@niledatabase/server 5.0.0-alpha.3 → 5.0.0-alpha.31

package/dist/index.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var async_hooks = require('async_hooks');
 require('dotenv/config');
 var pg = require('pg');
 
@@ -8,6 +9,13 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 var pg__default = /*#__PURE__*/_interopDefault(pg);
 
 // src/types.ts
+var ExtensionState = /* @__PURE__ */ ((ExtensionState2) => {
+  ExtensionState2["onHandleRequest"] = "onHandleRequest";
+  ExtensionState2["onRequest"] = "onRequest";
+  ExtensionState2["onResponse"] = "onResponse";
+  ExtensionState2["withContext"] = "withContext";
+  return ExtensionState2;
+})(ExtensionState || {});
 var APIErrorErrorCodeEnum = {
   InternalError: "internal_error",
   BadRequest: "bad_request",
@@ -31,6 +39,12 @@ var LoginUserResponseTokenTypeEnum = {
   IdToken: "ID_TOKEN"
 };
 
+// src/utils/constants.ts
+var TENANT_COOKIE = "nile.tenant-id";
+var USER_COOKIE = "nile.user-id";
+var HEADER_ORIGIN = "nile-origin";
+var HEADER_SECURE_COOKIES = "nile-secure-cookies";
+
 // src/api/utils/routes/index.ts
 var NILEDB_API_URL = process.env.NILEDB_API_URL;
 var DEFAULT_PREFIX = "/api";
@@ -53,21 +67,22 @@ var appRoutes = (prefix = DEFAULT_PREFIX) => ({
   TENANT_USER: `${prefix}${"/tenants/{tenantId}/users/{userId}" /* TENANT_USER */}`,
   TENANT_USERS: `${prefix}${"/tenants/{tenantId}/users" /* TENANT_USERS */}`,
   SIGNUP: `${prefix}${"/signup" /* SIGNUP */}`,
+  INVITES: `${prefix}${"/tenants/{tenantId}/invites" /* INVITES */}`,
+  INVITE: `${prefix}${"/tenants/{tenantId}/invite" /* INVITE */}`,
   LOG: `${prefix}/_log`
 });
-var apiRoutes = (config) => ({
-  ME: makeRestUrl(config, "/me"),
-  USERS: (qp) => makeRestUrl(config, "/users", qp),
-  USER: (userId) => makeRestUrl(config, `/users/${userId}`),
-  TENANTS: makeRestUrl(config, "/tenants"),
-  TENANT: (tenantId) => makeRestUrl(config, `/tenants/${tenantId}`),
-  SIGNUP: makeRestUrl(config, "/signup"),
-  TENANT_USERS: (tenantId) => makeRestUrl(config, `/tenants/${tenantId}/users`),
-  TENANT_USER: makeRestUrl(
-    config,
-    `/tenants/${config.tenantId}/users/${config.userId}`
-  ),
-  USER_TENANTS: (userId) => makeRestUrl(config, `/users/${userId}/tenants`)
+var apiRoutes = (apiUrl) => ({
+  ME: makeRestUrl(apiUrl, "/me"),
+  USERS: (qp) => makeRestUrl(apiUrl, "/users", qp),
+  USER: (userId) => makeRestUrl(apiUrl, `/users/${userId}`),
+  TENANTS: makeRestUrl(apiUrl, "/tenants"),
+  TENANT: (tenantId) => makeRestUrl(apiUrl, `/tenants/${tenantId}`),
+  SIGNUP: makeRestUrl(apiUrl, "/signup"),
+  TENANT_USERS: (tenantId) => makeRestUrl(apiUrl, `/tenants/${tenantId}/users`),
+  INVITES: (tenantId) => makeRestUrl(apiUrl, `/tenants/${tenantId}/invites`),
+  INVITE: (tenantId) => makeRestUrl(apiUrl, `/tenants/${tenantId}/invite`),
+  TENANT_USER: (tenantId, userId) => makeRestUrl(apiUrl, `/tenants/${tenantId}/users/${userId}`),
+  USER_TENANTS: (userId) => makeRestUrl(apiUrl, `/users/${userId}/tenants`)
 });
 var proxyRoutes = (config) => ({
   SIGNIN: makeRestUrl(config, "/auth/signin" /* SIGNIN */),
@@ -91,8 +106,8 @@ function filterNullUndefined(obj) {
     )
   );
 }
-function makeRestUrl(config, path, qp) {
-  const url = config.apiUrl || NILEDB_API_URL;
+function makeRestUrl(apiUrl, path, qp) {
+  const url = apiUrl || NILEDB_API_URL;
   if (!url) {
     throw new Error(
       "An API url is required. Set it via NILEDB_API_URL. Was auto configuration run?"
@@ -104,9 +119,9 @@ function makeRestUrl(config, path, qp) {
   const strParams = params.toString();
   return `${[url, path.substring(1, path.length)].join("/")}${strParams ? `?${strParams}` : ""}`;
 }
-function urlMatches(requestUrl, route17) {
+function urlMatches(requestUrl, route20) {
   const url = new URL(requestUrl);
-  return url.pathname.startsWith(route17);
+  return url.pathname.startsWith(route20);
 }
 function isUUID(value) {
   if (!value) {
@@ -123,6 +138,16 @@ var purple = "\x1B[38;2;200;160;255m";
 var orange = "\x1B[38;2;255;165;0m";
 var reset = "\x1B[0m";
 var baseLogger = (config, ...params) => ({
+  silly(message, meta) {
+    if (config?.debug && process.env.LOG_LEVEL === "silly") {
+      console.log(
+        `${orange}[niledb]${reset}${purple}[DEBUG]${reset}${params.join(
+          ""
+        )}${reset} ${message}`,
+        meta ? `${JSON.stringify(meta)}` : ""
+      );
+    }
+  },
   info(message, meta) {
     if (config?.debug) {
       console.info(
@@ -135,7 +160,7 @@ var baseLogger = (config, ...params) => ({
   },
   debug(message, meta) {
     if (config?.debug) {
-      console.debug(
+      console.log(
         `${orange}[niledb]${reset}${purple}[DEBUG]${reset}${params.join(
           ""
         )}${reset} ${message}`,
@@ -163,43 +188,267 @@ var baseLogger = (config, ...params) => ({
     );
   }
 });
-function Logger(config, ...params) {
-  const base = baseLogger(config, params);
-  const info = config?.logger?.info ?? base.info;
-  const debug = config?.logger?.debug ?? base.debug;
-  const warn = config?.logger?.warn ?? base.warn;
-  const error = config?.logger?.error ?? base.error;
-  return { info, warn, error, debug };
+function Logger(config) {
+  return (prefixes) => {
+    const { info, debug, warn: warn2, error, silly: silly2 } = config && typeof config?.logger === "function" ? config.logger(prefixes) : baseLogger(config, prefixes);
+    return {
+      info,
+      debug,
+      warn: warn2,
+      error,
+      silly: silly2
+    };
+  };
 }
 function matchesLog(configRoutes, request2) {
   return urlMatches(request2.url, configRoutes.LOG);
 }
 
-// src/utils/constants.ts
-var X_NILE_TENANT = "nile-tenant-id";
-var X_NILE_ORIGIN = "nile-origin";
-var X_NILE_SECURECOOKIES = "nile-secure-cookies";
+// src/api/utils/extensions.ts
+function getRequestConfig(params) {
+  if (typeof params[1] === "object") {
+    return params[1];
+  }
+  return {};
+}
+function bindRunExtensions(instance) {
+  return async function runExtensions(toRun, config, params, _init) {
+    const { debug } = config.logger("[EXTENSIONS]");
+    const extensionConfig = getRequestConfig(
+      Array.isArray(params) ? params : [null, params]
+    );
+    if (config.extensions) {
+      for (const create2 of config.extensions) {
+        if (typeof create2 !== "function") {
+          continue;
+        }
+        const ext = create2(instance);
+        if (extensionConfig.disableExtensions?.includes(ext.id)) {
+          continue;
+        }
+        if (ext.withContext && toRun === "withContext" /* withContext */) {
+          await ext.withContext(ctx);
+        }
+        if (ext.onHandleRequest && toRun === "onHandleRequest" /* onHandleRequest */) {
+          const result = await ext.onHandleRequest(
+            Array.isArray(params) ? params : [params]
+          );
+          debug(`${ext.id ?? create2.name} ran onHandleRequest`);
+          if (result != null) {
+            return result;
+          }
+        }
+        const [param] = Array.isArray(params) ? params : [params];
+        if (ext.onRequest && toRun === "onRequest" /* onRequest */) {
+          const { ...previousContext } = ctx.get();
+          const preserveHeaders = previousContext.preserveHeaders;
+          if (preserveHeaders) {
+            ctx.set({ preserveHeaders: false });
+          }
+          if (!_init) {
+            continue;
+          }
+          const previousHeaders = new Headers(previousContext.headers);
+          await ext.onRequest(_init.request, ctx);
+          const updatedContext = ctx.get();
+          if (updatedContext?.headers) {
+            const cookie = updatedContext.headers.get("cookie");
+            if (cookie && param.headers) {
+              const updatedCookies = mergeCookies(
+                preserveHeaders ? previousHeaders?.get("cookie") : null,
+                updatedContext.headers.get("cookie")
+              );
+              param.headers.set("cookie", updatedCookies);
+            }
+            if (updatedContext.tenantId && param.headers) {
+              param.headers.set(
+                TENANT_COOKIE,
+                String(updatedContext.headers.get(TENANT_COOKIE))
+              );
+            }
+            ctx.set({ headers: param.headers });
+          }
+          debug(`${ext.id ?? create2.name} ran onRequest`);
+        }
+        if (ext.onResponse && toRun === "onResponse" /* onResponse */) {
+          const result = await ext.onResponse(param, ctx);
+          debug(`${ext.id ?? create2.name} ran onResponse`);
+          if (result != null) {
+            return result;
+          }
+        }
+      }
+    }
+    return void 0;
+  };
+}
+function buildExtensionConfig(instance) {
+  return {
+    runExtensions: bindRunExtensions(instance)
+  };
+}
+function mergeCookies(...cookieStrings) {
+  const cookieMap = /* @__PURE__ */ new Map();
+  for (const str of cookieStrings) {
+    if (!str) continue;
+    for (const part of str.split(";")) {
+      const [key17, value] = part.split("=").map((s) => s.trim());
+      if (key17 && value) cookieMap.set(key17, value);
+    }
+  }
+  return [...cookieMap.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
+}
+async function runExtensionContext(config) {
+  await config?.extensionCtx?.runExtensions("withContext" /* withContext */, config);
+}
+
+// src/api/utils/request-context.ts
+var { warn, silly } = Logger({ debug: true })("[REQUEST CONTEXT]");
+var storage = new async_hooks.AsyncLocalStorage();
+var defaultContext = {
+  headers: new Headers(),
+  tenantId: void 0,
+  userId: void 0,
+  preserveHeaders: false
+};
+var lastUsedContext = defaultContext;
+var ctx = {
+  run(ctx2, fn) {
+    const merged = {
+      ...defaultContext,
+      ...ctx2,
+      headers: ctx2.headers instanceof Headers ? ctx2.headers : new Headers(ctx2.headers)
+    };
+    lastUsedContext = merged;
+    return storage.run(merged, fn);
+  },
+  get: () => {
+    const ctx2 = storage.getStore();
+    if (!ctx2) {
+      return { ...defaultContext };
+    }
+    silly(`[GET] ${serializeContext(ctx2)}`);
+    return ctx2;
+  },
+  /**
+   * This is a mirror of Server.getContext, but only for requests. We keep only the request
+   * information around, everything else is :above_my_pay_grade:
+   * @param partial A partial context to override
+   */
+  set: (partial) => {
+    const store = storage.getStore();
+    if (!store) {
+      warn("ctx.set() called outside of ctx.run(). This will not persist.");
+      return;
+    }
+    if (partial.headers === null) {
+      store.headers = new Headers();
+    } else if (partial.headers && store.headers instanceof Headers) {
+      for (const [key17, value] of new Headers(partial.headers).entries()) {
+        if (key17.toLowerCase() === "cookie") {
+          const existingCookies = parseCookieHeader(
+            store.headers.get("cookie") || ""
+          );
+          const newCookies = parseCookieHeader(value);
+          const mergedCookies = { ...existingCookies, ...newCookies };
+          store.headers.set("cookie", serializeCookies(mergedCookies));
+        } else {
+          store.headers.set(key17, value);
+        }
+      }
+    }
+    if ("tenantId" in partial) store.tenantId = partial.tenantId;
+    if ("userId" in partial) store.userId = partial.userId;
+    if ("preserveHeaders" in partial)
+      store.preserveHeaders = Boolean(partial.preserveHeaders);
+    silly(`[SET] ${serializeContext(store)}`);
+    lastUsedContext = { ...store };
+  },
+  // for convenience only
+  getLastUsed: () => lastUsedContext
+};
+function withNileContext(config, fn, name = "unknown") {
+  const initialContext = config.context;
+  const existing = ctx.get();
+  const mergedHeaders = new Headers(existing.headers);
+  if (initialContext instanceof Request) {
+    initialContext.headers.forEach((value, key17) => {
+      mergedHeaders.set(key17, value);
+    });
+    const context2 = {
+      headers: mergedHeaders,
+      tenantId: existing.tenantId,
+      userId: existing.userId,
+      preserveHeaders: existing.preserveHeaders ?? false
+    };
+    silly(`${name} [INITIAL - Request] ${serializeContext(context2)}`);
+    return ctx.run(context2, fn);
+  }
+  if (initialContext.headers) {
+    const incoming = initialContext.headers instanceof Headers ? initialContext.headers : new Headers(initialContext.headers);
+    incoming.forEach((value, key17) => {
+      mergedHeaders.set(key17, value);
+    });
+  }
+  const hasTenantId = "tenantId" in initialContext;
+  const hasUserId = "userId" in initialContext;
+  const hasPreserveHeaders = "preserveHeaders" in initialContext;
+  const context = {
+    headers: mergedHeaders,
+    tenantId: hasTenantId ? initialContext.tenantId : existing.tenantId,
+    userId: hasUserId ? initialContext.userId : existing.userId,
+    preserveHeaders: hasPreserveHeaders ? Boolean(initialContext.preserveHeaders) : existing.preserveHeaders ?? false
+  };
+  silly(`${name} [INITIAL - Partial<Context>] ${serializeContext(context)}`);
+  return ctx.run(context, async () => {
+    await runExtensionContext(config);
+    return fn();
+  });
+}
+function serializeContext(context) {
+  const headers = {};
+  const rawHeaders = new Headers(context.headers);
+  rawHeaders.forEach((value, key17) => {
+    headers[key17] = value;
+  });
+  return JSON.stringify({
+    headers,
+    tenantId: context.tenantId,
+    userId: context.userId,
+    preserveHeaders: context.preserveHeaders
+  });
+}
+function parseCookieHeader(header) {
+  return header.split(";").map((c) => c.trim()).filter(Boolean).reduce((acc, curr) => {
+    const [key17, ...val] = curr.split("=");
+    if (key17) acc[key17] = val.join("=");
+    return acc;
+  }, {});
+}
+function serializeCookies(cookies) {
+  return Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+}
 
