@korajs/auth 0.3.2 → 0.4.0

package/dist/server.cjs

@@ -47,14 +47,8 @@ __export(password_hash_exports, {
   verifyPassword: () => verifyPassword
 });
 async function hashPassword(password) {
-  const salt = (0, import_node_crypto3.randomBytes)(SALT_LENGTH);
-  const derivedKey = await pbkdf2Async(
-    password,
-    salt,
-    PBKDF2_ITERATIONS,
-    KEY_LENGTH,
-    PBKDF2_DIGEST
-  );
+  const salt = (0, import_node_crypto.randomBytes)(SALT_LENGTH);
+  const derivedKey = await pbkdf2Async(password, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);
   return {
     hash: derivedKey.toString("hex"),
     salt: salt.toString("hex")
@@ -73,11 +67,11 @@ async function verifyPassword(password, hash, salt) {
   if (derivedKey.length !== hashBuffer.length) {
     return false;
   }
-  return (0, import_node_crypto3.timingSafeEqual)(derivedKey, hashBuffer);
+  return (0, import_node_crypto.timingSafeEqual)(derivedKey, hashBuffer);
 }
 function pbkdf2Async(password, salt, iterations, keyLength, digest) {
   return new Promise((resolve, reject) => {
-    (0, import_node_crypto3.pbkdf2)(password, salt, iterations, keyLength, digest, (err, derivedKey) => {
+    (0, import_node_crypto.pbkdf2)(password, salt, iterations, keyLength, digest, (err, derivedKey) => {
       if (err) {
         reject(err);
       } else {
@@ -86,12 +80,12 @@ function pbkdf2Async(password, salt, iterations, keyLength, digest) {
     });
   });
 }
-var import_node_crypto3, PBKDF2_ITERATIONS, PBKDF2_DIGEST, KEY_LENGTH, SALT_LENGTH;
+var import_node_crypto, PBKDF2_ITERATIONS, PBKDF2_DIGEST, KEY_LENGTH, SALT_LENGTH;
 var init_password_hash = __esm({
   "src/provider/built-in/password-hash.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_crypto3 = require("crypto");
+    import_node_crypto = require("crypto");
     PBKDF2_ITERATIONS = 6e5;
     PBKDF2_DIGEST = "sha512";
     KEY_LENGTH = 64;
@@ -217,1403 +211,1156 @@ init_cjs_shims();
 
 // src/provider/built-in/auth-routes.ts
 init_cjs_shims();
-var import_node_crypto5 = require("crypto");
-
-// src/tokens/token-manager.ts
-init_cjs_shims();
 var import_node_crypto2 = require("crypto");
 
-// src/types.ts
+// src/device/device-identity.ts
 init_cjs_shims();
 var import_core = require("@korajs/core");
-var DEFAULT_ACCESS_TOKEN_LIFETIME = 15 * 60 * 1e3;
-var DEFAULT_REFRESH_TOKEN_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
-var DEFAULT_DEVICE_CREDENTIAL_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
-var DEFAULT_MAX_OFFLINE_DURATION = 30 * 24 * 60 * 60 * 1e3;
-var DEFAULT_AUTO_LOCK_TIMEOUT = 15 * 60 * 1e3;
-
-// src/tokens/jwt.ts
-init_cjs_shims();
-var import_node_crypto = require("crypto");
-function base64urlEncode(input) {
-  return Buffer.from(input, "utf-8").toString("base64url");
-}
-function base64urlDecode(input) {
-  return Buffer.from(input, "base64url").toString("utf-8");
-}
-function hmacSha256Base64url(data, secret) {
-  return (0, import_node_crypto.createHmac)("sha256", secret).update(data).digest("base64url");
-}
-var ENCODED_HEADER = base64urlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
-function encodeJwt(payload, secret) {
-  const encodedPayload = base64urlEncode(JSON.stringify(payload));
-  const signingInput = `${ENCODED_HEADER}.${encodedPayload}`;
-  const signature = hmacSha256Base64url(signingInput, secret);
-  return `${signingInput}.${signature}`;
-}
-function decodeJwt(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return null;
+var CryptoUnavailableError = class extends import_core.KoraError {
+  constructor() {
+    super(
+      "Web Crypto API (crypto.subtle) is not available in this environment. Device identity requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
+      "CRYPTO_UNAVAILABLE"
+    );
+    this.name = "CryptoUnavailableError";
   }
-  const payloadSegment = parts[1];
-  if (payloadSegment === void 0) {
-    return null;
+};
+var DeviceIdentityError = class extends import_core.KoraError {
+  constructor(message, context) {
+    super(message, "DEVICE_IDENTITY_ERROR", context);
+    this.name = "DeviceIdentityError";
   }
-  try {
-    const decoded = base64urlDecode(payloadSegment);
-    const parsed = JSON.parse(decoded);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
+};
+function toBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
   }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function verifyJwt(token, secret) {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const headerSegment = parts[0];
-  const payloadSegment = parts[1];
-  const signatureSegment = parts[2];
-  if (headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
-    return null;
+function fromBase64Url(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingNeeded = (4 - base64.length % 4) % 4;
+  base64 += "=".repeat(paddingNeeded);
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
   }
-  if (headerSegment !== ENCODED_HEADER) {
-    return null;
+  return bytes;
+}
+function assertCryptoAvailable() {
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+    throw new CryptoUnavailableError();
   }
-  const signingInput = `${headerSegment}.${payloadSegment}`;
-  const expectedSignature = hmacSha256Base64url(signingInput, secret);
-  if (expectedSignature.length !== signatureSegment.length) {
-    return null;
+}
+var ECDSA_ALGORITHM = {
+  name: "ECDSA",
+  namedCurve: "P-256"
+};
+var ECDSA_SIGN_ALGORITHM = {
+  name: "ECDSA",
+  hash: { name: "SHA-256" }
+};
+async function verifyChallenge(publicKeyJwk, challenge, signature) {
+  assertCryptoAvailable();
+  try {
+    const publicKey = await globalThis.crypto.subtle.importKey(
+      "jwk",
+      publicKeyJwk,
+      ECDSA_ALGORITHM,
+      true,
+      ["verify"]
+    );
+    const encoded = new TextEncoder().encode(challenge);
+    const signatureBytes = fromBase64Url(signature);
+    const isValid = await globalThis.crypto.subtle.verify(
+      ECDSA_SIGN_ALGORITHM,
+      publicKey,
+      signatureBytes,
+      encoded
+    );
+    return isValid;
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to verify challenge signature. The public key JWK or signature format may be invalid.",
+      {
+        cause: cause instanceof Error ? cause.message : String(cause),
+        publicKeyKty: publicKeyJwk.kty,
+        publicKeyCrv: publicKeyJwk.crv
+      }
+    );
   }
-  let mismatch = 0;
-  for (let i = 0; i < expectedSignature.length; i++) {
-    mismatch |= expectedSignature.charCodeAt(i) ^ signatureSegment.charCodeAt(i);
+}
+async function computePublicKeyThumbprint(publicKeyJwk) {
+  assertCryptoAvailable();
+  if (publicKeyJwk.kty !== "EC") {
+    throw new DeviceIdentityError(
+      `Expected JWK key type "EC" but received "${publicKeyJwk.kty ?? "undefined"}". Only ECDSA public keys are supported for device identity.`,
+      { kty: publicKeyJwk.kty }
+    );
   }
-  if (mismatch !== 0) {
-    return null;
+  if (!publicKeyJwk.crv || !publicKeyJwk.x || !publicKeyJwk.y) {
+    throw new DeviceIdentityError(
+      'JWK is missing required EC fields. An EC public key JWK must include "crv", "x", and "y" members.',
+      {
+        hasCrv: Boolean(publicKeyJwk.crv),
+        hasX: Boolean(publicKeyJwk.x),
+        hasY: Boolean(publicKeyJwk.y)
+      }
+    );
   }
+  const canonicalJson = JSON.stringify({
+    crv: publicKeyJwk.crv,
+    kty: publicKeyJwk.kty,
+    x: publicKeyJwk.x,
+    y: publicKeyJwk.y
+  });
   try {
-    const decoded = base64urlDecode(payloadSegment);
-    const parsed = JSON.parse(decoded);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-var CLOCK_SKEW_TOLERANCE_SECONDS = 5;
-function isExpired(payload) {
-  if (typeof payload.exp !== "number") {
-    return false;
+    const encoded = new TextEncoder().encode(canonicalJson);
+    const hashBuffer = await globalThis.crypto.subtle.digest("SHA-256", encoded);
+    return toBase64Url(hashBuffer);
+  } catch (cause) {
+    throw new DeviceIdentityError("Failed to compute SHA-256 thumbprint of the public key JWK.", {
+      cause: cause instanceof Error ? cause.message : String(cause)
+    });
   }
-  const nowSeconds = Math.floor(Date.now() / 1e3);
-  return nowSeconds >= payload.exp + CLOCK_SKEW_TOLERANCE_SECONDS;
 }
 
-// src/tokens/token-manager.ts
-var MIN_SECRET_LENGTH = 32;
-var InMemoryTokenRevocationStore = class {
-  revokedTokens = /* @__PURE__ */ new Map();
-  revokedDevices = /* @__PURE__ */ new Set();
-  async isRevoked(jti) {
-    return this.revokedTokens.has(jti);
-  }
-  async revoke(jti, expiresAt) {
-    this.revokedTokens.set(jti, expiresAt);
-  }
-  async revokeAllForDevice(deviceId) {
-    this.revokedDevices.add(deviceId);
+// src/provider/built-in/auth-routes.ts
+init_password_hash();
+var InMemoryChallengeStore = class {
+  challenges = /* @__PURE__ */ new Map();
+  async store(challenge, deviceId, expiresAt) {
+    this.challenges.set(challenge, { deviceId, expiresAt });
   }
-  /**
-   * Check if a device has been revoked.
-   */
-  isDeviceRevoked(deviceId) {
-    return this.revokedDevices.has(deviceId);
+  async consume(challenge) {
+    const entry = this.challenges.get(challenge);
+    if (entry === void 0) {
+      return null;
+    }
+    this.challenges.delete(challenge);
+    if (Date.now() > entry.expiresAt) {
+      return null;
+    }
+    return { deviceId: entry.deviceId };
   }
   /**
-   * Remove expired revocations to prevent unbounded memory growth.
-   * Call periodically (e.g., every hour) in long-running servers.
+   * Remove expired challenges to prevent unbounded memory growth.
    */
   cleanup() {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    for (const [jti, expiresAt] of this.revokedTokens) {
-      if (nowSeconds > expiresAt) {
-        this.revokedTokens.delete(jti);
+    const now = Date.now();
+    for (const [challenge, entry] of this.challenges) {
+      if (now > entry.expiresAt) {
+        this.challenges.delete(challenge);
       }
     }
   }
 };
-var TokenManager = class {
-  /** All signing/verification secrets (index 0 = current signing key) */
-  secrets;
-  accessTokenLifetime;
-  refreshTokenLifetime;
-  deviceCredentialLifetime;
-  revocationStore;
-  constructor(config) {
-    const secrets = Array.isArray(config.secret) ? config.secret : [config.secret];
-    if (secrets.length === 0) {
-      throw new Error("TokenManager requires at least one secret.");
-    }
-    for (const secret of secrets) {
-      if (secret.length < MIN_SECRET_LENGTH) {
-        throw new Error(
-          `JWT secret must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for HMAC-SHA256 security. Received ${secret.length} characters. Use TokenManager.generateSecret() to generate a secure secret.`
-        );
-      }
-    }
-    this.secrets = secrets;
-    this.accessTokenLifetime = config.accessTokenLifetime ?? DEFAULT_ACCESS_TOKEN_LIFETIME;
-    this.refreshTokenLifetime = config.refreshTokenLifetime ?? DEFAULT_REFRESH_TOKEN_LIFETIME;
-    this.deviceCredentialLifetime = config.deviceCredentialLifetime ?? DEFAULT_DEVICE_CREDENTIAL_LIFETIME;
-    this.revocationStore = config.revocationStore;
-  }
-  /**
-   * Generate a cryptographically random secret suitable for HMAC-SHA256 signing.
-   *
-   * Returns a 64-character hex string (32 bytes / 256 bits of entropy).
-   * Store this securely (environment variable, secrets manager) — never in source code.
-   *
-   * @returns A random 256-bit hex-encoded secret
-   */
-  static generateSecret() {
-    return (0, import_node_crypto2.randomBytes)(32).toString("hex");
-  }
+var InMemoryRateLimiter = class {
+  attempts = /* @__PURE__ */ new Map();
+  maxAttempts;
+  windowMs;
   /**
-   * Issue a signed JWT access token.
-   *
-   * Access tokens are short-lived (default 15 minutes) and used to authorize
-   * API requests. When expired, use {@link refreshAccessToken} with a valid
-   * refresh token to obtain a new one.
-   *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @returns A signed JWT string with type 'access'
+   * @param maxAttempts - Maximum number of attempts within the time window (default: 10)
+   * @param windowMs - Time window in milliseconds (default: 60,000 = 1 minute)
    */
-  issueAccessToken(userId, deviceId) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const payload = {
-      jti: (0, import_node_crypto2.randomUUID)(),
-      sub: userId,
-      dev: deviceId,
-      type: "access",
-      iat: nowSeconds,
-      exp: nowSeconds + Math.floor(this.accessTokenLifetime / 1e3)
-    };
-    return encodeJwt(payload, this.secrets[0]);
+  constructor(maxAttempts = 10, windowMs = 6e4) {
+    this.maxAttempts = maxAttempts;
+    this.windowMs = windowMs;
   }
-  /**
-   * Issue a signed JWT refresh token.
-   *
-   * Refresh tokens are longer-lived (default 90 days) and used exclusively
-   * to obtain new access tokens via {@link refreshAccessToken}. They should
-   * be stored securely and never sent to resource APIs.
-   *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @returns A signed JWT string with type 'refresh'
-   */
-  issueRefreshToken(userId, deviceId) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const payload = {
-      jti: (0, import_node_crypto2.randomUUID)(),
-      sub: userId,
-      dev: deviceId,
-      type: "refresh",
-      iat: nowSeconds,
-      exp: nowSeconds + Math.floor(this.refreshTokenLifetime / 1e3)
-    };
-    return encodeJwt(payload, this.secrets[0]);
+  async isAllowed(key) {
+    const now = Date.now();
+    const attempts = this.attempts.get(key) ?? [];
+    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
+    return recentAttempts.length < this.maxAttempts;
   }
-  /**
-   * Issue a signed device credential token.
-   *
-   * Device credentials are long-lived tokens bound to a device's public key.
-   * They include a `mustCheckinBy` deadline; if the device does not check in
-   * before this deadline, the credential should be treated as revoked.
