@finueva/auth 0.32.0 → 0.34.0

package/dist/server.js

@@ -41,26 +41,59 @@ const messages = {
 	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
 	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
 	ceremony_return_refused: "The return address is not registered for this application.",
-	password_sign_in_required: "A password sign-in method is required for this passkey change."
+	password_sign_in_required: "A password sign-in method is required for this passkey change.",
+	account_deletion_pending: "This account is scheduled for deletion.",
+	account_restore_unavailable: "The restore ticket or link is used or expired, or the account is not scheduled for deletion."
 };
 var AuthError = class extends Error {
 	code;
 	status;
 	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
+	accountDeletion;
+	constructor(code, status, retryAfterSeconds, details) {
 		super(messages[code]);
 		this.name = "AuthError";
 		this.code = code;
 		this.status = status;
 		this.retryAfterSeconds = retryAfterSeconds;
+		if (details?.accountDeletion) this.accountDeletion = details.accountDeletion;
 	}
 };
 //#endregion
+//#region src/account-deletion.ts
+function isObject$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function authorityUnavailable$1() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+const tokenPattern = /^[A-Za-z0-9_-]{43}$(?![\s\S])/;
+function isoDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable$1();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable$1();
+	return parsed;
+}
+function accountDeletionPending(value, status) {
+	if (status !== 403 || !isObject$2(value) || value.code !== "ACCOUNT_DELETION_PENDING") return null;
+	let deleteAfter;
+	try {
+		deleteAfter = isoDate(value.deleteAfter);
+	} catch {
+		return null;
+	}
+	const restoreTicket = typeof value.restoreTicket === "string" && tokenPattern.test(value.restoreTicket) ? value.restoreTicket : null;
+	return {
+		deleteAfter,
+		restoreTicket
+	};
+}
+//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id$3 = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
-const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+const MAX_SOCIAL_ID_TOKEN_BYTES = 16384;
 function normalizeEmail(value) {
 	if (typeof value !== "string") throw new TypeError("email is invalid");
 	const normalized = value.trim().toLowerCase();
@@ -70,7 +103,9 @@ function normalizeEmail(value) {
 function normalizeSocialIdTokenInput(value) {
 	if (!isObject$1(value)) throw new TypeError("social ID token input is invalid");
 	const keys = Object.keys(value);
-	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
+	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => {
+		return key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp";
+	}) || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
 	return {
 		provider: value.provider,
 		idToken: value.idToken,
@@ -88,7 +123,15 @@ function socialIdTokenRequest(value) {
 		requestSignUp: value.signUp
 	};
 }
-function normalizeOrigin(value, name) {
+function isPrivateIpv4(hostname) {
+	const parts = hostname.split(".").map(Number);
+	if (parts.length !== 4 || parts.some((part) => {
+		return !Number.isInteger(part) || part < 0 || part > 255;
+	})) return false;
+	const [first, second] = parts;
+	return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+}
+function normalizeOrigin(value, name, allowPrivateNetwork = false) {
 	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	let url;
 	try {
@@ -97,7 +140,7 @@ function normalizeOrigin(value, name) {
 		throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	}
 	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
-	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	if (url.protocol !== "https:" && !((local || allowPrivateNetwork && isPrivateIpv4(url.hostname)) && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	return url.origin;
 }
 function normalizeTimeout(value) {
@@ -124,7 +167,7 @@ function normalizeSession(value) {
 	};
 }
 function normalizeDriveCredential(value, now) {
-	if (!isObject$1(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
+	if (!isObject$1(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16384) throw authorityUnavailable();
 	return {
 		tokenType: "Bearer",
 		token: value.token,
@@ -133,7 +176,9 @@ function normalizeDriveCredential(value, now) {
 }
 function normalizeOrganizationPageInput(value) {
 	if (value === void 0) return new URLSearchParams();
-	if (!isObject$1(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
+	if (!isObject$1(value) || Object.keys(value).some((key) => {
+		return key !== "limit" && key !== "cursor";
+	})) throw new AuthError("invalid_request", 400);
 	const input = value;
 	const query = new URLSearchParams();
 	if (input.limit !== void 0) {
@@ -148,17 +193,23 @@ function normalizeOrganizationPageInput(value) {
 }
 function normalizeOrganizationMemberPageInput(value) {
 	if (value === void 0) return new URLSearchParams();
-	if (!isObject$1(value) || Object.keys(value).some((key) => ![
-		"limit",
-		"cursor",
-		"search"
-	].includes(key))) throw new AuthError("invalid_request", 400);
+	if (!isObject$1(value) || Object.keys(value).some((key) => {
+		return ![
+			"limit",
+			"cursor",
+			"search"
+		].includes(key);
+	})) throw new AuthError("invalid_request", 400);
 	const { search, ...page } = value;
 	const query = normalizeOrganizationPageInput(page);
 	if (search !== void 0) {
 		if (typeof search !== "string") throw new AuthError("invalid_request", 400);
-		const prefix = search.trim().replace(/[A-Z]/g, (character) => character.toLowerCase());
-		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new AuthError("invalid_request", 400);
+		const prefix = search.trim().replace(/[A-Z]/g, (character) => {
+			return character.toLowerCase();
+		});
+		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => {
+			return character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127;
+		})) throw new AuthError("invalid_request", 400);
 		query.set("search", prefix);
 	}
 	return query;
@@ -278,7 +329,9 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 		throw new AuthError("invalid_request", 400);
 	}
 	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
-	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	const teamIds = value.teamIds?.map((teamId) => {
+		return normalizeIdInput(teamId);
+	});
 	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
 	return {
 		email: normalizedEmail,
@@ -345,7 +398,9 @@ function normalizeOrganizations(value) {
 	exact$8(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
-		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
+		organizations: unique(value.organizations.map(normalizeOrganization), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -366,7 +421,11 @@ function normalizeOrganizationMembers(value) {
 				"userId"
 			]);
 			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
-			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
+			const teamIds = unique(member.teamIds.map((teamId) => {
+				return normalizeResponseId(teamId);
+			}), (item) => {
+				return item;
+			});
 			return {
 				id: member.id,
 				userId: member.userId,
@@ -378,7 +437,9 @@ function normalizeOrganizationMembers(value) {
 				joinedAt: responseDate(member.joinedAt),
 				teamIds
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -400,7 +461,9 @@ function normalizeOrganizationTeams(value) {
 				category: team.category,
 				createdAt: responseDate(team.createdAt)
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -408,7 +471,11 @@ function normalizeOrganizationTeamMembers(value) {
 	exact$8(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
-		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
+		memberIds: unique(value.memberIds.map((item) => {
+			return normalizeResponseId(item);
+		}), (item) => {
+			return item;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -430,7 +497,9 @@ function normalizeOrganizationInvitation(value) {
 		id: value.id,
 		email: value.email,
 		role: value.role,
-		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
+		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => {
+			return item;
+		}),
 		inviter: {
 			membershipId: value.inviter.membershipId,
 			name: value.inviter.name
@@ -444,7 +513,9 @@ function normalizeOrganizationInvitations(value) {
 	exact$8(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
-		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
+		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -481,7 +552,9 @@ function normalizeReceivedInvitation(value) {
 				id: team.id,
 				name: team.name
 			};
-		}), (item) => item.id),
+		}), (item) => {
+			return item.id;
+		}),
 		inviterName: value.inviterName,
 		expiresAt: responseDate(value.expiresAt)
 	};
@@ -490,7 +563,9 @@ function normalizeReceivedInvitations(value) {
 	exact$8(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
-		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
+		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => {
+			return item.id;
+		}),
 		nextCursor: nullableCursor(value.nextCursor)
 	};
 }
@@ -522,6 +597,8 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 }
 function fromAccountAuthorityError(value, status, retryAfter) {
 	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
+	const pendingDeletion = accountDeletionPending(value, status);
+	if (pendingDeletion) return new AuthError("account_deletion_pending", 403, void 0, { accountDeletion: pendingDeletion });
 	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
 	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
 	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
@@ -714,7 +791,7 @@ function mapError$2(code, status) {
 	};
 }
 function parseRetryAfter(value) {
-	if (!value || !/^\d+$/.test(value)) return void 0;
+	if (!value || !/^\d+$/.test(value)) return;
 	const seconds = Number(value);
 	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
 }
@@ -774,7 +851,9 @@ function record$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function exact$7(value, keys) {
-	return record$1(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return record$1(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function directoryId(value) {
 	return typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(value);
@@ -1145,8 +1224,10 @@ function mergeHeaders(input, defaults, Headers) {
 	return headers;
 }
 async function callHooks(context, hooks) {
-	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
-	else await hooks(context);
+	if (hooks) {
+		if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+		else await hooks(context);
+	}
 }
 const retryStatusCodes = new Set([
 	408,
@@ -1277,7 +1358,7 @@ function createFetch(globalOptions = {}) {
 }
 //#endregion
 //#region src/http.ts
-const MAX_RESPONSE_BYTES = 64 * 1024;
+const MAX_RESPONSE_BYTES = 65536;
 async function requestJson(url, options) {
 	return (await requestJsonResponse(url, options)).value;
 }
@@ -1303,7 +1384,7 @@ async function requestJsonResponse(url, options) {
 	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
 		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes, options.signal) : void 0;
-		response.body?.cancel().catch(() => void 0);
+		response.body?.cancel().catch(() => {});
 		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
 	return {
@@ -1314,17 +1395,17 @@ async function requestJsonResponse(url, options) {
 async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 	const length = response.headers.get("content-length");
 	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
-		response.body?.cancel().catch(() => void 0);
+		response.body?.cancel().catch(() => {});
 		throw authorityUnavailable();
 	}
 	if (!response.body) throw authorityUnavailable();
 	if (signal?.aborted) {
-		response.body.cancel().catch(() => void 0);
+		response.body.cancel().catch(() => {});
 		throw authorityUnavailable();
 	}
 	const reader = response.body.getReader();
 	const cancel = () => {
-		reader.cancel().catch(() => void 0);
+		reader.cancel().catch(() => {});
 	};
 	signal?.addEventListener("abort", cancel, { once: true });
 	const chunks = [];
@@ -1339,7 +1420,7 @@ async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 			chunks.push(value);
 		}
 	} catch (error) {
-		reader.cancel().catch(() => void 0);
+		reader.cancel().catch(() => {});
 		throw error;
 	} finally {
 		signal?.removeEventListener("abort", cancel);
@@ -1366,7 +1447,7 @@ function createOrganizationDirectoryAuth(options) {
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
 	let inFlight = 0;
 	async function exchange(operation, body, assertion) {
-		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
+		if (typeof assertion !== "string" || assertion.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
 		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
 		inFlight += 1;
 		const controller = new AbortController();
@@ -1390,7 +1471,7 @@ function createOrganizationDirectoryAuth(options) {
 					accept: "application/json"
 				},
 				body,
-				maxResponseBytes: 256 * 1024,
+				maxResponseBytes: 262144,
 				signal: controller.signal
 			}).finally(() => {
 				inFlight -= 1;
@@ -1415,17 +1496,27 @@ function createOrganizationDirectoryAuth(options) {
 			return organization;
 		},
 		async searchOrganizations(input, assertion) {
-			if (!record$1(input) || Object.keys(input).some((key) => ![
-				"applicationId",
-				"query",
-				"limit",
-				"cursor"
-			].includes(key)) || !directoryId(input.applicationId) || input.query !== void 0 && (typeof input.query !== "string" || input.query.length < 1 || input.query.length > 128 || Array.from(input.query).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100) || input.cursor !== void 0 && (typeof input.cursor !== "string" || input.cursor.length > 2048)) throw new AuthError("invalid_request", 400);
+			if (!record$1(input) || Object.keys(input).some((key) => {
+				return ![
+					"applicationId",
+					"query",
+					"limit",
+					"cursor"
+				].includes(key);
