@korajs/auth 0.4.0 → 0.6.0

package/dist/index.js

@@ -24,6 +24,11 @@ import {
   toBase64Url,
   verifyChallenge
 } from "./chunk-IO2MCCG2.js";
+import {
+  checkOrgPermission,
+  createAuthSession,
+  createOrgSession
+} from "./chunk-7OXBRSJL.js";
 
 // src/client/auth-client.ts
 import { KoraError } from "@korajs/core";
@@ -62,6 +67,36 @@ function getUserIdFromToken(token) {
   }
   return payload.sub;
 }
+function getDefaultFetch() {
+  if (typeof globalThis.fetch !== "function") {
+    return async () => {
+      throw new AuthError(
+        "No fetch implementation is available in this runtime. Pass `fetch` to AuthClientConfig.",
+        "AUTH_FETCH_UNAVAILABLE"
+      );
+    };
+  }
+  return globalThis.fetch.bind(globalThis);
+}
+function normalizeAuthUser(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name ?? null
+  };
+}
+function canRedirectCurrentWindow() {
+  return typeof globalThis.window !== "undefined" && typeof globalThis.window.location?.assign === "function";
+}
+function redirectCurrentWindow(url) {
+  if (!canRedirectCurrentWindow()) {
+    throw new AuthError(
+      "OAuth redirect is not available in this runtime. Pass redirect: false and open the returned URL with your platform browser API.",
+      "AUTH_OAUTH_REDIRECT_UNAVAILABLE"
+    );
+  }
+  globalThis.window.location.assign(url);
+}
 function createTokenStorage(prefix) {
   let useLocalStorage = false;
   try {
@@ -115,6 +150,8 @@ function createTokenStorage(prefix) {
 var AuthClient = class {
   serverUrl;
   storage;
+  fetchFn;
+  deviceIdentity;
   listeners = /* @__PURE__ */ new Set();
   _state = "loading";
   _user = null;
@@ -128,7 +165,9 @@ var AuthClient = class {
   constructor(config) {
     this.serverUrl = config.serverUrl.replace(/\/+$/, "");
     const prefix = config.storageKey ?? "kora_auth";
-    this.storage = createTokenStorage(prefix);
+    this.storage = config.storage ?? createTokenStorage(prefix);
+    this.fetchFn = config.fetch ?? getDefaultFetch();
+    this.deviceIdentity = config.deviceIdentity;
   }
   // -----------------------------------------------------------------------
   // Public getters
@@ -160,8 +199,8 @@ var AuthClient = class {
       return;
     }
     this._initialized = true;
-    const accessToken = this.storage.getAccessToken();
-    const refreshToken = this.storage.getRefreshToken();
+    const accessToken = await this.storage.getAccessToken();
+    const refreshToken = await this.storage.getRefreshToken();
     if (!accessToken || !refreshToken) {
       this.setState("unauthenticated", null);
       return;
@@ -178,7 +217,7 @@ var AuthClient = class {
       }
     } catch {
     }
-    this.storage.clear();
+    await this.storage.clear();
     this.setState("unauthenticated", null);
   }
   // -----------------------------------------------------------------------
@@ -192,12 +231,13 @@ var AuthClient = class {
    * @throws {AuthError} If the request fails or the server returns an error
    */
   async signUp(params) {
+    const body = await this.withDeviceIdentity(params);
     const response = await this.request("/auth/signup", {
       method: "POST",
-      body: params
+      body
     });
     const tokens = "tokens" in response ? response.tokens : response;
-    this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
+    await this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
     const user = await this.fetchUserProfile(tokens.accessToken);
     this.setState("authenticated", user);
     return user;
@@ -210,16 +250,88 @@ var AuthClient = class {
    * @throws {AuthError} If the credentials are invalid or the request fails
    */
   async signIn(params) {
+    const body = await this.withDeviceIdentity(params);
     const response = await this.request("/auth/signin", {
       method: "POST",
-      body: params
+      body
     });
     const tokens = "tokens" in response ? response.tokens : response;
-    this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
+    await this.storage.setTokens(tokens.accessToken, tokens.refreshToken);
     const user = await this.fetchUserProfile(tokens.accessToken);
     this.setState("authenticated", user);
     return user;
   }
+  /**
+   * Create an OAuth authorization URL and optionally redirect the current window.
+   *
+   * For web apps, call this from a button click and keep the default redirect behavior.
+   * For desktop/mobile, pass `redirect: false`, open the returned URL with the runtime's
+   * browser API, then call `completeOAuthSignIn()` after receiving the callback.
+   */
+  async signInWithOAuth(provider, options = {}) {
+    const result = await this.createOAuthAuthorization(provider, options);
+    if (options.redirect ?? canRedirectCurrentWindow()) {
+      redirectCurrentWindow(result.url);
+    }
+    return result;
+  }
+  /**
