@finueva/auth 0.23.0 → 0.26.0

package/dist/server.js

@@ -1,992 +1,1486 @@
-//#region src/errors.ts
-const messages = {
-	invalid_credentials: "The credentials are invalid.",
-	invalid_auth_input: "The authentication input is invalid.",
-	account_conflict: "The account is not available.",
-	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
-	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
-	google_recovery_not_required: "Google account recovery is not required.",
-	google_recovery_invalid: "The Google account recovery request is invalid.",
-	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
-	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
-	password_reset_invalid: "The password reset request is invalid.",
-	authentication_required: "Authentication is required.",
-	request_origin_denied: "The request origin is not allowed.",
-	invalid_request: "The request is invalid.",
-	invalid_invitation: "The invitation is invalid.",
-	invitation_unavailable: "The invitation is not available.",
-	recipient_unavailable: "The recipient is unavailable.",
-	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
-	invitation_recovery_required: "Invitation administration requires separate recovery.",
-	membership_removal_recovery_required: "Membership removal requires separate recovery.",
-	email_verification_required: "Email verification is required.",
-	invalid_workspace_selection: "The workspace selection is invalid.",
-	organization_context_too_large: "The organization context is too large.",
-	credential_rate_limited: "Credential requests are temporarily limited.",
-	auth_request_rate_limited: "Authentication requests are temporarily limited.",
-	organization_slug_unavailable: "The organization address is unavailable.",
-	state_conflict: "The authentication state conflicts with the request.",
-	access_denied: "Access is denied.",
-	platform_target_unavailable: "The platform administration target is unavailable.",
-	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
-	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable.",
-	two_factor_required: "A second authentication factor is required.",
-	two_factor_code_invalid: "The verification code is invalid.",
-	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
-	two_factor_locked: "Second-factor verification is temporarily locked.",
-	recent_sign_in_required: "A recent sign-in is required.",
-	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
-	recent_authentication_required: "A ready recent-authentication action is required.",
-	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
-	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
-	ceremony_return_refused: "The return address is not registered for this application.",
-	password_sign_in_required: "A password sign-in method is required for this passkey change."
-};
-var AuthError = class extends Error {
-	code;
-	status;
-	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
-		super(messages[code]);
-		this.name = "AuthError";
-		this.code = code;
-		this.status = status;
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-};
-//#endregion
-//#region src/shared.ts
-const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
-const id = /^[A-Za-z0-9_-]{1,128}$/;
-const email = /^[^\s@]+@[^\s@]+$/;
-const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
-function normalizeEmail(value) {
-	if (typeof value !== "string") throw new TypeError("email is invalid");
-	const normalized = value.trim().toLowerCase();
-	if (normalized.length === 0 || normalized.length > 320 || !email.test(normalized)) throw new TypeError("email is invalid");
-	return normalized;
+String.fromCharCode;
+const HASH_RE = /#/g;
+const AMPERSAND_RE = /&/g;
+const SLASH_RE = /\//g;
+const EQUAL_RE = /=/g;
+const PLUS_RE = /\+/g;
+const ENC_CARET_RE = /%5e/gi;
+const ENC_BACKTICK_RE = /%60/gi;
+const ENC_PIPE_RE = /%7c/gi;
+const ENC_SPACE_RE = /%20/gi;
+function encode$2(text) {
+	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
 }
-function normalizeSocialIdTokenInput(value) {
-	if (!isObject$1(value)) throw new TypeError("social ID token input is invalid");
-	const keys = Object.keys(value);
-	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
-	return {
-		provider: value.provider,
-		idToken: value.idToken,
-		...value.nonce === void 0 ? {} : { nonce: value.nonce },
-		signUp: value.signUp
-	};
+function encodeQueryValue(input) {
+	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
 }
-function socialIdTokenRequest(value) {
-	return {
-		provider: value.provider,
-		idToken: {
-			token: value.idToken,
-			...value.nonce === void 0 ? {} : { nonce: value.nonce }
-		},
-		requestSignUp: value.signUp
-	};
+function encodeQueryKey(text) {
+	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
 }
-function normalizeOrigin(value, name) {
-	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
-	let url;
+function decode$1(text = "") {
 	try {
-		url = new URL(value);
+		return decodeURIComponent("" + text);
 	} catch {
-		throw new TypeError(`${name} must be an ASCII HTTP origin`);
+		return "" + text;
 	}
-	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
-	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
-	return url.origin;
-}
-function normalizeTimeout(value) {
-	const timeout = value ?? 1e4;
-	if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 6e4) throw new TypeError("timeoutMs must be an integer from 1 to 60000");
-	return timeout;
 }
-function normalizeSession(value) {
-	if (value === null) return null;
-	if (!isObject$1(value) || !isObject$1(value.session) || !isObject$1(value.user)) throw authorityUnavailable();
-	const expiresAt = toDate(value.session.expiresAt);
-	const image = value.user.image;
-	if (!isId(value.session.id) || !expiresAt || !isId(value.user.id) || typeof value.user.name !== "string" || value.user.name.length > 256 || typeof value.user.email !== "string" || value.user.email.length > 320 || !email.test(value.user.email) || typeof value.user.emailVerified !== "boolean" || image !== null && image !== void 0 && (typeof image !== "string" || image.length > 2048)) throw authorityUnavailable();
-	return {
-		id: value.session.id,
-		expiresAt,
-		user: {
-			id: value.user.id,
-			name: value.user.name,
-			email: value.user.email,
-			emailVerified: value.user.emailVerified,
-			image: image ?? null
-		}
-	};
+function decodeQueryKey(text) {
+	return decode$1(text.replace(PLUS_RE, " "));
 }
-function normalizeDriveCredential(value, now) {
-	if (!isObject$1(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
-	return {
-		tokenType: "Bearer",
-		token: value.token,
-		expiresAt: new Date(now + value.expiresIn * 1e3)
-	};
+function decodeQueryValue(text) {
+	return decode$1(text.replace(PLUS_RE, " "));
 }
-function normalizeOrganizationPageInput(value) {
-	if (value === void 0) return new URLSearchParams();
-	if (!isObject$1(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
-	const input = value;
-	const query = new URLSearchParams();
-	if (input.limit !== void 0) {
-		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100) throw new AuthError("invalid_request", 400);
-		query.set("limit", String(input.limit));
-	}
-	if (input.cursor !== void 0) {
-		if (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.cursor)) throw new AuthError("invalid_request", 400);
-		query.set("cursor", input.cursor);
+function parseQuery(parametersString = "") {
+	const object = Object.create(null);
+	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
+	for (const parameter of parametersString.split("&")) {
+		const s = parameter.match(/([^=]+)=?(.*)/) || [];
+		if (s.length < 2) continue;
+		const key = decodeQueryKey(s[1]);
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = decodeQueryValue(s[2] || "");
+		if (object[key] === void 0) object[key] = value;
+		else if (Array.isArray(object[key])) object[key].push(value);
+		else object[key] = [object[key], value];
 	}
-	return query;
+	return object;
 }
-function normalizeIdInput(value) {
-	if (!isId(value)) throw new AuthError("invalid_request", 400);
-	return value;
+function encodeQueryItem(key, value) {
+	if (typeof value === "number" || typeof value === "boolean") value = String(value);
+	if (!value) return encodeQueryKey(key);
+	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
+	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
 }
-function normalizeOrganization(value) {
-	exact$3(value, [
-		"capabilities",
-		"id",
-		"lifecycle",
-		"logo",
-		"name",
-		"role",
-		"slug"
-	]);
-	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject$1(value.capabilities)) throw authorityUnavailable();
-	exact$3(value.capabilities, [
-		"readInvitations",
-		"readMembers",
-		"readTeams"
-	]);
-	if (value.capabilities.readMembers !== true || value.capabilities.readTeams !== true || typeof value.capabilities.readInvitations !== "boolean") throw authorityUnavailable();
-	return {
-		id: value.id,
-		name: value.name,
-		slug: value.slug,
-		logo: nullableHttpsUrl(value.logo),
-		lifecycle: value.lifecycle,
-		role: value.role,
-		capabilities: {
-			readMembers: true,
-			readTeams: true,
-			readInvitations: value.capabilities.readInvitations
-		}
-	};
+function stringifyQuery(query) {
+	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
 }
-function normalizeOrganizationDisplayInput(value) {
-	if (!isObject$1(value) || Object.keys(value).sort().join(",") !== "logo,name,slug") throw new AuthError("invalid_request", 400);
-	if (!boundedString(value.name, 255) || !boundedString(value.slug, 255)) throw new AuthError("invalid_request", 400);
-	let logo;
-	try {
-		logo = nullableHttpsUrl(value.logo);
-	} catch {
-		throw new AuthError("invalid_request", 400);
-	}
-	return {
-		name: value.name,
-		slug: value.slug,
-		logo
-	};
+const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
+const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
+const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
+const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
+const JOIN_LEADING_SLASH_RE = /^\.?\//;
+function hasProtocol(inputString, opts = {}) {
+	if (typeof opts === "boolean") opts = { acceptRelative: opts };
+	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
+	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
 }
-function normalizeOrganizationDisplay(value) {
-	try {
-		return normalizeOrganizationDisplayInput(value);
-	} catch {
-		throw authorityUnavailable();
+function hasTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/");
+	return TRAILING_SLASH_RE.test(input);
+}
+function withoutTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
+	if (!hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
 	}
+	const [s0, ...s] = path.split("?");
+	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
 }
-function normalizeOrganizationTeamDisplayInput(value) {
-	if (!isObject$1(value) || Object.keys(value).join(",") !== "name" || !boundedString(value.name, 255)) throw new AuthError("invalid_request", 400);
-	return { name: value.name };
+function withTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
+	if (hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+		if (!path) return fragment;
+	}
+	const [s0, ...s] = path.split("?");
+	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
 }
-function normalizeOrganizationTeamDisplay(value) {
-	try {
-		return normalizeOrganizationTeamDisplayInput(value);
-	} catch {
-		throw authorityUnavailable();
+function withBase(input, base) {
+	if (isEmptyURL(base) || hasProtocol(input)) return input;
+	const _base = withoutTrailingSlash(base);
+	if (input.startsWith(_base)) {
+		const nextChar = input[_base.length];
+		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
 	}
+	return joinURL(_base, input);
 }
-function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
-	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255) || typeof slug !== "string" || !/^[a-z0-9-]{1,128}$/.test(slug)) throw new AuthError("invalid_request", 400);
-	return {
-		name,
-		slug,
-		idempotencyKey
-	};
+function withQuery(input, query) {
+	const parsed = parseURL(input);
+	parsed.search = stringifyQuery({
+		...parseQuery(parsed.search),
+		...query
+	});
+	return stringifyParsedURL(parsed);
 }
-function normalizeCreatedOrganization(value) {
-	exact$3(value, [
-		"id",
-		"name",
-		"slug"
-	]);
-	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 128)) throw authorityUnavailable();
-	return {
-		id: value.id,
-		name: value.name,
-		slug: value.slug
-	};
+function isEmptyURL(url) {
+	return !url || url === "/";
 }
-function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
-	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
-	return {
-		name,
-		idempotencyKey
-	};
+function isNonEmptyURL(url) {
+	return url && url !== "/";
 }
-function normalizeCreatedOrganizationTeam(value) {
-	exact$3(value, ["id", "name"]);
-	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
-	return {
-		id: value.id,
-		name: value.name
-	};
+function joinURL(base, ...input) {
+	let url = base || "";
+	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
+		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
+		url = withTrailingSlash(url) + _segment;
+	} else url = segment;
+	return url;
 }
-function normalizeOrganizationMemberInvitationCreationInput(value) {
-	if (!isObject$1(value)) throw new AuthError("invalid_request", 400);
-	const keys = Object.keys(value).sort().join(",");
-	if (keys !== "email,idempotencyKey" && keys !== "email,idempotencyKey,teamIds") throw new AuthError("invalid_request", 400);