+			}) || !directoryId(input.applicationId) || input.query !== void 0 && (typeof input.query !== "string" || input.query.length < 1 || input.query.length > 128 || Array.from(input.query).some((character) => {
+				return character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127;
+			})) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100) || input.cursor !== void 0 && (typeof input.cursor !== "string" || input.cursor.length > 2048)) throw new AuthError("invalid_request", 400);
 			const limit = input.limit ?? 50;
 			const value = await exchange("search", input, assertion);
 			if (!exact$7(value, ["organizations", "nextCursor"]) || !Array.isArray(value.organizations) || value.organizations.length > limit || value.nextCursor !== null && (typeof value.nextCursor !== "string" || !value.nextCursor.length || value.nextCursor.length > 2048)) throw authorityUnavailable();
-			const organizations = value.organizations.map((item) => normalizeDirectoryEntry(item, input.applicationId));
-			if (organizations.some((organization) => organization.lifecycle === "deleted") || new Set(organizations.map((organization) => `${organization.organizationId}:${organization.organizationGeneration}`)).size !== organizations.length) throw authorityUnavailable();
+			const organizations = value.organizations.map((item) => {
+				return normalizeDirectoryEntry(item, input.applicationId);
+			});
+			if (organizations.some((organization) => {
+				return organization.lifecycle === "deleted";
+			}) || new Set(organizations.map((organization) => {
+				return `${organization.organizationId}:${organization.organizationGeneration}`;
+			})).size !== organizations.length) throw authorityUnavailable();
 			return {
 				organizations,
 				nextCursor: value.nextCursor
@@ -1435,25 +1526,39 @@ function createOrganizationDirectoryAuth(options) {
 }
 //#endregion
 //#region src/organization-admission/contract.ts
-const invalid$1 = () => new AuthError("invalid_request", 400);
-const positive = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value < Number.MAX_SAFE_INTEGER;
-const timestamp$1 = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 864e13;
-const digest$2 = (value) => typeof value === "string" && /^[a-f0-9]{64}$(?![\s\S])/.test(value);
-const text = (value) => typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= 255;
-const slug = (value) => typeof value === "string" && /^[a-z0-9-]{1,128}$(?![\s\S])/.test(value);
+const invalid$2 = () => {
+	return new AuthError("invalid_request", 400);
+};
+const positive = (value) => {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value < Number.MAX_SAFE_INTEGER;
+};
+const timestamp$1 = (value) => {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 864e13;
+};
+const digest$2 = (value) => {
+	return typeof value === "string" && /^[a-f0-9]{64}$(?![\s\S])/.test(value);
+};
+const text = (value) => {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= 255;
+};
+const slug = (value) => {
+	return typeof value === "string" && /^[a-z0-9-]{1,128}$(?![\s\S])/.test(value);
+};
 function setupInput(input, additional = []) {
 	if (!exact$7(input, [
 		"applicationId",
 		"setupId",
 		...additional
-	]) || !directoryId(input.applicationId) || !directoryGeneration(input.setupId)) throw invalid$1();
+	]) || !directoryId(input.applicationId) || !directoryGeneration(input.setupId)) throw invalid$2();
 }
 function pageInput$1(input) {
-	if (!record$1(input) || Object.keys(input).some((key) => ![
-		"applicationId",
-		"cursor",
-		"limit"
-	].includes(key)) || !directoryId(input.applicationId) || input.cursor !== void 0 && (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 2048) || input.limit !== void 0 && (!positive(input.limit) || input.limit > 50)) throw invalid$1();
+	if (!record$1(input) || Object.keys(input).some((key) => {
+		return ![
+			"applicationId",
+			"cursor",
+			"limit"
+		].includes(key);
+	}) || !directoryId(input.applicationId) || input.cursor !== void 0 && (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 2048) || input.limit !== void 0 && (!positive(input.limit) || input.limit > 50)) throw invalid$2();
 }
 const setupKeys = [
 	"setupId",
@@ -1504,8 +1609,14 @@ function billingSetup(value, applicationId, setupId) {
 }
 function page(value, input, pending = false) {
 	if (!exact$7(value, ["setups", "nextCursor"]) || !Array.isArray(value.setups) || value.setups.length > (input.limit ?? 25) || value.nextCursor !== null && (typeof value.nextCursor !== "string" || !value.nextCursor.length || value.nextCursor.length > 2048 || value.nextCursor === input.cursor)) throw authorityUnavailable();
-	const setups = value.setups.map((item) => setup(item, input.applicationId));
-	if (new Set(setups.map((item) => item.setupId)).size !== setups.length || pending && setups.some((item) => item.status === "activated")) throw authorityUnavailable();
+	const setups = value.setups.map((item) => {
+		return setup(item, input.applicationId);
+	});
+	if (new Set(setups.map((item) => {
+		return item.setupId;
+	})).size !== setups.length || pending && setups.some((item) => {
+		return item.status === "activated";
+	})) throw authorityUnavailable();
 	return {
 		setups,
 		nextCursor: value.nextCursor
@@ -1536,18 +1647,20 @@ function actorHeaders(proof) {
 		"serviceAssertion",
 		"request",
 		"appOrigin"
-	]) || !(proof.request instanceof Request)) throw invalid$1();
+	]) || !(proof.request instanceof Request)) throw invalid$2();
 	const authorization = proof.request.headers.get("authorization");
 	if (authorization !== null) {
-		if (new TextEncoder().encode(authorization).byteLength > 16 * 1024 || /[^\x20-\x7e]/.test(authorization) || !/^Bearer [^\s,]+$/i.test(authorization) || /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(authorization.slice(7))) throw new AuthError("authentication_required", 401);
+		if (new TextEncoder().encode(authorization).byteLength > 16384 || /[^\x20-\x7e]/.test(authorization) || !/^Bearer [^\s,]+$/i.test(authorization) || /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(authorization.slice(7))) throw new AuthError("authentication_required", 401);
 		return { authorization };
 	}
-	const cookie = (proof.request.headers.get("cookie") ?? "").split(";").map((entry) => entry.trim()).filter((entry) => {
+	const cookie = (proof.request.headers.get("cookie") ?? "").split(";").map((entry) => {
+		return entry.trim();
+	}).filter((entry) => {
 		const separator = entry.indexOf("=");
 		const name = entry.slice(0, separator);
 		return separator > 0 && (name.startsWith("better-auth.") || name.startsWith("__Secure-better-auth."));
 	}).join("; ");
-	if (!cookie || new TextEncoder().encode(cookie).byteLength > 16 * 1024) throw new AuthError("authentication_required", 401);
+	if (!cookie || new TextEncoder().encode(cookie).byteLength > 16384) throw new AuthError("authentication_required", 401);
 	const origin = normalizeOrigin(proof.appOrigin, "appOrigin");
 	if (proof.request.headers.get("origin") !== origin) throw new AuthError("request_origin_denied", 403);
 	return {
@@ -1562,12 +1675,12 @@ function transport(options, operations) {
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
 	let inFlight = 0;
 	function audience(operation) {
-		if (!operations.includes(operation)) throw invalid$1();
+		if (!operations.includes(operation)) throw invalid$2();
 		return joinURL(base, operation);
 	}
 	async function exchange(operation, body, assertion, actor) {
 		const url = audience(operation);
-		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion) || new TextEncoder().encode(JSON.stringify(body)).byteLength > 8192) throw invalid$1();
+		if (typeof assertion !== "string" || assertion.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion) || new TextEncoder().encode(JSON.stringify(body)).byteLength > 8192) throw invalid$2();
 		const headers = actor ? actorHeaders(actor) : {};
 		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
 		inFlight += 1;
@@ -1587,7 +1700,7 @@ function transport(options, operations) {
 				credentials: "omit",
 				cache: "no-store",
 				signal: controller.signal,
-				maxResponseBytes: 64 * 1024,
+				maxResponseBytes: 65536,
 				headers: {
 					...headers,
 					"x-finueva-service-assertion": assertion,
@@ -1596,7 +1709,7 @@ function transport(options, operations) {
 				},
 				body,
 				mapError: (_value, status, retryAfter) => {
-					if (status === 400) return invalid$1();
+					if (status === 400) return invalid$2();
 					if (status === 401) return new AuthError("authentication_required", 401);
 					if (status === 403) return new AuthError("access_denied", 403);
 					if (status === 409) return new AuthError("state_conflict", 409);
@@ -1624,7 +1737,7 @@ function validate(operation, input) {
 			"applicationId",
 			"idempotencyKey",
 			"target"
-		]) || !directoryId(input.applicationId) || typeof input.idempotencyKey !== "string" || !/^[A-Za-z0-9_-]{16,128}$(?![\s\S])/.test(input.idempotencyKey) || !record$1(input.target)) throw invalid$1();
+		]) || !directoryId(input.applicationId) || typeof input.idempotencyKey !== "string" || !/^[A-Za-z0-9_-]{16,128}$(?![\s\S])/.test(input.idempotencyKey) || !record$1(input.target)) throw invalid$2();
 		const target = input.target;
 		if (target.kind === "new" ? !exact$7(target, [
 			"kind",
@@ -1634,7 +1747,7 @@ function validate(operation, input) {
 			"kind",
 			"organizationId",
 			"organizationGeneration"
-		]) || !directoryId(target.organizationId) || !directoryGeneration(target.organizationGeneration)) throw invalid$1();
+		]) || !directoryId(target.organizationId) || !directoryGeneration(target.organizationGeneration)) throw invalid$2();
 	} else if (operation === "list" || operation === "pending") {
 		pageInput$1(input);
 		return {
@@ -1642,20 +1755,22 @@ function validate(operation, input) {
 			limit: input.limit ?? 25
 		};
 	} else if (operation === "identity") {
-		if (!exact$7(input, ["applicationId", "organizationId"]) || !directoryId(input.applicationId) || !directoryId(input.organizationId)) throw invalid$1();
+		if (!exact$7(input, ["applicationId", "organizationId"]) || !directoryId(input.applicationId) || !directoryId(input.organizationId)) throw invalid$2();
 	} else if (operation === "current") {
-		if (!record$1(input) || Object.keys(input).some((key) => ![
-			"applicationId",
-			"organizationId",
-			"organizationGeneration"
-		].includes(key)) || !directoryId(input.applicationId) || !directoryId(input.organizationId) || input.organizationGeneration !== void 0 && !directoryGeneration(input.organizationGeneration)) throw invalid$1();
+		if (!record$1(input) || Object.keys(input).some((key) => {
+			return ![
+				"applicationId",
+				"organizationId",
+				"organizationGeneration"
+			].includes(key);
+		}) || !directoryId(input.applicationId) || !directoryId(input.organizationId) || input.organizationGeneration !== void 0 && !directoryGeneration(input.organizationGeneration)) throw invalid$2();
 	} else if (operation === "amend") {
 		setupInput(input, [
 			"expectedDisplayRevision",
 			"name",
 			"slug"
 		]);
-		if (!positive(input.expectedDisplayRevision) || !text(input.name) || !slug(input.slug)) throw invalid$1();
+		if (!positive(input.expectedDisplayRevision) || !text(input.name) || !slug(input.slug)) throw invalid$2();
 	} else if (operation === "read" || operation === "lookup") setupInput(input);
 	else if (operation === "finalize" || operation === "withdraw") {
 		setupInput(input, [
@@ -1663,7 +1778,7 @@ function validate(operation, input) {
 			"receiptRevision",
 			...operation === "withdraw" ? ["selectionDigest"] : []
 		]);
-		if (!directoryId(input.receiptId) || !positive(input.receiptRevision) || operation === "withdraw" && !digest$2(input.selectionDigest)) throw invalid$1();
+		if (!directoryId(input.receiptId) || !positive(input.receiptRevision) || operation === "withdraw" && !digest$2(input.selectionDigest)) throw invalid$2();
 	} else if (operation === "attest") {
 		setupInput(input, [
 			"organizationId",
@@ -1690,19 +1805,25 @@ function validate(operation, input) {
 			"paid",
 			"trial",
 			"complimentary"
-		].includes(String(receipt.source)) || !timestamp$1(receipt.observedAt) || !timestamp$1(receipt.validUntil) || receipt.validUntil <= receipt.observedAt || receipt.validUntil - receipt.observedAt > 6e4 || (receipt.source === "complimentary" ? receipt.observedPriceId !== null : receipt.observedPriceId !== selection.priceId)) throw invalid$1();
-	} else throw invalid$1();
+		].includes(String(receipt.source)) || !timestamp$1(receipt.observedAt) || !timestamp$1(receipt.validUntil) || receipt.validUntil <= receipt.observedAt || receipt.validUntil - receipt.observedAt > 6e4 || (receipt.source === "complimentary" ? receipt.observedPriceId !== null : receipt.observedPriceId !== selection.priceId)) throw invalid$2();
+	} else throw invalid$2();
 	return input;
 }
 function canonical(value) {
 	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-	if (record$1(value)) return `{${Object.keys(value).filter((key) => value[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+	if (record$1(value)) return `{${Object.keys(value).filter((key) => {
+		return value[key] !== void 0;
+	}).sort().map((key) => {
+		return `${JSON.stringify(key)}:${canonical(value[key])}`;
+	}).join(",")}}`;
 	return JSON.stringify(value);
 }
 async function organizationAdmissionBodyDigest(operation, input) {
 	const bytes = new TextEncoder().encode(canonical(validate(operation, input)));
-	if (bytes.byteLength > 8192) throw invalid$1();
-	return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+	if (bytes.byteLength > 8192) throw invalid$2();
+	return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => {
+		return byte.toString(16).padStart(2, "0");
+	}).join("");
 }
 function createOrganizationAdmissionAuth(options) {
 	const { audience, exchange } = transport(options, [
@@ -1833,7 +1954,9 @@ const id$2 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 const digest$1 = /^[a-f0-9]{64}$(?![\s\S])/;
 const credential = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/;
 function exact$6(value, keys) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function identifier(value) {
