@korajs/auth 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,14 +1,29 @@
 import {
   CryptoUnavailableError,
   DeviceIdentityError,
+  EncryptionError,
+  OperationEncryptionError,
+  OperationEncryptor,
+  PasskeyError,
+  PasskeyUnsupportedError,
+  authenticateWithPasskey,
   computePublicKeyThumbprint,
+  createPasskeyCredential,
+  decryptData,
+  encryptData,
+  exportKey,
   exportPublicKeyJwk,
   fromBase64Url,
   generateDeviceKeyPair,
+  generateEncryptionKey,
+  importKey,
+  isEncryptedField,
+  isPasskeySupported,
+  isPlatformAuthenticatorAvailable,
   signChallenge,
   toBase64Url,
   verifyChallenge
-} from "./chunk-L554ZDPY.js";
+} from "./chunk-FSU4SK32.js";
 
 // src/client/auth-client.ts
 import { KoraError } from "@korajs/core";
@@ -104,6 +119,7 @@ var AuthClient = class {
   _state = "loading";
   _user = null;
   _refreshPromise = null;
+  _initialized = false;
   /**
    * Creates a new AuthClient.
    *
@@ -140,6 +156,10 @@ var AuthClient = class {
    * Safe to call multiple times -- subsequent calls are no-ops once initialized.
    */
   async initialize() {
+    if (this._initialized) {
+      return;
+    }
+    this._initialized = true;
     const accessToken = this.storage.getAccessToken();
     const refreshToken = this.storage.getRefreshToken();
     if (!accessToken || !refreshToken) {
@@ -201,13 +221,26 @@ var AuthClient = class {
   /**
    * Sign out the current user.
    *
-   * Clears local tokens and state. Does not make a network request to the
-   * server -- tokens are simply discarded locally.
+   * Clears local tokens and attempts to revoke the refresh token on the server
+   * (best-effort — succeeds even if the server is unreachable). This ensures that
+   * stolen refresh tokens cannot be used after the user explicitly signs out.
    */
   async signOut() {
+    const accessToken = this.storage.getAccessToken();
+    const refreshToken = this.storage.getRefreshToken();
     this.storage.clear();
     this._refreshPromise = null;
     this.setState("unauthenticated", null);
+    if (accessToken) {
+      try {
+        await this.request("/auth/signout", {
+          method: "POST",
+          body: { refreshToken: refreshToken ?? void 0 },
+          token: accessToken
+        });
+      } catch {
+      }
+    }
   }
   // -----------------------------------------------------------------------
   // Token access
@@ -414,6 +447,492 @@ var AuthClient = class {
   }
 };
 
+// src/client/org-client.ts
+import { KoraError as KoraError2 } from "@korajs/core";
+var OrgClientError = class extends KoraError2 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "OrgClientError";
+  }
+};
+var OrgClient = class {
+  serverUrl;
+  getAccessToken;
+  listeners = /* @__PURE__ */ new Set();
+  _activeOrgId = null;
+  _activeOrg = null;
+  _activeRole = null;
+  constructor(config) {
+    this.serverUrl = config.serverUrl.replace(/\/+$/, "");
+    this.getAccessToken = config.getAccessToken;
+  }
+  // --- Getters ---
+  /** Currently active organization ID */
+  get activeOrgId() {
+    return this._activeOrgId;
+  }
+  /** Currently active organization */
+  get activeOrg() {
+    return this._activeOrg;
+  }
+  /** Current user's role in the active organization */
+  get activeRole() {
+    return this._activeRole;
+  }
+  // --- Organization Operations ---
+  /**
+   * Create a new organization.
+   */
+  async createOrg(params) {
+    return this.request("/orgs", {
+      method: "POST",
+      body: params
+    });
+  }
+  /**
+   * List all organizations the current user belongs to.
+   */
+  async listOrgs() {
+    return this.request("/orgs", { method: "GET" });
+  }
+  /**
+   * Get an organization by ID.
+   */
+  async getOrg(orgId) {
+    return this.request(`/orgs/${orgId}`, { method: "GET" });
+  }
+  /**
+   * Update an organization.
