@korajs/auth 0.1.0 → 0.3.1

package/dist/server.js

@@ -1,7 +1,23 @@
 import {
+  OperationEncryptionError,
+  OperationEncryptor,
   computePublicKeyThumbprint,
+  decodeCbor,
+  fromBase64Url,
+  isEncryptedField,
+  toBase64Url,
   verifyChallenge
-} from "./chunk-L554ZDPY.js";
+} from "./chunk-FSU4SK32.js";
+import {
+  hashPassword,
+  verifyPassword
+} from "./chunk-HOZXDR6Y.js";
+
+// src/provider/built-in/auth-routes.ts
+import { randomBytes as randomBytes2 } from "crypto";
+
+// src/tokens/token-manager.ts
+import { randomBytes, randomUUID } from "crypto";
 
 // src/types.ts
 import { KoraError } from "@korajs/core";
@@ -60,6 +76,9 @@ function verifyJwt(token, secret) {
   if (headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
     return null;
   }
+  if (headerSegment !== ENCODED_HEADER) {
+    return null;
+  }
   const signingInput = `${headerSegment}.${payloadSegment}`;
   const expectedSignature = hmacSha256Base64url(signingInput, secret);
   if (expectedSignature.length !== signatureSegment.length) {
@@ -83,25 +102,83 @@ function verifyJwt(token, secret) {
     return null;
   }
 }
+var CLOCK_SKEW_TOLERANCE_SECONDS = 5;
 function isExpired(payload) {
   if (typeof payload.exp !== "number") {
     return false;
   }
   const nowSeconds = Math.floor(Date.now() / 1e3);
-  return nowSeconds >= payload.exp;
+  return nowSeconds >= payload.exp + CLOCK_SKEW_TOLERANCE_SECONDS;
 }
 
 // src/tokens/token-manager.ts
+var MIN_SECRET_LENGTH = 32;
+var InMemoryTokenRevocationStore = class {
+  revokedTokens = /* @__PURE__ */ new Map();
+  revokedDevices = /* @__PURE__ */ new Set();
+  async isRevoked(jti) {
+    return this.revokedTokens.has(jti);
+  }
+  async revoke(jti, expiresAt) {
+    this.revokedTokens.set(jti, expiresAt);
+  }
+  async revokeAllForDevice(deviceId) {
+    this.revokedDevices.add(deviceId);
+  }
+  /**
+   * Check if a device has been revoked.
+   */
+  isDeviceRevoked(deviceId) {
+    return this.revokedDevices.has(deviceId);
+  }
+  /**
+   * Remove expired revocations to prevent unbounded memory growth.
+   * Call periodically (e.g., every hour) in long-running servers.
+   */
+  cleanup() {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    for (const [jti, expiresAt] of this.revokedTokens) {
+      if (nowSeconds > expiresAt) {
+        this.revokedTokens.delete(jti);
+      }
+    }
+  }
+};
 var TokenManager = class {
-  secret;
+  /** All signing/verification secrets (index 0 = current signing key) */
+  secrets;
   accessTokenLifetime;
   refreshTokenLifetime;
   deviceCredentialLifetime;
+  revocationStore;
   constructor(config) {
-    this.secret = config.secret;
+    const secrets = Array.isArray(config.secret) ? config.secret : [config.secret];
+    if (secrets.length === 0) {
+      throw new Error("TokenManager requires at least one secret.");
+    }
+    for (const secret of secrets) {
+      if (secret.length < MIN_SECRET_LENGTH) {
+        throw new Error(
+          `JWT secret must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for HMAC-SHA256 security. Received ${secret.length} characters. Use TokenManager.generateSecret() to generate a secure secret.`
+        );
+      }
+    }
+    this.secrets = secrets;
     this.accessTokenLifetime = config.accessTokenLifetime ?? DEFAULT_ACCESS_TOKEN_LIFETIME;
     this.refreshTokenLifetime = config.refreshTokenLifetime ?? DEFAULT_REFRESH_TOKEN_LIFETIME;
     this.deviceCredentialLifetime = config.deviceCredentialLifetime ?? DEFAULT_DEVICE_CREDENTIAL_LIFETIME;
+    this.revocationStore = config.revocationStore;
+  }
+  /**
+   * Generate a cryptographically random secret suitable for HMAC-SHA256 signing.
+   *
+   * Returns a 64-character hex string (32 bytes / 256 bits of entropy).
+   * Store this securely (environment variable, secrets manager) — never in source code.
+   *
+   * @returns A random 256-bit hex-encoded secret
+   */
+  static generateSecret() {
+    return randomBytes(32).toString("hex");
   }
   /**
    * Issue a signed JWT access token.
@@ -117,13 +194,14 @@ var TokenManager = class {
   issueAccessToken(userId, deviceId) {
     const nowSeconds = Math.floor(Date.now() / 1e3);
     const payload = {
+      jti: randomUUID(),
       sub: userId,
       dev: deviceId,
       type: "access",
       iat: nowSeconds,
       exp: nowSeconds + Math.floor(this.accessTokenLifetime / 1e3)
     };
-    return encodeJwt(payload, this.secret);
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
    * Issue a signed JWT refresh token.
@@ -139,13 +217,14 @@ var TokenManager = class {
   issueRefreshToken(userId, deviceId) {
     const nowSeconds = Math.floor(Date.now() / 1e3);
     const payload = {
+      jti: randomUUID(),
       sub: userId,
       dev: deviceId,
       type: "refresh",
       iat: nowSeconds,
       exp: nowSeconds + Math.floor(this.refreshTokenLifetime / 1e3)
     };
-    return encodeJwt(payload, this.secret);
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
    * Issue a signed device credential token.
@@ -163,6 +242,7 @@ var TokenManager = class {
     const nowSeconds = Math.floor(Date.now() / 1e3);
     const lifetimeSeconds = Math.floor(this.deviceCredentialLifetime / 1e3);
     const payload = {
+      jti: randomUUID(),
       sub: userId,
       dev: deviceId,
       type: "device_credential",
@@ -171,7 +251,7 @@ var TokenManager = class {
       dpk: publicKeyThumbprint,
       mustCheckinBy: nowSeconds + lifetimeSeconds
     };
-    return encodeJwt(payload, this.secret);
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
    * Issue a complete set of authentication tokens.
@@ -202,7 +282,8 @@ var TokenManager = class {
   /**
    * Validate and decode a token.
    *
-   * Verifies the HMAC-SHA256 signature and checks that the token has not expired.
+   * Verifies the HMAC-SHA256 signature (trying all configured secrets for key rotation),
+   * checks that the token has not expired, and validates all required claims.
    * Returns null (rather than throwing) for invalid or expired tokens, so callers
    * can handle authentication failure without try/catch.
    *
@@ -211,14 +292,20 @@ var TokenManager = class {
    *   invalid, expired, or missing required claims
    */
   validateToken(token) {
-    const decoded = verifyJwt(token, this.secret);
+    let decoded = null;
+    for (const secret of this.secrets) {
+      decoded = verifyJwt(token, secret);
+      if (decoded !== null) {
+        break;
+      }
+    }
     if (decoded === null) {
       return null;
     }
     if (isExpired(decoded)) {
       return null;
     }
-    if (typeof decoded["sub"] !== "string" || typeof decoded["dev"] !== "string" || typeof decoded["type"] !== "string" || typeof decoded["iat"] !== "number" || typeof decoded["exp"] !== "number") {
+    if (typeof decoded["jti"] !== "string" || typeof decoded["sub"] !== "string" || typeof decoded["dev"] !== "string" || typeof decoded["type"] !== "string" || typeof decoded["iat"] !== "number" || typeof decoded["exp"] !== "number") {
       return null;
     }
     const type = decoded["type"];
@@ -226,6 +313,7 @@ var TokenManager = class {
       return null;
     }
     return {
+      jti: decoded["jti"],
       sub: decoded["sub"],
       dev: decoded["dev"],
       type,
@@ -233,19 +321,69 @@ var TokenManager = class {
       exp: decoded["exp"]
     };
   }
+  /**
+   * Validate a token and check it against the revocation store.
+   *
+   * Like {@link validateToken}, but also checks whether the token's `jti` has been
+   * revoked. Requires a revocation store to be configured.
+   *
+   * @param token - The JWT string to validate
+   * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
+   */
+  async validateTokenWithRevocation(token) {
+    const payload = this.validateToken(token);
+    if (payload === null) {
+      return null;
+    }
+    if (this.revocationStore) {
+      const revoked = await this.revocationStore.isRevoked(payload.jti);
+      if (revoked) {
+        return null;
+      }
+    }
+    return payload;
+  }
+  /**
+   * Revoke a specific token by its JWT ID.
+   *
+   * Requires a revocation store to be configured. After revocation, the token
+   * will be rejected by {@link validateTokenWithRevocation}.
+   *
+   * @param jti - The JWT ID of the token to revoke
+   * @param expiresAt - The token's expiration time (seconds since epoch)
+   */
+  async revokeToken(jti, expiresAt) {
+    if (this.revocationStore) {
+      await this.revocationStore.revoke(jti, expiresAt);
+    }
+  }
+  /**
+   * Revoke all tokens for a specific device.
+   *
+   * Called when a device is revoked to ensure all its existing tokens
+   * (access, refresh, and device credentials) are invalidated.
+   *
+   * @param deviceId - The device ID whose tokens should be revoked
+   */
+  async revokeDeviceTokens(deviceId) {
+    if (this.revocationStore) {
+      await this.revocationStore.revokeAllForDevice(deviceId);
+    }
+  }
   /**
    * Refresh an access token using a valid refresh token.
    *
-   * Implements **refresh token rotation**: a new refresh token is issued alongside
-   * the new access token, and the old refresh token should be considered consumed.
-   * This limits the window of vulnerability if a refresh token is compromised.
+   * Implements **refresh token rotation with reuse detection**: a new refresh token
+   * is issued alongside the new access token. The old refresh token's `jti` is
+   * recorded in the revocation store (if configured). If a previously consumed
+   * refresh token is presented again, it indicates potential token theft.
    *
    * Returns null if the provided token is invalid, expired, or not a refresh token.
    *
    * @param refreshToken - The refresh token JWT string
    * @returns A new access/refresh token pair, or null if the refresh token is invalid
    */
-  refreshAccessToken(refreshToken) {
+  async refreshAccessToken(refreshToken) {
     const payload = this.validateToken(refreshToken);
     if (payload === null) {
       return null;
@@ -253,6 +391,14 @@ var TokenManager = class {
     if (payload.type !== "refresh") {
       return null;
     }
+    if (this.revocationStore) {
+      const wasRevoked = await this.revocationStore.isRevoked(payload.jti);
+      if (wasRevoked) {
+        await this.revocationStore.revokeAllForDevice(payload.dev);
+        return null;
+      }
+      await this.revocationStore.revoke(payload.jti, payload.exp);
+    }
     return {
       accessToken: this.issueAccessToken(payload.sub, payload.dev),
       refreshToken: this.issueRefreshToken(payload.sub, payload.dev)
@@ -260,62 +406,14 @@ var TokenManager = class {
   }
 };
 
-// src/provider/built-in/password-hash.ts
-import { randomBytes, pbkdf2, timingSafeEqual } from "crypto";
-var PBKDF2_ITERATIONS = 6e5;
-var PBKDF2_DIGEST = "sha512";
-var KEY_LENGTH = 64;
-var SALT_LENGTH = 32;
-async function hashPassword(password) {
-  const salt = randomBytes(SALT_LENGTH);
-  const derivedKey = await pbkdf2Async(
-    password,
-    salt,
-    PBKDF2_ITERATIONS,
-    KEY_LENGTH,
-    PBKDF2_DIGEST
-  );
-  return {
-    hash: derivedKey.toString("hex"),
-    salt: salt.toString("hex")
-  };
-}
-async function verifyPassword(password, hash, salt) {
-  const saltBuffer = Buffer.from(salt, "hex");
-  const derivedKey = await pbkdf2Async(
-    password,
-    saltBuffer,
-    PBKDF2_ITERATIONS,
-    KEY_LENGTH,
-    PBKDF2_DIGEST
-  );
-  const hashBuffer = Buffer.from(hash, "hex");
-  if (derivedKey.length !== hashBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual(derivedKey, hashBuffer);
-}
-function pbkdf2Async(password, salt, iterations, keyLength, digest) {
-  return new Promise((resolve, reject) => {
-    pbkdf2(password, salt, iterations, keyLength, digest, (err, derivedKey) => {
-      if (err) {
-        reject(err);
-      } else {
-        resolve(derivedKey);
-      }
-    });
-  });
-}
-
 // src/provider/built-in/user-store.ts
 import { KoraError as KoraError2 } from "@korajs/core";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 var DuplicateEmailError = class extends KoraError2 {
-  constructor(email) {
+  constructor() {
     super(
-      `A user with email "${email}" already exists. Use a different email address or sign in to the existing account.`,
-      "DUPLICATE_EMAIL",
-      { email }
+      "A user with this email already exists.",
+      "DUPLICATE_EMAIL"
     );
     this.name = "DuplicateEmailError";
   }
@@ -343,14 +441,15 @@ var InMemoryUserStore = class {
   async createUser(params) {
     const normalizedEmail = params.email.toLowerCase();
     if (this.usersByEmail.has(normalizedEmail)) {
-      throw new DuplicateEmailError(params.email);
+      throw new DuplicateEmailError();
     }
     const now = Date.now();
-    const id = randomUUID();
+    const id = randomUUID2();
     const storedUser = {
       id,
       email: normalizedEmail,
       name: params.name,
+      emailVerified: false,
       createdAt: now,
       passwordHash: params.passwordHash,
       salt: params.salt
@@ -458,6 +557,69 @@ var InMemoryUserStore = class {
       device.revoked = true;
     }
   }
+  /**
+   * Set a user's email verification status.
+   *
+   * @param userId - The user whose email to verify
+   * @param verified - Whether the email is verified
+   */
+  async setEmailVerified(userId, verified) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, emailVerified: verified };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
+  }
+  /**
+   * Update a user's password hash and salt.
+   *
+   * @param userId - The user whose password to update
+   * @param passwordHash - New hex-encoded PBKDF2 derived key
+   * @param salt - New hex-encoded salt
+   */
+  async updatePassword(userId, passwordHash, salt) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, passwordHash, salt };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
+  }
+  /**
+   * List all users. For admin/development use.
+   */
+  async listAll() {
+    return [...this.usersById.values()];
+  }
+  /**
+   * Update a stored user record.
+   */
+  async update(user) {
+    const existing = this.usersById.get(user.id);
+    if (!existing) return;
+    if (existing.email !== user.email) {
+      this.usersByEmail.delete(existing.email);
+      this.usersByEmail.set(user.email, user);
+    } else {
+      this.usersByEmail.set(user.email, user);
+    }
+    this.usersById.set(user.id, user);
+  }
+  /**
+   * Delete a user and all associated devices.
+   */
+  async delete(userId) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    this.usersById.delete(userId);
+    this.usersByEmail.delete(user.email);
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds) {
+      for (const deviceId of deviceIds) {
+        this.devicesById.delete(deviceId);
+      }
+      this.devicesByUserId.delete(userId);
+    }
+  }
   /**
    * Update the last-seen timestamp for a device.
    *
@@ -478,12 +640,73 @@ function toAuthUser(stored) {
     id: stored.id,
     email: stored.email,
     name: stored.name,
+    emailVerified: stored.emailVerified,
     createdAt: stored.createdAt
   };
 }
 
 // src/provider/built-in/auth-routes.ts
+var InMemoryChallengeStore = class {
+  challenges = /* @__PURE__ */ new Map();
+  async store(challenge, deviceId, expiresAt) {
+    this.challenges.set(challenge, { deviceId, expiresAt });
+  }
+  async consume(challenge) {
+    const entry = this.challenges.get(challenge);
+    if (entry === void 0) {
+      return null;
+    }
+    this.challenges.delete(challenge);
+    if (Date.now() > entry.expiresAt) {
+      return null;
+    }
+    return { deviceId: entry.deviceId };
+  }
+  /**
+   * Remove expired challenges to prevent unbounded memory growth.
+   */
+  cleanup() {
+    const now = Date.now();
+    for (const [challenge, entry] of this.challenges) {
+      if (now > entry.expiresAt) {
+        this.challenges.delete(challenge);
+      }
+    }
+  }
+};
+var InMemoryRateLimiter = class {
+  attempts = /* @__PURE__ */ new Map();
+  maxAttempts;
+  windowMs;
+  /**
+   * @param maxAttempts - Maximum number of attempts within the time window (default: 10)
+   * @param windowMs - Time window in milliseconds (default: 60,000 = 1 minute)
+   */
+  constructor(maxAttempts = 10, windowMs = 6e4) {
+    this.maxAttempts = maxAttempts;
+    this.windowMs = windowMs;
+  }
+  async isAllowed(key) {
+    const now = Date.now();
+    const attempts = this.attempts.get(key) ?? [];
+    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
+    return recentAttempts.length < this.maxAttempts;
+  }
+  async record(key) {
+    const now = Date.now();
+    const attempts = this.attempts.get(key) ?? [];
+    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
+    recentAttempts.push(now);
+    this.attempts.set(key, recentAttempts);
+  }
+  async reset(key) {
+    this.attempts.delete(key);
+  }
+};
 var MIN_PASSWORD_LENGTH = 8;
+var MAX_PASSWORD_LENGTH = 128;
+var MAX_NAME_LENGTH = 200;
+var CHALLENGE_TTL_MS = 6e4;
 function isValidEmail(email) {
   if (email.length === 0 || email.length > 254) {
     return false;
@@ -504,12 +727,24 @@ function isValidEmail(email) {
   }
   return true;
 }
+function sanitizeName(name) {
+  const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
+  const trimmed = cleaned.trim();
+  if (trimmed.length > MAX_NAME_LENGTH) {
+    return trimmed.slice(0, MAX_NAME_LENGTH);
+  }
+  return trimmed;
+}
 var BuiltInAuthRoutes = class {
   userStore;
   tokenManager;
+  challengeStore;
+  rateLimiter;
   constructor(config) {
     this.userStore = config.userStore;
     this.tokenManager = config.tokenManager;
+    this.challengeStore = config.challengeStore ?? new InMemoryChallengeStore();
+    this.rateLimiter = config.rateLimiter ?? new InMemoryRateLimiter();
   }
   /**
    * Handle user sign-up (POST /auth/signup).