 	return typeof value === "string" && id$2.test(value);
@@ -1854,7 +1977,9 @@ function operationProof(value) {
 		"development",
 		"staging",
 		"production"
-	].includes(value.environment) || [value.applicationCredential, value.serviceAssertion].some((token) => typeof token !== "string" || token.length > 16 * 1024 || !credential.test(token))) throw new AuthError("invalid_request", 400);
+	].includes(value.environment) || [value.applicationCredential, value.serviceAssertion].some((token) => {
+		return typeof token !== "string" || token.length > 16384 || !credential.test(token);
+	})) throw new AuthError("invalid_request", 400);
 	return {
 		applicationCredential: value.applicationCredential,
 		serviceAssertion: value.serviceAssertion,
@@ -1865,7 +1990,9 @@ function operationProof(value) {
 	};
 }
 function snapshotInput(value) {
-	if (!exact$6(value, ["applicationId", "participantUserUids"]) || !identifier(value.applicationId) || !Array.isArray(value.participantUserUids) || value.participantUserUids.length < 1 || value.participantUserUids.length > 100 || !value.participantUserUids.every((uid, index, all) => identifier(uid) && (index === 0 || all[index - 1] < uid))) throw new AuthError("invalid_request", 400);
+	if (!exact$6(value, ["applicationId", "participantUserUids"]) || !identifier(value.applicationId) || !Array.isArray(value.participantUserUids) || value.participantUserUids.length < 1 || value.participantUserUids.length > 100 || !value.participantUserUids.every((uid, index, all) => {
+		return identifier(uid) && (index === 0 || all[index - 1] < uid);
+	})) throw new AuthError("invalid_request", 400);
 	return {
 		applicationId: value.applicationId,
 		participantUserUids: [...value.participantUserUids]
@@ -2022,20 +2149,22 @@ function createAccountProductOperationAuth(options) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/buffer_utils.js
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js
 const encoder$1 = new TextEncoder();
 const decoder = new TextDecoder();
+const strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
 function concat(...buffers) {
-	const size = buffers.reduce((acc, { length }) => acc + length, 0);
-	const buf = new Uint8Array(size);
+	const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
 	let i = 0;
-	for (const buffer of buffers) {
-		buf.set(buffer, i);
-		i += buffer.length;
-	}
+	for (const buffer of buffers) buf.set(buffer, i), i += buffer.length;
 	return buf;
 }
+const NON_ASCII = /[^\x00-\x7f]/;
 function encode$1(string) {
+	if (typeof string == "string" && string.length >= 128) {
+		if (NON_ASCII.test(string)) throw new TypeError("non-ASCII string encountered in encode()");
+		return encoder$1.encode(string);
+	}
 	const bytes = new Uint8Array(string.length);
 	for (let i = 0; i < string.length; i++) {
 		const code = string.charCodeAt(i);
@@ -2044,133 +2173,37 @@ function encode$1(string) {
 	}
 	return bytes;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/base64.js
-function encodeBase64(input) {
-	if (Uint8Array.prototype.toBase64) return input.toBase64();
-	const CHUNK_SIZE = 32768;
-	const arr = [];
+function encodeBase64(input, url = !1) {
+	if (Uint8Array.prototype.toBase64) return input.toBase64({
+		alphabet: url ? "base64url" : "base64",
+		omitPadding: url
+	});
+	const CHUNK_SIZE = 32768, arr = [];
 	for (let i = 0; i < input.length; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-	return btoa(arr.join(""));
-}
-function decodeBase64(encoded) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded);
-	const binary = atob(encoded);
-	const bytes = new Uint8Array(binary.length);
+	const encoded = btoa(arr.join(""));
+	return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+}
+function decodeBase64(encoded, url = !1) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+	if (url) {
+		if (encoded.includes("+") || encoded.includes("/")) throw new TypeError("Invalid base64url");
+		encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+	}
+	const binary = atob(encoded), bytes = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
 	return bytes;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/base64url.js
-function decode(input) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), { alphabet: "base64url" });
-	let encoded = input;
-	if (encoded instanceof Uint8Array) encoded = decoder.decode(encoded);
-	encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
-	try {
-		return decodeBase64(encoded);
-	} catch {
-		throw new TypeError("The input to be decoded is not correctly encoded.");
-	}
-}
-function encode(input) {
-	let unencoded = input;
-	if (typeof unencoded === "string") unencoded = encoder$1.encode(unencoded);
-	if (Uint8Array.prototype.toBase64) return unencoded.toBase64({
-		alphabet: "base64url",
-		omitPadding: true
-	});
-	return encodeBase64(unencoded).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/crypto_key.js
-const unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-const isAlgorithm = (algorithm, name) => algorithm.name === name;
-function getHashLength(hash) {
-	return parseInt(hash.name.slice(4), 10);
-}
-function checkHashLength(algorithm, expected) {
-	if (getHashLength(algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
-}
-function getNamedCurve(alg) {
-	switch (alg) {
-		case "ES256": return "P-256";
-		case "ES384": return "P-384";
-		case "ES512": return "P-521";
-		default: throw new Error("unreachable");
-	}
-}
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-function checkSigCryptoKey(key, alg, usage) {
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512":
-			if (!isAlgorithm(key.algorithm, "HMAC")) throw unusable("HMAC");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "RS256":
-		case "RS384":
-		case "RS512":
-			if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable("RSASSA-PKCS1-v1_5");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "PS256":
-		case "PS384":
-		case "PS512":
-			if (!isAlgorithm(key.algorithm, "RSA-PSS")) throw unusable("RSA-PSS");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "Ed25519":
-		case "EdDSA":
-			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusable("Ed25519");
-			break;
-		case "ML-DSA-44":
-		case "ML-DSA-65":
-		case "ML-DSA-87":
-			if (!isAlgorithm(key.algorithm, alg)) throw unusable(alg);
-			break;
-		case "ES256":
-		case "ES384":
-		case "ES512": {
-			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusable("ECDSA");
-			const expected = getNamedCurve(alg);
-			if (key.algorithm.namedCurve !== expected) throw unusable(expected, "algorithm.namedCurve");
-			break;
-		}
-		default: throw new TypeError("CryptoKey does not support this operation");
-	}
-	checkUsage(key, usage);
-}
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/invalid_key_input.js
-function message(msg, actual, ...types) {
-	types = types.filter(Boolean);
-	if (types.length > 2) {
-		const last = types.pop();
-		msg += `one of type ${types.join(", ")}, or ${last}.`;
-	} else if (types.length === 2) msg += `one of type ${types[0]} or ${types[1]}.`;
-	else msg += `of type ${types[0]}.`;
-	if (actual == null) msg += ` Received ${actual}`;
-	else if (typeof actual === "function" && actual.name) msg += ` Received function ${actual.name}`;
-	else if (typeof actual === "object" && actual != null) {
-		if (actual.constructor?.name) msg += ` Received an instance of ${actual.constructor.name}`;
-	}
-	return msg;
+async function digest(algorithm, data) {
+	const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+	return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
 }
-const invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
-const withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/errors.js
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js
 var JOSEError = class extends Error {
 	static code = "ERR_JOSE_GENERIC";
 	code = "ERR_JOSE_GENERIC";
 	constructor(message, options) {
-		super(message, options);
-		this.name = this.constructor.name;
-		Error.captureStackTrace?.(this, this.constructor);
+		super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
 	}
 };
 var JWTClaimValidationFailed = class extends JOSEError {
@@ -2184,10 +2217,7 @@ var JWTClaimValidationFailed = class extends JOSEError {
 			claim,
 			reason,
 			payload
-		} });
-		this.claim = claim;
-		this.reason = reason;
-		this.payload = payload;
+		} }), this.claim = claim, this.reason = reason, this.payload = payload;
 	}
 };
 var JWTExpired = class extends JOSEError {
@@ -2201,10 +2231,7 @@ var JWTExpired = class extends JOSEError {
 			claim,
 			reason,
 			payload
-		} });
-		this.claim = claim;
-		this.reason = reason;
-		this.payload = payload;
+		} }), this.claim = claim, this.reason = reason, this.payload = payload;
 	}
 };
 var JOSEAlgNotAllowed = class extends JOSEError {
@@ -2235,763 +2262,615 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/is_key_like.js
-const isCryptoKey = (key) => {
-	if (key?.[Symbol.toStringTag] === "CryptoKey") return true;
-	try {
-		return key instanceof CryptoKey;
-	} catch {
-		return false;
-	}
-};
-const isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/helpers.js
-function decodeBase64url(value, label, ErrorClass) {
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js
+const invalid$1 = "The input to be decoded is not correctly encoded.";
+function decode(input) {
 	try {
-		return decode(value);
-	} catch {
-		throw new ErrorClass(`Failed to base64url decode the ${label}`);
+		return decodeBase64(typeof input == "string" ? input : decoder.decode(input), !0);
+	} catch (cause) {
+		throw new TypeError(invalid$1, { cause });
 	}
 }
-async function digest(algorithm, data) {
-	const subtleDigest = `SHA-${algorithm.slice(-3)}`;
-	return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+function encode(input) {
+	return encodeBase64(typeof input == "string" ? encoder$1.encode(input) : input, !0);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/type_checks.js
-const isObjectLike = (value) => typeof value === "object" && value !== null;
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js
 function isObject(input) {
-	if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") return false;
-	if (Object.getPrototypeOf(input) === null) return true;
-	let proto = input;
-	while (Object.getPrototypeOf(proto) !== null) proto = Object.getPrototypeOf(proto);
-	return Object.getPrototypeOf(input) === proto;
+	if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") return !1;
+	const prototype = Object.getPrototypeOf(input);
+	return prototype === null || Object.getPrototypeOf(prototype) === null;
 }
 function isDisjoint(...headers) {
-	const sources = headers.filter(Boolean);
-	if (sources.length === 0 || sources.length === 1) return true;
-	let acc;
-	for (const header of sources) {
-		const parameters = Object.keys(header);
-		if (!acc || acc.size === 0) {
-			acc = new Set(parameters);
-			continue;
-		}
-		for (const parameter of parameters) {
-			if (acc.has(parameter)) return false;
-			acc.add(parameter);
-		}
+	const parameters = new Set();
+	for (const header of headers) if (header) for (const parameter of Object.keys(header)) {
+		if (parameters.has(parameter)) return !1;
+		parameters.add(parameter);
 	}
-	return true;
+	return !0;
 }
-const isJWK = (key) => isObject(key) && typeof key.kty === "string";
-const isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
-const isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
-const isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/signing.js
-function checkKeyLength(alg, key) {
-	if (alg.startsWith("RS") || alg.startsWith("PS")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-	}
-}
-function subtleAlgorithm(alg, algorithm) {
-	const hash = `SHA-${alg.slice(-3)}`;
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512": return {
-			hash,
-			name: "HMAC"
-		};
-		case "PS256":
-		case "PS384":
-		case "PS512": return {
-			hash,
-			name: "RSA-PSS",
-			saltLength: parseInt(alg.slice(-3), 10) >> 3
-		};
-		case "RS256":
-		case "RS384":
-		case "RS512": return {
-			hash,
-			name: "RSASSA-PKCS1-v1_5"
-		};
-		case "ES256":
-		case "ES384":
-		case "ES512": return {
-			hash,
-			name: "ECDSA",
-			namedCurve: algorithm.namedCurve
-		};
-		case "Ed25519":
-		case "EdDSA": return { name: "Ed25519" };
-		case "ML-DSA-44":
-		case "ML-DSA-65":
-		case "ML-DSA-87": return { name: alg };
-		default: throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+function decodeBase64url(value, label, ErrorClass) {
+	try {
+		return decode(value);
+	} catch {
+		throw new ErrorClass(`Failed to base64url decode the ${label}`);
 	}
 }
-async function getSigKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		if (!alg.startsWith("HS")) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-		return crypto.subtle.importKey("raw", key, {
-			hash: `SHA-${alg.slice(-3)}`,
-			name: "HMAC"
-		}, false, [usage]);
+function encodeBase64url(value, label, ErrorClass) {
+	try {
+		return encode$1(value);
+	} catch {
+		throw new ErrorClass(`The ${label} is not a valid base64url string`);
 	}
-	checkSigCryptoKey(key, alg, usage);
-	return key;
 }
-async function verify(alg, key, signature, data) {
-	const cryptoKey = await getSigKey(alg, key, "verify");
-	checkKeyLength(alg, cryptoKey);
-	const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
+function parseJoseHeader(b64, ErrorClass, message) {
+	let parsed;
 	try {
-		return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+		parsed = JSON.parse(strictDecoder.decode(decode(b64)));
 	} catch {
-		return false;
+		throw new ErrorClass(message);
 	}
+	if (!isObject(parsed)) throw new ErrorClass(message);
+	return parsed;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/jwk_to_key.js
-const unsupportedAlg = "Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value";
-function subtleMapping(jwk) {
-	let algorithm;
-	let keyUsages;
-	switch (jwk.kty) {
-		case "AKP":
-			switch (jwk.alg) {
-				case "ML-DSA-44":
-				case "ML-DSA-65":
-				case "ML-DSA-87":
-					algorithm = { name: jwk.alg };