+   */
+  async updateOrg(orgId, params) {
+    const result = await this.request(`/orgs/${orgId}`, {
+      method: "PATCH",
+      body: params
+    });
+    if (this._activeOrgId === orgId) {
+      this._activeOrg = result;
+    }
+    return result;
+  }
+  /**
+   * Delete an organization.
+   */
+  async deleteOrg(orgId) {
+    await this.request(`/orgs/${orgId}`, { method: "DELETE" });
+    if (this._activeOrgId === orgId) {
+      this._activeOrgId = null;
+      this._activeOrg = null;
+      this._activeRole = null;
+      this.notifyListeners();
+    }
+  }
+  // --- Org Switching ---
+  /**
+   * Switch the active organization context.
+   * Fetches the org details and the user's membership/role.
+   */
+  async switchOrg(orgId) {
+    const org = await this.request(`/orgs/${orgId}`, { method: "GET" });
+    const membership = await this.request(`/orgs/${orgId}/membership`, {
+      method: "GET"
+    });
+    this._activeOrgId = orgId;
+    this._activeOrg = org;
+    this._activeRole = membership.role;
+    this.notifyListeners();
+  }
+  /**
+   * Clear the active organization (no org selected).
+   */
+  clearActiveOrg() {
+    this._activeOrgId = null;
+    this._activeOrg = null;
+    this._activeRole = null;
+    this.notifyListeners();
+  }
+  // --- Member Management ---
+  /**
+   * List members of an organization.
+   */
+  async listMembers(orgId) {
+    return this.request(`/orgs/${orgId}/members`, { method: "GET" });
+  }
+  /**
+   * Remove a member from an organization.
+   */
+  async removeMember(orgId, userId) {
+    await this.request(`/orgs/${orgId}/members/${userId}`, { method: "DELETE" });
+  }
+  /**
+   * Update a member's role.
+   */
+  async updateMemberRole(orgId, userId, role) {
+    return this.request(`/orgs/${orgId}/members/${userId}/role`, {
+      method: "PATCH",
+      body: { role }
+    });
+  }
+  /**
+   * Transfer ownership to another member.
+   */
+  async transferOwnership(orgId, newOwnerId) {
+    await this.request(`/orgs/${orgId}/transfer`, {
+      method: "POST",
+      body: { newOwnerId }
+    });
+  }
+  /**
+   * Leave an organization (remove yourself).
+   */
+  async leaveOrg(orgId) {
+    await this.request(`/orgs/${orgId}/leave`, { method: "POST" });
+    if (this._activeOrgId === orgId) {
+      this._activeOrgId = null;
+      this._activeOrg = null;
+      this._activeRole = null;
+      this.notifyListeners();
+    }
+  }
+  // --- Invitations ---
+  /**
+   * Invite a user to an organization by email.
+   */
+  async inviteMember(orgId, params) {
+    return this.request(`/orgs/${orgId}/invitations`, {
+      method: "POST",
+      body: params
+    });
+  }
+  /**
+   * Accept an invitation by token.
+   */
+  async acceptInvitation(token) {
+    return this.request("/invitations/accept", {
+      method: "POST",
+      body: { token }
+    });
+  }
+  /**
+   * List pending invitations for an organization.
+   */
+  async listInvitations(orgId) {
+    return this.request(`/orgs/${orgId}/invitations`, { method: "GET" });
+  }
+  /**
+   * Revoke a pending invitation.
+   */
+  async revokeInvitation(orgId, invitationId) {
+    await this.request(`/orgs/${orgId}/invitations/${invitationId}`, { method: "DELETE" });
+  }
+  /**
+   * List pending invitations for the current user's email.
+   */
+  async listMyInvitations(email) {
+    return this.request(
+      `/invitations?email=${encodeURIComponent(email)}`,
+      { method: "GET" }
+    );
+  }
+  // --- Subscriptions ---
+  /**
+   * Subscribe to active org changes.
