@flaghoist/server 0.3.1 → 0.4.0

package/dist/index.js

@@ -1,433 +1,1157 @@
 // src/index.ts
-import { evaluate } from "@flaghoist/core";
+import {
+  auditCategory as auditCategory2,
+  evaluate,
+  WEBHOOK_EVENTS as WEBHOOK_EVENTS2
+} from "@flaghoist/core";
 import { Hono } from "hono";
 
-// src/cache.ts
-function createDefinitionCache() {
-  let entry = null;
-  return {
-    async load(storage, ttlMs2) {
-      const now = Date.now();
-      if (entry && entry.expiresAt > now) return entry.flags;
-      const flags = await storage.list();
-      entry = { flags, expiresAt: now + ttlMs2 };
-      return flags;
-    },
-    invalidate() {
-      entry = null;
+// src/permissions.ts
+var ROLES = ["viewer", "editor", "admin", "owner"];
+var MINIMUM_ROLE = {
+  "flags:read": "viewer",
+  "audit:read": "viewer",
+  "flags:write": "editor",
+  "flags:delete": "admin",
+  "flags:import": "admin",
+  "audit:security": "admin",
+  "webhooks:manage": "admin",
+  "members:manage": "admin"
+};
+function isRole(value) {
+  return typeof value === "string" && ROLES.includes(value);
+}
+function minimumRole(permission) {
+  return MINIMUM_ROLE[permission];
+}
+function can(role, permission) {
+  if (!isRole(role)) return false;
+  return ROLES.indexOf(role) >= ROLES.indexOf(MINIMUM_ROLE[permission]);
+}
+var ENVIRONMENT_PERMISSIONS = [
+  "flags:read",
+  "flags:write",
+  "flags:delete",
+  "flags:import",
+  "audit:read"
+];
+function isEnvironmentPermission(permission) {
+  return ENVIRONMENT_PERMISSIONS.includes(permission);
+}
+function lowerRole(a, b) {
+  return ROLES.indexOf(a) <= ROLES.indexOf(b) ? a : b;
+}
+
+// src/sealed.ts
+var encoder = new TextEncoder();
+var sealKeys = /* @__PURE__ */ new Map();
+function sealKey(pepper) {
+  let key = sealKeys.get(pepper);
+  if (!key) {
+    key = (async () => {
+      const material = await crypto.subtle.importKey("raw", encoder.encode(pepper), "HKDF", false, [
+        "deriveKey"
+      ]);
+      return crypto.subtle.deriveKey(
+        {
+          name: "HKDF",
+          hash: "SHA-256",
+          salt: new Uint8Array(0),
+          info: encoder.encode("flaghoist sso seal v1")
+        },
+        material,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+      );
+    })();
+    sealKeys.set(pepper, key);
+  }
+  return key;
+}
+async function seal(pepper, purpose, value) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const plain = encoder.encode(JSON.stringify({ ...value, purpose }));
+  const cipher = new Uint8Array(
+    await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await sealKey(pepper), plain)
+  );
+  const out = new Uint8Array(iv.length + cipher.length);
+  out.set(iv);
+  out.set(cipher, iv.length);
+  return toBase64Url(out);
+}
+async function unseal(pepper, purpose, sealed) {
+  const bytes = fromBase64Url(sealed);
+  if (!bytes || bytes.length < 29) return null;
+  try {
+    const plain = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: bytes.slice(0, 12) },
+      await sealKey(pepper),
+      bytes.slice(12)
+    );
+    const value = JSON.parse(new TextDecoder().decode(plain));
+    if (value.purpose !== purpose || typeof value.exp !== "number" || Date.now() > value.exp) {
+      return null;
     }
-  };
+    return value;
+  } catch {
+    return null;
+  }
+}
+async function sha256Url(text) {
+  return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(text))));
 }
 
-// src/flags.ts
-import { clampPercentage, LIMITS, parseFlag } from "@flaghoist/core";
-function buildFlag(key, body, identity, existing) {
-  if (typeof body !== "object" || body === null) {
-    return { ok: false, error: "Request body must be a JSON object" };
+// src/sso.ts
+import { createLocalJWKSet, errors as joseErrors, jwtVerify } from "jose";
+var SSO_CALLBACK_PATH = "/api/v1/auth/sso/callback";
+var STATE_TTL_MS = 10 * 6e4;
+var EXCHANGE_TTL_MS = 6e4;
+var DISCOVERY_TTL_MS = 60 * 6e4;
+var JWKS_TTL_MS = 10 * 6e4;
+var ALGORITHMS = ["RS256", "RS384", "RS512", "PS256", "ES256", "ES384", "EdDSA"];
+function assertSsoConfig(sso) {
+  const problems = [];
+  try {
+    const url = new URL(sso.issuer);
+    if (url.protocol !== "https:" && url.hostname !== "localhost")
+      problems.push("issuer must use https");
+  } catch {
+    problems.push("issuer must be a URL");
   }
-  const b = body;
-  const enabled = typeof b.enabled === "boolean" ? b.enabled : false;
-  const rollout = typeof b.rollout === "object" && b.rollout !== null ? b.rollout : {};
-  const percentage = typeof rollout.percentage === "number" ? clampPercentage(rollout.percentage) : 0;
-  const description = typeof b.description === "string" ? b.description : "";
-  if (description.length > LIMITS.maxDescriptionLength) {
-    return { ok: false, error: `Description exceeds ${LIMITS.maxDescriptionLength} characters` };
+  if (typeof sso.clientId !== "string" || !sso.clientId) problems.push("clientId is required");
+  for (const [group, role] of Object.entries(sso.roleMapping ?? {})) {
+    if (!isRole(role)) problems.push(`roleMapping["${group}"] is not a role`);
   }
-  const inputRules = Array.isArray(b.rules) ? b.rules : [];
-  const nowMs = Date.now();
-  const prevMs = existing ? Date.parse(existing.metadata.updatedAt) : 0;
-  const updatedAt = new Date(nowMs > prevMs ? nowMs : prevMs + 1).toISOString();
-  const createdAt = existing?.metadata.createdAt ?? new Date(nowMs).toISOString();
-  const candidate = {
-    key,
-    enabled,
-    rollout: { percentage },
-    rules: inputRules,
-    description,
-    metadata: {
-      createdBy: existing?.metadata.createdBy ?? identity,
-      createdAt,
-      updatedBy: identity,
-      updatedAt
+  if (sso.defaultRole !== void 0 && !isRole(sso.defaultRole)) {
+    problems.push("defaultRole is not a role");
+  }
+  if (problems.length > 0) {
+    throw new Error(`[flaghoist] users.sso: ${problems.join("; ")}.`);
+  }
+}
+function randomUrl(bytes = 32) {
+  return toBase64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+var discoveries = /* @__PURE__ */ new Map();
+var keySets = /* @__PURE__ */ new Map();
+async function fetchJson(url, what) {
+  const res = await fetch(url, {
+    headers: { accept: "application/json" },
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!res.ok) throw new SsoError(`Could not load the provider's ${what} (${res.status}).`);
+  return res.json();
+}
+function discover(issuer) {
+  const cached = discoveries.get(issuer);
+  if (cached && Date.now() - cached.at < DISCOVERY_TTL_MS) return cached.value;
+  const url = `${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`;
+  const value = fetchJson(url, "configuration").then((body) => {
+    const d = body;
+    if (!d.authorization_endpoint || !d.token_endpoint || !d.jwks_uri) {
+      throw new SsoError("The provider's configuration is missing its endpoints.");
     }
+    return d;
+  });
+  value.catch(() => discoveries.delete(issuer));
+  discoveries.set(issuer, { at: Date.now(), value });
+  return value;
+}
+function keySet(uri, refresh = false) {
+  const cached = keySets.get(uri);
+  if (!refresh && cached && Date.now() - cached.at < JWKS_TTL_MS) return cached.value;
+  const value = fetchJson(uri, "signing keys");
+  value.catch(() => keySets.delete(uri));
+  keySets.set(uri, { at: Date.now(), value });
+  return value;
+}
+var SsoError = class extends Error {
+};
+async function buildAuthorizationUrl(input) {
+  const d = await discover(input.sso.issuer);
+  const verifier = randomUrl();
+  const nonce = randomUrl(16);
+  const state = await seal(input.pepper, "sso-state", {
+    exp: Date.now() + STATE_TTL_MS,
+    verifier,
+    nonce,
+    browser: input.browserHash,
+    returnTo: input.returnTo,
+    redirectUri: input.redirectUri
+  });
+  const url = new URL(d.authorization_endpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", input.sso.clientId);
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("scope", (input.sso.scopes ?? ["openid", "email", "profile"]).join(" "));
+  url.searchParams.set("state", state);
+  url.searchParams.set("nonce", nonce);
+  url.searchParams.set("code_challenge", await sha256Url(verifier));
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+function readState(pepper, state) {
+  return unseal(pepper, "sso-state", state);
+}
+async function completeSignIn(input) {
+  const { sso, state } = input;
+  const d = await discover(sso.issuer);
+  const form = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: input.code,
+    redirect_uri: state.redirectUri,
+    client_id: sso.clientId,
+    code_verifier: state.verifier
+  });
+  const headers = {
+    "content-type": "application/x-www-form-urlencoded",
+    accept: "application/json"
   };
-  const validated = parseFlag(candidate);
-  if (!validated) return { ok: false, error: "Invalid flag definition" };
-  if ((validated.rules?.length ?? 0) !== inputRules.length) {
-    return { ok: false, error: "One or more targeting rules are invalid" };
+  if (sso.clientSecret) {
+    const basic = `${encodeURIComponent(sso.clientId)}:${encodeURIComponent(sso.clientSecret)}`;
+    headers.authorization = `Basic ${btoa(basic)}`;
   }
-  return { ok: true, flag: validated };
+  const res = await fetch(d.token_endpoint, {
+    method: "POST",
+    headers,
+    body: form,
+    signal: AbortSignal.timeout(1e4)
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || typeof body.id_token !== "string") {
+    throw new SsoError(
+      `The provider did not complete the sign-in${typeof body.error === "string" ? ` (${body.error})` : ""}.`
+    );
+  }
+  const supported = d.id_token_signing_alg_values_supported;
+  const algorithms = supported ? ALGORITHMS.filter((a) => supported.includes(a)) : ALGORITHMS;
+  const verify = async (refresh) => jwtVerify(body.id_token, createLocalJWKSet(await keySet(d.jwks_uri, refresh)), {
+    issuer: sso.issuer,
+    audience: sso.clientId,
+    algorithms
+  });
+  let payload;
+  try {
+    payload = (await verify(false)).payload;
+  } catch (err) {
+    if (!(err instanceof joseErrors.JWKSNoMatchingKey)) {
+      throw new SsoError("The sign-in could not be verified.");
+    }
+    try {
+      payload = (await verify(true)).payload;
+    } catch {
+      throw new SsoError("The sign-in could not be verified.");
+    }
+  }
+  if (payload.nonce !== state.nonce) throw new SsoError("The sign-in could not be verified.");
+  const email = typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "";
+  if (!email || typeof payload.sub !== "string") {
+    throw new SsoError("The provider did not share an email address. Check the email scope.");
+  }
+  const claim = payload[sso.groupsClaim ?? "groups"];
+  const groups = Array.isArray(claim) ? claim.filter((g) => typeof g === "string") : typeof claim === "string" ? claim.split(/[,\s]+/).filter(Boolean) : [];
+  const name = typeof payload.name === "string" ? payload.name : [payload.given_name, payload.family_name].filter((p) => typeof p === "string").join(" ");
+  return {
+    subject: payload.sub,
+    email,
+    emailVerified: payload.email_verified === true || payload.email_verified === "true",
+    name,
+    groups
+  };
 }
-function flagEtag(flag) {
-  return `"${flag.metadata.updatedAt}"`;
+function roleFor(sso, groups) {
+  let best = -1;
+  for (const group of groups) {
+    const role = sso.roleMapping?.[group];
+    if (role && ROLES.indexOf(role) > best) best = ROLES.indexOf(role);
+  }
+  if (best >= 0) return ROLES[best];
+  return sso.defaultRole ?? null;
+}
+function domainAllowed(sso, email) {
+  if (!sso.allowedDomains || sso.allowedDomains.length === 0) return true;
+  const domain = email.slice(email.lastIndexOf("@") + 1);
+  return sso.allowedDomains.some((d) => d.toLowerCase() === domain);
+}
+function exchangeCode(pepper, userId, browserHash) {
+  return seal(pepper, "sso-exchange", {
+    exp: Date.now() + EXCHANGE_TTL_MS,
+    userId,
+    browser: browserHash
+  });
+}
+async function redeemExchangeCode(pepper, code, browserSecret) {
+  const value = await unseal(pepper, "sso-exchange", code);
+  if (!value || await sha256Url(browserSecret) !== value.browser) return null;
+  return value.userId;
 }
 
-// src/openapi.ts
-var openApiDocument = {
-  openapi: "3.1.0",
-  info: {
-    title: "Flaghoist API",
-    version: "0.1.0",
-    description: "Manage and evaluate feature flags. The admin API (`/api/v1/flags`) is Flaghoist's own; the read API (`/ofrep/v1`) follows the OpenFeature Remote Evaluation Protocol (OFREP). The unversioned `/flags` paths remain as a legacy alias of `/api/v1/flags`.",
-    license: { name: "Apache-2.0", url: "https://www.apache.org/licenses/LICENSE-2.0" }
-  },
-  servers: [{ url: "/", description: "This Flaghoist server" }],
-  tags: [
-    { name: "admin", description: "Manage flag definitions (admin auth)." },
-    {
-      name: "evaluate",
-      description: "Evaluate flags for a context (OFREP read path, API-key auth)."
+// src/totp.ts
+var TOTP_PERIOD_SECONDS = 30;
+var TOTP_DIGITS = 6;
+var SECRET_BYTES = 20;
+var DRIFT_STEPS = 1;
+var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(bytes) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of bytes) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += BASE32[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += BASE32[value << 5 - bits & 31];
+  return out;
+}
+function base32Decode(text) {
+  const clean = text.toUpperCase().replace(/[\s=-]/g, "");
+  let bits = 0;
+  let value = 0;
+  const out = [];
+  for (const ch of clean) {
+    const index = BASE32.indexOf(ch);
+    if (index < 0) return null;
+    value = value << 5 | index;
+    bits += 5;
+    if (bits >= 8) {
+      out.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return new Uint8Array(out);
+}
+function newTotpSecret() {
+  return base32Encode(crypto.getRandomValues(new Uint8Array(SECRET_BYTES)));
+}
+function currentStep(now = Date.now()) {
+  return Math.floor(now / 1e3 / TOTP_PERIOD_SECONDS);
+}
+async function totpAt(secret, step) {
+  const key = base32Decode(secret);
+  if (!key) throw new Error("Invalid two-factor secret");
+  const counter = new Uint8Array(8);
+  let rest = step;
+  for (let i = 7; i >= 0; i--) {
+    counter[i] = rest & 255;
+    rest = Math.floor(rest / 256);
+  }
+  const hmacKey = await crypto.subtle.importKey(
+    "raw",
+    key,
+    { name: "HMAC", hash: "SHA-1" },
+    false,
+    ["sign"]
+  );
+  const mac = new Uint8Array(await crypto.subtle.sign("HMAC", hmacKey, counter));
+  const offset = mac[mac.length - 1] & 15;
+  const binary = (mac[offset] & 127) << 24 | mac[offset + 1] << 16 | mac[offset + 2] << 8 | mac[offset + 3];
+  return String(binary % 10 ** TOTP_DIGITS).padStart(TOTP_DIGITS, "0");
+}
+async function matchTotp(secret, code, now = Date.now()) {
+  const digits = code.replace(/\s/g, "");
+  if (!/^\d{6}$/.test(digits)) return null;
+  const step = currentStep(now);
+  for (let d = -DRIFT_STEPS; d <= DRIFT_STEPS; d++) {
+    if (await totpAt(secret, step + d) === digits) return step + d;
+  }
+  return null;
+}
+function otpauthUri(secret, account, issuer = "Flaghoist") {
+  const label = encodeURIComponent(`${issuer}:${account}`);
+  const params = new URLSearchParams({
+    secret,
+    issuer,
+    algorithm: "SHA1",
+    digits: String(TOTP_DIGITS),
+    period: String(TOTP_PERIOD_SECONDS)
+  });
+  return `otpauth://totp/${label}?${params}`;
+}
+var RECOVERY_CODE_COUNT = 10;
+function newRecoveryCodes() {
+  return Array.from({ length: RECOVERY_CODE_COUNT }, () => {
+    const raw = base32Encode(crypto.getRandomValues(new Uint8Array(7))).slice(0, 10);
+    return `${raw.slice(0, 5)}-${raw.slice(5)}`;
+  });
+}
+function normalizeRecoveryCode(code) {
+  return code.toUpperCase().replace(/[\s-]/g, "");
+}
+function looksLikeRecoveryCode(code) {
+  return /^[A-Z2-7]{10}$/.test(normalizeRecoveryCode(code));
+}
+
+// src/accounts.ts
+var PASSWORD_KDF = "pbkdf2-sha256";
+var PASSWORD_ITERATIONS = 6e5;
+var SESSION_PREFIX = "fh_sess_";
+var INVITE_PREFIX = "fh_inv_";
+var RESET_PREFIX = "fh_rst_";
+var TOKEN_PREFIX = "fh_pat_";
+var DEFAULT_TOKEN_DAYS = 90;
+var MAX_TOKEN_DAYS = 3650;
+var RESET_LINK_MS = 24 * 36e5;
+var SALT_BYTES = 16;
+var CLIENT_KEY_BYTES = 32;
+var MIN_PEPPER_LENGTH = 32;
+var MAX_EMAIL_LENGTH = 254;
+var MAX_NAME_LENGTH = 100;
+var MAX_USER_AGENT_LENGTH = 200;
+var USERS = "users";
+var USERS_BY_EMAIL = "users-email";
+var SESSIONS = "sessions";
+var LOGIN_ATTEMPTS = "login-attempts";
+var INVITES = "invites";
+var TOKENS = "tokens";
+var USERS_BY_SSO = "users-sso";
+var ABSENT_USER_ID = "usr_absent";
+function publicToken(token) {
+  const { userId: _, ...rest } = token;
+  return rest;
+}
+function hasRecordStore(storage) {
+  return typeof storage.getRecord === "function" && typeof storage.putRecord === "function" && typeof storage.deleteRecord === "function" && typeof storage.listRecords === "function";
+}
+function assertUsersConfig(users, storage) {
+  if (!hasRecordStore(storage)) {
+    throw new Error(
+      "[flaghoist] `users` needs a storage adapter with the record store (getRecord, putRecord, deleteRecord, listRecords). Every bundled adapter has it; a custom adapter must add it, since accounts cannot be kept in memory."