-					keyUsages = jwk.priv ? ["sign"] : ["verify"];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "RSA":
-			switch (jwk.alg) {
-				case "PS256":
-				case "PS384":
-				case "PS512":
-					algorithm = {
-						name: "RSA-PSS",
-						hash: `SHA-${jwk.alg.slice(-3)}`
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "RS256":
-				case "RS384":
-				case "RS512":
-					algorithm = {
-						name: "RSASSA-PKCS1-v1_5",
-						hash: `SHA-${jwk.alg.slice(-3)}`
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "RSA-OAEP":
-				case "RSA-OAEP-256":
-				case "RSA-OAEP-384":
-				case "RSA-OAEP-512":
-					algorithm = {
-						name: "RSA-OAEP",
-						hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
-					};
-					keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "EC":
-			switch (jwk.alg) {
-				case "ES256":
-				case "ES384":
-				case "ES512":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: {
-							ES256: "P-256",
-							ES384: "P-384",
-							ES512: "P-521"
-						}[jwk.alg]
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = {
-						name: "ECDH",
-						namedCurve: jwk.crv
-					};
-					keyUsages = jwk.d ? ["deriveBits"] : [];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "OKP":
-			switch (jwk.alg) {
-				case "Ed25519":
-				case "EdDSA":
-					algorithm = { name: "Ed25519" };
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = { name: jwk.crv };
-					keyUsages = jwk.d ? ["deriveBits"] : [];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		default: throw new JOSENotSupported("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
-	}
-	return {
-		algorithm,
-		keyUsages
+const JWS_RECOGNIZED = {
+	__proto__: null,
+	b64: !0
+};
+function validateAlgorithms(option, algorithms) {
+	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
+	return algorithms === void 0 ? void 0 : new Set(algorithms);
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
+	if (!protectedHeader || protectedHeader.crit === void 0) return [];
+	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
+	const recognized = recognizedOption === void 0 ? recognizedDefault : {
+		__proto__: null,
+		...recognizedOption,
+		...recognizedDefault
 	};
+	for (const parameter of protectedHeader.crit) {
+		if (!(parameter in recognized)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+		if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+		if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+	}
+	return protectedHeader.crit;
 }
-async function jwkToKey(jwk) {
-	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
-	const { algorithm, keyUsages } = subtleMapping(jwk);
-	const keyData = { ...jwk };
-	if (keyData.kty !== "AKP") delete keyData.alg;
-	delete keyData.use;
-	return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+function validateB64(protectedHeader, extensions) {
+	if (extensions.includes("b64")) {
+		const b64 = protectedHeader.b64;
+		if (typeof b64 != "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
+		return b64;
+	}
+	return !0;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/normalize_key.js
-const unusableForAlg = "given KeyObject instance cannot be used for this algorithm";
-let cache;
-const handleJWK = async (key, jwk, alg, freeze = false) => {
-	cache ||= new WeakMap();
-	let cached = cache.get(key);
-	if (cached?.[alg]) return cached[alg];
-	const cryptoKey = await jwkToKey({
-		...jwk,
-		alg
-	});
-	if (freeze) Object.freeze(key);
-	if (!cached) cache.set(key, { [alg]: cryptoKey });
-	else cached[alg] = cryptoKey;
-	return cryptoKey;
-};
-const handleKeyObject = (keyObject, alg) => {
-	cache ||= new WeakMap();
-	let cached = cache.get(keyObject);
-	if (cached?.[alg]) return cached[alg];
-	const isPublic = keyObject.type === "public";
-	const extractable = isPublic ? true : false;
-	let cryptoKey;
-	if (keyObject.asymmetricKeyType === "x25519") {
-		switch (alg) {
-			case "ECDH-ES":
-			case "ECDH-ES+A128KW":
-			case "ECDH-ES+A192KW":
-			case "ECDH-ES+A256KW": break;
-			default: throw new TypeError(unusableForAlg);
-		}
-		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ["deriveBits"]);
-	}
-	if (keyObject.asymmetricKeyType === "ed25519") {
-		if (alg !== "EdDSA" && alg !== "Ed25519") throw new TypeError(unusableForAlg);
-		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js
+const tag = (key) => key[Symbol.toStringTag];
+const jwkMatchesOp = (entry, key, usage) => {
+	const { alg } = entry;
+	if (key.use !== void 0) {
+		const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
 	}
-	switch (keyObject.asymmetricKeyType) {
-		case "ml-dsa-44":
-		case "ml-dsa-65":
-		case "ml-dsa-87":
-			if (alg !== keyObject.asymmetricKeyType.toUpperCase()) throw new TypeError(unusableForAlg);
-			cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
+	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+	if (Array.isArray(key.key_ops)) {
+		const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+		if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
 	}
-	if (keyObject.asymmetricKeyType === "rsa") {
-		let hash;
-		switch (alg) {
-			case "RSA-OAEP":
-				hash = "SHA-1";
-				break;
-			case "RS256":
-			case "PS256":
-			case "RSA-OAEP-256":
-				hash = "SHA-256";
-				break;
-			case "RS384":
-			case "PS384":
-			case "RSA-OAEP-384":
-				hash = "SHA-384";
-				break;
-			case "RS512":
-			case "PS512":
-			case "RSA-OAEP-512":
-				hash = "SHA-512";
-				break;
-			default: throw new TypeError(unusableForAlg);
+};
+async function prepareKey(entry, key, usage) {
+	const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+	if (secret && key instanceof Uint8Array) return key;
+	let normalized, keyObject;
+	if (isObject(key)) {
+		if (normalized = normalizeJwk(key), typeof normalized.kty != "string") throw invalidKeyType(alg, key, secret);
+		if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0))) throw new TypeError(secret ? "JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present" : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+		if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct") return decode(normalized.k);
+		if (!Object.isFrozen(key)) {
+			const { key_ops } = key;
+			Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
 		}
-		if (alg.startsWith("RSA-OAEP")) return keyObject.toCryptoKey({
-			name: "RSA-OAEP",
-			hash
-		}, extractable, isPublic ? ["encrypt"] : ["decrypt"]);
-		cryptoKey = keyObject.toCryptoKey({
-			name: alg.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
-			hash
-		}, extractable, [isPublic ? "verify" : "sign"]);
+	} else {
+		if (!isKeyLike(key)) throw invalidKeyType(alg, key, secret);
+		const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+		if (key.type !== expectedType && (secret || [
+			"secret",
+			"public",
+			"private"
+		].includes(key.type))) throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+		if (isCryptoKey(key)) return key;
+		if (keyObject = key, keyObject.type === "secret") return keyObject.export();
 	}
-	if (keyObject.asymmetricKeyType === "ec") {
-		const namedCurve = new Map([
-			["prime256v1", "P-256"],
-			["secp384r1", "P-384"],
-			["secp521r1", "P-521"]
-		]).get(keyObject.asymmetricKeyDetails?.namedCurve);
-		if (!namedCurve) throw new TypeError(unusableForAlg);
-		const expectedCurve = {
-			ES256: "P-256",
-			ES384: "P-384",
-			ES512: "P-521"
-		};
-		if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) cryptoKey = keyObject.toCryptoKey({
-			name: "ECDSA",
-			namedCurve
-		}, extractable, [isPublic ? "verify" : "sign"]);
-		if (alg.startsWith("ECDH-ES")) cryptoKey = keyObject.toCryptoKey({
-			name: "ECDH",
-			namedCurve
-		}, extractable, isPublic ? [] : ["deriveBits"]);
+	cache ||= new WeakMap();
+	const cacheKey = key;
+	let cached = cache.get(cacheKey);
+	if (cached?.[alg]) return cached[alg];
+	if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+		const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({
+			crv,
+			asymmetricKeyType: keyObject.asymmetricKeyType
+		}) ?? entry.subtle;
+		return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
 	}
-	if (!cryptoKey) throw new TypeError(unusableForAlg);
-	if (!cached) cache.set(keyObject, { [alg]: cryptoKey });
-	else cached[alg] = cryptoKey;
-	return cryptoKey;
+	return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+}
+let cache;
+const nist = {
+	__proto__: null,
+	prime256v1: "P-256",
+	secp384r1: "P-384",
+	secp521r1: "P-521"
 };
-async function normalizeKey(key, alg) {
-	if (key instanceof Uint8Array) return key;
-	if (isCryptoKey(key)) return key;
-	if (isKeyObject(key)) {
-		if (key.type === "secret") return key.export();
-		if ("toCryptoKey" in key && typeof key.toCryptoKey === "function") try {
-			return handleKeyObject(key, alg);
-		} catch (err) {
-			if (err instanceof TypeError) throw err;
-		}
-		let jwk = key.export({ format: "jwk" });
-		return handleJWK(key, jwk, alg);
-	}
-	if (isJWK(key)) {
-		if (key.k) return decode(key.k);
-		return handleJWK(key, key, alg, true);
+const isCryptoKey = (key) => {
+	if (key?.[Symbol.toStringTag] === "CryptoKey") return !0;
+	try {
+		return key instanceof CryptoKey;
+	} catch {
+		return !1;
 	}
-	throw new Error("unreachable");
+};
+const isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+	if (types.length > 2) {
+		const last = types.pop();
+		msg += `one of type ${types.join(", ")}, or ${last}.`;
+	} else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+	return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/key/import.js
-async function importJWK(jwk, alg, options) {
-	if (!isObject(jwk)) throw new TypeError("JWK must be an object");
-	let ext;
-	alg ??= jwk.alg;
-	ext ??= options?.extractable ?? jwk.ext;
-	switch (jwk.kty) {
-		case "oct":
-			if (typeof jwk.k !== "string" || !jwk.k) throw new TypeError("missing \"k\" (Key Value) Parameter value");
-			return decode(jwk.k);
-		case "RSA":
-			if ("oth" in jwk && jwk.oth !== void 0) throw new JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");
-			return jwkToKey({
-				...jwk,
-				alg,
-				ext
-			});
-		case "AKP":
-			if (typeof jwk.alg !== "string" || !jwk.alg) throw new TypeError("missing \"alg\" (Algorithm) Parameter value");
-			if (alg !== void 0 && alg !== jwk.alg) throw new TypeError("JWK alg and alg option value mismatch");
-			return jwkToKey({
-				...jwk,
-				ext
-			});
-		case "EC":
-		case "OKP": return jwkToKey({
-			...jwk,
-			alg,
-			ext
-		});
-		default: throw new JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");
+const invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+function invalidKeyType(alg, actual, secret) {
+	const types = [
+		"CryptoKey",
+		"KeyObject",
+		"JSON Web Key"
+	];
+	return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+const unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+	const { modulusLength } = key.algorithm;
+	if (typeof modulusLength != "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+	const algorithm = key.algorithm;
+	if (algorithm.name !== expected.name) throw unusable(expected.name);
+	if (expected.hash && algorithm.hash?.name !== expected.hash) throw unusable(expected.hash, "algorithm.hash");
+	if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) throw unusable(expected.namedCurve, "algorithm.namedCurve");
+	if (expected.length !== void 0 && algorithm.length !== expected.length) throw unusable(expected.length, "algorithm.length");
+	checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+	return {
+		__proto__: null,
+		...jwk
+	};
+}
+function normalizeJwk(jwk) {
+	const normalized = snapshotJwk(jwk);
+	if (normalized.ext !== void 0 && typeof normalized.ext != "boolean") throw new TypeError("\"ext\" (Extractable) Parameter must be a boolean");
+	if (normalized.key_ops !== void 0) {
+		const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+		if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length) throw new TypeError("\"key_ops\" (Key Operations) Parameter must be an array of unique strings");
+		normalized.key_ops = keyOps;
 	}
+	return normalized;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/key_to_jwk.js
-function omitUndefinedProperties(jwk) {
-	return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== void 0));
+function validateExtractableOption(extractable) {
+	if (extractable !== void 0 && typeof extractable != "boolean") throw new TypeError("\"extractable\" option must be a boolean");
+	return extractable;
 }
-async function keyToJWK(key) {
-	if (isKeyObject(key)) if (key.type === "secret") key = key.export();
-	else return key.export({ format: "jwk" });
-	if (key instanceof Uint8Array) return {
-		kty: "oct",
-		k: encode(key)
+async function jwkToKey(entry, jwk, extractable) {
+	if (!entry.kty.includes(jwk.kty)) throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+	const algorithm = entry.resolve?.({
+		kty: jwk.kty,
+		crv: jwk.crv
+	}) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = {
+		...jwk,
+		ext: extractable ?? jwk.ext
 	};
-	if (!isCryptoKey(key)) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
-	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
-	const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey("jwk", key));
-	if (jwk.kty === "AKP") jwk.alg = alg;
-	return jwk;
+	return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/key/export.js
-async function exportJWK(key) {
-	return keyToJWK(key);
+async function rawKey(key, expected, usage, extractable = !1) {
+	return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/validate_crit.js
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
-	if (!protectedHeader || protectedHeader.crit === void 0) return new Set();
-	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
-	let recognized;
-	if (recognizedOption !== void 0) recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
-	else recognized = recognizedDefault;
-	for (const parameter of protectedHeader.crit) {
-		if (!recognized.has(parameter)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-		if (joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-		if (recognized.get(parameter) && protectedHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-	}
