
+				work.then(cleanup, cleanup).then(() => void 0, () => void 0);
+				return;
+			}
+			if (!isCurrent() && !await finishesWithin(cleanup())) enabled = false;
+		});
+	}
+	return {
+		hydrate(accept) {
+			schedule(async (isCurrent) => {
+				const value = await storage.getItem(KEY);
+				if (!isCurrent()) return;
+				if (value === null) return;
+				const session = readSnapshot(value, authOrigin, now());
+				if (!session) {
+					await storage.removeItem(KEY);
+					return;
+				}
+				if (isCurrent()) accept(session);
+			});
+		},
+		persist(session) {
+			const expiresAt = session.expiresAt.getTime();
+			const normalizedSession = {
+				id: session.id,
+				expiresAt: session.expiresAt.toISOString(),
+				user: {
+					id: session.user.id,
+					name: session.user.name,
+					email: session.user.email,
+					emailVerified: session.user.emailVerified,
+					image: session.user.image
+				}
+			};
+			schedule(async () => {
+				const cachedAt = now();
+				if (expiresAt <= cachedAt) {
+					await storage.removeItem(KEY);
+					return;
+				}
+				const snapshot = {
+					version: 1,
+					authority: authOrigin,
+					cachedAt,
+					session: normalizedSession
+				};
+				if (byteLength(JSON.stringify(snapshot)) > MAX_SNAPSHOT_BYTES) {
+					await storage.removeItem(KEY);
+					return;
+				}
+				await storage.setItem(KEY, snapshot);
+				if (expiresAt <= now()) await storage.removeItem(KEY);
+			});
+		},
+		remove() {
+			schedule(() => storage.removeItem(KEY));
+		}
+	};
+}
+function selectDriver(persistence) {
+	if (typeof persistence === "object" && persistence !== null) return adaptDriver(persistence);
+	if (persistence === "memory") return memory_default();
+	if (persistence === "local" || persistence === "session") {
+		const storage = browserStorage(persistence);
+		return storage ? persistence === "local" ? localstorage_default({ storage }) : session_storage_default({ storage }) : memory_default();
+	}
+	if (persistence !== void 0) throw new TypeError("persistence must be local, session, memory, or a driver");
+	const storage = browserStorage("local");
+	return storage ? localstorage_default({ storage }) : memory_default();
+}
+function browserStorage(mode) {
+	try {
+		if (typeof window === "undefined" || typeof document === "undefined") return void 0;
+		const storage = mode === "local" ? window.localStorage : window.sessionStorage;
+		storage.getItem(KEY);
+		return storage;
+	} catch {
+		return;
+	}
+}
+function adaptDriver(driver) {
+	if (typeof driver.getItem !== "function" || typeof driver.setItem !== "function" || typeof driver.removeItem !== "function") throw new TypeError("persistence driver must implement getItem, setItem, and removeItem");
+	return {
+		name: "finueva-auth-custom",
+		hasItem: async (key) => await driver.getItem(key) !== null,
+		getItem: (key) => driver.getItem(key),
+		getKeys: () => [],
+		setItem: (key, value) => driver.setItem(key, value),
+		removeItem: (key) => driver.removeItem(key)
+	};
+}
+function guardRawValues(driver) {
+	return {
+		...driver,
+		async getItem(key) {
+			const value = await driver.getItem(key);
+			if (value !== null && typeof value !== "string") throw new Error("invalid persistence value");
+			if (typeof value === "string" && byteLength(value) > MAX_SNAPSHOT_BYTES) throw new Error("oversized persistence value");
+			if (typeof value === "string") JSON.parse(value, (field, nestedValue) => {
+				if (field === "__proto__") throw new Error("invalid persistence field");
+				return nestedValue;
+			});
+			return value;
+		}
+	};
+}
+function readSnapshot(value, authOrigin, currentTime) {
+	if (!exactObject(value, [
+		"authority",
+		"cachedAt",
+		"session",
+		"version"
+	])) return null;
+	if (value.version !== 1 || value.authority !== authOrigin || !Number.isSafeInteger(value.cachedAt)) return null;
+	if (!exactObject(value.session, [
+		"expiresAt",
+		"id",
+		"user"
+	])) return null;
+	if (!exactObject(value.session.user, [
+		"email",
+		"emailVerified",
+		"id",
+		"image",
+		"name"
+	])) return null;
+	const expiresAt = typeof value.session.expiresAt === "string" ? Date.parse(value.session.expiresAt) : NaN;
+	if (!Number.isFinite(expiresAt) || expiresAt <= currentTime || value.cachedAt > currentTime + MAX_FUTURE_SKEW_MS || value.cachedAt > expiresAt) return null;
+	try {
+		return normalizeSession({
+			session: {
+				id: value.session.id,
+				expiresAt: value.session.expiresAt
+			},
+			user: value.session.user
+		});
+	} catch {
+		return null;
+	}
+}
+function exactObject(value, fields) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === fields.length && fields.every((field) => keys.includes(field));
+}
+function byteLength(value) {
+	return new TextEncoder().encode(value).byteLength;
+}
+//#endregion
 //#region src/client.ts
 const REFRESH_WINDOW_MS = 120 * 1e3;
 function createAuthClient(options) {
@@ -2341,63 +3084,263 @@ function createAuthClient(options) {
 			timeout: timeoutMs
 		}
 	});
+	const persistence = createSessionPersistence(options.persistence, authOrigin, now, timeoutMs);
+	const authStateListeners = new Set();
+	let authState = { status: "loading" };
+	let authStateStarted = false;
 	let credential;
-	let credentialRequest;
