@finueva/auth 0.32.0 → 0.34.0

package/dist/index.js

@@ -61,27 +61,149 @@ const messages = {
 	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
 	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
 	ceremony_return_refused: "The return address is not registered for this application.",
-	password_sign_in_required: "A password sign-in method is required for this passkey change."
+	password_sign_in_required: "A password sign-in method is required for this passkey change.",
+	account_deletion_pending: "This account is scheduled for deletion.",
+	account_restore_unavailable: "The restore ticket or link is used or expired, or the account is not scheduled for deletion."
 };
 var AuthError = class extends Error {
 	code;
 	status;
 	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
+	accountDeletion;
+	constructor(code, status, retryAfterSeconds, details) {
 		super(messages[code]);
 		this.name = "AuthError";
 		this.code = code;
 		this.status = status;
 		this.retryAfterSeconds = retryAfterSeconds;
+		if (details?.accountDeletion) this.accountDeletion = details.accountDeletion;
 	}
 };
 //#endregion
+//#region src/account-deletion.ts
+function isObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function authorityUnavailable$1() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+const idPattern$3 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const tokenPattern = /^[A-Za-z0-9_-]{43}$(?![\s\S])/;
+const idempotencyPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$(?![\s\S])/;
+const MAX_SOLE_ORGANIZATIONS = 20;
+const MAX_BLOCKING_ORGANIZATIONS = 100;
+const organizationBlockers = new Set(["owner_with_members", "enterprise_connection"]);
+const accountBlockers = new Set(["managed_account", "platform_role"]);
+const stepUps = new Set([
+	"recent_sign_in",
+	"password",
+	"sign_in_again"
+]);
+function exact$5(value, keys) {
+	return isObject$1(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
+}
+function isoDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable$1();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable$1();
+	return parsed;
+}
+function organization(value, keys) {
+	if (!exact$5(value, keys) || typeof value.id !== "string" || !idPattern$3.test(value.id) || typeof value.name !== "string" || value.name.length === 0 || value.name.length > 255 || value.slug !== null && (typeof value.slug !== "string" || value.slug.length === 0 || value.slug.length > 255)) throw authorityUnavailable$1();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
+function normalizeAccountDeletionStartRequest(value) {
+	if (!isObject$1(value) || typeof value.idempotencyKey !== "string" || !idempotencyPattern.test(value.idempotencyKey)) throw new TypeError("idempotencyKey is invalid");
+	const ids = value.soleOrganizationIds;
+	if (!Array.isArray(ids) || ids.length > MAX_SOLE_ORGANIZATIONS || !ids.every((id) => {
+		return typeof id === "string" && idPattern$3.test(id);
+	})) throw new TypeError("soleOrganizationIds is invalid");
+	return {
+		idempotencyKey: value.idempotencyKey,
+		soleOrganizationIds: [...ids]
+	};
+}
+function normalizeAccountDeletionEligibility(value) {
+	if (!exact$5(value, [
+		"accountBlocker",
+		"blockingOrganizations",
+		"deleteAfter",
+		"eligible",
+		"soleOrganizations",
+		"stepUp"
+	]) || typeof value.eligible !== "boolean" || value.accountBlocker !== null && !accountBlockers.has(value.accountBlocker) || !Array.isArray(value.blockingOrganizations) || value.blockingOrganizations.length > MAX_BLOCKING_ORGANIZATIONS || !Array.isArray(value.soleOrganizations) || value.soleOrganizations.length > MAX_SOLE_ORGANIZATIONS || !stepUps.has(value.stepUp)) throw authorityUnavailable$1();
+	const blockingOrganizations = value.blockingOrganizations.map((entry) => {
+		const summary = organization(entry, [
+			"id",
+			"name",
+			"reason",
+			"slug"
+		]);
+		const reason = entry.reason;
+		if (!organizationBlockers.has(reason)) throw authorityUnavailable$1();
+		return {
+			...summary,
+			reason
+		};
+	});
+	return {
+		eligible: value.eligible,
+		accountBlocker: value.accountBlocker,
+		blockingOrganizations,
+		soleOrganizations: value.soleOrganizations.map((entry) => {
+			return organization(entry, [
+				"id",
+				"name",
+				"slug"
+			]);
+		}),
+		stepUp: value.stepUp,
+		deleteAfter: isoDate(value.deleteAfter)
+	};
+}
+function normalizeAccountDeletionRestoreInput(value) {
+	if (exact$5(value, ["restoreTicket"]) && typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket)) return { restoreTicket: value.restoreTicket };
+	if (exact$5(value, ["restoreLinkToken"]) && typeof value.restoreLinkToken === "string" && tokenPattern.test(value.restoreLinkToken)) return { restoreLinkToken: value.restoreLinkToken };
+	throw new TypeError("restore input is invalid");
+}
+function normalizeAccountDeletionRestore(value) {
+	if (!exact$5(value, ["status"]) || value.status !== "restored") throw authorityUnavailable$1();
+}
+function accountDeletionPending(value, status) {
+	if (status !== 403 || !isObject$1(value) || value.code !== "ACCOUNT_DELETION_PENDING") return null;
+	let deleteAfter;
+	try {
+		deleteAfter = isoDate(value.deleteAfter);
+	} catch {
+		return null;
+	}
+	const restoreTicket = typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket) ? value.restoreTicket : null;
+	return {
+		deleteAfter,
+		restoreTicket
+	};
+}
+function fromAccountDeletionError(value, status) {
+	const code = isObject$1(value) ? value.code : void 0;
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404 && code === "RESTORE_UNAVAILABLE") return new AuthError("account_restore_unavailable", 404);
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	return authorityUnavailable$1();
+}
+//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
 const passwordResetToken = /^[A-Za-z0-9_-]{1,512}$/;
-const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+const MAX_SOCIAL_ID_TOKEN_BYTES = 16384;
 function normalizeEmail(value) {
 	if (typeof value !== "string") throw new TypeError("email is invalid");
 	const normalized = value.trim().toLowerCase();
@@ -95,7 +217,9 @@ function normalizePassword(value, name = "password", minLength = 8) {
 function normalizeSocialIdTokenInput(value) {
 	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
 	const keys = Object.keys(value);
-	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
+	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => {
+		return key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp";
+	}) || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
 	return {
 		provider: value.provider,
 		idToken: value.idToken,
@@ -122,7 +246,9 @@ function normalizeName(value) {
 function normalizeProfileInput(value) {
 	if (!isObject(value)) throw new TypeError("profile input is invalid");
 	const keys = Object.keys(value);
-	if (keys.length === 0 || keys.length > 2 || keys.some((key) => key !== "name" && key !== "image") || value.name === void 0 && value.image === void 0) throw new TypeError("profile input is invalid");
+	if (keys.length === 0 || keys.length > 2 || keys.some((key) => {
+		return key !== "name" && key !== "image";
+	}) || value.name === void 0 && value.image === void 0) throw new TypeError("profile input is invalid");
 	const result = {};
 	if (value.name !== void 0) result.name = normalizeName(value.name);
 	if (value.image !== void 0) result.image = value.image === null ? null : normalizeProfileImage(value.image);
@@ -143,7 +269,15 @@ function normalizeSameAppURL(value, appOrigin, name) {
 	if (url.origin !== appOrigin || url.username || url.password || url.toString() !== value) throw new TypeError(`${name} must belong to appOrigin`);