-	let normalizedEmail;
-	try {
-		normalizedEmail = normalizeEmail(value.email);
-	} catch {
-		throw new AuthError("invalid_request", 400);
+const protocolRelative = Symbol.for("ufo:protocolRelative");
+function parseURL(input = "", defaultProto) {
+	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
+	if (_specialProtoMatch) {
+		const [, _proto, _pathname = ""] = _specialProtoMatch;
+		return {
+			protocol: _proto.toLowerCase(),
+			pathname: _pathname,
+			href: _proto + _pathname,
+			auth: "",
+			host: "",
+			search: "",
+			hash: ""
+		};
 	}
-	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
-	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
-	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
+	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
+	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
+	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
+	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
+	const { pathname, search, hash } = parsePath(path);
 	return {
-		email: normalizedEmail,
-		...teamIds === void 0 ? {} : { teamIds },
-		idempotencyKey: value.idempotencyKey
+		protocol: protocol.toLowerCase(),
+		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
+		host,
+		pathname,
+		search,
+		hash,
+		[protocolRelative]: !protocol
 	};
 }
-function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact$3(value, ["expiresAt", "id"]);
-	if (!isId(value.id)) throw authorityUnavailable();
+function parsePath(input = "") {
+	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
 	return {
-		id: value.id,
-		expiresAt: responseDate(value.expiresAt)
+		pathname,
+		search,
+		hash
 	};
 }
-function normalizeResentOrganizationInvitation(value, invitationId) {
-	const invitation = normalizeCreatedOrganizationMemberInvitation(value);
-	if (invitation.id !== invitationId) throw authorityUnavailable();
-	return invitation;
-}
-function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
-	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
-	return { idempotencyKey };
-}
-function normalizeCanceledOrganizationInvitation(value) {
-	exact$3(value, ["status"]);
-	if (value.status !== "canceled") throw authorityUnavailable();
-	return { status: "canceled" };
-}
-function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
-	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
-	return { idempotencyKey };
+function stringifyParsedURL(parsed) {
+	const pathname = parsed.pathname || "";
+	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
+	const hash = parsed.hash || "";
+	const auth = parsed.auth ? parsed.auth + "@" : "";
+	const host = parsed.host || "";
+	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
 }
-function normalizeRemovedOrganizationMember(value) {
-	exact$3(value, ["status"]);
-	if (value.status !== "removed") throw authorityUnavailable();
-	return { status: "removed" };
+//#endregion
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
 }
-function normalizeOrganizationDeparture(value) {
-	exact$3(value, ["status"]);
-	if (value.status !== "left") throw authorityUnavailable();
-	return { status: "left" };
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
 }
-function normalizeOrganizationTeamMembershipInput(idempotencyKey) {
-	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
-	return { idempotencyKey };
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
 }
-function normalizeAddedOrganizationTeamMember(value) {
-	exact$3(value, ["status"]);
-	if (value.status !== "added") throw authorityUnavailable();
-	return { status: "added" };
+//#endregion
+//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
+var FetchError = class extends Error {
+	constructor(message, opts) {
+		super(message, opts);
+		this.name = "FetchError";
+		if (opts?.cause && !this.cause) this.cause = opts.cause;
+	}
+};
+function createFetchError(ctx) {
+	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
+	const method = ctx.request?.method || ctx.options?.method || "GET";
+	const url = ctx.request?.url || String(ctx.request) || "/";
+	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
+	for (const key of [
+		"request",
+		"options",
+		"response"
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx[key];
+	} });
+	for (const [key, refKey] of [
+		["data", "_data"],
+		["status", "status"],
+		["statusCode", "status"],
+		["statusText", "statusText"],
+		["statusMessage", "statusText"]
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx.response && ctx.response[refKey];
+	} });
+	return fetchError;
 }
-function normalizeRemovedOrganizationTeamMember(value) {
-	exact$3(value, ["status"]);
-	if (value.status !== "removed") throw authorityUnavailable();
-	return { status: "removed" };
+const payloadMethods = new Set(Object.freeze([
+	"PATCH",
+	"POST",
+	"PUT",
+	"DELETE"
+]));
+function isPayloadMethod(method = "GET") {
+	return payloadMethods.has(method.toUpperCase());
 }
-function normalizeDeletedOrganizationTeam(value) {
-	exact$3(value, ["status"]);
-	if (value.status !== "deleted") throw authorityUnavailable();
-	return { status: "deleted" };
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	if (value instanceof FormData || value instanceof URLSearchParams) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
 }
-function normalizeOrganizations(value) {
-	exact$3(value, ["nextCursor", "organizations"]);
-	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
-	return {
-		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
-	};
+const textTypes = new Set([
+	"image/svg",
+	"application/xml",
+	"application/xhtml",
+	"application/html"
+]);
+const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(_contentType = "") {
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (contentType === "text/event-stream") return "stream";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
 }
-function normalizeOrganizationMembers(value) {
-	exact$3(value, ["members", "nextCursor"]);
-	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
-	return {
-		members: unique(value.members.map((member) => {
-			exact$3(member, [
-				"email",
-				"id",
-				"image",
-				"joinedAt",
-				"name",
-				"owner",
-				"role",
-				"teamIds",
-				"userId"
-			]);
-			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
-			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
-			return {
-				id: member.id,
-				userId: member.userId,
-				name: member.name,
-				email: member.email,
-				image: nullableHttpsUrl(member.image),
-				role: member.role,
-				owner: member.owner,
-				joinedAt: responseDate(member.joinedAt),
-				teamIds
-			};
-		}), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
+function resolveFetchOptions(request, input, defaults, Headers) {
+	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
+	let query;
+	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
+		...defaults?.params,
+		...defaults?.query,
+		...input?.params,
+		...input?.query
 	};
-}
-function normalizeOrganizationTeams(value) {
-	exact$3(value, ["nextCursor", "teams"]);
-	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
-		teams: unique(value.teams.map((team) => {
-			exact$3(team, [
-				"category",
-				"createdAt",
-				"id",
-				"name"
-			]);
-			if (!isId(team.id) || !boundedString(team.name, 255) || team.category !== "manual" && team.category !== "managed") throw authorityUnavailable();
-			return {
-				id: team.id,
-				name: team.name,
-				category: team.category,
-				createdAt: responseDate(team.createdAt)
-			};
-		}), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
+		...defaults,
+		...input,
+		query,
+		params: query,
+		headers
 	};
 }
-function normalizeOrganizationTeamMembers(value) {
-	exact$3(value, ["memberIds", "nextCursor"]);
-	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
-	return {
-		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
-		nextCursor: nullableCursor(value.nextCursor)
-	};
+function mergeHeaders(input, defaults, Headers) {
+	if (!defaults) return new Headers(input);
+	const headers = new Headers(defaults);
+	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
+	return headers;
 }
-function normalizeOrganizationInvitation(value) {
-	exact$3(value, [
-		"createdAt",
-		"email",
-		"expiresAt",
-		"id",
-		"inviter",
-		"role",
-		"status",
-		"teamIds"
-	]);
-	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject$1(value.inviter)) throw authorityUnavailable();
-	exact$3(value.inviter, ["membershipId", "name"]);
-	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
-	return {
-		id: value.id,
-		email: value.email,
-		role: value.role,
-		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
-		inviter: {
-			membershipId: value.inviter.membershipId,
-			name: value.inviter.name
-		},
-		createdAt: responseDate(value.createdAt),
-		expiresAt: responseDate(value.expiresAt),
-		status: "pending"
-	};
+async function callHooks(context, hooks) {
+	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+	else await hooks(context);
 }
-function normalizeOrganizationInvitations(value) {
-	exact$3(value, ["invitations", "nextCursor"]);
-	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
-	return {
-		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
+const retryStatusCodes = new Set([
+	408,
+	409,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const nullBodyResponses = new Set([
+	101,
+	204,
+	205,
+	304
+]);
+function createFetch(globalOptions = {}) {
+	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
+	async function onError(context) {
+		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
+		if (context.options.retry !== false && !isAbort) {
+			let retries;
+			if (typeof context.options.retry === "number") retries = context.options.retry;
+			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
+			const responseCode = context.response && context.response.status || 500;
+			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
+				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
+				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
+				return $fetchRaw(context.request, {
+					...context.options,
+					retry: retries - 1
+				});
+			}
+		}
+		const error = createFetchError(context);
+		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
+		throw error;
+	}
+	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
+		const context = {
+			request: _request,
+			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
+			response: void 0,
+			error: void 0
+		};
+		if (context.options.method) context.options.method = context.options.method.toUpperCase();
+		if (context.options.onRequest) {
+			await callHooks(context, context.options.onRequest);
+			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
+		}
+		if (typeof context.request === "string") {
+			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
+			if (context.options.query) {
+				context.request = withQuery(context.request, context.options.query);
+				delete context.options.query;
+			}
+			if ("query" in context.options) delete context.options.query;
+			if ("params" in context.options) delete context.options.params;
+		}
+		if (context.options.body && isPayloadMethod(context.options.method)) {
+			if (isJSONSerializable(context.options.body)) {
+				const contentType = context.options.headers.get("content-type");
+				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
+				if (!contentType) context.options.headers.set("content-type", "application/json");
+				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
+			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
+				if (!("duplex" in context.options)) context.options.duplex = "half";
+			}
+		}
+		let abortTimeout;
+		if (!context.options.signal && context.options.timeout) {
+			const controller = new AbortController();
+			abortTimeout = setTimeout(() => {
+				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
+				error.name = "TimeoutError";
+				error.code = 23;
+				controller.abort(error);
+			}, context.options.timeout);
+			context.options.signal = controller.signal;
+		}
+		try {
+			context.response = await fetch(context.request, context.options);
+		} catch (error) {
+			context.error = error;
+			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
+			return await onError(context);
+		} finally {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
+			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
+			switch (responseType) {
+				case "json": {
+					const data = await context.response.text();
+					const parseFunction = context.options.parseResponse || destr;
+					context.response._data = parseFunction(data);
+					break;
+				}
+				case "stream":
+					context.response._data = context.response.body || context.response._bodyInit;
+					break;
+				default: context.response._data = await context.response[responseType]();
+			}
+		}
+		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
+		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
+			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
+			return await onError(context);
+		}
+		return context.response;
+	};
+	const $fetch = async function $fetch2(request, options) {
+		return (await $fetchRaw(request, options))._data;
 	};
+	$fetch.raw = $fetchRaw;
+	$fetch.native = (...args) => fetch(...args);
+	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
+		...globalOptions,
+		...customGlobalOptions,
+		defaults: {
+			...globalOptions.defaults,
+			...customGlobalOptions.defaults,
+			...defaultOptions
+		}
