@korajs/auth 0.3.2 → 0.4.0

package/dist/server.js

@@ -7,1294 +7,1049 @@ import {
   isEncryptedField,
   toBase64Url,
   verifyChallenge
-} from "./chunk-FSU4SK32.js";
+} from "./chunk-IO2MCCG2.js";
 import {
   hashPassword,
   verifyPassword
-} from "./chunk-HOZXDR6Y.js";
+} from "./chunk-L7GXPS74.js";
 
 // src/provider/built-in/auth-routes.ts
-import { randomBytes as randomBytes2 } from "crypto";
-
-// src/tokens/token-manager.ts
-import { randomBytes, randomUUID } from "crypto";
-
-// src/types.ts
-import { KoraError } from "@korajs/core";
-var DEFAULT_ACCESS_TOKEN_LIFETIME = 15 * 60 * 1e3;
-var DEFAULT_REFRESH_TOKEN_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
-var DEFAULT_DEVICE_CREDENTIAL_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
-var DEFAULT_MAX_OFFLINE_DURATION = 30 * 24 * 60 * 60 * 1e3;
-var DEFAULT_AUTO_LOCK_TIMEOUT = 15 * 60 * 1e3;
-
-// src/tokens/jwt.ts
-import { createHmac } from "crypto";
-function base64urlEncode(input) {
-  return Buffer.from(input, "utf-8").toString("base64url");
-}
-function base64urlDecode(input) {
-  return Buffer.from(input, "base64url").toString("utf-8");
-}
-function hmacSha256Base64url(data, secret) {
-  return createHmac("sha256", secret).update(data).digest("base64url");
-}
-var ENCODED_HEADER = base64urlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
-function encodeJwt(payload, secret) {
-  const encodedPayload = base64urlEncode(JSON.stringify(payload));
-  const signingInput = `${ENCODED_HEADER}.${encodedPayload}`;
-  const signature = hmacSha256Base64url(signingInput, secret);
-  return `${signingInput}.${signature}`;
-}
-function decodeJwt(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const payloadSegment = parts[1];
-  if (payloadSegment === void 0) {
-    return null;
+import { randomBytes } from "crypto";
+var InMemoryChallengeStore = class {
+  challenges = /* @__PURE__ */ new Map();
+  async store(challenge, deviceId, expiresAt) {
+    this.challenges.set(challenge, { deviceId, expiresAt });
   }
-  try {
-    const decoded = base64urlDecode(payloadSegment);
-    const parsed = JSON.parse(decoded);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+  async consume(challenge) {
+    const entry = this.challenges.get(challenge);
+    if (entry === void 0) {
       return null;
     }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function verifyJwt(token, secret) {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const headerSegment = parts[0];
-  const payloadSegment = parts[1];
-  const signatureSegment = parts[2];
-  if (headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
-    return null;
+    this.challenges.delete(challenge);
+    if (Date.now() > entry.expiresAt) {
+      return null;
+    }
+    return { deviceId: entry.deviceId };
   }
-  if (headerSegment !== ENCODED_HEADER) {
-    return null;
+  /**
+   * Remove expired challenges to prevent unbounded memory growth.
+   */
+  cleanup() {
+    const now = Date.now();
+    for (const [challenge, entry] of this.challenges) {
+      if (now > entry.expiresAt) {
+        this.challenges.delete(challenge);
+      }
+    }
   }
-  const signingInput = `${headerSegment}.${payloadSegment}`;
-  const expectedSignature = hmacSha256Base64url(signingInput, secret);
-  if (expectedSignature.length !== signatureSegment.length) {
-    return null;
+};
+var InMemoryRateLimiter = class {
+  attempts = /* @__PURE__ */ new Map();
+  maxAttempts;
+  windowMs;
+  /**
+   * @param maxAttempts - Maximum number of attempts within the time window (default: 10)
+   * @param windowMs - Time window in milliseconds (default: 60,000 = 1 minute)
+   */
+  constructor(maxAttempts = 10, windowMs = 6e4) {
+    this.maxAttempts = maxAttempts;
+    this.windowMs = windowMs;
   }
-  let mismatch = 0;
-  for (let i = 0; i < expectedSignature.length; i++) {
-    mismatch |= expectedSignature.charCodeAt(i) ^ signatureSegment.charCodeAt(i);
+  async isAllowed(key) {
+    const now = Date.now();
+    const attempts = this.attempts.get(key) ?? [];
+    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
+    return recentAttempts.length < this.maxAttempts;
   }
-  if (mismatch !== 0) {
-    return null;
+  async record(key) {
+    const now = Date.now();
+    const attempts = this.attempts.get(key) ?? [];
+    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
+    recentAttempts.push(now);
+    this.attempts.set(key, recentAttempts);
   }
-  try {
-    const decoded = base64urlDecode(payloadSegment);
-    const parsed = JSON.parse(decoded);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
+  async reset(key) {
+    this.attempts.delete(key);
   }
-}
-var CLOCK_SKEW_TOLERANCE_SECONDS = 5;
-function isExpired(payload) {
-  if (typeof payload.exp !== "number") {
+};
+var MIN_PASSWORD_LENGTH = 8;
+var MAX_PASSWORD_LENGTH = 128;
+var MAX_NAME_LENGTH = 200;
+var CHALLENGE_TTL_MS = 6e4;
+function isValidEmail(email) {
+  if (email.length === 0 || email.length > 254) {
     return false;
   }
-  const nowSeconds = Math.floor(Date.now() / 1e3);
-  return nowSeconds >= payload.exp + CLOCK_SKEW_TOLERANCE_SECONDS;
-}
-
-// src/tokens/token-manager.ts
-var MIN_SECRET_LENGTH = 32;
-var InMemoryTokenRevocationStore = class {
-  revokedTokens = /* @__PURE__ */ new Map();
-  revokedDevices = /* @__PURE__ */ new Set();
-  async isRevoked(jti) {
-    return this.revokedTokens.has(jti);
+  const atIndex = email.indexOf("@");
+  if (atIndex < 1) {
+    return false;
   }
-  async revoke(jti, expiresAt) {
-    this.revokedTokens.set(jti, expiresAt);
+  const domain = email.slice(atIndex + 1);
+  if (domain.length === 0 || !domain.includes(".")) {
+    return false;
   }
-  async revokeAllForDevice(deviceId) {
-    this.revokedDevices.add(deviceId);
+  if (email.indexOf("@", atIndex + 1) !== -1) {
+    return false;
   }
-  /**
-   * Check if a device has been revoked.
-   */
-  isDeviceRevoked(deviceId) {
-    return this.revokedDevices.has(deviceId);
+  if (email.includes(" ")) {
+    return false;
   }
-  /**
-   * Remove expired revocations to prevent unbounded memory growth.
-   * Call periodically (e.g., every hour) in long-running servers.
-   */
-  cleanup() {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    for (const [jti, expiresAt] of this.revokedTokens) {
-      if (nowSeconds > expiresAt) {
-        this.revokedTokens.delete(jti);
-      }
-    }
+  return true;
+}
+function sanitizeName(name) {
+  const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
+  const trimmed = cleaned.trim();
+  if (trimmed.length > MAX_NAME_LENGTH) {
+    return trimmed.slice(0, MAX_NAME_LENGTH);
   }
-};
-var TokenManager = class {
-  /** All signing/verification secrets (index 0 = current signing key) */
-  secrets;
-  accessTokenLifetime;
-  refreshTokenLifetime;
-  deviceCredentialLifetime;
-  revocationStore;
+  return trimmed;
+}
+var BuiltInAuthRoutes = class {
+  userStore;
+  tokenManager;
+  challengeStore;
+  rateLimiter;
   constructor(config) {
-    const secrets = Array.isArray(config.secret) ? config.secret : [config.secret];
-    if (secrets.length === 0) {
-      throw new Error("TokenManager requires at least one secret.");
-    }
-    for (const secret of secrets) {
-      if (secret.length < MIN_SECRET_LENGTH) {
-        throw new Error(
-          `JWT secret must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for HMAC-SHA256 security. Received ${secret.length} characters. Use TokenManager.generateSecret() to generate a secure secret.`
-        );
-      }
-    }
-    this.secrets = secrets;
-    this.accessTokenLifetime = config.accessTokenLifetime ?? DEFAULT_ACCESS_TOKEN_LIFETIME;
-    this.refreshTokenLifetime = config.refreshTokenLifetime ?? DEFAULT_REFRESH_TOKEN_LIFETIME;
-    this.deviceCredentialLifetime = config.deviceCredentialLifetime ?? DEFAULT_DEVICE_CREDENTIAL_LIFETIME;
-    this.revocationStore = config.revocationStore;
-  }
-  /**
-   * Generate a cryptographically random secret suitable for HMAC-SHA256 signing.
-   *
-   * Returns a 64-character hex string (32 bytes / 256 bits of entropy).
-   * Store this securely (environment variable, secrets manager) — never in source code.
-   *
-   * @returns A random 256-bit hex-encoded secret
-   */
-  static generateSecret() {
-    return randomBytes(32).toString("hex");
+    this.userStore = config.userStore;
+    this.tokenManager = config.tokenManager;
+    this.challengeStore = config.challengeStore ?? new InMemoryChallengeStore();
+    this.rateLimiter = config.rateLimiter ?? new InMemoryRateLimiter();
   }
   /**
-   * Issue a signed JWT access token.
+   * Handle user sign-up (POST /auth/signup).
    *
-   * Access tokens are short-lived (default 15 minutes) and used to authorize
-   * API requests. When expired, use {@link refreshAccessToken} with a valid
-   * refresh token to obtain a new one.
+   * Validates email format and password length, hashes the password,
+   * creates the user, optionally registers a device, and issues tokens.
    *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @returns A signed JWT string with type 'access'
+   * @param body - Sign-up request body
+   * @param body.email - The user's email address
+   * @param body.password - The plaintext password (8-128 characters)
+   * @param body.name - Optional display name (defaults to email local part)
+   * @param body.deviceId - Optional device ID to register
+   * @param body.devicePublicKey - Optional device public key (base64url)
+   * @param clientIp - Optional client IP for rate limiting
+   * @returns Auth response with the created user and tokens, or an error
    */
-  issueAccessToken(userId, deviceId) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const payload = {
-      jti: randomUUID(),
-      sub: userId,
-      dev: deviceId,
-      type: "access",
-      iat: nowSeconds,
-      exp: nowSeconds + Math.floor(this.accessTokenLifetime / 1e3)
-    };
-    return encodeJwt(payload, this.secrets[0]);
-  }
-  /**
-   * Issue a signed JWT refresh token.
-   *
-   * Refresh tokens are longer-lived (default 90 days) and used exclusively
-   * to obtain new access tokens via {@link refreshAccessToken}. They should
-   * be stored securely and never sent to resource APIs.
-   *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @returns A signed JWT string with type 'refresh'
-   */
-  issueRefreshToken(userId, deviceId) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const payload = {
-      jti: randomUUID(),
-      sub: userId,
-      dev: deviceId,
-      type: "refresh",
-      iat: nowSeconds,
-      exp: nowSeconds + Math.floor(this.refreshTokenLifetime / 1e3)
+  async handleSignUp(body, clientIp) {
+    const rateLimitKey = clientIp ?? "global";
+    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+      return {
+        status: 429,
+        body: { error: "Too many requests. Please try again later." }
+      };
+    }
+    await this.rateLimiter.record(rateLimitKey);
+    if (!isValidEmail(body.email)) {
+      return {
+        status: 400,
+        body: {
+          error: "Invalid email address. Please provide a valid email in the format user@domain.com."
+        }
+      };
+    }
+    if (body.password.length < MIN_PASSWORD_LENGTH) {
+      return {
+        status: 400,
+        body: {
+          error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long.`
+        }
+      };
+    }
+    if (body.password.length > MAX_PASSWORD_LENGTH) {
+      return {
+        status: 400,
+        body: {
+          error: `Password must be at most ${MAX_PASSWORD_LENGTH} characters long.`
+        }
+      };
+    }
+    const { hash, salt } = await hashPassword(body.password);
+    const rawName = body.name ?? body.email.split("@")[0] ?? body.email;
+    const name = sanitizeName(rawName);
+    let user;
+    try {
+      user = await this.userStore.createUser({
+        email: body.email,
+        passwordHash: hash,
+        salt,
+        name
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "DuplicateEmailError") {
+        return {
+          status: 409,
+          body: { error: "An account with this email already exists." }
+        };
+      }
+      throw err;
+    }
+    const deviceId = body.deviceId ?? `device-${user.id}`;
+    await this.userStore.registerDevice({
+      id: deviceId,
+      userId: user.id,
+      publicKey: body.devicePublicKey ?? "",
+      name: body.deviceId ? "Primary Device" : "Browser"
+    });
+    const tokens = this.tokenManager.issueTokens(user.id, deviceId);
+    return {
+      status: 201,
+      body: { data: { user, tokens } }
     };
-    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Issue a signed device credential token.