 	return value;
 }
-function normalizeOrigin(value, name) {
+function isPrivateIpv4(hostname) {
+	const parts = hostname.split(".").map(Number);
+	if (parts.length !== 4 || parts.some((part) => {
+		return !Number.isInteger(part) || part < 0 || part > 255;
+	})) return false;
+	const [first, second] = parts;
+	return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+}
+function normalizeOrigin(value, name, allowPrivateNetwork = false) {
 	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	let url;
 	try {
@@ -152,7 +286,7 @@ function normalizeOrigin(value, name) {
 		throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	}
 	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
-	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	if (url.protocol !== "https:" && !((local || allowPrivateNetwork && isPrivateIpv4(url.hostname)) && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	return url.origin;
 }
 function normalizeTimeout(value) {
@@ -179,7 +313,7 @@ function normalizeSession(value) {
 	};
 }
 function normalizeDriveCredential(value, now) {
-	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
+	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16384) throw authorityUnavailable();
 	return {
 		tokenType: "Bearer",
 		token: value.token,
@@ -188,7 +322,9 @@ function normalizeDriveCredential(value, now) {
 }
 function normalizeOrganizationPageInput(value) {
 	if (value === void 0) return new URLSearchParams();
-	if (!isObject(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
+	if (!isObject(value) || Object.keys(value).some((key) => {
+		return key !== "limit" && key !== "cursor";
+	})) throw new AuthError("invalid_request", 400);
 	const input = value;
 	const query = new URLSearchParams();
 	if (input.limit !== void 0) {
@@ -203,17 +339,23 @@ function normalizeOrganizationPageInput(value) {
 }
 function normalizeOrganizationMemberPageInput(value) {
 	if (value === void 0) return new URLSearchParams();
-	if (!isObject(value) || Object.keys(value).some((key) => ![
-		"limit",
-		"cursor",
-		"search"
-	].includes(key))) throw new AuthError("invalid_request", 400);
+	if (!isObject(value) || Object.keys(value).some((key) => {
+		return ![
+			"limit",
+			"cursor",
+			"search"
+		].includes(key);
+	})) throw new AuthError("invalid_request", 400);
 	const { search, ...page } = value;
 	const query = normalizeOrganizationPageInput(page);
 	if (search !== void 0) {
 		if (typeof search !== "string") throw new AuthError("invalid_request", 400);
-		const prefix = search.trim().replace(/[A-Z]/g, (character) => character.toLowerCase());
-		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new AuthError("invalid_request", 400);
+		const prefix = search.trim().replace(/[A-Z]/g, (character) => {
+			return character.toLowerCase();
+		});
+		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => {
+			return character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127;
+		})) throw new AuthError("invalid_request", 400);
 		query.set("search", prefix);
 	}
 	return query;
@@ -333,7 +475,9 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 		throw new AuthError("invalid_request", 400);
 	}
 	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
-	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	const teamIds = value.teamIds?.map((teamId) => {
+		return normalizeIdInput(teamId);
+	});
 	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
 	return {
 		email: normalizedEmail,
@@ -409,10 +553,16 @@ function normalizeSuspendedOrganizationMembers(value) {
 				email: member.email,
 				image: nullableHttpsUrl(member.image),
 				role: member.role,
-				teamIds: unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item),
+				teamIds: unique(member.teamIds.map((teamId) => {
+					return normalizeResponseId(teamId);
+				}), (item) => {
+					return item;
+				}),
 				suspendedAt: responseDate(member.suspendedAt)
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -438,7 +588,9 @@ function normalizeDepartedOrganizationMembers(value) {
 				departure: member.departure,
 				departedAt: responseDate(member.departedAt)
 			};
-		}), (item) => item.userId),
+		}), (item) => {
+			return item.userId;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -470,7 +622,9 @@ function normalizeOrganizations(value) {
 	exact$4(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
-		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
+		organizations: unique(value.organizations.map(normalizeOrganization), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -491,7 +645,11 @@ function normalizeOrganizationMembers(value) {
 				"userId"
 			]);
 			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
-			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
+			const teamIds = unique(member.teamIds.map((teamId) => {
+				return normalizeResponseId(teamId);
+			}), (item) => {
+				return item;
+			});
 			return {
 				id: member.id,
 				userId: member.userId,
@@ -503,7 +661,9 @@ function normalizeOrganizationMembers(value) {
 				joinedAt: responseDate(member.joinedAt),
 				teamIds
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -525,7 +685,9 @@ function normalizeOrganizationTeams(value) {
 				category: team.category,
 				createdAt: responseDate(team.createdAt)
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -533,7 +695,11 @@ function normalizeOrganizationTeamMembers(value) {
 	exact$4(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
-		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
+		memberIds: unique(value.memberIds.map((item) => {
+			return normalizeResponseId(item);
+		}), (item) => {
+			return item;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -555,7 +721,9 @@ function normalizeOrganizationInvitation(value) {
 		id: value.id,
 		email: value.email,
 		role: value.role,
-		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
+		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => {
+			return item;
+		}),
 		inviter: {
 			membershipId: value.inviter.membershipId,
 			name: value.inviter.name
@@ -569,7 +737,9 @@ function normalizeOrganizationInvitations(value) {
 	exact$4(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
-		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
+		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -606,7 +776,9 @@ function normalizeReceivedInvitation(value) {
 				id: team.id,
 				name: team.name
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		inviterName: value.inviterName,
 		expiresAt: responseDate(value.expiresAt)
 	};
@@ -615,7 +787,9 @@ function normalizeReceivedInvitations(value) {
 	exact$4(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
-		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
+		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -661,6 +835,8 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 }
 function fromAccountAuthorityError(value, status, retryAfter) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	const pendingDeletion = accountDeletionPending(value, status);
+	if (pendingDeletion) return new AuthError("account_deletion_pending", 403, void 0, { accountDeletion: pendingDeletion });
 	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
 	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
 	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
@@ -737,7 +913,7 @@ function normalizeOrganizationClosureCancelInput(value) {
 function closureWindow(value) {
 	const startedAt = responseDate(value.startedAt);
 	const cancelUntil = responseDate(value.cancelUntil);
-	if (cancelUntil.getTime() - startedAt.getTime() !== 720 * 60 * 60 * 1e3 || typeof value.canCancel !== "boolean") throw authorityUnavailable();