@@ -519,13 +754,22 @@ var BuiltInAuthRoutes = class {
    *
    * @param body - Sign-up request body
    * @param body.email - The user's email address
-   * @param body.password - The plaintext password (min 8 characters)
+   * @param body.password - The plaintext password (8-128 characters)
    * @param body.name - Optional display name (defaults to email local part)
    * @param body.deviceId - Optional device ID to register
    * @param body.devicePublicKey - Optional device public key (base64url)
+   * @param clientIp - Optional client IP for rate limiting
    * @returns Auth response with the created user and tokens, or an error
    */
-  async handleSignUp(body) {
+  async handleSignUp(body, clientIp) {
+    const rateLimitKey = clientIp ?? "global";
+    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+      return {
+        status: 429,
+        body: { error: "Too many requests. Please try again later." }
+      };
+    }
+    await this.rateLimiter.record(rateLimitKey);
     if (!isValidEmail(body.email)) {
       return {
         status: 400,
@@ -542,14 +786,24 @@ var BuiltInAuthRoutes = class {
         }
       };
     }
+    if (body.password.length > MAX_PASSWORD_LENGTH) {
+      return {
+        status: 400,
+        body: {
+          error: `Password must be at most ${MAX_PASSWORD_LENGTH} characters long.`
+        }
+      };
+    }
     const { hash, salt } = await hashPassword(body.password);
+    const rawName = body.name ?? body.email.split("@")[0] ?? body.email;
+    const name = sanitizeName(rawName);
     let user;
     try {
       user = await this.userStore.createUser({
         email: body.email,
         passwordHash: hash,
         salt,
-        name: body.name ?? body.email.split("@")[0] ?? body.email
+        name
       });
     } catch (err) {
       if (err instanceof Error && err.name === "DuplicateEmailError") {
@@ -586,9 +840,18 @@ var BuiltInAuthRoutes = class {
    * @param body.password - The plaintext password
    * @param body.deviceId - Optional device ID to register
    * @param body.devicePublicKey - Optional device public key (base64url)
+   * @param clientIp - Optional client IP for rate limiting
    * @returns Auth response with the user and tokens, or an error
    */
-  async handleSignIn(body) {
+  async handleSignIn(body, clientIp) {
+    const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
+    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+      return {
+        status: 429,
+        body: { error: "Too many sign-in attempts. Please try again later." }
+      };
+    }
+    await this.rateLimiter.record(rateLimitKey);
     const storedUser = await this.userStore.findByEmail(body.email);
     if (storedUser === null) {
       return {
@@ -607,6 +870,7 @@ var BuiltInAuthRoutes = class {
         body: { error: "Invalid email or password." }
       };
     }
+    await this.rateLimiter.reset(rateLimitKey);
     const deviceId = body.deviceId ?? `device-${storedUser.id}`;
     if (body.deviceId !== void 0 && body.devicePublicKey !== void 0) {
       await this.userStore.registerDevice({
@@ -621,6 +885,7 @@ var BuiltInAuthRoutes = class {
       id: storedUser.id,
       email: storedUser.email,
       name: storedUser.name,
+      emailVerified: storedUser.emailVerified,
       createdAt: storedUser.createdAt
     };
     return {
@@ -632,15 +897,15 @@ var BuiltInAuthRoutes = class {
    * Handle token refresh (POST /auth/refresh).
    *
    * Validates the provided refresh token and issues a new token pair
-   * (refresh token rotation). The old refresh token should be considered
-   * consumed after this call.
+   * (refresh token rotation with reuse detection). The old refresh token
+   * is marked as consumed in the revocation store.
    *
    * @param body - Refresh request body
    * @param body.refreshToken - The current refresh token
    * @returns Auth response with new tokens, or an error
    */
   async handleRefresh(body) {
-    const result = this.tokenManager.refreshAccessToken(body.refreshToken);
+    const result = await this.tokenManager.refreshAccessToken(body.refreshToken);
     if (result === null) {
       return {
         status: 401,
@@ -652,6 +917,38 @@ var BuiltInAuthRoutes = class {
       body: { data: result }
     };
   }
+  /**
+   * Handle sign-out (POST /auth/signout).
+   *
+   * Validates the access token and revokes the current refresh token
+   * (if a revocation store is configured). This ensures that stolen
+   * refresh tokens cannot be used after the user signs out.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param body - Sign-out request body
+   * @param body.refreshToken - The current refresh token to revoke
+   * @returns Auth response with success flag, or an error
+   */
+  async handleSignOut(accessToken, body) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    await this.tokenManager.revokeToken(payload.jti, payload.exp);
+    if (body.refreshToken) {
+      const refreshPayload = this.tokenManager.validateToken(body.refreshToken);
+      if (refreshPayload !== null && refreshPayload.type === "refresh") {
+        await this.tokenManager.revokeToken(refreshPayload.jti, refreshPayload.exp);
+      }
+    }
+    return {
+      status: 200,
+      body: { data: { success: true } }
+    };
+  }
   /**
    * Handle get-current-user (GET /auth/me).
    *
@@ -679,6 +976,7 @@ var BuiltInAuthRoutes = class {
       id: storedUser.id,
       email: storedUser.email,
       name: storedUser.name,
+      emailVerified: storedUser.emailVerified,
       createdAt: storedUser.createdAt
     };
     return {
@@ -711,8 +1009,8 @@ var BuiltInAuthRoutes = class {
   /**
    * Handle device revocation (DELETE /auth/device/:id).
    *
-   * Validates the access token and revokes the specified device.
-   * Only the device's owner can revoke it.
+   * Validates the access token, revokes the specified device, and invalidates
+   * all tokens issued to that device. Only the device's owner can revoke it.
    *
    * @param accessToken - The JWT access token (without "Bearer " prefix)
    * @param deviceId - The ID of the device to revoke
@@ -740,11 +1038,207 @@ var BuiltInAuthRoutes = class {
       };
     }
     await this.userStore.revokeDevice(deviceId);
+    await this.tokenManager.revokeDeviceTokens(deviceId);
     return {
       status: 200,
       body: { data: { success: true } }
     };
   }
+  /**
+   * Handle device registration (POST /auth/device/register).
+   *
+   * Requires a valid access token. Registers a new device for the authenticated
+   * user and issues a device credential token bound to the device's public key.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param body - Device registration request body
+   * @param body.deviceId - Unique identifier for the device
+   * @param body.publicKey - The device's public key as a JWK JSON string
+   * @param body.name - Human-readable device name (e.g., "Chrome on MacBook")
+   * @returns Auth response with the registered device and device credential, or an error
+   */
+  async handleDeviceRegister(accessToken, body) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const deviceName = sanitizeName(body.name);
+    if (deviceName.length === 0) {
+      return {
+        status: 400,
+        body: { error: "Device name must not be empty." }
+      };
+    }
+    let publicKeyJwk;
+    try {
+      publicKeyJwk = JSON.parse(body.publicKey);
+    } catch {
+      return {
+        status: 400,
+        body: { error: "Invalid public key format. Expected a JSON-encoded JWK string." }
+      };
+    }
+    let thumbprint;
+    try {
+      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
+    } catch {
+      return {
+        status: 400,
+        body: { error: "Failed to compute public key thumbprint. Ensure the key is a valid EC P-256 JWK." }
+      };
+    }
+    const device = await this.userStore.registerDevice({
+      id: body.deviceId,
+      userId: payload.sub,
+      publicKey: body.publicKey,
+      name: deviceName
+    });
+    const deviceCredential = this.tokenManager.issueDeviceCredential(
+      payload.sub,
+      body.deviceId,
+      thumbprint
+    );
+    return {
+      status: 201,
+      body: { data: { device, deviceCredential } }
+    };
+  }
+  /**
+   * Generate a challenge for device proof-of-possession verification.
+   *
+   * Creates a cryptographically random challenge, stores it server-side with
+   * a 60-second TTL and the target device ID, and returns the challenge string.
+   * The client signs this challenge with its private key and submits it via
+   * {@link handleDeviceVerify}.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param deviceId - The device this challenge is intended for
+   * @returns Auth response with the challenge string, or an error
+   */
+  async handleDeviceChallenge(accessToken, deviceId) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const device = await this.userStore.findDevice(deviceId);
+    if (device === null || device.userId !== payload.sub) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.revoked) {
+      return {
+        status: 403,
+        body: { error: "Device has been revoked." }
+      };
+    }
+    const challenge = randomBytes2(32).toString("hex");
+    const expiresAt = Date.now() + CHALLENGE_TTL_MS;
+    await this.challengeStore.store(challenge, deviceId, expiresAt);
+    return {
+      status: 200,
+      body: { data: { challenge } }
+    };
+  }
+  /**
+   * Handle device proof-of-possession verification (POST /auth/device/verify).
+   *
+   * Verifies that the device holds the private key corresponding to its registered
+   * public key by checking a signed challenge. The challenge must have been previously
+   * issued via {@link handleDeviceChallenge} and is single-use.
+   *
+   * On success, issues fresh tokens for the device.
+   *
+   * @param body - Device verification request body
+   * @param body.deviceId - The ID of the device to verify
+   * @param body.challenge - The challenge string (from handleDeviceChallenge)
+   * @param body.signature - The base64url-encoded ECDSA signature of the challenge
+   * @returns Auth response with fresh tokens on success, or an error
+   */
+  async handleDeviceVerify(body) {
+    const challengeEntry = await this.challengeStore.consume(body.challenge);
+    if (challengeEntry === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired challenge. Request a new challenge and try again." }
+      };
+    }
+    if (challengeEntry.deviceId !== body.deviceId) {
+      return {
+        status: 401,
+        body: { error: "Challenge was not issued for this device." }
+      };
+    }
+    const device = await this.userStore.findDevice(body.deviceId);
+    if (device === null) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.revoked) {
+      return {
+        status: 403,
+        body: { error: "Device has been revoked and cannot authenticate." }
+      };
+    }
+    let publicKeyJwk;
+    try {
+      publicKeyJwk = JSON.parse(device.publicKey);
+    } catch {
+      return {
+        status: 500,
+        body: { error: "Device has an invalid stored public key." }
+      };
+    }
+    let isValid;
+    try {
+      isValid = await verifyChallenge(publicKeyJwk, body.challenge, body.signature);
+    } catch {
+      return {
+        status: 400,
+        body: { error: "Signature verification failed. The signature or public key format may be invalid." }
+      };
+    }
+    if (!isValid) {
+      return {
+        status: 401,
+        body: { error: "Invalid signature. Proof-of-possession verification failed." }
+      };
+    }
+    let thumbprint;
+    try {
+      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
+    } catch {
+      return {
+        status: 500,
+        body: { error: "Failed to compute public key thumbprint." }
+      };
+    }
+    const tokens = this.tokenManager.issueTokens(device.userId, device.id, thumbprint);
+    return {
+      status: 200,
+      body: { data: { tokens } }
+    };
+  }
+  /**
+   * Generates a random challenge string for proof-of-possession verification.
+   *
+   * **Deprecated:** Use {@link handleDeviceChallenge} instead, which stores
+   * the challenge server-side with expiry and single-use semantics.
+   *
+   * @returns A 64-character hex string (32 random bytes)
+   */
+  static generateChallenge() {
+    return randomBytes2(32).toString("hex");
+  }
   /**
    * Creates a sync server auth provider compatible with `@korajs/server`.
    *
@@ -753,6 +1247,9 @@ var BuiltInAuthRoutes = class {
    * context containing the user ID and device metadata. This bridges
    * the built-in auth system with the sync server's authentication layer.
    *
+   * Also checks device revocation status during authentication, ensuring
+   * that revoked devices are rejected even if their tokens haven't expired.
+   *
    * @returns An object with an `authenticate` method suitable for KoraSyncServer's `auth` config
    *
    * @example
@@ -777,6 +1274,10 @@ var BuiltInAuthRoutes = class {
         if (user === null) {
           return null;
         }
+        const device = await userStore.findDevice(payload.dev);
+        if (device !== null && device.revoked) {
+          return null;
+        }
         await userStore.touchDevice(payload.dev);
         return {
           userId: payload.sub,
@@ -791,6 +1292,722 @@ var BuiltInAuthRoutes = class {
   }
 };
 
+// src/provider/built-in/password-reset.ts
+import { KoraError as KoraError3 } from "@korajs/core";
+var PasswordResetError = class extends KoraError3 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "PasswordResetError";
+  }
+};
+var ResetTokenExpiredError = class extends PasswordResetError {
+  constructor() {
+    super("Password reset token has expired.", "RESET_TOKEN_EXPIRED");
+  }
+};
+var ResetTokenNotFoundError = class extends PasswordResetError {
+  constructor() {
+    super("Password reset token not found or already used.", "RESET_TOKEN_NOT_FOUND");
+  }
+};
+var ResetRateLimitedError = class extends PasswordResetError {
+  constructor() {
+    super("Too many password reset requests. Please try again later.", "RESET_RATE_LIMITED");
+  }
+};
+var InMemoryPasswordResetStore = class {
+  tokens = /* @__PURE__ */ new Map();
+  async store(token) {
+    this.tokens.set(token.token, token);
+  }
+  async get(token) {
+    return this.tokens.get(token) ?? null;
+  }
+  async consume(token) {
+    const entry = this.tokens.get(token);
+    if (entry) {
+      this.tokens.set(token, { ...entry, consumed: true });
+    }
+  }
+  async countActiveForEmail(email) {
+    const now = Date.now();
+    let count = 0;
+    for (const token of this.tokens.values()) {
+      if (token.email === email && !token.consumed && now < token.expiresAt) {
+        count++;
+      }
+    }
+    return count;
+  }
+  async cleanExpired() {
+    const now = Date.now();
+    let count = 0;
+    for (const [key, token] of this.tokens) {
+      if (now > token.expiresAt) {
+        this.tokens.delete(key);
+        count++;
+      }
+    }
+    return count;
+  }
+};
+var DEFAULT_TOKEN_TTL_MS = 60 * 60 * 1e3;
+var DEFAULT_MAX_REQUESTS = 3;
+var MIN_PASSWORD_LENGTH2 = 8;
+var MAX_PASSWORD_LENGTH2 = 128;
+var PasswordResetManager = class {
+  userStore;
+  resetStore;
+  tokenTtlMs;
+  maxRequestsPerEmail;
+  onResetRequested;
+  constructor(config) {
+    this.userStore = config.userStore;
+    this.resetStore = config.resetStore ?? new InMemoryPasswordResetStore();
+    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
+    this.maxRequestsPerEmail = config.maxRequestsPerEmail ?? DEFAULT_MAX_REQUESTS;
+    this.onResetRequested = config.onResetRequested;
+  }
+  /**
+   * Request a password reset for an email.
+   * Always returns success to prevent email enumeration.
+   *
+   * If a callback is configured, invokes it with the token.
+   * In development mode (no callback), returns the token in the response.
+   */
+  async requestReset(email) {
+    const normalizedEmail = email.toLowerCase().trim();
+    const successResponse = {
+      status: 200,
+      body: { data: { message: "If an account with that email exists, a password reset link has been sent." } }
+    };
+    const user = await this.userStore.findByEmail(normalizedEmail);
+    if (!user) {
+      return successResponse;
+    }
+    const activeCount = await this.resetStore.countActiveForEmail(normalizedEmail);
+    if (activeCount >= this.maxRequestsPerEmail) {
+      return successResponse;
+    }
+    const token = generateSecureToken();
+    const now = Date.now();
+    const resetToken = {
+      token,
+      userId: user.id,
+      email: normalizedEmail,
+      createdAt: now,
+      expiresAt: now + this.tokenTtlMs,
+      consumed: false
+    };
+    await this.resetStore.store(resetToken);
+    if (this.onResetRequested) {
+      try {
+        await this.onResetRequested(normalizedEmail, token, resetToken.expiresAt);
+      } catch {
+      }
+    }
+    if (!this.onResetRequested) {
+      successResponse.body = { data: { message: "Password reset token generated.", token } };
+    }
+    return successResponse;
+  }
+  /**
+   * Consume a reset token and set a new password.
+   */
+  async resetPassword(token, newPassword) {
+    if (typeof newPassword !== "string" || newPassword.length < MIN_PASSWORD_LENGTH2) {
+      return {
+        status: 400,
+        body: { error: `Password must be at least ${MIN_PASSWORD_LENGTH2} characters.` }
+      };
+    }
+    if (newPassword.length > MAX_PASSWORD_LENGTH2) {
+      return {
+        status: 400,
+        body: { error: `Password must be at most ${MAX_PASSWORD_LENGTH2} characters.` }
+      };
+    }
+    const resetToken = await this.resetStore.get(token);
+    if (!resetToken || resetToken.consumed) {
+      return { status: 404, body: { error: "Password reset token not found or already used." } };
+    }
+    if (Date.now() > resetToken.expiresAt) {
+      await this.resetStore.consume(token);
+      return { status: 410, body: { error: "Password reset token has expired." } };
+    }
+    await this.resetStore.consume(token);
+    const hashed = await hashPassword(newPassword);
+    await this.userStore.updatePassword(resetToken.userId, hashed.hash, hashed.salt);
+    return { status: 200, body: { data: { message: "Password has been reset successfully." } } };
+  }
+  /**
+   * Change password for an authenticated user (requires current password verification).
+   */
+  async changePassword(userId, currentPassword, newPassword) {
+    if (typeof newPassword !== "string" || newPassword.length < MIN_PASSWORD_LENGTH2) {
+      return {
+        status: 400,
+        body: { error: `New password must be at least ${MIN_PASSWORD_LENGTH2} characters.` }
+      };
+    }
+    if (newPassword.length > MAX_PASSWORD_LENGTH2) {
+      return {
+        status: 400,
+        body: { error: `New password must be at most ${MAX_PASSWORD_LENGTH2} characters.` }
+      };
+    }
+    const user = await this.userStore.findById(userId);
+    if (!user) {
+      return { status: 404, body: { error: "User not found." } };
+    }
+    const { verifyPassword: verifyPassword2 } = await import("./password-hash-HDH6VQCQ.js");
+    const isValid = await verifyPassword2(currentPassword, user.passwordHash, user.salt);
+    if (!isValid) {
+      return { status: 401, body: { error: "Current password is incorrect." } };
+    }
+    const hashed = await hashPassword(newPassword);
+    await this.userStore.updatePassword(userId, hashed.hash, hashed.salt);
+    return { status: 200, body: { data: { message: "Password changed successfully." } } };
+  }
+};
+function generateSecureToken() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/provider/built-in/email-verification.ts
+import { KoraError as KoraError4 } from "@korajs/core";
+var EmailVerificationError = class extends KoraError4 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "EmailVerificationError";
+  }
+};
+var VerificationTokenExpiredError = class extends EmailVerificationError {
+  constructor() {
+    super("Email verification token has expired.", "VERIFICATION_TOKEN_EXPIRED");
+  }
+};
+var VerificationTokenNotFoundError = class extends EmailVerificationError {
+  constructor() {
+    super("Email verification token not found or already used.", "VERIFICATION_TOKEN_NOT_FOUND");
+  }
+};
+var InMemoryEmailVerificationStore = class {
+  tokens = /* @__PURE__ */ new Map();
+  async store(token) {
+    this.tokens.set(token.token, token);
+  }
+  async get(token) {
+    return this.tokens.get(token) ?? null;
+  }
+  async consume(token) {
+    const entry = this.tokens.get(token);
+    if (entry) {
+      this.tokens.set(token, { ...entry, consumed: true });
+    }
+  }
+  async countActiveForUser(userId) {
+    const now = Date.now();
+    let count = 0;
+    for (const token of this.tokens.values()) {
+      if (token.userId === userId && !token.consumed && now < token.expiresAt) {
+        count++;
+      }
+    }
+    return count;
+  }
+  async cleanExpired() {
+    const now = Date.now();
+    let count = 0;
+    for (const [key, token] of this.tokens) {
+      if (now > token.expiresAt) {
+        this.tokens.delete(key);
+        count++;
+      }
+    }
+    return count;
+  }
+};
+var DEFAULT_TOKEN_TTL_MS2 = 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_REQUESTS2 = 3;
+var EmailVerificationManager = class {
+  userStore;
+  verificationStore;
+  tokenTtlMs;
+  maxRequestsPerUser;
+  onVerificationRequired;
+  constructor(config) {
+    this.userStore = config.userStore;
+    this.verificationStore = config.verificationStore ?? new InMemoryEmailVerificationStore();
+    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS2;
+    this.maxRequestsPerUser = config.maxRequestsPerUser ?? DEFAULT_MAX_REQUESTS2;
+    this.onVerificationRequired = config.onVerificationRequired;
+  }
+  /**
+   * Send a verification email for a user.
+   * Rate-limited to prevent abuse.
+   */
+  async sendVerification(userId, email) {
+    const normalizedEmail = email.toLowerCase().trim();
+    const activeCount = await this.verificationStore.countActiveForUser(userId);
+    if (activeCount >= this.maxRequestsPerUser) {
+      return { status: 429, body: { error: "Too many verification requests. Please try again later." } };
+    }
+    const token = generateSecureToken2();
+    const now = Date.now();
+    const verificationToken = {
+      token,
+      userId,
+      email: normalizedEmail,
+      createdAt: now,
+      expiresAt: now + this.tokenTtlMs,
+      consumed: false
+    };
+    await this.verificationStore.store(verificationToken);
+    if (this.onVerificationRequired) {
+      try {
+        await this.onVerificationRequired(normalizedEmail, token, verificationToken.expiresAt);
+      } catch {
+      }
+    }
+    const responseData = {
+      message: "Verification email sent."