-	return new Set(protectedHeader.crit);
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+	const out = { __proto__: null };
+	for (const alg in entries) out[alg] = {
+		...entries[alg],
+		alg
+	};
+	return out;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/validate_algorithms.js
-function validateAlgorithms(option, algorithms) {
-	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
-	if (!algorithms) return;
-	return new Set(algorithms);
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwe_algorithms.js
+const wrap = [["encrypt", "wrapKey"], ["decrypt", "unwrapKey"]];
+const derive = [[], ["deriveBits"]];
+const none = [[], []];
+function rsaes(bits) {
+	return {
+		kty: ["RSA"],
+		mode: "key-encryption",
+		subtle: {
+			name: "RSA-OAEP",
+			hash: `SHA-${bits}`
+		},
+		usages: wrap,
+		ops: ["wrapKey", "unwrapKey"]
+	};
+}
+function ecdh(mode) {
+	return {
+		kty: ["EC", "OKP"],
+		mode,
+		subtle: { name: "ECDH" },
+		resolve: ({ kty, crv, asymmetricKeyType }) => {
+			if (crv === "X25519" || asymmetricKeyType === "x25519") return { name: "X25519" };
+			if (kty === "OKP") throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+			return {
+				name: "ECDH",
+				namedCurve: crv
+			};
+		},
+		usages: derive,
+		ops: [void 0, "deriveBits"]
+	};
 }
+function aeskw(bits, gcm = !1) {
+	return {
+		kty: ["oct"],
+		mode: "key-wrapping",
+		secret: !0,
+		subtle: {
+			name: gcm ? "AES-GCM" : "AES-KW",
+			length: bits
+		},
+		usages: none,
+		ops: gcm ? ["encrypt", "decrypt"] : ["wrapKey", "unwrapKey"]
+	};
+}
+function pbes2() {
+	return {
+		kty: ["oct"],
+		mode: "key-wrapping",
+		secret: !0,
+		subtle: { name: "PBKDF2" },
+		usages: none,
+		ops: ["deriveBits", "deriveBits"]
+	};
+}
+const JWE = table({
+	dir: {
+		kty: ["oct"],
+		mode: "direct-encryption",
+		secret: !0,
+		subtle: { name: "AES-GCM" },
+		usages: none,
+		ops: ["encrypt", "decrypt"]
+	},
+	"RSA-OAEP": rsaes(1),
+	"RSA-OAEP-256": rsaes(256),
+	"RSA-OAEP-384": rsaes(384),
+	"RSA-OAEP-512": rsaes(512),
+	"ECDH-ES": ecdh("direct-key-agreement"),
+	"ECDH-ES+A128KW": ecdh("key-agreement-with-key-wrapping"),
+	"ECDH-ES+A192KW": ecdh("key-agreement-with-key-wrapping"),
+	"ECDH-ES+A256KW": ecdh("key-agreement-with-key-wrapping"),
+	A128KW: aeskw(128),
+	A192KW: aeskw(192),
+	A256KW: aeskw(256),
+	A128GCMKW: aeskw(128, !0),
+	A192GCMKW: aeskw(192, !0),
+	A256GCMKW: aeskw(256, !0),
+	"PBES2-HS256+A128KW": pbes2(),
+	"PBES2-HS384+A192KW": pbes2(),
+	"PBES2-HS512+A256KW": pbes2()
+});
+const contentOps = ["encrypt", "decrypt"];
+function contentEncryption(bits, cbc = !1) {
+	return {
+		kty: ["oct"],
+		secret: !0,
+		subtle: {
+			name: cbc ? "AES-CBC" : "AES-GCM",
+			length: bits
+		},
+		usages: none,
+		ops: contentOps,
+		cekBits: bits,
+		ivBits: cbc ? 128 : 96,
+		cbc
+	};
+}
+table({
+	A128GCM: contentEncryption(128),
+	A192GCM: contentEncryption(192),
+	A256GCM: contentEncryption(256),
+	"A128CBC-HS256": contentEncryption(256, !0),
+	"A192CBC-HS384": contentEncryption(384, !0),
+	"A256CBC-HS512": contentEncryption(512, !0)
+});
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/check_key_type.js
-const tag = (key) => key?.[Symbol.toStringTag];
-const jwkMatchesOp = (alg, key, usage) => {
-	if (key.use !== void 0) {
-		let expected;
-		switch (usage) {
-			case "sign":
-			case "verify":
-				expected = "sig";
-				break;
-			case "encrypt":
-			case "decrypt":
-				expected = "enc";
-				break;
-		}
-		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-	}
-	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-	if (Array.isArray(key.key_ops)) {
-		let expectedKeyOp;
-		switch (true) {
-			case usage === "sign" || usage === "verify":
-			case alg === "dir":
-			case alg.includes("CBC-HS"):
-				expectedKeyOp = usage;
-				break;
-			case alg.startsWith("PBES2"):
-				expectedKeyOp = "deriveBits";
-				break;
-			case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
-				if (!alg.includes("GCM") && alg.endsWith("KW")) expectedKeyOp = usage === "encrypt" ? "wrapKey" : "unwrapKey";
-				else expectedKeyOp = usage;
-				break;
-			case usage === "encrypt" && alg.startsWith("RSA"):
-				expectedKeyOp = "wrapKey";
-				break;
-			case usage === "decrypt":
-				expectedKeyOp = alg.startsWith("RSA") ? "unwrapKey" : "deriveBits";
-				break;
-		}
-		if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-	}
-	return true;
-};
-const symmetricTypeCheck = (alg, key, usage) => {
-	if (key instanceof Uint8Array) return;
-	if (isJWK(key)) {
-		if (isSecretJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-		throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
-	}
-	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
-	if (key.type !== "secret") throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-};
-const asymmetricTypeCheck = (alg, key, usage) => {
-	if (isJWK(key)) switch (usage) {
-		case "decrypt":
-		case "sign":
-			if (isPrivateJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-			throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
-		case "encrypt":
-		case "verify":
-			if (isPublicJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-			throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
-	}
-	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-	if (key.type === "secret") throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-	if (key.type === "public") switch (usage) {
-		case "sign": throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
-		case "decrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
-	}
-	if (key.type === "private") switch (usage) {
-		case "verify": throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
-		case "encrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
-	}
-};
-function checkKeyType(alg, key, usage) {
-	switch (alg.substring(0, 2)) {
-		case "A1":
-		case "A2":
-		case "di":
-		case "HS":
-		case "PB":
-			symmetricTypeCheck(alg, key, usage);
-			break;
-		default: asymmetricTypeCheck(alg, key, usage);
-	}
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js
+const sig = [["verify"], ["sign"]];
+function hmac(bits) {
+	const subtle = {
+		name: "HMAC",
+		hash: `SHA-${bits}`
+	};
+	return {
+		kty: ["oct"],
+		secret: !0,
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+function rsa(bits, saltLength) {
+	const subtle = {
+		name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+		hash: `SHA-${bits}`
+	};
+	return {
+		kty: ["RSA"],
+		subtle,
+		signing: saltLength ? {
+			...subtle,
+			saltLength
+		} : subtle,
+		usages: sig,
+		minRsaBits: 2048
+	};
+}
+function ecdsa(crv, bits) {
+	return {
+		kty: ["EC"],
+		crv,
+		subtle: {
+			name: "ECDSA",
+			namedCurve: crv
+		},
+		signing: {
+			name: "ECDSA",
+			hash: `SHA-${bits}`
+		},
+		usages: sig
+	};
+}
+function eddsa() {
+	const subtle = { name: "Ed25519" };
+	return {
+		kty: ["OKP"],
+		crv: "Ed25519",
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+function mldsa(bits) {
+	const subtle = { name: `ML-DSA-${bits}` };
+	return {
+		kty: ["AKP"],
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+const JWS = table({
+	HS256: hmac(256),
+	HS384: hmac(384),
+	HS512: hmac(512),
+	RS256: rsa(256),
+	RS384: rsa(384),
+	RS512: rsa(512),
+	PS256: rsa(256, 32),
+	PS384: rsa(384, 48),
+	PS512: rsa(512, 64),
+	ES256: ecdsa("P-256", 256),
+	ES384: ecdsa("P-384", 384),
+	ES512: ecdsa("P-521", 512),
+	EdDSA: eddsa(),
+	Ed25519: eddsa(),
+	"ML-DSA-44": mldsa(44),
+	"ML-DSA-65": mldsa(65),
+	"ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+	const entry = typeof alg == "string" ? JWS[alg] : void 0;
+	if (!entry) throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+	return entry;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/jws/flattened/verify.js
-async function flattenedVerify(jws, key, options) {
-	if (!isObject(jws)) throw new JWSInvalid("Flattened JWS must be an object");
-	if (jws.protected === void 0 && jws.header === void 0) throw new JWSInvalid("Flattened JWS must have either of the \"protected\" or \"header\" members");
-	if (jws.protected !== void 0 && typeof jws.protected !== "string") throw new JWSInvalid("JWS Protected Header incorrect type");
-	if (jws.payload === void 0) throw new JWSInvalid("JWS Payload missing");
-	if (typeof jws.signature !== "string") throw new JWSInvalid("JWS Signature missing or incorrect type");
-	if (jws.header !== void 0 && !isObject(jws.header)) throw new JWSInvalid("JWS Unprotected Header incorrect type");
-	let parsedProt = {};
-	if (jws.protected) try {
-		const protectedHeader = decode(jws.protected);
-		parsedProt = JSON.parse(decoder.decode(protectedHeader));
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js
+function prepareVerify(options) {
+	return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+	return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeCompactUnencodedPayload(payload) {
+	try {
+		return encode$1(payload);
 	} catch {
-		throw new JWSInvalid("JWS Protected Header is invalid");
+		throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
 	}
-	if (!isDisjoint(parsedProt, jws.header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+	const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+	if (!isDisjoint(parsedProt, header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
 	const joseHeader = {
 		...parsedProt,
-		...jws.header
-	};
-	const extensions = validateCrit(JWSInvalid, new Map([["b64", true]]), options?.crit, parsedProt, joseHeader);
-	let b64 = true;
-	if (extensions.has("b64")) {
-		b64 = parsedProt.b64;
-		if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
-	}
-	const { alg } = joseHeader;
-	if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
-	const algorithms = options && validateAlgorithms("algorithms", options.algorithms);
-	if (algorithms && !algorithms.has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
+		...header
+	}, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+	if (shared[0] && !shared[0].has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
 	if (b64) {
-		if (typeof jws.payload !== "string") throw new JWSInvalid("JWS Payload must be a string");
-	} else if (typeof jws.payload !== "string" && !(jws.payload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
-	let resolvedKey = false;
-	if (typeof key === "function") {
-		key = await key(parsedProt, jws);
-		resolvedKey = true;
-	}
-	checkKeyType(alg, key, "verify");
-	const data = concat(jws.protected !== void 0 ? encode$1(jws.protected) : new Uint8Array(), encode$1("."), typeof jws.payload === "string" ? b64 ? encode$1(jws.payload) : encoder$1.encode(jws.payload) : jws.payload);
-	const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
-	const k = await normalizeKey(key, alg);
-	if (!await verify(alg, k, signature, data)) throw new JWSSignatureVerificationFailed();
-	let payload;
-	if (b64) payload = decodeBase64url(jws.payload, "payload", JWSInvalid);
-	else if (typeof jws.payload === "string") payload = encoder$1.encode(jws.payload);
-	else payload = jws.payload;
-	const result = { payload };
-	if (jws.protected !== void 0) result.protectedHeader = parsedProt;
-	if (jws.header !== void 0) result.unprotectedHeader = jws.header;
-	if (resolvedKey) return {
+		if (typeof inputPayload != "string") throw new JWSInvalid("JWS Payload must be a string");
+	} else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+	const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+	let resolvedKey = !1;
+	typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
+	const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode$1(encodedProtected) : new Uint8Array(), encode$1("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+	entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+	let verified = !1;
+	try {
+		verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+	} catch {}
+	if (!verified) throw new JWSSignatureVerificationFailed();
+	const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+	return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{
 		...result,
 		key: k
-	};
-	return result;
+	}, b64] : [result, b64];
 }
-//#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/jws/compact/verify.js
-async function compactVerify(jws, key, options) {
-	if (jws instanceof Uint8Array) jws = decoder.decode(jws);
-	if (typeof jws !== "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+async function verifyCompact(jws, shared, key) {
+	if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
 	const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
 	if (length !== 3) throw new JWSInvalid("Invalid Compact JWS");
-	const verified = await flattenedVerify({
+	return verifySignature({
 		payload,
 		protected: protectedHeader,
 		signature
-	}, key, options);
-	const result = {
-		payload: verified.payload,
-		protectedHeader: verified.protectedHeader
-	};
-	if (typeof key === "function") return {
-		...result,
-		key: verified.key
-	};
-	return result;
+	}, shared, key, encodeCompactUnencodedPayload);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
 const epoch = (date) => Math.floor(date.getTime() / 1e3);
-const minute = 60;
-const hour = minute * 60;
-const day = hour * 24;
-const week = day * 7;
-const year = day * 365.25;
+const multipliers = {
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 86400,
+	w: 604800,
+	y: 31557600
+};
 const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+const checkFailed = "check_failed";
+function invalidDuration() {
+	throw new TypeError("Invalid time period format");
+}
 function secs(str) {
+	typeof str != "string" && invalidDuration();
 	const matched = REGEX.exec(str);
-	if (!matched || matched[4] && matched[1]) throw new TypeError("Invalid time period format");
-	const value = parseFloat(matched[2]);
-	const unit = matched[3].toLowerCase();
-	let numericDate;
-	switch (unit) {
-		case "sec":
-		case "secs":
-		case "second":
-		case "seconds":
-		case "s":
-			numericDate = Math.round(value);
-			break;
-		case "minute":
-		case "minutes":
-		case "min":
-		case "mins":
-		case "m":
-			numericDate = Math.round(value * minute);
-			break;
-		case "hour":
-		case "hours":