+    );
+  }
+  if (typeof users.pepper !== "string" || users.pepper.length < MIN_PEPPER_LENGTH) {
+    throw new Error(
+      `[flaghoist] \`users.pepper\` must be at least ${MIN_PEPPER_LENGTH} characters. Generate one with \`openssl rand -hex 32\` and keep it in a secret, not in code.`
+    );
+  }
+  if (users.sso) assertSsoConfig(users.sso);
+}
+var encoder2 = new TextEncoder();
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+  if (!/^[A-Za-z0-9_-]*$/.test(text)) return null;
+  try {
+    const padded = text.replace(/-/g, "+").replace(/_/g, "/");
+    const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+function randomBytes(length) {
+  const out = new Uint8Array(length);
+  crypto.getRandomValues(out);
+  return out;
+}
+function hex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(text) {
+  return hex(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder2.encode(text))));
+}
+var pepperKeys = /* @__PURE__ */ new Map();
+function pepperKey(pepper) {
+  let key = pepperKeys.get(pepper);
+  if (!key) {
+    key = crypto.subtle.importKey(
+      "raw",
+      encoder2.encode(pepper),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    pepperKeys.set(pepper, key);
+  }
+  return key;
+}
+async function hmac(pepper, data) {
+  return new Uint8Array(await crypto.subtle.sign("HMAC", await pepperKey(pepper), data));
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function normalizeEmail(value) {
+  if (typeof value !== "string") return null;
+  const email = value.trim().toLowerCase();
+  if (email.length < 3 || encoder2.encode(email).length > MAX_EMAIL_LENGTH) return null;
+  if (!/^[^\s@]+@[^\s@]+$/.test(email)) return null;
+  return email;
+}
+function normalizeName(value) {
+  return typeof value === "string" ? value.trim().slice(0, MAX_NAME_LENGTH) : "";
+}
+function decodeFixed(value, bytes) {
+  if (typeof value !== "string") return null;
+  const decoded = fromBase64Url(value);
+  return decoded && decoded.length === bytes ? decoded : null;
+}
+var decodeClientKey = (value) => decodeFixed(value, CLIENT_KEY_BYTES);
+var decodeSalt = (value) => decodeFixed(value, SALT_BYTES);
+var ATTEMPT_WINDOW_MS = 15 * 6e4;
+var EMAIL_FREE_FAILURES = 5;
+var EMAIL_BASE_LOCK_MS = 3e4;
+var MAX_LOCK_MS = 15 * 6e4;
+var IP_MAX_FAILURES = 30;
+function roleInEnvironment(user, environment) {
+  if (user.role === "owner") return "owner";
+  return user.environmentRoles?.[environment] ?? user.role;
+}
+function publicUser(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    role: user.role,
+    status: user.status,
+    createdAt: user.createdAt,
+    hasPassword: user.password !== void 0,
+    twoFactor: user.twoFactor !== void 0,
+    ...user.environmentRoles && Object.keys(user.environmentRoles).length > 0 ? { environmentRoles: user.environmentRoles } : {},
+    ...user.sso ? { sso: true } : {},
+    ...user.roleManagedBy ? { roleManagedBy: user.roleManagedBy } : {},
+    ...user.lastLoginAt ? { lastLoginAt: user.lastLoginAt } : {}
+  };
+}
+function isUserRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.id === "string" && typeof v.email === "string" && isRole(v.role) && (v.status === "active" || v.status === "disabled");
+}
+function isSessionRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.id === "string" && typeof v.userId === "string" && typeof v.lastSeenAt === "string" && typeof v.expiresAt === "string";
+}
+function isInviteRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.id === "string" && (v.kind === "invite" || v.kind === "reset") && typeof v.email === "string" && isRole(v.role) && typeof v.expiresAt === "string";
+}
+function publicInvite(invite) {
+  const { userId: _, ...rest } = invite;
+  return rest;
+}
+function isTokenRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.id === "string" && typeof v.userId === "string" && typeof v.name === "string" && isRole(v.role);
+}
+function isAttemptRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.failures === "number" && typeof v.windowStart === "number";
+}
+function createAccountStore(storage, users) {
+  const records = storage;
+  const pepper = users.pepper;
+  const pepperId = users.pepperId ?? "p1";
+  const idleMs = (users.session?.idleMinutes ?? 30) * 6e4;
+  const maxMs = (users.session?.maxHours ?? 12) * 36e5;
+  const touchMs = Math.min(5 * 6e4, idleMs / 6);
+  const inviteMs = (users.invites?.expiresInDays ?? 7) * 864e5;
+  async function liveInvites() {
+    const now = Date.now();
+    const out = [];
+    for (const { id, value } of await records.listRecords(INVITES)) {
+      if (!isInviteRecord(value)) continue;
+      if (now >= Date.parse(value.expiresAt)) await records.deleteRecord(INVITES, id);
+      else out.push({ key: id, invite: value });
+    }
+    return out;
+  }
+  const ssoKey = (issuer, subject) => sha256Hex(`${issuer}
+${subject}`);
+  const sealSecret = (secret) => seal(pepper, "totp-secret", { exp: Number.MAX_SAFE_INTEGER, secret });
+  const openSecret = async (sealed) => (await unseal(pepper, "totp-secret", sealed))?.secret ?? null;
+  const hashRecoveryCode = (code) => sha256Hex(`recovery:${normalizeRecoveryCode(code)}`);
+  async function tokensOf(userId) {
+    return (await records.listRecords(TOKENS)).filter((r) => isTokenRecord(r.value)).filter((r) => r.value.userId === userId).map((r) => ({ key: r.id, token: r.value }));
+  }
+  async function allSessions() {
+    const now = Date.now();
+    const out = [];
+    for (const { id, value } of await records.listRecords(SESSIONS)) {
+      if (!isSessionRecord(value)) continue;
+      const expired = now >= Date.parse(value.expiresAt) || now - Date.parse(value.lastSeenAt) >= idleMs;
+      if (expired) await records.deleteRecord(SESSIONS, id);
+      else out.push({ key: id, session: value });
+    }
+    return out;
+  }
+  async function getUser(id) {
+    const value = await records.getRecord(USERS, id);
+    return isUserRecord(value) ? value : null;
+  }
+  async function userIdForEmail(email) {
+    const value = await records.getRecord(USERS_BY_EMAIL, email);
+    return typeof value?.userId === "string" ? value.userId : null;
+  }
+  async function findByEmail(email) {
+    const id = await userIdForEmail(email);
+    const user = await getUser(id ?? ABSENT_USER_ID);
+    return id && user && user.email === email ? user : null;
+  }
+  async function fakeSalt(email) {
+    return toBase64Url((await hmac(pepper, encoder2.encode(`salt:${email}`))).slice(0, SALT_BYTES));
+  }
+  async function makeVerifier(salt, clientKey) {
+    return {
+      kdf: PASSWORD_KDF,
+      iterations: PASSWORD_ITERATIONS,
+      salt: toBase64Url(salt),
+      verifier: toBase64Url(await hmac(pepper, clientKey)),
+      pepperId
+    };
+  }
+  async function checkPassword(user, clientKey) {
+    const [computed, dummy] = await Promise.all([
+      hmac(pepper, clientKey),
+      hmac(pepper, encoder2.encode("absent"))
+    ]);
+    const stored = user?.password ? fromBase64Url(user.password.verifier) : null;
+    const expected = stored ?? dummy;
+    const match = constantTimeEqual(computed, expected);
+    return match && stored !== null && user?.status === "active";
+  }
+  async function readAttempt(id) {
+    const value = await records.getRecord(LOGIN_ATTEMPTS, id);
+    return isAttemptRecord(value) ? value : null;
+  }
+  function attemptIds(email, ip) {
+    return [`email:${email}`, `ip:${ip.slice(0, 64)}`];
+  }
+  return {
+    async count() {
+      return (await records.listRecords(USERS)).length;
     },
-    { name: "meta", description: "Health and discovery." }
-  ],
-  paths: {
-    "/api/v1/flags": {
-      get: {
-        tags: ["admin"],
-        summary: "List all flags",
-        security: [{ bearerAuth: [] }],
-        responses: {
-          "200": {
-            description: "All flags",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  required: ["flags"],
-                  properties: {
-                    flags: { type: "array", items: { $ref: "#/components/schemas/FeatureFlag" } }
-                  }
-                }
-              }
-            }
-          },
-          "401": { $ref: "#/components/responses/Unauthorized" }
-        }
+    getUser,
+    findByEmail,
+    async listUsers() {
+      return (await records.listRecords(USERS)).map((r) => r.value).filter(isUserRecord).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+    },
+    async saveUser(user) {
+      const updated = { ...user, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      await records.putRecord(USERS, user.id, updated);
+      return updated;
+    },
+    /** Delete an account with its email index, sessions and any open reset link. */
+    async removeUser(user) {
+      await Promise.all([
+        ...(await allSessions()).filter((s) => s.session.userId === user.id).map((s) => records.deleteRecord(SESSIONS, s.key)),
+        ...(await liveInvites()).filter((i) => i.invite.userId === user.id).map((i) => records.deleteRecord(INVITES, i.key)),
+        ...(await tokensOf(user.id)).map((t) => records.deleteRecord(TOKENS, t.key)),
+        ...user.sso ? [
+          ssoKey(user.sso.issuer, user.sso.subject).then(
+            (k) => records.deleteRecord(USERS_BY_SSO, k)
+          )
+        ] : []
+      ]);
+      await records.deleteRecord(USERS_BY_EMAIL, user.email);
+      await records.deleteRecord(USERS, user.id);
+    },
+    /** When each user was last seen, from their live sessions. */
+    async lastActive() {
+      const out = /* @__PURE__ */ new Map();
+      for (const { session } of await allSessions()) {
+        const prev = out.get(session.userId);
+        if (!prev || session.lastSeenAt > prev) out.set(session.userId, session.lastSeenAt);
       }
+      return out;
     },
-    "/api/v1/flags/{key}": {
-      parameters: [{ $ref: "#/components/parameters/FlagKey" }],
-      get: {
-        tags: ["admin"],
-        summary: "Get one flag",
-        security: [{ bearerAuth: [] }],
-        responses: {
-          "200": {
-            description: "The flag",
-            content: {
-              "application/json": { schema: { $ref: "#/components/schemas/FeatureFlag" } }
-            }
-          },
-          "401": { $ref: "#/components/responses/Unauthorized" },
-          "404": { $ref: "#/components/responses/NotFound" }
-        }
-      },
-      put: {
-        tags: ["admin"],
-        summary: "Create or replace a flag",
-        description: "A full replace. Creation metadata (createdBy/createdAt) is preserved; the updater and updatedAt are stamped server-side. Invalid targeting rules are rejected with 400.",
-        security: [{ bearerAuth: [] }],
-        requestBody: {
-          required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/FlagInput" } } }
+    /** Sign out every session of a user, except `keepId`. Returns how many ended. */
+    async revokeSessionsFor(userId, keepId) {
+      const ended = (await allSessions()).filter(
+        (s) => s.session.userId === userId && s.session.id !== keepId
+      );
+      await Promise.all(ended.map((s) => records.deleteRecord(SESSIONS, s.key)));
+      return ended.length;
+    },
+    // ---- two-factor codes ----
+    /** Whether the policy makes this account use two-factor codes with its password. */
+    twoFactorRequired(user) {
+      const policy = users.twoFactor ?? "optional";
+      if (policy === "everyone") return true;
+      return policy === "admins" && (user.role === "admin" || user.role === "owner");
+    },
+    /** Start setup: a fresh secret, kept sealed on the account until a code confirms it. */
+    async beginTwoFactor(user) {
+      const secret = newTotpSecret();
+      await records.putRecord(USERS, user.id, {
+        ...user,
+        pendingTwoFactor: {
+          secret: await sealSecret(secret),
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
         },
-        responses: {
-          "200": {
-            description: "The stored flag",
-            content: {
-              "application/json": { schema: { $ref: "#/components/schemas/FeatureFlag" } }
-            }
-          },
-          "400": { $ref: "#/components/responses/BadRequest" },
-          "401": { $ref: "#/components/responses/Unauthorized" },
-          "413": { description: "Payload too large" }
-        }
-      },
-      delete: {
-        tags: ["admin"],
-        summary: "Delete a flag",
-        security: [{ bearerAuth: [] }],
-        responses: {
-          "204": { description: "Deleted (idempotent)" },
-          "401": { $ref: "#/components/responses/Unauthorized" }
-        }
-      }
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      return secret;
     },
-    "/ofrep/v1/evaluate/flags": {
-      post: {
-        tags: ["evaluate"],
-        summary: "Evaluate all flags for a context (OFREP bulk)",
-        security: [{ apiKeyAuth: [] }],
-        requestBody: {
-          content: {
-            "application/json": { schema: { $ref: "#/components/schemas/EvaluationRequest" } }
-          }
+    /** Finish setup with a code from the app. Returns the recovery codes, or null for a wrong code. */
+    async confirmTwoFactor(user, code) {
+      if (!user.pendingTwoFactor) return null;
+      const secret = await openSecret(user.pendingTwoFactor.secret);
+      if (!secret) return null;
+      const step = await matchTotp(secret, code);
+      if (step === null) return null;
+      const codes = newRecoveryCodes();
+      const { pendingTwoFactor: _, ...rest } = user;
+      await records.putRecord(USERS, user.id, {
+        ...rest,
+        twoFactor: {
+          secret: user.pendingTwoFactor.secret,
+          enabledAt: (/* @__PURE__ */ new Date()).toISOString(),
+          lastStep: step,
+          recoveryCodes: await Promise.all(codes.map(hashRecoveryCode))
         },
-        responses: {
-          "200": {
-            description: "Evaluated flags",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    flags: { type: "array", items: { $ref: "#/components/schemas/EvaluatedFlag" } }
-                  }
-                }
-              }
-            }
-          },
-          "401": { $ref: "#/components/responses/Unauthorized" }
-        }
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      return codes;
+    },
+    /**
+     * Check a code from the app, or a recovery code, for an account that has two-factor on. A code
+     * is accepted once: its time step is recorded, and a recovery code is used up.
+     */
+    async checkSecondFactor(user, code) {
+      const tf = user.twoFactor;
+      if (!tf) return null;
+      if (looksLikeRecoveryCode(code)) {
+        const hash = await hashRecoveryCode(code);
+        if (!tf.recoveryCodes.includes(hash)) return null;
+        await records.putRecord(USERS, user.id, {
+          ...user,
+          twoFactor: { ...tf, recoveryCodes: tf.recoveryCodes.filter((h) => h !== hash) },
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        return "recovery";
       }
+      const secret = await openSecret(tf.secret);
+      const step = secret ? await matchTotp(secret, code) : null;
+      if (step === null || tf.lastStep !== void 0 && step <= tf.lastStep) return null;
+      await records.putRecord(USERS, user.id, {
+        ...user,
+        twoFactor: { ...tf, lastStep: step },
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      return "app";
     },
-    "/ofrep/v1/evaluate/flags/{key}": {
-      parameters: [{ $ref: "#/components/parameters/FlagKey" }],
-      post: {
-        tags: ["evaluate"],
-        summary: "Evaluate one flag (OFREP)",
-        security: [{ apiKeyAuth: [] }],
-        requestBody: {
-          content: {
-            "application/json": { schema: { $ref: "#/components/schemas/EvaluationRequest" } }
-          }
+    async newRecoveryCodes(user) {
+      if (!user.twoFactor) return null;
+      const codes = newRecoveryCodes();
+      await records.putRecord(USERS, user.id, {
+        ...user,
+        twoFactor: {
+          ...user.twoFactor,
+          recoveryCodes: await Promise.all(codes.map(hashRecoveryCode))
         },
-        responses: {
-          "200": {
-            description: "Evaluated flag",
-            content: {
-              "application/json": { schema: { $ref: "#/components/schemas/EvaluatedFlag" } }
-            }
-          },
-          "404": { description: "Unknown flag (errorCode FLAG_NOT_FOUND)" }
-        }
-      }
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      return codes;
     },
-    "/api/v1/openapi.json": {
-      get: {
-        tags: ["meta"],
-        summary: "This OpenAPI document",
-        responses: { "200": { description: "The OpenAPI document" } }
+    async removeTwoFactor(user) {
+      const { twoFactor: _, pendingTwoFactor: __, ...rest } = user;
+      await records.putRecord(USERS, user.id, {
+        ...rest,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    },
+    // ---- personal access tokens ----
+    async createToken(user, input) {
+      const token = TOKEN_PREFIX + toBase64Url(randomBytes(32));
+      const now = Date.now();
+      const record = {
+        id: `tok_${hex(randomBytes(12))}`,
+        userId: user.id,
+        name: input.name,
+        role: input.role,
+        prefix: token.slice(0, TOKEN_PREFIX.length + 4),
+        createdAt: new Date(now).toISOString(),
+        ...input.expiresInDays !== null ? { expiresAt: new Date(now + input.expiresInDays * 864e5).toISOString() } : {}
+      };
+      await records.putRecord(TOKENS, await sha256Hex(token), record);
+      return { token, record };
+    },
+    /** A user's tokens, newest first. Expired ones are listed until revoked, marked by expiresAt. */
+    async listTokens(userId) {
+      return (await tokensOf(userId)).map((t) => t.token).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    },
+    /**
+     * The owner and effective role behind a token, or null. An expired token is deleted and
+     * reported through `onExpired` so the caller can audit it. lastUsedAt is written back at most
+     * every few minutes, like a session's lastSeenAt.
+     */
+    async resolveToken(token, onExpired) {
+      const key = await sha256Hex(token);
+      const value = await records.getRecord(TOKENS, key);
+      if (!isTokenRecord(value)) return null;
+      const now = Date.now();
+      if (value.expiresAt && now >= Date.parse(value.expiresAt)) {
+        await records.deleteRecord(TOKENS, key);
+        await onExpired?.(value);
+        return null;
       }
+      const user = await getUser(value.userId);
+      if (!user || user.status !== "active") return null;
+      let record = value;
+      if (!value.lastUsedAt || now - Date.parse(value.lastUsedAt) >= touchMs) {
+        record = { ...value, lastUsedAt: new Date(now).toISOString() };
+        await records.putRecord(TOKENS, key, record);
+      }
+      return { user, token: record, role: lowerRole(record.role, user.role) };
     },
-    "/health": {
-      get: {
-        tags: ["meta"],
-        summary: "Health check",
-        responses: {
-          "200": {
-            description: "ok",
-            content: {
-              "application/json": {
-                schema: { type: "object", properties: { status: { type: "string" } } }
-              }
-            }
-          }
+    async revokeToken(userId, id) {
+      const match = (await tokensOf(userId)).find((t) => t.token.id === id);
+      if (!match) return null;
+      await records.deleteRecord(TOKENS, match.key);
+      return match.token;
+    },
+    /** Revoke the token presented, for signing out a CLI. */
+    async revokePresentedToken(token) {
+      const key = await sha256Hex(token);
+      const value = await records.getRecord(TOKENS, key);
+      await records.deleteRecord(TOKENS, key);
+      return isTokenRecord(value) ? value : null;
+    },
+    // ---- invites and reset links ----
+    /**
+     * Issue an invite, or a reset link for an existing account. Any earlier open link of the same
+     * kind for the same email stops working, so only the newest one can be used.
+     */
+    async createInvite(input) {
+      for (const { key, invite: invite2 } of await liveInvites()) {
+        if (invite2.kind === input.kind && invite2.email === input.email) {
+          await records.deleteRecord(INVITES, key);
         }
       }
-    }
-  },
-  components: {
-    securitySchemes: {
-      bearerAuth: {
-        type: "http",
-        scheme: "bearer",
-        description: "Admin token (or a validated OIDC JWT)."
-      },
-      apiKeyAuth: {
-        type: "apiKey",
-        in: "header",
-        name: "x-api-key",
-        description: "Read-only API key."
