@korajs/auth 0.3.3 → 0.5.0

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   AuthClient: () => AuthClient,
+  AuthDeviceIdentityError: () => AuthDeviceIdentityError,
   AuthError: () => AuthError,
   AutoLockManager: () => AutoLockManager,
   CryptoUnavailableError: () => CryptoUnavailableError,
@@ -41,8 +42,14 @@ __export(index_exports, {
   TokenStore: () => TokenStore,
   authenticateWithPasskey: () => authenticateWithPasskey,
   computePublicKeyThumbprint: () => computePublicKeyThumbprint,
+  createAuthTokenStorage: () => createAuthTokenStorage,
   createDeviceKeyStore: () => createDeviceKeyStore,
+  createKoraAuth: () => createKoraAuth,
+  createKoraAuthSync: () => createKoraAuthSync,
+  createMemoryAuthTokenStorage: () => createMemoryAuthTokenStorage,
   createPasskeyCredential: () => createPasskeyCredential,
+  createPersistentDeviceIdentity: () => createPersistentDeviceIdentity,
+  createWebStorageAuthTokenStorage: () => createWebStorageAuthTokenStorage,
   decryptData: () => decryptData,
   deriveEncryptionKey: () => deriveEncryptionKey,
   encryptData: () => encryptData,
@@ -86,18 +93,48 @@ function decodeJwtPayload(token) {
 }
 function isTokenExpired(token) {
   const payload = decodeJwtPayload(token);
-  if (!payload || typeof payload["exp"] !== "number") {
+  if (!payload || typeof payload.exp !== "number") {
     return true;
   }
   const nowSeconds = Math.floor(Date.now() / 1e3);
-  return payload["exp"] <= nowSeconds + EXPIRY_BUFFER_SECONDS;
+  return payload.exp <= nowSeconds + EXPIRY_BUFFER_SECONDS;
 }
 function getUserIdFromToken(token) {
   const payload = decodeJwtPayload(token);
-  if (!payload || typeof payload["sub"] !== "string") {
+  if (!payload || typeof payload.sub !== "string") {
     return null;
   }
-  return payload["sub"];
+  return payload.sub;
+}
+function getDefaultFetch() {
+  if (typeof globalThis.fetch !== "function") {
+    return async () => {
+      throw new AuthError(
+        "No fetch implementation is available in this runtime. Pass `fetch` to AuthClientConfig.",
+        "AUTH_FETCH_UNAVAILABLE"
+      );
+    };
+  }
+  return globalThis.fetch.bind(globalThis);
+}
+function normalizeAuthUser(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name ?? null
+  };
+}
+function canRedirectCurrentWindow() {
+  return typeof globalThis.window !== "undefined" && typeof globalThis.window.location?.assign === "function";
+}
+function redirectCurrentWindow(url) {
+  if (!canRedirectCurrentWindow()) {
+    throw new AuthError(
+      "OAuth redirect is not available in this runtime. Pass redirect: false and open the returned URL with your platform browser API.",
+      "AUTH_OAUTH_REDIRECT_UNAVAILABLE"
+    );
+  }
+  globalThis.window.location.assign(url);
 }
 function createTokenStorage(prefix) {
   let useLocalStorage = false;
@@ -152,6 +189,8 @@ function createTokenStorage(prefix) {
 var AuthClient = class {
   serverUrl;
   storage;
+  fetchFn;
+  deviceIdentity;
   listeners = /* @__PURE__ */ new Set();
   _state = "loading";
   _user = null;
@@ -165,7 +204,9 @@ var AuthClient = class {
   constructor(config) {
     this.serverUrl = config.serverUrl.replace(/\/+$/, "");
     const prefix = config.storageKey ?? "kora_auth";
-    this.storage = createTokenStorage(prefix);
+    this.storage = config.storage ?? createTokenStorage(prefix);
+    this.fetchFn = config.fetch ?? getDefaultFetch();
+    this.deviceIdentity = config.deviceIdentity;
   }
   // -----------------------------------------------------------------------
   // Public getters
@@ -197,8 +238,8 @@ var AuthClient = class {
       return;
     }
     this._initialized = true;
-    const accessToken = this.storage.getAccessToken();
-    const refreshToken = this.storage.getRefreshToken();
+    const accessToken = await this.storage.getAccessToken();
+    const refreshToken = await this.storage.getRefreshToken();
     if (!accessToken || !refreshToken) {
       this.setState("unauthenticated", null);
       return;
@@ -215,7 +256,7 @@ var AuthClient = class {
       }
     } catch {
     }
-    this.storage.clear();
+    await this.storage.clear();
     this.setState("unauthenticated", null);
   }
   // -----------------------------------------------------------------------
@@ -229,12 +270,13 @@ var AuthClient = class {
    * @throws {AuthError} If the request fails or the server returns an error
    */
   async signUp(params) {
+    const body = await this.withDeviceIdentity(params);
     const response = await this.request("/auth/signup", {
       method: "POST",
-      body: params
+      body
     });
     const tokens = "tokens" in response ? response.tokens : response;
-    this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
+    await this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
     const user = await this.fetchUserProfile(tokens.accessToken);
     this.setState("authenticated", user);
     return user;
@@ -247,16 +289,88 @@ var AuthClient = class {
    * @throws {AuthError} If the credentials are invalid or the request fails
    */
   async signIn(params) {
+    const body = await this.withDeviceIdentity(params);
     const response = await this.request("/auth/signin", {
       method: "POST",
-      body: params
+      body
     });
     const tokens = "tokens" in response ? response.tokens : response;
-    this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
+    await this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
     const user = await this.fetchUserProfile(tokens.accessToken);
     this.setState("authenticated", user);
     return user;
   }
+  /**
+   * Create an OAuth authorization URL and optionally redirect the current window.
+   *
+   * For web apps, call this from a button click and keep the default redirect behavior.
+   * For desktop/mobile, pass `redirect: false`, open the returned URL with the runtime's
+   * browser API, then call `completeOAuthSignIn()` after receiving the callback.
+   */
+  async signInWithOAuth(provider, options = {}) {
+    const result = await this.createOAuthAuthorization(provider, options);
+    if (options.redirect ?? canRedirectCurrentWindow()) {
+      redirectCurrentWindow(result.url);
+    }
+    return result;
+  }
+  /**
+   * Complete an OAuth sign-in callback and store the issued Kora tokens.
+   */
+  async completeOAuthSignIn(provider, params) {
+    const body = await this.withDeviceIdentity(params);
+    const response = await this.request(
+      `/auth/oauth/${encodeURIComponent(provider)}/callback`,
+      {
+        method: "POST",
+        body: { ...body }
+      }
+    );
+    await this.storage.setTokens(response.tokens.accessToken, response.tokens.refreshToken);
+    const user = normalizeAuthUser(response.user);
+    this.setState("authenticated", user);
+    return user;
+  }
+  /**
+   * Create an OAuth authorization URL for linking another provider to the current user.
+   */
+  async getOAuthAuthorizationUrl(provider, options = {}) {
+    return this.createOAuthAuthorization(provider, { ...options, redirect: false });
+  }
+  /**
+   * Link an OAuth provider to the current authenticated user.
+   */
+  async linkOAuth(provider, params) {
+    const token = await this.requireAccessToken();
+    return this.request(`/auth/oauth/${encodeURIComponent(provider)}/link`, {
+      method: "POST",
+      body: {
+        code: params.code,
+        state: params.state
+      },
+      token
+    });
+  }
+  /**
+   * List OAuth accounts linked to the current authenticated user.