+   * Handle user sign-in (POST /auth/signin).
    *
-   * Device credentials are long-lived tokens bound to a device's public key.
-   * They include a `mustCheckinBy` deadline; if the device does not check in
-   * before this deadline, the credential should be treated as revoked.
+   * Looks up the user by email, verifies the password, optionally registers
+   * a new device, and issues tokens.
    *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @param publicKeyThumbprint - SHA-256 thumbprint of the device's public key
-   * @returns A signed JWT string with type 'device_credential'
+   * @param body - Sign-in request body
+   * @param body.email - The user's email address
+   * @param body.password - The plaintext password
+   * @param body.deviceId - Optional device ID to register
+   * @param body.devicePublicKey - Optional device public key (base64url)
+   * @param clientIp - Optional client IP for rate limiting
+   * @returns Auth response with the user and tokens, or an error
    */
-  issueDeviceCredential(userId, deviceId, publicKeyThumbprint) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const lifetimeSeconds = Math.floor(this.deviceCredentialLifetime / 1e3);
-    const payload = {
-      jti: randomUUID(),
-      sub: userId,
-      dev: deviceId,
-      type: "device_credential",
-      iat: nowSeconds,
-      exp: nowSeconds + lifetimeSeconds,
-      dpk: publicKeyThumbprint,
-      mustCheckinBy: nowSeconds + lifetimeSeconds
+  async handleSignIn(body, clientIp) {
+    const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
+    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+      return {
+        status: 429,
+        body: { error: "Too many sign-in attempts. Please try again later." }
+      };
+    }
+    await this.rateLimiter.record(rateLimitKey);
+    const storedUser = await this.userStore.findByEmail(body.email);
+    if (storedUser === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid email or password." }
+      };
+    }
+    const passwordValid = await verifyPassword(
+      body.password,
+      storedUser.passwordHash,
+      storedUser.salt
+    );
+    if (!passwordValid) {
+      return {
+        status: 401,
+        body: { error: "Invalid email or password." }
+      };
+    }
+    await this.rateLimiter.reset(rateLimitKey);
+    const deviceId = body.deviceId ?? `device-${storedUser.id}`;
+    await this.userStore.registerDevice({
+      id: deviceId,
+      userId: storedUser.id,
+      publicKey: body.devicePublicKey ?? "",
+      name: body.deviceId ? "Device" : "Browser"
+    });
+    const tokens = this.tokenManager.issueTokens(storedUser.id, deviceId);
+    const user = {
+      id: storedUser.id,
+      email: storedUser.email,
+      name: storedUser.name,
+      emailVerified: storedUser.emailVerified,
+      createdAt: storedUser.createdAt
+    };
+    return {
+      status: 200,
+      body: { data: { user, tokens } }
     };
-    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Issue a complete set of authentication tokens.
+   * Handle token refresh (POST /auth/refresh).
    *
-   * Always issues an access token and refresh token. If a `publicKeyThumbprint`
-   * is provided, also issues a device credential.
+   * Validates the provided refresh token and issues a new token pair
+   * (refresh token rotation with reuse detection). The old refresh token
+   * is marked as consumed in the revocation store.
    *
-   * @param userId - The subject (user ID) to encode in the tokens
-   * @param deviceId - The device ID of the requesting device
-   * @param publicKeyThumbprint - Optional SHA-256 thumbprint of the device's public key.
-   *   When provided, a device credential is included in the returned tokens.
-   * @returns An {@link AuthTokens} object containing the issued tokens
+   * @param body - Refresh request body
+   * @param body.refreshToken - The current refresh token
+   * @returns Auth response with new tokens, or an error
    */
-  issueTokens(userId, deviceId, publicKeyThumbprint) {
-    const tokens = {
-      accessToken: this.issueAccessToken(userId, deviceId),
-      refreshToken: this.issueRefreshToken(userId, deviceId)
-    };
-    if (publicKeyThumbprint !== void 0) {
-      tokens.deviceCredential = this.issueDeviceCredential(
-        userId,
-        deviceId,
-        publicKeyThumbprint
-      );
+  async handleRefresh(body) {
+    const result = await this.tokenManager.refreshAccessToken(body.refreshToken);
+    if (result === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired refresh token." }
+      };
     }
-    return tokens;
+    return {
+      status: 200,
+      body: { data: result }
+    };
   }
   /**
-   * Validate and decode a token.
+   * Handle sign-out (POST /auth/signout).
    *
-   * Verifies the HMAC-SHA256 signature (trying all configured secrets for key rotation),
-   * checks that the token has not expired, and validates all required claims.
-   * Returns null (rather than throwing) for invalid or expired tokens, so callers
-   * can handle authentication failure without try/catch.
+   * Validates the access token and revokes the current refresh token
+   * (if a revocation store is configured). This ensures that stolen
+   * refresh tokens cannot be used after the user signs out.
    *
-   * @param token - The JWT string to validate
-   * @returns The decoded {@link TokenPayload} if valid, or null if the token is
-   *   invalid, expired, or missing required claims
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param body - Sign-out request body
+   * @param body.refreshToken - The current refresh token to revoke
+   * @returns Auth response with success flag, or an error
    */
-  validateToken(token) {
-    let decoded = null;
-    for (const secret of this.secrets) {
-      decoded = verifyJwt(token, secret);
-      if (decoded !== null) {
-        break;
-      }
-    }
-    if (decoded === null) {
-      return null;
-    }
-    if (isExpired(decoded)) {
-      return null;
-    }
-    if (typeof decoded["jti"] !== "string" || typeof decoded["sub"] !== "string" || typeof decoded["dev"] !== "string" || typeof decoded["type"] !== "string" || typeof decoded["iat"] !== "number" || typeof decoded["exp"] !== "number") {
-      return null;
+  async handleSignOut(accessToken, body) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    const type = decoded["type"];
-    if (type !== "access" && type !== "refresh" && type !== "device_credential") {
-      return null;
+    await this.tokenManager.revokeToken(payload.jti, payload.exp);
+    if (body.refreshToken) {
+      const refreshPayload = this.tokenManager.validateToken(body.refreshToken);
+      if (refreshPayload !== null && refreshPayload.type === "refresh") {
+        await this.tokenManager.revokeToken(refreshPayload.jti, refreshPayload.exp);
+      }
     }
     return {
-      jti: decoded["jti"],
-      sub: decoded["sub"],
-      dev: decoded["dev"],
-      type,
-      iat: decoded["iat"],
-      exp: decoded["exp"]
+      status: 200,
+      body: { data: { success: true } }
     };
   }
   /**
-   * Validate a token and check it against the revocation store.
+   * Handle get-current-user (GET /auth/me).
    *
-   * Like {@link validateToken}, but also checks whether the token's `jti` has been
-   * revoked. Requires a revocation store to be configured.
+   * Validates the access token and returns the authenticated user's profile.
    *
-   * @param token - The JWT string to validate
-   * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @returns Auth response with the user profile, or an error
    */
-  async validateTokenWithRevocation(token) {
-    const payload = this.validateToken(token);
-    if (payload === null) {
-      return null;
-    }
-    if (this.revocationStore) {
-      const revoked = await this.revocationStore.isRevoked(payload.jti);
-      if (revoked) {
-        return null;
-      }
+  async handleGetMe(accessToken) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    return payload;
+    const storedUser = await this.userStore.findById(payload.sub);
+    if (storedUser === null) {
+      return {
+        status: 404,
+        body: { error: "User not found." }
+      };
+    }
+    const user = {
+      id: storedUser.id,
+      email: storedUser.email,
+      name: storedUser.name,
+      emailVerified: storedUser.emailVerified,
+      createdAt: storedUser.createdAt
+    };
+    return {
+      status: 200,
+      body: { data: user }
+    };
   }
   /**
-   * Revoke a specific token by its JWT ID.
+   * Handle list-devices (GET /auth/devices).
    *
-   * Requires a revocation store to be configured. After revocation, the token
-   * will be rejected by {@link validateTokenWithRevocation}.
+   * Validates the access token and returns all devices registered for the user.
    *
-   * @param jti - The JWT ID of the token to revoke
-   * @param expiresAt - The token's expiration time (seconds since epoch)
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @returns Auth response with the device list, or an error
    */
-  async revokeToken(jti, expiresAt) {
-    if (this.revocationStore) {
-      await this.revocationStore.revoke(jti, expiresAt);
+  async handleListDevices(accessToken) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
+    const devices = await this.userStore.listDevices(payload.sub);
+    return {
+      status: 200,
+      body: { data: devices }
+    };
   }
   /**
-   * Revoke all tokens for a specific device.
+   * Handle device revocation (DELETE /auth/device/:id).
    *
-   * Called when a device is revoked to ensure all its existing tokens
-   * (access, refresh, and device credentials) are invalidated.
+   * Validates the access token, revokes the specified device, and invalidates
+   * all tokens issued to that device. Only the device's owner can revoke it.
    *
-   * @param deviceId - The device ID whose tokens should be revoked
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param deviceId - The ID of the device to revoke
+   * @returns Auth response with success flag, or an error
    */
-  async revokeDeviceTokens(deviceId) {
-    if (this.revocationStore) {
-      await this.revocationStore.revokeAllForDevice(deviceId);
+  async handleRevokeDevice(accessToken, deviceId) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const device = await this.userStore.findDevice(deviceId);
+    if (device === null) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.userId !== payload.sub) {
+      return {
+        status: 403,
+        body: { error: "You can only revoke your own devices." }
+      };
     }
+    await this.userStore.revokeDevice(deviceId);
+    await this.tokenManager.revokeDeviceTokens(deviceId);
+    return {
+      status: 200,
+      body: { data: { success: true } }
+    };
   }
   /**
-   * Refresh an access token using a valid refresh token.
-   *
-   * Implements **refresh token rotation with reuse detection**: a new refresh token
-   * is issued alongside the new access token. The old refresh token's `jti` is
-   * recorded in the revocation store (if configured). If a previously consumed
-   * refresh token is presented again, it indicates potential token theft.
+   * Handle device registration (POST /auth/device/register).
    *
-   * Returns null if the provided token is invalid, expired, or not a refresh token.
+   * Requires a valid access token. Registers a new device for the authenticated
+   * user and issues a device credential token bound to the device's public key.
    *
-   * @param refreshToken - The refresh token JWT string
-   * @returns A new access/refresh token pair, or null if the refresh token is invalid
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param body - Device registration request body
+   * @param body.deviceId - Unique identifier for the device
+   * @param body.publicKey - The device's public key as a JWK JSON string
+   * @param body.name - Human-readable device name (e.g., "Chrome on MacBook")
+   * @returns Auth response with the registered device and device credential, or an error
    */
-  async refreshAccessToken(refreshToken) {
-    const payload = this.validateToken(refreshToken);
-    if (payload === null) {
-      return null;
+  async handleDeviceRegister(accessToken, body) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    if (payload.type !== "refresh") {
-      return null;
+    const deviceName = sanitizeName(body.name);
+    if (deviceName.length === 0) {
+      return {
+        status: 400,
+        body: { error: "Device name must not be empty." }
+      };
     }
-    if (this.revocationStore) {
-      const wasRevoked = await this.revocationStore.isRevoked(payload.jti);
-      if (wasRevoked) {
-        await this.revocationStore.revokeAllForDevice(payload.dev);
-        return null;
-      }
-      await this.revocationStore.revoke(payload.jti, payload.exp);
+    let publicKeyJwk;
+    try {
+      publicKeyJwk = JSON.parse(body.publicKey);
+    } catch {
+      return {
+        status: 400,
+        body: { error: "Invalid public key format. Expected a JSON-encoded JWK string." }
+      };
+    }
+    let thumbprint;
+    try {
+      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
+    } catch {
+      return {
+        status: 400,
+        body: {
+          error: "Failed to compute public key thumbprint. Ensure the key is a valid EC P-256 JWK."
+        }
+      };
     }
+    const device = await this.userStore.registerDevice({
+      id: body.deviceId,
+      userId: payload.sub,
+      publicKey: body.publicKey,
+      name: deviceName
+    });
+    const deviceCredential = this.tokenManager.issueDeviceCredential(
+      payload.sub,
+      body.deviceId,
+      thumbprint
+    );
     return {
-      accessToken: this.issueAccessToken(payload.sub, payload.dev),
-      refreshToken: this.issueRefreshToken(payload.sub, payload.dev)
+      status: 201,
+      body: { data: { device, deviceCredential } }
     };
   }
-};
-
-// src/provider/built-in/user-store.ts
-import { KoraError as KoraError2 } from "@korajs/core";
-import { randomUUID as randomUUID2 } from "crypto";
-var DuplicateEmailError = class extends KoraError2 {
-  constructor() {
-    super(
-      "A user with this email already exists.",
-      "DUPLICATE_EMAIL"
-    );
-    this.name = "DuplicateEmailError";
-  }
-};
-var InMemoryUserStore = class {
-  /** Users indexed by ID */
-  usersById = /* @__PURE__ */ new Map();
-  /** Users indexed by email (lowercase) for fast lookup */
-  usersByEmail = /* @__PURE__ */ new Map();
-  /** Devices indexed by device ID */
-  devicesById = /* @__PURE__ */ new Map();
-  /** Device IDs indexed by user ID for fast listing */
-  devicesByUserId = /* @__PURE__ */ new Map();
   /**
-   * Create a new user account.