+      const prefix = input.kind === "invite" ? INVITE_PREFIX : RESET_PREFIX;
+      const token = prefix + toBase64Url(randomBytes(32));
+      const now = Date.now();
+      const invite = {
+        id: `inv_${hex(randomBytes(12))}`,
+        kind: input.kind,
+        email: input.email,
+        role: input.role,
+        ...input.userId ? { userId: input.userId } : {},
+        invitedBy: input.invitedBy,
+        createdAt: new Date(now).toISOString(),
+        expiresAt: new Date(
+          now + (input.kind === "invite" ? inviteMs : RESET_LINK_MS)
+        ).toISOString()
+      };
+      await records.putRecord(INVITES, await sha256Hex(token), invite);
+      return { token, invite };
+    },
+    async listInvites() {
+      return (await liveInvites()).map((i) => i.invite).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    },
+    /** The open invite or reset link behind a token, or null when unknown, used or expired. */
+    async findInvite(token) {
+      if (!token.startsWith(INVITE_PREFIX) && !token.startsWith(RESET_PREFIX)) return null;
+      const key = await sha256Hex(token);
+      const value = await records.getRecord(INVITES, key);
+      if (!isInviteRecord(value)) return null;
+      if (Date.now() >= Date.parse(value.expiresAt)) {
+        await records.deleteRecord(INVITES, key);
+        return null;
       }
+      return value;
     },
-    parameters: {
-      FlagKey: {
-        name: "key",
-        in: "path",
-        required: true,
-        description: "Flag key.",
-        schema: { type: "string", pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*$", maxLength: 256 }
+    async consumeInvite(token) {
+      await records.deleteRecord(INVITES, await sha256Hex(token));
+    },
+    /** Revoke an open invite or reset link by its public id. */
+    async revokeInvite(id) {
+      const match = (await liveInvites()).find((i) => i.invite.id === id);
+      if (!match) return null;
+      await records.deleteRecord(INVITES, match.key);
+      return match.invite;
+    },
+    async passwordParams(email) {
+      const user = await findByEmail(email);
+      const salt = user?.password?.salt ?? await fakeSalt(email);
+      return {
+        kdf: PASSWORD_KDF,
+        iterations: user?.password?.iterations ?? PASSWORD_ITERATIONS,
+        salt
+      };
+    },
+    /** Create an account. Returns null when the email is already taken. */
+    async createUser(input) {
+      if (await userIdForEmail(input.email)) return null;
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const user = {
+        id: `usr_${hex(randomBytes(12))}`,
+        email: input.email,
+        name: input.name,
+        role: input.role,
+        status: "active",
+        password: await makeVerifier(input.salt, input.clientKey),
+        createdAt: now,
+        updatedAt: now
+      };
+      await records.putRecord(USERS, user.id, user);
+      await records.putRecord(USERS_BY_EMAIL, user.email, { userId: user.id });
+      return user;
+    },
+    checkPassword,
+    // ---- SSO ----
+    async findBySso(issuer, subject) {
+      const value = await records.getRecord(USERS_BY_SSO, await ssoKey(issuer, subject));
+      return typeof value?.userId === "string" ? getUser(value.userId) : null;
+    },
+    /** Tie an account to a provider identity, so later sign-ins find it even if the email changes. */
+    async linkSso(user, issuer, subject) {
+      const updated = {
+        ...user,
+        sso: { issuer, subject },
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await records.putRecord(USERS, user.id, updated);
+      await records.putRecord(USERS_BY_SSO, await ssoKey(issuer, subject), { userId: user.id });
+      return updated;
+    },
+    /** Create an account that signs in with SSO only. Returns null when the email is taken. */
+    async createSsoUser(input) {
+      if (await userIdForEmail(input.email)) return null;
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const user = {
+        id: `usr_${hex(randomBytes(12))}`,
+        email: input.email,
+        name: input.name.slice(0, MAX_NAME_LENGTH),
+        role: input.role,
+        status: "active",
+        sso: { issuer: input.issuer, subject: input.subject },
+        ...input.managed ? { roleManagedBy: "sso" } : {},
+        createdAt: now,
+        updatedAt: now
+      };
+      await records.putRecord(USERS, user.id, user);
+      await records.putRecord(USERS_BY_EMAIL, user.email, { userId: user.id });
+      await records.putRecord(USERS_BY_SSO, await ssoKey(input.issuer, input.subject), {
+        userId: user.id
+      });
+      return user;
+    },
+    async setPassword(user, salt, clientKey) {
+      const updated = {
+        ...user,
+        password: await makeVerifier(salt, clientKey),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await records.putRecord(USERS, user.id, updated);
+    },
+    async recordLogin(user) {
+      await records.putRecord(USERS, user.id, { ...user, lastLoginAt: (/* @__PURE__ */ new Date()).toISOString() });
+    },
+    // ---- throttling ----
+    async throttled(email, ip) {
+      const now = Date.now();
+      const attempts = await Promise.all(attemptIds(email, ip).map(readAttempt));
+      const lockedUntil = Math.max(0, ...attempts.map((a) => a?.lockedUntil ?? 0));
+      if (lockedUntil > now) {
+        return { ok: false, retryAfterSeconds: Math.ceil((lockedUntil - now) / 1e3) };
       }
+      return { ok: true };
     },
-    responses: {
-      Unauthorized: {
-        description: "Missing or invalid credentials",
-        content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
-      },
-      BadRequest: {
-        description: "Invalid request or flag definition",
-        content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
-      },
-      NotFound: {
-        description: "Flag not found",
-        content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
+    async recordFailure(email, ip) {
+      const now = Date.now();
+      const [emailId, ipId] = attemptIds(email, ip);
+      const bump = async (id, lockFor) => {
+        const prev = await readAttempt(id);
+        const fresh = !prev || now - prev.windowStart > ATTEMPT_WINDOW_MS;
+        const failures = fresh ? 1 : prev.failures + 1;
+        const lockMs = lockFor(failures);
+        const next = {
+          failures,
+          windowStart: fresh ? now : prev.windowStart,
+          ...lockMs > 0 ? { lockedUntil: now + lockMs } : {}
+        };
+        await records.putRecord(LOGIN_ATTEMPTS, id, next);
+      };
+      await Promise.all([
+        bump(
+          emailId,
+          (n) => n <= EMAIL_FREE_FAILURES ? 0 : Math.min(EMAIL_BASE_LOCK_MS * 2 ** (n - EMAIL_FREE_FAILURES - 1), MAX_LOCK_MS)
+        ),
+        bump(ipId, (n) => n >= IP_MAX_FAILURES ? MAX_LOCK_MS : 0)
+      ]);
+    },
+    async clearFailures(email) {
+      await records.deleteRecord(LOGIN_ATTEMPTS, `email:${email}`);
+    },
+    // ---- sessions ----
+    async createSession(user, userAgent, via) {
+      const token = SESSION_PREFIX + toBase64Url(randomBytes(32));
+      const now = Date.now();
+      const session = {
+        id: `ses_${hex(randomBytes(12))}`,
+        userId: user.id,
+        createdAt: new Date(now).toISOString(),
+        lastSeenAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + maxMs).toISOString(),
+        ...userAgent ? { userAgent: userAgent.slice(0, MAX_USER_AGENT_LENGTH) } : {},
+        ...via ? { via } : {}
+      };
+      await records.putRecord(SESSIONS, await sha256Hex(token), session);
+      return { token, session };
+    },
+    /**
+     * The live session and active user behind a session token, or null. Expired sessions are
+     * deleted on sight. lastSeenAt is written back at most every few minutes.
+     */
+    async resolveSession(token) {
+      const key = await sha256Hex(token);
+      const value = await records.getRecord(SESSIONS, key);
+      if (!isSessionRecord(value)) return null;
+      const now = Date.now();
+      const lastSeen = Date.parse(value.lastSeenAt);
+      if (now >= Date.parse(value.expiresAt) || now - lastSeen >= idleMs) {
+        await records.deleteRecord(SESSIONS, key);
+        return null;
+      }
+      const user = await getUser(value.userId);
+      if (!user || user.status !== "active") return null;
+      let session = value;
+      if (now - lastSeen >= touchMs) {
+        session = { ...value, lastSeenAt: new Date(now).toISOString() };
+        await records.putRecord(SESSIONS, key, session);
       }
+      return { user, session };
     },
-    schemas: {
-      Error: { type: "object", required: ["error"], properties: { error: { type: "string" } } },
-      Condition: {
-        type: "object",
-        required: ["attribute", "operator", "value"],
-        properties: {
-          attribute: { type: "string", maxLength: 256 },
-          operator: {
-            type: "string",
-            enum: [
-              "eq",
-              "neq",
-              "in",
-              "notIn",
-              "contains",
-              "startsWith",
-              "endsWith",
-              "gt",
-              "gte",
-              "lt",
-              "lte",
-              "semverGte",
-              "semverLt"
-            ]
-          },
-          value: {
-            description: "A scalar, or an array of scalars for `in` / `notIn`.",
-            oneOf: [
-              { type: "string" },
-              { type: "number" },
-              { type: "boolean" },
-              { type: "array", items: { oneOf: [{ type: "string" }, { type: "number" }] } }
-            ]
-          }
-        }
-      },
-      RuleResult: {
-        type: "object",
-        required: ["enabled"],
-        properties: {
-          enabled: { type: "boolean" },
-          rollout: {
-            type: "object",
-            properties: { percentage: { type: "number", minimum: 0, maximum: 100 } }
-          }
-        }
-      },
-      TargetingRule: {
-        type: "object",
-        required: ["conditions", "result"],
-        properties: {
-          description: { type: "string" },
-          conditions: { type: "array", items: { $ref: "#/components/schemas/Condition" } },
-          result: { $ref: "#/components/schemas/RuleResult" }
-        }
-      },
-      FlagMetadata: {
-        type: "object",
-        properties: {
-          createdBy: { type: "string" },
-          createdAt: { type: "string", format: "date-time" },
-          updatedBy: { type: "string" },
-          updatedAt: { type: "string", format: "date-time" }
-        }
-      },
-      FlagInput: {
-        type: "object",
-        required: ["enabled", "rollout"],
-        properties: {
-          enabled: { type: "boolean" },
-          rollout: {
-            type: "object",
-            required: ["percentage"],
-            properties: { percentage: { type: "number", minimum: 0, maximum: 100 } }
-          },
-          rules: { type: "array", items: { $ref: "#/components/schemas/TargetingRule" } },
-          description: { type: "string" }
-        }
-      },
-      FeatureFlag: {
-        allOf: [
-          { $ref: "#/components/schemas/FlagInput" },
-          {
-            type: "object",
-            required: ["key", "metadata"],
-            properties: {
-              key: { type: "string" },
-              metadata: { $ref: "#/components/schemas/FlagMetadata" }
-            }
-          }
-        ]
-      },
-      EvaluationRequest: {
-        type: "object",
-        properties: {
-          context: {
-            type: "object",
-            description: "OpenFeature evaluation context.",
-            properties: { targetingKey: { type: "string" } },
-            additionalProperties: true
-          }
-        }
+    async endSession(token) {
+      const key = await sha256Hex(token);
+      const value = await records.getRecord(SESSIONS, key);
+      await records.deleteRecord(SESSIONS, key);
+      return isSessionRecord(value) ? value : null;
+    },
+    /** A user's live sessions, keyed by storage id. Expired ones are cleaned up along the way. */
+    async sessionsFor(userId) {
+      return (await allSessions()).filter((s) => s.session.userId === userId);
+    },
+    async deleteSessionKey(key) {
+      await records.deleteRecord(SESSIONS, key);
+    }
+  };
+}
+function publicSession(session, currentId) {
+  return {
+    id: session.id,
+    createdAt: session.createdAt,
+    lastSeenAt: session.lastSeenAt,
+    expiresAt: session.expiresAt,
+    ...session.userAgent ? { userAgent: session.userAgent } : {},
+    current: session.id === currentId
+  };
+}
+
+// src/audit.ts
+import {
+  auditCategory
+} from "@flaghoist/core";
+function generateId() {
+  const ts = Date.now().toString(36);
+  const rand = Math.random().toString(36).slice(2, 8);
+  return `${ts}-${rand}`;
+}
+function createAuditLog(storage) {
+  if (storage?.appendAudit && storage?.listAudit) {
+    return {
+      async record(entry) {
+        await storage.appendAudit({
+          ...entry,
+          id: generateId(),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        });
       },
-      EvaluatedFlag: {
-        type: "object",
-        properties: {
-          key: { type: "string" },
-          value: { type: "boolean" },
-          reason: {
-            type: "string",
-            enum: ["STATIC", "TARGETING_MATCH", "SPLIT", "DEFAULT"]
-          },
-          variant: { type: "string" }
-        }
+      async list(options) {
+        return storage.listAudit(options);
       }
-    }
+    };
   }
-};
+  const buffers = { flags: [], security: [] };
+  const CAPACITY = 500;
+  return {
+    async record(entry) {
+      const buf = buffers[auditCategory(entry.action)];
+      buf.push({ ...entry, id: generateId(), timestamp: (/* @__PURE__ */ new Date()).toISOString() });
+      if (buf.length > CAPACITY) buf.splice(0, buf.length - CAPACITY);
+    },
+    async list(options) {
+      const source = options?.category ? buffers[options.category] : [...buffers.flags, ...buffers.security].sort(
+        (a, b) => a.timestamp.localeCompare(b.timestamp)
+      );
+      let entries = source.slice().reverse();
+      if (options?.flagKey) entries = entries.filter((e) => e.flagKey === options.flagKey);
+      if (options?.action) entries = entries.filter((e) => e.action === options.action);
+      if (options?.environment !== void 0) {
+        entries = entries.filter((e) => e.environment === options.environment);
+      }
+      const total = entries.length;
+      const offset = options?.offset ?? 0;
+      const limit = options?.limit ?? 50;
+      return { entries: entries.slice(offset, offset + limit), total };
+    }
+  };
+}
 
-// src/ratelimit.ts
-function defaultRateLimitKey(headers) {
-  const cf = headers.get("cf-connecting-ip");
-  if (cf) return cf;
-  const fwd = headers.get("x-forwarded-for");
-  if (fwd) {
-    const first = fwd.split(",")[0]?.trim();
-    if (first) return first;
-  }
-  return "anonymous";
+// src/email.ts
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function memoryRateLimit(options = {}) {
-  const max = options.max ?? 120;
-  const windowMs = options.windowMs ?? 6e4;
-  const maxKeys = options.maxKeys ?? 1e5;
-  const hits = /* @__PURE__ */ new Map();
-  const sweep = (now) => {
-    for (const [key, entry] of hits) {
-      if (entry.resetAt <= now) hits.delete(key);
-    }
+function formatDate(iso) {
+  return new Date(iso).toUTCString().replace(/:\d\d GMT$/, " UTC");
+}
+function htmlBody(paragraphs, link, button) {
+  const safeLink = escapeHtml(link);
+  return [
+    '<!doctype html><html><body style="font-family:system-ui,sans-serif;line-height:1.5;color:#0b1e3a">',
+    ...paragraphs.map((p) => `<p>${escapeHtml(p)}</p>`),
+    `<p><a href="${safeLink}" style="display:inline-block;padding:10px 16px;background:#d9532b;color:#fff;border-radius:6px;text-decoration:none">${escapeHtml(button)}</a></p>`,
+    `<p style="font-size:13px;color:#4a5a73">Or open this link: ${safeLink}</p>`,
+    "</body></html>"
+  ].join("");
+}
+function inviteEmail(input) {
+  const paragraphs = [
+    input.invitedBy ? `${input.invitedBy} invited you to Flaghoist as ${input.role}.` : `You are invited to Flaghoist as ${input.role}.`,
+    input.ssoLabel ? `Open Flaghoist and choose Continue with ${input.ssoLabel}, signing in as ${input.to}. The invite lasts until ${formatDate(input.expiresAt)}.` : `Open the link to choose a password and sign in. It works once, until ${formatDate(input.expiresAt)}.`,
+    "If you were not expecting this, you can ignore this email; nothing happens until the link is used."
+  ];
+  return {
+    to: input.to,
+    subject: "You are invited to Flaghoist",
+    text: [...paragraphs, "", input.link].join("\n\n"),
+    html: htmlBody(paragraphs, input.link, "Accept the invite")
   };
+}
+function resetEmail(input) {
+  const paragraphs = [
+    "An admin created a link for you to set a new Flaghoist password.",
+    `It works once, until ${formatDate(input.expiresAt)}. Setting a new password signs you out everywhere else.`,
+    "If you did not ask for this, tell your Flaghoist admin; your current password keeps working until the link is used."
