@finueva/auth 0.16.1 → 0.18.0

package/dist/server.js

@@ -8,16 +8,16 @@ const ENC_CARET_RE = /%5e/gi;
 const ENC_BACKTICK_RE = /%60/gi;
 const ENC_PIPE_RE = /%7c/gi;
 const ENC_SPACE_RE = /%20/gi;
-function encode(text) {
+function encode$2(text) {
 	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
 }
 function encodeQueryValue(input) {
-	return encode(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
+	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
 }
 function encodeQueryKey(text) {
 	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
 }
-function decode(text = "") {
+function decode$1(text = "") {
 	try {
 		return decodeURIComponent("" + text);
 	} catch {
@@ -25,10 +25,10 @@ function decode(text = "") {
 	}
 }
 function decodeQueryKey(text) {
-	return decode(text.replace(PLUS_RE, " "));
+	return decode$1(text.replace(PLUS_RE, " "));
 }
 function decodeQueryValue(text) {
-	return decode(text.replace(PLUS_RE, " "));
+	return decode$1(text.replace(PLUS_RE, " "));
 }
 function parseQuery(parametersString = "") {
 	const object = Object.create(null);
@@ -187,6 +187,7 @@ const messages = {
 	recipient_unavailable: "The recipient is unavailable.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
 	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -212,1278 +213,2682 @@ var AuthError = class extends Error {
 	}
 };
 //#endregion
-//#region src/shared.ts
-const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
-const id = /^[A-Za-z0-9_-]{1,128}$/;
-const email = /^[^\s@]+@[^\s@]+$/;
-const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
-function normalizeEmail(value) {
-	if (typeof value !== "string") throw new TypeError("email is invalid");
-	const normalized = value.trim().toLowerCase();
-	if (normalized.length === 0 || normalized.length > 320 || !email.test(normalized)) throw new TypeError("email is invalid");
-	return normalized;
+//#region src/user-api/credential.ts
+function userApiApplication(input) {
+	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
+	return input.applicationId;
 }
-function normalizeSocialIdTokenInput(value) {
-	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
-	const keys = Object.keys(value);
-	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
+function normalizeUserApiCredential(value, startedAt) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
 	return {
-		provider: value.provider,
-		idToken: value.idToken,
-		...value.nonce === void 0 ? {} : { nonce: value.nonce },
-		signUp: value.signUp
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
 	};
 }
-function socialIdTokenRequest(value) {
-	return {
-		provider: value.provider,
-		idToken: {
-			token: value.idToken,
-			...value.nonce === void 0 ? {} : { nonce: value.nonce }
-		},
-		requestSignUp: value.signUp
-	};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/buffer_utils.js
+const encoder$1 = new TextEncoder();
+const decoder = new TextDecoder();
+function concat(...buffers) {
+	const size = buffers.reduce((acc, { length }) => acc + length, 0);
+	const buf = new Uint8Array(size);
+	let i = 0;
+	for (const buffer of buffers) {
+		buf.set(buffer, i);
+		i += buffer.length;
+	}
+	return buf;
+}
+function encode$1(string) {
+	const bytes = new Uint8Array(string.length);
+	for (let i = 0; i < string.length; i++) {
+		const code = string.charCodeAt(i);
+		if (code > 127) throw new TypeError("non-ASCII string encountered in encode()");
+		bytes[i] = code;
+	}
+	return bytes;
 }
-function normalizeOrigin(value, name) {
-	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
-	let url;
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/base64.js
+function encodeBase64(input) {
+	if (Uint8Array.prototype.toBase64) return input.toBase64();
+	const CHUNK_SIZE = 32768;
+	const arr = [];
+	for (let i = 0; i < input.length; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+	return btoa(arr.join(""));
+}
+function decodeBase64(encoded) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded);
+	const binary = atob(encoded);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/base64url.js
+function decode(input) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), { alphabet: "base64url" });
+	let encoded = input;
+	if (encoded instanceof Uint8Array) encoded = decoder.decode(encoded);
+	encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
 	try {
-		url = new URL(value);
+		return decodeBase64(encoded);
 	} catch {
-		throw new TypeError(`${name} must be an ASCII HTTP origin`);
+		throw new TypeError("The input to be decoded is not correctly encoded.");
 	}
-	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
-	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
-	return url.origin;
 }
-function normalizeTimeout(value) {
-	const timeout = value ?? 1e4;
-	if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 6e4) throw new TypeError("timeoutMs must be an integer from 1 to 60000");
-	return timeout;
+function encode(input) {
+	let unencoded = input;
+	if (typeof unencoded === "string") unencoded = encoder$1.encode(unencoded);
+	if (Uint8Array.prototype.toBase64) return unencoded.toBase64({
+		alphabet: "base64url",
+		omitPadding: true
+	});
+	return encodeBase64(unencoded).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
 }
-function normalizeSession(value) {
-	if (value === null) return null;
-	if (!isObject(value) || !isObject(value.session) || !isObject(value.user)) throw authorityUnavailable();
-	const expiresAt = toDate(value.session.expiresAt);
-	const image = value.user.image;
-	if (!isId(value.session.id) || !expiresAt || !isId(value.user.id) || typeof value.user.name !== "string" || value.user.name.length > 256 || typeof value.user.email !== "string" || value.user.email.length > 320 || !email.test(value.user.email) || typeof value.user.emailVerified !== "boolean" || image !== null && image !== void 0 && (typeof image !== "string" || image.length > 2048)) throw authorityUnavailable();
-	return {
-		id: value.session.id,
-		expiresAt,
-		user: {
-			id: value.user.id,
-			name: value.user.name,
-			email: value.user.email,
-			emailVerified: value.user.emailVerified,
-			image: image ?? null
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/crypto_key.js
+const unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+const isAlgorithm = (algorithm, name) => algorithm.name === name;
+function getHashLength(hash) {
+	return parseInt(hash.name.slice(4), 10);
+}
+function checkHashLength(algorithm, expected) {
+	if (getHashLength(algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
+}
+function getNamedCurve(alg) {
+	switch (alg) {
+		case "ES256": return "P-256";
+		case "ES384": return "P-384";
+		case "ES512": return "P-521";
+		default: throw new Error("unreachable");
+	}
+}
+function checkUsage(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkSigCryptoKey(key, alg, usage) {
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512":
+			if (!isAlgorithm(key.algorithm, "HMAC")) throw unusable("HMAC");
+			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable("RSASSA-PKCS1-v1_5");
+			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+			break;
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			if (!isAlgorithm(key.algorithm, "RSA-PSS")) throw unusable("RSA-PSS");
+			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+			break;
+		case "Ed25519":
+		case "EdDSA":
+			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusable("Ed25519");
+			break;
+		case "ML-DSA-44":
+		case "ML-DSA-65":
+		case "ML-DSA-87":
+			if (!isAlgorithm(key.algorithm, alg)) throw unusable(alg);
+			break;
+		case "ES256":
+		case "ES384":
+		case "ES512": {
+			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusable("ECDSA");
+			const expected = getNamedCurve(alg);
+			if (key.algorithm.namedCurve !== expected) throw unusable(expected, "algorithm.namedCurve");
+			break;
 		}
-	};
+		default: throw new TypeError("CryptoKey does not support this operation");
+	}
+	checkUsage(key, usage);
 }
-function normalizeDriveCredential(value, now) {
-	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
-	return {
-		tokenType: "Bearer",
-		token: value.token,
-		expiresAt: new Date(now + value.expiresIn * 1e3)
-	};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/invalid_key_input.js
+function message(msg, actual, ...types) {
+	types = types.filter(Boolean);
+	if (types.length > 2) {
+		const last = types.pop();
+		msg += `one of type ${types.join(", ")}, or ${last}.`;
+	} else if (types.length === 2) msg += `one of type ${types[0]} or ${types[1]}.`;
+	else msg += `of type ${types[0]}.`;
+	if (actual == null) msg += ` Received ${actual}`;
+	else if (typeof actual === "function" && actual.name) msg += ` Received function ${actual.name}`;
+	else if (typeof actual === "object" && actual != null) {
+		if (actual.constructor?.name) msg += ` Received an instance of ${actual.constructor.name}`;
+	}
+	return msg;
 }
-function normalizeOrganizationPageInput(value) {
-	if (value === void 0) return new URLSearchParams();
-	if (!isObject(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
-	const input = value;
-	const query = new URLSearchParams();
-	if (input.limit !== void 0) {
-		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100) throw new AuthError("invalid_request", 400);
-		query.set("limit", String(input.limit));
+const invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+const withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+	static code = "ERR_JOSE_GENERIC";
+	code = "ERR_JOSE_GENERIC";
+	constructor(message, options) {
+		super(message, options);
+		this.name = this.constructor.name;
+		Error.captureStackTrace?.(this, this.constructor);
 	}
-	if (input.cursor !== void 0) {
-		if (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.cursor)) throw new AuthError("invalid_request", 400);
-		query.set("cursor", input.cursor);
+};
+var JWTClaimValidationFailed = class extends JOSEError {
+	static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+	code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+	claim;
+	reason;
+	payload;
+	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+		super(message, { cause: {
+			claim,
+			reason,
+			payload
+		} });
+		this.claim = claim;
+		this.reason = reason;
+		this.payload = payload;
 	}
-	return query;
-}
-function normalizeIdInput(value) {
-	if (!isId(value)) throw new AuthError("invalid_request", 400);
-	return value;
-}
-function normalizeOrganization(value) {
-	exact$2(value, [
-		"capabilities",
-		"id",
-		"lifecycle",
-		"logo",
-		"name",
-		"role",
-		"slug"
-	]);
-	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
-	exact$2(value.capabilities, [
-		"readInvitations",
-		"readMembers",
-		"readTeams"
-	]);
-	if (value.capabilities.readMembers !== true || value.capabilities.readTeams !== true || typeof value.capabilities.readInvitations !== "boolean") throw authorityUnavailable();
-	return {
-		id: value.id,
-		name: value.name,
-		slug: value.slug,
-		logo: nullableHttpsUrl(value.logo),
-		lifecycle: value.lifecycle,
-		role: value.role,
-		capabilities: {
-			readMembers: true,
-			readTeams: true,
-			readInvitations: value.capabilities.readInvitations
-		}
-	};
-}
-function normalizeOrganizationDisplayInput(value) {
-	if (!isObject(value) || Object.keys(value).sort().join(",") !== "logo,name,slug") throw new AuthError("invalid_request", 400);
-	if (!boundedString(value.name, 255) || !boundedString(value.slug, 255)) throw new AuthError("invalid_request", 400);
-	let logo;
+};
+var JWTExpired = class extends JOSEError {
+	static code = "ERR_JWT_EXPIRED";
+	code = "ERR_JWT_EXPIRED";
+	claim;
+	reason;
+	payload;
+	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+		super(message, { cause: {
+			claim,
+			reason,
+			payload
+		} });
+		this.claim = claim;
+		this.reason = reason;
+		this.payload = payload;
+	}
+};
+var JOSEAlgNotAllowed = class extends JOSEError {
+	static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+	code = "ERR_JOSE_ALG_NOT_ALLOWED";
+};
+var JOSENotSupported = class extends JOSEError {
+	static code = "ERR_JOSE_NOT_SUPPORTED";
+	code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWSInvalid = class extends JOSEError {
+	static code = "ERR_JWS_INVALID";
+	code = "ERR_JWS_INVALID";
+};
+var JWTInvalid = class extends JOSEError {
+	static code = "ERR_JWT_INVALID";
+	code = "ERR_JWT_INVALID";
+};
+var JWKInvalid = class extends JOSEError {
+	static code = "ERR_JWK_INVALID";
+	code = "ERR_JWK_INVALID";
+};
+var JWSSignatureVerificationFailed = class extends JOSEError {
+	static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+	code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+	constructor(message = "signature verification failed", options) {
+		super(message, options);
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/is_key_like.js
+const isCryptoKey = (key) => {
+	if (key?.[Symbol.toStringTag] === "CryptoKey") return true;
 	try {
-		logo = nullableHttpsUrl(value.logo);
+		return key instanceof CryptoKey;
 	} catch {
-		throw new AuthError("invalid_request", 400);
+		return false;
 	}
-	return {
-		name: value.name,
-		slug: value.slug,
-		logo
-	};
-}
-function normalizeOrganizationDisplay(value) {
+};
+const isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/helpers.js
+function decodeBase64url(value, label, ErrorClass) {
 	try {
-		return normalizeOrganizationDisplayInput(value);
+		return decode(value);
 	} catch {
-		throw authorityUnavailable();
+		throw new ErrorClass(`Failed to base64url decode the ${label}`);
 	}
 }
-function normalizeOrganizationTeamDisplayInput(value) {
-	if (!isObject(value) || Object.keys(value).join(",") !== "name" || !boundedString(value.name, 255)) throw new AuthError("invalid_request", 400);
-	return { name: value.name };
+async function digest(algorithm, data) {
+	const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+	return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
 }
-function normalizeOrganizationTeamDisplay(value) {
-	try {
-		return normalizeOrganizationTeamDisplayInput(value);
-	} catch {
-		throw authorityUnavailable();
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/type_checks.js
+const isObjectLike = (value) => typeof value === "object" && value !== null;
+function isObject$1(input) {
+	if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") return false;
+	if (Object.getPrototypeOf(input) === null) return true;
+	let proto = input;
+	while (Object.getPrototypeOf(proto) !== null) proto = Object.getPrototypeOf(proto);
+	return Object.getPrototypeOf(input) === proto;
+}
+function isDisjoint(...headers) {
+	const sources = headers.filter(Boolean);
+	if (sources.length === 0 || sources.length === 1) return true;
+	let acc;
+	for (const header of sources) {
+		const parameters = Object.keys(header);
+		if (!acc || acc.size === 0) {
+			acc = new Set(parameters);
+			continue;
+		}
+		for (const parameter of parameters) {
+			if (acc.has(parameter)) return false;
+			acc.add(parameter);
+		}
 	}
+	return true;
 }
-function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
-	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
-	return {
-		name,
-		idempotencyKey
-	};
+const isJWK = (key) => isObject$1(key) && typeof key.kty === "string";
+const isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
+const isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
+const isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/signing.js
+function checkKeyLength(alg, key) {
+	if (alg.startsWith("RS") || alg.startsWith("PS")) {
+		const { modulusLength } = key.algorithm;
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+	}
 }
-function normalizeCreatedOrganizationTeam(value) {
-	exact$2(value, ["id", "name"]);
-	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
-	return {
-		id: value.id,
-		name: value.name
-	};
+function subtleAlgorithm(alg, algorithm) {
+	const hash = `SHA-${alg.slice(-3)}`;
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512": return {
+			hash,
+			name: "HMAC"
+		};
+		case "PS256":
+		case "PS384":