+   * @returns Unsubscribe function
+   */
+  onOrgChange(callback) {
+    this.listeners.add(callback);
+    return () => {
+      this.listeners.delete(callback);
+    };
+  }
+  // --- Internal ---
+  notifyListeners() {
+    for (const listener of this.listeners) {
+      try {
+        listener(this._activeOrgId);
+      } catch {
+      }
+    }
+  }
+  async request(path, options) {
+    const token = await this.getAccessToken();
+    if (!token) {
+      throw new OrgClientError(
+        "Not authenticated. Sign in before performing organization operations.",
+        "ORG_NOT_AUTHENTICATED"
+      );
+    }
+    const url = `${this.serverUrl}${path}`;
+    const headers = {
+      Authorization: `Bearer ${token}`
+    };
+    if (options.body) {
+      headers["Content-Type"] = "application/json";
+    }
+    let response;
+    try {
+      response = await fetch(url, {
+        method: options.method,
+        headers,
+        body: options.body ? JSON.stringify(options.body) : void 0
+      });
+    } catch (cause) {
+      throw new OrgClientError(
+        `Network request to ${path} failed.`,
+        "ORG_NETWORK_ERROR",
+        { path, cause: cause instanceof Error ? cause.message : String(cause) }
+      );
+    }
+    if (!response.ok) {
+      let errorMessage = `Server returned HTTP ${response.status}`;
+      try {
+        const body = await response.json();
+        if (typeof body["error"] === "string") {
+          errorMessage = body["error"];
+        }
+      } catch {
+      }
+      throw new OrgClientError(errorMessage, "ORG_SERVER_ERROR", {
+        path,
+        status: response.status
+      });
+    }
+    const text = await response.text();
+    if (text.length === 0) return void 0;
+    try {
+      const body = JSON.parse(text);
+      if (body && typeof body === "object" && "data" in body) {
+        return body.data;
+      }
+      return body;
+    } catch {
+      return void 0;
+    }
+  }
+};
+
+// src/device/device-store.ts
+import { KoraError as KoraError3 } from "@korajs/core";
+var DeviceKeyStoreError = class extends KoraError3 {
+  constructor(message, context) {
+    super(message, "DEVICE_KEY_STORE_ERROR", context);
+    this.name = "DeviceKeyStoreError";
+  }
+};
+var IDB_DATABASE_NAME = "kora_device_keys";
+var IDB_STORE_NAME = "keypairs";
+var IDB_VERSION = 1;
+var IndexedDBDeviceKeyStore = class {
+  dbPromise = null;
+  /**
+   * Opens (or creates) the IndexedDB database.
+   *
+   * The database connection is lazily initialized on first use and
+   * reused for subsequent operations. If the database does not exist,
+   * it is created with the `keypairs` object store.
+   */
+  openDatabase() {
+    if (this.dbPromise !== null) {
+      return this.dbPromise;
+    }
+    this.dbPromise = new Promise((resolve, reject) => {
+      let request;
+      try {
+        request = globalThis.indexedDB.open(IDB_DATABASE_NAME, IDB_VERSION);
+      } catch (cause) {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError(
+            "Failed to open IndexedDB database for device key storage. IndexedDB may be unavailable or access may be denied.",
+            { cause: cause instanceof Error ? cause.message : String(cause) }
+          )
+        );
+        return;
+      }
+      request.onupgradeneeded = () => {
+        const db = request.result;
+        if (!db.objectStoreNames.contains(IDB_STORE_NAME)) {
+          db.createObjectStore(IDB_STORE_NAME);
+        }
+      };
+      request.onsuccess = () => {
+        resolve(request.result);
+      };
+      request.onerror = () => {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError(
+            "Failed to open IndexedDB database for device key storage.",
+            { error: request.error?.message }
+          )
+        );
+      };
+      request.onblocked = () => {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError(
+            "IndexedDB database open was blocked. Another tab may have an older version of the database open. Close other tabs and try again."