-   *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @param publicKeyThumbprint - SHA-256 thumbprint of the device's public key
-   * @returns A signed JWT string with type 'device_credential'
-   */
-  issueDeviceCredential(userId, deviceId, publicKeyThumbprint) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const lifetimeSeconds = Math.floor(this.deviceCredentialLifetime / 1e3);
-    const payload = {
-      jti: (0, import_node_crypto2.randomUUID)(),
-      sub: userId,
-      dev: deviceId,
-      type: "device_credential",
-      iat: nowSeconds,
-      exp: nowSeconds + lifetimeSeconds,
-      dpk: publicKeyThumbprint,
-      mustCheckinBy: nowSeconds + lifetimeSeconds
-    };
-    return encodeJwt(payload, this.secrets[0]);
+  async record(key) {
+    const now = Date.now();
+    const attempts = this.attempts.get(key) ?? [];
+    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
+    recentAttempts.push(now);
+    this.attempts.set(key, recentAttempts);
   }
-  /**
-   * Issue a complete set of authentication tokens.
-   *
-   * Always issues an access token and refresh token. If a `publicKeyThumbprint`
-   * is provided, also issues a device credential.
-   *
-   * @param userId - The subject (user ID) to encode in the tokens
-   * @param deviceId - The device ID of the requesting device
-   * @param publicKeyThumbprint - Optional SHA-256 thumbprint of the device's public key.
-   *   When provided, a device credential is included in the returned tokens.
-   * @returns An {@link AuthTokens} object containing the issued tokens
-   */
-  issueTokens(userId, deviceId, publicKeyThumbprint) {
-    const tokens = {
-      accessToken: this.issueAccessToken(userId, deviceId),
-      refreshToken: this.issueRefreshToken(userId, deviceId)
-    };
-    if (publicKeyThumbprint !== void 0) {
-      tokens.deviceCredential = this.issueDeviceCredential(
-        userId,
-        deviceId,
-        publicKeyThumbprint
-      );
-    }
-    return tokens;
+  async reset(key) {
+    this.attempts.delete(key);
+  }
+};
+var MIN_PASSWORD_LENGTH = 8;
+var MAX_PASSWORD_LENGTH = 128;
+var MAX_NAME_LENGTH = 200;
+var CHALLENGE_TTL_MS = 6e4;
+function isValidEmail(email) {
+  if (email.length === 0 || email.length > 254) {
+    return false;
+  }
+  const atIndex = email.indexOf("@");
+  if (atIndex < 1) {
+    return false;
+  }
+  const domain = email.slice(atIndex + 1);
+  if (domain.length === 0 || !domain.includes(".")) {
+    return false;
+  }
+  if (email.indexOf("@", atIndex + 1) !== -1) {
+    return false;
+  }
+  if (email.includes(" ")) {
+    return false;
+  }
+  return true;
+}
+function sanitizeName(name) {
+  const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
+  const trimmed = cleaned.trim();
+  if (trimmed.length > MAX_NAME_LENGTH) {
+    return trimmed.slice(0, MAX_NAME_LENGTH);
+  }
+  return trimmed;
+}
+var BuiltInAuthRoutes = class {
+  userStore;
+  tokenManager;
+  challengeStore;
+  rateLimiter;
+  constructor(config) {
+    this.userStore = config.userStore;
+    this.tokenManager = config.tokenManager;
+    this.challengeStore = config.challengeStore ?? new InMemoryChallengeStore();
+    this.rateLimiter = config.rateLimiter ?? new InMemoryRateLimiter();
   }
   /**
-   * Validate and decode a token.
+   * Handle user sign-up (POST /auth/signup).
    *
-   * Verifies the HMAC-SHA256 signature (trying all configured secrets for key rotation),
-   * checks that the token has not expired, and validates all required claims.
-   * Returns null (rather than throwing) for invalid or expired tokens, so callers
-   * can handle authentication failure without try/catch.
+   * Validates email format and password length, hashes the password,
+   * creates the user, optionally registers a device, and issues tokens.
    *
-   * @param token - The JWT string to validate
-   * @returns The decoded {@link TokenPayload} if valid, or null if the token is
-   *   invalid, expired, or missing required claims
+   * @param body - Sign-up request body
+   * @param body.email - The user's email address
+   * @param body.password - The plaintext password (8-128 characters)
+   * @param body.name - Optional display name (defaults to email local part)
+   * @param body.deviceId - Optional device ID to register
+   * @param body.devicePublicKey - Optional device public key (base64url)
+   * @param clientIp - Optional client IP for rate limiting
+   * @returns Auth response with the created user and tokens, or an error
    */
-  validateToken(token) {
-    let decoded = null;
-    for (const secret of this.secrets) {
-      decoded = verifyJwt(token, secret);
-      if (decoded !== null) {
-        break;
-      }
+  async handleSignUp(body, clientIp) {
+    const rateLimitKey = clientIp ?? "global";
+    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+      return {
+        status: 429,
+        body: { error: "Too many requests. Please try again later." }
+      };
     }
-    if (decoded === null) {
-      return null;
+    await this.rateLimiter.record(rateLimitKey);
+    if (!isValidEmail(body.email)) {
+      return {
+        status: 400,
+        body: {
+          error: "Invalid email address. Please provide a valid email in the format user@domain.com."
+        }
+      };
     }
-    if (isExpired(decoded)) {
-      return null;
+    if (body.password.length < MIN_PASSWORD_LENGTH) {
+      return {
+        status: 400,
+        body: {
+          error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long.`
+        }
+      };
     }
-    if (typeof decoded["jti"] !== "string" || typeof decoded["sub"] !== "string" || typeof decoded["dev"] !== "string" || typeof decoded["type"] !== "string" || typeof decoded["iat"] !== "number" || typeof decoded["exp"] !== "number") {
-      return null;
+    if (body.password.length > MAX_PASSWORD_LENGTH) {
+      return {
+        status: 400,
+        body: {
+          error: `Password must be at most ${MAX_PASSWORD_LENGTH} characters long.`
+        }
+      };
     }
-    const type = decoded["type"];
-    if (type !== "access" && type !== "refresh" && type !== "device_credential") {
-      return null;
+    const { hash, salt } = await hashPassword(body.password);
+    const rawName = body.name ?? body.email.split("@")[0] ?? body.email;
+    const name = sanitizeName(rawName);
+    let user;
+    try {
+      user = await this.userStore.createUser({
+        email: body.email,
+        passwordHash: hash,
+        salt,
+        name
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "DuplicateEmailError") {
+        return {
+          status: 409,
+          body: { error: "An account with this email already exists." }
+        };
+      }
+      throw err;
     }
+    const deviceId = body.deviceId ?? `device-${user.id}`;
+    await this.userStore.registerDevice({
+      id: deviceId,
+      userId: user.id,
+      publicKey: body.devicePublicKey ?? "",
+      name: body.deviceId ? "Primary Device" : "Browser"
+    });
+    const tokens = this.tokenManager.issueTokens(user.id, deviceId);
     return {
-      jti: decoded["jti"],
-      sub: decoded["sub"],
-      dev: decoded["dev"],
-      type,
-      iat: decoded["iat"],
-      exp: decoded["exp"]
+      status: 201,
+      body: { data: { user, tokens } }
     };
   }
   /**
-   * Validate a token and check it against the revocation store.
+   * Handle user sign-in (POST /auth/signin).
    *
-   * Like {@link validateToken}, but also checks whether the token's `jti` has been
-   * revoked. Requires a revocation store to be configured.
+   * Looks up the user by email, verifies the password, optionally registers
+   * a new device, and issues tokens.
    *
-   * @param token - The JWT string to validate
-   * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
+   * @param body - Sign-in request body
+   * @param body.email - The user's email address
+   * @param body.password - The plaintext password
+   * @param body.deviceId - Optional device ID to register
+   * @param body.devicePublicKey - Optional device public key (base64url)
+   * @param clientIp - Optional client IP for rate limiting
+   * @returns Auth response with the user and tokens, or an error
    */
-  async validateTokenWithRevocation(token) {
-    const payload = this.validateToken(token);
-    if (payload === null) {
-      return null;
+  async handleSignIn(body, clientIp) {
+    const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
+    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+      return {
+        status: 429,
+        body: { error: "Too many sign-in attempts. Please try again later." }
+      };
     }
-    if (this.revocationStore) {
-      const revoked = await this.revocationStore.isRevoked(payload.jti);
-      if (revoked) {
-        return null;
-      }
+    await this.rateLimiter.record(rateLimitKey);
+    const storedUser = await this.userStore.findByEmail(body.email);
+    if (storedUser === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid email or password." }
+      };
     }
-    return payload;
+    const passwordValid = await verifyPassword(
+      body.password,
+      storedUser.passwordHash,
+      storedUser.salt
+    );
+    if (!passwordValid) {
+      return {
+        status: 401,
+        body: { error: "Invalid email or password." }
+      };
+    }
+    await this.rateLimiter.reset(rateLimitKey);
+    const deviceId = body.deviceId ?? `device-${storedUser.id}`;
+    await this.userStore.registerDevice({
+      id: deviceId,
+      userId: storedUser.id,
+      publicKey: body.devicePublicKey ?? "",
+      name: body.deviceId ? "Device" : "Browser"
+    });
+    const tokens = this.tokenManager.issueTokens(storedUser.id, deviceId);
+    const user = {
+      id: storedUser.id,
+      email: storedUser.email,
+      name: storedUser.name,
+      emailVerified: storedUser.emailVerified,
+      createdAt: storedUser.createdAt
+    };
+    return {
+      status: 200,
+      body: { data: { user, tokens } }
+    };
   }
   /**
-   * Revoke a specific token by its JWT ID.
+   * Handle token refresh (POST /auth/refresh).
    *
-   * Requires a revocation store to be configured. After revocation, the token
-   * will be rejected by {@link validateTokenWithRevocation}.
+   * Validates the provided refresh token and issues a new token pair
+   * (refresh token rotation with reuse detection). The old refresh token
+   * is marked as consumed in the revocation store.
    *
-   * @param jti - The JWT ID of the token to revoke
-   * @param expiresAt - The token's expiration time (seconds since epoch)
+   * @param body - Refresh request body
+   * @param body.refreshToken - The current refresh token
+   * @returns Auth response with new tokens, or an error
    */
-  async revokeToken(jti, expiresAt) {
-    if (this.revocationStore) {
-      await this.revocationStore.revoke(jti, expiresAt);
+  async handleRefresh(body) {
+    const result = await this.tokenManager.refreshAccessToken(body.refreshToken);
+    if (result === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired refresh token." }
+      };
     }
+    return {
+      status: 200,
+      body: { data: result }
+    };
   }
   /**
-   * Revoke all tokens for a specific device.
+   * Handle sign-out (POST /auth/signout).
    *
-   * Called when a device is revoked to ensure all its existing tokens
-   * (access, refresh, and device credentials) are invalidated.
+   * Validates the access token and revokes the current refresh token
+   * (if a revocation store is configured). This ensures that stolen
+   * refresh tokens cannot be used after the user signs out.
    *
-   * @param deviceId - The device ID whose tokens should be revoked
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param body - Sign-out request body
+   * @param body.refreshToken - The current refresh token to revoke
+   * @returns Auth response with success flag, or an error
    */
-  async revokeDeviceTokens(deviceId) {
-    if (this.revocationStore) {
-      await this.revocationStore.revokeAllForDevice(deviceId);
+  async handleSignOut(accessToken, body) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    await this.tokenManager.revokeToken(payload.jti, payload.exp);
+    if (body.refreshToken) {
+      const refreshPayload = this.tokenManager.validateToken(body.refreshToken);
+      if (refreshPayload !== null && refreshPayload.type === "refresh") {
+        await this.tokenManager.revokeToken(refreshPayload.jti, refreshPayload.exp);
+      }
     }
+    return {
+      status: 200,
+      body: { data: { success: true } }
+    };
   }
   /**
-   * Refresh an access token using a valid refresh token.
-   *
-   * Implements **refresh token rotation with reuse detection**: a new refresh token
-   * is issued alongside the new access token. The old refresh token's `jti` is
-   * recorded in the revocation store (if configured). If a previously consumed
-   * refresh token is presented again, it indicates potential token theft.
+   * Handle get-current-user (GET /auth/me).
    *
-   * Returns null if the provided token is invalid, expired, or not a refresh token.
+   * Validates the access token and returns the authenticated user's profile.
    *
-   * @param refreshToken - The refresh token JWT string
-   * @returns A new access/refresh token pair, or null if the refresh token is invalid
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @returns Auth response with the user profile, or an error
    */
-  async refreshAccessToken(refreshToken) {
-    const payload = this.validateToken(refreshToken);
-    if (payload === null) {
-      return null;
-    }
-    if (payload.type !== "refresh") {
-      return null;
+  async handleGetMe(accessToken) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    if (this.revocationStore) {
-      const wasRevoked = await this.revocationStore.isRevoked(payload.jti);
-      if (wasRevoked) {
-        await this.revocationStore.revokeAllForDevice(payload.dev);
-        return null;
-      }
-      await this.revocationStore.revoke(payload.jti, payload.exp);
+    const storedUser = await this.userStore.findById(payload.sub);
+    if (storedUser === null) {
+      return {
+        status: 404,
+        body: { error: "User not found." }
+      };
     }
+    const user = {
+      id: storedUser.id,
+      email: storedUser.email,
+      name: storedUser.name,
+      emailVerified: storedUser.emailVerified,
+      createdAt: storedUser.createdAt
+    };
     return {
-      accessToken: this.issueAccessToken(payload.sub, payload.dev),
-      refreshToken: this.issueRefreshToken(payload.sub, payload.dev)
+      status: 200,
+      body: { data: user }
     };
   }
-};
-
-// src/device/device-identity.ts
-init_cjs_shims();
-var import_core2 = require("@korajs/core");
-var CryptoUnavailableError = class extends import_core2.KoraError {
-  constructor() {
-    super(
-      "Web Crypto API (crypto.subtle) is not available in this environment. Device identity requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
-      "CRYPTO_UNAVAILABLE"
-    );
-    this.name = "CryptoUnavailableError";
-  }
-};
-var DeviceIdentityError = class extends import_core2.KoraError {
-  constructor(message, context) {
-    super(message, "DEVICE_IDENTITY_ERROR", context);
-    this.name = "DeviceIdentityError";
+  /**
+   * Handle list-devices (GET /auth/devices).
+   *
+   * Validates the access token and returns all devices registered for the user.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @returns Auth response with the device list, or an error
+   */
+  async handleListDevices(accessToken) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const devices = await this.userStore.listDevices(payload.sub);
+    return {
+      status: 200,
+      body: { data: devices }
+    };
   }
-};
-function toBase64Url(buffer) {
-  const bytes = new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
+  /**
+   * Handle device revocation (DELETE /auth/device/:id).
