@korajs/auth 0.3.3 → 0.5.0

package/dist/server.js

@@ -7,1290 +7,2026 @@ import {
   isEncryptedField,
   toBase64Url,
   verifyChallenge
-} from "./chunk-FSU4SK32.js";
+} from "./chunk-IO2MCCG2.js";
 import {
   hashPassword,
   verifyPassword
-} from "./chunk-HOZXDR6Y.js";
+} from "./chunk-L7GXPS74.js";
 
 // src/provider/built-in/auth-routes.ts
-import { randomBytes as randomBytes2 } from "crypto";
-
-// src/tokens/token-manager.ts
-import { randomBytes, randomUUID } from "crypto";
-
-// src/types.ts
-import { KoraError } from "@korajs/core";
-var DEFAULT_ACCESS_TOKEN_LIFETIME = 15 * 60 * 1e3;
-var DEFAULT_REFRESH_TOKEN_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
-var DEFAULT_DEVICE_CREDENTIAL_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
-var DEFAULT_MAX_OFFLINE_DURATION = 30 * 24 * 60 * 60 * 1e3;
-var DEFAULT_AUTO_LOCK_TIMEOUT = 15 * 60 * 1e3;
-
-// src/tokens/jwt.ts
-import { createHmac } from "crypto";
-function base64urlEncode(input) {
-  return Buffer.from(input, "utf-8").toString("base64url");
-}
-function base64urlDecode(input) {
-  return Buffer.from(input, "base64url").toString("utf-8");
-}
-function hmacSha256Base64url(data, secret) {
-  return createHmac("sha256", secret).update(data).digest("base64url");
-}
-var ENCODED_HEADER = base64urlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
-function encodeJwt(payload, secret) {
-  const encodedPayload = base64urlEncode(JSON.stringify(payload));
-  const signingInput = `${ENCODED_HEADER}.${encodedPayload}`;
-  const signature = hmacSha256Base64url(signingInput, secret);
-  return `${signingInput}.${signature}`;
-}
-function decodeJwt(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const payloadSegment = parts[1];
-  if (payloadSegment === void 0) {
-    return null;
+import { randomBytes } from "crypto";
+var InMemoryChallengeStore = class {
+  challenges = /* @__PURE__ */ new Map();
+  async store(challenge, deviceId, expiresAt) {
+    this.challenges.set(challenge, { deviceId, expiresAt });
   }
-  try {
-    const decoded = base64urlDecode(payloadSegment);
-    const parsed = JSON.parse(decoded);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+  async consume(challenge) {
+    const entry = this.challenges.get(challenge);
+    if (entry === void 0) {
       return null;
     }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function verifyJwt(token, secret) {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const headerSegment = parts[0];
-  const payloadSegment = parts[1];
-  const signatureSegment = parts[2];
-  if (headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
-    return null;
+    this.challenges.delete(challenge);
+    if (Date.now() > entry.expiresAt) {
+      return null;
+    }
+    return { deviceId: entry.deviceId };
   }
-  if (headerSegment !== ENCODED_HEADER) {
-    return null;
+  /**
+   * Remove expired challenges to prevent unbounded memory growth.
+   */
+  cleanup() {
+    const now = Date.now();
+    for (const [challenge, entry] of this.challenges) {
+      if (now > entry.expiresAt) {
+        this.challenges.delete(challenge);
+      }
+    }
   }
-  const signingInput = `${headerSegment}.${payloadSegment}`;
-  const expectedSignature = hmacSha256Base64url(signingInput, secret);
-  if (expectedSignature.length !== signatureSegment.length) {
-    return null;
+};
+var InMemoryRateLimiter = class {
+  attempts = /* @__PURE__ */ new Map();
+  maxAttempts;
+  windowMs;
+  /**
+   * @param maxAttempts - Maximum number of attempts within the time window (default: 10)
+   * @param windowMs - Time window in milliseconds (default: 60,000 = 1 minute)
+   */
+  constructor(maxAttempts = 10, windowMs = 6e4) {
+    this.maxAttempts = maxAttempts;
+    this.windowMs = windowMs;
   }
-  let mismatch = 0;
-  for (let i = 0; i < expectedSignature.length; i++) {
-    mismatch |= expectedSignature.charCodeAt(i) ^ signatureSegment.charCodeAt(i);
+  async isAllowed(key) {
+    const now = Date.now();
+    const attempts = this.attempts.get(key) ?? [];
+    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
+    return recentAttempts.length < this.maxAttempts;
   }
-  if (mismatch !== 0) {
-    return null;
+  async record(key) {
+    const now = Date.now();
+    const attempts = this.attempts.get(key) ?? [];
+    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
+    recentAttempts.push(now);
+    this.attempts.set(key, recentAttempts);
   }
-  try {
-    const decoded = base64urlDecode(payloadSegment);
-    const parsed = JSON.parse(decoded);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
+  async reset(key) {
+    this.attempts.delete(key);
   }
-}
-var CLOCK_SKEW_TOLERANCE_SECONDS = 5;
-function isExpired(payload) {
-  if (typeof payload.exp !== "number") {
+};
+var MIN_PASSWORD_LENGTH = 8;
+var MAX_PASSWORD_LENGTH = 128;
+var MAX_NAME_LENGTH = 200;
+var CHALLENGE_TTL_MS = 6e4;
+function isValidEmail(email) {
+  if (email.length === 0 || email.length > 254) {
     return false;
   }
-  const nowSeconds = Math.floor(Date.now() / 1e3);
-  return nowSeconds >= payload.exp + CLOCK_SKEW_TOLERANCE_SECONDS;
-}
-
-// src/tokens/token-manager.ts
-var MIN_SECRET_LENGTH = 32;
-var InMemoryTokenRevocationStore = class {
-  revokedTokens = /* @__PURE__ */ new Map();
-  revokedDevices = /* @__PURE__ */ new Set();
-  async isRevoked(jti) {
-    return this.revokedTokens.has(jti);
+  const atIndex = email.indexOf("@");
+  if (atIndex < 1) {
+    return false;
   }
-  async revoke(jti, expiresAt) {
-    this.revokedTokens.set(jti, expiresAt);
+  const domain = email.slice(atIndex + 1);
+  if (domain.length === 0 || !domain.includes(".")) {
+    return false;
   }
-  async revokeAllForDevice(deviceId) {
-    this.revokedDevices.add(deviceId);
+  if (email.indexOf("@", atIndex + 1) !== -1) {
+    return false;
   }
-  /**
-   * Check if a device has been revoked.
-   */
-  isDeviceRevoked(deviceId) {
-    return this.revokedDevices.has(deviceId);
+  if (email.includes(" ")) {
+    return false;
   }
-  /**
-   * Remove expired revocations to prevent unbounded memory growth.
-   * Call periodically (e.g., every hour) in long-running servers.
-   */
-  cleanup() {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    for (const [jti, expiresAt] of this.revokedTokens) {
-      if (nowSeconds > expiresAt) {
-        this.revokedTokens.delete(jti);
-      }
-    }
+  return true;
+}
+function sanitizeName(name) {
+  const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
+  const trimmed = cleaned.trim();
+  if (trimmed.length > MAX_NAME_LENGTH) {
+    return trimmed.slice(0, MAX_NAME_LENGTH);
   }
-};
-var TokenManager = class {
-  /** All signing/verification secrets (index 0 = current signing key) */
-  secrets;
-  accessTokenLifetime;
-  refreshTokenLifetime;
-  deviceCredentialLifetime;
-  revocationStore;
+  return trimmed;
+}
+var BuiltInAuthRoutes = class {
+  userStore;
+  tokenManager;
+  challengeStore;
+  rateLimiter;
   constructor(config) {
-    const secrets = Array.isArray(config.secret) ? config.secret : [config.secret];
-    if (secrets.length === 0) {
-      throw new Error("TokenManager requires at least one secret.");
-    }
-    for (const secret of secrets) {
-      if (secret.length < MIN_SECRET_LENGTH) {
-        throw new Error(
-          `JWT secret must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for HMAC-SHA256 security. Received ${secret.length} characters. Use TokenManager.generateSecret() to generate a secure secret.`
-        );
-      }
-    }
-    this.secrets = secrets;
-    this.accessTokenLifetime = config.accessTokenLifetime ?? DEFAULT_ACCESS_TOKEN_LIFETIME;
-    this.refreshTokenLifetime = config.refreshTokenLifetime ?? DEFAULT_REFRESH_TOKEN_LIFETIME;
-    this.deviceCredentialLifetime = config.deviceCredentialLifetime ?? DEFAULT_DEVICE_CREDENTIAL_LIFETIME;
-    this.revocationStore = config.revocationStore;
-  }
-  /**
-   * Generate a cryptographically random secret suitable for HMAC-SHA256 signing.
-   *
-   * Returns a 64-character hex string (32 bytes / 256 bits of entropy).
-   * Store this securely (environment variable, secrets manager) — never in source code.
-   *
-   * @returns A random 256-bit hex-encoded secret
-   */
-  static generateSecret() {
-    return randomBytes(32).toString("hex");
+    this.userStore = config.userStore;
+    this.tokenManager = config.tokenManager;
+    this.challengeStore = config.challengeStore ?? new InMemoryChallengeStore();
+    this.rateLimiter = config.rateLimiter ?? new InMemoryRateLimiter();
   }
   /**
-   * Issue a signed JWT access token.
+   * Handle user sign-up (POST /auth/signup).
    *
-   * Access tokens are short-lived (default 15 minutes) and used to authorize
-   * API requests. When expired, use {@link refreshAccessToken} with a valid
-   * refresh token to obtain a new one.
+   * Validates email format and password length, hashes the password,
+   * creates the user, optionally registers a device, and issues tokens.
    *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @returns A signed JWT string with type 'access'
+   * @param body - Sign-up request body
+   * @param body.email - The user's email address
+   * @param body.password - The plaintext password (8-128 characters)
+   * @param body.name - Optional display name (defaults to email local part)
+   * @param body.deviceId - Optional device ID to register
+   * @param body.devicePublicKey - Optional device public key (base64url)
+   * @param clientIp - Optional client IP for rate limiting
+   * @returns Auth response with the created user and tokens, or an error
    */
-  issueAccessToken(userId, deviceId) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const payload = {
-      jti: randomUUID(),
-      sub: userId,
-      dev: deviceId,
-      type: "access",
-      iat: nowSeconds,
-      exp: nowSeconds + Math.floor(this.accessTokenLifetime / 1e3)
-    };
-    return encodeJwt(payload, this.secrets[0]);
-  }
-  /**
-   * Issue a signed JWT refresh token.
-   *
-   * Refresh tokens are longer-lived (default 90 days) and used exclusively
-   * to obtain new access tokens via {@link refreshAccessToken}. They should
-   * be stored securely and never sent to resource APIs.
-   *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @returns A signed JWT string with type 'refresh'
-   */
-  issueRefreshToken(userId, deviceId) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const payload = {
-      jti: randomUUID(),
-      sub: userId,
-      dev: deviceId,
-      type: "refresh",
-      iat: nowSeconds,
-      exp: nowSeconds + Math.floor(this.refreshTokenLifetime / 1e3)
+  async handleSignUp(body, clientIp) {
+    const rateLimitKey = clientIp ?? "global";
+    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+      return {
+        status: 429,
+        body: { error: "Too many requests. Please try again later." }
+      };
+    }
+    await this.rateLimiter.record(rateLimitKey);
+    if (!isValidEmail(body.email)) {
+      return {
+        status: 400,
+        body: {
+          error: "Invalid email address. Please provide a valid email in the format user@domain.com."
+        }
+      };
+    }
+    if (body.password.length < MIN_PASSWORD_LENGTH) {
+      return {
+        status: 400,
+        body: {
+          error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long.`
+        }
+      };
+    }
+    if (body.password.length > MAX_PASSWORD_LENGTH) {
+      return {
+        status: 400,
+        body: {
+          error: `Password must be at most ${MAX_PASSWORD_LENGTH} characters long.`
+        }
+      };
+    }
+    const { hash, salt } = await hashPassword(body.password);
+    const rawName = body.name ?? body.email.split("@")[0] ?? body.email;
+    const name = sanitizeName(rawName);
+    let user;
+    try {
+      user = await this.userStore.createUser({
+        email: body.email,
+        passwordHash: hash,
+        salt,
+        name
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "DuplicateEmailError") {
+        return {
+          status: 409,
+          body: { error: "An account with this email already exists." }
+        };
+      }
+      throw err;
+    }
+    const deviceId = body.deviceId ?? `device-${user.id}`;
+    await this.userStore.registerDevice({
+      id: deviceId,
+      userId: user.id,
+      publicKey: body.devicePublicKey ?? "",
+      name: body.deviceId ? "Primary Device" : "Browser"
+    });
+    const tokens = this.tokenManager.issueTokens(user.id, deviceId);
+    return {
+      status: 201,
+      body: { data: { user, tokens } }
     };
-    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Issue a signed device credential token.
+   * Handle user sign-in (POST /auth/signin).
    *
-   * Device credentials are long-lived tokens bound to a device's public key.
-   * They include a `mustCheckinBy` deadline; if the device does not check in
-   * before this deadline, the credential should be treated as revoked.
+   * Looks up the user by email, verifies the password, optionally registers
+   * a new device, and issues tokens.
    *
-   * @param userId - The subject (user ID) to encode in the token
-   * @param deviceId - The device ID of the requesting device
-   * @param publicKeyThumbprint - SHA-256 thumbprint of the device's public key
-   * @returns A signed JWT string with type 'device_credential'
+   * @param body - Sign-in request body
+   * @param body.email - The user's email address
+   * @param body.password - The plaintext password
+   * @param body.deviceId - Optional device ID to register
+   * @param body.devicePublicKey - Optional device public key (base64url)
+   * @param clientIp - Optional client IP for rate limiting
+   * @returns Auth response with the user and tokens, or an error
    */
-  issueDeviceCredential(userId, deviceId, publicKeyThumbprint) {
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const lifetimeSeconds = Math.floor(this.deviceCredentialLifetime / 1e3);
-    const payload = {
-      jti: randomUUID(),
-      sub: userId,
-      dev: deviceId,
-      type: "device_credential",
-      iat: nowSeconds,
-      exp: nowSeconds + lifetimeSeconds,
-      dpk: publicKeyThumbprint,
-      mustCheckinBy: nowSeconds + lifetimeSeconds
+  async handleSignIn(body, clientIp) {
+    const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
+    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
+      return {
+        status: 429,
+        body: { error: "Too many sign-in attempts. Please try again later." }
+      };
+    }
+    await this.rateLimiter.record(rateLimitKey);
+    const storedUser = await this.userStore.findByEmail(body.email);
+    if (storedUser === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid email or password." }
+      };
+    }
+    const passwordValid = await verifyPassword(
+      body.password,
+      storedUser.passwordHash,
+      storedUser.salt
+    );
+    if (!passwordValid) {
+      return {
+        status: 401,
+        body: { error: "Invalid email or password." }
+      };
+    }
+    await this.rateLimiter.reset(rateLimitKey);
+    const deviceId = body.deviceId ?? `device-${storedUser.id}`;
+    await this.userStore.registerDevice({
+      id: deviceId,
+      userId: storedUser.id,
+      publicKey: body.devicePublicKey ?? "",
+      name: body.deviceId ? "Device" : "Browser"
+    });
+    const tokens = this.tokenManager.issueTokens(storedUser.id, deviceId);
+    const user = {
+      id: storedUser.id,
+      email: storedUser.email,
+      name: storedUser.name,
+      emailVerified: storedUser.emailVerified,
+      createdAt: storedUser.createdAt
+    };
+    return {
+      status: 200,
+      body: { data: { user, tokens } }
     };
-    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Issue a complete set of authentication tokens.
+   * Handle token refresh (POST /auth/refresh).
    *
-   * Always issues an access token and refresh token. If a `publicKeyThumbprint`
-   * is provided, also issues a device credential.
+   * Validates the provided refresh token and issues a new token pair
+   * (refresh token rotation with reuse detection). The old refresh token
+   * is marked as consumed in the revocation store.
    *
-   * @param userId - The subject (user ID) to encode in the tokens
-   * @param deviceId - The device ID of the requesting device
-   * @param publicKeyThumbprint - Optional SHA-256 thumbprint of the device's public key.
-   *   When provided, a device credential is included in the returned tokens.
-   * @returns An {@link AuthTokens} object containing the issued tokens
+   * @param body - Refresh request body
+   * @param body.refreshToken - The current refresh token
+   * @returns Auth response with new tokens, or an error
    */
-  issueTokens(userId, deviceId, publicKeyThumbprint) {
-    const tokens = {
-      accessToken: this.issueAccessToken(userId, deviceId),
-      refreshToken: this.issueRefreshToken(userId, deviceId)
-    };
-    if (publicKeyThumbprint !== void 0) {
-      tokens.deviceCredential = this.issueDeviceCredential(
-        userId,
-        deviceId,
-        publicKeyThumbprint
-      );
+  async handleRefresh(body) {
+    const result = await this.tokenManager.refreshAccessToken(body.refreshToken);
+    if (result === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired refresh token." }
+      };
     }
-    return tokens;
+    return {
+      status: 200,
+      body: { data: result }
+    };
   }
   /**
-   * Validate and decode a token.
+   * Handle sign-out (POST /auth/signout).
    *
-   * Verifies the HMAC-SHA256 signature (trying all configured secrets for key rotation),
-   * checks that the token has not expired, and validates all required claims.
-   * Returns null (rather than throwing) for invalid or expired tokens, so callers
-   * can handle authentication failure without try/catch.
+   * Validates the access token and revokes the current refresh token
+   * (if a revocation store is configured). This ensures that stolen
+   * refresh tokens cannot be used after the user signs out.
    *
-   * @param token - The JWT string to validate
-   * @returns The decoded {@link TokenPayload} if valid, or null if the token is
-   *   invalid, expired, or missing required claims
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param body - Sign-out request body
+   * @param body.refreshToken - The current refresh token to revoke
+   * @returns Auth response with success flag, or an error
    */
-  validateToken(token) {
-    let decoded = null;
-    for (const secret of this.secrets) {
-      decoded = verifyJwt(token, secret);
-      if (decoded !== null) {
-        break;
-      }
-    }
-    if (decoded === null) {
-      return null;
-    }
-    if (isExpired(decoded)) {
-      return null;
-    }
-    if (typeof decoded["jti"] !== "string" || typeof decoded["sub"] !== "string" || typeof decoded["dev"] !== "string" || typeof decoded["type"] !== "string" || typeof decoded["iat"] !== "number" || typeof decoded["exp"] !== "number") {
-      return null;
+  async handleSignOut(accessToken, body) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    const type = decoded["type"];
-    if (type !== "access" && type !== "refresh" && type !== "device_credential") {
-      return null;
+    await this.tokenManager.revokeToken(payload.jti, payload.exp);
+    if (body.refreshToken) {
+      const refreshPayload = this.tokenManager.validateToken(body.refreshToken);
+      if (refreshPayload !== null && refreshPayload.type === "refresh") {
+        await this.tokenManager.revokeToken(refreshPayload.jti, refreshPayload.exp);
+      }
     }
     return {
-      jti: decoded["jti"],
-      sub: decoded["sub"],
-      dev: decoded["dev"],
-      type,
-      iat: decoded["iat"],
-      exp: decoded["exp"]
+      status: 200,
+      body: { data: { success: true } }
     };
   }
   /**
-   * Validate a token and check it against the revocation store.
+   * Handle get-current-user (GET /auth/me).
    *
-   * Like {@link validateToken}, but also checks whether the token's `jti` has been
-   * revoked. Requires a revocation store to be configured.
+   * Validates the access token and returns the authenticated user's profile.
    *
-   * @param token - The JWT string to validate
-   * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @returns Auth response with the user profile, or an error
    */
-  async validateTokenWithRevocation(token) {
-    const payload = this.validateToken(token);
-    if (payload === null) {
-      return null;
+  async handleGetMe(accessToken) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    if (this.revocationStore) {
-      const revoked = await this.revocationStore.isRevoked(payload.jti);
-      if (revoked) {
-        return null;
-      }
+    const storedUser = await this.userStore.findById(payload.sub);
+    if (storedUser === null) {
+      return {
+        status: 404,
+        body: { error: "User not found." }
+      };
     }
-    return payload;
+    const user = {
+      id: storedUser.id,
+      email: storedUser.email,
+      name: storedUser.name,
+      emailVerified: storedUser.emailVerified,
+      createdAt: storedUser.createdAt
+    };
+    return {
+      status: 200,
+      body: { data: user }
+    };
   }
   /**
-   * Revoke a specific token by its JWT ID.
+   * Handle list-devices (GET /auth/devices).
    *
-   * Requires a revocation store to be configured. After revocation, the token
-   * will be rejected by {@link validateTokenWithRevocation}.
+   * Validates the access token and returns all devices registered for the user.
    *
-   * @param jti - The JWT ID of the token to revoke
-   * @param expiresAt - The token's expiration time (seconds since epoch)
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @returns Auth response with the device list, or an error
    */
-  async revokeToken(jti, expiresAt) {
-    if (this.revocationStore) {
-      await this.revocationStore.revoke(jti, expiresAt);
+  async handleListDevices(accessToken) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
+    const devices = await this.userStore.listDevices(payload.sub);
+    return {
+      status: 200,
+      body: { data: devices }
+    };
   }
   /**
-   * Revoke all tokens for a specific device.
+   * Handle device revocation (DELETE /auth/device/:id).
    *
-   * Called when a device is revoked to ensure all its existing tokens
-   * (access, refresh, and device credentials) are invalidated.
+   * Validates the access token, revokes the specified device, and invalidates
+   * all tokens issued to that device. Only the device's owner can revoke it.
    *
-   * @param deviceId - The device ID whose tokens should be revoked
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param deviceId - The ID of the device to revoke
+   * @returns Auth response with success flag, or an error
    */
-  async revokeDeviceTokens(deviceId) {
-    if (this.revocationStore) {
-      await this.revocationStore.revokeAllForDevice(deviceId);
+  async handleRevokeDevice(accessToken, deviceId) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const device = await this.userStore.findDevice(deviceId);
+    if (device === null) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.userId !== payload.sub) {
+      return {
+        status: 403,
+        body: { error: "You can only revoke your own devices." }
+      };
     }
+    await this.userStore.revokeDevice(deviceId);
+    await this.tokenManager.revokeDeviceTokens(deviceId);
+    return {
+      status: 200,
+      body: { data: { success: true } }
+    };
   }
   /**
-   * Refresh an access token using a valid refresh token.
-   *
-   * Implements **refresh token rotation with reuse detection**: a new refresh token
-   * is issued alongside the new access token. The old refresh token's `jti` is
-   * recorded in the revocation store (if configured). If a previously consumed
-   * refresh token is presented again, it indicates potential token theft.
+   * Handle device registration (POST /auth/device/register).
    *
-   * Returns null if the provided token is invalid, expired, or not a refresh token.
+   * Requires a valid access token. Registers a new device for the authenticated
+   * user and issues a device credential token bound to the device's public key.
    *
-   * @param refreshToken - The refresh token JWT string
-   * @returns A new access/refresh token pair, or null if the refresh token is invalid
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param body - Device registration request body
+   * @param body.deviceId - Unique identifier for the device
+   * @param body.publicKey - The device's public key as a JWK JSON string
+   * @param body.name - Human-readable device name (e.g., "Chrome on MacBook")
+   * @returns Auth response with the registered device and device credential, or an error
    */
-  async refreshAccessToken(refreshToken) {
-    const payload = this.validateToken(refreshToken);
-    if (payload === null) {
-      return null;
+  async handleDeviceRegister(accessToken, body) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    if (payload.type !== "refresh") {
-      return null;
+    const deviceName = sanitizeName(body.name);
+    if (deviceName.length === 0) {
+      return {
+        status: 400,
+        body: { error: "Device name must not be empty." }
+      };
     }
-    if (this.revocationStore) {
-      const wasRevoked = await this.revocationStore.isRevoked(payload.jti);
-      if (wasRevoked) {
-        await this.revocationStore.revokeAllForDevice(payload.dev);
-        return null;
-      }
-      await this.revocationStore.revoke(payload.jti, payload.exp);
+    let publicKeyJwk;
+    try {
+      publicKeyJwk = JSON.parse(body.publicKey);
+    } catch {
+      return {
+        status: 400,
+        body: { error: "Invalid public key format. Expected a JSON-encoded JWK string." }
+      };
+    }
+    let thumbprint;
+    try {
+      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
+    } catch {
+      return {
+        status: 400,
+        body: {
+          error: "Failed to compute public key thumbprint. Ensure the key is a valid EC P-256 JWK."
+        }
+      };
     }
+    const device = await this.userStore.registerDevice({
+      id: body.deviceId,
+      userId: payload.sub,
+      publicKey: body.publicKey,
+      name: deviceName
+    });
+    const deviceCredential = this.tokenManager.issueDeviceCredential(
+      payload.sub,
+      body.deviceId,
+      thumbprint
+    );
     return {
-      accessToken: this.issueAccessToken(payload.sub, payload.dev),
-      refreshToken: this.issueRefreshToken(payload.sub, payload.dev)
+      status: 201,
+      body: { data: { device, deviceCredential } }
     };
   }
-};
-
-// src/provider/built-in/user-store.ts
-import { KoraError as KoraError2 } from "@korajs/core";
-import { randomUUID as randomUUID2 } from "crypto";
-var DuplicateEmailError = class extends KoraError2 {
-  constructor() {
-    super(
-      "A user with this email already exists.",
-      "DUPLICATE_EMAIL"
-    );
-    this.name = "DuplicateEmailError";
-  }
-};
-var InMemoryUserStore = class {
-  /** Users indexed by ID */
-  usersById = /* @__PURE__ */ new Map();
-  /** Users indexed by email (lowercase) for fast lookup */
-  usersByEmail = /* @__PURE__ */ new Map();
-  /** Devices indexed by device ID */
-  devicesById = /* @__PURE__ */ new Map();
-  /** Device IDs indexed by user ID for fast listing */
-  devicesByUserId = /* @__PURE__ */ new Map();
   /**
-   * Create a new user account.
+   * Generate a challenge for device proof-of-possession verification.
    *
-   * @param params - User creation parameters
-   * @param params.email - The user's email address (must be unique, case-insensitive)
-   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
-   * @param params.salt - Hex-encoded salt used during hashing
-   * @param params.name - The user's display name
-   * @returns The created user (without sensitive credential fields)
-   * @throws {DuplicateEmailError} If a user with the same email already exists
+   * Creates a cryptographically random challenge, stores it server-side with
+   * a 60-second TTL and the target device ID, and returns the challenge string.
+   * The client signs this challenge with its private key and submits it via
+   * {@link handleDeviceVerify}.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param deviceId - The device this challenge is intended for
+   * @returns Auth response with the challenge string, or an error
    */
-  async createUser(params) {
-    const normalizedEmail = params.email.toLowerCase();
-    if (this.usersByEmail.has(normalizedEmail)) {
-      throw new DuplicateEmailError();
+  async handleDeviceChallenge(accessToken, deviceId) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
     }
-    const now = Date.now();
-    const id = randomUUID2();
-    const storedUser = {
-      id,
-      email: normalizedEmail,
-      name: params.name,
-      emailVerified: false,
-      createdAt: now,
-      passwordHash: params.passwordHash,
-      salt: params.salt
+    const device = await this.userStore.findDevice(deviceId);
+    if (device === null || device.userId !== payload.sub) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.revoked) {
+      return {
+        status: 403,
+        body: { error: "Device has been revoked." }
+      };
+    }
+    const challenge = randomBytes(32).toString("hex");
+    const expiresAt = Date.now() + CHALLENGE_TTL_MS;
+    await this.challengeStore.store(challenge, deviceId, expiresAt);
+    return {
+      status: 200,
+      body: { data: { challenge } }
     };
-    this.usersById.set(id, storedUser);
-    this.usersByEmail.set(normalizedEmail, storedUser);
-    return toAuthUser(storedUser);
   }
   /**
-   * Find a user by email address.
+   * Handle device proof-of-possession verification (POST /auth/device/verify).
    *
-   * @param email - The email to search for (case-insensitive)
-   * @returns The stored user record including credentials, or null if not found
-   */
-  async findByEmail(email) {
-    return this.usersByEmail.get(email.toLowerCase()) ?? null;
+   * Verifies that the device holds the private key corresponding to its registered
+   * public key by checking a signed challenge. The challenge must have been previously
+   * issued via {@link handleDeviceChallenge} and is single-use.
+   *
+   * On success, issues fresh tokens for the device.
+   *
+   * @param body - Device verification request body
+   * @param body.deviceId - The ID of the device to verify
+   * @param body.challenge - The challenge string (from handleDeviceChallenge)
+   * @param body.signature - The base64url-encoded ECDSA signature of the challenge
+   * @returns Auth response with fresh tokens on success, or an error
+   */
+  async handleDeviceVerify(body) {
+    const challengeEntry = await this.challengeStore.consume(body.challenge);
+    if (challengeEntry === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired challenge. Request a new challenge and try again." }
+      };
+    }
+    if (challengeEntry.deviceId !== body.deviceId) {
+      return {
+        status: 401,
+        body: { error: "Challenge was not issued for this device." }
+      };
+    }
+    const device = await this.userStore.findDevice(body.deviceId);
+    if (device === null) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.revoked) {
+      return {
+        status: 403,
+        body: { error: "Device has been revoked and cannot authenticate." }
+      };
+    }
+    let publicKeyJwk;
+    try {
+      publicKeyJwk = JSON.parse(device.publicKey);
+    } catch {
+      return {
+        status: 500,
+        body: { error: "Device has an invalid stored public key." }
+      };
+    }
+    let isValid;
+    try {
+      isValid = await verifyChallenge(publicKeyJwk, body.challenge, body.signature);
+    } catch {
+      return {
+        status: 400,
+        body: {
+          error: "Signature verification failed. The signature or public key format may be invalid."
+        }
+      };
+    }
+    if (!isValid) {
+      return {
+        status: 401,
+        body: { error: "Invalid signature. Proof-of-possession verification failed." }
+      };
+    }
+    let thumbprint;
+    try {
+      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
+    } catch {
+      return {
+        status: 500,
+        body: { error: "Failed to compute public key thumbprint." }
+      };
+    }
+    const tokens = this.tokenManager.issueTokens(device.userId, device.id, thumbprint);
+    return {
+      status: 200,
+      body: { data: { tokens } }
+    };
   }
   /**
-   * Find a user by ID.
+   * Generates a random challenge string for proof-of-possession verification.
    *
-   * @param id - The user ID to search for
-   * @returns The stored user record including credentials, or null if not found
+   * **Deprecated:** Use {@link handleDeviceChallenge} instead, which stores
+   * the challenge server-side with expiry and single-use semantics.
+   *
+   * @returns A 64-character hex string (32 random bytes)
    */
-  async findById(id) {
-    return this.usersById.get(id) ?? null;
+  static generateChallenge() {
+    return randomBytes(32).toString("hex");
   }
   /**
-   * Register a device for a user.
+   * Creates a sync server auth provider compatible with `@korajs/server`.
    *
-   * If a device with the same ID already exists and is not revoked, it is
-   * returned as-is (idempotent registration). If it was previously revoked,
-   * it is re-activated with updated details.
+   * The returned object implements the `AuthProvider` interface from
+   * `@korajs/server`, validating access tokens and returning an auth
+   * context containing the user ID and device metadata. This bridges
+   * the built-in auth system with the sync server's authentication layer.
    *
-   * @param params - Device registration parameters
-   * @param params.id - Unique device identifier
-   * @param params.userId - ID of the user who owns the device
-   * @param params.publicKey - Base64url-encoded device public key or thumbprint
-   * @param params.name - Human-readable device name
-   * @returns The registered device record
+   * Also checks device revocation status during authentication, ensuring
+   * that revoked devices are rejected even if their tokens haven't expired.
+   *
+   * @returns An object with an `authenticate` method suitable for KoraSyncServer's `auth` config
+   *
+   * @example
+   * ```typescript
+   * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+   * const syncServer = new KoraSyncServer({
+   *   store,
+   *   auth: routes.toSyncAuthProvider(),
+   * })
+   * ```
    */
-  async registerDevice(params) {
-    const existing = this.devicesById.get(params.id);