+	if (cancelUntil.getTime() - startedAt.getTime() !== 2592e6 || typeof value.canCancel !== "boolean") throw authorityUnavailable();
 	return {
 		startedAt: startedAt.toISOString(),
 		cancelUntil: cancelUntil.toISOString(),
@@ -780,12 +956,16 @@ function normalizeClosingOrganizations(value) {
 			slug: item.slug,
 			...closureWindow(item)
 		};
-	}), (item) => item.id) };
+	}), (item) => {
+		return item.id;
+	}) };
 }
 function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== "changeReference,expectedGlobalRevision,expectedTargetRevision,idempotencyKey,reasonCategory,requestedRoles,targetUserId") throw new TypeError("recent authentication input is invalid");
 	if (!isId(value.targetUserId)) throw new TypeError("targetUserId is invalid");
-	if (!Array.isArray(value.requestedRoles) || value.requestedRoles.length < 1 || value.requestedRoles.length > 2 || value.requestedRoles.some((role) => role !== "administrator" && role !== "investigator") || new Set(value.requestedRoles).size !== value.requestedRoles.length) throw new TypeError("requestedRoles is invalid");
+	if (!Array.isArray(value.requestedRoles) || value.requestedRoles.length < 1 || value.requestedRoles.length > 2 || value.requestedRoles.some((role) => {
+		return role !== "administrator" && role !== "investigator";
+	}) || new Set(value.requestedRoles).size !== value.requestedRoles.length) throw new TypeError("requestedRoles is invalid");
 	for (const field of ["expectedTargetRevision", "expectedGlobalRevision"]) if (!Number.isSafeInteger(value[field]) || value[field] < 0 || value[field] >= Number.MAX_SAFE_INTEGER) throw new TypeError(`${field} is invalid`);
 	if (!(typeof value.reasonCategory === "string" && [
 		"initial_bootstrap",
@@ -1081,7 +1261,7 @@ function mapError(code, status) {
 	};
 }
 function parseRetryAfter(value) {
-	if (!value || !/^\d+$/.test(value)) return void 0;
+	if (!value || !/^\d+$/.test(value)) return;
 	const seconds = Number(value);
 	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
 }
@@ -1146,7 +1326,7 @@ function unique(items, key) {
 }
 function credentialSessionId(token) {
 	const parts = token.split(".");
-	if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return void 0;
+	if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return;
 	try {
 		const base64 = parts[1].replaceAll("-", "+").replaceAll("_", "/");
 		const decoded = atob(base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "="));
@@ -1165,7 +1345,9 @@ function record(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function exact$3(value, keys) {
-	return record(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return record(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function directoryId(value) {
 	return typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(value);
@@ -1230,7 +1412,7 @@ function normalizeRegisteredOrganizationApplication(value, organizationId, appli
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -1437,7 +1619,7 @@ let onMount = ($store, initialize) => {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/equality.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/equality.mjs
 function isPlainObject$1(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const prototype = Object.getPrototypeOf(value);
@@ -1465,7 +1647,7 @@ function withEquality(store, isEqual) {
 	});
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = new Set();
@@ -1494,7 +1676,7 @@ function getGlobalFocusManager() {
 	return globalThis[kFocusManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = new Set();
@@ -1526,7 +1708,7 @@ function getGlobalOnlineManager() {
 	return globalThis[kOnlineManager];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -1595,7 +1777,7 @@ function parseJSON(value, options = { strict: true }) {
 	return betterJSONParse(value, options);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/query.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/query.mjs
 const isServer$1 = () => typeof window === "undefined";
 function isAuthQueryStateEqual(a, b) {
 	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
@@ -1698,7 +1880,7 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 	return value;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 const FOCUS_REFETCH_RATE_LIMIT_SECONDS = 5;
 function createSessionRefreshManager(opts) {
@@ -1822,7 +2004,7 @@ function createSessionRefreshManager(opts) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_17975d57218030f5a353914665f207d6/node_modules/@better-auth/core/dist/env/env-impl.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_a77e2cbc2dff6985c9110d681072429e/node_modules/@better-auth/core/dist/env/env-impl.mjs
 const _envShim = Object.create(null);
 const _getEnv = (useShim) => globalThis.process?.env || globalThis.Deno?.env.toObject() || globalThis.__env__ || (useShim ? _envShim : globalThis);
 const env = new Proxy(_envShim, {
@@ -1879,7 +2061,7 @@ Object.freeze({
 	}
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_17975d57218030f5a353914665f207d6/node_modules/@better-auth/core/dist/utils/error-codes.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_a77e2cbc2dff6985c9110d681072429e/node_modules/@better-auth/core/dist/utils/error-codes.mjs
 function defineErrorCodes(codes) {
 	return Object.fromEntries(Object.entries(codes).map(([key, value]) => [key, {
 		code: key,
@@ -1888,7 +2070,7 @@ function defineErrorCodes(codes) {
 	}]));
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.4.3/node_modules/better-call/dist/error.mjs
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.6.7/node_modules/better-call/dist/error.mjs
 function isErrorStackTraceLimitWritable() {
 	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
 	if (desc === void 0) return Object.isExtensible(Error);
@@ -1994,7 +2176,7 @@ var InternalAPIError = class extends Error {
 };
 makeErrorForHideStackFrame(InternalAPIError, Error);
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_17975d57218030f5a353914665f207d6/node_modules/@better-auth/core/dist/error/index.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_a77e2cbc2dff6985c9110d681072429e/node_modules/@better-auth/core/dist/error/index.mjs
 var BetterAuthError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -2004,7 +2186,7 @@ var BetterAuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/utils/url.mjs
 const SLASH_CHAR_CODE = "/".charCodeAt(0);
 function trimTrailingSlashes(value) {
 	let end = value.length;
@@ -2082,7 +2264,7 @@ function getOrigin(url) {
 	}
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_17975d57218030f5a353914665f207d6/node_modules/@better-auth/core/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_a77e2cbc2dff6985c9110d681072429e/node_modules/@better-auth/core/dist/utils/url.mjs
 const DANGEROUS_URL_SCHEMES = [
 	"javascript:",
 	"data:",
@@ -2098,7 +2280,7 @@ function isSafeUrlScheme(value) {
 	return !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
@@ -2113,7 +2295,7 @@ const redirectPlugin = {
 	} }
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/session-atom.mjs
 const isServer = () => typeof window === "undefined";
 function normalizeSessionResponse(res) {
 	if (typeof res === "object" && res !== null && "data" in res && "error" in res) return res;
@@ -2652,13 +2834,15 @@ function getURL2(url, option) {
 		queryParams.set(key, serializedValue);
 	}
 	const pathParams = new Map();
-	if (params) if (Array.isArray(params)) {
-		const paramPaths = path.split("/").filter((p) => p.startsWith(":"));
-		for (const [index, key] of paramPaths.entries()) {
-			const value = params[index];
-			pathParams.set(key, String(value));
-		}