+   * Generate a challenge for device proof-of-possession verification.
    *
-   * @param params - User creation parameters
-   * @param params.email - The user's email address (must be unique, case-insensitive)
-   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
-   * @param params.salt - Hex-encoded salt used during hashing
-   * @param params.name - The user's display name
-   * @returns The created user (without sensitive credential fields)
-   * @throws {DuplicateEmailError} If a user with the same email already exists
+   * Creates a cryptographically random challenge, stores it server-side with
+   * a 60-second TTL and the target device ID, and returns the challenge string.
+   * The client signs this challenge with its private key and submits it via
+   * {@link handleDeviceVerify}.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param deviceId - The device this challenge is intended for
+   * @returns Auth response with the challenge string, or an error
    */
-  async createUser(params) {
-    const normalizedEmail = params.email.toLowerCase();
-    if (this.usersByEmail.has(normalizedEmail)) {
-      throw new DuplicateEmailError();
+  async handleDeviceChallenge(accessToken, deviceId) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    const now = Date.now();
-    const id = randomUUID2();
-    const storedUser = {
-      id,
-      email: normalizedEmail,
-      name: params.name,
-      emailVerified: false,
-      createdAt: now,
-      passwordHash: params.passwordHash,
-      salt: params.salt
+    const device = await this.userStore.findDevice(deviceId);
+    if (device === null || device.userId !== payload.sub) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.revoked) {
+      return {
+        status: 403,
+        body: { error: "Device has been revoked." }
+      };
+    }
+    const challenge = randomBytes(32).toString("hex");
+    const expiresAt = Date.now() + CHALLENGE_TTL_MS;
+    await this.challengeStore.store(challenge, deviceId, expiresAt);
+    return {
+      status: 200,
+      body: { data: { challenge } }
     };
-    this.usersById.set(id, storedUser);
-    this.usersByEmail.set(normalizedEmail, storedUser);
-    return toAuthUser(storedUser);
   }
   /**
-   * Find a user by email address.
+   * Handle device proof-of-possession verification (POST /auth/device/verify).
    *
-   * @param email - The email to search for (case-insensitive)
-   * @returns The stored user record including credentials, or null if not found
-   */
-  async findByEmail(email) {
-    return this.usersByEmail.get(email.toLowerCase()) ?? null;
-  }
-  /**
-   * Find a user by ID.
-   *
-   * @param id - The user ID to search for
-   * @returns The stored user record including credentials, or null if not found
-   */
-  async findById(id) {
-    return this.usersById.get(id) ?? null;
-  }
-  /**
-   * Register a device for a user.
-   *
-   * If a device with the same ID already exists and is not revoked, it is
-   * returned as-is (idempotent registration). If it was previously revoked,
-   * it is re-activated with updated details.
-   *
-   * @param params - Device registration parameters
-   * @param params.id - Unique device identifier
-   * @param params.userId - ID of the user who owns the device
-   * @param params.publicKey - Base64url-encoded device public key or thumbprint
-   * @param params.name - Human-readable device name
-   * @returns The registered device record
-   */
-  async registerDevice(params) {
-    const existing = this.devicesById.get(params.id);
-    if (existing !== void 0 && !existing.revoked) {
-      return existing;
-    }
-    const now = Date.now();
-    const device = {
-      id: params.id,
-      userId: params.userId,
-      publicKey: params.publicKey,
-      name: params.name,
-      revoked: false,
-      createdAt: now,
-      lastSeenAt: now
-    };
-    this.devicesById.set(params.id, device);
-    let userDevices = this.devicesByUserId.get(params.userId);
-    if (userDevices === void 0) {
-      userDevices = /* @__PURE__ */ new Set();
-      this.devicesByUserId.set(params.userId, userDevices);
-    }
-    userDevices.add(params.id);
-    return device;
-  }
-  /**
-   * Find a device by its ID.
-   *
-   * @param deviceId - The device ID to search for
-   * @returns The device record, or null if not found
-   */
-  async findDevice(deviceId) {
-    return this.devicesById.get(deviceId) ?? null;
-  }
-  /**
-   * List all devices registered for a user.
-   *
-   * @param userId - The user ID whose devices to list
-   * @returns Array of device records (includes revoked devices)
-   */
-  async listDevices(userId) {
-    const deviceIds = this.devicesByUserId.get(userId);
-    if (deviceIds === void 0) {
-      return [];
-    }
-    const devices = [];
-    for (const deviceId of deviceIds) {
-      const device = this.devicesById.get(deviceId);
-      if (device !== void 0) {
-        devices.push(device);
-      }
-    }
-    return devices;
-  }
-  /**
-   * Revoke a device, preventing it from being used for authentication.
-   *
-   * This is a soft revoke — the device record remains but is marked as revoked.
-   * If the device does not exist, this is a no-op.
-   *
-   * @param deviceId - The ID of the device to revoke
-   */
-  async revokeDevice(deviceId) {
-    const device = this.devicesById.get(deviceId);
-    if (device !== void 0) {
-      device.revoked = true;
-    }
-  }
-  /**
-   * Set a user's email verification status.
-   *
-   * @param userId - The user whose email to verify
-   * @param verified - Whether the email is verified
-   */
-  async setEmailVerified(userId, verified) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    const updated = { ...user, emailVerified: verified };
-    this.usersById.set(userId, updated);
-    this.usersByEmail.set(user.email, updated);
-  }
-  /**
-   * Update a user's password hash and salt.
-   *
-   * @param userId - The user whose password to update
-   * @param passwordHash - New hex-encoded PBKDF2 derived key
-   * @param salt - New hex-encoded salt
-   */
-  async updatePassword(userId, passwordHash, salt) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    const updated = { ...user, passwordHash, salt };
-    this.usersById.set(userId, updated);
-    this.usersByEmail.set(user.email, updated);
-  }
-  /**
-   * List all users. For admin/development use.
-   */
-  async listAll() {
-    return [...this.usersById.values()];
-  }
-  /**
-   * Update a stored user record.
-   */
-  async update(user) {
-    const existing = this.usersById.get(user.id);
-    if (!existing) return;
-    if (existing.email !== user.email) {
-      this.usersByEmail.delete(existing.email);
-      this.usersByEmail.set(user.email, user);
-    } else {
-      this.usersByEmail.set(user.email, user);
-    }
-    this.usersById.set(user.id, user);
-  }
-  /**
-   * Delete a user and all associated devices.
-   */
-  async delete(userId) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    this.usersById.delete(userId);
-    this.usersByEmail.delete(user.email);
-    const deviceIds = this.devicesByUserId.get(userId);
-    if (deviceIds) {
-      for (const deviceId of deviceIds) {
-        this.devicesById.delete(deviceId);
-      }
-      this.devicesByUserId.delete(userId);
-    }
-  }
-  /**
-   * Update the last-seen timestamp for a device.
+   * Verifies that the device holds the private key corresponding to its registered
+   * public key by checking a signed challenge. The challenge must have been previously
+   * issued via {@link handleDeviceChallenge} and is single-use.
    *
-   * Called when a device authenticates or syncs to track activity.
-   * If the device does not exist, this is a no-op.
+   * On success, issues fresh tokens for the device.
    *
-   * @param deviceId - The ID of the device to update
-   */
-  async touchDevice(deviceId) {
-    const device = this.devicesById.get(deviceId);
-    if (device !== void 0) {
-      device.lastSeenAt = Date.now();
-    }
-  }
-};
-function toAuthUser(stored) {
-  return {
-    id: stored.id,
-    email: stored.email,
-    name: stored.name,
-    emailVerified: stored.emailVerified,
-    createdAt: stored.createdAt
-  };
-}
-
-// src/provider/built-in/auth-routes.ts
-var InMemoryChallengeStore = class {
-  challenges = /* @__PURE__ */ new Map();
-  async store(challenge, deviceId, expiresAt) {
-    this.challenges.set(challenge, { deviceId, expiresAt });
-  }
-  async consume(challenge) {
-    const entry = this.challenges.get(challenge);
-    if (entry === void 0) {
-      return null;
-    }
-    this.challenges.delete(challenge);
-    if (Date.now() > entry.expiresAt) {
-      return null;
-    }
-    return { deviceId: entry.deviceId };
-  }
-  /**
-   * Remove expired challenges to prevent unbounded memory growth.
+   * @param body - Device verification request body
+   * @param body.deviceId - The ID of the device to verify
+   * @param body.challenge - The challenge string (from handleDeviceChallenge)
+   * @param body.signature - The base64url-encoded ECDSA signature of the challenge
+   * @returns Auth response with fresh tokens on success, or an error
    */
-  cleanup() {
-    const now = Date.now();
-    for (const [challenge, entry] of this.challenges) {
-      if (now > entry.expiresAt) {
-        this.challenges.delete(challenge);
-      }
+  async handleDeviceVerify(body) {
+    const challengeEntry = await this.challengeStore.consume(body.challenge);
+    if (challengeEntry === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired challenge. Request a new challenge and try again." }
+      };
     }
-  }
-};
-var InMemoryRateLimiter = class {
-  attempts = /* @__PURE__ */ new Map();
-  maxAttempts;
-  windowMs;
-  /**
-   * @param maxAttempts - Maximum number of attempts within the time window (default: 10)
-   * @param windowMs - Time window in milliseconds (default: 60,000 = 1 minute)
-   */
-  constructor(maxAttempts = 10, windowMs = 6e4) {
-    this.maxAttempts = maxAttempts;
-    this.windowMs = windowMs;
-  }
-  async isAllowed(key) {
-    const now = Date.now();
-    const attempts = this.attempts.get(key) ?? [];
-    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
-    return recentAttempts.length < this.maxAttempts;
-  }
-  async record(key) {
-    const now = Date.now();
-    const attempts = this.attempts.get(key) ?? [];
-    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
-    recentAttempts.push(now);
-    this.attempts.set(key, recentAttempts);
-  }
-  async reset(key) {
-    this.attempts.delete(key);
-  }
-};
-var MIN_PASSWORD_LENGTH = 8;
-var MAX_PASSWORD_LENGTH = 128;
-var MAX_NAME_LENGTH = 200;
-var CHALLENGE_TTL_MS = 6e4;
-function isValidEmail(email) {
-  if (email.length === 0 || email.length > 254) {
-    return false;
-  }
-  const atIndex = email.indexOf("@");
-  if (atIndex < 1) {
-    return false;
-  }
-  const domain = email.slice(atIndex + 1);
-  if (domain.length === 0 || !domain.includes(".")) {
-    return false;
-  }
-  if (email.indexOf("@", atIndex + 1) !== -1) {
-    return false;
-  }
-  if (email.includes(" ")) {
-    return false;
-  }
-  return true;
-}
-function sanitizeName(name) {
-  const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
-  const trimmed = cleaned.trim();
-  if (trimmed.length > MAX_NAME_LENGTH) {
-    return trimmed.slice(0, MAX_NAME_LENGTH);
-  }
-  return trimmed;
-}
-var BuiltInAuthRoutes = class {
-  userStore;
-  tokenManager;
-  challengeStore;
-  rateLimiter;
-  constructor(config) {
-    this.userStore = config.userStore;
-    this.tokenManager = config.tokenManager;
-    this.challengeStore = config.challengeStore ?? new InMemoryChallengeStore();
-    this.rateLimiter = config.rateLimiter ?? new InMemoryRateLimiter();
-  }
-  /**
-   * Handle user sign-up (POST /auth/signup).
-   *
-   * Validates email format and password length, hashes the password,
-   * creates the user, optionally registers a device, and issues tokens.
-   *
-   * @param body - Sign-up request body
-   * @param body.email - The user's email address
-   * @param body.password - The plaintext password (8-128 characters)
-   * @param body.name - Optional display name (defaults to email local part)
-   * @param body.deviceId - Optional device ID to register
-   * @param body.devicePublicKey - Optional device public key (base64url)
-   * @param clientIp - Optional client IP for rate limiting
-   * @returns Auth response with the created user and tokens, or an error
-   */
-  async handleSignUp(body, clientIp) {
-    const rateLimitKey = clientIp ?? "global";
-    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+    if (challengeEntry.deviceId !== body.deviceId) {
+      return {
+        status: 401,
+        body: { error: "Challenge was not issued for this device." }
+      };
+    }
+    const device = await this.userStore.findDevice(body.deviceId);
+    if (device === null) {
       return {
-        status: 429,
-        body: { error: "Too many requests. Please try again later." }
+        status: 404,
+        body: { error: "Device not found." }
       };
     }
-    await this.rateLimiter.record(rateLimitKey);
-    if (!isValidEmail(body.email)) {
+    if (device.revoked) {
       return {
-        status: 400,
-        body: {
-          error: "Invalid email address. Please provide a valid email in the format user@domain.com."