+		case "PS512": return {
+			hash,
+			name: "RSA-PSS",
+			saltLength: parseInt(alg.slice(-3), 10) >> 3
+		};
+		case "RS256":
+		case "RS384":
+		case "RS512": return {
+			hash,
+			name: "RSASSA-PKCS1-v1_5"
+		};
+		case "ES256":
+		case "ES384":
+		case "ES512": return {
+			hash,
+			name: "ECDSA",
+			namedCurve: algorithm.namedCurve
+		};
+		case "Ed25519":
+		case "EdDSA": return { name: "Ed25519" };
+		case "ML-DSA-44":
+		case "ML-DSA-65":
+		case "ML-DSA-87": return { name: alg };
+		default: throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+	}
 }
-function normalizeOrganizationMemberInvitationCreationInput(value) {
-	if (!isObject(value)) throw new AuthError("invalid_request", 400);
-	const keys = Object.keys(value).sort().join(",");
-	if (keys !== "email,idempotencyKey" && keys !== "email,idempotencyKey,teamIds") throw new AuthError("invalid_request", 400);
-	let normalizedEmail;
+async function getSigKey(alg, key, usage) {
+	if (key instanceof Uint8Array) {
+		if (!alg.startsWith("HS")) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+		return crypto.subtle.importKey("raw", key, {
+			hash: `SHA-${alg.slice(-3)}`,
+			name: "HMAC"
+		}, false, [usage]);
+	}
+	checkSigCryptoKey(key, alg, usage);
+	return key;
+}
+async function verify(alg, key, signature, data) {
+	const cryptoKey = await getSigKey(alg, key, "verify");
+	checkKeyLength(alg, cryptoKey);
+	const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
 	try {
-		normalizedEmail = normalizeEmail(value.email);
+		return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
 	} catch {
-		throw new AuthError("invalid_request", 400);
+		return false;
 	}
-	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
-	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
-	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
-	return {
-		email: normalizedEmail,
-		...teamIds === void 0 ? {} : { teamIds },
-		idempotencyKey: value.idempotencyKey
-	};
 }
-function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact$2(value, ["expiresAt", "id"]);
-	if (!isId(value.id)) throw authorityUnavailable();
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/jwk_to_key.js
+const unsupportedAlg = "Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value";
+function subtleMapping(jwk) {
+	let algorithm;
+	let keyUsages;
+	switch (jwk.kty) {
+		case "AKP":
+			switch (jwk.alg) {
+				case "ML-DSA-44":
+				case "ML-DSA-65":
+				case "ML-DSA-87":
+					algorithm = { name: jwk.alg };
+					keyUsages = jwk.priv ? ["sign"] : ["verify"];
+					break;
+				default: throw new JOSENotSupported(unsupportedAlg);
+			}
+			break;
+		case "RSA":
+			switch (jwk.alg) {
+				case "PS256":
+				case "PS384":
+				case "PS512":
+					algorithm = {
+						name: "RSA-PSS",
+						hash: `SHA-${jwk.alg.slice(-3)}`
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "RS256":
+				case "RS384":
+				case "RS512":
+					algorithm = {
+						name: "RSASSA-PKCS1-v1_5",
+						hash: `SHA-${jwk.alg.slice(-3)}`
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "RSA-OAEP":
+				case "RSA-OAEP-256":
+				case "RSA-OAEP-384":
+				case "RSA-OAEP-512":
+					algorithm = {
+						name: "RSA-OAEP",
+						hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
+					};
+					keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+					break;
+				default: throw new JOSENotSupported(unsupportedAlg);
+			}
+			break;
+		case "EC":
+			switch (jwk.alg) {
+				case "ES256":
+				case "ES384":
+				case "ES512":
+					algorithm = {
+						name: "ECDSA",
+						namedCurve: {
+							ES256: "P-256",
+							ES384: "P-384",
+							ES512: "P-521"
+						}[jwk.alg]
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					algorithm = {
+						name: "ECDH",
+						namedCurve: jwk.crv
+					};
+					keyUsages = jwk.d ? ["deriveBits"] : [];
+					break;
+				default: throw new JOSENotSupported(unsupportedAlg);
+			}
+			break;
+		case "OKP":
+			switch (jwk.alg) {
+				case "Ed25519":
+				case "EdDSA":
+					algorithm = { name: "Ed25519" };
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					algorithm = { name: jwk.crv };
+					keyUsages = jwk.d ? ["deriveBits"] : [];
+					break;
+				default: throw new JOSENotSupported(unsupportedAlg);
+			}
+			break;
+		default: throw new JOSENotSupported("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
+	}
 	return {
-		id: value.id,
-		expiresAt: responseDate(value.expiresAt)
+		algorithm,
+		keyUsages
 	};
 }
-function normalizeResentOrganizationInvitation(value, invitationId) {
-	const invitation = normalizeCreatedOrganizationMemberInvitation(value);
-	if (invitation.id !== invitationId) throw authorityUnavailable();
-	return invitation;
+async function jwkToKey(jwk) {
+	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
+	const { algorithm, keyUsages } = subtleMapping(jwk);
+	const keyData = { ...jwk };
+	if (keyData.kty !== "AKP") delete keyData.alg;
+	delete keyData.use;
+	return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
 }
-function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
-	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
-	return { idempotencyKey };
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/normalize_key.js
+const unusableForAlg = "given KeyObject instance cannot be used for this algorithm";
+let cache;
+const handleJWK = async (key, jwk, alg, freeze = false) => {
+	cache ||= new WeakMap();
+	let cached = cache.get(key);
+	if (cached?.[alg]) return cached[alg];
+	const cryptoKey = await jwkToKey({
+		...jwk,
+		alg
+	});
+	if (freeze) Object.freeze(key);
+	if (!cached) cache.set(key, { [alg]: cryptoKey });
+	else cached[alg] = cryptoKey;
+	return cryptoKey;
+};
+const handleKeyObject = (keyObject, alg) => {
+	cache ||= new WeakMap();
+	let cached = cache.get(keyObject);
+	if (cached?.[alg]) return cached[alg];
+	const isPublic = keyObject.type === "public";
+	const extractable = isPublic ? true : false;
+	let cryptoKey;
+	if (keyObject.asymmetricKeyType === "x25519") {
+		switch (alg) {
+			case "ECDH-ES":
+			case "ECDH-ES+A128KW":
+			case "ECDH-ES+A192KW":
+			case "ECDH-ES+A256KW": break;
+			default: throw new TypeError(unusableForAlg);
+		}
+		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ["deriveBits"]);
+	}
+	if (keyObject.asymmetricKeyType === "ed25519") {
+		if (alg !== "EdDSA" && alg !== "Ed25519") throw new TypeError(unusableForAlg);
+		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
+	}
+	switch (keyObject.asymmetricKeyType) {
+		case "ml-dsa-44":
+		case "ml-dsa-65":
+		case "ml-dsa-87":
+			if (alg !== keyObject.asymmetricKeyType.toUpperCase()) throw new TypeError(unusableForAlg);
+			cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
+	}
+	if (keyObject.asymmetricKeyType === "rsa") {
+		let hash;
+		switch (alg) {
+			case "RSA-OAEP":
+				hash = "SHA-1";
+				break;
+			case "RS256":
+			case "PS256":
+			case "RSA-OAEP-256":
+				hash = "SHA-256";
+				break;
+			case "RS384":
+			case "PS384":
+			case "RSA-OAEP-384":
+				hash = "SHA-384";
+				break;
+			case "RS512":
+			case "PS512":
+			case "RSA-OAEP-512":
+				hash = "SHA-512";
+				break;
+			default: throw new TypeError(unusableForAlg);
+		}
+		if (alg.startsWith("RSA-OAEP")) return keyObject.toCryptoKey({
+			name: "RSA-OAEP",
+			hash
+		}, extractable, isPublic ? ["encrypt"] : ["decrypt"]);
+		cryptoKey = keyObject.toCryptoKey({
+			name: alg.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+			hash
+		}, extractable, [isPublic ? "verify" : "sign"]);
+	}
+	if (keyObject.asymmetricKeyType === "ec") {
+		const namedCurve = new Map([
+			["prime256v1", "P-256"],
+			["secp384r1", "P-384"],
+			["secp521r1", "P-521"]
+		]).get(keyObject.asymmetricKeyDetails?.namedCurve);
+		if (!namedCurve) throw new TypeError(unusableForAlg);
+		const expectedCurve = {
+			ES256: "P-256",
+			ES384: "P-384",
+			ES512: "P-521"
+		};
+		if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) cryptoKey = keyObject.toCryptoKey({
+			name: "ECDSA",
+			namedCurve
+		}, extractable, [isPublic ? "verify" : "sign"]);
+		if (alg.startsWith("ECDH-ES")) cryptoKey = keyObject.toCryptoKey({
+			name: "ECDH",
+			namedCurve
+		}, extractable, isPublic ? [] : ["deriveBits"]);
+	}
+	if (!cryptoKey) throw new TypeError(unusableForAlg);
+	if (!cached) cache.set(keyObject, { [alg]: cryptoKey });
+	else cached[alg] = cryptoKey;
+	return cryptoKey;
+};
+async function normalizeKey(key, alg) {
+	if (key instanceof Uint8Array) return key;
+	if (isCryptoKey(key)) return key;
+	if (isKeyObject(key)) {
+		if (key.type === "secret") return key.export();
+		if ("toCryptoKey" in key && typeof key.toCryptoKey === "function") try {
+			return handleKeyObject(key, alg);
+		} catch (err) {
+			if (err instanceof TypeError) throw err;
+		}
+		let jwk = key.export({ format: "jwk" });
+		return handleJWK(key, jwk, alg);
+	}
+	if (isJWK(key)) {
+		if (key.k) return decode(key.k);
+		return handleJWK(key, key, alg, true);
+	}
+	throw new Error("unreachable");
 }
-function normalizeCanceledOrganizationInvitation(value) {
-	exact$2(value, ["status"]);
-	if (value.status !== "canceled") throw authorityUnavailable();
-	return { status: "canceled" };
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+	if (!isObject$1(jwk)) throw new TypeError("JWK must be an object");
+	let ext;
+	alg ??= jwk.alg;
+	ext ??= options?.extractable ?? jwk.ext;
+	switch (jwk.kty) {
+		case "oct":
+			if (typeof jwk.k !== "string" || !jwk.k) throw new TypeError("missing \"k\" (Key Value) Parameter value");
+			return decode(jwk.k);
+		case "RSA":
+			if ("oth" in jwk && jwk.oth !== void 0) throw new JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");
+			return jwkToKey({
+				...jwk,
+				alg,
+				ext
+			});
+		case "AKP":
+			if (typeof jwk.alg !== "string" || !jwk.alg) throw new TypeError("missing \"alg\" (Algorithm) Parameter value");
+			if (alg !== void 0 && alg !== jwk.alg) throw new TypeError("JWK alg and alg option value mismatch");
+			return jwkToKey({
+				...jwk,
+				ext
+			});
+		case "EC":
+		case "OKP": return jwkToKey({
+			...jwk,
+			alg,
+			ext
+		});
+		default: throw new JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");
+	}
 }
-function normalizeOrganizations(value) {
-	exact$2(value, ["nextCursor", "organizations"]);
-	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
-	return {
-		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/key_to_jwk.js
+function omitUndefinedProperties(jwk) {
+	return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== void 0));
+}
+async function keyToJWK(key) {
+	if (isKeyObject(key)) if (key.type === "secret") key = key.export();
+	else return key.export({ format: "jwk" });
+	if (key instanceof Uint8Array) return {
+		kty: "oct",
+		k: encode(key)
 	};
+	if (!isCryptoKey(key)) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+	const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey("jwk", key));
+	if (jwk.kty === "AKP") jwk.alg = alg;
+	return jwk;
 }
-function normalizeOrganizationMembers(value) {
-	exact$2(value, ["members", "nextCursor"]);
-	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
-	return {
-		members: unique(value.members.map((member) => {
-			exact$2(member, [
-				"email",
-				"id",
-				"image",
-				"joinedAt",
-				"name",
-				"owner",
-				"role",
-				"teamIds",
-				"userId"
-			]);
-			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
-			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
-			return {
-				id: member.id,
-				userId: member.userId,
-				name: member.name,
-				email: member.email,
-				image: nullableHttpsUrl(member.image),
-				role: member.role,
-				owner: member.owner,
-				joinedAt: responseDate(member.joinedAt),
-				teamIds
-			};
-		}), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
-	};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/key/export.js
+async function exportJWK(key) {
+	return keyToJWK(key);
 }
-function normalizeOrganizationTeams(value) {
-	exact$2(value, ["nextCursor", "teams"]);
-	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
-	return {
-		teams: unique(value.teams.map((team) => {
-			exact$2(team, [
-				"category",
-				"createdAt",
-				"id",
-				"name"
-			]);
-			if (!isId(team.id) || !boundedString(team.name, 255) || team.category !== "manual" && team.category !== "managed") throw authorityUnavailable();
-			return {
-				id: team.id,
-				name: team.name,
-				category: team.category,
-				createdAt: responseDate(team.createdAt)
-			};
-		}), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
-	};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/validate_crit.js
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
+	if (!protectedHeader || protectedHeader.crit === void 0) return new Set();
+	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
+	let recognized;
+	if (recognizedOption !== void 0) recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
+	else recognized = recognizedDefault;
+	for (const parameter of protectedHeader.crit) {
+		if (!recognized.has(parameter)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+		if (joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+		if (recognized.get(parameter) && protectedHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+	}
+	return new Set(protectedHeader.crit);
 }
-function normalizeOrganizationTeamMembers(value) {
-	exact$2(value, ["memberIds", "nextCursor"]);
-	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
-	return {
-		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
-		nextCursor: nullableCursor(value.nextCursor)
-	};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/validate_algorithms.js
+function validateAlgorithms(option, algorithms) {
+	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
+	if (!algorithms) return;
+	return new Set(algorithms);
 }
-function normalizeOrganizationInvitation(value) {
-	exact$2(value, [
-		"createdAt",
-		"email",
-		"expiresAt",
-		"id",
-		"inviter",
-		"role",
-		"status",
-		"teamIds"
-	]);
-	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
-	exact$2(value.inviter, ["membershipId", "name"]);
-	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
-	return {
-		id: value.id,
-		email: value.email,
-		role: value.role,
-		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
-		inviter: {
-			membershipId: value.inviter.membershipId,
-			name: value.inviter.name
-		},
-		createdAt: responseDate(value.createdAt),
-		expiresAt: responseDate(value.expiresAt),
-		status: "pending"
-	};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/check_key_type.js
+const tag = (key) => key?.[Symbol.toStringTag];
+const jwkMatchesOp = (alg, key, usage) => {
+	if (key.use !== void 0) {
+		let expected;
+		switch (usage) {
+			case "sign":
+			case "verify":
+				expected = "sig";
+				break;
+			case "encrypt":
+			case "decrypt":
+				expected = "enc";
+				break;
+		}
+		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+	}
+	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+	if (Array.isArray(key.key_ops)) {
+		let expectedKeyOp;
+		switch (true) {
+			case usage === "sign" || usage === "verify":
+			case alg === "dir":
+			case alg.includes("CBC-HS"):
+				expectedKeyOp = usage;
+				break;
+			case alg.startsWith("PBES2"):
+				expectedKeyOp = "deriveBits";
+				break;
+			case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
+				if (!alg.includes("GCM") && alg.endsWith("KW")) expectedKeyOp = usage === "encrypt" ? "wrapKey" : "unwrapKey";
+				else expectedKeyOp = usage;
+				break;
+			case usage === "encrypt" && alg.startsWith("RSA"):
+				expectedKeyOp = "wrapKey";
+				break;
+			case usage === "decrypt":
+				expectedKeyOp = alg.startsWith("RSA") ? "unwrapKey" : "deriveBits";
+				break;
+		}
+		if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+	}
+	return true;
+};
+const symmetricTypeCheck = (alg, key, usage) => {
+	if (key instanceof Uint8Array) return;
+	if (isJWK(key)) {
+		if (isSecretJWK(key) && jwkMatchesOp(alg, key, usage)) return;
+		throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+	}