+          )
+        );
+      };
+    });
+    return this.dbPromise;
+  }
+  /** @inheritdoc */
+  async saveKeyPair(deviceId, keyPair) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        store.put(keyPair, deviceId);
+        tx.oncomplete = () => {
+          resolve();
+        };
+        tx.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(
+              `Failed to save key pair for device "${deviceId}".`,
+              { deviceId, error: tx.error?.message }
+            )
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(
+            `Failed to save key pair for device "${deviceId}".`,
+            {
+              deviceId,
+              cause: cause instanceof Error ? cause.message : String(cause)
+            }
+          )
+        );
+      }
+    });
+  }
+  /** @inheritdoc */
+  async loadKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readonly");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        const request = store.get(deviceId);
+        request.onsuccess = () => {
+          const result = request.result;
+          resolve(result ?? null);
+        };
+        request.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(
+              `Failed to load key pair for device "${deviceId}".`,
+              { deviceId, error: request.error?.message }
+            )
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(
+            `Failed to load key pair for device "${deviceId}".`,
+            {
+              deviceId,
+              cause: cause instanceof Error ? cause.message : String(cause)
+            }
+          )
+        );
+      }
+    });
+  }
+  /** @inheritdoc */
+  async deleteKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        store.delete(deviceId);
+        tx.oncomplete = () => {
+          resolve();
+        };
+        tx.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(
+              `Failed to delete key pair for device "${deviceId}".`,
+              { deviceId, error: tx.error?.message }
+            )
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(
+            `Failed to delete key pair for device "${deviceId}".`,
+            {
+              deviceId,
+              cause: cause instanceof Error ? cause.message : String(cause)
+            }
+          )
+        );
+      }
+    });
+  }
+  /** @inheritdoc */
+  async hasKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readonly");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        const request = store.count(deviceId);
+        request.onsuccess = () => {
+          resolve(request.result > 0);
+        };
+        request.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(
+              `Failed to check if key pair exists for device "${deviceId}".`,
+              { deviceId, error: request.error?.message }
+            )
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(
+            `Failed to check if key pair exists for device "${deviceId}".`,
+            {
+              deviceId,
+              cause: cause instanceof Error ? cause.message : String(cause)
+            }
+          )
+        );
+      }
+    });
+  }
+};
+var InMemoryDeviceKeyStore = class {
+  store = /* @__PURE__ */ new Map();
+  /** @inheritdoc */
+  async saveKeyPair(deviceId, keyPair) {
+    this.store.set(deviceId, keyPair);
+  }
+  /** @inheritdoc */
+  async loadKeyPair(deviceId) {
+    return this.store.get(deviceId) ?? null;
+  }
+  /** @inheritdoc */
+  async deleteKeyPair(deviceId) {
+    this.store.delete(deviceId);
+  }
+  /** @inheritdoc */
+  async hasKeyPair(deviceId) {
+    return this.store.has(deviceId);
+  }
+};
+function createDeviceKeyStore() {
+  if (typeof globalThis.indexedDB !== "undefined") {
+    return new IndexedDBDeviceKeyStore();
+  }
+  return new InMemoryDeviceKeyStore();
+}
+
 // src/tokens/token-store.ts
 var DEFAULT_STORAGE_KEY = "kora_auth_tokens";
 var MemoryStorage = class {
@@ -535,16 +1054,420 @@ var TokenStore = class {
     return tokens?.refreshToken ?? null;
   }
 };
+
+// src/tokens/encrypted-token-store.ts
+import { KoraError as KoraError4 } from "@korajs/core";
+var EncryptedTokenStoreError = class extends KoraError4 {
+  constructor(message, context) {
+    super(message, "ENCRYPTED_TOKEN_STORE_ERROR", context);
+    this.name = "EncryptedTokenStoreError";
+  }
+};
+function toBase64Url2(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url2(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingNeeded = (4 - base64.length % 4) % 4;
+  base64 += "=".repeat(paddingNeeded);
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+var MemoryStorage2 = class {
+  store = /* @__PURE__ */ new Map();
+  getItem(key) {
+    return this.store.get(key) ?? null;
+  }
+  setItem(key, value) {
+    this.store.set(key, value);
+  }
+  removeItem(key) {
+    this.store.delete(key);
+  }
+};
+function tryGetLocalStorage2() {
+  try {
+    if (typeof globalThis !== "undefined" && "localStorage" in globalThis) {
+      const storage = globalThis.localStorage;
+      const testKey = "__kora_encrypted_storage_test__";
+      storage.setItem(testKey, "1");
+      storage.removeItem(testKey);
+      return storage;
+    }
+  } catch {
+  }
+  return null;
+}
+var DEFAULT_STORAGE_KEY2 = "kora_auth_encrypted";
+var EncryptedTokenStore = class {
+  storageKey;
+  key;
+  storage;
+  /**
+   * Creates a new EncryptedTokenStore instance.