+  ];
   return {
-    key: defaultRateLimitKey,
-    check(key) {
-      const now = Date.now();
-      let entry = hits.get(key);
-      if (!entry || entry.resetAt <= now) {
-        if (!hits.has(key) && hits.size >= maxKeys) {
-          sweep(now);
-          if (hits.size >= maxKeys) return { ok: true };
-        }
-        entry = { count: 0, resetAt: now + windowMs };
-        hits.set(key, entry);
-      }
-      entry.count += 1;
-      if (entry.count > max) {
-        return { ok: false, retryAfter: Math.max(1, Math.ceil((entry.resetAt - now) / 1e3)) };
-      }
-      return { ok: true };
-    }
+    to: input.to,
+    subject: "Set a new Flaghoist password",
+    text: [...paragraphs, "", input.link].join("\n\n"),
+    html: htmlBody(paragraphs, input.link, "Set a new password")
   };
 }
 
 // src/auth.ts
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, jwtVerify as jwtVerify2 } from "jose";
 function extractBearer(headers) {
   const header = headers.get("authorization");
   if (!header) return null;
@@ -436,10 +1160,10 @@ function extractBearer(headers) {
   return token.trim() || null;
 }
 async function safeEqual(a, b) {
-  const encoder = new TextEncoder();
+  const encoder3 = new TextEncoder();
   const [da, db] = await Promise.all([
-    crypto.subtle.digest("SHA-256", encoder.encode(a)),
-    crypto.subtle.digest("SHA-256", encoder.encode(b))
+    crypto.subtle.digest("SHA-256", encoder3.encode(a)),
+    crypto.subtle.digest("SHA-256", encoder3.encode(b))
   ]);
   const va = new Uint8Array(da);
   const vb = new Uint8Array(db);
@@ -473,6 +1197,22 @@ function apiKey(expected) {
     return { ok: true, identity: "api-key" };
   };
 }
+function apiKeys(keys) {
+  const entries = Object.entries(keys);
+  for (const [env, secret] of entries) {
+    warnIfWeakSecret(`read API key for "${env}"`, secret);
+  }
+  return async (headers) => {
+    const provided = headers.get("x-api-key");
+    if (!provided) return { ok: false, status: 401, message: "Invalid or missing API key" };
+    const results = await Promise.all(
+      entries.map(async ([env, secret]) => ({ env, match: await safeEqual(provided, secret) }))
+    );
+    const hit = results.find((r) => r.match);
+    if (!hit) return { ok: false, status: 401, message: "Invalid or missing API key" };
+    return { ok: true, identity: "api-key", environment: hit.env };
+  };
+}
 function bearerToken(expected) {
   warnIfWeakSecret("admin token", expected);
   return async (headers) => {
@@ -501,210 +1241,2439 @@ function oidc(options) {
     if (!token) return { ok: false, status: 401, message: "Missing bearer token" };
     let payload;
     try {
-      const verified = await jwtVerify(token, resolveKey, {
-        issuer: options.issuer,
-        audience: options.audience,
-        algorithms
+      const verified = await jwtVerify2(token, resolveKey, {
+        issuer: options.issuer,
+        audience: options.audience,
+        algorithms
+      });
+      payload = verified.payload;
+    } catch {
+      return { ok: false, status: 401, message: "Invalid token" };
+    }
+    if (options.tokenUse && payload["token_use"] !== options.tokenUse) {
+      return { ok: false, status: 401, message: "Invalid token" };
+    }
+    if (options.allowedGroups && options.allowedGroups.length > 0) {
+      const groups = extractGroups(payload, options.groupsClaim ?? "groups");
+      const allowed = options.allowedGroups;
+      if (!groups.some((group) => allowed.includes(group))) {
+        return { ok: false, status: 403, message: "Admin group required" };
+      }
+    }
+    const email = typeof payload["email"] === "string" ? payload["email"] : void 0;
+    const sub = typeof payload.sub === "string" ? payload.sub : void 0;
+    return { ok: true, identity: email ?? sub ?? "unknown" };
+  };
+}
+
+// src/cache.ts
+function createDefinitionCache() {
+  let entry = null;
+  return {
+    async load(storage, ttlMs2) {
+      const now = Date.now();
+      if (entry && entry.expiresAt > now) return entry.flags;
+      const flags = await storage.list();
+      entry = { flags, expiresAt: now + ttlMs2 };
+      return flags;
+    },
+    invalidate() {
+      entry = null;
+    }
+  };
+}
+
+// src/environments.ts
+function scopedStorage(storage, environment, defaultEnvironment) {
+  const isDefault = environment === defaultEnvironment;
+  const storageKey = (key) => isDefault ? key : `${environment}:${key}`;
+  return {
+    async get(key) {
+      return storage.get(storageKey(key));
+    },
+    async put(key, flag) {
+      const { environment: _drop, ...rest } = flag;
+      const stamped = isDefault ? rest : { ...rest, environment };
+      await storage.put(storageKey(key), stamped);
+    },
+    async delete(key) {
+      await storage.delete(storageKey(key));
+    },
+    async list() {
+      const all = await storage.list();
+      return isDefault ? all.filter((f) => !f.environment) : all.filter((f) => f.environment === environment);
+    }
+  };
+}
+function resolveAdminEnvironment(environments, defaultEnvironment, headers) {
+  if (!environments || environments.length === 0) {
+    return { ok: true, environment: defaultEnvironment };
+  }
+  const requested = headers.get("x-flaghoist-environment")?.trim();
+  if (!requested) return { ok: true, environment: defaultEnvironment };
+  if (!environments.includes(requested)) {
+    return {
+      ok: false,
+      status: 400,
+      message: `Unknown environment "${requested}". Configured environments: ${environments.join(", ")}.`
+    };
+  }
+  return { ok: true, environment: requested };
+}
+function resolveReadEnvironment(environments, defaultEnvironment, authEnvironment) {
+  if (!environments || environments.length === 0) return defaultEnvironment;
+  if (authEnvironment && environments.includes(authEnvironment)) return authEnvironment;
+  return defaultEnvironment;
+}
+
+// src/flags.ts
+import { clampPercentage, LIMITS, parseFlag } from "@flaghoist/core";
+function buildFlag(key, body, identity, existing) {
+  if (typeof body !== "object" || body === null) {
+    return { ok: false, error: "Request body must be a JSON object" };
+  }
+  const b = body;
+  const enabled = typeof b.enabled === "boolean" ? b.enabled : false;
+  const rollout = typeof b.rollout === "object" && b.rollout !== null ? b.rollout : {};
+  const percentage = typeof rollout.percentage === "number" ? clampPercentage(rollout.percentage) : 0;
+  const description = typeof b.description === "string" ? b.description : "";
+  if (description.length > LIMITS.maxDescriptionLength) {
+    return { ok: false, error: `Description exceeds ${LIMITS.maxDescriptionLength} characters` };
+  }
+  const inputRules = Array.isArray(b.rules) ? b.rules : [];
+  const nowMs = Date.now();
+  const prevMs = existing ? Date.parse(existing.metadata.updatedAt) : 0;
+  const updatedAt = new Date(nowMs > prevMs ? nowMs : prevMs + 1).toISOString();
+  const createdAt = existing?.metadata.createdAt ?? new Date(nowMs).toISOString();
+  const candidate = {
+    key,
+    enabled,
+    rollout: { percentage },
+    rules: inputRules,
+    description,
+    metadata: {
+      createdBy: existing?.metadata.createdBy ?? identity,
+      createdAt,
+      updatedBy: identity,
+      updatedAt
+    }
+  };
+  const validated = parseFlag(candidate);
+  if (!validated) return { ok: false, error: "Invalid flag definition" };
+  if ((validated.rules?.length ?? 0) !== inputRules.length) {
+    return { ok: false, error: "One or more targeting rules are invalid" };
+  }
+  return { ok: true, flag: validated };
+}
+function flagEtag(flag) {
+  return `"${flag.metadata.updatedAt}"`;
+}
+
+// src/openapi.ts
+var openApiDocument = {
+  openapi: "3.1.0",
+  info: {
+    title: "Flaghoist API",
+    version: "0.1.0",
+    description: "Manage and evaluate feature flags. The admin API (`/api/v1/flags`) is Flaghoist's own; the read API (`/ofrep/v1`) follows the OpenFeature Remote Evaluation Protocol (OFREP). The unversioned `/flags` paths remain as a legacy alias of `/api/v1/flags`.",
+    license: { name: "Apache-2.0", url: "https://www.apache.org/licenses/LICENSE-2.0" }
+  },
+  servers: [{ url: "/", description: "This Flaghoist server" }],
+  tags: [
+    { name: "admin", description: "Manage flag definitions (admin auth)." },
+    {
+      name: "evaluate",
+      description: "Evaluate flags for a context (OFREP read path, API-key auth)."
+    },
+    { name: "meta", description: "Health and discovery." }
+  ],
+  paths: {
+    "/api/v1/flags": {
+      get: {
+        tags: ["admin"],
+        summary: "List all flags",
+        security: [{ bearerAuth: [] }],
+        responses: {
+          "200": {
+            description: "All flags",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  required: ["flags"],
+                  properties: {
+                    flags: { type: "array", items: { $ref: "#/components/schemas/FeatureFlag" } }
+                  }
+                }
+              }
+            }
+          },
+          "401": { $ref: "#/components/responses/Unauthorized" }
+        }
+      }
+    },
+    "/api/v1/flags/{key}": {
+      parameters: [{ $ref: "#/components/parameters/FlagKey" }],
+      get: {
+        tags: ["admin"],
+        summary: "Get one flag",
+        security: [{ bearerAuth: [] }],
+        responses: {
+          "200": {
+            description: "The flag",
+            content: {
+              "application/json": { schema: { $ref: "#/components/schemas/FeatureFlag" } }
+            }
+          },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "404": { $ref: "#/components/responses/NotFound" }
+        }
+      },
+      put: {
+        tags: ["admin"],
+        summary: "Create or replace a flag",
+        description: "A full replace. Creation metadata (createdBy/createdAt) is preserved; the updater and updatedAt are stamped server-side. Invalid targeting rules are rejected with 400.",
+        security: [{ bearerAuth: [] }],
+        requestBody: {
+          required: true,
+          content: { "application/json": { schema: { $ref: "#/components/schemas/FlagInput" } } }
+        },
+        responses: {
+          "200": {
+            description: "The stored flag",
+            content: {
+              "application/json": { schema: { $ref: "#/components/schemas/FeatureFlag" } }
+            }
+          },
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "413": { description: "Payload too large" }
+        }
+      },
+      delete: {
+        tags: ["admin"],
+        summary: "Delete a flag",
+        security: [{ bearerAuth: [] }],
+        responses: {
+          "204": { description: "Deleted (idempotent)" },
+          "401": { $ref: "#/components/responses/Unauthorized" }
+        }
+      }
+    },
+    "/ofrep/v1/evaluate/flags": {
+      post: {
+        tags: ["evaluate"],
+        summary: "Evaluate all flags for a context (OFREP bulk)",
+        security: [{ apiKeyAuth: [] }],
+        requestBody: {
+          content: {
+            "application/json": { schema: { $ref: "#/components/schemas/EvaluationRequest" } }
+          }
+        },
+        responses: {
+          "200": {
+            description: "Evaluated flags",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    flags: { type: "array", items: { $ref: "#/components/schemas/EvaluatedFlag" } }
+                  }
+                }
+              }
+            }
+          },
+          "401": { $ref: "#/components/responses/Unauthorized" }
+        }
+      }
+    },
+    "/ofrep/v1/evaluate/flags/{key}": {
+      parameters: [{ $ref: "#/components/parameters/FlagKey" }],
+      post: {
+        tags: ["evaluate"],
+        summary: "Evaluate one flag (OFREP)",
+        security: [{ apiKeyAuth: [] }],
+        requestBody: {
+          content: {
+            "application/json": { schema: { $ref: "#/components/schemas/EvaluationRequest" } }
+          }
+        },
+        responses: {
+          "200": {
+            description: "Evaluated flag",
+            content: {
+              "application/json": { schema: { $ref: "#/components/schemas/EvaluatedFlag" } }
+            }
+          },
+          "404": { description: "Unknown flag (errorCode FLAG_NOT_FOUND)" }
+        }
+      }
+    },
+    "/api/v1/openapi.json": {
+      get: {
+        tags: ["meta"],
+        summary: "This OpenAPI document",
+        responses: { "200": { description: "The OpenAPI document" } }
+      }
+    },
+    "/health": {
+      get: {
+        tags: ["meta"],
+        summary: "Health check",
+        responses: {
+          "200": {
+            description: "ok",
+            content: {
+              "application/json": {
+                schema: { type: "object", properties: { status: { type: "string" } } }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  components: {
+    securitySchemes: {
+      bearerAuth: {
+        type: "http",
+        scheme: "bearer",
+        description: "Admin token (or a validated OIDC JWT)."
+      },
+      apiKeyAuth: {
+        type: "apiKey",
+        in: "header",
+        name: "x-api-key",
+        description: "Read-only API key."
+      }
+    },
+    parameters: {
+      FlagKey: {
+        name: "key",
+        in: "path",
+        required: true,
+        description: "Flag key.",
+        schema: { type: "string", pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*$", maxLength: 256 }
+      }
+    },
+    responses: {
+      Unauthorized: {
+        description: "Missing or invalid credentials",
+        content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
+      },
+      BadRequest: {
+        description: "Invalid request or flag definition",
+        content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
+      },
+      NotFound: {
+        description: "Flag not found",
+        content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
+      }
+    },
+    schemas: {
+      Error: { type: "object", required: ["error"], properties: { error: { type: "string" } } },
+      Condition: {
+        type: "object",
+        required: ["attribute", "operator", "value"],
+        properties: {
+          attribute: { type: "string", maxLength: 256 },
+          operator: {
+            type: "string",
+            enum: [
+              "eq",
+              "neq",
+              "in",
+              "notIn",
+              "contains",
+              "startsWith",
+              "endsWith",
+              "gt",
+              "gte",
+              "lt",
+              "lte",
+              "semverGte",
+              "semverLt"
+            ]
+          },
+          value: {
+            description: "A scalar, or an array of scalars for `in` / `notIn`.",
+            oneOf: [
+              { type: "string" },
+              { type: "number" },
+              { type: "boolean" },
+              { type: "array", items: { oneOf: [{ type: "string" }, { type: "number" }] } }
+            ]
+          }
+        }
+      },
+      RuleResult: {
+        type: "object",
+        required: ["enabled"],
+        properties: {
+          enabled: { type: "boolean" },
+          rollout: {
+            type: "object",
+            properties: { percentage: { type: "number", minimum: 0, maximum: 100 } }
+          }
+        }
+      },
+      TargetingRule: {
+        type: "object",
+        required: ["conditions", "result"],
+        properties: {
+          description: { type: "string" },
+          conditions: { type: "array", items: { $ref: "#/components/schemas/Condition" } },
+          result: { $ref: "#/components/schemas/RuleResult" }
+        }
+      },
+      FlagMetadata: {
+        type: "object",
+        properties: {
+          createdBy: { type: "string" },
+          createdAt: { type: "string", format: "date-time" },
+          updatedBy: { type: "string" },
+          updatedAt: { type: "string", format: "date-time" }
+        }
+      },
+      FlagInput: {
+        type: "object",
+        required: ["enabled", "rollout"],
+        properties: {
+          enabled: { type: "boolean" },
+          rollout: {
+            type: "object",
+            required: ["percentage"],
+            properties: { percentage: { type: "number", minimum: 0, maximum: 100 } }
+          },
+          rules: { type: "array", items: { $ref: "#/components/schemas/TargetingRule" } },
+          description: { type: "string" }
+        }
+      },
+      FeatureFlag: {
+        allOf: [
+          { $ref: "#/components/schemas/FlagInput" },
+          {
+            type: "object",
+            required: ["key", "metadata"],
+            properties: {
+              key: { type: "string" },
+              metadata: { $ref: "#/components/schemas/FlagMetadata" }
+            }
+          }
+        ]
+      },
+      EvaluationRequest: {
+        type: "object",
+        properties: {
+          context: {
+            type: "object",
+            description: "OpenFeature evaluation context.",
+            properties: { targetingKey: { type: "string" } },
+            additionalProperties: true
+          }
+        }
+      },
+      EvaluatedFlag: {
+        type: "object",
+        properties: {
+          key: { type: "string" },
+          value: { type: "boolean" },
+          reason: {
+            type: "string",
+            enum: ["STATIC", "TARGETING_MATCH", "SPLIT", "DEFAULT"]
+          },
+          variant: { type: "string" }
+        }
+      }
+    }
+  }
+};
+
+// src/ratelimit.ts
+function defaultRateLimitKey(headers) {
+  const cf = headers.get("cf-connecting-ip");
+  if (cf) return cf;
+  const fwd = headers.get("x-forwarded-for");
+  if (fwd) {
+    const first = fwd.split(",")[0]?.trim();
+    if (first) return first;
+  }
+  return "anonymous";
+}
+function memoryRateLimit(options = {}) {
+  const max = options.max ?? 120;
+  const windowMs = options.windowMs ?? 6e4;
+  const maxKeys = options.maxKeys ?? 1e5;
+  const hits = /* @__PURE__ */ new Map();
+  const sweep = (now) => {
+    for (const [key, entry] of hits) {
+      if (entry.resetAt <= now) hits.delete(key);
+    }
+  };
+  return {
+    key: defaultRateLimitKey,
+    check(key) {
+      const now = Date.now();
+      let entry = hits.get(key);
+      if (!entry || entry.resetAt <= now) {
+        if (!hits.has(key) && hits.size >= maxKeys) {
+          sweep(now);
+          if (hits.size >= maxKeys) return { ok: true };
+        }
+        entry = { count: 0, resetAt: now + windowMs };
+        hits.set(key, entry);
+      }
+      entry.count += 1;
+      if (entry.count > max) {
+        return { ok: false, retryAfter: Math.max(1, Math.ceil((entry.resetAt - now) / 1e3)) };
+      }
+      return { ok: true };
+    }
+  };
+}
+
+// src/webhooks.ts
+import { MEMBER_WEBHOOK_EVENTS, WEBHOOK_EVENTS } from "@flaghoist/core";
+var ALL_WEBHOOK_EVENTS = [...WEBHOOK_EVENTS, ...MEMBER_WEBHOOK_EVENTS];
+function createWebhookStore(storage) {
+  if (storage?.putWebhook && storage?.getWebhook && storage?.deleteWebhook && storage?.listWebhooks) {
+    return {
+      list: () => storage.listWebhooks(),
+      get: (id) => storage.getWebhook(id),
+      put: (id, w) => storage.putWebhook(id, w),
+      delete: (id) => storage.deleteWebhook(id)
+    };
+  }
+  const mem = /* @__PURE__ */ new Map();
+  return {
+    async list() {
+      return [...mem.values()];
+    },
+    async get(id) {
+      return mem.get(id) ?? null;
+    },
+    async put(id, w) {
+      mem.set(id, w);
+    },
+    async delete(id) {
+      mem.delete(id);
+    }
+  };
+}
+var URL_MAX = 2048;
+function validateWebhookInput(input) {
+  if (!input || typeof input !== "object") return { ok: false, error: "Expected an object" };