-		case "hr":
-		case "hrs":
-		case "h":
-			numericDate = Math.round(value * hour);
-			break;
-		case "day":
-		case "days":
-		case "d":
-			numericDate = Math.round(value * day);
-			break;
-		case "week":
-		case "weeks":
-		case "w":
-			numericDate = Math.round(value * week);
-			break;
-		default:
-			numericDate = Math.round(value * year);
-			break;
-	}
-	if (matched[1] === "-" || matched[4] === "ago") return -numericDate;
-	return numericDate;
+	(!matched || matched[4] && matched[1]) && invalidDuration();
+	const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+	return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input) {
+	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
+	return input;
 }
 const normalizeTyp = (value) => {
-	if (value.includes("/")) return value.toLowerCase();
-	return `application/${value.toLowerCase()}`;
-};
-const checkAudiencePresence = (audPayload, audOption) => {
-	if (typeof audPayload === "string") return audOption.includes(audPayload);
-	if (Array.isArray(audPayload)) return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
-	return false;
+	const normalized = value.toLowerCase();
+	return value.includes("/") ? normalized : `application/${normalized}`;
 };
+const checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
+function validateNumericDate(payload, claim, required = !1) {
+	const value = payload[claim];
+	if (!(value === void 0 && !required)) {
+		if (typeof value != "number") throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+		return value;
+	}
+}
+function unexpectedClaim(payload, claim) {
+	throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
 function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
 	let payload;
 	try {
-		payload = JSON.parse(decoder.decode(encodedPayload));
+		payload = JSON.parse(strictDecoder.decode(encodedPayload));
 	} catch {}
 	if (!isObject(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
 	const { typ } = options;
-	if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", "check_failed");
-	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-	const presenceCheck = [...requiredClaims];
-	if (maxTokenAge !== void 0) presenceCheck.push("iat");
-	if (audience !== void 0) presenceCheck.push("aud");
-	if (subject !== void 0) presenceCheck.push("sub");
-	if (issuer !== void 0) presenceCheck.push("iss");
-	for (const claim of new Set(presenceCheck.reverse())) if (!(claim in payload)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-	if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) throw new JWTClaimValidationFailed("unexpected \"iss\" claim value", payload, "iss", "check_failed");
-	if (subject && payload.sub !== subject) throw new JWTClaimValidationFailed("unexpected \"sub\" claim value", payload, "sub", "check_failed");
-	if (audience && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) throw new JWTClaimValidationFailed("unexpected \"aud\" claim value", payload, "aud", "check_failed");
-	let tolerance;
-	switch (typeof options.clockTolerance) {
-		case "string":
-			tolerance = secs(options.clockTolerance);
-			break;
-		case "number":
-			tolerance = options.clockTolerance;
-			break;
-		case "undefined":
-			tolerance = 0;
-			break;
-		default: throw new TypeError("Invalid clockTolerance option type");
-	}
-	const { currentDate } = options;
-	const now = epoch(currentDate || new Date());
-	if ((payload.iat !== void 0 || maxTokenAge) && typeof payload.iat !== "number") throw new JWTClaimValidationFailed("\"iat\" claim must be a number", payload, "iat", "invalid");
-	if (payload.nbf !== void 0) {
-		if (typeof payload.nbf !== "number") throw new JWTClaimValidationFailed("\"nbf\" claim must be a number", payload, "nbf", "invalid");
-		if (payload.nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", "check_failed");
-	}
-	if (payload.exp !== void 0) {
-		if (typeof payload.exp !== "number") throw new JWTClaimValidationFailed("\"exp\" claim must be a number", payload, "exp", "invalid");
-		if (payload.exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", "check_failed");
+	if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", checkFailed);
+	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+	maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+	for (const claim of new Set(presenceCheck.reverse())) if (!Object.hasOwn(payload, claim)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+	issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+	const { clockTolerance } = options;
+	let tolerance = 0;
+	if (typeof clockTolerance == "string") tolerance = secs(clockTolerance);
+	else if (clockTolerance !== void 0) {
+		if (typeof clockTolerance != "number") throw new TypeError("Invalid clockTolerance option type");
+		tolerance = clockTolerance;
 	}
-	if (maxTokenAge) {
-		const age = now - payload.iat;
-		const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
-		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", "check_failed");
-		if (age < 0 - tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", "check_failed");
+	validateInput("clockTolerance option", tolerance);
+	const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+	if (nbf !== void 0 && nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", checkFailed);
+	const exp = validateNumericDate(payload, "exp");
+	if (exp !== void 0 && exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", checkFailed);
+	if (maxTokenAge !== void 0) {
+		const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", checkFailed);
+		if (age < -tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", checkFailed);
 	}
 	return payload;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/jwt/verify.js
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
-	const verified = await compactVerify(jwt, key, options);
-	if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-	const result = {
-		payload: validateClaimsSet(verified.protectedHeader, verified.payload, options),
-		protectedHeader: verified.protectedHeader
+	const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+	if (!b64) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+	const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+	return {
+		...verified,
+		payload
 	};
-	if (typeof key === "function") return {
-		...result,
-		key: verified.key
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_algorithm.js
+function unsupportedAlg(source = "JWK \"alg\" (Algorithm) Parameter") {
+	throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+function keyAlgorithm(alg, source) {
+	return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/key/export.js
+async function exportJWK(key) {
+	if (isKeyObject(key)) if (key.type === "secret") key = key.export();
+	else return key.export({ format: "jwk" });
+	if (key instanceof Uint8Array) return {
+		kty: "oct",
+		k: encode(key)
 	};
-	return result;
+	if (!isCryptoKey(key)) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+	const jwk = await crypto.subtle.exportKey("jwk", key);
+	delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+	for (const parameter of Object.keys(jwk)) jwk[parameter] === void 0 && delete jwk[parameter];
+	return jwk;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/jwk/thumbprint.js
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwk/thumbprint.js
 const check = (value, description) => {
-	if (typeof value !== "string" || !value) throw new JWKInvalid(`${description} missing or invalid`);
+	if (typeof value != "string" || !value) throw new JWKInvalid(`${description} missing or invalid`);
 };
 async function calculateJwkThumbprint(key, digestAlgorithm) {
 	let jwk;
-	if (isJWK(key)) jwk = key;
-	else if (isKeyLike(key)) jwk = await exportJWK(key);
+	if (isObject(key)) {
+		if (jwk = snapshotJwk(key), typeof jwk.kty != "string") throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+	} else if (isKeyLike(key)) jwk = snapshotJwk(await exportJWK(key));
 	else throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-	digestAlgorithm ??= "sha256";
-	if (digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512") throw new TypeError("digestAlgorithm must one of \"sha256\", \"sha384\", or \"sha512\"");
+	if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512") throw new TypeError("digestAlgorithm must one of \"sha256\", \"sha384\", or \"sha512\"");
 	let components;
 	switch (jwk.kty) {
 		case "AKP":
-			check(jwk.alg, "\"alg\" (Algorithm) Parameter");
-			check(jwk.pub, "\"pub\" (Public key) Parameter");
-			components = {
+			check(jwk.alg, "\"alg\" (Algorithm) Parameter"), check(jwk.pub, "\"pub\" (Public key) Parameter"), components = {
 				alg: jwk.alg,
 				kty: jwk.kty,
 				pub: jwk.pub
 			};
 			break;
 		case "EC":
-			check(jwk.crv, "\"crv\" (Curve) Parameter");
-			check(jwk.x, "\"x\" (X Coordinate) Parameter");
-			check(jwk.y, "\"y\" (Y Coordinate) Parameter");
-			components = {
+			check(jwk.crv, "\"crv\" (Curve) Parameter"), check(jwk.x, "\"x\" (X Coordinate) Parameter"), check(jwk.y, "\"y\" (Y Coordinate) Parameter"), components = {
 				crv: jwk.crv,
 				kty: jwk.kty,
 				x: jwk.x,
@@ -2999,25 +2878,21 @@ async function calculateJwkThumbprint(key, digestAlgorithm) {
 			};
 			break;
 		case "OKP":
-			check(jwk.crv, "\"crv\" (Subtype of Key Pair) Parameter");
-			check(jwk.x, "\"x\" (Public Key) Parameter");
-			components = {
+			check(jwk.crv, "\"crv\" (Subtype of Key Pair) Parameter"), check(jwk.x, "\"x\" (Public Key) Parameter"), components = {
 				crv: jwk.crv,
 				kty: jwk.kty,
 				x: jwk.x
 			};
 			break;
 		case "RSA":
-			check(jwk.e, "\"e\" (Exponent) Parameter");
-			check(jwk.n, "\"n\" (Modulus) Parameter");
-			components = {
+			check(jwk.e, "\"e\" (Exponent) Parameter"), check(jwk.n, "\"n\" (Modulus) Parameter"), components = {
 				e: jwk.e,
 				kty: jwk.kty,
 				n: jwk.n
 			};
 			break;
 		case "oct":
-			check(jwk.k, "\"k\" (Key Value) Parameter");
+			if (typeof jwk.k != "string") throw new JWKInvalid("\"k\" (Key Value) Parameter missing or invalid");
 			components = {
 				k: jwk.k,
 				kty: jwk.kty
@@ -3029,27 +2904,42 @@ async function calculateJwkThumbprint(key, digestAlgorithm) {
 	return encode(await digest(digestAlgorithm, data));
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/decode_protected_header.js
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+	if (!isObject(jwk)) throw new TypeError("JWK must be an object");
+	const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
+	if (alg ??= jwkAlg, normalized.kty !== "oct" && !alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
+	switch (normalized.kty) {
+		case "oct":
+			if (typeof normalized.k != "string") throw new TypeError("missing \"k\" (Key Value) Parameter value");
+			return decode(normalized.k);
+		case "AKP":
+			if (typeof jwkAlg != "string" || !jwkAlg) throw new TypeError("missing \"alg\" (Algorithm) Parameter value");
+			if (alg !== jwkAlg) throw new TypeError("JWK alg and alg option value mismatch");
+			return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+		case "RSA":
+		case "EC":
+		case "OKP": return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+		default: throw new JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/decode_protected_header.js
 function decodeProtectedHeader(token) {
 	let protectedB64u;
-	if (typeof token === "string") {
+	if (typeof token == "string") {
 		const parts = token.split(".");
-		if (parts.length === 3 || parts.length === 5) [protectedB64u] = parts;
-	} else if (typeof token === "object" && token) if ("protected" in token) protectedB64u = token.protected;
+		(parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);
+	} else if (typeof token == "object" && token) if ("protected" in token) protectedB64u = token.protected;
 	else throw new TypeError("Token does not contain a Protected Header");
-	try {
-		if (typeof protectedB64u !== "string" || !protectedB64u) throw new Error();
-		const result = JSON.parse(decoder.decode(decode(protectedB64u)));
-		if (!isObject(result)) throw new Error();
-		return result;
-	} catch {
-		throw new TypeError("Invalid Token or Protected Header formatting");
-	}
+	const invalid = "Invalid Token or Protected Header formatting";
+	if (typeof protectedB64u != "string" || !protectedB64u) throw new TypeError(invalid);
+	return parseJoseHeader(protectedB64u, TypeError, invalid);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/util/decode_jwt.js
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/decode_jwt.js
 function decodeJwt(jwt) {
-	if (typeof jwt !== "string") throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
+	if (typeof jwt != "string") throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
 	const { 1: payload, length } = jwt.split(".");
 	if (length === 5) throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
 	if (length !== 3) throw new JWTInvalid("Invalid JWT");
@@ -3062,7 +2952,7 @@ function decodeJwt(jwt) {
 	}
 	let result;
 	try {
-		result = JSON.parse(decoder.decode(decoded));
+		result = JSON.parse(strictDecoder.decode(decoded));
 	} catch {
 		throw new JWTInvalid("Failed to parse the decoded payload as JSON");
 	}
@@ -3073,7 +2963,9 @@ function decodeJwt(jwt) {
 //#region src/organization-presence.ts
 const id$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 function presenceInput(input) {
-	if (!input || typeof input.applicationId !== "string" || !id$1.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => typeof value !== "string" || !id$1.test(value)) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Organization presence selection is invalid");
+	if (!input || typeof input.applicationId !== "string" || !id$1.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => {
+		return typeof value !== "string" || !id$1.test(value);
+	}) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Organization presence selection is invalid");
 	return {
 		applicationId: input.applicationId,
 		userIds: [...input.userIds]
@@ -3092,7 +2984,9 @@ function presenceProofActor(token, applicationId) {
 	}
 }
 function exact$5(value, keys) {