+   *
+   * @param config - Configuration including the encryption key and optional storage key
+   */
+  constructor(config) {
+    this.storageKey = config.storageKey ?? DEFAULT_STORAGE_KEY2;
+    this.key = config.key;
+    this.storage = tryGetLocalStorage2() ?? new MemoryStorage2();
+  }
+  /**
+   * Encrypt and save tokens to persistent storage.
+   *
+   * Serializes the tokens as JSON, encrypts with AES-256-GCM using a fresh
+   * random IV, then stores the result as a JSON object containing the
+   * base64url-encoded IV and ciphertext.
+   *
+   * Overwrites any previously stored tokens.
+   *
+   * @param tokens - The token set to encrypt and store
+   * @throws {EncryptedTokenStoreError} If encryption fails
+   */
+  async saveTokens(tokens) {
+    const serialized = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken
+    };
+    if (tokens.deviceCredential !== void 0) {
+      serialized.deviceCredential = tokens.deviceCredential;
+    }
+    const plaintext = new TextEncoder().encode(JSON.stringify(serialized));
+    try {
+      const { ciphertext, iv } = await encryptData(this.key, plaintext);
+      const payload = {
+        iv: toBase64Url2(iv),
+        data: toBase64Url2(ciphertext)
+      };
+      this.storage.setItem(this.storageKey, JSON.stringify(payload));
+    } catch (cause) {
+      if (cause instanceof EncryptedTokenStoreError) {
+        throw cause;
+      }
+      throw new EncryptedTokenStoreError(
+        "Failed to encrypt and save auth tokens. Ensure the encryption key is a valid AES-256-GCM CryptoKey.",
+        { cause: cause instanceof Error ? cause.message : String(cause) }
+      );
+    }
+  }
+  /**
+   * Load and decrypt tokens from storage.
+   *
+   * Reads the encrypted payload from localStorage, decodes the base64url IV
+   * and ciphertext, decrypts with AES-256-GCM, and parses the resulting JSON.
+   *
+   * Returns null (without throwing) if:
+   * - No tokens have been saved
+   * - The stored data is corrupted or not valid JSON
+   * - Decryption fails (wrong key, tampered ciphertext, or wrong IV)
+   * - The decrypted data does not contain valid token fields
+   *
+   * This fail-silent design prevents decryption errors from crashing the
+   * application. The caller should treat null as "no valid tokens available"
+   * and initiate a re-authentication flow.
+   *
+   * @returns The decrypted {@link AuthTokens}, or null if unavailable or decryption fails
+   */
+  async loadTokens() {
+    const raw = this.storage.getItem(this.storageKey);
+    if (raw === null) {
+      return null;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return null;
+      }
+      const record = parsed;
+      if (typeof record["iv"] !== "string" || typeof record["data"] !== "string") {
+        return null;
+      }
+      const iv = fromBase64Url2(record["iv"]);
+      const ciphertext = fromBase64Url2(record["data"]);
+      const plaintextBytes = await decryptData(this.key, ciphertext, iv);
+      const json = new TextDecoder().decode(plaintextBytes);
+      const tokenData = JSON.parse(json);
+      if (typeof tokenData !== "object" || tokenData === null || Array.isArray(tokenData)) {
+        return null;
+      }
+      const tokenRecord = tokenData;
+      if (typeof tokenRecord["accessToken"] !== "string" || typeof tokenRecord["refreshToken"] !== "string") {
+        return null;
+      }
+      const tokens = {
+        accessToken: tokenRecord["accessToken"],
+        refreshToken: tokenRecord["refreshToken"]
+      };
+      if (typeof tokenRecord["deviceCredential"] === "string") {
+        tokens.deviceCredential = tokenRecord["deviceCredential"];
+      }
+      return tokens;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Clear all stored encrypted tokens.