+   *
+   * Validates the access token, revokes the specified device, and invalidates
+   * all tokens issued to that device. Only the device's owner can revoke it.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param deviceId - The ID of the device to revoke
+   * @returns Auth response with success flag, or an error
+   */
+  async handleRevokeDevice(accessToken, deviceId) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const device = await this.userStore.findDevice(deviceId);
+    if (device === null) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.userId !== payload.sub) {
+      return {
+        status: 403,
+        body: { error: "You can only revoke your own devices." }
+      };
+    }
+    await this.userStore.revokeDevice(deviceId);
+    await this.tokenManager.revokeDeviceTokens(deviceId);
+    return {
+      status: 200,
+      body: { data: { success: true } }
+    };
   }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function fromBase64Url(str) {
-  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
-  const paddingNeeded = (4 - base64.length % 4) % 4;
-  base64 += "=".repeat(paddingNeeded);
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
-function assertCryptoAvailable() {
-  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
-    throw new CryptoUnavailableError();
-  }
-}
-var ECDSA_ALGORITHM = {
-  name: "ECDSA",
-  namedCurve: "P-256"
-};
-var ECDSA_SIGN_ALGORITHM = {
-  name: "ECDSA",
-  hash: { name: "SHA-256" }
-};
-async function verifyChallenge(publicKeyJwk, challenge, signature) {
-  assertCryptoAvailable();
-  try {
-    const publicKey = await globalThis.crypto.subtle.importKey(
-      "jwk",
-      publicKeyJwk,
-      ECDSA_ALGORITHM,
-      true,
-      ["verify"]
-    );
-    const encoded = new TextEncoder().encode(challenge);
-    const signatureBytes = fromBase64Url(signature);
-    const isValid = await globalThis.crypto.subtle.verify(
-      ECDSA_SIGN_ALGORITHM,
-      publicKey,
-      signatureBytes,
-      encoded
-    );
-    return isValid;
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to verify challenge signature. The public key JWK or signature format may be invalid.",
-      {
-        cause: cause instanceof Error ? cause.message : String(cause),
-        publicKeyKty: publicKeyJwk.kty,
-        publicKeyCrv: publicKeyJwk.crv
-      }
-    );
-  }
-}
-async function computePublicKeyThumbprint(publicKeyJwk) {
-  assertCryptoAvailable();
-  if (publicKeyJwk.kty !== "EC") {
-    throw new DeviceIdentityError(
-      `Expected JWK key type "EC" but received "${publicKeyJwk.kty ?? "undefined"}". Only ECDSA public keys are supported for device identity.`,
-      { kty: publicKeyJwk.kty }
-    );
-  }
-  if (!publicKeyJwk.crv || !publicKeyJwk.x || !publicKeyJwk.y) {
-    throw new DeviceIdentityError(
-      'JWK is missing required EC fields. An EC public key JWK must include "crv", "x", and "y" members.',
-      {
-        hasCrv: Boolean(publicKeyJwk.crv),
-        hasX: Boolean(publicKeyJwk.x),
-        hasY: Boolean(publicKeyJwk.y)
-      }
-    );
-  }
-  const canonicalJson = JSON.stringify({
-    crv: publicKeyJwk.crv,
-    kty: publicKeyJwk.kty,
-    x: publicKeyJwk.x,
-    y: publicKeyJwk.y
-  });
-  try {
-    const encoded = new TextEncoder().encode(canonicalJson);
-    const hashBuffer = await globalThis.crypto.subtle.digest("SHA-256", encoded);
-    return toBase64Url(hashBuffer);
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to compute SHA-256 thumbprint of the public key JWK.",
-      { cause: cause instanceof Error ? cause.message : String(cause) }
-    );
-  }
-}
-
-// src/provider/built-in/auth-routes.ts
-init_password_hash();
-
-// src/provider/built-in/user-store.ts
-init_cjs_shims();
-var import_core3 = require("@korajs/core");
-var import_node_crypto4 = require("crypto");
-var DuplicateEmailError = class extends import_core3.KoraError {
-  constructor() {
-    super(
-      "A user with this email already exists.",
-      "DUPLICATE_EMAIL"
-    );
-    this.name = "DuplicateEmailError";
-  }
-};
-var InMemoryUserStore = class {
-  /** Users indexed by ID */
-  usersById = /* @__PURE__ */ new Map();
-  /** Users indexed by email (lowercase) for fast lookup */
-  usersByEmail = /* @__PURE__ */ new Map();
-  /** Devices indexed by device ID */
-  devicesById = /* @__PURE__ */ new Map();
-  /** Device IDs indexed by user ID for fast listing */
-  devicesByUserId = /* @__PURE__ */ new Map();
   /**
-   * Create a new user account.
+   * Handle device registration (POST /auth/device/register).
    *
-   * @param params - User creation parameters
-   * @param params.email - The user's email address (must be unique, case-insensitive)
-   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
-   * @param params.salt - Hex-encoded salt used during hashing
-   * @param params.name - The user's display name
-   * @returns The created user (without sensitive credential fields)
-   * @throws {DuplicateEmailError} If a user with the same email already exists
+   * Requires a valid access token. Registers a new device for the authenticated
+   * user and issues a device credential token bound to the device's public key.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param body - Device registration request body
+   * @param body.deviceId - Unique identifier for the device
+   * @param body.publicKey - The device's public key as a JWK JSON string
+   * @param body.name - Human-readable device name (e.g., "Chrome on MacBook")
+   * @returns Auth response with the registered device and device credential, or an error
    */
-  async createUser(params) {
-    const normalizedEmail = params.email.toLowerCase();
-    if (this.usersByEmail.has(normalizedEmail)) {
-      throw new DuplicateEmailError();
+  async handleDeviceRegister(accessToken, body) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    const now = Date.now();
-    const id = (0, import_node_crypto4.randomUUID)();
-    const storedUser = {
-      id,
-      email: normalizedEmail,
-      name: params.name,
-      emailVerified: false,
-      createdAt: now,
-      passwordHash: params.passwordHash,
-      salt: params.salt
+    const deviceName = sanitizeName(body.name);
+    if (deviceName.length === 0) {
+      return {
+        status: 400,
+        body: { error: "Device name must not be empty." }
+      };
+    }
+    let publicKeyJwk;
+    try {
+      publicKeyJwk = JSON.parse(body.publicKey);
+    } catch {
+      return {
+        status: 400,
+        body: { error: "Invalid public key format. Expected a JSON-encoded JWK string." }
+      };
+    }
+    let thumbprint;
+    try {
+      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
+    } catch {
+      return {
+        status: 400,
+        body: {
+          error: "Failed to compute public key thumbprint. Ensure the key is a valid EC P-256 JWK."
+        }
+      };
+    }
+    const device = await this.userStore.registerDevice({
+      id: body.deviceId,
+      userId: payload.sub,
+      publicKey: body.publicKey,
+      name: deviceName
+    });
+    const deviceCredential = this.tokenManager.issueDeviceCredential(
+      payload.sub,
+      body.deviceId,
+      thumbprint
+    );
+    return {
+      status: 201,
+      body: { data: { device, deviceCredential } }
     };
-    this.usersById.set(id, storedUser);
-    this.usersByEmail.set(normalizedEmail, storedUser);
-    return toAuthUser(storedUser);
   }
   /**
-   * Find a user by email address.
+   * Generate a challenge for device proof-of-possession verification.
    *
-   * @param email - The email to search for (case-insensitive)
-   * @returns The stored user record including credentials, or null if not found
-   */
-  async findByEmail(email) {
-    return this.usersByEmail.get(email.toLowerCase()) ?? null;
-  }
-  /**
-   * Find a user by ID.
+   * Creates a cryptographically random challenge, stores it server-side with
+   * a 60-second TTL and the target device ID, and returns the challenge string.
+   * The client signs this challenge with its private key and submits it via
+   * {@link handleDeviceVerify}.
    *
-   * @param id - The user ID to search for
-   * @returns The stored user record including credentials, or null if not found
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param deviceId - The device this challenge is intended for
+   * @returns Auth response with the challenge string, or an error
    */
-  async findById(id) {
-    return this.usersById.get(id) ?? null;
+  async handleDeviceChallenge(accessToken, deviceId) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const device = await this.userStore.findDevice(deviceId);
+    if (device === null || device.userId !== payload.sub) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.revoked) {
+      return {
+        status: 403,
+        body: { error: "Device has been revoked." }
+      };
+    }
+    const challenge = (0, import_node_crypto2.randomBytes)(32).toString("hex");
+    const expiresAt = Date.now() + CHALLENGE_TTL_MS;
+    await this.challengeStore.store(challenge, deviceId, expiresAt);
+    return {
+      status: 200,
+      body: { data: { challenge } }
+    };
   }
   /**
-   * Register a device for a user.
+   * Handle device proof-of-possession verification (POST /auth/device/verify).
    *
-   * If a device with the same ID already exists and is not revoked, it is
-   * returned as-is (idempotent registration). If it was previously revoked,
-   * it is re-activated with updated details.
+   * Verifies that the device holds the private key corresponding to its registered
+   * public key by checking a signed challenge. The challenge must have been previously
+   * issued via {@link handleDeviceChallenge} and is single-use.
    *
-   * @param params - Device registration parameters
-   * @param params.id - Unique device identifier
-   * @param params.userId - ID of the user who owns the device
-   * @param params.publicKey - Base64url-encoded device public key or thumbprint
-   * @param params.name - Human-readable device name
-   * @returns The registered device record
+   * On success, issues fresh tokens for the device.
+   *
+   * @param body - Device verification request body
+   * @param body.deviceId - The ID of the device to verify
+   * @param body.challenge - The challenge string (from handleDeviceChallenge)
+   * @param body.signature - The base64url-encoded ECDSA signature of the challenge
+   * @returns Auth response with fresh tokens on success, or an error
    */
-  async registerDevice(params) {
-    const existing = this.devicesById.get(params.id);
-    if (existing !== void 0 && !existing.revoked) {
-      return existing;
+  async handleDeviceVerify(body) {
+    const challengeEntry = await this.challengeStore.consume(body.challenge);
+    if (challengeEntry === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired challenge. Request a new challenge and try again." }
+      };
     }
-    const now = Date.now();
-    const device = {
-      id: params.id,
-      userId: params.userId,
-      publicKey: params.publicKey,
-      name: params.name,
-      revoked: false,
-      createdAt: now,
-      lastSeenAt: now
-    };
-    this.devicesById.set(params.id, device);
-    let userDevices = this.devicesByUserId.get(params.userId);
-    if (userDevices === void 0) {
-      userDevices = /* @__PURE__ */ new Set();
-      this.devicesByUserId.set(params.userId, userDevices);
+    if (challengeEntry.deviceId !== body.deviceId) {
+      return {
+        status: 401,
+        body: { error: "Challenge was not issued for this device." }
+      };
+    }
+    const device = await this.userStore.findDevice(body.deviceId);
+    if (device === null) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.revoked) {
+      return {
+        status: 403,
+        body: { error: "Device has been revoked and cannot authenticate." }
+      };
+    }
+    let publicKeyJwk;
+    try {
+      publicKeyJwk = JSON.parse(device.publicKey);
+    } catch {
+      return {
+        status: 500,
+        body: { error: "Device has an invalid stored public key." }
+      };
     }
-    userDevices.add(params.id);
-    return device;
-  }
-  /**
-   * Find a device by its ID.
-   *
-   * @param deviceId - The device ID to search for
-   * @returns The device record, or null if not found
-   */
-  async findDevice(deviceId) {
-    return this.devicesById.get(deviceId) ?? null;
-  }
-  /**
-   * List all devices registered for a user.
-   *
-   * @param userId - The user ID whose devices to list
-   * @returns Array of device records (includes revoked devices)
-   */
-  async listDevices(userId) {
-    const deviceIds = this.devicesByUserId.get(userId);
-    if (deviceIds === void 0) {
-      return [];
+    let isValid;
+    try {
+      isValid = await verifyChallenge(publicKeyJwk, body.challenge, body.signature);
+    } catch {
+      return {
+        status: 400,
+        body: {
+          error: "Signature verification failed. The signature or public key format may be invalid."
+        }
+      };
     }
-    const devices = [];
-    for (const deviceId of deviceIds) {
-      const device = this.devicesById.get(deviceId);
-      if (device !== void 0) {
-        devices.push(device);
-      }
+    if (!isValid) {
+      return {
+        status: 401,
+        body: { error: "Invalid signature. Proof-of-possession verification failed." }
+      };
     }
-    return devices;
+    let thumbprint;
+    try {
+      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
+    } catch {
+      return {
+        status: 500,
+        body: { error: "Failed to compute public key thumbprint." }
+      };
+    }
+    const tokens = this.tokenManager.issueTokens(device.userId, device.id, thumbprint);
+    return {
+      status: 200,
+      body: { data: { tokens } }
+    };
   }
   /**
-   * Revoke a device, preventing it from being used for authentication.
+   * Generates a random challenge string for proof-of-possession verification.
    *
-   * This is a soft revoke — the device record remains but is marked as revoked.
-   * If the device does not exist, this is a no-op.
+   * **Deprecated:** Use {@link handleDeviceChallenge} instead, which stores
+   * the challenge server-side with expiry and single-use semantics.
    *
-   * @param deviceId - The ID of the device to revoke
+   * @returns A 64-character hex string (32 random bytes)
    */
-  async revokeDevice(deviceId) {
-    const device = this.devicesById.get(deviceId);
-    if (device !== void 0) {
-      device.revoked = true;
-    }
+  static generateChallenge() {
+    return (0, import_node_crypto2.randomBytes)(32).toString("hex");
   }
   /**
-   * Set a user's email verification status.
+   * Creates a sync server auth provider compatible with `@korajs/server`.
    *
-   * @param userId - The user whose email to verify
-   * @param verified - Whether the email is verified
-   */
-  async setEmailVerified(userId, verified) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    const updated = { ...user, emailVerified: verified };
-    this.usersById.set(userId, updated);
-    this.usersByEmail.set(user.email, updated);
-  }
-  /**
-   * Update a user's password hash and salt.
+   * The returned object implements the `AuthProvider` interface from
+   * `@korajs/server`, validating access tokens and returning an auth
+   * context containing the user ID and device metadata. This bridges
+   * the built-in auth system with the sync server's authentication layer.
    *
-   * @param userId - The user whose password to update
-   * @param passwordHash - New hex-encoded PBKDF2 derived key
-   * @param salt - New hex-encoded salt
-   */
-  async updatePassword(userId, passwordHash, salt) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    const updated = { ...user, passwordHash, salt };
-    this.usersById.set(userId, updated);
-    this.usersByEmail.set(user.email, updated);
-  }
-  /**
-   * List all users. For admin/development use.
-   */
-  async listAll() {
-    return [...this.usersById.values()];
-  }
-  /**
-   * Update a stored user record.