-	} else for (const [key, value] of Object.entries(params)) pathParams.set(`:${key}`, String(value));
+	if (params) {
+		if (Array.isArray(params)) {
+			const paramPaths = path.split("/").filter((p) => p.startsWith(":"));
+			for (const [index, key] of paramPaths.entries()) {
+				const value = params[index];
+				pathParams.set(key, String(value));
+			}
+		} else for (const [key, value] of Object.entries(params)) pathParams.set(`:${key}`, String(value));
+	}
 	path = path.split("/").map((segment) => encodePathSegment(segment, pathParams)).join("/");
 	path = path.replace(/^\/+/, "");
 	let queryParamString = queryParams.toString();
@@ -2761,7 +2945,7 @@ var betterFetch = async (url, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -2859,12 +3043,12 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_17975d57218030f5a353914665f207d6/node_modules/@better-auth/core/dist/utils/string.mjs
+//#region ../../node_modules/.pnpm/@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-fetch+fetch@1.3.1_better-call_a77e2cbc2dff6985c9110d681072429e/node_modules/@better-auth/core/dist/utils/string.mjs
 function capitalizeFirstLetter(str) {
 	return str.charAt(0).toUpperCase() + str.slice(1);
 }
@@ -2877,7 +3061,7 @@ function toKebabCase(input) {
 	return splitWords(input).map((word) => word.toLowerCase()).join("-");
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -2946,7 +3130,7 @@ function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomLis
 	return createProxy();
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.10_drizzle-orm@0.45.2_@libsql+client@0.17.4_kysely@_fc032d4b6d0d0a5be5267474da10b212/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.6.22_drizzle-kit@0.31.11_drizzle-orm@0.45.4_@libsql+client@0.17.4_kysely@_da7fa90773149f2e7e31ce000ac5bb37/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient$1(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -2959,7 +3143,7 @@ function createAuthClient$1(options) {
 	}, $fetch, pluginPathMethods, pluginsAtoms, atomListeners);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.22_@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-f_9dcb641568b0468b4b3f2fd37291240f/node_modules/@better-auth/passkey/dist/version-uW-pDlTC.mjs
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.22_@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-f_8db206d544b09d03eee70498f68bff74/node_modules/@better-auth/passkey/dist/version-uW-pDlTC.mjs
 const PASSKEY_ERROR_CODES = defineErrorCodes({
 	CHALLENGE_NOT_FOUND: "Challenge not found",
 	YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
@@ -3315,7 +3499,7 @@ async function startAuthentication(options) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.22_@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-f_9dcb641568b0468b4b3f2fd37291240f/node_modules/@better-auth/passkey/dist/client.mjs
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.6.22_@better-auth+core@1.6.22_@better-auth+utils@0.4.2_@better-f_8db206d544b09d03eee70498f68bff74/node_modules/@better-auth/passkey/dist/client.mjs
 const getPasskeyActions = ($fetch, { $listPasskeys, $store }) => {
 	const signInPasskey = async (opts, options) => {
 		const response = await $fetch("/passkey/generate-authenticate-options", {
@@ -3503,7 +3687,7 @@ const passkeyClient = () => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.1_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_80fa16dd1813631ddeb36d2ee29b8660/node_modules/@chiballc/utils/dist/index.mjs
+//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.1_@hono+zod-openapi@1.6.3_hono@4.13.14_zod@4.6.7__hono@4.13.14_magi_47a03f1f8de0b7557e1d609897e1fe54/node_modules/@chiballc/utils/dist/index.mjs
 function isPromise(arg) {
 	return arg && typeof arg.then === "function";
 }
@@ -3876,8 +4060,10 @@ function mergeHeaders(input, defaults, Headers) {
 	return headers;
 }
 async function callHooks(context, hooks) {
-	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
-	else await hooks(context);
+	if (hooks) {
+		if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+		else await hooks(context);
+	}
 }
 const retryStatusCodes = new Set([
 	408,
@@ -4008,7 +4194,7 @@ function createFetch(globalOptions = {}) {
 }
 //#endregion
 //#region src/http.ts
-const MAX_RESPONSE_BYTES = 64 * 1024;
+const MAX_RESPONSE_BYTES = 65536;
 async function requestJson(url, options) {
 	return (await requestJsonResponse(url, options)).value;
 }
@@ -4034,7 +4220,7 @@ async function requestJsonResponse(url, options) {
 	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
 		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes, options.signal) : void 0;
-		response.body?.cancel().catch(() => void 0);
+		response.body?.cancel().catch(() => {});
 		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
 	return {
@@ -4045,17 +4231,17 @@ async function requestJsonResponse(url, options) {
 async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 	const length = response.headers.get("content-length");
 	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
-		response.body?.cancel().catch(() => void 0);
+		response.body?.cancel().catch(() => {});
 		throw authorityUnavailable();
 	}
 	if (!response.body) throw authorityUnavailable();
 	if (signal?.aborted) {
-		response.body.cancel().catch(() => void 0);
+		response.body.cancel().catch(() => {});
 		throw authorityUnavailable();
 	}
 	const reader = response.body.getReader();
 	const cancel = () => {
-		reader.cancel().catch(() => void 0);
+		reader.cancel().catch(() => {});
 	};
 	signal?.addEventListener("abort", cancel, { once: true });
 	const chunks = [];
@@ -4070,7 +4256,7 @@ async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 			chunks.push(value);
 		}
 	} catch (error) {
-		reader.cancel().catch(() => void 0);
+		reader.cancel().catch(() => {});
 		throw error;
 	} finally {
 		signal?.removeEventListener("abort", cancel);
@@ -4089,7 +4275,7 @@ async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 	}
 }
 //#endregion
-//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/dist/shared/unstorage.zVDD2mZo.mjs
+//#region ../../node_modules/.pnpm/unstorage@1.17.6/node_modules/unstorage/dist/shared/unstorage.lWbgcyKt.mjs
 function wrapToPromise(value) {
 	if (!value || typeof value.then !== "function") return Promise.resolve(value);
 	return value;
@@ -4137,6 +4323,9 @@ function normalizeKey$1(key) {
 	if (!key) return "";
 	return key.split("?")[0]?.replace(/[/\\]/g, ":").replace(/:+/g, ":").replace(/^:|:$/g, "") || "";
 }
+function hasDotSegment(key) {
+	return key.split(":").some((segment) => segment === "." || segment === "..");
+}
 function joinKeys(...keys) {
 	return normalizeKey$1(keys.join(":"));
 }
@@ -4159,7 +4348,7 @@ function filterKeyByBase(key, base) {
 	return key[key.length - 1] !== "$";
 }
 //#endregion
-//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/dist/index.mjs
+//#region ../../node_modules/.pnpm/unstorage@1.17.6/node_modules/unstorage/dist/index.mjs
 function defineDriver$1(factory) {
 	return factory;
 }
@@ -4206,6 +4395,16 @@ function createStorage(options = {}) {
 		watchListeners: [],
 		unwatch: {}
 	};
+	const normalizeItemKey = (key) => {
+		const normalizedKey = normalizeKey$1(key);
+		if (!normalizedKey || hasDotSegment(normalizedKey)) throw new Error(`[unstorage] Invalid key: ${JSON.stringify(key)}`);
+		return normalizedKey;
+	};
+	const normalizeBase = (base) => {
+		const normalizedBase = normalizeBaseKey(base);
+		if (hasDotSegment(normalizedBase)) throw new Error(`[unstorage] Invalid base: ${JSON.stringify(base)}`);
+		return normalizedBase;
+	};
 	const getMount = (key) => {
 		for (const base of context.mountpoints) if (key.startsWith(base)) return {