+   *
+   * Removes the encrypted payload from storage. This is a synchronous
+   * operation since it only removes the localStorage entry.
+   *
+   * Call this on logout to ensure no encrypted credential material
+   * remains in persistent storage.
+   */
+  clearTokens() {
+    this.storage.removeItem(this.storageKey);
+  }
+  /**
+   * Get the current access token by decrypting stored tokens.
+   *
+   * Returns the raw token string without validating expiration.
+   * The caller is responsible for checking whether the token is
+   * still valid and initiating a refresh if needed.
+   *
+   * @returns The decrypted access token string, or null if no valid tokens are stored
+   */
+  async getAccessToken() {
+    const tokens = await this.loadTokens();
+    return tokens?.accessToken ?? null;
+  }
+  /**
+   * Get the current refresh token by decrypting stored tokens.
+   *
+   * @returns The decrypted refresh token string, or null if no valid tokens are stored
+   */
+  async getRefreshToken() {
+    const tokens = await this.loadTokens();
+    return tokens?.refreshToken ?? null;
+  }
+};
+
+// src/encryption/key-derivation.ts
+import { KoraError as KoraError5 } from "@korajs/core";
+var KeyDerivationError = class extends KoraError5 {
+  constructor(message, context) {
+    super(message, "KEY_DERIVATION_ERROR", context);
+    this.name = "KeyDerivationError";
+  }
+};
+var SALT_LENGTH = 32;
+var PBKDF2_ITERATIONS = 6e5;
+var DERIVED_KEY_LENGTH = 256;
+function assertCryptoAvailable() {
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+    throw new KeyDerivationError(
+      "Web Crypto API (crypto.subtle) is not available in this environment. Key derivation requires crypto.subtle, which is available in modern browsers and Node.js 20+."
+    );
+  }
+}
+function generateSalt() {
+  if (typeof globalThis.crypto === "undefined") {
+    throw new KeyDerivationError(
+      "Web Crypto API (crypto) is not available. Cannot generate random salt."
+    );
+  }
+  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+}
+async function deriveEncryptionKey(passphrase, salt) {
+  assertCryptoAvailable();
+  if (passphrase.length === 0) {
+    throw new KeyDerivationError(
+      "Passphrase must not be empty. Provide a non-empty string for key derivation."
+    );
+  }
+  const usedSalt = salt ?? generateSalt();
+  try {
+    const passphraseBytes = new TextEncoder().encode(passphrase);
+    const baseKey = await globalThis.crypto.subtle.importKey(
+      "raw",
+      passphraseBytes,
+      "PBKDF2",
+      false,
+      ["deriveBits", "deriveKey"]
+    );
+    const derivedKey = await globalThis.crypto.subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: usedSalt,
+        iterations: PBKDF2_ITERATIONS,
+        hash: "SHA-256"
+      },
+      baseKey,
+      { name: "AES-GCM", length: DERIVED_KEY_LENGTH },
+      // extractable: true so the derived key can be exported if needed
+      true,
+      ["encrypt", "decrypt"]
+    );
+    return { key: derivedKey, salt: usedSalt };
+  } catch (cause) {
+    if (cause instanceof KeyDerivationError) {
+      throw cause;
+    }
+    throw new KeyDerivationError(
+      "Failed to derive encryption key from passphrase using PBKDF2. Ensure the runtime supports PBKDF2 with SHA-256.",
+      { cause: cause instanceof Error ? cause.message : String(cause) }
+    );
+  }
+}
+
+// src/encryption/auto-lock.ts
+var AutoLockManager = class {
+  _timeout;
+  _onLock;
+  _timerId = null;
+  _isLocked = false;
+  _isRunning = false;
+  constructor(config) {
+    if (config.timeout <= 0) {
+      throw new Error(
+        `AutoLockManager timeout must be a positive number, but received ${config.timeout}.`
+      );
+    }
+    this._timeout = config.timeout;
+    this._onLock = config.onLock;
+  }
+  /**
+   * Whether the manager is currently in the locked state.