-   */
-  async update(user) {
-    const existing = this.usersById.get(user.id);
-    if (!existing) return;
-    if (existing.email !== user.email) {
-      this.usersByEmail.delete(existing.email);
-      this.usersByEmail.set(user.email, user);
-    } else {
-      this.usersByEmail.set(user.email, user);
-    }
-    this.usersById.set(user.id, user);
-  }
-  /**
-   * Delete a user and all associated devices.
-   */
-  async delete(userId) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    this.usersById.delete(userId);
-    this.usersByEmail.delete(user.email);
-    const deviceIds = this.devicesByUserId.get(userId);
-    if (deviceIds) {
-      for (const deviceId of deviceIds) {
-        this.devicesById.delete(deviceId);
-      }
-      this.devicesByUserId.delete(userId);
-    }
-  }
-  /**
-   * Update the last-seen timestamp for a device.
+   * Also checks device revocation status during authentication, ensuring
+   * that revoked devices are rejected even if their tokens haven't expired.
    *
-   * Called when a device authenticates or syncs to track activity.
-   * If the device does not exist, this is a no-op.
+   * @returns An object with an `authenticate` method suitable for KoraSyncServer's `auth` config
    *
-   * @param deviceId - The ID of the device to update
+   * @example
+   * ```typescript
+   * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+   * const syncServer = new KoraSyncServer({
+   *   store,
+   *   auth: routes.toSyncAuthProvider(),
+   * })
+   * ```
    */
-  async touchDevice(deviceId) {
-    const device = this.devicesById.get(deviceId);
-    if (device !== void 0) {
-      device.lastSeenAt = Date.now();
-    }
+  toSyncAuthProvider() {
+    const tokenManager = this.tokenManager;
+    const userStore = this.userStore;
+    return {
+      async authenticate(token) {
+        const payload = tokenManager.validateToken(token);
+        if (payload === null || payload.type !== "access") {
+          return null;
+        }
+        const user = await userStore.findById(payload.sub);
+        if (user === null) {
+          return null;
+        }
+        const device = await userStore.findDevice(payload.dev);
+        if (device?.revoked) {
+          return null;
+        }
+        await userStore.touchDevice(payload.dev);
+        return {
+          userId: payload.sub,
+          metadata: {
+            deviceId: payload.dev,
+            email: user.email,
+            name: user.name
+          }
+        };
+      }
+    };
   }
 };
-function toAuthUser(stored) {
-  return {
-    id: stored.id,
-    email: stored.email,
-    name: stored.name,
-    emailVerified: stored.emailVerified,
-    createdAt: stored.createdAt
-  };
-}
 
-// src/provider/built-in/auth-routes.ts
-var InMemoryChallengeStore = class {
-  challenges = /* @__PURE__ */ new Map();
-  async store(challenge, deviceId, expiresAt) {
-    this.challenges.set(challenge, { deviceId, expiresAt });
+// src/tokens/token-manager.ts
+init_cjs_shims();
+var import_node_crypto4 = require("crypto");
+
+// src/types.ts
+init_cjs_shims();
+var import_core2 = require("@korajs/core");
+var DEFAULT_ACCESS_TOKEN_LIFETIME = 15 * 60 * 1e3;
+var DEFAULT_REFRESH_TOKEN_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_DEVICE_CREDENTIAL_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_OFFLINE_DURATION = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_AUTO_LOCK_TIMEOUT = 15 * 60 * 1e3;
+
+// src/tokens/jwt.ts
+init_cjs_shims();
+var import_node_crypto3 = require("crypto");
+function base64urlEncode(input) {
+  return Buffer.from(input, "utf-8").toString("base64url");
+}
+function base64urlDecode(input) {
+  return Buffer.from(input, "base64url").toString("utf-8");
+}
+function hmacSha256Base64url(data, secret) {
+  return (0, import_node_crypto3.createHmac)("sha256", secret).update(data).digest("base64url");
+}
+var ENCODED_HEADER = base64urlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+function encodeJwt(payload, secret) {
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const signingInput = `${ENCODED_HEADER}.${encodedPayload}`;
+  const signature = hmacSha256Base64url(signingInput, secret);
+  return `${signingInput}.${signature}`;
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
   }
-  async consume(challenge) {
-    const entry = this.challenges.get(challenge);
-    if (entry === void 0) {
-      return null;
-    }
-    this.challenges.delete(challenge);
-    if (Date.now() > entry.expiresAt) {
+  const payloadSegment = parts[1];
+  if (payloadSegment === void 0) {
+    return null;
+  }
+  try {
+    const decoded = base64urlDecode(payloadSegment);
+    const parsed = JSON.parse(decoded);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       return null;
     }
-    return { deviceId: entry.deviceId };
-  }
-  /**
-   * Remove expired challenges to prevent unbounded memory growth.
-   */
-  cleanup() {
-    const now = Date.now();
-    for (const [challenge, entry] of this.challenges) {
-      if (now > entry.expiresAt) {
-        this.challenges.delete(challenge);
-      }
-    }
-  }
-};
-var InMemoryRateLimiter = class {
-  attempts = /* @__PURE__ */ new Map();
-  maxAttempts;
-  windowMs;
-  /**
-   * @param maxAttempts - Maximum number of attempts within the time window (default: 10)
-   * @param windowMs - Time window in milliseconds (default: 60,000 = 1 minute)
-   */
-  constructor(maxAttempts = 10, windowMs = 6e4) {
-    this.maxAttempts = maxAttempts;
-    this.windowMs = windowMs;
+    return parsed;
+  } catch {
+    return null;
   }
-  async isAllowed(key) {
-    const now = Date.now();
-    const attempts = this.attempts.get(key) ?? [];
-    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
-    return recentAttempts.length < this.maxAttempts;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
   }
-  async record(key) {
-    const now = Date.now();
-    const attempts = this.attempts.get(key) ?? [];
-    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
-    recentAttempts.push(now);
-    this.attempts.set(key, recentAttempts);
+  const headerSegment = parts[0];
+  const payloadSegment = parts[1];
+  const signatureSegment = parts[2];
+  if (headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
+    return null;
   }
-  async reset(key) {
-    this.attempts.delete(key);
+  if (headerSegment !== ENCODED_HEADER) {
+    return null;
   }
-};
-var MIN_PASSWORD_LENGTH = 8;
-var MAX_PASSWORD_LENGTH = 128;
-var MAX_NAME_LENGTH = 200;
-var CHALLENGE_TTL_MS = 6e4;
-function isValidEmail(email) {
-  if (email.length === 0 || email.length > 254) {
-    return false;
+  const signingInput = `${headerSegment}.${payloadSegment}`;
+  const expectedSignature = hmacSha256Base64url(signingInput, secret);
+  if (expectedSignature.length !== signatureSegment.length) {
+    return null;
   }
-  const atIndex = email.indexOf("@");
-  if (atIndex < 1) {
-    return false;
+  let mismatch = 0;
+  for (let i = 0; i < expectedSignature.length; i++) {
+    mismatch |= expectedSignature.charCodeAt(i) ^ signatureSegment.charCodeAt(i);
   }
-  const domain = email.slice(atIndex + 1);
-  if (domain.length === 0 || !domain.includes(".")) {
-    return false;
+  if (mismatch !== 0) {
+    return null;
   }
-  if (email.indexOf("@", atIndex + 1) !== -1) {
-    return false;
+  try {
+    const decoded = base64urlDecode(payloadSegment);
+    const parsed = JSON.parse(decoded);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
   }
-  if (email.includes(" ")) {
+}
+var CLOCK_SKEW_TOLERANCE_SECONDS = 5;
+function isExpired(payload) {
+  if (typeof payload.exp !== "number") {
     return false;
   }
-  return true;
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  return nowSeconds >= payload.exp + CLOCK_SKEW_TOLERANCE_SECONDS;
 }
-function sanitizeName(name) {
-  const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
-  const trimmed = cleaned.trim();
-  if (trimmed.length > MAX_NAME_LENGTH) {
-    return trimmed.slice(0, MAX_NAME_LENGTH);
+
+// src/tokens/token-manager.ts
+var MIN_SECRET_LENGTH = 32;
+var InMemoryTokenRevocationStore = class {
+  revokedTokens = /* @__PURE__ */ new Map();
+  revokedDevices = /* @__PURE__ */ new Set();
+  async isRevoked(jti) {
+    return this.revokedTokens.has(jti);
   }
-  return trimmed;
-}
-var BuiltInAuthRoutes = class {
-  userStore;
-  tokenManager;
-  challengeStore;
-  rateLimiter;
-  constructor(config) {
-    this.userStore = config.userStore;
-    this.tokenManager = config.tokenManager;
-    this.challengeStore = config.challengeStore ?? new InMemoryChallengeStore();
-    this.rateLimiter = config.rateLimiter ?? new InMemoryRateLimiter();
+  async revoke(jti, expiresAt) {
+    this.revokedTokens.set(jti, expiresAt);
   }
-  /**
-   * Handle user sign-up (POST /auth/signup).
-   *
-   * Validates email format and password length, hashes the password,
-   * creates the user, optionally registers a device, and issues tokens.
-   *
-   * @param body - Sign-up request body
-   * @param body.email - The user's email address
-   * @param body.password - The plaintext password (8-128 characters)
-   * @param body.name - Optional display name (defaults to email local part)
-   * @param body.deviceId - Optional device ID to register
-   * @param body.devicePublicKey - Optional device public key (base64url)
-   * @param clientIp - Optional client IP for rate limiting
-   * @returns Auth response with the created user and tokens, or an error
-   */
-  async handleSignUp(body, clientIp) {
-    const rateLimitKey = clientIp ?? "global";
-    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
-      return {
-        status: 429,
-        body: { error: "Too many requests. Please try again later." }
-      };
-    }
-    await this.rateLimiter.record(rateLimitKey);
-    if (!isValidEmail(body.email)) {
-      return {
-        status: 400,
-        body: {
-          error: "Invalid email address. Please provide a valid email in the format user@domain.com."
-        }
-      };
-    }
-    if (body.password.length < MIN_PASSWORD_LENGTH) {
-      return {
-        status: 400,
-        body: {
-          error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long.`
-        }
-      };
-    }
-    if (body.password.length > MAX_PASSWORD_LENGTH) {
-      return {
-        status: 400,
-        body: {
-          error: `Password must be at most ${MAX_PASSWORD_LENGTH} characters long.`
-        }
-      };
-    }
-    const { hash, salt } = await hashPassword(body.password);
-    const rawName = body.name ?? body.email.split("@")[0] ?? body.email;
-    const name = sanitizeName(rawName);
-    let user;
-    try {
-      user = await this.userStore.createUser({
-        email: body.email,
-        passwordHash: hash,
-        salt,
-        name
-      });
-    } catch (err) {
-      if (err instanceof Error && err.name === "DuplicateEmailError") {
-        return {
-          status: 409,
-          body: { error: "An account with this email already exists." }
-        };
-      }
-      throw err;
-    }
-    const deviceId = body.deviceId ?? `device-${user.id}`;
-    if (body.deviceId !== void 0 && body.devicePublicKey !== void 0) {
-      await this.userStore.registerDevice({
-        id: body.deviceId,
-        userId: user.id,
-        publicKey: body.devicePublicKey,
-        name: "Primary Device"
-      });
-    }
-    const tokens = this.tokenManager.issueTokens(user.id, deviceId);
-    return {
-      status: 201,
-      body: { data: { user, tokens } }
-    };
+  async revokeAllForDevice(deviceId) {
+    this.revokedDevices.add(deviceId);
   }
   /**
-   * Handle user sign-in (POST /auth/signin).
-   *
-   * Looks up the user by email, verifies the password, optionally registers
-   * a new device, and issues tokens.
-   *
-   * @param body - Sign-in request body
-   * @param body.email - The user's email address
-   * @param body.password - The plaintext password
-   * @param body.deviceId - Optional device ID to register
-   * @param body.devicePublicKey - Optional device public key (base64url)
-   * @param clientIp - Optional client IP for rate limiting
-   * @returns Auth response with the user and tokens, or an error
+   * Check if a device has been revoked.
    */
-  async handleSignIn(body, clientIp) {
-    const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
-    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
-      return {
-        status: 429,
-        body: { error: "Too many sign-in attempts. Please try again later." }
-      };
-    }
-    await this.rateLimiter.record(rateLimitKey);
-    const storedUser = await this.userStore.findByEmail(body.email);
-    if (storedUser === null) {
-      return {
-        status: 401,
-        body: { error: "Invalid email or password." }
-      };
-    }
-    const passwordValid = await verifyPassword(
-      body.password,
-      storedUser.passwordHash,
-      storedUser.salt
-    );
-    if (!passwordValid) {
-      return {
-        status: 401,
-        body: { error: "Invalid email or password." }
-      };
-    }
-    await this.rateLimiter.reset(rateLimitKey);
-    const deviceId = body.deviceId ?? `device-${storedUser.id}`;
-    if (body.deviceId !== void 0 && body.devicePublicKey !== void 0) {
-      await this.userStore.registerDevice({
-        id: body.deviceId,
-        userId: storedUser.id,
-        publicKey: body.devicePublicKey,
-        name: "Device"
-      });
-    }
-    const tokens = this.tokenManager.issueTokens(storedUser.id, deviceId);
-    const user = {
-      id: storedUser.id,
-      email: storedUser.email,
-      name: storedUser.name,
-      emailVerified: storedUser.emailVerified,
-      createdAt: storedUser.createdAt
-    };
-    return {
-      status: 200,
-      body: { data: { user, tokens } }
-    };
+  isDeviceRevoked(deviceId) {
+    return this.revokedDevices.has(deviceId);
   }
   /**
-   * Handle token refresh (POST /auth/refresh).
-   *
-   * Validates the provided refresh token and issues a new token pair
-   * (refresh token rotation with reuse detection). The old refresh token
-   * is marked as consumed in the revocation store.
-   *
-   * @param body - Refresh request body
-   * @param body.refreshToken - The current refresh token
-   * @returns Auth response with new tokens, or an error
+   * Remove expired revocations to prevent unbounded memory growth.
+   * Call periodically (e.g., every hour) in long-running servers.
    */
-  async handleRefresh(body) {
-    const result = await this.tokenManager.refreshAccessToken(body.refreshToken);
-    if (result === null) {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired refresh token." }
-      };
+  cleanup() {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    for (const [jti, expiresAt] of this.revokedTokens) {
+      if (nowSeconds > expiresAt) {
+        this.revokedTokens.delete(jti);
+      }
     }
-    return {
-      status: 200,
-      body: { data: result }
-    };
   }
-  /**
-   * Handle sign-out (POST /auth/signout).
-   *
-   * Validates the access token and revokes the current refresh token
-   * (if a revocation store is configured). This ensures that stolen
-   * refresh tokens cannot be used after the user signs out.