+    };
+    if (!this.onVerificationRequired) {
+      responseData.token = token;
+    }
+    return { status: 200, body: { data: responseData } };
+  }
+  /**
+   * Verify an email using a verification token.
+   */
+  async verifyEmail(token) {
+    const verificationToken = await this.verificationStore.get(token);
+    if (!verificationToken || verificationToken.consumed) {
+      return { status: 404, body: { error: "Verification token not found or already used." } };
+    }
+    if (Date.now() > verificationToken.expiresAt) {
+      await this.verificationStore.consume(token);
+      return { status: 410, body: { error: "Verification token has expired." } };
+    }
+    await this.verificationStore.consume(token);
+    await this.userStore.setEmailVerified(verificationToken.userId, true);
+    return {
+      status: 200,
+      body: {
+        data: {
+          message: "Email verified successfully.",
+          userId: verificationToken.userId,
+          email: verificationToken.email
+        }
+      }
+    };
+  }
+  /**
+   * Resend verification email for a user.
+   * Delegates to sendVerification with rate limiting.
+   */
+  async resendVerification(userId) {
+    const user = await this.userStore.findById(userId);
+    if (!user) {
+      return { status: 404, body: { error: "User not found." } };
+    }
+    return this.sendVerification(userId, user.email);
+  }
+};
+function generateSecureToken2() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/provider/built-in/sqlite-user-store.ts
+import { randomUUID as randomUUID3 } from "crypto";
+var SqliteUserStore = class {
+  db;
+  constructor(db) {
+    this.db = db;
+    this.db.pragma("journal_mode = WAL");
+    this.ensureTables();
+  }
+  ensureTables() {
+    this.db.exec(`
+			CREATE TABLE IF NOT EXISTS auth_users (
+				id TEXT PRIMARY KEY,
+				email TEXT NOT NULL UNIQUE COLLATE NOCASE,
+				name TEXT NOT NULL,
+				email_verified INTEGER NOT NULL DEFAULT 0,
+				created_at INTEGER NOT NULL,
+				password_hash TEXT NOT NULL,
+				salt TEXT NOT NULL
+			);
+
+			CREATE TABLE IF NOT EXISTS auth_devices (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL,
+				public_key TEXT NOT NULL,
+				name TEXT NOT NULL,
+				revoked INTEGER NOT NULL DEFAULT 0,
+				created_at INTEGER NOT NULL,
+				last_seen_at INTEGER NOT NULL,
+				FOREIGN KEY (user_id) REFERENCES auth_users(id) ON DELETE CASCADE
+			);
+
+			CREATE INDEX IF NOT EXISTS idx_auth_devices_user_id ON auth_devices(user_id);
+		`);
+  }
+  async createUser(params) {
+    const normalizedEmail = params.email.toLowerCase();
+    const now = Date.now();
+    const id = randomUUID3();
+    try {
+      this.db.prepare(`
+				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
+				VALUES (?, ?, ?, 0, ?, ?, ?)
+			`).run(id, normalizedEmail, params.name, now, params.passwordHash, params.salt);
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("UNIQUE constraint failed")) {
+        throw new DuplicateEmailError();
+      }
+      throw err;
+    }
+    return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
+  }
+  async findByEmail(email) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_users WHERE email = ?"
+    ).get(email.toLowerCase());
+    return row ? rowToStoredUser(row) : null;
+  }
+  async findById(id) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_users WHERE id = ?"
+    ).get(id);
+    return row ? rowToStoredUser(row) : null;
+  }
+  async registerDevice(params) {
+    const existing = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE id = ?"
+    ).get(params.id);
+    if (existing && !existing.revoked) {
+      return rowToDevice(existing);
+    }
+    const now = Date.now();
+    if (existing) {
+      this.db.prepare(`
+				UPDATE auth_devices SET revoked = 0, public_key = ?, name = ?, last_seen_at = ?
+				WHERE id = ?
+			`).run(params.publicKey, params.name, now, params.id);
+    } else {
+      this.db.prepare(`
+				INSERT INTO auth_devices (id, user_id, public_key, name, revoked, created_at, last_seen_at)
+				VALUES (?, ?, ?, ?, 0, ?, ?)
+			`).run(params.id, params.userId, params.publicKey, params.name, now, now);
+    }
+    return {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: existing ? existing.created_at : now,
+      lastSeenAt: now
+    };
+  }
+  async findDevice(deviceId) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE id = ?"
+    ).get(deviceId);
+    return row ? rowToDevice(row) : null;
+  }
+  async listDevices(userId) {
+    const rows = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE user_id = ?"
+    ).all(userId);
+    return rows.map(rowToDevice);
+  }
+  async revokeDevice(deviceId) {
+    this.db.prepare("UPDATE auth_devices SET revoked = 1 WHERE id = ?").run(deviceId);
+  }
+  async setEmailVerified(userId, verified) {
+    this.db.prepare(
+      "UPDATE auth_users SET email_verified = ? WHERE id = ?"
+    ).run(verified ? 1 : 0, userId);
+  }
+  async updatePassword(userId, passwordHash, salt) {
+    this.db.prepare(
+      "UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?"
+    ).run(passwordHash, salt, userId);
+  }
+  async listAll() {
+    const rows = this.db.prepare("SELECT * FROM auth_users").all();
+    return rows.map(rowToStoredUser);
+  }
+  async update(user) {
+    this.db.prepare(`
+			UPDATE auth_users
+			SET email = ?, name = ?, email_verified = ?, password_hash = ?, salt = ?
+			WHERE id = ?
+		`).run(user.email, user.name, user.emailVerified ? 1 : 0, user.passwordHash, user.salt, user.id);
+  }
+  async delete(userId) {
+    const deleteInTransaction = this.db.transaction(() => {
+      this.db.prepare("DELETE FROM auth_devices WHERE user_id = ?").run(userId);
+      this.db.prepare("DELETE FROM auth_users WHERE id = ?").run(userId);
+    });
+    deleteInTransaction();
+  }
+  async touchDevice(deviceId) {
+    this.db.prepare(
+      "UPDATE auth_devices SET last_seen_at = ? WHERE id = ?"
+    ).run(Date.now(), deviceId);
+  }
+};
+async function createSqliteUserStore(options) {
+  const Database = await loadBetterSqlite3();
+  const db = new Database(options.filename);
+  return new SqliteUserStore(db);
+}
+async function loadBetterSqlite3() {
+  try {
+    const { createRequire } = await import("module");
+    const require2 = createRequire(import.meta.url);
+    return require2("better-sqlite3");
+  } catch {
+    throw new Error(
+      'SQLite backend requires the "better-sqlite3" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToStoredUser(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    emailVerified: Boolean(row.email_verified),
+    createdAt: row.created_at,
+    passwordHash: row.password_hash,
+    salt: row.salt
+  };
+}
+function rowToDevice(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    publicKey: row.public_key,
+    name: row.name,
+    revoked: Boolean(row.revoked),
+    createdAt: row.created_at,
+    lastSeenAt: row.last_seen_at
+  };
+}
+
+// src/provider/built-in/postgres-user-store.ts
+import { randomUUID as randomUUID4 } from "crypto";
+var PostgresUserStore = class {
+  sql;
+  ready;
+  constructor(sql) {
+    this.sql = sql;
+    this.ready = this.ensureTables();
+  }
+  async ensureTables() {
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_users (
+				id TEXT PRIMARY KEY,
+				email TEXT NOT NULL UNIQUE,
+				name TEXT NOT NULL,
+				email_verified BOOLEAN NOT NULL DEFAULT FALSE,
+				created_at BIGINT NOT NULL,
+				password_hash TEXT NOT NULL,
+				salt TEXT NOT NULL
+			)
+		`;
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_devices (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL REFERENCES auth_users(id) ON DELETE CASCADE,
+				public_key TEXT NOT NULL,
+				name TEXT NOT NULL,
+				revoked BOOLEAN NOT NULL DEFAULT FALSE,
+				created_at BIGINT NOT NULL,
+				last_seen_at BIGINT NOT NULL
+			)
+		`;
+    await this.sql`
+			CREATE INDEX IF NOT EXISTS idx_auth_devices_user_id ON auth_devices(user_id)
+		`;
+    await this.sql`
+			CREATE UNIQUE INDEX IF NOT EXISTS idx_auth_users_email_lower ON auth_users(LOWER(email))
+		`;
+  }
+  async createUser(params) {
+    await this.ready;
+    const normalizedEmail = params.email.toLowerCase();
+    const now = Date.now();
+    const id = randomUUID4();
+    try {
+      await this.sql`
+				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
+				VALUES (${id}, ${normalizedEmail}, ${params.name}, FALSE, ${now}, ${params.passwordHash}, ${params.salt})
+			`;
+    } catch (err) {
+      if (err instanceof Error && (err.message.includes("unique constraint") || err.message.includes("duplicate key"))) {
+        throw new DuplicateEmailError();
+      }
+      throw err;
+    }
+    return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
+  }
+  async findByEmail(email) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_users WHERE LOWER(email) = ${email.toLowerCase()}
+		`;
+    return rows.length > 0 ? rowToStoredUser2(rows[0]) : null;
+  }
+  async findById(id) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_users WHERE id = ${id}
+		`;
+    return rows.length > 0 ? rowToStoredUser2(rows[0]) : null;
+  }
+  async registerDevice(params) {
+    await this.ready;
+    const existingRows = await this.sql`
+			SELECT * FROM auth_devices WHERE id = ${params.id}
+		`;
+    if (existingRows.length > 0 && !existingRows[0].revoked) {
+      return rowToDevice2(existingRows[0]);
+    }
+    const now = Date.now();
+    if (existingRows.length > 0) {
+      await this.sql`
+				UPDATE auth_devices SET revoked = FALSE, public_key = ${params.publicKey}, name = ${params.name}, last_seen_at = ${now}
+				WHERE id = ${params.id}
+			`;
+    } else {
+      await this.sql`
+				INSERT INTO auth_devices (id, user_id, public_key, name, revoked, created_at, last_seen_at)
+				VALUES (${params.id}, ${params.userId}, ${params.publicKey}, ${params.name}, FALSE, ${now}, ${now})
+			`;
+    }
+    return {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: existingRows.length > 0 ? Number(existingRows[0].created_at) : now,
+      lastSeenAt: now
+    };
+  }
+  async findDevice(deviceId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_devices WHERE id = ${deviceId}
+		`;
+    return rows.length > 0 ? rowToDevice2(rows[0]) : null;
+  }
+  async listDevices(userId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_devices WHERE user_id = ${userId}
+		`;
+    return rows.map(rowToDevice2);
+  }
+  async revokeDevice(deviceId) {
+    await this.ready;
+    await this.sql`UPDATE auth_devices SET revoked = TRUE WHERE id = ${deviceId}`;
+  }
+  async setEmailVerified(userId, verified) {
+    await this.ready;
+    await this.sql`UPDATE auth_users SET email_verified = ${verified} WHERE id = ${userId}`;
+  }
+  async updatePassword(userId, passwordHash, salt) {
+    await this.ready;
+    await this.sql`
+			UPDATE auth_users SET password_hash = ${passwordHash}, salt = ${salt}
+			WHERE id = ${userId}
+		`;
+  }
+  async listAll() {
+    await this.ready;
+    const rows = await this.sql`SELECT * FROM auth_users`;
+    return rows.map(rowToStoredUser2);
+  }
+  async update(user) {
+    await this.ready;
+    await this.sql`
+			UPDATE auth_users
+			SET email = ${user.email}, name = ${user.name}, email_verified = ${user.emailVerified},
+				password_hash = ${user.passwordHash}, salt = ${user.salt}
+			WHERE id = ${user.id}
+		`;
+  }
+  async delete(userId) {
+    await this.ready;
+    await this.sql.begin(async (tx) => {
+      await tx`DELETE FROM auth_devices WHERE user_id = ${userId}`;
+      await tx`DELETE FROM auth_users WHERE id = ${userId}`;
+    });
+  }
+  async touchDevice(deviceId) {
+    await this.ready;
+    const now = Date.now();
+    await this.sql`UPDATE auth_devices SET last_seen_at = ${now} WHERE id = ${deviceId}`;
+  }
+};
+async function createPostgresUserStore(options) {
+  const postgresClient = await loadPostgresDeps();
+  const sql = postgresClient(options.connectionString);
+  return new PostgresUserStore(sql);
+}
+async function loadPostgresDeps() {
+  try {
+    const dynamicImport = new Function("specifier", "return import(specifier)");
+    const postgresMod = await dynamicImport("postgres");
+    return postgresMod.default;
+  } catch {
+    throw new Error(
+      'PostgreSQL backend requires the "postgres" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToStoredUser2(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    emailVerified: Boolean(row.email_verified),
+    createdAt: Number(row.created_at),
+    passwordHash: row.password_hash,
+    salt: row.salt
+  };
+}
+function rowToDevice2(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    publicKey: row.public_key,
+    name: row.name,
+    revoked: Boolean(row.revoked),
+    createdAt: Number(row.created_at),
+    lastSeenAt: Number(row.last_seen_at)
+  };
+}
+
 // src/provider/adapter.ts
 var AuthProviderError = class extends Error {
   /** HTTP-style status code */
@@ -852,6 +2069,7 @@ var BuiltInProvider = class {
       id: stored.id,
       email: stored.email,
       name: stored.name,
+      emailVerified: stored.emailVerified,
       createdAt: stored.createdAt
     };
   }
@@ -871,20 +2089,3363 @@ var BuiltInProvider = class {
     return result.body.data;
   }
 };
-export {
-  AuthProviderError,
-  BuiltInAuthRoutes,
-  BuiltInProvider,
-  DuplicateEmailError,
-  InMemoryUserStore,
-  TokenManager,
-  computePublicKeyThumbprint,
-  decodeJwt,
-  encodeJwt,
-  hashPassword,
-  isExpired,
-  verifyChallenge,
-  verifyJwt,
-  verifyPassword
+
+// src/provider/external/external-jwt-provider.ts
+import { KoraError as KoraError5 } from "@korajs/core";
+var ExternalAuthOperationNotSupportedError = class extends KoraError5 {
+  constructor(operation, provider) {
+    super(
+      `The "${operation}" operation is not supported by the external auth provider "${provider}". Perform this operation through your external auth provider's SDK or dashboard instead.`,
+      "AUTH_EXTERNAL_OPERATION_NOT_SUPPORTED",
+      { operation, provider }
+    );
+    this.name = "ExternalAuthOperationNotSupportedError";
+  }
+};
+var ExternalTokenValidationError = class extends KoraError5 {
+  constructor(reason, context) {
+    super(
+      `External token validation failed: ${reason}`,
+      "AUTH_EXTERNAL_TOKEN_INVALID",
+      context
+    );
+    this.name = "ExternalTokenValidationError";
+  }
+};
+function defaultMapClaims(claims) {
+  const sub = claims["sub"];
+  if (typeof sub !== "string" || sub.length === 0) {
+    throw new ExternalTokenValidationError(
+      'JWT is missing a valid "sub" (subject) claim. The "sub" claim must be a non-empty string identifying the user.',
+      { availableClaims: Object.keys(claims) }
+    );
+  }
+  return {
+    userId: sub,
+    email: typeof claims["email"] === "string" ? claims["email"] : void 0,
+    name: typeof claims["name"] === "string" ? claims["name"] : void 0,
+    metadata: void 0
+  };
+}
+var ExternalJwtProvider = class {
+  providerName;
+  jwtSecret;
+  customValidateToken;
+  mapClaims;
+  constructor(config) {
+    if (config.validateToken === void 0 && config.jwtSecret === void 0) {
+      throw new ExternalTokenValidationError(
+        'ExternalJwtProvider requires either a "jwtSecret" for HS256 verification or a custom "validateToken" function. Provide at least one.',
+        { providerName: config.providerName }
+      );
+    }
+    this.providerName = config.providerName;
+    this.jwtSecret = config.jwtSecret;
+    this.customValidateToken = config.validateToken;
+    this.mapClaims = config.mapClaims ?? defaultMapClaims;
+  }
+  /**
+   * Not supported for external providers.
+   *
+   * User registration must be performed through the external auth provider's
+   * SDK or UI. Kora does not manage user accounts for external providers.
+   *
+   * @throws {ExternalAuthOperationNotSupportedError} Always
+   */
+  async signUp(_params) {
+    throw new ExternalAuthOperationNotSupportedError("signUp", this.providerName);
+  }
+  /**
+   * Not supported for external providers.
+   *
+   * User authentication must be performed through the external auth provider's
+   * SDK or UI. Kora does not manage credentials for external providers.
+   *
+   * @throws {ExternalAuthOperationNotSupportedError} Always
+   */
+  async signIn(_params) {
+    throw new ExternalAuthOperationNotSupportedError("signIn", this.providerName);
+  }
+  /**
+   * Not supported for external providers.
+   *
+   * Token refresh must be performed through the external auth provider's SDK.
+   * Kora does not manage token lifecycle for external providers.
+   *
+   * @throws {ExternalAuthOperationNotSupportedError} Always
+   */
+  async refreshTokens(_refreshToken) {
+    throw new ExternalAuthOperationNotSupportedError("refreshTokens", this.providerName);
+  }
+  /**
+   * Validate an access token from the external auth provider.
+   *
+   * Uses either the custom `validateToken` function or HS256 HMAC verification
+   * (depending on configuration) to validate the JWT. On success, maps the claims
+   * to Kora's expected format and returns the user ID and device ID.
+   *
+   * The device ID for external providers is derived from the user ID with a
+   * "external-" prefix, since external providers typically don't use Kora's
+   * device identity system.
+   *
+   * @param token - The JWT access token issued by the external provider
+   * @returns User ID and device ID if the token is valid, or null if invalid/expired
+   */
+  async validateAccessToken(token) {
+    const claims = await this.extractClaims(token);
+    if (claims === null) {
+      return null;
+    }
+    let userInfo;
+    try {
+      userInfo = this.mapClaims(claims);
+    } catch {
+      return null;
+    }
+    if (typeof userInfo.userId !== "string" || userInfo.userId.length === 0) {
+      return null;
+    }
+    const deviceId = `external-${this.providerName}-${userInfo.userId}`;
+    return { userId: userInfo.userId, deviceId };
+  }
+  /**
+   * Not supported for external providers.
+   *
+   * User lookup must be performed through the external auth provider's API.
+   *
+   * @throws {ExternalAuthOperationNotSupportedError} Always
+   */
+  async getUser(_userId) {
+    throw new ExternalAuthOperationNotSupportedError("getUser", this.providerName);
+  }
+  /**
+   * Not supported for external providers.
+   *
+   * Device revocation must be managed through the external auth provider
+   * or by revoking the user's tokens at the provider level.
+   *
+   * @throws {ExternalAuthOperationNotSupportedError} Always
+   */
+  async revokeDevice(_accessToken, _deviceId) {
+    throw new ExternalAuthOperationNotSupportedError("revokeDevice", this.providerName);
+  }
+  /**
+   * Not supported for external providers.
+   *
+   * Device listing must be performed through the external auth provider's API.
+   *
+   * @throws {ExternalAuthOperationNotSupportedError} Always
+   */
+  async listDevices(_accessToken) {
+    throw new ExternalAuthOperationNotSupportedError("listDevices", this.providerName);
+  }
+  /**
+   * Creates a sync server auth provider compatible with `@korajs/server`.
+   *
+   * Returns an object with an `authenticate` method that validates the external
+   * JWT and returns a Kora-compatible auth context. Use this to wire the external
+   * auth provider into KoraSyncServer.