-        }
+        status: 403,
+        body: { error: "Device has been revoked and cannot authenticate." }
       };
     }
-    if (body.password.length < MIN_PASSWORD_LENGTH) {
+    let publicKeyJwk;
+    try {
+      publicKeyJwk = JSON.parse(device.publicKey);
+    } catch {
       return {
-        status: 400,
-        body: {
-          error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long.`
-        }
+        status: 500,
+        body: { error: "Device has an invalid stored public key." }
       };
     }
-    if (body.password.length > MAX_PASSWORD_LENGTH) {
+    let isValid;
+    try {
+      isValid = await verifyChallenge(publicKeyJwk, body.challenge, body.signature);
+    } catch {
       return {
         status: 400,
         body: {
-          error: `Password must be at most ${MAX_PASSWORD_LENGTH} characters long.`
+          error: "Signature verification failed. The signature or public key format may be invalid."
         }
       };
     }
-    const { hash, salt } = await hashPassword(body.password);
-    const rawName = body.name ?? body.email.split("@")[0] ?? body.email;
-    const name = sanitizeName(rawName);
-    let user;
-    try {
-      user = await this.userStore.createUser({
-        email: body.email,
-        passwordHash: hash,
-        salt,
-        name
-      });
-    } catch (err) {
-      if (err instanceof Error && err.name === "DuplicateEmailError") {
-        return {
-          status: 409,
-          body: { error: "An account with this email already exists." }
-        };
-      }
-      throw err;
+    if (!isValid) {
+      return {
+        status: 401,
+        body: { error: "Invalid signature. Proof-of-possession verification failed." }
+      };
     }
-    const deviceId = body.deviceId ?? `device-${user.id}`;
-    if (body.deviceId !== void 0 && body.devicePublicKey !== void 0) {
-      await this.userStore.registerDevice({
-        id: body.deviceId,
-        userId: user.id,
-        publicKey: body.devicePublicKey,
-        name: "Primary Device"
-      });
+    let thumbprint;
+    try {
+      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
+    } catch {
+      return {
+        status: 500,
+        body: { error: "Failed to compute public key thumbprint." }
+      };
     }
-    const tokens = this.tokenManager.issueTokens(user.id, deviceId);
+    const tokens = this.tokenManager.issueTokens(device.userId, device.id, thumbprint);
     return {
-      status: 201,
-      body: { data: { user, tokens } }
+      status: 200,
+      body: { data: { tokens } }
     };
   }
   /**
-   * Handle user sign-in (POST /auth/signin).
+   * Generates a random challenge string for proof-of-possession verification.
    *
-   * Looks up the user by email, verifies the password, optionally registers
-   * a new device, and issues tokens.
+   * **Deprecated:** Use {@link handleDeviceChallenge} instead, which stores
+   * the challenge server-side with expiry and single-use semantics.
    *
-   * @param body - Sign-in request body
-   * @param body.email - The user's email address
-   * @param body.password - The plaintext password
-   * @param body.deviceId - Optional device ID to register
-   * @param body.devicePublicKey - Optional device public key (base64url)
-   * @param clientIp - Optional client IP for rate limiting
-   * @returns Auth response with the user and tokens, or an error
+   * @returns A 64-character hex string (32 random bytes)
    */
-  async handleSignIn(body, clientIp) {
-    const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
-    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
-      return {
-        status: 429,
-        body: { error: "Too many sign-in attempts. Please try again later." }
-      };
-    }
-    await this.rateLimiter.record(rateLimitKey);
-    const storedUser = await this.userStore.findByEmail(body.email);
-    if (storedUser === null) {
-      return {
-        status: 401,
-        body: { error: "Invalid email or password." }
-      };
-    }
-    const passwordValid = await verifyPassword(
-      body.password,
-      storedUser.passwordHash,
-      storedUser.salt
-    );
-    if (!passwordValid) {
-      return {
-        status: 401,
-        body: { error: "Invalid email or password." }
-      };
-    }
-    await this.rateLimiter.reset(rateLimitKey);
-    const deviceId = body.deviceId ?? `device-${storedUser.id}`;
-    if (body.deviceId !== void 0 && body.devicePublicKey !== void 0) {
-      await this.userStore.registerDevice({
-        id: body.deviceId,
-        userId: storedUser.id,
-        publicKey: body.devicePublicKey,
-        name: "Device"
-      });
-    }
-    const tokens = this.tokenManager.issueTokens(storedUser.id, deviceId);
-    const user = {
-      id: storedUser.id,
-      email: storedUser.email,
-      name: storedUser.name,
-      emailVerified: storedUser.emailVerified,
-      createdAt: storedUser.createdAt
-    };
+  static generateChallenge() {
+    return randomBytes(32).toString("hex");
+  }
+  /**
+   * Creates a sync server auth provider compatible with `@korajs/server`.
+   *
+   * The returned object implements the `AuthProvider` interface from
+   * `@korajs/server`, validating access tokens and returning an auth
+   * context containing the user ID and device metadata. This bridges
+   * the built-in auth system with the sync server's authentication layer.
+   *
+   * Also checks device revocation status during authentication, ensuring
+   * that revoked devices are rejected even if their tokens haven't expired.
+   *
+   * @returns An object with an `authenticate` method suitable for KoraSyncServer's `auth` config
+   *
+   * @example
+   * ```typescript
+   * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+   * const syncServer = new KoraSyncServer({
+   *   store,
+   *   auth: routes.toSyncAuthProvider(),
+   * })
+   * ```
+   */
+  toSyncAuthProvider() {
+    const tokenManager = this.tokenManager;
+    const userStore = this.userStore;
     return {
-      status: 200,
-      body: { data: { user, tokens } }
+      async authenticate(token) {
+        const payload = tokenManager.validateToken(token);
+        if (payload === null || payload.type !== "access") {
+          return null;
+        }
+        const user = await userStore.findById(payload.sub);
+        if (user === null) {
+          return null;
+        }
+        const device = await userStore.findDevice(payload.dev);
+        if (device?.revoked) {
+          return null;
+        }
+        await userStore.touchDevice(payload.dev);
+        return {
+          userId: payload.sub,
+          metadata: {
+            deviceId: payload.dev,
+            email: user.email,
+            name: user.name
+          }
+        };
+      }
     };
   }
+};
+
+// src/tokens/token-manager.ts
+import { randomBytes as randomBytes2, randomUUID } from "crypto";
+
+// src/types.ts
+import { KoraError } from "@korajs/core";
+var DEFAULT_ACCESS_TOKEN_LIFETIME = 15 * 60 * 1e3;
+var DEFAULT_REFRESH_TOKEN_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_DEVICE_CREDENTIAL_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_OFFLINE_DURATION = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_AUTO_LOCK_TIMEOUT = 15 * 60 * 1e3;
+
+// src/tokens/jwt.ts
+import { createHmac } from "crypto";
+function base64urlEncode(input) {
+  return Buffer.from(input, "utf-8").toString("base64url");
+}
+function base64urlDecode(input) {
+  return Buffer.from(input, "base64url").toString("utf-8");
+}
+function hmacSha256Base64url(data, secret) {
+  return createHmac("sha256", secret).update(data).digest("base64url");
+}
+var ENCODED_HEADER = base64urlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+function encodeJwt(payload, secret) {
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const signingInput = `${ENCODED_HEADER}.${encodedPayload}`;
+  const signature = hmacSha256Base64url(signingInput, secret);
+  return `${signingInput}.${signature}`;
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const payloadSegment = parts[1];
+  if (payloadSegment === void 0) {
+    return null;
+  }
+  try {
+    const decoded = base64urlDecode(payloadSegment);
+    const parsed = JSON.parse(decoded);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const headerSegment = parts[0];
+  const payloadSegment = parts[1];
+  const signatureSegment = parts[2];
+  if (headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
+    return null;
+  }
+  if (headerSegment !== ENCODED_HEADER) {
+    return null;
+  }
+  const signingInput = `${headerSegment}.${payloadSegment}`;
+  const expectedSignature = hmacSha256Base64url(signingInput, secret);
+  if (expectedSignature.length !== signatureSegment.length) {
+    return null;
+  }
+  let mismatch = 0;
+  for (let i = 0; i < expectedSignature.length; i++) {
+    mismatch |= expectedSignature.charCodeAt(i) ^ signatureSegment.charCodeAt(i);
+  }
+  if (mismatch !== 0) {
+    return null;
+  }
+  try {
+    const decoded = base64urlDecode(payloadSegment);
+    const parsed = JSON.parse(decoded);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+var CLOCK_SKEW_TOLERANCE_SECONDS = 5;
+function isExpired(payload) {
+  if (typeof payload.exp !== "number") {
+    return false;
+  }
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  return nowSeconds >= payload.exp + CLOCK_SKEW_TOLERANCE_SECONDS;
+}
+
+// src/tokens/token-manager.ts
+var MIN_SECRET_LENGTH = 32;
+var InMemoryTokenRevocationStore = class {
+  revokedTokens = /* @__PURE__ */ new Map();
+  revokedDevices = /* @__PURE__ */ new Set();
+  async isRevoked(jti) {
+    return this.revokedTokens.has(jti);
+  }
+  async revoke(jti, expiresAt) {
+    this.revokedTokens.set(jti, expiresAt);
+  }
+  async revokeAllForDevice(deviceId) {
+    this.revokedDevices.add(deviceId);
+  }
   /**
-   * Handle token refresh (POST /auth/refresh).
-   *
-   * Validates the provided refresh token and issues a new token pair
-   * (refresh token rotation with reuse detection). The old refresh token
-   * is marked as consumed in the revocation store.
-   *
-   * @param body - Refresh request body
-   * @param body.refreshToken - The current refresh token
-   * @returns Auth response with new tokens, or an error
+   * Check if a device has been revoked.
    */
-  async handleRefresh(body) {
-    const result = await this.tokenManager.refreshAccessToken(body.refreshToken);
-    if (result === null) {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired refresh token." }
-      };
-    }
-    return {
-      status: 200,
-      body: { data: result }
-    };
+  isDeviceRevoked(deviceId) {
+    return this.revokedDevices.has(deviceId);
   }
   /**
-   * Handle sign-out (POST /auth/signout).
-   *
-   * Validates the access token and revokes the current refresh token
-   * (if a revocation store is configured). This ensures that stolen
-   * refresh tokens cannot be used after the user signs out.
-   *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param body - Sign-out request body
-   * @param body.refreshToken - The current refresh token to revoke
-   * @returns Auth response with success flag, or an error
+   * Remove expired revocations to prevent unbounded memory growth.
+   * Call periodically (e.g., every hour) in long-running servers.
    */
-  async handleSignOut(accessToken, body) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
+  cleanup() {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    for (const [jti, expiresAt] of this.revokedTokens) {
+      if (nowSeconds > expiresAt) {
+        this.revokedTokens.delete(jti);
+      }
     }
-    await this.tokenManager.revokeToken(payload.jti, payload.exp);
-    if (body.refreshToken) {
-      const refreshPayload = this.tokenManager.validateToken(body.refreshToken);
-      if (refreshPayload !== null && refreshPayload.type === "refresh") {
-        await this.tokenManager.revokeToken(refreshPayload.jti, refreshPayload.exp);
+  }
+};
+var TokenManager = class {
+  /** All signing/verification secrets (index 0 = current signing key) */
+  secrets;
+  accessTokenLifetime;
+  refreshTokenLifetime;
+  deviceCredentialLifetime;
+  revocationStore;
+  constructor(config) {
+    const secrets = Array.isArray(config.secret) ? config.secret : [config.secret];
+    if (secrets.length === 0) {
+      throw new Error("TokenManager requires at least one secret.");
+    }
+    for (const secret of secrets) {
+      if (secret.length < MIN_SECRET_LENGTH) {
+        throw new Error(
+          `JWT secret must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for HMAC-SHA256 security. Received ${secret.length} characters. Use TokenManager.generateSecret() to generate a secure secret.`
+        );
       }
     }
-    return {
-      status: 200,
-      body: { data: { success: true } }
-    };
+    this.secrets = secrets;
+    this.accessTokenLifetime = config.accessTokenLifetime ?? DEFAULT_ACCESS_TOKEN_LIFETIME;
+    this.refreshTokenLifetime = config.refreshTokenLifetime ?? DEFAULT_REFRESH_TOKEN_LIFETIME;
+    this.deviceCredentialLifetime = config.deviceCredentialLifetime ?? DEFAULT_DEVICE_CREDENTIAL_LIFETIME;
+    this.revocationStore = config.revocationStore;
   }
   /**
-   * Handle get-current-user (GET /auth/me).
+   * Generate a cryptographically random secret suitable for HMAC-SHA256 signing.
    *
-   * Validates the access token and returns the authenticated user's profile.
+   * Returns a 64-character hex string (32 bytes / 256 bits of entropy).