 			base,
@@ -4257,7 +4456,7 @@ function createStorage(options = {}) {
 		};
 		for (const item of items) {
 			const isStringItem = typeof item === "string";
-			const key = normalizeKey$1(isStringItem ? item : item.key);
+			const key = normalizeItemKey(isStringItem ? item : item.key);
 			const value = isStringItem ? void 0 : item.value;
 			const options2 = isStringItem || !item.options ? commonOptions : {
 				...commonOptions,
@@ -4274,17 +4473,17 @@ function createStorage(options = {}) {
 		return Promise.all([...batches.values()].map((batch) => cb(batch))).then((r) => r.flat());
 	};
 	const storage = {
-		hasItem(key, opts = {}) {
-			key = normalizeKey$1(key);
+		async hasItem(key, opts = {}) {
+			key = normalizeItemKey(key);
 			const { relativeKey, driver } = getMount(key);
 			return asyncCall(driver.hasItem, relativeKey, opts);
 		},
-		getItem(key, opts = {}) {
-			key = normalizeKey$1(key);
+		async getItem(key, opts = {}) {
+			key = normalizeItemKey(key);
 			const { relativeKey, driver } = getMount(key);
 			return asyncCall(driver.getItem, relativeKey, opts).then((value) => destr(value));
 		},
-		getItems(items, commonOptions = {}) {
+		async getItems(items, commonOptions = {}) {
 			return runBatch(items, commonOptions, (batch) => {
 				if (batch.driver.getItems) return asyncCall(batch.driver.getItems, batch.items.map((item) => ({
 					key: item.relativeKey,
@@ -4301,15 +4500,15 @@ function createStorage(options = {}) {
 				}));
 			});
 		},
-		getItemRaw(key, opts = {}) {
-			key = normalizeKey$1(key);
+		async getItemRaw(key, opts = {}) {
+			key = normalizeItemKey(key);
 			const { relativeKey, driver } = getMount(key);
 			if (driver.getItemRaw) return asyncCall(driver.getItemRaw, relativeKey, opts);
 			return asyncCall(driver.getItem, relativeKey, opts).then((value) => deserializeRaw(value));
 		},
 		async setItem(key, value, opts = {}) {
 			if (value === void 0) return storage.removeItem(key);
-			key = normalizeKey$1(key);
+			key = normalizeItemKey(key);
 			const { relativeKey, driver } = getMount(key);
 			if (!driver.setItem) return;
 			await asyncCall(driver.setItem, relativeKey, stringify(value), opts);
@@ -4330,7 +4529,7 @@ function createStorage(options = {}) {
 		},
 		async setItemRaw(key, value, opts = {}) {
 			if (value === void 0) return storage.removeItem(key, opts);
-			key = normalizeKey$1(key);
+			key = normalizeItemKey(key);
 			const { relativeKey, driver } = getMount(key);
 			if (driver.setItemRaw) await asyncCall(driver.setItemRaw, relativeKey, value, opts);
 			else if (driver.setItem) await asyncCall(driver.setItem, relativeKey, serializeRaw(value), opts);
@@ -4339,7 +4538,7 @@ function createStorage(options = {}) {
 		},
 		async removeItem(key, opts = {}) {
 			if (typeof opts === "boolean") opts = { removeMeta: opts };
-			key = normalizeKey$1(key);
+			key = normalizeItemKey(key);
 			const { relativeKey, driver } = getMount(key);
 			if (!driver.removeItem) return;
 			await asyncCall(driver.removeItem, relativeKey, opts);
@@ -4348,7 +4547,7 @@ function createStorage(options = {}) {
 		},
 		async getMeta(key, opts = {}) {
 			if (typeof opts === "boolean") opts = { nativeOnly: opts };
-			key = normalizeKey$1(key);
+			key = normalizeItemKey(key);
 			const { relativeKey, driver } = getMount(key);
 			const meta = Object.create(null);
 			if (driver.getMeta) Object.assign(meta, await asyncCall(driver.getMeta, relativeKey, opts));
@@ -4362,14 +4561,14 @@ function createStorage(options = {}) {
 			}
 			return meta;
 		},
-		setMeta(key, value, opts = {}) {
-			return this.setItem(key + "$", value, opts);
+		async setMeta(key, value, opts = {}) {
+			return this.setItem(normalizeItemKey(key) + "$", value, opts);
 		},
-		removeMeta(key, opts = {}) {
-			return this.removeItem(key + "$", opts);
+		async removeMeta(key, opts = {}) {
+			return this.removeItem(normalizeItemKey(key) + "$", opts);
 		},
 		async getKeys(base, opts = {}) {
-			base = normalizeBaseKey(base);
+			base = normalizeBase(base);
 			const mounts = getMounts(base, true);
 			let maskedMounts = [];
 			const allKeys = [];
@@ -4387,7 +4586,7 @@ function createStorage(options = {}) {
 			return allKeys.filter((key) => (!shouldFilterByDepth || filterKeyByDepth(key, opts.maxDepth)) && filterKeyByBase(key, base));
 		},
 		async clear(base, opts = {}) {
-			base = normalizeBaseKey(base);
+			base = normalizeBase(base);
 			await Promise.all(getMounts(base, false).map(async (m) => {
 				if (m.driver.clear) return asyncCall(m.driver.clear, m.relativeBase, opts);
 				if (m.driver.removeItem) {
@@ -4412,7 +4611,7 @@ function createStorage(options = {}) {
 			await stopWatch();
 		},
 		mount(base, driver) {
-			base = normalizeBaseKey(base);
+			base = normalizeBase(base);
 			if (base && context.mounts[base]) throw new Error(`already mounted at ${base}`);
 			if (base) {
 				context.mountpoints.push(base);
@@ -4466,7 +4665,7 @@ async function dispose(driver) {
 	if (typeof driver.dispose === "function") await asyncCall(driver.dispose);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/drivers/utils/index.mjs
+//#region ../../node_modules/.pnpm/unstorage@1.17.6/node_modules/unstorage/drivers/utils/index.mjs
 function defineDriver(factory) {
 	return factory;
 }
@@ -4485,7 +4684,7 @@ function createRequiredError(driver, name) {
 }
 var init_utils = __esmMin((() => {}));
 //#endregion
-//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/drivers/memory.mjs
+//#region ../../node_modules/.pnpm/unstorage@1.17.6/node_modules/unstorage/drivers/memory.mjs
 var memory_exports = __exportAll({ default: () => memory_default });
 var DRIVER_NAME$2, memory_default;
 var init_memory = __esmMin((() => {
@@ -4527,7 +4726,7 @@ var init_memory = __esmMin((() => {
 	});
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/drivers/localstorage.mjs
+//#region ../../node_modules/.pnpm/unstorage@1.17.6/node_modules/unstorage/drivers/localstorage.mjs
 var localstorage_exports = __exportAll({ default: () => localstorage_default });
 var DRIVER_NAME$1, localstorage_default;
 var init_localstorage = __esmMin((() => {
@@ -4584,7 +4783,7 @@ var init_localstorage = __esmMin((() => {
 	});
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/unstorage@1.17.5/node_modules/unstorage/drivers/session-storage.mjs
+//#region ../../node_modules/.pnpm/unstorage@1.17.6/node_modules/unstorage/drivers/session-storage.mjs
 var session_storage_exports = __exportAll({ default: () => session_storage_default });
 var DRIVER_NAME, session_storage_default;
 var init_session_storage = __esmMin((() => {
@@ -4604,8 +4803,8 @@ var init_session_storage = __esmMin((() => {
 //#endregion
 //#region src/persistence.ts
 const KEY = "finueva-auth:session:v1";
-const MAX_SNAPSHOT_BYTES = 16 * 1024;
-const MAX_FUTURE_SKEW_MS = 300 * 1e3;
+const MAX_SNAPSHOT_BYTES = 16384;
+const MAX_FUTURE_SKEW_MS = 3e5;
 function createSessionPersistence(persistence, authOrigin, now, timeoutMs) {
 	validatePersistence(persistence);
 	const storageCache = {};
@@ -4630,7 +4829,9 @@ function createSessionPersistence(persistence, authOrigin, now, timeoutMs) {
 		let timeout;
 		try {
 			await Promise.race([work, new Promise((_, reject) => {
-				timeout = setTimeout(() => reject(new Error("persistence timeout")), operationTimeoutMs);
+				timeout = setTimeout(() => {
+					return reject(new Error("persistence timeout"));
+				}, operationTimeoutMs);
 			})]);
 			return true;
 		} catch {
@@ -4643,12 +4844,16 @@ function createSessionPersistence(persistence, authOrigin, now, timeoutMs) {
 		const operationGeneration = ++generation;
 		queue = queue.then(async () => {