 // src/api/utils/request.ts
 async function request(url, _init, config) {
-  const { debug, info, error } = Logger(config, "[REQUEST]");
+  const { debug, info, error, warn: warn2 } = config.logger("[REQUEST]");
   const { request: request2, ...init } = _init;
   const requestUrl = new URL(request2.url);
   const updatedHeaders = new Headers({});
   if (request2.headers.get("cookie")) {
     updatedHeaders.set("cookie", String(request2.headers.get("cookie")));
   }
-  if (request2.headers.get(X_NILE_TENANT)) {
+  if (request2.headers.get(TENANT_COOKIE)) {
     updatedHeaders.set(
-      X_NILE_TENANT,
-      String(request2.headers.get(X_NILE_TENANT))
+      TENANT_COOKIE,
+      String(request2.headers.get(TENANT_COOKIE))
     );
   }
   if (config.secureCookies != null) {
-    updatedHeaders.set(X_NILE_SECURECOOKIES, String(config.secureCookies));
+    updatedHeaders.set(HEADER_SECURE_COOKIES, String(config.secureCookies));
   } else {
     updatedHeaders.set(
-      X_NILE_SECURECOOKIES,
+      HEADER_SECURE_COOKIES,
       process.env.NODE_ENV === "production" ? "true" : "false"
     );
   }
@@ -207,32 +456,42 @@ async function request(url, _init, config) {
   if (config.callbackUrl) {
     const cbUrl = new URL(config.callbackUrl);
     debug(`Obtained origin from config.callbackUrl ${config.callbackUrl}`);
-    updatedHeaders.set(X_NILE_ORIGIN, cbUrl.origin);
+    updatedHeaders.set(HEADER_ORIGIN, cbUrl.origin);
   } else if (config.origin) {
     debug(`Obtained origin from config.origin ${config.origin}`);
-    updatedHeaders.set(X_NILE_ORIGIN, config.origin);
+    updatedHeaders.set(HEADER_ORIGIN, config.origin);
   } else {
-    const passedOrigin = request2.headers.get(X_NILE_ORIGIN);
+    const passedOrigin = request2.headers.get(HEADER_ORIGIN);
     if (passedOrigin) {
-      updatedHeaders.set(X_NILE_ORIGIN, passedOrigin);
+      updatedHeaders.set(HEADER_ORIGIN, passedOrigin);
     } else {
-      const reqOrigin = config.routePrefix !== DEFAULT_PREFIX ? `${requestUrl.origin}${config.routePrefix}` : requestUrl.origin;
-      updatedHeaders.set(X_NILE_ORIGIN, reqOrigin);
-      debug(`Obtained origin from request ${reqOrigin}`);
+      const { headers } = ctx.get();
+      const host = headers.get("host");
+      if (host) {
+        const serverSideOrigin = `${getProtocolFromHeaders(headers)}://${host}`;
+        updatedHeaders.set(HEADER_ORIGIN, serverSideOrigin);
+        debug(`Obtained origin from server side headers ${serverSideOrigin}`);
+      } else {
+        const reqOrigin = config.routePrefix !== DEFAULT_PREFIX ? `${requestUrl.origin}${config.routePrefix}` : requestUrl.origin;
+        updatedHeaders.set(HEADER_ORIGIN, reqOrigin);
+        debug(`Obtained origin from request ${reqOrigin}`);
+      }
     }
   }
   const params = { ...init };
   if (params.method?.toLowerCase() === "post" || params.method?.toLowerCase() === "put") {
     try {
       updatedHeaders.set("content-type", "application/json");
-      const initBody = await new Response(_init.request.clone().body).json();
-      const requestBody = await new Response(request2.clone().body).json();
-      params.body = JSON.stringify(initBody ?? requestBody);
+      const bodyStream = _init.body ?? _init.request?.body ?? request2.body;
+      const bodyText = await new Response(bodyStream).text();
+      try {
+        params.body = JSON.stringify(JSON.parse(bodyText));
+      } catch {
+        updatedHeaders.set("content-type", "application/x-www-form-urlencoded");
+        params.body = bodyText;
+      }
     } catch (e) {
-      updatedHeaders.set("content-type", "application/x-www-form-urlencoded");
-      const initBody = await new Response(_init.request.clone().body).text();
-      const requestBody = await new Response(request2.clone().body).text();
-      params.body = initBody ?? requestBody;
+      error("Failed to parse request body");
     }
   }
   params.headers = updatedHeaders;
@@ -241,6 +500,12 @@ async function request(url, _init, config) {
     params.headers.set("request-id", crypto.randomUUID());
     params.cache = "no-store";
   }
+  await config.extensionCtx?.runExtensions(
+    "onRequest" /* onRequest */,
+    config,
+    params,
+    _init
+  );
   try {
     const res = await fetch(fullUrl, {
       ...params
@@ -260,6 +525,14 @@ async function request(url, _init, config) {
       statusText: res?.statusText,
       text: await loggingRes?.text()
     });
+    const updatedRes = await config.extensionCtx?.runExtensions(
+      "onResponse" /* onResponse */,
+      config,
+      { ...params, response: res }
+    );
+    if (updatedRes) {
+      return updatedRes;
+    }
     return res;
   } catch (e) {
     if (e instanceof Error) {
@@ -274,25 +547,35 @@ async function request(url, _init, config) {
     );
   }
 }
+function getProtocolFromHeaders(headers) {
+  const get = (key17) => headers instanceof Headers ? headers.get(key17) : headers[key17.toLowerCase()];
+  const xfp = get("x-forwarded-proto");
+  if (xfp) return xfp.toLowerCase();
+  const forwarded = get("forwarded");
+  if (forwarded) {
+    const match = forwarded.match(/proto=(https?)/i);
+    if (match) return match[1].toLowerCase();
+  }
+  const ref = get("referer") || get("origin");
+  if (ref && ref.startsWith("https")) return "https";
+  return "http";
+}
 
 // src/api/utils/auth.ts
 async function auth(req, config) {
-  const { info, error } = Logger(config, "[nileauth]");
+  const { info, error } = config.logger("[nileauth]");
   info("checking auth");
   const sessionUrl = `${config.apiUrl}/auth/session`;
   info(`using session ${sessionUrl}`);
   req.headers.delete("content-length");
   const res = await request(sessionUrl, { request: req }, config);
-  if (!res) {
-    info("no session found");
-    return void 0;
-  }
-  info("session active");
   try {
     const session = await new Response(res.body).json();
     if (Object.keys(session).length === 0) {
+      info("no session found");
       return void 0;
     }
+    info("session active");
     return session;
   } catch (e) {
     error(e);
@@ -303,7 +586,7 @@ async function auth(req, config) {
 // src/api/routes/me/index.ts
 var key = "ME";
 async function route(request2, config) {
-  const url = apiRoutes(config)[key];
+  const url = apiRoutes(config.apiUrl)[key];
   if (request2.method === "GET") {
     return await GET(url, { request: request2 }, config);
   }
@@ -324,8 +607,9 @@ function matches(configRoutes, request2) {
 }
 async function fetchMe(config, method, body) {
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/me" /* ME */}`;
+  const { headers } = ctx.get();
   const init = {
-    headers: config.headers,
+    headers,
     method: method ?? "GET"
   };
   if (method === "PUT") {
@@ -377,9 +661,9 @@ function getTokenFromCookie(headers, cookieKey) {
     return _cookies[cookieKey];
   }
 }
-function getTenantFromHttp(headers, config) {
-  const cookieTenant = getTokenFromCookie(headers, X_NILE_TENANT);
-  return cookieTenant ?? headers?.get(X_NILE_TENANT) ?? config?.tenantId;
+function getTenantFromHttp(headers, context) {
+  const cookieTenant = getTokenFromCookie(headers, TENANT_COOKIE);
+  return cookieTenant ? cookieTenant : context?.tenantId;
 }
 
 // src/api/routes/users/POST.ts
@@ -390,7 +674,10 @@ async function POST(config, init) {
   const tenantId = yurl.searchParams.get("tenantId");
   const newTenantName = yurl.searchParams.get("newTenantName");
   const tenant = tenantId ?? getTenantFromHttp(init.request.headers);
-  const url = apiRoutes(config).USERS({ tenantId: tenant, newTenantName });
+  const url = apiRoutes(config.apiUrl).USERS({
+    tenantId: tenant,
+    newTenantName
+  });
   return await request(url, init, config);
 }
 
@@ -398,43 +685,36 @@ async function POST(config, init) {
 async function GET2(config, init, log) {
   const yurl = new URL(init.request.url);
   const tenantId = yurl.searchParams.get("tenantId");
-  const tenant = tenantId ?? getTenantFromHttp(init.request.headers);
+  const tenant = tenantId ?? getTenantFromHttp(init.request.headers, config.context);
   if (!tenant) {
     log("[GET] No tenant id provided.");
     return new Response(null, { status: 404 });
   }
-  const url = apiRoutes(config).TENANT_USERS(tenant);
   init.method = "GET";
+  const url = apiRoutes(config.apiUrl).TENANT_USERS(tenant);
   return await request(url, init, config);
 }
 
 // src/api/routes/users/[userId]/PUT.ts
-async function PUT2(config, session, init) {
-  if (!session) {
-    return new Response(null, { status: 401 });
-  }
+async function PUT2(config, init) {
   init.body = init.request.body;
   init.method = "PUT";
   const [userId] = new URL(init.request.url).pathname.split("/").reverse();
-  const url = apiRoutes(config).USER(userId);
+  const url = apiRoutes(config.apiUrl).USER(userId);
   return await request(url, init, config);
 }
 
 // src/api/routes/users/index.ts
 var key2 = "USERS";
 async function route2(request2, config) {
-  const { info } = Logger(
-    { ...config, debug: config.debug },
-    `[ROUTES][${key2}]`
-  );
-  const session = await auth(request2, config);
+  const { info } = config.logger(`[ROUTES][${key2}]`);
   switch (request2.method) {
     case "GET":
       return await GET2(config, { request: request2 }, info);
     case "POST":
       return await POST(config, { request: request2 });
     case "PUT":
-      return await PUT2(config, session, { request: request2 });
+      return await PUT2(config, { request: request2 });
     default:
       return new Response("method not allowed", { status: 405 });
   }
@@ -447,32 +727,28 @@ function matches2(configRoutes, request2) {
 async function GET3(config, init) {
   const yurl = new URL(init.request.url);
   const [, tenantId] = yurl.pathname.split("/").reverse();
-  const url = `${apiRoutes(config).TENANT_USERS(tenantId)}`;
+  const url = `${apiRoutes(config.apiUrl).TENANT_USERS(tenantId)}`;
   return await request(url, init, config);
 }
 
 // src/api/routes/tenants/[tenantId]/users/POST.ts
-async function POST2(config, session, init) {
+async function POST2(config, init) {
+  const session = await auth(init.request, config);
+  if (!session) {
+    return new Response(null, { status: 401 });
+  }
   const yurl = new URL(init.request.url);
   const [, tenantId] = yurl.pathname.split("/").reverse();
   init.body = JSON.stringify({ email: session.email });
   init.method = "POST";
-  const url = apiRoutes(config).TENANT_USERS(tenantId);
+  const url = apiRoutes(config.apiUrl).TENANT_USERS(tenantId);
   return await request(url, init, config);
 }
 
 // src/api/routes/tenants/[tenantId]/users/index.ts
 var key3 = "TENANT_USERS";
 async function route3(request2, config) {
-  const { info } = Logger(
-    { ...config, debug: config.debug },
-    `[ROUTES][${key3}]`
-  );
-  const session = await auth(request2, config);
-  if (!session) {
-    info("401");
-    return new Response(null, { status: 401 });
-  }
+  const { info } = config.logger(`[ROUTES][${key3}]`);
   const yurl = new URL(request2.url);
   const [, tenantId] = yurl.pathname.split("/").reverse();
   if (!tenantId) {
@@ -483,7 +759,7 @@ async function route3(request2, config) {
     case "GET":
       return await GET3(config, { request: request2 });
     case "POST":
-      return await POST2(config, session, { request: request2 });
+      return await POST2(config, { request: request2 });
     default:
       return new Response("method not allowed", { status: 405 });
   }
@@ -491,21 +767,22 @@ async function route3(request2, config) {
 function matches3(configRoutes, request2) {
   const url = new URL(request2.url);
   const [userId, possibleTenantId, tenantId] = url.pathname.split("/").reverse();
-  let route17 = configRoutes[key3].replace("{tenantId}", tenantId).replace("{userId}", userId);
+  let route20 = configRoutes[key3].replace("{tenantId}", tenantId).replace("{userId}", userId);
   if (userId === "users") {
-    route17 = configRoutes[key3].replace("{tenantId}", possibleTenantId);
+    route20 = configRoutes[key3].replace("{tenantId}", possibleTenantId);
   }
-  return urlMatches(request2.url, route17);
+  return urlMatches(request2.url, route20);
 }
 async function fetchTenantUsers(config, method, payload) {
   const { body, params } = {};
-  if (!config.tenantId) {
+  const { tenantId, headers } = ctx.get();
+  if (!tenantId) {
     throw new Error(
-      'Unable to fetch tenant, the tenantId context is missing. Call nile.setContext({ tenantId }), set nile.tenantId = "tenantId", or add it to the function call'
+      "Unable to fetch the user's tenants, the tenantId context is missing. Call nile.setContext({ tenantId })"
     );
   }
-  if (!isUUID(config.tenantId) && config.logger?.warn) {
-    config.logger?.warn(
+  if (!isUUID(tenantId)) {
+    config.logger("fetchTenantUsers").warn(
       "nile.tenantId is not a valid UUID. This may lead to unexpected behavior in your application."
     );
   }
@@ -516,31 +793,160 @@ async function fetchTenantUsers(config, method, payload) {
   if (params?.tenantId) {
     q.set("tenantId", params.tenantId);
   }
-  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants/{tenantId}/users" /* TENANT_USERS */.replace(
-    "{tenantId}",
-    config.tenantId
-  )}`;
+  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants/{tenantId}/users" /* TENANT_USERS */.replace("{tenantId}", tenantId)}`;
   const m = method;
   const init = {
     method: m,
-    headers: config.headers
+    headers
+  };
+  const req = new Request(clientUrl, init);
+  return await config.handlers[m](req);
+}
+
+// src/api/routes/tenants/[tenantId]/invite/PUT.ts
+async function PUT3(config, init) {
+  const yurl = new URL(init.request.url);
+  const [, tenantId] = yurl.pathname.split("/").reverse();
+  if (!tenantId) {
+    return new Response(null, { status: 404 });
+  }
+  if (yurl.searchParams.size > 0) {
+    init.body = new URLSearchParams(yurl.searchParams).toString();
+  }
+  init.method = "PUT";
+  const url = `${apiRoutes(config.apiUrl).INVITE(tenantId)}`;
+  const res = await request(url, init, config);
+  const location = res?.headers?.get("location");
+  if (location) {
+    return new Response(res?.body, {
+      status: 302,
+      headers: res?.headers
+    });
+  }
+  return new Response(res?.body, {
+    status: res?.status,
+    headers: res?.headers
+  });
+}
+
+// src/api/routes/tenants/[tenantId]/invite/POST.ts
+async function POST3(config, init) {
+  const yurl = new URL(init.request.url);
+  const [, tenantId] = yurl.pathname.split("/").reverse();
+  if (!tenantId) {
+    return new Response(null, { status: 404 });
+  }
+  init.method = "POST";
+  init.body = init.request.body;
+  const url = `${apiRoutes(config.apiUrl).INVITE(tenantId)}`;
+  return await request(url, init, config);
+}
+
+// src/api/routes/tenants/[tenantId]/invite/index.ts
+var key4 = "INVITE";
+async function route4(request2, config) {
+  switch (request2.method) {
+    // the browser is a GET, but we need to PUT it into nile-auth
+    // server side, this is a put
+    case "GET":
+    case "PUT":
+      return await PUT3(config, { request: request2 });
+    case "POST":
+      return await POST3(config, { request: request2 });
+    default:
+      return new Response("method not allowed", { status: 405 });
+  }
+}
+function matches4(configRoutes, request2) {
+  const url = new URL(request2.url);
+  const [, tenantId] = url.pathname.split("/").reverse();
+  const route20 = configRoutes[key4].replace("{tenantId}", tenantId);
+  return urlMatches(request2.url, route20);
+}
+async function fetchInvite(config, method, body) {
+  const { headers, tenantId } = ctx.get();
+  if (!tenantId) {
+    throw new Error(
+      "Unable to fetch the invite for the tenant, the tenantId context is missing. Call nile.setContext({ tenantId })"
+    );
+  }
+  if (!isUUID(tenantId)) {
+    config.logger("fetchInvite").warn(
+      "nile.tenantId is not a valid UUID. This may lead to unexpected behavior in your application."
+    );
+  }
+  let clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants/{tenantId}/invite" /* INVITE */.replace("{tenantId}", tenantId)}`;
+  const m = method ?? "GET";
+  const init = {
+    method: m,
+    headers
   };
+  if (method === "POST" || method === "PUT") {
+    init.body = body;
+  }
+  if (method === "DELETE") {
+    clientUrl = `${clientUrl}/${body}`;
+  }
   const req = new Request(clientUrl, init);
   return await config.handlers[m](req);
 }
 
+// src/api/routes/tenants/[tenantId]/invites/GET.ts
+async function GET4(config, init) {
+  const yurl = new URL(init.request.url);
+  const [, tenantId] = yurl.pathname.split("/").reverse();
+  if (!tenantId) {
+    return new Response(null, { status: 404 });
+  }
+  init.method = "GET";
+  const url = `${apiRoutes(config.apiUrl).INVITES(tenantId)}`;
+  return await request(url, init, config);
+}
+
+// src/api/routes/tenants/[tenantId]/invites/index.ts
+var key5 = "INVITES";
+async function route5(request2, config) {
+  switch (request2.method) {
+    case "GET":
+      return await GET4(config, { request: request2 });
+    default:
+      return new Response("method not allowed", { status: 405 });
+  }
+}
+function matches5(configRoutes, request2) {
+  const url = new URL(request2.url);
+  const [, tenantId] = url.pathname.split("/").reverse();
+  const route20 = configRoutes[key5].replace("{tenantId}", tenantId);
+  return url.pathname.endsWith(route20);
+}
+async function fetchInvites(config) {
+  const { tenantId, headers } = ctx.get();
+  if (!tenantId) {
+    throw new Error(
+      "Unable to fetch invites for the tenant, the tenantId context is missing. Call nile.setContext({ tenantId })"
+    );
+  }
+  if (!isUUID(tenantId)) {
+    config.logger("fetchInvites").warn(
+      "nile.tenantId is not a valid UUID. This may lead to unexpected behavior in your application."
+    );
+  }
+  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants/{tenantId}/invites" /* INVITES */.replace("{tenantId}", tenantId)}`;
+  const req = new Request(clientUrl, { headers });
+  return await config.handlers.GET(req);
+}
+
 // src/api/routes/tenants/GET.ts
-async function GET4(config, session, init) {
-  let url = `${apiRoutes(config).USER_TENANTS(session.id)}`;
+async function GET5(config, session, init) {
+  let url = `${apiRoutes(config.apiUrl).USER_TENANTS(session.id)}`;
   if (typeof session === "object" && "user" in session && session.user) {
-    url = `${apiRoutes(config).USER_TENANTS(session.user.id)}`;
+    url = `${apiRoutes(config.apiUrl).USER_TENANTS(session.user.id)}`;
   }
-  const res = await request(url, init, config);
-  return res;
+  return await request(url, init, config);
 }
 