+   * Store this securely (environment variable, secrets manager) — never in source code.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @returns Auth response with the user profile, or an error
+   * @returns A random 256-bit hex-encoded secret
    */
-  async handleGetMe(accessToken) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const storedUser = await this.userStore.findById(payload.sub);
-    if (storedUser === null) {
-      return {
-        status: 404,
-        body: { error: "User not found." }
-      };
-    }
-    const user = {
-      id: storedUser.id,
-      email: storedUser.email,
-      name: storedUser.name,
-      emailVerified: storedUser.emailVerified,
-      createdAt: storedUser.createdAt
-    };
-    return {
-      status: 200,
-      body: { data: user }
+  static generateSecret() {
+    return randomBytes2(32).toString("hex");
+  }
+  /**
+   * Issue a signed JWT access token.
+   *
+   * Access tokens are short-lived (default 15 minutes) and used to authorize
+   * API requests. When expired, use {@link refreshAccessToken} with a valid
+   * refresh token to obtain a new one.
+   *
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @returns A signed JWT string with type 'access'
+   */
+  issueAccessToken(userId, deviceId) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const payload = {
+      jti: randomUUID(),
+      sub: userId,
+      dev: deviceId,
+      type: "access",
+      iat: nowSeconds,
+      exp: nowSeconds + Math.floor(this.accessTokenLifetime / 1e3)
     };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Handle list-devices (GET /auth/devices).
+   * Issue a signed JWT refresh token.
    *
-   * Validates the access token and returns all devices registered for the user.
+   * Refresh tokens are longer-lived (default 90 days) and used exclusively
+   * to obtain new access tokens via {@link refreshAccessToken}. They should
+   * be stored securely and never sent to resource APIs.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @returns Auth response with the device list, or an error
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @returns A signed JWT string with type 'refresh'
    */
-  async handleListDevices(accessToken) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const devices = await this.userStore.listDevices(payload.sub);
-    return {
-      status: 200,
-      body: { data: devices }
+  issueRefreshToken(userId, deviceId) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const payload = {
+      jti: randomUUID(),
+      sub: userId,
+      dev: deviceId,
+      type: "refresh",
+      iat: nowSeconds,
+      exp: nowSeconds + Math.floor(this.refreshTokenLifetime / 1e3)
     };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Handle device revocation (DELETE /auth/device/:id).
+   * Issue a signed device credential token.
    *
-   * Validates the access token, revokes the specified device, and invalidates
-   * all tokens issued to that device. Only the device's owner can revoke it.
+   * Device credentials are long-lived tokens bound to a device's public key.
+   * They include a `mustCheckinBy` deadline; if the device does not check in
+   * before this deadline, the credential should be treated as revoked.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param deviceId - The ID of the device to revoke
-   * @returns Auth response with success flag, or an error
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @param publicKeyThumbprint - SHA-256 thumbprint of the device's public key
+   * @returns A signed JWT string with type 'device_credential'
    */
-  async handleRevokeDevice(accessToken, deviceId) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const device = await this.userStore.findDevice(deviceId);
-    if (device === null) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
-    }
-    if (device.userId !== payload.sub) {
-      return {
-        status: 403,
-        body: { error: "You can only revoke your own devices." }
-      };
-    }
-    await this.userStore.revokeDevice(deviceId);
-    await this.tokenManager.revokeDeviceTokens(deviceId);
-    return {
-      status: 200,
-      body: { data: { success: true } }
+  issueDeviceCredential(userId, deviceId, publicKeyThumbprint) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const lifetimeSeconds = Math.floor(this.deviceCredentialLifetime / 1e3);
+    const payload = {
+      jti: randomUUID(),
+      sub: userId,
+      dev: deviceId,
+      type: "device_credential",
+      iat: nowSeconds,
+      exp: nowSeconds + lifetimeSeconds,
+      dpk: publicKeyThumbprint,
+      mustCheckinBy: nowSeconds + lifetimeSeconds
     };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Handle device registration (POST /auth/device/register).
+   * Issue a complete set of authentication tokens.
    *
-   * Requires a valid access token. Registers a new device for the authenticated
-   * user and issues a device credential token bound to the device's public key.
+   * Always issues an access token and refresh token. If a `publicKeyThumbprint`
+   * is provided, also issues a device credential.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param body - Device registration request body
-   * @param body.deviceId - Unique identifier for the device
-   * @param body.publicKey - The device's public key as a JWK JSON string
-   * @param body.name - Human-readable device name (e.g., "Chrome on MacBook")
-   * @returns Auth response with the registered device and device credential, or an error
+   * @param userId - The subject (user ID) to encode in the tokens
+   * @param deviceId - The device ID of the requesting device
+   * @param publicKeyThumbprint - Optional SHA-256 thumbprint of the device's public key.
+   *   When provided, a device credential is included in the returned tokens.
+   * @returns An {@link AuthTokens} object containing the issued tokens
    */
-  async handleDeviceRegister(accessToken, body) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const deviceName = sanitizeName(body.name);
-    if (deviceName.length === 0) {
-      return {
-        status: 400,
-        body: { error: "Device name must not be empty." }
-      };
-    }
-    let publicKeyJwk;
-    try {
-      publicKeyJwk = JSON.parse(body.publicKey);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Invalid public key format. Expected a JSON-encoded JWK string." }
-      };
-    }
-    let thumbprint;
-    try {
-      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Failed to compute public key thumbprint. Ensure the key is a valid EC P-256 JWK." }
-      };
-    }
-    const device = await this.userStore.registerDevice({
-      id: body.deviceId,
-      userId: payload.sub,
-      publicKey: body.publicKey,
-      name: deviceName
-    });
-    const deviceCredential = this.tokenManager.issueDeviceCredential(
-      payload.sub,
-      body.deviceId,
-      thumbprint
-    );
-    return {
-      status: 201,
-      body: { data: { device, deviceCredential } }
+  issueTokens(userId, deviceId, publicKeyThumbprint) {
+    const tokens = {
+      accessToken: this.issueAccessToken(userId, deviceId),
+      refreshToken: this.issueRefreshToken(userId, deviceId)
     };
+    if (publicKeyThumbprint !== void 0) {
+      tokens.deviceCredential = this.issueDeviceCredential(userId, deviceId, publicKeyThumbprint);
+    }
+    return tokens;
   }
   /**
-   * Generate a challenge for device proof-of-possession verification.
+   * Validate and decode a token.
    *
-   * Creates a cryptographically random challenge, stores it server-side with
-   * a 60-second TTL and the target device ID, and returns the challenge string.
-   * The client signs this challenge with its private key and submits it via
-   * {@link handleDeviceVerify}.
+   * Verifies the HMAC-SHA256 signature (trying all configured secrets for key rotation),
+   * checks that the token has not expired, and validates all required claims.
+   * Returns null (rather than throwing) for invalid or expired tokens, so callers
+   * can handle authentication failure without try/catch.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param deviceId - The device this challenge is intended for
-   * @returns Auth response with the challenge string, or an error
+   * @param token - The JWT string to validate
+   * @returns The decoded {@link TokenPayload} if valid, or null if the token is
+   *   invalid, expired, or missing required claims
    */
-  async handleDeviceChallenge(accessToken, deviceId) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
+  validateToken(token) {
+    let decoded = null;
+    for (const secret of this.secrets) {
+      decoded = verifyJwt(token, secret);
+      if (decoded !== null) {
+        break;
+      }
     }
-    const device = await this.userStore.findDevice(deviceId);
-    if (device === null || device.userId !== payload.sub) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
+    if (decoded === null) {
+      return null;
     }
-    if (device.revoked) {
-      return {
-        status: 403,
-        body: { error: "Device has been revoked." }
-      };
+    if (isExpired(decoded)) {
+      return null;
+    }
+    if (typeof decoded.jti !== "string" || typeof decoded.sub !== "string" || typeof decoded.dev !== "string" || typeof decoded.type !== "string" || typeof decoded.iat !== "number" || typeof decoded.exp !== "number") {
+      return null;
+    }
+    const type = decoded.type;
+    if (type !== "access" && type !== "refresh" && type !== "device_credential") {
+      return null;
     }
-    const challenge = randomBytes2(32).toString("hex");
-    const expiresAt = Date.now() + CHALLENGE_TTL_MS;
-    await this.challengeStore.store(challenge, deviceId, expiresAt);
     return {
-      status: 200,
-      body: { data: { challenge } }
+      jti: decoded.jti,
+      sub: decoded.sub,
+      dev: decoded.dev,
+      type,
+      iat: decoded.iat,
+      exp: decoded.exp
     };
   }
   /**
-   * Handle device proof-of-possession verification (POST /auth/device/verify).
-   *
-   * Verifies that the device holds the private key corresponding to its registered
-   * public key by checking a signed challenge. The challenge must have been previously
-   * issued via {@link handleDeviceChallenge} and is single-use.
+   * Validate a token and check it against the revocation store.
    *
-   * On success, issues fresh tokens for the device.
+   * Like {@link validateToken}, but also checks whether the token's `jti` has been
+   * revoked. Requires a revocation store to be configured.
    *
-   * @param body - Device verification request body
-   * @param body.deviceId - The ID of the device to verify
-   * @param body.challenge - The challenge string (from handleDeviceChallenge)
-   * @param body.signature - The base64url-encoded ECDSA signature of the challenge
-   * @returns Auth response with fresh tokens on success, or an error
+   * @param token - The JWT string to validate
+   * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
    */
-  async handleDeviceVerify(body) {
-    const challengeEntry = await this.challengeStore.consume(body.challenge);
-    if (challengeEntry === null) {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired challenge. Request a new challenge and try again." }
-      };
-    }
-    if (challengeEntry.deviceId !== body.deviceId) {
-      return {
-        status: 401,
-        body: { error: "Challenge was not issued for this device." }
-      };
-    }
-    const device = await this.userStore.findDevice(body.deviceId);
-    if (device === null) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
-    }
-    if (device.revoked) {
-      return {
-        status: 403,
-        body: { error: "Device has been revoked and cannot authenticate." }
-      };
-    }
-    let publicKeyJwk;
-    try {
-      publicKeyJwk = JSON.parse(device.publicKey);
-    } catch {
-      return {
-        status: 500,
-        body: { error: "Device has an invalid stored public key." }
-      };
-    }
-    let isValid;
-    try {
-      isValid = await verifyChallenge(publicKeyJwk, body.challenge, body.signature);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Signature verification failed. The signature or public key format may be invalid." }
-      };
-    }
-    if (!isValid) {
-      return {
-        status: 401,
-        body: { error: "Invalid signature. Proof-of-possession verification failed." }
-      };
+  async validateTokenWithRevocation(token) {
+    const payload = this.validateToken(token);
+    if (payload === null) {
+      return null;
     }
-    let thumbprint;
-    try {
-      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
-    } catch {
-      return {
-        status: 500,
-        body: { error: "Failed to compute public key thumbprint." }
-      };
+    if (this.revocationStore) {
+      const revoked = await this.revocationStore.isRevoked(payload.jti);
+      if (revoked) {
+        return null;
+      }
     }
-    const tokens = this.tokenManager.issueTokens(device.userId, device.id, thumbprint);
-    return {
-      status: 200,
-      body: { data: { tokens } }
-    };
+    return payload;
   }
   /**
-   * Generates a random challenge string for proof-of-possession verification.
+   * Revoke a specific token by its JWT ID.
    *
-   * **Deprecated:** Use {@link handleDeviceChallenge} instead, which stores
-   * the challenge server-side with expiry and single-use semantics.
+   * Requires a revocation store to be configured. After revocation, the token
+   * will be rejected by {@link validateTokenWithRevocation}.
    *
-   * @returns A 64-character hex string (32 random bytes)
+   * @param jti - The JWT ID of the token to revoke
+   * @param expiresAt - The token's expiration time (seconds since epoch)
    */
-  static generateChallenge() {
-    return randomBytes2(32).toString("hex");
+  async revokeToken(jti, expiresAt) {
+    if (this.revocationStore) {
+      await this.revocationStore.revoke(jti, expiresAt);
+    }
   }
   /**
-   * Creates a sync server auth provider compatible with `@korajs/server`.
+   * Revoke all tokens for a specific device.
    *
-   * The returned object implements the `AuthProvider` interface from
-   * `@korajs/server`, validating access tokens and returning an auth
-   * context containing the user ID and device metadata. This bridges
-   * the built-in auth system with the sync server's authentication layer.
+   * Called when a device is revoked to ensure all its existing tokens
+   * (access, refresh, and device credentials) are invalidated.
    *
-   * Also checks device revocation status during authentication, ensuring
-   * that revoked devices are rejected even if their tokens haven't expired.
+   * @param deviceId - The device ID whose tokens should be revoked
+   */
+  async revokeDeviceTokens(deviceId) {
+    if (this.revocationStore) {
+      await this.revocationStore.revokeAllForDevice(deviceId);
+    }
+  }
+  /**
+   * Refresh an access token using a valid refresh token.