+   */
+  async listLinkedAccounts() {
+    const token = await this.requireAccessToken();
+    return this.request("/auth/oauth/links", {
+      method: "GET",
+      token
+    });
+  }
+  /**
+   * Unlink an OAuth provider from the current authenticated user.
+   */
+  async unlinkOAuth(provider) {
+    const token = await this.requireAccessToken();
+    await this.request(`/auth/oauth/${encodeURIComponent(provider)}/link`, {
+      method: "DELETE",
+      token
+    });
+  }
   /**
    * Sign out the current user.
    *
@@ -265,9 +379,9 @@ var AuthClient = class {
    * stolen refresh tokens cannot be used after the user explicitly signs out.
    */
   async signOut() {
-    const accessToken = this.storage.getAccessToken();
-    const refreshToken = this.storage.getRefreshToken();
-    this.storage.clear();
+    const accessToken = await this.storage.getAccessToken();
+    const refreshToken = await this.storage.getRefreshToken();
+    await this.storage.clear();
     this._refreshPromise = null;
     this.setState("unauthenticated", null);
     if (accessToken) {
@@ -291,11 +405,11 @@ var AuthClient = class {
    *          authenticated and refresh is not possible
    */
   async getAccessToken() {
-    const accessToken = this.storage.getAccessToken();
+    const accessToken = await this.storage.getAccessToken();
     if (accessToken && !isTokenExpired(accessToken)) {
       return accessToken;
     }
-    const refreshToken = this.storage.getRefreshToken();
+    const refreshToken = await this.storage.getRefreshToken();
     if (!refreshToken) {
       return null;
     }
@@ -378,7 +492,7 @@ var AuthClient = class {
           name: null
         });
       } else {
-        this.storage.clear();
+        await this.storage.clear();
         this.setState("unauthenticated", null);
       }
     }
@@ -391,10 +505,47 @@ var AuthClient = class {
       method: "GET",
       token: accessToken
     });
+    return normalizeAuthUser(profile);
+  }
+  async createOAuthAuthorization(provider, options) {
+    const params = new URLSearchParams();
+    const withIdentity = await this.withDeviceIdentity({
+      deviceId: options.deviceId,
+      devicePublicKey: options.devicePublicKey
+    });
+    if (options.returnTo) {
+      params.set("returnTo", options.returnTo);
+    }
+    if (withIdentity.deviceId) {
+      params.set("deviceId", withIdentity.deviceId);
+    }
+    if (withIdentity.devicePublicKey) {
+      params.set("devicePublicKey", withIdentity.devicePublicKey);
+    }
+    if (options.metadata) {
+      for (const [key, value] of Object.entries(options.metadata)) {
+        if (value !== void 0 && value !== null) {
+          params.set(key, String(value));
+        }
+      }
+    }
+    const query = params.toString();
+    return this.request(
+      `/auth/oauth/${encodeURIComponent(provider)}${query ? `?${query}` : ""}`,
+      {
+        method: "GET"
+      }
+    );
+  }
+  async withDeviceIdentity(params) {
+    if (!this.deviceIdentity || params.deviceId && params.devicePublicKey) {
+      return params;
+    }
+    const identity = await this.deviceIdentity.getDeviceIdentity();
     return {
-      id: profile.id,
-      email: profile.email,
-      name: profile.name ?? null
+      ...params,
+      deviceId: params.deviceId ?? identity.deviceId,
+      devicePublicKey: params.devicePublicKey ?? identity.devicePublicKey
     };
   }
   /**
@@ -413,6 +564,13 @@ var AuthClient = class {
       this._refreshPromise = null;
     }
   }
+  async requireAccessToken() {
+    const token = await this.getAccessToken();
+    if (!token) {
+      throw new AuthError("You must be signed in to perform this action.", "AUTH_REQUIRED");
+    }
+    return token;
+  }
   /**
    * Execute the token refresh network request.
    */
@@ -422,10 +580,10 @@ var AuthClient = class {
         method: "POST",
         body: { refreshToken }
       });
-      this.storage.setTokens(response.accessToken, response.refreshToken);
+      await this.storage.setTokens(response.accessToken, response.refreshToken);
       return response.accessToken;
     } catch {
-      this.storage.clear();
+      await this.storage.clear();
       this.setState("unauthenticated", null);
       return null;
     }
@@ -445,11 +603,11 @@ var AuthClient = class {
       headers["Content-Type"] = "application/json";
     }
     if (options.token) {
-      headers["Authorization"] = `Bearer ${options.token}`;
+      headers.Authorization = `Bearer ${options.token}`;
     }
     let response;
     try {
-      response = await fetch(url, {
+      response = await this.fetchFn(url, {
         method: options.method,
         headers,
         body: options.body ? JSON.stringify(options.body) : void 0
@@ -466,414 +624,154 @@ var AuthClient = class {
       let serverError;
       try {
         const body = await response.json();
-        if (typeof body["error"] === "string") {
-          errorMessage = body["error"];
+        if (typeof body.error === "string") {
+          errorMessage = body.error;
           serverError = errorMessage;
-        } else if (typeof body["message"] === "string") {
-          errorMessage = body["message"];
+        } else if (typeof body.message === "string") {
+          errorMessage = body.message;
           serverError = errorMessage;
         }
       } catch {
       }
-      throw new AuthError(
-        errorMessage,
-        "AUTH_SERVER_ERROR",
-        { path, status: response.status, serverError }
-      );
+      throw new AuthError(errorMessage, "AUTH_SERVER_ERROR", {
+        path,
+        status: response.status,
+        serverError
+      });
     }
     const json = await response.json();
-    const data = json["data"] !== void 0 ? json["data"] : json;
+    const data = json.data !== void 0 ? json.data : json;
     return data;
   }
 };
 
-// src/client/org-client.ts
+// src/client/device-session.ts
+var import_core4 = require("@korajs/core");
+
+// src/device/device-identity.ts
 var import_core2 = require("@korajs/core");
-var OrgClientError = class extends import_core2.KoraError {
-  constructor(message, code, context) {
-    super(message, code, context);
-    this.name = "OrgClientError";
+var CryptoUnavailableError = class extends import_core2.KoraError {
+  constructor() {
+    super(
+      "Web Crypto API (crypto.subtle) is not available in this environment. Device identity requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
+      "CRYPTO_UNAVAILABLE"
+    );
+    this.name = "CryptoUnavailableError";
   }
 };
-var OrgClient = class {
-  serverUrl;
-  getAccessToken;
-  listeners = /* @__PURE__ */ new Set();
-  _activeOrgId = null;
-  _activeOrg = null;
-  _activeRole = null;
-  constructor(config) {
-    this.serverUrl = config.serverUrl.replace(/\/+$/, "");
-    this.getAccessToken = config.getAccessToken;
-  }
-  // --- Getters ---
-  /** Currently active organization ID */
-  get activeOrgId() {
-    return this._activeOrgId;
+var DeviceIdentityError = class extends import_core2.KoraError {
+  constructor(message, context) {
+    super(message, "DEVICE_IDENTITY_ERROR", context);
+    this.name = "DeviceIdentityError";
   }
-  /** Currently active organization */
-  get activeOrg() {
-    return this._activeOrg;
+};
+function toBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
   }
-  /** Current user's role in the active organization */
-  get activeRole() {
-    return this._activeRole;
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingNeeded = (4 - base64.length % 4) % 4;
+  base64 += "=".repeat(paddingNeeded);
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
   }
-  // --- Organization Operations ---
-  /**
-   * Create a new organization.
-   */
-  async createOrg(params) {
-    return this.request("/orgs", {
-      method: "POST",
-      body: params
-    });
+  return bytes;
+}
+function assertCryptoAvailable() {
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+    throw new CryptoUnavailableError();
   }
-  /**
-   * List all organizations the current user belongs to.