+  const obj = input;
+  if (typeof obj.url !== "string" || !obj.url.trim()) {
+    return { ok: false, error: "url is required" };
+  }
+  const url = obj.url.trim();
+  if (url.length > URL_MAX) return { ok: false, error: `url must be at most ${URL_MAX} characters` };
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { ok: false, error: "url is not a valid URL" };
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return { ok: false, error: "url must use http or https" };
+  }
+  let events;
+  if (obj.events !== void 0) {
+    if (!Array.isArray(obj.events)) return { ok: false, error: "events must be an array" };
+    for (const e of obj.events) {
+      if (!ALL_WEBHOOK_EVENTS.includes(e)) {
+        return { ok: false, error: `Unknown event: ${String(e)}` };
+      }
+    }
+    events = obj.events;
+  }
+  let enabled;
+  if (obj.enabled !== void 0) {
+    if (typeof obj.enabled !== "boolean") return { ok: false, error: "enabled must be a boolean" };
+    enabled = obj.enabled;
+  }
+  return { ok: true, value: { url, events, enabled } };
+}
+async function sign(secret, body) {
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(body));
+  const hex2 = [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `sha256=${hex2}`;
+}
+async function dispatchWebhooks(store, event, payload) {
+  const hooks = await store.list();
+  const active = hooks.filter((h) => h.enabled && h.events.includes(event));
+  if (active.length === 0) return;
+  const body = JSON.stringify(payload);
+  const deliveries = active.map(async (hook) => {
+    try {
+      const signature = await sign(hook.secret, body);
+      await fetch(hook.url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-Flaghoist-Event": event,
+          "X-Flaghoist-Signature": signature,
+          "X-Flaghoist-Webhook-Id": hook.id
+        },
+        body,
+        signal: AbortSignal.timeout(1e4)
+      });
+    } catch {
+    }
+  });
+  await Promise.allSettled(deliveries);
+}
+function generateId2() {
+  return crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+}
+function generateSecret() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/index.ts
+var ADMIN_TOKEN_IDENTITY = "admin token";
+var DEFAULT_CACHE_TTL_SECONDS = 30;
+var MAX_BODY_BYTES = 64 * 1024;
+async function readJsonBody(text) {
+  if (new TextEncoder().encode(text).length > MAX_BODY_BYTES) {
+    return { ok: false, status: 413, message: "Payload too large" };
+  }
+  if (!text) return { ok: true, value: {} };
+  try {
+    return { ok: true, value: JSON.parse(text) };
+  } catch {
+    return { ok: false, status: 400, message: "Invalid JSON body" };
+  }
+}
+function ttlMs(cfg) {
+  return (cfg.cacheTtlSeconds ?? DEFAULT_CACHE_TTL_SECONDS) * 1e3;
+}
+function resolveContext(body, cfg, headers) {
+  const client = body && typeof body === "object" && "context" in body && typeof body.context === "object" ? body.context : {};
+  const trusted = cfg.trustedContext?.(headers) ?? {};
+  return { ...client, ...trusted };
+}
+function createFlagServer(config) {
+  const caches = /* @__PURE__ */ new Map();
+  function cacheFor(environment) {
+    let c = caches.get(environment);
+    if (!c) {
+      c = createDefinitionCache();
+      caches.set(environment, c);
+    }
+    return c;
+  }
+  const resolve = (env) => {
+    const cfg = typeof config === "function" ? config(env) : config;
+    if (cfg.users) assertUsersConfig(cfg.users, cfg.storage);
+    return cfg;
+  };
+  const directConfig = typeof config === "function" ? null : config;
+  if (directConfig?.users) assertUsersConfig(directConfig.users, directConfig.storage);
+  const audit = createAuditLog(directConfig?.storage);
+  const webhookStore = createWebhookStore(directConfig?.storage);
+  function defaultEnvOf(cfg) {
+    return cfg.defaultEnvironment ?? "production";
+  }
+  function snapshot(flag) {
+    return { enabled: flag.enabled, rollout: flag.rollout, description: flag.description };
+  }
+  function fireWebhook(event, flagKey, actor, environment, current, previous) {
+    const payload = {
+      event,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      flag: {
+        key: flagKey,
+        enabled: current?.enabled ?? previous?.enabled ?? false,
+        rollout: current?.rollout ?? previous?.rollout ?? { percentage: 0 },
+        description: current?.description ?? previous?.description ?? ""
+      },
+      actor,
+      previous,
+      environment
+    };
+    dispatchWebhooks(webhookStore, event, payload).catch(() => {
+    });
+  }
+  function fireMemberEvent(event, actor, member, previous) {
+    const payload = {
+      event,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      actor,
+      member: {
+        ...member.id ? { id: member.id } : {},
+        email: member.email,
+        role: member.role,
+        ...member.status ? { status: member.status } : {},
+        ...member.environmentRoles && Object.keys(member.environmentRoles).length > 0 ? { environmentRoles: member.environmentRoles } : {}
+      },
+      ...previous ? { previous } : {}
+    };
+    dispatchWebhooks(webhookStore, event, payload).catch(() => {
+    });
+  }
+  function accountsOf(cfg) {
+    return cfg.users ? createAccountStore(cfg.storage, cfg.users) : null;
+  }
+  async function authenticate(c) {
+    const cfg = resolve(c.env);
+    const token = extractBearer(c.req.raw.headers);
+    const accounts = accountsOf(cfg);
+    if (accounts && token?.startsWith(SESSION_PREFIX)) {
+      const resolved = await accounts.resolveSession(token);
+      if (!resolved) {
+        return c.json(
+          { error: "Your session has ended. Sign in again.", code: "session_expired" },
+          401
+        );
+      }
+      const { user, session } = resolved;
+      const twoFactorPending = session.via !== "sso" && accounts.twoFactorRequired(user) && !user.twoFactor;
+      return {
+        cfg,
+        identity: user.email,
+        role: user.role,
+        user,
+        session,
+        pat: null,
+        token,
+        twoFactorPending
+      };
+    }
+    if (accounts && token?.startsWith(TOKEN_PREFIX)) {
+      const resolved = await accounts.resolveToken(token, async (expired) => {
+        await audit.record({
+          action: "token.expired",
+          actor: expired.name,
+          target: { type: "token", id: expired.id },
+          changeDescription: `${expired.prefix}... expired`
+        });
+      });
+      if (!resolved) {
+        return c.json(
+          {
+            error: "This access token is not valid. It may have expired or been revoked.",
+            code: "token_invalid"
+          },
+          401
+        );
+      }
+      const { user, token: pat, role: role2 } = resolved;
+      return {
+        cfg,
+        identity: user.email,
+        role: role2,
+        user,
+        session: null,
+        pat,
+        token,
+        twoFactorPending: false
+      };
+    }
+    const auth = await cfg.auth.admin(c.req.raw.headers);
+    if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
+    const role = auth.role === void 0 ? "owner" : isRole(auth.role) ? auth.role : null;
+    const adminToken = accounts !== null && auth.role === void 0 && auth.identity === "admin";
+    const identity = adminToken ? ADMIN_TOKEN_IDENTITY : auth.identity ?? "unknown";
+    return {
+      cfg,
+      identity,
+      role,
+      user: null,
+      session: null,
+      pat: null,
+      token,
+      twoFactorPending: false
+    };
+  }
+  async function authorize(c, permission) {
+    const caller = await authenticate(c);
+    if (caller instanceof Response) return caller;
+    if (caller.twoFactorPending) return twoFactorSetupFirst(c);
+    let role = caller.role;
+    if (role !== null && caller.user && isEnvironmentPermission(permission)) {
+      const env = resolveAdminEnvironment(
+        caller.cfg.environments,
+        defaultEnvOf(caller.cfg),
+        c.req.raw.headers
+      );
+      if (env.ok) role = effectiveRole(caller, env.environment);
+    }
+    if (role === null || !can(role, permission)) {
+      return c.json(
+        {
+          error: `This needs the ${minimumRole(permission)} role or higher.`,
+          code: "insufficient_role"
+        },
+        403
+      );
+    }
+    return { ...caller, role };
+  }
+  function effectiveRole(caller, environment) {
+    if (!caller.user) return caller.role;
+    const inEnvironment = roleInEnvironment(caller.user, environment);
+    return caller.pat ? lowerRole(caller.pat.role, inEnvironment) : inEnvironment;
+  }
+  const twoFactorSetupFirst = (c) => c.json(
+    {
+      error: "Your role needs two-factor sign-in. Set it up on your Account page to continue.",
+      code: "two_factor_setup_required"
+    },
+    403
+  );
+  const app = new Hono();
+  const csp = [
+    "default-src 'none'",
+    "script-src 'unsafe-inline'",
+    "style-src 'unsafe-inline'",
+    "connect-src *",
+    "img-src data:",
+    "font-src data:",
+    "frame-ancestors 'none'",
+    "base-uri 'none'",
+    "form-action 'none'"
+  ].join("; ");
+  app.use("*", async (c, next) => {
+    await next();
+    c.header("X-Content-Type-Options", "nosniff");
+    c.header("X-Frame-Options", "DENY");
+    c.header("Content-Security-Policy", csp);
+    c.header("Referrer-Policy", "no-referrer");
+    c.header("Permissions-Policy", "geolocation=(), microphone=(), camera=(), payment=(), usb=()");
+  });
+  app.use("*", async (c, next) => {
+    const cfg = resolve(c.env);
+    const origin = c.req.header("Origin");
+    if (origin && cfg.allowedOrigins?.includes(origin)) {
+      c.header("Access-Control-Allow-Origin", origin);
+      c.header("Vary", "Origin");
+    }
+    if (c.req.method === "OPTIONS") {
+      c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+      c.header(
+        "Access-Control-Allow-Headers",
+        "Content-Type, Authorization, x-api-key, If-Match, X-Flaghoist-Environment"
+      );
+      return c.body(null, 204);
+    }
+    return next();
+  });
+  app.use("*", async (c, next) => {
+    const cfg = resolve(c.env);
+    if (!cfg.rateLimit || c.req.path === "/health") return next();
+    const deriveKey = cfg.rateLimit.key ?? defaultRateLimitKey;
+    const result = await cfg.rateLimit.check(deriveKey(c.req.raw.headers));
+    if (!result.ok) {
+      if (result.retryAfter) c.header("Retry-After", String(result.retryAfter));
+      return c.json({ error: "Too many requests" }, 429);
+    }
+    return next();
+  });
+  app.get("/health", (c) => c.json({ status: "ok" }));
+  app.get("/api/v1/openapi.json", (c) => {
+    const cfg = resolve(c.env);
+    if (cfg.exposeOpenApi === false) return c.text("Not found", 404);
+    return c.json(openApiDocument);
+  });
+  const dashboardLimiter = memoryRateLimit({ max: 30, windowMs: 6e4 });
+  app.get("/admin", async (c) => {
+    const cfg = resolve(c.env);
+    if (!cfg.dashboard) return c.text("Dashboard not configured", 404);
+    const ip = defaultRateLimitKey(c.req.raw.headers);
+    const result = dashboardLimiter.check(`admin:${ip}`);
+    if (!result.ok) {
+      if (result.retryAfter) c.header("Retry-After", String(result.retryAfter));
+      return c.text("Too many requests", 429);
+    }
+    return c.html(cfg.dashboard);
+  });
+  app.get("/admin/*", async (c) => {
+    const cfg = resolve(c.env);
+    if (!cfg.dashboard) return c.text("Dashboard not configured", 404);
+    const ip = defaultRateLimitKey(c.req.raw.headers);
+    const result = dashboardLimiter.check(`admin:${ip}`);
+    if (!result.ok) {
+      if (result.retryAfter) c.header("Retry-After", String(result.retryAfter));
+      return c.text("Too many requests", 429);
+    }
+    return c.html(cfg.dashboard);
+  });
+  const wireReason = (reason) => reason === "DISABLED" ? "STATIC" : reason;
+  app.post("/ofrep/v1/evaluate/flags", async (c) => {
+    const cfg = resolve(c.env);
+    const auth = await cfg.auth.read(c.req.raw.headers);
+    if (!auth.ok) {
+      return c.json({ errorCode: "GENERAL", errorDetails: auth.message }, auth.status ?? 401);
+    }
+    const parsed = await readJsonBody(await c.req.text());
+    if (!parsed.ok) {
+      const errorCode = parsed.status === 413 ? "GENERAL" : "PARSE_ERROR";
+      return c.json({ errorCode, errorDetails: parsed.message }, parsed.status);
+    }
+    const context = resolveContext(parsed.value, cfg, c.req.raw.headers);
+    const defaultEnv = defaultEnvOf(cfg);
+    const environment = resolveReadEnvironment(cfg.environments, defaultEnv, auth.environment);
+    const scoped = scopedStorage(cfg.storage, environment, defaultEnv);
+    const flags = await cacheFor(environment).load(scoped, ttlMs(cfg));
+    const results = await Promise.all(
+      flags.map(async (flag) => {
+        const result = await evaluate(flag, context);
+        return {
+          key: flag.key,
+          value: result.value,
+          reason: wireReason(result.reason),
+          variant: result.value ? "on" : "off"
+        };
+      })
+    );
+    return c.json({ flags: results });
+  });
+  app.post("/ofrep/v1/evaluate/flags/:key", async (c) => {
+    const cfg = resolve(c.env);
+    const key = c.req.param("key");
+    const auth = await cfg.auth.read(c.req.raw.headers);
+    if (!auth.ok) {
+      return c.json({ key, errorCode: "GENERAL", errorDetails: auth.message }, auth.status ?? 401);
+    }
+    const parsed = await readJsonBody(await c.req.text());
+    if (!parsed.ok) {
+      const errorCode = parsed.status === 413 ? "GENERAL" : "PARSE_ERROR";
+      return c.json({ key, errorCode, errorDetails: parsed.message }, parsed.status);
+    }
+    const context = resolveContext(parsed.value, cfg, c.req.raw.headers);
+    const defaultEnv = defaultEnvOf(cfg);
+    const environment = resolveReadEnvironment(cfg.environments, defaultEnv, auth.environment);
+    const scoped = scopedStorage(cfg.storage, environment, defaultEnv);
+    const flags = await cacheFor(environment).load(scoped, ttlMs(cfg));
+    const flag = flags.find((f) => f.key === key);
+    if (!flag) {
+      return c.json(
+        { key, errorCode: "FLAG_NOT_FOUND", errorDetails: `Flag ${key} not found` },
+        404
+      );
+    }
+    const result = await evaluate(flag, context);
+    return c.json({
+      key,
+      value: result.value,
+      reason: wireReason(result.reason),
+      variant: result.value ? "on" : "off"
+    });
+  });
+  const registerAdmin = (prefix) => {
+    app.get(`${prefix}/flags`, async (c) => {
+      const authorized = await authorize(c, "flags:read");
+      if (authorized instanceof Response) return authorized;
+      const { cfg } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const scoped = scopedStorage(cfg.storage, envResult.environment, defaultEnv);
+      const all = await scoped.list();
+      const includeArchived = c.req.query("includeArchived") === "true";
+      return c.json({ flags: includeArchived ? all : all.filter((f) => !f.archived) });
+    });
+    app.get(`${prefix}/flags/:key`, async (c) => {
+      const authorized = await authorize(c, "flags:read");
+      if (authorized instanceof Response) return authorized;
+      const { cfg } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const scoped = scopedStorage(cfg.storage, envResult.environment, defaultEnv);
+      const flag = await scoped.get(c.req.param("key"));
+      if (!flag) return c.json({ error: "Flag not found" }, 404);
+      c.header("ETag", flagEtag(flag));
+      return c.json(flag);
+    });
+    app.put(`${prefix}/flags/:key`, async (c) => {
+      const authorized = await authorize(c, "flags:write");
+      if (authorized instanceof Response) return authorized;
+      const { cfg, identity } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const environment = envResult.environment;
+      const scoped = scopedStorage(cfg.storage, environment, defaultEnv);
+      const key = c.req.param("key");
+      const existing = await scoped.get(key);
+      const ifMatch = c.req.header("If-Match")?.trim();
+      if (ifMatch !== void 0) {
+        const precondition = ifMatch === "*" ? existing !== null : existing !== null && flagEtag(existing) === ifMatch;
+        if (!precondition) {
+          return c.json(
+            { error: "This flag changed since you loaded it. Reload and reapply your change." },
+            412
+          );
+        }
+      }
+      const parsed = await readJsonBody(await c.req.text());
+      if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
+      const changeDescription = parsed.value && typeof parsed.value === "object" && typeof parsed.value.changeDescription === "string" ? parsed.value.changeDescription.trim() || void 0 : void 0;
+      const built = buildFlag(key, parsed.value, identity, existing);
+      if (!built.ok) return c.json({ error: built.error }, 400);
+      await scoped.put(key, built.flag);
+      cacheFor(environment).invalidate();
+      const flagAction = existing ? "update" : "create";
+      const auditEnv = cfg.environments ? environment : void 0;
+      await audit.record({
+        action: flagAction,
+        flagKey: key,
+        actor: identity,
+        previous: existing ? snapshot(existing) : void 0,
+        current: snapshot(built.flag),
+        changeDescription,
+        environment: auditEnv
+      });
+      fireWebhook(
+        `flag.${flagAction === "update" ? "updated" : "created"}`,
+        key,
+        identity,
+        auditEnv,
+        snapshot(built.flag),
+        existing ? snapshot(existing) : void 0
+      );
+      c.header("ETag", flagEtag(built.flag));
+      return c.json(built.flag);
+    });
+    app.post(`${prefix}/flags/:key/archive`, async (c) => {
+      const authorized = await authorize(c, "flags:write");
+      if (authorized instanceof Response) return authorized;
+      const { cfg, identity } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const environment = envResult.environment;
+      const scoped = scopedStorage(cfg.storage, environment, defaultEnv);
+      const key = c.req.param("key");
+      const existing = await scoped.get(key);
+      if (!existing) return c.json({ error: "Flag not found" }, 404);
+      if (existing.archived) return c.json({ error: "Flag is already archived" }, 409);
+      const archived = {
+        ...existing,
+        archived: true,
+        archivedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await scoped.put(key, archived);
+      cacheFor(environment).invalidate();
+      const auditEnv = cfg.environments ? environment : void 0;
+      await audit.record({
+        action: "archive",
+        flagKey: key,
+        actor: identity,
+        previous: snapshot(existing),
+        environment: auditEnv
+      });
+      fireWebhook("flag.archived", key, identity, auditEnv, void 0, snapshot(existing));
+      return c.json(archived);
+    });
+    app.post(`${prefix}/flags/:key/restore`, async (c) => {
+      const authorized = await authorize(c, "flags:write");
+      if (authorized instanceof Response) return authorized;
+      const { cfg, identity } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const environment = envResult.environment;
+      const scoped = scopedStorage(cfg.storage, environment, defaultEnv);
+      const key = c.req.param("key");
+      const existing = await scoped.get(key);
+      if (!existing) return c.json({ error: "Flag not found" }, 404);
+      if (!existing.archived) return c.json({ error: "Flag is not archived" }, 409);
+      const { archived: _, archivedAt: __, ...rest } = existing;
+      const restored = rest;
+      await scoped.put(key, restored);
+      cacheFor(environment).invalidate();