    *
-   * @returns An object with an `authenticate` method suitable for KoraSyncServer's `auth` config
+   * Implements **refresh token rotation with reuse detection**: a new refresh token
+   * is issued alongside the new access token. The old refresh token's `jti` is
+   * recorded in the revocation store (if configured). If a previously consumed
+   * refresh token is presented again, it indicates potential token theft.
+   *
+   * Returns null if the provided token is invalid, expired, or not a refresh token.
    *
-   * @example
-   * ```typescript
-   * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
-   * const syncServer = new KoraSyncServer({
-   *   store,
-   *   auth: routes.toSyncAuthProvider(),
-   * })
-   * ```
+   * @param refreshToken - The refresh token JWT string
+   * @returns A new access/refresh token pair, or null if the refresh token is invalid
    */
-  toSyncAuthProvider() {
-    const tokenManager = this.tokenManager;
-    const userStore = this.userStore;
-    return {
-      async authenticate(token) {
-        const payload = tokenManager.validateToken(token);
-        if (payload === null || payload.type !== "access") {
-          return null;
-        }
-        const user = await userStore.findById(payload.sub);
-        if (user === null) {
-          return null;
-        }
-        const device = await userStore.findDevice(payload.dev);
-        if (device !== null && device.revoked) {
-          return null;
-        }
-        await userStore.touchDevice(payload.dev);
-        return {
-          userId: payload.sub,
-          metadata: {
-            deviceId: payload.dev,
-            email: user.email,
-            name: user.name
-          }
-        };
+  async refreshAccessToken(refreshToken) {
+    const payload = this.validateToken(refreshToken);
+    if (payload === null) {
+      return null;
+    }
+    if (payload.type !== "refresh") {
+      return null;
+    }
+    if (this.revocationStore) {
+      const wasRevoked = await this.revocationStore.isRevoked(payload.jti);
+      if (wasRevoked) {
+        await this.revocationStore.revokeAllForDevice(payload.dev);
+        return null;
       }
+      await this.revocationStore.revoke(payload.jti, payload.exp);
+    }
+    return {
+      accessToken: this.issueAccessToken(payload.sub, payload.dev),
+      refreshToken: this.issueRefreshToken(payload.sub, payload.dev)
     };
   }
 };
 
 // src/provider/built-in/password-reset.ts
-import { KoraError as KoraError3 } from "@korajs/core";
-var PasswordResetError = class extends KoraError3 {
+import { KoraError as KoraError2 } from "@korajs/core";
+var PasswordResetError = class extends KoraError2 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "PasswordResetError";
@@ -1379,7 +1134,11 @@ var PasswordResetManager = class {
     const normalizedEmail = email.toLowerCase().trim();
     const successResponse = {
       status: 200,
-      body: { data: { message: "If an account with that email exists, a password reset link has been sent." } }
+      body: {
+        data: {
+          message: "If an account with that email exists, a password reset link has been sent."
+        }
+      }
     };
     const user = await this.userStore.findByEmail(normalizedEmail);
     if (!user) {
@@ -1460,7 +1219,7 @@ var PasswordResetManager = class {
     if (!user) {
       return { status: 404, body: { error: "User not found." } };
     }
-    const { verifyPassword: verifyPassword2 } = await import("./password-hash-HDH6VQCQ.js");
+    const { verifyPassword: verifyPassword2 } = await import("./password-hash-QRBG6BNJ.js");
     const isValid = await verifyPassword2(currentPassword, user.passwordHash, user.salt);
     if (!isValid) {
       return { status: 401, body: { error: "Current password is incorrect." } };
@@ -1481,8 +1240,8 @@ function generateSecureToken() {
 }
 
 // src/provider/built-in/email-verification.ts
-import { KoraError as KoraError4 } from "@korajs/core";
-var EmailVerificationError = class extends KoraError4 {
+import { KoraError as KoraError3 } from "@korajs/core";
+var EmailVerificationError = class extends KoraError3 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "EmailVerificationError";
@@ -1531,104 +1290,343 @@ var InMemoryEmailVerificationStore = class {
         count++;
       }
     }
-    return count;
+    return count;
+  }
+};
+var DEFAULT_TOKEN_TTL_MS2 = 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_REQUESTS2 = 3;
+var EmailVerificationManager = class {
+  userStore;
+  verificationStore;
+  tokenTtlMs;
+  maxRequestsPerUser;
+  onVerificationRequired;
+  constructor(config) {
+    this.userStore = config.userStore;
+    this.verificationStore = config.verificationStore ?? new InMemoryEmailVerificationStore();
+    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS2;
+    this.maxRequestsPerUser = config.maxRequestsPerUser ?? DEFAULT_MAX_REQUESTS2;
+    this.onVerificationRequired = config.onVerificationRequired;
+  }
+  /**
+   * Send a verification email for a user.
+   * Rate-limited to prevent abuse.
+   */
+  async sendVerification(userId, email) {
+    const normalizedEmail = email.toLowerCase().trim();
+    const activeCount = await this.verificationStore.countActiveForUser(userId);
+    if (activeCount >= this.maxRequestsPerUser) {
+      return {
+        status: 429,
+        body: { error: "Too many verification requests. Please try again later." }
+      };
+    }
+    const token = generateSecureToken2();
+    const now = Date.now();
+    const verificationToken = {
+      token,
+      userId,
+      email: normalizedEmail,
+      createdAt: now,
+      expiresAt: now + this.tokenTtlMs,
+      consumed: false
+    };
+    await this.verificationStore.store(verificationToken);
+    if (this.onVerificationRequired) {
+      try {
+        await this.onVerificationRequired(normalizedEmail, token, verificationToken.expiresAt);
+      } catch {
+      }
+    }
+    const responseData = {
+      message: "Verification email sent."
+    };
+    if (!this.onVerificationRequired) {
+      responseData.token = token;
+    }
+    return { status: 200, body: { data: responseData } };
+  }
+  /**
+   * Verify an email using a verification token.
+   */
+  async verifyEmail(token) {
+    const verificationToken = await this.verificationStore.get(token);
+    if (!verificationToken || verificationToken.consumed) {
+      return { status: 404, body: { error: "Verification token not found or already used." } };
+    }
+    if (Date.now() > verificationToken.expiresAt) {
+      await this.verificationStore.consume(token);
+      return { status: 410, body: { error: "Verification token has expired." } };
+    }
+    await this.verificationStore.consume(token);
+    await this.userStore.setEmailVerified(verificationToken.userId, true);
+    return {
+      status: 200,
+      body: {
+        data: {
+          message: "Email verified successfully.",
+          userId: verificationToken.userId,
+          email: verificationToken.email
+        }
+      }
+    };
+  }
+  /**
+   * Resend verification email for a user.
+   * Delegates to sendVerification with rate limiting.
+   */
+  async resendVerification(userId) {
+    const user = await this.userStore.findById(userId);
+    if (!user) {
+      return { status: 404, body: { error: "User not found." } };
+    }
+    return this.sendVerification(userId, user.email);
+  }
+};
+function generateSecureToken2() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/provider/built-in/user-store.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { KoraError as KoraError4 } from "@korajs/core";
+var DuplicateEmailError = class extends KoraError4 {
+  constructor() {
+    super("A user with this email already exists.", "DUPLICATE_EMAIL");
+    this.name = "DuplicateEmailError";
+  }
+};
+var InMemoryUserStore = class {
+  /** Users indexed by ID */
+  usersById = /* @__PURE__ */ new Map();
+  /** Users indexed by email (lowercase) for fast lookup */
+  usersByEmail = /* @__PURE__ */ new Map();
+  /** Devices indexed by device ID */
+  devicesById = /* @__PURE__ */ new Map();
+  /** Device IDs indexed by user ID for fast listing */
+  devicesByUserId = /* @__PURE__ */ new Map();
+  /**
+   * Create a new user account.
+   *
+   * @param params - User creation parameters
+   * @param params.email - The user's email address (must be unique, case-insensitive)
+   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
+   * @param params.salt - Hex-encoded salt used during hashing
+   * @param params.name - The user's display name
+   * @returns The created user (without sensitive credential fields)
+   * @throws {DuplicateEmailError} If a user with the same email already exists
+   */
+  async createUser(params) {
+    const normalizedEmail = params.email.toLowerCase();
+    if (this.usersByEmail.has(normalizedEmail)) {
+      throw new DuplicateEmailError();
+    }
+    const now = Date.now();
+    const id = randomUUID2();
+    const storedUser = {
+      id,
+      email: normalizedEmail,
+      name: params.name,
+      emailVerified: false,
+      createdAt: now,
+      passwordHash: params.passwordHash,
+      salt: params.salt
+    };
+    this.usersById.set(id, storedUser);
+    this.usersByEmail.set(normalizedEmail, storedUser);
+    return toAuthUser(storedUser);
+  }
+  /**
+   * Find a user by email address.
+   *
+   * @param email - The email to search for (case-insensitive)
+   * @returns The stored user record including credentials, or null if not found
+   */
+  async findByEmail(email) {
+    return this.usersByEmail.get(email.toLowerCase()) ?? null;
+  }
+  /**
+   * Find a user by ID.
+   *
+   * @param id - The user ID to search for
+   * @returns The stored user record including credentials, or null if not found
+   */
+  async findById(id) {
+    return this.usersById.get(id) ?? null;
+  }
+  /**
+   * Register a device for a user.
+   *
+   * If a device with the same ID already exists and is not revoked, it is
+   * returned as-is (idempotent registration). If it was previously revoked,
+   * it is re-activated with updated details.
+   *
+   * @param params - Device registration parameters
+   * @param params.id - Unique device identifier
+   * @param params.userId - ID of the user who owns the device
+   * @param params.publicKey - Base64url-encoded device public key or thumbprint
+   * @param params.name - Human-readable device name
+   * @returns The registered device record
+   */
+  async registerDevice(params) {
+    const existing = this.devicesById.get(params.id);
+    if (existing !== void 0 && !existing.revoked) {
+      return existing;
+    }
+    const now = Date.now();
+    const device = {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: now,
+      lastSeenAt: now
+    };
+    this.devicesById.set(params.id, device);
+    let userDevices = this.devicesByUserId.get(params.userId);
+    if (userDevices === void 0) {
+      userDevices = /* @__PURE__ */ new Set();
+      this.devicesByUserId.set(params.userId, userDevices);
+    }
+    userDevices.add(params.id);
+    return device;
   }
-};
-var DEFAULT_TOKEN_TTL_MS2 = 24 * 60 * 60 * 1e3;
-var DEFAULT_MAX_REQUESTS2 = 3;
-var EmailVerificationManager = class {
-  userStore;
-  verificationStore;
-  tokenTtlMs;
-  maxRequestsPerUser;
-  onVerificationRequired;
-  constructor(config) {
-    this.userStore = config.userStore;
-    this.verificationStore = config.verificationStore ?? new InMemoryEmailVerificationStore();
-    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS2;
-    this.maxRequestsPerUser = config.maxRequestsPerUser ?? DEFAULT_MAX_REQUESTS2;
-    this.onVerificationRequired = config.onVerificationRequired;
+  /**
+   * Find a device by its ID.
+   *
+   * @param deviceId - The device ID to search for
+   * @returns The device record, or null if not found
+   */
+  async findDevice(deviceId) {
+    return this.devicesById.get(deviceId) ?? null;
   }
   /**
-   * Send a verification email for a user.
-   * Rate-limited to prevent abuse.
+   * List all devices registered for a user.
+   *
+   * @param userId - The user ID whose devices to list
+   * @returns Array of device records (includes revoked devices)
    */
-  async sendVerification(userId, email) {
-    const normalizedEmail = email.toLowerCase().trim();
-    const activeCount = await this.verificationStore.countActiveForUser(userId);
-    if (activeCount >= this.maxRequestsPerUser) {
-      return { status: 429, body: { error: "Too many verification requests. Please try again later." } };
+  async listDevices(userId) {
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds === void 0) {
+      return [];
     }
-    const token = generateSecureToken2();
-    const now = Date.now();
-    const verificationToken = {
-      token,
-      userId,
-      email: normalizedEmail,
-      createdAt: now,
-      expiresAt: now + this.tokenTtlMs,
-      consumed: false
-    };
-    await this.verificationStore.store(verificationToken);
-    if (this.onVerificationRequired) {
-      try {
-        await this.onVerificationRequired(normalizedEmail, token, verificationToken.expiresAt);
-      } catch {
+    const devices = [];
+    for (const deviceId of deviceIds) {
+      const device = this.devicesById.get(deviceId);
+      if (device !== void 0) {
+        devices.push(device);
       }
     }
-    const responseData = {
-      message: "Verification email sent."
-    };
-    if (!this.onVerificationRequired) {
-      responseData.token = token;
-    }
-    return { status: 200, body: { data: responseData } };
+    return devices;
   }
   /**
-   * Verify an email using a verification token.
+   * Revoke a device, preventing it from being used for authentication.