+	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
+	if (key.type !== "secret") throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+};
+const asymmetricTypeCheck = (alg, key, usage) => {
+	if (isJWK(key)) switch (usage) {
+		case "decrypt":
+		case "sign":
+			if (isPrivateJWK(key) && jwkMatchesOp(alg, key, usage)) return;
+			throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
+		case "encrypt":
+		case "verify":
+			if (isPublicJWK(key) && jwkMatchesOp(alg, key, usage)) return;
+			throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
+	}
+	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+	if (key.type === "secret") throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+	if (key.type === "public") switch (usage) {
+		case "sign": throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
+		case "decrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
+	}
+	if (key.type === "private") switch (usage) {
+		case "verify": throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
+		case "encrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+	}
+};
+function checkKeyType(alg, key, usage) {
+	switch (alg.substring(0, 2)) {
+		case "A1":
+		case "A2":
+		case "di":
+		case "HS":
+		case "PB":
+			symmetricTypeCheck(alg, key, usage);
+			break;
+		default: asymmetricTypeCheck(alg, key, usage);
+	}
 }
-function normalizeOrganizationInvitations(value) {
-	exact$2(value, ["invitations", "nextCursor"]);
-	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
-	return {
-		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/jws/flattened/verify.js
+async function flattenedVerify(jws, key, options) {
+	if (!isObject$1(jws)) throw new JWSInvalid("Flattened JWS must be an object");
+	if (jws.protected === void 0 && jws.header === void 0) throw new JWSInvalid("Flattened JWS must have either of the \"protected\" or \"header\" members");
+	if (jws.protected !== void 0 && typeof jws.protected !== "string") throw new JWSInvalid("JWS Protected Header incorrect type");
+	if (jws.payload === void 0) throw new JWSInvalid("JWS Payload missing");
+	if (typeof jws.signature !== "string") throw new JWSInvalid("JWS Signature missing or incorrect type");
+	if (jws.header !== void 0 && !isObject$1(jws.header)) throw new JWSInvalid("JWS Unprotected Header incorrect type");
+	let parsedProt = {};
+	if (jws.protected) try {
+		const protectedHeader = decode(jws.protected);
+		parsedProt = JSON.parse(decoder.decode(protectedHeader));
+	} catch {
+		throw new JWSInvalid("JWS Protected Header is invalid");
+	}
+	if (!isDisjoint(parsedProt, jws.header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+	const joseHeader = {
+		...parsedProt,
+		...jws.header
 	};
-}
-function normalizeReceivedInvitation(value) {
-	exact$2(value, [
-		"expiresAt",
-		"id",
-		"inviterName",
-		"organization",
-		"role",
-		"teams"
-	]);
-	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
-	exact$2(value.organization, [
-		"id",
-		"logo",
-		"name",
-		"slug"
-	]);
-	if (!isId(value.organization.id) || !boundedString(value.organization.name, 255) || !boundedString(value.organization.slug, 255)) throw authorityUnavailable();
-	return {
-		id: value.id,
-		organization: {
-			id: value.organization.id,
-			name: value.organization.name,
-			slug: value.organization.slug,
-			logo: nullableHttpsUrl(value.organization.logo)
-		},
-		role: value.role,
-		teams: unique(value.teams.map((team) => {
-			exact$2(team, ["id", "name"]);
-			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
-			return {
-				id: team.id,
-				name: team.name
-			};
-		}), (item) => item.id),
-		inviterName: value.inviterName,
-		expiresAt: responseDate(value.expiresAt)
+	const extensions = validateCrit(JWSInvalid, new Map([["b64", true]]), options?.crit, parsedProt, joseHeader);
+	let b64 = true;
+	if (extensions.has("b64")) {
+		b64 = parsedProt.b64;
+		if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
+	}
+	const { alg } = joseHeader;
+	if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+	const algorithms = options && validateAlgorithms("algorithms", options.algorithms);
+	if (algorithms && !algorithms.has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
+	if (b64) {
+		if (typeof jws.payload !== "string") throw new JWSInvalid("JWS Payload must be a string");
+	} else if (typeof jws.payload !== "string" && !(jws.payload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+	let resolvedKey = false;
+	if (typeof key === "function") {
+		key = await key(parsedProt, jws);
+		resolvedKey = true;
+	}
+	checkKeyType(alg, key, "verify");
+	const data = concat(jws.protected !== void 0 ? encode$1(jws.protected) : new Uint8Array(), encode$1("."), typeof jws.payload === "string" ? b64 ? encode$1(jws.payload) : encoder$1.encode(jws.payload) : jws.payload);
+	const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
+	const k = await normalizeKey(key, alg);
+	if (!await verify(alg, k, signature, data)) throw new JWSSignatureVerificationFailed();
+	let payload;
+	if (b64) payload = decodeBase64url(jws.payload, "payload", JWSInvalid);
+	else if (typeof jws.payload === "string") payload = encoder$1.encode(jws.payload);
+	else payload = jws.payload;
+	const result = { payload };
+	if (jws.protected !== void 0) result.protectedHeader = parsedProt;
+	if (jws.header !== void 0) result.unprotectedHeader = jws.header;
+	if (resolvedKey) return {
+		...result,
+		key: k
 	};
+	return result;
 }
-function normalizeReceivedInvitations(value) {
-	exact$2(value, ["invitations", "nextCursor"]);
-	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
-	return {
-		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/jws/compact/verify.js
+async function compactVerify(jws, key, options) {
+	if (jws instanceof Uint8Array) jws = decoder.decode(jws);
+	if (typeof jws !== "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+	const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+	if (length !== 3) throw new JWSInvalid("Invalid Compact JWS");
+	const verified = await flattenedVerify({
+		payload,
+		protected: protectedHeader,
+		signature
+	}, key, options);
+	const result = {
+		payload: verified.payload,
+		protectedHeader: verified.protectedHeader
 	};
-}
-function normalizeInvitationInput(value) {
-	if (!isObject(value) || Object.keys(value).length !== 1 || !isId(value.invitationId)) throw new AuthError("invalid_invitation", 422);
-	return { invitationId: value.invitationId };
-}
-function normalizeInvitationAcceptance(value, invitationId) {
-	if (!isObject(value) || !isObject(value.invitation) || !isObject(value.member) || value.invitation.id !== invitationId || value.invitation.status !== "accepted" || !isId(value.invitation.organizationId) || value.member.organizationId !== value.invitation.organizationId) throw authorityUnavailable();
-	return { organizationId: value.invitation.organizationId };
-}
-function normalizeWorkspaceSelection(value) {
-	if (!isObject(value)) throw new AuthError("invalid_workspace_selection", 422);
-	const keys = Object.keys(value);
-	if (value.type === "personal" && keys.length === 1 && keys[0] === "type") return { type: "personal" };
-	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id.test(value.organizationId)) return {
-		type: "organization",
-		organizationId: value.organizationId
+	if (typeof key === "function") return {
+		...result,
+		key: verified.key
 	};
-	throw new AuthError("invalid_workspace_selection", 422);
+	return result;
 }
-function fromAuthorityError(value, fallbackStatus, retryAfter) {
-	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
-	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+const epoch = (date) => Math.floor(date.getTime() / 1e3);
+const minute = 60;
+const hour = minute * 60;
+const day = hour * 24;
+const week = day * 7;
+const year = day * 365.25;
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+function secs(str) {
+	const matched = REGEX.exec(str);
+	if (!matched || matched[4] && matched[1]) throw new TypeError("Invalid time period format");
+	const value = parseFloat(matched[2]);
+	const unit = matched[3].toLowerCase();
+	let numericDate;
+	switch (unit) {
+		case "sec":
+		case "secs":
+		case "second":
+		case "seconds":
+		case "s":
+			numericDate = Math.round(value);
+			break;
+		case "minute":
+		case "minutes":
+		case "min":
+		case "mins":
+		case "m":
+			numericDate = Math.round(value * minute);
+			break;
+		case "hour":
+		case "hours":
+		case "hr":
+		case "hrs":
+		case "h":
+			numericDate = Math.round(value * hour);
+			break;
+		case "day":
+		case "days":
+		case "d":
+			numericDate = Math.round(value * day);
+			break;
+		case "week":
+		case "weeks":
+		case "w":
+			numericDate = Math.round(value * week);
+			break;
+		default:
+			numericDate = Math.round(value * year);
+			break;
+	}
+	if (matched[1] === "-" || matched[4] === "ago") return -numericDate;
+	return numericDate;
 }
-function fromAccountAuthorityError(value, status, retryAfter) {
-	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
-	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
-	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
-	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
-	if (code === "INVALID_PASSWORD" || code === "INVALID_EMAIL_OR_PASSWORD") return new AuthError("invalid_credentials", 401);
-	if (code === "INVALID_EMAIL" || code === "PASSWORD_TOO_SHORT" || code === "PASSWORD_TOO_LONG" || code === "BODY_MUST_BE_AN_OBJECT" || code === "EMAIL_CAN_NOT_BE_UPDATED") return new AuthError("invalid_auth_input", 422);
-	if (status === 401) return new AuthError("authentication_required", 401);
-	if (status === 403) return new AuthError("access_denied", 403);
-	if (status === 409) return new AuthError("state_conflict", 409);
-	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
-	if (status === 400 || status === 422) return new AuthError("invalid_auth_input", 422);
-	return authorityUnavailable();
+const normalizeTyp = (value) => {
+	if (value.includes("/")) return value.toLowerCase();
+	return `application/${value.toLowerCase()}`;
+};
+const checkAudiencePresence = (audPayload, audOption) => {
+	if (typeof audPayload === "string") return audOption.includes(audPayload);
+	if (Array.isArray(audPayload)) return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
+	return false;
+};
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+	let payload;
+	try {
+		payload = JSON.parse(decoder.decode(encodedPayload));
+	} catch {}
+	if (!isObject$1(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+	const { typ } = options;
+	if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", "check_failed");
+	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+	const presenceCheck = [...requiredClaims];
+	if (maxTokenAge !== void 0) presenceCheck.push("iat");
+	if (audience !== void 0) presenceCheck.push("aud");
+	if (subject !== void 0) presenceCheck.push("sub");
+	if (issuer !== void 0) presenceCheck.push("iss");
+	for (const claim of new Set(presenceCheck.reverse())) if (!(claim in payload)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+	if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) throw new JWTClaimValidationFailed("unexpected \"iss\" claim value", payload, "iss", "check_failed");
+	if (subject && payload.sub !== subject) throw new JWTClaimValidationFailed("unexpected \"sub\" claim value", payload, "sub", "check_failed");
+	if (audience && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) throw new JWTClaimValidationFailed("unexpected \"aud\" claim value", payload, "aud", "check_failed");
+	let tolerance;
+	switch (typeof options.clockTolerance) {
+		case "string":
+			tolerance = secs(options.clockTolerance);
+			break;
+		case "number":
+			tolerance = options.clockTolerance;
+			break;
+		case "undefined":
+			tolerance = 0;
+			break;
+		default: throw new TypeError("Invalid clockTolerance option type");
+	}
+	const { currentDate } = options;
+	const now = epoch(currentDate || new Date());
+	if ((payload.iat !== void 0 || maxTokenAge) && typeof payload.iat !== "number") throw new JWTClaimValidationFailed("\"iat\" claim must be a number", payload, "iat", "invalid");
+	if (payload.nbf !== void 0) {
+		if (typeof payload.nbf !== "number") throw new JWTClaimValidationFailed("\"nbf\" claim must be a number", payload, "nbf", "invalid");
+		if (payload.nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", "check_failed");
+	}
+	if (payload.exp !== void 0) {
+		if (typeof payload.exp !== "number") throw new JWTClaimValidationFailed("\"exp\" claim must be a number", payload, "exp", "invalid");
+		if (payload.exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", "check_failed");
+	}
+	if (maxTokenAge) {
+		const age = now - payload.iat;
+		const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
+		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", "check_failed");
+		if (age < 0 - tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", "check_failed");
+	}
+	return payload;
 }
-function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
-	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
-	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
-	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
-	return fromAccountAuthorityError(value, status, retryAfter);
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/jwt/verify.js
+async function jwtVerify(jwt, key, options) {
+	const verified = await compactVerify(jwt, key, options);
+	if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+	const result = {
+		payload: validateClaimsSet(verified.protectedHeader, verified.payload, options),
+		protectedHeader: verified.protectedHeader
+	};
+	if (typeof key === "function") return {
+		...result,
+		key: verified.key
+	};
+	return result;
 }
-function authorityUnavailable() {
-	return new AuthError("identity_authority_unavailable", 503);
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/jwk/thumbprint.js
+const check = (value, description) => {
+	if (typeof value !== "string" || !value) throw new JWKInvalid(`${description} missing or invalid`);
+};
+async function calculateJwkThumbprint(key, digestAlgorithm) {
+	let jwk;
+	if (isJWK(key)) jwk = key;
+	else if (isKeyLike(key)) jwk = await exportJWK(key);
+	else throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+	digestAlgorithm ??= "sha256";
+	if (digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512") throw new TypeError("digestAlgorithm must one of \"sha256\", \"sha384\", or \"sha512\"");
+	let components;
+	switch (jwk.kty) {
+		case "AKP":
+			check(jwk.alg, "\"alg\" (Algorithm) Parameter");
+			check(jwk.pub, "\"pub\" (Public key) Parameter");
+			components = {
+				alg: jwk.alg,
+				kty: jwk.kty,
+				pub: jwk.pub
+			};
+			break;
+		case "EC":
+			check(jwk.crv, "\"crv\" (Curve) Parameter");
+			check(jwk.x, "\"x\" (X Coordinate) Parameter");
+			check(jwk.y, "\"y\" (Y Coordinate) Parameter");
+			components = {
+				crv: jwk.crv,
+				kty: jwk.kty,
+				x: jwk.x,
+				y: jwk.y
+			};
+			break;
+		case "OKP":
+			check(jwk.crv, "\"crv\" (Subtype of Key Pair) Parameter");
+			check(jwk.x, "\"x\" (Public Key) Parameter");
+			components = {
+				crv: jwk.crv,
+				kty: jwk.kty,
+				x: jwk.x
+			};
+			break;
+		case "RSA":
+			check(jwk.e, "\"e\" (Exponent) Parameter");
+			check(jwk.n, "\"n\" (Modulus) Parameter");
+			components = {
+				e: jwk.e,
+				kty: jwk.kty,
+				n: jwk.n
+			};
+			break;
+		case "oct":
+			check(jwk.k, "\"k\" (Key Value) Parameter");
+			components = {
+				k: jwk.k,
+				kty: jwk.kty
+			};
+			break;
+		default: throw new JOSENotSupported("\"kty\" (Key Type) Parameter missing or unsupported");
+	}
+	const data = encode$1(JSON.stringify(components));
+	return encode(await digest(digestAlgorithm, data));
 }
-function fromOrganizationListError(error) {
-	if (error instanceof AuthError && error.status === 401) return new AuthError("authentication_required", 401);
-	if (error instanceof AuthError) return error;
-	return authorityUnavailable();
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/decode_protected_header.js