-   *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param body - Sign-out request body
-   * @param body.refreshToken - The current refresh token to revoke
-   * @returns Auth response with success flag, or an error
-   */
-  async handleSignOut(accessToken, body) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
+};
+var TokenManager = class {
+  /** All signing/verification secrets (index 0 = current signing key) */
+  secrets;
+  accessTokenLifetime;
+  refreshTokenLifetime;
+  deviceCredentialLifetime;
+  revocationStore;
+  constructor(config) {
+    const secrets = Array.isArray(config.secret) ? config.secret : [config.secret];
+    if (secrets.length === 0) {
+      throw new Error("TokenManager requires at least one secret.");
     }
-    await this.tokenManager.revokeToken(payload.jti, payload.exp);
-    if (body.refreshToken) {
-      const refreshPayload = this.tokenManager.validateToken(body.refreshToken);
-      if (refreshPayload !== null && refreshPayload.type === "refresh") {
-        await this.tokenManager.revokeToken(refreshPayload.jti, refreshPayload.exp);
+    for (const secret of secrets) {
+      if (secret.length < MIN_SECRET_LENGTH) {
+        throw new Error(
+          `JWT secret must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for HMAC-SHA256 security. Received ${secret.length} characters. Use TokenManager.generateSecret() to generate a secure secret.`
+        );
       }
     }
-    return {
-      status: 200,
-      body: { data: { success: true } }
-    };
+    this.secrets = secrets;
+    this.accessTokenLifetime = config.accessTokenLifetime ?? DEFAULT_ACCESS_TOKEN_LIFETIME;
+    this.refreshTokenLifetime = config.refreshTokenLifetime ?? DEFAULT_REFRESH_TOKEN_LIFETIME;
+    this.deviceCredentialLifetime = config.deviceCredentialLifetime ?? DEFAULT_DEVICE_CREDENTIAL_LIFETIME;
+    this.revocationStore = config.revocationStore;
   }
   /**
-   * Handle get-current-user (GET /auth/me).
+   * Generate a cryptographically random secret suitable for HMAC-SHA256 signing.
    *
-   * Validates the access token and returns the authenticated user's profile.
+   * Returns a 64-character hex string (32 bytes / 256 bits of entropy).
+   * Store this securely (environment variable, secrets manager) — never in source code.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @returns Auth response with the user profile, or an error
+   * @returns A random 256-bit hex-encoded secret
    */
-  async handleGetMe(accessToken) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const storedUser = await this.userStore.findById(payload.sub);
-    if (storedUser === null) {
-      return {
-        status: 404,
-        body: { error: "User not found." }
-      };
-    }
-    const user = {
-      id: storedUser.id,
-      email: storedUser.email,
-      name: storedUser.name,
-      emailVerified: storedUser.emailVerified,
-      createdAt: storedUser.createdAt
-    };
-    return {
-      status: 200,
-      body: { data: user }
-    };
+  static generateSecret() {
+    return (0, import_node_crypto4.randomBytes)(32).toString("hex");
   }
   /**
-   * Handle list-devices (GET /auth/devices).
+   * Issue a signed JWT access token.
    *
-   * Validates the access token and returns all devices registered for the user.
+   * Access tokens are short-lived (default 15 minutes) and used to authorize
+   * API requests. When expired, use {@link refreshAccessToken} with a valid
+   * refresh token to obtain a new one.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @returns Auth response with the device list, or an error
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @returns A signed JWT string with type 'access'
    */
-  async handleListDevices(accessToken) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const devices = await this.userStore.listDevices(payload.sub);
-    return {
-      status: 200,
-      body: { data: devices }
+  issueAccessToken(userId, deviceId) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const payload = {
+      jti: (0, import_node_crypto4.randomUUID)(),
+      sub: userId,
+      dev: deviceId,
+      type: "access",
+      iat: nowSeconds,
+      exp: nowSeconds + Math.floor(this.accessTokenLifetime / 1e3)
     };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Handle device revocation (DELETE /auth/device/:id).
+   * Issue a signed JWT refresh token.
    *
-   * Validates the access token, revokes the specified device, and invalidates
-   * all tokens issued to that device. Only the device's owner can revoke it.
+   * Refresh tokens are longer-lived (default 90 days) and used exclusively
+   * to obtain new access tokens via {@link refreshAccessToken}. They should
+   * be stored securely and never sent to resource APIs.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param deviceId - The ID of the device to revoke
-   * @returns Auth response with success flag, or an error
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @returns A signed JWT string with type 'refresh'
    */
-  async handleRevokeDevice(accessToken, deviceId) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const device = await this.userStore.findDevice(deviceId);
-    if (device === null) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
-    }
-    if (device.userId !== payload.sub) {
-      return {
-        status: 403,
-        body: { error: "You can only revoke your own devices." }
-      };
-    }
-    await this.userStore.revokeDevice(deviceId);
-    await this.tokenManager.revokeDeviceTokens(deviceId);
-    return {
-      status: 200,
-      body: { data: { success: true } }
+  issueRefreshToken(userId, deviceId) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const payload = {
+      jti: (0, import_node_crypto4.randomUUID)(),
+      sub: userId,
+      dev: deviceId,
+      type: "refresh",
+      iat: nowSeconds,
+      exp: nowSeconds + Math.floor(this.refreshTokenLifetime / 1e3)
     };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Handle device registration (POST /auth/device/register).
+   * Issue a signed device credential token.
    *
-   * Requires a valid access token. Registers a new device for the authenticated
-   * user and issues a device credential token bound to the device's public key.
+   * Device credentials are long-lived tokens bound to a device's public key.
+   * They include a `mustCheckinBy` deadline; if the device does not check in
+   * before this deadline, the credential should be treated as revoked.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param body - Device registration request body
-   * @param body.deviceId - Unique identifier for the device
-   * @param body.publicKey - The device's public key as a JWK JSON string
-   * @param body.name - Human-readable device name (e.g., "Chrome on MacBook")
-   * @returns Auth response with the registered device and device credential, or an error
-   */
-  async handleDeviceRegister(accessToken, body) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const deviceName = sanitizeName(body.name);
-    if (deviceName.length === 0) {
-      return {
-        status: 400,
-        body: { error: "Device name must not be empty." }
-      };
-    }
-    let publicKeyJwk;
-    try {
-      publicKeyJwk = JSON.parse(body.publicKey);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Invalid public key format. Expected a JSON-encoded JWK string." }
-      };
-    }
-    let thumbprint;
-    try {
-      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Failed to compute public key thumbprint. Ensure the key is a valid EC P-256 JWK." }
-      };
-    }
-    const device = await this.userStore.registerDevice({
-      id: body.deviceId,
-      userId: payload.sub,
-      publicKey: body.publicKey,
-      name: deviceName
-    });
-    const deviceCredential = this.tokenManager.issueDeviceCredential(
-      payload.sub,
-      body.deviceId,
-      thumbprint
-    );
-    return {
-      status: 201,
-      body: { data: { device, deviceCredential } }
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @param publicKeyThumbprint - SHA-256 thumbprint of the device's public key
+   * @returns A signed JWT string with type 'device_credential'
+   */
+  issueDeviceCredential(userId, deviceId, publicKeyThumbprint) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const lifetimeSeconds = Math.floor(this.deviceCredentialLifetime / 1e3);
+    const payload = {
+      jti: (0, import_node_crypto4.randomUUID)(),
+      sub: userId,
+      dev: deviceId,
+      type: "device_credential",
+      iat: nowSeconds,
+      exp: nowSeconds + lifetimeSeconds,
+      dpk: publicKeyThumbprint,
+      mustCheckinBy: nowSeconds + lifetimeSeconds
     };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Generate a challenge for device proof-of-possession verification.
+   * Issue a complete set of authentication tokens.
    *
-   * Creates a cryptographically random challenge, stores it server-side with
-   * a 60-second TTL and the target device ID, and returns the challenge string.
-   * The client signs this challenge with its private key and submits it via
-   * {@link handleDeviceVerify}.
+   * Always issues an access token and refresh token. If a `publicKeyThumbprint`
+   * is provided, also issues a device credential.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param deviceId - The device this challenge is intended for
-   * @returns Auth response with the challenge string, or an error
+   * @param userId - The subject (user ID) to encode in the tokens
+   * @param deviceId - The device ID of the requesting device
+   * @param publicKeyThumbprint - Optional SHA-256 thumbprint of the device's public key.
+   *   When provided, a device credential is included in the returned tokens.
+   * @returns An {@link AuthTokens} object containing the issued tokens
    */
-  async handleDeviceChallenge(accessToken, deviceId) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const device = await this.userStore.findDevice(deviceId);
-    if (device === null || device.userId !== payload.sub) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
-    }
-    if (device.revoked) {
-      return {
-        status: 403,
-        body: { error: "Device has been revoked." }
-      };
-    }
-    const challenge = (0, import_node_crypto5.randomBytes)(32).toString("hex");
-    const expiresAt = Date.now() + CHALLENGE_TTL_MS;
-    await this.challengeStore.store(challenge, deviceId, expiresAt);
-    return {
-      status: 200,
-      body: { data: { challenge } }
+  issueTokens(userId, deviceId, publicKeyThumbprint) {
+    const tokens = {
+      accessToken: this.issueAccessToken(userId, deviceId),
+      refreshToken: this.issueRefreshToken(userId, deviceId)
     };
+    if (publicKeyThumbprint !== void 0) {
+      tokens.deviceCredential = this.issueDeviceCredential(userId, deviceId, publicKeyThumbprint);
+    }
+    return tokens;
   }
   /**
-   * Handle device proof-of-possession verification (POST /auth/device/verify).
-   *
-   * Verifies that the device holds the private key corresponding to its registered
-   * public key by checking a signed challenge. The challenge must have been previously
-   * issued via {@link handleDeviceChallenge} and is single-use.
+   * Validate and decode a token.
    *
-   * On success, issues fresh tokens for the device.
+   * Verifies the HMAC-SHA256 signature (trying all configured secrets for key rotation),
+   * checks that the token has not expired, and validates all required claims.
+   * Returns null (rather than throwing) for invalid or expired tokens, so callers
+   * can handle authentication failure without try/catch.
    *
-   * @param body - Device verification request body
-   * @param body.deviceId - The ID of the device to verify
-   * @param body.challenge - The challenge string (from handleDeviceChallenge)
-   * @param body.signature - The base64url-encoded ECDSA signature of the challenge
-   * @returns Auth response with fresh tokens on success, or an error
+   * @param token - The JWT string to validate
+   * @returns The decoded {@link TokenPayload} if valid, or null if the token is
+   *   invalid, expired, or missing required claims
    */
-  async handleDeviceVerify(body) {
-    const challengeEntry = await this.challengeStore.consume(body.challenge);
-    if (challengeEntry === null) {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired challenge. Request a new challenge and try again." }
-      };
-    }
-    if (challengeEntry.deviceId !== body.deviceId) {
-      return {
-        status: 401,
-        body: { error: "Challenge was not issued for this device." }
-      };
-    }
-    const device = await this.userStore.findDevice(body.deviceId);
-    if (device === null) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
-    }
-    if (device.revoked) {
-      return {
-        status: 403,
-        body: { error: "Device has been revoked and cannot authenticate." }
-      };
+  validateToken(token) {
+    let decoded = null;
+    for (const secret of this.secrets) {
+      decoded = verifyJwt(token, secret);
+      if (decoded !== null) {
+        break;
+      }
     }
-    let publicKeyJwk;
-    try {
-      publicKeyJwk = JSON.parse(device.publicKey);
-    } catch {
-      return {
-        status: 500,
-        body: { error: "Device has an invalid stored public key." }
-      };
+    if (decoded === null) {
+      return null;
     }
-    let isValid;
-    try {
-      isValid = await verifyChallenge(publicKeyJwk, body.challenge, body.signature);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Signature verification failed. The signature or public key format may be invalid." }
-      };
+    if (isExpired(decoded)) {
+      return null;
     }
-    if (!isValid) {
-      return {
-        status: 401,
-        body: { error: "Invalid signature. Proof-of-possession verification failed." }
-      };
+    if (typeof decoded.jti !== "string" || typeof decoded.sub !== "string" || typeof decoded.dev !== "string" || typeof decoded.type !== "string" || typeof decoded.iat !== "number" || typeof decoded.exp !== "number") {
+      return null;
     }
-    let thumbprint;
-    try {
-      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
-    } catch {
-      return {
-        status: 500,
-        body: { error: "Failed to compute public key thumbprint." }
-      };
+    const type = decoded.type;
+    if (type !== "access" && type !== "refresh" && type !== "device_credential") {
+      return null;
     }
-    const tokens = this.tokenManager.issueTokens(device.userId, device.id, thumbprint);
     return {
-      status: 200,
-      body: { data: { tokens } }
+      jti: decoded.jti,
+      sub: decoded.sub,
+      dev: decoded.dev,
+      type,
+      iat: decoded.iat,
+      exp: decoded.exp
     };
   }
   /**
-   * Generates a random challenge string for proof-of-possession verification.
+   * Validate a token and check it against the revocation store.
    *
-   * **Deprecated:** Use {@link handleDeviceChallenge} instead, which stores
-   * the challenge server-side with expiry and single-use semantics.
+   * Like {@link validateToken}, but also checks whether the token's `jti` has been
+   * revoked. Requires a revocation store to be configured.
    *
-   * @returns A 64-character hex string (32 random bytes)
+   * @param token - The JWT string to validate
+   * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
    */
-  static generateChallenge() {
-    return (0, import_node_crypto5.randomBytes)(32).toString("hex");
+  async validateTokenWithRevocation(token) {
+    const payload = this.validateToken(token);
+    if (payload === null) {
+      return null;
+    }
+    if (this.revocationStore) {
+      const revoked = await this.revocationStore.isRevoked(payload.jti);
+      if (revoked) {
+        return null;
+      }
+    }
+    return payload;
   }
   /**
-   * Creates a sync server auth provider compatible with `@korajs/server`.
+   * Revoke a specific token by its JWT ID.
    *
-   * The returned object implements the `AuthProvider` interface from
-   * `@korajs/server`, validating access tokens and returning an auth
-   * context containing the user ID and device metadata. This bridges
-   * the built-in auth system with the sync server's authentication layer.
+   * Requires a revocation store to be configured. After revocation, the token
+   * will be rejected by {@link validateTokenWithRevocation}.
    *
-   * Also checks device revocation status during authentication, ensuring
-   * that revoked devices are rejected even if their tokens haven't expired.
+   * @param jti - The JWT ID of the token to revoke
+   * @param expiresAt - The token's expiration time (seconds since epoch)
+   */
+  async revokeToken(jti, expiresAt) {
+    if (this.revocationStore) {
+      await this.revocationStore.revoke(jti, expiresAt);
+    }
+  }
+  /**
+   * Revoke all tokens for a specific device.
    *
-   * @returns An object with an `authenticate` method suitable for KoraSyncServer's `auth` config
+   * Called when a device is revoked to ensure all its existing tokens
+   * (access, refresh, and device credentials) are invalidated.