-    if (existing !== void 0 && !existing.revoked) {
-      return existing;
-    }
-    const now = Date.now();
-    const device = {
-      id: params.id,
-      userId: params.userId,
-      publicKey: params.publicKey,
-      name: params.name,
-      revoked: false,
-      createdAt: now,
-      lastSeenAt: now
+  toSyncAuthProvider() {
+    const tokenManager = this.tokenManager;
+    const userStore = this.userStore;
+    return {
+      async authenticate(token) {
+        const payload = await tokenManager.validateTokenWithRevocation(token);
+        if (payload === null || payload.type !== "access") {
+          return null;
+        }
+        const user = await userStore.findById(payload.sub);
+        if (user === null) {
+          return null;
+        }
+        const device = await userStore.findDevice(payload.dev);
+        if (device?.revoked) {
+          return null;
+        }
+        await userStore.touchDevice(payload.dev);
+        return {
+          userId: payload.sub,
+          metadata: {
+            deviceId: payload.dev,
+            email: user.email,
+            name: user.name
+          }
+        };
+      }
     };
-    this.devicesById.set(params.id, device);
-    let userDevices = this.devicesByUserId.get(params.userId);
-    if (userDevices === void 0) {
-      userDevices = /* @__PURE__ */ new Set();
-      this.devicesByUserId.set(params.userId, userDevices);
+  }
+};
+
+// src/provider/built-in/quickstart-server.ts
+import { randomUUID as randomUUID4 } from "crypto";
+
+// src/tokens/token-manager.ts
+import { randomBytes as randomBytes2, randomUUID } from "crypto";
+
+// src/types.ts
+import { KoraError } from "@korajs/core";
+var DEFAULT_ACCESS_TOKEN_LIFETIME = 15 * 60 * 1e3;
+var DEFAULT_REFRESH_TOKEN_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_DEVICE_CREDENTIAL_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_OFFLINE_DURATION = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_AUTO_LOCK_TIMEOUT = 15 * 60 * 1e3;
+
+// src/tokens/jwt.ts
+import { createHmac } from "crypto";
+function base64urlEncode(input) {
+  return Buffer.from(input, "utf-8").toString("base64url");
+}
+function base64urlDecode(input) {
+  return Buffer.from(input, "base64url").toString("utf-8");
+}
+function hmacSha256Base64url(data, secret) {
+  return createHmac("sha256", secret).update(data).digest("base64url");
+}
+var ENCODED_HEADER = base64urlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+function encodeJwt(payload, secret) {
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const signingInput = `${ENCODED_HEADER}.${encodedPayload}`;
+  const signature = hmacSha256Base64url(signingInput, secret);
+  return `${signingInput}.${signature}`;
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const payloadSegment = parts[1];
+  if (payloadSegment === void 0) {
+    return null;
+  }
+  try {
+    const decoded = base64urlDecode(payloadSegment);
+    const parsed = JSON.parse(decoded);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
     }
-    userDevices.add(params.id);
-    return device;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const headerSegment = parts[0];
+  const payloadSegment = parts[1];
+  const signatureSegment = parts[2];
+  if (headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
+    return null;
+  }
+  if (headerSegment !== ENCODED_HEADER) {
+    return null;
+  }
+  const signingInput = `${headerSegment}.${payloadSegment}`;
+  const expectedSignature = hmacSha256Base64url(signingInput, secret);
+  if (expectedSignature.length !== signatureSegment.length) {
+    return null;
+  }
+  let mismatch = 0;
+  for (let i = 0; i < expectedSignature.length; i++) {
+    mismatch |= expectedSignature.charCodeAt(i) ^ signatureSegment.charCodeAt(i);
+  }
+  if (mismatch !== 0) {
+    return null;
+  }
+  try {
+    const decoded = base64urlDecode(payloadSegment);
+    const parsed = JSON.parse(decoded);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+var CLOCK_SKEW_TOLERANCE_SECONDS = 5;
+function isExpired(payload) {
+  if (typeof payload.exp !== "number") {
+    return false;
+  }
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  return nowSeconds >= payload.exp + CLOCK_SKEW_TOLERANCE_SECONDS;
+}
+
+// src/tokens/token-manager.ts
+var MIN_SECRET_LENGTH = 32;
+var InMemoryTokenRevocationStore = class {
+  revokedTokens = /* @__PURE__ */ new Map();
+  revokedDevices = /* @__PURE__ */ new Set();
+  async isRevoked(jti) {
+    return this.revokedTokens.has(jti);
+  }
+  async revoke(jti, expiresAt) {
+    this.revokedTokens.set(jti, expiresAt);
+  }
+  async revokeAllForDevice(deviceId) {
+    this.revokedDevices.add(deviceId);
   }
   /**
-   * Find a device by its ID.
-   *
-   * @param deviceId - The device ID to search for
-   * @returns The device record, or null if not found
+   * Check if a device has been revoked.
    */
-  async findDevice(deviceId) {
-    return this.devicesById.get(deviceId) ?? null;
+  async isDeviceRevoked(deviceId) {
+    return this.revokedDevices.has(deviceId);
+  }
+  /**
+   * Remove expired revocations to prevent unbounded memory growth.
+   * Call periodically (e.g., every hour) in long-running servers.
+   */
+  cleanup() {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    for (const [jti, expiresAt] of this.revokedTokens) {
+      if (nowSeconds > expiresAt) {
+        this.revokedTokens.delete(jti);
+      }
+    }
+  }
+};
+var TokenManager = class {
+  /** All signing/verification secrets (index 0 = current signing key) */
+  secrets;
+  accessTokenLifetime;
+  refreshTokenLifetime;
+  deviceCredentialLifetime;
+  revocationStore;
+  constructor(config) {
+    const secrets = Array.isArray(config.secret) ? config.secret : [config.secret];
+    if (secrets.length === 0) {
+      throw new Error("TokenManager requires at least one secret.");
+    }
+    for (const secret of secrets) {
+      if (secret.length < MIN_SECRET_LENGTH) {
+        throw new Error(
+          `JWT secret must be at least ${MIN_SECRET_LENGTH} characters (256 bits) for HMAC-SHA256 security. Received ${secret.length} characters. Use TokenManager.generateSecret() to generate a secure secret.`
+        );
+      }
+    }
+    this.secrets = secrets;
+    this.accessTokenLifetime = config.accessTokenLifetime ?? DEFAULT_ACCESS_TOKEN_LIFETIME;
+    this.refreshTokenLifetime = config.refreshTokenLifetime ?? DEFAULT_REFRESH_TOKEN_LIFETIME;
+    this.deviceCredentialLifetime = config.deviceCredentialLifetime ?? DEFAULT_DEVICE_CREDENTIAL_LIFETIME;
+    this.revocationStore = config.revocationStore;
   }
   /**
-   * List all devices registered for a user.
+   * Generate a cryptographically random secret suitable for HMAC-SHA256 signing.
    *
-   * @param userId - The user ID whose devices to list
-   * @returns Array of device records (includes revoked devices)
+   * Returns a 64-character hex string (32 bytes / 256 bits of entropy).
+   * Store this securely (environment variable, secrets manager) — never in source code.
+   *
+   * @returns A random 256-bit hex-encoded secret
    */
-  async listDevices(userId) {
-    const deviceIds = this.devicesByUserId.get(userId);
-    if (deviceIds === void 0) {
-      return [];
-    }
-    const devices = [];
-    for (const deviceId of deviceIds) {
-      const device = this.devicesById.get(deviceId);
-      if (device !== void 0) {
-        devices.push(device);
-      }
-    }
-    return devices;
+  static generateSecret() {
+    return randomBytes2(32).toString("hex");
   }
   /**
-   * Revoke a device, preventing it from being used for authentication.
+   * Issue a signed JWT access token.
    *
-   * This is a soft revoke — the device record remains but is marked as revoked.
-   * If the device does not exist, this is a no-op.
+   * Access tokens are short-lived (default 15 minutes) and used to authorize
+   * API requests. When expired, use {@link refreshAccessToken} with a valid
+   * refresh token to obtain a new one.
    *
-   * @param deviceId - The ID of the device to revoke
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @returns A signed JWT string with type 'access'
    */
-  async revokeDevice(deviceId) {
-    const device = this.devicesById.get(deviceId);
-    if (device !== void 0) {
-      device.revoked = true;
-    }
+  issueAccessToken(userId, deviceId) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const payload = {
+      jti: randomUUID(),
+      sub: userId,
+      dev: deviceId,
+      type: "access",
+      iat: nowSeconds,
+      exp: nowSeconds + Math.floor(this.accessTokenLifetime / 1e3)
+    };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Set a user's email verification status.
+   * Issue a signed JWT refresh token.
    *
-   * @param userId - The user whose email to verify
-   * @param verified - Whether the email is verified
+   * Refresh tokens are longer-lived (default 90 days) and used exclusively
+   * to obtain new access tokens via {@link refreshAccessToken}. They should
+   * be stored securely and never sent to resource APIs.
+   *
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @returns A signed JWT string with type 'refresh'
    */
-  async setEmailVerified(userId, verified) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    const updated = { ...user, emailVerified: verified };
-    this.usersById.set(userId, updated);
-    this.usersByEmail.set(user.email, updated);
+  issueRefreshToken(userId, deviceId) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const payload = {
+      jti: randomUUID(),
+      sub: userId,
+      dev: deviceId,
+      type: "refresh",
+      iat: nowSeconds,
+      exp: nowSeconds + Math.floor(this.refreshTokenLifetime / 1e3)
+    };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * Update a user's password hash and salt.
+   * Issue a signed device credential token.
    *
-   * @param userId - The user whose password to update
-   * @param passwordHash - New hex-encoded PBKDF2 derived key
-   * @param salt - New hex-encoded salt
+   * Device credentials are long-lived tokens bound to a device's public key.
+   * They include a `mustCheckinBy` deadline; if the device does not check in
+   * before this deadline, the credential should be treated as revoked.
+   *
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @param publicKeyThumbprint - SHA-256 thumbprint of the device's public key
+   * @returns A signed JWT string with type 'device_credential'
    */
-  async updatePassword(userId, passwordHash, salt) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    const updated = { ...user, passwordHash, salt };
-    this.usersById.set(userId, updated);
-    this.usersByEmail.set(user.email, updated);
+  issueDeviceCredential(userId, deviceId, publicKeyThumbprint) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const lifetimeSeconds = Math.floor(this.deviceCredentialLifetime / 1e3);
+    const payload = {
+      jti: randomUUID(),
+      sub: userId,
+      dev: deviceId,
+      type: "device_credential",
+      iat: nowSeconds,
+      exp: nowSeconds + lifetimeSeconds,
+      dpk: publicKeyThumbprint,
+      mustCheckinBy: nowSeconds + lifetimeSeconds
+    };
+    return encodeJwt(payload, this.secrets[0]);
   }
   /**
-   * List all users. For admin/development use.
+   * Issue a complete set of authentication tokens.
+   *
+   * Always issues an access token and refresh token. If a `publicKeyThumbprint`
+   * is provided, also issues a device credential.
+   *
+   * @param userId - The subject (user ID) to encode in the tokens
+   * @param deviceId - The device ID of the requesting device
+   * @param publicKeyThumbprint - Optional SHA-256 thumbprint of the device's public key.
+   *   When provided, a device credential is included in the returned tokens.
+   * @returns An {@link AuthTokens} object containing the issued tokens
    */
-  async listAll() {
-    return [...this.usersById.values()];
+  issueTokens(userId, deviceId, publicKeyThumbprint) {
+    const tokens = {
+      accessToken: this.issueAccessToken(userId, deviceId),
+      refreshToken: this.issueRefreshToken(userId, deviceId)
+    };
+    if (publicKeyThumbprint !== void 0) {
+      tokens.deviceCredential = this.issueDeviceCredential(userId, deviceId, publicKeyThumbprint);
+    }
+    return tokens;
   }
   /**
-   * Update a stored user record.
+   * Validate and decode a token.
+   *
+   * Verifies the HMAC-SHA256 signature (trying all configured secrets for key rotation),
+   * checks that the token has not expired, and validates all required claims.
+   * Returns null (rather than throwing) for invalid or expired tokens, so callers
+   * can handle authentication failure without try/catch.
+   *
+   * @param token - The JWT string to validate
+   * @returns The decoded {@link TokenPayload} if valid, or null if the token is
+   *   invalid, expired, or missing required claims
    */
-  async update(user) {
-    const existing = this.usersById.get(user.id);
-    if (!existing) return;
-    if (existing.email !== user.email) {
-      this.usersByEmail.delete(existing.email);
-      this.usersByEmail.set(user.email, user);
-    } else {
-      this.usersByEmail.set(user.email, user);
+  validateToken(token) {
+    let decoded = null;
+    for (const secret of this.secrets) {
+      decoded = verifyJwt(token, secret);
+      if (decoded !== null) {
+        break;
+      }
     }
-    this.usersById.set(user.id, user);
+    if (decoded === null) {
+      return null;
+    }
+    if (isExpired(decoded)) {
+      return null;
+    }
+    if (typeof decoded.jti !== "string" || typeof decoded.sub !== "string" || typeof decoded.dev !== "string" || typeof decoded.type !== "string" || typeof decoded.iat !== "number" || typeof decoded.exp !== "number") {
+      return null;
+    }
+    const type = decoded.type;
+    if (type !== "access" && type !== "refresh" && type !== "device_credential") {
+      return null;
+    }
+    return {
+      jti: decoded.jti,
+      sub: decoded.sub,
+      dev: decoded.dev,
+      type,
+      iat: decoded.iat,
+      exp: decoded.exp
+    };
   }
   /**
-   * Delete a user and all associated devices.
+   * Validate a token and check it against the revocation store.
+   *
+   * Like {@link validateToken}, but also checks whether the token's `jti` has been
+   * revoked or belongs to a revoked device. Requires a revocation store to be configured.
+   *
+   * @param token - The JWT string to validate
+   * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
    */
-  async delete(userId) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    this.usersById.delete(userId);
-    this.usersByEmail.delete(user.email);
-    const deviceIds = this.devicesByUserId.get(userId);
-    if (deviceIds) {
-      for (const deviceId of deviceIds) {
-        this.devicesById.delete(deviceId);
+  async validateTokenWithRevocation(token) {
+    const payload = this.validateToken(token);
+    if (payload === null) {
+      return null;
+    }
+    if (this.revocationStore) {
+      const revoked = await this.revocationStore.isRevoked(payload.jti);
+      if (revoked) {
+        return null;
+      }
+      const deviceRevoked = await this.revocationStore.isDeviceRevoked(payload.dev);
+      if (deviceRevoked) {
+        return null;
       }
-      this.devicesByUserId.delete(userId);
     }
+    return payload;
   }
   /**
-   * Update the last-seen timestamp for a device.
+   * Revoke a specific token by its JWT ID.
    *
-   * Called when a device authenticates or syncs to track activity.
-   * If the device does not exist, this is a no-op.
+   * Requires a revocation store to be configured. After revocation, the token
+   * will be rejected by {@link validateTokenWithRevocation}.
    *
-   * @param deviceId - The ID of the device to update
+   * @param jti - The JWT ID of the token to revoke
+   * @param expiresAt - The token's expiration time (seconds since epoch)
    */
-  async touchDevice(deviceId) {
-    const device = this.devicesById.get(deviceId);
-    if (device !== void 0) {
-      device.lastSeenAt = Date.now();
+  async revokeToken(jti, expiresAt) {
+    if (this.revocationStore) {
+      await this.revocationStore.revoke(jti, expiresAt);
     }
   }
-};
-function toAuthUser(stored) {
-  return {
-    id: stored.id,
-    email: stored.email,
-    name: stored.name,
-    emailVerified: stored.emailVerified,
-    createdAt: stored.createdAt
-  };
-}
-
-// src/provider/built-in/auth-routes.ts
-var InMemoryChallengeStore = class {
-  challenges = /* @__PURE__ */ new Map();
-  async store(challenge, deviceId, expiresAt) {
-    this.challenges.set(challenge, { deviceId, expiresAt });
+  /**
+   * Revoke all tokens for a specific device.
+   *
+   * Called when a device is revoked to ensure all its existing tokens
+   * (access, refresh, and device credentials) are invalidated.
+   *
+   * @param deviceId - The device ID whose tokens should be revoked
+   */
+  async revokeDeviceTokens(deviceId) {
+    if (this.revocationStore) {
+      await this.revocationStore.revokeAllForDevice(deviceId);
+    }
   }
-  async consume(challenge) {
-    const entry = this.challenges.get(challenge);
-    if (entry === void 0) {
+  /**
+   * Refresh an access token using a valid refresh token.
+   *
+   * Implements **refresh token rotation with reuse detection**: a new refresh token
+   * is issued alongside the new access token. The old refresh token's `jti` is
+   * recorded in the revocation store (if configured). If a previously consumed
+   * refresh token is presented again, it indicates potential token theft.
+   *
+   * Returns null if the provided token is invalid, expired, or not a refresh token.
+   *
+   * @param refreshToken - The refresh token JWT string
+   * @returns A new access/refresh token pair, or null if the refresh token is invalid
+   */
+  async refreshAccessToken(refreshToken) {
+    const payload = this.validateToken(refreshToken);
+    if (payload === null) {
       return null;
     }
-    this.challenges.delete(challenge);
-    if (Date.now() > entry.expiresAt) {
+    if (payload.type !== "refresh") {
       return null;
     }
-    return { deviceId: entry.deviceId };
-  }
-  /**
-   * Remove expired challenges to prevent unbounded memory growth.
-   */
-  cleanup() {
-    const now = Date.now();
-    for (const [challenge, entry] of this.challenges) {
-      if (now > entry.expiresAt) {
-        this.challenges.delete(challenge);
+    if (this.revocationStore) {
+      const wasRevoked = await this.revocationStore.isRevoked(payload.jti);
+      if (wasRevoked) {
+        await this.revocationStore.revokeAllForDevice(payload.dev);
+        return null;
       }
+      await this.revocationStore.revoke(payload.jti, payload.exp);
     }
+    return {
+      accessToken: this.issueAccessToken(payload.sub, payload.dev),
+      refreshToken: this.issueRefreshToken(payload.sub, payload.dev)
+    };
   }
 };
-var InMemoryRateLimiter = class {
-  attempts = /* @__PURE__ */ new Map();
-  maxAttempts;
-  windowMs;
-  /**
-   * @param maxAttempts - Maximum number of attempts within the time window (default: 10)
-   * @param windowMs - Time window in milliseconds (default: 60,000 = 1 minute)
-   */
-  constructor(maxAttempts = 10, windowMs = 6e4) {
-    this.maxAttempts = maxAttempts;
-    this.windowMs = windowMs;
+
+// src/provider/oauth/linked-identity-store.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { KoraError as KoraError2 } from "@korajs/core";
+var DuplicateLinkedIdentityError = class extends KoraError2 {
+  constructor(provider) {
+    super(`This ${provider} account is already linked.`, "DUPLICATE_LINKED_IDENTITY", {
+      provider
+    });
+    this.name = "DuplicateLinkedIdentityError";
   }
-  async isAllowed(key) {
-    const now = Date.now();
-    const attempts = this.attempts.get(key) ?? [];
-    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
-    return recentAttempts.length < this.maxAttempts;
+};
+var InMemoryLinkedIdentityStore = class {
+  identitiesById = /* @__PURE__ */ new Map();
+  identityIdByProvider = /* @__PURE__ */ new Map();
+  identityIdsByUser = /* @__PURE__ */ new Map();
+  identityIdByUserProvider = /* @__PURE__ */ new Map();
+  async findByProvider(provider, providerUserId) {
+    const id = this.identityIdByProvider.get(providerIdentityKey(provider, providerUserId));
+    return id ? this.identitiesById.get(id) ?? null : null;
+  }
+  async findByUser(userId) {
+    const ids = this.identityIdsByUser.get(userId);
+    if (!ids) return [];
+    return [...ids].map((id) => this.identitiesById.get(id)).filter((identity) => identity !== void 0);
   }
-  async record(key) {
-    const now = Date.now();
-    const attempts = this.attempts.get(key) ?? [];
-    const recentAttempts = attempts.filter((t) => now - t < this.windowMs);
-    recentAttempts.push(now);
-    this.attempts.set(key, recentAttempts);
+  async create(params) {
+    const providerKey = providerIdentityKey(params.provider, params.providerUserId);
+    const userProviderKeyValue = userProviderKey(params.userId, params.provider);
+    if (this.identityIdByProvider.has(providerKey) || this.identityIdByUserProvider.has(userProviderKeyValue)) {
+      throw new DuplicateLinkedIdentityError(params.provider);
+    }
+    const identity = {
+      id: randomUUID2(),
+      userId: params.userId,
+      provider: params.provider,
+      providerUserId: params.providerUserId,
+      email: params.email,
+      linkedAt: Date.now()
+    };
+    this.identitiesById.set(identity.id, identity);
+    this.identityIdByProvider.set(providerKey, identity.id);
+    this.identityIdByUserProvider.set(userProviderKeyValue, identity.id);
+    const userIdentities = this.identityIdsByUser.get(params.userId) ?? /* @__PURE__ */ new Set();
+    userIdentities.add(identity.id);
+    this.identityIdsByUser.set(params.userId, userIdentities);
+    return identity;
+  }
+  async delete(userId, provider) {
+    const userProviderKeyValue = userProviderKey(userId, provider);
+    const id = this.identityIdByUserProvider.get(userProviderKeyValue);
+    if (!id) return;
+    const identity = this.identitiesById.get(id);
+    this.identitiesById.delete(id);
+    this.identityIdByUserProvider.delete(userProviderKeyValue);
+    if (identity) {
+      this.identityIdByProvider.delete(
+        providerIdentityKey(identity.provider, identity.providerUserId)
+      );
+    }
+    const userIdentities = this.identityIdsByUser.get(userId);
+    userIdentities?.delete(id);
+    if (userIdentities?.size === 0) {
+      this.identityIdsByUser.delete(userId);
+    }
   }
-  async reset(key) {
-    this.attempts.delete(key);
+};
+function providerIdentityKey(provider, providerUserId) {
+  return `${provider}:${providerUserId}`;
+}
+function userProviderKey(userId, provider) {
+  return `${userId}:${provider}`;
+}
+
+// src/provider/oauth/oauth-types.ts
+import { KoraError as KoraError3 } from "@korajs/core";
+var OAuthError = class extends KoraError3 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "OAuthError";
   }
 };
-var MIN_PASSWORD_LENGTH = 8;
-var MAX_PASSWORD_LENGTH = 128;
-var MAX_NAME_LENGTH = 200;
-var CHALLENGE_TTL_MS = 6e4;
-function isValidEmail(email) {
-  if (email.length === 0 || email.length > 254) {
-    return false;
+var OAuthStateMismatchError = class extends OAuthError {
+  constructor() {
+    super("OAuth state parameter does not match. Possible CSRF attack.", "OAUTH_STATE_MISMATCH");
   }
-  const atIndex = email.indexOf("@");
-  if (atIndex < 1) {
-    return false;
+};
+var OAuthCodeExchangeError = class extends OAuthError {
+  constructor(details) {
+    super(
+      `Failed to exchange authorization code for tokens.${details ? ` ${details}` : ""}`,
+      "OAUTH_CODE_EXCHANGE_FAILED",
+      details ? { details } : void 0
+    );
   }
-  const domain = email.slice(atIndex + 1);
-  if (domain.length === 0 || !domain.includes(".")) {
-    return false;
+};
+var OAuthUserInfoError = class extends OAuthError {
+  constructor(details) {
+    super(
+      `Failed to fetch user info from OAuth provider.${details ? ` ${details}` : ""}`,
+      "OAUTH_USER_INFO_FAILED",
+      details ? { details } : void 0
+    );
   }
-  if (email.indexOf("@", atIndex + 1) !== -1) {
-    return false;
+};
+var OAuthProviderNotFoundError = class extends OAuthError {
+  constructor(provider) {
+    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", {
+      provider
+    });
   }
-  if (email.includes(" ")) {
-    return false;
+};
+
+// src/provider/oauth/oauth-flow.ts
+var DEFAULT_STATE_TTL_MS = 10 * 60 * 1e3;
+var PKCE_VERIFIER_BYTES = 32;
+var InMemoryOAuthStateStore = class {
+  states = /* @__PURE__ */ new Map();
+  async store(state) {
+    this.states.set(state.state, state);
   }
-  return true;
-}
-function sanitizeName(name) {
-  const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
-  const trimmed = cleaned.trim();
-  if (trimmed.length > MAX_NAME_LENGTH) {
-    return trimmed.slice(0, MAX_NAME_LENGTH);
+  async consume(stateValue) {
+    const state = this.states.get(stateValue);
+    if (!state) return null;
+    this.states.delete(stateValue);
+    if (Date.now() > state.expiresAt) return null;
+    return state;
   }
-  return trimmed;
-}
-var BuiltInAuthRoutes = class {
-  userStore;
-  tokenManager;
-  challengeStore;
-  rateLimiter;
+  async cleanExpired() {
+    const now = Date.now();
+    let count = 0;
+    for (const [key, state] of this.states) {
+      if (now > state.expiresAt) {
+        this.states.delete(key);
+        count++;
+      }
+    }
+    return count;
+  }
+};
+var OAuthManager = class {
+  providers = /* @__PURE__ */ new Map();
+  stateStore;
+  stateTtlMs;
+  fetchFn;
   constructor(config) {
-    this.userStore = config.userStore;
-    this.tokenManager = config.tokenManager;
-    this.challengeStore = config.challengeStore ?? new InMemoryChallengeStore();
-    this.rateLimiter = config.rateLimiter ?? new InMemoryRateLimiter();
+    for (const provider of config.providers) {
+      this.providers.set(provider.providerId, provider);
+    }
+    this.stateStore = config.stateStore ?? new InMemoryOAuthStateStore();
+    this.stateTtlMs = config.stateTtlMs ?? DEFAULT_STATE_TTL_MS;
+    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
   }
   /**
-   * Handle user sign-up (POST /auth/signup).
-   *
-   * Validates email format and password length, hashes the password,
-   * creates the user, optionally registers a device, and issues tokens.
-   *
-   * @param body - Sign-up request body
-   * @param body.email - The user's email address
-   * @param body.password - The plaintext password (8-128 characters)
-   * @param body.name - Optional display name (defaults to email local part)
-   * @param body.deviceId - Optional device ID to register
-   * @param body.devicePublicKey - Optional device public key (base64url)
-   * @param clientIp - Optional client IP for rate limiting
-   * @returns Auth response with the created user and tokens, or an error
+   * Generate an authorization URL for the user to visit.
+   * Returns the URL and the state parameter for CSRF validation.
    */
-  async handleSignUp(body, clientIp) {
-    const rateLimitKey = clientIp ?? "global";
-    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
-      return {
-        status: 429,
-        body: { error: "Too many requests. Please try again later." }
-      };
+  async getAuthorizationUrl(providerId, metadata) {
+    const provider = this.getProvider(providerId);
+    const state = generateState();
+    const codeVerifier = provider.pkce ? generateCodeVerifier() : void 0;
+    const codeChallenge = codeVerifier ? await createCodeChallenge(codeVerifier) : void 0;
+    const now = Date.now();
+    const oauthState = {
+      state,
+      provider: providerId,
+      redirectUri: provider.redirectUri,
+      createdAt: now,
+      expiresAt: now + this.stateTtlMs,
+      metadata,
+      codeVerifier
+    };
+    await this.stateStore.store(oauthState);
+    const params = new URLSearchParams({
+      client_id: provider.clientId,
+      redirect_uri: provider.redirectUri,
+      response_type: "code",
+      scope: provider.scopes.join(" "),
+      state
+    });
+    if (codeChallenge) {
+      params.set("code_challenge", codeChallenge);
+      params.set("code_challenge_method", "S256");
     }
-    await this.rateLimiter.record(rateLimitKey);
-    if (!isValidEmail(body.email)) {
-      return {
-        status: 400,
-        body: {
-          error: "Invalid email address. Please provide a valid email in the format user@domain.com."
-        }
-      };
+    const url = `${provider.authorizationUrl}?${params.toString()}`;
+    return { url, state };
+  }
+  /**
+   * Handle the OAuth callback after the user authorizes.
+   * Validates the state parameter, exchanges the code for tokens,
+   * and fetches user info.
+   *
+   * @param providerId - The OAuth provider
+   * @param code - The authorization code from the callback
+   * @param state - The state parameter from the callback
+   * @returns Tokens and user info from the provider
+   */
+  async handleCallback(providerId, code, state) {
+    const provider = this.getProvider(providerId);
+    const oauthState = await this.stateStore.consume(state);
+    if (!oauthState || oauthState.provider !== providerId) {
+      throw new OAuthStateMismatchError();
     }
-    if (body.password.length < MIN_PASSWORD_LENGTH) {
-      return {
-        status: 400,
-        body: {
-          error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long.`
-        }
-      };
+    const tokens = await this.exchangeCodeForTokens(provider, code, oauthState);
+    const userInfo = await this.fetchUserInfo(provider, tokens.accessToken);
+    return { tokens, userInfo, stateMetadata: oauthState.metadata };
+  }
+  /**
+   * Get a registered provider by ID.
+   */
+  getProvider(providerId) {
+    const provider = this.providers.get(providerId);
+    if (!provider) {
+      throw new OAuthProviderNotFoundError(providerId);
     }
-    if (body.password.length > MAX_PASSWORD_LENGTH) {
-      return {
-        status: 400,
-        body: {
-          error: `Password must be at most ${MAX_PASSWORD_LENGTH} characters long.`
-        }
-      };
+    return provider;
+  }
+  /**
+   * List all registered provider IDs.
+   */
+  getProviderIds() {
+    return [...this.providers.keys()];
+  }
+  // --- Private ---
+  async exchangeCodeForTokens(provider, code, oauthState) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: provider.redirectUri,
+      client_id: provider.clientId
+    });
+    if (provider.clientSecret) {
+      body.set("client_secret", provider.clientSecret);
     }
-    const { hash, salt } = await hashPassword(body.password);
-    const rawName = body.name ?? body.email.split("@")[0] ?? body.email;
-    const name = sanitizeName(rawName);
-    let user;
+    if (oauthState.codeVerifier) {
+      body.set("code_verifier", oauthState.codeVerifier);
+    }
+    let response;
     try {
-      user = await this.userStore.createUser({
-        email: body.email,
-        passwordHash: hash,
-        salt,
-        name
+      response = await this.fetchFn(provider.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: body.toString()
       });
     } catch (err) {
-      if (err instanceof Error && err.name === "DuplicateEmailError") {
-        return {
-          status: 409,
-          body: { error: "An account with this email already exists." }
-        };
+      throw new OAuthCodeExchangeError(err instanceof Error ? err.message : "Network error");
+    }
+    if (!response.ok) {
+      let details = `HTTP ${response.status}`;
+      try {
+        const errorBody = await response.text();
+        details += `: ${errorBody}`;
+      } catch {
       }
-      throw err;
+      throw new OAuthCodeExchangeError(details);
     }
-    const deviceId = body.deviceId ?? `device-${user.id}`;
-    await this.userStore.registerDevice({
-      id: deviceId,
-      userId: user.id,
-      publicKey: body.devicePublicKey ?? "",
-      name: body.deviceId ? "Primary Device" : "Browser"
-    });
-    const tokens = this.tokenManager.issueTokens(user.id, deviceId);
+    const data = await response.json();
     return {
-      status: 201,
-      body: { data: { user, tokens } }
+      accessToken: data.access_token,
+      tokenType: data.token_type ?? "Bearer",
+      expiresIn: data.expires_in,
+      refreshToken: data.refresh_token,
+      idToken: data.id_token,
+      scope: data.scope
     };
   }
-  /**
-   * Handle user sign-in (POST /auth/signin).
-   *
-   * Looks up the user by email, verifies the password, optionally registers
-   * a new device, and issues tokens.
-   *
-   * @param body - Sign-in request body
-   * @param body.email - The user's email address
-   * @param body.password - The plaintext password
-   * @param body.deviceId - Optional device ID to register
-   * @param body.devicePublicKey - Optional device public key (base64url)
-   * @param clientIp - Optional client IP for rate limiting
-   * @returns Auth response with the user and tokens, or an error
-   */
-  async handleSignIn(body, clientIp) {
-    const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
-    if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
-      return {
-        status: 429,
-        body: { error: "Too many sign-in attempts. Please try again later." }
-      };
+  async fetchUserInfo(provider, accessToken) {
+    let response;
+    try {
+      response = await this.fetchFn(provider.userInfoUrl, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: "application/json"
+        }
+      });
+    } catch (err) {
+      throw new OAuthUserInfoError(err instanceof Error ? err.message : "Network error");
     }
-    await this.rateLimiter.record(rateLimitKey);
-    const storedUser = await this.userStore.findByEmail(body.email);
-    if (storedUser === null) {
+    if (!response.ok) {
+      throw new OAuthUserInfoError(`HTTP ${response.status}`);
+    }
+    const profile = await response.json();
+    return normalizeUserInfo(provider.providerId, profile);
+  }
+};
+function normalizeUserInfo(providerId, profile) {
+  switch (providerId) {
+    case "google":
       return {
-        status: 401,
-        body: { error: "Invalid email or password." }
+        providerId: profile.sub,
+        provider: "google",
+        email: profile.email ?? null,
+        emailVerified: profile.email_verified ?? false,
+        name: profile.name ?? null,
+        avatarUrl: profile.picture ?? null,
+        rawProfile: profile
       };
-    }
-    const passwordValid = await verifyPassword(
-      body.password,
-      storedUser.passwordHash,
-      storedUser.salt