 // src/api/routes/tenants/[tenantId]/GET.ts
-async function GET5(config, init, log) {
+async function GET6(config, init, log) {
   const yurl = new URL(init.request.url);
   const [tenantId] = yurl.pathname.split("/").reverse();
   if (!tenantId) {
@@ -548,7 +954,7 @@ async function GET5(config, init, log) {
     return new Response(null, { status: 404 });
   }
   init.method = "GET";
-  const url = `${apiRoutes(config).TENANT(tenantId)}`;
+  const url = `${apiRoutes(config.apiUrl).TENANT(tenantId)}`;
   return await request(url, init, config);
 }
 
@@ -560,12 +966,12 @@ async function DELETE2(config, init) {
     return new Response(null, { status: 404 });
   }
   init.method = "DELETE";
-  const url = `${apiRoutes(config).TENANT(tenantId)}`;
+  const url = `${apiRoutes(config.apiUrl).TENANT(tenantId)}`;
   return await request(url, init, config);
 }
 
 // src/api/routes/tenants/[tenantId]/PUT.ts
-async function PUT3(config, init) {
+async function PUT4(config, init) {
   const yurl = new URL(init.request.url);
   const [tenantId] = yurl.pathname.split("/").reverse();
   if (!tenantId) {
@@ -573,25 +979,22 @@ async function PUT3(config, init) {
   }
   init.body = init.request.body;
   init.method = "PUT";
-  const url = `${apiRoutes(config).TENANT(tenantId)}`;
+  const url = `${apiRoutes(config.apiUrl).TENANT(tenantId)}`;
   return await request(url, init, config);
 }
 
 // src/api/routes/tenants/POST.ts
-async function POST3(config, init) {
+async function POST4(config, init) {
   init.body = init.request.body;
   init.method = "POST";
-  const url = `${apiRoutes(config).TENANTS}`;
+  const url = `${apiRoutes(config.apiUrl).TENANTS}`;
   return await request(url, init, config);
 }
 
 // src/api/routes/tenants/index.ts
-var key4 = "TENANTS";
-async function route4(request2, config) {
-  const { info } = Logger(
-    { ...config, debug: config.debug },
-    `[ROUTES][${key4}]`
-  );
+var key6 = "TENANTS";
+async function route6(request2, config) {
+  const { info } = config.logger(`[ROUTES][${key6}]`);
   const session = await auth(request2, config);
   if (!session) {
     info("401");
@@ -601,27 +1004,28 @@ async function route4(request2, config) {
   switch (request2.method) {
     case "GET":
       if (isUUID(possibleTenantId)) {
-        return await GET5(config, { request: request2 }, info);
+        return await GET6(config, { request: request2 }, info);
       }
-      return await GET4(config, session, { request: request2 });
+      return await GET5(config, session, { request: request2 });
     case "POST":
-      return await POST3(config, { request: request2 });
+      return await POST4(config, { request: request2 });
     case "DELETE":
       return await DELETE2(config, { request: request2 });
     case "PUT":
-      return await PUT3(config, { request: request2 });
+      return await PUT4(config, { request: request2 });
     default:
       return new Response("method not allowed", { status: 405 });
   }
 }
-function matches4(configRoutes, request2) {
-  return urlMatches(request2.url, configRoutes[key4]);
+function matches6(configRoutes, request2) {
+  return urlMatches(request2.url, configRoutes[key6]);
 }
 async function fetchTenants(config, method, body) {
+  const { headers } = ctx.get();
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants" /* TENANTS */}`;
   const init = {
     method,
-    headers: config.headers
+    headers
   };
   {
     init.body = body;
@@ -630,21 +1034,22 @@ async function fetchTenants(config, method, body) {
   return await config.handlers.POST(req);
 }
 async function fetchTenant(config, method, body) {
-  if (!config.tenantId) {
+  const { headers, tenantId } = ctx.get();
+  if (!tenantId) {
     throw new Error(
-      'Unable to fetch tenant, the tenantId context is missing. Call nile.setContext({ tenantId }), set nile.tenantId = "tenantId", or add it to the function call'
+      "Unable to fetch tenants, the tenantId context is missing. Call nile.setContext({ tenantId })"
     );
   }
-  if (!isUUID(config.tenantId) && config.logger?.warn) {
-    config.logger?.warn(
+  if (!isUUID(tenantId)) {
+    config.logger("fetch tenant").warn(
       "nile.tenantId is not a valid UUID. This may lead to unexpected behavior in your application."
     );
   }
-  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants/{tenantId}" /* TENANT */.replace("{tenantId}", config.tenantId)}`;
+  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants/{tenantId}" /* TENANT */.replace("{tenantId}", tenantId)}`;
   const m = method ?? "GET";
   const init = {
     method: m,
-    headers: config.headers
+    headers
   };
   if (m === "PUT") {
     init.body = body;
@@ -653,36 +1058,33 @@ async function fetchTenant(config, method, body) {
   return await config.handlers[m](req);
 }
 async function fetchTenantsByUser(config) {
-  if (config.logger?.warn) {
-    if (!config.userId) {
-      config.logger?.warn(
-        "nile.userId is not set. The call will still work for the API, but the database context is not set properly and may lead to unexpected behavior in your application."
-      );
-    } else if (!isUUID(config.userId)) {
-      config.logger?.warn(
-        "nile.userId is not a valid UUID. This may lead to unexpected behavior in your application."
-      );
-    }
+  const { warn: warn2 } = config.logger(" fetchTenantsByUser ");
+  const { userId, headers } = ctx.get();
+  if (!userId) {
+    warn2(
+      "nile.userId is not set. The call will still work for the API, but the database context is not set properly and may lead to unexpected behavior in your application."
+    );
+  } else if (!isUUID(userId)) {
+    warn2(
+      "nile.userId is not a valid UUID. This may lead to unexpected behavior in your application."
+    );
   }
-  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/users/{userId}/tenants" /* USER_TENANTS */.replace(
-    "{userId}",
-    config.userId ?? "WARN_NOT_SET"
-  )}`;
-  const req = new Request(clientUrl, { headers: config.headers });
+  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants" /* TENANTS */}`;
+  const req = new Request(clientUrl, { headers });
   return await config.handlers.GET(req);
 }
 
 // src/api/routes/auth/signin.ts
-var key5 = "SIGNIN";
-async function route5(req, config) {
-  let url = proxyRoutes(config)[key5];
+var key7 = "SIGNIN";
+async function route7(req, config) {
+  let url = proxyRoutes(config.apiUrl)[key7];
   const init = {
     method: req.method,
     headers: req.headers
   };
   if (req.method === "POST") {
     const [provider] = new URL(req.url).pathname.split("/").reverse();
-    url = `${proxyRoutes(config)[key5]}/${provider}`;
+    url = `${proxyRoutes(config.apiUrl)[key7]}/${provider}`;
   }
   const passThroughUrl = new URL(req.url);
   const params = new URLSearchParams(passThroughUrl.search);
@@ -690,23 +1092,24 @@ async function route5(req, config) {
   const res = await request(url, { ...init, request: req }, config);
   return res;
 }
-function matches5(configRoutes, request2) {
-  return urlMatches(request2.url, configRoutes[key5]);
+function matches7(configRoutes, request2) {
+  return urlMatches(request2.url, configRoutes[key7]);
 }
 async function fetchSignIn(config, provider, body) {
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/auth/signin" /* SIGNIN */}/${provider}`;
+  const { headers } = ctx.get();
   const req = new Request(clientUrl, {
     method: "POST",
-    headers: config.headers,
-    body
+    body,
+    headers
   });
   return await config.handlers.POST(req);
 }
 
 // src/api/routes/auth/session.ts
-async function route6(req, config) {
+async function route8(req, config) {
   return request(
-    proxyRoutes(config).SESSION,
+    proxyRoutes(config.apiUrl).SESSION,
     {
       method: req.method,
       request: req
@@ -714,22 +1117,23 @@ async function route6(req, config) {
     config
   );
 }
-function matches6(configRoutes, request2) {
+function matches8(configRoutes, request2) {
   return urlMatches(request2.url, configRoutes.SESSION);
 }
 async function fetchSession(config) {
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/auth/session" /* SESSION */}`;
+  const { headers } = ctx.get();
   const req = new Request(clientUrl, {
     method: "GET",
-    headers: config.headers
+    headers
   });
   return await config.handlers.GET(req);
 }
 
 // src/api/routes/auth/providers.ts
-async function route7(req, config) {
+async function route9(req, config) {
   return request(
-    proxyRoutes(config).PROVIDERS,
+    proxyRoutes(config.apiUrl).PROVIDERS,
     {
       method: req.method,
       request: req
@@ -737,22 +1141,23 @@ async function route7(req, config) {
     config
   );
 }
-function matches7(configRoutes, request2) {
+function matches9(configRoutes, request2) {
   return urlMatches(request2.url, configRoutes.PROVIDERS);
 }
 async function fetchProviders(config) {
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/auth/providers" /* PROVIDERS */}`;
+  const { headers } = ctx.get();
   const req = new Request(clientUrl, {
     method: "GET",
-    headers: config.headers
+    headers
   });
   return await config.handlers.GET(req);
 }
 
 // src/api/routes/auth/csrf.ts
-async function route8(req, config) {
+async function route10(req, config) {
   return request(
-    proxyRoutes(config).CSRF,
+    proxyRoutes(config.apiUrl).CSRF,
     {
       method: req.method,
       request: req
@@ -760,30 +1165,28 @@ async function route8(req, config) {
     config
   );
 }
-function matches8(configRoutes, request2) {
+function matches10(configRoutes, request2) {
   return urlMatches(request2.url, configRoutes.CSRF);
 }
 async function fetchCsrf(config) {
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/auth/csrf" /* CSRF */}`;
+  const { headers } = ctx.get();
   const req = new Request(clientUrl, {
     method: "GET",
-    headers: config.headers
+    headers
   });
   return await config.handlers.GET(req);
 }
 
 // src/api/routes/auth/callback.ts
-var key6 = "CALLBACK";
-async function route9(req, config) {
-  const { error } = Logger(
-    { ...config, debug: config.debug },
-    `[ROUTES][${key6}]`
-  );
+var key8 = "CALLBACK";
+async function route11(req, config) {
+  const { error } = config.logger(`[ROUTES][${key8}]`);
   const [provider] = new URL(req.url).pathname.split("/").reverse();
   try {
     const passThroughUrl = new URL(req.url);
     const params = new URLSearchParams(passThroughUrl.search);
-    const url = `${proxyRoutes(config)[key6]}/${provider}${params.toString() !== "" ? `?${params.toString()}` : ""}`;
+    const url = `${proxyRoutes(config.apiUrl)[key8]}/${provider}${params.toString() !== "" ? `?${params.toString()}` : ""}`;
     const res = await request(
       url,
       {
@@ -794,7 +1197,7 @@ async function route9(req, config) {
     ).catch((e) => {
       error("an error as occurred", e);
     });
-    const location = res?.headers.get("location");
+    const location = res?.headers?.get("location");
     if (location) {
       return new Response(res?.body, {
         status: 302,
@@ -810,52 +1213,54 @@ async function route9(req, config) {
   }
   return new Response("An unexpected error has occurred.", { status: 400 });
 }
-function matches9(configRoutes, request2) {
+function matches11(configRoutes, request2) {
   return urlMatches(request2.url, configRoutes.CALLBACK);
 }
 async function fetchCallback(config, provider, body, request2, method = "POST") {
+  const { headers } = ctx.get();
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/auth/callback" /* CALLBACK */}/${provider}${request2 ? `?${new URL(request2.url).searchParams}` : ""}`;
   const req = new Request(clientUrl, {
     method,
-    headers: config.headers,
+    headers,
     body
   });
   return await config.handlers.POST(req);
 }
 
 // src/api/routes/auth/signout.ts
-var key7 = "SIGNOUT";
-async function route10(request2, config) {
-  let url = proxyRoutes(config)[key7];
+var key9 = "SIGNOUT";
+async function route12(request2, config) {
+  let url = proxyRoutes(config.apiUrl)[key9];
   const init = {
     method: request2.method
   };
   if (request2.method === "POST") {
     init.body = request2.body;
     const [provider] = new URL(request2.url).pathname.split("/").reverse();
-    url = `${proxyRoutes(config)[key7]}${provider !== "signout" ? `/${provider}` : ""}`;
+    url = `${proxyRoutes(config.apiUrl)[key9]}${provider !== "signout" ? `/${provider}` : ""}`;
   }
   const res = await request(url, { ...init, request: request2 }, config);
   return res;
 }
-function matches10(configRoutes, request2) {
-  return urlMatches(request2.url, configRoutes[key7]);
+function matches12(configRoutes, request2) {
+  return urlMatches(request2.url, configRoutes[key9]);
 }
 async function fetchSignOut(config, body) {
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/auth/signout" /* SIGNOUT */}`;
+  const { headers } = ctx.get();
   const req = new Request(clientUrl, {
     method: "POST",
     body,
-    headers: config.headers
+    headers
   });
   return await config.handlers.POST(req);
 }
 
 // src/api/routes/auth/error.ts
-var key8 = "ERROR";
-async function route11(req, config) {
+var key10 = "ERROR";
+async function route13(req, config) {
   return request(
-    proxyRoutes(config)[key8],
+    proxyRoutes(config.apiUrl)[key10],
     {
       method: req.method,
       request: req
@@ -863,15 +1268,15 @@ async function route11(req, config) {
     config
   );
 }
-function matches11(configRoutes, request2) {
-  return urlMatches(request2.url, configRoutes[key8]);
+function matches13(configRoutes, request2) {
+  return urlMatches(request2.url, configRoutes[key10]);
 }
 
 // src/api/routes/auth/verify-request.ts
-var key9 = "VERIFY_REQUEST";
-async function route12(req, config) {
+var key11 = "VERIFY_REQUEST";
+async function route14(req, config) {
   return request(
-    proxyRoutes(config)[key9],
+    proxyRoutes(config.apiUrl)[key11],
     {
       method: req.method,
       request: req
@@ -879,14 +1284,14 @@ async function route12(req, config) {
     config
   );
 }
-function matches12(configRoutes, request2) {
-  return urlMatches(request2.url, configRoutes[key9]);
+function matches14(configRoutes, request2) {
+  return urlMatches(request2.url, configRoutes[key11]);
 }
 
 // src/api/routes/auth/password-reset.ts
-var key10 = "PASSWORD_RESET";
-async function route13(req, config) {
-  const url = proxyRoutes(config)[key10];
+var key12 = "PASSWORD_RESET";
+async function route15(req, config) {
+  const url = proxyRoutes(config.apiUrl)[key12];
   const res = await request(
     url,
     {
@@ -895,7 +1300,7 @@ async function route13(req, config) {
     },
     config
   );
-  const location = res?.headers.get("location");
+  const location = res?.headers?.get("location");
   if (location) {
     return new Response(res?.body, {
       status: 302,
@@ -907,7 +1312,7 @@ async function route13(req, config) {
     headers: res?.headers
   });
 }
-function matches13(configRoutes, request2) {
+function matches15(configRoutes, request2) {
   return urlMatches(request2.url, configRoutes.PASSWORD_RESET);
 }
 async function fetchResetPassword(config, method, body, params, useJson = true) {
@@ -915,10 +1320,11 @@ async function fetchResetPassword(config, method, body, params, useJson = true)
   if (useJson) {
     authParams?.set("json", "true");
   }
+  const { headers } = ctx.get();
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/auth/reset-password" /* PASSWORD_RESET */}?${authParams?.toString()}`;
   const init = {
     method,
-    headers: config.headers
+    headers
   };
   if (body && method !== "GET") {
     init.body = body;
@@ -928,9 +1334,9 @@ async function fetchResetPassword(config, method, body, params, useJson = true)
 }
 
 // src/api/routes/auth/verify-email.ts
-var key11 = "VERIFY_EMAIL";
-async function route14(req, config) {
-  const url = proxyRoutes(config)[key11];
+var key13 = "VERIFY_EMAIL";
+async function route16(req, config) {
+  const url = proxyRoutes(config.apiUrl)[key13];
   const res = await request(
     url,
     {
@@ -939,7 +1345,7 @@ async function route14(req, config) {
     },
     config
   );
-  const location = res?.headers.get("location");
+  const location = res?.headers?.get("location");
   if (location) {
     return new Response(res?.body, {
       status: 302,
@@ -951,14 +1357,15 @@ async function route14(req, config) {
     headers: res?.headers
   });
 }
-function matches14(configRoutes, request2) {
-  return urlMatches(request2.url, configRoutes[key11]);
+function matches16(configRoutes, request2) {
+  return urlMatches(request2.url, configRoutes[key13]);
 }
 async function fetchVerifyEmail(config, method, body) {
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/auth/verify-email" /* VERIFY_EMAIL */}`;
+  const { headers } = ctx.get();
   const init = {
     method,
-    headers: config.headers
+    headers
   };
   if (body) {
     init.body = body;
@@ -969,89 +1376,110 @@ async function fetchVerifyEmail(config, method, body) {
 