+	});
+	return $fetch;
 }
-function normalizeReceivedInvitation(value) {
-	exact$3(value, [
-		"expiresAt",
-		"id",
-		"inviterName",
-		"organization",
-		"role",
-		"teams"
-	]);
-	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject$1(value.organization)) throw authorityUnavailable();
-	exact$3(value.organization, [
-		"id",
-		"logo",
-		"name",
-		"slug"
-	]);
-	if (!isId(value.organization.id) || !boundedString(value.organization.name, 255) || !boundedString(value.organization.slug, 255)) throw authorityUnavailable();
+//#endregion
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	invalid_auth_input: "The authentication input is invalid.",
+	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
+	password_reset_invalid: "The password reset request is invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_request: "The request is invalid.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	recipient_unavailable: "The recipient is unavailable.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable.",
+	two_factor_required: "A second authentication factor is required.",
+	two_factor_code_invalid: "The verification code is invalid.",
+	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
+	two_factor_locked: "Second-factor verification is temporarily locked.",
+	recent_sign_in_required: "A recent sign-in is required.",
+	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
+	recent_authentication_required: "A ready recent-authentication action is required.",
+	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
+	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
+	ceremony_return_refused: "The return address is not registered for this application.",
+	password_sign_in_required: "A password sign-in method is required for this passkey change."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	constructor(code, status, retryAfterSeconds) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+//#endregion
+//#region src/shared.ts
+const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
+const id$3 = /^[A-Za-z0-9_-]{1,128}$/;
+const email = /^[^\s@]+@[^\s@]+$/;
+const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+function normalizeEmail(value) {
+	if (typeof value !== "string") throw new TypeError("email is invalid");
+	const normalized = value.trim().toLowerCase();
+	if (normalized.length === 0 || normalized.length > 320 || !email.test(normalized)) throw new TypeError("email is invalid");
+	return normalized;
+}
+function normalizeSocialIdTokenInput(value) {
+	if (!isObject$1(value)) throw new TypeError("social ID token input is invalid");
+	const keys = Object.keys(value);
+	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
 	return {
-		id: value.id,
-		organization: {
-			id: value.organization.id,
-			name: value.organization.name,
-			slug: value.organization.slug,
-			logo: nullableHttpsUrl(value.organization.logo)
-		},
-		role: value.role,
-		teams: unique(value.teams.map((team) => {
-			exact$3(team, ["id", "name"]);
-			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
-			return {
-				id: team.id,
-				name: team.name
-			};
-		}), (item) => item.id),
-		inviterName: value.inviterName,
-		expiresAt: responseDate(value.expiresAt)
+		provider: value.provider,
+		idToken: value.idToken,
+		...value.nonce === void 0 ? {} : { nonce: value.nonce },
+		signUp: value.signUp
 	};
 }
-function normalizeReceivedInvitations(value) {
-	exact$3(value, ["invitations", "nextCursor"]);
-	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+function socialIdTokenRequest(value) {
 	return {
-		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
-		nextCursor: nullableCursor(value.nextCursor)
+		provider: value.provider,
+		idToken: {
+			token: value.idToken,
+			...value.nonce === void 0 ? {} : { nonce: value.nonce }
+		},
+		requestSignUp: value.signUp
 	};
 }
-function normalizeInvitationInput(value) {
-	if (!isObject$1(value) || Object.keys(value).length !== 1 || !isId(value.invitationId)) throw new AuthError("invalid_invitation", 422);
-	return { invitationId: value.invitationId };
-}
-function normalizeInvitationAcceptance(value, invitationId) {
-	if (!isObject$1(value) || !isObject$1(value.invitation) || !isObject$1(value.member) || value.invitation.id !== invitationId || value.invitation.status !== "accepted" || !isId(value.invitation.organizationId) || value.member.organizationId !== value.invitation.organizationId) throw authorityUnavailable();
-	return { organizationId: value.invitation.organizationId };
+function normalizeOrigin(value, name) {
+	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	return url.origin;
 }
-function normalizeInvitationDecline(value, invitationId) {
-	if (!isObject$1(value) || !isObject$1(value.invitation) || value.invitation.id !== invitationId || value.invitation.status !== "rejected" || value.member !== null) throw authorityUnavailable();
-	return { status: "declined" };
+function normalizeTimeout(value) {
+	const timeout = value ?? 1e4;
+	if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 6e4) throw new TypeError("timeoutMs must be an integer from 1 to 60000");
+	return timeout;
 }
-function normalizeWorkspaceSelection(value) {
-	if (!isObject$1(value)) throw new AuthError("invalid_workspace_selection", 422);
-	const keys = Object.keys(value);
-	if (value.type === "personal" && keys.length === 1 && keys[0] === "type") return { type: "personal" };
-	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id.test(value.organizationId)) return {
-		type: "organization",
-		organizationId: value.organizationId
+function normalizeSession(value) {
+	if (value === null) return null;
+	if (!isObject$1(value) || !isObject$1(value.session) || !isObject$1(value.user)) throw authorityUnavailable();
+	const expiresAt = toDate(value.session.expiresAt);
+	const image = value.user.image;
+	if (!isId(value.session.id) || !expiresAt || !isId(value.user.id) || typeof value.user.name !== "string" || value.user.name.length > 256 || typeof value.user.email !== "string" || value.user.email.length > 320 || !email.test(value.user.email) || typeof value.user.emailVerified !== "boolean" || image !== null && image !== void 0 && (typeof image !== "string" || image.length > 2048)) throw authorityUnavailable();
+	return {
+		id: value.session.id,
+		expiresAt,
+		user: {
+			id: value.user.id,
+			name: value.user.name,
+			email: value.user.email,
+			emailVerified: value.user.emailVerified,
+			image: image ?? null
+		}
 	};
-	throw new AuthError("invalid_workspace_selection", 422);
-}
-function fromAuthorityError(value, fallbackStatus, retryAfter) {
-	const mapped = mapError(isObject$1(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
-	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
 }
-function fromAccountAuthorityError(value, status, retryAfter) {
-	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
-	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
-	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
-	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
-	if (code === "INVALID_PASSWORD" || code === "INVALID_EMAIL_OR_PASSWORD") return new AuthError("invalid_credentials", 401);
-	if (code === "INVALID_EMAIL" || code === "PASSWORD_TOO_SHORT" || code === "PASSWORD_TOO_LONG" || code === "BODY_MUST_BE_AN_OBJECT" || code === "EMAIL_CAN_NOT_BE_UPDATED") return new AuthError("invalid_auth_input", 422);
-	if (status === 401) return new AuthError("authentication_required", 401);
-	if (status === 403) return new AuthError("access_denied", 403);
-	if (status === 409) return new AuthError("state_conflict", 409);
-	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
-	if (status === 400 || status === 422) return new AuthError("invalid_auth_input", 422);
-	return authorityUnavailable();
+function normalizeDriveCredential(value, now) {
+	if (!isObject$1(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(now + value.expiresIn * 1e3)
+	};
 }
-function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
-	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
-	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
-	if (code === "OAUTH_LINK_ERROR") {
-		const message = isObject$1(value) && typeof value.message === "string" ? value.message : void 0;
-		if (message === "account not linked") return new AuthError("account_conflict", 409);
-		if (message === "signup disabled") return new AuthError("social_signup_required", 409);
-		return authorityUnavailable();
+function normalizeOrganizationPageInput(value) {
+	if (value === void 0) return new URLSearchParams();
+	if (!isObject$1(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
+	const input = value;
+	const query = new URLSearchParams();
+	if (input.limit !== void 0) {
+		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100) throw new AuthError("invalid_request", 400);
+		query.set("limit", String(input.limit));
 	}
-	return fromAccountAuthorityError(value, status, retryAfter);
-}
-function authorityUnavailable() {
-	return new AuthError("identity_authority_unavailable", 503);
-}
-function fromOrganizationListError(error) {
-	if (error instanceof AuthError && error.status === 401) return new AuthError("authentication_required", 401);
-	if (error instanceof AuthError) return error;
-	return authorityUnavailable();
-}
-function fromOrganizationReadAuthorityError(value, status) {
-	if (status === 400) return new AuthError("invalid_request", 400);
-	if (status === 401) return new AuthError("authentication_required", 401);
-	if (status === 403) return new AuthError("access_denied", 403);
-	return authorityUnavailable();
-}
-function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
-	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
-	if (status === 409 && isObject$1(value) && value.code === "ORGANIZATION_SLUG_UNAVAILABLE") return new AuthError("organization_slug_unavailable", 409);
-	if (status === 409) return new AuthError("state_conflict", 409);
-	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
-	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
-	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
-	return fromOrganizationReadAuthorityError(value, status);
+	if (input.cursor !== void 0) {
+		if (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.cursor)) throw new AuthError("invalid_request", 400);
+		query.set("cursor", input.cursor);
+	}
+	return query;
 }
-function fromOrganizationInvitationAdministrationError(value, status, retryAfter) {
-	if (status === 422 && isObject$1(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
-	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+function normalizeOrganizationMemberPageInput(value) {
+	if (value === void 0) return new URLSearchParams();
+	if (!isObject$1(value) || Object.keys(value).some((key) => ![
+		"limit",
+		"cursor",
+		"search"
+	].includes(key))) throw new AuthError("invalid_request", 400);
+	const { search, ...page } = value;
+	const query = normalizeOrganizationPageInput(page);
+	if (search !== void 0) {
+		if (typeof search !== "string") throw new AuthError("invalid_request", 400);
+		const prefix = search.trim().replace(/[A-Z]/g, (character) => character.toLowerCase());
+		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new AuthError("invalid_request", 400);
+		query.set("search", prefix);
+	}
+	return query;
 }
-function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
-	if (status === 422 && isObject$1(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("membership_removal_recovery_required", 422);
-	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+function normalizeIdInput(value) {
+	if (!isId(value)) throw new AuthError("invalid_request", 400);
+	return value;
 }
-function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact$3(value, [
-		"organizationId",
-		"actor",
-		"target"
+function normalizeOrganization(value) {
+	exact$6(value, [
+		"capabilities",
+		"id",
+		"lifecycle",
+		"logo",
+		"name",
+		"role",
+		"slug"
 	]);
-	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
-	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
-	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
-	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
-	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
-	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject$1(value.capabilities)) throw authorityUnavailable();
+	exact$6(value.capabilities, [
+		"readInvitations",
+		"readMembers",
+		"readTeams"
+	]);
+	if (value.capabilities.readMembers !== true || value.capabilities.readTeams !== true || typeof value.capabilities.readInvitations !== "boolean") throw authorityUnavailable();
 	return {
-		organizationId: value.organizationId,
-		actor,
-		target
+		id: value.id,
+		name: value.name,
+		slug: value.slug,
+		logo: nullableHttpsUrl(value.logo),
+		lifecycle: value.lifecycle,
+		role: value.role,
+		capabilities: {
+			readMembers: true,
+			readTeams: true,
+			readInvitations: value.capabilities.readInvitations
+		}
 	};
 }
-function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact$3(value, [
-		"memberId",
-		"manualRole",
-		"role",
-		"authorityRevision",
-		...includesStatus ? ["status"] : []
-	]);
-	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
+function normalizeOrganizationDisplayInput(value) {
+	if (!isObject$1(value) || Object.keys(value).sort().join(",") !== "logo,name,slug") throw new AuthError("invalid_request", 400);
+	if (!boundedString(value.name, 255) || !boundedString(value.slug, 255)) throw new AuthError("invalid_request", 400);