-    );
-    if (!passwordValid) {
+    case "github":
       return {
-        status: 401,
-        body: { error: "Invalid email or password." }
+        providerId: String(profile.id),
+        provider: "github",
+        email: profile.email ?? null,
+        emailVerified: false,
+        // GitHub doesn't confirm in the profile response
+        name: profile.name ?? profile.login ?? null,
+        avatarUrl: profile.avatar_url ?? null,
+        rawProfile: profile
       };
-    }
-    await this.rateLimiter.reset(rateLimitKey);
-    const deviceId = body.deviceId ?? `device-${storedUser.id}`;
-    await this.userStore.registerDevice({
-      id: deviceId,
-      userId: storedUser.id,
-      publicKey: body.devicePublicKey ?? "",
-      name: body.deviceId ? "Device" : "Browser"
-    });
-    const tokens = this.tokenManager.issueTokens(storedUser.id, deviceId);
-    const user = {
-      id: storedUser.id,
-      email: storedUser.email,
-      name: storedUser.name,
-      emailVerified: storedUser.emailVerified,
-      createdAt: storedUser.createdAt
-    };
-    return {
-      status: 200,
-      body: { data: { user, tokens } }
-    };
-  }
-  /**
-   * Handle token refresh (POST /auth/refresh).
-   *
-   * Validates the provided refresh token and issues a new token pair
-   * (refresh token rotation with reuse detection). The old refresh token
-   * is marked as consumed in the revocation store.
-   *
-   * @param body - Refresh request body
-   * @param body.refreshToken - The current refresh token
-   * @returns Auth response with new tokens, or an error
-   */
-  async handleRefresh(body) {
-    const result = await this.tokenManager.refreshAccessToken(body.refreshToken);
-    if (result === null) {
+    case "microsoft":
       return {
-        status: 401,
-        body: { error: "Invalid or expired refresh token." }
+        providerId: profile.id,
+        provider: "microsoft",
+        email: profile.mail ?? profile.userPrincipalName ?? null,
+        emailVerified: false,
+        name: profile.displayName ?? null,
+        avatarUrl: null,
+        rawProfile: profile
       };
-    }
-    return {
-      status: 200,
-      body: { data: result }
-    };
-  }
-  /**
-   * Handle sign-out (POST /auth/signout).
-   *
-   * Validates the access token and revokes the current refresh token
-   * (if a revocation store is configured). This ensures that stolen
-   * refresh tokens cannot be used after the user signs out.
-   *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param body - Sign-out request body
-   * @param body.refreshToken - The current refresh token to revoke
-   * @returns Auth response with success flag, or an error
-   */
-  async handleSignOut(accessToken, body) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
+    default:
       return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
+        providerId: String(profile.id ?? profile.sub ?? ""),
+        provider: providerId,
+        email: profile.email ?? null,
+        emailVerified: profile.email_verified ?? false,
+        name: profile.name ?? null,
+        avatarUrl: profile.picture ?? profile.avatar_url ?? null,
+        rawProfile: profile
       };
-    }
-    await this.tokenManager.revokeToken(payload.jti, payload.exp);
-    if (body.refreshToken) {
-      const refreshPayload = this.tokenManager.validateToken(body.refreshToken);
-      if (refreshPayload !== null && refreshPayload.type === "refresh") {
-        await this.tokenManager.revokeToken(refreshPayload.jti, refreshPayload.exp);
-      }
-    }
-    return {
-      status: 200,
-      body: { data: { success: true } }
-    };
   }
+}
+function googleProvider(config) {
+  return {
+    providerId: "google",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
+    scopes: config.scopes ?? ["openid", "email", "profile"],
+    redirectUri: config.redirectUri,
+    pkce: config.pkce
+  };
+}
+function githubProvider(config) {
+  return {
+    providerId: "github",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    userInfoUrl: "https://api.github.com/user",
+    scopes: config.scopes ?? ["read:user", "user:email"],
+    redirectUri: config.redirectUri,
+    pkce: config.pkce
+  };
+}
+function microsoftProvider(config) {
+  const tenant = config.tenantId ?? "common";
+  return {
+    providerId: "microsoft",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
+    tokenUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+    userInfoUrl: "https://graph.microsoft.com/v1.0/me",
+    scopes: config.scopes ?? ["openid", "email", "profile", "User.Read"],
+    redirectUri: config.redirectUri,
+    pkce: config.pkce
+  };
+}
+function generateState() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  return toBase64Url2(bytes);
+}
+function generateCodeVerifier() {
+  const bytes = new Uint8Array(PKCE_VERIFIER_BYTES);
+  globalThis.crypto.getRandomValues(bytes);
+  return toBase64Url2(bytes);
+}
+async function createCodeChallenge(codeVerifier) {
+  const data = new TextEncoder().encode(codeVerifier);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+  return toBase64Url2(new Uint8Array(digest));
+}
+function toBase64Url2(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/provider/built-in/user-store.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { KoraError as KoraError4 } from "@korajs/core";
+var DuplicateEmailError = class extends KoraError4 {
+  constructor() {
+    super("A user with this email already exists.", "DUPLICATE_EMAIL");
+    this.name = "DuplicateEmailError";
+  }
+};
+var InMemoryUserStore = class {
+  /** Users indexed by ID */
+  usersById = /* @__PURE__ */ new Map();
+  /** Users indexed by email (lowercase) for fast lookup */
+  usersByEmail = /* @__PURE__ */ new Map();
+  /** Devices indexed by device ID */
+  devicesById = /* @__PURE__ */ new Map();
+  /** Device IDs indexed by user ID for fast listing */
+  devicesByUserId = /* @__PURE__ */ new Map();
   /**
-   * Handle get-current-user (GET /auth/me).
-   *
-   * Validates the access token and returns the authenticated user's profile.
+   * Create a new user account.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @returns Auth response with the user profile, or an error
+   * @param params - User creation parameters
+   * @param params.email - The user's email address (must be unique, case-insensitive)
+   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
+   * @param params.salt - Hex-encoded salt used during hashing
+   * @param params.name - The user's display name
+   * @returns The created user (without sensitive credential fields)
+   * @throws {DuplicateEmailError} If a user with the same email already exists
    */
-  async handleGetMe(accessToken) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const storedUser = await this.userStore.findById(payload.sub);
-    if (storedUser === null) {
-      return {
-        status: 404,
-        body: { error: "User not found." }
-      };
+  async createUser(params) {
+    const normalizedEmail = params.email.toLowerCase();
+    if (this.usersByEmail.has(normalizedEmail)) {
+      throw new DuplicateEmailError();
     }
-    const user = {
-      id: storedUser.id,
-      email: storedUser.email,
-      name: storedUser.name,
-      emailVerified: storedUser.emailVerified,
-      createdAt: storedUser.createdAt
-    };
-    return {
-      status: 200,
-      body: { data: user }
+    const now = Date.now();
+    const id = randomUUID3();
+    const storedUser = {
+      id,
+      email: normalizedEmail,
+      name: params.name,
+      emailVerified: false,
+      createdAt: now,
+      passwordHash: params.passwordHash,
+      salt: params.salt
     };
+    this.usersById.set(id, storedUser);
+    this.usersByEmail.set(normalizedEmail, storedUser);
+    return toAuthUser(storedUser);
   }
   /**
-   * Handle list-devices (GET /auth/devices).
-   *
-   * Validates the access token and returns all devices registered for the user.
+   * Find a user by email address.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @returns Auth response with the device list, or an error
+   * @param email - The email to search for (case-insensitive)
+   * @returns The stored user record including credentials, or null if not found
    */
-  async handleListDevices(accessToken) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const devices = await this.userStore.listDevices(payload.sub);
-    return {
-      status: 200,
-      body: { data: devices }
-    };
+  async findByEmail(email) {
+    return this.usersByEmail.get(email.toLowerCase()) ?? null;
   }
   /**
-   * Handle device revocation (DELETE /auth/device/:id).
-   *
-   * Validates the access token, revokes the specified device, and invalidates
-   * all tokens issued to that device. Only the device's owner can revoke it.
+   * Find a user by ID.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param deviceId - The ID of the device to revoke
-   * @returns Auth response with success flag, or an error
+   * @param id - The user ID to search for
+   * @returns The stored user record including credentials, or null if not found
    */
-  async handleRevokeDevice(accessToken, deviceId) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const device = await this.userStore.findDevice(deviceId);
-    if (device === null) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
-    }
-    if (device.userId !== payload.sub) {
-      return {
-        status: 403,
-        body: { error: "You can only revoke your own devices." }
-      };
-    }
-    await this.userStore.revokeDevice(deviceId);
-    await this.tokenManager.revokeDeviceTokens(deviceId);
-    return {
-      status: 200,
-      body: { data: { success: true } }
-    };
+  async findById(id) {
+    return this.usersById.get(id) ?? null;
   }
   /**
-   * Handle device registration (POST /auth/device/register).
+   * Register a device for a user.
    *
-   * Requires a valid access token. Registers a new device for the authenticated
-   * user and issues a device credential token bound to the device's public key.
+   * If a device with the same ID already exists and is not revoked, it is
+   * returned as-is (idempotent registration). If it was previously revoked,
+   * it is re-activated with updated details.
    *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param body - Device registration request body
-   * @param body.deviceId - Unique identifier for the device
-   * @param body.publicKey - The device's public key as a JWK JSON string
-   * @param body.name - Human-readable device name (e.g., "Chrome on MacBook")
-   * @returns Auth response with the registered device and device credential, or an error
+   * @param params - Device registration parameters
+   * @param params.id - Unique device identifier
+   * @param params.userId - ID of the user who owns the device
+   * @param params.publicKey - Base64url-encoded device public key or thumbprint
+   * @param params.name - Human-readable device name
+   * @returns The registered device record
    */
-  async handleDeviceRegister(accessToken, body) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const deviceName = sanitizeName(body.name);
-    if (deviceName.length === 0) {
-      return {
-        status: 400,
-        body: { error: "Device name must not be empty." }
-      };
-    }
-    let publicKeyJwk;
-    try {
-      publicKeyJwk = JSON.parse(body.publicKey);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Invalid public key format. Expected a JSON-encoded JWK string." }
-      };
-    }
-    let thumbprint;
-    try {
-      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Failed to compute public key thumbprint. Ensure the key is a valid EC P-256 JWK." }
-      };
+  async registerDevice(params) {
+    const existing = this.devicesById.get(params.id);
+    if (existing !== void 0 && !existing.revoked) {
+      return existing;
     }
-    const device = await this.userStore.registerDevice({
-      id: body.deviceId,
-      userId: payload.sub,
-      publicKey: body.publicKey,
-      name: deviceName
-    });
-    const deviceCredential = this.tokenManager.issueDeviceCredential(
-      payload.sub,
-      body.deviceId,
-      thumbprint
-    );
-    return {
-      status: 201,
-      body: { data: { device, deviceCredential } }
+    const now = Date.now();
+    const device = {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: now,
+      lastSeenAt: now
     };
-  }
-  /**
-   * Generate a challenge for device proof-of-possession verification.
-   *
-   * Creates a cryptographically random challenge, stores it server-side with
-   * a 60-second TTL and the target device ID, and returns the challenge string.
-   * The client signs this challenge with its private key and submits it via
-   * {@link handleDeviceVerify}.
-   *
-   * @param accessToken - The JWT access token (without "Bearer " prefix)
-   * @param deviceId - The device this challenge is intended for
-   * @returns Auth response with the challenge string, or an error
-   */
-  async handleDeviceChallenge(accessToken, deviceId) {
-    const payload = this.tokenManager.validateToken(accessToken);
-    if (payload === null || payload.type !== "access") {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired access token." }
-      };
-    }
-    const device = await this.userStore.findDevice(deviceId);
-    if (device === null || device.userId !== payload.sub) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
-    }
-    if (device.revoked) {
-      return {
-        status: 403,
-        body: { error: "Device has been revoked." }
-      };
+    this.devicesById.set(params.id, device);
+    let userDevices = this.devicesByUserId.get(params.userId);
+    if (userDevices === void 0) {
+      userDevices = /* @__PURE__ */ new Set();
+      this.devicesByUserId.set(params.userId, userDevices);
     }
-    const challenge = randomBytes2(32).toString("hex");
-    const expiresAt = Date.now() + CHALLENGE_TTL_MS;
-    await this.challengeStore.store(challenge, deviceId, expiresAt);
-    return {
-      status: 200,
-      body: { data: { challenge } }
-    };
+    userDevices.add(params.id);
+    return device;
   }
   /**
-   * Handle device proof-of-possession verification (POST /auth/device/verify).
-   *
-   * Verifies that the device holds the private key corresponding to its registered
-   * public key by checking a signed challenge. The challenge must have been previously
-   * issued via {@link handleDeviceChallenge} and is single-use.
+   * Find a device by its ID.
    *
-   * On success, issues fresh tokens for the device.
+   * @param deviceId - The device ID to search for
+   * @returns The device record, or null if not found
+   */
+  async findDevice(deviceId) {
+    return this.devicesById.get(deviceId) ?? null;
+  }
+  /**
+   * List all devices registered for a user.
    *
-   * @param body - Device verification request body
-   * @param body.deviceId - The ID of the device to verify
-   * @param body.challenge - The challenge string (from handleDeviceChallenge)
-   * @param body.signature - The base64url-encoded ECDSA signature of the challenge
-   * @returns Auth response with fresh tokens on success, or an error
+   * @param userId - The user ID whose devices to list
+   * @returns Array of device records (includes revoked devices)
    */
-  async handleDeviceVerify(body) {
-    const challengeEntry = await this.challengeStore.consume(body.challenge);
-    if (challengeEntry === null) {
-      return {
-        status: 401,
-        body: { error: "Invalid or expired challenge. Request a new challenge and try again." }
-      };
-    }
-    if (challengeEntry.deviceId !== body.deviceId) {
-      return {
-        status: 401,
-        body: { error: "Challenge was not issued for this device." }
-      };
-    }
-    const device = await this.userStore.findDevice(body.deviceId);
-    if (device === null) {
-      return {
-        status: 404,
-        body: { error: "Device not found." }
-      };
-    }
-    if (device.revoked) {
-      return {
-        status: 403,
-        body: { error: "Device has been revoked and cannot authenticate." }
-      };
-    }
-    let publicKeyJwk;
-    try {
-      publicKeyJwk = JSON.parse(device.publicKey);
-    } catch {
-      return {
-        status: 500,
-        body: { error: "Device has an invalid stored public key." }
-      };
-    }
-    let isValid;
-    try {
-      isValid = await verifyChallenge(publicKeyJwk, body.challenge, body.signature);
-    } catch {
-      return {
-        status: 400,
-        body: { error: "Signature verification failed. The signature or public key format may be invalid." }
-      };
-    }
-    if (!isValid) {
-      return {
-        status: 401,
-        body: { error: "Invalid signature. Proof-of-possession verification failed." }
-      };
+  async listDevices(userId) {
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds === void 0) {
+      return [];
     }
-    let thumbprint;
-    try {
-      thumbprint = await computePublicKeyThumbprint(publicKeyJwk);
-    } catch {
-      return {
-        status: 500,
-        body: { error: "Failed to compute public key thumbprint." }
-      };
+    const devices = [];
+    for (const deviceId of deviceIds) {
+      const device = this.devicesById.get(deviceId);
+      if (device !== void 0) {
+        devices.push(device);
+      }
     }
-    const tokens = this.tokenManager.issueTokens(device.userId, device.id, thumbprint);
-    return {
-      status: 200,
-      body: { data: { tokens } }
-    };
+    return devices;
   }
   /**
-   * Generates a random challenge string for proof-of-possession verification.
+   * Revoke a device, preventing it from being used for authentication.
    *
-   * **Deprecated:** Use {@link handleDeviceChallenge} instead, which stores
-   * the challenge server-side with expiry and single-use semantics.
+   * This is a soft revoke — the device record remains but is marked as revoked.
+   * If the device does not exist, this is a no-op.
    *
-   * @returns A 64-character hex string (32 random bytes)
+   * @param deviceId - The ID of the device to revoke
    */
-  static generateChallenge() {
-    return randomBytes2(32).toString("hex");
+  async revokeDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.revoked = true;
+    }
   }
   /**
-   * Creates a sync server auth provider compatible with `@korajs/server`.
+   * Set a user's email verification status.
    *
-   * The returned object implements the `AuthProvider` interface from
-   * `@korajs/server`, validating access tokens and returning an auth
-   * context containing the user ID and device metadata. This bridges
-   * the built-in auth system with the sync server's authentication layer.
+   * @param userId - The user whose email to verify
+   * @param verified - Whether the email is verified
+   */
+  async setEmailVerified(userId, verified) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, emailVerified: verified };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
+  }
+  /**
+   * Update a user's password hash and salt.
    *
-   * Also checks device revocation status during authentication, ensuring
-   * that revoked devices are rejected even if their tokens haven't expired.
+   * @param userId - The user whose password to update
+   * @param passwordHash - New hex-encoded PBKDF2 derived key
+   * @param salt - New hex-encoded salt
+   */
+  async updatePassword(userId, passwordHash, salt) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, passwordHash, salt };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
+  }
+  /**
+   * List all users. For admin/development use.
+   */
+  async listAll() {
+    return [...this.usersById.values()];
+  }
+  /**
+   * Update a stored user record.
+   */
+  async update(user) {
+    const existing = this.usersById.get(user.id);
+    if (!existing) return;
+    if (existing.email !== user.email) {
+      this.usersByEmail.delete(existing.email);
+      this.usersByEmail.set(user.email, user);
+    } else {
+      this.usersByEmail.set(user.email, user);
+    }
+    this.usersById.set(user.id, user);
+  }
+  /**
+   * Delete a user and all associated devices.
+   */
+  async delete(userId) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    this.usersById.delete(userId);
+    this.usersByEmail.delete(user.email);
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds) {
+      for (const deviceId of deviceIds) {
+        this.devicesById.delete(deviceId);
+      }
+      this.devicesByUserId.delete(userId);
+    }
+  }
+  /**
+   * Update the last-seen timestamp for a device.
    *
-   * @returns An object with an `authenticate` method suitable for KoraSyncServer's `auth` config
+   * Called when a device authenticates or syncs to track activity.
+   * If the device does not exist, this is a no-op.
    *
-   * @example
-   * ```typescript
-   * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
-   * const syncServer = new KoraSyncServer({
-   *   store,
-   *   auth: routes.toSyncAuthProvider(),
-   * })
-   * ```
+   * @param deviceId - The ID of the device to update
    */
-  toSyncAuthProvider() {
-    const tokenManager = this.tokenManager;
-    const userStore = this.userStore;
-    return {
-      async authenticate(token) {
-        const payload = tokenManager.validateToken(token);
-        if (payload === null || payload.type !== "access") {
-          return null;
-        }
-        const user = await userStore.findById(payload.sub);
-        if (user === null) {
-          return null;
-        }
-        const device = await userStore.findDevice(payload.dev);
-        if (device !== null && device.revoked) {
-          return null;
-        }
-        await userStore.touchDevice(payload.dev);
+  async touchDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.lastSeenAt = Date.now();
+    }
+  }
+};
+function toAuthUser(stored) {
+  return {
+    id: stored.id,
+    email: stored.email,
+    name: stored.name,
+    emailVerified: stored.emailVerified,
+    createdAt: stored.createdAt
+  };
+}
+
+// src/provider/built-in/quickstart-server.ts
+function createKoraAuthServer(options = {}) {
+  const userStore = options.userStore ?? new InMemoryUserStore();
+  const tokenManager = options.tokenManager ?? createDefaultTokenManager(options);
+  const routes = new BuiltInAuthRoutes({
+    userStore,
+    tokenManager,
+    challengeStore: options.challengeStore,
+    rateLimiter: options.rateLimiter
+  });
+  const oauth = options.oauth ? createOAuthRuntime(options.oauth) : void 0;
+  const path = normalizePath(options.path ?? "/auth");
+  return {
+    routes,
+    userStore,
+    tokenManager,
+    oauth: oauth?.manager,
+    linkedIdentityStore: oauth?.linkedIdentityStore,
+    auth: routes.toSyncAuthProvider(),
+    handleRequest(request) {
+      return handleAuthRequest(routes, path, request, oauth, userStore, tokenManager);
+    }
+  };
+}
+function createDefaultTokenManager(options) {
+  const secret = options.jwtSecret ?? readEnvSecret();
+  if (!secret && isProduction()) {
+    throw new Error(
+      "createKoraAuthServer requires jwtSecret in production. Set KORA_AUTH_SECRET or pass jwtSecret."
+    );
+  }
+  return new TokenManager({
+    secret: secret ?? TokenManager.generateSecret(),
+    revocationStore: new InMemoryTokenRevocationStore(),
+    ...options.tokenManagerOptions
+  });
+}
+function createOAuthRuntime(config) {
+  return {
+    manager: new OAuthManager(config),
+    linkedIdentityStore: config.linkedIdentityStore ?? new InMemoryLinkedIdentityStore(),
+    createNewUsers: config.createNewUsers ?? true,
+    autoLinkVerifiedEmail: config.autoLinkVerifiedEmail ?? false,
+    allowUnlinkLastIdentity: config.allowUnlinkLastIdentity ?? false
+  };
+}
+async function handleAuthRequest(routes, pathPrefix, request, oauth, userStore, tokenManager) {
+  const path = normalizePath(request.path);
+  const relativePath = path === pathPrefix ? "/" : path.slice(pathPrefix.length);
+  const method = request.method.toUpperCase();
+  const body = isRecord(request.body) ? request.body : {};
+  const token = extractBearerToken(request.headers);
+  if (path !== pathPrefix && !path.startsWith(`${pathPrefix}/`)) {
+    return notFound();
+  }
+  if (relativePath.startsWith("/oauth/")) {
+    return handleOAuthRequest({
+      oauth,
+      userStore,
+      tokenManager,
+      relativePath,
+      method,
+      body,
+      query: request.query,
+      token
+    });
+  }
+  if (method === "POST" && relativePath === "/signup") {
+    return routes.handleSignUp(body, request.ip);
+  }
+  if (method === "POST" && relativePath === "/signin") {
+    return routes.handleSignIn(body, request.ip);
+  }
+  if (method === "POST" && relativePath === "/refresh") {
+    return routes.handleRefresh(body);
+  }
+  if (method === "POST" && relativePath === "/signout") {
+    return routes.handleSignOut(token, body);
+  }
+  if (method === "GET" && relativePath === "/me") {
+    return routes.handleGetMe(token);
+  }
+  if (method === "GET" && relativePath === "/devices") {
+    return routes.handleListDevices(token);
+  }
+  if (method === "POST" && relativePath === "/device/register") {
+    return routes.handleDeviceRegister(token, body);
+  }
+  if (method === "POST" && relativePath === "/device/challenge") {
+    const deviceId = typeof body.deviceId === "string" ? body.deviceId : "";
+    return routes.handleDeviceChallenge(token, deviceId);
+  }
+  if (method === "POST" && relativePath === "/device/verify") {
+    return routes.handleDeviceVerify(body);
+  }
+  if (method === "DELETE" && relativePath.startsWith("/device/")) {
+    return routes.handleRevokeDevice(token, relativePath.slice("/device/".length));
+  }
+  return notFound();
+}
+async function handleOAuthRequest(params) {
+  const { oauth, userStore, tokenManager, relativePath, method, body, query, token } = params;
+  if (!oauth) {
+    return notFound();
+  }
+  try {
+    if (method === "GET" && relativePath === "/oauth/links") {
+      const authUser = await requireAuthUser(tokenManager, userStore, token);
+      if ("status" in authUser) return authUser;
+      const identities = await oauth.linkedIdentityStore.findByUser(authUser.id);
+      return { status: 200, body: { data: identities } };
+    }
+    const match = /^\/oauth\/([^/]+)(?:\/(callback|link))?$/.exec(relativePath);
+    if (!match) {
+      return notFound();
+    }
+    const provider = decodeURIComponent(match[1]);
+    const action = match[2];
+    if (method === "GET" && !action) {
+      const { url, state } = await oauth.manager.getAuthorizationUrl(
+        provider,
+        metadataFromQuery(query)
+      );
+      return { status: 200, body: { data: { url, state } } };
+    }
+    if ((method === "GET" || method === "POST") && action === "callback") {
+      const code = readString(method === "GET" ? queryValue(query, "code") : body.code);
+      const state = readString(method === "GET" ? queryValue(query, "state") : body.state);
+      if (!code || !state) {
+        return { status: 400, body: { error: "OAuth callback requires code and state." } };
+      }
+      return completeOAuthSignIn({
+        oauth,
+        userStore,
+        tokenManager,
+        provider,
+        code,
+        state,
+        deviceId: readString(body.deviceId),
+        devicePublicKey: readString(body.devicePublicKey)
+      });
+    }
+    if (method === "POST" && action === "link") {
+      const authUser = await requireAuthUser(tokenManager, userStore, token);
+      if ("status" in authUser) return authUser;
+      const code = readString(body.code);
+      const state = readString(body.state);
+      if (!code || !state) {
+        return { status: 400, body: { error: "OAuth linking requires code and state." } };
+      }
+      return linkOAuthIdentity(oauth, authUser.id, provider, code, state);
+    }
+    if (method === "DELETE" && action === "link") {
+      const authUser = await requireAuthUser(tokenManager, userStore, token);
+      if ("status" in authUser) return authUser;
+      const identities = await oauth.linkedIdentityStore.findByUser(authUser.id);
+      if (!oauth.allowUnlinkLastIdentity && identities.length <= 1) {
         return {
-          userId: payload.sub,
-          metadata: {
-            deviceId: payload.dev,
-            email: user.email,
-            name: user.name
+          status: 409,
+          body: {
+            error: "Cannot unlink the last OAuth identity unless allowUnlinkLastIdentity is enabled."
           }
         };
       }
+      await oauth.linkedIdentityStore.delete(authUser.id, provider);
+      return { status: 200, body: { data: { ok: true } } };
+    }
+  } catch (error) {
+    return oauthErrorResponse(error);
+  }
+  return notFound();
+}
+async function completeOAuthSignIn(params) {
+  const { oauth, userStore, tokenManager, provider, code, state, deviceId, devicePublicKey } = params;
+  const { userInfo, stateMetadata } = await oauth.manager.handleCallback(provider, code, state);
+  const linkedIdentity = await oauth.linkedIdentityStore.findByProvider(
+    userInfo.provider,
+    userInfo.providerId
+  );
+  let user;
+  let identity;
+  if (linkedIdentity) {
+    const storedUser = await userStore.findById(linkedIdentity.userId);
+    if (!storedUser) {
+      return { status: 409, body: { error: "Linked OAuth account has no matching user." } };
+    }
+    user = toAuthUser2(storedUser);
+    identity = linkedIdentity;
+  } else {
+    const resolved = await resolveOAuthUser(userStore, oauth, userInfo);
+    if ("status" in resolved) return resolved;
+    user = resolved;
+    identity = await oauth.linkedIdentityStore.create({
+      userId: user.id,
+      provider: userInfo.provider,
+      providerUserId: userInfo.providerId,
+      email: userInfo.email
+    });
+  }
+  const resolvedDeviceId = deviceId ?? readString(stateMetadata?.deviceId) ?? `device-${user.id}`;
+  await userStore.registerDevice({
+    id: resolvedDeviceId,
+    userId: user.id,
+    publicKey: devicePublicKey ?? readString(stateMetadata?.devicePublicKey) ?? "",
+    name: deviceId ? "Device" : "Browser"
+  });
+  const tokens = tokenManager.issueTokens(user.id, resolvedDeviceId);
+  return { status: 200, body: { data: { user, tokens, identity } } };
+}
+async function resolveOAuthUser(userStore, oauth, userInfo) {
+  if (!userInfo.email) {
+    return { status: 400, body: { error: "OAuth provider did not return an email address." } };
+  }
+  const existingUser = await userStore.findByEmail(userInfo.email);
+  if (existingUser) {
+    if (oauth.autoLinkVerifiedEmail && userInfo.emailVerified) {
+      return toAuthUser2(existingUser);
+    }
+    return {
+      status: 409,
+      body: { error: "OAuth account is not linked. Sign in and link this provider first." }
     };
   }
-};
+  if (!oauth.createNewUsers) {
+    return { status: 403, body: { error: "OAuth sign-up is disabled for this application." } };
+  }
+  const credential = await hashPassword(randomUUID4());
+  const user = await userStore.createUser({
+    email: userInfo.email,
+    passwordHash: credential.hash,
+    salt: credential.salt,
+    name: userInfo.name ?? userInfo.email.split("@")[0] ?? userInfo.email
+  });
+  if (userInfo.emailVerified) {
+    await userStore.setEmailVerified(user.id, true);
+    return { ...user, emailVerified: true };
+  }
+  return user;
+}
+async function linkOAuthIdentity(oauth, userId, provider, code, state) {
+  const { userInfo } = await oauth.manager.handleCallback(provider, code, state);
+  const existing = await oauth.linkedIdentityStore.findByProvider(
+    userInfo.provider,
+    userInfo.providerId
+  );
+  if (existing && existing.userId !== userId) {
+    return { status: 409, body: { error: "This OAuth account is already linked to another user." } };
+  }
+  if (existing) {
+    return { status: 200, body: { data: existing } };
+  }
+  const identity = await oauth.linkedIdentityStore.create({
+    userId,
+    provider: userInfo.provider,
+    providerUserId: userInfo.providerId,
+    email: userInfo.email
+  });
+  return { status: 201, body: { data: identity } };
+}
+async function requireAuthUser(tokenManager, userStore, token) {
+  if (!token) {
+    return { status: 401, body: { error: "Authorization token required." } };
+  }
+  const payload = await tokenManager.validateToken(token);
+  if (!payload || payload.type !== "access") {
+    return { status: 401, body: { error: "Invalid or expired token." } };
+  }
+  const user = await userStore.findById(payload.sub);
+  if (!user) {
+    return { status: 401, body: { error: "User not found." } };
+  }
+  return toAuthUser2(user);
+}
+function extractBearerToken(headers) {
+  const authorization = headers?.authorization ?? headers?.Authorization;
+  const value = Array.isArray(authorization) ? authorization[0] : authorization;
+  if (!value?.startsWith("Bearer ")) {
+    return "";
+  }
+  return value.slice("Bearer ".length).trim();
+}
+function normalizePath(path) {
+  const withoutQuery = path.split("?")[0] || "/";
+  const normalized = withoutQuery.startsWith("/") ? withoutQuery : `/${withoutQuery}`;
+  return normalized.length > 1 ? normalized.replace(/\/+$/, "") : normalized;
+}
+function metadataFromQuery(query) {
+  if (!query) return void 0;
+  const metadata = {};
+  for (const [key, value] of Object.entries(query)) {
+    if (key === "code" || key === "state") continue;
+    if (value !== void 0) {
+      metadata[key] = value;
+    }
+  }
+  return Object.keys(metadata).length > 0 ? metadata : void 0;
+}
+function queryValue(query, key) {
+  return query?.[key];
+}
+function readString(value) {
+  if (typeof value === "string" && value.length > 0) return value;
+  if (Array.isArray(value) && typeof value[0] === "string" && value[0].length > 0) {
+    return value[0];
+  }
+  return void 0;
+}
+function oauthErrorResponse(error) {
+  if (error instanceof DuplicateLinkedIdentityError) {
+    return { status: 409, body: { error: error.message } };
+  }
+  if (error instanceof OAuthError) {
+    const status = error.code === "OAUTH_PROVIDER_NOT_FOUND" ? 404 : 400;
+    return { status, body: { error: error.message } };
+  }
+  throw error;
+}
+function toAuthUser2(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    emailVerified: user.emailVerified,
+    createdAt: user.createdAt
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function notFound() {
+  return { status: 404, body: { error: "Not found" } };
+}
+function readEnvSecret() {
+  return typeof process !== "undefined" ? process.env.KORA_AUTH_SECRET : void 0;
+}
+function isProduction() {
+  return typeof process !== "undefined" && process.env.NODE_ENV === "production";
+}
 