+function decodeProtectedHeader(token) {
+	let protectedB64u;
+	if (typeof token === "string") {
+		const parts = token.split(".");
+		if (parts.length === 3 || parts.length === 5) [protectedB64u] = parts;
+	} else if (typeof token === "object" && token) if ("protected" in token) protectedB64u = token.protected;
+	else throw new TypeError("Token does not contain a Protected Header");
+	try {
+		if (typeof protectedB64u !== "string" || !protectedB64u) throw new Error();
+		const result = JSON.parse(decoder.decode(decode(protectedB64u)));
+		if (!isObject$1(result)) throw new Error();
+		return result;
+	} catch {
+		throw new TypeError("Invalid Token or Protected Header formatting");
+	}
 }
-function fromOrganizationReadAuthorityError(value, status) {
-	if (status === 400) return new AuthError("invalid_request", 400);
-	if (status === 401) return new AuthError("authentication_required", 401);
-	if (status === 403) return new AuthError("access_denied", 403);
-	return authorityUnavailable();
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/decode_jwt.js
+function decodeJwt(jwt) {
+	if (typeof jwt !== "string") throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
+	const { 1: payload, length } = jwt.split(".");
+	if (length === 5) throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
+	if (length !== 3) throw new JWTInvalid("Invalid JWT");
+	if (!payload) throw new JWTInvalid("JWTs must contain a payload");
+	let decoded;
+	try {
+		decoded = decode(payload);
+	} catch {
+		throw new JWTInvalid("Failed to base64url decode the payload");
+	}
+	let result;
+	try {
+		result = JSON.parse(decoder.decode(decoded));
+	} catch {
+		throw new JWTInvalid("Failed to parse the decoded payload as JSON");
+	}
+	if (!isObject$1(result)) throw new JWTInvalid("Invalid JWT Claims Set");
+	return result;
 }
-function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
-	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
-	if (status === 409) return new AuthError("state_conflict", 409);
-	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
-	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
-	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
-	return fromOrganizationReadAuthorityError(value, status);
+//#endregion
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
 }
-function fromOrganizationInvitationAdministrationError(value, status, retryAfter) {
-	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
-	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
 }
-function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact$2(value, [
-		"organizationId",
-		"actor",
-		"target"
-	]);
-	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
-	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
-	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
-	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
-	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
-	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
-	return {
-		organizationId: value.organizationId,
-		actor,
-		target
-	};
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
 }
-function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact$2(value, [
-		"memberId",
-		"manualRole",
-		"role",
-		"authorityRevision",
-		...includesStatus ? ["status"] : []
-	]);
-	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
-	return {
-		memberId: value.memberId,
-		manualRole: value.manualRole,
-		role: value.role,
-		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
-	};
+//#endregion
+//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
+var FetchError = class extends Error {
+	constructor(message, opts) {
+		super(message, opts);
+		this.name = "FetchError";
+		if (opts?.cause && !this.cause) this.cause = opts.cause;
+	}
+};
+function createFetchError(ctx) {
+	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
+	const method = ctx.request?.method || ctx.options?.method || "GET";
+	const url = ctx.request?.url || String(ctx.request) || "/";
+	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
+	for (const key of [
+		"request",
+		"options",
+		"response"
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx[key];
+	} });
+	for (const [key, refKey] of [
+		["data", "_data"],
+		["status", "status"],
+		["statusCode", "status"],
+		["statusText", "statusText"],
+		["statusMessage", "statusText"]
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx.response && ctx.response[refKey];
+	} });
+	return fetchError;
 }
-function normalizeAuthorityResultRevision(value) {
-	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
-	return value;
+const payloadMethods = new Set(Object.freeze([
+	"PATCH",
+	"POST",
+	"PUT",
+	"DELETE"
+]));
+function isPayloadMethod(method = "GET") {
+	return payloadMethods.has(method.toUpperCase());
 }
-function fromInvitationAuthorityError(value, status) {
-	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
-	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
-	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
-	if (status === 403 && code === "YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION") return new AuthError("invitation_recipient_mismatch", 403);
-	if (status === 403 && code === "EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION") return new AuthError("email_verification_required", 403);
-	if (status === 400 && (code === "INVITATION_NOT_FOUND" || code === "ORGANIZATION_NOT_FOUND" || code === "TEAM_NOT_FOUND")) return new AuthError("invitation_unavailable", 409);
-	return authorityUnavailable();
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	if (value instanceof FormData || value instanceof URLSearchParams) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
 }
-function fromInvitationError(error) {
-	return error instanceof AuthError ? error : authorityUnavailable();
+const textTypes = new Set([
+	"image/svg",
+	"application/xml",
+	"application/xhtml",
+	"application/html"
+]);
+const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(_contentType = "") {
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (contentType === "text/event-stream") return "stream";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
 }
-function mapError(code, status) {
-	if (code === "authentication_required") return {
-		code,
-		status: 401
-	};
-	if (code === "request_origin_denied") return {
-		code,
-		status: 403
-	};
-	if (code === "invalid_workspace_selection") return {
-		code,
-		status: 422
-	};
-	if (code === "organization_context_too_large") return {
-		code,
-		status: 422
-	};
-	if (code === "credential_rate_limited") return {
-		code,
-		status: 429
-	};
-	if (code === "identity_authority_unavailable") return {
-		code,
-		status: 503
-	};
-	if (status === 401 || status === 400) return {
-		code: "invalid_credentials",
-		status: 401
-	};
-	if (status === 403) return {
-		code: "access_denied",
-		status: 403
-	};
-	if (status === 409) return {
-		code: "state_conflict",
-		status: 409
-	};
-	if (status === 422) return {
-		code: "invalid_workspace_selection",
-		status: 422
-	};
-	if (status === 429) return {
-		code: "credential_rate_limited",
-		status: 429
+function resolveFetchOptions(request, input, defaults, Headers) {
+	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
+	let query;
+	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
+		...defaults?.params,
+		...defaults?.query,
+		...input?.params,
+		...input?.query
 	};
 	return {
-		code: "identity_authority_unavailable",
-		status: 503
+		...defaults,
+		...input,
+		query,
+		params: query,
+		headers
 	};
 }
-function parseRetryAfter(value) {
-	if (!value || !/^\d+$/.test(value)) return void 0;
-	const seconds = Number(value);
-	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
-}
-function toDate(value) {
-	const result = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
-	return result && Number.isFinite(result.getTime()) ? result : void 0;
-}
-function isId(value) {
-	return typeof value === "string" && id.test(value);
-}
-function exact$2(value, keys) {
-	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
-}
-function boundedString(value, maximum) {
-	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+function mergeHeaders(input, defaults, Headers) {
+	if (!defaults) return new Headers(input);
+	const headers = new Headers(defaults);
+	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
+	return headers;
 }
-function role(value) {
-	return value === "owner" || value === "admin" || value === "member";
+async function callHooks(context, hooks) {
+	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+	else await hooks(context);
 }
-function nullableHttpsUrl(value) {
-	if (value === null) return null;
-	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw authorityUnavailable();
+const retryStatusCodes = new Set([
+	408,
+	409,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const nullBodyResponses = new Set([
+	101,
+	204,
+	205,
+	304
+]);
+function createFetch(globalOptions = {}) {
+	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
+	async function onError(context) {
+		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
+		if (context.options.retry !== false && !isAbort) {
+			let retries;
+			if (typeof context.options.retry === "number") retries = context.options.retry;
+			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
+			const responseCode = context.response && context.response.status || 500;
+			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
+				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
+				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
+				return $fetchRaw(context.request, {
+					...context.options,
+					retry: retries - 1
+				});
+			}
+		}
+		const error = createFetchError(context);
+		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
+		throw error;
 	}
-	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
-	return value;
+	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
+		const context = {
+			request: _request,
+			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
+			response: void 0,
+			error: void 0
+		};
+		if (context.options.method) context.options.method = context.options.method.toUpperCase();
+		if (context.options.onRequest) {
+			await callHooks(context, context.options.onRequest);
+			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
+		}
+		if (typeof context.request === "string") {
+			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
+			if (context.options.query) {
+				context.request = withQuery(context.request, context.options.query);
+				delete context.options.query;
+			}
+			if ("query" in context.options) delete context.options.query;
+			if ("params" in context.options) delete context.options.params;
+		}
+		if (context.options.body && isPayloadMethod(context.options.method)) {
+			if (isJSONSerializable(context.options.body)) {
+				const contentType = context.options.headers.get("content-type");
+				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
+				if (!contentType) context.options.headers.set("content-type", "application/json");
+				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
+			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
+				if (!("duplex" in context.options)) context.options.duplex = "half";
+			}
+		}
+		let abortTimeout;
+		if (!context.options.signal && context.options.timeout) {
+			const controller = new AbortController();
+			abortTimeout = setTimeout(() => {
+				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
+				error.name = "TimeoutError";
+				error.code = 23;
+				controller.abort(error);
+			}, context.options.timeout);
+			context.options.signal = controller.signal;
+		}
+		try {
+			context.response = await fetch(context.request, context.options);
+		} catch (error) {
+			context.error = error;
+			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
+			return await onError(context);
+		} finally {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
+			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
+			switch (responseType) {
+				case "json": {
+					const data = await context.response.text();
+					const parseFunction = context.options.parseResponse || destr;
+					context.response._data = parseFunction(data);
+					break;
+				}
+				case "stream":
+					context.response._data = context.response.body || context.response._bodyInit;
+					break;
+				default: context.response._data = await context.response[responseType]();
+			}
+		}
+		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
+		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
+			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
+			return await onError(context);
+		}
+		return context.response;
+	};
+	const $fetch = async function $fetch2(request, options) {
+		return (await $fetchRaw(request, options))._data;
+	};
+	$fetch.raw = $fetchRaw;
+	$fetch.native = (...args) => fetch(...args);
+	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
+		...globalOptions,
+		...customGlobalOptions,
+		defaults: {
+			...globalOptions.defaults,
+			...customGlobalOptions.defaults,
+			...defaultOptions
+		}
+	});
+	return $fetch;
 }
-function responseDate(value) {
-	if (typeof value !== "string") throw authorityUnavailable();
-	const date = new Date(value);
-	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
-	return date;
+//#endregion
+//#region src/shared.ts
+const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
+const id = /^[A-Za-z0-9_-]{1,128}$/;
+const email = /^[^\s@]+@[^\s@]+$/;
+const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+function normalizeEmail(value) {
+	if (typeof value !== "string") throw new TypeError("email is invalid");
+	const normalized = value.trim().toLowerCase();
+	if (normalized.length === 0 || normalized.length > 320 || !email.test(normalized)) throw new TypeError("email is invalid");
+	return normalized;
 }
-function nullableCursor(value) {
+function normalizeSocialIdTokenInput(value) {
+	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
+	const keys = Object.keys(value);
+	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
+	return {
+		provider: value.provider,
+		idToken: value.idToken,
+		...value.nonce === void 0 ? {} : { nonce: value.nonce },
+		signUp: value.signUp
+	};
+}
+function socialIdTokenRequest(value) {
+	return {
+		provider: value.provider,
+		idToken: {
+			token: value.idToken,
+			...value.nonce === void 0 ? {} : { nonce: value.nonce }
+		},
+		requestSignUp: value.signUp
+	};
+}
+function normalizeOrigin(value, name) {
+	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	return url.origin;
+}
+function normalizeTimeout(value) {
+	const timeout = value ?? 1e4;
+	if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 6e4) throw new TypeError("timeoutMs must be an integer from 1 to 60000");
+	return timeout;
+}
+function normalizeSession(value) {
 	if (value === null) return null;
-	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
-	return value;
+	if (!isObject(value) || !isObject(value.session) || !isObject(value.user)) throw authorityUnavailable();
+	const expiresAt = toDate(value.session.expiresAt);
+	const image = value.user.image;
+	if (!isId(value.session.id) || !expiresAt || !isId(value.user.id) || typeof value.user.name !== "string" || value.user.name.length > 256 || typeof value.user.email !== "string" || value.user.email.length > 320 || !email.test(value.user.email) || typeof value.user.emailVerified !== "boolean" || image !== null && image !== void 0 && (typeof image !== "string" || image.length > 2048)) throw authorityUnavailable();
+	return {
+		id: value.session.id,
+		expiresAt,
+		user: {
+			id: value.user.id,
+			name: value.user.name,
+			email: value.user.email,
+			emailVerified: value.user.emailVerified,
+			image: image ?? null
+		}
+	};
 }
-function normalizeResponseId(value) {
-	if (!isId(value)) throw authorityUnavailable();
+function normalizeDriveCredential(value, now) {
+	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(now + value.expiresIn * 1e3)
+	};
+}