 // src/api/handlers/GET.ts
 function GETTER(configRoutes, config) {
-  const { info, warn } = Logger(config, "[GET MATCHER]");
-  return async function GET6(req) {
-    if (matches(configRoutes, req)) {
-      info("matches me");
+  const { error, info, warn: warn2 } = config.logger("[GET MATCHER]");
+  return async function GET7(...params) {
+    const handledRequest = await config.extensionCtx?.runExtensions(
+      "onHandleRequest" /* onHandleRequest */,
+      config,
+      params
+    );
+    if (handledRequest) {
+      return handledRequest;
+    }
+    const req = params[0] instanceof Request ? params[0] : null;
+    if (!req) {
+      error("Proxy requests failed, a Request object was not passed.");
+      return;
+    }
+    if (matches(configRoutes, req)) {
+      info("matches me");
       return route(req, config);
     }
+    if (matches5(configRoutes, req)) {
+      info("matches tenant invites");
+      return route5(req, config);
+    }
+    if (matches4(configRoutes, req)) {
+      info("matches invite");
+      return route4(req, config);
+    }
     if (matches3(configRoutes, req)) {
       info("matches tenant users");
       return route3(req, config);
     }
+    if (matches6(configRoutes, req)) {
+      info("matches tenants");
+      return route6(req, config);
+    }
     if (matches2(configRoutes, req)) {
       info("matches users");
       return route2(req, config);
     }
-    if (matches4(configRoutes, req)) {
-      info("matches tenants");
-      return route4(req, config);
-    }
-    if (matches6(configRoutes, req)) {
+    if (matches8(configRoutes, req)) {
       info("matches session");
-      return route6(req, config);
+      return route8(req, config);
     }
-    if (matches5(configRoutes, req)) {
+    if (matches7(configRoutes, req)) {
       info("matches signin");
-      return route5(req, config);
+      return route7(req, config);
     }
-    if (matches7(configRoutes, req)) {
+    if (matches9(configRoutes, req)) {
       info("matches providers");
-      return route7(req, config);
+      return route9(req, config);
     }
-    if (matches8(configRoutes, req)) {
+    if (matches10(configRoutes, req)) {
       info("matches csrf");
-      return route8(req, config);
+      return route10(req, config);
     }
-    if (matches13(configRoutes, req)) {
+    if (matches15(configRoutes, req)) {
       info("matches password reset");
-      return route13(req, config);
+      return route15(req, config);
     }
-    if (matches9(configRoutes, req)) {
+    if (matches11(configRoutes, req)) {
       info("matches callback");
-      return route9(req, config);
-    }
-    if (matches10(configRoutes, req)) {
-      info("matches signout");
-      return route10(req, config);
+      return route11(req, config);
     }
     if (matches12(configRoutes, req)) {
-      info("matches verify-request");
+      info("matches signout");
       return route12(req, config);
     }
     if (matches14(configRoutes, req)) {
-      info("matches verify-email");
+      info("matches verify-request");
       return route14(req, config);
     }
-    if (matches11(configRoutes, req)) {
+    if (matches16(configRoutes, req)) {
+      info("matches verify-email");
+      return route16(req, config);
+    }
+    if (matches13(configRoutes, req)) {
       info("matches error");
-      return route11(req, config);
+      return route13(req, config);
     }
-    warn(`No GET routes matched ${req.url}`);
+    warn2(`No GET routes matched ${req.url}`);
     return new Response(null, { status: 404 });
   };
 }
 
 // src/api/routes/signup/POST.ts
-async function POST4(config, init) {
+async function POST5(config, init) {
   init.body = init.request.body;
   init.method = "POST";
-  const url = `${apiRoutes(config).SIGNUP}`;
+  const url = `${apiRoutes(config.apiUrl).SIGNUP}`;
   return await request(url, init, config);
 }
 
 // src/api/routes/signup/index.tsx
-var key12 = "SIGNUP";
-async function route15(request2, config) {
+var key14 = "SIGNUP";
+async function route17(request2, config) {
   switch (request2.method) {
     case "POST":
-      return await POST4(config, { request: request2 });
+      return await POST5(config, { request: request2 });
     default:
       return new Response("method not allowed", { status: 405 });
   }
 }
-function matches15(configRoutes, request2) {
-  return urlMatches(request2.url, configRoutes[key12]);
+function matches17(configRoutes, request2) {
+  return urlMatches(request2.url, configRoutes[key14]);
 }
 async function fetchSignUp(config, payload) {
   const { body, params } = payload ?? {};
@@ -1063,9 +1491,10 @@ async function fetchSignUp(config, payload) {
     q.set("tenantId", params.tenantId);
   }
   const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/signup" /* SIGNUP */}${q.size > 0 ? `?${q}` : ""}`;
+  const { headers } = ctx.get();
   const req = new Request(clientUrl, {
     method: "POST",
-    headers: config.headers,
+    headers,
     body
   });
   return await config.handlers.POST(req);
@@ -1073,8 +1502,21 @@ async function fetchSignUp(config, payload) {
 
 // src/api/handlers/POST.ts
 function POSTER(configRoutes, config) {
-  const { info, warn, error } = Logger(config, "[POST MATCHER]");
-  return async function POST5(req) {
+  const { info, warn: warn2, error } = config.logger("[POST MATCHER]");
+  return async function POST6(...params) {
+    const handledRequest = await config.extensionCtx?.runExtensions(
+      "onHandleRequest" /* onHandleRequest */,
+      config,
+      params
+    );
+    if (handledRequest) {
+      return handledRequest;
+    }
+    const req = params[0] instanceof Request ? params[0] : null;
+    if (!req) {
+      error("Proxy requests failed, a Request object was not passed.");
+      return;
+    }
     if (matchesLog(configRoutes, req)) {
       try {
         const json = await req.clone().json();
@@ -1088,51 +1530,51 @@ function POSTER(configRoutes, config) {
       info("matches tenant users");
       return route3(req, config);
     }
-    if (matches15(configRoutes, req)) {
-      info("matches signup");
-      return route15(req, config);
-    }
-    if (matches2(configRoutes, req)) {
-      info("matches users");
-      return route2(req, config);
-    }
     if (matches4(configRoutes, req)) {
-      info("matches tenants");
+      info("matches tenant invite");
       return route4(req, config);
     }
+    if (matches17(configRoutes, req)) {
+      info("matches signup");
+      return route17(req, config);
+    }
     if (matches6(configRoutes, req)) {
-      info("matches session");
+      info("matches tenants");
       return route6(req, config);
     }
-    if (matches5(configRoutes, req)) {
+    if (matches8(configRoutes, req)) {
+      info("matches session");
+      return route8(req, config);
+    }
+    if (matches7(configRoutes, req)) {
       info("matches signin");
-      return route5(req, config);
+      return route7(req, config);
     }
-    if (matches13(configRoutes, req)) {
+    if (matches15(configRoutes, req)) {
       info("matches password reset");
-      return route13(req, config);
+      return route15(req, config);
     }
-    if (matches7(configRoutes, req)) {
+    if (matches9(configRoutes, req)) {
       info("matches providers");
-      return route7(req, config);
+      return route9(req, config);
     }
-    if (matches8(configRoutes, req)) {
+    if (matches10(configRoutes, req)) {
       info("matches csrf");
-      return route8(req, config);
+      return route10(req, config);
     }
-    if (matches9(configRoutes, req)) {
+    if (matches11(configRoutes, req)) {
       info("matches callback");
-      return route9(req, config);
+      return route11(req, config);
     }
-    if (matches10(configRoutes, req)) {
+    if (matches12(configRoutes, req)) {
       info("matches signout");
-      return route10(req, config);
+      return route12(req, config);
     }
-    if (matches14(configRoutes, req)) {
+    if (matches16(configRoutes, req)) {
       info("matches verify-email");
-      return route14(req, config);
+      return route16(req, config);
     }
-    warn(`No POST routes matched ${req.url}`);
+    warn2(`No POST routes matched ${req.url}`);
     return new Response(null, { status: 404 });
   };
 }
@@ -1141,31 +1583,24 @@ function POSTER(configRoutes, config) {
 async function DELETE3(config, init) {
   const yurl = new URL(init.request.url);
   const [, userId, , tenantId] = yurl.pathname.split("/").reverse();
-  config.tenantId = tenantId;
-  config.userId = userId;
   init.method = "DELETE";
-  const url = `${apiRoutes(config).TENANT_USER}/link`;
+  const url = `${apiRoutes(config.apiUrl).TENANT_USER(tenantId, userId)}/link`;
   return await request(url, init, config);
 }
 
 // src/api/routes/tenants/[tenantId]/users/[userId]/PUT.ts
-async function PUT4(config, init) {
+async function PUT5(config, init) {
   const yurl = new URL(init.request.url);
   const [, userId, , tenantId] = yurl.pathname.split("/").reverse();
-  config.tenantId = tenantId;
-  config.userId = userId;
   init.method = "PUT";
-  const url = `${apiRoutes(config).TENANT_USER}/link`;
+  const url = `${apiRoutes(config.apiUrl).TENANT_USER(tenantId, userId)}/link`;
   return await request(url, init, config);
 }
 
 // src/api/routes/tenants/[tenantId]/users/[userId]/index.ts
-var key13 = "TENANT_USER";
-async function route16(request2, config) {
-  const { info } = Logger(
-    { ...config, debug: config.debug },
-    `[ROUTES][${key13}]`
-  );
+var key15 = "TENANT_USER";
+async function route18(request2, config) {
+  const { info } = config.logger(`[ROUTES][${key15}]`);
   const session = await auth(request2, config);
   if (!session) {
     info("401");
@@ -1179,113 +1614,170 @@ async function route16(request2, config) {
   }
   switch (request2.method) {
     case "PUT":
-      return await PUT4(config, { request: request2 });
+      return await PUT5(config, { request: request2 });
     case "DELETE":
       return await DELETE3(config, { request: request2 });
     default:
       return new Response("method not allowed", { status: 405 });
   }
 }
-function matches16(configRoutes, request2) {
+function matches18(configRoutes, request2) {
   const url = new URL(request2.url);
   const [, userId, possibleTenantId, tenantId] = url.pathname.split("/").reverse();
-  let route17 = configRoutes[key13].replace("{tenantId}", tenantId).replace("{userId}", userId);
+  let route20 = configRoutes[key15].replace("{tenantId}", tenantId).replace("{userId}", userId);
   if (userId === "users") {
-    route17 = configRoutes[key13].replace("{tenantId}", possibleTenantId);
+    route20 = configRoutes[key15].replace("{tenantId}", possibleTenantId);
   }
-  return urlMatches(request2.url, route17);
+  return urlMatches(request2.url, route20);
 }
 async function fetchTenantUser(config, method) {
-  if (!config.tenantId) {
+  const { headers, tenantId, userId } = ctx.get();
+  const action = method === "PUT" ? "add" : "delete";
+  if (!tenantId) {
     throw new Error(
-      "The tenantId context is missing. Call nile.setContext({ tenantId })"
+      `Unable to ${action} user to the tenant, the tenantId context is missing. Use nile.withContext({ tenantId })`
     );
   }
-  if (!config.userId) {
+  if (!userId) {
     throw new Error(
-      "the userId context is missing. Call nile.setContext({ userId })"
+      `Unable to ${action} user to tenant. The userId context is missing. Use nile.withContext({ userId })`
     );
   }
-  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants/{tenantId}/users/{userId}" /* TENANT_USER */.replace(
-    "{tenantId}",
-    config.tenantId
-  ).replace("{userId}", config.userId)}/link`;
+  const clientUrl = `${config.serverOrigin}${config.routePrefix}${"/tenants/{tenantId}/users/{userId}" /* TENANT_USER */.replace("{tenantId}", tenantId).replace(
+    "{userId}",
+    userId
+  )}/link`;
   const req = new Request(clientUrl, {
-    headers: config.headers,
+    headers,
     method
   });
   return await config.handlers[method](req);
 }
 
+// src/api/routes/tenants/[tenantId]/invite/[inviteId]/DELETE.ts
+async function DELETE4(config, init) {
+  const yurl = new URL(init.request.url);
+  const [inviteId, , tenantId] = yurl.pathname.split("/").reverse();
+  if (!tenantId) {
+    return new Response(null, { status: 404 });
+  }
+  init.method = "DELETE";
+  const url = `${apiRoutes(config.apiUrl).INVITE(tenantId)}/${inviteId}`;
+  return await request(url, init, config);
+}
+
+// src/api/routes/tenants/[tenantId]/invite/[inviteId]/index.ts
+var key16 = "INVITE";
+async function route19(request2, config) {
+  switch (request2.method) {
+    case "DELETE":
+      return await DELETE4(config, { request: request2 });
+    default:
+      return new Response("method not allowed", { status: 405 });
+  }
+}
+function matches19(configRoutes, request2) {
+  const url = new URL(request2.url);
+  const [inviteId, , tenantId] = url.pathname.split("/").reverse();
+  const route20 = configRoutes[key16].replace("{tenantId}", tenantId).replace("{inviteId}", inviteId);
+  return urlMatches(request2.url, route20);
+}
+
 // src/api/handlers/DELETE.ts
 function DELETER(configRoutes, config) {
-  const { info, warn } = Logger(config, "[DELETE MATCHER]");
-  return async function DELETE4(req) {
-    if (matches16(configRoutes, req)) {
-      info("matches tenant user");
-      return route16(req, config);
+  const { error, info, warn: warn2 } = config.logger("[DELETE MATCHER]");
+  return async function DELETE5(...params) {
+    const handledRequest = await config.extensionCtx?.runExtensions(
+      "onHandleRequest" /* onHandleRequest */,
+      config,
+      params
+    );
+    if (handledRequest) {
+      return handledRequest;
     }
-    if (matches3(configRoutes, req)) {
-      info("matches tenant users");
-      return route3(req, config);
+    const req = params[0] instanceof Request ? params[0] : null;
+    if (!req) {
+      error("Proxy requests failed, a Request object was not passed.");
+      return;
     }
-    if (matches4(configRoutes, req)) {
+    if (matches19(configRoutes, req)) {
+      info("matches tenant invite id");
+      return route19(req, config);
+    }
+    if (matches18(configRoutes, req)) {
+      info("matches tenant user");
+      return route18(req, config);
+    }
+    if (matches6(configRoutes, req)) {
       info("matches tenants");
-      return route4(req, config);
+      return route6(req, config);
     }
     if (matches(configRoutes, req)) {
       info("matches me");
       return route(req, config);
     }
-    warn("No DELETE routes matched");
+    warn2("No DELETE routes matched");
     return new Response(null, { status: 404 });
   };
 }
 
 // src/api/handlers/PUT.ts
 function PUTER(configRoutes, config) {
-  const { info, warn } = Logger(config, "[PUT MATCHER]");
-  return async function PUT5(req) {
-    if (matches16(configRoutes, req)) {
+  const { error, info, warn: warn2 } = config.logger("[PUT MATCHER]");
+  return async function PUT6(...params) {
+    const handledRequest = await config.extensionCtx?.runExtensions(
+      "onHandleRequest" /* onHandleRequest */,
+      config,
+      params
+    );
+    if (handledRequest) {
+      return handledRequest;
+    }
+    const req = params[0] instanceof Request ? params[0] : null;
+    if (!req) {
+      error("Proxy requests failed, a Request object was not passed.");
+      return;
+    }
+    if (matches4(configRoutes, req)) {
+      info("matches tenant invite");
+      return route4(req, config);
+    }
+    if (matches18(configRoutes, req)) {
       info("matches tenant user");
-      return route16(req, config);
+      return route18(req, config);
     }
     if (matches3(configRoutes, req)) {
       info("matches tenant users");
       return route3(req, config);
     }
-    if (matches2(configRoutes, req)) {
-      info("matches users");
-      return route2(req, config);
-    }
     if (matches(configRoutes, req)) {
       info("matches me");
       return route(req, config);
     }
-    if (matches4(configRoutes, req)) {
+    if (matches6(configRoutes, req)) {
       info("matches tenants");
-      return route4(req, config);
+      return route6(req, config);
     }
-    if (matches13(configRoutes, req)) {
+    if (matches15(configRoutes, req)) {
       info("matches reset password");
-      return route13(req, config);
+      return route15(req, config);
     }
-    warn("No PUT routes matched");
+    warn2("No PUT routes matched");
     return new Response(null, { status: 404 });
   };
 }
 