 // src/provider/built-in/password-reset.ts
-import { KoraError as KoraError3 } from "@korajs/core";
-var PasswordResetError = class extends KoraError3 {
+import { KoraError as KoraError5 } from "@korajs/core";
+var PasswordResetError = class extends KoraError5 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "PasswordResetError";
@@ -1375,7 +2111,11 @@ var PasswordResetManager = class {
     const normalizedEmail = email.toLowerCase().trim();
     const successResponse = {
       status: 200,
-      body: { data: { message: "If an account with that email exists, a password reset link has been sent." } }
+      body: {
+        data: {
+          message: "If an account with that email exists, a password reset link has been sent."
+        }
+      }
     };
     const user = await this.userStore.findByEmail(normalizedEmail);
     if (!user) {
@@ -1456,7 +2196,7 @@ var PasswordResetManager = class {
     if (!user) {
       return { status: 404, body: { error: "User not found." } };
     }
-    const { verifyPassword: verifyPassword2 } = await import("./password-hash-HDH6VQCQ.js");
+    const { verifyPassword: verifyPassword2 } = await import("./password-hash-QRBG6BNJ.js");
     const isValid = await verifyPassword2(currentPassword, user.passwordHash, user.salt);
     if (!isValid) {
       return { status: 401, body: { error: "Current password is incorrect." } };
@@ -1477,8 +2217,8 @@ function generateSecureToken() {
 }
 