    *
-   * @example
-   * ```typescript
-   * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
-   * const syncServer = new KoraSyncServer({
-   *   store,
-   *   auth: routes.toSyncAuthProvider(),
-   * })
-   * ```
+   * @param deviceId - The device ID whose tokens should be revoked
    */
-  toSyncAuthProvider() {
-    const tokenManager = this.tokenManager;
-    const userStore = this.userStore;
-    return {
-      async authenticate(token) {
-        const payload = tokenManager.validateToken(token);
-        if (payload === null || payload.type !== "access") {
-          return null;
-        }
-        const user = await userStore.findById(payload.sub);
-        if (user === null) {
-          return null;
-        }
-        const device = await userStore.findDevice(payload.dev);
-        if (device !== null && device.revoked) {
-          return null;
-        }
-        await userStore.touchDevice(payload.dev);
-        return {
-          userId: payload.sub,
-          metadata: {
-            deviceId: payload.dev,
-            email: user.email,
-            name: user.name
-          }
-        };
+  async revokeDeviceTokens(deviceId) {
+    if (this.revocationStore) {
+      await this.revocationStore.revokeAllForDevice(deviceId);
+    }
+  }
+  /**
+   * Refresh an access token using a valid refresh token.
+   *
+   * Implements **refresh token rotation with reuse detection**: a new refresh token
+   * is issued alongside the new access token. The old refresh token's `jti` is
+   * recorded in the revocation store (if configured). If a previously consumed
+   * refresh token is presented again, it indicates potential token theft.
+   *
+   * Returns null if the provided token is invalid, expired, or not a refresh token.
+   *
+   * @param refreshToken - The refresh token JWT string
+   * @returns A new access/refresh token pair, or null if the refresh token is invalid
+   */
+  async refreshAccessToken(refreshToken) {
+    const payload = this.validateToken(refreshToken);
+    if (payload === null) {
+      return null;
+    }
+    if (payload.type !== "refresh") {
+      return null;
+    }
+    if (this.revocationStore) {
+      const wasRevoked = await this.revocationStore.isRevoked(payload.jti);
+      if (wasRevoked) {
+        await this.revocationStore.revokeAllForDevice(payload.dev);
+        return null;
       }
+      await this.revocationStore.revoke(payload.jti, payload.exp);
+    }
+    return {
+      accessToken: this.issueAccessToken(payload.sub, payload.dev),
+      refreshToken: this.issueRefreshToken(payload.sub, payload.dev)
     };
   }
 };
@@ -1623,9 +1370,9 @@ init_password_hash();
 
 // src/provider/built-in/password-reset.ts
 init_cjs_shims();
-var import_core4 = require("@korajs/core");
+var import_core3 = require("@korajs/core");
 init_password_hash();
-var PasswordResetError = class extends import_core4.KoraError {
+var PasswordResetError = class extends import_core3.KoraError {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "PasswordResetError";
@@ -1710,7 +1457,11 @@ var PasswordResetManager = class {
     const normalizedEmail = email.toLowerCase().trim();
     const successResponse = {
       status: 200,
-      body: { data: { message: "If an account with that email exists, a password reset link has been sent." } }
+      body: {
+        data: {
+          message: "If an account with that email exists, a password reset link has been sent."
+        }
+      }
     };
     const user = await this.userStore.findByEmail(normalizedEmail);
     if (!user) {
@@ -1813,8 +1564,8 @@ function generateSecureToken() {
 
 // src/provider/built-in/email-verification.ts
 init_cjs_shims();
-var import_core5 = require("@korajs/core");
-var EmailVerificationError = class extends import_core5.KoraError {
+var import_core4 = require("@korajs/core");
+var EmailVerificationError = class extends import_core4.KoraError {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "EmailVerificationError";
@@ -1852,115 +1603,355 @@ var InMemoryEmailVerificationStore = class {
         count++;
       }
     }
-    return count;
+    return count;
+  }
+  async cleanExpired() {
+    const now = Date.now();
+    let count = 0;
+    for (const [key, token] of this.tokens) {
+      if (now > token.expiresAt) {
+        this.tokens.delete(key);
+        count++;
+      }
+    }
+    return count;
+  }
+};
+var DEFAULT_TOKEN_TTL_MS2 = 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_REQUESTS2 = 3;
+var EmailVerificationManager = class {
+  userStore;
+  verificationStore;
+  tokenTtlMs;
+  maxRequestsPerUser;
+  onVerificationRequired;
+  constructor(config) {
+    this.userStore = config.userStore;
+    this.verificationStore = config.verificationStore ?? new InMemoryEmailVerificationStore();
+    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS2;
+    this.maxRequestsPerUser = config.maxRequestsPerUser ?? DEFAULT_MAX_REQUESTS2;
+    this.onVerificationRequired = config.onVerificationRequired;
+  }
+  /**
+   * Send a verification email for a user.
+   * Rate-limited to prevent abuse.
+   */
+  async sendVerification(userId, email) {
+    const normalizedEmail = email.toLowerCase().trim();
+    const activeCount = await this.verificationStore.countActiveForUser(userId);
+    if (activeCount >= this.maxRequestsPerUser) {
+      return {
+        status: 429,
+        body: { error: "Too many verification requests. Please try again later." }
+      };
+    }
+    const token = generateSecureToken2();
+    const now = Date.now();
+    const verificationToken = {
+      token,
+      userId,
+      email: normalizedEmail,
+      createdAt: now,
+      expiresAt: now + this.tokenTtlMs,
+      consumed: false
+    };
+    await this.verificationStore.store(verificationToken);
+    if (this.onVerificationRequired) {
+      try {
+        await this.onVerificationRequired(normalizedEmail, token, verificationToken.expiresAt);
+      } catch {
+      }
+    }
+    const responseData = {
+      message: "Verification email sent."
+    };
+    if (!this.onVerificationRequired) {
+      responseData.token = token;
+    }
+    return { status: 200, body: { data: responseData } };
+  }
+  /**
+   * Verify an email using a verification token.
+   */
+  async verifyEmail(token) {
+    const verificationToken = await this.verificationStore.get(token);
+    if (!verificationToken || verificationToken.consumed) {
+      return { status: 404, body: { error: "Verification token not found or already used." } };
+    }
+    if (Date.now() > verificationToken.expiresAt) {
+      await this.verificationStore.consume(token);
+      return { status: 410, body: { error: "Verification token has expired." } };
+    }
+    await this.verificationStore.consume(token);
+    await this.userStore.setEmailVerified(verificationToken.userId, true);
+    return {
+      status: 200,
+      body: {
+        data: {
+          message: "Email verified successfully.",
+          userId: verificationToken.userId,
+          email: verificationToken.email
+        }
+      }
+    };
+  }
+  /**
+   * Resend verification email for a user.
+   * Delegates to sendVerification with rate limiting.
+   */
+  async resendVerification(userId) {
+    const user = await this.userStore.findById(userId);
+    if (!user) {
+      return { status: 404, body: { error: "User not found." } };
+    }
+    return this.sendVerification(userId, user.email);
+  }
+};
+function generateSecureToken2() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/provider/built-in/user-store.ts
+init_cjs_shims();
+var import_node_crypto5 = require("crypto");
+var import_core5 = require("@korajs/core");
+var DuplicateEmailError = class extends import_core5.KoraError {
+  constructor() {
+    super("A user with this email already exists.", "DUPLICATE_EMAIL");
+    this.name = "DuplicateEmailError";
+  }
+};
+var InMemoryUserStore = class {
+  /** Users indexed by ID */
+  usersById = /* @__PURE__ */ new Map();
+  /** Users indexed by email (lowercase) for fast lookup */
+  usersByEmail = /* @__PURE__ */ new Map();
+  /** Devices indexed by device ID */
+  devicesById = /* @__PURE__ */ new Map();
+  /** Device IDs indexed by user ID for fast listing */
+  devicesByUserId = /* @__PURE__ */ new Map();
+  /**
+   * Create a new user account.
+   *
+   * @param params - User creation parameters
+   * @param params.email - The user's email address (must be unique, case-insensitive)
+   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
+   * @param params.salt - Hex-encoded salt used during hashing
+   * @param params.name - The user's display name
+   * @returns The created user (without sensitive credential fields)
+   * @throws {DuplicateEmailError} If a user with the same email already exists
+   */
+  async createUser(params) {
+    const normalizedEmail = params.email.toLowerCase();
+    if (this.usersByEmail.has(normalizedEmail)) {
+      throw new DuplicateEmailError();
+    }
+    const now = Date.now();
+    const id = (0, import_node_crypto5.randomUUID)();
+    const storedUser = {
+      id,
+      email: normalizedEmail,
+      name: params.name,
+      emailVerified: false,
+      createdAt: now,
+      passwordHash: params.passwordHash,
+      salt: params.salt
+    };
+    this.usersById.set(id, storedUser);
+    this.usersByEmail.set(normalizedEmail, storedUser);
+    return toAuthUser(storedUser);
+  }
+  /**
+   * Find a user by email address.
+   *
+   * @param email - The email to search for (case-insensitive)
+   * @returns The stored user record including credentials, or null if not found
+   */
+  async findByEmail(email) {
+    return this.usersByEmail.get(email.toLowerCase()) ?? null;
+  }
+  /**
+   * Find a user by ID.
+   *
+   * @param id - The user ID to search for
+   * @returns The stored user record including credentials, or null if not found
+   */
+  async findById(id) {
+    return this.usersById.get(id) ?? null;
+  }
+  /**
+   * Register a device for a user.
+   *
+   * If a device with the same ID already exists and is not revoked, it is
+   * returned as-is (idempotent registration). If it was previously revoked,
+   * it is re-activated with updated details.
+   *
+   * @param params - Device registration parameters
+   * @param params.id - Unique device identifier
+   * @param params.userId - ID of the user who owns the device
+   * @param params.publicKey - Base64url-encoded device public key or thumbprint
+   * @param params.name - Human-readable device name
+   * @returns The registered device record
+   */
+  async registerDevice(params) {
+    const existing = this.devicesById.get(params.id);
+    if (existing !== void 0 && !existing.revoked) {
+      return existing;
+    }
+    const now = Date.now();
+    const device = {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: now,
+      lastSeenAt: now
+    };
+    this.devicesById.set(params.id, device);
+    let userDevices = this.devicesByUserId.get(params.userId);
+    if (userDevices === void 0) {
+      userDevices = /* @__PURE__ */ new Set();
+      this.devicesByUserId.set(params.userId, userDevices);
+    }
+    userDevices.add(params.id);
+    return device;
+  }
+  /**
+   * Find a device by its ID.
+   *
+   * @param deviceId - The device ID to search for
+   * @returns The device record, or null if not found
+   */
+  async findDevice(deviceId) {
+    return this.devicesById.get(deviceId) ?? null;
+  }
+  /**
+   * List all devices registered for a user.
+   *
+   * @param userId - The user ID whose devices to list
+   * @returns Array of device records (includes revoked devices)
+   */
+  async listDevices(userId) {
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds === void 0) {
+      return [];
+    }
+    const devices = [];
+    for (const deviceId of deviceIds) {
+      const device = this.devicesById.get(deviceId);
+      if (device !== void 0) {
+        devices.push(device);
+      }
+    }
+    return devices;
   }
-  async cleanExpired() {
-    const now = Date.now();
-    let count = 0;
-    for (const [key, token] of this.tokens) {
-      if (now > token.expiresAt) {
-        this.tokens.delete(key);
-        count++;
-      }
+  /**
+   * Revoke a device, preventing it from being used for authentication.
+   *
+   * This is a soft revoke — the device record remains but is marked as revoked.
+   * If the device does not exist, this is a no-op.
+   *
+   * @param deviceId - The ID of the device to revoke
+   */
+  async revokeDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.revoked = true;
     }
-    return count;
   }
-};
-var DEFAULT_TOKEN_TTL_MS2 = 24 * 60 * 60 * 1e3;
-var DEFAULT_MAX_REQUESTS2 = 3;
-var EmailVerificationManager = class {
-  userStore;
-  verificationStore;
-  tokenTtlMs;
-  maxRequestsPerUser;
-  onVerificationRequired;
-  constructor(config) {
-    this.userStore = config.userStore;
-    this.verificationStore = config.verificationStore ?? new InMemoryEmailVerificationStore();
-    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS2;
-    this.maxRequestsPerUser = config.maxRequestsPerUser ?? DEFAULT_MAX_REQUESTS2;
-    this.onVerificationRequired = config.onVerificationRequired;
+  /**
+   * Set a user's email verification status.
+   *
+   * @param userId - The user whose email to verify
+   * @param verified - Whether the email is verified
+   */
+  async setEmailVerified(userId, verified) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, emailVerified: verified };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
   }
   /**
-   * Send a verification email for a user.
-   * Rate-limited to prevent abuse.
+   * Update a user's password hash and salt.
+   *
+   * @param userId - The user whose password to update
+   * @param passwordHash - New hex-encoded PBKDF2 derived key
+   * @param salt - New hex-encoded salt
    */
-  async sendVerification(userId, email) {
-    const normalizedEmail = email.toLowerCase().trim();
-    const activeCount = await this.verificationStore.countActiveForUser(userId);
-    if (activeCount >= this.maxRequestsPerUser) {
-      return { status: 429, body: { error: "Too many verification requests. Please try again later." } };
-    }
-    const token = generateSecureToken2();
-    const now = Date.now();
-    const verificationToken = {
-      token,
-      userId,
-      email: normalizedEmail,
-      createdAt: now,
-      expiresAt: now + this.tokenTtlMs,
-      consumed: false
-    };
-    await this.verificationStore.store(verificationToken);
-    if (this.onVerificationRequired) {
-      try {
-        await this.onVerificationRequired(normalizedEmail, token, verificationToken.expiresAt);
-      } catch {
-      }
-    }
-    const responseData = {
-      message: "Verification email sent."
-    };
-    if (!this.onVerificationRequired) {
-      responseData.token = token;
-    }
-    return { status: 200, body: { data: responseData } };
+  async updatePassword(userId, passwordHash, salt) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, passwordHash, salt };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
   }
   /**
-   * Verify an email using a verification token.
+   * List all users. For admin/development use.
    */
-  async verifyEmail(token) {
-    const verificationToken = await this.verificationStore.get(token);
-    if (!verificationToken || verificationToken.consumed) {
-      return { status: 404, body: { error: "Verification token not found or already used." } };
-    }
-    if (Date.now() > verificationToken.expiresAt) {
-      await this.verificationStore.consume(token);
-      return { status: 410, body: { error: "Verification token has expired." } };
+  async listAll() {
+    return [...this.usersById.values()];
+  }
+  /**
+   * Update a stored user record.