+      const auditEnv = cfg.environments ? environment : void 0;
+      await audit.record({
+        action: "restore",
+        flagKey: key,
+        actor: identity,
+        current: snapshot(restored),
+        environment: auditEnv
+      });
+      fireWebhook("flag.restored", key, identity, auditEnv, snapshot(restored));
+      return c.json(restored);
+    });
+    app.delete(`${prefix}/flags/:key`, async (c) => {
+      const authorized = await authorize(c, "flags:delete");
+      if (authorized instanceof Response) return authorized;
+      const { cfg, identity } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const environment = envResult.environment;
+      const scoped = scopedStorage(cfg.storage, environment, defaultEnv);
+      const key = c.req.param("key");
+      const existing = await scoped.get(key);
+      await scoped.delete(key);
+      cacheFor(environment).invalidate();
+      const auditEnv = cfg.environments ? environment : void 0;
+      await audit.record({
+        action: "delete",
+        flagKey: key,
+        actor: identity,
+        previous: existing ? snapshot(existing) : void 0,
+        environment: auditEnv
+      });
+      if (existing) {
+        fireWebhook("flag.deleted", key, identity, auditEnv, void 0, snapshot(existing));
+      }
+      return c.body(null, 204);
+    });
+    app.get(`${prefix}/export`, async (c) => {
+      const authorized = await authorize(c, "flags:read");
+      if (authorized instanceof Response) return authorized;
+      const { cfg } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const scoped = scopedStorage(cfg.storage, envResult.environment, defaultEnv);
+      const all = await scoped.list();
+      const active = all.filter((f) => !f.archived);
+      const payload = {
+        version: 1,
+        exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        flags: active.map((f) => ({
+          key: f.key,
+          enabled: f.enabled,
+          rollout: f.rollout,
+          description: f.description,
+          ...f.rules && f.rules.length > 0 ? { rules: f.rules } : {}
+        }))
+      };
+      c.header("Content-Disposition", 'attachment; filename="flaghoist-export.json"');
+      return c.json(payload);
+    });
+    app.post(`${prefix}/import`, async (c) => {
+      const authorized = await authorize(c, "flags:import");
+      if (authorized instanceof Response) return authorized;
+      const { cfg, identity } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const environment = envResult.environment;
+      const scoped = scopedStorage(cfg.storage, environment, defaultEnv);
+      const parsed = await readJsonBody(await c.req.text());
+      if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
+      const body = parsed.value;
+      if (!body || typeof body !== "object" || !Array.isArray(body.flags)) {
+        return c.json({ error: "Expected { flags: [...] }" }, 400);
+      }
+      const incoming = body.flags;
+      if (incoming.length > 500) {
+        return c.json({ error: "Import limited to 500 flags" }, 400);
+      }
+      const auditEnv = cfg.environments ? environment : void 0;
+      let created = 0;
+      let updated = 0;
+      const errors = [];
+      for (const raw of incoming) {
+        const obj = raw;
+        if (!obj || typeof obj !== "object" || typeof obj.key !== "string") {
+          errors.push({ key: String(obj?.key ?? "(missing)"), error: "Missing or invalid key" });
+          continue;
+        }
+        const existing = await scoped.get(obj.key);
+        const built = buildFlag(obj.key, obj, identity, existing);
+        if (!built.ok) {
+          errors.push({ key: obj.key, error: built.error });
+          continue;
+        }
+        await scoped.put(obj.key, built.flag);
+        await audit.record({
+          action: existing ? "update" : "create",
+          flagKey: obj.key,
+          actor: identity,
+          previous: existing ? snapshot(existing) : void 0,
+          current: snapshot(built.flag),
+          changeDescription: "Bulk import",
+          environment: auditEnv
+        });
+        if (existing) updated++;
+        else created++;
+      }
+      cacheFor(environment).invalidate();
+      return c.json({ created, updated, errors });
+    });
+    app.get(`${prefix}/audit`, async (c) => {
+      const security = c.req.query("category") === "security";
+      const authorized = await authorize(c, security ? "audit:security" : "audit:read");
+      if (authorized instanceof Response) return authorized;
+      const { cfg } = authorized;
+      const defaultEnv = defaultEnvOf(cfg);
+      const envResult = resolveAdminEnvironment(cfg.environments, defaultEnv, c.req.raw.headers);
+      if (!envResult.ok) return c.json({ error: envResult.message }, envResult.status);
+      const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "50", 10) || 50, 1), 200);
+      const offset = Math.max(parseInt(c.req.query("offset") ?? "0", 10) || 0, 0);
+      const category = security ? "security" : "flags";
+      const action = c.req.query("action");
+      const validAction = action && auditCategory2(action) === category ? action : void 0;
+      if (security) {
+        const page2 = await audit.list({ limit, offset, category, action: validAction });
+        return c.json({ ...page2, entries: page2.entries.filter((e) => !e.flagKey) });
+      }
+      const flagKey = c.req.query("flagKey") || void 0;
+      const environment = cfg.environments ? envResult.environment : void 0;
+      const page = await audit.list({
+        limit,
+        offset,
+        category,
+        flagKey,
+        action: validAction,
+        environment
+      });
+      return c.json({ ...page, entries: page.entries.filter((e) => e.flagKey !== void 0) });
+    });
+    app.get(`${prefix}/environments`, async (c) => {
+      const authorized = await authorize(c, "flags:read");
+      if (authorized instanceof Response) return authorized;
+      const { cfg } = authorized;
+      const defaultEnvironment = defaultEnvOf(cfg);
+      const environments = cfg.environments && cfg.environments.length > 0 ? cfg.environments : [defaultEnvironment];
+      return c.json({ environments, default: defaultEnvironment });
+    });
+    app.get(`${prefix}/webhooks`, async (c) => {
+      const authorized = await authorize(c, "webhooks:manage");
+      if (authorized instanceof Response) return authorized;
+      return c.json({ webhooks: await webhookStore.list() });
+    });
+    app.get(`${prefix}/webhooks/:id`, async (c) => {
+      const authorized = await authorize(c, "webhooks:manage");
+      if (authorized instanceof Response) return authorized;
+      const hook = await webhookStore.get(c.req.param("id"));
+      if (!hook) return c.json({ error: "Webhook not found" }, 404);
+      return c.json(hook);
+    });
+    app.post(`${prefix}/webhooks`, async (c) => {
+      const authorized = await authorize(c, "webhooks:manage");
+      if (authorized instanceof Response) return authorized;
+      const parsed = await readJsonBody(await c.req.text());
+      if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
+      const validated = validateWebhookInput(parsed.value);
+      if (!validated.ok) return c.json({ error: validated.error }, 400);
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const hook = {
+        id: generateId2(),
+        url: validated.value.url,
+        secret: generateSecret(),
+        events: validated.value.events ?? [...WEBHOOK_EVENTS2],
+        enabled: validated.value.enabled ?? true,
+        createdAt: now,
+        updatedAt: now
+      };
+      await webhookStore.put(hook.id, hook);
+      await audit.record({
+        action: "webhook.created",
+        target: { type: "webhook", id: hook.id },
+        actor: authorized.identity,
+        changeDescription: hook.url
+      });
+      return c.json(hook, 201);
+    });
+    app.put(`${prefix}/webhooks/:id`, async (c) => {
+      const authorized = await authorize(c, "webhooks:manage");
+      if (authorized instanceof Response) return authorized;
+      const id = c.req.param("id");
+      const existing = await webhookStore.get(id);
+      if (!existing) return c.json({ error: "Webhook not found" }, 404);
+      const parsed = await readJsonBody(await c.req.text());
+      if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
+      const obj = parsed.value;
+      if (obj.url !== void 0) {
+        const v = validateWebhookInput({ url: obj.url });
+        if (!v.ok) return c.json({ error: v.error }, 400);
+        existing.url = v.value.url;
+      }
+      if (obj.events !== void 0) {
+        if (!Array.isArray(obj.events)) return c.json({ error: "events must be an array" }, 400);
+        for (const e of obj.events) {
+          if (!ALL_WEBHOOK_EVENTS.includes(e)) {
+            return c.json({ error: `Unknown event: ${String(e)}` }, 400);
+          }
+        }
+        existing.events = obj.events;
+      }
+      if (obj.enabled !== void 0) {
+        if (typeof obj.enabled !== "boolean") {
+          return c.json({ error: "enabled must be a boolean" }, 400);
+        }
+        existing.enabled = obj.enabled;
+      }
+      existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await webhookStore.put(id, existing);
+      await audit.record({
+        action: "webhook.updated",
+        target: { type: "webhook", id },
+        actor: authorized.identity,
+        changeDescription: existing.url
+      });
+      return c.json(existing);
+    });
+    app.delete(`${prefix}/webhooks/:id`, async (c) => {
+      const authorized = await authorize(c, "webhooks:manage");
+      if (authorized instanceof Response) return authorized;
+      const id = c.req.param("id");
+      const existing = await webhookStore.get(id);
+      if (!existing) return c.json({ error: "Webhook not found" }, 404);
+      await webhookStore.delete(id);
+      await audit.record({
+        action: "webhook.deleted",
+        target: { type: "webhook", id },
+        actor: authorized.identity,
+        changeDescription: existing.url
+      });
+      return c.body(null, 204);
+    });
+    app.post(`${prefix}/webhooks/:id/test`, async (c) => {
+      const authorized = await authorize(c, "webhooks:manage");
+      if (authorized instanceof Response) return authorized;
+      const { identity } = authorized;
+      const hook = await webhookStore.get(c.req.param("id"));
+      if (!hook) return c.json({ error: "Webhook not found" }, 404);
+      const payload = {
+        event: "flag.updated",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        flag: {
+          key: "test-flag",
+          enabled: true,
+          rollout: { percentage: 100 },
+          description: "Test webhook delivery"
+        },
+        actor: identity
+      };
+      try {
+        const body = JSON.stringify(payload);
+        const signature = await sign(hook.secret, body);
+        const res = await fetch(hook.url, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "X-Flaghoist-Event": "flag.updated",
+            "X-Flaghoist-Signature": signature,
+            "X-Flaghoist-Webhook-Id": hook.id
+          },
+          body,
+          signal: AbortSignal.timeout(1e4)
+        });
+        return c.json({ status: res.status, ok: res.ok });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Request failed";
+        return c.json({ status: 0, ok: false, error: message });
+      }
+    });
+  };
+  const accountsOff = (c) => c.json({ error: "Accounts are not enabled on this server.", code: "accounts_disabled" }, 404);
+  async function readBody(c) {
+    const parsed = await readJsonBody(await c.req.text());
+    if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
+    const value = parsed.value;
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return c.json({ error: "Expected a JSON object" }, 400);
+    }
+    return value;
+  }
+  function clientIp(c) {
+    return defaultRateLimitKey(c.req.raw.headers);
+  }
+  function fromIp(ip) {
+    return ip === "anonymous" ? void 0 : `From ${ip}`;
+  }
+  function throttledResponse(c, retryAfterSeconds) {
+    const minutes = Math.ceil(retryAfterSeconds / 60);
+    c.header("Retry-After", String(retryAfterSeconds));
+    return c.json(
+      {
+        error: `Too many sign-in attempts. Try again in ${minutes} minute${minutes === 1 ? "" : "s"}.`,
+        code: "login_throttled"
+      },
+      429
+    );
+  }
+  const passwordOff = (cfg) => cfg.users?.sso?.passwordSignIn === false;
+  const passwordDisabled = (c, cfg, extra = "") => c.json(
+    {
+      error: `Password sign-in is turned off. Continue with ${cfg.users?.sso?.label ?? "SSO"}${extra}.`,
+      code: "password_disabled"
+    },
+    409
+  );
+  app.get("/api/v1/auth/config", async (c) => {
+    const cfg = resolve(c.env);
+    const accounts = accountsOf(cfg);
+    if (!accounts) return c.json({ accounts: false });
+    return c.json({
+      accounts: true,
+      password: { kdf: PASSWORD_KDF, iterations: PASSWORD_ITERATIONS },
+      passwordSignIn: !passwordOff(cfg),
+      sso: cfg.users?.sso ? { label: cfg.users.sso.label ?? "SSO" } : null,
+      setupRequired: await accounts.count() === 0
+    });
+  });
+  app.post("/api/v1/auth/prelogin", async (c) => {
+    const cfg = resolve(c.env);
+    const accounts = accountsOf(cfg);
+    if (!accounts) return accountsOff(c);
+    if (passwordOff(cfg)) return passwordDisabled(c, cfg);
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const email = normalizeEmail(body.email);
+    if (!email) return c.json({ error: "Enter a valid email address." }, 400);
+    return c.json(await accounts.passwordParams(email));
+  });
+  app.post("/api/v1/auth/login", async (c) => {
+    const cfg = resolve(c.env);
+    const accounts = accountsOf(cfg);
+    if (!accounts) return accountsOff(c);
+    if (passwordOff(cfg)) return passwordDisabled(c, cfg);
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const email = normalizeEmail(body.email);
+    const clientKey = decodeClientKey(body.clientKey);
+    if (!email || !clientKey) return c.json({ error: "Enter your email and password." }, 400);
+    const ip = clientIp(c);
+    const throttle = await accounts.throttled(email, ip);
+    if (!throttle.ok) return throttledResponse(c, throttle.retryAfterSeconds);
+    const user = await accounts.findByEmail(email);
+    if (!await accounts.checkPassword(user, clientKey)) {
+      await accounts.recordFailure(email, ip);
+      await audit.record({
+        action: "login.failed",
+        actor: email,
+        ...user ? { target: { type: "user", id: user.id } } : {},
+        changeDescription: user?.status === "disabled" ? "Account is disabled" : fromIp(ip)
+      });
+      return c.json({ error: "Invalid email or password.", code: "invalid_credentials" }, 401);
+    }
+    const signedIn = user;
+    if (signedIn.twoFactor) {
+      return c.json({
+        twoFactorRequired: true,
+        challenge: await twoFactorChallenge(cfg, signedIn)
+      });
+    }
+    await accounts.clearFailures(email);
+    await accounts.recordLogin(signedIn);
+    const { token, session } = await accounts.createSession(signedIn, c.req.header("user-agent"));
+    await audit.record({
+      action: "login",
+      actor: signedIn.email,
+      target: { type: "user", id: signedIn.id },
+      changeDescription: fromIp(ip)
+    });
+    return c.json({ token, expiresAt: session.expiresAt, user: publicUser(signedIn) });
+  });
+  function twoFactorChallenge(cfg, user) {
+    return seal(cfg.users.pepper, "two-factor-challenge", {
+      exp: Date.now() + 5 * 6e4,
+      userId: user.id
+    });
+  }
+  app.post("/api/v1/auth/login/two-factor", async (c) => {
+    const cfg = resolve(c.env);
+    const accounts = accountsOf(cfg);
+    if (!cfg.users || !accounts) return accountsOff(c);
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const challenge = typeof body.challenge === "string" ? body.challenge : "";
+    const code = typeof body.code === "string" ? body.code : "";
+    const opened = challenge ? await unseal(
+      cfg.users.pepper,
+      "two-factor-challenge",
+      challenge
+    ) : null;
+    const user = opened ? await accounts.getUser(opened.userId) : null;
+    if (!user || user.status !== "active" || !user.twoFactor) {
+      return c.json(
+        {
+          error: "This sign-in has expired. Enter your password again.",
+          code: "challenge_expired"
+        },
+        401
+      );
+    }
+    const ip = clientIp(c);
+    const throttle = await accounts.throttled(user.email, ip);
+    if (!throttle.ok) return throttledResponse(c, throttle.retryAfterSeconds);
+    const used = await accounts.checkSecondFactor(user, code);
+    if (!used) {
+      await accounts.recordFailure(user.email, ip);
+      await audit.record({
+        action: "login.failed",
+        actor: user.email,
+        target: { type: "user", id: user.id },
+        changeDescription: ["Wrong two-factor code", fromIp(ip)].filter(Boolean).join(". ")
+      });
+      return c.json(
+        {
+          error: "That code is not right. Enter the current one from your app.",
+          code: "invalid_code"
+        },
+        401
+      );
+    }
+    const fresh = await accounts.getUser(user.id) ?? user;
+    await accounts.clearFailures(user.email);
+    await accounts.recordLogin(fresh);
+    const { token, session } = await accounts.createSession(fresh, c.req.header("user-agent"));
+    await audit.record({
+      action: "login",
+      actor: user.email,
+      target: { type: "user", id: user.id },
+      changeDescription: ["With two-factor", fromIp(ip)].filter(Boolean).join(". ")
+    });
+    if (used === "recovery") {
+      const left = fresh.twoFactor?.recoveryCodes.length ?? 0;
+      await audit.record({
+        action: "two_factor.recovery_used",
+        actor: user.email,
+        target: { type: "user", id: user.id },
+        changeDescription: `${left} recovery code${left === 1 ? "" : "s"} left`
+      });
+    }
+    return c.json({ token, expiresAt: session.expiresAt, user: publicUser(fresh) });
+  });
+  app.post("/api/v1/auth/logout", async (c) => {
+    const caller = await authenticate(c);
+    if (caller instanceof Response) return caller;
+    const accounts = accountsOf(caller.cfg);
+    if (accounts && caller.session && caller.token) {
+      await accounts.endSession(caller.token);
+      await audit.record({
+        action: "logout",
+        actor: caller.identity,
+        target: { type: "session", id: caller.session.id }
+      });
+    }
+    if (accounts && caller.pat && caller.token) {
+      await accounts.revokePresentedToken(caller.token);
+      await audit.record({
+        action: "token.revoked",
+        actor: caller.identity,
+        target: { type: "token", id: caller.pat.id },
+        changeDescription: `${caller.pat.name} (signed out)`
+      });
+    }
+    return c.body(null, 204);
+  });
+  app.get("/api/v1/auth/me", async (c) => {
+    const caller = await authenticate(c);
+    if (caller instanceof Response) return caller;
+    return c.json({
+      identity: caller.identity,
+      role: caller.role,
+      accounts: caller.cfg.users !== void 0,
+      passwordSignIn: caller.cfg.users !== void 0 && !passwordOff(caller.cfg),
+      user: caller.user ? publicUser(caller.user) : null,
+      session: caller.session ? {
+        id: caller.session.id,
+        createdAt: caller.session.createdAt,
+        expiresAt: caller.session.expiresAt
+      } : null,
+      token: caller.pat ? publicToken(caller.pat) : null,
+      // The role this credential has in each environment, for a dashboard that follows it.