+   *
+   * @returns An object with an `authenticate` method for KoraSyncServer's `auth` config
+   *
+   * @example
+   * ```typescript
+   * const externalAuth = new ExternalJwtProvider({ ... })
+   * const syncServer = new KoraSyncServer({
+   *   store,
+   *   auth: externalAuth.toSyncAuthProvider(),
+   * })
+   * ```
+   */
+  toSyncAuthProvider() {
+    return {
+      authenticate: async (token) => {
+        const claims = await this.extractClaims(token);
+        if (claims === null) {
+          return null;
+        }
+        let userInfo;
+        try {
+          userInfo = this.mapClaims(claims);
+        } catch {
+          return null;
+        }
+        if (typeof userInfo.userId !== "string" || userInfo.userId.length === 0) {
+          return null;
+        }
+        return {
+          userId: userInfo.userId,
+          metadata: {
+            provider: this.providerName,
+            email: userInfo.email,
+            name: userInfo.name,
+            ...userInfo.metadata
+          }
+        };
+      }
+    };
+  }
+  /**
+   * Extract and validate claims from a JWT token.
+   *
+   * Uses the custom validator if configured, otherwise falls back to
+   * HS256 HMAC verification with the configured secret.
+   *
+   * @param token - The raw JWT string
+   * @returns The decoded claims object, or null if the token is invalid
+   */
+  async extractClaims(token) {
+    if (this.customValidateToken !== void 0) {
+      try {
+        const result = await this.customValidateToken(token);
+        if (result === null) {
+          return null;
+        }
+        return result;
+      } catch {
+        return null;
+      }
+    }
+    if (this.jwtSecret !== void 0) {
+      const claims = verifyJwt(token, this.jwtSecret);
+      if (claims === null) {
+        return null;
+      }
+      if (isExpired(claims)) {
+        return null;
+      }
+      return claims;
+    }
+    return null;
+  }
+};
+
+// src/provider/external/clerk-adapter.ts
+function defaultClerkClaimMapping(claims) {
+  const sub = claims["sub"];
+  if (typeof sub !== "string" || sub.length === 0) {
+    return { userId: "" };
+  }
+  const firstName = typeof claims["first_name"] === "string" ? claims["first_name"] : "";
+  const lastName = typeof claims["last_name"] === "string" ? claims["last_name"] : "";
+  const fullName = [firstName, lastName].filter(Boolean).join(" ");
+  const email = typeof claims["email"] === "string" ? claims["email"] : void 0;
+  const metadata = {};
+  if (typeof claims["org_id"] === "string") {
+    metadata["orgId"] = claims["org_id"];
+  }
+  if (typeof claims["org_slug"] === "string") {
+    metadata["orgSlug"] = claims["org_slug"];
+  }
+  if (typeof claims["org_role"] === "string") {
+    metadata["orgRole"] = claims["org_role"];
+  }
+  return {
+    userId: sub,
+    email,
+    name: fullName.length > 0 ? fullName : void 0,
+    metadata: Object.keys(metadata).length > 0 ? metadata : void 0
+  };
+}
+function createClerkAdapter(config) {
+  return new ExternalJwtProvider({
+    providerName: "clerk",
+    validateToken: config.validateToken,
+    mapClaims: config.mapClaims ?? defaultClerkClaimMapping
+  });
+}
+
+// src/provider/external/supabase-adapter.ts
+function defaultSupabaseClaimMapping(claims) {
+  const sub = claims["sub"];
+  if (typeof sub !== "string" || sub.length === 0) {
+    return { userId: "" };
+  }
+  const email = typeof claims["email"] === "string" ? claims["email"] : void 0;
+  let name;
+  const userMetadata = claims["user_metadata"];
+  if (typeof userMetadata === "object" && userMetadata !== null && !Array.isArray(userMetadata)) {
+    const meta = userMetadata;
+    if (typeof meta["full_name"] === "string" && meta["full_name"].length > 0) {
+      name = meta["full_name"];
+    } else if (typeof meta["name"] === "string" && meta["name"].length > 0) {
+      name = meta["name"];
+    }
+  }
+  const metadata = {};
+  if (typeof claims["role"] === "string") {
+    metadata["role"] = claims["role"];
+  }
+  if (typeof claims["aud"] === "string") {
+    metadata["aud"] = claims["aud"];
+  }
+  if (typeof claims["app_metadata"] === "object" && claims["app_metadata"] !== null && !Array.isArray(claims["app_metadata"])) {
+    metadata["appMetadata"] = claims["app_metadata"];
+  }
+  return {
+    userId: sub,
+    email,
+    name,
+    metadata: Object.keys(metadata).length > 0 ? metadata : void 0
+  };
+}
+function createSupabaseAdapter(config) {
+  return new ExternalJwtProvider({
+    providerName: "supabase",
+    jwtSecret: config.jwtSecret,
+    mapClaims: config.mapClaims ?? defaultSupabaseClaimMapping
+  });
+}
+
+// src/passkey/passkey-server.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { KoraError as KoraError6 } from "@korajs/core";
+var PasskeyVerificationError = class extends KoraError6 {
+  constructor(message, context) {
+    super(message, "PASSKEY_VERIFICATION_ERROR", context);
+    this.name = "PasskeyVerificationError";
+  }
+};
+function generateRegistrationOptions(params) {
+  const challengeBytes = randomBytes3(32);
+  const challenge = toBase64Url(challengeBytes.buffer.slice(
+    challengeBytes.byteOffset,
+    challengeBytes.byteOffset + challengeBytes.byteLength
+  ));
+  return {
+    challenge,
+    rpId: params.rpId,
+    rpName: params.rpName,
+    userId: params.userId,
+    userName: params.userName,
+    userDisplayName: params.userDisplayName,
+    excludeCredentialIds: params.existingCredentialIds ?? [],
+    authenticatorSelection: {
+      authenticatorAttachment: "platform",
+      residentKey: "preferred",
+      userVerification: "required"
+    },
+    timeout: 6e4
+  };
+}
+async function verifyRegistrationResponse(params) {
+  const { credential, expectedChallenge, expectedOrigin, expectedRpId } = params;
+  const clientDataBytes = fromBase64Url(credential.clientDataJSON);
+  const clientDataText = new TextDecoder().decode(clientDataBytes);
+  let clientData;
+  try {
+    clientData = JSON.parse(clientDataText);
+  } catch {
+    throw new PasskeyVerificationError(
+      "Failed to parse clientDataJSON. The response may be malformed."
+    );
+  }
+  if (clientData.type !== "webauthn.create") {
+    throw new PasskeyVerificationError(
+      `Expected clientData.type "webauthn.create" but received "${clientData.type}".`,
+      { type: clientData.type }
+    );
+  }
+  if (clientData.challenge !== expectedChallenge) {
+    throw new PasskeyVerificationError(
+      "Challenge mismatch. The response does not match the expected challenge. This may indicate a replay attack or session mismatch."
+    );
+  }
+  if (clientData.origin !== expectedOrigin) {
+    throw new PasskeyVerificationError(
+      `Origin mismatch. Expected "${expectedOrigin}" but received "${clientData.origin}".`,
+      { expected: expectedOrigin, received: clientData.origin }
+    );
+  }
+  const attestationBytes = fromBase64Url(credential.attestationObject);
+  const attestationResult = decodeCbor(attestationBytes, 0);
+  const attestationMap = attestationResult.value;
+  const fmt = attestationMap.get("fmt");
+  if (fmt !== "none") {
+    throw new PasskeyVerificationError(
+      `Unsupported attestation format "${String(fmt)}". Only "none" attestation is currently supported.`,
+      { format: String(fmt) }
+    );
+  }
+  const authData = attestationMap.get("authData");
+  if (!(authData instanceof Uint8Array)) {
+    throw new PasskeyVerificationError(
+      "Invalid attestation object: authData is missing or not a byte string."
+    );
+  }
+  const rpIdHash = authData.slice(0, 32);
+  const expectedRpIdHash = await sha256(new TextEncoder().encode(expectedRpId));
+  if (!constantTimeEqual(rpIdHash, new Uint8Array(expectedRpIdHash))) {
+    throw new PasskeyVerificationError(
+      "RP ID hash mismatch. The authenticator data does not match the expected relying party."
+    );
+  }
+  const flags = authData[32];
+  if ((flags & 1) === 0) {
+    throw new PasskeyVerificationError(
+      "User Present flag is not set in authenticator data. The authenticator did not confirm user presence."
+    );
+  }
+  if ((flags & 64) === 0) {
+    throw new PasskeyVerificationError(
+      "Attested Credential Data flag is not set. The authenticator did not include credential data."
+    );
+  }
+  const signCount = authData[33] << 24 | authData[34] << 16 | authData[35] << 8 | authData[36];
+  let offset = 37;
+  offset += 16;
+  const credentialIdLength = authData[offset] << 8 | authData[offset + 1];
+  offset += 2;
+  const credentialIdBytes = authData.slice(offset, offset + credentialIdLength);
+  offset += credentialIdLength;
+  const expectedCredentialId = toBase64Url(credentialIdBytes.buffer);
+  if (expectedCredentialId !== credential.credentialId) {
+    throw new PasskeyVerificationError(
+      "Credential ID mismatch between attestation object and client response."
+    );
+  }
+  const coseKeyResult = decodeCbor(authData, offset);
+  const coseKeyBytes = authData.slice(offset, coseKeyResult.offset);
+  const publicKeyFromAttestation = toBase64Url(coseKeyBytes.buffer);
+  if (publicKeyFromAttestation !== credential.publicKey) {
+    throw new PasskeyVerificationError(
+      "Public key mismatch between attestation object and client response."
+    );
+  }
+  return {
+    verified: true,
+    credentialId: credential.credentialId,
+    publicKey: credential.publicKey,
+    signCount: signCount >>> 0
+  };
+}
+function generateAuthenticationOptions(params) {
+  const challengeBytes = randomBytes3(32);
+  const challenge = toBase64Url(challengeBytes.buffer.slice(
+    challengeBytes.byteOffset,
+    challengeBytes.byteOffset + challengeBytes.byteLength
+  ));
+  return {
+    challenge,
+    rpId: params.rpId,
+    allowCredentialIds: params.allowCredentialIds,
+    userVerification: "preferred",
+    timeout: 6e4
+  };
+}
+async function verifyAuthenticationResponse(params) {
+  const {
+    assertion,
+    expectedChallenge,
+    expectedOrigin,
+    expectedRpId,
+    publicKey,
+    previousSignCount
+  } = params;
+  const clientDataBytes = fromBase64Url(assertion.clientDataJSON);
+  const clientDataText = new TextDecoder().decode(clientDataBytes);
+  let clientData;
+  try {
+    clientData = JSON.parse(clientDataText);
+  } catch {
+    throw new PasskeyVerificationError(
+      "Failed to parse clientDataJSON. The assertion may be malformed."
+    );
+  }
+  if (clientData.type !== "webauthn.get") {
+    throw new PasskeyVerificationError(
+      `Expected clientData.type "webauthn.get" but received "${clientData.type}".`,
+      { type: clientData.type }
+    );
+  }
+  if (clientData.challenge !== expectedChallenge) {
+    throw new PasskeyVerificationError(
+      "Challenge mismatch. The assertion does not match the expected challenge."
+    );
+  }
+  if (clientData.origin !== expectedOrigin) {
+    throw new PasskeyVerificationError(
+      `Origin mismatch. Expected "${expectedOrigin}" but received "${clientData.origin}".`,
+      { expected: expectedOrigin, received: clientData.origin }
+    );
+  }
+  const authDataBytes = fromBase64Url(assertion.authenticatorData);
+  const rpIdHash = authDataBytes.slice(0, 32);
+  const expectedRpIdHash = await sha256(new TextEncoder().encode(expectedRpId));
+  if (!constantTimeEqual(rpIdHash, new Uint8Array(expectedRpIdHash))) {
+    throw new PasskeyVerificationError(
+      "RP ID hash mismatch. The authenticator data does not match the expected relying party."
+    );
+  }
+  const flags = authDataBytes[32];
+  if ((flags & 1) === 0) {
+    throw new PasskeyVerificationError(
+      "User Present flag is not set in authenticator data."
+    );
+  }
+  const signCount = (authDataBytes[33] << 24 | authDataBytes[34] << 16 | authDataBytes[35] << 8 | authDataBytes[36]) >>> 0;
+  if (previousSignCount > 0 || signCount > 0) {
+    if (signCount <= previousSignCount) {
+      throw new PasskeyVerificationError(
+        `Signature counter did not increase. This may indicate a cloned authenticator. Previous count: ${previousSignCount}, received count: ${signCount}.`,
+        {
+          previousSignCount,
+          receivedSignCount: signCount
+        }
+      );
+    }
+  }
+  const clientDataHash = await sha256(clientDataBytes);
+  const signedData = new Uint8Array(
+    authDataBytes.length + clientDataHash.byteLength
+  );
+  signedData.set(authDataBytes, 0);
+  signedData.set(new Uint8Array(clientDataHash), authDataBytes.length);
+  const coseKeyBytes = fromBase64Url(publicKey);
+  const coseKeyResult = decodeCbor(coseKeyBytes, 0);
+  const coseKeyMap = coseKeyResult.value;
+  const kty = coseKeyMap.get(1);
+  const alg = coseKeyMap.get(3);
+  if (kty !== 2) {
+    throw new PasskeyVerificationError(
+      `Unsupported COSE key type ${String(kty)}. Only EC2 (kty=2) is supported.`,
+      { kty: String(kty) }
+    );
+  }
+  if (alg !== -7) {
+    throw new PasskeyVerificationError(
+      `Unsupported COSE algorithm ${String(alg)}. Only ES256 (alg=-7) is supported.`,
+      { alg: String(alg) }
+    );
+  }
+  const xCoord = coseKeyMap.get(-2);
+  const yCoord = coseKeyMap.get(-3);
+  if (!(xCoord instanceof Uint8Array) || !(yCoord instanceof Uint8Array) || xCoord.length !== 32 || yCoord.length !== 32) {
+    throw new PasskeyVerificationError(
+      "Invalid COSE public key: x and y coordinates must be 32-byte arrays."
+    );
+  }
+  const rawPublicKey = new Uint8Array(65);
+  rawPublicKey[0] = 4;
+  rawPublicKey.set(xCoord, 1);
+  rawPublicKey.set(yCoord, 33);
+  let cryptoKey;
+  try {
+    cryptoKey = await globalThis.crypto.subtle.importKey(
+      "raw",
+      rawPublicKey.buffer,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"]
+    );
+  } catch (error) {
+    throw new PasskeyVerificationError(
+      "Failed to import COSE public key for signature verification.",
+      { cause: error instanceof Error ? error.message : String(error) }
+    );
+  }
+  const signatureBytes = fromBase64Url(assertion.signature);
+  const p1363Signature = derToP1363(signatureBytes, 32);
+  let verified;
+  try {
+    verified = await globalThis.crypto.subtle.verify(
+      { name: "ECDSA", hash: { name: "SHA-256" } },
+      cryptoKey,
+      p1363Signature.buffer,
+      signedData.buffer
+    );
+  } catch (error) {
+    throw new PasskeyVerificationError(
+      "Signature verification operation failed.",
+      { cause: error instanceof Error ? error.message : String(error) }
+    );
+  }
+  if (!verified) {
+    return { verified: false, newSignCount: signCount };
+  }
+  return { verified: true, newSignCount: signCount };
+}
+async function sha256(data) {
+  return globalThis.crypto.subtle.digest("SHA-256", data);
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a[i] ^ b[i];
+  }
+  return result === 0;
+}
+function derToP1363(derSignature, componentLength) {
+  let offset = 0;
+  if (derSignature[offset] !== 48) {
+    throw new PasskeyVerificationError(
+      "Invalid DER signature: expected SEQUENCE tag (0x30)."
+    );
+  }
+  offset += 1;
+  if (derSignature[offset] & 128) {
+    const lengthBytes = derSignature[offset] & 127;
+    offset += 1 + lengthBytes;
+  } else {
+    offset += 1;
+  }
+  if (derSignature[offset] !== 2) {
+    throw new PasskeyVerificationError(
+      "Invalid DER signature: expected INTEGER tag (0x02) for r component."
+    );
+  }
+  offset += 1;
+  const rLength = derSignature[offset];
+  offset += 1;
+  const rBytes = derSignature.slice(offset, offset + rLength);
+  offset += rLength;
+  if (derSignature[offset] !== 2) {
+    throw new PasskeyVerificationError(
+      "Invalid DER signature: expected INTEGER tag (0x02) for s component."
+    );
+  }
+  offset += 1;
+  const sLength = derSignature[offset];
+  offset += 1;
+  const sBytes = derSignature.slice(offset, offset + sLength);
+  const result = new Uint8Array(componentLength * 2);
+  copyComponentToP1363(rBytes, result, 0, componentLength);
+  copyComponentToP1363(sBytes, result, componentLength, componentLength);
+  return result;
+}
+function copyComponentToP1363(component, target, targetOffset, componentLength) {
+  if (component.length === componentLength) {
+    target.set(component, targetOffset);
+  } else if (component.length > componentLength) {
+    const excess = component.length - componentLength;
+    target.set(component.slice(excess), targetOffset);
+  } else {
+    const padding = componentLength - component.length;
+    target.set(component, targetOffset + padding);
+  }
+}
+
+// src/org/org-types.ts
+import { KoraError as KoraError7 } from "@korajs/core";
+var ORG_ROLES = ["owner", "admin", "member", "viewer", "billing"];
+var ROLE_HIERARCHY = {
+  viewer: 10,
+  billing: 15,
+  member: 20,
+  admin: 30,
+  owner: 40
+};
+function hasRoleLevel(userRole, requiredRole) {
+  return ROLE_HIERARCHY[userRole] >= ROLE_HIERARCHY[requiredRole];
+}
+var INVITATION_STATUSES = ["pending", "accepted", "revoked", "expired"];
+var OrgError = class extends KoraError7 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "OrgError";
+  }
+};
+var OrgNotFoundError = class extends OrgError {
+  constructor() {
+    super("Organization not found.", "ORG_NOT_FOUND");
+  }
+};
+var OrgSlugTakenError = class extends OrgError {
+  constructor() {
+    super("An organization with this slug already exists.", "ORG_SLUG_TAKEN");
+  }
+};
+var MembershipNotFoundError = class extends OrgError {
+  constructor() {
+    super("User is not a member of this organization.", "MEMBERSHIP_NOT_FOUND");
+  }
+};
+var MemberAlreadyExistsError = class extends OrgError {
+  constructor() {
+    super("User is already a member of this organization.", "MEMBER_ALREADY_EXISTS");
+  }
+};
+var InsufficientRoleError = class extends OrgError {
+  constructor(required) {
+    super(
+      `This action requires at least the "${required}" role.`,
+      "INSUFFICIENT_ROLE",
+      { requiredRole: required }
+    );
+  }
+};
+var CannotRemoveOwnerError = class extends OrgError {
+  constructor() {
+    super(
+      "The organization owner cannot be removed. Transfer ownership first.",
+      "CANNOT_REMOVE_OWNER"
+    );
+  }
+};
+var InvitationNotFoundError = class extends OrgError {
+  constructor() {
+    super("Invitation not found or has already been used.", "INVITATION_NOT_FOUND");
+  }
+};
+var InvitationExpiredError = class extends OrgError {
+  constructor() {
+    super("This invitation has expired.", "INVITATION_EXPIRED");
+  }
+};
+
+// src/org/org-routes.ts
+var MAX_ORG_NAME_LENGTH = 200;
+var MAX_SLUG_LENGTH = 100;
+var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,98}[a-z0-9]$/;
+function isValidEmail2(email) {
+  if (email.length === 0 || email.length > 254) return false;
+  const atIndex = email.indexOf("@");
+  if (atIndex < 1) return false;
+  const domain = email.slice(atIndex + 1);
+  if (domain.length === 0 || !domain.includes(".")) return false;
+  if (email.indexOf("@", atIndex + 1) !== -1) return false;
+  if (email.includes(" ")) return false;
+  return true;
+}
+function sanitize(value) {
+  return value.replace(/[\x00-\x1f\x7f]/g, "").trim();
+}
+var OrgRoutes = class {
+  store;
+  constructor(config) {
+    this.store = config.orgStore;
+  }
+  // --- Organizations ---
+  /**
+   * Create a new organization. The authenticated user becomes the owner.