+function normalizeOrganizationPageInput(value) {
+	if (value === void 0) return new URLSearchParams();
+	if (!isObject(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
+	const input = value;
+	const query = new URLSearchParams();
+	if (input.limit !== void 0) {
+		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100) throw new AuthError("invalid_request", 400);
+		query.set("limit", String(input.limit));
+	}
+	if (input.cursor !== void 0) {
+		if (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.cursor)) throw new AuthError("invalid_request", 400);
+		query.set("cursor", input.cursor);
+	}
+	return query;
+}
+function normalizeIdInput(value) {
+	if (!isId(value)) throw new AuthError("invalid_request", 400);
 	return value;
 }
-function unique(items, key) {
-	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
-	return items;
+function normalizeOrganization(value) {
+	exact$3(value, [
+		"capabilities",
+		"id",
+		"lifecycle",
+		"logo",
+		"name",
+		"role",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
+	exact$3(value.capabilities, [
+		"readInvitations",
+		"readMembers",
+		"readTeams"
+	]);
+	if (value.capabilities.readMembers !== true || value.capabilities.readTeams !== true || typeof value.capabilities.readInvitations !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug,
+		logo: nullableHttpsUrl(value.logo),
+		lifecycle: value.lifecycle,
+		role: value.role,
+		capabilities: {
+			readMembers: true,
+			readTeams: true,
+			readInvitations: value.capabilities.readInvitations
+		}
+	};
 }
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function normalizeOrganizationDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "logo,name,slug") throw new AuthError("invalid_request", 400);
+	if (!boundedString(value.name, 255) || !boundedString(value.slug, 255)) throw new AuthError("invalid_request", 400);
+	let logo;
+	try {
+		logo = nullableHttpsUrl(value.logo);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	return {
+		name: value.name,
+		slug: value.slug,
+		logo
+	};
 }
-//#endregion
-//#region src/identity-resolution.ts
-const emailPattern$1 = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$(?![\s\S])/;
-function exact$1(value, keys) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+function normalizeOrganizationDisplay(value) {
+	try {
+		return normalizeOrganizationDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
 }
-function createIdentityResolverAuth(options) {
-	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/identities/resolve");
-	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
-	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
-	const timeoutMs = normalizeTimeout(options.timeoutMs);
-	let inFlight = false;
-	return { async resolveIdentity(input, clientAssertion) {
-		if (!exact$1(input, ["identifier"]) || typeof input.identifier !== "string" || input.identifier.length > 324) throw new AuthError("invalid_request", 400);
-		const identifier = input.identifier.trim().toLowerCase();
-		if (!(identifier.length <= 320 && emailPattern$1.test(identifier)) && !/^[a-z0-9_.]{3,30}$(?![\s\S])/.test(identifier)) throw new AuthError("invalid_request", 400);
-		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
-		if (inFlight) throw new AuthError("state_conflict", 409);
-		inFlight = true;
-		const controller = new AbortController();
-		let reader;
-		let timer;
-		let mappedError;
-		try {
-			const deadline = new Promise((_, reject) => {
-				timer = setTimeout(() => {
-					reject(authorityUnavailable());
-					controller.abort();
-					reader?.cancel().catch(() => {});
-				}, timeoutMs);
-			});
-			const exchange = async () => {
-				const response = await fetchImpl(url, {
-					method: "POST",
-					headers: {
-						authorization: `Bearer ${clientAssertion}`,
-						accept: "application/json",
-						"content-type": "application/json"
-					},
-					body: JSON.stringify({ identifier }),
-					credentials: "omit",
-					cache: "no-store",
-					redirect: "manual",
-					signal: controller.signal
-				});
-				if (controller.signal.aborted) {
-					response.body?.cancel().catch(() => {});
-					throw authorityUnavailable();
-				}
-				if (!response.body) throw authorityUnavailable();
-				reader = response.body.getReader();
-				const length = response.headers.get("content-length");
-				if (response.redirected || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 1024)) throw authorityUnavailable();
-				const bytes = new Uint8Array(1024);
-				let size = 0;
-				while (true) {
-					const chunk = await reader.read();
-					if (controller.signal.aborted) throw authorityUnavailable();
-					if (chunk.done) break;
-					if (size + chunk.value.byteLength > bytes.length) throw authorityUnavailable();
-					bytes.set(chunk.value, size);
-					size += chunk.value.byteLength;
-				}
-				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
-				if (response.status !== 200) {
-					if (!exact$1(value, ["code", "message"])) throw authorityUnavailable();
-					if (response.status === 401 && value.code === "UNAUTHORIZED" && value.message === "The identity resolution assertion is invalid.") mappedError = new AuthError("authentication_required", 401);
-					if (response.status === 429 && value.code === "TOO_MANY_REQUESTS" && value.message === "Identity resolution requests are temporarily limited.") {
-						const retryAfter = response.headers.get("retry-after");
-						if (retryAfter === null || !/^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) throw authorityUnavailable();
-						mappedError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
-					}
-					throw mappedError ?? authorityUnavailable();
-				}
-				if (!exact$1(value, ["identity"])) throw authorityUnavailable();
-				if (value.identity === null) return null;
-				if (!exact$1(value.identity, ["userId"]) || typeof value.identity.userId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(value.identity.userId)) throw authorityUnavailable();
-				return { userId: value.identity.userId };
+function normalizeOrganizationTeamDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).join(",") !== "name" || !boundedString(value.name, 255)) throw new AuthError("invalid_request", 400);
+	return { name: value.name };
+}
+function normalizeOrganizationTeamDisplay(value) {
+	try {
+		return normalizeOrganizationTeamDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255) || typeof slug !== "string" || !/^[a-z0-9-]{1,128}$/.test(slug)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		slug,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganization(value) {
+	exact$3(value, [
+		"id",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 128)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
+function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationTeam(value) {
+	exact$3(value, ["id", "name"]);
+	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name
+	};
+}
+function normalizeOrganizationMemberInvitationCreationInput(value) {
+	if (!isObject(value)) throw new AuthError("invalid_request", 400);
+	const keys = Object.keys(value).sort().join(",");
+	if (keys !== "email,idempotencyKey" && keys !== "email,idempotencyKey,teamIds") throw new AuthError("invalid_request", 400);
+	let normalizedEmail;
+	try {
+		normalizedEmail = normalizeEmail(value.email);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
+	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
+	return {
+		email: normalizedEmail,
+		...teamIds === void 0 ? {} : { teamIds },
+		idempotencyKey: value.idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationMemberInvitation(value) {
+	exact$3(value, ["expiresAt", "id"]);
+	if (!isId(value.id)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
+function normalizeResentOrganizationInvitation(value, invitationId) {
+	const invitation = normalizeCreatedOrganizationMemberInvitation(value);
+	if (invitation.id !== invitationId) throw authorityUnavailable();
+	return invitation;
+}
+function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeCanceledOrganizationInvitation(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "canceled") throw authorityUnavailable();
+	return { status: "canceled" };
+}
+function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeRemovedOrganizationMember(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "removed") throw authorityUnavailable();
+	return { status: "removed" };
+}
+function normalizeOrganizationDeparture(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "left") throw authorityUnavailable();
+	return { status: "left" };
+}
+function normalizeOrganizations(value) {
+	exact$3(value, ["nextCursor", "organizations"]);
+	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
+	return {
+		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationMembers(value) {
+	exact$3(value, ["members", "nextCursor"]);
+	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
+	return {
+		members: unique(value.members.map((member) => {
+			exact$3(member, [
+				"email",
+				"id",
+				"image",
+				"joinedAt",
+				"name",
+				"owner",
+				"role",
+				"teamIds",
+				"userId"
+			]);
+			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
+			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
+			return {
+				id: member.id,
+				userId: member.userId,
+				name: member.name,
+				email: member.email,
+				image: nullableHttpsUrl(member.image),
+				role: member.role,
+				owner: member.owner,
+				joinedAt: responseDate(member.joinedAt),
+				teamIds
 			};
-			return await Promise.race([exchange().finally(() => {
-				inFlight = false;
-			}), deadline]);
-		} catch (error) {
-			if (mappedError && mappedError === error) throw mappedError;
-			throw authorityUnavailable();
-		} finally {
-			clearTimeout(timer);
-			controller.abort();
-			reader?.cancel().catch(() => {});
-		}
-	} };
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
 }
-//#endregion
-//#region src/drive-recipients.ts
-const encoder = new TextEncoder();
-const emailPattern = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$/;
-function validEmail(value) {
-	return typeof value === "string" && encoder.encode(value).byteLength <= 320 && emailPattern.test(value);
+function normalizeOrganizationTeams(value) {
+	exact$3(value, ["nextCursor", "teams"]);
+	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
+	return {
+		teams: unique(value.teams.map((team) => {
+			exact$3(team, [
+				"category",
+				"createdAt",
+				"id",
+				"name"
+			]);
+			if (!isId(team.id) || !boundedString(team.name, 255) || team.category !== "manual" && team.category !== "managed") throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name,
+				category: team.category,
+				createdAt: responseDate(team.createdAt)
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
 }
-function exact(value, keys) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+function normalizeOrganizationTeamMembers(value) {
+	exact$3(value, ["memberIds", "nextCursor"]);
+	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
+	return {
+		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
 }
-const failures = {
-	400: [
-		"BAD_REQUEST",
-		"The recipient request is invalid.",
-		"invalid_request"
-	],
-	401: [
-		"UNAUTHORIZED",
-		"The recipient service assertion is invalid.",
-		"authentication_required"
-	],
-	404: [
-		"NOT_FOUND",
-		"The recipient is unavailable.",
-		"recipient_unavailable"
-	],
-	405: [
-		"METHOD_NOT_ALLOWED",
-		"METHOD_NOT_ALLOWED",
-		"invalid_request"
-	],
-	413: [
-		"REQUEST_TOO_LONG",
-		"The recipient request is too large.",
-		"invalid_request"
-	],
-	429: [
-		"TOO_MANY_REQUESTS",
-		"Recipient requests are temporarily limited.",
-		"auth_request_rate_limited"
-	],
-	503: [
-		"SERVICE_UNAVAILABLE",
-		"Recipient resolution is temporarily unavailable.",
-		"identity_authority_unavailable"
-	]
-};
-function createDriveRecipientAuth(options) {
-	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/drive-share-recipients/resolve");
-	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
-	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
-	const timeoutMs = normalizeTimeout(options.timeoutMs);
-	let inFlight = false;
-	return { async resolveRecipient(input, clientAssertion) {
-		let body;
-		let email;
-		try {
-			if (!exact(input, ["email"]) || typeof input.email !== "string") throw new Error();
-			email = input.email.trim().toLowerCase();
-			if (!validEmail(email)) throw new Error();
-			body = JSON.stringify({ email });
-		} catch {
-			throw new AuthError("invalid_request", 400);
-		}
-		if (encoder.encode(body).byteLength > 1024) throw new AuthError("invalid_request", 413);
-		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
-		if (inFlight) throw new AuthError("state_conflict", 409);
-		inFlight = true;
-		const controller = new AbortController();
-		let reader;
-		let timer;
-		let authorityError;
-		try {
-			const deadline = new Promise((_, reject) => {
-				timer = setTimeout(() => {
-					reject(authorityUnavailable());
-					controller.abort();
-					reader?.cancel().catch(() => {});
-				}, timeoutMs);
-			});
-			const exchange = async () => {
-				const response = await fetchImpl(url, {
-					method: "POST",
-					headers: {
-						authorization: `Bearer ${clientAssertion}`,
-						accept: "application/json",
-						"content-type": "application/json"
-					},
-					body,
-					credentials: "omit",
-					cache: "no-store",
-					redirect: "manual",
-					signal: controller.signal
-				});
-				if (controller.signal.aborted) {
-					response.body?.cancel().catch(() => {});
-					throw authorityUnavailable();
-				}
-				if (!response.body) throw authorityUnavailable();
-				reader = response.body.getReader();
-				const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-				const length = response.headers.get("content-length");
-				if (response.redirected || contentType !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 4096)) throw authorityUnavailable();
-				const bytes = new Uint8Array(4096);
-				let size = 0;
-				while (true) {
-					const chunk = await reader.read();
-					if (controller.signal.aborted) throw authorityUnavailable();
-					if (chunk.done) break;
-					if (size + chunk.value.byteLength > bytes.byteLength) throw authorityUnavailable();
-					bytes.set(chunk.value, size);
-					size += chunk.value.byteLength;
-				}
-				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
-				if (response.status !== 200) {
-					const status = response.status;
-					const failure = failures[status];
-					if (!failure || !exact(value, ["code", "message"]) || value.code !== failure[0] || value.message !== failure[1]) throw authorityUnavailable();
-					let retryAfterSeconds;
-					if (status === 429) {
-						const retryAfter = response.headers.get("retry-after");
-						if (retryAfter === null || !/^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) throw authorityUnavailable();
-						retryAfterSeconds = Number(retryAfter);
-					}
-					authorityError = new AuthError(failure[2], status, retryAfterSeconds);
-					throw authorityError;
-				}
-				if (!exact(value, ["recipient"]) || !exact(value.recipient, [
-					"userId",
-					"name",
-					"email"
-				])) throw authorityUnavailable();
-				const recipient = value.recipient;
-				if (typeof recipient.userId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(recipient.userId) || typeof recipient.name !== "string" || recipient.name.length === 0 || encoder.encode(recipient.name).byteLength > 1024 || !validEmail(recipient.email) || recipient.email !== recipient.email.trim().toLowerCase() || recipient.email !== email) throw authorityUnavailable();
-				return {
-					userId: recipient.userId,
-					name: recipient.name,
-					email: recipient.email
-				};
+function normalizeOrganizationInvitation(value) {
+	exact$3(value, [
+		"createdAt",
+		"email",
+		"expiresAt",
+		"id",
+		"inviter",
+		"role",
+		"status",
+		"teamIds"
+	]);
+	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
+	exact$3(value.inviter, ["membershipId", "name"]);