+      environmentRoles: caller.user && caller.cfg.environments && caller.cfg.environments.length > 0 ? Object.fromEntries(
+        caller.cfg.environments.map((env) => [env, effectiveRole(caller, env)])
+      ) : null,
+      twoFactor: caller.user ? {
+        enabled: caller.user.twoFactor !== void 0,
+        required: accountsOf(caller.cfg)?.twoFactorRequired(caller.user) ?? false,
+        setupRequired: caller.twoFactorPending
+      } : null
+    });
+  });
+  app.post("/api/v1/auth/setup", async (c) => {
+    const caller = await authenticate(c);
+    if (caller instanceof Response) return caller;
+    const accounts = accountsOf(caller.cfg);
+    if (!accounts) return accountsOff(c);
+    if (caller.role !== "owner" || caller.user) {
+      return c.json(
+        { error: "Only the admin token can create the first account.", code: "insufficient_role" },
+        403
+      );
+    }
+    if (await accounts.count() > 0) {
+      return c.json(
+        { error: "An account already exists. Sign in with it instead.", code: "setup_complete" },
+        409
+      );
+    }
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const email = normalizeEmail(body.email);
+    const salt = decodeSalt(body.salt);
+    const clientKey = decodeClientKey(body.clientKey);
+    if (!email) return c.json({ error: "Enter a valid email address." }, 400);
+    if (!salt || !clientKey) return c.json({ error: "Missing or malformed password key." }, 400);
+    const user = await accounts.createUser({
+      email,
+      name: normalizeName(body.name),
+      role: "owner",
+      salt,
+      clientKey
+    });
+    if (!user) return c.json({ error: "That email already has an account." }, 409);
+    await audit.record({
+      action: "user.created",
+      actor: caller.identity,
+      target: { type: "user", id: user.id },
+      changeDescription: `${user.email} as owner`
+    });
+    fireMemberEvent("member.joined", caller.identity, user);
+    return c.json({ user: publicUser(user) }, 201);
+  });
+  async function signedInUser(c) {
+    const caller = await authenticate(c);
+    if (caller instanceof Response) return caller;
+    const accounts = accountsOf(caller.cfg);
+    if (!accounts) return accountsOff(c);
+    if (!caller.user || !caller.session) {
+      return c.json(
+        { error: "Sign in with an account to manage it.", code: "account_required" },
+        400
+      );
+    }
+    return { ...caller, user: caller.user, session: caller.session, accounts };
+  }
+  app.put("/api/v1/me/password", async (c) => {
+    const caller = await signedInUser(c);
+    if (caller instanceof Response) return caller;
+    const { accounts, user, session } = caller;
+    if (passwordOff(caller.cfg)) return passwordDisabled(c, caller.cfg);
+    if (!user.password) {
+      return c.json(
+        { error: "This account signs in with SSO and has no password.", code: "no_password" },
+        409
+      );
+    }
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const currentKey = decodeClientKey(body.currentClientKey);
+    const salt = decodeSalt(body.salt);
+    const clientKey = decodeClientKey(body.clientKey);
+    if (!currentKey || !salt || !clientKey) {
+      return c.json({ error: "Missing or malformed password key." }, 400);
+    }
+    const ip = clientIp(c);
+    const throttle = await accounts.throttled(user.email, ip);
+    if (!throttle.ok) return throttledResponse(c, throttle.retryAfterSeconds);
+    if (!await accounts.checkPassword(user, currentKey)) {
+      await accounts.recordFailure(user.email, ip);
+      return c.json({ error: "Your current password is incorrect.", code: "invalid_password" }, 400);
+    }
+    await accounts.setPassword(user, salt, clientKey);
+    const others = (await accounts.sessionsFor(user.id)).filter((s) => s.session.id !== session.id);
+    await Promise.all(others.map((s) => accounts.deleteSessionKey(s.key)));
+    await audit.record({
+      action: "password.changed",
+      actor: user.email,
+      target: { type: "user", id: user.id },
+      changeDescription: others.length > 0 ? `Signed out ${others.length} other session${others.length === 1 ? "" : "s"}` : void 0
+    });
+    return c.json({ revokedSessions: others.length });
+  });
+  app.get("/api/v1/me/sessions", async (c) => {
+    const caller = await signedInUser(c);
+    if (caller instanceof Response) return caller;
+    const sessions = (await caller.accounts.sessionsFor(caller.user.id)).map((s) => publicSession(s.session, caller.session.id)).sort((a, b) => b.lastSeenAt.localeCompare(a.lastSeenAt));
+    return c.json({ sessions });
+  });
+  app.delete("/api/v1/me/sessions", async (c) => {
+    const caller = await signedInUser(c);
+    if (caller instanceof Response) return caller;
+    const others = (await caller.accounts.sessionsFor(caller.user.id)).filter(
+      (s) => s.session.id !== caller.session.id
+    );
+    await Promise.all(others.map((s) => caller.accounts.deleteSessionKey(s.key)));
+    if (others.length > 0) {
+      await audit.record({
+        action: "session.revoked",
+        actor: caller.user.email,
+        target: { type: "user", id: caller.user.id },
+        changeDescription: `Signed out ${others.length} other session${others.length === 1 ? "" : "s"}`
+      });
+    }
+    return c.json({ revoked: others.length });
+  });
+  app.delete("/api/v1/me/sessions/:id", async (c) => {
+    const caller = await signedInUser(c);
+    if (caller instanceof Response) return caller;
+    const id = c.req.param("id");
+    const match = (await caller.accounts.sessionsFor(caller.user.id)).find(
+      (s) => s.session.id === id
+    );
+    if (!match) return c.json({ error: "Session not found" }, 404);
+    await caller.accounts.deleteSessionKey(match.key);
+    await audit.record({
+      action: "session.revoked",
+      actor: caller.user.email,
+      target: { type: "session", id }
+    });
+    return c.body(null, 204);
+  });
+  const ssoOff = (c) => c.json({ error: "SSO is not set up on this server.", code: "sso_disabled" }, 404);
+  function allowedReturn(cfg, requestUrl, value) {
+    if (!value) return null;
+    try {
+      const url = new URL(value);
+      if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+      const own = new URL(requestUrl).origin;
+      if (url.origin !== own && !cfg.allowedOrigins?.includes(url.origin)) return null;
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return null;
+    }
+  }
+  app.get("/api/v1/auth/sso/start", async (c) => {
+    const cfg = resolve(c.env);
+    const sso = cfg.users?.sso;
+    if (!cfg.users || !sso) return ssoOff(c);
+    const returnTo = allowedReturn(cfg, c.req.url, c.req.query("return"));
+    if (!returnTo) {
+      return c.text("The return address is not allowed. Add its origin to allowedOrigins.", 400);
+    }
+    const browserHash = c.req.query("browser") ?? "";
+    if (!/^[A-Za-z0-9_-]{43}$/.test(browserHash)) return c.text("Missing browser check.", 400);
+    const redirectUri = sso.redirectUri ?? `${new URL(c.req.url).origin}${SSO_CALLBACK_PATH}`;
+    try {
+      const url = await buildAuthorizationUrl({
+        sso,
+        pepper: cfg.users.pepper,
+        redirectUri,
+        returnTo,
+        browserHash
       });
-      payload = verified.payload;
-    } catch {
-      return { ok: false, status: 401, message: "Invalid token" };
+      return c.redirect(url, 302);
+    } catch (err) {
+      const message = err instanceof SsoError ? err.message : "Could not reach the SSO provider.";
+      if (!(err instanceof SsoError)) console.error("[flaghoist] SSO start failed", err);
+      return c.redirect(`${returnTo}#sso_error=${encodeURIComponent(message)}`, 302);
     }
-    if (options.tokenUse && payload["token_use"] !== options.tokenUse) {
-      return { ok: false, status: 401, message: "Invalid token" };
+  });
+  app.get(SSO_CALLBACK_PATH, async (c) => {
+    const cfg = resolve(c.env);
+    const sso = cfg.users?.sso;
+    const accounts = accountsOf(cfg);
+    if (!cfg.users || !sso || !accounts) return ssoOff(c);
+    const state = await readState(cfg.users.pepper, c.req.query("state") ?? "");
+    if (!state) {
+      return c.text(
+        "This sign-in has expired or did not start here. Go back to the dashboard and try again.",
+        400
+      );
     }
-    if (options.allowedGroups && options.allowedGroups.length > 0) {
-      const groups = extractGroups(payload, options.groupsClaim ?? "groups");
-      const allowed = options.allowedGroups;
-      if (!groups.some((group) => allowed.includes(group))) {
-        return { ok: false, status: 403, message: "Admin group required" };
+    const back = (message) => c.redirect(`${state.returnTo}#sso_error=${encodeURIComponent(message)}`, 302);
+    const ip = clientIp(c);
+    const refuse = async (email2, reason, message) => {
+      await audit.record({
+        action: "login.failed",
+        actor: email2,
+        changeDescription: [`SSO: ${reason}`, fromIp(ip)].filter(Boolean).join(". ")
+      });
+      return back(message);
+    };
+    const providerError = c.req.query("error");
+    if (providerError) {
+      return back(
+        c.req.query("error_description") ?? `The provider refused the sign-in (${providerError}).`
+      );
+    }
+    const code = c.req.query("code");
+    if (!code) return back("The provider did not send a sign-in code.");
+    let identity;
+    try {
+      identity = await completeSignIn({ sso, state, code });
+    } catch (err) {
+      if (!(err instanceof SsoError)) console.error("[flaghoist] SSO callback failed", err);
+      return back(err instanceof SsoError ? err.message : "The sign-in could not be completed.");
+    }
+    const { email } = identity;
+    if (!domainAllowed(sso, email)) {
+      return refuse(email, "domain not allowed", `${email} is not allowed to sign in here.`);
+    }
+    const mapped = sso.roleMapping !== void 0 && Object.keys(sso.roleMapping).length > 0;
+    const groupRole = roleFor(sso, identity.groups);
+    const noAccess = "You are not in a group that has access to Flaghoist. Ask an admin.";
+    let user = await accounts.findBySso(sso.issuer, identity.subject);
+    if (!user) {
+      if (!identity.emailVerified && sso.requireVerifiedEmail !== false) {
+        return refuse(
+          email,
+          "email not verified",
+          "Your provider has not verified your email address."
+        );
+      }
+      const existing = await accounts.findByEmail(email);
+      if (existing) {
+        user = await accounts.linkSso(existing, sso.issuer, identity.subject);
+        await audit.record({
+          action: "user.updated",
+          actor: email,
+          target: { type: "user", id: user.id },
+          changeDescription: `${email}: linked to SSO`
+        });
+      } else {
+        const invite = (await accounts.listInvites()).find(
+          (i) => i.kind === "invite" && i.email === email
+        );
+        const role = mapped ? groupRole : invite?.role ?? sso.defaultRole ?? null;
+        if (!role) return refuse(email, "no mapped group", noAccess);
+        const created = await accounts.createSsoUser({
+          email,
+          name: identity.name,
+          role,
+          issuer: sso.issuer,
+          subject: identity.subject,
+          managed: mapped
+        });
+        if (!created) return back("That email already has an account.");
+        user = created;
+        if (invite) {
+          await accounts.revokeInvite(invite.id);
+          await audit.record({
+            action: "invite.accepted",
+            actor: email,
+            target: { type: "user", id: user.id },
+            changeDescription: `Joined as ${user.role} with SSO`
+          });
+          fireMemberEvent("member.joined", email, user);
+        } else {
+          await audit.record({
+            action: "user.created",
+            actor: email,
+            target: { type: "user", id: user.id },
+            changeDescription: `${email} as ${user.role}, with SSO`
+          });
+          fireMemberEvent("member.joined", email, user);
+        }
       }
     }
-    const email = typeof payload["email"] === "string" ? payload["email"] : void 0;
-    const sub = typeof payload.sub === "string" ? payload.sub : void 0;
-    return { ok: true, identity: email ?? sub ?? "unknown" };
-  };
-}
-
-// src/index.ts
-var DEFAULT_CACHE_TTL_SECONDS = 30;
-var MAX_BODY_BYTES = 64 * 1024;
-async function readJsonBody(text) {
-  if (new TextEncoder().encode(text).length > MAX_BODY_BYTES) {
-    return { ok: false, status: 413, message: "Payload too large" };
-  }
-  if (!text) return { ok: true, value: {} };
-  try {
-    return { ok: true, value: JSON.parse(text) };
-  } catch {
-    return { ok: false, status: 400, message: "Invalid JSON body" };
-  }
-}
-function ttlMs(cfg) {
-  return (cfg.cacheTtlSeconds ?? DEFAULT_CACHE_TTL_SECONDS) * 1e3;
-}
-function resolveContext(body, cfg, headers) {
-  const client = body && typeof body === "object" && "context" in body && typeof body.context === "object" ? body.context : {};
-  const trusted = cfg.trustedContext?.(headers) ?? {};
-  return { ...client, ...trusted };
-}
-function createFlagServer(config) {
-  const cache = createDefinitionCache();
-  const resolve = (env) => typeof config === "function" ? config(env) : config;
-  const app = new Hono();
-  app.use("*", async (c, next) => {
-    await next();
-    c.header("X-Content-Type-Options", "nosniff");
-    c.header("X-Frame-Options", "DENY");
-    c.header("Content-Security-Policy", "frame-ancestors 'none'");
-    c.header("Referrer-Policy", "no-referrer");
-    c.header("Permissions-Policy", "geolocation=(), microphone=(), camera=(), payment=(), usb=()");
+    if (user.status !== "active") {
+      return refuse(email, "account disabled", "This account is disabled. Ask an admin.");
+    }
+    if (mapped) {
+      if (!groupRole) return refuse(email, "no mapped group", noAccess);
+      if (user.role !== groupRole || user.roleManagedBy !== "sso") {
+        const before = user.role;
+        user = await accounts.saveUser({ ...user, role: groupRole, roleManagedBy: "sso" });
+        if (before !== groupRole) {
+          await audit.record({
+            action: "user.updated",
+            actor: "SSO groups",
+            target: { type: "user", id: user.id },
+            changeDescription: `${email}: role ${before} to ${groupRole}`
+          });
+          fireMemberEvent("member.role_changed", "SSO groups", user, { role: before });
+        }
+      }
+    }
+    await accounts.recordLogin(user);
+    await audit.record({
+      action: "login",
+      actor: email,
+      target: { type: "user", id: user.id },
+      changeDescription: ["With SSO", fromIp(ip)].filter(Boolean).join(". ")
+    });
+    const handBack = await exchangeCode(cfg.users.pepper, user.id, state.browser);
+    return c.redirect(`${state.returnTo}#sso=${encodeURIComponent(handBack)}`, 302);
   });
-  app.use("*", async (c, next) => {
+  app.post("/api/v1/auth/sso/exchange", async (c) => {
     const cfg = resolve(c.env);
-    const origin = c.req.header("Origin");
-    if (origin && cfg.allowedOrigins?.includes(origin)) {
-      c.header("Access-Control-Allow-Origin", origin);
-      c.header("Vary", "Origin");
+    const accounts = accountsOf(cfg);
+    if (!cfg.users?.sso || !accounts) return ssoOff(c);
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const code = typeof body.code === "string" ? body.code : "";
+    const secret = typeof body.browserSecret === "string" ? body.browserSecret : "";
+    const userId = code && secret ? await redeemExchangeCode(cfg.users.pepper, code, secret) : null;
+    const user = userId ? await accounts.getUser(userId) : null;
+    if (!user || user.status !== "active") {
+      return c.json({ error: "This sign-in has expired. Try again.", code: "sso_expired" }, 410);
     }
-    if (c.req.method === "OPTIONS") {
-      c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
-      c.header("Access-Control-Allow-Headers", "Content-Type, Authorization, x-api-key");
-      return c.body(null, 204);
+    const { token, session } = await accounts.createSession(user, c.req.header("user-agent"), "sso");
+    return c.json({ token, expiresAt: session.expiresAt, user: publicUser(user) });
+  });
+  async function tokenOwner(c) {
+    const caller = await authenticate(c);
+    if (caller instanceof Response) return caller;
+    const accounts = accountsOf(caller.cfg);
+    if (!accounts) return accountsOff(c);
+    if (!caller.user || caller.role === null) {
+      return c.json(
+        { error: "Sign in with an account to manage its access tokens.", code: "account_required" },
+        400
+      );
     }
-    return next();
+    if (caller.twoFactorPending) return twoFactorSetupFirst(c);
+    return { ...caller, user: caller.user, accounts };
+  }
+  app.get("/api/v1/tokens", async (c) => {
+    const caller = await tokenOwner(c);
+    if (caller instanceof Response) return caller;
+    const tokens = await caller.accounts.listTokens(caller.user.id);
+    return c.json({ tokens: tokens.map(publicToken) });
   });
-  app.use("*", async (c, next) => {
-    const cfg = resolve(c.env);
-    if (!cfg.rateLimit || c.req.path === "/health") return next();
-    const deriveKey = cfg.rateLimit.key ?? defaultRateLimitKey;
-    const result = await cfg.rateLimit.check(deriveKey(c.req.raw.headers));
-    if (!result.ok) {
-      if (result.retryAfter) c.header("Retry-After", String(result.retryAfter));
-      return c.json({ error: "Too many requests" }, 429);
+  app.post("/api/v1/tokens", async (c) => {
+    const caller = await tokenOwner(c);
+    if (caller instanceof Response) return caller;
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const name = normalizeName(body.name);
+    if (!name) return c.json({ error: "Give the token a name." }, 400);
+    const role = body.role ?? caller.role;
+    if (!isRole(role)) return c.json({ error: `role must be one of ${ROLES.join(", ")}` }, 400);
+    if (ROLES.indexOf(role) > ROLES.indexOf(caller.role)) {
+      return c.json(
+        {
+          error: `A token cannot have a higher role than yours (${caller.role}).`,
+          code: "insufficient_role"
+        },
+        403
+      );
     }
-    return next();
+    const days = body.expiresInDays === void 0 ? DEFAULT_TOKEN_DAYS : body.expiresInDays;
+    const validDays = days === null || typeof days === "number" && Number.isInteger(days) && days >= 1 && days <= MAX_TOKEN_DAYS;
+    if (!validDays) {
+      return c.json(
+        { error: `expiresInDays must be a whole number from 1 to ${MAX_TOKEN_DAYS}, or null.` },
+        400
+      );
+    }
+    const { token, record } = await caller.accounts.createToken(caller.user, {
+      name,
+      role,
+      expiresInDays: days
+    });
+    await audit.record({
+      action: "token.created",
+      actor: caller.identity,
+      target: { type: "token", id: record.id },
+      changeDescription: `${record.name} as ${record.role}, ${record.expiresAt ? `expires ${record.expiresAt.slice(0, 10)}` : "never expires"}`
+    });
+    return c.json({ token, info: publicToken(record) }, 201);
   });
-  app.get("/health", (c) => c.json({ status: "ok" }));
-  app.get("/api/v1/openapi.json", (c) => {
-    const cfg = resolve(c.env);
-    if (cfg.exposeOpenApi === false) return c.text("Not found", 404);
-    return c.json(openApiDocument);
+  app.delete("/api/v1/tokens/:id", async (c) => {
+    const caller = await tokenOwner(c);
+    if (caller instanceof Response) return caller;
+    const revoked = await caller.accounts.revokeToken(caller.user.id, c.req.param("id"));
+    if (!revoked) return c.json({ error: "Token not found" }, 404);
+    await audit.record({
+      action: "token.revoked",
+      actor: caller.identity,
+      target: { type: "token", id: revoked.id },
+      changeDescription: revoked.name
+    });
+    return c.body(null, 204);
   });
-  app.get("/admin", (c) => {
-    const cfg = resolve(c.env);
-    return cfg.dashboard ? c.html(cfg.dashboard) : c.text("Dashboard not configured", 404);
+  const invalidCode = (c) => c.json(
+    {
+      error: "That code is not right. Enter the current one from your app.",
+      code: "invalid_code"
+    },
+    400
+  );
+  app.post("/api/v1/me/two-factor/setup", async (c) => {
+    const caller = await signedInUser(c);
+    if (caller instanceof Response) return caller;
+    const { accounts, user } = caller;
+    if (user.twoFactor) {
+      return c.json({ error: "Two-factor sign-in is already on.", code: "already_enabled" }, 409);
+    }
+    if (!user.password) {
+      return c.json(
+        {
+          error: "This account signs in with SSO. Your identity provider's two-factor covers it.",
+          code: "no_password"
+        },
+        409
+      );
+    }
+    const secret = await accounts.beginTwoFactor(user);
+    return c.json({ secret, uri: otpauthUri(secret, user.email) });
   });
-  app.get("/admin/*", (c) => {
-    const cfg = resolve(c.env);
-    return cfg.dashboard ? c.html(cfg.dashboard) : c.text("Dashboard not configured", 404);
+  app.post("/api/v1/me/two-factor/confirm", async (c) => {
+    const caller = await signedInUser(c);
+    if (caller instanceof Response) return caller;
+    const { accounts, user } = caller;
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    if (!user.pendingTwoFactor) {
+      return c.json({ error: "Start the setup first.", code: "not_started" }, 409);
+    }
+    const codes = await accounts.confirmTwoFactor(user, String(body.code ?? ""));
+    if (!codes) return invalidCode(c);
+    await audit.record({
+      action: "two_factor.enabled",
+      actor: user.email,
+      target: { type: "user", id: user.id }
+    });
+    return c.json({ recoveryCodes: codes });
   });
-  const wireReason = (reason) => reason === "DISABLED" ? "STATIC" : reason;
-  app.post("/ofrep/v1/evaluate/flags", async (c) => {
-    const cfg = resolve(c.env);
-    const auth = await cfg.auth.read(c.req.raw.headers);
-    if (!auth.ok) {
-      return c.json({ errorCode: "GENERAL", errorDetails: auth.message }, auth.status ?? 401);
+  app.post("/api/v1/me/two-factor/recovery-codes", async (c) => {
+    const caller = await signedInUser(c);
+    if (caller instanceof Response) return caller;
+    const { accounts, user } = caller;
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    if (!user.twoFactor)