+   */
+  async createOrg(userId, params) {
+    if (typeof params.name !== "string" || params.name.trim().length === 0) {
+      return { status: 400, body: { error: "Organization name is required." } };
+    }
+    const name = sanitize(params.name);
+    if (name.length > MAX_ORG_NAME_LENGTH) {
+      return {
+        status: 400,
+        body: { error: `Organization name must be at most ${MAX_ORG_NAME_LENGTH} characters.` }
+      };
+    }
+    let slug;
+    if (params.slug !== void 0) {
+      if (typeof params.slug !== "string") {
+        return { status: 400, body: { error: "Slug must be a string." } };
+      }
+      slug = params.slug.toLowerCase().trim();
+      if (slug.length < 2) {
+        return { status: 400, body: { error: "Slug must be at least 2 characters." } };
+      }
+      if (slug.length > MAX_SLUG_LENGTH) {
+        return {
+          status: 400,
+          body: { error: `Slug must be at most ${MAX_SLUG_LENGTH} characters.` }
+        };
+      }
+      if (!SLUG_PATTERN.test(slug)) {
+        return {
+          status: 400,
+          body: {
+            error: "Slug must contain only lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen."
+          }
+        };
+      }
+    }
+    if (params.metadata !== void 0 && (typeof params.metadata !== "object" || params.metadata === null || Array.isArray(params.metadata))) {
+      return { status: 400, body: { error: "Metadata must be a plain object." } };
+    }
+    try {
+      const createParams = {
+        name,
+        slug,
+        metadata: params.metadata
+      };
+      const org = await this.store.createOrg(userId, createParams);
+      return { status: 201, body: { data: org } };
+    } catch (err) {
+      if (err instanceof OrgSlugTakenError) {
+        return { status: 409, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * Get an organization by ID. Requires membership.
+   */
+  async getOrg(userId, orgId) {
+    const membership = await this.store.getMembership(orgId, userId);
+    if (!membership) {
+      return { status: 404, body: { error: "Organization not found." } };
+    }
+    const org = await this.store.getOrg(orgId);
+    if (!org) {
+      return { status: 404, body: { error: "Organization not found." } };
+    }
+    return { status: 200, body: { data: org } };
+  }
+  /**
+   * Update an organization. Requires admin or higher.
+   */
+  async updateOrg(userId, orgId, params) {
+    const authResult = await this.requireRole(orgId, userId, "admin");
+    if (authResult) return authResult;
+    const updateParams = {};
+    if (params.name !== void 0) {
+      if (typeof params.name !== "string" || params.name.trim().length === 0) {
+        return { status: 400, body: { error: "Organization name must be a non-empty string." } };
+      }
+      updateParams.name = sanitize(params.name);
+      if (updateParams.name.length > MAX_ORG_NAME_LENGTH) {
+        return {
+          status: 400,
+          body: { error: `Organization name must be at most ${MAX_ORG_NAME_LENGTH} characters.` }
+        };
+      }
+    }
+    if (params.slug !== void 0) {
+      if (typeof params.slug !== "string") {
+        return { status: 400, body: { error: "Slug must be a string." } };
+      }
+      updateParams.slug = params.slug.toLowerCase().trim();
+      if (updateParams.slug.length < 2) {
+        return { status: 400, body: { error: "Slug must be at least 2 characters." } };
+      }
+      if (updateParams.slug.length > MAX_SLUG_LENGTH) {
+        return {
+          status: 400,
+          body: { error: `Slug must be at most ${MAX_SLUG_LENGTH} characters.` }
+        };
+      }
+      if (!SLUG_PATTERN.test(updateParams.slug)) {
+        return {
+          status: 400,
+          body: {
+            error: "Slug must contain only lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen."
+          }
+        };
+      }
+    }
+    if (params.metadata !== void 0) {
+      if (typeof params.metadata !== "object" || params.metadata === null || Array.isArray(params.metadata)) {
+        return { status: 400, body: { error: "Metadata must be a plain object." } };
+      }
+      updateParams.metadata = params.metadata;
+    }
+    try {
+      const org = await this.store.updateOrg(orgId, updateParams);
+      return { status: 200, body: { data: org } };
+    } catch (err) {
+      if (err instanceof OrgNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      if (err instanceof OrgSlugTakenError) {
+        return { status: 409, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * Delete an organization. Requires owner.
+   */
+  async deleteOrg(userId, orgId) {
+    const authResult = await this.requireRole(orgId, userId, "owner");
+    if (authResult) return authResult;
+    try {
+      await this.store.deleteOrg(orgId);
+      return { status: 200, body: { data: { deleted: true } } };
+    } catch (err) {
+      if (err instanceof OrgNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * List all organizations the authenticated user belongs to.
+   */
+  async listUserOrgs(userId) {
+    const orgs = await this.store.listUserOrgs(userId);
+    return { status: 200, body: { data: orgs } };
+  }
+  // --- Members ---
+  /**
+   * Add a member to an organization. Requires admin or higher.
+   */
+  async addMember(userId, orgId, params) {
+    const authResult = await this.requireRole(orgId, userId, "admin");
+    if (authResult) return authResult;
+    if (typeof params.targetUserId !== "string" || params.targetUserId.length === 0) {
+      return { status: 400, body: { error: "Target user ID is required." } };
+    }
+    if (typeof params.role !== "string" || !isValidRole(params.role)) {
+      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+    }
+    if (params.role === "owner") {
+      return { status: 400, body: { error: "Cannot assign owner role directly. Use ownership transfer." } };
+    }
+    const callerMembership = await this.store.getMembership(orgId, userId);
+    if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
+      return { status: 403, body: { error: "Only the owner can add admin members." } };
+    }
+    try {
+      const membership = await this.store.addMember(orgId, params.targetUserId, params.role, userId);
+      return { status: 201, body: { data: membership } };
+    } catch (err) {
+      if (err instanceof OrgNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      if (err instanceof MemberAlreadyExistsError) {
+        return { status: 409, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * Remove a member from an organization. Requires admin or higher.
+   * Members can also remove themselves (leave).
+   */
+  async removeMember(userId, orgId, targetUserId) {
+    const isSelfRemoval = userId === targetUserId;
+    if (!isSelfRemoval) {
+      const authResult = await this.requireRole(orgId, userId, "admin");
+      if (authResult) return authResult;
+    } else {
+      const membership = await this.store.getMembership(orgId, userId);
+      if (!membership) {
+        return { status: 404, body: { error: "Organization not found." } };
+      }
+    }
+    try {
+      await this.store.removeMember(orgId, targetUserId);
+      return { status: 200, body: { data: { removed: true } } };
+    } catch (err) {
+      if (err instanceof OrgNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      if (err instanceof CannotRemoveOwnerError) {
+        return { status: 400, body: { error: err.message } };
+      }
+      if (err instanceof MembershipNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * Update a member's role. Requires admin or higher.
+   */
+  async updateMemberRole(userId, orgId, params) {
+    const authResult = await this.requireRole(orgId, userId, "admin");
+    if (authResult) return authResult;
+    if (typeof params.targetUserId !== "string" || params.targetUserId.length === 0) {
+      return { status: 400, body: { error: "Target user ID is required." } };
+    }
+    if (typeof params.role !== "string" || !isValidRole(params.role)) {
+      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+    }
+    if (params.role === "owner") {
+      return { status: 400, body: { error: "Cannot assign owner role directly. Use ownership transfer." } };
+    }
+    const callerMembership = await this.store.getMembership(orgId, userId);
+    if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
+      return { status: 403, body: { error: "Only the owner can assign admin role." } };
+    }
+    try {
+      const membership = await this.store.updateMemberRole(orgId, params.targetUserId, params.role);
+      return { status: 200, body: { data: membership } };
+    } catch (err) {
+      if (err instanceof MembershipNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * List all members of an organization. Requires membership.
+   */
+  async listMembers(userId, orgId) {
+    const membership = await this.store.getMembership(orgId, userId);
+    if (!membership) {
+      return { status: 404, body: { error: "Organization not found." } };
+    }
+    try {
+      const members = await this.store.listMembers(orgId);
+      return { status: 200, body: { data: members } };
+    } catch (err) {
+      if (err instanceof OrgNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * Transfer ownership to another member. Requires owner.
+   */
+  async transferOwnership(userId, orgId, params) {
+    const authResult = await this.requireRole(orgId, userId, "owner");
+    if (authResult) return authResult;
+    if (typeof params.newOwnerId !== "string" || params.newOwnerId.length === 0) {
+      return { status: 400, body: { error: "New owner ID is required." } };
+    }
+    if (params.newOwnerId === userId) {
+      return { status: 400, body: { error: "You are already the owner." } };
+    }
+    try {
+      await this.store.transferOwnership(orgId, params.newOwnerId);
+      return { status: 200, body: { data: { transferred: true } } };
+    } catch (err) {
+      if (err instanceof OrgNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      if (err instanceof MembershipNotFoundError) {
+        return { status: 404, body: { error: "Target user is not a member of this organization." } };
+      }
+      throw err;
+    }
+  }
+  // --- Invitations ---
+  /**
+   * Create an invitation to join the organization. Requires admin or higher.
+   */
+  async createInvitation(userId, orgId, params) {
+    const authResult = await this.requireRole(orgId, userId, "admin");
+    if (authResult) return authResult;
+    if (typeof params.email !== "string" || !isValidEmail2(params.email.trim())) {
+      return { status: 400, body: { error: "A valid email address is required." } };
+    }
+    if (typeof params.role !== "string" || !isValidRole(params.role)) {
+      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+    }
+    if (params.role === "owner") {
+      return { status: 400, body: { error: "Cannot invite with owner role. Use ownership transfer." } };
+    }
+    const callerMembership = await this.store.getMembership(orgId, userId);
+    if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
+      return { status: 403, body: { error: "Only the owner can invite admin members." } };
+    }
+    try {
+      const invitation = await this.store.createInvitation(orgId, userId, {
+        email: params.email.trim(),
+        role: params.role
+      });
+      return { status: 201, body: { data: invitation } };
+    } catch (err) {
+      if (err instanceof OrgNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * Accept an invitation by its token. The authenticated user joins the org.
+   */
+  async acceptInvitation(userId, params) {
+    if (typeof params.token !== "string" || params.token.length === 0) {
+      return { status: 400, body: { error: "Invitation token is required." } };
+    }
+    try {
+      const invitation = await this.store.consumeInvitation(params.token);
+      const membership = await this.store.addMember(
+        invitation.orgId,
+        userId,
+        invitation.role,
+        invitation.invitedBy
+      );
+      return { status: 200, body: { data: membership } };
+    } catch (err) {
+      if (err instanceof InvitationNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      if (err instanceof InvitationExpiredError) {
+        return { status: 410, body: { error: err.message } };
+      }
+      if (err instanceof MemberAlreadyExistsError) {
+        return { status: 409, body: { error: "You are already a member of this organization." } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * Revoke a pending invitation. Requires admin or higher.
+   */
+  async revokeInvitation(userId, orgId, invitationId) {
+    const authResult = await this.requireRole(orgId, userId, "admin");
+    if (authResult) return authResult;
+    try {
+      await this.store.revokeInvitation(invitationId);
+      return { status: 200, body: { data: { revoked: true } } };
+    } catch (err) {
+      if (err instanceof InvitationNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * List pending invitations for an organization. Requires admin or higher.
+   */
+  async listPendingInvitations(userId, orgId) {
+    const authResult = await this.requireRole(orgId, userId, "admin");
+    if (authResult) return authResult;
+    try {
+      const invitations = await this.store.listPendingInvitations(orgId);
+      return { status: 200, body: { data: invitations } };
+    } catch (err) {
+      if (err instanceof OrgNotFoundError) {
+        return { status: 404, body: { error: err.message } };
+      }
+      throw err;
+    }
+  }
+  /**
+   * List pending invitations for the authenticated user's email.
+   */
+  async listMyInvitations(email) {
+    if (!isValidEmail2(email)) {
+      return { status: 400, body: { error: "A valid email address is required." } };
+    }
+    const invitations = await this.store.listInvitationsForEmail(email);
+    return { status: 200, body: { data: invitations } };
+  }
+  // --- Private helpers ---
+  /**
+   * Check if the caller has the required role in the org.
+   * Returns an error response if not authorized, or null if authorized.
+   */
+  async requireRole(orgId, userId, requiredRole) {
+    const membership = await this.store.getMembership(orgId, userId);
+    if (!membership) {
+      return { status: 404, body: { error: "Organization not found." } };
+    }
+    if (!hasRoleLevel(membership.role, requiredRole)) {
+      return {
+        status: 403,
+        body: { error: `This action requires at least the "${requiredRole}" role.` }
+      };
+    }
+    return null;
+  }
+};
+var ASSIGNABLE_ROLES = /* @__PURE__ */ new Set(["admin", "member", "viewer", "billing"]);
+function isValidRole(role) {
+  return ASSIGNABLE_ROLES.has(role) || role === "owner";
+}
+
+// src/org/org-store.ts
+var InMemoryOrgStore = class {
+  orgs = /* @__PURE__ */ new Map();
+  memberships = /* @__PURE__ */ new Map();
+  invitations = /* @__PURE__ */ new Map();
+  // --- Organizations ---
+  async createOrg(ownerId, params) {
+    const slug = params.slug ?? slugify(params.name);
+    for (const org2 of this.orgs.values()) {
+      if (org2.slug === slug) {
+        throw new OrgSlugTakenError();
+      }
+    }
+    const now = Date.now();
+    const org = {
+      id: generateId(),
+      name: params.name,
+      slug,
+      ownerId,
+      createdAt: now,
+      updatedAt: now,
+      metadata: params.metadata ?? {}
+    };
+    this.orgs.set(org.id, org);
+    await this.addMember(org.id, ownerId, "owner", null);
+    return org;
+  }
+  async getOrg(orgId) {
+    return this.orgs.get(orgId) ?? null;
+  }
+  async getOrgBySlug(slug) {
+    for (const org of this.orgs.values()) {
+      if (org.slug === slug) return org;
+    }
+    return null;
+  }
+  async updateOrg(orgId, params) {
+    const org = this.orgs.get(orgId);
+    if (!org) throw new OrgNotFoundError();
+    if (params.slug !== void 0 && params.slug !== org.slug) {
+      for (const existing of this.orgs.values()) {
+        if (existing.slug === params.slug && existing.id !== orgId) {
+          throw new OrgSlugTakenError();
+        }
+      }
+    }
+    const updated = {
+      ...org,
+      name: params.name ?? org.name,
+      slug: params.slug ?? org.slug,
+      updatedAt: Date.now(),
+      metadata: params.metadata ? { ...org.metadata, ...params.metadata } : org.metadata
+    };
+    this.orgs.set(orgId, updated);
+    return updated;
+  }
+  async deleteOrg(orgId) {
+    if (!this.orgs.has(orgId)) throw new OrgNotFoundError();
+    for (const [id, membership] of this.memberships) {
+      if (membership.orgId === orgId) {
+        this.memberships.delete(id);
+      }
+    }
+    for (const [id, invitation] of this.invitations) {
+      if (invitation.orgId === orgId) {
+        this.invitations.delete(id);
+      }
+    }
+    this.orgs.delete(orgId);
+  }
+  async listUserOrgs(userId) {
+    const orgIds = /* @__PURE__ */ new Set();
+    for (const membership of this.memberships.values()) {
+      if (membership.userId === userId) {
+        orgIds.add(membership.orgId);
+      }
+    }
+    const result = [];
+    for (const orgId of orgIds) {
+      const org = this.orgs.get(orgId);
+      if (org) result.push(org);
+    }
+    return result;
+  }
+  // --- Memberships ---
+  async addMember(orgId, userId, role, invitedBy) {
+    if (!this.orgs.has(orgId)) throw new OrgNotFoundError();
+    for (const membership2 of this.memberships.values()) {
+      if (membership2.orgId === orgId && membership2.userId === userId) {
+        throw new MemberAlreadyExistsError();
+      }
+    }
+    const membership = {
+      id: generateId(),
+      orgId,
+      userId,
+      role,
+      invitedBy,
+      joinedAt: Date.now(),
+      metadata: {}
+    };
+    this.memberships.set(membership.id, membership);
+    return membership;
+  }
+  async removeMember(orgId, userId) {
+    const org = this.orgs.get(orgId);
+    if (!org) throw new OrgNotFoundError();
+    if (org.ownerId === userId) {
+      throw new CannotRemoveOwnerError();
+    }
+    let found = false;
+    for (const [id, membership] of this.memberships) {
+      if (membership.orgId === orgId && membership.userId === userId) {
+        this.memberships.delete(id);
+        found = true;
+        break;
+      }
+    }
+    if (!found) throw new MembershipNotFoundError();
+  }
+  async updateMemberRole(orgId, userId, role) {
+    for (const [id, membership] of this.memberships) {
+      if (membership.orgId === orgId && membership.userId === userId) {
+        const updated = { ...membership, role };
+        this.memberships.set(id, updated);
+        if (role === "owner") {
+          const org = this.orgs.get(orgId);
+          if (org) {
+            for (const [mId, m] of this.memberships) {
+              if (m.orgId === orgId && m.userId === org.ownerId && m.userId !== userId) {
+                this.memberships.set(mId, { ...m, role: "admin" });
+              }
+            }
+            this.orgs.set(orgId, { ...org, ownerId: userId, updatedAt: Date.now() });
+          }
+        }
+        return updated;
+      }
+    }
+    throw new MembershipNotFoundError();
+  }
+  async listMembers(orgId) {
+    if (!this.orgs.has(orgId)) throw new OrgNotFoundError();
+    const result = [];
+    for (const membership of this.memberships.values()) {
+      if (membership.orgId === orgId) {
+        result.push(membership);
+      }
+    }
+    return result;
+  }
+  async getMembership(orgId, userId) {
+    for (const membership of this.memberships.values()) {
+      if (membership.orgId === orgId && membership.userId === userId) {
+        return membership;
+      }
+    }
+    return null;
+  }
+  async transferOwnership(orgId, newOwnerId) {
+    const org = this.orgs.get(orgId);
+    if (!org) throw new OrgNotFoundError();
+    const membership = await this.getMembership(orgId, newOwnerId);
+    if (!membership) throw new MembershipNotFoundError();
+    await this.updateMemberRole(orgId, org.ownerId, "admin");
+    await this.updateMemberRole(orgId, newOwnerId, "owner");
+  }
+  // --- Invitations ---
+  async createInvitation(orgId, invitedBy, params) {
+    if (!this.orgs.has(orgId)) throw new OrgNotFoundError();
+    const now = Date.now();
+    const invitation = {
+      id: generateId(),
+      orgId,
+      email: params.email.toLowerCase().trim(),
+      role: params.role,
+      invitedBy,
+      token: generateToken(),
+      createdAt: now,
+      expiresAt: now + 7 * 24 * 60 * 60 * 1e3,
+      // 7 days
+      status: "pending"
+    };
+    this.invitations.set(invitation.id, invitation);
+    return invitation;
+  }
+  async getInvitationByToken(token) {
+    for (const invitation of this.invitations.values()) {
+      if (invitation.token === token && invitation.status === "pending") {
+        return invitation;
+      }
+    }
+    return null;
+  }
+  async consumeInvitation(token) {
+    for (const [id, invitation] of this.invitations) {
+      if (invitation.token === token) {
+        if (invitation.status !== "pending") {
+          throw new InvitationNotFoundError();
+        }
+        if (Date.now() > invitation.expiresAt) {
+          this.invitations.set(id, { ...invitation, status: "expired" });
+          throw new InvitationExpiredError();
+        }
+        const consumed = { ...invitation, status: "accepted" };
+        this.invitations.set(id, consumed);
+        return consumed;
+      }
+    }
+    throw new InvitationNotFoundError();
+  }
+  async revokeInvitation(invitationId) {
+    const invitation = this.invitations.get(invitationId);
+    if (!invitation || invitation.status !== "pending") {
+      throw new InvitationNotFoundError();
+    }
+    this.invitations.set(invitationId, { ...invitation, status: "revoked" });
+  }
+  async listPendingInvitations(orgId) {
+    if (!this.orgs.has(orgId)) throw new OrgNotFoundError();
+    const result = [];
+    const now = Date.now();
+    for (const invitation of this.invitations.values()) {
+      if (invitation.orgId === orgId && invitation.status === "pending") {
+        if (now > invitation.expiresAt) {
+          continue;
+        }
+        result.push(invitation);
+      }
+    }
+    return result;
+  }
+  async listInvitationsForEmail(email) {
+    const normalizedEmail = email.toLowerCase().trim();
+    const result = [];
+    const now = Date.now();
+    for (const invitation of this.invitations.values()) {
+      if (invitation.email === normalizedEmail && invitation.status === "pending" && now <= invitation.expiresAt) {
+        result.push(invitation);
+      }
+    }
+    return result;
+  }
+  async cleanExpiredInvitations() {
+    let count = 0;
+    const now = Date.now();
+    for (const [id, invitation] of this.invitations) {
+      if (invitation.status === "pending" && now > invitation.expiresAt) {
+        this.invitations.set(id, { ...invitation, status: "expired" });
+        count++;
+      }
+    }
+    return count;
+  }
+};
+function generateId() {
+  return globalThis.crypto.randomUUID();
+}
+function generateToken() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function slugify(name) {
+  return name.toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/[\s]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+
+// src/rbac/rbac-types.ts
+import { KoraError as KoraError8 } from "@korajs/core";
+function parsePermission(permission) {
+  const colonIndex = permission.indexOf(":");
+  if (colonIndex === -1) {
+    throw new InvalidPermissionError(permission);
+  }
+  const resource = permission.slice(0, colonIndex);
+  const action = permission.slice(colonIndex + 1);
+  if (resource.length === 0 || action.length === 0) {
+    throw new InvalidPermissionError(permission);
+  }
+  return { resource, action };
+}
+function permissionCovers(granted, required) {
+  const g = parsePermission(granted);
+  const r = parsePermission(required);
+  const resourceMatch = g.resource === "*" || g.resource === r.resource;
+  const actionMatch = g.action === "*" || g.action === r.action;
+  return resourceMatch && actionMatch;
+}
+var BUILT_IN_ROLES = [
+  {
+    name: "viewer",
+    permissions: ["*:read"]
+  },
+  {
+    name: "billing",
+    permissions: ["org:billing"]
+  },
+  {
+    name: "member",
+    permissions: ["*:write", "*:delete"],
+    inherits: ["viewer"]
+  },
+  {
+    name: "admin",
+    permissions: ["org:manage-members", "org:manage-settings", "org:manage-invitations"],
+    inherits: ["member"]
+  },
+  {
+    name: "owner",
+    permissions: ["*:*"]
+  }
+];
+var RbacError = class extends KoraError8 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "RbacError";
+  }
+};
+var InvalidPermissionError = class extends RbacError {
+  constructor(permission) {
+    super(
+      `Invalid permission format: "${permission}". Expected "resource:action".`,
+      "INVALID_PERMISSION",
+      { permission }
+    );
+  }
+};
+var RoleNotFoundError = class extends RbacError {
+  constructor(role) {
+    super(
+      `Role "${role}" is not defined.`,
+      "ROLE_NOT_FOUND",
+      { role }
+    );
+  }
+};
+var CircularInheritanceError = class extends RbacError {
+  constructor(chain) {
+    super(
+      `Circular role inheritance detected: ${chain.join(" \u2192 ")}.`,
+      "CIRCULAR_INHERITANCE",
+      { chain }
+    );
+  }
+};
+
+// src/rbac/rbac-engine.ts
+var RbacEngine = class {
+  orgStore;
+  roleMap;
+  resolvedPermissions = /* @__PURE__ */ new Map();
+  collectionResolvers = /* @__PURE__ */ new Map();
+  constructor(orgStore, config) {
+    this.orgStore = orgStore;
+    const roles = config?.roles ?? [...BUILT_IN_ROLES];
+    this.roleMap = /* @__PURE__ */ new Map();
+    for (const role of roles) {
+      this.roleMap.set(role.name, role);
+    }
+    this.validateRoles();
+  }
+  // --- Permission Checks ---
+  /**
+   * Check if a user has a specific permission in an organization.