 // src/api/handlers/index.ts
 function Handlers(configRoutes, config) {
-  const GET6 = GETTER(configRoutes, config);
-  const POST5 = POSTER(configRoutes, config);
-  const DELETE4 = DELETER(configRoutes, config);
-  const PUT5 = PUTER(configRoutes, config);
+  const GET7 = GETTER(configRoutes, config);
+  const POST6 = POSTER(configRoutes, config);
+  const DELETE5 = DELETER(configRoutes, config);
+  const PUT6 = PUTER(configRoutes, config);
   return {
-    GET: GET6,
-    POST: POST5,
-    DELETE: DELETE4,
-    PUT: PUT5
+    GET: GET7,
+    POST: POST6,
+    DELETE: DELETE5,
+    PUT: PUT6
   };
 }
 var getApiUrl = (cfg) => {
@@ -1318,15 +1810,16 @@ var getSecureCookies = (cfg) => {
   return void 0;
 };
 var getUsername = (cfg) => {
-  const { config, logger } = cfg;
-  const { info } = Logger(config, "[username]");
+  const { config } = cfg;
+  const logger = config.logger;
+  const { info } = logger();
   if (config?.user) {
-    logger && info(`${logger}[config] ${config.user}`);
+    info(`[config] ${config.user}`);
     return String(config?.user);
   }
   const user = stringCheck(process.env.NILEDB_USER);
   if (user) {
-    logger && info(`${logger}[NILEDB_USER] ${user}`);
+    info(`[NILEDB_USER] ${user}`);
     return user;
   }
   const pg2 = stringCheck(process.env.NILEDB_POSTGRES_URL);
@@ -1344,16 +1837,16 @@ var getUsername = (cfg) => {
   );
 };
 var getPassword = (cfg) => {
-  const { config, logger } = cfg;
+  const { config } = cfg;
+  const logger = config.logger;
   const log = logProtector(logger);
-  const { info } = Logger(config, "[password]");
   if (stringCheck(config?.password)) {
-    log && info(`${logger}[config] ***`);
+    log && log("[config]").info("***");
     return String(config?.password);
   }
   const pass = stringCheck(process.env.NILEDB_PASSWORD);
   if (pass) {
-    logger && info(`${logger}[NILEDB_PASSWORD] ***`);
+    logger("[NILEDB_PASSWORD]").info("***");
     return pass;
   }
   const pg2 = stringCheck(process.env.NILEDB_POSTGRES_URL);
@@ -1371,15 +1864,15 @@ var getPassword = (cfg) => {
   );
 };
 var getDatabaseName = (cfg) => {
-  const { config, logger } = cfg;
-  const { info } = Logger(config, "[databaseName]");
+  const { config } = cfg;
+  const { info } = config.logger("[databaseName]");
   if (stringCheck(config?.databaseName)) {
-    logger && info(`${logger}[config] ${config?.databaseName}`);
+    info(`[config] ${config?.databaseName}`);
     return String(config?.databaseName);
   }
   const name = stringCheck(process.env.NILEDB_NAME);
   if (name) {
-    logger && info(`${logger}[NILEDB_NAME] ${name}`);
+    info(`[NILEDB_NAME] ${name}`);
     return name;
   }
   if (process.env.NILEDB_POSTGRES_URL) {
@@ -1394,50 +1887,52 @@ var getDatabaseName = (cfg) => {
   );
 };
 var getTenantId = (cfg) => {
-  const { config, logger } = cfg;
-  const { info } = Logger(config, "[tenantId]");
+  const { config } = cfg;
+  const { info } = config.logger("[tenantId]");
   if (stringCheck(config?.tenantId)) {
-    logger && info(`${logger}[config] ${config?.tenantId}`);
+    info(`[config] ${config?.tenantId}`);
     return String(config?.tenantId);
   }
   if (stringCheck(process.env.NILEDB_TENANT)) {
-    logger && info(`${logger}[NILEDB_TENANT] ${process.env.NILEDB_TENANT}`);
+    info(`[NILEDB_TENANT] ${process.env.NILEDB_TENANT}`);
     return String(process.env.NILEDB_TENANT);
   }
   return null;
 };
 function getDbHost(cfg) {
-  const { config, logger } = cfg;
-  const { info } = Logger(config, "[db.host]");
+  const { config } = cfg;
+  const logger = config.logger;
+  const { info } = logger("[db.host]");
   if (stringCheck(config?.db && config.db.host)) {
-    logger && info(`${logger}[config] ${config?.db?.host}`);
+    info(`[config] ${config?.db?.host}`);
     return String(config?.db?.host);
   }
   if (stringCheck(process.env.NILEDB_HOST)) {
-    logger && info(`${logger}[NILEDB_HOST] ${process.env.NILEDB_HOST}`);
+    info(`[NILEDB_HOST] ${process.env.NILEDB_HOST}`);
     return process.env.NILEDB_HOST;
   }
   const pg2 = stringCheck(process.env.NILEDB_POSTGRES_URL);
   if (pg2) {
     try {
       const pgUrl = new URL(pg2);
-      logger && info(`${logger}[NILEDB_POSTGRES_URL] ${pgUrl.hostname}`);
+      info(`[NILEDB_POSTGRES_URL] ${pgUrl.hostname}`);
       return pgUrl.hostname;
     } catch (e) {
     }
   }
-  logger && info(`${logger}[default] db.thenile.dev`);
+  info("[default] db.thenile.dev");
   return "db.thenile.dev";
 }
 function getDbPort(cfg) {
-  const { config, logger } = cfg;
-  const { info } = Logger(config, "[db.port]");
+  const { config } = cfg;
+  const logger = config.logger;
+  const { info } = logger("[db.port]");
   if (config?.db?.port && config.db.port != null) {
-    logger && info(`${logger}[config] ${config?.db.port}`);
+    info(`[config] ${config?.db.port}`);
     return Number(config.db?.port);
   }
   if (stringCheck(process.env.NILEDB_PORT)) {
-    logger && info(`${logger}[NILEDB_PORT] ${process.env.NILEDB_PORT}`);
+    info(`[NILEDB_PORT] ${process.env.NILEDB_PORT}`);
     return Number(process.env.NILEDB_PORT);
   }
   const pg2 = stringCheck(process.env.NILEDB_POSTGRES_URL);
@@ -1450,7 +1945,7 @@ function getDbPort(cfg) {
     } catch (e) {
     }
   }
-  logger && info(`${logger}[default] 5432`);
+  info("[default] 5432");
   return 5432;
 }
 var logProtector = (logger) => {
@@ -1468,19 +1963,10 @@ var Config = class {
   routes;
   handlers;
   paths;
+  extensionCtx;
+  extensions;
   logger;
-  /**
-   * Stores the set tenant id from Server for use in sub classes
-   */
-  tenantId;
-  /**
-   * Stores the set user id from Server for use in sub classes
-   */
-  userId;
-  /**
-   * Stores the headers to be used in `fetch` calls
-   */
-  headers;
+  context;
   /**
    * The nile-auth url
    */
@@ -1501,15 +1987,19 @@ var Config = class {
    */
   routePrefix;
   db;
-  // api: ApiConfig;
-  constructor(config, logger) {
-    const envVarConfig = { config, logger };
+  constructor(config) {
     this.routePrefix = config?.routePrefix ?? "/api";
-    this.secureCookies = getSecureCookies(envVarConfig);
-    this.callbackUrl = getCallbackUrl(envVarConfig);
     this.debug = config?.debug;
     this.origin = config?.origin;
+    this.extensions = config?.extensions;
+    this.extensionCtx = config?.extensionCtx;
     this.serverOrigin = config?.origin ?? "http://localhost:3000";
+    this.logger = Logger(config);
+    const envVarConfig = {
+      config: { ...config, logger: this.logger }
+    };
+    this.secureCookies = getSecureCookies(envVarConfig);
+    this.callbackUrl = getCallbackUrl(envVarConfig);
     this.apiUrl = getApiUrl(envVarConfig);
     const user = getUsername(envVarConfig);
     const password = getPassword(envVarConfig);
@@ -1527,11 +2017,12 @@ var Config = class {
     if (databaseName) {
       this.db.database = databaseName;
     }
-    if (config?.headers) {
-      this.headers = config?.headers;
-    } else {
-      this.headers = new Headers();
-    }
+    this.context = {
+      tenantId: config?.tenantId,
+      userId: config?.userId,
+      headers: config?.headers ? new Headers(config.headers) : new Headers(),
+      preserveHeaders: false
+    };
     this.routes = {
       ...appRoutes(config?.routePrefix),
       ...config?.routes
@@ -1574,9 +2065,6 @@ var Config = class {
       ],
       delete: [this.routes.TENANT_USER, this.routes.TENANT]
     };
-    this.tenantId = config?.tenantId;
-    this.userId = config?.userId;
-    this.logger = config?.logger;
   }
 };
 
@@ -1610,6 +2098,9 @@ var Eventer = class {
   }
 };
 var eventer = new Eventer();
+var updateTenantId = (tenantId) => {
+  eventer.publish("tenantId" /* Tenant */, tenantId);
+};
 var watchTenantId = (cb) => eventer.subscribe("tenantId" /* Tenant */, cb);
 var watchUserId = (cb) => eventer.subscribe("userId" /* User */, cb);
 var evictPool = (val) => {
@@ -1623,7 +2114,7 @@ var watchHeaders = (cb) => eventer.subscribe("headers" /* Headers */, cb);
 