+	let logo;
+	try {
+		logo = nullableHttpsUrl(value.logo);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
 	return {
-		memberId: value.memberId,
-		manualRole: value.manualRole,
-		role: value.role,
-		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
+		name: value.name,
+		slug: value.slug,
+		logo
 	};
 }
-function normalizeAuthorityResultRevision(value) {
-	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
-	return value;
+function normalizeOrganizationDisplay(value) {
+	try {
+		return normalizeOrganizationDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
 }
-function fromInvitationAuthorityError(value, status) {
-	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
-	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
-	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
-	if (status === 403 && code === "YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION") return new AuthError("invitation_recipient_mismatch", 403);
-	if (status === 403 && code === "EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION") return new AuthError("email_verification_required", 403);
-	if (status === 400 && (code === "INVITATION_NOT_FOUND" || code === "ORGANIZATION_NOT_FOUND" || code === "TEAM_NOT_FOUND")) return new AuthError("invitation_unavailable", 409);
-	return authorityUnavailable();
+function normalizeOrganizationTeamDisplayInput(value) {
+	if (!isObject$1(value) || Object.keys(value).join(",") !== "name" || !boundedString(value.name, 255)) throw new AuthError("invalid_request", 400);
+	return { name: value.name };
 }
-function fromInvitationError(error) {
-	return error instanceof AuthError ? error : authorityUnavailable();
+function normalizeOrganizationTeamDisplay(value) {
+	try {
+		return normalizeOrganizationTeamDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
 }
-function mapError(code, status) {
-	if (code === "authentication_required") return {
-		code,
-		status: 401
-	};
-	if (code === "request_origin_denied") return {
-		code,
-		status: 403
-	};
-	if (code === "invalid_workspace_selection") return {
-		code,
-		status: 422
-	};
-	if (code === "organization_context_too_large") return {
-		code,
-		status: 422
-	};
-	if (code === "credential_rate_limited") return {
-		code,
-		status: 429
-	};
-	if (code === "identity_authority_unavailable") return {
-		code,
-		status: 503
-	};
-	if (status === 401 || status === 400) return {
-		code: "invalid_credentials",
-		status: 401
-	};
-	if (status === 403) return {
-		code: "access_denied",
-		status: 403
-	};
-	if (status === 409) return {
-		code: "state_conflict",
-		status: 409
-	};
-	if (status === 422) return {
-		code: "invalid_workspace_selection",
-		status: 422
+function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255) || typeof slug !== "string" || !/^[a-z0-9-]{1,128}$/.test(slug)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		slug,
+		idempotencyKey
 	};
-	if (status === 429) return {
-		code: "credential_rate_limited",
-		status: 429
+}
+function normalizeCreatedOrganization(value) {
+	exact$6(value, [
+		"id",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 128)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
 	};
+}
+function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
 	return {
-		code: "identity_authority_unavailable",
-		status: 503
+		name,
+		idempotencyKey
 	};
 }
-function parseRetryAfter(value) {
-	if (!value || !/^\d+$/.test(value)) return void 0;
-	const seconds = Number(value);
-	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
+function normalizeCreatedOrganizationTeam(value) {
+	exact$6(value, ["id", "name"]);
+	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name
+	};
 }
-function toDate(value) {
-	const result = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
-	return result && Number.isFinite(result.getTime()) ? result : void 0;
+function normalizeOrganizationMemberInvitationCreationInput(value) {
+	if (!isObject$1(value)) throw new AuthError("invalid_request", 400);
+	const keys = Object.keys(value).sort().join(",");
+	if (keys !== "email,idempotencyKey" && keys !== "email,idempotencyKey,teamIds") throw new AuthError("invalid_request", 400);
+	let normalizedEmail;
+	try {
+		normalizedEmail = normalizeEmail(value.email);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
+	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
+	return {
+		email: normalizedEmail,
+		...teamIds === void 0 ? {} : { teamIds },
+		idempotencyKey: value.idempotencyKey
+	};
 }
-function isId(value) {
-	return typeof value === "string" && id.test(value);
+function normalizeCreatedOrganizationMemberInvitation(value) {
+	exact$6(value, ["expiresAt", "id"]);
+	if (!isId(value.id)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		expiresAt: responseDate(value.expiresAt)
+	};
 }
-function exact$3(value, keys) {
-	if (!isObject$1(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
+function normalizeResentOrganizationInvitation(value, invitationId) {
+	const invitation = normalizeCreatedOrganizationMemberInvitation(value);
+	if (invitation.id !== invitationId) throw authorityUnavailable();
+	return invitation;
 }
-function boundedString(value, maximum) {
-	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
 }
-function role(value) {
-	return value === "owner" || value === "admin" || value === "member";
+function normalizeCanceledOrganizationInvitation(value) {
+	exact$6(value, ["status"]);
+	if (value.status !== "canceled") throw authorityUnavailable();
+	return { status: "canceled" };
 }
-function nullableHttpsUrl(value) {
-	if (value === null) return null;
-	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw authorityUnavailable();
-	}
-	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
-	return value;
+function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
 }
-function responseDate(value) {
-	if (typeof value !== "string") throw authorityUnavailable();
-	const date = new Date(value);
-	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
-	return date;
+function normalizeRemovedOrganizationMember(value) {
+	exact$6(value, ["status"]);
+	if (value.status !== "removed") throw authorityUnavailable();
+	return { status: "removed" };
 }
-function nullableCursor(value) {
-	if (value === null) return null;
-	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
-	return value;
+function normalizeOrganizationDeparture(value) {
+	exact$6(value, ["status"]);
+	if (value.status !== "left") throw authorityUnavailable();
+	return { status: "left" };
 }
-function normalizeResponseId(value) {
-	if (!isId(value)) throw authorityUnavailable();
-	return value;
+function normalizeOrganizationTeamMembershipInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
 }
-function unique(items, key) {
-	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
-	return items;
+function normalizeAddedOrganizationTeamMember(value) {
+	exact$6(value, ["status"]);
+	if (value.status !== "added") throw authorityUnavailable();
+	return { status: "added" };
 }
-function isObject$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function normalizeRemovedOrganizationTeamMember(value) {
+	exact$6(value, ["status"]);
+	if (value.status !== "removed") throw authorityUnavailable();
+	return { status: "removed" };
 }
-//#endregion
-//#region src/google-recovery.ts
-function object(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
+function normalizeDeletedOrganizationTeam(value) {
+	exact$6(value, ["status"]);
+	if (value.status !== "deleted") throw authorityUnavailable();
+	return { status: "deleted" };
 }
-function validTicket(value) {
-	return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+function normalizeOrganizations(value) {
+	exact$6(value, ["nextCursor", "organizations"]);
+	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
+	return {
+		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
 }
-function googleRecoveryInput(value, complete) {
-	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => key !== "token" && key !== "nonce") || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
-	const social = normalizeSocialIdTokenInput({
-		provider: "google",
-		idToken: value.idToken.token,
-		signUp: false,
-		...value.idToken.nonce === void 0 ? {} : { nonce: value.idToken.nonce }
-	});
+function normalizeOrganizationMembers(value) {
+	exact$6(value, ["members", "nextCursor"]);
+	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
-		idToken: {
-			token: social.idToken,
-			...social.nonce === void 0 ? {} : { nonce: social.nonce }
+		members: unique(value.members.map((member) => {
+			exact$6(member, [
+				"email",
+				"id",
+				"image",
+				"joinedAt",
+				"name",
+				"owner",
+				"role",
+				"teamIds",
+				"userId"
+			]);
+			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
+			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
+			return {
+				id: member.id,
+				userId: member.userId,
+				name: member.name,
+				email: member.email,
+				image: nullableHttpsUrl(member.image),
+				role: member.role,
+				owner: member.owner,
+				joinedAt: responseDate(member.joinedAt),
+				teamIds
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationTeams(value) {
+	exact$6(value, ["nextCursor", "teams"]);
+	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
+	return {
+		teams: unique(value.teams.map((team) => {
+			exact$6(team, [
+				"category",
+				"createdAt",
+				"id",
+				"name"
+			]);
+			if (!isId(team.id) || !boundedString(team.name, 255) || team.category !== "manual" && team.category !== "managed") throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name,
+				category: team.category,
+				createdAt: responseDate(team.createdAt)
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationTeamMembers(value) {
+	exact$6(value, ["memberIds", "nextCursor"]);
+	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
+	return {
+		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationInvitation(value) {
+	exact$6(value, [
+		"createdAt",
+		"email",
+		"expiresAt",
+		"id",
+		"inviter",
+		"role",
+		"status",
+		"teamIds"
+	]);
+	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject$1(value.inviter)) throw authorityUnavailable();
+	exact$6(value.inviter, ["membershipId", "name"]);
+	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		email: value.email,
+		role: value.role,
+		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
+		inviter: {
+			membershipId: value.inviter.membershipId,
+			name: value.inviter.name
 		},
-		...complete ? { recoveryToken: value.recoveryToken } : {}
+		createdAt: responseDate(value.createdAt),
+		expiresAt: responseDate(value.expiresAt),
+		status: "pending"
 	};
 }
-function normalizeGoogleRecovery(value, now) {
-	if (!object(value) || Object.keys(value).sort().join(",") !== "expiresAt,recoveryToken" || !validTicket(value.recoveryToken) || typeof value.expiresAt !== "string") throw authorityUnavailable();
-	const expiresAt = Date.parse(value.expiresAt);
-	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 10 * 6e4) throw authorityUnavailable();
+function normalizeOrganizationInvitations(value) {
+	exact$6(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
-		recoveryToken: value.recoveryToken,
-		expiresAt: value.expiresAt
+		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
-function normalizeGoogleRecoveryCompletion(value) {
-	if (!object(value) || Object.keys(value).join(",") !== "linked" || value.linked !== true) throw authorityUnavailable();
-	return { linked: true };
+function normalizeReceivedInvitation(value) {
+	exact$6(value, [
+		"expiresAt",
+		"id",
+		"inviterName",
+		"organization",
+		"role",
+		"teams"
+	]);
+	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject$1(value.organization)) throw authorityUnavailable();
+	exact$6(value.organization, [
+		"id",
+		"logo",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.organization.id) || !boundedString(value.organization.name, 255) || !boundedString(value.organization.slug, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		organization: {
+			id: value.organization.id,
+			name: value.organization.name,
+			slug: value.organization.slug,
+			logo: nullableHttpsUrl(value.organization.logo)
+		},
+		role: value.role,
+		teams: unique(value.teams.map((team) => {
+			exact$6(team, ["id", "name"]);
+			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name
+			};
+		}), (item) => item.id),
+		inviterName: value.inviterName,
+		expiresAt: responseDate(value.expiresAt)
+	};
 }
-function fromGoogleRecoveryError(value, status, retryAfter) {
-	const code = object(value) ? value.code : void 0;
-	if (status === 409 && code === "GOOGLE_RECOVERY_IN_PROGRESS") return new AuthError("google_recovery_in_progress", 409);
-	if (status === 409 && code === "GOOGLE_RECOVERY_NOT_REQUIRED") return new AuthError("google_recovery_not_required", 409);
-	if (status === 403 && code === "GOOGLE_RECOVERY_EMAIL_VERIFICATION_REQUIRED") return new AuthError("email_verification_required", 403);
-	if (status === 400 && code === "GOOGLE_RECOVERY_INVALID") return new AuthError("google_recovery_invalid", 400);
-	if (status === 410 && code === "GOOGLE_RECOVERY_EXPIRED") return new AuthError("google_recovery_expired", 410);
-	if (status === 403 && code === "GOOGLE_RECOVERY_ACCOUNT_MISMATCH") return new AuthError("google_recovery_account_mismatch", 403);
-	if (status === 401 && code === "GOOGLE_RECOVERY_FRESH_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 401);
-	if (code === "GOOGLE_RECOVERY_UNAVAILABLE") return authorityUnavailable();