+	const credentialRequests = new Map();
+	let selectedWorkspaceKey;
 	let credentialGeneration = 0;
+	let authorityGeneration = 0;
+	let locallySignedOut = false;
+	let activeSignInGeneration;
+	let invitationAbort;
+	let invitationRequest;
+	let signOutRequest;
 	let sessionId;
+	function setAuthState(state) {
+		authState = state;
+		for (const listener of authStateListeners) listener(state);
+	}
+	function unavailable() {
+		setAuthState({
+			status: "unavailable",
+			session: "session" in authState ? authState.session : null,
+			authoritative: false
+		});
+	}
+	function acceptAuthoritySession(session, generation = authorityGeneration) {
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		const normalized = updateSession(session);
+		if (normalized) {
+			persistence.persist(normalized);
+			setAuthState({
+				status: "authenticated",
+				session: normalized,
+				authoritative: true
+			});
+		} else {
+			setAuthState({
+				status: "unauthenticated",
+				session: null,
+				authoritative: true
+			});
+			persistence.remove();
+		}
+		return normalized;
+	}
+	function startAuthState() {
+		if (authStateStarted) return;
+		authStateStarted = true;
+		betterAuth.useSession.subscribe((state) => {
+			if (state.isPending) return;
+			if (state.error) {
+				unavailable();
+				return;
+			}
+			try {
+				const session = normalizeSession(state.data);
+				if (session && (locallySignedOut || signOutRequest)) return;
+				acceptAuthoritySession(session);
+			} catch {
+				unavailable();
+			}
+		});
+		persistence.hydrate((session) => {
+			if (authState.status === "loading") setAuthState({
+				status: "cached",
+				session,
+				authoritative: false
+			});
+			else if (authState.status === "unavailable" && authState.session === null) setAuthState({
+				status: "unavailable",
+				session,
+				authoritative: false
+			});
+		});
+		if (typeof window === "undefined" || typeof document === "undefined") getSession().catch(() => void 0);
+	}
 	function clearCredential() {
 		credential = void 0;
-		credentialRequest = void 0;
+		credentialRequests.clear();
+		selectedWorkspaceKey = void 0;
 		credentialGeneration += 1;
 	}
 	function updateSession(session) {
-		if (!session || !sessionId && (credential || credentialRequest) || sessionId && session.id !== sessionId) clearCredential();
+		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0);
+		if (!session || unboundCredential || sessionId && session.id !== sessionId) clearCredential();
 		sessionId = session?.id;
 		return session;
 	}
 	async function getSession() {
+		if (signOutRequest) throw new AuthError("state_conflict", 409);
+		locallySignedOut = false;
+		const generation = authorityGeneration;
 		let result;
 		try {
 			result = await betterAuth.getSession();
 		} catch {
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			unavailable();
+			throw authorityUnavailable();
+		}
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		if (result.error) {
+			unavailable();
+			throw fromAuthorityError(result.error, result.error.status);
+		}
+		try {
+			return acceptAuthoritySession(normalizeSession(result.data), generation);
+		} catch (error) {
+			if (error instanceof AuthError) throw error;
+			unavailable();
 			throw authorityUnavailable();
 		}
-		if (result.error) throw fromAuthorityError(result.error, result.error.status);
-		return updateSession(normalizeSession(result.data));
 	}
-	return {
-		getSession,
-		async signIn(input) {
-			clearCredential();
+	function signOut() {
+		if (signOutRequest) return signOutRequest;
+		const pendingInvitation = invitationRequest;
+		invitationAbort?.abort();
+		const generation = ++authorityGeneration;
+		locallySignedOut = true;
+		clearCredential();
+		sessionId = void 0;
+		persistence.remove();
+		const request = (async () => {
+			await pendingInvitation?.catch(() => void 0);
 			let result;
 			try {
-				result = await betterAuth.signIn.email({
-					email: input.email,
-					password: input.password
-				});
+				result = await betterAuth.signOut();
 			} catch {
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				locallySignedOut = false;
+				unavailable();
 				throw authorityUnavailable();
 			}
-			if (result.error) throw fromAuthorityError(result.error, result.error.status);
-			const session = await getSession();
-			if (!session) throw new AuthError("authentication_required", 401);
-			return session;
-		},
-		async signOut() {
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			if (result.error) {
+				locallySignedOut = false;
+				unavailable();
+				throw fromAuthorityError(result.error, result.error.status);
+			}
+			setAuthState({
+				status: "unauthenticated",
+				session: null,
+				authoritative: true
+			});
+		})().finally(() => {
+			if (signOutRequest === request) signOutRequest = void 0;
+		});
+		signOutRequest = request;
+		return request;
+	}
+	return {
+		acceptInvitation(input) {
+			let invitation;
+			try {
+				invitation = normalizeInvitationInput(input);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			if (signOutRequest || activeSignInGeneration !== void 0 || invitationRequest) return Promise.reject(new AuthError("state_conflict", 409));
+			const generation = authorityGeneration;