 // src/db/PoolProxy.ts
 function createProxyForPool(pool, config) {
-  const { info, error } = Logger(config, "[pool]");
+  const { info, error } = config.logger("[pool]");
   return new Proxy(pool, {
     get(target, property) {
       if (property === "query") {
@@ -1640,7 +2131,15 @@ function createProxyForPool(pool, config) {
         }
         const caller = target[property];
         return function query(...args) {
-          info("query", ...args);
+          let log = "[QUERY]";
+          const { userId, tenantId } = config.context;
+          if (tenantId) {
+            log = `${log}[TENANT:${tenantId}]`;
+          }
+          if (userId) {
+            log = `${log}[USER:${userId}]`;
+          }
+          info(log, ...args);
           const called = caller.apply(this, args);
           return called;
         };
@@ -1659,7 +2158,7 @@ var NileDatabase = class {
   config;
   timer;
   constructor(config, id) {
-    const { warn, info, debug } = Logger(config, "[NileInstance]");
+    const { warn: warn2, info, debug } = config.logger("[NileInstance]");
     this.id = id;
     const poolConfig = {
       min: 0,
@@ -1675,7 +2174,7 @@ var NileDatabase = class {
     debug(`Connection pool config ${JSON.stringify(cloned)}`);
     this.pool = createProxyForPool(new pg__default.default.Pool(remaining), this.config);
     if (typeof afterCreate === "function") {
-      warn(
+      warn2(
         "Providing an pool configuration will stop automatic tenant context setting."
       );
     }
@@ -1688,7 +2187,7 @@ var NileDatabase = class {
         `${this.id}-${this.timer}`
       );
       afterCreate2(client, (err) => {
-        const { error } = Logger(config, "[after create callback]");
+        const { error } = config.logger("[after create callback]");
         if (err) {
           clearTimeout(this.timer);
           error("after create failed", {
@@ -1716,7 +2215,7 @@ var NileDatabase = class {
     });
   }
   startTimeout() {
-    const { debug } = Logger(this.config, "[NileInstance]");
+    const { debug } = this.config.logger("[NileInstance]");
     if (this.timer) {
       clearTimeout(this.timer);
     }
@@ -1731,7 +2230,7 @@ var NileDatabase = class {
     }, Number(this.config.db.idleTimeoutMillis) ?? 3e4);
   }
   shutdown() {
-    const { debug } = Logger(this.config, "[NileInstance]");
+    const { debug } = this.config.logger("[NileInstance]");
     debug(`attempting to shut down ${this.id}`);
     clearTimeout(this.timer);
     this.pool.end(() => {
@@ -1741,7 +2240,7 @@ var NileDatabase = class {
 };
 var NileInstance_default = NileDatabase;
 function makeAfterCreate(config, id) {
-  const { error, warn, debug } = Logger(config, "[afterCreate]");
+  const { error, warn: warn2, debug } = config.logger("[afterCreate]");
   return (conn, done) => {
     conn.on("error", function errorHandler(e) {
       error(`Connection ${id} was terminated by server`, {
@@ -1750,13 +2249,14 @@ function makeAfterCreate(config, id) {
       });
       done(e, conn);
     });
-    if (config.tenantId) {
-      const query = [`SET nile.tenant_id = '${config.tenantId}'`];
-      if (config.userId) {
-        if (!config.tenantId) {
-          warn("A user id cannot be set in context without a tenant id");
+    const { tenantId, userId } = ctx.getLastUsed();
+    if (tenantId) {
+      const query = [`SET nile.tenant_id = '${tenantId}'`];
+      if (userId) {
+        if (!tenantId) {
+          warn2("A user id cannot be set in context without a tenant id");
         }
-        query.push(`SET nile.user_id = '${config.userId}'`);
+        query.push(`SET nile.user_id = '${userId}'`);
       }
       conn.query(query.join(";"), function(err) {
         if (err) {
@@ -1769,11 +2269,11 @@ function makeAfterCreate(config, id) {
           });
         } else {
           if (query.length === 1) {
-            debug(`connection context set: tenantId=${config.tenantId}`);
+            debug(`connection context set: tenantId=${tenantId}`);
           }
           if (query.length === 2) {
             debug(
-              `connection context set: tenantId=${config.tenantId} userId=${config.userId}`
+              `connection context set: tenantId=${tenantId} userId=${userId}`
             );
           }
         }
@@ -1805,19 +2305,20 @@ var DBManager = class {
     watchEvictPool(this.poolWatcherFn);
   }
   poolWatcher = (config) => (id) => {
-    const { info, warn } = Logger(config, "[DBManager]");
+    const { info, warn: warn2 } = Logger(config)("[DBManager]");
     if (id && this.connections.has(id)) {
       info(`Removing ${id} from db connection pool.`);
       const connection = this.connections.get(id);
       connection?.shutdown();
       this.connections.delete(id);
     } else {
-      warn(`missed eviction of ${id}`);
+      warn2(`missed eviction of ${id}`);
     }
   };
   getConnection = (config) => {
-    const { info } = Logger(config, "[DBManager]");
-    const id = this.makeId(config.tenantId, config.userId);
+    const { info } = Logger(config)("[DBManager]");
+    const { tenantId, userId } = ctx.getLastUsed();
+    const id = this.makeId(tenantId, userId);
     const existing = this.connections.get(id);
     info(`# of instances: ${this.connections.size}`);
     if (existing) {
@@ -1825,7 +2326,7 @@ var DBManager = class {
       existing.startTimeout();
       return existing.pool;
     }
-    const newOne = new NileInstance_default(new Config(config), id);
+    const newOne = new NileInstance_default(config, id);
     this.connections.set(id, newOne);
     info(`created new ${id}`);
     info(`# of instances: ${this.connections.size}`);
@@ -1835,7 +2336,7 @@ var DBManager = class {
     return newOne.pool;
   };
   clear = (config) => {
-    const { info } = Logger(config, "[DBManager]");
+    const { info } = Logger(config)("[DBManager]");
     info(`Clearing all connections ${this.connections.size}`);
     this.cleared = true;
     this.connections.forEach((connection) => {
@@ -1849,223 +2350,284 @@ var DBManager = class {
 var Auth = class {
   #logger;
   #config;
+  /**
+   * Create an Auth helper.
+   *
+   * @param config - runtime configuration used by the underlying fetch helpers
+   *   such as `serverOrigin`, `routePrefix` and default headers.
+   */
   constructor(config) {
     this.#config = config;
-    this.#logger = Logger(config, "[auth]");
+    this.#logger = config.logger("[auth]");
   }
   async getSession(rawResponse = false) {
-    const res = await fetchSession(this.#config);
-    if (rawResponse) {
-      return res;
-    }
-    try {
-      const session = await res.clone().json();
-      if (Object.keys(session).length === 0) {
-        return void 0;
+    return withNileContext(this.#config, async () => {
+      const res = await fetchSession(this.#config);
+      if (rawResponse) {
+        return res;
       }
-      return session;
-    } catch {
-      return res;
-    }
+      try {
+        const session = await res.clone().json();
+        if (Object.keys(session).length === 0) {
+          return void 0;
+        }
+        return session;
+      } catch {
+        return res;
+      }
+    });
   }
   async getCsrf(rawResponse = false) {
-    return await getCsrf(this.#config, rawResponse);
+    return withNileContext(this.#config, async () => {
+      return await obtainCsrf(this.#config, rawResponse);
+    });
   }
   async listProviders(rawResponse = false) {
-    const res = await fetchProviders(this.#config);
-    if (rawResponse) {
-      return res;
-    }
-    try {
-      return await res.clone().json();
-    } catch {
-      return res;
-    }
+    return withNileContext(this.#config, async () => {
+      const res = await fetchProviders(this.#config);
+      if (rawResponse) {
+        return res;
+      }
+      try {
+        return await res.clone().json();
+      } catch {
+        return res;
+      }
+    });
   }
+  /**
+   * Sign the current user out by calling `/api/auth/signout`.
+   *
+   * The CSRF token is fetched automatically and the stored cookies are cleared
+   * from the internal configuration once the request completes.
+   */
   async signOut() {
-    const csrfRes = await this.getCsrf();
-    if (!("csrfToken" in csrfRes)) {
-      throw new Error("Unable to obtain CSRF token. Sign out failed.");
-    }
-    const body = JSON.stringify({
-      csrfToken: csrfRes.csrfToken,
-      json: true
+    return withNileContext(this.#config, async () => {
+      const csrfRes = await this.getCsrf();
+      if (!("csrfToken" in csrfRes)) {
+        throw new Error("Unable to obtain CSRF token. Sign out failed.");
+      }
+      const body = JSON.stringify({
+        csrfToken: csrfRes.csrfToken,
+        json: true
+      });
+      const res = await fetchSignOut(this.#config, body);
+      updateHeaders(new Headers({}));
+      ctx.set({ headers: null });
+      return res;
     });
-    const res = await fetchSignOut(this.#config, body);
-    updateHeaders(new Headers({}));
-    this.#config.headers = new Headers();
-    return res;
   }
   async signUp(payload, rawResponse) {
-    this.#config.headers = new Headers();
-    const { email, password, ...params } = payload;
-    if (!email || !password) {
-      throw new Error(
-        "Server side sign up requires a user email and password."
-      );
-    }
-    const providers = await this.listProviders();
-    const { credentials } = providers ?? {};
-    if (!credentials) {
-      throw new Error(
-        "Unable to obtain credential provider. Aborting server side sign up."
-      );
-    }
-    const csrf = await this.getCsrf();
-    let csrfToken;
-    if ("csrfToken" in csrf) {
-      csrfToken = csrf.csrfToken;
-    } else {
-      throw new Error("Unable to obtain parse CSRF. Request blocked.");
-    }
-    const body = JSON.stringify({
-      email,
-      password,
-      csrfToken,
-      callbackUrl: credentials.callbackUrl
+    return withNileContext(this.#config, async () => {
+      ctx.set({ headers: null });
+      const { email, password, ...params } = payload;
+      if (!email || !password) {
+        throw new Error(
+          "Server side sign up requires a user email and password."
+        );
+      }
+      const providers = await this.listProviders();
+      const { credentials } = providers ?? {};
+      if (!credentials) {
+        throw new Error(
+          "Unable to obtain credential provider. Aborting server side sign up."
+        );
+      }
+      const csrf = await obtainCsrf(this.#config);
+      let csrfToken;
+      if ("csrfToken" in csrf) {
+        csrfToken = csrf.csrfToken;
+      } else {
+        throw new Error("Unable to obtain parse CSRF. Request blocked.");
+      }
+      const body = JSON.stringify({
+        email,
+        password,
+        csrfToken,
+        callbackUrl: credentials.callbackUrl
+      });
+      const res = await fetchSignUp(this.#config, { body, params });
+      if (res.status > 299) {
+        this.#logger.error(await res.clone().text());
+        return void 0;
+      }
+      const token = parseToken(res.headers);
+      if (!token) {
+        throw new Error("Server side sign up failed. Session token not found");
+      }
+      const { headers } = ctx.get();
+      headers?.append("cookie", token);
+      ctx.set({ headers });
+      updateHeaders(headers);
+      if (rawResponse) {
+        return res;
+      }
+      try {
+        const json = await res.clone().json();
+        if (json && typeof json === "object" && "tenants" in json) {
+          const tenantId = json.tenants[0];
+          if (tenantId) {
+            updateTenantId(tenantId);
+          }
+        }
+        return json;
+      } catch {
+        return res;
+      }
     });
-    const res = await fetchSignUp(this.#config, { body, params });
-    if (res.status > 299) {
-      this.#logger.error(await res.clone().text());
-      return void 0;
-    }
-    const token = parseToken(res.headers);
-    if (!token) {
-      throw new Error("Server side sign up failed. Session token not found");
-    }
-    this.#config.headers?.append("cookie", token);
-    updateHeaders(this.#config.headers);
-    if (rawResponse) {
-      return res;
-    }
-    try {
-      return await res.clone().json();
-    } catch {
-      return res;
-    }
   }
+  /**
+   * Request a password reset email.
+   *
+   * Sends a `POST` to `/api/auth/password-reset` with the provided email and
+   * optional callback information. The endpoint responds with a redirect URL
+   * which is returned as a {@link Response} object.
+   */
   async forgotPassword(req) {
-    let email = "";
-    const defaults = defaultCallbackUrl({
-      config: this.#config
-    });
-    let callbackUrl = defaults.callbackUrl;
-    let redirectUrl = defaults.redirectUrl;
-    if ("email" in req) {
-      email = req.email;
-    }
-    if ("callbackUrl" in req) {
-      callbackUrl = req.callbackUrl ? req.callbackUrl : null;
-    }
-    if ("redirectUrl" in req) {
-      redirectUrl = req.redirectUrl ? req.redirectUrl : null;
-    }
-    const body = JSON.stringify({
-      email,
-      redirectUrl,
-      callbackUrl
-    });
-    const data = await fetchResetPassword(
-      this.#config,
-      "POST",
-      body,
-      new URLSearchParams(),
-      false
-    );
-    return data;
-  }
-  async resetPassword(req) {
-    let email = "";
-    let password = "";
-    const defaults = defaultCallbackUrl({ config: this.#config });
-    let callbackUrl = defaults.callbackUrl;
-    let redirectUrl = defaults.redirectUrl;
-    if (req instanceof Request) {
-      const body2 = await req.json();
-      email = body2.email;
-      password = body2.password;
-      const cbFromHeaders = parseCallback(req.headers);
-      if (cbFromHeaders) {
-        callbackUrl = cbFromHeaders;
-      }
-      if (body2.callbackUrl) {
-        callbackUrl = body2.callbackUrl;
-      }
-      if (body2.redirectUrl) {
-        redirectUrl = body2.redirectUrl;
-      }
-    } else {
+    return withNileContext(this.#config, async () => {
+      let email = "";
+      const defaults = defaultCallbackUrl(this.#config);
+      let callbackUrl = defaults.callbackUrl;
+      let redirectUrl = defaults.redirectUrl;
       if ("email" in req) {
         email = req.email;
       }
-      if ("password" in req) {
-        password = req.password;
-      }
       if ("callbackUrl" in req) {
-        callbackUrl = req.callbackUrl ? req.callbackUrl : null;
+        callbackUrl = fQUrl(req.callbackUrl ?? "", this.#config);
       }
       if ("redirectUrl" in req) {
-        redirectUrl = req.redirectUrl ? req.redirectUrl : null;
+        redirectUrl = fQUrl(req.redirectUrl ?? "", this.#config);
       }
-    }
-    await this.getCsrf();
-    const body = JSON.stringify({
-      email,
-      password,
-      redirectUrl,
-      callbackUrl
-    });
-    let urlWithParams;
-    try {
-      const data = await fetchResetPassword(this.#config, "POST", body);
-      const cloned = data.clone();
-      if (data.status === 400) {
-        const text = await cloned.text();
-        this.#logger.error(text);
-        return data;
-      }
-      const { url } = await data.json();
-      urlWithParams = url;
-    } catch {
-    }
-    let token;
-    try {
-      const worthyParams = new URL(urlWithParams).searchParams;
-      const answer = await fetchResetPassword(
+      const body = JSON.stringify({
+        email,
+        redirectUrl,
+        callbackUrl
+      });
+      const data = await fetchResetPassword(
         this.#config,
-        "GET",
-        null,
-        worthyParams
-      );
-      token = parseResetToken(answer.headers);
-    } catch {
-      this.#logger.warn(
-        "Unable to parse reset password url. Password not reset."
-      );
-    }
-    const cookie = this.#config.headers.get("cookie")?.split("; ");
-    if (token) {
-      cookie?.push(token);
-    } else {
-      throw new Error(
-        "Unable to reset password, reset token is missing from response"
+        "POST",
+        body,
+        new URLSearchParams(),
+        false
       );
-    }
-    this.#config.headers = new Headers({
-      ...this.#config.headers,
-      cookie: cookie?.join("; ")
+      return data;
     });
-    const res = await fetchResetPassword(this.#config, "PUT", body);
-    cookie?.pop();
-    const cleaned = cookie?.filter((c) => !c.includes("nile.session")) ?? [];
-    cleaned.push(String(parseToken(res.headers)));
-    const updatedHeaders = new Headers({ cookie: cleaned.join("; ") });
-    updateHeaders(updatedHeaders);
-    return res;
   }
+  /**
+   * Complete a password reset.
+   *
+   * This workflow expects a token obtained from {@link forgotPassword}. The
+   * function performs a POST/GET/PUT sequence against
+   * `/api/auth/password-reset` as described in the OpenAPI specification.
+   *
+   * @param req - either a {@link Request} with a JSON body or an object
+   *   containing the necessary fields.
+   */
+  async resetPassword(req) {
+    return withNileContext(this.#config, async () => {
+      let email = "";
+      let password = "";
+      const defaults = defaultCallbackUrl(this.#config);
+      let callbackUrl = defaults.callbackUrl;
+      let redirectUrl = defaults.redirectUrl;
+      if (req instanceof Request) {
+        const body2 = await req.json();
+        email = body2.email;
+        password = body2.password;
+        const cbFromHeaders = parseCallback(req.headers);
+        if (cbFromHeaders) {
+          callbackUrl = cbFromHeaders;
+        }
+        if (body2.callbackUrl) {
+          callbackUrl = body2.callbackUrl;
+        }
+        if (body2.redirectUrl) {
+          redirectUrl = body2.redirectUrl;
+        }
+      } else {
+        if ("email" in req) {
+          email = req.email;
+        }
+        if ("password" in req) {
+          password = req.password;
+        }
+        if ("callbackUrl" in req) {
+          callbackUrl = req.callbackUrl ? req.callbackUrl : null;
+        }
+        if ("redirectUrl" in req) {
+          redirectUrl = req.redirectUrl ? req.redirectUrl : null;
+        }
+      }
+      await this.getCsrf();
+      const body = JSON.stringify({
+        email,
+        password,
+        redirectUrl,
+        callbackUrl
+      });
+      let urlWithParams;
+      try {
+        const data = await fetchResetPassword(this.#config, "POST", body);
+        const cloned = data.clone();
+        if (data.status === 400) {
+          const text = await cloned.text();
+          this.#logger.error(text);
+          return data;
+        }
+        const { url } = await data.json();
+        urlWithParams = url;
+      } catch {
+      }
+      let token;
+      try {
+        const worthyParams = new URL(urlWithParams).searchParams;
+        const answer = await fetchResetPassword(
+          this.#config,
+          "GET",
+          null,
+          worthyParams
+        );
+        token = parseResetToken(answer.headers);
+      } catch {
+        this.#logger.warn(
+          "Unable to parse reset password url. Password not reset."
+        );
+      }
+      const { headers } = ctx.get();
+      const cookie = headers?.get("cookie")?.split("; ");
+      if (token) {
+        cookie?.push(token);
+      } else {
+        throw new Error(
+          "Unable to reset password, reset token is missing from response"
+        );
+      }
+      if (cookie) {
+        headers?.set("cookie", cookie?.join("; "));
+        ctx.set({
+          headers
+        });
+      }
+      const res = await fetchResetPassword(this.#config, "PUT", body);
+      cookie?.pop();
+      const cleaned = cookie?.filter((c) => !c.includes("nile.session")) ?? [];
+      cleaned.push(String(parseToken(res.headers)));
+      const updatedHeaders = new Headers({ cookie: cleaned.join("; ") });
+      updateHeaders(updatedHeaders);
+      return res;
+    });
+  }
+  /**
+   * Low level helper used by {@link signIn} to complete provider flows.
+   *
+   * Depending on the provider this issues either a GET or POST request to
+   * `/api/auth/callback/{provider}` via {@link fetchCallback}.
+   */
   async callback(provider, body) {
     if (body instanceof Request) {
-      this.#config.headers = body.headers;
+      ctx.set({
+        headers: body.headers
+      });
       return await fetchCallback(
         this.#config,
         provider,
@@ -2077,109 +2639,115 @@ var Auth = class {
     return await fetchCallback(this.#config, provider, body);
   }
   async signIn(provider, payload, rawResponse) {
-    if (payload instanceof Request) {
-      const body2 = new URLSearchParams(await payload.text());
-      const origin = new URL(payload.url).origin;
-      const payloadUrl = body2?.get("callbackUrl");
-      const csrfToken2 = body2?.get("csrfToken");
-      const callbackUrl = `${!payloadUrl?.startsWith("http") ? origin : ""}${payloadUrl}`;
-      if (!csrfToken2) {
+    return withNileContext(this.#config, async () => {
+      if (payload instanceof Request) {
+        const body2 = new URLSearchParams(await payload.text());
+        const origin = new URL(payload.url).origin;
+        const payloadUrl = body2?.get("callbackUrl");
+        const csrfToken2 = body2?.get("csrfToken");
+        const callbackUrl = `${!payloadUrl?.startsWith("http") ? origin : ""}${payloadUrl}`;
+        if (!csrfToken2) {
+          throw new Error(
+            "CSRF token in missing from request. Request it by the client before calling sign in"
+          );
+        }
+        const updatedHeaders = new Headers(payload.headers);
+        updatedHeaders.set("Content-Type", "application/x-www-form-urlencoded");
+        ctx.set({ headers: updatedHeaders });
+        const params = new URLSearchParams({
+          csrfToken: csrfToken2,
+          json: String(true)
+        });
+        if (payloadUrl) {
+          params.set("callbackUrl", callbackUrl);
+        }
+        return await fetchSignIn(this.#config, provider, params);
+      }
+      ctx.set({ headers: null });
+      const { info, error } = this.#logger;
+      const providers = await this.listProviders();
+      info("Obtaining csrf");
+      const csrf = await obtainCsrf(this.#config);
+      let csrfToken;
+      if ("csrfToken" in csrf) {
+        csrfToken = csrf.csrfToken;
+      } else {
+        throw new Error("Unable to obtain parse CSRF. Request blocked.");
+      }
+      const { credentials } = providers ?? {};
+      if (!credentials) {
         throw new Error(
-          "CSRF token in missing from request. Request it by the client before calling sign in"
+          "Unable to obtain credential provider. Aborting server side sign in."
         );
       }
-      this.#config.headers = new Headers(payload.headers);
-      this.#config.headers.set(
-        "Content-Type",
-        "application/x-www-form-urlencoded"
-      );
-      const params = new URLSearchParams({
-        csrfToken: csrfToken2,
-        json: String(true)
+      const { email, password } = payload ?? {};
+      if (provider === "email" && (!email || !password)) {
+        throw new Error(
+          "Server side sign in requires a user email and password."
+        );
+      }
+      info(`Obtaining providers for ${email}`);
+      info(`Attempting sign in with email ${email}`);
+      if (!email) {
+        throw new Error("Email missing from payload, unable to sign in");
+      }
+      const body = JSON.stringify({
+        email,
+        password,
+        csrfToken,
+        callbackUrl: credentials.callbackUrl
       });
-      if (payloadUrl) {
-        params.set("callbackUrl", callbackUrl);
-      }
-      return await fetchSignIn(this.#config, provider, params);
-    }
-    this.#config.headers = new Headers();
-    const { info, error } = this.#logger;
-    const providers = await this.listProviders();
-    info("Obtaining csrf");
-    const csrf = await this.getCsrf();
-    let csrfToken;
-    if ("csrfToken" in csrf) {
-      csrfToken = csrf.csrfToken;
-    } else {
-      throw new Error("Unable to obtain parse CSRF. Request blocked.");
-    }
-    const { credentials } = providers ?? {};
-    if (!credentials) {
-      throw new Error(
-        "Unable to obtain credential provider. Aborting server side sign in."
-      );
-    }
-    const { email, password } = payload ?? {};
-    if (provider === "email" && (!email || !password)) {
-      throw new Error(
-        "Server side sign in requires a user email and password."
-      );
-    }
-    info(`Obtaining providers for ${email}`);
-    info(`Attempting sign in with email ${email}`);
-    const body = JSON.stringify({
-      email,
-      password,
-      csrfToken,
-      callbackUrl: credentials.callbackUrl
-    });
-    const signInRes = await this.callback(provider, body);
-    const authCookie = signInRes?.headers.get("set-cookie");
-    if (!authCookie) {
-      throw new Error("authentication failed");
-    }
-    const token = parseToken(signInRes?.headers);
-    const possibleError = signInRes?.headers.get("location");
-    if (possibleError) {
-      let urlError;
+      const signInRes = await this.callback(provider, body);
+      const authCookie = signInRes?.headers.get("set-cookie");
+      if (!authCookie) {
+        throw new Error("authentication failed");
+      }
+      const token = parseToken(signInRes?.headers);
+      const possibleError = signInRes?.headers.get("location");
+      if (possibleError) {
+        let urlError;
+        try {
+          urlError = new URL(possibleError).searchParams.get("error");
+        } catch {
+        }
+        if (urlError) {
+          error("Unable to log user in", { error: urlError });
+          return new Response(urlError, { status: signInRes.status });
+        }
+      }
+      if (!token) {
+        error("Unable to obtain auth token", {
+          authCookie,
+          signInRes
+        });
+        throw new Error("Server login failed");
+      }
+      info("Server sign in successful", { authCookie });
+      const setCookie = signInRes.headers.get("set-cookie");
+      const { headers } = ctx.get();
+      if (setCookie) {
+        const cookie = [
+          parseCSRF(headers),
+          parseCallback(signInRes.headers),
+          parseToken(signInRes.headers)
+        ].filter(Boolean).join("; ");
+        const uHeaders = new Headers({ cookie });
+        updateHeaders(uHeaders);
+        ctx.set({ headers: uHeaders, preserveHeaders: true });
+      } else {
+        error("Unable to set context after sign in", {
+          headers: signInRes.headers
+        });
+      }
+      if (rawResponse) {
+        return signInRes;
+      }
       try {
-        urlError = new URL(possibleError).searchParams.get("error");
+        return await signInRes.clone().json();
       } catch {
+        return signInRes;
       }
-      if (urlError) {
-        error("Unable to log user in", { error: urlError });
-        return void 0;
-      }
-    }
-    if (!token) {
-      error("Unable to obtain auth token", {
-        authCookie,
-        signInRes
-      });
-      throw new Error("Server login failed");
-    }
-    info("Server sign in successful", { authCookie });
-    const setCookie = signInRes.headers.get("set-cookie");
-    if (setCookie) {
-      const cookie = [
-        parseCSRF(this.#config.headers),
-        parseCallback(signInRes.headers),
-        parseToken(signInRes.headers)
-      ].filter(Boolean).join("; ");
-      updateHeaders(new Headers({ cookie }));
-    } else {
-      error("Unable to set context after sign in", {
-        headers: signInRes.headers
-      });
-    }
-    if (rawResponse) {
-      return signInRes;
-    }
-    try {
-      return await signInRes.clone().json();
-    } catch {
-      return signInRes;
-    }
+    });
   }
 };
 function parseCSRF(headers) {
@@ -2226,22 +2794,54 @@ function parseResetToken(headers) {
   const [, token] = /((__Secure-)?nile\.reset=[^;]+)/.exec(authCookie) ?? [];
   return token;
 }
-function defaultCallbackUrl({ config }) {
+function parseTenantId(headers) {
+  let authCookie = headers?.get("set-cookie");
+  if (!authCookie) {
+    authCookie = headers?.get("cookie");
+  }
+  if (!authCookie) {
+    return void 0;
+  }
+  const [, token] = /((__Secure-)?nile\.tenant-id=[^;]+)/.exec(authCookie) ?? [];
+  if (token) {
+    const [, tenantId] = token.split("=");
+    return tenantId;
+  }
+  return null;
+}
+function defaultCallbackUrl(config) {
   let cb = null;
   let redirect = null;
-  const fallbackCb = parseCallback(config.headers);
+  const { headers } = ctx.get();
+  const fallbackCb = parseCallback(headers);
   if (fallbackCb) {
     const [, value] = fallbackCb.split("=");
     cb = decodeURIComponent(value);
     if (value) {
-      redirect = `${new URL(cb).origin}${"/auth/reset-password" /* PASSWORD_RESET */}`;
+      redirect = `${new URL(cb).origin}${config.routePrefix}${"/auth/reset-password" /* PASSWORD_RESET */}`;
     }
   }
   return { callbackUrl: cb, redirectUrl: redirect };
 }
+function fQUrl(path, config) {
+  if (path.startsWith("/")) {
+    const { callbackUrl } = defaultCallbackUrl(config);
+    if (callbackUrl) {
+      const { origin } = new URL(callbackUrl);
+      return `${origin}${path}`;
+    }
+  }
+  try {
+    new URL(path);
+  } catch {
+    throw new Error("An invalid URL has been passed.");
+  }
+  return path;
+}
 