+   */
+  async update(user) {
+    const existing = this.usersById.get(user.id);
+    if (!existing) return;
+    if (existing.email !== user.email) {
+      this.usersByEmail.delete(existing.email);
+      this.usersByEmail.set(user.email, user);
+    } else {
+      this.usersByEmail.set(user.email, user);
     }
-    await this.verificationStore.consume(token);
-    await this.userStore.setEmailVerified(verificationToken.userId, true);
-    return {
-      status: 200,
-      body: {
-        data: {
-          message: "Email verified successfully.",
-          userId: verificationToken.userId,
-          email: verificationToken.email
-        }
+    this.usersById.set(user.id, user);
+  }
+  /**
+   * Delete a user and all associated devices.
+   */
+  async delete(userId) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    this.usersById.delete(userId);
+    this.usersByEmail.delete(user.email);
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds) {
+      for (const deviceId of deviceIds) {
+        this.devicesById.delete(deviceId);
       }
-    };
+      this.devicesByUserId.delete(userId);
+    }
   }
   /**
-   * Resend verification email for a user.
-   * Delegates to sendVerification with rate limiting.
+   * Update the last-seen timestamp for a device.
+   *
+   * Called when a device authenticates or syncs to track activity.
+   * If the device does not exist, this is a no-op.
+   *
+   * @param deviceId - The ID of the device to update
    */
-  async resendVerification(userId) {
-    const user = await this.userStore.findById(userId);
-    if (!user) {
-      return { status: 404, body: { error: "User not found." } };
+  async touchDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.lastSeenAt = Date.now();
     }
-    return this.sendVerification(userId, user.email);
   }
 };
-function generateSecureToken2() {
-  const bytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(bytes);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function toAuthUser(stored) {
+  return {
+    id: stored.id,
+    email: stored.email,
+    name: stored.name,
+    emailVerified: stored.emailVerified,
+    createdAt: stored.createdAt
+  };
 }
 
 // src/provider/built-in/sqlite-user-store.ts
@@ -2017,21 +2008,15 @@ var SqliteUserStore = class {
     return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
   }
   async findByEmail(email) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_users WHERE email = ?"
-    ).get(email.toLowerCase());
+    const row = this.db.prepare("SELECT * FROM auth_users WHERE email = ?").get(email.toLowerCase());
     return row ? rowToStoredUser(row) : null;
   }
   async findById(id) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_users WHERE id = ?"
-    ).get(id);
+    const row = this.db.prepare("SELECT * FROM auth_users WHERE id = ?").get(id);
     return row ? rowToStoredUser(row) : null;
   }
   async registerDevice(params) {
-    const existing = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE id = ?"
-    ).get(params.id);
+    const existing = this.db.prepare("SELECT * FROM auth_devices WHERE id = ?").get(params.id);
     if (existing && !existing.revoked) {
       return rowToDevice(existing);
     }
@@ -2058,29 +2043,21 @@ var SqliteUserStore = class {
     };
   }
   async findDevice(deviceId) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE id = ?"
-    ).get(deviceId);
+    const row = this.db.prepare("SELECT * FROM auth_devices WHERE id = ?").get(deviceId);
     return row ? rowToDevice(row) : null;
   }
   async listDevices(userId) {
-    const rows = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE user_id = ?"
-    ).all(userId);
+    const rows = this.db.prepare("SELECT * FROM auth_devices WHERE user_id = ?").all(userId);
     return rows.map(rowToDevice);
   }
   async revokeDevice(deviceId) {
     this.db.prepare("UPDATE auth_devices SET revoked = 1 WHERE id = ?").run(deviceId);
   }
   async setEmailVerified(userId, verified) {
-    this.db.prepare(
-      "UPDATE auth_users SET email_verified = ? WHERE id = ?"
-    ).run(verified ? 1 : 0, userId);
+    this.db.prepare("UPDATE auth_users SET email_verified = ? WHERE id = ?").run(verified ? 1 : 0, userId);
   }
   async updatePassword(userId, passwordHash, salt) {
-    this.db.prepare(
-      "UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?"
-    ).run(passwordHash, salt, userId);
+    this.db.prepare("UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?").run(passwordHash, salt, userId);
   }
   async listAll() {
     const rows = this.db.prepare("SELECT * FROM auth_users").all();
@@ -2101,9 +2078,7 @@ var SqliteUserStore = class {
     deleteInTransaction();
   }
   async touchDevice(deviceId) {
-    this.db.prepare(
-      "UPDATE auth_devices SET last_seen_at = ? WHERE id = ?"
-    ).run(Date.now(), deviceId);
+    this.db.prepare("UPDATE auth_devices SET last_seen_at = ? WHERE id = ?").run(Date.now(), deviceId);
   }
 };
 async function createSqliteUserStore(options) {
@@ -2222,7 +2197,7 @@ var PostgresUserStore = class {
     const existingRows = await this.sql`
 			SELECT * FROM auth_devices WHERE id = ${params.id}
 		`;
-    if (existingRows.length > 0 && !existingRows[0].revoked) {
+    if (existingRows.length > 0 && !existingRows[0]?.revoked) {
       return rowToDevice2(existingRows[0]);
     }
     const now = Date.now();
@@ -2243,7 +2218,7 @@ var PostgresUserStore = class {
       publicKey: params.publicKey,
       name: params.name,
       revoked: false,
-      createdAt: existingRows.length > 0 ? Number(existingRows[0].created_at) : now,
+      createdAt: existingRows.length > 0 ? Number(existingRows[0]?.created_at) : now,
       lastSeenAt: now
     };
   }
@@ -2440,16 +2415,12 @@ var ExternalAuthOperationNotSupportedError = class extends import_core6.KoraErro
 };
 var ExternalTokenValidationError = class extends import_core6.KoraError {
   constructor(reason, context) {
-    super(
-      `External token validation failed: ${reason}`,
-      "AUTH_EXTERNAL_TOKEN_INVALID",
-      context
-    );
+    super(`External token validation failed: ${reason}`, "AUTH_EXTERNAL_TOKEN_INVALID", context);
     this.name = "ExternalTokenValidationError";
   }
 };
 function defaultMapClaims(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     throw new ExternalTokenValidationError(
       'JWT is missing a valid "sub" (subject) claim. The "sub" claim must be a non-empty string identifying the user.',
@@ -2458,8 +2429,8 @@ function defaultMapClaims(claims) {
   }
   return {
     userId: sub,
-    email: typeof claims["email"] === "string" ? claims["email"] : void 0,
-    name: typeof claims["name"] === "string" ? claims["name"] : void 0,
+    email: typeof claims.email === "string" ? claims.email : void 0,
+    name: typeof claims.name === "string" ? claims.name : void 0,
     metadata: void 0
   };
 }
@@ -2659,23 +2630,23 @@ var ExternalJwtProvider = class {
 // src/provider/external/clerk-adapter.ts
 init_cjs_shims();
 function defaultClerkClaimMapping(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     return { userId: "" };
   }
-  const firstName = typeof claims["first_name"] === "string" ? claims["first_name"] : "";
-  const lastName = typeof claims["last_name"] === "string" ? claims["last_name"] : "";
+  const firstName = typeof claims.first_name === "string" ? claims.first_name : "";
+  const lastName = typeof claims.last_name === "string" ? claims.last_name : "";
   const fullName = [firstName, lastName].filter(Boolean).join(" ");
-  const email = typeof claims["email"] === "string" ? claims["email"] : void 0;
+  const email = typeof claims.email === "string" ? claims.email : void 0;
   const metadata = {};
-  if (typeof claims["org_id"] === "string") {
-    metadata["orgId"] = claims["org_id"];
+  if (typeof claims.org_id === "string") {
+    metadata.orgId = claims.org_id;
   }
-  if (typeof claims["org_slug"] === "string") {
-    metadata["orgSlug"] = claims["org_slug"];
+  if (typeof claims.org_slug === "string") {
+    metadata.orgSlug = claims.org_slug;
   }
-  if (typeof claims["org_role"] === "string") {
-    metadata["orgRole"] = claims["org_role"];
+  if (typeof claims.org_role === "string") {
+    metadata.orgRole = claims.org_role;
   }
   return {
     userId: sub,
@@ -2695,30 +2666,30 @@ function createClerkAdapter(config) {
 // src/provider/external/supabase-adapter.ts
 init_cjs_shims();
 function defaultSupabaseClaimMapping(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     return { userId: "" };
   }
-  const email = typeof claims["email"] === "string" ? claims["email"] : void 0;
+  const email = typeof claims.email === "string" ? claims.email : void 0;
   let name;
-  const userMetadata = claims["user_metadata"];
+  const userMetadata = claims.user_metadata;
   if (typeof userMetadata === "object" && userMetadata !== null && !Array.isArray(userMetadata)) {
     const meta = userMetadata;
-    if (typeof meta["full_name"] === "string" && meta["full_name"].length > 0) {
-      name = meta["full_name"];
-    } else if (typeof meta["name"] === "string" && meta["name"].length > 0) {
-      name = meta["name"];
+    if (typeof meta.full_name === "string" && meta.full_name.length > 0) {
+      name = meta.full_name;
+    } else if (typeof meta.name === "string" && meta.name.length > 0) {
+      name = meta.name;
     }
   }
   const metadata = {};
-  if (typeof claims["role"] === "string") {
-    metadata["role"] = claims["role"];
+  if (typeof claims.role === "string") {
+    metadata.role = claims.role;
   }
-  if (typeof claims["aud"] === "string") {
-    metadata["aud"] = claims["aud"];
+  if (typeof claims.aud === "string") {
+    metadata.aud = claims.aud;
   }
-  if (typeof claims["app_metadata"] === "object" && claims["app_metadata"] !== null && !Array.isArray(claims["app_metadata"])) {
-    metadata["appMetadata"] = claims["app_metadata"];
+  if (typeof claims.app_metadata === "object" && claims.app_metadata !== null && !Array.isArray(claims.app_metadata)) {
+    metadata.appMetadata = claims.app_metadata;
   }
   return {
     userId: sub,
@@ -2750,53 +2721,54 @@ var PasskeyError = class extends import_core7.KoraError {
   }
 };
 function decodeCbor(data, offset) {
-  if (offset >= data.length) {
+  let pos = offset;
+  if (pos >= data.length) {
     throw new PasskeyError("CBOR decode error: unexpected end of data.");
   }
-  const initialByte = data[offset];
+  const initialByte = data[pos];
   const majorType = initialByte >> 5;
   const additionalInfo = initialByte & 31;
-  offset += 1;
+  pos += 1;
   let argument;
   if (additionalInfo < 24) {
     argument = additionalInfo;
   } else if (additionalInfo === 24) {
-    argument = data[offset];
-    offset += 1;
+    argument = data[pos];
+    pos += 1;
   } else if (additionalInfo === 25) {
-    argument = data[offset] << 8 | data[offset + 1];
-    offset += 2;
+    argument = data[pos] << 8 | data[pos + 1];
+    pos += 2;
   } else if (additionalInfo === 26) {
-    argument = data[offset] << 24 | data[offset + 1] << 16 | data[offset + 2] << 8 | data[offset + 3];
+    argument = data[pos] << 24 | data[pos + 1] << 16 | data[pos + 2] << 8 | data[pos + 3];
     argument = argument >>> 0;
-    offset += 4;
+    pos += 4;
   } else {
     throw new PasskeyError(
-      `CBOR decode error: unsupported additional info ${additionalInfo} at byte ${offset - 1}. This CBOR decoder only supports definite-length encodings.`
+      `CBOR decode error: unsupported additional info ${additionalInfo} at byte ${pos - 1}. This CBOR decoder only supports definite-length encodings.`
     );
   }
   switch (majorType) {
     // Major type 0: Unsigned integer
     case 0:
-      return { value: argument, offset };
+      return { value: argument, offset: pos };
     // Major type 1: Negative integer (-1 - argument)
     case 1:
-      return { value: -1 - argument, offset };
+      return { value: -1 - argument, offset: pos };
     // Major type 2: Byte string
     case 2: {
-      const bytes = data.slice(offset, offset + argument);
-      return { value: bytes, offset: offset + argument };
+      const bytes = data.slice(pos, pos + argument);
+      return { value: bytes, offset: pos + argument };
     }
     // Major type 3: Text string (UTF-8)
     case 3: {
-      const textBytes = data.slice(offset, offset + argument);
+      const textBytes = data.slice(pos, pos + argument);
       const text = new TextDecoder().decode(textBytes);
-      return { value: text, offset: offset + argument };
+      return { value: text, offset: pos + argument };
     }
     // Major type 4: Array
     case 4: {
       const arr = [];
-      let currentOffset = offset;
+      let currentOffset = pos;
       for (let i = 0; i < argument; i++) {
         const item = decodeCbor(data, currentOffset);
         arr.push(item.value);
@@ -2807,7 +2779,7 @@ function decodeCbor(data, offset) {
     // Major type 5: Map
     case 5: {
       const map = /* @__PURE__ */ new Map();
-      let currentOffset = offset;
+      let currentOffset = pos;
       for (let i = 0; i < argument; i++) {
         const keyResult = decodeCbor(data, currentOffset);
         const valResult = decodeCbor(data, keyResult.offset);
@@ -2818,7 +2790,7 @@ function decodeCbor(data, offset) {
     }
     default:
       throw new PasskeyError(
-        `CBOR decode error: unsupported major type ${majorType} at byte ${offset - 1}. This CBOR decoder only supports types 0-5 (integers, byte/text strings, arrays, maps).`
+        `CBOR decode error: unsupported major type ${majorType} at byte ${pos - 1}. This CBOR decoder only supports types 0-5 (integers, byte/text strings, arrays, maps).`
       );
   }
 }
@@ -2832,10 +2804,12 @@ var PasskeyVerificationError = class extends import_core8.KoraError {
 };
 function generateRegistrationOptions(params) {
   const challengeBytes = (0, import_node_crypto8.randomBytes)(32);
-  const challenge = toBase64Url(challengeBytes.buffer.slice(
-    challengeBytes.byteOffset,
-    challengeBytes.byteOffset + challengeBytes.byteLength
-  ));
+  const challenge = toBase64Url(
+    challengeBytes.buffer.slice(
+      challengeBytes.byteOffset,
+      challengeBytes.byteOffset + challengeBytes.byteLength
+    )
+  );
   return {
     challenge,
     rpId: params.rpId,
@@ -2945,10 +2919,12 @@ async function verifyRegistrationResponse(params) {
 }
 function generateAuthenticationOptions(params) {
   const challengeBytes = (0, import_node_crypto8.randomBytes)(32);
-  const challenge = toBase64Url(challengeBytes.buffer.slice(
-    challengeBytes.byteOffset,
-    challengeBytes.byteOffset + challengeBytes.byteLength
-  ));
+  const challenge = toBase64Url(
+    challengeBytes.buffer.slice(
+      challengeBytes.byteOffset,
+      challengeBytes.byteOffset + challengeBytes.byteLength
+    )
+  );
   return {
     challenge,
     rpId: params.rpId,
@@ -3003,9 +2979,7 @@ async function verifyAuthenticationResponse(params) {
   }
   const flags = authDataBytes[32];
   if ((flags & 1) === 0) {
-    throw new PasskeyVerificationError(
-      "User Present flag is not set in authenticator data."