-	return fromAccountAuthorityError(value, status, retryAfter);
+function normalizeReceivedInvitations(value) {
+	exact$6(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
 }
-String.fromCharCode;
-const HASH_RE = /#/g;
-const AMPERSAND_RE = /&/g;
-const SLASH_RE = /\//g;
-const EQUAL_RE = /=/g;
-const PLUS_RE = /\+/g;
-const ENC_CARET_RE = /%5e/gi;
-const ENC_BACKTICK_RE = /%60/gi;
-const ENC_PIPE_RE = /%7c/gi;
-const ENC_SPACE_RE = /%20/gi;
-function encode$2(text) {
-	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
+function normalizeInvitationInput(value) {
+	if (!isObject$1(value) || Object.keys(value).length !== 1 || !isId(value.invitationId)) throw new AuthError("invalid_invitation", 422);
+	return { invitationId: value.invitationId };
 }
-function encodeQueryValue(input) {
-	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
+function normalizeInvitationAcceptance(value, invitationId) {
+	if (!isObject$1(value) || !isObject$1(value.invitation) || !isObject$1(value.member) || value.invitation.id !== invitationId || value.invitation.status !== "accepted" || !isId(value.invitation.organizationId) || value.member.organizationId !== value.invitation.organizationId) throw authorityUnavailable();
+	return { organizationId: value.invitation.organizationId };
 }
-function encodeQueryKey(text) {
-	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
+function normalizeInvitationDecline(value, invitationId) {
+	if (!isObject$1(value) || !isObject$1(value.invitation) || value.invitation.id !== invitationId || value.invitation.status !== "rejected" || value.member !== null) throw authorityUnavailable();
+	return { status: "declined" };
 }
-function decode$1(text = "") {
-	try {
-		return decodeURIComponent("" + text);
-	} catch {
-		return "" + text;
-	}
+function normalizeWorkspaceSelection(value) {
+	if (!isObject$1(value)) throw new AuthError("invalid_workspace_selection", 422);
+	const keys = Object.keys(value);
+	if (value.type === "personal" && keys.length === 1 && keys[0] === "type") return { type: "personal" };
+	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id$3.test(value.organizationId)) return {
+		type: "organization",
+		organizationId: value.organizationId
+	};
+	throw new AuthError("invalid_workspace_selection", 422);
 }
-function decodeQueryKey(text) {
-	return decode$1(text.replace(PLUS_RE, " "));
+function fromAuthorityError(value, fallbackStatus, retryAfter) {
+	const mapped = mapError(isObject$1(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
+	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
 }
-function decodeQueryValue(text) {
-	return decode$1(text.replace(PLUS_RE, " "));
+function fromAccountAuthorityError(value, status, retryAfter) {
+	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
+	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
+	if (code === "INVALID_PASSWORD" || code === "INVALID_EMAIL_OR_PASSWORD") return new AuthError("invalid_credentials", 401);
+	if (code === "INVALID_EMAIL" || code === "PASSWORD_TOO_SHORT" || code === "PASSWORD_TOO_LONG" || code === "BODY_MUST_BE_AN_OBJECT" || code === "EMAIL_CAN_NOT_BE_UPDATED") return new AuthError("invalid_auth_input", 422);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	if (status === 400 || status === 422) return new AuthError("invalid_auth_input", 422);
+	return authorityUnavailable();
 }
-function parseQuery(parametersString = "") {
-	const object = Object.create(null);
-	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
-	for (const parameter of parametersString.split("&")) {
-		const s = parameter.match(/([^=]+)=?(.*)/) || [];
-		if (s.length < 2) continue;
-		const key = decodeQueryKey(s[1]);
-		if (key === "__proto__" || key === "constructor") continue;
-		const value = decodeQueryValue(s[2] || "");
-		if (object[key] === void 0) object[key] = value;
-		else if (Array.isArray(object[key])) object[key].push(value);
-		else object[key] = [object[key], value];
+function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
+	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
+	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
+	if (code === "OAUTH_LINK_ERROR") {
+		const message = isObject$1(value) && typeof value.message === "string" ? value.message : void 0;
+		if (message === "account not linked") return new AuthError("account_conflict", 409);
+		if (message === "signup disabled") return new AuthError("social_signup_required", 409);
+		return authorityUnavailable();
 	}
-	return object;
+	return fromAccountAuthorityError(value, status, retryAfter);
 }
-function encodeQueryItem(key, value) {
-	if (typeof value === "number" || typeof value === "boolean") value = String(value);
-	if (!value) return encodeQueryKey(key);
-	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
-	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
+function authorityUnavailable() {
+	return new AuthError("identity_authority_unavailable", 503);
 }
-function stringifyQuery(query) {
-	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
+function fromOrganizationListError(error) {
+	if (error instanceof AuthError && error.status === 401) return new AuthError("authentication_required", 401);
+	if (error instanceof AuthError) return error;
+	return authorityUnavailable();
 }
-const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
-const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
-const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
-const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
-const JOIN_LEADING_SLASH_RE = /^\.?\//;
-function hasProtocol(inputString, opts = {}) {
-	if (typeof opts === "boolean") opts = { acceptRelative: opts };
-	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
-	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
-}
-function hasTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return input.endsWith("/");
-	return TRAILING_SLASH_RE.test(input);
-}
-function withoutTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
-	if (!hasTrailingSlash(input, true)) return input || "/";
-	let path = input;
-	let fragment = "";
-	const fragmentIndex = input.indexOf("#");
-	if (fragmentIndex !== -1) {
-		path = input.slice(0, fragmentIndex);
-		fragment = input.slice(fragmentIndex);
-	}
-	const [s0, ...s] = path.split("?");
-	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
-}
-function withTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
-	if (hasTrailingSlash(input, true)) return input || "/";
-	let path = input;
-	let fragment = "";
-	const fragmentIndex = input.indexOf("#");
-	if (fragmentIndex !== -1) {
-		path = input.slice(0, fragmentIndex);
-		fragment = input.slice(fragmentIndex);
-		if (!path) return fragment;
-	}
-	const [s0, ...s] = path.split("?");
-	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
-}
-function withBase(input, base) {
-	if (isEmptyURL(base) || hasProtocol(input)) return input;
-	const _base = withoutTrailingSlash(base);
-	if (input.startsWith(_base)) {
-		const nextChar = input[_base.length];
-		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
-	}
-	return joinURL(_base, input);
-}
-function withQuery(input, query) {
-	const parsed = parseURL(input);
-	parsed.search = stringifyQuery({
-		...parseQuery(parsed.search),
-		...query
-	});
-	return stringifyParsedURL(parsed);
+function fromOrganizationReadAuthorityError(value, status) {
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	return authorityUnavailable();
 }
-function isEmptyURL(url) {
-	return !url || url === "/";
+function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409 && isObject$1(value) && value.code === "ORGANIZATION_SLUG_UNAVAILABLE") return new AuthError("organization_slug_unavailable", 409);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
+	return fromOrganizationReadAuthorityError(value, status);
 }
-function isNonEmptyURL(url) {
-	return url && url !== "/";
+function fromOrganizationInvitationAdministrationError(value, status, retryAfter) {
+	if (status === 422 && isObject$1(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
-function joinURL(base, ...input) {
-	let url = base || "";
-	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
-		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
-		url = withTrailingSlash(url) + _segment;
-	} else url = segment;
-	return url;
+function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
+	if (status === 422 && isObject$1(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("membership_removal_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
-const protocolRelative = Symbol.for("ufo:protocolRelative");
-function parseURL(input = "", defaultProto) {
-	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
-	if (_specialProtoMatch) {
-		const [, _proto, _pathname = ""] = _specialProtoMatch;
-		return {
-			protocol: _proto.toLowerCase(),
-			pathname: _pathname,
-			href: _proto + _pathname,
-			auth: "",
-			host: "",
-			search: "",
-			hash: ""
-		};
-	}
-	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
-	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
-	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
-	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
-	const { pathname, search, hash } = parsePath(path);
+function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
+	exact$6(value, [
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
+	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
+	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
+	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
 	return {
-		protocol: protocol.toLowerCase(),
-		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
-		host,
-		pathname,
-		search,
-		hash,
-		[protocolRelative]: !protocol
+		organizationId: value.organizationId,
+		actor,
+		target
 	};
 }
-function parsePath(input = "") {
-	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
+function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
+	exact$6(value, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision",
+		...includesStatus ? ["status"] : []
+	]);
+	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
 	return {
-		pathname,
-		search,
-		hash
+		memberId: value.memberId,
+		manualRole: value.manualRole,
+		role: value.role,
+		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
 	};
 }
-function stringifyParsedURL(parsed) {
-	const pathname = parsed.pathname || "";
-	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
-	const hash = parsed.hash || "";
-	const auth = parsed.auth ? parsed.auth + "@" : "";
-	const host = parsed.host || "";
-	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
+function normalizeAuthorityResultRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	return value;
 }
-//#endregion
-//#region src/user-api/credential.ts
-function userApiApplication(input) {
-	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
-	return input.applicationId;
+function fromInvitationAuthorityError(value, status) {
+	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (status === 403 && code === "YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION") return new AuthError("invitation_recipient_mismatch", 403);
+	if (status === 403 && code === "EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION") return new AuthError("email_verification_required", 403);
+	if (status === 400 && (code === "INVITATION_NOT_FOUND" || code === "ORGANIZATION_NOT_FOUND" || code === "TEAM_NOT_FOUND")) return new AuthError("invitation_unavailable", 409);
+	return authorityUnavailable();
 }
-function normalizeUserApiCredential(value, startedAt) {
-	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+function fromInvitationError(error) {
+	return error instanceof AuthError ? error : authorityUnavailable();
+}
+function mapError(code, status) {
+	if (code === "authentication_required") return {
+		code,
+		status: 401
+	};
+	if (code === "request_origin_denied") return {
+		code,
+		status: 403
+	};
+	if (code === "invalid_workspace_selection") return {
+		code,
+		status: 422
+	};
+	if (code === "organization_context_too_large") return {
+		code,
+		status: 422
+	};
+	if (code === "credential_rate_limited") return {
+		code,
+		status: 429
+	};
+	if (code === "identity_authority_unavailable") return {
+		code,
+		status: 503
+	};
+	if (status === 401 || status === 400) return {
+		code: "invalid_credentials",
+		status: 401
+	};
+	if (status === 403) return {
+		code: "access_denied",
+		status: 403
+	};
+	if (status === 409) return {
+		code: "state_conflict",
+		status: 409
+	};
+	if (status === 422) return {
+		code: "invalid_workspace_selection",
+		status: 422
+	};
+	if (status === 429) return {
+		code: "credential_rate_limited",
+		status: 429
+	};
 	return {
-		tokenType: "Bearer",
-		token: value.token,
-		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
+		code: "identity_authority_unavailable",
+		status: 503
 	};
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/buffer_utils.js
-const encoder$1 = new TextEncoder();
-const decoder = new TextDecoder();
-function concat(...buffers) {
-	const size = buffers.reduce((acc, { length }) => acc + length, 0);
-	const buf = new Uint8Array(size);
-	let i = 0;
-	for (const buffer of buffers) {
-		buf.set(buffer, i);
-		i += buffer.length;
-	}
-	return buf;
+function parseRetryAfter(value) {
+	if (!value || !/^\d+$/.test(value)) return void 0;
+	const seconds = Number(value);
+	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
 }
-function encode$1(string) {