+   *
+   * Resolves the user's role from the org membership, then evaluates
+   * the role's permissions (including inherited ones) against the required permission.
+   *
+   * Returns false (not an error) if the user is not a member.
+   */
+  async hasPermission(userId, orgId, permission) {
+    const membership = await this.orgStore.getMembership(orgId, userId);
+    if (!membership) return false;
+    const rolePerms = this.getRolePermissions(membership.role);
+    return rolePerms.some((granted) => permissionCovers(granted, permission));
+  }
+  /**
+   * Get all effective permissions for a user in an organization.
+   *
+   * Returns an empty array if the user is not a member.
+   */
+  async getUserPermissions(userId, orgId) {
+    const membership = await this.orgStore.getMembership(orgId, userId);
+    if (!membership) return [];
+    return this.getRolePermissions(membership.role);
+  }
+  /**
+   * Get all effective permissions for a role name.
+   * Includes permissions from inherited roles.
+   *
+   * @throws {RoleNotFoundError} if the role is not defined
+   */
+  getRolePermissions(roleName) {
+    const cached = this.resolvedPermissions.get(roleName);
+    if (cached) return cached;
+    if (!this.roleMap.has(roleName)) {
+      throw new RoleNotFoundError(roleName);
+    }
+    const perms = this.resolvePermissionsForRole(roleName, /* @__PURE__ */ new Set());
+    this.resolvedPermissions.set(roleName, perms);
+    return perms;
+  }
+  /**
+   * Check if a role has a specific permission.
+   */
+  roleHasPermission(roleName, permission) {
+    const perms = this.getRolePermissions(roleName);
+    return perms.some((granted) => permissionCovers(granted, permission));
+  }
+  // --- Scope Resolution ---
+  /**
+   * Register a custom scope resolver for a collection.
+   *
+   * Custom resolvers override the default scope logic for that collection.
+   */
+  registerScopeResolver(collection, resolver) {
+    this.collectionResolvers.set(collection, resolver);
+  }
+  /**
+   * Resolve sync scopes for a user in an organization.
+   *
+   * The scopes determine what data the user can see and modify during sync.
+   * - Owner/Admin: all org data
+   * - Member: all org data (read + write)
+   * - Viewer: all org data (read-only)
+   * - Billing: no data scopes (billing-only access)
+   *
+   * Custom collection resolvers can override the defaults.
+   *
+   * @param collections - List of collection names to resolve scopes for.
+   *                      If not provided, only custom-registered collections are included.
+   */
+  async resolveScopes(userId, orgId, collections) {
+    const membership = await this.orgStore.getMembership(orgId, userId);
+    if (!membership) return null;
+    const permissions = this.getRolePermissions(membership.role);
+    const ctx = {
+      userId,
+      orgId,
+      role: membership.role,
+      permissions
+    };
+    const scopes = {};
+    const hasAnyRead = permissions.some(
+      (p) => permissionCovers(p, "*:read")
+    );
+    if (!hasAnyRead) {
+      return scopes;
+    }
+    const isReadOnly = !permissions.some(
+      (p) => permissionCovers(p, "*:write")
+    );
+    const collectionsToResolve = collections ?? [...this.collectionResolvers.keys()];
+    for (const collection of collectionsToResolve) {
+      const customResolver = this.collectionResolvers.get(collection);
+      if (customResolver) {
+        const customScope = customResolver(ctx);
+        if (customScope) {
+          scopes[collection] = customScope;
+        }
+        continue;
+      }
+      const scope = { orgId };
+      if (isReadOnly) {
+        scope.__readonly = true;
+      }
+      scopes[collection] = scope;
+    }
+    return scopes;
+  }
+  // --- Role Management ---
+  /**
+   * Get all defined role names.
+   */
+  getRoleNames() {
+    return [...this.roleMap.keys()];
+  }
+  /**
+   * Get a role definition by name.
+   */
+  getRoleDefinition(roleName) {
+    return this.roleMap.get(roleName) ?? null;
+  }
+  // --- Private ---
+  /**
+   * Validate all role definitions for circular inheritance and unknown references.
+   */
+  validateRoles() {
+    for (const role of this.roleMap.values()) {
+      if (role.inherits) {
+        for (const parent of role.inherits) {
+          if (!this.roleMap.has(parent)) {
+            throw new RoleNotFoundError(parent);
+          }
+        }
+      }
+    }
+    for (const role of this.roleMap.values()) {
+      this.detectCircularInheritance(role.name, /* @__PURE__ */ new Set());
+    }
+  }
+  /**
+   * Detect circular inheritance in role hierarchy.
+   */
+  detectCircularInheritance(roleName, visited) {
+    if (visited.has(roleName)) {
+      throw new CircularInheritanceError([...visited, roleName]);
+    }
+    visited.add(roleName);
+    const role = this.roleMap.get(roleName);
+    if (role?.inherits) {
+      for (const parent of role.inherits) {
+        this.detectCircularInheritance(parent, new Set(visited));
+      }
+    }
+  }
+  /**
+   * Recursively resolve all permissions for a role, including inherited permissions.
+   */
+  resolvePermissionsForRole(roleName, visited) {
+    if (visited.has(roleName)) return [];
+    visited.add(roleName);
+    const role = this.roleMap.get(roleName);
+    if (!role) return [];
+    const perms = new Set(role.permissions);
+    if (role.inherits) {
+      for (const parent of role.inherits) {
+        const parentPerms = this.resolvePermissionsForRole(parent, visited);
+        for (const p of parentPerms) {
+          perms.add(p);
+        }
+      }
+    }
+    return [...perms];
+  }
+};
+function defineRoles() {
+  return new RoleBuilder();
+}
+var RoleBuilder = class {
+  roles = [];
+  /**
+   * Add a role definition.
+   */
+  role(name, permissions, options) {
+    this.roles.push({
+      name,
+      permissions,
+      inherits: options?.inherits
+    });
+    return this;
+  }
+  /**
+   * Include the built-in roles as a base.
+   */
+  withBuiltInRoles() {
+    this.roles = [...BUILT_IN_ROLES, ...this.roles];
+    return this;
+  }
+  /**
+   * Build and return the role definitions array.
+   */
+  build() {
+    return [...this.roles];
+  }
+};
+
+// src/rbac/scope-resolver.ts
+var OrgScopeResolver = class {
+  orgStore;
+  rbac;
+  collectionScopes = /* @__PURE__ */ new Map();
+  constructor(orgStore, rbac) {
+    this.orgStore = orgStore;
+    this.rbac = rbac;
+  }
+  /**
+   * Register a custom scope resolver for a collection.
+   * This overrides the default orgId-based filtering for that collection.
+   */
+  registerCollectionScope(collection, resolver) {
+    this.collectionScopes.set(collection, resolver);
+  }
+  /**
+   * Resolve sync scopes for all specified collections.
+   *
+   * Returns null if the user is not a member of the organization.
+   * Returns an empty object if the user has no data access (e.g., billing role).
+   */
+  async resolve(userId, orgId, collections) {
+    const membership = await this.orgStore.getMembership(orgId, userId);
+    if (!membership) return null;
+    const permissions = this.rbac.getRolePermissions(membership.role);
+    const ctx = {
+      userId,
+      orgId,
+      role: membership.role,
+      permissions
+    };
+    const scopes = {};
+    for (const collection of collections) {
+      const scope = this.resolveCollectionScope(ctx, collection);
+      if (scope) {
+        scopes[collection] = scope;
+      }
+    }
+    return scopes;
+  }
+  /**
+   * Check if a user can write to a specific collection in an org.
+   */
+  async canWrite(userId, orgId, collection) {
+    return this.rbac.hasPermission(
+      userId,
+      orgId,
+      `${collection}:write`
+    );
+  }
+  /**
+   * Check if a user can read from a specific collection in an org.
+   */
+  async canRead(userId, orgId, collection) {
+    return this.rbac.hasPermission(
+      userId,
+      orgId,
+      `${collection}:read`
+    );
+  }
+  // --- Private ---
+  resolveCollectionScope(ctx, collection) {
+    const canRead = ctx.permissions.some(
+      (p) => permissionCovers(p, `${collection}:read`) || permissionCovers(p, "*:read")
+    );
+    if (!canRead) return null;
+    const customResolver = this.collectionScopes.get(collection);
+    if (customResolver) {
+      return customResolver(ctx);
+    }
+    const scope = { orgId: ctx.orgId };
+    const canWrite = ctx.permissions.some(
+      (p) => permissionCovers(p, `${collection}:write`) || permissionCovers(p, "*:write")
+    );
+    if (!canWrite) {
+      scope.__readonly = true;
+    }
+    return scope;
+  }
+};
+
+// src/provider/oauth/oauth-types.ts
+import { KoraError as KoraError9 } from "@korajs/core";
+var OAuthError = class extends KoraError9 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "OAuthError";
+  }
+};
+var OAuthStateMismatchError = class extends OAuthError {
+  constructor() {
+    super("OAuth state parameter does not match. Possible CSRF attack.", "OAUTH_STATE_MISMATCH");
+  }
+};
+var OAuthCodeExchangeError = class extends OAuthError {
+  constructor(details) {
+    super(
+      `Failed to exchange authorization code for tokens.${details ? ` ${details}` : ""}`,
+      "OAUTH_CODE_EXCHANGE_FAILED",
+      details ? { details } : void 0
+    );
+  }
+};
+var OAuthUserInfoError = class extends OAuthError {
+  constructor(details) {
+    super(
+      `Failed to fetch user info from OAuth provider.${details ? ` ${details}` : ""}`,
+      "OAUTH_USER_INFO_FAILED",
+      details ? { details } : void 0
+    );
+  }
+};
+var OAuthProviderNotFoundError = class extends OAuthError {
+  constructor(provider) {
+    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", { provider });
+  }
+};
+
+// src/provider/oauth/oauth-flow.ts
+var DEFAULT_STATE_TTL_MS = 10 * 60 * 1e3;
+var InMemoryOAuthStateStore = class {
+  states = /* @__PURE__ */ new Map();
+  async store(state) {
+    this.states.set(state.state, state);
+  }
+  async consume(stateValue) {
+    const state = this.states.get(stateValue);
+    if (!state) return null;
+    this.states.delete(stateValue);
+    if (Date.now() > state.expiresAt) return null;
+    return state;
+  }
+  async cleanExpired() {
+    const now = Date.now();
+    let count = 0;
+    for (const [key, state] of this.states) {
+      if (now > state.expiresAt) {
+        this.states.delete(key);
+        count++;
+      }
+    }
+    return count;
+  }
+};
+var OAuthManager = class {
+  providers = /* @__PURE__ */ new Map();
+  stateStore;
+  stateTtlMs;
+  fetchFn;
+  constructor(config) {
+    for (const provider of config.providers) {
+      this.providers.set(provider.providerId, provider);
+    }
+    this.stateStore = config.stateStore ?? new InMemoryOAuthStateStore();
+    this.stateTtlMs = config.stateTtlMs ?? DEFAULT_STATE_TTL_MS;
+    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+  /**
+   * Generate an authorization URL for the user to visit.
+   * Returns the URL and the state parameter for CSRF validation.
+   */
+  async getAuthorizationUrl(providerId, metadata) {
+    const provider = this.getProvider(providerId);
+    const state = generateState();
+    const now = Date.now();
+    const oauthState = {
+      state,
+      provider: providerId,
+      redirectUri: provider.redirectUri,
+      createdAt: now,
+      expiresAt: now + this.stateTtlMs,
+      metadata
+    };
+    await this.stateStore.store(oauthState);
+    const params = new URLSearchParams({
+      client_id: provider.clientId,
+      redirect_uri: provider.redirectUri,
+      response_type: "code",
+      scope: provider.scopes.join(" "),
+      state
+    });
+    const url = `${provider.authorizationUrl}?${params.toString()}`;
+    return { url, state };
+  }
+  /**
+   * Handle the OAuth callback after the user authorizes.
+   * Validates the state parameter, exchanges the code for tokens,
+   * and fetches user info.
+   *
+   * @param providerId - The OAuth provider
+   * @param code - The authorization code from the callback
+   * @param state - The state parameter from the callback
+   * @returns Tokens and user info from the provider
+   */
+  async handleCallback(providerId, code, state) {
+    const provider = this.getProvider(providerId);
+    const oauthState = await this.stateStore.consume(state);
+    if (!oauthState || oauthState.provider !== providerId) {
+      throw new OAuthStateMismatchError();
+    }
+    const tokens = await this.exchangeCodeForTokens(provider, code);
+    const userInfo = await this.fetchUserInfo(provider, tokens.accessToken);
+    return { tokens, userInfo, stateMetadata: oauthState.metadata };
+  }
+  /**
+   * Get a registered provider by ID.
+   */
+  getProvider(providerId) {
+    const provider = this.providers.get(providerId);
+    if (!provider) {
+      throw new OAuthProviderNotFoundError(providerId);
+    }
+    return provider;
+  }
+  /**
+   * List all registered provider IDs.