+   *
+   * This is a soft revoke — the device record remains but is marked as revoked.
+   * If the device does not exist, this is a no-op.
+   *
+   * @param deviceId - The ID of the device to revoke
    */
-  async verifyEmail(token) {
-    const verificationToken = await this.verificationStore.get(token);
-    if (!verificationToken || verificationToken.consumed) {
-      return { status: 404, body: { error: "Verification token not found or already used." } };
+  async revokeDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.revoked = true;
     }
-    if (Date.now() > verificationToken.expiresAt) {
-      await this.verificationStore.consume(token);
-      return { status: 410, body: { error: "Verification token has expired." } };
+  }
+  /**
+   * Set a user's email verification status.
+   *
+   * @param userId - The user whose email to verify
+   * @param verified - Whether the email is verified
+   */
+  async setEmailVerified(userId, verified) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, emailVerified: verified };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
+  }
+  /**
+   * Update a user's password hash and salt.
+   *
+   * @param userId - The user whose password to update
+   * @param passwordHash - New hex-encoded PBKDF2 derived key
+   * @param salt - New hex-encoded salt
+   */
+  async updatePassword(userId, passwordHash, salt) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, passwordHash, salt };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
+  }
+  /**
+   * List all users. For admin/development use.
+   */
+  async listAll() {
+    return [...this.usersById.values()];
+  }
+  /**
+   * Update a stored user record.
+   */
+  async update(user) {
+    const existing = this.usersById.get(user.id);
+    if (!existing) return;
+    if (existing.email !== user.email) {
+      this.usersByEmail.delete(existing.email);
+      this.usersByEmail.set(user.email, user);
+    } else {
+      this.usersByEmail.set(user.email, user);
     }
-    await this.verificationStore.consume(token);
-    await this.userStore.setEmailVerified(verificationToken.userId, true);
-    return {
-      status: 200,
-      body: {
-        data: {
-          message: "Email verified successfully.",
-          userId: verificationToken.userId,
-          email: verificationToken.email
-        }
+    this.usersById.set(user.id, user);
+  }
+  /**
+   * Delete a user and all associated devices.
+   */
+  async delete(userId) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    this.usersById.delete(userId);
+    this.usersByEmail.delete(user.email);
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds) {
+      for (const deviceId of deviceIds) {
+        this.devicesById.delete(deviceId);
       }
-    };
+      this.devicesByUserId.delete(userId);
+    }
   }
   /**
-   * Resend verification email for a user.
-   * Delegates to sendVerification with rate limiting.
+   * Update the last-seen timestamp for a device.
+   *
+   * Called when a device authenticates or syncs to track activity.
+   * If the device does not exist, this is a no-op.
+   *
+   * @param deviceId - The ID of the device to update
    */
-  async resendVerification(userId) {
-    const user = await this.userStore.findById(userId);
-    if (!user) {
-      return { status: 404, body: { error: "User not found." } };
+  async touchDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.lastSeenAt = Date.now();
     }
-    return this.sendVerification(userId, user.email);
   }
 };
-function generateSecureToken2() {
-  const bytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(bytes);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function toAuthUser(stored) {
+  return {
+    id: stored.id,
+    email: stored.email,
+    name: stored.name,
+    emailVerified: stored.emailVerified,
+    createdAt: stored.createdAt
+  };
 }
 
 // src/provider/built-in/sqlite-user-store.ts
@@ -1684,21 +1682,15 @@ var SqliteUserStore = class {
     return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
   }
   async findByEmail(email) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_users WHERE email = ?"
-    ).get(email.toLowerCase());
+    const row = this.db.prepare("SELECT * FROM auth_users WHERE email = ?").get(email.toLowerCase());
     return row ? rowToStoredUser(row) : null;
   }
   async findById(id) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_users WHERE id = ?"
-    ).get(id);
+    const row = this.db.prepare("SELECT * FROM auth_users WHERE id = ?").get(id);
     return row ? rowToStoredUser(row) : null;
   }
   async registerDevice(params) {
-    const existing = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE id = ?"
-    ).get(params.id);
+    const existing = this.db.prepare("SELECT * FROM auth_devices WHERE id = ?").get(params.id);
     if (existing && !existing.revoked) {
       return rowToDevice(existing);
     }
@@ -1725,29 +1717,21 @@ var SqliteUserStore = class {
     };
   }
   async findDevice(deviceId) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE id = ?"
-    ).get(deviceId);
+    const row = this.db.prepare("SELECT * FROM auth_devices WHERE id = ?").get(deviceId);
     return row ? rowToDevice(row) : null;
   }
   async listDevices(userId) {
-    const rows = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE user_id = ?"
-    ).all(userId);
+    const rows = this.db.prepare("SELECT * FROM auth_devices WHERE user_id = ?").all(userId);
     return rows.map(rowToDevice);
   }
   async revokeDevice(deviceId) {
     this.db.prepare("UPDATE auth_devices SET revoked = 1 WHERE id = ?").run(deviceId);
   }
   async setEmailVerified(userId, verified) {
-    this.db.prepare(
-      "UPDATE auth_users SET email_verified = ? WHERE id = ?"
-    ).run(verified ? 1 : 0, userId);
+    this.db.prepare("UPDATE auth_users SET email_verified = ? WHERE id = ?").run(verified ? 1 : 0, userId);
   }
   async updatePassword(userId, passwordHash, salt) {
-    this.db.prepare(
-      "UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?"
-    ).run(passwordHash, salt, userId);
+    this.db.prepare("UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?").run(passwordHash, salt, userId);
   }
   async listAll() {
     const rows = this.db.prepare("SELECT * FROM auth_users").all();
@@ -1768,9 +1752,7 @@ var SqliteUserStore = class {
     deleteInTransaction();
   }
   async touchDevice(deviceId) {
-    this.db.prepare(
-      "UPDATE auth_devices SET last_seen_at = ? WHERE id = ?"
-    ).run(Date.now(), deviceId);
+    this.db.prepare("UPDATE auth_devices SET last_seen_at = ? WHERE id = ?").run(Date.now(), deviceId);
   }
 };
 async function createSqliteUserStore(options) {
@@ -1888,7 +1870,7 @@ var PostgresUserStore = class {
     const existingRows = await this.sql`
 			SELECT * FROM auth_devices WHERE id = ${params.id}
 		`;
-    if (existingRows.length > 0 && !existingRows[0].revoked) {
+    if (existingRows.length > 0 && !existingRows[0]?.revoked) {
       return rowToDevice2(existingRows[0]);
     }
     const now = Date.now();
@@ -1909,7 +1891,7 @@ var PostgresUserStore = class {
       publicKey: params.publicKey,
       name: params.name,
       revoked: false,
-      createdAt: existingRows.length > 0 ? Number(existingRows[0].created_at) : now,
+      createdAt: existingRows.length > 0 ? Number(existingRows[0]?.created_at) : now,
       lastSeenAt: now
     };
   }
@@ -2104,16 +2086,12 @@ var ExternalAuthOperationNotSupportedError = class extends KoraError5 {
 };
 var ExternalTokenValidationError = class extends KoraError5 {
   constructor(reason, context) {
-    super(
-      `External token validation failed: ${reason}`,
-      "AUTH_EXTERNAL_TOKEN_INVALID",
-      context
-    );
+    super(`External token validation failed: ${reason}`, "AUTH_EXTERNAL_TOKEN_INVALID", context);
     this.name = "ExternalTokenValidationError";
   }
 };
 function defaultMapClaims(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     throw new ExternalTokenValidationError(
       'JWT is missing a valid "sub" (subject) claim. The "sub" claim must be a non-empty string identifying the user.',
@@ -2122,8 +2100,8 @@ function defaultMapClaims(claims) {
   }
   return {
     userId: sub,
-    email: typeof claims["email"] === "string" ? claims["email"] : void 0,
-    name: typeof claims["name"] === "string" ? claims["name"] : void 0,
+    email: typeof claims.email === "string" ? claims.email : void 0,
+    name: typeof claims.name === "string" ? claims.name : void 0,
     metadata: void 0
   };
 }
@@ -2322,23 +2300,23 @@ var ExternalJwtProvider = class {
 
 // src/provider/external/clerk-adapter.ts
 function defaultClerkClaimMapping(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     return { userId: "" };
   }
-  const firstName = typeof claims["first_name"] === "string" ? claims["first_name"] : "";
-  const lastName = typeof claims["last_name"] === "string" ? claims["last_name"] : "";
+  const firstName = typeof claims.first_name === "string" ? claims.first_name : "";
+  const lastName = typeof claims.last_name === "string" ? claims.last_name : "";
   const fullName = [firstName, lastName].filter(Boolean).join(" ");
-  const email = typeof claims["email"] === "string" ? claims["email"] : void 0;
+  const email = typeof claims.email === "string" ? claims.email : void 0;
   const metadata = {};
-  if (typeof claims["org_id"] === "string") {
-    metadata["orgId"] = claims["org_id"];
+  if (typeof claims.org_id === "string") {
+    metadata.orgId = claims.org_id;
   }
-  if (typeof claims["org_slug"] === "string") {
-    metadata["orgSlug"] = claims["org_slug"];
+  if (typeof claims.org_slug === "string") {
+    metadata.orgSlug = claims.org_slug;
   }
-  if (typeof claims["org_role"] === "string") {
-    metadata["orgRole"] = claims["org_role"];
+  if (typeof claims.org_role === "string") {
+    metadata.orgRole = claims.org_role;
   }
   return {
     userId: sub,
@@ -2357,30 +2335,30 @@ function createClerkAdapter(config) {
 
 // src/provider/external/supabase-adapter.ts
 function defaultSupabaseClaimMapping(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     return { userId: "" };
   }
-  const email = typeof claims["email"] === "string" ? claims["email"] : void 0;
+  const email = typeof claims.email === "string" ? claims.email : void 0;
   let name;
-  const userMetadata = claims["user_metadata"];
+  const userMetadata = claims.user_metadata;
   if (typeof userMetadata === "object" && userMetadata !== null && !Array.isArray(userMetadata)) {
     const meta = userMetadata;
-    if (typeof meta["full_name"] === "string" && meta["full_name"].length > 0) {
-      name = meta["full_name"];
-    } else if (typeof meta["name"] === "string" && meta["name"].length > 0) {
-      name = meta["name"];
+    if (typeof meta.full_name === "string" && meta.full_name.length > 0) {
+      name = meta.full_name;
+    } else if (typeof meta.name === "string" && meta.name.length > 0) {
+      name = meta.name;
     }
   }
   const metadata = {};
-  if (typeof claims["role"] === "string") {
-    metadata["role"] = claims["role"];
+  if (typeof claims.role === "string") {
+    metadata.role = claims.role;
   }
-  if (typeof claims["aud"] === "string") {
-    metadata["aud"] = claims["aud"];
+  if (typeof claims.aud === "string") {
+    metadata.aud = claims.aud;
   }
-  if (typeof claims["app_metadata"] === "object" && claims["app_metadata"] !== null && !Array.isArray(claims["app_metadata"])) {
-    metadata["appMetadata"] = claims["app_metadata"];
+  if (typeof claims.app_metadata === "object" && claims.app_metadata !== null && !Array.isArray(claims.app_metadata)) {
+    metadata.appMetadata = claims.app_metadata;
   }
   return {
     userId: sub,
@@ -2408,10 +2386,12 @@ var PasskeyVerificationError = class extends KoraError6 {
 };
 function generateRegistrationOptions(params) {
   const challengeBytes = randomBytes3(32);
-  const challenge = toBase64Url(challengeBytes.buffer.slice(
-    challengeBytes.byteOffset,
-    challengeBytes.byteOffset + challengeBytes.byteLength
-  ));
+  const challenge = toBase64Url(
+    challengeBytes.buffer.slice(
+      challengeBytes.byteOffset,
+      challengeBytes.byteOffset + challengeBytes.byteLength
+    )
+  );
   return {
     challenge,
     rpId: params.rpId,
@@ -2521,10 +2501,12 @@ async function verifyRegistrationResponse(params) {
 }
 function generateAuthenticationOptions(params) {
   const challengeBytes = randomBytes3(32);
-  const challenge = toBase64Url(challengeBytes.buffer.slice(
-    challengeBytes.byteOffset,
-    challengeBytes.byteOffset + challengeBytes.byteLength
-  ));
+  const challenge = toBase64Url(
+    challengeBytes.buffer.slice(
+      challengeBytes.byteOffset,
+      challengeBytes.byteOffset + challengeBytes.byteLength
+    )
+  );
   return {
     challenge,
     rpId: params.rpId,
@@ -2579,9 +2561,7 @@ async function verifyAuthenticationResponse(params) {
   }
   const flags = authDataBytes[32];
   if ((flags & 1) === 0) {
-    throw new PasskeyVerificationError(
-      "User Present flag is not set in authenticator data."