 			if (!enabled || operationGeneration !== generation) return;
-			const isCurrent = () => enabled && operationGeneration === generation;
-			const work = Promise.resolve().then(() => operation(isCurrent));
+			const isCurrent = () => {
+				return enabled && operationGeneration === generation;
+			};
+			const work = Promise.resolve().then(() => {
+				return operation(isCurrent);
+			});
 			if (!await finishesWithin(work)) {
 				enabled = false;
 				finishesWithin(cleanup());
-				work.then(cleanup, cleanup).then(() => void 0, () => void 0);
+				work.then(cleanup, cleanup).then(() => {}, () => {});
 				return;
 			}
 			if (!isCurrent() && !await finishesWithin(cleanup())) enabled = false;
@@ -4750,7 +4955,7 @@ async function selectDriver(persistence) {
 }
 function browserStorage(mode) {
 	try {
-		if (typeof window === "undefined" || typeof document === "undefined") return void 0;
+		if (typeof window === "undefined" || typeof document === "undefined") return;
 		const storage = mode === "local" ? window.localStorage : window.sessionStorage;
 		storage.getItem(KEY);
 		return storage;
@@ -4762,11 +4967,21 @@ function adaptDriver(driver) {
 	if (typeof driver.getItem !== "function" || typeof driver.setItem !== "function" || typeof driver.removeItem !== "function") throw new TypeError("persistence driver must implement getItem, setItem, and removeItem");
 	return {
 		name: "finueva-auth-custom",
-		hasItem: async (key) => await driver.getItem(key) !== null,
-		getItem: (key) => driver.getItem(key),
-		getKeys: () => [],
-		setItem: (key, value) => driver.setItem(key, value),
-		removeItem: (key) => driver.removeItem(key)
+		hasItem: async (key) => {
+			return await driver.getItem(key) !== null;
+		},
+		getItem: (key) => {
+			return driver.getItem(key);
+		},
+		getKeys: () => {
+			return [];
+		},
+		setItem: (key, value) => {
+			return driver.setItem(key, value);
+		},
+		removeItem: (key) => {
+			return driver.removeItem(key);
+		}
 	};
 }
 function guardRawValues(driver) {
@@ -4821,7 +5036,9 @@ function readSnapshot(value, authOrigin, currentTime) {
 function exactObject(value, fields) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
-	return keys.length === fields.length && fields.every((field) => keys.includes(field));
+	return keys.length === fields.length && fields.every((field) => {
+		return keys.includes(field);
+	});
 }
 function byteLength(value) {
 	return new TextEncoder().encode(value).byteLength;
@@ -4840,7 +5057,9 @@ const itemKeys$1 = [
 	"userAgent"
 ];
 function exact$2(value, keys) {
-	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function date$2(value) {
 	if (typeof value !== "string") throw authorityUnavailable();
@@ -4873,8 +5092,12 @@ function normalizeSessionSummary(value) {
 function normalizeSessionInventory(value) {
 	if (!exact$2(value, ["sessions", "truncated"]) || !Array.isArray(value.sessions) || value.sessions.length > MAX_SESSIONS || typeof value.truncated !== "boolean") throw authorityUnavailable();
 	const sessions = value.sessions.map(normalizeSessionSummary);
-	if (new Set(sessions.map((session) => session.id)).size !== sessions.length) throw authorityUnavailable();
-	if (sessions.filter((session) => session.current).length !== 1) throw authorityUnavailable();
+	if (new Set(sessions.map((session) => {
+		return session.id;
+	})).size !== sessions.length) throw authorityUnavailable();
+	if (sessions.filter((session) => {
+		return session.current;
+	}).length !== 1) throw authorityUnavailable();
 	return {
 		sessions,
 		truncated: value.truncated
@@ -4909,7 +5132,9 @@ const itemKeys = [
 	"name"
 ];
 function exact$1(value, keys) {
-	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function date$1(value) {
 	if (typeof value !== "string") throw authorityUnavailable();
@@ -4982,6 +5207,11 @@ function normalizeCeremonyHandoffInput(value) {
 			}
 			throw new TypeError("request action is invalid");
 		}
+		case "user_closure": return {
+			purpose: input.purpose,
+			...base,
+			request: normalizeAccountDeletionStartRequest(input.request)
+		};
 		default: throw new TypeError("purpose is invalid");
 	}
 }
@@ -5026,7 +5256,9 @@ function normalizePasskeySummary(value) {
 function normalizePasskeyInventory(value) {
 	if (!exact$1(value, ["passkeys", "truncated"]) || !Array.isArray(value.passkeys) || value.passkeys.length > MAX_PASSKEYS || typeof value.truncated !== "boolean") throw authorityUnavailable();
 	const passkeys = value.passkeys.map(normalizePasskeySummary);
-	if (new Set(passkeys.map((passkey) => passkey.id)).size !== passkeys.length) throw authorityUnavailable();
+	if (new Set(passkeys.map((passkey) => {
+		return passkey.id;
+	})).size !== passkeys.length) throw authorityUnavailable();
 	return {
 		passkeys,
 		truncated: value.truncated
@@ -5043,6 +5275,7 @@ function fromCeremonyHandoffError(value, status, retryAfter) {
 	if (status === 403) return new AuthError("request_origin_denied", 403);
 	if (status === 404) return new AuthError("state_conflict", 409);
 	if (status === 409 && code === "PASSWORD_REQUIRED") return new AuthError("password_sign_in_required", 409);
+	if (status === 409 && code === "RECENT_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	return authorityUnavailable();
@@ -5086,7 +5319,9 @@ function isTwoFactorChallenge(value) {
 	return isObject(value) && value.twoFactorRedirect === true;
 }
 function normalizeBackupCodes(value) {
-	if (!Array.isArray(value) || value.length !== BACKUP_CODE_COUNT || value.some((code) => typeof code !== "string" || !backupCode.test(code)) || new Set(value).size !== value.length) throw authorityUnavailable();
+	if (!Array.isArray(value) || value.length !== BACKUP_CODE_COUNT || value.some((code) => {
+		return typeof code !== "string" || !backupCode.test(code);
+	}) || new Set(value).size !== value.length) throw authorityUnavailable();
 	return [...value];
 }
 function normalizeRegeneratedBackupCodes(value) {
@@ -5149,7 +5384,9 @@ const stateKeys = [
 	"status"
 ];
 function exact(value, keys) {
-	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function date(value, nullable) {
 	if (value === null && nullable) return null;
@@ -5275,9 +5512,13 @@ function enterpriseDomainInput(value) {
 function normalizeEnterpriseConnectionSetup(value) {
 	if (!exact(value, setupKeys) || value.capability !== "federated_sign_in" && value.capability !== "managed_lifecycle" || typeof value.id !== "string" || !idPattern.test(value.id) || typeof value.issuer !== "string" || value.issuer.length > 2048 || !value.issuer.startsWith("https://") || typeof value.clientId !== "string" || value.clientId.length < 1 || value.clientId.length > 256 || value.domain !== null && (typeof value.domain !== "string" || !domainPattern.test(value.domain) || value.domain.length > 253 || value.dnsRecordName !== `_finueva-sso.${value.domain}` || typeof value.dnsRecordValue !== "string" || !/^finueva-sso=[A-Za-z0-9_-]{43}$/.test(value.dnsRecordValue)) || value.domain === null && (value.dnsRecordName !== null || value.dnsRecordValue !== null || value.challengeExpiresAt !== null || value.domainVerified !== false) || !Array.isArray(value.domains) || value.domains.length > 10 || typeof value.redirectUri !== "string" || value.redirectUri.length > 2048 || !Number.isSafeInteger(value.revision) || value.revision < 0) throw authorityUnavailable();
 	const domains = value.domains.map(normalizeConnectionDomain);
-	const primary = domains.filter((domain) => domain.primary);
+	const primary = domains.filter((domain) => {
+		return domain.primary;
+	});
 	const challengeExpiresAt = date(value.challengeExpiresAt, value.domain === null);