-   */
-  async listOrgs() {
-    return this.request("/orgs", { method: "GET" });
+}
+var ECDSA_ALGORITHM = {
+  name: "ECDSA",
+  namedCurve: "P-256"
+};
+var ECDSA_SIGN_ALGORITHM = {
+  name: "ECDSA",
+  hash: { name: "SHA-256" }
+};
+async function generateDeviceKeyPair() {
+  assertCryptoAvailable();
+  try {
+    const keyPair = await globalThis.crypto.subtle.generateKey(
+      ECDSA_ALGORITHM,
+      // extractable: false makes the private key non-extractable.
+      // The public key is always extractable regardless of this flag.
+      false,
+      ["sign", "verify"]
+    );
+    return keyPair;
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to generate ECDSA P-256 device key pair. Ensure the runtime supports the ECDSA algorithm with the P-256 curve.",
+      { cause: cause instanceof Error ? cause.message : String(cause) }
+    );
   }
-  /**
-   * Get an organization by ID.
-   */
-  async getOrg(orgId) {
-    return this.request(`/orgs/${orgId}`, { method: "GET" });
+}
+async function exportPublicKeyJwk(keyPair) {
+  assertCryptoAvailable();
+  try {
+    const jwk = await globalThis.crypto.subtle.exportKey("jwk", keyPair.publicKey);
+    return jwk;
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to export public key as JWK. The key pair may be invalid or the public key may not support JWK export.",
+      { cause: cause instanceof Error ? cause.message : String(cause) }
+    );
   }
-  /**
-   * Update an organization.
-   */
-  async updateOrg(orgId, params) {
-    const result = await this.request(`/orgs/${orgId}`, {
-      method: "PATCH",
-      body: params
-    });
-    if (this._activeOrgId === orgId) {
-      this._activeOrg = result;
-    }
-    return result;
+}
+async function signChallenge(privateKey, challenge) {
+  assertCryptoAvailable();
+  try {
+    const encoded = new TextEncoder().encode(challenge);
+    const signatureBuffer = await globalThis.crypto.subtle.sign(
+      ECDSA_SIGN_ALGORITHM,
+      privateKey,
+      encoded
+    );
+    return toBase64Url(signatureBuffer);
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      'Failed to sign challenge. Ensure the key is a valid ECDSA P-256 private key with "sign" usage.',
+      { cause: cause instanceof Error ? cause.message : String(cause) }
+    );
   }
-  /**
-   * Delete an organization.
-   */
-  async deleteOrg(orgId) {
-    await this.request(`/orgs/${orgId}`, { method: "DELETE" });
-    if (this._activeOrgId === orgId) {
-      this._activeOrgId = null;
-      this._activeOrg = null;
-      this._activeRole = null;
-      this.notifyListeners();
-    }
-  }
-  // --- Org Switching ---
-  /**
-   * Switch the active organization context.
-   * Fetches the org details and the user's membership/role.
-   */
-  async switchOrg(orgId) {
-    const org = await this.request(`/orgs/${orgId}`, { method: "GET" });
-    const membership = await this.request(`/orgs/${orgId}/membership`, {
-      method: "GET"
-    });
-    this._activeOrgId = orgId;
-    this._activeOrg = org;
-    this._activeRole = membership.role;
-    this.notifyListeners();
-  }
-  /**
-   * Clear the active organization (no org selected).
-   */
-  clearActiveOrg() {
-    this._activeOrgId = null;
-    this._activeOrg = null;
-    this._activeRole = null;
-    this.notifyListeners();
-  }
-  // --- Member Management ---
-  /**
-   * List members of an organization.
-   */
-  async listMembers(orgId) {
-    return this.request(`/orgs/${orgId}/members`, { method: "GET" });
-  }
-  /**
-   * Remove a member from an organization.
-   */
-  async removeMember(orgId, userId) {
-    await this.request(`/orgs/${orgId}/members/${userId}`, { method: "DELETE" });
-  }
-  /**
-   * Update a member's role.
-   */
-  async updateMemberRole(orgId, userId, role) {
-    return this.request(`/orgs/${orgId}/members/${userId}/role`, {
-      method: "PATCH",
-      body: { role }
-    });
-  }
-  /**
-   * Transfer ownership to another member.
-   */
-  async transferOwnership(orgId, newOwnerId) {
-    await this.request(`/orgs/${orgId}/transfer`, {
-      method: "POST",
-      body: { newOwnerId }
-    });
-  }
-  /**
-   * Leave an organization (remove yourself).
-   */
-  async leaveOrg(orgId) {
-    await this.request(`/orgs/${orgId}/leave`, { method: "POST" });
-    if (this._activeOrgId === orgId) {
-      this._activeOrgId = null;
-      this._activeOrg = null;
-      this._activeRole = null;
-      this.notifyListeners();
-    }
-  }
-  // --- Invitations ---
-  /**
-   * Invite a user to an organization by email.
-   */
-  async inviteMember(orgId, params) {
-    return this.request(`/orgs/${orgId}/invitations`, {
-      method: "POST",
-      body: params
-    });
-  }
-  /**
-   * Accept an invitation by token.
-   */
-  async acceptInvitation(token) {
-    return this.request("/invitations/accept", {
-      method: "POST",
-      body: { token }
-    });
-  }
-  /**
-   * List pending invitations for an organization.
-   */
-  async listInvitations(orgId) {
-    return this.request(`/orgs/${orgId}/invitations`, { method: "GET" });
-  }
-  /**
-   * Revoke a pending invitation.
-   */
-  async revokeInvitation(orgId, invitationId) {
-    await this.request(`/orgs/${orgId}/invitations/${invitationId}`, { method: "DELETE" });
-  }
-  /**
-   * List pending invitations for the current user's email.
-   */
-  async listMyInvitations(email) {
-    return this.request(
-      `/invitations?email=${encodeURIComponent(email)}`,
-      { method: "GET" }
-    );
-  }
-  // --- Subscriptions ---
-  /**
-   * Subscribe to active org changes.
-   * @returns Unsubscribe function
-   */
-  onOrgChange(callback) {
-    this.listeners.add(callback);
-    return () => {
-      this.listeners.delete(callback);
-    };
-  }
-  // --- Internal ---
-  notifyListeners() {
-    for (const listener of this.listeners) {
-      try {
-        listener(this._activeOrgId);
-      } catch {
-      }
-    }
-  }
-  async request(path, options) {
-    const token = await this.getAccessToken();
-    if (!token) {
-      throw new OrgClientError(
-        "Not authenticated. Sign in before performing organization operations.",
-        "ORG_NOT_AUTHENTICATED"
-      );
-    }
-    const url = `${this.serverUrl}${path}`;
-    const headers = {
-      Authorization: `Bearer ${token}`
-    };
-    if (options.body) {
-      headers["Content-Type"] = "application/json";
-    }
-    let response;
-    try {
-      response = await fetch(url, {
-        method: options.method,
-        headers,
-        body: options.body ? JSON.stringify(options.body) : void 0
-      });
-    } catch (cause) {
-      throw new OrgClientError(
-        `Network request to ${path} failed.`,
-        "ORG_NETWORK_ERROR",
-        { path, cause: cause instanceof Error ? cause.message : String(cause) }
-      );
-    }
-    if (!response.ok) {
-      let errorMessage = `Server returned HTTP ${response.status}`;
-      try {
-        const body = await response.json();
-        if (typeof body["error"] === "string") {
-          errorMessage = body["error"];
-        }
-      } catch {
-      }
-      throw new OrgClientError(errorMessage, "ORG_SERVER_ERROR", {
-        path,
-        status: response.status
-      });
-    }
-    const text = await response.text();
-    if (text.length === 0) return void 0;
-    try {
-      const body = JSON.parse(text);
-      if (body && typeof body === "object" && "data" in body) {
-        return body.data;
-      }
-      return body;
-    } catch {
-      return void 0;
-    }
-  }
-};
-
-// src/device/device-identity.ts
-var import_core3 = require("@korajs/core");
-var CryptoUnavailableError = class extends import_core3.KoraError {
-  constructor() {
-    super(
-      "Web Crypto API (crypto.subtle) is not available in this environment. Device identity requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
-      "CRYPTO_UNAVAILABLE"
-    );
-    this.name = "CryptoUnavailableError";
-  }
-};
-var DeviceIdentityError = class extends import_core3.KoraError {
-  constructor(message, context) {
-    super(message, "DEVICE_IDENTITY_ERROR", context);
-    this.name = "DeviceIdentityError";
-  }
-};
-function toBase64Url(buffer) {
-  const bytes = new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function fromBase64Url(str) {
-  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
-  const paddingNeeded = (4 - base64.length % 4) % 4;
-  base64 += "=".repeat(paddingNeeded);
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
-function assertCryptoAvailable() {
-  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
-    throw new CryptoUnavailableError();
-  }
-}
-var ECDSA_ALGORITHM = {
-  name: "ECDSA",
-  namedCurve: "P-256"
-};
-var ECDSA_SIGN_ALGORITHM = {
-  name: "ECDSA",
-  hash: { name: "SHA-256" }
-};
-async function generateDeviceKeyPair() {
-  assertCryptoAvailable();
-  try {
-    const keyPair = await globalThis.crypto.subtle.generateKey(
-      ECDSA_ALGORITHM,
-      // extractable: false makes the private key non-extractable.
-      // The public key is always extractable regardless of this flag.
-      false,
-      ["sign", "verify"]
-    );
-    return keyPair;
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to generate ECDSA P-256 device key pair. Ensure the runtime supports the ECDSA algorithm with the P-256 curve.",
-      { cause: cause instanceof Error ? cause.message : String(cause) }
-    );
-  }
-}
-async function exportPublicKeyJwk(keyPair) {
-  assertCryptoAvailable();
-  try {
-    const jwk = await globalThis.crypto.subtle.exportKey("jwk", keyPair.publicKey);
-    return jwk;
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to export public key as JWK. The key pair may be invalid or the public key may not support JWK export.",
-      { cause: cause instanceof Error ? cause.message : String(cause) }
-    );
-  }
-}
-async function signChallenge(privateKey, challenge) {
-  assertCryptoAvailable();
-  try {
-    const encoded = new TextEncoder().encode(challenge);
-    const signatureBuffer = await globalThis.crypto.subtle.sign(
-      ECDSA_SIGN_ALGORITHM,
-      privateKey,
-      encoded
-    );
-    return toBase64Url(signatureBuffer);
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      'Failed to sign challenge. Ensure the key is a valid ECDSA P-256 private key with "sign" usage.',
-      { cause: cause instanceof Error ? cause.message : String(cause) }
-    );
-  }
-}
-async function verifyChallenge(publicKeyJwk, challenge, signature) {
-  assertCryptoAvailable();
-  try {
-    const publicKey = await globalThis.crypto.subtle.importKey(
-      "jwk",
-      publicKeyJwk,
-      ECDSA_ALGORITHM,
-      true,
-      ["verify"]
-    );
-    const encoded = new TextEncoder().encode(challenge);
-    const signatureBytes = fromBase64Url(signature);
-    const isValid = await globalThis.crypto.subtle.verify(
-      ECDSA_SIGN_ALGORITHM,
-      publicKey,
-      signatureBytes,
-      encoded
-    );
-    return isValid;
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to verify challenge signature. The public key JWK or signature format may be invalid.",
-      {
-        cause: cause instanceof Error ? cause.message : String(cause),
-        publicKeyKty: publicKeyJwk.kty,
-        publicKeyCrv: publicKeyJwk.crv
-      }
-    );
+}
+async function verifyChallenge(publicKeyJwk, challenge, signature) {
+  assertCryptoAvailable();
+  try {
+    const publicKey = await globalThis.crypto.subtle.importKey(
+      "jwk",
+      publicKeyJwk,
+      ECDSA_ALGORITHM,
+      true,
+      ["verify"]
+    );
+    const encoded = new TextEncoder().encode(challenge);
+    const signatureBytes = fromBase64Url(signature);
+    const isValid = await globalThis.crypto.subtle.verify(
+      ECDSA_SIGN_ALGORITHM,
+      publicKey,
+      signatureBytes,
+      encoded
+    );
+    return isValid;
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to verify challenge signature. The public key JWK or signature format may be invalid.",
+      {
+        cause: cause instanceof Error ? cause.message : String(cause),
+        publicKeyKty: publicKeyJwk.kty,
+        publicKeyCrv: publicKeyJwk.crv
+      }
+    );
   }
 }
 async function computePublicKeyThumbprint(publicKeyJwk) {
@@ -905,16 +803,15 @@ async function computePublicKeyThumbprint(publicKeyJwk) {
     const hashBuffer = await globalThis.crypto.subtle.digest("SHA-256", encoded);
     return toBase64Url(hashBuffer);
   } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to compute SHA-256 thumbprint of the public key JWK.",
-      { cause: cause instanceof Error ? cause.message : String(cause) }
-    );
+    throw new DeviceIdentityError("Failed to compute SHA-256 thumbprint of the public key JWK.", {
+      cause: cause instanceof Error ? cause.message : String(cause)
+    });
   }
 }
 
 // src/device/device-store.ts
-var import_core4 = require("@korajs/core");
-var DeviceKeyStoreError = class extends import_core4.KoraError {
+var import_core3 = require("@korajs/core");
+var DeviceKeyStoreError = class extends import_core3.KoraError {
   constructor(message, context) {
     super(message, "DEVICE_KEY_STORE_ERROR", context);
     this.name = "DeviceKeyStoreError";
@@ -962,10 +859,9 @@ var IndexedDBDeviceKeyStore = class {
       request.onerror = () => {
         this.dbPromise = null;
         reject(
-          new DeviceKeyStoreError(
-            "Failed to open IndexedDB database for device key storage.",
-            { error: request.error?.message }
-          )
+          new DeviceKeyStoreError("Failed to open IndexedDB database for device key storage.", {
+            error: request.error?.message
+          })
         );
       };
       request.onblocked = () => {
@@ -977,163 +873,636 @@ var IndexedDBDeviceKeyStore = class {
         );
       };
     });
-    return this.dbPromise;
+    return this.dbPromise;
+  }
+  /** @inheritdoc */
+  async saveKeyPair(deviceId, keyPair) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        store.put(keyPair, deviceId);
+        tx.oncomplete = () => {
+          resolve();
+        };
+        tx.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
+              deviceId,
+              error: tx.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
+    });
+  }
+  /** @inheritdoc */
+  async loadKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readonly");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        const request = store.get(deviceId);
+        request.onsuccess = () => {
+          const result = request.result;
+          resolve(result ?? null);
+        };
+        request.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
+              deviceId,
+              error: request.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
+    });
   }
   /** @inheritdoc */
-  async saveKeyPair(deviceId, keyPair) {
+  async deleteKeyPair(deviceId) {
     const db = await this.openDatabase();
     return new Promise((resolve, reject) => {
       try {
         const tx = db.transaction(IDB_STORE_NAME, "readwrite");
         const store = tx.objectStore(IDB_STORE_NAME);
-        store.put(keyPair, deviceId);
+        store.delete(deviceId);
         tx.oncomplete = () => {
           resolve();
         };
         tx.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
+              deviceId,
+              error: tx.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
+    });
+  }
+  /** @inheritdoc */
+  async hasKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readonly");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        const request = store.count(deviceId);
+        request.onsuccess = () => {
+          resolve(request.result > 0);
+        };
+        request.onerror = () => {
           reject(
             new DeviceKeyStoreError(
-              `Failed to save key pair for device "${deviceId}".`,
-              { deviceId, error: tx.error?.message }
+              `Failed to check if key pair exists for device "${deviceId}".`,
+              { deviceId, error: request.error?.message }
             )
           );
         };
       } catch (cause) {
         reject(
-          new DeviceKeyStoreError(
-            `Failed to save key pair for device "${deviceId}".`,
-            {
-              deviceId,
-              cause: cause instanceof Error ? cause.message : String(cause)
-            }
-          )
+          new DeviceKeyStoreError(`Failed to check if key pair exists for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
         );
       }
     });
   }
-  /** @inheritdoc */
-  async loadKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readonly");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        const request = store.get(deviceId);
-        request.onsuccess = () => {
-          const result = request.result;
-          resolve(result ?? null);
-        };
-        request.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(
-              `Failed to load key pair for device "${deviceId}".`,
-              { deviceId, error: request.error?.message }
-            )
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(
-            `Failed to load key pair for device "${deviceId}".`,
-            {
-              deviceId,
-              cause: cause instanceof Error ? cause.message : String(cause)
-            }
-          )
-        );
-      }
+};
+var InMemoryDeviceKeyStore = class {
+  store = /* @__PURE__ */ new Map();
+  /** @inheritdoc */
+  async saveKeyPair(deviceId, keyPair) {
+    this.store.set(deviceId, keyPair);
+  }
+  /** @inheritdoc */
+  async loadKeyPair(deviceId) {
+    return this.store.get(deviceId) ?? null;
+  }
+  /** @inheritdoc */
+  async deleteKeyPair(deviceId) {
+    this.store.delete(deviceId);
+  }
+  /** @inheritdoc */
+  async hasKeyPair(deviceId) {
+    return this.store.has(deviceId);
+  }
+};
+function createDeviceKeyStore() {
+  if (typeof globalThis.indexedDB !== "undefined") {
+    return new IndexedDBDeviceKeyStore();
+  }
+  return new InMemoryDeviceKeyStore();
+}
+
+// src/client/device-session.ts
+var DEFAULT_DEVICE_ID_KEY = "kora_auth_device_id";
+var AuthDeviceIdentityError = class extends import_core4.KoraError {
+  constructor(message, context) {
+    super(message, "AUTH_DEVICE_IDENTITY_ERROR", context);
+    this.name = "AuthDeviceIdentityError";
+  }
+};
+function createPersistentDeviceIdentity(options) {
+  const storage = options.storage;
+  const keyStore = options.keyStore ?? createDefaultPersistentKeyStore();
+  const deviceIdKey = options.deviceIdKey ?? DEFAULT_DEVICE_ID_KEY;
+  const generateDeviceId = options.generateDeviceId ?? defaultDeviceId;
+  return {
+    async getDeviceIdentity() {
+      let deviceId = await storage.getItem(deviceIdKey);
+      if (!deviceId) {
+        deviceId = generateDeviceId();
+        await storage.setItem(deviceIdKey, deviceId);
+      }
+      let keyPair = await keyStore.loadKeyPair(deviceId);
+      if (!keyPair) {
+        keyPair = await generateDeviceKeyPair();
+        await keyStore.saveKeyPair(deviceId, keyPair);
+      }
+      const publicKey = await exportPublicKeyJwk(keyPair);
+      return {
+        deviceId,
+        devicePublicKey: JSON.stringify(publicKey)
+      };
+    }
+  };
+}
+function createDefaultPersistentKeyStore() {
+  if (typeof globalThis.indexedDB !== "undefined") {
+    return createDeviceKeyStore();
+  }
+  throw new AuthDeviceIdentityError(
+    "No persistent device key store is available in this runtime. Pass `keyStore` to createPersistentDeviceIdentity()."
+  );
+}
+function defaultDeviceId() {
+  if (typeof globalThis.crypto?.randomUUID === "function") {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = new Uint8Array(16);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) {
+      bytes[i] = Math.floor(Math.random() * 256);
+    }
+  }
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
+// src/client/storage.ts
+function createAuthTokenStorage(options) {
+  const prefix = options.prefix ?? "kora_auth";
+  const accessKey = `${prefix}_access_token`;
+  const refreshKey = `${prefix}_refresh_token`;
+  const store = options.store;
+  return {
+    getAccessToken: () => store.getItem(accessKey),
+    getRefreshToken: () => store.getItem(refreshKey),
+    async setTokens(accessToken, refreshToken) {
+      await store.setItem(accessKey, accessToken);
+      await store.setItem(refreshKey, refreshToken);
+    },
+    async clear() {
+      await store.removeItem(accessKey);
+      await store.removeItem(refreshKey);
+    }
+  };
+}
+function createMemoryAuthTokenStorage() {
+  let accessToken = null;
+  let refreshToken = null;
+  return {
+    getAccessToken: () => accessToken,
+    getRefreshToken: () => refreshToken,
+    setTokens(access, refresh) {
+      accessToken = access;
+      refreshToken = refresh;
+    },
+    clear() {
+      accessToken = null;
+      refreshToken = null;
+    }
+  };
+}
+function createWebStorageAuthTokenStorage(storage, prefix) {
+  return createAuthTokenStorage({
+    prefix,
+    store: {
+      getItem: (key) => storage.getItem(key),
+      setItem: (key, value) => {
+        storage.setItem(key, value);
+      },
+      removeItem: (key) => {
+        storage.removeItem(key);
+      }
+    }
+  });
+}
+
+// src/client/quickstart.ts
+function createKoraAuth(options) {
+  const storage = options.storage ?? (options.credentialStore ? createAuthTokenStorage({
+    store: options.credentialStore,
+    prefix: options.storageKey
+  }) : tryCreateDefaultTokenStorage(options.storageKey));
+  const deviceIdentity = options.deviceIdentity === false ? void 0 : options.deviceIdentity ?? tryCreateDefaultDeviceIdentity(options.credentialStore, options.deviceKeyStore);
+  return new AuthClient({
+    serverUrl: options.serverUrl,
+    storageKey: options.storageKey,
+    storage,
+    fetch: options.fetch,
+    deviceIdentity
+  });
+}
+function tryCreateDefaultTokenStorage(storageKey) {
+  const storage = tryGetBrowserStorage();
+  return storage ? createWebStorageAuthTokenStorage(storage, storageKey) : void 0;
+}
+function tryCreateDefaultDeviceIdentity(credentialStore, deviceKeyStore) {
+  const storage = credentialStore ?? tryGetBrowserStorage();
+  if (!storage) {
+    return void 0;
+  }
+  try {
+    return createPersistentDeviceIdentity({
+      storage,
+      keyStore: deviceKeyStore
+    });
+  } catch {
+    return void 0;
+  }
+}
+function tryGetBrowserStorage() {
+  try {
+    if (typeof globalThis.localStorage === "undefined") {
+      return null;
+    }
+    const key = "__kora_auth_quickstart_test__";
+    globalThis.localStorage.setItem(key, "1");
+    globalThis.localStorage.removeItem(key);
+    return globalThis.localStorage;
+  } catch {
+    return null;
+  }
+}
+
+// src/client/auth-sync.ts
+var import_core5 = require("@korajs/core");
+function decodeJwtPayload2(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const payloadSegment = parts[1];
+  if (payloadSegment === void 0) {
+    return null;
+  }
+  try {
+    const base64 = payloadSegment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+    const json = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf-8");
+    const parsed = JSON.parse(json);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function readDeviceIdFromClaims(claims) {
+  const dev = claims.dev;
+  return typeof dev === "string" && dev.length > 0 ? dev : void 0;
+}
+function createKoraAuthSync(options) {
+  const { authClient, schema, scopeFromClaims } = options;
+  const binding = {
+    auth: async () => {
+      const token = await authClient.getAccessToken();
+      return { token: token ?? "" };
+    }
+  };
+  if (schema) {
+    binding.resolveScopeMap = async () => {
+      const token = await authClient.getAccessToken();
+      if (!token) {
+        return void 0;
+      }
+      const claims = decodeJwtPayload2(token);
+      if (!claims) {
+        return void 0;
+      }
+      const scopeValues = scopeFromClaims ? scopeFromClaims(claims) : (0, import_core5.extractScopeValuesFromClaims)(schema, claims);
+      return (0, import_core5.buildScopeMap)(schema, scopeValues);
+    };
+  }
+  binding.resolveNodeId = async () => {
+    const token = await authClient.getAccessToken();
+    if (!token) {
+      return void 0;
+    }
+    const claims = decodeJwtPayload2(token);
+    if (!claims) {
+      return void 0;
+    }
+    return readDeviceIdFromClaims(claims);
+  };
+  if (authClient.onAuthChange) {
+    binding.subscribe = (listener) => authClient.onAuthChange?.(() => listener()) ?? (() => {
+    });
+  }
+  return binding;
+}
+
+// src/client/org-client.ts
+var import_core6 = require("@korajs/core");
+var OrgClientError = class extends import_core6.KoraError {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "OrgClientError";
+  }
+};
+var OrgClient = class {
+  serverUrl;
+  getAccessToken;
+  listeners = /* @__PURE__ */ new Set();
+  _activeOrgId = null;
+  _activeOrg = null;
+  _activeRole = null;
+  constructor(config) {
+    this.serverUrl = config.serverUrl.replace(/\/+$/, "");
+    this.getAccessToken = config.getAccessToken;
+  }
+  // --- Getters ---
+  /** Currently active organization ID */
+  get activeOrgId() {
+    return this._activeOrgId;
+  }
+  /** Currently active organization */
+  get activeOrg() {
+    return this._activeOrg;
+  }
+  /** Current user's role in the active organization */
+  get activeRole() {
+    return this._activeRole;
+  }
+  // --- Organization Operations ---
+  /**
+   * Create a new organization.
+   */
+  async createOrg(params) {
+    return this.request("/orgs", {
+      method: "POST",
+      body: params
+    });
+  }
+  /**
+   * List all organizations the current user belongs to.
+   */
+  async listOrgs() {
+    return this.request("/orgs", { method: "GET" });
+  }
+  /**
+   * Get an organization by ID.
+   */
+  async getOrg(orgId) {
+    return this.request(`/orgs/${orgId}`, { method: "GET" });
+  }
+  /**
+   * Update an organization.
+   */
+  async updateOrg(orgId, params) {
+    const result = await this.request(`/orgs/${orgId}`, {
+      method: "PATCH",
+      body: params
+    });
+    if (this._activeOrgId === orgId) {
+      this._activeOrg = result;
+    }
+    return result;
+  }
+  /**
+   * Delete an organization.
+   */
+  async deleteOrg(orgId) {
+    await this.request(`/orgs/${orgId}`, { method: "DELETE" });
+    if (this._activeOrgId === orgId) {
+      this._activeOrgId = null;
+      this._activeOrg = null;
+      this._activeRole = null;
+      this.notifyListeners();
+    }
+  }
+  // --- Org Switching ---
+  /**
+   * Switch the active organization context.
+   * Fetches the org details and the user's membership/role.
+   */
+  async switchOrg(orgId) {
+    const org = await this.request(`/orgs/${orgId}`, { method: "GET" });
+    const membership = await this.request(`/orgs/${orgId}/membership`, {
+      method: "GET"
+    });
+    this._activeOrgId = orgId;
+    this._activeOrg = org;
+    this._activeRole = membership.role;
+    this.notifyListeners();
+  }
+  /**
+   * Clear the active organization (no org selected).
+   */
+  clearActiveOrg() {
+    this._activeOrgId = null;
+    this._activeOrg = null;
+    this._activeRole = null;
+    this.notifyListeners();
+  }
+  // --- Member Management ---
+  /**
+   * List members of an organization.
+   */
+  async listMembers(orgId) {
+    return this.request(`/orgs/${orgId}/members`, { method: "GET" });
+  }
+  /**
+   * Remove a member from an organization.
+   */
+  async removeMember(orgId, userId) {
+    await this.request(`/orgs/${orgId}/members/${userId}`, { method: "DELETE" });
+  }
+  /**
+   * Update a member's role.
+   */
+  async updateMemberRole(orgId, userId, role) {
+    return this.request(`/orgs/${orgId}/members/${userId}/role`, {
+      method: "PATCH",
+      body: { role }
+    });
+  }
+  /**
+   * Transfer ownership to another member.
+   */
+  async transferOwnership(orgId, newOwnerId) {
+    await this.request(`/orgs/${orgId}/transfer`, {
+      method: "POST",
+      body: { newOwnerId }
     });
   }
-  /** @inheritdoc */
-  async deleteKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        store.delete(deviceId);
-        tx.oncomplete = () => {
-          resolve();
-        };
-        tx.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(
-              `Failed to delete key pair for device "${deviceId}".`,
-              { deviceId, error: tx.error?.message }
-            )
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(
-            `Failed to delete key pair for device "${deviceId}".`,
-            {
-              deviceId,
-              cause: cause instanceof Error ? cause.message : String(cause)
-            }
-          )
-        );
-      }
+  /**
+   * Leave an organization (remove yourself).
+   */
+  async leaveOrg(orgId) {
+    await this.request(`/orgs/${orgId}/leave`, { method: "POST" });
+    if (this._activeOrgId === orgId) {
+      this._activeOrgId = null;
+      this._activeOrg = null;
+      this._activeRole = null;
+      this.notifyListeners();
+    }
+  }
+  // --- Invitations ---
+  /**
+   * Invite a user to an organization by email.
+   */
+  async inviteMember(orgId, params) {
+    return this.request(`/orgs/${orgId}/invitations`, {
+      method: "POST",
+      body: params
     });
   }
-  /** @inheritdoc */
-  async hasKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readonly");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        const request = store.count(deviceId);
-        request.onsuccess = () => {
-          resolve(request.result > 0);
-        };
-        request.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(
-              `Failed to check if key pair exists for device "${deviceId}".`,
-              { deviceId, error: request.error?.message }
-            )
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(
-            `Failed to check if key pair exists for device "${deviceId}".`,
-            {
-              deviceId,
-              cause: cause instanceof Error ? cause.message : String(cause)
-            }
-          )
-        );
-      }
+  /**
+   * Accept an invitation by token.
+   */
+  async acceptInvitation(token) {
+    return this.request("/invitations/accept", {
+      method: "POST",
+      body: { token }
     });
   }
-};
-var InMemoryDeviceKeyStore = class {
-  store = /* @__PURE__ */ new Map();
-  /** @inheritdoc */
-  async saveKeyPair(deviceId, keyPair) {
-    this.store.set(deviceId, keyPair);
+  /**
+   * List pending invitations for an organization.
+   */
+  async listInvitations(orgId) {
+    return this.request(`/orgs/${orgId}/invitations`, { method: "GET" });
   }
-  /** @inheritdoc */
-  async loadKeyPair(deviceId) {
-    return this.store.get(deviceId) ?? null;
+  /**
+   * Revoke a pending invitation.
+   */
+  async revokeInvitation(orgId, invitationId) {
+    await this.request(`/orgs/${orgId}/invitations/${invitationId}`, { method: "DELETE" });
   }
-  /** @inheritdoc */
-  async deleteKeyPair(deviceId) {
-    this.store.delete(deviceId);
+  /**
+   * List pending invitations for the current user's email.
+   */
+  async listMyInvitations(email) {
+    return this.request(`/invitations?email=${encodeURIComponent(email)}`, {
+      method: "GET"
+    });
   }
-  /** @inheritdoc */
-  async hasKeyPair(deviceId) {
-    return this.store.has(deviceId);
+  // --- Subscriptions ---
+  /**
+   * Subscribe to active org changes.
+   * @returns Unsubscribe function
+   */
+  onOrgChange(callback) {
+    this.listeners.add(callback);
+    return () => {
+      this.listeners.delete(callback);
+    };
   }
-};
-function createDeviceKeyStore() {
-  if (typeof globalThis.indexedDB !== "undefined") {
-    return new IndexedDBDeviceKeyStore();
+  // --- Internal ---
+  notifyListeners() {
+    for (const listener of this.listeners) {
+      try {
+        listener(this._activeOrgId);
+      } catch {
+      }
+    }
   }
-  return new InMemoryDeviceKeyStore();
-}
+  async request(path, options) {
+    const token = await this.getAccessToken();
+    if (!token) {
+      throw new OrgClientError(
+        "Not authenticated. Sign in before performing organization operations.",
+        "ORG_NOT_AUTHENTICATED"
+      );
+    }
+    const url = `${this.serverUrl}${path}`;
+    const headers = {
+      Authorization: `Bearer ${token}`
+    };
+    if (options.body) {
+      headers["Content-Type"] = "application/json";
+    }
+    let response;
+    try {
+      response = await fetch(url, {
+        method: options.method,
+        headers,
+        body: options.body ? JSON.stringify(options.body) : void 0
+      });
+    } catch (cause) {
+      throw new OrgClientError(`Network request to ${path} failed.`, "ORG_NETWORK_ERROR", {
+        path,
+        cause: cause instanceof Error ? cause.message : String(cause)
+      });
+    }
+    if (!response.ok) {
+      let errorMessage = `Server returned HTTP ${response.status}`;
+      try {
+        const body = await response.json();
+        if (typeof body.error === "string") {
+          errorMessage = body.error;
+        }
+      } catch {
+      }
+      throw new OrgClientError(errorMessage, "ORG_SERVER_ERROR", {
+        path,
+        status: response.status
+      });
+    }
+    const text = await response.text();
+    if (text.length === 0) return void 0;
+    try {
+      const body = JSON.parse(text);
+      if (body && typeof body === "object" && "data" in body) {
+        return body.data;
+      }
+      return body;
+    } catch {
+      return void 0;
+    }
+  }
+};
 
 // src/tokens/token-store.ts
 var DEFAULT_STORAGE_KEY = "kora_auth_tokens";
@@ -1210,15 +1579,15 @@ var TokenStore = class {
         return null;
       }
       const record = parsed;
-      if (typeof record["accessToken"] !== "string" || typeof record["refreshToken"] !== "string") {
+      if (typeof record.accessToken !== "string" || typeof record.refreshToken !== "string") {
         return null;
       }
       const tokens = {
-        accessToken: record["accessToken"],
-        refreshToken: record["refreshToken"]
+        accessToken: record.accessToken,
+        refreshToken: record.refreshToken
       };
-      if (typeof record["deviceCredential"] === "string") {
-        tokens.deviceCredential = record["deviceCredential"];
+      if (typeof record.deviceCredential === "string") {
+        tokens.deviceCredential = record.deviceCredential;
       }
       return tokens;
     } catch {
@@ -1258,17 +1627,17 @@ var TokenStore = class {
 };
 
 // src/tokens/encrypted-token-store.ts
-var import_core6 = require("@korajs/core");
+var import_core8 = require("@korajs/core");
 
 // src/encryption/database-encryption.ts
-var import_core5 = require("@korajs/core");
-var EncryptionError = class extends import_core5.KoraError {
+var import_core7 = require("@korajs/core");
+var EncryptionError = class extends import_core7.KoraError {
   constructor(message, context) {
     super(message, "ENCRYPTION_ERROR", context);
     this.name = "EncryptionError";
   }
 };
-var CryptoUnavailableError2 = class extends import_core5.KoraError {
+var CryptoUnavailableError2 = class extends import_core7.KoraError {
   constructor() {
     super(
       "Web Crypto API (crypto.subtle) is not available in this environment. Database encryption requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
@@ -1376,7 +1745,7 @@ async function importKey(rawKey) {
 }
 
 // src/tokens/encrypted-token-store.ts
-var EncryptedTokenStoreError = class extends import_core6.KoraError {
+var EncryptedTokenStoreError = class extends import_core8.KoraError {
   constructor(message, context) {
     super(message, "ENCRYPTED_TOKEN_STORE_ERROR", context);
     this.name = "EncryptedTokenStoreError";
@@ -1507,11 +1876,11 @@ var EncryptedTokenStore = class {
         return null;
       }
       const record = parsed;
-      if (typeof record["iv"] !== "string" || typeof record["data"] !== "string") {
+      if (typeof record.iv !== "string" || typeof record.data !== "string") {
         return null;
       }
-      const iv = fromBase64Url2(record["iv"]);
-      const ciphertext = fromBase64Url2(record["data"]);
+      const iv = fromBase64Url2(record.iv);
+      const ciphertext = fromBase64Url2(record.data);
       const plaintextBytes = await decryptData(this.key, ciphertext, iv);
       const json = new TextDecoder().decode(plaintextBytes);
       const tokenData = JSON.parse(json);
@@ -1519,15 +1888,15 @@ var EncryptedTokenStore = class {
         return null;
       }
       const tokenRecord = tokenData;
-      if (typeof tokenRecord["accessToken"] !== "string" || typeof tokenRecord["refreshToken"] !== "string") {
+      if (typeof tokenRecord.accessToken !== "string" || typeof tokenRecord.refreshToken !== "string") {
         return null;
       }
       const tokens = {
-        accessToken: tokenRecord["accessToken"],
-        refreshToken: tokenRecord["refreshToken"]
+        accessToken: tokenRecord.accessToken,
+        refreshToken: tokenRecord.refreshToken
       };
-      if (typeof tokenRecord["deviceCredential"] === "string") {
-        tokens.deviceCredential = tokenRecord["deviceCredential"];
+      if (typeof tokenRecord.deviceCredential === "string") {
+        tokens.deviceCredential = tokenRecord.deviceCredential;
       }
       return tokens;
     } catch {
@@ -1571,14 +1940,14 @@ var EncryptedTokenStore = class {
 };
 
 // src/passkey/passkey-client.ts
-var import_core7 = require("@korajs/core");
-var PasskeyError = class extends import_core7.KoraError {
+var import_core9 = require("@korajs/core");
+var PasskeyError = class extends import_core9.KoraError {
   constructor(message, context) {
     super(message, "PASSKEY_ERROR", context);
     this.name = "PasskeyError";
   }
 };
-var PasskeyUnsupportedError = class extends import_core7.KoraError {
+var PasskeyUnsupportedError = class extends import_core9.KoraError {
   constructor() {
     super(
       "WebAuthn is not supported in this browser. Passkey authentication requires a modern browser with WebAuthn support.",
@@ -1753,9 +2122,7 @@ function extractPublicKeyFromAttestationObject(attestationObject) {
   const topMap = decoded.value;
   const authData = topMap.get("authData");
   if (!(authData instanceof Uint8Array)) {
-    throw new PasskeyError(
-      "Invalid attestation object: authData is missing or not a byte string."
-    );
+    throw new PasskeyError("Invalid attestation object: authData is missing or not a byte string.");
   }
   let offset = 0;
   offset += 32;
@@ -1777,53 +2144,54 @@ function extractPublicKeyFromAttestationObject(attestationObject) {
   return authData.slice(offset, offset + coseKeyLength);
 }
 function decodeCbor(data, offset) {
-  if (offset >= data.length) {
+  let pos = offset;
+  if (pos >= data.length) {
     throw new PasskeyError("CBOR decode error: unexpected end of data.");
   }
-  const initialByte = data[offset];
+  const initialByte = data[pos];
   const majorType = initialByte >> 5;
   const additionalInfo = initialByte & 31;
-  offset += 1;
+  pos += 1;
   let argument;
   if (additionalInfo < 24) {
     argument = additionalInfo;
   } else if (additionalInfo === 24) {
-    argument = data[offset];
-    offset += 1;
+    argument = data[pos];
+    pos += 1;
   } else if (additionalInfo === 25) {
-    argument = data[offset] << 8 | data[offset + 1];
-    offset += 2;
+    argument = data[pos] << 8 | data[pos + 1];
+    pos += 2;
   } else if (additionalInfo === 26) {
-    argument = data[offset] << 24 | data[offset + 1] << 16 | data[offset + 2] << 8 | data[offset + 3];
+    argument = data[pos] << 24 | data[pos + 1] << 16 | data[pos + 2] << 8 | data[pos + 3];
     argument = argument >>> 0;
-    offset += 4;
+    pos += 4;
   } else {
     throw new PasskeyError(
-      `CBOR decode error: unsupported additional info ${additionalInfo} at byte ${offset - 1}. This CBOR decoder only supports definite-length encodings.`
+      `CBOR decode error: unsupported additional info ${additionalInfo} at byte ${pos - 1}. This CBOR decoder only supports definite-length encodings.`
     );
   }
   switch (majorType) {
     // Major type 0: Unsigned integer
     case 0:
-      return { value: argument, offset };
+      return { value: argument, offset: pos };
     // Major type 1: Negative integer (-1 - argument)
     case 1:
-      return { value: -1 - argument, offset };
+      return { value: -1 - argument, offset: pos };
     // Major type 2: Byte string
     case 2: {
-      const bytes = data.slice(offset, offset + argument);
-      return { value: bytes, offset: offset + argument };
+      const bytes = data.slice(pos, pos + argument);
+      return { value: bytes, offset: pos + argument };
     }
     // Major type 3: Text string (UTF-8)
     case 3: {
-      const textBytes = data.slice(offset, offset + argument);
+      const textBytes = data.slice(pos, pos + argument);
       const text = new TextDecoder().decode(textBytes);
-      return { value: text, offset: offset + argument };
+      return { value: text, offset: pos + argument };
     }
     // Major type 4: Array
     case 4: {
       const arr = [];
-      let currentOffset = offset;
+      let currentOffset = pos;
       for (let i = 0; i < argument; i++) {
         const item = decodeCbor(data, currentOffset);
         arr.push(item.value);
@@ -1834,7 +2202,7 @@ function decodeCbor(data, offset) {
     // Major type 5: Map
     case 5: {
       const map = /* @__PURE__ */ new Map();
-      let currentOffset = offset;
+      let currentOffset = pos;
       for (let i = 0; i < argument; i++) {
         const keyResult = decodeCbor(data, currentOffset);
         const valResult = decodeCbor(data, keyResult.offset);
@@ -1845,14 +2213,14 @@ function decodeCbor(data, offset) {
     }
     default:
       throw new PasskeyError(
-        `CBOR decode error: unsupported major type ${majorType} at byte ${offset - 1}. This CBOR decoder only supports types 0-5 (integers, byte/text strings, arrays, maps).`
+        `CBOR decode error: unsupported major type ${majorType} at byte ${pos - 1}. This CBOR decoder only supports types 0-5 (integers, byte/text strings, arrays, maps).`
       );
   }
 }
 
 // src/encryption/key-derivation.ts
-var import_core8 = require("@korajs/core");
-var KeyDerivationError = class extends import_core8.KoraError {
+var import_core10 = require("@korajs/core");
+var KeyDerivationError = class extends import_core10.KoraError {
   constructor(message, context) {
     super(message, "KEY_DERIVATION_ERROR", context);
     this.name = "KeyDerivationError";
@@ -2032,10 +2400,10 @@ var AutoLockManager = class {
 };
 
 // src/encryption/operation-encryptor.ts
-var import_core9 = require("@korajs/core");
+var import_core11 = require("@korajs/core");
 var ENCRYPTED_MARKER = "__kora_encrypted";
 var ENCRYPTION_VERSION = 1;
-var OperationEncryptionError = class extends import_core9.KoraError {
+var OperationEncryptionError = class extends import_core11.KoraError {
   constructor(message, context) {
     super(message, "OPERATION_ENCRYPTION_ERROR", context);
     this.name = "OperationEncryptionError";
@@ -2170,14 +2538,11 @@ var OperationEncryptor = class {
       if (cause instanceof OperationEncryptionError) {
         throw cause;
       }
-      throw new OperationEncryptionError(
-        `Failed to encrypt operation ${fieldName} field.`,
-        {
-          operationId,
-          fieldName,
-          cause: cause instanceof Error ? cause.message : String(cause)
-        }
-      );
+      throw new OperationEncryptionError(`Failed to encrypt operation ${fieldName} field.`, {
+        operationId,
+        fieldName,
+        cause: cause instanceof Error ? cause.message : String(cause)
+      });
     }
   }
   async decryptField(field, operationId, fieldName) {
@@ -2201,10 +2566,10 @@ var OperationEncryptor = class {
       const json = new TextDecoder().decode(plaintextBytes);
       const parsed = JSON.parse(json);
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        throw new OperationEncryptionError(
-          `Decrypted ${fieldName} is not a valid record object.`,
-          { operationId, fieldName }
-        );
+        throw new OperationEncryptionError(`Decrypted ${fieldName} is not a valid record object.`, {
+          operationId,
+          fieldName
+        });
       }
       return parsed;
     } catch (cause) {
@@ -2229,11 +2594,12 @@ function isEncryptedEnvelope(field) {
   if (field === null || typeof field !== "object") {
     return false;
   }
-  return field[ENCRYPTED_MARKER] === true && typeof field["ciphertext"] === "string" && typeof field["iv"] === "string" && field["algorithm"] === "AES-256-GCM";
+  return field[ENCRYPTED_MARKER] === true && typeof field.ciphertext === "string" && typeof field.iv === "string" && field.algorithm === "AES-256-GCM";
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthClient,
+  AuthDeviceIdentityError,
   AuthError,
   AutoLockManager,
   CryptoUnavailableError,
@@ -2254,8 +2620,14 @@ function isEncryptedEnvelope(field) {
   TokenStore,
   authenticateWithPasskey,
   computePublicKeyThumbprint,
+  createAuthTokenStorage,
   createDeviceKeyStore,
+  createKoraAuth,
+  createKoraAuthSync,
+  createMemoryAuthTokenStorage,
   createPasskeyCredential,
+  createPersistentDeviceIdentity,
+  createWebStorageAuthTokenStorage,
   decryptData,
   deriveEncryptionKey,
   encryptData,