-	const bytes = new Uint8Array(string.length);
-	for (let i = 0; i < string.length; i++) {
-		const code = string.charCodeAt(i);
-		if (code > 127) throw new TypeError("non-ASCII string encountered in encode()");
-		bytes[i] = code;
-	}
-	return bytes;
+function toDate(value) {
+	const result = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
+	return result && Number.isFinite(result.getTime()) ? result : void 0;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/base64.js
-function encodeBase64(input) {
-	if (Uint8Array.prototype.toBase64) return input.toBase64();
-	const CHUNK_SIZE = 32768;
-	const arr = [];
-	for (let i = 0; i < input.length; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-	return btoa(arr.join(""));
+function isId(value) {
+	return typeof value === "string" && id$3.test(value);
 }
-function decodeBase64(encoded) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded);
-	const binary = atob(encoded);
-	const bytes = new Uint8Array(binary.length);
+function exact$6(value, keys) {
+	if (!isObject$1(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
+}
+function boundedString(value, maximum) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+}
+function role(value) {
+	return value === "owner" || value === "admin" || value === "member";
+}
+function nullableHttpsUrl(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
+	return value;
+}
+function responseDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const date = new Date(value);
+	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
+	return date;
+}
+function nullableCursor(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeResponseId(value) {
+	if (!isId(value)) throw authorityUnavailable();
+	return value;
+}
+function unique(items, key) {
+	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
+	return items;
+}
+function isObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/http.ts
+const MAX_RESPONSE_BYTES = 64 * 1024;
+async function requestJson(url, options) {
+	return (await requestJsonResponse(url, options)).value;
+}
+async function requestJsonResponse(url, options) {
+	let response;
+	try {
+		response = await createFetch({ fetch: options.fetch }).raw(url, {
+			method: options.method,
+			headers: options.headers,
+			body: options.body,
+			credentials: options.credentials ?? "include",
+			cache: options.cache,
+			retry: 0,
+			timeout: options.timeoutMs,
+			redirect: "manual",
+			signal: options.signal,
+			responseType: "stream",
+			ignoreResponseError: true
+		});
+	} catch {
+		throw authorityUnavailable();
+	}
+	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
+		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes, options.signal) : void 0;
+		response.body?.cancel().catch(() => void 0);
+		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
+	}
+	return {
+		value: await readJson(response, options.maxResponseBytes, options.signal),
+		headers: response.headers
+	};
+}
+async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
+	const length = response.headers.get("content-length");
+	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
+		response.body?.cancel().catch(() => void 0);
+		throw authorityUnavailable();
+	}
+	if (!response.body) throw authorityUnavailable();
+	if (signal?.aborted) {
+		response.body.cancel().catch(() => void 0);
+		throw authorityUnavailable();
+	}
+	const reader = response.body.getReader();
+	const cancel = () => {
+		reader.cancel().catch(() => void 0);
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
+	const chunks = [];
+	let size = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (signal?.aborted) throw authorityUnavailable();
+			if (done) break;
+			size += value.byteLength;
+			if (size > maximum) throw authorityUnavailable();
+			chunks.push(value);
+		}
+	} catch (error) {
+		reader.cancel().catch(() => void 0);
+		throw error;
+	} finally {
+		signal?.removeEventListener("abort", cancel);
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+//#endregion
+//#region src/product-operations/contract.ts
+const id$2 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const digest$1 = /^[a-f0-9]{64}$(?![\s\S])/;
+const credential = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/;
+function exact$5(value, keys) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function identifier(value) {
+	return typeof value === "string" && id$2.test(value);
+}
+function timestamp(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 864e13;
+}
+function operationProof(value) {
+	if (!exact$5(value, [
+		"applicationCredential",
+		"serviceAssertion",
+		"actorUserId",
+		"actorSessionId",
+		"serviceId",
+		"environment"
+	]) || !identifier(value.actorUserId) || !identifier(value.actorSessionId) || !identifier(value.serviceId) || ![
+		"local",
+		"development",
+		"staging",
+		"production"
+	].includes(value.environment) || [value.applicationCredential, value.serviceAssertion].some((token) => typeof token !== "string" || token.length > 16 * 1024 || !credential.test(token))) throw new AuthError("invalid_request", 400);
+	return {
+		applicationCredential: value.applicationCredential,
+		serviceAssertion: value.serviceAssertion,
+		actorUserId: value.actorUserId,
+		actorSessionId: value.actorSessionId,
+		serviceId: value.serviceId,
+		environment: value.environment
+	};
+}
+function snapshotInput(value) {
+	if (!exact$5(value, ["applicationId", "participantUserUids"]) || !identifier(value.applicationId) || !Array.isArray(value.participantUserUids) || value.participantUserUids.length < 1 || value.participantUserUids.length > 100 || !value.participantUserUids.every((uid, index, all) => identifier(uid) && (index === 0 || all[index - 1] < uid))) throw new AuthError("invalid_request", 400);
+	return {
+		applicationId: value.applicationId,
+		participantUserUids: [...value.participantUserUids]
+	};
+}
+function operationInput(value) {
+	if (!exact$5(value, [
+		"applicationId",
+		"snapshotId",
+		"operationHash",
+		"nonce"
+	]) || !identifier(value.applicationId) || !identifier(value.snapshotId) || typeof value.operationHash !== "string" || !digest$1.test(value.operationHash) || typeof value.nonce !== "string" || !digest$1.test(value.nonce)) throw new AuthError("invalid_request", 400);
+	return {
+		applicationId: value.applicationId,
+		snapshotId: value.snapshotId,
+		operationHash: value.operationHash,
+		nonce: value.nonce
+	};
+}
+const snapshotKeys = [
+	"snapshotId",
+	"actorUserId",
+	"actorSessionId",
+	"issuedAt",
+	"expiresAt"
+];
+function snapshotFields(value) {
+	if (!identifier(value.snapshotId) || !identifier(value.actorUserId) || !identifier(value.actorSessionId) || !timestamp(value.issuedAt) || !timestamp(value.expiresAt) || value.expiresAt <= value.issuedAt || value.expiresAt - value.issuedAt > 3e4) throw authorityUnavailable();
+	return {
+		snapshotId: value.snapshotId,
+		actorUserId: value.actorUserId,
+		actorSessionId: value.actorSessionId,
+		issuedAt: value.issuedAt,
+		expiresAt: value.expiresAt
+	};
+}
+function snapshotOutput(value, participants, proof) {
+	if (!exact$5(value, snapshotKeys)) throw authorityUnavailable();
+	const result = snapshotFields(value);
+	if (!participants.includes(result.actorUserId) || result.actorUserId !== proof.actorUserId || result.actorSessionId !== proof.actorSessionId) throw authorityUnavailable();
+	return result;
+}
+function receiptOutput(value, input, proof, phase) {
+	if (!exact$5(value, [
+		...snapshotKeys,
+		"serviceId",
+		"applicationId",
+		"actorAccountCreatedAt",
+		"environment",
+		"scopeKind",
+		"organizationId",
+		"nonce",
+		"operationHash",
+		"consumedAt"
+	])) throw authorityUnavailable();
+	const snapshot = snapshotFields(value);
+	if (snapshot.snapshotId !== input.snapshotId || snapshot.actorUserId !== proof.actorUserId || phase === "consume" && snapshot.actorSessionId !== proof.actorSessionId || value.serviceId !== proof.serviceId || value.environment !== proof.environment || value.applicationId !== input.applicationId || value.nonce !== input.nonce || value.operationHash !== input.operationHash || !identifier(value.serviceId) || !timestamp(value.actorAccountCreatedAt) || value.scopeKind !== "account" || value.organizationId !== null || !timestamp(value.consumedAt) || value.consumedAt < snapshot.issuedAt || value.consumedAt >= snapshot.expiresAt || ![
+		"local",
+		"development",
+		"staging",
+		"production"
+	].includes(value.environment)) throw authorityUnavailable();
+	return {
+		...snapshot,
+		serviceId: value.serviceId,
+		applicationId: input.applicationId,
+		actorAccountCreatedAt: value.actorAccountCreatedAt,
+		environment: value.environment,
+		scopeKind: "account",
+		organizationId: null,
+		nonce: input.nonce,
+		operationHash: input.operationHash,
+		consumedAt: value.consumedAt
+	};
+}
+//#endregion
+//#region src/product-operations/index.ts
+function createAccountProductOperationAuth(options) {
+	const base = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/product-operations/account");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	function audience(phase) {
+		if (![
+			"snapshot",
+			"consume",
+			"receipt"
+		].includes(phase)) throw new AuthError("invalid_request", 400);
+		return joinURL(base, phase);
+	}
+	async function exchange(phase, applicationId, body, proof) {
+		const credentials = proof;
+		const url = new URL(audience(phase));
+		url.searchParams.set("applicationId", applicationId);
+		const controller = new AbortController();
+		let timer;
+		try {
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					controller.abort();
+					reject(authorityUnavailable());
+				}, timeoutMs);
+			});
+			return await Promise.race([requestJson(url.toString(), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "omit",
+				cache: "no-store",
+				signal: controller.signal,
+				maxResponseBytes: 4096,
+				headers: {
+					"x-finueva-application-credential": credentials.applicationCredential,
+					"x-finueva-service-assertion": credentials.serviceAssertion,
+					accept: "application/json",
+					"content-type": "application/json"
+				},
+				body,
+				mapError: (_value, status, retryAfter) => {
+					if (status === 401) return new AuthError("access_denied", 401);
+					if (status === 429 && retryAfter !== null && /^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) return new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
+					return authorityUnavailable();
+				}
+			}), deadline]);
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+		}
+	}
+	return {
+		audience,
+		async captureAccountOperation(input, proof) {
+			const validated = snapshotInput(input);
+			const expected = operationProof(proof);
+			return snapshotOutput(await exchange("snapshot", validated.applicationId, { participantUserUids: validated.participantUserUids }, expected), validated.participantUserUids, expected);
+		},
+		async consumeAccountOperation(input, proof) {
+			const validated = operationInput(input);
+			const expected = operationProof(proof);
+			const { applicationId, ...body } = validated;
+			const value = await exchange("consume", applicationId, body, expected);
+			if (!exact$5(value, ["receipt", "replayed"]) || typeof value.replayed !== "boolean") throw authorityUnavailable();
+			return {
+				receipt: receiptOutput(value.receipt, validated, expected, "consume"),
+				replayed: value.replayed
+			};
+		},
+		async retrieveAccountOperationReceipt(input, proof) {
+			const validated = operationInput(input);
+			const expected = operationProof(proof);
+			const { applicationId, ...body } = validated;
+			return receiptOutput(await exchange("receipt", applicationId, body, expected), validated, expected, "receipt");
+		}
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/buffer_utils.js
+const encoder$1 = new TextEncoder();
+const decoder = new TextDecoder();
+function concat(...buffers) {
+	const size = buffers.reduce((acc, { length }) => acc + length, 0);
+	const buf = new Uint8Array(size);
+	let i = 0;
+	for (const buffer of buffers) {
+		buf.set(buffer, i);
+		i += buffer.length;
+	}
+	return buf;
+}
+function encode$1(string) {
+	const bytes = new Uint8Array(string.length);
+	for (let i = 0; i < string.length; i++) {
+		const code = string.charCodeAt(i);
+		if (code > 127) throw new TypeError("non-ASCII string encountered in encode()");
+		bytes[i] = code;
+	}
+	return bytes;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/base64.js
+function encodeBase64(input) {
+	if (Uint8Array.prototype.toBase64) return input.toBase64();
+	const CHUNK_SIZE = 32768;
+	const arr = [];
+	for (let i = 0; i < input.length; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+	return btoa(arr.join(""));
+}
+function decodeBase64(encoded) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded);
+	const binary = atob(encoded);
+	const bytes = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
 	return bytes;
 }
@@ -1907,432 +2401,231 @@ async function calculateJwkThumbprint(key, digestAlgorithm) {
 	digestAlgorithm ??= "sha256";
 	if (digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512") throw new TypeError("digestAlgorithm must one of \"sha256\", \"sha384\", or \"sha512\"");
 	let components;
-	switch (jwk.kty) {
-		case "AKP":
-			check(jwk.alg, "\"alg\" (Algorithm) Parameter");
-			check(jwk.pub, "\"pub\" (Public key) Parameter");
-			components = {
-				alg: jwk.alg,
-				kty: jwk.kty,
-				pub: jwk.pub
-			};
-			break;
-		case "EC":
-			check(jwk.crv, "\"crv\" (Curve) Parameter");