+   *
+   * Becomes `true` when the inactivity timeout fires or {@link lock} is called manually.
+   * Returns to `false` only when {@link unlock} is called.
+   */
+  get isLocked() {
+    return this._isLocked;
+  }
+  /**
+   * Starts monitoring for inactivity.
+   *
+   * Begins the inactivity countdown. If the manager is already running, this is
+   * a no-op to prevent creating multiple timers. Calling `start()` also resets
+   * the locked state if the manager was previously locked.
+   */
+  start() {
+    if (this._isRunning) {
+      return;
+    }
+    this._isRunning = true;
+    this._isLocked = false;
+    this._startTimer();
+  }
+  /**
+   * Stops monitoring for inactivity.
+   *
+   * Clears the pending inactivity timer. Does not change the lock state: if
+   * the manager was locked, it remains locked. If unlocked, it remains unlocked.
+   * To resume monitoring, call {@link start} again.
+   */
+  stop() {
+    this._isRunning = false;
+    this._clearTimer();
+  }
+  /**
+   * Reports user activity, resetting the inactivity timer.
+   *
+   * Call this whenever the user interacts with the application (clicks, key presses,
+   * touches, etc.). If the manager is not running or is already locked, this is a no-op.
+   */
+  reportActivity() {
+    if (!this._isRunning || this._isLocked) {
+      return;
+    }
+    this._clearTimer();
+    this._startTimer();
+  }
+  /**
+   * Manually locks the manager immediately.
+   *
+   * Clears the inactivity timer and transitions to the locked state. The `onLock`
+   * callback is invoked. The manager remains running but locked: call {@link unlock}
+   * to return to the unlocked state, which will restart the inactivity timer.
+   */
+  lock() {
+    this._clearTimer();
+    if (!this._isLocked) {
+      this._isLocked = true;
+      this._onLock();
+    }
+  }
+  /**
+   * Unlocks the manager, returning to the unlocked state.
+   *
+   * If the manager is running, the inactivity timer is restarted. If the manager
+   * is not running (was stopped), it simply clears the locked state without
+   * starting a timer.
+   */
+  unlock() {
+    this._isLocked = false;
+    if (this._isRunning) {
+      this._clearTimer();
+      this._startTimer();
+    }
+  }
+  /**
+   * Starts the inactivity timer. When it fires, the manager locks.
+   */
+  _startTimer() {
+    this._timerId = setTimeout(() => {
+      this._timerId = null;
+      this._isLocked = true;
+      this._onLock();
+    }, this._timeout);
+  }
+  /**
+   * Clears the pending inactivity timer, if any.
+   */
+  _clearTimer() {
+    if (this._timerId !== null) {
+      clearTimeout(this._timerId);
+      this._timerId = null;
+    }
+  }
+};
 export {
   AuthClient,
   AuthError,
+  AutoLockManager,
   CryptoUnavailableError,
   DeviceIdentityError,
+  DeviceKeyStoreError,
+  EncryptedTokenStore,
+  EncryptedTokenStoreError,
+  EncryptionError,
+  InMemoryDeviceKeyStore,
+  IndexedDBDeviceKeyStore,
+  KeyDerivationError,
+  OperationEncryptionError,
+  OperationEncryptor,
+  OrgClient,
+  OrgClientError,
+  PasskeyError,
+  PasskeyUnsupportedError,
   TokenStore,
+  authenticateWithPasskey,
   computePublicKeyThumbprint,
+  createDeviceKeyStore,
+  createPasskeyCredential,
+  decryptData,
+  deriveEncryptionKey,
+  encryptData,
+  exportKey,
   exportPublicKeyJwk,
   fromBase64Url,
   generateDeviceKeyPair,
+  generateEncryptionKey,
+  generateSalt,
+  importKey,
+  isEncryptedField,
+  isPasskeySupported,
+  isPlatformAuthenticatorAvailable,
   signChallenge,
   toBase64Url,
   verifyChallenge