-// src/auth/getCsrf.ts
-async function getCsrf(config, rawResponse = false) {
+// src/auth/obtainCsrf.ts
+async function obtainCsrf(config, rawResponse = false) {
+  const { headers } = ctx.get();
   const res = await fetchCsrf(config);
   const csrfCook = parseCSRF(res.headers);
   if (csrfCook) {
@@ -2254,28 +2854,27 @@ async function getCsrf(config, rawResponse = false) {
         parseCallback(res.headers),
         parseToken(res.headers)
       ].filter(Boolean).join("; ");
-      config.headers.set("cookie", cookie);
-      updateHeaders(new Headers({ cookie }));
+      headers.set("cookie", cookie);
+      ctx.set({ headers, preserveHeaders: true });
+      updateHeaders(headers);
     }
     if (!rawResponse) {
       return { csrfToken: token };
     }
   } else {
-    const existingCookie = config.headers.get("cookie");
+    const existingCookie = headers.get("cookie");
     const cookieParts = [];
     if (existingCookie) {
-      cookieParts.push(
-        parseToken(config.headers),
-        parseCallback(config.headers)
-      );
+      cookieParts.push(parseToken(headers), parseCallback(headers));
     }
     if (csrfCook) {
       cookieParts.push(csrfCook);
     } else {
-      cookieParts.push(parseCSRF(config.headers));
+      cookieParts.push(parseCSRF(headers));
     }
     const cookie = cookieParts.filter(Boolean).join("; ");
-    config.headers.set("cookie", cookie);
+    headers.set("cookie", cookie);
+    ctx.set({ headers, preserveHeaders: true });
     updateHeaders(new Headers({ cookie }));
   }
   if (rawResponse) {
@@ -2288,209 +2887,443 @@ async function getCsrf(config, rawResponse = false) {
   }
 }
 
+// src/utils/qualifyDomain.ts
+function fQUrl2(callbackUrl, path) {
+  if (path.startsWith("/")) {
+    if (callbackUrl) {
+      const { origin } = new URL(callbackUrl);
+      return `${origin}${path}`;
+    }
+  }
+  try {
+    new URL(path);
+  } catch {
+    throw new Error("An invalid URL has been passed.");
+  }
+  return path;
+}
+
 // src/users/index.ts
 var Users = class {
   #config;
   #logger;
+  /**
+   * Create a new Users helper.
+   * @param config - The configuration used for requests.
+   */
   constructor(config) {
     this.#config = config;
-    this.#logger = Logger(config, "[me]");
+    this.#logger = config.logger("[me]");
   }
+  /**
+   * Update the current user via `PUT /api/me`.
+   *
+   * The OpenAPI description for this endpoint can be found in
+   * `packages/server/src/api/routes/me/index.ts` under `updateSelf`.
+   *
+   * @param req - Partial user fields to send.
+   * @param [rawResponse] - When `true`, return the raw {@link Response}.
+   */
   async updateSelf(req, rawResponse) {
-    const res = await fetchMe(this.#config, "PUT", JSON.stringify(req));
-    if (rawResponse) {
-      return res;
-    }
-    try {
-      return await res?.clone().json();
-    } catch {
-      return res;
-    }
+    return withNileContext(this.#config, async () => {
+      const res = await fetchMe(this.#config, "PUT", JSON.stringify(req));
+      if (rawResponse) {
+        return res;
+      }
+      try {
+        return await res?.clone().json();
+      } catch {
+        return res;
+      }
+    });
   }
+  /**
+   * Remove the current user using `DELETE /api/me`.
+   *
+   * After the request the authentication headers are cleared with
+   * {@link updateHeaders}. The OpenAPI docs for this route are in
+   * `packages/server/src/api/routes/me/index.ts` under `removeSelf`.
+   */
   async removeSelf() {
-    const me = await this.getSelf();
-    if ("id" in me) {
-      this.#config.userId = me.id;
-    }
-    const res = await fetchMe(this.#config, "DELETE");
-    updateHeaders(new Headers());
-    return res;
+    return withNileContext(this.#config, async () => {
+      const me = await this.getSelf();
+      if ("id" in me) {
+        const userId = me.id;
+        ctx.set({ userId });
+      }
+      const res = await fetchMe(this.#config, "DELETE");
+      updateHeaders(new Headers());
+      return res;
+    });
   }
   async getSelf(rawResponse) {
-    const res = await fetchMe(this.#config);
-    if (rawResponse) {
-      return res;
-    }
-    try {
-      return await res?.clone().json();
-    } catch {
-      return res;
-    }
+    return withNileContext(this.#config, async () => {
+      const res = await fetchMe(this.#config);
+      if (rawResponse) {
+        return res;
+      }
+      try {
+        return await res?.clone().json();
+      } catch {
+        return res;
+      }
+    });
   }
-  async verifySelf(bypassEmail = process.env.NODE_ENV !== "production", rawResponse = false) {
-    try {
-      const me = await this.getSelf();
-      if (me instanceof Response) {
-        return me;
+  async verifySelf(options, rawResponse = false) {
+    return withNileContext(this.#config, async () => {
+      const bypassEmail = typeof options === "object" && options?.bypassEmail === true;
+      const callbackUrl = fQUrl2(
+        defaultCallbackUrl2().callbackUrl,
+        typeof options === "object" ? String(options.callbackUrl) : "/"
+      );
+      let res;
+      try {
+        const me = await this.getSelf();
+        if (me instanceof Response) {
+          return me;
+        }
+        res = await verifyEmailAddress(this.#config, me, String(callbackUrl));
+        return res;
+      } catch (e) {
+        if (!bypassEmail) {
+          let message = "Unable to verify email.";
+          if (e instanceof Error) {
+            message = e.message;
+          }
+          this.#logger?.error(
+            `${message} you can bypass this message by setting bypassEmail: true when calling 'verifySelf'`
+          );
+          res = new Response(message, { status: 400 });
+        }
+      }
+      if (bypassEmail) {
+        this.#logger?.info(
+          "bypassing email requirements for email verification"
+        );
+        res = this.updateSelf({ emailVerified: true }, rawResponse);
       }
-      const res = await verifyEmailAddress(this.#config, me);
       return res;
-    } catch {
-      this.#logger?.warn(
-        "Unable to verify email. The current user's email will be set to verified any way. Be sure to configure emails for production."
-      );
-    }
-    if (bypassEmail) {
-      return await this.updateSelf({ emailVerified: true }, rawResponse);
-    }
-    this.#logger.error(
-      "Unable to verify email address. Configure your SMTP server in the console."
-    );
-    return void 0;
+    });
   }
 };
-async function verifyEmailAddress(config, user) {
-  config.headers.set("content-type", "application/x-www-form-urlencoded");
-  const { csrfToken } = await getCsrf(config);
+async function verifyEmailAddress(config, user, callback) {
+  const { headers } = ctx.get();
+  headers?.set("content-type", "application/x-www-form-urlencoded");
+  ctx.set({ headers });
+  const { csrfToken } = await obtainCsrf(config);
+  const defaults = defaultCallbackUrl2();
+  const callbackUrl = callback ?? String(defaults.callbackUrl);
   const res = await fetchVerifyEmail(
     config,
     "POST",
-    new URLSearchParams({ csrfToken, email: user.email }).toString()
+    new URLSearchParams({
+      csrfToken,
+      email: user.email,
+      callbackUrl
+    }).toString()
   );
   if (res.status > 299) {
     throw new Error(await res.text());
   }
   return res;
 }
+function defaultCallbackUrl2() {
+  let cb = null;
+  const { headers } = ctx.get();
+  const fallbackCb = parseCallback(headers);
+  if (fallbackCb) {
+    const [, value] = fallbackCb.split("=");
+    cb = decodeURIComponent(value);
+  }
+  return { callbackUrl: cb };
+}
 
 // src/tenants/index.ts
 var Tenants = class {
-  #logger;
   #config;
   constructor(config) {
-    this.#logger = Logger(config, "[tenants]");
     this.#config = config;
   }
+  /**
+   * Create a new tenant using `POST /api/tenants`.
+   * See `packages/server/src/api/routes/tenants/POST.ts` for the
+   * `createTenant` operation definition.
+   */
   async create(req, rawResponse) {
-    let res;
-    if (typeof req === "string") {
-      res = await fetchTenants(
-        this.#config,
-        "POST",
-        JSON.stringify({ name: req })
-      );
-    } else if (typeof req === "object" && ("name" in req || "id" in req)) {
-      res = await fetchTenants(this.#config, "POST", JSON.stringify(req));
-    }
-    if (rawResponse) {
-      return res;
-    }
-    try {
-      return await res?.clone().json();
-    } catch {
-      return res;
-    }
+    return withNileContext(this.#config, async () => {
+      let res;
+      if (typeof req === "string") {
+        res = await fetchTenants(
+          this.#config,
+          "POST",
+          JSON.stringify({ name: req })
+        );
+      } else if (typeof req === "object" && ("name" in req || "id" in req)) {
+        res = await fetchTenants(this.#config, "POST", JSON.stringify(req));
+      }
+      if (rawResponse) {
+        return res;
+      }
+      try {
+        return await res?.clone().json();
+      } catch {
+        return res;
+      }
+    });
   }
+  /**
+   * Remove a tenant via `DELETE /api/tenants/{tenantId}`.
+   *
+   * @param req - The tenant to remove or context containing the id.
+   */
   async delete(req) {
-    if (typeof req === "string") {
-      this.#config.tenantId = req;
-    }
-    if (typeof req === "object" && "id" in req) {
-      this.#config.tenantId = req.id;
-    }
-    const res = await fetchTenant(this.#config, "DELETE");
-    return res;
+    return withNileContext(this.#config, async () => {
+      if (typeof req === "string") {
+        ctx.set({ tenantId: req });
+      }
+      if (typeof req === "object" && "id" in req) {
+        ctx.set({ tenantId: req.id });
+      }
+      const res = await fetchTenant(this.#config, "DELETE");
+      return res;
+    });
   }
+  /**
+   * Fetch details for a tenant using `GET /api/tenants/{tenantId}`.
+   *
+   * @param req - Tenant identifier or context.
+   * @param [rawResponse] - When true, return the raw {@link Response}.
+   */
   async get(req, rawResponse) {
-    if (typeof req === "string") {
-      this.#config.tenantId = req;
-    } else if (typeof req === "object" && "id" in req) {
-      this.#config.tenantId = req.id;
-    }
-    const res = await fetchTenant(this.#config, "GET");
-    if (rawResponse === true || req === true) {
-      return res;
-    }
-    try {
-      return await res?.clone().json();
-    } catch {
-      return res;
-    }
+    return withNileContext(this.#config, async () => {
+      if (typeof req === "string") {
+        ctx.set({ tenantId: req });
+      } else if (typeof req === "object" && "id" in req) {
+        ctx.set({ tenantId: req.id });
+      }
+      const res = await fetchTenant(this.#config, "GET");
+      if (rawResponse === true || req === true) {
+        return res;
+      }
+      try {
+        return await res?.clone().json();
+      } catch {
+        return res;
+      }
+    });
   }
   async update(req, rawResponse) {
-    let res;
-    if (typeof req === "object" && ("name" in req || "id" in req)) {
-      const { id, ...remaining } = req;
-      if (id) {
-        this.#config.tenantId = id;
+    return withNileContext(this.#config, async () => {
+      let res;
+      if (typeof req === "object" && ("name" in req || "id" in req)) {
+        const { id, ...remaining } = req;
+        if (id) {
+          ctx.set({ tenantId: id });
+        }
+        res = await fetchTenant(this.#config, "PUT", JSON.stringify(remaining));
       }
-      res = await fetchTenant(this.#config, "PUT", JSON.stringify(remaining));
-    }
-    if (rawResponse) {
-      return res;
-    }
-    try {
-      return await res?.clone().json();
-    } catch {
-      return res;
-    }
+      if (rawResponse) {
+        return res;
+      }
+      try {
+        return await res?.clone().json();
+      } catch {
+        return res;
+      }
+    });
   }
+  /**
+   * List tenants for the current user via `GET /api/tenants`.
+   * See `packages/server/src/api/routes/tenants/GET.ts` for details.
+   */
   async list(req) {
-    const res = await fetchTenantsByUser(this.#config);
-    if (req === true) {
-      return res;
-    }
-    try {
-      return await res?.clone().json();
-    } catch {
-      return res;
-    }
+    return withNileContext(
+      this.#config,
+      async () => {
+        const res = await fetchTenantsByUser(this.#config);
+        if (req === true) {
+          return res;
+        }
+        try {
+          return await res?.clone().json();
+        } catch {
+          return res;
+        }
+      },
+      "listTenants"
+    );
   }
+  /**
+   * Leave the current tenant using `DELETE /api/tenants/{tenantId}/users/{userId}`.
+   *
+   * @param [req] - Optionally specify the tenant id to leave.
+   */
   async leaveTenant(req) {
-    const me = await fetchMe(this.#config);
-    try {
-      const json = await me.json();
-      if ("id" in json) {
-        this.#config.userId = json.id;
+    return withNileContext(this.#config, async () => {
+      const me = await fetchMe(this.#config);
+      try {
+        const json = await me.json();
+        if ("id" in json) {
+          ctx.set({ userId: json.id, preserveHeaders: true });
+        }
+      } catch {
       }
-    } catch {
-    }
-    if (typeof req === "string") {
-      this.#config.tenantId = req;
-    } else {
-      this.#handleContext(req);
-    }
-    return await fetchTenantUser(this.#config, "DELETE");
+      if (typeof req === "string") {
+        ctx.set({ tenantId: req, preserveHeaders: true });
+      } else {
+        this.#handleContext(req);
+      }
+      return await fetchTenantUser(this.#config, "DELETE");
+    });
   }
   async addMember(req, rawResponse) {
-    if (typeof req === "string") {
-      this.#config.userId = req;
-    } else {
-      this.#handleContext(req);
-    }
-    const res = await fetchTenantUser(this.#config, "PUT");
-    return responseHandler(res, rawResponse);
+    return withNileContext(this.#config, async () => {
+      if (typeof req === "string") {
+        ctx.set({ userId: req, preserveHeaders: true });
+      } else {
+        this.#handleContext(req);
+      }
+      const res = await fetchTenantUser(this.#config, "PUT");
+      return responseHandler(res, rawResponse);
+    });
   }
+  /**
+   * Remove a user from a tenant with `DELETE /api/tenants/{tenantId}/users/{userId}`.
+   *
+   * @param req - User and tenant identifiers or context.
+   * @param [rawResponse] - When true, return the raw {@link Response}.
+   */
   async removeMember(req, rawResponse) {
-    this.#handleContext(req);
-    const res = await fetchTenantUser(this.#config, "DELETE");
-    return responseHandler(res, rawResponse);
+    return withNileContext(this.#config, async () => {
+      this.#handleContext(req);
+      if (typeof req === "string") {
+        ctx.set({ userId: req, preserveHeaders: true });
+      }
+      const res = await fetchTenantUser(this.#config, "DELETE");
+      return responseHandler(res, rawResponse);
+    });
   }
   async users(req, rawResponse) {
-    this.#handleContext(req);
-    const res = await fetchTenantUsers(this.#config, "GET");
-    return responseHandler(
-      res,
-      rawResponse || typeof req === "boolean" && req
+    return withNileContext(
+      this.#config,
+      async () => {
+        this.#handleContext(req);
+        const res = await fetchTenantUsers(this.#config, "GET");
+        return responseHandler(
+          res,
+          rawResponse || typeof req === "boolean" && req
+        );
+      },
+      "users"
+    );
+  }
+  /**
+   * List invites for the current tenant via `GET /api/tenants/{tenantId}/invites`.
+   */
+  async invites() {
+    return withNileContext(
+      this.#config,
+      async () => {
+        const res = await fetchInvites(this.#config);
+        return responseHandler(res);
+      },
+      "invites"
     );
   }
+  async invite(req, rawResponse) {
+    return withNileContext(
+      this.#config,
+      async () => {
+        const { csrfToken } = await obtainCsrf(
+          this.#config
+        );
+        const defaults = defaultCallbackUrl3(this.#config);
+        let identifier = req;
+        let callbackUrl = defaults.callbackUrl;
+        let redirectUrl = defaults.redirectUrl;
+        if (typeof req === "object") {
+          if ("email" in req) {
+            identifier = req.email;
+          }
+          const { callbackUrl: cbUrl } = defaultCallbackUrl3(this.#config);
+          if ("callbackUrl" in req) {
+            callbackUrl = fQUrl2(cbUrl, req.callbackUrl ?? "/");
+          }
+          if ("redirectUrl" in req) {
+            redirectUrl = fQUrl2(cbUrl, req.redirectUrl ?? "/");
+          }
+        }
+        const { headers } = ctx.get();
+        headers?.set("Content-Type", "application/x-www-form-urlencoded");
+        ctx.set({ headers });
+        const res = await fetchInvite(
+          this.#config,
+          "POST",
+          new URLSearchParams({
+            identifier,
+            csrfToken,
+            callbackUrl,
+            redirectUrl
+          }).toString()
+        );
+        return responseHandler(res, rawResponse);
+      },
+      "invites"
+    );
+  }
+  /**
+   * Accept an invite using `PUT /api/tenants/{tenantId}/invite`.
+   *
+   * @param req - Identifier and token from the invite email.
+   * @param [rawResponse] - When true, return the raw {@link Response}.
+   */
+  async acceptInvite(req, rawResponse) {
+    return withNileContext(this.#config, async () => {
+      if (!req) {
+        throw new Error("The identifier and token are required.");
+      }
+      const { identifier, token } = req;
+      const { callbackUrl: cbUrl } = defaultCallbackUrl3(this.#config);
+      const callbackUrl = fQUrl2(cbUrl, req?.callbackUrl ?? "/");
+      const res = await fetchInvite(
+        this.#config,
+        "PUT",
+        new URLSearchParams({
+          identifier,
+          token,
+          callbackUrl
+        }).toString()
+      );
+      return responseHandler(res, rawResponse);
+    });
+  }
+  /**
+   * Delete a pending invite using `DELETE /api/tenants/{tenantId}/invite/{inviteId}`.
+   *
+   * @param req - Identifier of the invite to remove.
+   */
+  async deleteInvite(req) {
+    return withNileContext(this.#config, async () => {
+      let id = "";
+      if (typeof req === "object") {
+        id = req.id;
+      } else {
+        id = req;
+      }
+      if (!id) {
+        throw new Error("An invite id is required.");
+      }
+      const res = await fetchInvite(this.#config, "DELETE", id);
+      return responseHandler(res, true);
+    });
+  }
   #handleContext(req) {
     if (typeof req === "object") {
       if ("tenantId" in req) {
-        this.#config.tenantId = req.tenantId;
+        ctx.set({ tenantId: req.tenantId, preserveHeaders: true });
       }
       if ("userId" in req) {
-        this.#config.tenantId = req.tenantId;
+        ctx.set({ userId: req.userId, preserveHeaders: true });
       }
     }
   }
@@ -2505,31 +3338,45 @@ async function responseHandler(res, rawResponse) {
     return res;
   }
 }
+function defaultCallbackUrl3(config) {
+  let cb = null;
+  let redirect = null;
+  const { headers, tenantId } = ctx.get();
+  const fallbackCb = parseCallback(headers);
+  if (fallbackCb) {
+    const [, value] = fallbackCb.split("=");
+    cb = decodeURIComponent(value);
+    if (value) {
+      redirect = `${new URL(cb).origin}${config.routePrefix}${"/tenants/{tenantId}/invite" /* INVITE */.replace("{tenantId}", String(tenantId))}`;
+    }
+  }
+  return { callbackUrl: cb, redirectUrl: redirect };
+}
 