-	if (new Set(domains.map((domain) => domain.domain)).size !== domains.length || (value.domain === null ? primary.length !== 0 : primary.length !== 1 || primary[0].domain !== value.domain || primary[0].dnsRecordName !== value.dnsRecordName || primary[0].dnsRecordValue !== value.dnsRecordValue || primary[0].verified !== value.domainVerified || primary[0].challengeExpiresAt.getTime() !== challengeExpiresAt?.getTime())) throw authorityUnavailable();
+	if (new Set(domains.map((domain) => {
+		return domain.domain;
+	})).size !== domains.length || (value.domain === null ? primary.length !== 0 : primary.length !== 1 || primary[0].domain !== value.domain || primary[0].dnsRecordName !== value.dnsRecordName || primary[0].dnsRecordValue !== value.dnsRecordValue || primary[0].verified !== value.domainVerified || primary[0].challengeExpiresAt.getTime() !== challengeExpiresAt?.getTime())) throw authorityUnavailable();
 	let redirect;
 	try {
 		redirect = new URL(value.redirectUri);
@@ -5352,23 +5593,27 @@ function userApiApplication(input) {
 	return input.applicationId;
 }
 function normalizeUserApiCredential(value, startedAt) {
-	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
 	return {
 		tokenType: "Bearer",
 		token: value.token,
 		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
 	};
 }
-function createUserApiCredentialCache(issue, now, currentSessionId = () => void 0) {
+function createUserApiCredentialCache(issue, now, currentSessionId = () => {}) {
 	let generation = 0;
 	let cached;
 	let pending;
-	const copy = (value) => ({
-		...value,
-		expiresAt: new Date(value.expiresAt)
-	});
+	const copy = (value) => {
+		return {
+			...value,
+			expiresAt: new Date(value.expiresAt)
+		};
+	};
 	return {
-		hasAuthority: () => Boolean(cached || pending),
+		hasAuthority: () => {
+			return Boolean(cached || pending);
+		},
 		retainSession(sessionId) {
 			if (cached?.sessionId === sessionId && !pending) return;
 			generation += 1;
@@ -5421,7 +5666,7 @@ function createUserApiCredentialCache(issue, now, currentSessionId = () => void
 }
 //#endregion
 //#region src/client.ts
-const REFRESH_WINDOW_MS = 120 * 1e3;
+const REFRESH_WINDOW_MS = 12e4;
 const RECENT_AUTHENTICATION_BROWSER_HEADER = "x-finueva-recent-auth-browser";
 const RECENT_AUTHENTICATION_REQUEST_HEADER = "x-finueva-recent-auth-request";
 function createAuthClient(options) {
@@ -5432,13 +5677,17 @@ function createAuthClient(options) {
 	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
 	const now = options.now ?? Date.now;
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
-	const userApiCredentials = createUserApiCredentialCache((applicationId) => requestJson(joinURL(authOrigin, "api/v1/auth/user-api-credential"), {
-		fetch: fetchImpl,
-		timeoutMs,
-		method: "POST",
-		headers: { "content-type": "application/json; charset=utf-8" },
-		body: { applicationId }
-	}), now, () => sessionId);
+	const userApiCredentials = createUserApiCredentialCache((applicationId) => {
+		return requestJson(joinURL(authOrigin, "api/v1/auth/user-api-credential"), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method: "POST",
+			headers: { "content-type": "application/json; charset=utf-8" },
+			body: { applicationId }
+		});
+	}, now, () => {
+		return sessionId;
+	});
 	const betterAuth = createAuthClient$1({
 		baseURL: authOrigin,
 		basePath: "/api/v1/auth",
@@ -5549,7 +5798,7 @@ function createAuthClient(options) {
 				authoritative: false
 			});
 		});
-		if (typeof window === "undefined") getSession().catch(() => void 0);
+		if (typeof window === "undefined") getSession().catch(() => {});
 	}
 	function subscribeToSessionSignals() {
 		if (sessionSignalSubscribed) return;
@@ -5586,7 +5835,7 @@ function createAuthClient(options) {
 		signalRefreshScheduled = false;
 		if (!signalRefreshPending || signalRefreshRequest || signOutRequest || activeAccountMutationGeneration !== void 0) return;
 		signalRefreshPending = false;
-		const request = refreshAuthoritySession(authorityGeneration).then(() => void 0, () => void 0).finally(() => {
+		const request = refreshAuthoritySession(authorityGeneration).then(() => {}, () => {}).finally(() => {
 			if (signalRefreshRequest === request) signalRefreshRequest = void 0;
 			if (signalRefreshPending) queueSignalRefresh();
 		});
@@ -5666,7 +5915,7 @@ function createAuthClient(options) {
 		});
 		emitSession(null);
 		const request = (async () => {
-			await pendingInvitation?.catch(() => void 0);
+			await pendingInvitation?.catch(() => {});
 			let result;
 			try {
 				result = await betterAuth.signOut();
@@ -5713,7 +5962,7 @@ function createAuthClient(options) {
 		});
 		emitSession(null);
 		try {
-			await pendingInvitation?.catch(() => void 0);
+			await pendingInvitation?.catch(() => {});
 			try {
 				const data = await operation();
 				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
@@ -5789,7 +6038,7 @@ function createAuthClient(options) {
 			timeoutMs,
 			method: "GET",
 			mapError: fromOrganizationReadAuthorityError,
-			maxResponseBytes: 256 * 1024
+			maxResponseBytes: 262144
 		});
 		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 		try {
@@ -5815,6 +6064,18 @@ function createAuthClient(options) {
 		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 		return normalize(value);
 	}
+	async function accountDeletionRequest(method, path, body, normalize) {
+		return normalize(await requestJson(joinURL(authOrigin, "api/v1/auth/user/closure", path), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method,
+			...body ? {
+				headers: { "content-type": "application/json" },
+				body
+			} : {},
+			mapError: fromAccountDeletionError
+		}));
+	}
 	async function ceremonyRequest(method, path, body, normalize) {
 		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
 		const generation = authorityGeneration;
@@ -6086,15 +6347,23 @@ function createAuthClient(options) {
 		async getOrganizationMemberAuthority(organizationId, memberId) {
 			const organization = normalizeIdInput(organizationId);
 			const member = normalizeIdInput(memberId);
-			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => {
+				return normalizeOrganizationMemberAuthority(value, organization, member);
+			});
 		},
 		async getOrganizationMemberAuthorityV2(organizationId, memberId) {
 			const organization = normalizeIdInput(organizationId);
 			const member = normalizeIdInput(memberId);
-			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthorityV2(value, organization, member), () => new URLSearchParams({ version: "2" }));
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => {
+				return normalizeOrganizationMemberAuthorityV2(value, organization, member);
+			}, () => {
+				return new URLSearchParams({ version: "2" });
+			});
 		},
 		getOrganizationApplicationRegistration(organizationId, applicationId) {
-			return organizationRead(registrationTarget(organizationId, applicationId), void 0, (value) => normalizeOrganizationApplicationRegistration(value, organizationId, applicationId));
+			return organizationRead(registrationTarget(organizationId, applicationId), void 0, (value) => {
+				return normalizeOrganizationApplicationRegistration(value, organizationId, applicationId);
+			});
 		},
 		async registerOrganizationApplication(organizationId, applicationId, input) {
 			const path = registrationTarget(organizationId, applicationId);
@@ -6261,17 +6530,23 @@ function createAuthClient(options) {
 				organizationId,
 				teamId,
 				memberId
-			], idempotencyKey, (organization, team, member) => joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "members", member, "add")));
+			], idempotencyKey, (organization, team, member) => {