 // src/provider/built-in/email-verification.ts
-import { KoraError as KoraError4 } from "@korajs/core";
-var EmailVerificationError = class extends KoraError4 {
+import { KoraError as KoraError6 } from "@korajs/core";
+var EmailVerificationError = class extends KoraError6 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "EmailVerificationError";
@@ -1553,7 +2293,10 @@ var EmailVerificationManager = class {
     const normalizedEmail = email.toLowerCase().trim();
     const activeCount = await this.verificationStore.countActiveForUser(userId);
     if (activeCount >= this.maxRequestsPerUser) {
-      return { status: 429, body: { error: "Too many verification requests. Please try again later." } };
+      return {
+        status: 429,
+        body: { error: "Too many verification requests. Please try again later." }
+      };
     }
     const token = generateSecureToken2();
     const now = Date.now();
@@ -1628,7 +2371,7 @@ function generateSecureToken2() {
 }
 
 // src/provider/built-in/sqlite-user-store.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var SqliteUserStore = class {
   db;
   constructor(db) {
@@ -1665,7 +2408,7 @@ var SqliteUserStore = class {
   async createUser(params) {
     const normalizedEmail = params.email.toLowerCase();
     const now = Date.now();
-    const id = randomUUID3();
+    const id = randomUUID5();
     try {
       this.db.prepare(`
 				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
@@ -1680,21 +2423,15 @@ var SqliteUserStore = class {
     return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
   }
   async findByEmail(email) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_users WHERE email = ?"
-    ).get(email.toLowerCase());
+    const row = this.db.prepare("SELECT * FROM auth_users WHERE email = ?").get(email.toLowerCase());
     return row ? rowToStoredUser(row) : null;
   }
   async findById(id) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_users WHERE id = ?"
-    ).get(id);
+    const row = this.db.prepare("SELECT * FROM auth_users WHERE id = ?").get(id);
     return row ? rowToStoredUser(row) : null;
   }
   async registerDevice(params) {
-    const existing = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE id = ?"
-    ).get(params.id);
+    const existing = this.db.prepare("SELECT * FROM auth_devices WHERE id = ?").get(params.id);
     if (existing && !existing.revoked) {
       return rowToDevice(existing);
     }
@@ -1721,29 +2458,21 @@ var SqliteUserStore = class {
     };
   }
   async findDevice(deviceId) {
-    const row = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE id = ?"
-    ).get(deviceId);
+    const row = this.db.prepare("SELECT * FROM auth_devices WHERE id = ?").get(deviceId);
     return row ? rowToDevice(row) : null;
   }
   async listDevices(userId) {
-    const rows = this.db.prepare(
-      "SELECT * FROM auth_devices WHERE user_id = ?"
-    ).all(userId);
+    const rows = this.db.prepare("SELECT * FROM auth_devices WHERE user_id = ?").all(userId);
     return rows.map(rowToDevice);
   }
   async revokeDevice(deviceId) {
     this.db.prepare("UPDATE auth_devices SET revoked = 1 WHERE id = ?").run(deviceId);
   }
   async setEmailVerified(userId, verified) {
-    this.db.prepare(
-      "UPDATE auth_users SET email_verified = ? WHERE id = ?"
-    ).run(verified ? 1 : 0, userId);
+    this.db.prepare("UPDATE auth_users SET email_verified = ? WHERE id = ?").run(verified ? 1 : 0, userId);
   }
   async updatePassword(userId, passwordHash, salt) {
-    this.db.prepare(
-      "UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?"
-    ).run(passwordHash, salt, userId);
+    this.db.prepare("UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?").run(passwordHash, salt, userId);
   }
   async listAll() {
     const rows = this.db.prepare("SELECT * FROM auth_users").all();
@@ -1764,9 +2493,7 @@ var SqliteUserStore = class {
     deleteInTransaction();
   }
   async touchDevice(deviceId) {
-    this.db.prepare(
-      "UPDATE auth_devices SET last_seen_at = ? WHERE id = ?"
-    ).run(Date.now(), deviceId);
+    this.db.prepare("UPDATE auth_devices SET last_seen_at = ? WHERE id = ?").run(Date.now(), deviceId);
   }
 };
 async function createSqliteUserStore(options) {
@@ -1809,7 +2536,7 @@ function rowToDevice(row) {
 }
 