+      return c.json({ error: "Two-factor sign-in is off.", code: "not_enabled" }, 409);
+    if (!await accounts.checkSecondFactor(user, String(body.code ?? ""))) return invalidCode(c);
+    const codes = await accounts.newRecoveryCodes(await accounts.getUser(user.id) ?? user);
+    return c.json({ recoveryCodes: codes });
+  });
+  app.delete("/api/v1/me/two-factor", async (c) => {
+    const caller = await signedInUser(c);
+    if (caller instanceof Response) return caller;
+    const { accounts, user } = caller;
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    if (!user.twoFactor)
+      return c.json({ error: "Two-factor sign-in is off.", code: "not_enabled" }, 409);
+    if (accounts.twoFactorRequired(user)) {
+      return c.json(
+        {
+          error: "Your role needs two-factor sign-in, so it cannot be turned off.",
+          code: "required"
+        },
+        409
+      );
     }
-    const parsed = await readJsonBody(await c.req.text());
-    if (!parsed.ok) {
-      const errorCode = parsed.status === 413 ? "GENERAL" : "PARSE_ERROR";
-      return c.json({ errorCode, errorDetails: parsed.message }, parsed.status);
+    if (!await accounts.checkSecondFactor(user, String(body.code ?? ""))) return invalidCode(c);
+    await accounts.removeTwoFactor(await accounts.getUser(user.id) ?? user);
+    await audit.record({
+      action: "two_factor.disabled",
+      actor: user.email,
+      target: { type: "user", id: user.id }
+    });
+    return c.body(null, 204);
+  });
+  async function memberAdmin(c) {
+    const authorized = await authorize(c, "members:manage");
+    if (authorized instanceof Response) return authorized;
+    const accounts = accountsOf(authorized.cfg);
+    if (!accounts) return accountsOff(c);
+    return { ...authorized, accounts };
+  }
+  const ownersOnly = (c) => c.json({ error: "Only an owner can manage owners.", code: "insufficient_role" }, 403);
+  async function isLastOwner(accounts, user) {
+    if (user.role !== "owner" || user.status !== "active") return false;
+    const owners = (await accounts.listUsers()).filter(
+      (u) => u.role === "owner" && u.status === "active"
+    );
+    return owners.length <= 1;
+  }
+  const lastOwner = (c) => c.json(
+    {
+      error: "This is the only owner. Make someone else an owner first.",
+      code: "last_owner"
+    },
+    409
+  );
+  const notYourself = (c, what) => c.json({ error: `You cannot ${what} yourself.`, code: "self_change" }, 409);
+  async function deliverLink(c, cfg, token, invite, requested) {
+    const sender = cfg.users?.email;
+    let emailed = false;
+    if (sender) {
+      const base = allowedReturn(cfg, c.req.url, typeof requested === "string" ? requested : void 0) ?? `${new URL(c.req.url).origin}/admin/`;
+      const ssoOnly = passwordOff(cfg) ? cfg.users?.sso?.label ?? "SSO" : void 0;
+      const plainBase = base.replace(/#.*$/, "");
+      const link = invite.kind === "invite" && ssoOnly ? plainBase : `${plainBase}#accept=${encodeURIComponent(token)}`;
+      const message = invite.kind === "invite" ? inviteEmail({
+        to: invite.email,
+        role: invite.role,
+        invitedBy: invite.invitedBy === ADMIN_TOKEN_IDENTITY ? void 0 : invite.invitedBy,
+        link,
+        expiresAt: invite.expiresAt,
+        ssoLabel: ssoOnly
+      }) : resetEmail({ to: invite.email, link, expiresAt: invite.expiresAt });
+      try {
+        await sender.send(message);
+        emailed = true;
+      } catch (err) {
+        console.error("[flaghoist] sending the email failed; the link was still returned", err);
+      }
     }
-    const context = resolveContext(parsed.value, cfg, c.req.raw.headers);
-    const flags = await cache.load(cfg.storage, ttlMs(cfg));
-    const results = await Promise.all(
-      flags.map(async (flag) => {
-        const result = await evaluate(flag, context);
-        return {
-          key: flag.key,
-          value: result.value,
-          reason: wireReason(result.reason),
-          variant: result.value ? "on" : "off"
-        };
+    return { token, invite: publicInvite(invite), emailed };
+  }
+  app.get("/api/v1/users", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const [users, lastActive] = await Promise.all([
+      caller.accounts.listUsers(),
+      caller.accounts.lastActive()
+    ]);
+    return c.json({
+      users: users.map((u) => {
+        const seen = lastActive.get(u.id);
+        return { ...publicUser(u), ...seen ? { lastActiveAt: seen } : {} };
       })
-    );
-    return c.json({ flags: results });
+    });
   });
-  app.post("/ofrep/v1/evaluate/flags/:key", async (c) => {
-    const cfg = resolve(c.env);
-    const key = c.req.param("key");
-    const auth = await cfg.auth.read(c.req.raw.headers);
-    if (!auth.ok) {
-      return c.json({ key, errorCode: "GENERAL", errorDetails: auth.message }, auth.status ?? 401);
+  app.put("/api/v1/users/:id", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const { accounts } = caller;
+    const user = await accounts.getUser(c.req.param("id"));
+    if (!user) return c.json({ error: "Member not found" }, 404);
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    if (body.role !== void 0 && !isRole(body.role)) {
+      return c.json({ error: `role must be one of ${ROLES.join(", ")}` }, 400);
     }
-    const parsed = await readJsonBody(await c.req.text());
-    if (!parsed.ok) {
-      const errorCode = parsed.status === 413 ? "GENERAL" : "PARSE_ERROR";
-      return c.json({ key, errorCode, errorDetails: parsed.message }, parsed.status);
+    if (body.status !== void 0 && body.status !== "active" && body.status !== "disabled") {
+      return c.json({ error: "status must be active or disabled" }, 400);
     }
-    const context = resolveContext(parsed.value, cfg, c.req.raw.headers);
-    const flags = await cache.load(cfg.storage, ttlMs(cfg));
-    const flag = flags.find((f) => f.key === key);
-    if (!flag) {
+    const role = body.role ?? user.role;
+    const status = body.status ?? user.status;
+    const name = body.name !== void 0 ? normalizeName(body.name) : user.name;
+    const roleChanged = role !== user.role;
+    const statusChanged = status !== user.status;
+    let environmentRoles = user.environmentRoles ?? {};
+    if (body.environmentRoles !== void 0) {
+      const envs = caller.cfg.environments ?? [];
+      const value = body.environmentRoles;
+      if (envs.length === 0) {
+        return c.json({ error: "This server has no environments configured." }, 400);
+      }
+      if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return c.json({ error: "environmentRoles must be an object of environment to role." }, 400);
+      }
+      const next = {};
+      for (const [env, r] of Object.entries(value)) {
+        if (!envs.includes(env)) {
+          return c.json({ error: `Unknown environment "${env}".` }, 400);
+        }
+        if (r === null) continue;
+        if (!isRole(r) || r === "owner") {
+          return c.json({ error: "An environment role must be viewer, editor or admin." }, 400);
+        }
+        next[env] = r;
+      }
+      environmentRoles = next;
+    }
+    if (role === "owner") {
+      if (body.environmentRoles !== void 0 && Object.keys(environmentRoles).length > 0) {
+        return c.json({ error: "Owners have full access in every environment." }, 400);
+      }
+      environmentRoles = {};
+    }
+    const envChanges = [
+      .../* @__PURE__ */ new Set([...Object.keys(user.environmentRoles ?? {}), ...Object.keys(environmentRoles)])
+    ].sort().filter((env) => user.environmentRoles?.[env] !== environmentRoles[env]).map((env) => `${env}: ${environmentRoles[env] ?? "main role"}`);
+    const envRolesChanged = envChanges.length > 0 && role !== "owner";
+    if (roleChanged && user.roleManagedBy === "sso" && caller.cfg.users?.sso?.roleMapping) {
       return c.json(
-        { key, errorCode: "FLAG_NOT_FOUND", errorDetails: `Flag ${key} not found` },
-        404
+        {
+          error: `${user.email} gets their role from SSO groups. Change it in your identity provider.`,
+          code: "managed_by_sso"
+        },
+        409
       );
     }
-    const result = await evaluate(flag, context);
-    return c.json({
-      key,
-      value: result.value,
-      reason: wireReason(result.reason),
-      variant: result.value ? "on" : "off"
+    if ((user.role === "owner" || role === "owner") && caller.role !== "owner") {
+      if (roleChanged || statusChanged) return ownersOnly(c);
+    }
+    if (caller.user?.id === user.id && (roleChanged || statusChanged || envRolesChanged)) {
+      return notYourself(c, roleChanged || envRolesChanged ? "change the role of" : "disable");
+    }
+    if ((roleChanged || status === "disabled") && await isLastOwner(accounts, user)) {
+      return lastOwner(c);
+    }
+    const { environmentRoles: _previous, ...rest } = user;
+    const saved = await accounts.saveUser({
+      ...rest,
+      role,
+      status,
+      name,
+      ...Object.keys(environmentRoles).length > 0 ? { environmentRoles } : {}
+    });
+    const demoted = ROLES.indexOf(role) < ROLES.indexOf(user.role);
+    if (status === "disabled" || demoted) await accounts.revokeSessionsFor(user.id);
+    const changes = [];
+    if (roleChanged) changes.push(`role ${user.role} to ${role}`);
+    if (statusChanged) changes.push(status === "disabled" ? "disabled" : "enabled");
+    if (name !== user.name) changes.push("name changed");
+    if (envRolesChanged) changes.push(...envChanges.map((change) => `role in ${change}`));
+    if (changes.length > 0) {
+      await audit.record({
+        action: "user.updated",
+        actor: caller.identity,
+        target: { type: "user", id: user.id },
+        changeDescription: `${user.email}: ${changes.join(", ")}`
+      });
+    }
+    if (roleChanged || envRolesChanged) {
+      fireMemberEvent("member.role_changed", caller.identity, saved, {
+        role: user.role,
+        ...user.environmentRoles ? { environmentRoles: user.environmentRoles } : {}
+      });
+    }
+    if (statusChanged) {
+      fireMemberEvent(
+        status === "disabled" ? "member.disabled" : "member.enabled",
+        caller.identity,
+        saved
+      );
+    }
+    return c.json(publicUser(saved));
+  });
+  app.delete("/api/v1/users/:id", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const { accounts } = caller;
+    const user = await accounts.getUser(c.req.param("id"));
+    if (!user) return c.json({ error: "Member not found" }, 404);
+    if (user.role === "owner" && caller.role !== "owner") return ownersOnly(c);
+    if (caller.user?.id === user.id) return notYourself(c, "remove");
+    if (await isLastOwner(accounts, user)) return lastOwner(c);
+    await accounts.removeUser(user);
+    await audit.record({
+      action: "user.removed",
+      actor: caller.identity,
+      target: { type: "user", id: user.id },
+      changeDescription: user.email
     });
+    fireMemberEvent("member.removed", caller.identity, { ...user, status: "removed" });
+    return c.body(null, 204);
   });
-  const registerAdmin = (prefix) => {
-    app.get(`${prefix}/flags`, async (c) => {
-      const cfg = resolve(c.env);
-      const auth = await cfg.auth.admin(c.req.raw.headers);
-      if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
-      return c.json({ flags: await cfg.storage.list() });
+  app.delete("/api/v1/users/:id/two-factor", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const { accounts } = caller;
+    const user = await accounts.getUser(c.req.param("id"));
+    if (!user) return c.json({ error: "Member not found" }, 404);
+    if (user.role === "owner" && caller.role !== "owner") return ownersOnly(c);
+    if (caller.user?.id === user.id) return notYourself(c, "reset two-factor for");
+    if (!user.twoFactor && !user.pendingTwoFactor) {
+      return c.json({ error: `${user.email} does not use two-factor sign-in.` }, 409);
+    }
+    await accounts.removeTwoFactor(user);
+    await accounts.revokeSessionsFor(user.id);
+    await audit.record({
+      action: "two_factor.reset",
+      actor: caller.identity,
+      target: { type: "user", id: user.id },
+      changeDescription: user.email
     });
-    app.get(`${prefix}/flags/:key`, async (c) => {
-      const cfg = resolve(c.env);
-      const auth = await cfg.auth.admin(c.req.raw.headers);
-      if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
-      const flag = await cfg.storage.get(c.req.param("key"));
-      if (!flag) return c.json({ error: "Flag not found" }, 404);
-      c.header("ETag", flagEtag(flag));
-      return c.json(flag);
+    return c.body(null, 204);
+  });
+  app.post("/api/v1/users/:id/reset", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const { accounts } = caller;
+    const user = await accounts.getUser(c.req.param("id"));
+    if (!user) return c.json({ error: "Member not found" }, 404);
+    if (user.role === "owner" && caller.role !== "owner") return ownersOnly(c);
+    if (caller.user?.id === user.id) {
+      return c.json(
+        {
+          error: "Change your own password from the Account page instead.",
+          code: "self_change"
+        },
+        409
+      );
+    }
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const { token, invite } = await accounts.createInvite({
+      kind: "reset",
+      email: user.email,
+      role: user.role,
+      userId: user.id,
+      invitedBy: caller.identity
     });
-    app.put(`${prefix}/flags/:key`, async (c) => {
-      const cfg = resolve(c.env);
-      const auth = await cfg.auth.admin(c.req.raw.headers);
-      if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
-      const key = c.req.param("key");
-      const existing = await cfg.storage.get(key);
-      const ifMatch = c.req.header("If-Match")?.trim();
-      if (ifMatch !== void 0) {
-        const precondition = ifMatch === "*" ? existing !== null : existing !== null && flagEtag(existing) === ifMatch;
-        if (!precondition) {
-          return c.json(
-            { error: "This flag changed since you loaded it. Reload and reapply your change." },
-            412
-          );
-        }
-      }
-      const parsed = await readJsonBody(await c.req.text());
-      if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
-      const built = buildFlag(key, parsed.value, auth.identity ?? "unknown", existing);
-      if (!built.ok) return c.json({ error: built.error }, 400);
-      await cfg.storage.put(key, built.flag);
-      cache.invalidate();
-      c.header("ETag", flagEtag(built.flag));
-      return c.json(built.flag);
+    const result = await deliverLink(c, caller.cfg, token, invite, body.dashboardUrl);
+    await audit.record({
+      action: "password.reset",
+      actor: caller.identity,
+      target: { type: "user", id: user.id },
+      changeDescription: `Reset link for ${user.email}${result.emailed ? ", emailed" : ""}`
     });
-    app.delete(`${prefix}/flags/:key`, async (c) => {
-      const cfg = resolve(c.env);
-      const auth = await cfg.auth.admin(c.req.raw.headers);
-      if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
-      await cfg.storage.delete(c.req.param("key"));
-      cache.invalidate();
-      return c.body(null, 204);
+    return c.json(result, 201);
+  });
+  app.get("/api/v1/invites", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const invites = (await caller.accounts.listInvites()).filter((i) => i.kind === "invite");
+    return c.json({ invites: invites.map(publicInvite) });
+  });
+  app.post("/api/v1/invites", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const { accounts } = caller;
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const email = normalizeEmail(body.email);
+    if (!email) return c.json({ error: "Enter a valid email address." }, 400);
+    const role = body.role ?? "viewer";
+    if (!isRole(role)) return c.json({ error: `role must be one of ${ROLES.join(", ")}` }, 400);
+    if (role === "owner" && caller.role !== "owner") return ownersOnly(c);
+    if (await accounts.findByEmail(email)) {
+      return c.json({ error: "That email already has an account.", code: "already_member" }, 409);
+    }
+    const { token, invite } = await accounts.createInvite({
+      kind: "invite",
+      email,
+      role,
+      invitedBy: caller.identity
     });
-  };
+    const result = await deliverLink(c, caller.cfg, token, invite, body.dashboardUrl);
+    await audit.record({
+      action: "invite.created",
+      actor: caller.identity,
+      target: { type: "invite", id: invite.id },
+      changeDescription: `${email} as ${role}${result.emailed ? ", emailed" : ""}`
+    });
+    fireMemberEvent("member.invited", caller.identity, { email, role });
+    return c.json(result, 201);
+  });
+  app.post("/api/v1/invites/:id/resend", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const { accounts } = caller;
+    const existing = (await accounts.listInvites()).find(
+      (i) => i.id === c.req.param("id") && i.kind === "invite"
+    );
+    if (!existing) return c.json({ error: "Invite not found" }, 404);
+    if (existing.role === "owner" && caller.role !== "owner") return ownersOnly(c);
+    const { token, invite } = await accounts.createInvite({
+      kind: "invite",
+      email: existing.email,
+      role: existing.role,
+      invitedBy: caller.identity
+    });
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const result = await deliverLink(c, caller.cfg, token, invite, body.dashboardUrl);
+    await audit.record({
+      action: "invite.created",
+      actor: caller.identity,
+      target: { type: "invite", id: invite.id },
+      changeDescription: `${existing.email} as ${existing.role}, resent${result.emailed ? ", emailed" : ""}`
+    });
+    return c.json(result, 201);
+  });
+  app.delete("/api/v1/invites/:id", async (c) => {
+    const caller = await memberAdmin(c);
+    if (caller instanceof Response) return caller;
+    const { accounts } = caller;
+    const existing = (await accounts.listInvites()).find((i) => i.id === c.req.param("id"));
+    if (!existing) return c.json({ error: "Invite not found" }, 404);
+    if (existing.role === "owner" && caller.role !== "owner") return ownersOnly(c);
+    await accounts.revokeInvite(existing.id);
+    await audit.record({
+      action: "invite.revoked",
+      actor: caller.identity,
+      target: { type: "invite", id: existing.id },
+      changeDescription: existing.email
+    });
+    return c.body(null, 204);
+  });
+  const linkGone = (c) => c.json(
+    {
+      error: "This link has expired or was already used. Ask an admin for a new one.",
+      code: "link_invalid"
+    },
+    410
+  );
+  app.post("/api/v1/invites/inspect", async (c) => {
+    const accounts = accountsOf(resolve(c.env));
+    if (!accounts) return accountsOff(c);
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const invite = typeof body.token === "string" ? await accounts.findInvite(body.token) : null;
+    if (!invite) return linkGone(c);
+    return c.json({
+      kind: invite.kind,
+      email: invite.email,
+      role: invite.role,
+      expiresAt: invite.expiresAt,
+      password: { kdf: PASSWORD_KDF, iterations: PASSWORD_ITERATIONS }
+    });
+  });
+  app.post("/api/v1/invites/accept", async (c) => {
+    const cfg = resolve(c.env);
+    const accounts = accountsOf(cfg);
+    if (!accounts) return accountsOff(c);
+    const body = await readBody(c);
+    if (body instanceof Response) return body;
+    const token = typeof body.token === "string" ? body.token : "";
+    const invite = token ? await accounts.findInvite(token) : null;
+    if (!invite) return linkGone(c);
+    if (passwordOff(cfg)) return passwordDisabled(c, cfg, ` as ${invite.email}`);
+    const salt = decodeSalt(body.salt);
+    const clientKey = decodeClientKey(body.clientKey);
+    if (!salt || !clientKey) return c.json({ error: "Missing or malformed password key." }, 400);
+    let user;
+    if (invite.kind === "invite") {
+      user = await accounts.createUser({
+        email: invite.email,
+        name: normalizeName(body.name),
+        role: invite.role,
+        salt,
+        clientKey
+      });
+      if (!user) {
+        await accounts.consumeInvite(token);
+        return c.json(
+          { error: "That email already has an account. Sign in instead.", code: "already_member" },
+          409
+        );
+      }
+      await audit.record({
+        action: "invite.accepted",
+        actor: user.email,
+        target: { type: "user", id: user.id },
+        changeDescription: `Joined as ${user.role}`
+      });
+      fireMemberEvent("member.joined", user.email, user);
+    } else {
+      const existing = invite.userId ? await accounts.getUser(invite.userId) : null;
+      if (!existing || existing.email !== invite.email) {
+        await accounts.consumeInvite(token);
+        return linkGone(c);
+      }
+      if (existing.status !== "active") {
+        return c.json({ error: "This account is disabled.", code: "account_disabled" }, 403);
+      }
+      await accounts.setPassword(existing, salt, clientKey);
+      await accounts.revokeSessionsFor(existing.id);
+      await accounts.clearFailures(existing.email);
+      user = await accounts.getUser(existing.id) ?? existing;
+      await audit.record({
+        action: "password.changed",
+        actor: user.email,
+        target: { type: "user", id: user.id },
+        changeDescription: "With a reset link"
+      });
+    }
+    await accounts.consumeInvite(token);
+    if (user.twoFactor) {
+      return c.json({ twoFactorRequired: true, challenge: await twoFactorChallenge(cfg, user) });
+    }
+    await accounts.recordLogin(user);
+    const session = await accounts.createSession(user, c.req.header("user-agent"));
+    return c.json({
+      token: session.token,
+      expiresAt: session.session.expiresAt,
+      user: publicUser(user)
+    });
+  });
   registerAdmin("/api/v1");
   registerAdmin("");
   app.onError((err, c) => {
@@ -714,11 +3683,19 @@ function createFlagServer(config) {
   return app;
 }
 export {
+  ADMIN_TOKEN_IDENTITY,
+  ROLES,
   apiKey,
+  apiKeys,
   bearerToken,
+  can,
   createFlagServer,
   defaultRateLimitKey,
   memoryRateLimit,
+  minimumRole,
   oidc,
-  openApiDocument
+  openApiDocument,
+  resolveAdminEnvironment,
+  resolveReadEnvironment,
+  scopedStorage
 };