+			const controller = new AbortController();
 			clearCredential();
-			sessionId = void 0;
-			let result;
+			const request = (async () => {
+				try {
+					const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organization/accept-invitation"), {
+						fetch: fetchImpl,
+						timeoutMs,
+						method: "POST",
+						headers: { "content-type": "application/json; charset=utf-8" },
+						body: invitation,
+						mapError: fromInvitationAuthorityError,
+						signal: controller.signal
+					});
+					if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+					return normalizeInvitationAcceptance(value, invitation.invitationId);
+				} catch (error) {
+					if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+					throw fromInvitationError(error);
+				}
+			})().finally(() => {
+				if (invitationRequest === request) {
+					invitationAbort = void 0;
+					invitationRequest = void 0;
+				}
+			});
+			invitationAbort = controller;
+			invitationRequest = request;
+			return request;
+		},
+		getSession,
+		async listOrganizations() {
+			if (signOutRequest || activeSignInGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
 			try {
-				result = await betterAuth.signOut();
-			} catch {
-				throw authorityUnavailable();
+				const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organization/list"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "GET"
+				});
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				return normalizeOrganizations(value);
+			} catch (error) {
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				throw fromOrganizationListError(error);
 			}
-			if (result.error) throw fromAuthorityError(result.error, result.error.status);
 		},
+		async signIn(input) {
+			if (signOutRequest) throw new AuthError("state_conflict", 409);
+			const pendingInvitation = invitationRequest;
+			invitationAbort?.abort();
+			const generation = ++authorityGeneration;
+			activeSignInGeneration = generation;
+			try {
+				await pendingInvitation?.catch(() => void 0);
+				locallySignedOut = false;
+				clearCredential();
+				let result;
+				try {
+					result = await betterAuth.signIn.email({
+						email: input.email,
+						password: input.password
+					});
+				} catch {
+					if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+					unavailable();
+					throw authorityUnavailable();
+				}
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				if (result.error) {
+					unavailable();
+					throw fromAuthorityError(result.error, result.error.status);
+				}
+				const session = await getSession();
+				if (!session) throw new AuthError("authentication_required", 401);
+				return session;
+			} finally {
+				if (activeSignInGeneration === generation) activeSignInGeneration = void 0;
+			}
+		},
+		signOut,
 		getDriveCredential(input) {
-			if (input.workspace.type !== "personal") return Promise.reject(new AuthError("invalid_workspace_selection", 422));
-			if (!input.forceRefresh && credential && credential.expiresAt.getTime() - now() > REFRESH_WINDOW_MS) return Promise.resolve(credential);
+			let workspace;
+			try {
+				workspace = normalizeWorkspaceSelection(input?.workspace);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			if (invitationRequest) return Promise.reject(new AuthError("state_conflict", 409));
+			const workspaceKey = workspace.type === "personal" ? "personal" : `organization:${workspace.organizationId}`;
+			if (selectedWorkspaceKey !== workspaceKey) {
+				credential = void 0;
+				selectedWorkspaceKey = workspaceKey;
+			}
+			if (!input.forceRefresh && credential?.key === workspaceKey && credential.value.expiresAt.getTime() - now() > REFRESH_WINDOW_MS) return Promise.resolve(credential.value);
 			if (input.forceRefresh) credential = void 0;
+			let credentialRequest = credentialRequests.get(workspaceKey);
 			if (!credentialRequest) {
 				const generation = credentialGeneration;
 				const request = (async () => {
@@ -2406,20 +3349,30 @@ function createAuthClient(options) {
 						timeoutMs,
 						method: "POST",
 						headers: { "content-type": "application/json; charset=utf-8" },
-						body: { workspace: { type: "personal" } }
+						body: { workspace }
 					}));
 					if (error) throw error;
 					const nextCredential = normalizeDriveCredential(result, now());
 					if (generation !== credentialGeneration) throw new AuthError("authentication_required", 401);
-					credential = nextCredential;
+					if (selectedWorkspaceKey === workspaceKey) credential = {
+						key: workspaceKey,
+						value: nextCredential
+					};
 					return nextCredential;
 				})().finally(() => {
-					if (credentialRequest === request) credentialRequest = void 0;
+					if (credentialRequests.get(workspaceKey) === request) credentialRequests.delete(workspaceKey);
 				});
+				credentialRequests.set(workspaceKey, request);
 				credentialRequest = request;
 			}
 			return credentialRequest;
 		},
+		onAuthStateChange(listener) {
+			authStateListeners.add(listener);
+			listener(authState);
+			startAuthState();
+			return () => authStateListeners.delete(listener);
+		},
 		onSessionChange(listener) {
 			return betterAuth.useSession.subscribe((state) => {
 				let session;