-    );
+    throw new PasskeyVerificationError("User Present flag is not set in authenticator data.");
   }
   const signCount = (authDataBytes[33] << 24 | authDataBytes[34] << 16 | authDataBytes[35] << 8 | authDataBytes[36]) >>> 0;
   if (previousSignCount > 0 || signCount > 0) {
@@ -2596,9 +2576,7 @@ async function verifyAuthenticationResponse(params) {
     }
   }
   const clientDataHash = await sha256(clientDataBytes);
-  const signedData = new Uint8Array(
-    authDataBytes.length + clientDataHash.byteLength
-  );
+  const signedData = new Uint8Array(authDataBytes.length + clientDataHash.byteLength);
   signedData.set(authDataBytes, 0);
   signedData.set(new Uint8Array(clientDataHash), authDataBytes.length);
   const coseKeyBytes = fromBase64Url(publicKey);
@@ -2655,10 +2633,9 @@ async function verifyAuthenticationResponse(params) {
       signedData.buffer
     );
   } catch (error) {
-    throw new PasskeyVerificationError(
-      "Signature verification operation failed.",
-      { cause: error instanceof Error ? error.message : String(error) }
-    );
+    throw new PasskeyVerificationError("Signature verification operation failed.", {
+      cause: error instanceof Error ? error.message : String(error)
+    });
   }
   if (!verified) {
     return { verified: false, newSignCount: signCount };
@@ -2681,9 +2658,7 @@ function constantTimeEqual(a, b) {
 function derToP1363(derSignature, componentLength) {
   let offset = 0;
   if (derSignature[offset] !== 48) {
-    throw new PasskeyVerificationError(
-      "Invalid DER signature: expected SEQUENCE tag (0x30)."
-    );
+    throw new PasskeyVerificationError("Invalid DER signature: expected SEQUENCE tag (0x30).");
   }
   offset += 1;
   if (derSignature[offset] & 128) {
@@ -2770,11 +2745,9 @@ var MemberAlreadyExistsError = class extends OrgError {
 };
 var InsufficientRoleError = class extends OrgError {
   constructor(required) {
-    super(
-      `This action requires at least the "${required}" role.`,
-      "INSUFFICIENT_ROLE",
-      { requiredRole: required }
-    );
+    super(`This action requires at least the "${required}" role.`, "INSUFFICIENT_ROLE", {
+      requiredRole: required
+    });
   }
 };
 var CannotRemoveOwnerError = class extends OrgError {
@@ -2984,17 +2957,28 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "Target user ID is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot assign owner role directly. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot assign owner role directly. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
       return { status: 403, body: { error: "Only the owner can add admin members." } };
     }
     try {
-      const membership = await this.store.addMember(orgId, params.targetUserId, params.role, userId);
+      const membership = await this.store.addMember(
+        orgId,
+        params.targetUserId,
+        params.role,
+        userId
+      );
       return { status: 201, body: { data: membership } };
     } catch (err) {
       if (err instanceof OrgNotFoundError) {
@@ -3047,17 +3031,27 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "Target user ID is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot assign owner role directly. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot assign owner role directly. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
       return { status: 403, body: { error: "Only the owner can assign admin role." } };
     }
     try {
-      const membership = await this.store.updateMemberRole(orgId, params.targetUserId, params.role);
+      const membership = await this.store.updateMemberRole(
+        orgId,
+        params.targetUserId,
+        params.role
+      );
       return { status: 200, body: { data: membership } };
     } catch (err) {
       if (err instanceof MembershipNotFoundError) {
@@ -3120,10 +3114,16 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "A valid email address is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot invite with owner role. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot invite with owner role. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
@@ -3570,20 +3570,14 @@ var InvalidPermissionError = class extends RbacError {
 };
 var RoleNotFoundError = class extends RbacError {
   constructor(role) {
-    super(
-      `Role "${role}" is not defined.`,
-      "ROLE_NOT_FOUND",
-      { role }
-    );
+    super(`Role "${role}" is not defined.`, "ROLE_NOT_FOUND", { role });
   }
 };
 var CircularInheritanceError = class extends RbacError {
   constructor(chain) {
-    super(
-      `Circular role inheritance detected: ${chain.join(" \u2192 ")}.`,
-      "CIRCULAR_INHERITANCE",
-      { chain }
-    );
+    super(`Circular role inheritance detected: ${chain.join(" \u2192 ")}.`, "CIRCULAR_INHERITANCE", {
+      chain
+    });
   }
 };
 
@@ -3684,15 +3678,11 @@ var RbacEngine = class {
       permissions
     };
     const scopes = {};
-    const hasAnyRead = permissions.some(
-      (p) => permissionCovers(p, "*:read")
-    );
+    const hasAnyRead = permissions.some((p) => permissionCovers(p, "*:read"));
     if (!hasAnyRead) {
       return scopes;
     }
-    const isReadOnly = !permissions.some(
-      (p) => permissionCovers(p, "*:write")
-    );
+    const isReadOnly = !permissions.some((p) => permissionCovers(p, "*:write"));
     const collectionsToResolve = collections ?? [...this.collectionResolvers.keys()];
     for (const collection of collectionsToResolve) {
       const customResolver = this.collectionResolvers.get(collection);
@@ -3853,21 +3843,13 @@ var OrgScopeResolver = class {
    * Check if a user can write to a specific collection in an org.
    */
   async canWrite(userId, orgId, collection) {
-    return this.rbac.hasPermission(
-      userId,
-      orgId,
-      `${collection}:write`
-    );
+    return this.rbac.hasPermission(userId, orgId, `${collection}:write`);
   }
   /**
    * Check if a user can read from a specific collection in an org.
    */
   async canRead(userId, orgId, collection) {
-    return this.rbac.hasPermission(
-      userId,
-      orgId,
-      `${collection}:read`
-    );
+    return this.rbac.hasPermission(userId, orgId, `${collection}:read`);
   }
   // --- Private ---
   resolveCollectionScope(ctx, collection) {
@@ -3923,7 +3905,9 @@ var OAuthUserInfoError = class extends OAuthError {
 };
 var OAuthProviderNotFoundError = class extends OAuthError {
   constructor(provider) {
-    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", { provider });
+    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", {
+      provider
+    });
   }
 };
 
@@ -4049,9 +4033,7 @@ var OAuthManager = class {
         body: body.toString()
       });
     } catch (err) {
-      throw new OAuthCodeExchangeError(
-        err instanceof Error ? err.message : "Network error"
-      );
+      throw new OAuthCodeExchangeError(err instanceof Error ? err.message : "Network error");
     }
     if (!response.ok) {
       let details = `HTTP ${response.status}`;
@@ -4064,12 +4046,12 @@ var OAuthManager = class {
     }
     const data = await response.json();
     return {
-      accessToken: data["access_token"],
-      tokenType: data["token_type"] ?? "Bearer",
-      expiresIn: data["expires_in"],
-      refreshToken: data["refresh_token"],
-      idToken: data["id_token"],
-      scope: data["scope"]
+      accessToken: data.access_token,
+      tokenType: data.token_type ?? "Bearer",
+      expiresIn: data.expires_in,
+      refreshToken: data.refresh_token,
+      idToken: data.id_token,
+      scope: data.scope
     };
   }
   async fetchUserInfo(provider, accessToken) {
@@ -4082,9 +4064,7 @@ var OAuthManager = class {
         }
       });
     } catch (err) {
-      throw new OAuthUserInfoError(
-        err instanceof Error ? err.message : "Network error"
-      );
+      throw new OAuthUserInfoError(err instanceof Error ? err.message : "Network error");
     }
     if (!response.ok) {
       throw new OAuthUserInfoError(`HTTP ${response.status}`);
@@ -4097,43 +4077,43 @@ function normalizeUserInfo(providerId, profile) {
   switch (providerId) {
     case "google":
       return {
-        providerId: profile["sub"],
+        providerId: profile.sub,
         provider: "google",
-        email: profile["email"] ?? null,
-        emailVerified: profile["email_verified"] ?? false,
-        name: profile["name"] ?? null,
-        avatarUrl: profile["picture"] ?? null,
+        email: profile.email ?? null,
+        emailVerified: profile.email_verified ?? false,
+        name: profile.name ?? null,
+        avatarUrl: profile.picture ?? null,
         rawProfile: profile
       };
     case "github":
       return {
-        providerId: String(profile["id"]),
+        providerId: String(profile.id),
         provider: "github",
-        email: profile["email"] ?? null,
+        email: profile.email ?? null,
         emailVerified: false,
         // GitHub doesn't confirm in the profile response
-        name: profile["name"] ?? profile["login"] ?? null,
-        avatarUrl: profile["avatar_url"] ?? null,
+        name: profile.name ?? profile.login ?? null,
+        avatarUrl: profile.avatar_url ?? null,
         rawProfile: profile
       };
     case "microsoft":
       return {
-        providerId: profile["id"],
+        providerId: profile.id,
         provider: "microsoft",
-        email: profile["mail"] ?? profile["userPrincipalName"] ?? null,
+        email: profile.mail ?? profile.userPrincipalName ?? null,
         emailVerified: false,
-        name: profile["displayName"] ?? null,
+        name: profile.displayName ?? null,
         avatarUrl: null,
         rawProfile: profile
       };
     default:
       return {
-        providerId: String(profile["id"] ?? profile["sub"] ?? ""),
+        providerId: String(profile.id ?? profile.sub ?? ""),
         provider: providerId,
-        email: profile["email"] ?? null,
-        emailVerified: profile["email_verified"] ?? false,
-        name: profile["name"] ?? null,
-        avatarUrl: profile["picture"] ?? profile["avatar_url"] ?? null,
+        email: profile.email ?? null,
+        emailVerified: profile.email_verified ?? false,
+        name: profile.name ?? null,
+        avatarUrl: profile.picture ?? profile.avatar_url ?? null,
         rawProfile: profile
       };
   }
@@ -4410,7 +4390,7 @@ function generateSessionId() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -4625,7 +4605,7 @@ var TotpManager = class {
    */
   async isEnabled(userId) {
     const stored = await this.store.getByUserId(userId);
-    return stored !== null && stored.verified;
+    return stored?.verified ?? false;
   }
   /**
    * Get the number of remaining recovery codes for a user.
@@ -4659,7 +4639,7 @@ function generateTotpCode(secret, counter, digits, algorithm) {
   const hash = hmacSha(algorithm, secret, counterBytes);
   const offset = hash[hash.length - 1] & 15;
   const binary = (hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255;
-  const otp = binary % Math.pow(10, digits);
+  const otp = binary % 10 ** digits;
   return otp.toString().padStart(digits, "0");
 }
 function hmacSha(algorithm, key, message) {
@@ -4703,7 +4683,10 @@ function sha1(data) {
       w[i] = view.getInt32(offset + i * 4, false);
     }
     for (let i = 16; i < 80; i++) {
-      w[i] = rotl32(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16] | 0, 1);
+      w[i] = rotl32(
+        w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16] | 0,
+        1
+      );
     }
     let a = h0;
     let b = h1;
@@ -4812,7 +4795,7 @@ async function hashRecoveryCode(code) {
   const bytes = new Uint8Array(hash);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -5015,8 +4998,9 @@ var InMemoryAuditLogStore = class {
     const initialLength = this.entries.length;
     let writeIndex = 0;
     for (let i = 0; i < this.entries.length; i++) {
-      if (this.entries[i].timestamp >= timestamp) {
-        this.entries[writeIndex] = this.entries[i];
+      const entry = this.entries[i];
+      if (entry.timestamp >= timestamp) {
+        this.entries[writeIndex] = entry;
         writeIndex++;
       }
     }
@@ -5107,7 +5091,7 @@ function generateAuditId() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -5226,9 +5210,7 @@ var WebhookManager = class {
    */
   async dispatch(event, data) {
     const endpoints = await this.store.listEndpoints();
-    const matching = endpoints.filter(
-      (ep) => ep.active && ep.events.includes(event)
-    );
+    const matching = endpoints.filter((ep) => ep.active && ep.events.includes(event));
     const payload = {
       id: generateId2(),
       event,
@@ -5236,9 +5218,7 @@ var WebhookManager = class {
       data
     };
     const payloadJson = JSON.stringify(payload);
-    await Promise.allSettled(
-      matching.map((ep) => this.deliverToEndpoint(ep, payloadJson, event))
-    );
+    await Promise.allSettled(matching.map((ep) => this.deliverToEndpoint(ep, payloadJson, event)));
   }
   // --- Private ---
   async deliverToEndpoint(endpoint, payloadJson, event) {
@@ -5291,7 +5271,7 @@ function generateId2() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -5300,7 +5280,7 @@ function generateSecret2() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return `whsec_${hex}`;
 }
@@ -5313,15 +5293,11 @@ async function signPayload(payload, secret) {
     false,
     ["sign"]
   );
-  const signature = await globalThis.crypto.subtle.sign(
-    "HMAC",
-    key,
-    encoder.encode(payload)
-  );
+  const signature = await globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(payload));
   const bytes = new Uint8Array(signature);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return `sha256=${hex}`;
 }