-			check(jwk.x, "\"x\" (X Coordinate) Parameter");
-			check(jwk.y, "\"y\" (Y Coordinate) Parameter");
-			components = {
-				crv: jwk.crv,
-				kty: jwk.kty,
-				x: jwk.x,
-				y: jwk.y
-			};
-			break;
-		case "OKP":
-			check(jwk.crv, "\"crv\" (Subtype of Key Pair) Parameter");
-			check(jwk.x, "\"x\" (Public Key) Parameter");
-			components = {
-				crv: jwk.crv,
-				kty: jwk.kty,
-				x: jwk.x
-			};
-			break;
-		case "RSA":
-			check(jwk.e, "\"e\" (Exponent) Parameter");
-			check(jwk.n, "\"n\" (Modulus) Parameter");
-			components = {
-				e: jwk.e,
-				kty: jwk.kty,
-				n: jwk.n
-			};
-			break;
-		case "oct":
-			check(jwk.k, "\"k\" (Key Value) Parameter");
-			components = {
-				k: jwk.k,
-				kty: jwk.kty
-			};
-			break;
-		default: throw new JOSENotSupported("\"kty\" (Key Type) Parameter missing or unsupported");
-	}
-	const data = encode$1(JSON.stringify(components));
-	return encode(await digest(digestAlgorithm, data));
-}
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/decode_protected_header.js
-function decodeProtectedHeader(token) {
-	let protectedB64u;
-	if (typeof token === "string") {
-		const parts = token.split(".");
-		if (parts.length === 3 || parts.length === 5) [protectedB64u] = parts;
-	} else if (typeof token === "object" && token) if ("protected" in token) protectedB64u = token.protected;
-	else throw new TypeError("Token does not contain a Protected Header");
-	try {
-		if (typeof protectedB64u !== "string" || !protectedB64u) throw new Error();
-		const result = JSON.parse(decoder.decode(decode(protectedB64u)));
-		if (!isObject(result)) throw new Error();
-		return result;
-	} catch {
-		throw new TypeError("Invalid Token or Protected Header formatting");
-	}
-}
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/decode_jwt.js
-function decodeJwt(jwt) {
-	if (typeof jwt !== "string") throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
-	const { 1: payload, length } = jwt.split(".");
-	if (length === 5) throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
-	if (length !== 3) throw new JWTInvalid("Invalid JWT");
-	if (!payload) throw new JWTInvalid("JWTs must contain a payload");
-	let decoded;
-	try {
-		decoded = decode(payload);
-	} catch {
-		throw new JWTInvalid("Failed to base64url decode the payload");
-	}
-	let result;
-	try {
-		result = JSON.parse(decoder.decode(decoded));
-	} catch {
-		throw new JWTInvalid("Failed to parse the decoded payload as JSON");
-	}
-	if (!isObject(result)) throw new JWTInvalid("Invalid JWT Claims Set");
-	return result;
-}
-//#endregion
-//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
-const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
-const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
-const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
-function jsonParseTransform(key, value) {
-	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
-		warnKeyDropped(key);
-		return;
-	}
-	return value;
-}
-function warnKeyDropped(key) {
-	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
-}
-function destr(value, options = {}) {
-	if (typeof value !== "string") return value;
-	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
-	const _value = value.trim();
-	if (_value.length <= 9) switch (_value.toLowerCase()) {
-		case "true": return true;
-		case "false": return false;
-		case "undefined": return;
-		case "null": return null;
-		case "nan": return NaN;
-		case "infinity": return Number.POSITIVE_INFINITY;
-		case "-infinity": return Number.NEGATIVE_INFINITY;
-	}
-	if (!JsonSigRx.test(value)) {
-		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
-		return value;
-	}
-	try {
-		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
-			if (options.strict) throw new Error("[destr] Possible prototype pollution");
-			return JSON.parse(value, jsonParseTransform);
-		}
-		return JSON.parse(value);
-	} catch (error) {
-		if (options.strict) throw error;
-		return value;
-	}
-}
-//#endregion
-//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
-var FetchError = class extends Error {
-	constructor(message, opts) {
-		super(message, opts);
-		this.name = "FetchError";
-		if (opts?.cause && !this.cause) this.cause = opts.cause;
-	}
-};
-function createFetchError(ctx) {
-	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
-	const method = ctx.request?.method || ctx.options?.method || "GET";
-	const url = ctx.request?.url || String(ctx.request) || "/";
-	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
-	for (const key of [
-		"request",
-		"options",
-		"response"
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx[key];
-	} });
-	for (const [key, refKey] of [
-		["data", "_data"],
-		["status", "status"],
-		["statusCode", "status"],
-		["statusText", "statusText"],
-		["statusMessage", "statusText"]
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx.response && ctx.response[refKey];
-	} });
-	return fetchError;
-}
-const payloadMethods = new Set(Object.freeze([
-	"PATCH",
-	"POST",
-	"PUT",
-	"DELETE"
-]));
-function isPayloadMethod(method = "GET") {
-	return payloadMethods.has(method.toUpperCase());
-}
-function isJSONSerializable(value) {
-	if (value === void 0) return false;
-	const t = typeof value;
-	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
-	if (t !== "object") return false;
-	if (Array.isArray(value)) return true;
-	if (value.buffer) return false;
-	if (value instanceof FormData || value instanceof URLSearchParams) return false;
-	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
-}
-const textTypes = new Set([
-	"image/svg",
-	"application/xml",
-	"application/xhtml",
-	"application/html"
-]);
-const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
-function detectResponseType(_contentType = "") {
-	if (!_contentType) return "json";
-	const contentType = _contentType.split(";").shift() || "";
-	if (JSON_RE.test(contentType)) return "json";
-	if (contentType === "text/event-stream") return "stream";
-	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
-	return "blob";
-}
-function resolveFetchOptions(request, input, defaults, Headers) {
-	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
-	let query;
-	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
-		...defaults?.params,
-		...defaults?.query,
-		...input?.params,
-		...input?.query
-	};
-	return {
-		...defaults,
-		...input,
-		query,
-		params: query,
-		headers
-	};
-}
-function mergeHeaders(input, defaults, Headers) {
-	if (!defaults) return new Headers(input);
-	const headers = new Headers(defaults);
-	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
-	return headers;
-}
-async function callHooks(context, hooks) {
-	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
-	else await hooks(context);
-}
-const retryStatusCodes = new Set([
-	408,
-	409,
-	425,
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-const nullBodyResponses = new Set([
-	101,
-	204,
-	205,
-	304
-]);
-function createFetch(globalOptions = {}) {
-	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
-	async function onError(context) {
-		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
-		if (context.options.retry !== false && !isAbort) {
-			let retries;
-			if (typeof context.options.retry === "number") retries = context.options.retry;
-			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
-			const responseCode = context.response && context.response.status || 500;
-			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
-				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
-				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
-				return $fetchRaw(context.request, {
-					...context.options,
-					retry: retries - 1
-				});
-			}
-		}
-		const error = createFetchError(context);
-		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
-		throw error;
-	}
-	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
-		const context = {
-			request: _request,
-			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
-			response: void 0,
-			error: void 0
-		};
-		if (context.options.method) context.options.method = context.options.method.toUpperCase();
-		if (context.options.onRequest) {
-			await callHooks(context, context.options.onRequest);
-			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
-		}
-		if (typeof context.request === "string") {
-			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
-			if (context.options.query) {
-				context.request = withQuery(context.request, context.options.query);
-				delete context.options.query;
-			}
-			if ("query" in context.options) delete context.options.query;
-			if ("params" in context.options) delete context.options.params;
-		}
-		if (context.options.body && isPayloadMethod(context.options.method)) {
-			if (isJSONSerializable(context.options.body)) {
-				const contentType = context.options.headers.get("content-type");
-				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
-				if (!contentType) context.options.headers.set("content-type", "application/json");
-				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
-			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
-				if (!("duplex" in context.options)) context.options.duplex = "half";
-			}
-		}
-		let abortTimeout;
-		if (!context.options.signal && context.options.timeout) {
-			const controller = new AbortController();
-			abortTimeout = setTimeout(() => {
-				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
-				error.name = "TimeoutError";
-				error.code = 23;
-				controller.abort(error);
-			}, context.options.timeout);
-			context.options.signal = controller.signal;
-		}
-		try {
-			context.response = await fetch(context.request, context.options);
-		} catch (error) {
-			context.error = error;
-			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
-			return await onError(context);
-		} finally {
-			if (abortTimeout) clearTimeout(abortTimeout);
-		}
-		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
-			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
-			switch (responseType) {
-				case "json": {
-					const data = await context.response.text();
-					const parseFunction = context.options.parseResponse || destr;
-					context.response._data = parseFunction(data);
-					break;
-				}
-				case "stream":
-					context.response._data = context.response.body || context.response._bodyInit;
-					break;
-				default: context.response._data = await context.response[responseType]();
-			}
-		}
-		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
-		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
-			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
-			return await onError(context);
-		}
-		return context.response;
-	};
-	const $fetch = async function $fetch2(request, options) {
-		return (await $fetchRaw(request, options))._data;
-	};
-	$fetch.raw = $fetchRaw;
-	$fetch.native = (...args) => fetch(...args);
-	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
-		...globalOptions,
-		...customGlobalOptions,
-		defaults: {
-			...globalOptions.defaults,
-			...customGlobalOptions.defaults,
-			...defaultOptions
-		}
-	});
-	return $fetch;
+	switch (jwk.kty) {
+		case "AKP":
+			check(jwk.alg, "\"alg\" (Algorithm) Parameter");
+			check(jwk.pub, "\"pub\" (Public key) Parameter");
+			components = {
+				alg: jwk.alg,
+				kty: jwk.kty,
+				pub: jwk.pub
+			};
+			break;
+		case "EC":
+			check(jwk.crv, "\"crv\" (Curve) Parameter");
+			check(jwk.x, "\"x\" (X Coordinate) Parameter");
+			check(jwk.y, "\"y\" (Y Coordinate) Parameter");
+			components = {
+				crv: jwk.crv,
+				kty: jwk.kty,
+				x: jwk.x,
+				y: jwk.y
+			};
+			break;
+		case "OKP":
+			check(jwk.crv, "\"crv\" (Subtype of Key Pair) Parameter");
+			check(jwk.x, "\"x\" (Public Key) Parameter");
+			components = {
+				crv: jwk.crv,
+				kty: jwk.kty,
+				x: jwk.x
+			};
+			break;
+		case "RSA":
+			check(jwk.e, "\"e\" (Exponent) Parameter");
+			check(jwk.n, "\"n\" (Modulus) Parameter");
+			components = {
+				e: jwk.e,
+				kty: jwk.kty,
+				n: jwk.n
+			};
+			break;
+		case "oct":
+			check(jwk.k, "\"k\" (Key Value) Parameter");
+			components = {
+				k: jwk.k,
+				kty: jwk.kty
+			};
+			break;
+		default: throw new JOSENotSupported("\"kty\" (Key Type) Parameter missing or unsupported");
+	}
+	const data = encode$1(JSON.stringify(components));
+	return encode(await digest(digestAlgorithm, data));
 }
 //#endregion
-//#region src/http.ts
-const MAX_RESPONSE_BYTES = 64 * 1024;
-async function requestJson(url, options) {
-	return (await requestJsonResponse(url, options)).value;
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/decode_protected_header.js
+function decodeProtectedHeader(token) {
+	let protectedB64u;
+	if (typeof token === "string") {
+		const parts = token.split(".");
+		if (parts.length === 3 || parts.length === 5) [protectedB64u] = parts;
+	} else if (typeof token === "object" && token) if ("protected" in token) protectedB64u = token.protected;
+	else throw new TypeError("Token does not contain a Protected Header");
+	try {
+		if (typeof protectedB64u !== "string" || !protectedB64u) throw new Error();
+		const result = JSON.parse(decoder.decode(decode(protectedB64u)));
+		if (!isObject(result)) throw new Error();
+		return result;
+	} catch {
+		throw new TypeError("Invalid Token or Protected Header formatting");
+	}
 }
-async function requestJsonResponse(url, options) {
-	let response;
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/decode_jwt.js
+function decodeJwt(jwt) {