 // src/provider/built-in/postgres-user-store.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var PostgresUserStore = class {
   sql;
   ready;
@@ -1851,7 +2578,7 @@ var PostgresUserStore = class {
     await this.ready;
     const normalizedEmail = params.email.toLowerCase();
     const now = Date.now();
-    const id = randomUUID4();
+    const id = randomUUID6();
     try {
       await this.sql`
 				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
@@ -1884,7 +2611,7 @@ var PostgresUserStore = class {
     const existingRows = await this.sql`
 			SELECT * FROM auth_devices WHERE id = ${params.id}
 		`;
-    if (existingRows.length > 0 && !existingRows[0].revoked) {
+    if (existingRows.length > 0 && !existingRows[0]?.revoked) {
       return rowToDevice2(existingRows[0]);
     }
     const now = Date.now();
@@ -1905,7 +2632,7 @@ var PostgresUserStore = class {
       publicKey: params.publicKey,
       name: params.name,
       revoked: false,
-      createdAt: existingRows.length > 0 ? Number(existingRows[0].created_at) : now,
+      createdAt: existingRows.length > 0 ? Number(existingRows[0]?.created_at) : now,
       lastSeenAt: now
     };
   }
@@ -2087,8 +2814,8 @@ var BuiltInProvider = class {
 };
 
 // src/provider/external/external-jwt-provider.ts
-import { KoraError as KoraError5 } from "@korajs/core";
-var ExternalAuthOperationNotSupportedError = class extends KoraError5 {
+import { KoraError as KoraError7 } from "@korajs/core";
+var ExternalAuthOperationNotSupportedError = class extends KoraError7 {
   constructor(operation, provider) {
     super(
       `The "${operation}" operation is not supported by the external auth provider "${provider}". Perform this operation through your external auth provider's SDK or dashboard instead.`,
@@ -2098,18 +2825,14 @@ var ExternalAuthOperationNotSupportedError = class extends KoraError5 {
     this.name = "ExternalAuthOperationNotSupportedError";
   }
 };
-var ExternalTokenValidationError = class extends KoraError5 {
+var ExternalTokenValidationError = class extends KoraError7 {
   constructor(reason, context) {
-    super(
-      `External token validation failed: ${reason}`,
-      "AUTH_EXTERNAL_TOKEN_INVALID",
-      context
-    );
+    super(`External token validation failed: ${reason}`, "AUTH_EXTERNAL_TOKEN_INVALID", context);
     this.name = "ExternalTokenValidationError";
   }
 };
 function defaultMapClaims(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     throw new ExternalTokenValidationError(
       'JWT is missing a valid "sub" (subject) claim. The "sub" claim must be a non-empty string identifying the user.',
@@ -2118,8 +2841,8 @@ function defaultMapClaims(claims) {
   }
   return {
     userId: sub,
-    email: typeof claims["email"] === "string" ? claims["email"] : void 0,
-    name: typeof claims["name"] === "string" ? claims["name"] : void 0,
+    email: typeof claims.email === "string" ? claims.email : void 0,
+    name: typeof claims.name === "string" ? claims.name : void 0,
     metadata: void 0
   };
 }
@@ -2318,23 +3041,23 @@ var ExternalJwtProvider = class {
 
 // src/provider/external/clerk-adapter.ts
 function defaultClerkClaimMapping(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     return { userId: "" };
   }
-  const firstName = typeof claims["first_name"] === "string" ? claims["first_name"] : "";
-  const lastName = typeof claims["last_name"] === "string" ? claims["last_name"] : "";
+  const firstName = typeof claims.first_name === "string" ? claims.first_name : "";
+  const lastName = typeof claims.last_name === "string" ? claims.last_name : "";
   const fullName = [firstName, lastName].filter(Boolean).join(" ");
-  const email = typeof claims["email"] === "string" ? claims["email"] : void 0;
+  const email = typeof claims.email === "string" ? claims.email : void 0;
   const metadata = {};
-  if (typeof claims["org_id"] === "string") {
-    metadata["orgId"] = claims["org_id"];
+  if (typeof claims.org_id === "string") {
+    metadata.orgId = claims.org_id;
   }
-  if (typeof claims["org_slug"] === "string") {
-    metadata["orgSlug"] = claims["org_slug"];
+  if (typeof claims.org_slug === "string") {
+    metadata.orgSlug = claims.org_slug;
   }
-  if (typeof claims["org_role"] === "string") {
-    metadata["orgRole"] = claims["org_role"];
+  if (typeof claims.org_role === "string") {
+    metadata.orgRole = claims.org_role;
   }
   return {
     userId: sub,
@@ -2353,30 +3076,30 @@ function createClerkAdapter(config) {
 
 // src/provider/external/supabase-adapter.ts
 function defaultSupabaseClaimMapping(claims) {
-  const sub = claims["sub"];
+  const sub = claims.sub;
   if (typeof sub !== "string" || sub.length === 0) {
     return { userId: "" };
   }
-  const email = typeof claims["email"] === "string" ? claims["email"] : void 0;
+  const email = typeof claims.email === "string" ? claims.email : void 0;
   let name;
-  const userMetadata = claims["user_metadata"];
+  const userMetadata = claims.user_metadata;
   if (typeof userMetadata === "object" && userMetadata !== null && !Array.isArray(userMetadata)) {
     const meta = userMetadata;
-    if (typeof meta["full_name"] === "string" && meta["full_name"].length > 0) {
-      name = meta["full_name"];
-    } else if (typeof meta["name"] === "string" && meta["name"].length > 0) {
-      name = meta["name"];
+    if (typeof meta.full_name === "string" && meta.full_name.length > 0) {
+      name = meta.full_name;
+    } else if (typeof meta.name === "string" && meta.name.length > 0) {
+      name = meta.name;
     }
   }
   const metadata = {};
-  if (typeof claims["role"] === "string") {
-    metadata["role"] = claims["role"];
+  if (typeof claims.role === "string") {
+    metadata.role = claims.role;
   }
-  if (typeof claims["aud"] === "string") {
-    metadata["aud"] = claims["aud"];
+  if (typeof claims.aud === "string") {
+    metadata.aud = claims.aud;
   }
-  if (typeof claims["app_metadata"] === "object" && claims["app_metadata"] !== null && !Array.isArray(claims["app_metadata"])) {
-    metadata["appMetadata"] = claims["app_metadata"];
+  if (typeof claims.app_metadata === "object" && claims.app_metadata !== null && !Array.isArray(claims.app_metadata)) {
+    metadata.appMetadata = claims.app_metadata;
   }
   return {
     userId: sub,
@@ -2395,8 +3118,8 @@ function createSupabaseAdapter(config) {
 