+				return joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "members", member, "add");
+			}));
 		},
 		async removeOrganizationTeamMember(organizationId, teamId, memberId, idempotencyKey) {
 			return normalizeRemovedOrganizationTeamMember(await teamMembershipMutation([
 				organizationId,
 				teamId,
 				memberId
-			], idempotencyKey, (organization, team, member) => joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "members", member, "remove")));
+			], idempotencyKey, (organization, team, member) => {
+				return joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "members", member, "remove");
+			}));
 		},
 		async deleteOrganizationTeam(organizationId, teamId, idempotencyKey) {
-			return normalizeDeletedOrganizationTeam(await teamMembershipMutation([organizationId, teamId], idempotencyKey, (organization, team) => joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "delete")));
+			return normalizeDeletedOrganizationTeam(await teamMembershipMutation([organizationId, teamId], idempotencyKey, (organization, team) => {
+				return joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "delete");
+			}));
 		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
@@ -6464,7 +6739,9 @@ function createAuthClient(options) {
 			}, normalizeEnterpriseConnectionSetup);
 		},
 		async getScimCredential(organizationId, connectionId) {
-			return enterpriseRequest("GET", scimCredentialPath(organizationId, connectionId), void 0, (value) => normalizeScimCredentialState(value));
+			return enterpriseRequest("GET", scimCredentialPath(organizationId, connectionId), void 0, (value) => {
+				return normalizeScimCredentialState(value);
+			});
 		},
 		async issueScimCredential(organizationId, connectionId) {
 			return enterpriseRequest("POST", scimCredentialPath(organizationId, connectionId), {}, normalizeScimCredentialIssuance);
@@ -6478,7 +6755,9 @@ function createAuthClient(options) {
 		},
 		async revokeScimCredential(organizationId, connectionId, input) {
 			const body = { expectedRevision: normalizeRevision(input?.expectedRevision) };
-			return enterpriseRequest("POST", `${scimCredentialPath(organizationId, connectionId)}/revoke`, body, (value) => normalizeScimCredentialState(value));
+			return enterpriseRequest("POST", `${scimCredentialPath(organizationId, connectionId)}/revoke`, body, (value) => {
+				return normalizeScimCredentialState(value);
+			});
 		},
 		async signIn(input) {
 			const body = {
@@ -6505,7 +6784,9 @@ function createAuthClient(options) {
 		},
 		async verifyTwoFactor(code) {
 			const normalized = normalizeTwoFactorCode(code);
-			const result = await runAccountMutation(() => accountRequest(normalized.route, { code: normalized.code }, fromTwoFactorAuthorityError));
+			const result = await runAccountMutation(() => {
+				return accountRequest(normalized.route, { code: normalized.code }, fromTwoFactorAuthorityError);
+			});
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
@@ -6531,13 +6812,17 @@ function createAuthClient(options) {
 		},
 		async confirmTwoFactorEnrollment(code) {
 			const body = { code: normalizeTotpCode(code) };
-			const result = await runAccountMutation(() => accountRequest("two-factor/verify-totp", body, fromTwoFactorAuthorityError));
+			const result = await runAccountMutation(() => {
+				return accountRequest("two-factor/verify-totp", body, fromTwoFactorAuthorityError);
+			});
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
 		async disableTwoFactor(input) {
 			const body = normalizeTwoFactorStepUp(input);
-			const result = await runAccountMutation(() => accountRequest("two-factor/disable", body, fromTwoFactorAuthorityError));
+			const result = await runAccountMutation(() => {
+				return accountRequest("two-factor/disable", body, fromTwoFactorAuthorityError);
+			});
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
@@ -6564,6 +6849,12 @@ function createAuthClient(options) {
 		async listPasskeys() {
 			return ceremonyRequest("GET", "passkeys", void 0, normalizePasskeyInventory);
 		},
+		async getAccountDeletionEligibility() {
+			return accountDeletionRequest("GET", "eligibility", void 0, normalizeAccountDeletionEligibility);
+		},
+		async restoreAccount(input) {
+			await accountDeletionRequest("POST", "restore", normalizeAccountDeletionRestoreInput(input), normalizeAccountDeletionRestore);
+		},
 		async renamePasskey(passkeyId, name) {
 			const id = normalizePasskeyId(passkeyId);
 			const body = { name: normalizePasskeyName(name) };
@@ -6571,7 +6862,9 @@ function createAuthClient(options) {
 		},
 		async signInWithSocialIdToken(input) {
 			const body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));
-			const result = await runAccountMutation(() => accountRequest("sign-in/social", body, fromSocialIdTokenAuthorityError));
+			const result = await runAccountMutation(() => {
+				return accountRequest("sign-in/social", body, fromSocialIdTokenAuthorityError);
+			});
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
@@ -6581,13 +6874,17 @@ function createAuthClient(options) {
 				password: normalizePassword(password, "password", 10),
 				name: normalizeName(name)
 			};
-			const result = await runAccountMutation(() => accountRequest("sign-up/email", body));
+			const result = await runAccountMutation(() => {
+				return accountRequest("sign-up/email", body);
+			});
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
 		async updateProfile(input) {
 			const body = normalizeProfileInput(input);
-			const result = await runAccountMutation(() => accountRequest("update-user", body));
+			const result = await runAccountMutation(() => {
+				return accountRequest("update-user", body);
+			});
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
@@ -6595,11 +6892,13 @@ function createAuthClient(options) {
 			const current = normalizePassword(currentPassword, "currentPassword");
 			const next = normalizePassword(newPassword, "newPassword", 10);
 			if (typeof revokeOtherSessions !== "boolean") throw new TypeError("revokeOtherSessions is invalid");
-			const result = await runAccountMutation(() => accountRequest("change-password", {
-				currentPassword: current,
-				newPassword: next,
-				revokeOtherSessions
-			}));
+			const result = await runAccountMutation(() => {
+				return accountRequest("change-password", {
+					currentPassword: current,
+					newPassword: next,
+					revokeOtherSessions
+				});
+			});
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
@@ -6614,7 +6913,9 @@ function createAuthClient(options) {
 				token: normalizePasswordResetToken(token),
 				newPassword: normalizePassword(newPassword, "newPassword", 10)
 			};
-			normalizeVerificationEmailResponse((await runAccountMutation(() => accountRequest("reset-password", body))).data);
+			normalizeVerificationEmailResponse((await runAccountMutation(() => {
+				return accountRequest("reset-password", body);
+			})).data);
 		},
 		async sendVerificationEmail(input) {
 			const body = normalizeVerificationEmailInput(input, appOrigin);
@@ -6682,7 +6983,9 @@ function createAuthClient(options) {
 				listener(authState);
 			} catch {}
 			startAuthState();
-			return () => authStateListeners.delete(listener);
+			return () => {
+				return authStateListeners.delete(listener);
+			};
 		},
 		onSessionChange(listener) {
 			sessionListeners.add(listener);
@@ -6691,7 +6994,9 @@ function createAuthClient(options) {
 				else if (authState.status === "unauthenticated") listener(null);
 			} catch {}
 			startAuthState();
-			return () => sessionListeners.delete(listener);
+			return () => {
+				return sessionListeners.delete(listener);
+			};
 		}
 	};
 }