-	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function normalizePresence(value, organizationId, input, actor) {
 	if (!exact$5(value, [
@@ -3101,7 +2995,9 @@ function normalizePresence(value, organizationId, input, actor) {
 		"actor",
 		"userIds",
 		"checkedAt"
-	]) || value.organizationId !== organizationId || value.applicationId !== input.applicationId || !exact$5(value.actor, ["userId", "sessionId"]) || value.actor.userId !== actor.userId || value.actor.sessionId !== actor.sessionId || !Array.isArray(value.userIds) || value.userIds.length !== input.userIds.length || value.userIds.some((userId, index) => userId !== input.userIds[index]) || typeof value.checkedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(value.checkedAt) || Number.isNaN(Date.parse(value.checkedAt)) || new Date(value.checkedAt).toISOString() !== value.checkedAt) throw new AuthError("identity_authority_unavailable", 503);
+	]) || value.organizationId !== organizationId || value.applicationId !== input.applicationId || !exact$5(value.actor, ["userId", "sessionId"]) || value.actor.userId !== actor.userId || value.actor.sessionId !== actor.sessionId || !Array.isArray(value.userIds) || value.userIds.length !== input.userIds.length || value.userIds.some((userId, index) => {
+		return userId !== input.userIds[index];
+	}) || typeof value.checkedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(value.checkedAt) || Number.isNaN(Date.parse(value.checkedAt)) || new Date(value.checkedAt).toISOString() !== value.checkedAt) throw new AuthError("identity_authority_unavailable", 503);
 	return {
 		organizationId,
 		applicationId: input.applicationId,
@@ -3114,7 +3010,9 @@ function normalizePresence(value, organizationId, input, actor) {
 //#region src/enterprise.ts
 const idPattern$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 function exact$4(value, keys) {
-	return isObject$1(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return isObject$1(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function normalizeOrganizationSignInState(value) {
 	if (exact$4(value, ["status", "mode"]) && value.status === "available" && (value.mode === "membership" || value.mode === "provider")) return {
@@ -3142,17 +3040,23 @@ function normalizeOrganizationSignInStates(value, requestedIds) {
 //#region src/application-access.ts
 const id = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 function applicationAccessInput(input) {
-	if (!input || typeof input.applicationId !== "string" || !id.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => typeof value !== "string" || !id.test(value)) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Application access input is invalid");
+	if (!input || typeof input.applicationId !== "string" || !id.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => {
+		return typeof value !== "string" || !id.test(value);
+	}) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Application access input is invalid");
 	return {
 		applicationId: input.applicationId,
 		userIds: [...input.userIds]
 	};
 }
 function exact$3(value, keys) {
-	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function normalizeApplicationAccess(value, userIds) {
-	const invalid = () => new AuthError("identity_authority_unavailable", 503);
+	const invalid = () => {
+		return new AuthError("identity_authority_unavailable", 503);
+	};
 	if (!exact$3(value, ["members"]) || !Array.isArray(value.members) || value.members.length !== userIds.length) throw invalid();
 	return { members: value.members.map((member, index) => {
 		if (!exact$3(member, [
@@ -3176,7 +3080,9 @@ function validTicket(value) {
 	return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
 }
 function googleRecoveryInput(value, complete) {
-	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => key !== "token" && key !== "nonce") || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
+	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => {
+		return key !== "token" && key !== "nonce";
+	}) || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
 	const social = normalizeSocialIdTokenInput({
 		provider: "google",
 		idToken: value.idToken.token,
@@ -3194,7 +3100,7 @@ function googleRecoveryInput(value, complete) {
 function normalizeGoogleRecovery(value, now) {
 	if (!object(value) || Object.keys(value).sort().join(",") !== "expiresAt,recoveryToken" || !validTicket(value.recoveryToken) || typeof value.expiresAt !== "string") throw authorityUnavailable();
 	const expiresAt = Date.parse(value.expiresAt);
-	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 10 * 6e4) throw authorityUnavailable();
+	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 6e5) throw authorityUnavailable();
 	return {
 		recoveryToken: value.recoveryToken,
 		expiresAt: value.expiresAt
@@ -3223,7 +3129,7 @@ function userApiApplication(input) {
 	return input.applicationId;
 }
 function normalizeUserApiCredential(value, startedAt) {
-	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
 	return {
 		tokenType: "Bearer",
 		token: value.token,
@@ -3238,8 +3144,12 @@ const PROFILE = "finueva-user-api+jwt";
 const CACHE_MS = 3e5;
 const REFRESH_COOLDOWN_MS = 3e4;
 const TIMEOUT_MS = 2e3;
-const invalid = () => new AuthError("authentication_required", 401);
-const unavailable = () => new AuthError("identity_authority_unavailable", 503);
+const invalid = () => {
+	return new AuthError("authentication_required", 401);
+};
+const unavailable = () => {
+	return new AuthError("identity_authority_unavailable", 503);
+};
 function record(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -3280,7 +3190,7 @@ function createUserApiVerifier(options) {
 				method: "GET",
 				credentials: "omit",
 				signal: controller.signal,
-				maxResponseBytes: 64 * 1024
+				maxResponseBytes: 65536
 			}), deadline]);
 			if (!record(value) || !exactKeys(value, ["keys"]) || !Array.isArray(value.keys) || value.keys.length < 1 || value.keys.length > 20) throw unavailable();
 			const keys = new Map();
@@ -3333,7 +3243,7 @@ function createUserApiVerifier(options) {
 		return key;
 	}
 	return { async verify(token) {
-		if (typeof token !== "string" || token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token)) throw invalid();
+		if (typeof token !== "string" || token.length + 7 > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token)) throw invalid();
 		let kid;
 		try {
 			const header = decodeProtectedHeader(token);
@@ -3416,7 +3326,9 @@ function createUserApiVerifier(options) {
 //#region src/identity-resolution.ts
 const emailPattern$1 = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$(?![\s\S])/;
 function exact$2(value, keys) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function createIdentityResolverAuth(options) {
 	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/identities/resolve");
@@ -3428,7 +3340,7 @@ function createIdentityResolverAuth(options) {
 		if (!exact$2(input, ["identifier"]) || typeof input.identifier !== "string" || input.identifier.length > 324) throw new AuthError("invalid_request", 400);
 		const identifier = input.identifier.trim().toLowerCase();
 		if (!(identifier.length <= 320 && emailPattern$1.test(identifier)) && !/^[a-z0-9_.]{3,30}$(?![\s\S])/.test(identifier)) throw new AuthError("invalid_request", 400);
-		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
 		if (inFlight) throw new AuthError("state_conflict", 409);
 		inFlight = true;
 		const controller = new AbortController();
@@ -3524,7 +3436,9 @@ const membershipKeys = [
 	"userId"
 ];
 function exact$1(value, keys) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 function parseMembership(value, organizationId, userId) {
 	if (!exact$1(value, ["membership"])) throw authorityUnavailable();
@@ -3550,8 +3464,8 @@ function createMembershipResolverAuth(options) {
 	let inFlight = false;
 	async function exchange(body, clientAssertion, batch, parseResult) {
 		const url = joinURL(origin, batch ? "api/v1/auth/memberships/resolve-batch" : "api/v1/auth/memberships/resolve");
-		const maxBytes = batch ? 512 * 1024 : 1024;
-		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		const maxBytes = batch ? 524288 : 1024;
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
 		if (inFlight) throw new AuthError("state_conflict", 409);
 		inFlight = true;
 		const controller = new AbortController();
@@ -3630,14 +3544,20 @@ function createMembershipResolverAuth(options) {
 			return exchange({
 				organizationId,
 				userId
-			}, assertion, false, (value) => parseMembership(value, organizationId, userId));
+			}, assertion, false, (value) => {
+				return parseMembership(value, organizationId, userId);
+			});
 		},
 		async resolveMembershipBatch(input, assertion) {
 			if (!input || typeof input !== "object" || Array.isArray(input) || !exact$1(input, Object.hasOwn(input, "teamIds") ? [
 				"organizationId",
 				"userIds",
 				"teamIds"
-			] : ["organizationId", "userIds"]) || typeof input.organizationId !== "string" || !idPattern.test(input.organizationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 100 || input.userIds.some((id) => typeof id !== "string" || !idPattern.test(id)) || new Set(input.userIds).size !== input.userIds.length || input.teamIds !== void 0 && (!Array.isArray(input.teamIds) || input.teamIds.length > 32 || input.teamIds.some((id) => typeof id !== "string" || !idPattern.test(id)) || new Set(input.teamIds).size !== input.teamIds.length)) throw new AuthError("invalid_request", 400);
+			] : ["organizationId", "userIds"]) || typeof input.organizationId !== "string" || !idPattern.test(input.organizationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 100 || input.userIds.some((id) => {
+				return typeof id !== "string" || !idPattern.test(id);
+			}) || new Set(input.userIds).size !== input.userIds.length || input.teamIds !== void 0 && (!Array.isArray(input.teamIds) || input.teamIds.length > 32 || input.teamIds.some((id) => {
+				return typeof id !== "string" || !idPattern.test(id);
+			}) || new Set(input.teamIds).size !== input.teamIds.length)) throw new AuthError("invalid_request", 400);
 			const organizationId = input.organizationId;
 			const userIds = [...input.userIds];
 			const teamIds = [...input.teamIds ?? []];
@@ -3653,7 +3573,9 @@ function createMembershipResolverAuth(options) {
 						"userId",
 						"membership",
 						"matchingTeamIds"
-					]) || entry.userId !== userId || !Array.isArray(entry.matchingTeamIds) || entry.matchingTeamIds.length > teamIds.length || entry.matchingTeamIds.some((id) => typeof id !== "string" || !teamIds.includes(id)) || new Set(entry.matchingTeamIds).size !== entry.matchingTeamIds.length) throw authorityUnavailable();
+					]) || entry.userId !== userId || !Array.isArray(entry.matchingTeamIds) || entry.matchingTeamIds.length > teamIds.length || entry.matchingTeamIds.some((id) => {
+						return typeof id !== "string" || !teamIds.includes(id);
+					}) || new Set(entry.matchingTeamIds).size !== entry.matchingTeamIds.length) throw authorityUnavailable();
 					const membership = parseMembership({ membership: entry.membership }, organizationId, userId);
 					if (!membership && entry.matchingTeamIds.length) throw authorityUnavailable();
 					return {
@@ -3678,7 +3600,9 @@ function validEmail(value) {
 	return typeof value === "string" && encoder.encode(value).byteLength <= 320 && emailPattern.test(value);
 }
 function exact(value, keys) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => {
+		return Object.hasOwn(value, key);
+	});
 }
 const failures = {
 	400: [
@@ -3741,7 +3665,7 @@ function createDriveRecipientAuth(options) {
 			throw new AuthError("invalid_request", 400);
 		}
 		if (encoder.encode(body).byteLength > 1024) throw new AuthError("invalid_request", 413);
-		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
 		if (inFlight) throw new AuthError("state_conflict", 409);
 		inFlight = true;
 		const controller = new AbortController();
@@ -3831,7 +3755,7 @@ function createDriveRecipientAuth(options) {
 }
 //#endregion
 //#region src/provisioning.ts
-const MAX_BYTES = 16 * 1024;
+const MAX_BYTES = 16384;
 const compactJwt = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
 function isCompactCredential(value) {
 	return typeof value === "string" && value.length + 7 <= MAX_BYTES && compactJwt.test(value);
@@ -3854,7 +3778,7 @@ function createDriveProvisioningAuth(options) {
 		let authorityError;
 		try {
 			const startedAt = now();
-			if (!Number.isSafeInteger(startedAt) || startedAt < 0 || startedAt > 86399999997e5) throw authorityUnavailable();
+			if (!Number.isSafeInteger(startedAt) || startedAt < 0 || startedAt > 864e13 - 3e5) throw authorityUnavailable();
 			const deadline = new Promise((_, reject) => {
 				timer = setTimeout(() => {
 					reject(authorityUnavailable());
@@ -3961,12 +3885,14 @@ function exactInput(input) {
 	]) || !directoryId(input.applicationId) || !directoryGeneration(input.userId) || !directoryGeneration(input.userGeneration)) throw new AuthError("invalid_request", 400);
 }
 function pageInput(input, members = false) {
-	if (!record$1(input) || Object.keys(input).some((key) => ![
-		"applicationId",
-		"limit",
-		"cursor",
-		...members ? ["organizationId", "organizationGeneration"] : []
-	].includes(key)) || !directoryId(input.applicationId) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100) || input.cursor !== void 0 && (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 2048) || members && (!directoryId(input.organizationId) || !directoryGeneration(input.organizationGeneration))) throw new AuthError("invalid_request", 400);
+	if (!record$1(input) || Object.keys(input).some((key) => {
+		return ![
+			"applicationId",
+			"limit",
+			"cursor",
+			...members ? ["organizationId", "organizationGeneration"] : []
+		].includes(key);
+	}) || !directoryId(input.applicationId) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100) || input.cursor !== void 0 && (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 2048) || members && (!directoryId(input.organizationId) || !directoryGeneration(input.organizationGeneration))) throw new AuthError("invalid_request", 400);