+	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		email: value.email,
+		role: value.role,
+		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
+		inviter: {
+			membershipId: value.inviter.membershipId,
+			name: value.inviter.name
+		},
+		createdAt: responseDate(value.createdAt),
+		expiresAt: responseDate(value.expiresAt),
+		status: "pending"
+	};
+}
+function normalizeOrganizationInvitations(value) {
+	exact$3(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeReceivedInvitation(value) {
+	exact$3(value, [
+		"expiresAt",
+		"id",
+		"inviterName",
+		"organization",
+		"role",
+		"teams"
+	]);
+	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
+	exact$3(value.organization, [
+		"id",
+		"logo",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.organization.id) || !boundedString(value.organization.name, 255) || !boundedString(value.organization.slug, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		organization: {
+			id: value.organization.id,
+			name: value.organization.name,
+			slug: value.organization.slug,
+			logo: nullableHttpsUrl(value.organization.logo)
+		},
+		role: value.role,
+		teams: unique(value.teams.map((team) => {
+			exact$3(team, ["id", "name"]);
+			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name
 			};
-			return await Promise.race([exchange().finally(() => {
-				inFlight = false;
-			}), deadline]);
-		} catch (error) {
-			if (authorityError && error === authorityError) throw authorityError;
-			throw authorityUnavailable();
-		} finally {
-			clearTimeout(timer);
-			controller.abort();
-			reader?.cancel().catch(() => {});
-		}
-	} };
+		}), (item) => item.id),
+		inviterName: value.inviterName,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
+function normalizeReceivedInvitations(value) {
+	exact$3(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeInvitationInput(value) {
+	if (!isObject(value) || Object.keys(value).length !== 1 || !isId(value.invitationId)) throw new AuthError("invalid_invitation", 422);
+	return { invitationId: value.invitationId };
+}
+function normalizeInvitationAcceptance(value, invitationId) {
+	if (!isObject(value) || !isObject(value.invitation) || !isObject(value.member) || value.invitation.id !== invitationId || value.invitation.status !== "accepted" || !isId(value.invitation.organizationId) || value.member.organizationId !== value.invitation.organizationId) throw authorityUnavailable();
+	return { organizationId: value.invitation.organizationId };
+}
+function normalizeWorkspaceSelection(value) {
+	if (!isObject(value)) throw new AuthError("invalid_workspace_selection", 422);
+	const keys = Object.keys(value);
+	if (value.type === "personal" && keys.length === 1 && keys[0] === "type") return { type: "personal" };
+	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id.test(value.organizationId)) return {
+		type: "organization",
+		organizationId: value.organizationId
+	};
+	throw new AuthError("invalid_workspace_selection", 422);
+}
+function fromAuthorityError(value, fallbackStatus, retryAfter) {
+	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
+	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
+}
+function fromAccountAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
+	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
+	if (code === "INVALID_PASSWORD" || code === "INVALID_EMAIL_OR_PASSWORD") return new AuthError("invalid_credentials", 401);
+	if (code === "INVALID_EMAIL" || code === "PASSWORD_TOO_SHORT" || code === "PASSWORD_TOO_LONG" || code === "BODY_MUST_BE_AN_OBJECT" || code === "EMAIL_CAN_NOT_BE_UPDATED") return new AuthError("invalid_auth_input", 422);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	if (status === 400 || status === 422) return new AuthError("invalid_auth_input", 422);
+	return authorityUnavailable();
+}
+function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
+	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
+function authorityUnavailable() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+function fromOrganizationListError(error) {
+	if (error instanceof AuthError && error.status === 401) return new AuthError("authentication_required", 401);
+	if (error instanceof AuthError) return error;
+	return authorityUnavailable();
+}
+function fromOrganizationReadAuthorityError(value, status) {
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	return authorityUnavailable();
+}
+function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
+	return fromOrganizationReadAuthorityError(value, status);
+}
+function fromOrganizationInvitationAdministrationError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
+function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("membership_removal_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
+function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
+	exact$3(value, [
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
+	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
+	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
+	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
+	return {
+		organizationId: value.organizationId,
+		actor,
+		target
+	};
+}
+function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
+	exact$3(value, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision",
+		...includesStatus ? ["status"] : []
+	]);
+	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
+	return {
+		memberId: value.memberId,
+		manualRole: value.manualRole,
+		role: value.role,
+		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
+	};
+}
+function normalizeAuthorityResultRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	return value;
+}
+function fromInvitationAuthorityError(value, status) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (status === 403 && code === "YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION") return new AuthError("invitation_recipient_mismatch", 403);
+	if (status === 403 && code === "EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION") return new AuthError("email_verification_required", 403);
+	if (status === 400 && (code === "INVITATION_NOT_FOUND" || code === "ORGANIZATION_NOT_FOUND" || code === "TEAM_NOT_FOUND")) return new AuthError("invitation_unavailable", 409);
+	return authorityUnavailable();
+}
+function fromInvitationError(error) {
+	return error instanceof AuthError ? error : authorityUnavailable();
+}
+function mapError(code, status) {
+	if (code === "authentication_required") return {
+		code,
+		status: 401
+	};
+	if (code === "request_origin_denied") return {
+		code,
+		status: 403
+	};
+	if (code === "invalid_workspace_selection") return {
+		code,
+		status: 422
+	};
+	if (code === "organization_context_too_large") return {
+		code,
+		status: 422
+	};
+	if (code === "credential_rate_limited") return {
+		code,
+		status: 429
+	};
+	if (code === "identity_authority_unavailable") return {
+		code,
+		status: 503
+	};
+	if (status === 401 || status === 400) return {
+		code: "invalid_credentials",
+		status: 401
+	};
+	if (status === 403) return {
+		code: "access_denied",
+		status: 403
+	};
+	if (status === 409) return {
+		code: "state_conflict",
+		status: 409
+	};
+	if (status === 422) return {
+		code: "invalid_workspace_selection",
+		status: 422
+	};
+	if (status === 429) return {
+		code: "credential_rate_limited",
+		status: 429
+	};
+	return {
+		code: "identity_authority_unavailable",
+		status: 503
+	};
 }
-//#endregion
-//#region src/provisioning.ts
-const MAX_BYTES = 16 * 1024;
-const compactJwt = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
-function isCompactCredential(value) {
-	return typeof value === "string" && value.length + 7 <= MAX_BYTES && compactJwt.test(value);
+function parseRetryAfter(value) {
+	if (!value || !/^\d+$/.test(value)) return void 0;
+	const seconds = Number(value);
+	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
 }
-function createDriveProvisioningAuth(options) {
-	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/drive-provisioning-credential");
-	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
-	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
-	const timeoutMs = normalizeTimeout(options.timeoutMs);
-	const now = options.now ?? Date.now;
-	let inFlight = false;
-	return { async getDriveProvisioningCredential(clientAssertion) {
-		if (!isCompactCredential(clientAssertion)) throw new AuthError("invalid_request", 400);
-		if (inFlight) throw new AuthError("state_conflict", 409);
-		inFlight = true;
-		const controller = new AbortController();
-		let reader;
-		let timer;
-		let exchangeStarted = false;
-		let authorityError;
-		try {
-			const startedAt = now();
-			if (!Number.isSafeInteger(startedAt) || startedAt < 0 || startedAt > 86399999997e5) throw authorityUnavailable();
-			const deadline = new Promise((_, reject) => {
-				timer = setTimeout(() => {
-					reject(authorityUnavailable());
-					controller.abort();
-					reader?.cancel().catch(() => {});
-				}, timeoutMs);
-			});
-			const exchange = async () => {
-				const response = await fetchImpl(url, {
-					method: "POST",
-					headers: {
-						authorization: `Bearer ${clientAssertion}`,
-						accept: "application/json"
-					},
-					credentials: "omit",
-					cache: "no-store",
-					redirect: "manual",
-					signal: controller.signal
-				});
-				if (controller.signal.aborted) {
-					response.body?.cancel().catch(() => {});
-					throw authorityUnavailable();
-				}
-				if (!response.body) throw authorityUnavailable();
-				reader = response.body.getReader();
-				const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-				const length = response.headers.get("content-length");
-				if (contentType !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > MAX_BYTES)) throw authorityUnavailable();
-				const bytes = new Uint8Array(MAX_BYTES);
-				let size = 0;
-				while (true) {
-					const chunk = await reader.read();
-					if (chunk.done) break;
-					if (controller.signal.aborted || size + chunk.value.byteLength > MAX_BYTES) throw authorityUnavailable();
-					bytes.set(chunk.value, size);
-					size += chunk.value.byteLength;
-				}
-				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
-				if (!value || typeof value !== "object" || Array.isArray(value)) throw authorityUnavailable();
-				const record = value;
-				if (response.status !== 200) {
-					if (Object.keys(record).length !== 2 || !("code" in record) || !("message" in record)) throw authorityUnavailable();
-					if (response.status === 401 && record.code === "UNAUTHORIZED" && record.message === "The ecosystem client assertion is invalid.") {
-						authorityError = new AuthError("authentication_required", 401);
-						throw authorityError;
-					}
-					const retryAfter = response.headers.get("retry-after");
-					if (response.status === 429 && record.code === "TOO_MANY_REQUESTS" && record.message === "Ecosystem credential exchanges are temporarily limited." && retryAfter !== null && /^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) {
-						authorityError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
-						throw authorityError;
-					}
-					throw authorityUnavailable();
-				}
-				if (Object.keys(record).length !== 3 || record.tokenType !== "Bearer" || record.expiresIn !== 300 || !isCompactCredential(record.token)) throw authorityUnavailable();
-				const expiresAt = new Date(Math.floor(startedAt / 1e3) * 1e3 + 3e5);
-				const completedAt = now();
-				if (!Number.isSafeInteger(completedAt) || completedAt < 0 || completedAt >= expiresAt.getTime()) throw authorityUnavailable();
-				return {
-					tokenType: "Bearer",
-					token: record.token,
-					expiresAt
-				};
-			};
-			exchangeStarted = true;
-			return await Promise.race([exchange().finally(() => {
-				inFlight = false;
-			}), deadline]);
-		} catch (error) {
-			if (authorityError && error === authorityError) throw authorityError;
-			throw authorityUnavailable();
-		} finally {
-			clearTimeout(timer);
-			controller.abort();
-			reader?.cancel().catch(() => {});
-			if (!exchangeStarted) inFlight = false;
-		}
-	} };
+function toDate(value) {
+	const result = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
+	return result && Number.isFinite(result.getTime()) ? result : void 0;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
-const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
-const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
-const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
-function jsonParseTransform(key, value) {
-	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
-		warnKeyDropped(key);
-		return;
-	}
-	return value;
+function isId(value) {
+	return typeof value === "string" && id.test(value);
 }
-function warnKeyDropped(key) {
-	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
+function exact$3(value, keys) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
-function destr(value, options = {}) {
-	if (typeof value !== "string") return value;
-	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
-	const _value = value.trim();
-	if (_value.length <= 9) switch (_value.toLowerCase()) {
-		case "true": return true;
-		case "false": return false;
-		case "undefined": return;
-		case "null": return null;
-		case "nan": return NaN;
-		case "infinity": return Number.POSITIVE_INFINITY;
-		case "-infinity": return Number.NEGATIVE_INFINITY;
-	}
-	if (!JsonSigRx.test(value)) {
-		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
-		return value;
-	}
-	try {
-		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
-			if (options.strict) throw new Error("[destr] Possible prototype pollution");
-			return JSON.parse(value, jsonParseTransform);
-		}
-		return JSON.parse(value);
-	} catch (error) {
-		if (options.strict) throw error;
-		return value;
-	}
+function boundedString(value, maximum) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
-var FetchError = class extends Error {
-	constructor(message, opts) {
-		super(message, opts);
-		this.name = "FetchError";
-		if (opts?.cause && !this.cause) this.cause = opts.cause;
+function role(value) {
+	return value === "owner" || value === "admin" || value === "member";
+}
+function nullableHttpsUrl(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw authorityUnavailable();
 	}
-};
-function createFetchError(ctx) {
-	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
-	const method = ctx.request?.method || ctx.options?.method || "GET";
-	const url = ctx.request?.url || String(ctx.request) || "/";
-	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
-	for (const key of [
-		"request",
-		"options",
-		"response"
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx[key];
-	} });
-	for (const [key, refKey] of [
-		["data", "_data"],
-		["status", "status"],
-		["statusCode", "status"],
-		["statusText", "statusText"],
-		["statusMessage", "statusText"]
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx.response && ctx.response[refKey];
-	} });
-	return fetchError;
+	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
+	return value;
 }
-const payloadMethods = new Set(Object.freeze([
-	"PATCH",
-	"POST",
-	"PUT",
-	"DELETE"
-]));
-function isPayloadMethod(method = "GET") {
-	return payloadMethods.has(method.toUpperCase());
+function responseDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const date = new Date(value);
+	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
+	return date;
 }
-function isJSONSerializable(value) {
-	if (value === void 0) return false;
-	const t = typeof value;
-	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
-	if (t !== "object") return false;
-	if (Array.isArray(value)) return true;
-	if (value.buffer) return false;
-	if (value instanceof FormData || value instanceof URLSearchParams) return false;
-	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
+function nullableCursor(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
+	return value;
 }
-const textTypes = new Set([
-	"image/svg",
-	"application/xml",
-	"application/xhtml",