 // src/passkey/passkey-server.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { KoraError as KoraError6 } from "@korajs/core";
-var PasskeyVerificationError = class extends KoraError6 {
+import { KoraError as KoraError8 } from "@korajs/core";
+var PasskeyVerificationError = class extends KoraError8 {
   constructor(message, context) {
     super(message, "PASSKEY_VERIFICATION_ERROR", context);
     this.name = "PasskeyVerificationError";
@@ -2404,10 +3127,12 @@ var PasskeyVerificationError = class extends KoraError6 {
 };
 function generateRegistrationOptions(params) {
   const challengeBytes = randomBytes3(32);
-  const challenge = toBase64Url(challengeBytes.buffer.slice(
-    challengeBytes.byteOffset,
-    challengeBytes.byteOffset + challengeBytes.byteLength
-  ));
+  const challenge = toBase64Url(
+    challengeBytes.buffer.slice(
+      challengeBytes.byteOffset,
+      challengeBytes.byteOffset + challengeBytes.byteLength
+    )
+  );
   return {
     challenge,
     rpId: params.rpId,
@@ -2517,10 +3242,12 @@ async function verifyRegistrationResponse(params) {
 }
 function generateAuthenticationOptions(params) {
   const challengeBytes = randomBytes3(32);
-  const challenge = toBase64Url(challengeBytes.buffer.slice(
-    challengeBytes.byteOffset,
-    challengeBytes.byteOffset + challengeBytes.byteLength
-  ));
+  const challenge = toBase64Url(
+    challengeBytes.buffer.slice(
+      challengeBytes.byteOffset,
+      challengeBytes.byteOffset + challengeBytes.byteLength
+    )
+  );
   return {
     challenge,
     rpId: params.rpId,
@@ -2575,9 +3302,7 @@ async function verifyAuthenticationResponse(params) {
   }
   const flags = authDataBytes[32];
   if ((flags & 1) === 0) {
-    throw new PasskeyVerificationError(
-      "User Present flag is not set in authenticator data."
-    );
+    throw new PasskeyVerificationError("User Present flag is not set in authenticator data.");
   }
   const signCount = (authDataBytes[33] << 24 | authDataBytes[34] << 16 | authDataBytes[35] << 8 | authDataBytes[36]) >>> 0;
   if (previousSignCount > 0 || signCount > 0) {
@@ -2592,9 +3317,7 @@ async function verifyAuthenticationResponse(params) {
     }
   }
   const clientDataHash = await sha256(clientDataBytes);
-  const signedData = new Uint8Array(
-    authDataBytes.length + clientDataHash.byteLength
-  );
+  const signedData = new Uint8Array(authDataBytes.length + clientDataHash.byteLength);
   signedData.set(authDataBytes, 0);
   signedData.set(new Uint8Array(clientDataHash), authDataBytes.length);
   const coseKeyBytes = fromBase64Url(publicKey);
@@ -2651,10 +3374,9 @@ async function verifyAuthenticationResponse(params) {
       signedData.buffer
     );
   } catch (error) {
-    throw new PasskeyVerificationError(
-      "Signature verification operation failed.",
-      { cause: error instanceof Error ? error.message : String(error) }
-    );
+    throw new PasskeyVerificationError("Signature verification operation failed.", {
+      cause: error instanceof Error ? error.message : String(error)
+    });
   }
   if (!verified) {
     return { verified: false, newSignCount: signCount };
@@ -2677,9 +3399,7 @@ function constantTimeEqual(a, b) {
 function derToP1363(derSignature, componentLength) {
   let offset = 0;
   if (derSignature[offset] !== 48) {
-    throw new PasskeyVerificationError(
-      "Invalid DER signature: expected SEQUENCE tag (0x30)."
-    );
+    throw new PasskeyVerificationError("Invalid DER signature: expected SEQUENCE tag (0x30).");
   }
   offset += 1;
   if (derSignature[offset] & 128) {
@@ -2725,7 +3445,7 @@ function copyComponentToP1363(component, target, targetOffset, componentLength)
 }
 
 // src/org/org-types.ts
-import { KoraError as KoraError7 } from "@korajs/core";
+import { KoraError as KoraError9 } from "@korajs/core";
 var ORG_ROLES = ["owner", "admin", "member", "viewer", "billing"];
 var ROLE_HIERARCHY = {
   viewer: 10,
@@ -2738,7 +3458,7 @@ function hasRoleLevel(userRole, requiredRole) {
   return ROLE_HIERARCHY[userRole] >= ROLE_HIERARCHY[requiredRole];
 }
 var INVITATION_STATUSES = ["pending", "accepted", "revoked", "expired"];
-var OrgError = class extends KoraError7 {
+var OrgError = class extends KoraError9 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "OrgError";
@@ -2766,11 +3486,9 @@ var MemberAlreadyExistsError = class extends OrgError {
 };
 var InsufficientRoleError = class extends OrgError {
   constructor(required) {
-    super(
-      `This action requires at least the "${required}" role.`,
-      "INSUFFICIENT_ROLE",
-      { requiredRole: required }
-    );
+    super(`This action requires at least the "${required}" role.`, "INSUFFICIENT_ROLE", {
+      requiredRole: required
+    });
   }
 };
 var CannotRemoveOwnerError = class extends OrgError {
@@ -2980,17 +3698,28 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "Target user ID is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot assign owner role directly. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot assign owner role directly. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
       return { status: 403, body: { error: "Only the owner can add admin members." } };
     }
     try {
-      const membership = await this.store.addMember(orgId, params.targetUserId, params.role, userId);
+      const membership = await this.store.addMember(
+        orgId,
+        params.targetUserId,
+        params.role,
+        userId
+      );
       return { status: 201, body: { data: membership } };
     } catch (err) {
       if (err instanceof OrgNotFoundError) {
@@ -3043,17 +3772,27 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "Target user ID is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot assign owner role directly. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot assign owner role directly. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
       return { status: 403, body: { error: "Only the owner can assign admin role." } };
     }
     try {
-      const membership = await this.store.updateMemberRole(orgId, params.targetUserId, params.role);
+      const membership = await this.store.updateMemberRole(
+        orgId,
+        params.targetUserId,
+        params.role
+      );
       return { status: 200, body: { data: membership } };
     } catch (err) {
       if (err instanceof MembershipNotFoundError) {
@@ -3116,10 +3855,16 @@ var OrgRoutes = class {
       return { status: 400, body: { error: "A valid email address is required." } };
     }
     if (typeof params.role !== "string" || !isValidRole(params.role)) {
-      return { status: 400, body: { error: "A valid role is required (admin, member, viewer, billing)." } };
+      return {
+        status: 400,
+        body: { error: "A valid role is required (admin, member, viewer, billing)." }
+      };
     }
     if (params.role === "owner") {
-      return { status: 400, body: { error: "Cannot invite with owner role. Use ownership transfer." } };
+      return {
+        status: 400,
+        body: { error: "Cannot invite with owner role. Use ownership transfer." }
+      };
     }
     const callerMembership = await this.store.getMembership(orgId, userId);
     if (callerMembership && callerMembership.role !== "owner" && params.role === "admin") {
@@ -3505,7 +4250,7 @@ function slugify(name) {
 }
 
 // src/rbac/rbac-types.ts
-import { KoraError as KoraError8 } from "@korajs/core";
+import { KoraError as KoraError10 } from "@korajs/core";
 function parsePermission(permission) {
   const colonIndex = permission.indexOf(":");
   if (colonIndex === -1) {
@@ -3549,7 +4294,7 @@ var BUILT_IN_ROLES = [
     permissions: ["*:*"]
   }
 ];
-var RbacError = class extends KoraError8 {
+var RbacError = class extends KoraError10 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "RbacError";
@@ -3566,20 +4311,14 @@ var InvalidPermissionError = class extends RbacError {
 };
 var RoleNotFoundError = class extends RbacError {
   constructor(role) {
-    super(
-      `Role "${role}" is not defined.`,
-      "ROLE_NOT_FOUND",
-      { role }
-    );
+    super(`Role "${role}" is not defined.`, "ROLE_NOT_FOUND", { role });
   }
 };
 var CircularInheritanceError = class extends RbacError {
   constructor(chain) {
-    super(
-      `Circular role inheritance detected: ${chain.join(" \u2192 ")}.`,
-      "CIRCULAR_INHERITANCE",
-      { chain }
-    );
+    super(`Circular role inheritance detected: ${chain.join(" \u2192 ")}.`, "CIRCULAR_INHERITANCE", {
+      chain
+    });
   }
 };
 
@@ -3680,15 +4419,11 @@ var RbacEngine = class {
       permissions
     };
     const scopes = {};
-    const hasAnyRead = permissions.some(
-      (p) => permissionCovers(p, "*:read")
-    );
+    const hasAnyRead = permissions.some((p) => permissionCovers(p, "*:read"));
     if (!hasAnyRead) {
       return scopes;
     }
-    const isReadOnly = !permissions.some(
-      (p) => permissionCovers(p, "*:write")
-    );
+    const isReadOnly = !permissions.some((p) => permissionCovers(p, "*:write"));
     const collectionsToResolve = collections ?? [...this.collectionResolvers.keys()];
     for (const collection of collectionsToResolve) {
       const customResolver = this.collectionResolvers.get(collection);
@@ -3849,21 +4584,13 @@ var OrgScopeResolver = class {
    * Check if a user can write to a specific collection in an org.
    */
   async canWrite(userId, orgId, collection) {
-    return this.rbac.hasPermission(
-      userId,
-      orgId,
-      `${collection}:write`
-    );
+    return this.rbac.hasPermission(userId, orgId, `${collection}:write`);
   }
   /**
    * Check if a user can read from a specific collection in an org.
    */
   async canRead(userId, orgId, collection) {
-    return this.rbac.hasPermission(
-      userId,
-      orgId,
-      `${collection}:read`
-    );
+    return this.rbac.hasPermission(userId, orgId, `${collection}:read`);
   }
   // --- Private ---
   resolveCollectionScope(ctx, collection) {
@@ -3886,304 +4613,409 @@ var OrgScopeResolver = class {
   }
 };
 
-// src/provider/oauth/oauth-types.ts
-import { KoraError as KoraError9 } from "@korajs/core";
-var OAuthError = class extends KoraError9 {
-  constructor(message, code, context) {
-    super(message, code, context);
-    this.name = "OAuthError";
-  }
-};
-var OAuthStateMismatchError = class extends OAuthError {
-  constructor() {
-    super("OAuth state parameter does not match. Possible CSRF attack.", "OAUTH_STATE_MISMATCH");
+// src/provider/oauth/sqlite-oauth-store.ts
+import { randomUUID as randomUUID7 } from "crypto";
+var SqliteOAuthStateStore = class {
+  db;
+  constructor(db) {
+    this.db = db;
+    this.db.pragma("journal_mode = WAL");
+    this.ensureTables();
   }
-};
-var OAuthCodeExchangeError = class extends OAuthError {
-  constructor(details) {
-    super(
-      `Failed to exchange authorization code for tokens.${details ? ` ${details}` : ""}`,
-      "OAUTH_CODE_EXCHANGE_FAILED",
-      details ? { details } : void 0
+  async store(state) {
+    this.db.prepare(`
+				INSERT OR REPLACE INTO auth_oauth_states
+					(state, provider, redirect_uri, created_at, expires_at, metadata_json, code_verifier)
+				VALUES (?, ?, ?, ?, ?, ?, ?)
+			`).run(
+      state.state,
+      state.provider,
+      state.redirectUri,
+      state.createdAt,
+      state.expiresAt,
+      state.metadata ? JSON.stringify(state.metadata) : null,
+      state.codeVerifier ?? null
     );
   }
-};
-var OAuthUserInfoError = class extends OAuthError {
-  constructor(details) {
-    super(
-      `Failed to fetch user info from OAuth provider.${details ? ` ${details}` : ""}`,
-      "OAUTH_USER_INFO_FAILED",
-      details ? { details } : void 0
-    );
+  async consume(stateValue) {
+    const consumeInTransaction = this.db.transaction(() => {
+      const row = this.db.prepare("SELECT * FROM auth_oauth_states WHERE state = ?").get(stateValue);
+      if (!row) return null;
+      this.db.prepare("DELETE FROM auth_oauth_states WHERE state = ?").run(stateValue);
+      if (Date.now() > row.expires_at) return null;
+      return rowToOAuthState(row);
+    });
+    return consumeInTransaction();
+  }
+  async cleanExpired() {
+    const result = this.db.prepare("DELETE FROM auth_oauth_states WHERE expires_at < ?").run(Date.now());
+    return result.changes ?? 0;
+  }
+  ensureTables() {
+    this.db.exec(`
+			CREATE TABLE IF NOT EXISTS auth_oauth_states (
+				state TEXT PRIMARY KEY,
+				provider TEXT NOT NULL,
+				redirect_uri TEXT NOT NULL,
+				created_at INTEGER NOT NULL,
+				expires_at INTEGER NOT NULL,
+				metadata_json TEXT,
+				code_verifier TEXT
+			);
+
+			CREATE INDEX IF NOT EXISTS idx_auth_oauth_states_expires_at
+				ON auth_oauth_states(expires_at);
+		`);
   }
 };
-var OAuthProviderNotFoundError = class extends OAuthError {
-  constructor(provider) {
-    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", { provider });
+var SqliteLinkedIdentityStore = class {
+  db;
+  constructor(db) {
+    this.db = db;
+    this.db.pragma("journal_mode = WAL");
+    this.ensureTables();
+  }
+  async findByProvider(provider, providerUserId) {
+    const row = this.db.prepare(`
+				SELECT * FROM auth_linked_identities
+				WHERE provider = ? AND provider_user_id = ?
+			`).get(provider, providerUserId);
+    return row ? rowToLinkedIdentity(row) : null;
+  }
+  async findByUser(userId) {
+    const rows = this.db.prepare(`
+				SELECT * FROM auth_linked_identities
+				WHERE user_id = ?
+				ORDER BY linked_at ASC
+			`).all(userId);
+    return rows.map(rowToLinkedIdentity);
+  }
+  async create(params) {
+    const identity = {
+      id: randomUUID7(),
+      userId: params.userId,
+      provider: params.provider,
+      providerUserId: params.providerUserId,
+      email: params.email,
+      linkedAt: Date.now()
+    };
+    try {
+      this.db.prepare(`
+					INSERT INTO auth_linked_identities
+						(id, user_id, provider, provider_user_id, email, linked_at)
+					VALUES (?, ?, ?, ?, ?, ?)
+				`).run(
+        identity.id,
+        identity.userId,
+        identity.provider,
+        identity.providerUserId,
+        identity.email,
+        identity.linkedAt
+      );
+    } catch (error) {
+      if (error instanceof Error && error.message.includes("UNIQUE constraint failed")) {
+        throw new DuplicateLinkedIdentityError(params.provider);
+      }
+      throw error;
+    }
+    return identity;
+  }
+  async delete(userId, provider) {
+    this.db.prepare("DELETE FROM auth_linked_identities WHERE user_id = ? AND provider = ?").run(userId, provider);
+  }
+  ensureTables() {
+    this.db.exec(`
+			CREATE TABLE IF NOT EXISTS auth_linked_identities (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL,
+				provider TEXT NOT NULL,
+				provider_user_id TEXT NOT NULL,
+				email TEXT,
+				linked_at INTEGER NOT NULL,
+				UNIQUE(provider, provider_user_id),
+				UNIQUE(user_id, provider)
+			);
+
+			CREATE INDEX IF NOT EXISTS idx_auth_linked_identities_user_id
+				ON auth_linked_identities(user_id);
+		`);
   }
 };
+async function createSqliteOAuthStateStore(options) {
+  const Database = await loadBetterSqlite32();
+  const db = new Database(options.filename);
+  return new SqliteOAuthStateStore(db);
+}
+async function createSqliteLinkedIdentityStore(options) {
+  const Database = await loadBetterSqlite32();
+  const db = new Database(options.filename);
+  return new SqliteLinkedIdentityStore(db);
+}
+async function createSqliteOAuthStores(options) {
+  const Database = await loadBetterSqlite32();
+  const db = new Database(options.filename);
+  return {
+    stateStore: new SqliteOAuthStateStore(db),
+    linkedIdentityStore: new SqliteLinkedIdentityStore(db)
+  };
+}
+async function loadBetterSqlite32() {
+  try {
+    const { createRequire } = await import("module");
+    const require2 = createRequire(import.meta.url);
+    return require2("better-sqlite3");
+  } catch {
+    throw new Error(
+      'SQLite OAuth stores require the "better-sqlite3" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToOAuthState(row) {
+  return {
+    state: row.state,
+    provider: row.provider,
+    redirectUri: row.redirect_uri,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    metadata: parseMetadata(row.metadata_json),
+    codeVerifier: row.code_verifier ?? void 0
+  };
+}
+function parseMetadata(value) {
+  if (!value) return void 0;
+  const parsed = JSON.parse(value);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+}
+function rowToLinkedIdentity(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    provider: row.provider,
+    providerUserId: row.provider_user_id,
+    email: row.email,
+    linkedAt: row.linked_at
+  };
+}
 