 }
 function nextCursor(value) {
 	if (value !== null && (typeof value !== "string" || !value.length || value.length > 2048)) throw authorityUnavailable();
@@ -3984,7 +3910,7 @@ function createUserDirectoryAuth(options) {
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
 	let inFlight = 0;
 	async function exchange(operation, body, assertion) {
-		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
+		if (typeof assertion !== "string" || assertion.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
 		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
 		inFlight += 1;
 		const controller = new AbortController();
@@ -4008,7 +3934,7 @@ function createUserDirectoryAuth(options) {
 					accept: "application/json"
 				},
 				body,
-				maxResponseBytes: 128 * 1024,
+				maxResponseBytes: 131072,
 				signal: controller.signal
 			}).finally(() => {
 				inFlight -= 1;
@@ -4026,8 +3952,14 @@ function createUserDirectoryAuth(options) {
 			pageInput(input);
 			const value = await exchange("list", input, assertion);
 			if (!exact$7(value, ["users", "nextCursor"]) || !Array.isArray(value.users) || value.users.length > (input.limit ?? 50)) throw authorityUnavailable();
-			const users = value.users.map((item) => user$1(item, input.applicationId));
-			if (users.some((item) => item.lifecycle === "deleted") || new Set(users.map((item) => item.userId)).size !== users.length) throw authorityUnavailable();
+			const users = value.users.map((item) => {
+				return user$1(item, input.applicationId);
+			});
+			if (users.some((item) => {
+				return item.lifecycle === "deleted";
+			}) || new Set(users.map((item) => {
+				return item.userId;
+			})).size !== users.length) throw authorityUnavailable();
 			return {
 				users,
 				nextCursor: nextCursor(value.nextCursor)
@@ -4063,7 +3995,9 @@ function createUserDirectoryAuth(options) {
 					membershipStatus: item.membershipStatus
 				};
 			});
-			if (new Set(members.map((item) => item.user.userId)).size !== members.length) throw authorityUnavailable();
+			if (new Set(members.map((item) => {
+				return item.user.userId;
+			})).size !== members.length) throw authorityUnavailable();
 			return {
 				applicationId: input.applicationId,
 				organizationId: input.organizationId,
@@ -4179,11 +4113,13 @@ function event(value, version) {
 	};
 }
 function listInput(input) {
-	if (!record$1(input) || Object.keys(input).some((key) => ![
-		"applicationId",
-		"after",
-		"limit"
-	].includes(key)) || !directoryId(input.applicationId) || input.after !== void 0 && !checkpoint(input.after) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100)) throw new AuthError("invalid_request", 400);
+	if (!record$1(input) || Object.keys(input).some((key) => {
+		return ![
+			"applicationId",
+			"after",
+			"limit"
+		].includes(key);
+	}) || !directoryId(input.applicationId) || input.after !== void 0 && !checkpoint(input.after) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100)) throw new AuthError("invalid_request", 400);
 }
 function mapError$1(value, status, retryAfter) {
 	if (status === 409 && exact$7(value, [
@@ -4194,10 +4130,14 @@ function mapError$1(value, status, retryAfter) {
 	return fromAuthorityError(value, status, retryAfter);
 }
 function createOrganizationRoleEventsAuth(options) {
-	return createRoleEventsClient(options, 1, (value) => event(value, 1));
+	return createRoleEventsClient(options, 1, (value) => {
+		return event(value, 1);
+	});
 }
 function createOrganizationRoleEventsV2Auth(options) {
-	return createRoleEventsClient(options, 2, (value) => event(value, 2));
+	return createRoleEventsClient(options, 2, (value) => {
+		return event(value, 2);
+	});
 }
 function createRoleEventsClient(options, version, normalizeEvent) {
 	const origin = normalizeOrigin(options.authOrigin, "authOrigin");
@@ -4206,7 +4146,7 @@ function createRoleEventsClient(options, version, normalizeEvent) {
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
 	let inFlight = 0;
 	async function exchange(body, assertion) {
-		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
+		if (typeof assertion !== "string" || assertion.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
 		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
 		inFlight += 1;
 		const controller = new AbortController();
@@ -4230,7 +4170,7 @@ function createRoleEventsClient(options, version, normalizeEvent) {
 					accept: "application/json"
 				},
 				body,
-				maxResponseBytes: 256 * 1024,
+				maxResponseBytes: 262144,
 				signal: controller.signal,
 				mapError: mapError$1
 			}).finally(() => {
@@ -4311,7 +4251,9 @@ function contactsInput(input) {
 }
 async function organizationServiceClosureBodyDigest(input) {
 	const bytes = new TextEncoder().encode(canonical(closureInput(input)));
-	return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+	return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => {
+		return byte.toString(16).padStart(2, "0");
+	}).join("");
 }
 var Outcome = class extends Error {
 	outcome;
@@ -4337,7 +4279,7 @@ function createOrganizationLifecycleAuth(options) {
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
 	let inFlight = 0;
 	async function exchange(operation, body, assertion) {
-		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
+		if (typeof assertion !== "string" || assertion.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
 		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
 		inFlight += 1;
 		const controller = new AbortController();
@@ -4361,7 +4303,7 @@ function createOrganizationLifecycleAuth(options) {
 					accept: "application/json"
 				},
 				body,
-				maxResponseBytes: 128 * 1024,
+				maxResponseBytes: 131072,
 				signal: controller.signal,
 				mapError
 			}).finally(() => {
@@ -4437,7 +4379,9 @@ function createOrganizationLifecycleAuth(options) {
 					name: item.name
 				};
 			});
-			if (new Set(contacts.map((contact) => contact.userId)).size !== contacts.length) throw authorityUnavailable();
+			if (new Set(contacts.map((contact) => {
+				return contact.userId;
+			})).size !== contacts.length) throw authorityUnavailable();
 			return {
 				...selected,
 				contacts,
@@ -4448,10 +4392,10 @@ function createOrganizationLifecycleAuth(options) {
 }
 //#endregion
 //#region src/server.ts
-const MAX_AUTHORIZATION_BYTES = 16 * 1024;
+const MAX_AUTHORIZATION_BYTES = 16384;
 function createServerAuth(options) {
 	const authOrigin = normalizeOrigin(options.authOrigin, "authOrigin");
-	const appOrigin = normalizeOrigin(options.appOrigin, "appOrigin");
+	const appOrigin = normalizeOrigin(options.appOrigin, "appOrigin", options.allowPrivateNetworkAppOrigin === true);
 	const fetchImpl = options.fetch ?? globalThis.fetch;
 	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
 	const now = options.now ?? Date.now;
@@ -4459,10 +4403,12 @@ function createServerAuth(options) {
 	const authorization = authAuthorizationHeader(options.request.headers.get("authorization"));
 	const cookie = authCookieHeader(options.request.headers.get("cookie"));
 	const credentials = authorization ? "omit" : "include";
-	const authHeaders = (includeOrigin = true) => ({
-		...authorization ? { authorization } : { cookie },
-		...includeOrigin ? { origin: appOrigin } : {}
-	});
+	const authHeaders = (includeOrigin = true) => {
+		return {
+			...authorization ? { authorization } : { cookie },
+			...includeOrigin ? { origin: appOrigin } : {}
+		};
+	};
 	async function teamMembershipMutation(ids, idempotencyKey, action) {
 		if (authorization) throw new AuthError("authentication_required", 401);
 		const [organization, team, member] = ids.map(normalizeIdInput);
@@ -4489,7 +4435,7 @@ function createServerAuth(options) {
 			credentials,
 			headers: authHeaders(false),
 			mapError: fromOrganizationReadAuthorityError,
-			maxResponseBytes: 256 * 1024
+			maxResponseBytes: 262144
 		}));
 	}
 	return {
@@ -4564,16 +4510,20 @@ function createServerAuth(options) {
 		getOrganizationSignInStates(organizationIds) {
 			if (!Array.isArray(organizationIds) || !organizationIds.length || organizationIds.length > 50 || new Set(organizationIds).size !== organizationIds.length) throw new AuthError("invalid_request", 400);
 			const ids = organizationIds.map(normalizeIdInput);
-			return organizationRead("sign-in-states", void 0, (value) => normalizeOrganizationSignInStates(value, ids), () => new URLSearchParams({ organizationIds: ids.join(",") }));
+			return organizationRead("sign-in-states", void 0, (value) => {
+				return normalizeOrganizationSignInStates(value, ids);
+			}, () => {
+				return new URLSearchParams({ organizationIds: ids.join(",") });
+			});
 		},
 		async authorizeOrganizationPresence(organizationId, input, serviceAssertion, options) {
-			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Organization presence service assertion is invalid");
+			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Organization presence service assertion is invalid");
 			const organization = normalizeIdInput(organizationId);
 			const body = presenceInput(input);
 			let applicationCredential;
 			if (options !== void 0) {
 				const supplied = options?.applicationCredential;
-				if (typeof supplied !== "string" || supplied.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(supplied)) throw new TypeError("Organization presence credential is invalid");
+				if (typeof supplied !== "string" || supplied.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(supplied)) throw new TypeError("Organization presence credential is invalid");
 				applicationCredential = supplied;
 			} else {
 				const startedAt = now();
@@ -4594,7 +4544,7 @@ function createServerAuth(options) {
 				fetch: fetchImpl,
 				timeoutMs,
 				method: "POST",
-				maxResponseBytes: 16 * 1024,
+				maxResponseBytes: 16384,
 				credentials,
 				headers: {
 					...authHeaders(!authorization),
@@ -4607,13 +4557,13 @@ function createServerAuth(options) {
 			}), organization, body, actor);
 		},
 		async getOrganizationMemberApplicationAccess(organizationId, input, serviceAssertion, options) {
-			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Application access service assertion is invalid");
+			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Application access service assertion is invalid");
 			const organization = normalizeIdInput(organizationId);
 			const body = applicationAccessInput(input);
 			let applicationCredential;
 			if (options !== void 0) {
 				const supplied = options?.applicationCredential;
-				if (typeof supplied !== "string" || supplied.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(supplied)) throw new TypeError("Application access credential is invalid");
+				if (typeof supplied !== "string" || supplied.length > 16384 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(supplied)) throw new TypeError("Application access credential is invalid");
 				applicationCredential = supplied;
 			} else {
 				const startedAt = now();
@@ -4633,7 +4583,7 @@ function createServerAuth(options) {
 				fetch: fetchImpl,
 				timeoutMs,
 				method: "POST",
-				maxResponseBytes: 16 * 1024,
+				maxResponseBytes: 16384,
 				credentials,
 				headers: {
 					...authHeaders(!authorization),
@@ -4648,12 +4598,18 @@ function createServerAuth(options) {
 		async getOrganizationMemberAuthority(organizationId, memberId) {
 			const organization = normalizeIdInput(organizationId);
 			const member = normalizeIdInput(memberId);
-			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => {
+				return normalizeOrganizationMemberAuthority(value, organization, member);
+			});
 		},
 		async getOrganizationMemberAuthorityV2(organizationId, memberId) {
 			const organization = normalizeIdInput(organizationId);
 			const member = normalizeIdInput(memberId);
-			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthorityV2(value, organization, member), () => new URLSearchParams({ version: "2" }));
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => {
+				return normalizeOrganizationMemberAuthorityV2(value, organization, member);
+			}, () => {
+				return new URLSearchParams({ version: "2" });
+			});
 		},
 		async getOrganizationApplicationRegistration(organizationId, applicationId) {
 			if (authorization) throw new AuthError("state_conflict", 409);
@@ -4923,7 +4879,9 @@ function createServerAuth(options) {
 				body,
 				mapError: fromSocialIdTokenAuthorityError
 			})).headers);
-			const cookieHeader = authCookieHeader(cookies.map((value) => value.split(";", 1)[0]).join("; "));
+			const cookieHeader = authCookieHeader(cookies.map((value) => {
+				return value.split(";", 1)[0];
+			}).join("; "));
 			if (!cookieHeader) throw authorityUnavailable();
 			const session = normalizeSession(await requestJson(joinURL(authOrigin, "api/v1/auth/get-session"), {
 				fetch: fetchImpl,
@@ -5000,14 +4958,18 @@ function createServerAuth(options) {
 }
 function responseCookies(headers) {
 	const getSetCookie = headers.getSetCookie;
-	return getSetCookie ? getSetCookie.call(headers) : [headers.get("set-cookie")].filter((value) => !!value);
+	return getSetCookie ? getSetCookie.call(headers) : [headers.get("set-cookie")].filter((value) => {
+		return !!value;
+	});
 }
 function applyCookies(cookies, headers) {
 	for (const value of cookies) headers.append("set-cookie", value);
 }
 function authCookieHeader(value) {
 	if (!value) return "";
-	return value.split(";").map((cookie) => cookie.trim()).filter((cookie) => {
+	return value.split(";").map((cookie) => {
+		return cookie.trim();
+	}).filter((cookie) => {
 		const separator = cookie.indexOf("=");
 		if (separator <= 0) return false;
 		const name = cookie.slice(0, separator);
@@ -5015,7 +4977,7 @@ function authCookieHeader(value) {
 	}).join("; ");
 }
 function authAuthorizationHeader(value) {
-	if (value === null) return void 0;
+	if (value === null) return;
 	if (new TextEncoder().encode(value).byteLength > MAX_AUTHORIZATION_BYTES || /[^\x20-\x7e]/.test(value) || !/^Bearer [^\s,]+$/i.test(value)) throw new AuthError("authentication_required", 401);
 	return value;
 }