+   */
+  getProviderIds() {
+    return [...this.providers.keys()];
+  }
+  // --- Private ---
+  async exchangeCodeForTokens(provider, code) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: provider.redirectUri,
+      client_id: provider.clientId,
+      client_secret: provider.clientSecret
+    });
+    let response;
+    try {
+      response = await this.fetchFn(provider.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: body.toString()
+      });
+    } catch (err) {
+      throw new OAuthCodeExchangeError(
+        err instanceof Error ? err.message : "Network error"
+      );
+    }
+    if (!response.ok) {
+      let details = `HTTP ${response.status}`;
+      try {
+        const errorBody = await response.text();
+        details += `: ${errorBody}`;
+      } catch {
+      }
+      throw new OAuthCodeExchangeError(details);
+    }
+    const data = await response.json();
+    return {
+      accessToken: data["access_token"],
+      tokenType: data["token_type"] ?? "Bearer",
+      expiresIn: data["expires_in"],
+      refreshToken: data["refresh_token"],
+      idToken: data["id_token"],
+      scope: data["scope"]
+    };
+  }
+  async fetchUserInfo(provider, accessToken) {
+    let response;
+    try {
+      response = await this.fetchFn(provider.userInfoUrl, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: "application/json"
+        }
+      });
+    } catch (err) {
+      throw new OAuthUserInfoError(
+        err instanceof Error ? err.message : "Network error"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthUserInfoError(`HTTP ${response.status}`);
+    }
+    const profile = await response.json();
+    return normalizeUserInfo(provider.providerId, profile);
+  }
+};
+function normalizeUserInfo(providerId, profile) {
+  switch (providerId) {
+    case "google":
+      return {
+        providerId: profile["sub"],
+        provider: "google",
+        email: profile["email"] ?? null,
+        emailVerified: profile["email_verified"] ?? false,
+        name: profile["name"] ?? null,
+        avatarUrl: profile["picture"] ?? null,
+        rawProfile: profile
+      };
+    case "github":
+      return {
+        providerId: String(profile["id"]),
+        provider: "github",
+        email: profile["email"] ?? null,
+        emailVerified: false,
+        // GitHub doesn't confirm in the profile response
+        name: profile["name"] ?? profile["login"] ?? null,
+        avatarUrl: profile["avatar_url"] ?? null,
+        rawProfile: profile
+      };
+    case "microsoft":
+      return {
+        providerId: profile["id"],
+        provider: "microsoft",
+        email: profile["mail"] ?? profile["userPrincipalName"] ?? null,
+        emailVerified: false,
+        name: profile["displayName"] ?? null,
+        avatarUrl: null,
+        rawProfile: profile
+      };
+    default:
+      return {
+        providerId: String(profile["id"] ?? profile["sub"] ?? ""),
+        provider: providerId,
+        email: profile["email"] ?? null,
+        emailVerified: profile["email_verified"] ?? false,
+        name: profile["name"] ?? null,
+        avatarUrl: profile["picture"] ?? profile["avatar_url"] ?? null,
+        rawProfile: profile
+      };
+  }
+}
+function googleProvider(config) {
+  return {
+    providerId: "google",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
+    scopes: config.scopes ?? ["openid", "email", "profile"],
+    redirectUri: config.redirectUri
+  };
+}
+function githubProvider(config) {
+  return {
+    providerId: "github",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    userInfoUrl: "https://api.github.com/user",
+    scopes: config.scopes ?? ["read:user", "user:email"],
+    redirectUri: config.redirectUri
+  };
+}
+function microsoftProvider(config) {
+  const tenant = config.tenantId ?? "common";
+  return {
+    providerId: "microsoft",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
+    tokenUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+    userInfoUrl: "https://graph.microsoft.com/v1.0/me",
+    scopes: config.scopes ?? ["openid", "email", "profile", "User.Read"],
+    redirectUri: config.redirectUri
+  };
+}
+function generateState() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/session/session.ts
+import { KoraError as KoraError10 } from "@korajs/core";
+var SessionError = class extends KoraError10 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "SessionError";
+  }
+};
+var SessionNotFoundError = class extends SessionError {
+  constructor(sessionId) {
+    super("Session not found or expired.", "SESSION_NOT_FOUND", { sessionId });
+  }
+};
+var SessionExpiredError = class extends SessionError {
+  constructor(sessionId) {
+    super("Session has expired.", "SESSION_EXPIRED", { sessionId });
+  }
+};
+var SessionLimitExceededError = class extends SessionError {
+  constructor(userId, limit) {
+    super(
+      `Maximum concurrent sessions (${limit}) reached. Revoke an existing session first.`,
+      "SESSION_LIMIT_EXCEEDED",
+      { userId, limit }
+    );
+  }
+};
+var SessionMfaRequiredError = class extends SessionError {
+  constructor(sessionId) {
+    super("MFA verification is required for this session.", "SESSION_MFA_REQUIRED", { sessionId });
+  }
+};
+var InMemorySessionStore = class {
+  sessions = /* @__PURE__ */ new Map();
+  async create(session) {
+    this.sessions.set(session.id, { ...session });
+  }
+  async getById(sessionId) {
+    const session = this.sessions.get(sessionId);
+    return session ? { ...session } : null;
+  }
+  async update(session) {
+    this.sessions.set(session.id, { ...session });
+  }
+  async delete(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+  async listByUserId(userId) {
+    const results = [];
+    for (const session of this.sessions.values()) {
+      if (session.userId === userId) {
+        results.push({ ...session });
+      }
+    }
+    return results.sort((a, b) => b.lastActiveAt - a.lastActiveAt);
+  }
+  async deleteAllForUser(userId) {
+    let count = 0;
+    for (const [id, session] of this.sessions) {
+      if (session.userId === userId) {
+        this.sessions.delete(id);
+        count++;
+      }
+    }
+    return count;
+  }
+  async deleteAllExcept(userId, keepSessionId) {
+    let count = 0;
+    for (const [id, session] of this.sessions) {
+      if (session.userId === userId && id !== keepSessionId) {
+        this.sessions.delete(id);
+        count++;
+      }
+    }
+    return count;
+  }
+  async cleanExpired() {
+    const now = Date.now();
+    let count = 0;
+    for (const [id, session] of this.sessions) {
+      if (now > session.expiresAt) {
+        this.sessions.delete(id);
+        count++;
+      }
+    }
+    return count;
+  }
+};
+var DEFAULT_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+var DEFAULT_MAX_SESSIONS = 10;
+var SessionManager = class {
+  store;
+  sessionTtlMs;
+  idleTimeoutMs;
+  maxSessionsPerUser;
+  slidingWindow;
+  constructor(config) {
+    this.store = config.store;
+    this.sessionTtlMs = config.sessionTtlMs ?? DEFAULT_SESSION_TTL_MS;
+    this.idleTimeoutMs = config.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+    this.maxSessionsPerUser = config.maxSessionsPerUser ?? DEFAULT_MAX_SESSIONS;
+    this.slidingWindow = config.slidingWindow ?? true;
+  }
+  /**
+   * Create a new session for a user.
+   * Enforces the maximum concurrent sessions limit.
+   */
+  async create(params) {
+    const existing = await this.store.listByUserId(params.userId);
+    const activeSessions = existing.filter((s) => Date.now() <= s.expiresAt);
+    if (activeSessions.length >= this.maxSessionsPerUser) {
+      throw new SessionLimitExceededError(params.userId, this.maxSessionsPerUser);
+    }
+    const now = Date.now();
+    const session = {
+      id: generateSessionId(),
+      userId: params.userId,
+      deviceId: params.deviceId ?? null,
+      ipAddress: params.ipAddress ?? null,
+      userAgent: params.userAgent ?? null,
+      createdAt: now,
+      lastActiveAt: now,
+      expiresAt: now + this.sessionTtlMs,
+      mfaVerified: params.mfaVerified ?? false,
+      metadata: params.metadata
+    };
+    await this.store.create(session);
+    return session;
+  }
+  /**
+   * Validate a session.
+   * Returns the session if valid, throws if not found or expired.
+   */
+  async validate(sessionId) {
+    const session = await this.store.getById(sessionId);
+    if (!session) {
+      throw new SessionNotFoundError(sessionId);
+    }
+    const now = Date.now();
+    if (now > session.expiresAt) {
+      await this.store.delete(sessionId);
+      throw new SessionExpiredError(sessionId);
+    }
+    if (now - session.lastActiveAt > this.idleTimeoutMs) {
+      await this.store.delete(sessionId);
+      throw new SessionExpiredError(sessionId);
+    }
+    return session;
+  }
+  /**
+   * Touch a session to update its last activity time.
+   * If sliding window is enabled, also extends the absolute expiry.
+   */
+  async touch(sessionId) {
+    const session = await this.validate(sessionId);
+    const now = Date.now();
+    session.lastActiveAt = now;
+    if (this.slidingWindow) {
+      session.expiresAt = now + this.sessionTtlMs;
+    }
+    await this.store.update(session);
+    return session;
+  }
+  /**
+   * Mark a session as MFA-verified.
+   */
+  async markMfaVerified(sessionId) {
+    const session = await this.validate(sessionId);
+    session.mfaVerified = true;
+    await this.store.update(session);
+    return session;
+  }
+  /**
+   * Require MFA verification on a session.
+   * Throws SessionMfaRequiredError if MFA is not verified.
+   */
+  async requireMfa(sessionId) {
+    const session = await this.validate(sessionId);
+    if (!session.mfaVerified) {
+      throw new SessionMfaRequiredError(sessionId);
+    }
+    return session;
+  }
+  /**
+   * Revoke (delete) a session.
+   */
+  async revoke(sessionId) {
+    await this.store.delete(sessionId);
+  }
+  /**
+   * Revoke all sessions for a user (sign out everywhere).
+   * Returns the number of sessions revoked.
+   */
+  async revokeAll(userId) {
+    return this.store.deleteAllForUser(userId);
+  }
+  /**
+   * Revoke all sessions for a user except the current one.
+   * Returns the number of sessions revoked.
+   */
+  async revokeOthers(userId, currentSessionId) {
+    return this.store.deleteAllExcept(userId, currentSessionId);
+  }
+  /**
+   * List all active sessions for a user.
+   */
+  async listSessions(userId) {
+    const sessions = await this.store.listByUserId(userId);
+    const now = Date.now();
+    return sessions.filter((s) => now <= s.expiresAt && now - s.lastActiveAt <= this.idleTimeoutMs);
+  }
+  /**
+   * Clean up expired sessions.
+   * Returns the number of sessions cleaned.
+   */
+  async cleanExpired() {
+    return this.store.cleanExpired();
+  }
+};
+function generateSessionId() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += bytes[i].toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+
+// src/mfa/totp.ts
+import { KoraError as KoraError11 } from "@korajs/core";
+var TotpError = class extends KoraError11 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "TotpError";
+  }
+};
+var TotpInvalidCodeError = class extends TotpError {
+  constructor() {
+    super("Invalid TOTP code.", "TOTP_INVALID_CODE");
+  }
+};
+var TotpNotEnabledError = class extends TotpError {
+  constructor(userId) {
+    super("TOTP MFA is not enabled for this user.", "TOTP_NOT_ENABLED", { userId });
+  }
+};
+var TotpAlreadyEnabledError = class extends TotpError {
+  constructor(userId) {
+    super("TOTP MFA is already enabled for this user.", "TOTP_ALREADY_ENABLED", { userId });
+  }
+};
+var TotpNotVerifiedError = class extends TotpError {
+  constructor(userId) {
+    super(
+      "TOTP MFA setup is pending verification. Verify with a valid code first.",
+      "TOTP_NOT_VERIFIED",
+      { userId }
+    );
+  }
+};
+var TotpRecoveryExhaustedError = class extends TotpError {
+  constructor() {
+    super("All recovery codes have been used. Please regenerate.", "TOTP_RECOVERY_EXHAUSTED");
+  }
+};
+var InMemoryTotpStore = class {
+  secrets = /* @__PURE__ */ new Map();
+  async save(secret) {
+    this.secrets.set(secret.userId, secret);
+  }
+  async getByUserId(userId) {
+    return this.secrets.get(userId) ?? null;
+  }
+  async delete(userId) {
+    this.secrets.delete(userId);
+  }
+};
+var DEFAULT_DIGITS = 6;
+var DEFAULT_PERIOD = 30;
+var DEFAULT_ALGORITHM = "SHA-1";
+var DEFAULT_WINDOW = 1;
+var DEFAULT_RECOVERY_CODES = 8;
+var RECOVERY_CODE_LENGTH = 10;
+var TotpManager = class {
+  store;
+  issuer;
+  digits;
+  period;
+  algorithm;
+  window;
+  recoveryCodeCount;
+  constructor(config) {
+    this.store = config.store;
+    this.issuer = config.issuer;
+    this.digits = config.digits ?? DEFAULT_DIGITS;
+    this.period = config.period ?? DEFAULT_PERIOD;
+    this.algorithm = config.algorithm ?? DEFAULT_ALGORITHM;
+    this.window = config.window ?? DEFAULT_WINDOW;
+    this.recoveryCodeCount = config.recoveryCodes ?? DEFAULT_RECOVERY_CODES;
+  }
+  /**
+   * Enable TOTP MFA for a user.
+   * Returns the secret URI (for QR code) and recovery codes.
+   * The user must verify setup with a valid code before MFA is active.
+   */
+  async enable(userId, accountName) {
+    const existing = await this.store.getByUserId(userId);
+    if (existing?.verified) {
+      throw new TotpAlreadyEnabledError(userId);
+    }
+    const secretBytes = generateSecret(20);
+    const secret = base32Encode(secretBytes);
+    const recoveryCodes = generateRecoveryCodes(this.recoveryCodeCount, RECOVERY_CODE_LENGTH);
+    const hashedCodes = await Promise.all(recoveryCodes.map((c) => hashRecoveryCode(c)));
+    const totpSecret = {
+      userId,
+      secret,
+      verified: false,
+      recoveryCodes: hashedCodes,
+      createdAt: Date.now(),
+      verifiedAt: null
+    };
+    await this.store.save(totpSecret);
+    const uri = buildOtpauthUri({
+      issuer: this.issuer,
+      accountName,
+      secret,
+      algorithm: this.algorithm,
+      digits: this.digits,
+      period: this.period
+    });
+    return { secret, uri, recoveryCodes };
+  }
+  /**
+   * Verify the TOTP setup by confirming the user can generate a valid code.
+   * Must be called after `enable()` and before MFA is enforced.
+   */
+  async verifySetup(userId, code) {
+    const stored = await this.store.getByUserId(userId);
+    if (!stored) {
+      throw new TotpNotEnabledError(userId);
+    }
+    if (stored.verified) {
+      return this.validateCode(stored.secret, code);
+    }
+    const valid = this.validateCode(stored.secret, code);
+    if (!valid) {
+      throw new TotpInvalidCodeError();
+    }
+    stored.verified = true;
+    stored.verifiedAt = Date.now();
+    await this.store.save(stored);
+    return true;
+  }
+  /**
+   * Verify a TOTP code during login.
+   * Returns true if the code is valid, false otherwise.
+   */
+  async verify(userId, code) {
+    const stored = await this.store.getByUserId(userId);
+    if (!stored) {
+      throw new TotpNotEnabledError(userId);
+    }
+    if (!stored.verified) {
+      throw new TotpNotVerifiedError(userId);
+    }
+    return this.validateCode(stored.secret, code);
+  }
+  /**
+   * Verify a recovery code as an alternative to TOTP.
+   * Recovery codes are single-use.
+   */
+  async verifyRecoveryCode(userId, recoveryCode) {
+    const stored = await this.store.getByUserId(userId);
+    if (!stored) {
+      throw new TotpNotEnabledError(userId);
+    }
+    if (!stored.verified) {
+      throw new TotpNotVerifiedError(userId);
+    }
+    const hashed = await hashRecoveryCode(recoveryCode.trim());
+    const index = stored.recoveryCodes.indexOf(hashed);
+    if (index === -1) {
+      return false;
+    }
+    stored.recoveryCodes.splice(index, 1);
+    await this.store.save(stored);
+    return true;
+  }
+  /**
+   * Regenerate recovery codes. Requires a valid TOTP code for authorization.
+   * Replaces all existing recovery codes.
+   */
+  async regenerateRecoveryCodes(userId, totpCode) {
+    const stored = await this.store.getByUserId(userId);
+    if (!stored) {
+      throw new TotpNotEnabledError(userId);
+    }
+    if (!stored.verified) {
+      throw new TotpNotVerifiedError(userId);
+    }
+    const valid = this.validateCode(stored.secret, totpCode);
+    if (!valid) {
+      throw new TotpInvalidCodeError();
+    }
+    const recoveryCodes = generateRecoveryCodes(this.recoveryCodeCount, RECOVERY_CODE_LENGTH);
+    const hashedCodes = await Promise.all(recoveryCodes.map((c) => hashRecoveryCode(c)));
+    stored.recoveryCodes = hashedCodes;
+    await this.store.save(stored);
+    return recoveryCodes;
+  }
+  /**
+   * Disable TOTP MFA for a user.
+   * Requires a valid TOTP code or recovery code for authorization.
+   */
+  async disable(userId, code) {
+    const stored = await this.store.getByUserId(userId);
+    if (!stored) {
+      throw new TotpNotEnabledError(userId);
+    }
+    let authorized = false;
+    if (stored.verified) {
+      authorized = this.validateCode(stored.secret, code);
+    }
+    if (!authorized) {
+      const hashed = await hashRecoveryCode(code.trim());
+      authorized = stored.recoveryCodes.includes(hashed);
+    }
+    if (!authorized) {
+      throw new TotpInvalidCodeError();
+    }
+    await this.store.delete(userId);
+  }
+  /**
+   * Check if a user has TOTP MFA enabled and verified.
+   */
+  async isEnabled(userId) {
+    const stored = await this.store.getByUserId(userId);
+    return stored !== null && stored.verified;
+  }
+  /**
+   * Get the number of remaining recovery codes for a user.
+   */
+  async remainingRecoveryCodes(userId) {
+    const stored = await this.store.getByUserId(userId);
+    if (!stored || !stored.verified) return 0;
+    return stored.recoveryCodes.length;
+  }
+  // --- Private ---
+  validateCode(base32Secret, code) {
+    const secretBytes = base32Decode(base32Secret);
+    const now = Math.floor(Date.now() / 1e3);
+    for (let offset = -this.window; offset <= this.window; offset++) {
+      const timeCounter = Math.floor((now + offset * this.period) / this.period);
+      const expected = generateTotpCode(secretBytes, timeCounter, this.digits, this.algorithm);
+      if (timingSafeEqual(code, expected)) {
+        return true;
+      }
+    }
+    return false;
+  }
+};
+function generateTotpCode(secret, counter, digits, algorithm) {
+  const counterBytes = new Uint8Array(8);
+  let c = counter;
+  for (let i = 7; i >= 0; i--) {
+    counterBytes[i] = c & 255;
+    c = Math.floor(c / 256);
+  }
+  const hash = hmacSha(algorithm, secret, counterBytes);
+  const offset = hash[hash.length - 1] & 15;
+  const binary = (hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255;
+  const otp = binary % Math.pow(10, digits);
+  return otp.toString().padStart(digits, "0");
+}
+function hmacSha(algorithm, key, message) {
+  const blockSize = algorithm === "SHA-512" ? 128 : 64;
+  let keyPad = key;
+  if (keyPad.length > blockSize) {
+    keyPad = sha1(keyPad);
+  }
+  const ipad = new Uint8Array(blockSize);
+  const opad = new Uint8Array(blockSize);
+  for (let i = 0; i < blockSize; i++) {
+    const k = i < keyPad.length ? keyPad[i] : 0;
+    ipad[i] = k ^ 54;
+    opad[i] = k ^ 92;
+  }
+  const innerData = new Uint8Array(blockSize + message.length);
+  innerData.set(ipad);
+  innerData.set(message, blockSize);
+  const innerHash = sha1(innerData);
+  const outerData = new Uint8Array(blockSize + innerHash.length);
+  outerData.set(opad);
+  outerData.set(innerHash, blockSize);
+  return sha1(outerData);
+}
+function sha1(data) {
+  let h0 = 1732584193;
+  let h1 = 4023233417;
+  let h2 = 2562383102;
+  let h3 = 271733878;
+  let h4 = 3285377520;
+  const bitLength = data.length * 8;
+  const paddedLength = Math.ceil((data.length + 9) / 64) * 64;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(data);
+  padded[data.length] = 128;
+  const view = new DataView(padded.buffer, padded.byteOffset);
+  view.setUint32(paddedLength - 4, bitLength, false);
+  const w = new Int32Array(80);
+  for (let offset = 0; offset < paddedLength; offset += 64) {
+    for (let i = 0; i < 16; i++) {
+      w[i] = view.getInt32(offset + i * 4, false);
+    }
+    for (let i = 16; i < 80; i++) {
+      w[i] = rotl32(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16] | 0, 1);
+    }
+    let a = h0;
+    let b = h1;
+    let c = h2;
+    let d = h3;
+    let e = h4;
+    for (let i = 0; i < 80; i++) {
+      let f;
+      let k;
+      if (i < 20) {
+        f = b & c | ~b & d;
+        k = 1518500249;
+      } else if (i < 40) {
+        f = b ^ c ^ d;
+        k = 1859775393;
+      } else if (i < 60) {
+        f = b & c | b & d | c & d;
+        k = 2400959708;
+      } else {
+        f = b ^ c ^ d;
+        k = 3395469782;
+      }
+      const temp = rotl32(a, 5) + f + e + k + w[i] | 0;
+      e = d;
+      d = c;
+      c = rotl32(b, 30);
+      b = a;
+      a = temp;
+    }
+    h0 = h0 + a | 0;
+    h1 = h1 + b | 0;
+    h2 = h2 + c | 0;
+    h3 = h3 + d | 0;
+    h4 = h4 + e | 0;
+  }
+  const result = new Uint8Array(20);
+  const rv = new DataView(result.buffer);
+  rv.setInt32(0, h0, false);
+  rv.setInt32(4, h1, false);
+  rv.setInt32(8, h2, false);
+  rv.setInt32(12, h3, false);
+  rv.setInt32(16, h4, false);
+  return result;
+}
+function rotl32(value, shift) {
+  return value << shift | value >>> 32 - shift | 0;
+}
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(data) {
+  let result = "";
+  let bits = 0;
+  let buffer = 0;
+  for (let i = 0; i < data.length; i++) {
+    buffer = buffer << 8 | data[i];
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      result += BASE32_ALPHABET[buffer >>> bits & 31];
+    }
+  }
+  if (bits > 0) {
+    result += BASE32_ALPHABET[buffer << 5 - bits & 31];
+  }
+  return result;
+}
+function base32Decode(encoded) {
+  const cleaned = encoded.replace(/=+$/, "").toUpperCase();
+  const output = [];
+  let bits = 0;
+  let buffer = 0;
+  for (let i = 0; i < cleaned.length; i++) {
+    const char = cleaned[i];
+    const value = BASE32_ALPHABET.indexOf(char);
+    if (value === -1) continue;
+    buffer = buffer << 5 | value;
+    bits += 5;
+    if (bits >= 8) {
+      bits -= 8;
+      output.push(buffer >>> bits & 255);
+    }
+  }
+  return new Uint8Array(output);
+}
+function generateSecret(byteLength) {
+  const bytes = new Uint8Array(byteLength);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+function generateRecoveryCodes(count, length) {
+  const codes = [];
+  const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
+  for (let i = 0; i < count; i++) {
+    const bytes = new Uint8Array(length);
+    globalThis.crypto.getRandomValues(bytes);
+    let code = "";
+    for (let j = 0; j < length; j++) {
+      code += chars[bytes[j] % chars.length];
+    }
+    codes.push(`${code.slice(0, 5)}-${code.slice(5)}`);
+  }
+  return codes;
+}
+async function hashRecoveryCode(code) {
+  const encoded = new TextEncoder().encode(code.toLowerCase().replace(/[-\s]/g, ""));
+  const hash = await globalThis.crypto.subtle.digest("SHA-256", encoded);
+  const bytes = new Uint8Array(hash);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += bytes[i].toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function buildOtpauthUri(params) {
+  const label = `${encodeURIComponent(params.issuer)}:${encodeURIComponent(params.accountName)}`;
+  const query = new URLSearchParams({
+    secret: params.secret,
+    issuer: params.issuer,
+    algorithm: params.algorithm.replace("-", ""),
+    digits: params.digits.toString(),
+    period: params.period.toString()
+  });
+  return `otpauth://totp/${label}?${query.toString()}`;
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}
+
+// src/admin/admin-api.ts
+import { KoraError as KoraError12 } from "@korajs/core";
+var AdminApiError = class extends KoraError12 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "AdminApiError";
+  }
+};
+var AdminUserNotFoundError = class extends AdminApiError {
+  constructor(userId) {
+    super(`User "${userId}" not found.`, "ADMIN_USER_NOT_FOUND", { userId });
+  }
+};
+var AdminUnauthorizedError = class extends AdminApiError {
+  constructor() {
+    super("Admin privileges required.", "ADMIN_UNAUTHORIZED");
+  }
+};
+var AdminApi = class {
+  userStore;
+  sessionStore;
+  auditLogger;
+  constructor(config) {
+    this.userStore = config.userStore;
+    this.sessionStore = config.sessionStore ?? null;
+    this.auditLogger = config.auditLogger ?? null;
+  }
+  /**
+   * Get a user by ID with full details.