 // src/api/handlers/withContext/index.ts
 function handlersWithContext(config) {
-  const GET6 = GETTER(config.routes, config);
-  const POST5 = POSTER(config.routes, config);
-  const DELETE4 = DELETER(config.routes, config);
-  const PUT5 = PUTER(config.routes, config);
+  const GET7 = GETTER(config.routes, config);
+  const POST6 = POSTER(config.routes, config);
+  const DELETE5 = DELETER(config.routes, config);
+  const PUT6 = PUTER(config.routes, config);
   return {
     GET: async (req) => {
-      const response = await GET6(req);
+      const response = await GET7(req);
       const updatedConfig = updateConfig(response, config);
       return { response, nile: new Server(updatedConfig) };
     },
     POST: async (req) => {
-      const response = await POST5(req);
+      const response = await POST6(req);
       const updatedConfig = updateConfig(response, config);
       return { response, nile: new Server(updatedConfig) };
     },
     DELETE: async (req) => {
-      const response = await DELETE4(req);
+      const response = await DELETE5(req);
       const updatedConfig = updateConfig(response, config);
       return { response, nile: new Server(updatedConfig) };
     },
     PUT: async (req) => {
-      const response = await PUT5(req);
+      const response = await PUT6(req);
       const updatedConfig = updateConfig(response, config);
       return { response, nile: new Server(updatedConfig) };
     }
@@ -2538,29 +3385,32 @@ function handlersWithContext(config) {
 function updateConfig(response, config) {
   let origin = "http://localhost:3000";
   let headers = null;
-  if (response?.status === 302) {
-    const location = response.headers.get("location");
-    if (location) {
-      const urlLocation = new URL(location);
-      origin = urlLocation.origin;
+  if (response instanceof Response) {
+    if (response?.status === 302) {
+      const location = response.headers.get("location");
+      if (location) {
+        const urlLocation = new URL(location);
+        origin = urlLocation.origin;
+      }
     }
-  }
-  const setCookies = [];
-  if (response?.headers) {
-    for (const [key14, value] of response.headers) {
-      if (key14.toLowerCase() === "set-cookie") {
-        setCookies.push(value);
+    const setCookies = [];
+    if (response?.headers) {
+      for (const [key17, value] of response.headers) {
+        if (key17.toLowerCase() === "set-cookie") {
+          setCookies.push(value);
+        }
       }
     }
-  }
-  if (setCookies.length > 0) {
-    const cookieHeader = setCookies.map((cookieStr) => cookieStr.split(";")[0]).join("; ");
-    headers = new Headers({ cookie: cookieHeader });
+    if (setCookies.length > 0) {
+      const cookieHeader = setCookies.map((cookieStr) => cookieStr.split(";")[0]).join("; ");
+      headers = new Headers({ cookie: cookieHeader });
+    }
   }
   return {
     ...config,
     origin,
-    headers: headers ?? void 0
+    headers: headers ?? void 0,
+    preserveHeaders: true
   };
 }
 
@@ -2571,40 +3421,63 @@ var Server = class {
   auth;
   #config;
   #handlers;
-  #paths;
   #manager;
-  #headers;
   constructor(config) {
-    this.#config = new Config(config, "[initial config]");
+    this.#config = new Config({
+      ...config,
+      extensionCtx: buildExtensionConfig(this)
+    });
     watchTenantId((tenantId) => {
-      if (tenantId !== this.#config.tenantId) {
-        this.#config.tenantId = tenantId;
+      if (tenantId !== this.#config.context.tenantId) {
+        this.#config.context.tenantId = String(tenantId);
         this.#reset();
       }
     });
     watchUserId((userId) => {
-      if (userId !== this.#config.userId) {
-        this.#config.userId = userId;
+      if (userId !== this.#config.context.userId) {
+        this.#config.context.userId = String(userId);
         this.#reset();
       }
     });
     watchHeaders((headers) => {
-      this.setContext(headers);
-      this.#reset();
+      if (headers) {
+        this.#config.context.headers = new Headers(headers);
+        this.#config.context.preserveHeaders = true;
+        this.#reset();
+      }
     });
     this.#handlers = {
       ...this.#config.handlers,
       withContext: handlersWithContext(this.#config)
     };
-    this.#paths = this.#config.paths;
-    this.#config.tenantId = getTenantId({ config: this.#config });
+    this.#config.context.preserveHeaders = config?.preserveHeaders ?? false;
+    this.#config.context.tenantId = getTenantId({ config: this.#config });
     this.#manager = new DBManager(this.#config);
     this.#handleHeaders(config);
     this.users = new Users(this.#config);
     this.tenants = new Tenants(this.#config);
     this.auth = new Auth(this.#config);
+    if (config?.extensions) {
+      for (const create2 of config.extensions) {
+        if (typeof create2 !== "function") {
+          continue;
+        }
+        const ext = create2(this);
+        if (ext.onConfigure) {
+          ext.onConfigure();
+        }
+        if (ext?.replace?.handlers) {
+          this.#config.logger("[EXTENSION]").debug(`${ext.id} replacing handlers`);
+          this.#handlers = ext.replace.handlers({
+            ...this.#config.handlers,
+            withContext: handlersWithContext(this.#config)
+          });
+        }
+      }
+    }
   }
   get db() {
+    this.#config.context = { ...this.getContext() };
     const pool = this.#manager.getConnection(this.#config);
     return Object.assign(pool, {
       clearConnections: () => {
@@ -2612,128 +3485,120 @@ var Server = class {
       }
     });
   }
-  /**
-   * A convenience function that applies a config and ensures whatever was passed is set properly
-   */
-  getInstance(config, req) {
-    const _config = { ...this.#config, ...config };
-    const updatedConfig = new Config(_config);
-    this.#config = new Config(updatedConfig);
-    this.#config.tenantId = config.tenantId;
-    this.#config.userId = config.userId;
-    if (req) {
-      this.setContext(req);
-    }
-    this.#reset();
-    return this;
+  get logger() {
+    return this.#config.logger;
   }
-  getPaths() {
-    return this.#paths;
+  get extensions() {
+    return {
+      remove: async (id) => {
+        if (!this.#config.extensions) return;
+        const resolved = this.#config.extensions.map((ext) => ext(this));
+        const index = resolved.findIndex((ext) => ext.id === id);
+        if (index !== -1) {
+          this.#config.extensions.splice(index, 1);
+        }
+        return resolved;
+      },
+      add: (extension) => {
+        if (!this.#config.extensions) {
+          this.#config.extensions = [];
+        }
+        this.#config.extensions.push(extension);
+      }
+    };
   }
   get handlers() {
     return this.#handlers;
   }
-  /**
-   * Allow the setting of headers from a req or header object.
-   * Makes it possible to handle REST requests easily
-   * Also makes it easy to set user + tenant in some way
-   * @param req
-   * @returns undefined
-   */
-  setContext(req) {
-    try {
-      if (req instanceof Headers) {
-        this.#handleHeaders(req);
-        this.#reset();
-        return;
-      } else if (req instanceof Request) {
-        this.#handleHeaders(new Headers(req.headers));
-        this.#reset();
-        return;
-      }
-    } catch {
-    }
-    let ok = false;
-    if (req && typeof req === "object" && "tenantId" in req) {
-      ok = true;
-      this.#config.tenantId = req.tenantId;
-    }
-    if (req && typeof req === "object" && "userId" in req) {
-      ok = true;
-      this.#config.userId = req.userId;
-    }
-    if (ok) {
-      return;
+  get paths() {
+    return this.#config.paths;
+  }
+  set paths(paths) {
+    this.#config.paths = paths;
+  }
+  async withContext(context, fn) {
+    const { ...initialContext } = context ?? defaultContext;
+    this.#config.context = { ...initialContext };
+    const preserve = (context && "preserveHeaders" in context && context.preserveHeaders) ?? true;
+    if (preserve) {
+      this.#config.context = { ...this.getContext(), ...context };
     }
-    if (typeof req === "object") {
-      const headers = new Headers(req);
-      if (headers) {
-        this.#handleHeaders(headers);
-        this.#reset();
-        return;
+    return withNileContext(this.#config, async () => {
+      if (fn) {
+        return fn(this);
       }
-    }
-    const { warn } = Logger(this.#config, "[API]");
-    if (warn) {
-      warn(
-        "Set context expects a Request, Header instance or an object of Record<string, string>"
-      );
-    }
+      return this;
+    });
+  }
+  async noContext(fn) {
+    this.#config.context.tenantId = void 0;
+    this.#config.context.userId = void 0;
+    return withNileContext(this.#config, async () => {
+      ctx.set({ userId: void 0, tenantId: void 0 });
+      if (fn) {
+        return fn(this);
+      }
+      return this;
+    });
   }
+  /**
+   *
+   * @returns the last used (basically global) context object, useful for debugging or making your own context
+   */
   getContext() {
-    return {
-      headers: this.#headers,
-      userId: this.#config.userId,
-      tenantId: this.#config.tenantId
-    };
+    return ctx.getLastUsed();
   }
   /**
    * Merge headers together
+   * Saves them in a singleton for use in a request later. It's basically the "default" value
    * Internally, passed a NileConfig, externally, should be using Headers
    */
   #handleHeaders(config) {
     const updates = [];
     let headers;
-    this.#headers = new Headers();
+    this.#config.context.headers = new Headers();
     if (config instanceof Headers) {
       headers = config;
     } else if (config?.headers) {
       headers = config?.headers;
       if (config && config.origin) {
-        this.#headers.set(X_NILE_ORIGIN, config.origin);
+        this.#config.context.headers.set(HEADER_ORIGIN, config.origin);
       }
       if (config && config.secureCookies != null) {
-        this.#headers.set(X_NILE_SECURECOOKIES, String(config.secureCookies));
+        this.#config.context.headers.set(
+          HEADER_SECURE_COOKIES,
+          String(config.secureCookies)
+        );
       }
     }
     if (headers instanceof Headers) {
-      headers.forEach((value, key14) => {
-        updates.push([key14.toLowerCase(), value]);
+      headers.forEach((value, key17) => {
+        updates.push([key17.toLowerCase(), value]);
       });
     } else {
-      for (const [key14, value] of Object.entries(headers ?? {})) {
-        updates.push([key14.toLowerCase(), value]);
+      for (const [key17, value] of Object.entries(headers ?? {})) {
+        updates.push([key17.toLowerCase(), value]);
       }
     }
     const merged = {};
-    this.#headers?.forEach((value, key14) => {
-      if (key14.toLowerCase() !== "cookie") {
-        merged[key14.toLowerCase()] = value;
+    this.#config.context.headers?.forEach((value, key17) => {
+      if (key17.toLowerCase() !== "cookie") {
+        merged[key17.toLowerCase()] = value;
       }
     });
-    for (const [key14, value] of updates) {
-      merged[key14] = value;
+    for (const [key17, value] of updates) {
+      merged[key17] = value;
     }
-    for (const [key14, value] of Object.entries(merged)) {
-      this.#headers.set(key14, value);
+    for (const [key17, value] of Object.entries(merged)) {
+      this.#config.context.headers.set(key17, value);
     }
-    this.#config.headers = this.#headers;
+    this.#config.logger("[handleHeaders]").debug(JSON.stringify(merged));
   }
   /**
    * Allow some internal mutations to reset our config + headers
    */
   #reset = () => {
-    this.#config.headers = this.#headers ?? new Headers();
+    this.#config.extensionCtx = buildExtensionConfig(this);
     this.users = new Users(this.#config);
     this.tenants = new Tenants(this.#config);
     this.auth = new Auth(this.#config);
@@ -2748,11 +3613,18 @@ function create(config) {
 }
 
 exports.APIErrorErrorCodeEnum = APIErrorErrorCodeEnum;
+exports.ExtensionState = ExtensionState;
+exports.HEADER_ORIGIN = HEADER_ORIGIN;
+exports.HEADER_SECURE_COOKIES = HEADER_SECURE_COOKIES;
 exports.LoginUserResponseTokenTypeEnum = LoginUserResponseTokenTypeEnum;
 exports.Nile = create;
 exports.Server = Server;
+exports.TENANT_COOKIE = TENANT_COOKIE;
+exports.USER_COOKIE = USER_COOKIE;
 exports.parseCSRF = parseCSRF;
 exports.parseCallback = parseCallback;
+exports.parseResetToken = parseResetToken;
+exports.parseTenantId = parseTenantId;
 exports.parseToken = parseToken;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map