-// src/provider/oauth/oauth-flow.ts
-var DEFAULT_STATE_TTL_MS = 10 * 60 * 1e3;
-var InMemoryOAuthStateStore = class {
-  states = /* @__PURE__ */ new Map();
-  async store(state) {
-    this.states.set(state.state, state);
+// src/provider/oauth/postgres-oauth-store.ts
+import { randomUUID as randomUUID8 } from "crypto";
+var PostgresOAuthStateStore = class {
+  sql;
+  ready;
+  constructor(sql) {
+    this.sql = sql;
+    this.ready = this.ensureTables();
   }
-  async consume(stateValue) {
-    const state = this.states.get(stateValue);
-    if (!state) return null;
-    this.states.delete(stateValue);
-    if (Date.now() > state.expiresAt) return null;
-    return state;
+  async store(state) {
+    await this.ready;
+    await this.sql`
+			INSERT INTO auth_oauth_states
+				(state, provider, redirect_uri, created_at, expires_at, metadata_json, code_verifier)
+			VALUES (
+				${state.state},
+				${state.provider},
+				${state.redirectUri},
+				${state.createdAt},
+				${state.expiresAt},
+				${state.metadata ? JSON.stringify(state.metadata) : null},
+				${state.codeVerifier ?? null}
+			)
+			ON CONFLICT (state) DO UPDATE SET
+				provider = EXCLUDED.provider,
+				redirect_uri = EXCLUDED.redirect_uri,
+				created_at = EXCLUDED.created_at,
+				expires_at = EXCLUDED.expires_at,
+				metadata_json = EXCLUDED.metadata_json,
+				code_verifier = EXCLUDED.code_verifier
+		`;
   }
-  async cleanExpired() {
-    const now = Date.now();
-    let count = 0;
-    for (const [key, state] of this.states) {
-      if (now > state.expiresAt) {
-        this.states.delete(key);
-        count++;
+  async consume(stateValue) {
+    await this.ready;
+    return this.sql.begin(async (tx) => {
+      const rows = await tx`
+				DELETE FROM auth_oauth_states
+				WHERE state = ${stateValue}
+				RETURNING *
+			`;
+      const row = rows[0];
+      if (!row || Date.now() > Number(row.expires_at)) {
+        return null;
       }
-    }
-    return count;
+      return rowToOAuthState2(row);
+    });
   }
-};
-var OAuthManager = class {
-  providers = /* @__PURE__ */ new Map();
-  stateStore;
-  stateTtlMs;
-  fetchFn;
-  constructor(config) {
-    for (const provider of config.providers) {
-      this.providers.set(provider.providerId, provider);
-    }
-    this.stateStore = config.stateStore ?? new InMemoryOAuthStateStore();
-    this.stateTtlMs = config.stateTtlMs ?? DEFAULT_STATE_TTL_MS;
-    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+  async cleanExpired() {
+    await this.ready;
+    const rows = await this.sql`
+			DELETE FROM auth_oauth_states
+			WHERE expires_at < ${Date.now()}
+			RETURNING state
+		`;
+    return rows.length;
   }
-  /**
-   * Generate an authorization URL for the user to visit.
-   * Returns the URL and the state parameter for CSRF validation.
-   */
-  async getAuthorizationUrl(providerId, metadata) {
-    const provider = this.getProvider(providerId);
-    const state = generateState();
-    const now = Date.now();
-    const oauthState = {
-      state,
-      provider: providerId,
-      redirectUri: provider.redirectUri,
-      createdAt: now,
-      expiresAt: now + this.stateTtlMs,
-      metadata
-    };
-    await this.stateStore.store(oauthState);
-    const params = new URLSearchParams({
-      client_id: provider.clientId,
-      redirect_uri: provider.redirectUri,
-      response_type: "code",
-      scope: provider.scopes.join(" "),
-      state
-    });
-    const url = `${provider.authorizationUrl}?${params.toString()}`;
-    return { url, state };
+  async ensureTables() {
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_oauth_states (
+				state TEXT PRIMARY KEY,
+				provider TEXT NOT NULL,
+				redirect_uri TEXT NOT NULL,
+				created_at BIGINT NOT NULL,
+				expires_at BIGINT NOT NULL,
+				metadata_json TEXT,
+				code_verifier TEXT
+			)
+		`;
+    await this.sql`
+			CREATE INDEX IF NOT EXISTS idx_auth_oauth_states_expires_at
+				ON auth_oauth_states(expires_at)
+		`;
   }
-  /**
-   * Handle the OAuth callback after the user authorizes.
-   * Validates the state parameter, exchanges the code for tokens,
-   * and fetches user info.
-   *
-   * @param providerId - The OAuth provider
-   * @param code - The authorization code from the callback
-   * @param state - The state parameter from the callback
-   * @returns Tokens and user info from the provider
-   */
-  async handleCallback(providerId, code, state) {
-    const provider = this.getProvider(providerId);
-    const oauthState = await this.stateStore.consume(state);
-    if (!oauthState || oauthState.provider !== providerId) {
-      throw new OAuthStateMismatchError();
-    }
-    const tokens = await this.exchangeCodeForTokens(provider, code);
-    const userInfo = await this.fetchUserInfo(provider, tokens.accessToken);
-    return { tokens, userInfo, stateMetadata: oauthState.metadata };
+};
+var PostgresLinkedIdentityStore = class {
+  sql;
+  ready;
+  constructor(sql) {
+    this.sql = sql;
+    this.ready = this.ensureTables();
   }
-  /**
-   * Get a registered provider by ID.
-   */
-  getProvider(providerId) {
-    const provider = this.providers.get(providerId);
-    if (!provider) {
-      throw new OAuthProviderNotFoundError(providerId);
-    }
-    return provider;
+  async findByProvider(provider, providerUserId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_linked_identities
+			WHERE provider = ${provider} AND provider_user_id = ${providerUserId}
+		`;
+    return rows[0] ? rowToLinkedIdentity2(rows[0]) : null;
   }
-  /**
-   * List all registered provider IDs.
-   */
-  getProviderIds() {
-    return [...this.providers.keys()];
+  async findByUser(userId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_linked_identities
+			WHERE user_id = ${userId}
+			ORDER BY linked_at ASC
+		`;
+    return rows.map(rowToLinkedIdentity2);
   }
-  // --- Private ---
-  async exchangeCodeForTokens(provider, code) {
-    const body = new URLSearchParams({
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: provider.redirectUri,
-      client_id: provider.clientId,
-      client_secret: provider.clientSecret
-    });
-    let response;
+  async create(params) {
+    await this.ready;
+    const identity = {
+      id: randomUUID8(),
+      userId: params.userId,
+      provider: params.provider,
+      providerUserId: params.providerUserId,
+      email: params.email,
+      linkedAt: Date.now()
+    };
     try {
-      response = await this.fetchFn(provider.tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        },
-        body: body.toString()
-      });
-    } catch (err) {
-      throw new OAuthCodeExchangeError(
-        err instanceof Error ? err.message : "Network error"
-      );
-    }
-    if (!response.ok) {
-      let details = `HTTP ${response.status}`;
-      try {
-        const errorBody = await response.text();
-        details += `: ${errorBody}`;
-      } catch {
+      await this.sql`
+				INSERT INTO auth_linked_identities
+					(id, user_id, provider, provider_user_id, email, linked_at)
+				VALUES (
+					${identity.id},
+					${identity.userId},
+					${identity.provider},
+					${identity.providerUserId},
+					${identity.email},
+					${identity.linkedAt}
+				)
+			`;
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new DuplicateLinkedIdentityError(params.provider);
       }
-      throw new OAuthCodeExchangeError(details);
+      throw error;
     }
-    const data = await response.json();
-    return {
-      accessToken: data["access_token"],
-      tokenType: data["token_type"] ?? "Bearer",
-      expiresIn: data["expires_in"],
-      refreshToken: data["refresh_token"],
-      idToken: data["id_token"],
-      scope: data["scope"]
-    };
+    return identity;
   }
-  async fetchUserInfo(provider, accessToken) {
-    let response;
-    try {
-      response = await this.fetchFn(provider.userInfoUrl, {
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          Accept: "application/json"
-        }
-      });
-    } catch (err) {
-      throw new OAuthUserInfoError(
-        err instanceof Error ? err.message : "Network error"
-      );
-    }
-    if (!response.ok) {
-      throw new OAuthUserInfoError(`HTTP ${response.status}`);
-    }
-    const profile = await response.json();
-    return normalizeUserInfo(provider.providerId, profile);
+  async delete(userId, provider) {
+    await this.ready;
+    await this.sql`
+			DELETE FROM auth_linked_identities
+			WHERE user_id = ${userId} AND provider = ${provider}
+		`;
   }
-};
-function normalizeUserInfo(providerId, profile) {
-  switch (providerId) {
-    case "google":
-      return {
-        providerId: profile["sub"],
-        provider: "google",
-        email: profile["email"] ?? null,
-        emailVerified: profile["email_verified"] ?? false,
-        name: profile["name"] ?? null,
-        avatarUrl: profile["picture"] ?? null,
-        rawProfile: profile
-      };
-    case "github":
-      return {
-        providerId: String(profile["id"]),
-        provider: "github",
-        email: profile["email"] ?? null,
-        emailVerified: false,
-        // GitHub doesn't confirm in the profile response
-        name: profile["name"] ?? profile["login"] ?? null,
-        avatarUrl: profile["avatar_url"] ?? null,
-        rawProfile: profile
-      };
-    case "microsoft":
-      return {
-        providerId: profile["id"],
-        provider: "microsoft",
-        email: profile["mail"] ?? profile["userPrincipalName"] ?? null,
-        emailVerified: false,
-        name: profile["displayName"] ?? null,
-        avatarUrl: null,
-        rawProfile: profile
-      };
-    default:
-      return {
-        providerId: String(profile["id"] ?? profile["sub"] ?? ""),
-        provider: providerId,
-        email: profile["email"] ?? null,
-        emailVerified: profile["email_verified"] ?? false,
-        name: profile["name"] ?? null,
-        avatarUrl: profile["picture"] ?? profile["avatar_url"] ?? null,
-        rawProfile: profile
-      };
+  async ensureTables() {
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_linked_identities (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL,
+				provider TEXT NOT NULL,
+				provider_user_id TEXT NOT NULL,
+				email TEXT,
+				linked_at BIGINT NOT NULL,
+				UNIQUE(provider, provider_user_id),
+				UNIQUE(user_id, provider)
+			)
+		`;
+    await this.sql`
+			CREATE INDEX IF NOT EXISTS idx_auth_linked_identities_user_id
+				ON auth_linked_identities(user_id)
+		`;
   }
+};
+async function createPostgresOAuthStateStore(options) {
+  const postgresClient = await loadPostgresDeps2();
+  const sql = postgresClient(options.connectionString);
+  return new PostgresOAuthStateStore(sql);
 }
-function googleProvider(config) {
+async function createPostgresLinkedIdentityStore(options) {
+  const postgresClient = await loadPostgresDeps2();
+  const sql = postgresClient(options.connectionString);
+  return new PostgresLinkedIdentityStore(sql);
+}
+async function createPostgresOAuthStores(options) {
+  const postgresClient = await loadPostgresDeps2();
+  const sql = postgresClient(options.connectionString);
   return {
-    providerId: "google",
-    clientId: config.clientId,
-    clientSecret: config.clientSecret,
-    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-    tokenUrl: "https://oauth2.googleapis.com/token",
-    userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
-    scopes: config.scopes ?? ["openid", "email", "profile"],
-    redirectUri: config.redirectUri
+    stateStore: new PostgresOAuthStateStore(sql),
+    linkedIdentityStore: new PostgresLinkedIdentityStore(sql)
   };
 }
-function githubProvider(config) {
+async function loadPostgresDeps2() {
+  try {
+    const dynamicImport = new Function("specifier", "return import(specifier)");
+    const postgresMod = await dynamicImport("postgres");
+    return postgresMod.default;
+  } catch {
+    throw new Error(
+      'PostgreSQL OAuth stores require the "postgres" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToOAuthState2(row) {
   return {
-    providerId: "github",
-    clientId: config.clientId,
-    clientSecret: config.clientSecret,
-    authorizationUrl: "https://github.com/login/oauth/authorize",
-    tokenUrl: "https://github.com/login/oauth/access_token",
-    userInfoUrl: "https://api.github.com/user",
-    scopes: config.scopes ?? ["read:user", "user:email"],
-    redirectUri: config.redirectUri
+    state: row.state,
+    provider: row.provider,
+    redirectUri: row.redirect_uri,
+    createdAt: Number(row.created_at),
+    expiresAt: Number(row.expires_at),
+    metadata: parseMetadata2(row.metadata_json),
+    codeVerifier: row.code_verifier ?? void 0
   };
 }
-function microsoftProvider(config) {
-  const tenant = config.tenantId ?? "common";
+function parseMetadata2(value) {
+  if (!value) return void 0;
+  const parsed = JSON.parse(value);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+}
+function rowToLinkedIdentity2(row) {
   return {
-    providerId: "microsoft",
-    clientId: config.clientId,
-    clientSecret: config.clientSecret,
-    authorizationUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
-    tokenUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
-    userInfoUrl: "https://graph.microsoft.com/v1.0/me",
-    scopes: config.scopes ?? ["openid", "email", "profile", "User.Read"],
-    redirectUri: config.redirectUri
+    id: row.id,
+    userId: row.user_id,
+    provider: row.provider,
+    providerUserId: row.provider_user_id,
+    email: row.email,
+    linkedAt: Number(row.linked_at)
   };
 }
-function generateState() {
-  const bytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(bytes);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function isUniqueViolation(error) {
+  if (!(error instanceof Error)) return false;
+  const code = error.code;
+  return code === "23505" || error.message.includes("unique constraint") || error.message.includes("duplicate key");
 }
 
 // src/session/session.ts
-import { KoraError as KoraError10 } from "@korajs/core";
-var SessionError = class extends KoraError10 {
+import { KoraError as KoraError11 } from "@korajs/core";
+var SessionError = class extends KoraError11 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "SessionError";
@@ -4406,14 +5238,14 @@ function generateSessionId() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
 
 // src/mfa/totp.ts
-import { KoraError as KoraError11 } from "@korajs/core";
-var TotpError = class extends KoraError11 {
+import { KoraError as KoraError12 } from "@korajs/core";
+var TotpError = class extends KoraError12 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "TotpError";
@@ -4621,7 +5453,7 @@ var TotpManager = class {
    */
   async isEnabled(userId) {
     const stored = await this.store.getByUserId(userId);
-    return stored !== null && stored.verified;
+    return stored?.verified ?? false;
   }
   /**
    * Get the number of remaining recovery codes for a user.
@@ -4655,7 +5487,7 @@ function generateTotpCode(secret, counter, digits, algorithm) {
   const hash = hmacSha(algorithm, secret, counterBytes);
   const offset = hash[hash.length - 1] & 15;
   const binary = (hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255;
-  const otp = binary % Math.pow(10, digits);
+  const otp = binary % 10 ** digits;
   return otp.toString().padStart(digits, "0");
 }
 function hmacSha(algorithm, key, message) {
@@ -4699,7 +5531,10 @@ function sha1(data) {
       w[i] = view.getInt32(offset + i * 4, false);
     }
     for (let i = 16; i < 80; i++) {
-      w[i] = rotl32(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16] | 0, 1);
+      w[i] = rotl32(
+        w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16] | 0,
+        1
+      );
     }
     let a = h0;
     let b = h1;
@@ -4808,7 +5643,7 @@ async function hashRecoveryCode(code) {
   const bytes = new Uint8Array(hash);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -4833,8 +5668,8 @@ function timingSafeEqual(a, b) {
 }
 
 // src/admin/admin-api.ts
-import { KoraError as KoraError12 } from "@korajs/core";
-var AdminApiError = class extends KoraError12 {
+import { KoraError as KoraError13 } from "@korajs/core";
+var AdminApiError = class extends KoraError13 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "AdminApiError";
@@ -4868,7 +5703,7 @@ var AdminApi = class {
       throw new AdminUserNotFoundError(userId);
     }
     await this.audit("admin.user_lookup", adminId, userId, "user");
-    return toAuthUser2(user);
+    return toAuthUser3(user);
   }
   /**
    * List users with optional filtering and pagination.
@@ -4886,7 +5721,7 @@ var AdminApi = class {
       filtered = filtered.filter((u) => u.emailVerified === query.emailVerified);
     }
     const total = filtered.length;
-    const data = filtered.slice(offset, offset + limit).map(toAuthUser2);
+    const data = filtered.slice(offset, offset + limit).map(toAuthUser3);
     return { data, total, limit, offset };
   }
   /**
@@ -4908,7 +5743,7 @@ var AdminApi = class {
     }
     await this.userStore.update(user);
     await this.audit("user.update", adminId, userId, "user", { updates });
-    return toAuthUser2(user);
+    return toAuthUser3(user);
   }
   /**
    * Delete a user and all associated sessions.
@@ -4973,7 +5808,7 @@ var AdminApi = class {
     });
   }
 };
-function toAuthUser2(stored) {
+function toAuthUser3(stored) {
   return {
     id: stored.id,
     email: stored.email,
@@ -4984,8 +5819,8 @@ function toAuthUser2(stored) {
 }
 
 // src/admin/audit-log.ts
-import { KoraError as KoraError13 } from "@korajs/core";
-var AuditLogError = class extends KoraError13 {
+import { KoraError as KoraError14 } from "@korajs/core";
+var AuditLogError = class extends KoraError14 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "AuditLogError";
@@ -5011,8 +5846,9 @@ var InMemoryAuditLogStore = class {
     const initialLength = this.entries.length;
     let writeIndex = 0;
     for (let i = 0; i < this.entries.length; i++) {
-      if (this.entries[i].timestamp >= timestamp) {
-        this.entries[writeIndex] = this.entries[i];
+      const entry = this.entries[i];
+      if (entry.timestamp >= timestamp) {
+        this.entries[writeIndex] = entry;
         writeIndex++;
       }
     }
@@ -5103,14 +5939,14 @@ function generateAuditId() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
 
 // src/admin/webhooks.ts
-import { KoraError as KoraError14 } from "@korajs/core";
-var WebhookError = class extends KoraError14 {
+import { KoraError as KoraError15 } from "@korajs/core";
+var WebhookError = class extends KoraError15 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "WebhookError";
@@ -5222,9 +6058,7 @@ var WebhookManager = class {
    */
   async dispatch(event, data) {
     const endpoints = await this.store.listEndpoints();
-    const matching = endpoints.filter(
-      (ep) => ep.active && ep.events.includes(event)
-    );
+    const matching = endpoints.filter((ep) => ep.active && ep.events.includes(event));
     const payload = {
       id: generateId2(),
       event,
@@ -5232,9 +6066,7 @@ var WebhookManager = class {
       data
     };
     const payloadJson = JSON.stringify(payload);
-    await Promise.allSettled(
-      matching.map((ep) => this.deliverToEndpoint(ep, payloadJson, event))
-    );
+    await Promise.allSettled(matching.map((ep) => this.deliverToEndpoint(ep, payloadJson, event)));
   }
   // --- Private ---
   async deliverToEndpoint(endpoint, payloadJson, event) {
@@ -5287,7 +6119,7 @@ function generateId2() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return hex;
 }
@@ -5296,7 +6128,7 @@ function generateSecret2() {
   globalThis.crypto.getRandomValues(bytes);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return `whsec_${hex}`;
 }
@@ -5309,15 +6141,11 @@ async function signPayload(payload, secret) {
     false,
     ["sign"]
   );
-  const signature = await globalThis.crypto.subtle.sign(
-    "HMAC",
-    key,
-    encoder.encode(payload)
-  );
+  const signature = await globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(payload));
   const bytes = new Uint8Array(signature);
   let hex = "";
   for (let i = 0; i < bytes.length; i++) {
-    hex += bytes[i].toString(16).padStart(2, "0");
+    hex += bytes[i]?.toString(16).padStart(2, "0");
   }
   return `sha256=${hex}`;
 }
@@ -5347,6 +6175,7 @@ export {
   CannotRemoveOwnerError,
   CircularInheritanceError,
   DuplicateEmailError,
+  DuplicateLinkedIdentityError,
   EmailVerificationError,
   EmailVerificationManager,
   ExternalAuthOperationNotSupportedError,
@@ -5356,6 +6185,7 @@ export {
   InMemoryAuditLogStore,
   InMemoryChallengeStore,
   InMemoryEmailVerificationStore,
+  InMemoryLinkedIdentityStore,
   InMemoryOAuthStateStore,
   InMemoryOrgStore,
   InMemoryPasswordResetStore,
@@ -5388,6 +6218,8 @@ export {
   PasskeyVerificationError,
   PasswordResetError,
   PasswordResetManager,
+  PostgresLinkedIdentityStore,
+  PostgresOAuthStateStore,
   PostgresUserStore,
   ROLE_HIERARCHY,
   RbacEngine,
@@ -5402,6 +6234,8 @@ export {
   SessionManager,
   SessionMfaRequiredError,
   SessionNotFoundError,
+  SqliteLinkedIdentityStore,
+  SqliteOAuthStateStore,
   SqliteUserStore,
   TokenManager,
   TotpAlreadyEnabledError,
@@ -5420,7 +6254,14 @@ export {
   base32Encode,
   computePublicKeyThumbprint,
   createClerkAdapter,
+  createKoraAuthServer,
+  createPostgresLinkedIdentityStore,
+  createPostgresOAuthStateStore,
+  createPostgresOAuthStores,
   createPostgresUserStore,
+  createSqliteLinkedIdentityStore,
+  createSqliteOAuthStateStore,
+  createSqliteOAuthStores,
   createSqliteUserStore,
   createSupabaseAdapter,
   decodeJwt,