+   */
+  async getUser(adminId, userId) {
+    const user = await this.userStore.findById(userId);
+    if (!user) {
+      throw new AdminUserNotFoundError(userId);
+    }
+    await this.audit("admin.user_lookup", adminId, userId, "user");
+    return toAuthUser2(user);
+  }
+  /**
+   * List users with optional filtering and pagination.
+   */
+  async listUsers(query = {}) {
+    const limit = query.limit ?? 50;
+    const offset = query.offset ?? 0;
+    const allUsers = await this.userStore.listAll();
+    let filtered = allUsers;
+    if (query.email) {
+      const searchEmail = query.email.toLowerCase();
+      filtered = filtered.filter((u) => u.email.toLowerCase().includes(searchEmail));
+    }
+    if (query.emailVerified !== void 0) {
+      filtered = filtered.filter((u) => u.emailVerified === query.emailVerified);
+    }
+    const total = filtered.length;
+    const data = filtered.slice(offset, offset + limit).map(toAuthUser2);
+    return { data, total, limit, offset };
+  }
+  /**
+   * Update a user's profile (admin-level).
+   */
+  async updateUser(adminId, userId, updates) {
+    const user = await this.userStore.findById(userId);
+    if (!user) {
+      throw new AdminUserNotFoundError(userId);
+    }
+    if (updates.name !== void 0) {
+      user.name = updates.name;
+    }
+    if (updates.emailVerified !== void 0) {
+      user.emailVerified = updates.emailVerified;
+    }
+    if (updates.email !== void 0) {
+      user.email = updates.email.toLowerCase().trim();
+    }
+    await this.userStore.update(user);
+    await this.audit("user.update", adminId, userId, "user", { updates });
+    return toAuthUser2(user);
+  }
+  /**
+   * Delete a user and all associated sessions.
+   */
+  async deleteUser(adminId, userId) {
+    const user = await this.userStore.findById(userId);
+    if (!user) {
+      throw new AdminUserNotFoundError(userId);
+    }
+    if (this.sessionStore) {
+      await this.sessionStore.deleteAllForUser(userId);
+    }
+    await this.userStore.delete(userId);
+    await this.audit("user.delete", adminId, userId, "user");
+  }
+  /**
+   * Get all active sessions for a user.
+   */
+  async getUserSessions(userId) {
+    if (!this.sessionStore) return [];
+    return this.sessionStore.listByUserId(userId);
+  }
+  /**
+   * Revoke all sessions for a user.
+   */
+  async revokeUserSessions(adminId, userId) {
+    if (!this.sessionStore) return 0;
+    const count = await this.sessionStore.deleteAllForUser(userId);
+    await this.audit("session.revoke_all", adminId, userId, "user", { sessionsRevoked: count });
+    return count;
+  }
+  /**
+   * Revoke a specific session.
+   */
+  async revokeSession(adminId, sessionId) {
+    if (!this.sessionStore) return;
+    await this.sessionStore.delete(sessionId);
+    await this.audit("session.revoke", adminId, sessionId, "session");
+  }
+  /**
+   * Get system statistics.
+   */
+  async getStats() {
+    const allUsers = await this.userStore.listAll();
+    const verified = allUsers.filter((u) => u.emailVerified).length;
+    return {
+      totalUsers: allUsers.length,
+      verifiedUsers: verified,
+      unverifiedUsers: allUsers.length - verified
+    };
+  }
+  // --- Private ---
+  async audit(action, actorId, targetId, targetType, metadata) {
+    if (!this.auditLogger) return;
+    await this.auditLogger.log({
+      action,
+      actorId,
+      actorType: "admin",
+      targetId,
+      targetType,
+      metadata
+    });
+  }
+};
+function toAuthUser2(stored) {
+  return {
+    id: stored.id,
+    email: stored.email,
+    name: stored.name,
+    emailVerified: stored.emailVerified,
+    createdAt: stored.createdAt
+  };
+}
+
+// src/admin/audit-log.ts
+import { KoraError as KoraError13 } from "@korajs/core";
+var AuditLogError = class extends KoraError13 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "AuditLogError";
+  }
+};
+var InMemoryAuditLogStore = class {
+  entries = [];
+  async append(entry) {
+    this.entries.push({ ...entry });
+  }
+  async query(params) {
+    let results = this.filterEntries(params);
+    results.sort((a, b) => b.timestamp - a.timestamp);
+    const offset = params.offset ?? 0;
+    const limit = params.limit ?? 100;
+    results = results.slice(offset, offset + limit);
+    return results.map((e) => ({ ...e }));
+  }
+  async count(params) {
+    return this.filterEntries(params).length;
+  }
+  async purgeOlderThan(timestamp) {
+    const initialLength = this.entries.length;
+    let writeIndex = 0;
+    for (let i = 0; i < this.entries.length; i++) {
+      if (this.entries[i].timestamp >= timestamp) {
+        this.entries[writeIndex] = this.entries[i];
+        writeIndex++;
+      }
+    }
+    this.entries.length = writeIndex;
+    return initialLength - writeIndex;
+  }
+  filterEntries(params) {
+    return this.entries.filter((e) => {
+      if (params.actorId !== void 0 && e.actorId !== params.actorId) return false;
+      if (params.targetId !== void 0 && e.targetId !== params.targetId) return false;
+      if (params.actions !== void 0 && !params.actions.includes(e.action)) return false;
+      if (params.success !== void 0 && e.success !== params.success) return false;
+      if (params.startTime !== void 0 && e.timestamp < params.startTime) return false;
+      if (params.endTime !== void 0 && e.timestamp > params.endTime) return false;
+      return true;
+    });
+  }
+};
+var AuditLogger = class {
+  store;
+  retentionMs;
+  constructor(config) {
+    this.store = config.store;
+    this.retentionMs = config.retentionDays ? config.retentionDays * 24 * 60 * 60 * 1e3 : null;
+  }
+  /**
+   * Log an audit event.
+   */
+  async log(params) {
+    const entry = {
+      id: generateAuditId(),
+      timestamp: Date.now(),
+      action: params.action,
+      actorId: params.actorId,
+      actorType: params.actorType ?? "user",
+      targetId: params.targetId ?? null,
+      targetType: params.targetType ?? null,
+      ipAddress: params.ipAddress ?? null,
+      userAgent: params.userAgent ?? null,
+      success: params.success ?? true,
+      errorMessage: params.errorMessage ?? null,
+      metadata: params.metadata
+    };
+    await this.store.append(entry);
+    return entry;
+  }
+  /**
+   * Query audit log entries.
+   */
+  async query(params) {
+    return this.store.query(params);
+  }
+  /**
+   * Count matching audit entries.
+   */
+  async count(params) {
+    return this.store.count(params);
+  }
+  /**
+   * Purge old entries based on retention policy.
+   * Returns the number of entries purged.
+   */
+  async purge() {
+    if (this.retentionMs === null) return 0;
+    const cutoff = Date.now() - this.retentionMs;
+    return this.store.purgeOlderThan(cutoff);
+  }
+  /**
+   * Get recent activity for a user.
+   */
+  async getUserActivity(userId, limit = 50) {
+    return this.store.query({ actorId: userId, limit });
+  }
+  /**
+   * Get failed login attempts for a user within a time window.
+   */
+  async getFailedLogins(userId, windowMs) {
+    return this.store.query({
+      targetId: userId,
+      actions: ["user.signin"],
+      success: false,
+      startTime: Date.now() - windowMs
+    });
+  }
+};
+function generateAuditId() {
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += bytes[i].toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+
+// src/admin/webhooks.ts
+import { KoraError as KoraError14 } from "@korajs/core";
+var WebhookError = class extends KoraError14 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "WebhookError";
+  }
+};
+var WebhookEndpointNotFoundError = class extends WebhookError {
+  constructor(id) {
+    super(`Webhook endpoint "${id}" not found.`, "WEBHOOK_ENDPOINT_NOT_FOUND", { id });
+  }
+};
+var InMemoryWebhookStore = class {
+  endpoints = /* @__PURE__ */ new Map();
+  deliveries = [];
+  async saveEndpoint(endpoint) {
+    this.endpoints.set(endpoint.id, { ...endpoint });
+  }
+  async getEndpoint(id) {
+    const ep = this.endpoints.get(id);
+    return ep ? { ...ep } : null;
+  }
+  async listEndpoints() {
+    return [...this.endpoints.values()].map((e) => ({ ...e }));
+  }
+  async deleteEndpoint(id) {
+    this.endpoints.delete(id);
+  }
+  async saveDelivery(delivery) {
+    const existing = this.deliveries.findIndex((d) => d.id === delivery.id);
+    if (existing >= 0) {
+      this.deliveries[existing] = { ...delivery };
+    } else {
+      this.deliveries.push({ ...delivery });
+    }
+  }
+  async listDeliveries(endpointId, limit = 50) {
+    return this.deliveries.filter((d) => d.endpointId === endpointId).sort((a, b) => b.createdAt - a.createdAt).slice(0, limit).map((d) => ({ ...d }));
+  }
+};
+var MAX_RETRIES = 3;
+var RETRY_DELAYS_MS = [1e3, 5e3, 3e4];
+var WebhookManager = class {
+  store;
+  fetchFn;
+  constructor(config) {
+    this.store = config.store;
+    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+  /**
+   * Register a new webhook endpoint.
+   */
+  async register(params) {
+    const endpoint = {
+      id: generateId2(),
+      url: params.url,
+      events: [...params.events],
+      secret: generateSecret2(),
+      active: true,
+      createdAt: Date.now(),
+      metadata: params.metadata
+    };
+    await this.store.saveEndpoint(endpoint);
+    return endpoint;
+  }
+  /**
+   * Update a webhook endpoint.
+   */
+  async update(id, updates) {
+    const endpoint = await this.store.getEndpoint(id);
+    if (!endpoint) {
+      throw new WebhookEndpointNotFoundError(id);
+    }
+    if (updates.url !== void 0) endpoint.url = updates.url;
+    if (updates.events !== void 0) endpoint.events = [...updates.events];
+    if (updates.active !== void 0) endpoint.active = updates.active;
+    await this.store.saveEndpoint(endpoint);
+    return endpoint;
+  }
+  /**
+   * Delete a webhook endpoint.
+   */
+  async remove(id) {
+    await this.store.deleteEndpoint(id);
+  }
+  /**
+   * List all webhook endpoints.
+   */
+  async list() {
+    return this.store.listEndpoints();
+  }
+  /**
+   * Get a specific endpoint.
+   */
+  async get(id) {
+    const endpoint = await this.store.getEndpoint(id);
+    if (!endpoint) {
+      throw new WebhookEndpointNotFoundError(id);
+    }
+    return endpoint;
+  }
+  /**
+   * Get recent deliveries for an endpoint.
+   */
+  async getDeliveries(endpointId, limit) {
+    return this.store.listDeliveries(endpointId, limit);
+  }
+  /**
+   * Dispatch an event to all matching webhook endpoints.
+   * Delivery is best-effort with retries.
+   */
+  async dispatch(event, data) {
+    const endpoints = await this.store.listEndpoints();
+    const matching = endpoints.filter(
+      (ep) => ep.active && ep.events.includes(event)
+    );
+    const payload = {
+      id: generateId2(),
+      event,
+      timestamp: Date.now(),
+      data
+    };
+    const payloadJson = JSON.stringify(payload);
+    await Promise.allSettled(
+      matching.map((ep) => this.deliverToEndpoint(ep, payloadJson, event))
+    );
+  }
+  // --- Private ---
+  async deliverToEndpoint(endpoint, payloadJson, event) {
+    const signature = await signPayload(payloadJson, endpoint.secret);
+    const delivery = {
+      id: generateId2(),
+      endpointId: endpoint.id,
+      event,
+      payload: payloadJson,
+      responseStatus: null,
+      success: false,
+      error: null,
+      attempts: 0,
+      createdAt: Date.now(),
+      lastAttemptAt: Date.now()
+    };
+    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+      delivery.attempts = attempt + 1;
+      delivery.lastAttemptAt = Date.now();
+      try {
+        const response = await this.fetchFn(endpoint.url, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "X-Webhook-Signature": signature,
+            "X-Webhook-Event": event,
+            "X-Webhook-Delivery": delivery.id
+          },
+          body: payloadJson
+        });
+        delivery.responseStatus = response.status;
+        delivery.success = response.ok;
+        if (response.ok) {
+          await this.store.saveDelivery(delivery);
+          return;
+        }
+        delivery.error = `HTTP ${response.status}`;
+      } catch (err) {
+        delivery.error = err instanceof Error ? err.message : "Network error";
+      }
+      if (attempt < MAX_RETRIES - 1) {
+        await delay(RETRY_DELAYS_MS[attempt] ?? 1e3);
+      }
+    }
+    await this.store.saveDelivery(delivery);
+  }
+};
+function generateId2() {
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += bytes[i].toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function generateSecret2() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += bytes[i].toString(16).padStart(2, "0");
+  }
+  return `whsec_${hex}`;
+}
+async function signPayload(payload, secret) {
+  const encoder = new TextEncoder();
+  const key = await globalThis.crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await globalThis.crypto.subtle.sign(
+    "HMAC",
+    key,
+    encoder.encode(payload)
+  );
+  const bytes = new Uint8Array(signature);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += bytes[i].toString(16).padStart(2, "0");
+  }
+  return `sha256=${hex}`;
+}
+async function verifyWebhookSignature(payload, signature, secret) {
+  const expected = await signPayload(payload, secret);
+  if (expected.length !== signature.length) return false;
+  let result = 0;
+  for (let i = 0; i < expected.length; i++) {
+    result |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  }
+  return result === 0;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export {
+  AdminApi,
+  AdminApiError,
+  AdminUnauthorizedError,
+  AdminUserNotFoundError,
+  AuditLogError,
+  AuditLogger,
+  AuthProviderError,
+  BUILT_IN_ROLES,
+  BuiltInAuthRoutes,
+  BuiltInProvider,
+  CannotRemoveOwnerError,
+  CircularInheritanceError,
+  DuplicateEmailError,
+  EmailVerificationError,
+  EmailVerificationManager,
+  ExternalAuthOperationNotSupportedError,
+  ExternalJwtProvider,
+  ExternalTokenValidationError,
+  INVITATION_STATUSES,
+  InMemoryAuditLogStore,
+  InMemoryChallengeStore,
+  InMemoryEmailVerificationStore,
+  InMemoryOAuthStateStore,
+  InMemoryOrgStore,
+  InMemoryPasswordResetStore,
+  InMemoryRateLimiter,
+  InMemorySessionStore,
+  InMemoryTokenRevocationStore,
+  InMemoryTotpStore,
+  InMemoryUserStore,
+  InMemoryWebhookStore,
+  InsufficientRoleError,
+  InvalidPermissionError,
+  InvitationExpiredError,
+  InvitationNotFoundError,
+  MemberAlreadyExistsError,
+  MembershipNotFoundError,
+  OAuthCodeExchangeError,
+  OAuthError,
+  OAuthManager,
+  OAuthProviderNotFoundError,
+  OAuthStateMismatchError,
+  OAuthUserInfoError,
+  ORG_ROLES,
+  OperationEncryptionError,
+  OperationEncryptor,
+  OrgError,
+  OrgNotFoundError,
+  OrgRoutes,
+  OrgScopeResolver,
+  OrgSlugTakenError,
+  PasskeyVerificationError,
+  PasswordResetError,
+  PasswordResetManager,
+  PostgresUserStore,
+  ROLE_HIERARCHY,
+  RbacEngine,
+  RbacError,
+  ResetRateLimitedError,
+  ResetTokenExpiredError,
+  ResetTokenNotFoundError,
+  RoleNotFoundError,
+  SessionError,
+  SessionExpiredError,
+  SessionLimitExceededError,
+  SessionManager,
+  SessionMfaRequiredError,
+  SessionNotFoundError,
+  SqliteUserStore,
+  TokenManager,
+  TotpAlreadyEnabledError,
+  TotpError,
+  TotpInvalidCodeError,
+  TotpManager,
+  TotpNotEnabledError,
+  TotpNotVerifiedError,
+  TotpRecoveryExhaustedError,
+  VerificationTokenExpiredError,
+  VerificationTokenNotFoundError,
+  WebhookEndpointNotFoundError,
+  WebhookError,
+  WebhookManager,
+  base32Decode,
+  base32Encode,
+  computePublicKeyThumbprint,
+  createClerkAdapter,
+  createPostgresUserStore,
+  createSqliteUserStore,
+  createSupabaseAdapter,
+  decodeJwt,
+  defineRoles,
+  encodeJwt,
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  githubProvider,
+  googleProvider,
+  hasRoleLevel,
+  hashPassword,
+  isEncryptedField,
+  isExpired,
+  microsoftProvider,
+  parsePermission,
+  permissionCovers,
+  verifyAuthenticationResponse,
+  verifyChallenge,
+  verifyJwt,
+  verifyPassword,
+  verifyRegistrationResponse,
+  verifyWebhookSignature
 };
 //# sourceMappingURL=server.js.map