+	if (typeof jwt !== "string") throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
+	const { 1: payload, length } = jwt.split(".");
+	if (length === 5) throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
+	if (length !== 3) throw new JWTInvalid("Invalid JWT");
+	if (!payload) throw new JWTInvalid("JWTs must contain a payload");
+	let decoded;
 	try {
-		response = await createFetch({ fetch: options.fetch }).raw(url, {
-			method: options.method,
-			headers: options.headers,
-			body: options.body,
-			credentials: options.credentials ?? "include",
-			retry: 0,
-			timeout: options.timeoutMs,
-			redirect: "manual",
-			signal: options.signal,
-			responseType: "stream",
-			ignoreResponseError: true
-		});
+		decoded = decode(payload);
 	} catch {
-		throw authorityUnavailable();
+		throw new JWTInvalid("Failed to base64url decode the payload");
 	}
-	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
-		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes) : void 0;
-		await response.body?.cancel();
-		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
+	let result;
+	try {
+		result = JSON.parse(decoder.decode(decoded));
+	} catch {
+		throw new JWTInvalid("Failed to parse the decoded payload as JSON");
 	}
+	if (!isObject(result)) throw new JWTInvalid("Invalid JWT Claims Set");
+	return result;
+}
+//#endregion
+//#region src/organization-presence.ts
+const id$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+function presenceInput(input) {
+	if (!input || typeof input.applicationId !== "string" || !id$1.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => typeof value !== "string" || !id$1.test(value)) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Organization presence selection is invalid");
 	return {
-		value: await readJson(response, options.maxResponseBytes),
-		headers: response.headers
+		applicationId: input.applicationId,
+		userIds: [...input.userIds]
 	};
 }
-async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
-	const length = response.headers.get("content-length");
-	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
-		await response.body?.cancel();
-		throw authorityUnavailable();
-	}
-	if (!response.body) throw authorityUnavailable();
-	const reader = response.body.getReader();
-	const chunks = [];
-	let size = 0;
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			size += value.byteLength;
-			if (size > maximum) throw authorityUnavailable();
-			chunks.push(value);
-		}
-	} catch (error) {
-		await reader.cancel();
-		throw error;
-	} finally {
-		reader.releaseLock();
-	}
-	const bytes = new Uint8Array(size);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
+function presenceProofActor(token, applicationId) {
 	try {
-		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+		const claims = decodeJwt(token);
+		if (typeof claims.sub !== "string" || !id$1.test(claims.sub) || typeof claims.sid !== "string" || !id$1.test(claims.sid) || claims.app !== applicationId) throw new Error("Invalid projection");
+		return {
+			userId: claims.sub,
+			sessionId: claims.sid
+		};
 	} catch {
-		throw authorityUnavailable();
+		throw new TypeError("Organization presence credential is invalid");
 	}
 }
+function exact$4(value, keys) {
+	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function normalizePresence(value, organizationId, input, actor) {
+	if (!exact$4(value, [
+		"organizationId",
+		"applicationId",
+		"actor",
+		"userIds",
+		"checkedAt"
+	]) || value.organizationId !== organizationId || value.applicationId !== input.applicationId || !exact$4(value.actor, ["userId", "sessionId"]) || value.actor.userId !== actor.userId || value.actor.sessionId !== actor.sessionId || !Array.isArray(value.userIds) || value.userIds.length !== input.userIds.length || value.userIds.some((userId, index) => userId !== input.userIds[index]) || typeof value.checkedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(value.checkedAt) || Number.isNaN(Date.parse(value.checkedAt)) || new Date(value.checkedAt).toISOString() !== value.checkedAt) throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		organizationId,
+		applicationId: input.applicationId,
+		actor: { ...actor },
+		userIds: [...input.userIds],
+		checkedAt: new Date(value.checkedAt)
+	};
+}
+//#endregion
+//#region src/application-access.ts
+const id = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+function applicationAccessInput(input) {
+	if (!input || typeof input.applicationId !== "string" || !id.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => typeof value !== "string" || !id.test(value)) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Application access input is invalid");
+	return {
+		applicationId: input.applicationId,
+		userIds: [...input.userIds]
+	};
+}
+function exact$3(value, keys) {
+	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function normalizeApplicationAccess(value, userIds) {
+	const invalid = () => new AuthError("identity_authority_unavailable", 503);
+	if (!exact$3(value, ["members"]) || !Array.isArray(value.members) || value.members.length !== userIds.length) throw invalid();
+	return { members: value.members.map((member, index) => {
+		if (!exact$3(member, [
+			"userId",
+			"latestAppSessionAdmittedAt",
+			"activeAppSessionCount"
+		]) || member.userId !== userIds[index] || typeof member.activeAppSessionCount !== "number" || !Number.isSafeInteger(member.activeAppSessionCount) || member.activeAppSessionCount < 0 || member.latestAppSessionAdmittedAt !== null && (typeof member.latestAppSessionAdmittedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(member.latestAppSessionAdmittedAt) || Number.isNaN(Date.parse(member.latestAppSessionAdmittedAt)) || new Date(member.latestAppSessionAdmittedAt).toISOString() !== member.latestAppSessionAdmittedAt)) throw invalid();
+		return {
+			userId: member.userId,
+			latestAppSessionAdmittedAt: member.latestAppSessionAdmittedAt,
+			activeAppSessionCount: member.activeAppSessionCount
+		};
+	}) };
+}
+//#endregion
+//#region src/google-recovery.ts
+function object(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validTicket(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+function googleRecoveryInput(value, complete) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => key !== "token" && key !== "nonce") || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
+	const social = normalizeSocialIdTokenInput({
+		provider: "google",
+		idToken: value.idToken.token,
+		signUp: false,
+		...value.idToken.nonce === void 0 ? {} : { nonce: value.idToken.nonce }
+	});
+	return {
+		idToken: {
+			token: social.idToken,
+			...social.nonce === void 0 ? {} : { nonce: social.nonce }
+		},
+		...complete ? { recoveryToken: value.recoveryToken } : {}
+	};
+}
+function normalizeGoogleRecovery(value, now) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== "expiresAt,recoveryToken" || !validTicket(value.recoveryToken) || typeof value.expiresAt !== "string") throw authorityUnavailable();
+	const expiresAt = Date.parse(value.expiresAt);
+	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 10 * 6e4) throw authorityUnavailable();
+	return {
+		recoveryToken: value.recoveryToken,
+		expiresAt: value.expiresAt
+	};
+}
+function normalizeGoogleRecoveryCompletion(value) {
+	if (!object(value) || Object.keys(value).join(",") !== "linked" || value.linked !== true) throw authorityUnavailable();
+	return { linked: true };
+}
+function fromGoogleRecoveryError(value, status, retryAfter) {
+	const code = object(value) ? value.code : void 0;
+	if (status === 409 && code === "GOOGLE_RECOVERY_IN_PROGRESS") return new AuthError("google_recovery_in_progress", 409);
+	if (status === 409 && code === "GOOGLE_RECOVERY_NOT_REQUIRED") return new AuthError("google_recovery_not_required", 409);
+	if (status === 403 && code === "GOOGLE_RECOVERY_EMAIL_VERIFICATION_REQUIRED") return new AuthError("email_verification_required", 403);
+	if (status === 400 && code === "GOOGLE_RECOVERY_INVALID") return new AuthError("google_recovery_invalid", 400);
+	if (status === 410 && code === "GOOGLE_RECOVERY_EXPIRED") return new AuthError("google_recovery_expired", 410);
+	if (status === 403 && code === "GOOGLE_RECOVERY_ACCOUNT_MISMATCH") return new AuthError("google_recovery_account_mismatch", 403);
+	if (status === 401 && code === "GOOGLE_RECOVERY_FRESH_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 401);
+	if (code === "GOOGLE_RECOVERY_UNAVAILABLE") return authorityUnavailable();
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
+//#endregion
+//#region src/user-api/credential.ts
+function userApiApplication(input) {
+	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
+	return input.applicationId;
+}
+function normalizeUserApiCredential(value, startedAt) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
+	};
+}
 //#endregion
 //#region src/user-api/verifier.ts
 const ID = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
@@ -3064,8 +3357,8 @@ function createServerAuth(options) {
 			mapError: fromOrganizationMutationAuthorityError
 		});
 	}
-	async function organizationRead(path, input, normalize) {
-		const query = normalizeOrganizationPageInput(input);
+	async function organizationRead(path, input, normalize, queryInput = normalizeOrganizationPageInput) {
+		const query = queryInput(input);
 		return normalize(await requestJson(`${joinURL(authOrigin, "api/v1/auth/organizations", path)}${query.size ? `?${query}` : ""}`, {
 			fetch: fetchImpl,
 			timeoutMs,
@@ -3142,6 +3435,85 @@ function createServerAuth(options) {
 		getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async authorizeOrganizationPresence(organizationId, input, serviceAssertion, options) {
+			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Organization presence service assertion is invalid");
+			const organization = normalizeIdInput(organizationId);
+			const body = presenceInput(input);
+			let applicationCredential;
+			if (options !== void 0) {
+				const supplied = options?.applicationCredential;
+				if (typeof supplied !== "string" || supplied.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(supplied)) throw new TypeError("Organization presence credential is invalid");
+				applicationCredential = supplied;
+			} else {
+				const startedAt = now();
+				applicationCredential = normalizeUserApiCredential(await requestJson(joinURL(authOrigin, "api/v1/auth/user-api-credential"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "POST",
+					credentials,
+					headers: {
+						...authHeaders(),
+						"content-type": "application/json"
+					},
+					body: { applicationId: body.applicationId }
+				}), startedAt).token;
+			}
+			const actor = presenceProofActor(applicationCredential, body.applicationId);
+			return normalizePresence(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "presence/authorize"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				maxResponseBytes: 16 * 1024,
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json",
+					"x-finueva-application-credential": applicationCredential,
+					"x-finueva-service-assertion": serviceAssertion
+				},
+				body,
+				mapError: fromOrganizationReadAuthorityError
+			}), organization, body, actor);
+		},
+		async getOrganizationMemberApplicationAccess(organizationId, input, serviceAssertion, options) {
+			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Application access service assertion is invalid");
+			const organization = normalizeIdInput(organizationId);
+			const body = applicationAccessInput(input);
+			let applicationCredential;
+			if (options !== void 0) {
+				const supplied = options?.applicationCredential;
+				if (typeof supplied !== "string" || supplied.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(supplied)) throw new TypeError("Application access credential is invalid");
+				applicationCredential = supplied;
+			} else {
+				const startedAt = now();
+				applicationCredential = normalizeUserApiCredential(await requestJson(joinURL(authOrigin, "api/v1/auth/user-api-credential"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "POST",
+					credentials,
+					headers: {
+						...authHeaders(),
+						"content-type": "application/json"
+					},
+					body: { applicationId: body.applicationId }
+				}), startedAt).token;
+			}
+			return normalizeApplicationAccess(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "members/application-access"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				maxResponseBytes: 16 * 1024,
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json",
+					"x-finueva-application-credential": applicationCredential,
+					"x-finueva-service-assertion": serviceAssertion
+				},
+				body,
+				mapError: fromOrganizationReadAuthorityError
+			}), body.userIds);
+		},
 		async getOrganizationMemberAuthority(organizationId, memberId) {
 			const organization = normalizeIdInput(organizationId);
 			const member = normalizeIdInput(memberId);
@@ -3316,7 +3688,7 @@ function createServerAuth(options) {
 			}));
 		},
 		listOrganizationMembers(organizationId, input) {
-			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
+			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers, normalizeOrganizationMemberPageInput);
 		},
 		listOrganizationTeams(organizationId, input) {
 			return organizationRead(`${normalizeIdInput(organizationId)}/teams`, input, normalizeOrganizationTeams);
@@ -3481,4 +3853,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };
+export { AuthError, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };