@korajs/auth 0.4.0 → 0.6.0

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   AuthClient: () => AuthClient,
+  AuthDeviceIdentityError: () => AuthDeviceIdentityError,
   AuthError: () => AuthError,
   AutoLockManager: () => AutoLockManager,
   CryptoUnavailableError: () => CryptoUnavailableError,
@@ -40,9 +41,18 @@ __export(index_exports, {
   PasskeyUnsupportedError: () => PasskeyUnsupportedError,
   TokenStore: () => TokenStore,
   authenticateWithPasskey: () => authenticateWithPasskey,
+  checkOrgPermission: () => checkOrgPermission,
   computePublicKeyThumbprint: () => computePublicKeyThumbprint,
+  createAuthSession: () => createAuthSession,
+  createAuthTokenStorage: () => createAuthTokenStorage,
   createDeviceKeyStore: () => createDeviceKeyStore,
+  createKoraAuth: () => createKoraAuth,
+  createKoraAuthSync: () => createKoraAuthSync,
+  createMemoryAuthTokenStorage: () => createMemoryAuthTokenStorage,
+  createOrgSession: () => createOrgSession,
   createPasskeyCredential: () => createPasskeyCredential,
+  createPersistentDeviceIdentity: () => createPersistentDeviceIdentity,
+  createWebStorageAuthTokenStorage: () => createWebStorageAuthTokenStorage,
   decryptData: () => decryptData,
   deriveEncryptionKey: () => deriveEncryptionKey,
   encryptData: () => encryptData,
@@ -99,6 +109,36 @@ function getUserIdFromToken(token) {
   }
   return payload.sub;
 }
+function getDefaultFetch() {
+  if (typeof globalThis.fetch !== "function") {
+    return async () => {
+      throw new AuthError(
+        "No fetch implementation is available in this runtime. Pass `fetch` to AuthClientConfig.",
+        "AUTH_FETCH_UNAVAILABLE"
+      );
+    };
+  }
+  return globalThis.fetch.bind(globalThis);
+}
+function normalizeAuthUser(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name ?? null
+  };
+}
+function canRedirectCurrentWindow() {
+  return typeof globalThis.window !== "undefined" && typeof globalThis.window.location?.assign === "function";
+}
+function redirectCurrentWindow(url) {
+  if (!canRedirectCurrentWindow()) {
+    throw new AuthError(
+      "OAuth redirect is not available in this runtime. Pass redirect: false and open the returned URL with your platform browser API.",
+      "AUTH_OAUTH_REDIRECT_UNAVAILABLE"
+    );
+  }
+  globalThis.window.location.assign(url);
+}
 function createTokenStorage(prefix) {
   let useLocalStorage = false;
   try {
@@ -152,6 +192,8 @@ function createTokenStorage(prefix) {
 var AuthClient = class {
   serverUrl;
   storage;
+  fetchFn;
+  deviceIdentity;
   listeners = /* @__PURE__ */ new Set();
   _state = "loading";
   _user = null;
@@ -165,7 +207,9 @@ var AuthClient = class {
   constructor(config) {
     this.serverUrl = config.serverUrl.replace(/\/+$/, "");
     const prefix = config.storageKey ?? "kora_auth";
-    this.storage = createTokenStorage(prefix);
+    this.storage = config.storage ?? createTokenStorage(prefix);
+    this.fetchFn = config.fetch ?? getDefaultFetch();
+    this.deviceIdentity = config.deviceIdentity;
   }
   // -----------------------------------------------------------------------
   // Public getters
@@ -197,8 +241,8 @@ var AuthClient = class {
       return;
     }
     this._initialized = true;
-    const accessToken = this.storage.getAccessToken();
-    const refreshToken = this.storage.getRefreshToken();
+    const accessToken = await this.storage.getAccessToken();
+    const refreshToken = await this.storage.getRefreshToken();
     if (!accessToken || !refreshToken) {
       this.setState("unauthenticated", null);
       return;
@@ -215,7 +259,7 @@ var AuthClient = class {
       }
     } catch {
     }
-    this.storage.clear();
+    await this.storage.clear();
     this.setState("unauthenticated", null);
   }
   // -----------------------------------------------------------------------
@@ -229,12 +273,13 @@ var AuthClient = class {
    * @throws {AuthError} If the request fails or the server returns an error
    */
   async signUp(params) {
+    const body = await this.withDeviceIdentity(params);
     const response = await this.request("/auth/signup", {
       method: "POST",
-      body: params
+      body
     });
     const tokens = "tokens" in response ? response.tokens : response;
-    this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
+    await this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
     const user = await this.fetchUserProfile(tokens.accessToken);
     this.setState("authenticated", user);
     return user;
@@ -247,16 +292,88 @@ var AuthClient = class {
    * @throws {AuthError} If the credentials are invalid or the request fails
    */
   async signIn(params) {
+    const body = await this.withDeviceIdentity(params);
     const response = await this.request("/auth/signin", {
       method: "POST",
-      body: params
+      body
     });
     const tokens = "tokens" in response ? response.tokens : response;
-    this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
+    await this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
     const user = await this.fetchUserProfile(tokens.accessToken);
     this.setState("authenticated", user);
     return user;
   }
+  /**
+   * Create an OAuth authorization URL and optionally redirect the current window.
+   *
+   * For web apps, call this from a button click and keep the default redirect behavior.
+   * For desktop/mobile, pass `redirect: false`, open the returned URL with the runtime's
+   * browser API, then call `completeOAuthSignIn()` after receiving the callback.
+   */
+  async signInWithOAuth(provider, options = {}) {
+    const result = await this.createOAuthAuthorization(provider, options);
+    if (options.redirect ?? canRedirectCurrentWindow()) {
+      redirectCurrentWindow(result.url);
+    }
+    return result;
+  }
+  /**
+   * Complete an OAuth sign-in callback and store the issued Kora tokens.
+   */
+  async completeOAuthSignIn(provider, params) {
+    const body = await this.withDeviceIdentity(params);
+    const response = await this.request(
+      `/auth/oauth/${encodeURIComponent(provider)}/callback`,
+      {
+        method: "POST",
+        body: { ...body }
+      }
+    );
+    await this.storage.setTokens(response.tokens.accessToken, response.tokens.refreshToken);
+    const user = normalizeAuthUser(response.user);
+    this.setState("authenticated", user);
+    return user;
+  }
+  /**
+   * Create an OAuth authorization URL for linking another provider to the current user.
+   */
+  async getOAuthAuthorizationUrl(provider, options = {}) {
+    return this.createOAuthAuthorization(provider, { ...options, redirect: false });
+  }
+  /**
+   * Link an OAuth provider to the current authenticated user.
+   */
+  async linkOAuth(provider, params) {
+    const token = await this.requireAccessToken();
+    return this.request(`/auth/oauth/${encodeURIComponent(provider)}/link`, {
+      method: "POST",
+      body: {
+        code: params.code,
+        state: params.state
+      },
+      token
+    });
+  }
+  /**
+   * List OAuth accounts linked to the current authenticated user.
+   */
+  async listLinkedAccounts() {
+    const token = await this.requireAccessToken();
+    return this.request("/auth/oauth/links", {
+      method: "GET",
+      token
+    });
+  }
+  /**
+   * Unlink an OAuth provider from the current authenticated user.
+   */
+  async unlinkOAuth(provider) {
+    const token = await this.requireAccessToken();
+    await this.request(`/auth/oauth/${encodeURIComponent(provider)}/link`, {
+      method: "DELETE",
+      token
+    });
+  }
   /**
    * Sign out the current user.
    *
@@ -265,9 +382,9 @@ var AuthClient = class {
    * stolen refresh tokens cannot be used after the user explicitly signs out.
    */
   async signOut() {
-    const accessToken = this.storage.getAccessToken();
-    const refreshToken = this.storage.getRefreshToken();
-    this.storage.clear();
+    const accessToken = await this.storage.getAccessToken();
+    const refreshToken = await this.storage.getRefreshToken();
+    await this.storage.clear();
     this._refreshPromise = null;
     this.setState("unauthenticated", null);
     if (accessToken) {
@@ -291,11 +408,11 @@ var AuthClient = class {
    *          authenticated and refresh is not possible
    */
   async getAccessToken() {
-    const accessToken = this.storage.getAccessToken();
+    const accessToken = await this.storage.getAccessToken();
     if (accessToken && !isTokenExpired(accessToken)) {
       return accessToken;
     }
-    const refreshToken = this.storage.getRefreshToken();
+    const refreshToken = await this.storage.getRefreshToken();
     if (!refreshToken) {
       return null;
     }
@@ -378,7 +495,7 @@ var AuthClient = class {
           name: null
         });
       } else {
-        this.storage.clear();
+        await this.storage.clear();
         this.setState("unauthenticated", null);
       }
     }
@@ -391,10 +508,47 @@ var AuthClient = class {
       method: "GET",
       token: accessToken
     });
+    return normalizeAuthUser(profile);
+  }
+  async createOAuthAuthorization(provider, options) {
+    const params = new URLSearchParams();
+    const withIdentity = await this.withDeviceIdentity({
+      deviceId: options.deviceId,
+      devicePublicKey: options.devicePublicKey
+    });
+    if (options.returnTo) {
+      params.set("returnTo", options.returnTo);
+    }
+    if (withIdentity.deviceId) {
+      params.set("deviceId", withIdentity.deviceId);
+    }
+    if (withIdentity.devicePublicKey) {
+      params.set("devicePublicKey", withIdentity.devicePublicKey);
+    }
+    if (options.metadata) {
+      for (const [key, value] of Object.entries(options.metadata)) {
+        if (value !== void 0 && value !== null) {
+          params.set(key, String(value));
+        }
+      }
+    }
+    const query = params.toString();
+    return this.request(
+      `/auth/oauth/${encodeURIComponent(provider)}${query ? `?${query}` : ""}`,
+      {
+        method: "GET"
+      }
+    );
+  }
+  async withDeviceIdentity(params) {
+    if (!this.deviceIdentity || params.deviceId && params.devicePublicKey) {
+      return params;
+    }
+    const identity = await this.deviceIdentity.getDeviceIdentity();
     return {
-      id: profile.id,
-      email: profile.email,
-      name: profile.name ?? null
+      ...params,
+      deviceId: params.deviceId ?? identity.deviceId,
+      devicePublicKey: params.devicePublicKey ?? identity.devicePublicKey
     };
   }
   /**
@@ -413,6 +567,13 @@ var AuthClient = class {
       this._refreshPromise = null;
     }
   }
+  async requireAccessToken() {
+    const token = await this.getAccessToken();
+    if (!token) {
+      throw new AuthError("You must be signed in to perform this action.", "AUTH_REQUIRED");
+    }
+    return token;
+  }
   /**
    * Execute the token refresh network request.
    */
@@ -422,10 +583,10 @@ var AuthClient = class {
         method: "POST",
         body: { refreshToken }
       });
-      this.storage.setTokens(response.accessToken, response.refreshToken);
+      await this.storage.setTokens(response.accessToken, response.refreshToken);
       return response.accessToken;
     } catch {
-      this.storage.clear();
+      await this.storage.clear();
       this.setState("unauthenticated", null);
       return null;
     }
@@ -449,7 +610,7 @@ var AuthClient = class {
     }
     let response;
     try {
-      response = await fetch(url, {
+      response = await this.fetchFn(url, {
         method: options.method,
         headers,
         body: options.body ? JSON.stringify(options.body) : void 0
@@ -487,637 +648,1026 @@ var AuthClient = class {
   }
 };
 
-// src/client/org-client.ts
+// src/client/device-session.ts
+var import_core4 = require("@korajs/core");
+
+// src/device/device-identity.ts
 var import_core2 = require("@korajs/core");
-var OrgClientError = class extends import_core2.KoraError {
-  constructor(message, code, context) {
-    super(message, code, context);
-    this.name = "OrgClientError";
+var CryptoUnavailableError = class extends import_core2.KoraError {
+  constructor() {
+    super(
+      "Web Crypto API (crypto.subtle) is not available in this environment. Device identity requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
+      "CRYPTO_UNAVAILABLE"
+    );
+    this.name = "CryptoUnavailableError";
   }
 };
-var OrgClient = class {
-  serverUrl;
-  getAccessToken;
-  listeners = /* @__PURE__ */ new Set();
-  _activeOrgId = null;
-  _activeOrg = null;
-  _activeRole = null;
-  constructor(config) {
-    this.serverUrl = config.serverUrl.replace(/\/+$/, "");
-    this.getAccessToken = config.getAccessToken;
+var DeviceIdentityError = class extends import_core2.KoraError {
+  constructor(message, context) {
+    super(message, "DEVICE_IDENTITY_ERROR", context);
+    this.name = "DeviceIdentityError";
   }
-  // --- Getters ---
-  /** Currently active organization ID */
-  get activeOrgId() {
-    return this._activeOrgId;
+};
+function toBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
   }
-  /** Currently active organization */
-  get activeOrg() {
-    return this._activeOrg;
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingNeeded = (4 - base64.length % 4) % 4;
+  base64 += "=".repeat(paddingNeeded);
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
   }
-  /** Current user's role in the active organization */
-  get activeRole() {
-    return this._activeRole;
+  return bytes;
+}
+function assertCryptoAvailable() {
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+    throw new CryptoUnavailableError();
   }
-  // --- Organization Operations ---
-  /**
-   * Create a new organization.
-   */
-  async createOrg(params) {
-    return this.request("/orgs", {
-      method: "POST",
-      body: params
-    });
+}
+var ECDSA_ALGORITHM = {
+  name: "ECDSA",
+  namedCurve: "P-256"
+};
+var ECDSA_SIGN_ALGORITHM = {
+  name: "ECDSA",
+  hash: { name: "SHA-256" }
+};
+async function generateDeviceKeyPair() {
+  assertCryptoAvailable();
+  try {
+    const keyPair = await globalThis.crypto.subtle.generateKey(
+      ECDSA_ALGORITHM,
+      // extractable: false makes the private key non-extractable.
+      // The public key is always extractable regardless of this flag.
+      false,
+      ["sign", "verify"]
+    );
+    return keyPair;
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to generate ECDSA P-256 device key pair. Ensure the runtime supports the ECDSA algorithm with the P-256 curve.",
+      { cause: cause instanceof Error ? cause.message : String(cause) }
+    );
   }
-  /**
-   * List all organizations the current user belongs to.
-   */
-  async listOrgs() {
-    return this.request("/orgs", { method: "GET" });
+}
+async function exportPublicKeyJwk(keyPair) {
+  assertCryptoAvailable();
+  try {
+    const jwk = await globalThis.crypto.subtle.exportKey("jwk", keyPair.publicKey);
+    return jwk;
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to export public key as JWK. The key pair may be invalid or the public key may not support JWK export.",
+      { cause: cause instanceof Error ? cause.message : String(cause) }
+    );
   }
-  /**
-   * Get an organization by ID.
-   */
-  async getOrg(orgId) {
-    return this.request(`/orgs/${orgId}`, { method: "GET" });
+}
+async function signChallenge(privateKey, challenge) {
+  assertCryptoAvailable();
+  try {
+    const encoded = new TextEncoder().encode(challenge);
+    const signatureBuffer = await globalThis.crypto.subtle.sign(
+      ECDSA_SIGN_ALGORITHM,
+      privateKey,
+      encoded
+    );
+    return toBase64Url(signatureBuffer);
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      'Failed to sign challenge. Ensure the key is a valid ECDSA P-256 private key with "sign" usage.',
+      { cause: cause instanceof Error ? cause.message : String(cause) }
+    );
   }
-  /**
-   * Update an organization.
-   */
-  async updateOrg(orgId, params) {
-    const result = await this.request(`/orgs/${orgId}`, {
-      method: "PATCH",
-      body: params
-    });
-    if (this._activeOrgId === orgId) {
-      this._activeOrg = result;
-    }
-    return result;
+}
+async function verifyChallenge(publicKeyJwk, challenge, signature) {
+  assertCryptoAvailable();
+  try {
+    const publicKey = await globalThis.crypto.subtle.importKey(
+      "jwk",
+      publicKeyJwk,
+      ECDSA_ALGORITHM,
+      true,
+      ["verify"]
+    );
+    const encoded = new TextEncoder().encode(challenge);
+    const signatureBytes = fromBase64Url(signature);
+    const isValid = await globalThis.crypto.subtle.verify(
+      ECDSA_SIGN_ALGORITHM,
+      publicKey,
+      signatureBytes,
+      encoded
+    );
+    return isValid;
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to verify challenge signature. The public key JWK or signature format may be invalid.",
+      {
+        cause: cause instanceof Error ? cause.message : String(cause),
+        publicKeyKty: publicKeyJwk.kty,
+        publicKeyCrv: publicKeyJwk.crv
+      }
+    );
   }
-  /**
-   * Delete an organization.
-   */
-  async deleteOrg(orgId) {
-    await this.request(`/orgs/${orgId}`, { method: "DELETE" });
-    if (this._activeOrgId === orgId) {
-      this._activeOrgId = null;
-      this._activeOrg = null;
-      this._activeRole = null;
-      this.notifyListeners();
-    }
+}
+async function computePublicKeyThumbprint(publicKeyJwk) {
+  assertCryptoAvailable();
+  if (publicKeyJwk.kty !== "EC") {
+    throw new DeviceIdentityError(
+      `Expected JWK key type "EC" but received "${publicKeyJwk.kty ?? "undefined"}". Only ECDSA public keys are supported for device identity.`,
+      { kty: publicKeyJwk.kty }
+    );
   }
-  // --- Org Switching ---
-  /**
-   * Switch the active organization context.
-   * Fetches the org details and the user's membership/role.
-   */
-  async switchOrg(orgId) {
-    const org = await this.request(`/orgs/${orgId}`, { method: "GET" });
-    const membership = await this.request(`/orgs/${orgId}/membership`, {
-      method: "GET"
-    });
-    this._activeOrgId = orgId;
-    this._activeOrg = org;
-    this._activeRole = membership.role;
-    this.notifyListeners();
-  }
-  /**
-   * Clear the active organization (no org selected).
-   */
-  clearActiveOrg() {
-    this._activeOrgId = null;
-    this._activeOrg = null;
-    this._activeRole = null;
-    this.notifyListeners();
+  if (!publicKeyJwk.crv || !publicKeyJwk.x || !publicKeyJwk.y) {
+    throw new DeviceIdentityError(
+      'JWK is missing required EC fields. An EC public key JWK must include "crv", "x", and "y" members.',
+      {
+        hasCrv: Boolean(publicKeyJwk.crv),
+        hasX: Boolean(publicKeyJwk.x),
+        hasY: Boolean(publicKeyJwk.y)
+      }
+    );
   }
-  // --- Member Management ---
-  /**
-   * List members of an organization.
-   */
-  async listMembers(orgId) {
-    return this.request(`/orgs/${orgId}/members`, { method: "GET" });
+  const canonicalJson = JSON.stringify({
+    crv: publicKeyJwk.crv,
+    kty: publicKeyJwk.kty,
+    x: publicKeyJwk.x,
+    y: publicKeyJwk.y
+  });
+  try {
+    const encoded = new TextEncoder().encode(canonicalJson);
+    const hashBuffer = await globalThis.crypto.subtle.digest("SHA-256", encoded);
+    return toBase64Url(hashBuffer);
+  } catch (cause) {
+    throw new DeviceIdentityError("Failed to compute SHA-256 thumbprint of the public key JWK.", {
+      cause: cause instanceof Error ? cause.message : String(cause)
+    });
   }
-  /**
-   * Remove a member from an organization.
-   */
-  async removeMember(orgId, userId) {
-    await this.request(`/orgs/${orgId}/members/${userId}`, { method: "DELETE" });
+}
+
+// src/device/device-store.ts
+var import_core3 = require("@korajs/core");
+var DeviceKeyStoreError = class extends import_core3.KoraError {
+  constructor(message, context) {
+    super(message, "DEVICE_KEY_STORE_ERROR", context);
+    this.name = "DeviceKeyStoreError";
   }
+};
+var IDB_DATABASE_NAME = "kora_device_keys";
+var IDB_STORE_NAME = "keypairs";
+var IDB_VERSION = 1;
+var IndexedDBDeviceKeyStore = class {
+  dbPromise = null;
   /**
-   * Update a member's role.
+   * Opens (or creates) the IndexedDB database.
+   *
+   * The database connection is lazily initialized on first use and
+   * reused for subsequent operations. If the database does not exist,
+   * it is created with the `keypairs` object store.
    */
-  async updateMemberRole(orgId, userId, role) {
-    return this.request(`/orgs/${orgId}/members/${userId}/role`, {
-      method: "PATCH",
-      body: { role }
+  openDatabase() {
+    if (this.dbPromise !== null) {
+      return this.dbPromise;
+    }
+    this.dbPromise = new Promise((resolve, reject) => {
+      let request;
+      try {
+        request = globalThis.indexedDB.open(IDB_DATABASE_NAME, IDB_VERSION);
+      } catch (cause) {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError(
+            "Failed to open IndexedDB database for device key storage. IndexedDB may be unavailable or access may be denied.",
+            { cause: cause instanceof Error ? cause.message : String(cause) }
+          )
+        );
+        return;
+      }
+      request.onupgradeneeded = () => {
+        const db = request.result;
+        if (!db.objectStoreNames.contains(IDB_STORE_NAME)) {
+          db.createObjectStore(IDB_STORE_NAME);
+        }
+      };
+      request.onsuccess = () => {
+        resolve(request.result);
+      };
+      request.onerror = () => {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError("Failed to open IndexedDB database for device key storage.", {
+            error: request.error?.message
+          })
+        );
+      };
+      request.onblocked = () => {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError(
+            "IndexedDB database open was blocked. Another tab may have an older version of the database open. Close other tabs and try again."
+          )
+        );
+      };
     });
+    return this.dbPromise;
   }
-  /**
-   * Transfer ownership to another member.
-   */
-  async transferOwnership(orgId, newOwnerId) {
-    await this.request(`/orgs/${orgId}/transfer`, {
-      method: "POST",
-      body: { newOwnerId }
+  /** @inheritdoc */
+  async saveKeyPair(deviceId, keyPair) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        store.put(keyPair, deviceId);
+        tx.oncomplete = () => {
+          resolve();
+        };
+        tx.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
+              deviceId,
+              error: tx.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
     });
   }
-  /**
-   * Leave an organization (remove yourself).
-   */
-  async leaveOrg(orgId) {
-    await this.request(`/orgs/${orgId}/leave`, { method: "POST" });
-    if (this._activeOrgId === orgId) {
-      this._activeOrgId = null;
-      this._activeOrg = null;
-      this._activeRole = null;
-      this.notifyListeners();
-    }
+  /** @inheritdoc */
+  async loadKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readonly");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        const request = store.get(deviceId);
+        request.onsuccess = () => {
+          const result = request.result;
+          resolve(result ?? null);
+        };
+        request.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
+              deviceId,
+              error: request.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
+    });
   }
-  // --- Invitations ---
-  /**
-   * Invite a user to an organization by email.
-   */
-  async inviteMember(orgId, params) {
-    return this.request(`/orgs/${orgId}/invitations`, {
-      method: "POST",
-      body: params
+  /** @inheritdoc */
+  async deleteKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        store.delete(deviceId);
+        tx.oncomplete = () => {
+          resolve();
+        };
+        tx.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
+              deviceId,
+              error: tx.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
     });
   }
-  /**
-   * Accept an invitation by token.
-   */
-  async acceptInvitation(token) {
-    return this.request("/invitations/accept", {
-      method: "POST",
-      body: { token }
+  /** @inheritdoc */
+  async hasKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readonly");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        const request = store.count(deviceId);
+        request.onsuccess = () => {
+          resolve(request.result > 0);
+        };
+        request.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(
+              `Failed to check if key pair exists for device "${deviceId}".`,
+              { deviceId, error: request.error?.message }
+            )
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to check if key pair exists for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
     });
   }
-  /**
-   * List pending invitations for an organization.
-   */
-  async listInvitations(orgId) {
-    return this.request(`/orgs/${orgId}/invitations`, { method: "GET" });
+};
+var InMemoryDeviceKeyStore = class {
+  store = /* @__PURE__ */ new Map();
+  /** @inheritdoc */
+  async saveKeyPair(deviceId, keyPair) {
+    this.store.set(deviceId, keyPair);
   }
-  /**
-   * Revoke a pending invitation.
-   */
-  async revokeInvitation(orgId, invitationId) {
-    await this.request(`/orgs/${orgId}/invitations/${invitationId}`, { method: "DELETE" });
+  /** @inheritdoc */
+  async loadKeyPair(deviceId) {
+    return this.store.get(deviceId) ?? null;
+  }
+  /** @inheritdoc */
+  async deleteKeyPair(deviceId) {
+    this.store.delete(deviceId);
   }
-  /**
-   * List pending invitations for the current user's email.
-   */
-  async listMyInvitations(email) {
-    return this.request(`/invitations?email=${encodeURIComponent(email)}`, {
-      method: "GET"
-    });
+  /** @inheritdoc */
+  async hasKeyPair(deviceId) {
+    return this.store.has(deviceId);
   }
-  // --- Subscriptions ---
-  /**
-   * Subscribe to active org changes.
-   * @returns Unsubscribe function
-   */
-  onOrgChange(callback) {
-    this.listeners.add(callback);
-    return () => {
-      this.listeners.delete(callback);
-    };
+};
+function createDeviceKeyStore() {
+  if (typeof globalThis.indexedDB !== "undefined") {
+    return new IndexedDBDeviceKeyStore();
   }
-  // --- Internal ---
-  notifyListeners() {
-    for (const listener of this.listeners) {
-      try {
-        listener(this._activeOrgId);
-      } catch {
+  return new InMemoryDeviceKeyStore();
+}
+
+// src/client/device-session.ts
+var DEFAULT_DEVICE_ID_KEY = "kora_auth_device_id";
+var AuthDeviceIdentityError = class extends import_core4.KoraError {
+  constructor(message, context) {
+    super(message, "AUTH_DEVICE_IDENTITY_ERROR", context);
+    this.name = "AuthDeviceIdentityError";
+  }
+};
+function createPersistentDeviceIdentity(options) {
+  const storage = options.storage;
+  const keyStore = options.keyStore ?? createDefaultPersistentKeyStore();
+  const deviceIdKey = options.deviceIdKey ?? DEFAULT_DEVICE_ID_KEY;
+  const generateDeviceId = options.generateDeviceId ?? defaultDeviceId;
+  return {
+    async getDeviceIdentity() {
+      let deviceId = await storage.getItem(deviceIdKey);
+      if (!deviceId) {
+        deviceId = generateDeviceId();
+        await storage.setItem(deviceIdKey, deviceId);
       }
+      let keyPair = await keyStore.loadKeyPair(deviceId);
+      if (!keyPair) {
+        keyPair = await generateDeviceKeyPair();
+        await keyStore.saveKeyPair(deviceId, keyPair);
+      }
+      const publicKey = await exportPublicKeyJwk(keyPair);
+      return {
+        deviceId,
+        devicePublicKey: JSON.stringify(publicKey)
+      };
     }
+  };
+}
+function createDefaultPersistentKeyStore() {
+  if (typeof globalThis.indexedDB !== "undefined") {
+    return createDeviceKeyStore();
   }
-  async request(path, options) {
-    const token = await this.getAccessToken();
-    if (!token) {
-      throw new OrgClientError(
-        "Not authenticated. Sign in before performing organization operations.",
-        "ORG_NOT_AUTHENTICATED"
-      );
-    }
-    const url = `${this.serverUrl}${path}`;
-    const headers = {
-      Authorization: `Bearer ${token}`
-    };
-    if (options.body) {
-      headers["Content-Type"] = "application/json";
+  throw new AuthDeviceIdentityError(
+    "No persistent device key store is available in this runtime. Pass `keyStore` to createPersistentDeviceIdentity()."
+  );
+}
+function defaultDeviceId() {
+  if (typeof globalThis.crypto?.randomUUID === "function") {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = new Uint8Array(16);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) {
+      bytes[i] = Math.floor(Math.random() * 256);
     }
-    let response;
-    try {
-      response = await fetch(url, {
-        method: options.method,
-        headers,
-        body: options.body ? JSON.stringify(options.body) : void 0
-      });
-    } catch (cause) {
-      throw new OrgClientError(`Network request to ${path} failed.`, "ORG_NETWORK_ERROR", {
-        path,
-        cause: cause instanceof Error ? cause.message : String(cause)
-      });
+  }
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
+// src/client/storage.ts
+function createAuthTokenStorage(options) {
+  const prefix = options.prefix ?? "kora_auth";
+  const accessKey = `${prefix}_access_token`;
+  const refreshKey = `${prefix}_refresh_token`;
+  const store = options.store;
+  return {
+    getAccessToken: () => store.getItem(accessKey),
+    getRefreshToken: () => store.getItem(refreshKey),
+    async setTokens(accessToken, refreshToken) {
+      await store.setItem(accessKey, accessToken);
+      await store.setItem(refreshKey, refreshToken);
+    },
+    async clear() {
+      await store.removeItem(accessKey);
+      await store.removeItem(refreshKey);
     }
-    if (!response.ok) {
-      let errorMessage = `Server returned HTTP ${response.status}`;
-      try {
-        const body = await response.json();
-        if (typeof body.error === "string") {
-          errorMessage = body.error;
-        }
-      } catch {
-      }
-      throw new OrgClientError(errorMessage, "ORG_SERVER_ERROR", {
-        path,
-        status: response.status
-      });
+  };
+}
+function createMemoryAuthTokenStorage() {
+  let accessToken = null;
+  let refreshToken = null;
+  return {
+    getAccessToken: () => accessToken,
+    getRefreshToken: () => refreshToken,
+    setTokens(access, refresh) {
+      accessToken = access;
+      refreshToken = refresh;
+    },
+    clear() {
+      accessToken = null;
+      refreshToken = null;
     }
-    const text = await response.text();
-    if (text.length === 0) return void 0;
-    try {
-      const body = JSON.parse(text);
-      if (body && typeof body === "object" && "data" in body) {
-        return body.data;
+  };
+}
+function createWebStorageAuthTokenStorage(storage, prefix) {
+  return createAuthTokenStorage({
+    prefix,
+    store: {
+      getItem: (key) => storage.getItem(key),
+      setItem: (key, value) => {
+        storage.setItem(key, value);
+      },
+      removeItem: (key) => {
+        storage.removeItem(key);
       }
-      return body;
-    } catch {
-      return void 0;
     }
-  }
-};
+  });
+}
 
-// src/device/device-identity.ts
-var import_core3 = require("@korajs/core");
-var CryptoUnavailableError = class extends import_core3.KoraError {
-  constructor() {
-    super(
-      "Web Crypto API (crypto.subtle) is not available in this environment. Device identity requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
-      "CRYPTO_UNAVAILABLE"
-    );
-    this.name = "CryptoUnavailableError";
-  }
-};
-var DeviceIdentityError = class extends import_core3.KoraError {
-  constructor(message, context) {
-    super(message, "DEVICE_IDENTITY_ERROR", context);
-    this.name = "DeviceIdentityError";
-  }
-};
-function toBase64Url(buffer) {
-  const bytes = new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+// src/client/quickstart.ts
+function createKoraAuth(options) {
+  const storage = options.storage ?? (options.credentialStore ? createAuthTokenStorage({
+    store: options.credentialStore,
+    prefix: options.storageKey
+  }) : tryCreateDefaultTokenStorage(options.storageKey));
+  const deviceIdentity = options.deviceIdentity === false ? void 0 : options.deviceIdentity ?? tryCreateDefaultDeviceIdentity(options.credentialStore, options.deviceKeyStore);
+  return new AuthClient({
+    serverUrl: options.serverUrl,
+    storageKey: options.storageKey,
+    storage,
+    fetch: options.fetch,
+    deviceIdentity
+  });
 }
-function fromBase64Url(str) {
-  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
-  const paddingNeeded = (4 - base64.length % 4) % 4;
-  base64 += "=".repeat(paddingNeeded);
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
+function tryCreateDefaultTokenStorage(storageKey) {
+  const storage = tryGetBrowserStorage();
+  return storage ? createWebStorageAuthTokenStorage(storage, storageKey) : void 0;
 }
-function assertCryptoAvailable() {
-  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
-    throw new CryptoUnavailableError();
+function tryCreateDefaultDeviceIdentity(credentialStore, deviceKeyStore) {
+  const storage = credentialStore ?? tryGetBrowserStorage();
+  if (!storage) {
+    return void 0;
   }
-}
-var ECDSA_ALGORITHM = {
-  name: "ECDSA",
-  namedCurve: "P-256"
-};
-var ECDSA_SIGN_ALGORITHM = {
-  name: "ECDSA",
-  hash: { name: "SHA-256" }
-};
-async function generateDeviceKeyPair() {
-  assertCryptoAvailable();
   try {
-    const keyPair = await globalThis.crypto.subtle.generateKey(
-      ECDSA_ALGORITHM,
-      // extractable: false makes the private key non-extractable.
-      // The public key is always extractable regardless of this flag.
-      false,
-      ["sign", "verify"]
-    );
-    return keyPair;
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to generate ECDSA P-256 device key pair. Ensure the runtime supports the ECDSA algorithm with the P-256 curve.",
-      { cause: cause instanceof Error ? cause.message : String(cause) }
-    );
+    return createPersistentDeviceIdentity({
+      storage,
+      keyStore: deviceKeyStore
+    });
+  } catch {
+    return void 0;
   }
 }
-async function exportPublicKeyJwk(keyPair) {
-  assertCryptoAvailable();
+function tryGetBrowserStorage() {
   try {
-    const jwk = await globalThis.crypto.subtle.exportKey("jwk", keyPair.publicKey);
-    return jwk;
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to export public key as JWK. The key pair may be invalid or the public key may not support JWK export.",
-      { cause: cause instanceof Error ? cause.message : String(cause) }
-    );
+    if (typeof globalThis.localStorage === "undefined") {
+      return null;
+    }
+    const key = "__kora_auth_quickstart_test__";
+    globalThis.localStorage.setItem(key, "1");
+    globalThis.localStorage.removeItem(key);
+    return globalThis.localStorage;
+  } catch {
+    return null;
   }
 }
-async function signChallenge(privateKey, challenge) {
-  assertCryptoAvailable();
-  try {
-    const encoded = new TextEncoder().encode(challenge);
-    const signatureBuffer = await globalThis.crypto.subtle.sign(
-      ECDSA_SIGN_ALGORITHM,
-      privateKey,
-      encoded
-    );
-    return toBase64Url(signatureBuffer);
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      'Failed to sign challenge. Ensure the key is a valid ECDSA P-256 private key with "sign" usage.',
-      { cause: cause instanceof Error ? cause.message : String(cause) }
-    );
+
+// src/client/auth-sync.ts
+var import_core5 = require("@korajs/core");
+function decodeJwtPayload2(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
   }
-}
-async function verifyChallenge(publicKeyJwk, challenge, signature) {
-  assertCryptoAvailable();
-  try {
-    const publicKey = await globalThis.crypto.subtle.importKey(
-      "jwk",
-      publicKeyJwk,
-      ECDSA_ALGORITHM,
-      true,
-      ["verify"]
-    );
-    const encoded = new TextEncoder().encode(challenge);
-    const signatureBytes = fromBase64Url(signature);
-    const isValid = await globalThis.crypto.subtle.verify(
-      ECDSA_SIGN_ALGORITHM,
-      publicKey,
-      signatureBytes,
-      encoded
-    );
-    return isValid;
-  } catch (cause) {
-    throw new DeviceIdentityError(
-      "Failed to verify challenge signature. The public key JWK or signature format may be invalid.",
-      {
-        cause: cause instanceof Error ? cause.message : String(cause),
-        publicKeyKty: publicKeyJwk.kty,
-        publicKeyCrv: publicKeyJwk.crv
-      }
-    );
+  const payloadSegment = parts[1];
+  if (payloadSegment === void 0) {
+    return null;
   }
-}
-async function computePublicKeyThumbprint(publicKeyJwk) {
-  assertCryptoAvailable();
-  if (publicKeyJwk.kty !== "EC") {
-    throw new DeviceIdentityError(
-      `Expected JWK key type "EC" but received "${publicKeyJwk.kty ?? "undefined"}". Only ECDSA public keys are supported for device identity.`,
-      { kty: publicKeyJwk.kty }
-    );
+  try {
+    const base64 = payloadSegment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+    const json = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf-8");
+    const parsed = JSON.parse(json);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
   }
-  if (!publicKeyJwk.crv || !publicKeyJwk.x || !publicKeyJwk.y) {
-    throw new DeviceIdentityError(
-      'JWK is missing required EC fields. An EC public key JWK must include "crv", "x", and "y" members.',
-      {
-        hasCrv: Boolean(publicKeyJwk.crv),
-        hasX: Boolean(publicKeyJwk.x),
-        hasY: Boolean(publicKeyJwk.y)
+}
+function readDeviceIdFromClaims(claims) {
+  const dev = claims.dev;
+  return typeof dev === "string" && dev.length > 0 ? dev : void 0;
+}
+function createKoraAuthSync(options) {
+  const { authClient, schema, scopeFromClaims } = options;
+  const binding = {
+    auth: async () => {
+      const token = await authClient.getAccessToken();
+      return { token: token ?? "" };
+    }
+  };
+  if (schema) {
+    binding.resolveScopeMap = async () => {
+      const token = await authClient.getAccessToken();
+      if (!token) {
+        return void 0;
       }
-    );
+      const claims = decodeJwtPayload2(token);
+      if (!claims) {
+        return void 0;
+      }
+      const scopeValues = scopeFromClaims ? scopeFromClaims(claims) : (0, import_core5.extractScopeValuesFromClaims)(schema, claims);
+      return (0, import_core5.buildScopeMap)(schema, scopeValues);
+    };
   }
-  const canonicalJson = JSON.stringify({
-    crv: publicKeyJwk.crv,
-    kty: publicKeyJwk.kty,
-    x: publicKeyJwk.x,
-    y: publicKeyJwk.y
-  });
-  try {
-    const encoded = new TextEncoder().encode(canonicalJson);
-    const hashBuffer = await globalThis.crypto.subtle.digest("SHA-256", encoded);
-    return toBase64Url(hashBuffer);
-  } catch (cause) {
-    throw new DeviceIdentityError("Failed to compute SHA-256 thumbprint of the public key JWK.", {
-      cause: cause instanceof Error ? cause.message : String(cause)
+  binding.resolveNodeId = async () => {
+    const token = await authClient.getAccessToken();
+    if (!token) {
+      return void 0;
+    }
+    const claims = decodeJwtPayload2(token);
+    if (!claims) {
+      return void 0;
+    }
+    return readDeviceIdFromClaims(claims);
+  };
+  if (authClient.onAuthChange) {
+    binding.subscribe = (listener) => authClient.onAuthChange?.(() => listener()) ?? (() => {
     });
   }
+  return binding;
 }
 
-// src/device/device-store.ts
-var import_core4 = require("@korajs/core");
-var DeviceKeyStoreError = class extends import_core4.KoraError {
-  constructor(message, context) {
-    super(message, "DEVICE_KEY_STORE_ERROR", context);
-    this.name = "DeviceKeyStoreError";
+// src/bindings/create-auth-session.ts
+function createAuthSession(client) {
+  let state = client.state;
+  let isLoading = true;
+  let initError = null;
+  let lastError = null;
+  const listeners = /* @__PURE__ */ new Set();
+  let snapshot = buildSnapshot2();
+  const refreshSnapshot = () => {
+    snapshot = buildSnapshot2();
+  };
+  const notify = () => {
+    refreshSnapshot();
+    for (const listener of listeners) {
+      listener();
+    }
+  };
+  function buildSnapshot2() {
+    return {
+      state,
+      user: client.currentUser,
+      isAuthenticated: state === "authenticated",
+      isLoading,
+      initError,
+      error: lastError
+    };
   }
-};
-var IDB_DATABASE_NAME = "kora_device_keys";
-var IDB_STORE_NAME = "keypairs";
-var IDB_VERSION = 1;
-var IndexedDBDeviceKeyStore = class {
-  dbPromise = null;
-  /**
-   * Opens (or creates) the IndexedDB database.
-   *
-   * The database connection is lazily initialized on first use and
-   * reused for subsequent operations. If the database does not exist,
-   * it is created with the `keypairs` object store.
-   */
-  openDatabase() {
-    if (this.dbPromise !== null) {
-      return this.dbPromise;
+  const captureError = (error) => {
+    lastError = error instanceof Error ? error.message : String(error);
+    notify();
+  };
+  const run = async (action) => {
+    lastError = null;
+    try {
+      await action();
+    } catch (error) {
+      captureError(error);
     }
-    this.dbPromise = new Promise((resolve, reject) => {
-      let request;
+  };
+  const runWithResult = async (action) => {
+    lastError = null;
+    try {
+      return await action();
+    } catch (error) {
+      captureError(error);
+      return null;
+    }
+  };
+  const unsubscribeAuth = client.onAuthChange((nextState) => {
+    state = nextState;
+    notify();
+  });
+  void client.initialize().then(() => {
+    state = client.state;
+    isLoading = false;
+    notify();
+  }).catch((error) => {
+    initError = error instanceof Error ? error : new Error(String(error));
+    isLoading = false;
+    notify();
+  });
+  return {
+    client,
+    getSnapshot: () => snapshot,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    signUp: (params) => run(async () => {
+      await client.signUp(params);
+    }),
+    signIn: (params) => run(async () => {
+      await client.signIn(params);
+    }),
+    signInWithOAuth: async (provider, options) => {
+      lastError = null;
       try {
-        request = globalThis.indexedDB.open(IDB_DATABASE_NAME, IDB_VERSION);
-      } catch (cause) {
-        this.dbPromise = null;
-        reject(
-          new DeviceKeyStoreError(
-            "Failed to open IndexedDB database for device key storage. IndexedDB may be unavailable or access may be denied.",
-            { cause: cause instanceof Error ? cause.message : String(cause) }
-          )
-        );
-        return;
+        return await client.signInWithOAuth(provider, options);
+      } catch (error) {
+        captureError(error);
+        throw error instanceof Error ? error : new Error(String(error));
       }
-      request.onupgradeneeded = () => {
-        const db = request.result;
-        if (!db.objectStoreNames.contains(IDB_STORE_NAME)) {
-          db.createObjectStore(IDB_STORE_NAME);
-        }
-      };
-      request.onsuccess = () => {
-        resolve(request.result);
-      };
-      request.onerror = () => {
-        this.dbPromise = null;
-        reject(
-          new DeviceKeyStoreError("Failed to open IndexedDB database for device key storage.", {
-            error: request.error?.message
-          })
-        );
-      };
-      request.onblocked = () => {
-        this.dbPromise = null;
-        reject(
-          new DeviceKeyStoreError(
-            "IndexedDB database open was blocked. Another tab may have an older version of the database open. Close other tabs and try again."
-          )
-        );
+    },
+    completeOAuthSignIn: (provider, params) => run(async () => {
+      await client.completeOAuthSignIn(provider, params);
+    }),
+    getOAuthAuthorizationUrl: async (provider, options) => {
+      lastError = null;
+      try {
+        return await client.getOAuthAuthorizationUrl(provider, options);
+      } catch (error) {
+        captureError(error);
+        throw error instanceof Error ? error : new Error(String(error));
+      }
+    },
+    linkOAuth: (provider, params) => runWithResult(async () => client.linkOAuth(provider, params)),
+    listLinkedAccounts: () => runWithResult(async () => client.listLinkedAccounts()).then((value) => value ?? []),
+    unlinkOAuth: (provider) => run(async () => {
+      await client.unlinkOAuth(provider);
+    }),
+    signOut: () => run(async () => {
+      await client.signOut();
+    }),
+    destroy() {
+      unsubscribeAuth();
+      listeners.clear();
+    }
+  };
+}
+
+// src/bindings/create-org-session.ts
+var ROLE_LEVELS = {
+  viewer: 10,
+  billing: 15,
+  member: 20,
+  admin: 30,
+  owner: 40
+};
+function checkOrgPermission(currentRole, requiredRole) {
+  if (!currentRole) return false;
+  const currentLevel = ROLE_LEVELS[currentRole] ?? 0;
+  const requiredLevel = ROLE_LEVELS[requiredRole] ?? 0;
+  return currentLevel >= requiredLevel;
+}
+function createOrgSession(client) {
+  let snapshot = buildSnapshot(client);
+  const listeners = /* @__PURE__ */ new Set();
+  const notify = () => {
+    snapshot = buildSnapshot(client);
+    for (const listener of listeners) {
+      listener();
+    }
+  };
+  const unsubscribeOrgChange = client.onOrgChange(notify);
+  return {
+    client,
+    getSnapshot: () => snapshot,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
       };
+    },
+    checkPermission(requiredRole) {
+      return checkOrgPermission(snapshot.role, requiredRole);
+    },
+    destroy() {
+      unsubscribeOrgChange();
+      listeners.clear();
+    }
+  };
+}
+function buildSnapshot(client) {
+  return {
+    orgId: client.activeOrgId,
+    org: client.activeOrg,
+    role: client.activeRole
+  };
+}
+
+// src/client/org-client.ts
+var import_core6 = require("@korajs/core");
+var OrgClientError = class extends import_core6.KoraError {
+  constructor(message, code, context) {
+    super(message, code, context);
+    this.name = "OrgClientError";
+  }
+};
+var OrgClient = class {
+  serverUrl;
+  getAccessToken;
+  listeners = /* @__PURE__ */ new Set();
+  _activeOrgId = null;
+  _activeOrg = null;
+  _activeRole = null;
+  constructor(config) {
+    this.serverUrl = config.serverUrl.replace(/\/+$/, "");
+    this.getAccessToken = config.getAccessToken;
+  }
+  // --- Getters ---
+  /** Currently active organization ID */
+  get activeOrgId() {
+    return this._activeOrgId;
+  }
+  /** Currently active organization */
+  get activeOrg() {
+    return this._activeOrg;
+  }
+  /** Current user's role in the active organization */
+  get activeRole() {
+    return this._activeRole;
+  }
+  // --- Organization Operations ---
+  /**
+   * Create a new organization.
+   */
+  async createOrg(params) {
+    return this.request("/orgs", {
+      method: "POST",
+      body: params
     });
-    return this.dbPromise;
   }
-  /** @inheritdoc */
-  async saveKeyPair(deviceId, keyPair) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        store.put(keyPair, deviceId);
-        tx.oncomplete = () => {
-          resolve();
-        };
-        tx.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
-              deviceId,
-              error: tx.error?.message
-            })
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
-            deviceId,
-            cause: cause instanceof Error ? cause.message : String(cause)
-          })
-        );
-      }
+  /**
+   * List all organizations the current user belongs to.
+   */
+  async listOrgs() {
+    return this.request("/orgs", { method: "GET" });
+  }
+  /**
+   * Get an organization by ID.
+   */
+  async getOrg(orgId) {
+    return this.request(`/orgs/${orgId}`, { method: "GET" });
+  }
+  /**
+   * Update an organization.
+   */
+  async updateOrg(orgId, params) {
+    const result = await this.request(`/orgs/${orgId}`, {
+      method: "PATCH",
+      body: params
+    });
+    if (this._activeOrgId === orgId) {
+      this._activeOrg = result;
+    }
+    return result;
+  }
+  /**
+   * Delete an organization.
+   */
+  async deleteOrg(orgId) {
+    await this.request(`/orgs/${orgId}`, { method: "DELETE" });
+    if (this._activeOrgId === orgId) {
+      this._activeOrgId = null;
+      this._activeOrg = null;
+      this._activeRole = null;
+      this.notifyListeners();
+    }
+  }
+  // --- Org Switching ---
+  /**
+   * Switch the active organization context.
+   * Fetches the org details and the user's membership/role.
+   */
+  async switchOrg(orgId) {
+    const org = await this.request(`/orgs/${orgId}`, { method: "GET" });
+    const membership = await this.request(`/orgs/${orgId}/membership`, {
+      method: "GET"
+    });
+    this._activeOrgId = orgId;
+    this._activeOrg = org;
+    this._activeRole = membership.role;
+    this.notifyListeners();
+  }
+  /**
+   * Clear the active organization (no org selected).
+   */
+  clearActiveOrg() {
+    this._activeOrgId = null;
+    this._activeOrg = null;
+    this._activeRole = null;
+    this.notifyListeners();
+  }
+  // --- Member Management ---
+  /**
+   * List members of an organization.
+   */
+  async listMembers(orgId) {
+    return this.request(`/orgs/${orgId}/members`, { method: "GET" });
+  }
+  /**
+   * Remove a member from an organization.
+   */
+  async removeMember(orgId, userId) {
+    await this.request(`/orgs/${orgId}/members/${userId}`, { method: "DELETE" });
+  }
+  /**
+   * Update a member's role.
+   */
+  async updateMemberRole(orgId, userId, role) {
+    return this.request(`/orgs/${orgId}/members/${userId}/role`, {
+      method: "PATCH",
+      body: { role }
     });
   }
-  /** @inheritdoc */
-  async loadKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readonly");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        const request = store.get(deviceId);
-        request.onsuccess = () => {
-          const result = request.result;
-          resolve(result ?? null);
-        };
-        request.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
-              deviceId,
-              error: request.error?.message
-            })
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
-            deviceId,
-            cause: cause instanceof Error ? cause.message : String(cause)
-          })
-        );
-      }
+  /**
+   * Transfer ownership to another member.
+   */
+  async transferOwnership(orgId, newOwnerId) {
+    await this.request(`/orgs/${orgId}/transfer`, {
+      method: "POST",
+      body: { newOwnerId }
     });
   }
-  /** @inheritdoc */
-  async deleteKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        store.delete(deviceId);
-        tx.oncomplete = () => {
-          resolve();
-        };
-        tx.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
-              deviceId,
-              error: tx.error?.message
-            })
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
-            deviceId,
-            cause: cause instanceof Error ? cause.message : String(cause)
-          })
-        );
-      }
+  /**
+   * Leave an organization (remove yourself).
+   */
+  async leaveOrg(orgId) {
+    await this.request(`/orgs/${orgId}/leave`, { method: "POST" });
+    if (this._activeOrgId === orgId) {
+      this._activeOrgId = null;
+      this._activeOrg = null;
+      this._activeRole = null;
+      this.notifyListeners();
+    }
+  }
+  // --- Invitations ---
+  /**
+   * Invite a user to an organization by email.
+   */
+  async inviteMember(orgId, params) {
+    return this.request(`/orgs/${orgId}/invitations`, {
+      method: "POST",
+      body: params
     });
   }
-  /** @inheritdoc */
-  async hasKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readonly");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        const request = store.count(deviceId);
-        request.onsuccess = () => {
-          resolve(request.result > 0);
-        };
-        request.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(
-              `Failed to check if key pair exists for device "${deviceId}".`,
-              { deviceId, error: request.error?.message }
-            )
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(`Failed to check if key pair exists for device "${deviceId}".`, {
-            deviceId,
-            cause: cause instanceof Error ? cause.message : String(cause)
-          })
-        );
-      }
+  /**
+   * Accept an invitation by token.
+   */
+  async acceptInvitation(token) {
+    return this.request("/invitations/accept", {
+      method: "POST",
+      body: { token }
     });
   }
-};
-var InMemoryDeviceKeyStore = class {
-  store = /* @__PURE__ */ new Map();
-  /** @inheritdoc */
-  async saveKeyPair(deviceId, keyPair) {
-    this.store.set(deviceId, keyPair);
+  /**
+   * List pending invitations for an organization.
+   */
+  async listInvitations(orgId) {
+    return this.request(`/orgs/${orgId}/invitations`, { method: "GET" });
   }
-  /** @inheritdoc */
-  async loadKeyPair(deviceId) {
-    return this.store.get(deviceId) ?? null;
+  /**
+   * Revoke a pending invitation.
+   */
+  async revokeInvitation(orgId, invitationId) {
+    await this.request(`/orgs/${orgId}/invitations/${invitationId}`, { method: "DELETE" });
   }
-  /** @inheritdoc */
-  async deleteKeyPair(deviceId) {
-    this.store.delete(deviceId);
+  /**
+   * List pending invitations for the current user's email.
+   */
+  async listMyInvitations(email) {
+    return this.request(`/invitations?email=${encodeURIComponent(email)}`, {
+      method: "GET"
+    });
   }
-  /** @inheritdoc */
-  async hasKeyPair(deviceId) {
-    return this.store.has(deviceId);
+  // --- Subscriptions ---
+  /**
+   * Subscribe to active org changes.
+   * @returns Unsubscribe function
+   */
+  onOrgChange(callback) {
+    this.listeners.add(callback);
+    return () => {
+      this.listeners.delete(callback);
+    };
   }
-};
-function createDeviceKeyStore() {
-  if (typeof globalThis.indexedDB !== "undefined") {
-    return new IndexedDBDeviceKeyStore();
+  // --- Internal ---
+  notifyListeners() {
+    for (const listener of this.listeners) {
+      try {
+        listener(this._activeOrgId);
+      } catch {
+      }
+    }
   }
-  return new InMemoryDeviceKeyStore();
-}
+  async request(path, options) {
+    const token = await this.getAccessToken();
+    if (!token) {
+      throw new OrgClientError(
+        "Not authenticated. Sign in before performing organization operations.",
+        "ORG_NOT_AUTHENTICATED"
+      );
+    }
+    const url = `${this.serverUrl}${path}`;
+    const headers = {
+      Authorization: `Bearer ${token}`
+    };
+    if (options.body) {
+      headers["Content-Type"] = "application/json";
+    }
+    let response;
+    try {
+      response = await fetch(url, {
+        method: options.method,
+        headers,
+        body: options.body ? JSON.stringify(options.body) : void 0
+      });
+    } catch (cause) {
+      throw new OrgClientError(`Network request to ${path} failed.`, "ORG_NETWORK_ERROR", {
+        path,
+        cause: cause instanceof Error ? cause.message : String(cause)
+      });
+    }
+    if (!response.ok) {
+      let errorMessage = `Server returned HTTP ${response.status}`;
+      try {
+        const body = await response.json();
+        if (typeof body.error === "string") {
+          errorMessage = body.error;
+        }
+      } catch {
+      }
+      throw new OrgClientError(errorMessage, "ORG_SERVER_ERROR", {
+        path,
+        status: response.status
+      });
+    }
+    const text = await response.text();
+    if (text.length === 0) return void 0;
+    try {
+      const body = JSON.parse(text);
+      if (body && typeof body === "object" && "data" in body) {
+        return body.data;
+      }
+      return body;
+    } catch {
+      return void 0;
+    }
+  }
+};
 
 // src/tokens/token-store.ts
 var DEFAULT_STORAGE_KEY = "kora_auth_tokens";
@@ -1242,17 +1792,17 @@ var TokenStore = class {
 };
 
 // src/tokens/encrypted-token-store.ts
-var import_core6 = require("@korajs/core");
+var import_core8 = require("@korajs/core");
 
 // src/encryption/database-encryption.ts
-var import_core5 = require("@korajs/core");
-var EncryptionError = class extends import_core5.KoraError {
+var import_core7 = require("@korajs/core");
+var EncryptionError = class extends import_core7.KoraError {
   constructor(message, context) {
     super(message, "ENCRYPTION_ERROR", context);
     this.name = "EncryptionError";
   }
 };
-var CryptoUnavailableError2 = class extends import_core5.KoraError {
+var CryptoUnavailableError2 = class extends import_core7.KoraError {
   constructor() {
     super(
       "Web Crypto API (crypto.subtle) is not available in this environment. Database encryption requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
@@ -1360,7 +1910,7 @@ async function importKey(rawKey) {
 }
 
 // src/tokens/encrypted-token-store.ts
-var EncryptedTokenStoreError = class extends import_core6.KoraError {
+var EncryptedTokenStoreError = class extends import_core8.KoraError {
   constructor(message, context) {
     super(message, "ENCRYPTED_TOKEN_STORE_ERROR", context);
     this.name = "EncryptedTokenStoreError";
@@ -1555,14 +2105,14 @@ var EncryptedTokenStore = class {
 };
 
 // src/passkey/passkey-client.ts
-var import_core7 = require("@korajs/core");
-var PasskeyError = class extends import_core7.KoraError {
+var import_core9 = require("@korajs/core");
+var PasskeyError = class extends import_core9.KoraError {
   constructor(message, context) {
     super(message, "PASSKEY_ERROR", context);
     this.name = "PasskeyError";
   }
 };
-var PasskeyUnsupportedError = class extends import_core7.KoraError {
+var PasskeyUnsupportedError = class extends import_core9.KoraError {
   constructor() {
     super(
       "WebAuthn is not supported in this browser. Passkey authentication requires a modern browser with WebAuthn support.",
@@ -1834,8 +2384,8 @@ function decodeCbor(data, offset) {
 }
 
 // src/encryption/key-derivation.ts
-var import_core8 = require("@korajs/core");
-var KeyDerivationError = class extends import_core8.KoraError {
+var import_core10 = require("@korajs/core");
+var KeyDerivationError = class extends import_core10.KoraError {
   constructor(message, context) {
     super(message, "KEY_DERIVATION_ERROR", context);
     this.name = "KeyDerivationError";
@@ -2015,10 +2565,10 @@ var AutoLockManager = class {
 };
 
 // src/encryption/operation-encryptor.ts
-var import_core9 = require("@korajs/core");
+var import_core11 = require("@korajs/core");
 var ENCRYPTED_MARKER = "__kora_encrypted";
 var ENCRYPTION_VERSION = 1;
-var OperationEncryptionError = class extends import_core9.KoraError {
+var OperationEncryptionError = class extends import_core11.KoraError {
   constructor(message, context) {
     super(message, "OPERATION_ENCRYPTION_ERROR", context);
     this.name = "OperationEncryptionError";
@@ -2214,6 +2764,7 @@ function isEncryptedEnvelope(field) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthClient,
+  AuthDeviceIdentityError,
   AuthError,
   AutoLockManager,
   CryptoUnavailableError,
@@ -2233,9 +2784,18 @@ function isEncryptedEnvelope(field) {
   PasskeyUnsupportedError,
   TokenStore,
   authenticateWithPasskey,
+  checkOrgPermission,
   computePublicKeyThumbprint,
+  createAuthSession,
+  createAuthTokenStorage,
   createDeviceKeyStore,
+  createKoraAuth,
+  createKoraAuthSync,
+  createMemoryAuthTokenStorage,
+  createOrgSession,
   createPasskeyCredential,
+  createPersistentDeviceIdentity,
+  createWebStorageAuthTokenStorage,
   decryptData,
   deriveEncryptionKey,
   encryptData,