-	"application/html"
-]);
-const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
-function detectResponseType(_contentType = "") {
-	if (!_contentType) return "json";
-	const contentType = _contentType.split(";").shift() || "";
-	if (JSON_RE.test(contentType)) return "json";
-	if (contentType === "text/event-stream") return "stream";
-	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
-	return "blob";
+function normalizeResponseId(value) {
+	if (!isId(value)) throw authorityUnavailable();
+	return value;
 }
-function resolveFetchOptions(request, input, defaults, Headers) {
-	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
-	let query;
-	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
-		...defaults?.params,
-		...defaults?.query,
-		...input?.params,
-		...input?.query
-	};
+function unique(items, key) {
+	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
+	return items;
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/http.ts
+const MAX_RESPONSE_BYTES = 64 * 1024;
+async function requestJson(url, options) {
+	return (await requestJsonResponse(url, options)).value;
+}
+async function requestJsonResponse(url, options) {
+	let response;
+	try {
+		response = await createFetch({ fetch: options.fetch }).raw(url, {
+			method: options.method,
+			headers: options.headers,
+			body: options.body,
+			credentials: options.credentials ?? "include",
+			retry: 0,
+			timeout: options.timeoutMs,
+			redirect: "manual",
+			signal: options.signal,
+			responseType: "stream",
+			ignoreResponseError: true
+		});
+	} catch {
+		throw authorityUnavailable();
+	}
+	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
+		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes) : void 0;
+		await response.body?.cancel();
+		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
+	}
 	return {
-		...defaults,
-		...input,
-		query,
-		params: query,
-		headers
+		value: await readJson(response, options.maxResponseBytes),
+		headers: response.headers
 	};
 }
-function mergeHeaders(input, defaults, Headers) {
-	if (!defaults) return new Headers(input);
-	const headers = new Headers(defaults);
-	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
-	return headers;
-}
-async function callHooks(context, hooks) {
-	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
-	else await hooks(context);
+async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
+	const length = response.headers.get("content-length");
+	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
+		await response.body?.cancel();
+		throw authorityUnavailable();
+	}
+	if (!response.body) throw authorityUnavailable();
+	const reader = response.body.getReader();
+	const chunks = [];
+	let size = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > maximum) throw authorityUnavailable();
+			chunks.push(value);
+		}
+	} catch (error) {
+		await reader.cancel();
+		throw error;
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		throw authorityUnavailable();
+	}
 }
-const retryStatusCodes = new Set([
-	408,
-	409,
-	425,
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-const nullBodyResponses = new Set([
-	101,
-	204,
-	205,
-	304
-]);
-function createFetch(globalOptions = {}) {
-	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
-	async function onError(context) {
-		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
-		if (context.options.retry !== false && !isAbort) {
-			let retries;
-			if (typeof context.options.retry === "number") retries = context.options.retry;
-			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
-			const responseCode = context.response && context.response.status || 500;
-			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
-				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
-				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
-				return $fetchRaw(context.request, {
-					...context.options,
-					retry: retries - 1
-				});
+//#endregion
+//#region src/user-api/verifier.ts
+const ID = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const KID = /^[A-Za-z0-9_-]{43}$(?![\s\S])/;
+const PROFILE = "finueva-user-api+jwt";
+const CACHE_MS = 3e5;
+const REFRESH_COOLDOWN_MS = 3e4;
+const TIMEOUT_MS = 2e3;
+const invalid = () => new AuthError("authentication_required", 401);
+const unavailable = () => new AuthError("identity_authority_unavailable", 503);
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+	return Object.keys(value).sort().join(",") === keys.sort().join(",");
+}
+function createUserApiVerifier(options) {
+	const { issuer, audience, applicationId, environment } = options;
+	if (!issuer || !audience || issuer.length > 2048 || audience.length > 2048 || !ID.test(applicationId) || ![
+		"local",
+		"development",
+		"staging",
+		"production"
+	].includes(environment)) throw new TypeError("User API verifier configuration is invalid");
+	const url = new URL(options.jwksUrl);
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost");
+	if (url.protocol !== "https:" && !(environment === "local" && local && url.protocol === "http:") || url.username || url.password || url.search || url.hash) throw new TypeError("User API JWKS URL is invalid");
+	const jwksUrl = url.href;
+	const fetchImpl = options.fetch ?? globalThis.fetch;
+	const now = options.now ?? Date.now;
+	let cached;
+	let pending;
+	let nextRefreshAt = -Infinity;
+	async function loadKeys() {
+		const controller = new AbortController();
+		let timer;
+		const deadline = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				controller.abort();
+				reject(unavailable());
+			}, TIMEOUT_MS);
+		});
+		const started = now();
+		try {
+			const value = await Promise.race([requestJson(jwksUrl, {
+				fetch: fetchImpl,
+				timeoutMs: TIMEOUT_MS,
+				method: "GET",
+				credentials: "omit",
+				signal: controller.signal,
+				maxResponseBytes: 64 * 1024
+			}), deadline]);
+			if (!record(value) || !exactKeys(value, ["keys"]) || !Array.isArray(value.keys) || value.keys.length < 1 || value.keys.length > 20) throw unavailable();
+			const keys = new Map();
+			for (const entry of value.keys) {
+				if (!record(entry) || !exactKeys(entry, [
+					"kty",
+					"crv",
+					"x",
+					"kid",
+					"alg",
+					"use"
+				]) || entry.kty !== "OKP" || entry.crv !== "Ed25519" || entry.alg !== "EdDSA" || entry.use !== "sig" || typeof entry.x !== "string" || !KID.test(entry.x) || typeof entry.kid !== "string" || !KID.test(entry.kid) || keys.has(entry.kid)) throw unavailable();
+				const jwk = {
+					kty: "OKP",
+					crv: "Ed25519",
+					x: entry.x
+				};
+				if (await calculateJwkThumbprint(jwk) !== entry.kid) throw unavailable();
+				keys.set(entry.kid, await importJWK(jwk, "EdDSA"));
 			}
+			if (controller.signal.aborted || now() < started || now() >= started + CACHE_MS) throw unavailable();
+			cached = {
+				keys,
+				loadedAt: started,
+				expiresAt: started + CACHE_MS
+			};
+		} catch {
+			throw unavailable();
+		} finally {
+			clearTimeout(timer);
 		}
-		const error = createFetchError(context);
-		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
-		throw error;
 	}
-	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
-		const context = {
-			request: _request,
-			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
-			response: void 0,
-			error: void 0
-		};
-		if (context.options.method) context.options.method = context.options.method.toUpperCase();
-		if (context.options.onRequest) {
-			await callHooks(context, context.options.onRequest);
-			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
+	async function keyFor(kid) {
+		const time = now();
+		const known = cached && time >= cached.loadedAt && time < cached.expiresAt ? cached?.keys.get(kid) : void 0;
+		if (known) return known;
+		if (pending) await pending;
+		else if (time >= nextRefreshAt) {
+			nextRefreshAt = time + REFRESH_COOLDOWN_MS;
+			const request = loadKeys().finally(() => {
+				if (pending === request) pending = void 0;
+			});
+			pending = request;
+			await request;
 		}
-		if (typeof context.request === "string") {
-			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
-			if (context.options.query) {
-				context.request = withQuery(context.request, context.options.query);
-				delete context.options.query;
-			}
-			if ("query" in context.options) delete context.options.query;
-			if ("params" in context.options) delete context.options.params;
+		const current = now();
+		if (!cached || current < cached.loadedAt || current >= cached.expiresAt) throw unavailable();
+		const key = cached.keys.get(kid);
+		if (!key) throw invalid();
+		return key;
+	}
+	return { async verify(token) {
+		if (typeof token !== "string" || token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token)) throw invalid();
+		let kid;
+		try {
+			const header = decodeProtectedHeader(token);
+			if (!exactKeys(header, [
+				"alg",
+				"typ",
+				"kid"
+			]) || header.alg !== "EdDSA" || header.typ !== PROFILE || typeof header.kid !== "string" || !KID.test(header.kid)) throw invalid();
+			kid = header.kid;
+		} catch {
+			throw invalid();
 		}
-		if (context.options.body && isPayloadMethod(context.options.method)) {
-			if (isJSONSerializable(context.options.body)) {
-				const contentType = context.options.headers.get("content-type");
-				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
-				if (!contentType) context.options.headers.set("content-type", "application/json");
-				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
-			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
-				if (!("duplex" in context.options)) context.options.duplex = "half";
-			}
+		let identity;
+		try {
+			const payload = decodeJwt(token);
+			const time = Math.floor(now() / 1e3);
+			if (!exactKeys(payload, [
+				"iss",
+				"aud",
+				"sub",
+				"sid",
+				"iat",
+				"exp",
+				"ver",
+				"principal_type",
+				"scope",
+				"app",
+				"environment",
+				"user"
+			]) || payload.iss !== issuer || payload.aud !== audience || payload.app !== applicationId || payload.environment !== environment || payload.ver !== 1 || payload.principal_type !== "user" || payload.scope !== "user:api" || typeof payload.sub !== "string" || !ID.test(payload.sub) || typeof payload.sid !== "string" || !ID.test(payload.sid) || !Number.isSafeInteger(payload.iat) || !Number.isSafeInteger(payload.exp) || payload.iat < 0 || payload.iat > time || payload.exp <= time || payload.exp <= payload.iat || payload.exp - payload.iat > 840) throw invalid();
+			const user = payload.user;
+			if (!record(user) || !exactKeys(user, [
+				"name",
+				"email",
+				"emailVerified",
+				"image"
+			]) || typeof user.name !== "string" || user.name.length > 200 || typeof user.email !== "string" || user.email.length < 1 || user.email.length > 320 || typeof user.emailVerified !== "boolean" || !(user.image === null || typeof user.image === "string" && user.image.length <= 2048)) throw invalid();
+			identity = {
+				userId: payload.sub,
+				sessionId: payload.sid,
+				applicationId,
+				issuedAt: new Date(payload.iat * 1e3),
+				expiresAt: new Date(payload.exp * 1e3),
+				user: {
+					id: payload.sub,
+					name: user.name,
+					email: user.email,
+					emailVerified: user.emailVerified,
+					image: user.image
+				}
+			};
+		} catch {
+			throw invalid();
 		}
-		let abortTimeout;
-		if (!context.options.signal && context.options.timeout) {
-			const controller = new AbortController();
-			abortTimeout = setTimeout(() => {
-				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
-				error.name = "TimeoutError";
-				error.code = 23;
-				controller.abort(error);
-			}, context.options.timeout);
-			context.options.signal = controller.signal;
+		const key = await keyFor(kid);
+		try {
+			await jwtVerify(token, key, {
+				algorithms: ["EdDSA"],
+				issuer,
+				audience,
+				typ: PROFILE,
+				currentDate: new Date(now()),
+				clockTolerance: 0,
+				requiredClaims: [
+					"iss",
+					"aud",
+					"sub",
+					"sid",
+					"iat",
+					"exp"
+				]
+			});
+		} catch {
+			throw invalid();
 		}
+		return identity;
+	} };
+}
+//#endregion
+//#region src/identity-resolution.ts
+const emailPattern$1 = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$(?![\s\S])/;
+function exact$2(value, keys) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function createIdentityResolverAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/identities/resolve");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = false;
+	return { async resolveIdentity(input, clientAssertion) {
+		if (!exact$2(input, ["identifier"]) || typeof input.identifier !== "string" || input.identifier.length > 324) throw new AuthError("invalid_request", 400);
+		const identifier = input.identifier.trim().toLowerCase();
+		if (!(identifier.length <= 320 && emailPattern$1.test(identifier)) && !/^[a-z0-9_.]{3,30}$(?![\s\S])/.test(identifier)) throw new AuthError("invalid_request", 400);
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let mappedError;
 		try {
-			context.response = await fetch(context.request, context.options);
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json",
+						"content-type": "application/json"
+					},
+					body: JSON.stringify({ identifier }),
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
+				}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const length = response.headers.get("content-length");
+				if (response.redirected || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 1024)) throw authorityUnavailable();
+				const bytes = new Uint8Array(1024);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (controller.signal.aborted) throw authorityUnavailable();
+					if (chunk.done) break;
+					if (size + chunk.value.byteLength > bytes.length) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (response.status !== 200) {
+					if (!exact$2(value, ["code", "message"])) throw authorityUnavailable();
+					if (response.status === 401 && value.code === "UNAUTHORIZED" && value.message === "The identity resolution assertion is invalid.") mappedError = new AuthError("authentication_required", 401);
+					if (response.status === 429 && value.code === "TOO_MANY_REQUESTS" && value.message === "Identity resolution requests are temporarily limited.") {
+						const retryAfter = response.headers.get("retry-after");
+						if (retryAfter === null || !/^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) throw authorityUnavailable();
+						mappedError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
+					}
+					throw mappedError ?? authorityUnavailable();
+				}
+				if (!exact$2(value, ["identity"])) throw authorityUnavailable();
+				if (value.identity === null) return null;
+				if (!exact$2(value.identity, ["userId"]) || typeof value.identity.userId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(value.identity.userId)) throw authorityUnavailable();
+				return { userId: value.identity.userId };
+			};
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
 		} catch (error) {
-			context.error = error;
-			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
-			return await onError(context);
+			if (mappedError && mappedError === error) throw mappedError;
+			throw authorityUnavailable();
 		} finally {
-			if (abortTimeout) clearTimeout(abortTimeout);
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
 		}
-		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
-			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
-			switch (responseType) {
-				case "json": {
-					const data = await context.response.text();
-					const parseFunction = context.options.parseResponse || destr;
-					context.response._data = parseFunction(data);
-					break;
+	} };
+}
+//#endregion
+//#region src/membership-resolution.ts
+const idPattern = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const isoPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$(?![\s\S])/;
+const roles = [
+	"admin",
+	"member",
+	"owner"
+];
+const membershipKeys = [
+	"checkedAt",
+	"manualRole",
+	"memberCount",
+	"memberId",
+	"organizationId",
+	"owner",
+	"role",
+	"userId"
+];
+function exact$1(value, keys) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function createMembershipResolverAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/memberships/resolve");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = false;
+	return { async resolveMembership(input, clientAssertion) {
+		if (!exact$1(input, ["organizationId", "userId"]) || typeof input.organizationId !== "string" || typeof input.userId !== "string" || !idPattern.test(input.organizationId) || !idPattern.test(input.userId)) throw new AuthError("invalid_request", 400);
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const organizationId = input.organizationId;
+		const userId = input.userId;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let mappedError;
+		try {
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json",
+						"content-type": "application/json"
+					},
+					body: JSON.stringify({
+						organizationId,
+						userId
+					}),
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
 				}
-				case "stream":
-					context.response._data = context.response.body || context.response._bodyInit;
-					break;
-				default: context.response._data = await context.response[responseType]();
-			}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const length = response.headers.get("content-length");
+				if (response.redirected || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 1024)) throw authorityUnavailable();
+				const bytes = new Uint8Array(1024);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (controller.signal.aborted) throw authorityUnavailable();
+					if (chunk.done) break;
+					if (size + chunk.value.byteLength > bytes.length) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (response.status !== 200) {
+					if (!exact$1(value, ["code", "message"])) throw authorityUnavailable();
+					if (response.status === 401 && value.code === "UNAUTHORIZED" && value.message === "The membership resolution assertion is invalid.") mappedError = new AuthError("authentication_required", 401);
+					if (response.status === 429 && value.code === "TOO_MANY_REQUESTS" && value.message === "Membership resolution requests are temporarily limited.") {
+						const retryAfter = response.headers.get("retry-after");
+						if (retryAfter === null || !/^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) throw authorityUnavailable();
+						mappedError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
+					}
+					throw mappedError ?? authorityUnavailable();
+				}
+				if (!exact$1(value, ["membership"])) throw authorityUnavailable();
+				if (value.membership === null) return null;
+				const membership = value.membership;
+				if (!exact$1(membership, membershipKeys) || typeof membership.checkedAt !== "string" || !isoPattern.test(membership.checkedAt) || Number.isNaN(Date.parse(membership.checkedAt)) || typeof membership.manualRole !== "string" || !roles.includes(membership.manualRole) || typeof membership.role !== "string" || !roles.includes(membership.role) || typeof membership.memberCount !== "number" || !Number.isSafeInteger(membership.memberCount) || membership.memberCount < 0 || typeof membership.memberId !== "string" || !idPattern.test(membership.memberId) || typeof membership.owner !== "boolean" || membership.organizationId !== organizationId || membership.userId !== userId) throw authorityUnavailable();
+				return {
+					checkedAt: membership.checkedAt,
+					manualRole: membership.manualRole,
+					memberCount: membership.memberCount,
+					memberId: membership.memberId,
+					organizationId,
+					owner: membership.owner,
+					role: membership.role,
+					userId
+				};
+			};
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
+		} catch (error) {
+			if (mappedError && mappedError === error) throw mappedError;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
 		}
-		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
-		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
-			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
-			return await onError(context);
+	} };
+}
+//#endregion
+//#region src/drive-recipients.ts
+const encoder = new TextEncoder();
+const emailPattern = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$/;
+function validEmail(value) {
+	return typeof value === "string" && encoder.encode(value).byteLength <= 320 && emailPattern.test(value);
+}
+function exact(value, keys) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+const failures = {
+	400: [
+		"BAD_REQUEST",
+		"The recipient request is invalid.",
+		"invalid_request"
+	],
+	401: [
+		"UNAUTHORIZED",
+		"The recipient service assertion is invalid.",
+		"authentication_required"
+	],
+	404: [
+		"NOT_FOUND",
+		"The recipient is unavailable.",
+		"recipient_unavailable"
+	],
+	405: [
+		"METHOD_NOT_ALLOWED",
+		"METHOD_NOT_ALLOWED",
+		"invalid_request"
+	],
+	413: [
+		"REQUEST_TOO_LONG",
+		"The recipient request is too large.",
+		"invalid_request"
+	],
+	429: [
+		"TOO_MANY_REQUESTS",
+		"Recipient requests are temporarily limited.",
+		"auth_request_rate_limited"
+	],
+	503: [
+		"SERVICE_UNAVAILABLE",
+		"Recipient resolution is temporarily unavailable.",
+		"identity_authority_unavailable"
+	]
+};
+function createDriveRecipientAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/drive-share-recipients/resolve");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = false;
+	return { async resolveRecipient(input, clientAssertion) {
+		let body;
+		let email;
+		try {
+			if (!exact(input, ["email"]) || typeof input.email !== "string") throw new Error();
+			email = input.email.trim().toLowerCase();
+			if (!validEmail(email)) throw new Error();
+			body = JSON.stringify({ email });
+		} catch {
+			throw new AuthError("invalid_request", 400);
 		}
-		return context.response;
-	};
-	const $fetch = async function $fetch2(request, options) {
-		return (await $fetchRaw(request, options))._data;
-	};
-	$fetch.raw = $fetchRaw;
-	$fetch.native = (...args) => fetch(...args);
-	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
-		...globalOptions,
-		...customGlobalOptions,
-		defaults: {
-			...globalOptions.defaults,
-			...customGlobalOptions.defaults,
-			...defaultOptions
+		if (encoder.encode(body).byteLength > 1024) throw new AuthError("invalid_request", 413);
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let authorityError;
+		try {
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json",
+						"content-type": "application/json"
+					},
+					body,
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
+				}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+				const length = response.headers.get("content-length");
+				if (response.redirected || contentType !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 4096)) throw authorityUnavailable();
+				const bytes = new Uint8Array(4096);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (controller.signal.aborted) throw authorityUnavailable();
+					if (chunk.done) break;
+					if (size + chunk.value.byteLength > bytes.byteLength) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (response.status !== 200) {
+					const status = response.status;
+					const failure = failures[status];
+					if (!failure || !exact(value, ["code", "message"]) || value.code !== failure[0] || value.message !== failure[1]) throw authorityUnavailable();
+					let retryAfterSeconds;
+					if (status === 429) {
+						const retryAfter = response.headers.get("retry-after");
+						if (retryAfter === null || !/^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) throw authorityUnavailable();
+						retryAfterSeconds = Number(retryAfter);
+					}
+					authorityError = new AuthError(failure[2], status, retryAfterSeconds);
+					throw authorityError;
+				}
+				if (!exact(value, ["recipient"]) || !exact(value.recipient, [
+					"userId",
+					"name",
+					"email"
+				])) throw authorityUnavailable();
+				const recipient = value.recipient;
+				if (typeof recipient.userId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(recipient.userId) || typeof recipient.name !== "string" || recipient.name.length === 0 || encoder.encode(recipient.name).byteLength > 1024 || !validEmail(recipient.email) || recipient.email !== recipient.email.trim().toLowerCase() || recipient.email !== email) throw authorityUnavailable();
+				return {
+					userId: recipient.userId,
+					name: recipient.name,
+					email: recipient.email
+				};
+			};
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
+		} catch (error) {
+			if (authorityError && error === authorityError) throw authorityError;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
 		}
-	});
-	return $fetch;
+	} };
 }
 //#endregion
-//#region src/http.ts
-const MAX_RESPONSE_BYTES = 64 * 1024;
-async function requestJson(url, options) {
-	return (await requestJsonResponse(url, options)).value;
-}
-async function requestJsonResponse(url, options) {
-	let response;
-	try {
-		response = await createFetch({ fetch: options.fetch }).raw(url, {
-			method: options.method,
-			headers: options.headers,
-			body: options.body,
-			credentials: options.credentials ?? "include",
-			retry: 0,
-			timeout: options.timeoutMs,
-			redirect: "manual",
-			signal: options.signal,
-			responseType: "stream",
-			ignoreResponseError: true
-		});
-	} catch {
-		throw authorityUnavailable();
-	}
-	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
-		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes) : void 0;
-		await response.body?.cancel();
-		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
-	}
-	return {
-		value: await readJson(response, options.maxResponseBytes),
-		headers: response.headers
-	};
+//#region src/provisioning.ts
+const MAX_BYTES = 16 * 1024;
+const compactJwt = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function isCompactCredential(value) {
+	return typeof value === "string" && value.length + 7 <= MAX_BYTES && compactJwt.test(value);
 }
-async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
-	const length = response.headers.get("content-length");
-	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
-		await response.body?.cancel();
-		throw authorityUnavailable();
-	}
-	if (!response.body) throw authorityUnavailable();
-	const reader = response.body.getReader();
-	const chunks = [];
-	let size = 0;
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			size += value.byteLength;
-			if (size > maximum) throw authorityUnavailable();
-			chunks.push(value);
+function createDriveProvisioningAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/drive-provisioning-credential");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	const now = options.now ?? Date.now;
+	let inFlight = false;
+	return { async getDriveProvisioningCredential(clientAssertion) {
+		if (!isCompactCredential(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let exchangeStarted = false;
+		let authorityError;
+		try {
+			const startedAt = now();
+			if (!Number.isSafeInteger(startedAt) || startedAt < 0 || startedAt > 86399999997e5) throw authorityUnavailable();
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json"
+					},
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
+				}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+				const length = response.headers.get("content-length");
+				if (contentType !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > MAX_BYTES)) throw authorityUnavailable();
+				const bytes = new Uint8Array(MAX_BYTES);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (chunk.done) break;
+					if (controller.signal.aborted || size + chunk.value.byteLength > MAX_BYTES) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (!value || typeof value !== "object" || Array.isArray(value)) throw authorityUnavailable();
+				const record = value;
+				if (response.status !== 200) {
+					if (Object.keys(record).length !== 2 || !("code" in record) || !("message" in record)) throw authorityUnavailable();
+					if (response.status === 401 && record.code === "UNAUTHORIZED" && record.message === "The ecosystem client assertion is invalid.") {
+						authorityError = new AuthError("authentication_required", 401);
+						throw authorityError;
+					}
+					const retryAfter = response.headers.get("retry-after");
+					if (response.status === 429 && record.code === "TOO_MANY_REQUESTS" && record.message === "Ecosystem credential exchanges are temporarily limited." && retryAfter !== null && /^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) {
+						authorityError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
+						throw authorityError;
+					}
+					throw authorityUnavailable();
+				}
+				if (Object.keys(record).length !== 3 || record.tokenType !== "Bearer" || record.expiresIn !== 300 || !isCompactCredential(record.token)) throw authorityUnavailable();
+				const expiresAt = new Date(Math.floor(startedAt / 1e3) * 1e3 + 3e5);
+				const completedAt = now();
+				if (!Number.isSafeInteger(completedAt) || completedAt < 0 || completedAt >= expiresAt.getTime()) throw authorityUnavailable();
+				return {
+					tokenType: "Bearer",
+					token: record.token,
+					expiresAt
+				};
+			};
+			exchangeStarted = true;
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
+		} catch (error) {
+			if (authorityError && error === authorityError) throw authorityError;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
+			if (!exchangeStarted) inFlight = false;
 		}
-	} catch (error) {
-		await reader.cancel();
-		throw error;
-	} finally {
-		reader.releaseLock();
-	}
-	const bytes = new Uint8Array(size);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	try {
-		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-	} catch {
-		throw authorityUnavailable();
-	}
+	} };
 }
 //#endregion
 //#region src/server.ts
@@ -1566,6 +2971,21 @@ function createServerAuth(options) {
 			const member = normalizeIdInput(memberId);
 			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
 		},
+		async createOrganization(name, slug, idempotencyKey) {
+			const body = normalizeOrganizationCreationInput(name, slug, idempotencyKey);
+			return normalizeCreatedOrganization(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
 		async createOrganizationTeam(organizationId, name, idempotencyKey) {
 			const id = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
@@ -1634,6 +3054,41 @@ function createServerAuth(options) {
 				mapError: fromOrganizationInvitationAdministrationError
 			}));
 		},
+		async removeOrganizationMember(organizationId, memberId, idempotencyKey) {
+			if (authorization) throw new AuthError("authentication_required", 401);
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			return normalizeRemovedOrganizationMember(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "members", member, "remove"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			}));
+		},
+		async leaveOrganization(organizationId, idempotencyKey) {
+			if (authorization) throw new AuthError("authentication_required", 401);
+			const organization = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			return normalizeOrganizationDeparture(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "leave"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			}));
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);
@@ -1734,6 +3189,21 @@ function createServerAuth(options) {
 				body: { workspace }
 			}), now());
 		},
+		async getUserApiCredential(input) {
+			const applicationId = userApiApplication(input);
+			const startedAt = now();
+			return normalizeUserApiCredential(await requestJson(joinURL(authOrigin, "api/v1/auth/user-api-credential"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json; charset=utf-8"
+				},
+				body: { applicationId }
+			}), startedAt);
+		},
 		async signOut() {
 			let response;
 			try {
@@ -1785,4 +3255,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createServerAuth };
+export { AuthError, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };