@korajs/auth 0.4.0 → 0.5.0

package/dist/server.js

@@ -635,7 +635,7 @@ var BuiltInAuthRoutes = class {
     const userStore = this.userStore;
     return {
       async authenticate(token) {
-        const payload = tokenManager.validateToken(token);
+        const payload = await tokenManager.validateTokenWithRevocation(token);
         if (payload === null || payload.type !== "access") {
           return null;
         }
@@ -661,6 +661,9 @@ var BuiltInAuthRoutes = class {
   }
 };
 
+// src/provider/built-in/quickstart-server.ts
+import { randomUUID as randomUUID4 } from "crypto";
+
 // src/tokens/token-manager.ts
 import { randomBytes as randomBytes2, randomUUID } from "crypto";
 
@@ -773,7 +776,7 @@ var InMemoryTokenRevocationStore = class {
   /**
    * Check if a device has been revoked.
    */
-  isDeviceRevoked(deviceId) {
+  async isDeviceRevoked(deviceId) {
     return this.revokedDevices.has(deviceId);
   }
   /**
@@ -966,7 +969,7 @@ var TokenManager = class {
    * Validate a token and check it against the revocation store.
    *
    * Like {@link validateToken}, but also checks whether the token's `jti` has been
-   * revoked. Requires a revocation store to be configured.
+   * revoked or belongs to a revoked device. Requires a revocation store to be configured.
    *
    * @param token - The JWT string to validate
    * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
@@ -981,6 +984,10 @@ var TokenManager = class {
       if (revoked) {
         return null;
       }
+      const deviceRevoked = await this.revocationStore.isDeviceRevoked(payload.dev);
+      if (deviceRevoked) {
+        return null;
+      }
     }
     return payload;
   }
@@ -1047,217 +1054,1000 @@ var TokenManager = class {
   }
 };
 
-// src/provider/built-in/password-reset.ts
+// src/provider/oauth/linked-identity-store.ts
+import { randomUUID as randomUUID2 } from "crypto";
 import { KoraError as KoraError2 } from "@korajs/core";
-var PasswordResetError = class extends KoraError2 {
+var DuplicateLinkedIdentityError = class extends KoraError2 {
+  constructor(provider) {
+    super(`This ${provider} account is already linked.`, "DUPLICATE_LINKED_IDENTITY", {
+      provider
+    });
+    this.name = "DuplicateLinkedIdentityError";
+  }
+};
+var InMemoryLinkedIdentityStore = class {
+  identitiesById = /* @__PURE__ */ new Map();
+  identityIdByProvider = /* @__PURE__ */ new Map();
+  identityIdsByUser = /* @__PURE__ */ new Map();
+  identityIdByUserProvider = /* @__PURE__ */ new Map();
+  async findByProvider(provider, providerUserId) {
+    const id = this.identityIdByProvider.get(providerIdentityKey(provider, providerUserId));
+    return id ? this.identitiesById.get(id) ?? null : null;
+  }
+  async findByUser(userId) {
+    const ids = this.identityIdsByUser.get(userId);
+    if (!ids) return [];
+    return [...ids].map((id) => this.identitiesById.get(id)).filter((identity) => identity !== void 0);
+  }
+  async create(params) {
+    const providerKey = providerIdentityKey(params.provider, params.providerUserId);
+    const userProviderKeyValue = userProviderKey(params.userId, params.provider);
+    if (this.identityIdByProvider.has(providerKey) || this.identityIdByUserProvider.has(userProviderKeyValue)) {
+      throw new DuplicateLinkedIdentityError(params.provider);
+    }
+    const identity = {
+      id: randomUUID2(),
+      userId: params.userId,
+      provider: params.provider,
+      providerUserId: params.providerUserId,
+      email: params.email,
+      linkedAt: Date.now()
+    };
+    this.identitiesById.set(identity.id, identity);
+    this.identityIdByProvider.set(providerKey, identity.id);
+    this.identityIdByUserProvider.set(userProviderKeyValue, identity.id);
+    const userIdentities = this.identityIdsByUser.get(params.userId) ?? /* @__PURE__ */ new Set();
+    userIdentities.add(identity.id);
+    this.identityIdsByUser.set(params.userId, userIdentities);
+    return identity;
+  }
+  async delete(userId, provider) {
+    const userProviderKeyValue = userProviderKey(userId, provider);
+    const id = this.identityIdByUserProvider.get(userProviderKeyValue);
+    if (!id) return;
+    const identity = this.identitiesById.get(id);
+    this.identitiesById.delete(id);
+    this.identityIdByUserProvider.delete(userProviderKeyValue);
+    if (identity) {
+      this.identityIdByProvider.delete(
+        providerIdentityKey(identity.provider, identity.providerUserId)
+      );
+    }
+    const userIdentities = this.identityIdsByUser.get(userId);
+    userIdentities?.delete(id);
+    if (userIdentities?.size === 0) {
+      this.identityIdsByUser.delete(userId);
+    }
+  }
+};
+function providerIdentityKey(provider, providerUserId) {
+  return `${provider}:${providerUserId}`;
+}
+function userProviderKey(userId, provider) {
+  return `${userId}:${provider}`;
+}
+
+// src/provider/oauth/oauth-types.ts
+import { KoraError as KoraError3 } from "@korajs/core";
+var OAuthError = class extends KoraError3 {
   constructor(message, code, context) {
     super(message, code, context);
-    this.name = "PasswordResetError";
+    this.name = "OAuthError";
   }
 };
-var ResetTokenExpiredError = class extends PasswordResetError {
+var OAuthStateMismatchError = class extends OAuthError {
   constructor() {
-    super("Password reset token has expired.", "RESET_TOKEN_EXPIRED");
+    super("OAuth state parameter does not match. Possible CSRF attack.", "OAUTH_STATE_MISMATCH");
   }
 };
-var ResetTokenNotFoundError = class extends PasswordResetError {
-  constructor() {
-    super("Password reset token not found or already used.", "RESET_TOKEN_NOT_FOUND");
+var OAuthCodeExchangeError = class extends OAuthError {
+  constructor(details) {
+    super(
+      `Failed to exchange authorization code for tokens.${details ? ` ${details}` : ""}`,
+      "OAUTH_CODE_EXCHANGE_FAILED",
+      details ? { details } : void 0
+    );
   }
 };
-var ResetRateLimitedError = class extends PasswordResetError {
-  constructor() {
-    super("Too many password reset requests. Please try again later.", "RESET_RATE_LIMITED");
+var OAuthUserInfoError = class extends OAuthError {
+  constructor(details) {
+    super(
+      `Failed to fetch user info from OAuth provider.${details ? ` ${details}` : ""}`,
+      "OAUTH_USER_INFO_FAILED",
+      details ? { details } : void 0
+    );
   }
 };
-var InMemoryPasswordResetStore = class {
-  tokens = /* @__PURE__ */ new Map();
-  async store(token) {
-    this.tokens.set(token.token, token);
-  }
-  async get(token) {
-    return this.tokens.get(token) ?? null;
+var OAuthProviderNotFoundError = class extends OAuthError {
+  constructor(provider) {
+    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", {
+      provider
+    });
   }
-  async consume(token) {
-    const entry = this.tokens.get(token);
-    if (entry) {
-      this.tokens.set(token, { ...entry, consumed: true });
-    }
+};
+
+// src/provider/oauth/oauth-flow.ts
+var DEFAULT_STATE_TTL_MS = 10 * 60 * 1e3;
+var PKCE_VERIFIER_BYTES = 32;
+var InMemoryOAuthStateStore = class {
+  states = /* @__PURE__ */ new Map();
+  async store(state) {
+    this.states.set(state.state, state);
   }
-  async countActiveForEmail(email) {
-    const now = Date.now();
-    let count = 0;
-    for (const token of this.tokens.values()) {
-      if (token.email === email && !token.consumed && now < token.expiresAt) {
-        count++;
-      }
-    }
-    return count;
+  async consume(stateValue) {
+    const state = this.states.get(stateValue);
+    if (!state) return null;
+    this.states.delete(stateValue);
+    if (Date.now() > state.expiresAt) return null;
+    return state;
   }
   async cleanExpired() {
     const now = Date.now();
     let count = 0;
-    for (const [key, token] of this.tokens) {
-      if (now > token.expiresAt) {
-        this.tokens.delete(key);
+    for (const [key, state] of this.states) {
+      if (now > state.expiresAt) {
+        this.states.delete(key);
         count++;
       }
     }
     return count;
   }
 };
-var DEFAULT_TOKEN_TTL_MS = 60 * 60 * 1e3;
-var DEFAULT_MAX_REQUESTS = 3;
-var MIN_PASSWORD_LENGTH2 = 8;
-var MAX_PASSWORD_LENGTH2 = 128;
-var PasswordResetManager = class {
-  userStore;
-  resetStore;
-  tokenTtlMs;
-  maxRequestsPerEmail;
-  onResetRequested;
+var OAuthManager = class {
+  providers = /* @__PURE__ */ new Map();
+  stateStore;
+  stateTtlMs;
+  fetchFn;
   constructor(config) {
-    this.userStore = config.userStore;
-    this.resetStore = config.resetStore ?? new InMemoryPasswordResetStore();
-    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
-    this.maxRequestsPerEmail = config.maxRequestsPerEmail ?? DEFAULT_MAX_REQUESTS;
-    this.onResetRequested = config.onResetRequested;
+    for (const provider of config.providers) {
+      this.providers.set(provider.providerId, provider);
+    }
+    this.stateStore = config.stateStore ?? new InMemoryOAuthStateStore();
+    this.stateTtlMs = config.stateTtlMs ?? DEFAULT_STATE_TTL_MS;
+    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
   }
   /**
-   * Request a password reset for an email.
-   * Always returns success to prevent email enumeration.
-   *
-   * If a callback is configured, invokes it with the token.
-   * In development mode (no callback), returns the token in the response.
+   * Generate an authorization URL for the user to visit.
+   * Returns the URL and the state parameter for CSRF validation.
    */
-  async requestReset(email) {
-    const normalizedEmail = email.toLowerCase().trim();
-    const successResponse = {
-      status: 200,
-      body: {
-        data: {
-          message: "If an account with that email exists, a password reset link has been sent."
-        }
-      }
-    };
-    const user = await this.userStore.findByEmail(normalizedEmail);
-    if (!user) {
-      return successResponse;
-    }
-    const activeCount = await this.resetStore.countActiveForEmail(normalizedEmail);
-    if (activeCount >= this.maxRequestsPerEmail) {
-      return successResponse;
-    }
-    const token = generateSecureToken();
+  async getAuthorizationUrl(providerId, metadata) {
+    const provider = this.getProvider(providerId);
+    const state = generateState();
+    const codeVerifier = provider.pkce ? generateCodeVerifier() : void 0;
+    const codeChallenge = codeVerifier ? await createCodeChallenge(codeVerifier) : void 0;
     const now = Date.now();
-    const resetToken = {
-      token,
-      userId: user.id,
-      email: normalizedEmail,
+    const oauthState = {
+      state,
+      provider: providerId,
+      redirectUri: provider.redirectUri,
       createdAt: now,
-      expiresAt: now + this.tokenTtlMs,
-      consumed: false
+      expiresAt: now + this.stateTtlMs,
+      metadata,
+      codeVerifier
     };
-    await this.resetStore.store(resetToken);
-    if (this.onResetRequested) {
-      try {
-        await this.onResetRequested(normalizedEmail, token, resetToken.expiresAt);
-      } catch {
-      }
-    }
-    if (!this.onResetRequested) {
-      successResponse.body = { data: { message: "Password reset token generated.", token } };
+    await this.stateStore.store(oauthState);
+    const params = new URLSearchParams({
+      client_id: provider.clientId,
+      redirect_uri: provider.redirectUri,
+      response_type: "code",
+      scope: provider.scopes.join(" "),
+      state
+    });
+    if (codeChallenge) {
+      params.set("code_challenge", codeChallenge);
+      params.set("code_challenge_method", "S256");
     }
-    return successResponse;
+    const url = `${provider.authorizationUrl}?${params.toString()}`;
+    return { url, state };
   }
   /**
-   * Consume a reset token and set a new password.
+   * Handle the OAuth callback after the user authorizes.
+   * Validates the state parameter, exchanges the code for tokens,
+   * and fetches user info.
+   *
+   * @param providerId - The OAuth provider
+   * @param code - The authorization code from the callback
+   * @param state - The state parameter from the callback
+   * @returns Tokens and user info from the provider
    */
-  async resetPassword(token, newPassword) {
-    if (typeof newPassword !== "string" || newPassword.length < MIN_PASSWORD_LENGTH2) {
-      return {
-        status: 400,
-        body: { error: `Password must be at least ${MIN_PASSWORD_LENGTH2} characters.` }
-      };
-    }
-    if (newPassword.length > MAX_PASSWORD_LENGTH2) {
-      return {
-        status: 400,
-        body: { error: `Password must be at most ${MAX_PASSWORD_LENGTH2} characters.` }
-      };
-    }
-    const resetToken = await this.resetStore.get(token);
-    if (!resetToken || resetToken.consumed) {
-      return { status: 404, body: { error: "Password reset token not found or already used." } };
+  async handleCallback(providerId, code, state) {
+    const provider = this.getProvider(providerId);
+    const oauthState = await this.stateStore.consume(state);
+    if (!oauthState || oauthState.provider !== providerId) {
+      throw new OAuthStateMismatchError();
     }
-    if (Date.now() > resetToken.expiresAt) {
-      await this.resetStore.consume(token);
-      return { status: 410, body: { error: "Password reset token has expired." } };
+    const tokens = await this.exchangeCodeForTokens(provider, code, oauthState);
+    const userInfo = await this.fetchUserInfo(provider, tokens.accessToken);
+    return { tokens, userInfo, stateMetadata: oauthState.metadata };
+  }
+  /**
+   * Get a registered provider by ID.
+   */
+  getProvider(providerId) {
+    const provider = this.providers.get(providerId);
+    if (!provider) {
+      throw new OAuthProviderNotFoundError(providerId);
     }
-    await this.resetStore.consume(token);
-    const hashed = await hashPassword(newPassword);
-    await this.userStore.updatePassword(resetToken.userId, hashed.hash, hashed.salt);
-    return { status: 200, body: { data: { message: "Password has been reset successfully." } } };
+    return provider;
   }
   /**
-   * Change password for an authenticated user (requires current password verification).
+   * List all registered provider IDs.
    */
-  async changePassword(userId, currentPassword, newPassword) {
-    if (typeof newPassword !== "string" || newPassword.length < MIN_PASSWORD_LENGTH2) {
-      return {
-        status: 400,
-        body: { error: `New password must be at least ${MIN_PASSWORD_LENGTH2} characters.` }
-      };
+  getProviderIds() {
+    return [...this.providers.keys()];
+  }
+  // --- Private ---
+  async exchangeCodeForTokens(provider, code, oauthState) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: provider.redirectUri,
+      client_id: provider.clientId
+    });
+    if (provider.clientSecret) {
+      body.set("client_secret", provider.clientSecret);
     }
-    if (newPassword.length > MAX_PASSWORD_LENGTH2) {
-      return {
-        status: 400,
-        body: { error: `New password must be at most ${MAX_PASSWORD_LENGTH2} characters.` }
-      };
+    if (oauthState.codeVerifier) {
+      body.set("code_verifier", oauthState.codeVerifier);
     }
-    const user = await this.userStore.findById(userId);
-    if (!user) {
-      return { status: 404, body: { error: "User not found." } };
+    let response;
+    try {
+      response = await this.fetchFn(provider.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: body.toString()
+      });
+    } catch (err) {
+      throw new OAuthCodeExchangeError(err instanceof Error ? err.message : "Network error");
     }
-    const { verifyPassword: verifyPassword2 } = await import("./password-hash-QRBG6BNJ.js");
-    const isValid = await verifyPassword2(currentPassword, user.passwordHash, user.salt);
-    if (!isValid) {
-      return { status: 401, body: { error: "Current password is incorrect." } };
+    if (!response.ok) {
+      let details = `HTTP ${response.status}`;
+      try {
+        const errorBody = await response.text();
+        details += `: ${errorBody}`;
+      } catch {
+      }
+      throw new OAuthCodeExchangeError(details);
+    }
+    const data = await response.json();
+    return {
+      accessToken: data.access_token,
+      tokenType: data.token_type ?? "Bearer",
+      expiresIn: data.expires_in,
+      refreshToken: data.refresh_token,
+      idToken: data.id_token,
+      scope: data.scope
+    };
+  }
+  async fetchUserInfo(provider, accessToken) {
+    let response;
+    try {
+      response = await this.fetchFn(provider.userInfoUrl, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: "application/json"
+        }
+      });
+    } catch (err) {
+      throw new OAuthUserInfoError(err instanceof Error ? err.message : "Network error");
+    }
+    if (!response.ok) {
+      throw new OAuthUserInfoError(`HTTP ${response.status}`);
+    }
+    const profile = await response.json();
+    return normalizeUserInfo(provider.providerId, profile);
+  }
+};
+function normalizeUserInfo(providerId, profile) {
+  switch (providerId) {
+    case "google":
+      return {
+        providerId: profile.sub,
+        provider: "google",
+        email: profile.email ?? null,
+        emailVerified: profile.email_verified ?? false,
+        name: profile.name ?? null,
+        avatarUrl: profile.picture ?? null,
+        rawProfile: profile
+      };
+    case "github":
+      return {
+        providerId: String(profile.id),
+        provider: "github",
+        email: profile.email ?? null,
+        emailVerified: false,
+        // GitHub doesn't confirm in the profile response
+        name: profile.name ?? profile.login ?? null,
+        avatarUrl: profile.avatar_url ?? null,
+        rawProfile: profile
+      };
+    case "microsoft":
+      return {
+        providerId: profile.id,
+        provider: "microsoft",
+        email: profile.mail ?? profile.userPrincipalName ?? null,
+        emailVerified: false,
+        name: profile.displayName ?? null,
+        avatarUrl: null,
+        rawProfile: profile
+      };
+    default:
+      return {
+        providerId: String(profile.id ?? profile.sub ?? ""),
+        provider: providerId,
+        email: profile.email ?? null,
+        emailVerified: profile.email_verified ?? false,
+        name: profile.name ?? null,
+        avatarUrl: profile.picture ?? profile.avatar_url ?? null,
+        rawProfile: profile
+      };
+  }
+}
+function googleProvider(config) {
+  return {
+    providerId: "google",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
+    scopes: config.scopes ?? ["openid", "email", "profile"],
+    redirectUri: config.redirectUri,
+    pkce: config.pkce
+  };
+}
+function githubProvider(config) {
+  return {
+    providerId: "github",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    userInfoUrl: "https://api.github.com/user",
+    scopes: config.scopes ?? ["read:user", "user:email"],
+    redirectUri: config.redirectUri,
+    pkce: config.pkce
+  };
+}
+function microsoftProvider(config) {
+  const tenant = config.tenantId ?? "common";
+  return {
+    providerId: "microsoft",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    authorizationUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
+    tokenUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+    userInfoUrl: "https://graph.microsoft.com/v1.0/me",
+    scopes: config.scopes ?? ["openid", "email", "profile", "User.Read"],
+    redirectUri: config.redirectUri,
+    pkce: config.pkce
+  };
+}
+function generateState() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  return toBase64Url2(bytes);
+}
+function generateCodeVerifier() {
+  const bytes = new Uint8Array(PKCE_VERIFIER_BYTES);
+  globalThis.crypto.getRandomValues(bytes);
+  return toBase64Url2(bytes);
+}
+async function createCodeChallenge(codeVerifier) {
+  const data = new TextEncoder().encode(codeVerifier);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+  return toBase64Url2(new Uint8Array(digest));
+}
+function toBase64Url2(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/provider/built-in/user-store.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { KoraError as KoraError4 } from "@korajs/core";
+var DuplicateEmailError = class extends KoraError4 {
+  constructor() {
+    super("A user with this email already exists.", "DUPLICATE_EMAIL");
+    this.name = "DuplicateEmailError";
+  }
+};
+var InMemoryUserStore = class {
+  /** Users indexed by ID */
+  usersById = /* @__PURE__ */ new Map();
+  /** Users indexed by email (lowercase) for fast lookup */
+  usersByEmail = /* @__PURE__ */ new Map();
+  /** Devices indexed by device ID */
+  devicesById = /* @__PURE__ */ new Map();
+  /** Device IDs indexed by user ID for fast listing */
+  devicesByUserId = /* @__PURE__ */ new Map();
+  /**
+   * Create a new user account.
+   *
+   * @param params - User creation parameters
+   * @param params.email - The user's email address (must be unique, case-insensitive)
+   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
+   * @param params.salt - Hex-encoded salt used during hashing
+   * @param params.name - The user's display name
+   * @returns The created user (without sensitive credential fields)
+   * @throws {DuplicateEmailError} If a user with the same email already exists
+   */
+  async createUser(params) {
+    const normalizedEmail = params.email.toLowerCase();
+    if (this.usersByEmail.has(normalizedEmail)) {
+      throw new DuplicateEmailError();
+    }
+    const now = Date.now();
+    const id = randomUUID3();
+    const storedUser = {
+      id,
+      email: normalizedEmail,
+      name: params.name,
+      emailVerified: false,
+      createdAt: now,
+      passwordHash: params.passwordHash,
+      salt: params.salt
+    };
+    this.usersById.set(id, storedUser);
+    this.usersByEmail.set(normalizedEmail, storedUser);
+    return toAuthUser(storedUser);
+  }
+  /**
+   * Find a user by email address.
+   *
+   * @param email - The email to search for (case-insensitive)
+   * @returns The stored user record including credentials, or null if not found
+   */
+  async findByEmail(email) {
+    return this.usersByEmail.get(email.toLowerCase()) ?? null;
+  }
+  /**
+   * Find a user by ID.
+   *
+   * @param id - The user ID to search for
+   * @returns The stored user record including credentials, or null if not found
+   */
+  async findById(id) {
+    return this.usersById.get(id) ?? null;
+  }
+  /**
+   * Register a device for a user.
+   *
+   * If a device with the same ID already exists and is not revoked, it is
+   * returned as-is (idempotent registration). If it was previously revoked,
+   * it is re-activated with updated details.
+   *
+   * @param params - Device registration parameters
+   * @param params.id - Unique device identifier
+   * @param params.userId - ID of the user who owns the device
+   * @param params.publicKey - Base64url-encoded device public key or thumbprint
+   * @param params.name - Human-readable device name
+   * @returns The registered device record
+   */
+  async registerDevice(params) {
+    const existing = this.devicesById.get(params.id);
+    if (existing !== void 0 && !existing.revoked) {
+      return existing;
+    }
+    const now = Date.now();
+    const device = {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: now,
+      lastSeenAt: now
+    };
+    this.devicesById.set(params.id, device);
+    let userDevices = this.devicesByUserId.get(params.userId);
+    if (userDevices === void 0) {
+      userDevices = /* @__PURE__ */ new Set();
+      this.devicesByUserId.set(params.userId, userDevices);
+    }
+    userDevices.add(params.id);
+    return device;
+  }
+  /**
+   * Find a device by its ID.
+   *
+   * @param deviceId - The device ID to search for
+   * @returns The device record, or null if not found
+   */
+  async findDevice(deviceId) {
+    return this.devicesById.get(deviceId) ?? null;
+  }
+  /**
+   * List all devices registered for a user.
+   *
+   * @param userId - The user ID whose devices to list
+   * @returns Array of device records (includes revoked devices)
+   */
+  async listDevices(userId) {
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds === void 0) {
+      return [];
+    }
+    const devices = [];
+    for (const deviceId of deviceIds) {
+      const device = this.devicesById.get(deviceId);
+      if (device !== void 0) {
+        devices.push(device);
+      }
+    }
+    return devices;
+  }
+  /**
+   * Revoke a device, preventing it from being used for authentication.
+   *
+   * This is a soft revoke — the device record remains but is marked as revoked.
+   * If the device does not exist, this is a no-op.
+   *
+   * @param deviceId - The ID of the device to revoke
+   */
+  async revokeDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.revoked = true;
+    }
+  }
+  /**
+   * Set a user's email verification status.
+   *
+   * @param userId - The user whose email to verify
+   * @param verified - Whether the email is verified
+   */
+  async setEmailVerified(userId, verified) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, emailVerified: verified };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
+  }
+  /**
+   * Update a user's password hash and salt.
+   *
+   * @param userId - The user whose password to update
+   * @param passwordHash - New hex-encoded PBKDF2 derived key
+   * @param salt - New hex-encoded salt
+   */
+  async updatePassword(userId, passwordHash, salt) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    const updated = { ...user, passwordHash, salt };
+    this.usersById.set(userId, updated);
+    this.usersByEmail.set(user.email, updated);
+  }
+  /**
+   * List all users. For admin/development use.
+   */
+  async listAll() {
+    return [...this.usersById.values()];
+  }
+  /**
+   * Update a stored user record.
+   */
+  async update(user) {
+    const existing = this.usersById.get(user.id);
+    if (!existing) return;
+    if (existing.email !== user.email) {
+      this.usersByEmail.delete(existing.email);
+      this.usersByEmail.set(user.email, user);
+    } else {
+      this.usersByEmail.set(user.email, user);
+    }
+    this.usersById.set(user.id, user);
+  }
+  /**
+   * Delete a user and all associated devices.
+   */
+  async delete(userId) {
+    const user = this.usersById.get(userId);
+    if (!user) return;
+    this.usersById.delete(userId);
+    this.usersByEmail.delete(user.email);
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds) {
+      for (const deviceId of deviceIds) {
+        this.devicesById.delete(deviceId);
+      }
+      this.devicesByUserId.delete(userId);
+    }
+  }
+  /**
+   * Update the last-seen timestamp for a device.
+   *
+   * Called when a device authenticates or syncs to track activity.
+   * If the device does not exist, this is a no-op.
+   *
+   * @param deviceId - The ID of the device to update
+   */
+  async touchDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.lastSeenAt = Date.now();
     }
-    const hashed = await hashPassword(newPassword);
-    await this.userStore.updatePassword(userId, hashed.hash, hashed.salt);
-    return { status: 200, body: { data: { message: "Password changed successfully." } } };
   }
 };
-function generateSecureToken() {
-  const bytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(bytes);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
+function toAuthUser(stored) {
+  return {
+    id: stored.id,
+    email: stored.email,
+    name: stored.name,
+    emailVerified: stored.emailVerified,
+    createdAt: stored.createdAt
+  };
+}
+
+// src/provider/built-in/quickstart-server.ts
+function createKoraAuthServer(options = {}) {
+  const userStore = options.userStore ?? new InMemoryUserStore();
+  const tokenManager = options.tokenManager ?? createDefaultTokenManager(options);
+  const routes = new BuiltInAuthRoutes({
+    userStore,
+    tokenManager,
+    challengeStore: options.challengeStore,
+    rateLimiter: options.rateLimiter
+  });
+  const oauth = options.oauth ? createOAuthRuntime(options.oauth) : void 0;
+  const path = normalizePath(options.path ?? "/auth");
+  return {
+    routes,
+    userStore,
+    tokenManager,
+    oauth: oauth?.manager,
+    linkedIdentityStore: oauth?.linkedIdentityStore,
+    auth: routes.toSyncAuthProvider(),
+    handleRequest(request) {
+      return handleAuthRequest(routes, path, request, oauth, userStore, tokenManager);
+    }
+  };
+}
+function createDefaultTokenManager(options) {
+  const secret = options.jwtSecret ?? readEnvSecret();
+  if (!secret && isProduction()) {
+    throw new Error(
+      "createKoraAuthServer requires jwtSecret in production. Set KORA_AUTH_SECRET or pass jwtSecret."
+    );
   }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return new TokenManager({
+    secret: secret ?? TokenManager.generateSecret(),
+    revocationStore: new InMemoryTokenRevocationStore(),
+    ...options.tokenManagerOptions
+  });
+}
+function createOAuthRuntime(config) {
+  return {
+    manager: new OAuthManager(config),
+    linkedIdentityStore: config.linkedIdentityStore ?? new InMemoryLinkedIdentityStore(),
+    createNewUsers: config.createNewUsers ?? true,
+    autoLinkVerifiedEmail: config.autoLinkVerifiedEmail ?? false,
+    allowUnlinkLastIdentity: config.allowUnlinkLastIdentity ?? false
+  };
+}
+async function handleAuthRequest(routes, pathPrefix, request, oauth, userStore, tokenManager) {
+  const path = normalizePath(request.path);
+  const relativePath = path === pathPrefix ? "/" : path.slice(pathPrefix.length);
+  const method = request.method.toUpperCase();
+  const body = isRecord(request.body) ? request.body : {};
+  const token = extractBearerToken(request.headers);
+  if (path !== pathPrefix && !path.startsWith(`${pathPrefix}/`)) {
+    return notFound();
+  }
+  if (relativePath.startsWith("/oauth/")) {
+    return handleOAuthRequest({
+      oauth,
+      userStore,
+      tokenManager,
+      relativePath,
+      method,
+      body,
+      query: request.query,
+      token
+    });
+  }
+  if (method === "POST" && relativePath === "/signup") {
+    return routes.handleSignUp(body, request.ip);
+  }
+  if (method === "POST" && relativePath === "/signin") {
+    return routes.handleSignIn(body, request.ip);
+  }
+  if (method === "POST" && relativePath === "/refresh") {
+    return routes.handleRefresh(body);
+  }
+  if (method === "POST" && relativePath === "/signout") {
+    return routes.handleSignOut(token, body);
+  }
+  if (method === "GET" && relativePath === "/me") {
+    return routes.handleGetMe(token);
+  }
+  if (method === "GET" && relativePath === "/devices") {
+    return routes.handleListDevices(token);
+  }
+  if (method === "POST" && relativePath === "/device/register") {
+    return routes.handleDeviceRegister(token, body);
+  }
+  if (method === "POST" && relativePath === "/device/challenge") {
+    const deviceId = typeof body.deviceId === "string" ? body.deviceId : "";
+    return routes.handleDeviceChallenge(token, deviceId);
+  }
+  if (method === "POST" && relativePath === "/device/verify") {
+    return routes.handleDeviceVerify(body);
+  }
+  if (method === "DELETE" && relativePath.startsWith("/device/")) {
+    return routes.handleRevokeDevice(token, relativePath.slice("/device/".length));
+  }
+  return notFound();
+}
+async function handleOAuthRequest(params) {
+  const { oauth, userStore, tokenManager, relativePath, method, body, query, token } = params;
+  if (!oauth) {
+    return notFound();
+  }
+  try {
+    if (method === "GET" && relativePath === "/oauth/links") {
+      const authUser = await requireAuthUser(tokenManager, userStore, token);
+      if ("status" in authUser) return authUser;
+      const identities = await oauth.linkedIdentityStore.findByUser(authUser.id);
+      return { status: 200, body: { data: identities } };
+    }
+    const match = /^\/oauth\/([^/]+)(?:\/(callback|link))?$/.exec(relativePath);
+    if (!match) {
+      return notFound();
+    }
+    const provider = decodeURIComponent(match[1]);
+    const action = match[2];
+    if (method === "GET" && !action) {
+      const { url, state } = await oauth.manager.getAuthorizationUrl(
+        provider,
+        metadataFromQuery(query)
+      );
+      return { status: 200, body: { data: { url, state } } };
+    }
+    if ((method === "GET" || method === "POST") && action === "callback") {
+      const code = readString(method === "GET" ? queryValue(query, "code") : body.code);
+      const state = readString(method === "GET" ? queryValue(query, "state") : body.state);
+      if (!code || !state) {
+        return { status: 400, body: { error: "OAuth callback requires code and state." } };
+      }
+      return completeOAuthSignIn({
+        oauth,
+        userStore,
+        tokenManager,
+        provider,
+        code,
+        state,
+        deviceId: readString(body.deviceId),
+        devicePublicKey: readString(body.devicePublicKey)
+      });
+    }
+    if (method === "POST" && action === "link") {
+      const authUser = await requireAuthUser(tokenManager, userStore, token);
+      if ("status" in authUser) return authUser;
+      const code = readString(body.code);
+      const state = readString(body.state);
+      if (!code || !state) {
+        return { status: 400, body: { error: "OAuth linking requires code and state." } };
+      }
+      return linkOAuthIdentity(oauth, authUser.id, provider, code, state);
+    }
+    if (method === "DELETE" && action === "link") {
+      const authUser = await requireAuthUser(tokenManager, userStore, token);
+      if ("status" in authUser) return authUser;
+      const identities = await oauth.linkedIdentityStore.findByUser(authUser.id);
+      if (!oauth.allowUnlinkLastIdentity && identities.length <= 1) {
+        return {
+          status: 409,
+          body: {
+            error: "Cannot unlink the last OAuth identity unless allowUnlinkLastIdentity is enabled."
+          }
+        };
+      }
+      await oauth.linkedIdentityStore.delete(authUser.id, provider);
+      return { status: 200, body: { data: { ok: true } } };
+    }
+  } catch (error) {
+    return oauthErrorResponse(error);
+  }
+  return notFound();
+}
+async function completeOAuthSignIn(params) {
+  const { oauth, userStore, tokenManager, provider, code, state, deviceId, devicePublicKey } = params;
+  const { userInfo, stateMetadata } = await oauth.manager.handleCallback(provider, code, state);
+  const linkedIdentity = await oauth.linkedIdentityStore.findByProvider(
+    userInfo.provider,
+    userInfo.providerId
+  );
+  let user;
+  let identity;
+  if (linkedIdentity) {
+    const storedUser = await userStore.findById(linkedIdentity.userId);
+    if (!storedUser) {
+      return { status: 409, body: { error: "Linked OAuth account has no matching user." } };
+    }
+    user = toAuthUser2(storedUser);
+    identity = linkedIdentity;
+  } else {
+    const resolved = await resolveOAuthUser(userStore, oauth, userInfo);
+    if ("status" in resolved) return resolved;
+    user = resolved;
+    identity = await oauth.linkedIdentityStore.create({
+      userId: user.id,
+      provider: userInfo.provider,
+      providerUserId: userInfo.providerId,
+      email: userInfo.email
+    });
+  }
+  const resolvedDeviceId = deviceId ?? readString(stateMetadata?.deviceId) ?? `device-${user.id}`;
+  await userStore.registerDevice({
+    id: resolvedDeviceId,
+    userId: user.id,
+    publicKey: devicePublicKey ?? readString(stateMetadata?.devicePublicKey) ?? "",
+    name: deviceId ? "Device" : "Browser"
+  });
+  const tokens = tokenManager.issueTokens(user.id, resolvedDeviceId);
+  return { status: 200, body: { data: { user, tokens, identity } } };
+}
+async function resolveOAuthUser(userStore, oauth, userInfo) {
+  if (!userInfo.email) {
+    return { status: 400, body: { error: "OAuth provider did not return an email address." } };
+  }
+  const existingUser = await userStore.findByEmail(userInfo.email);
+  if (existingUser) {
+    if (oauth.autoLinkVerifiedEmail && userInfo.emailVerified) {
+      return toAuthUser2(existingUser);
+    }
+    return {
+      status: 409,
+      body: { error: "OAuth account is not linked. Sign in and link this provider first." }
+    };
+  }
+  if (!oauth.createNewUsers) {
+    return { status: 403, body: { error: "OAuth sign-up is disabled for this application." } };
+  }
+  const credential = await hashPassword(randomUUID4());
+  const user = await userStore.createUser({
+    email: userInfo.email,
+    passwordHash: credential.hash,
+    salt: credential.salt,
+    name: userInfo.name ?? userInfo.email.split("@")[0] ?? userInfo.email
+  });
+  if (userInfo.emailVerified) {
+    await userStore.setEmailVerified(user.id, true);
+    return { ...user, emailVerified: true };
+  }
+  return user;
+}
+async function linkOAuthIdentity(oauth, userId, provider, code, state) {
+  const { userInfo } = await oauth.manager.handleCallback(provider, code, state);
+  const existing = await oauth.linkedIdentityStore.findByProvider(
+    userInfo.provider,
+    userInfo.providerId
+  );
+  if (existing && existing.userId !== userId) {
+    return { status: 409, body: { error: "This OAuth account is already linked to another user." } };
+  }
+  if (existing) {
+    return { status: 200, body: { data: existing } };
+  }
+  const identity = await oauth.linkedIdentityStore.create({
+    userId,
+    provider: userInfo.provider,
+    providerUserId: userInfo.providerId,
+    email: userInfo.email
+  });
+  return { status: 201, body: { data: identity } };
+}
+async function requireAuthUser(tokenManager, userStore, token) {
+  if (!token) {
+    return { status: 401, body: { error: "Authorization token required." } };
+  }
+  const payload = await tokenManager.validateToken(token);
+  if (!payload || payload.type !== "access") {
+    return { status: 401, body: { error: "Invalid or expired token." } };
+  }
+  const user = await userStore.findById(payload.sub);
+  if (!user) {
+    return { status: 401, body: { error: "User not found." } };
+  }
+  return toAuthUser2(user);
+}
+function extractBearerToken(headers) {
+  const authorization = headers?.authorization ?? headers?.Authorization;
+  const value = Array.isArray(authorization) ? authorization[0] : authorization;
+  if (!value?.startsWith("Bearer ")) {
+    return "";
+  }
+  return value.slice("Bearer ".length).trim();
+}
+function normalizePath(path) {
+  const withoutQuery = path.split("?")[0] || "/";
+  const normalized = withoutQuery.startsWith("/") ? withoutQuery : `/${withoutQuery}`;
+  return normalized.length > 1 ? normalized.replace(/\/+$/, "") : normalized;
+}
+function metadataFromQuery(query) {
+  if (!query) return void 0;
+  const metadata = {};
+  for (const [key, value] of Object.entries(query)) {
+    if (key === "code" || key === "state") continue;
+    if (value !== void 0) {
+      metadata[key] = value;
+    }
+  }
+  return Object.keys(metadata).length > 0 ? metadata : void 0;
+}
+function queryValue(query, key) {
+  return query?.[key];
+}
+function readString(value) {
+  if (typeof value === "string" && value.length > 0) return value;
+  if (Array.isArray(value) && typeof value[0] === "string" && value[0].length > 0) {
+    return value[0];
+  }
+  return void 0;
+}
+function oauthErrorResponse(error) {
+  if (error instanceof DuplicateLinkedIdentityError) {
+    return { status: 409, body: { error: error.message } };
+  }
+  if (error instanceof OAuthError) {
+    const status = error.code === "OAUTH_PROVIDER_NOT_FOUND" ? 404 : 400;
+    return { status, body: { error: error.message } };
+  }
+  throw error;
+}
+function toAuthUser2(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    emailVerified: user.emailVerified,
+    createdAt: user.createdAt
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function notFound() {
+  return { status: 404, body: { error: "Not found" } };
+}
+function readEnvSecret() {
+  return typeof process !== "undefined" ? process.env.KORA_AUTH_SECRET : void 0;
+}
+function isProduction() {
+  return typeof process !== "undefined" && process.env.NODE_ENV === "production";
 }
 
-// src/provider/built-in/email-verification.ts
-import { KoraError as KoraError3 } from "@korajs/core";
-var EmailVerificationError = class extends KoraError3 {
+// src/provider/built-in/password-reset.ts
+import { KoraError as KoraError5 } from "@korajs/core";
+var PasswordResetError = class extends KoraError5 {
   constructor(message, code, context) {
     super(message, code, context);
-    this.name = "EmailVerificationError";
+    this.name = "PasswordResetError";
   }
 };
-var VerificationTokenExpiredError = class extends EmailVerificationError {
+var ResetTokenExpiredError = class extends PasswordResetError {
   constructor() {
-    super("Email verification token has expired.", "VERIFICATION_TOKEN_EXPIRED");
+    super("Password reset token has expired.", "RESET_TOKEN_EXPIRED");
   }
 };
-var VerificationTokenNotFoundError = class extends EmailVerificationError {
+var ResetTokenNotFoundError = class extends PasswordResetError {
   constructor() {
-    super("Email verification token not found or already used.", "VERIFICATION_TOKEN_NOT_FOUND");
+    super("Password reset token not found or already used.", "RESET_TOKEN_NOT_FOUND");
   }
 };
-var InMemoryEmailVerificationStore = class {
+var ResetRateLimitedError = class extends PasswordResetError {
+  constructor() {
+    super("Too many password reset requests. Please try again later.", "RESET_RATE_LIMITED");
+  }
+};
+var InMemoryPasswordResetStore = class {
   tokens = /* @__PURE__ */ new Map();
   async store(token) {
     this.tokens.set(token.token, token);
@@ -1271,11 +2061,11 @@ var InMemoryEmailVerificationStore = class {
       this.tokens.set(token, { ...entry, consumed: true });
     }
   }
-  async countActiveForUser(userId) {
+  async countActiveForEmail(email) {
     const now = Date.now();
     let count = 0;
     for (const token of this.tokens.values()) {
-      if (token.userId === userId && !token.consumed && now < token.expiresAt) {
+      if (token.email === email && !token.consumed && now < token.expiresAt) {
         count++;
       }
     }
@@ -1293,97 +2083,130 @@ var InMemoryEmailVerificationStore = class {
     return count;
   }
 };
-var DEFAULT_TOKEN_TTL_MS2 = 24 * 60 * 60 * 1e3;
-var DEFAULT_MAX_REQUESTS2 = 3;
-var EmailVerificationManager = class {
+var DEFAULT_TOKEN_TTL_MS = 60 * 60 * 1e3;
+var DEFAULT_MAX_REQUESTS = 3;
+var MIN_PASSWORD_LENGTH2 = 8;
+var MAX_PASSWORD_LENGTH2 = 128;
+var PasswordResetManager = class {
   userStore;
-  verificationStore;
+  resetStore;
   tokenTtlMs;
-  maxRequestsPerUser;
-  onVerificationRequired;
+  maxRequestsPerEmail;
+  onResetRequested;
   constructor(config) {
     this.userStore = config.userStore;
-    this.verificationStore = config.verificationStore ?? new InMemoryEmailVerificationStore();
-    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS2;
-    this.maxRequestsPerUser = config.maxRequestsPerUser ?? DEFAULT_MAX_REQUESTS2;
-    this.onVerificationRequired = config.onVerificationRequired;
+    this.resetStore = config.resetStore ?? new InMemoryPasswordResetStore();
+    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
+    this.maxRequestsPerEmail = config.maxRequestsPerEmail ?? DEFAULT_MAX_REQUESTS;
+    this.onResetRequested = config.onResetRequested;
   }
   /**
-   * Send a verification email for a user.
-   * Rate-limited to prevent abuse.
+   * Request a password reset for an email.
+   * Always returns success to prevent email enumeration.
+   *
+   * If a callback is configured, invokes it with the token.
+   * In development mode (no callback), returns the token in the response.
    */
-  async sendVerification(userId, email) {
+  async requestReset(email) {
     const normalizedEmail = email.toLowerCase().trim();
-    const activeCount = await this.verificationStore.countActiveForUser(userId);
-    if (activeCount >= this.maxRequestsPerUser) {
-      return {
-        status: 429,
-        body: { error: "Too many verification requests. Please try again later." }
-      };
+    const successResponse = {
+      status: 200,
+      body: {
+        data: {
+          message: "If an account with that email exists, a password reset link has been sent."
+        }
+      }
+    };
+    const user = await this.userStore.findByEmail(normalizedEmail);
+    if (!user) {
+      return successResponse;
     }
-    const token = generateSecureToken2();
+    const activeCount = await this.resetStore.countActiveForEmail(normalizedEmail);
+    if (activeCount >= this.maxRequestsPerEmail) {
+      return successResponse;
+    }
+    const token = generateSecureToken();
     const now = Date.now();
-    const verificationToken = {
+    const resetToken = {
       token,
-      userId,
+      userId: user.id,
       email: normalizedEmail,
       createdAt: now,
       expiresAt: now + this.tokenTtlMs,
       consumed: false
     };
-    await this.verificationStore.store(verificationToken);
-    if (this.onVerificationRequired) {
+    await this.resetStore.store(resetToken);
+    if (this.onResetRequested) {
       try {
-        await this.onVerificationRequired(normalizedEmail, token, verificationToken.expiresAt);
+        await this.onResetRequested(normalizedEmail, token, resetToken.expiresAt);
       } catch {
       }
     }
-    const responseData = {
-      message: "Verification email sent."
-    };
-    if (!this.onVerificationRequired) {
-      responseData.token = token;
+    if (!this.onResetRequested) {
+      successResponse.body = { data: { message: "Password reset token generated.", token } };
     }
-    return { status: 200, body: { data: responseData } };
+    return successResponse;
   }
   /**
-   * Verify an email using a verification token.
+   * Consume a reset token and set a new password.
    */
-  async verifyEmail(token) {
-    const verificationToken = await this.verificationStore.get(token);
-    if (!verificationToken || verificationToken.consumed) {
-      return { status: 404, body: { error: "Verification token not found or already used." } };
+  async resetPassword(token, newPassword) {
+    if (typeof newPassword !== "string" || newPassword.length < MIN_PASSWORD_LENGTH2) {
+      return {
+        status: 400,
+        body: { error: `Password must be at least ${MIN_PASSWORD_LENGTH2} characters.` }
+      };
     }
-    if (Date.now() > verificationToken.expiresAt) {
-      await this.verificationStore.consume(token);
-      return { status: 410, body: { error: "Verification token has expired." } };
+    if (newPassword.length > MAX_PASSWORD_LENGTH2) {
+      return {
+        status: 400,
+        body: { error: `Password must be at most ${MAX_PASSWORD_LENGTH2} characters.` }
+      };
     }
-    await this.verificationStore.consume(token);
-    await this.userStore.setEmailVerified(verificationToken.userId, true);
-    return {
-      status: 200,
-      body: {
-        data: {
-          message: "Email verified successfully.",
-          userId: verificationToken.userId,
-          email: verificationToken.email
-        }
-      }
-    };
+    const resetToken = await this.resetStore.get(token);
+    if (!resetToken || resetToken.consumed) {
+      return { status: 404, body: { error: "Password reset token not found or already used." } };
+    }
+    if (Date.now() > resetToken.expiresAt) {
+      await this.resetStore.consume(token);
+      return { status: 410, body: { error: "Password reset token has expired." } };
+    }
+    await this.resetStore.consume(token);
+    const hashed = await hashPassword(newPassword);
+    await this.userStore.updatePassword(resetToken.userId, hashed.hash, hashed.salt);
+    return { status: 200, body: { data: { message: "Password has been reset successfully." } } };
   }
   /**
-   * Resend verification email for a user.
-   * Delegates to sendVerification with rate limiting.
+   * Change password for an authenticated user (requires current password verification).
    */
-  async resendVerification(userId) {
+  async changePassword(userId, currentPassword, newPassword) {
+    if (typeof newPassword !== "string" || newPassword.length < MIN_PASSWORD_LENGTH2) {
+      return {
+        status: 400,
+        body: { error: `New password must be at least ${MIN_PASSWORD_LENGTH2} characters.` }
+      };
+    }
+    if (newPassword.length > MAX_PASSWORD_LENGTH2) {
+      return {
+        status: 400,
+        body: { error: `New password must be at most ${MAX_PASSWORD_LENGTH2} characters.` }
+      };
+    }
     const user = await this.userStore.findById(userId);
     if (!user) {
       return { status: 404, body: { error: "User not found." } };
     }
-    return this.sendVerification(userId, user.email);
+    const { verifyPassword: verifyPassword2 } = await import("./password-hash-QRBG6BNJ.js");
+    const isValid = await verifyPassword2(currentPassword, user.passwordHash, user.salt);
+    if (!isValid) {
+      return { status: 401, body: { error: "Current password is incorrect." } };
+    }
+    const hashed = await hashPassword(newPassword);
+    await this.userStore.updatePassword(userId, hashed.hash, hashed.salt);
+    return { status: 200, body: { data: { message: "Password changed successfully." } } };
   }
 };
-function generateSecureToken2() {
+function generateSecureToken() {
   const bytes = new Uint8Array(32);
   globalThis.crypto.getRandomValues(bytes);
   let binary = "";
@@ -1393,244 +2216,162 @@ function generateSecureToken2() {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
-// src/provider/built-in/user-store.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { KoraError as KoraError4 } from "@korajs/core";
-var DuplicateEmailError = class extends KoraError4 {
+// src/provider/built-in/email-verification.ts
+import { KoraError as KoraError6 } from "@korajs/core";
+var EmailVerificationError = class extends KoraError6 {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "EmailVerificationError";
+  }
+};
+var VerificationTokenExpiredError = class extends EmailVerificationError {
   constructor() {
-    super("A user with this email already exists.", "DUPLICATE_EMAIL");
-    this.name = "DuplicateEmailError";
+    super("Email verification token has expired.", "VERIFICATION_TOKEN_EXPIRED");
   }
 };
-var InMemoryUserStore = class {
-  /** Users indexed by ID */
-  usersById = /* @__PURE__ */ new Map();
-  /** Users indexed by email (lowercase) for fast lookup */
-  usersByEmail = /* @__PURE__ */ new Map();
-  /** Devices indexed by device ID */
-  devicesById = /* @__PURE__ */ new Map();
-  /** Device IDs indexed by user ID for fast listing */
-  devicesByUserId = /* @__PURE__ */ new Map();
-  /**
-   * Create a new user account.
-   *
-   * @param params - User creation parameters
-   * @param params.email - The user's email address (must be unique, case-insensitive)
-   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
-   * @param params.salt - Hex-encoded salt used during hashing
-   * @param params.name - The user's display name
-   * @returns The created user (without sensitive credential fields)
-   * @throws {DuplicateEmailError} If a user with the same email already exists
-   */
-  async createUser(params) {
-    const normalizedEmail = params.email.toLowerCase();
-    if (this.usersByEmail.has(normalizedEmail)) {
-      throw new DuplicateEmailError();
-    }
-    const now = Date.now();
-    const id = randomUUID2();
-    const storedUser = {
-      id,
-      email: normalizedEmail,
-      name: params.name,
-      emailVerified: false,
-      createdAt: now,
-      passwordHash: params.passwordHash,
-      salt: params.salt
-    };
-    this.usersById.set(id, storedUser);
-    this.usersByEmail.set(normalizedEmail, storedUser);
-    return toAuthUser(storedUser);
+var VerificationTokenNotFoundError = class extends EmailVerificationError {
+  constructor() {
+    super("Email verification token not found or already used.", "VERIFICATION_TOKEN_NOT_FOUND");
   }
-  /**
-   * Find a user by email address.
-   *
-   * @param email - The email to search for (case-insensitive)
-   * @returns The stored user record including credentials, or null if not found
-   */
-  async findByEmail(email) {
-    return this.usersByEmail.get(email.toLowerCase()) ?? null;
+};
+var InMemoryEmailVerificationStore = class {
+  tokens = /* @__PURE__ */ new Map();
+  async store(token) {
+    this.tokens.set(token.token, token);
   }
-  /**
-   * Find a user by ID.
-   *
-   * @param id - The user ID to search for
-   * @returns The stored user record including credentials, or null if not found
-   */
-  async findById(id) {
-    return this.usersById.get(id) ?? null;
+  async get(token) {
+    return this.tokens.get(token) ?? null;
   }
-  /**
-   * Register a device for a user.
-   *
-   * If a device with the same ID already exists and is not revoked, it is
-   * returned as-is (idempotent registration). If it was previously revoked,
-   * it is re-activated with updated details.
-   *
-   * @param params - Device registration parameters
-   * @param params.id - Unique device identifier
-   * @param params.userId - ID of the user who owns the device
-   * @param params.publicKey - Base64url-encoded device public key or thumbprint
-   * @param params.name - Human-readable device name
-   * @returns The registered device record
-   */
-  async registerDevice(params) {
-    const existing = this.devicesById.get(params.id);
-    if (existing !== void 0 && !existing.revoked) {
-      return existing;
-    }
-    const now = Date.now();
-    const device = {
-      id: params.id,
-      userId: params.userId,
-      publicKey: params.publicKey,
-      name: params.name,
-      revoked: false,
-      createdAt: now,
-      lastSeenAt: now
-    };
-    this.devicesById.set(params.id, device);
-    let userDevices = this.devicesByUserId.get(params.userId);
-    if (userDevices === void 0) {
-      userDevices = /* @__PURE__ */ new Set();
-      this.devicesByUserId.set(params.userId, userDevices);
+  async consume(token) {
+    const entry = this.tokens.get(token);
+    if (entry) {
+      this.tokens.set(token, { ...entry, consumed: true });
     }
-    userDevices.add(params.id);
-    return device;
   }
-  /**
-   * Find a device by its ID.
-   *
-   * @param deviceId - The device ID to search for
-   * @returns The device record, or null if not found
-   */
-  async findDevice(deviceId) {
-    return this.devicesById.get(deviceId) ?? null;
-  }
-  /**
-   * List all devices registered for a user.
-   *
-   * @param userId - The user ID whose devices to list
-   * @returns Array of device records (includes revoked devices)
-   */
-  async listDevices(userId) {
-    const deviceIds = this.devicesByUserId.get(userId);
-    if (deviceIds === void 0) {
-      return [];
-    }
-    const devices = [];
-    for (const deviceId of deviceIds) {
-      const device = this.devicesById.get(deviceId);
-      if (device !== void 0) {
-        devices.push(device);
+  async countActiveForUser(userId) {
+    const now = Date.now();
+    let count = 0;
+    for (const token of this.tokens.values()) {
+      if (token.userId === userId && !token.consumed && now < token.expiresAt) {
+        count++;
       }
     }
-    return devices;
+    return count;
   }
-  /**
-   * Revoke a device, preventing it from being used for authentication.
-   *
-   * This is a soft revoke — the device record remains but is marked as revoked.
-   * If the device does not exist, this is a no-op.
-   *
-   * @param deviceId - The ID of the device to revoke
-   */
-  async revokeDevice(deviceId) {
-    const device = this.devicesById.get(deviceId);
-    if (device !== void 0) {
-      device.revoked = true;
+  async cleanExpired() {
+    const now = Date.now();
+    let count = 0;
+    for (const [key, token] of this.tokens) {
+      if (now > token.expiresAt) {
+        this.tokens.delete(key);
+        count++;
+      }
     }
+    return count;
   }
-  /**
-   * Set a user's email verification status.
-   *
-   * @param userId - The user whose email to verify
-   * @param verified - Whether the email is verified
-   */
-  async setEmailVerified(userId, verified) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    const updated = { ...user, emailVerified: verified };
-    this.usersById.set(userId, updated);
-    this.usersByEmail.set(user.email, updated);
-  }
-  /**
-   * Update a user's password hash and salt.
-   *
-   * @param userId - The user whose password to update
-   * @param passwordHash - New hex-encoded PBKDF2 derived key
-   * @param salt - New hex-encoded salt
-   */
-  async updatePassword(userId, passwordHash, salt) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    const updated = { ...user, passwordHash, salt };
-    this.usersById.set(userId, updated);
-    this.usersByEmail.set(user.email, updated);
-  }
-  /**
-   * List all users. For admin/development use.
-   */
-  async listAll() {
-    return [...this.usersById.values()];
+};
+var DEFAULT_TOKEN_TTL_MS2 = 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_REQUESTS2 = 3;
+var EmailVerificationManager = class {
+  userStore;
+  verificationStore;
+  tokenTtlMs;
+  maxRequestsPerUser;
+  onVerificationRequired;
+  constructor(config) {
+    this.userStore = config.userStore;
+    this.verificationStore = config.verificationStore ?? new InMemoryEmailVerificationStore();
+    this.tokenTtlMs = config.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS2;
+    this.maxRequestsPerUser = config.maxRequestsPerUser ?? DEFAULT_MAX_REQUESTS2;
+    this.onVerificationRequired = config.onVerificationRequired;
   }
   /**
-   * Update a stored user record.
+   * Send a verification email for a user.
+   * Rate-limited to prevent abuse.
    */
-  async update(user) {
-    const existing = this.usersById.get(user.id);
-    if (!existing) return;
-    if (existing.email !== user.email) {
-      this.usersByEmail.delete(existing.email);
-      this.usersByEmail.set(user.email, user);
-    } else {
-      this.usersByEmail.set(user.email, user);
+  async sendVerification(userId, email) {
+    const normalizedEmail = email.toLowerCase().trim();
+    const activeCount = await this.verificationStore.countActiveForUser(userId);
+    if (activeCount >= this.maxRequestsPerUser) {
+      return {
+        status: 429,
+        body: { error: "Too many verification requests. Please try again later." }
+      };
     }
-    this.usersById.set(user.id, user);
+    const token = generateSecureToken2();
+    const now = Date.now();
+    const verificationToken = {
+      token,
+      userId,
+      email: normalizedEmail,
+      createdAt: now,
+      expiresAt: now + this.tokenTtlMs,
+      consumed: false
+    };
+    await this.verificationStore.store(verificationToken);
+    if (this.onVerificationRequired) {
+      try {
+        await this.onVerificationRequired(normalizedEmail, token, verificationToken.expiresAt);
+      } catch {
+      }
+    }
+    const responseData = {
+      message: "Verification email sent."
+    };
+    if (!this.onVerificationRequired) {
+      responseData.token = token;
+    }
+    return { status: 200, body: { data: responseData } };
   }
   /**
-   * Delete a user and all associated devices.
+   * Verify an email using a verification token.
    */
-  async delete(userId) {
-    const user = this.usersById.get(userId);
-    if (!user) return;
-    this.usersById.delete(userId);
-    this.usersByEmail.delete(user.email);
-    const deviceIds = this.devicesByUserId.get(userId);
-    if (deviceIds) {
-      for (const deviceId of deviceIds) {
-        this.devicesById.delete(deviceId);
-      }
-      this.devicesByUserId.delete(userId);
+  async verifyEmail(token) {
+    const verificationToken = await this.verificationStore.get(token);
+    if (!verificationToken || verificationToken.consumed) {
+      return { status: 404, body: { error: "Verification token not found or already used." } };
+    }
+    if (Date.now() > verificationToken.expiresAt) {
+      await this.verificationStore.consume(token);
+      return { status: 410, body: { error: "Verification token has expired." } };
     }
+    await this.verificationStore.consume(token);
+    await this.userStore.setEmailVerified(verificationToken.userId, true);
+    return {
+      status: 200,
+      body: {
+        data: {
+          message: "Email verified successfully.",
+          userId: verificationToken.userId,
+          email: verificationToken.email
+        }
+      }
+    };
   }
   /**
-   * Update the last-seen timestamp for a device.
-   *
-   * Called when a device authenticates or syncs to track activity.
-   * If the device does not exist, this is a no-op.
-   *
-   * @param deviceId - The ID of the device to update
+   * Resend verification email for a user.
+   * Delegates to sendVerification with rate limiting.
    */
-  async touchDevice(deviceId) {
-    const device = this.devicesById.get(deviceId);
-    if (device !== void 0) {
-      device.lastSeenAt = Date.now();
+  async resendVerification(userId) {
+    const user = await this.userStore.findById(userId);
+    if (!user) {
+      return { status: 404, body: { error: "User not found." } };
     }
+    return this.sendVerification(userId, user.email);
   }
 };
-function toAuthUser(stored) {
-  return {
-    id: stored.id,
-    email: stored.email,
-    name: stored.name,
-    emailVerified: stored.emailVerified,
-    createdAt: stored.createdAt
-  };
+function generateSecureToken2() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
 // src/provider/built-in/sqlite-user-store.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var SqliteUserStore = class {
   db;
   constructor(db) {
@@ -1667,7 +2408,7 @@ var SqliteUserStore = class {
   async createUser(params) {
     const normalizedEmail = params.email.toLowerCase();
     const now = Date.now();
-    const id = randomUUID3();
+    const id = randomUUID5();
     try {
       this.db.prepare(`
 				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
@@ -1795,7 +2536,7 @@ function rowToDevice(row) {
 }
 
 // src/provider/built-in/postgres-user-store.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var PostgresUserStore = class {
   sql;
   ready;
@@ -1837,7 +2578,7 @@ var PostgresUserStore = class {
     await this.ready;
     const normalizedEmail = params.email.toLowerCase();
     const now = Date.now();
-    const id = randomUUID4();
+    const id = randomUUID6();
     try {
       await this.sql`
 				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
@@ -2073,8 +2814,8 @@ var BuiltInProvider = class {
 };
 
 // src/provider/external/external-jwt-provider.ts
-import { KoraError as KoraError5 } from "@korajs/core";
-var ExternalAuthOperationNotSupportedError = class extends KoraError5 {
+import { KoraError as KoraError7 } from "@korajs/core";
+var ExternalAuthOperationNotSupportedError = class extends KoraError7 {
   constructor(operation, provider) {
     super(
       `The "${operation}" operation is not supported by the external auth provider "${provider}". Perform this operation through your external auth provider's SDK or dashboard instead.`,
@@ -2084,7 +2825,7 @@ var ExternalAuthOperationNotSupportedError = class extends KoraError5 {
     this.name = "ExternalAuthOperationNotSupportedError";
   }
 };
-var ExternalTokenValidationError = class extends KoraError5 {
+var ExternalTokenValidationError = class extends KoraError7 {
   constructor(reason, context) {
     super(`External token validation failed: ${reason}`, "AUTH_EXTERNAL_TOKEN_INVALID", context);
     this.name = "ExternalTokenValidationError";
@@ -2377,8 +3118,8 @@ function createSupabaseAdapter(config) {
 
 // src/passkey/passkey-server.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { KoraError as KoraError6 } from "@korajs/core";
-var PasskeyVerificationError = class extends KoraError6 {
+import { KoraError as KoraError8 } from "@korajs/core";
+var PasskeyVerificationError = class extends KoraError8 {
   constructor(message, context) {
     super(message, "PASSKEY_VERIFICATION_ERROR", context);
     this.name = "PasskeyVerificationError";
@@ -2704,7 +3445,7 @@ function copyComponentToP1363(component, target, targetOffset, componentLength)
 }
 
 // src/org/org-types.ts
-import { KoraError as KoraError7 } from "@korajs/core";
+import { KoraError as KoraError9 } from "@korajs/core";
 var ORG_ROLES = ["owner", "admin", "member", "viewer", "billing"];
 var ROLE_HIERARCHY = {
   viewer: 10,
@@ -2717,7 +3458,7 @@ function hasRoleLevel(userRole, requiredRole) {
   return ROLE_HIERARCHY[userRole] >= ROLE_HIERARCHY[requiredRole];
 }
 var INVITATION_STATUSES = ["pending", "accepted", "revoked", "expired"];
-var OrgError = class extends KoraError7 {
+var OrgError = class extends KoraError9 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "OrgError";
@@ -3509,7 +4250,7 @@ function slugify(name) {
 }
 
 // src/rbac/rbac-types.ts
-import { KoraError as KoraError8 } from "@korajs/core";
+import { KoraError as KoraError10 } from "@korajs/core";
 function parsePermission(permission) {
   const colonIndex = permission.indexOf(":");
   if (colonIndex === -1) {
@@ -3553,7 +4294,7 @@ var BUILT_IN_ROLES = [
     permissions: ["*:*"]
   }
 ];
-var RbacError = class extends KoraError8 {
+var RbacError = class extends KoraError10 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "RbacError";
@@ -3872,302 +4613,409 @@ var OrgScopeResolver = class {
   }
 };
 
-// src/provider/oauth/oauth-types.ts
-import { KoraError as KoraError9 } from "@korajs/core";
-var OAuthError = class extends KoraError9 {
-  constructor(message, code, context) {
-    super(message, code, context);
-    this.name = "OAuthError";
-  }
-};
-var OAuthStateMismatchError = class extends OAuthError {
-  constructor() {
-    super("OAuth state parameter does not match. Possible CSRF attack.", "OAUTH_STATE_MISMATCH");
-  }
-};
-var OAuthCodeExchangeError = class extends OAuthError {
-  constructor(details) {
-    super(
-      `Failed to exchange authorization code for tokens.${details ? ` ${details}` : ""}`,
-      "OAUTH_CODE_EXCHANGE_FAILED",
-      details ? { details } : void 0
-    );
+// src/provider/oauth/sqlite-oauth-store.ts
+import { randomUUID as randomUUID7 } from "crypto";
+var SqliteOAuthStateStore = class {
+  db;
+  constructor(db) {
+    this.db = db;
+    this.db.pragma("journal_mode = WAL");
+    this.ensureTables();
   }
-};
-var OAuthUserInfoError = class extends OAuthError {
-  constructor(details) {
-    super(
-      `Failed to fetch user info from OAuth provider.${details ? ` ${details}` : ""}`,
-      "OAUTH_USER_INFO_FAILED",
-      details ? { details } : void 0
+  async store(state) {
+    this.db.prepare(`
+				INSERT OR REPLACE INTO auth_oauth_states
+					(state, provider, redirect_uri, created_at, expires_at, metadata_json, code_verifier)
+				VALUES (?, ?, ?, ?, ?, ?, ?)
+			`).run(
+      state.state,
+      state.provider,
+      state.redirectUri,
+      state.createdAt,
+      state.expiresAt,
+      state.metadata ? JSON.stringify(state.metadata) : null,
+      state.codeVerifier ?? null
     );
   }
-};
-var OAuthProviderNotFoundError = class extends OAuthError {
-  constructor(provider) {
-    super(`OAuth provider "${provider}" is not configured.`, "OAUTH_PROVIDER_NOT_FOUND", {
-      provider
+  async consume(stateValue) {
+    const consumeInTransaction = this.db.transaction(() => {
+      const row = this.db.prepare("SELECT * FROM auth_oauth_states WHERE state = ?").get(stateValue);
+      if (!row) return null;
+      this.db.prepare("DELETE FROM auth_oauth_states WHERE state = ?").run(stateValue);
+      if (Date.now() > row.expires_at) return null;
+      return rowToOAuthState(row);
     });
+    return consumeInTransaction();
   }
-};
+  async cleanExpired() {
+    const result = this.db.prepare("DELETE FROM auth_oauth_states WHERE expires_at < ?").run(Date.now());
+    return result.changes ?? 0;
+  }
+  ensureTables() {
+    this.db.exec(`
+			CREATE TABLE IF NOT EXISTS auth_oauth_states (
+				state TEXT PRIMARY KEY,
+				provider TEXT NOT NULL,
+				redirect_uri TEXT NOT NULL,
+				created_at INTEGER NOT NULL,
+				expires_at INTEGER NOT NULL,
+				metadata_json TEXT,
+				code_verifier TEXT
+			);
 
-// src/provider/oauth/oauth-flow.ts
-var DEFAULT_STATE_TTL_MS = 10 * 60 * 1e3;
-var InMemoryOAuthStateStore = class {
-  states = /* @__PURE__ */ new Map();
-  async store(state) {
-    this.states.set(state.state, state);
+			CREATE INDEX IF NOT EXISTS idx_auth_oauth_states_expires_at
+				ON auth_oauth_states(expires_at);
+		`);
   }
-  async consume(stateValue) {
-    const state = this.states.get(stateValue);
-    if (!state) return null;
-    this.states.delete(stateValue);
-    if (Date.now() > state.expiresAt) return null;
-    return state;
+};
+var SqliteLinkedIdentityStore = class {
+  db;
+  constructor(db) {
+    this.db = db;
+    this.db.pragma("journal_mode = WAL");
+    this.ensureTables();
   }
-  async cleanExpired() {
-    const now = Date.now();
-    let count = 0;
-    for (const [key, state] of this.states) {
-      if (now > state.expiresAt) {
-        this.states.delete(key);
-        count++;
+  async findByProvider(provider, providerUserId) {
+    const row = this.db.prepare(`
+				SELECT * FROM auth_linked_identities
+				WHERE provider = ? AND provider_user_id = ?
+			`).get(provider, providerUserId);
+    return row ? rowToLinkedIdentity(row) : null;
+  }
+  async findByUser(userId) {
+    const rows = this.db.prepare(`
+				SELECT * FROM auth_linked_identities
+				WHERE user_id = ?
+				ORDER BY linked_at ASC
+			`).all(userId);
+    return rows.map(rowToLinkedIdentity);
+  }
+  async create(params) {
+    const identity = {
+      id: randomUUID7(),
+      userId: params.userId,
+      provider: params.provider,
+      providerUserId: params.providerUserId,
+      email: params.email,
+      linkedAt: Date.now()
+    };
+    try {
+      this.db.prepare(`
+					INSERT INTO auth_linked_identities
+						(id, user_id, provider, provider_user_id, email, linked_at)
+					VALUES (?, ?, ?, ?, ?, ?)
+				`).run(
+        identity.id,
+        identity.userId,
+        identity.provider,
+        identity.providerUserId,
+        identity.email,
+        identity.linkedAt
+      );
+    } catch (error) {
+      if (error instanceof Error && error.message.includes("UNIQUE constraint failed")) {
+        throw new DuplicateLinkedIdentityError(params.provider);
       }
+      throw error;
     }
-    return count;
+    return identity;
+  }
+  async delete(userId, provider) {
+    this.db.prepare("DELETE FROM auth_linked_identities WHERE user_id = ? AND provider = ?").run(userId, provider);
+  }
+  ensureTables() {
+    this.db.exec(`
+			CREATE TABLE IF NOT EXISTS auth_linked_identities (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL,
+				provider TEXT NOT NULL,
+				provider_user_id TEXT NOT NULL,
+				email TEXT,
+				linked_at INTEGER NOT NULL,
+				UNIQUE(provider, provider_user_id),
+				UNIQUE(user_id, provider)
+			);
+
+			CREATE INDEX IF NOT EXISTS idx_auth_linked_identities_user_id
+				ON auth_linked_identities(user_id);
+		`);
   }
 };
-var OAuthManager = class {
-  providers = /* @__PURE__ */ new Map();
-  stateStore;
-  stateTtlMs;
-  fetchFn;
-  constructor(config) {
-    for (const provider of config.providers) {
-      this.providers.set(provider.providerId, provider);
-    }
-    this.stateStore = config.stateStore ?? new InMemoryOAuthStateStore();
-    this.stateTtlMs = config.stateTtlMs ?? DEFAULT_STATE_TTL_MS;
-    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+async function createSqliteOAuthStateStore(options) {
+  const Database = await loadBetterSqlite32();
+  const db = new Database(options.filename);
+  return new SqliteOAuthStateStore(db);
+}
+async function createSqliteLinkedIdentityStore(options) {
+  const Database = await loadBetterSqlite32();
+  const db = new Database(options.filename);
+  return new SqliteLinkedIdentityStore(db);
+}
+async function createSqliteOAuthStores(options) {
+  const Database = await loadBetterSqlite32();
+  const db = new Database(options.filename);
+  return {
+    stateStore: new SqliteOAuthStateStore(db),
+    linkedIdentityStore: new SqliteLinkedIdentityStore(db)
+  };
+}
+async function loadBetterSqlite32() {
+  try {
+    const { createRequire } = await import("module");
+    const require2 = createRequire(import.meta.url);
+    return require2("better-sqlite3");
+  } catch {
+    throw new Error(
+      'SQLite OAuth stores require the "better-sqlite3" package. Install it in your project dependencies.'
+    );
   }
-  /**
-   * Generate an authorization URL for the user to visit.
-   * Returns the URL and the state parameter for CSRF validation.
-   */
-  async getAuthorizationUrl(providerId, metadata) {
-    const provider = this.getProvider(providerId);
-    const state = generateState();
-    const now = Date.now();
-    const oauthState = {
-      state,
-      provider: providerId,
-      redirectUri: provider.redirectUri,
-      createdAt: now,
-      expiresAt: now + this.stateTtlMs,
-      metadata
-    };
-    await this.stateStore.store(oauthState);
-    const params = new URLSearchParams({
-      client_id: provider.clientId,
-      redirect_uri: provider.redirectUri,
-      response_type: "code",
-      scope: provider.scopes.join(" "),
-      state
+}
+function rowToOAuthState(row) {
+  return {
+    state: row.state,
+    provider: row.provider,
+    redirectUri: row.redirect_uri,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    metadata: parseMetadata(row.metadata_json),
+    codeVerifier: row.code_verifier ?? void 0
+  };
+}
+function parseMetadata(value) {
+  if (!value) return void 0;
+  const parsed = JSON.parse(value);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+}
+function rowToLinkedIdentity(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    provider: row.provider,
+    providerUserId: row.provider_user_id,
+    email: row.email,
+    linkedAt: row.linked_at
+  };
+}
+
+// src/provider/oauth/postgres-oauth-store.ts
+import { randomUUID as randomUUID8 } from "crypto";
+var PostgresOAuthStateStore = class {
+  sql;
+  ready;
+  constructor(sql) {
+    this.sql = sql;
+    this.ready = this.ensureTables();
+  }
+  async store(state) {
+    await this.ready;
+    await this.sql`
+			INSERT INTO auth_oauth_states
+				(state, provider, redirect_uri, created_at, expires_at, metadata_json, code_verifier)
+			VALUES (
+				${state.state},
+				${state.provider},
+				${state.redirectUri},
+				${state.createdAt},
+				${state.expiresAt},
+				${state.metadata ? JSON.stringify(state.metadata) : null},
+				${state.codeVerifier ?? null}
+			)
+			ON CONFLICT (state) DO UPDATE SET
+				provider = EXCLUDED.provider,
+				redirect_uri = EXCLUDED.redirect_uri,
+				created_at = EXCLUDED.created_at,
+				expires_at = EXCLUDED.expires_at,
+				metadata_json = EXCLUDED.metadata_json,
+				code_verifier = EXCLUDED.code_verifier
+		`;
+  }
+  async consume(stateValue) {
+    await this.ready;
+    return this.sql.begin(async (tx) => {
+      const rows = await tx`
+				DELETE FROM auth_oauth_states
+				WHERE state = ${stateValue}
+				RETURNING *
+			`;
+      const row = rows[0];
+      if (!row || Date.now() > Number(row.expires_at)) {
+        return null;
+      }
+      return rowToOAuthState2(row);
     });
-    const url = `${provider.authorizationUrl}?${params.toString()}`;
-    return { url, state };
   }
-  /**
-   * Handle the OAuth callback after the user authorizes.
-   * Validates the state parameter, exchanges the code for tokens,
-   * and fetches user info.
-   *
-   * @param providerId - The OAuth provider
-   * @param code - The authorization code from the callback
-   * @param state - The state parameter from the callback
-   * @returns Tokens and user info from the provider
-   */
-  async handleCallback(providerId, code, state) {
-    const provider = this.getProvider(providerId);
-    const oauthState = await this.stateStore.consume(state);
-    if (!oauthState || oauthState.provider !== providerId) {
-      throw new OAuthStateMismatchError();
-    }
-    const tokens = await this.exchangeCodeForTokens(provider, code);
-    const userInfo = await this.fetchUserInfo(provider, tokens.accessToken);
-    return { tokens, userInfo, stateMetadata: oauthState.metadata };
+  async cleanExpired() {
+    await this.ready;
+    const rows = await this.sql`
+			DELETE FROM auth_oauth_states
+			WHERE expires_at < ${Date.now()}
+			RETURNING state
+		`;
+    return rows.length;
   }
-  /**
-   * Get a registered provider by ID.
-   */
-  getProvider(providerId) {
-    const provider = this.providers.get(providerId);
-    if (!provider) {
-      throw new OAuthProviderNotFoundError(providerId);
-    }
-    return provider;
+  async ensureTables() {
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_oauth_states (
+				state TEXT PRIMARY KEY,
+				provider TEXT NOT NULL,
+				redirect_uri TEXT NOT NULL,
+				created_at BIGINT NOT NULL,
+				expires_at BIGINT NOT NULL,
+				metadata_json TEXT,
+				code_verifier TEXT
+			)
+		`;
+    await this.sql`
+			CREATE INDEX IF NOT EXISTS idx_auth_oauth_states_expires_at
+				ON auth_oauth_states(expires_at)
+		`;
   }
-  /**
-   * List all registered provider IDs.
-   */
-  getProviderIds() {
-    return [...this.providers.keys()];
+};
+var PostgresLinkedIdentityStore = class {
+  sql;
+  ready;
+  constructor(sql) {
+    this.sql = sql;
+    this.ready = this.ensureTables();
   }
-  // --- Private ---
-  async exchangeCodeForTokens(provider, code) {
-    const body = new URLSearchParams({
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: provider.redirectUri,
-      client_id: provider.clientId,
-      client_secret: provider.clientSecret
-    });
-    let response;
+  async findByProvider(provider, providerUserId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_linked_identities
+			WHERE provider = ${provider} AND provider_user_id = ${providerUserId}
+		`;
+    return rows[0] ? rowToLinkedIdentity2(rows[0]) : null;
+  }
+  async findByUser(userId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_linked_identities
+			WHERE user_id = ${userId}
+			ORDER BY linked_at ASC
+		`;
+    return rows.map(rowToLinkedIdentity2);
+  }
+  async create(params) {
+    await this.ready;
+    const identity = {
+      id: randomUUID8(),
+      userId: params.userId,
+      provider: params.provider,
+      providerUserId: params.providerUserId,
+      email: params.email,
+      linkedAt: Date.now()
+    };
     try {
-      response = await this.fetchFn(provider.tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        },
-        body: body.toString()
-      });
-    } catch (err) {
-      throw new OAuthCodeExchangeError(err instanceof Error ? err.message : "Network error");
-    }
-    if (!response.ok) {
-      let details = `HTTP ${response.status}`;
-      try {
-        const errorBody = await response.text();
-        details += `: ${errorBody}`;
-      } catch {
+      await this.sql`
+				INSERT INTO auth_linked_identities
+					(id, user_id, provider, provider_user_id, email, linked_at)
+				VALUES (
+					${identity.id},
+					${identity.userId},
+					${identity.provider},
+					${identity.providerUserId},
+					${identity.email},
+					${identity.linkedAt}
+				)
+			`;
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new DuplicateLinkedIdentityError(params.provider);
       }
-      throw new OAuthCodeExchangeError(details);
+      throw error;
     }
-    const data = await response.json();
-    return {
-      accessToken: data.access_token,
-      tokenType: data.token_type ?? "Bearer",
-      expiresIn: data.expires_in,
-      refreshToken: data.refresh_token,
-      idToken: data.id_token,
-      scope: data.scope
-    };
+    return identity;
   }
-  async fetchUserInfo(provider, accessToken) {
-    let response;
-    try {
-      response = await this.fetchFn(provider.userInfoUrl, {
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          Accept: "application/json"
-        }
-      });
-    } catch (err) {
-      throw new OAuthUserInfoError(err instanceof Error ? err.message : "Network error");
-    }
-    if (!response.ok) {
-      throw new OAuthUserInfoError(`HTTP ${response.status}`);
-    }
-    const profile = await response.json();
-    return normalizeUserInfo(provider.providerId, profile);
+  async delete(userId, provider) {
+    await this.ready;
+    await this.sql`
+			DELETE FROM auth_linked_identities
+			WHERE user_id = ${userId} AND provider = ${provider}
+		`;
   }
-};
-function normalizeUserInfo(providerId, profile) {
-  switch (providerId) {
-    case "google":
-      return {
-        providerId: profile.sub,
-        provider: "google",
-        email: profile.email ?? null,
-        emailVerified: profile.email_verified ?? false,
-        name: profile.name ?? null,
-        avatarUrl: profile.picture ?? null,
-        rawProfile: profile
-      };
-    case "github":
-      return {
-        providerId: String(profile.id),
-        provider: "github",
-        email: profile.email ?? null,
-        emailVerified: false,
-        // GitHub doesn't confirm in the profile response
-        name: profile.name ?? profile.login ?? null,
-        avatarUrl: profile.avatar_url ?? null,
-        rawProfile: profile
-      };
-    case "microsoft":
-      return {
-        providerId: profile.id,
-        provider: "microsoft",
-        email: profile.mail ?? profile.userPrincipalName ?? null,
-        emailVerified: false,
-        name: profile.displayName ?? null,
-        avatarUrl: null,
-        rawProfile: profile
-      };
-    default:
-      return {
-        providerId: String(profile.id ?? profile.sub ?? ""),
-        provider: providerId,
-        email: profile.email ?? null,
-        emailVerified: profile.email_verified ?? false,
-        name: profile.name ?? null,
-        avatarUrl: profile.picture ?? profile.avatar_url ?? null,
-        rawProfile: profile
-      };
+  async ensureTables() {
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_linked_identities (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL,
+				provider TEXT NOT NULL,
+				provider_user_id TEXT NOT NULL,
+				email TEXT,
+				linked_at BIGINT NOT NULL,
+				UNIQUE(provider, provider_user_id),
+				UNIQUE(user_id, provider)
+			)
+		`;
+    await this.sql`
+			CREATE INDEX IF NOT EXISTS idx_auth_linked_identities_user_id
+				ON auth_linked_identities(user_id)
+		`;
   }
+};
+async function createPostgresOAuthStateStore(options) {
+  const postgresClient = await loadPostgresDeps2();
+  const sql = postgresClient(options.connectionString);
+  return new PostgresOAuthStateStore(sql);
 }
-function googleProvider(config) {
+async function createPostgresLinkedIdentityStore(options) {
+  const postgresClient = await loadPostgresDeps2();
+  const sql = postgresClient(options.connectionString);
+  return new PostgresLinkedIdentityStore(sql);
+}
+async function createPostgresOAuthStores(options) {
+  const postgresClient = await loadPostgresDeps2();
+  const sql = postgresClient(options.connectionString);
   return {
-    providerId: "google",
-    clientId: config.clientId,
-    clientSecret: config.clientSecret,
-    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-    tokenUrl: "https://oauth2.googleapis.com/token",
-    userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
-    scopes: config.scopes ?? ["openid", "email", "profile"],
-    redirectUri: config.redirectUri
+    stateStore: new PostgresOAuthStateStore(sql),
+    linkedIdentityStore: new PostgresLinkedIdentityStore(sql)
   };
 }
-function githubProvider(config) {
+async function loadPostgresDeps2() {
+  try {
+    const dynamicImport = new Function("specifier", "return import(specifier)");
+    const postgresMod = await dynamicImport("postgres");
+    return postgresMod.default;
+  } catch {
+    throw new Error(
+      'PostgreSQL OAuth stores require the "postgres" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToOAuthState2(row) {
   return {
-    providerId: "github",
-    clientId: config.clientId,
-    clientSecret: config.clientSecret,
-    authorizationUrl: "https://github.com/login/oauth/authorize",
-    tokenUrl: "https://github.com/login/oauth/access_token",
-    userInfoUrl: "https://api.github.com/user",
-    scopes: config.scopes ?? ["read:user", "user:email"],
-    redirectUri: config.redirectUri
+    state: row.state,
+    provider: row.provider,
+    redirectUri: row.redirect_uri,
+    createdAt: Number(row.created_at),
+    expiresAt: Number(row.expires_at),
+    metadata: parseMetadata2(row.metadata_json),
+    codeVerifier: row.code_verifier ?? void 0
   };
 }
-function microsoftProvider(config) {
-  const tenant = config.tenantId ?? "common";
+function parseMetadata2(value) {
+  if (!value) return void 0;
+  const parsed = JSON.parse(value);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+}
+function rowToLinkedIdentity2(row) {
   return {
-    providerId: "microsoft",
-    clientId: config.clientId,
-    clientSecret: config.clientSecret,
-    authorizationUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
-    tokenUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
-    userInfoUrl: "https://graph.microsoft.com/v1.0/me",
-    scopes: config.scopes ?? ["openid", "email", "profile", "User.Read"],
-    redirectUri: config.redirectUri
+    id: row.id,
+    userId: row.user_id,
+    provider: row.provider,
+    providerUserId: row.provider_user_id,
+    email: row.email,
+    linkedAt: Number(row.linked_at)
   };
 }
-function generateState() {
-  const bytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(bytes);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function isUniqueViolation(error) {
+  if (!(error instanceof Error)) return false;
+  const code = error.code;
+  return code === "23505" || error.message.includes("unique constraint") || error.message.includes("duplicate key");
 }
 
 // src/session/session.ts
-import { KoraError as KoraError10 } from "@korajs/core";
-var SessionError = class extends KoraError10 {
+import { KoraError as KoraError11 } from "@korajs/core";
+var SessionError = class extends KoraError11 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "SessionError";
@@ -4396,8 +5244,8 @@ function generateSessionId() {
 }
 
 // src/mfa/totp.ts
-import { KoraError as KoraError11 } from "@korajs/core";
-var TotpError = class extends KoraError11 {
+import { KoraError as KoraError12 } from "@korajs/core";
+var TotpError = class extends KoraError12 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "TotpError";
@@ -4820,8 +5668,8 @@ function timingSafeEqual(a, b) {
 }
 
 // src/admin/admin-api.ts
-import { KoraError as KoraError12 } from "@korajs/core";
-var AdminApiError = class extends KoraError12 {
+import { KoraError as KoraError13 } from "@korajs/core";
+var AdminApiError = class extends KoraError13 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "AdminApiError";
@@ -4855,7 +5703,7 @@ var AdminApi = class {
       throw new AdminUserNotFoundError(userId);
     }
     await this.audit("admin.user_lookup", adminId, userId, "user");
-    return toAuthUser2(user);
+    return toAuthUser3(user);
   }
   /**
    * List users with optional filtering and pagination.
@@ -4873,7 +5721,7 @@ var AdminApi = class {
       filtered = filtered.filter((u) => u.emailVerified === query.emailVerified);
     }
     const total = filtered.length;
-    const data = filtered.slice(offset, offset + limit).map(toAuthUser2);
+    const data = filtered.slice(offset, offset + limit).map(toAuthUser3);
     return { data, total, limit, offset };
   }
   /**
@@ -4895,7 +5743,7 @@ var AdminApi = class {
     }
     await this.userStore.update(user);
     await this.audit("user.update", adminId, userId, "user", { updates });
-    return toAuthUser2(user);
+    return toAuthUser3(user);
   }
   /**
    * Delete a user and all associated sessions.
@@ -4960,7 +5808,7 @@ var AdminApi = class {
     });
   }
 };
-function toAuthUser2(stored) {
+function toAuthUser3(stored) {
   return {
     id: stored.id,
     email: stored.email,
@@ -4971,8 +5819,8 @@ function toAuthUser2(stored) {
 }
 
 // src/admin/audit-log.ts
-import { KoraError as KoraError13 } from "@korajs/core";
-var AuditLogError = class extends KoraError13 {
+import { KoraError as KoraError14 } from "@korajs/core";
+var AuditLogError = class extends KoraError14 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "AuditLogError";
@@ -5097,8 +5945,8 @@ function generateAuditId() {
 }
 
 // src/admin/webhooks.ts
-import { KoraError as KoraError14 } from "@korajs/core";
-var WebhookError = class extends KoraError14 {
+import { KoraError as KoraError15 } from "@korajs/core";
+var WebhookError = class extends KoraError15 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "WebhookError";
@@ -5327,6 +6175,7 @@ export {
   CannotRemoveOwnerError,
   CircularInheritanceError,
   DuplicateEmailError,
+  DuplicateLinkedIdentityError,
   EmailVerificationError,
   EmailVerificationManager,
   ExternalAuthOperationNotSupportedError,
@@ -5336,6 +6185,7 @@ export {
   InMemoryAuditLogStore,
   InMemoryChallengeStore,
   InMemoryEmailVerificationStore,
+  InMemoryLinkedIdentityStore,
   InMemoryOAuthStateStore,
   InMemoryOrgStore,
   InMemoryPasswordResetStore,
@@ -5368,6 +6218,8 @@ export {
   PasskeyVerificationError,
   PasswordResetError,
   PasswordResetManager,
+  PostgresLinkedIdentityStore,
+  PostgresOAuthStateStore,
   PostgresUserStore,
   ROLE_HIERARCHY,
   RbacEngine,
@@ -5382,6 +6234,8 @@ export {
   SessionManager,
   SessionMfaRequiredError,
   SessionNotFoundError,
+  SqliteLinkedIdentityStore,
+  SqliteOAuthStateStore,
   SqliteUserStore,
   TokenManager,
   TotpAlreadyEnabledError,
@@ -5400,7 +6254,14 @@ export {
   base32Encode,
   computePublicKeyThumbprint,
   createClerkAdapter,
+  createKoraAuthServer,
+  createPostgresLinkedIdentityStore,
+  createPostgresOAuthStateStore,
+  createPostgresOAuthStores,
   createPostgresUserStore,
+  createSqliteLinkedIdentityStore,
+  createSqliteOAuthStateStore,
+  createSqliteOAuthStores,
   createSqliteUserStore,
   createSupabaseAdapter,
   decodeJwt,