-    );
+    throw new PasskeyVerificationError("User Present flag is not set in authenticator data.");
   }
   const signCount = (authDataBytes[33] << 24 | authDataBytes[34] << 16 | authDataBytes[35] << 8 | authDataBytes[36]) >>> 0;
   if (previousSignCount > 0 || signCount > 0) {
@@ -3020,9 +2994,7 @@ async function verifyAuthenticationResponse(params) {
     }
   }
   const clientDataHash = await sha256(clientDataBytes);
-  const signedData = new Uint8Array(
-    authDataBytes.length + clientDataHash.byteLength
-  );
+  const signedData = new Uint8Array(authDataBytes.length + clientDataHash.byteLength);
   signedData.set(authDataBytes, 0);
   signedData.set(new Uint8Array(clientDataHash), authDataBytes.length);
   const coseKeyBytes = fromBase64Url(publicKey);
@@ -3079,10 +3051,9 @@ async function verifyAuthenticationResponse(params) {
       signedData.buffer
     );
   } catch (error) {
-    throw new PasskeyVerificationError(
-      "Signature verification operation failed.",
-      { cause: error instanceof Error ? error.message : String(error) }
-    );
+    throw new PasskeyVerificationError("Signature verification operation failed.", {
+      cause: error instanceof Error ? error.message : String(error)
+    });
   }
   if (!verified) {
     return { verified: false, newSignCount: signCount };
@@ -3105,9 +3076,7 @@ function constantTimeEqual(a, b) {
 function derToP1363(derSignature, componentLength) {
   let offset = 0;
   if (derSignature[offset] !== 48) {
-    throw new PasskeyVerificationError(
-      "Invalid DER signature: expected SEQUENCE tag (0x30)."
-    );
+    throw new PasskeyVerificationError("Invalid DER signature: expected SEQUENCE tag (0x30).");
   }
   offset += 1;
   if (derSignature[offset] & 128) {
@@ -3356,14 +3325,11 @@ var OperationEncryptor = class {
       if (cause instanceof OperationEncryptionError) {
         throw cause;
       }
-      throw new OperationEncryptionError(
-        `Failed to encrypt operation ${fieldName} field.`,
-        {
-          operationId,
-          fieldName,
-          cause: cause instanceof Error ? cause.message : String(cause)
-        }
-      );
+      throw new OperationEncryptionError(`Failed to encrypt operation ${fieldName} field.`, {
+        operationId,
+        fieldName,
+        cause: cause instanceof Error ? cause.message : String(cause)
+      });
     }
   }
   async decryptField(field, operationId, fieldName) {
@@ -3387,10 +3353,10 @@ var OperationEncryptor = class {
       const json = new TextDecoder().decode(plaintextBytes);
       const parsed = JSON.parse(json);
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        throw new OperationEncryptionError(
-          `Decrypted ${fieldName} is not a valid record object.`,
-          { operationId, fieldName }
-        );
+        throw new OperationEncryptionError(`Decrypted ${fieldName} is not a valid record object.`, {
+          operationId,
+          fieldName
+        });
       }
       return parsed;
     } catch (cause) {
@@ -3415,7 +3381,7 @@ function isEncryptedEnvelope(field) {
   if (field === null || typeof field !== "object") {
     return false;
   }
-  return field[ENCRYPTED_MARKER] === true && typeof field["ciphertext"] === "string" && typeof field["iv"] === "string" && field["algorithm"] === "AES-256-GCM";
+  return field[ENCRYPTED_MARKER] === true && typeof field.ciphertext === "string" && typeof field.iv === "string" && field.algorithm === "AES-256-GCM";
 }
 
 // src/org/org-routes.ts
@@ -3464,11 +3430,9 @@ var MemberAlreadyExistsError = class extends OrgError {
 };
 var InsufficientRoleError = class extends OrgError {
   constructor(required) {
-    super(
-      `This action requires at least the "${required}" role.`,
-      "INSUFFICIENT_ROLE",
-      { requiredRole: required }
-    );
+    super(`This action requires at least the "${required}" role.`, "INSUFFICIENT_ROLE", {
+      requiredRole: required
+    });
   }
 };
 var CannotRemoveOwnerError = class extends OrgError {
@@ -3678,17 +3642,28 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "Target user ID is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot assign owner role directly. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot assign owner role directly. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
       return { status: 403, body: { error: "Only the owner can add admin members." } };
     }
     try {
-      const membership = await this.store.addMember(orgId, params.targetUserId, params.role, userId);
+      const membership = await this.store.addMember(
+        orgId,
+        params.targetUserId,
+        params.role,
+        userId
+      );
       return { status: 201, body: { data: membership } };
     } catch (err) {
       if (err instanceof OrgNotFoundError) {
@@ -3741,17 +3716,27 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "Target user ID is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot assign owner role directly. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot assign owner role directly. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
       return { status: 403, body: { error: "Only the owner can assign admin role." } };
     }
     try {
-      const membership = await this.store.updateMemberRole(orgId, params.targetUserId, params.role);
+      const membership = await this.store.updateMemberRole(
+        orgId,
+        params.targetUserId,
+        params.role
+      );
       return { status: 200, body: { data: membership } };
     } catch (err) {
       if (err instanceof MembershipNotFoundError) {
@@ -3814,10 +3799,16 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "A valid email address is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot invite with owner role. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot invite with owner role. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
@@ -4269,20 +4260,14 @@ var InvalidPermissionError = class extends RbacError {
 };
 var RoleNotFoundError = class extends RbacError {
   constructor(role) {
-    super(
-      `Role "${role}" is not defined.`,
-      "ROLE_NOT_FOUND",
-      { role }
-    );
+    super(`Role "${role}" is not defined.`, "ROLE_NOT_FOUND", { role });
   }
 };
 var CircularInheritanceError = class extends RbacError {
   constructor(chain) {
-    super(
-      `Circular role inheritance detected: ${chain.join(" \u2192 ")}.`,
-      "CIRCULAR_INHERITANCE",
-      { chain }
-    );
+    super(`Circular role inheritance detected: ${chain.join(" \u2192 ")}.`, "CIRCULAR_INHERITANCE", {
+      chain
+    });
   }
 };
 
@@ -4383,15 +4368,11 @@ var RbacEngine = class {
       permissions
     };
     const scopes = {};
-    const hasAnyRead = permissions.some(
-      (p) => permissionCovers(p, "*:read")
-    );
+    const hasAnyRead = permissions.some((p) => permissionCovers(p, "*:read"));
     if (!hasAnyRead) {
       return scopes;
     }
-    const isReadOnly = !permissions.some(
-      (p) => permissionCovers(p, "*:write")
-    );
+    const isReadOnly = !permissions.some((p) => permissionCovers(p, "*:write"));
     const collectionsToResolve = collections ?? [...this.collectionResolvers.keys()];
     for (const collection of collectionsToResolve) {
       const customResolver = this.collectionResolvers.get(collection);
@@ -4553,21 +4534,13 @@ var OrgScopeResolver = class {
    * Check if a user can write to a specific collection in an org.
    */
   async canWrite(userId, orgId, collection) {
-    return this.rbac.hasPermission(
-      userId,
-      orgId,
-      `${collection}:write`
-    );
+    return this.rbac.hasPermission(userId, orgId, `${collection}:write`);
   }
   /**
    * Check if a user can read from a specific collection in an org.
    */
   async canRead(userId, orgId, collection) {
-    return this.rbac.hasPermission(
-      userId,
-      orgId,
-      `${collection}:read`
-    );
+    return this.rbac.hasPermission(userId, orgId, `${collection}:read`);
   }
   // --- Private ---
   resolveCollectionScope(ctx, collection) {
@@ -4627,7 +4600,9 @@ var OAuthUserInfoError = class extends OAuthError {
 };
 var OAuthProviderNotFoundError = class extends OAuthError {
   constructor(provider) {
-    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", { provider });
+    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", {
+      provider
+    });
   }
 };
 
@@ -4753,9 +4728,7 @@ var OAuthManager = class {
         body: body.toString()
       });
     } catch (err) {
-      throw new OAuthCodeExchangeError(
-        err instanceof Error ? err.message : "Network error"
-      );
+      throw new OAuthCodeExchangeError(err instanceof Error ? err.message : "Network error");
     }
     if (!response.ok) {
       let details = `HTTP ${response.status}`;
@@ -4768,12 +4741,12 @@ var OAuthManager = class {
     }
     const data = await response.json();
     return {
-      accessToken: data["access_token"],
-      tokenType: data["token_type"] ?? "Bearer",
-      expiresIn: data["expires_in"],
-      refreshToken: data["refresh_token"],
-      idToken: data["id_token"],
-      scope: data["scope"]
+      accessToken: data.access_token,
+      tokenType: data.token_type ?? "Bearer",
+      expiresIn: data.expires_in,
+      refreshToken: data.refresh_token,
+      idToken: data.id_token,
+      scope: data.scope
     };
   }
   async fetchUserInfo(provider, accessToken) {
@@ -4786,9 +4759,7 @@ var OAuthManager = class {
         }
       });
     } catch (err) {
-      throw new OAuthUserInfoError(
-        err instanceof Error ? err.message : "Network error"
-      );
+      throw new OAuthUserInfoError(err instanceof Error ? err.message : "Network error");
     }
     if (!response.ok) {
       throw new OAuthUserInfoError(`HTTP ${response.status}`);
@@ -4801,43 +4772,43 @@ function normalizeUserInfo(providerId, profile) {
   switch (providerId) {
     case "google":
       return {
-        providerId: profile["sub"],
+        providerId: profile.sub,
         provider: "google",
-        email: profile["email"] ?? null,
-        emailVerified: profile["email_verified"] ?? false,
-        name: profile["name"] ?? null,
-        avatarUrl: profile["picture"] ?? null,
+        email: profile.email ?? null,
+        emailVerified: profile.email_verified ?? false,
+        name: profile.name ?? null,
+        avatarUrl: profile.picture ?? null,
         rawProfile: profile
       };
     case "github":
       return {
-        providerId: String(profile["id"]),
+        providerId: String(profile.id),
         provider: "github",
-        email: profile["email"] ?? null,
+        email: profile.email ?? null,
         emailVerified: false,
         // GitHub doesn't confirm in the profile response
-        name: profile["name"] ?? profile["login"] ?? null,
-        avatarUrl: profile["avatar_url"] ?? null,
+        name: profile.name ?? profile.login ?? null,
+        avatarUrl: profile.avatar_url ?? null,
         rawProfile: profile
       };
     case "microsoft":
       return {
-        providerId: profile["id"],
+        providerId: profile.id,
         provider: "microsoft",
-        email: profile["mail"] ?? profile["userPrincipalName"] ?? null,
+        email: profile.mail ?? profile.userPrincipalName ?? null,
         emailVerified: false,
-        name: profile["displayName"] ?? null,
+        name: profile.displayName ?? null,
         avatarUrl: null,
         rawProfile: profile
       };
     default:
       return {
-        providerId: String(profile["id"] ?? profile["sub"] ?? ""),
+        providerId: String(profile.id ?? profile.sub ?? ""),
         provider: providerId,
-        email: profile["email"] ?? null,
-        emailVerified: profile["email_verified"] ?? false,
-        name: profile["name"] ?? null,
-        avatarUrl: profile["picture"] ?? profile["avatar_url"] ?? null,
+        email: profile.email ?? null,
+        emailVerified: profile.email_verified ?? false,
+        name: profile.name ?? null,
+        avatarUrl: profile.picture ?? profile.avatar_url ?? null,
         rawProfile: profile
       };
   }
@@ -5115,7 +5086,7 @@ function generateSessionId() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -5331,7 +5302,7 @@ var TotpManager = class {
    */
   async isEnabled(userId) {
     const stored = await this.store.getByUserId(userId);
-    return stored !== null && stored.verified;
+    return stored?.verified ?? false;
   }
   /**
    * Get the number of remaining recovery codes for a user.
@@ -5365,7 +5336,7 @@ function generateTotpCode(secret, counter, digits, algorithm) {
   const hash = hmacSha(algorithm, secret, counterBytes);
   const offset = hash[hash.length - 1] & 15;
   const binary = (hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255;
-  const otp = binary % Math.pow(10, digits);
+  const otp = binary % 10 ** digits;
   return otp.toString().padStart(digits, "0");
 }
 function hmacSha(algorithm, key, message) {
@@ -5409,7 +5380,10 @@ function sha1(data) {
       w[i] = view.getInt32(offset + i * 4, false);
     }
     for (let i = 16; i < 80; i++) {
-      w[i] = rotl32(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16] | 0, 1);
+      w[i] = rotl32(
+        w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16] | 0,
+        1
+      );
     }
     let a = h0;
     let b = h1;
@@ -5518,7 +5492,7 @@ async function hashRecoveryCode(code) {
   const bytes = new Uint8Array(hash);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -5723,8 +5697,9 @@ var InMemoryAuditLogStore = class {
     const initialLength = this.entries.length;
     let writeIndex = 0;
     for (let i = 0; i < this.entries.length; i++) {
-      if (this.entries[i].timestamp >= timestamp) {
-        this.entries[writeIndex] = this.entries[i];
+      const entry = this.entries[i];
+      if (entry.timestamp >= timestamp) {
+        this.entries[writeIndex] = entry;
         writeIndex++;
       }
     }
@@ -5815,7 +5790,7 @@ function generateAuditId() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -5935,9 +5910,7 @@ var WebhookManager = class {
    */
   async dispatch(event, data) {
     const endpoints = await this.store.listEndpoints();
-    const matching = endpoints.filter(
-      (ep) => ep.active && ep.events.includes(event)
-    );
+    const matching = endpoints.filter((ep) => ep.active && ep.events.includes(event));
     const payload = {
       id: generateId2(),
       event,
@@ -5945,9 +5918,7 @@ var WebhookManager = class {
       data
     };
     const payloadJson = JSON.stringify(payload);
-    await Promise.allSettled(
-      matching.map((ep) => this.deliverToEndpoint(ep, payloadJson, event))
-    );
+    await Promise.allSettled(matching.map((ep) => this.deliverToEndpoint(ep, payloadJson, event)));
   }
   // --- Private ---
   async deliverToEndpoint(endpoint, payloadJson, event) {
@@ -6000,7 +5971,7 @@ function generateId2() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -6009,7 +5980,7 @@ function generateSecret2() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return `whsec_${hex}`;
 }
@@ -6022,15 +5993,11 @@ async function signPayload(payload, secret) {
     false,
     ["sign"]
   );
-  const signature = await globalThis.crypto.subtle.sign(
-    "HMAC",
-    key,
-    encoder.encode(payload)
-  );
+  const signature = await globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(payload));
   const bytes = new Uint8Array(signature);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return `sha256=${hex}`;
 }