+   * Complete an OAuth sign-in callback and store the issued Kora tokens.
+   */
+  async completeOAuthSignIn(provider, params) {
+    const body = await this.withDeviceIdentity(params);
+    const response = await this.request(
+      `/auth/oauth/${encodeURIComponent(provider)}/callback`,
+      {
+        method: "POST",
+        body: { ...body }
+      }
+    );
+    await this.storage.setTokens(response.tokens.accessToken, response.tokens.refreshToken);
+    const user = normalizeAuthUser(response.user);
+    this.setState("authenticated", user);
+    return user;
+  }
+  /**
+   * Create an OAuth authorization URL for linking another provider to the current user.
+   */
+  async getOAuthAuthorizationUrl(provider, options = {}) {
+    return this.createOAuthAuthorization(provider, { ...options, redirect: false });
+  }
+  /**
+   * Link an OAuth provider to the current authenticated user.
+   */
+  async linkOAuth(provider, params) {
+    const token = await this.requireAccessToken();
+    return this.request(`/auth/oauth/${encodeURIComponent(provider)}/link`, {
+      method: "POST",
+      body: {
+        code: params.code,
+        state: params.state
+      },
+      token
+    });
+  }
+  /**
+   * List OAuth accounts linked to the current authenticated user.
+   */
+  async listLinkedAccounts() {
+    const token = await this.requireAccessToken();
+    return this.request("/auth/oauth/links", {
+      method: "GET",
+      token
+    });
+  }
+  /**
+   * Unlink an OAuth provider from the current authenticated user.
+   */
+  async unlinkOAuth(provider) {
+    const token = await this.requireAccessToken();
+    await this.request(`/auth/oauth/${encodeURIComponent(provider)}/link`, {
+      method: "DELETE",
+      token
+    });
+  }
   /**
    * Sign out the current user.
    *
@@ -228,9 +340,9 @@ var AuthClient = class {
    * stolen refresh tokens cannot be used after the user explicitly signs out.
    */
   async signOut() {
-    const accessToken = this.storage.getAccessToken();
-    const refreshToken = this.storage.getRefreshToken();
-    this.storage.clear();
+    const accessToken = await this.storage.getAccessToken();
+    const refreshToken = await this.storage.getRefreshToken();
+    await this.storage.clear();
     this._refreshPromise = null;
     this.setState("unauthenticated", null);
     if (accessToken) {
@@ -254,11 +366,11 @@ var AuthClient = class {
    *          authenticated and refresh is not possible
    */
   async getAccessToken() {
-    const accessToken = this.storage.getAccessToken();
+    const accessToken = await this.storage.getAccessToken();
     if (accessToken && !isTokenExpired(accessToken)) {
       return accessToken;
     }
-    const refreshToken = this.storage.getRefreshToken();
+    const refreshToken = await this.storage.getRefreshToken();
     if (!refreshToken) {
       return null;
     }
@@ -341,7 +453,7 @@ var AuthClient = class {
           name: null
         });
       } else {
-        this.storage.clear();
+        await this.storage.clear();
         this.setState("unauthenticated", null);
       }
     }
@@ -354,10 +466,47 @@ var AuthClient = class {
       method: "GET",
       token: accessToken
     });
+    return normalizeAuthUser(profile);
+  }
+  async createOAuthAuthorization(provider, options) {
+    const params = new URLSearchParams();
+    const withIdentity = await this.withDeviceIdentity({
+      deviceId: options.deviceId,
+      devicePublicKey: options.devicePublicKey
+    });
+    if (options.returnTo) {
+      params.set("returnTo", options.returnTo);
+    }
+    if (withIdentity.deviceId) {
+      params.set("deviceId", withIdentity.deviceId);
+    }
+    if (withIdentity.devicePublicKey) {
+      params.set("devicePublicKey", withIdentity.devicePublicKey);
+    }
+    if (options.metadata) {
+      for (const [key, value] of Object.entries(options.metadata)) {
+        if (value !== void 0 && value !== null) {
+          params.set(key, String(value));
+        }
+      }
+    }
+    const query = params.toString();
+    return this.request(
+      `/auth/oauth/${encodeURIComponent(provider)}${query ? `?${query}` : ""}`,
+      {
+        method: "GET"
+      }
+    );
+  }
+  async withDeviceIdentity(params) {
+    if (!this.deviceIdentity || params.deviceId && params.devicePublicKey) {
+      return params;
+    }
+    const identity = await this.deviceIdentity.getDeviceIdentity();
     return {
-      id: profile.id,
-      email: profile.email,
-      name: profile.name ?? null
+      ...params,
+      deviceId: params.deviceId ?? identity.deviceId,
+      devicePublicKey: params.devicePublicKey ?? identity.devicePublicKey
     };
   }
   /**
@@ -376,6 +525,13 @@ var AuthClient = class {
       this._refreshPromise = null;
     }
   }
+  async requireAccessToken() {
+    const token = await this.getAccessToken();
+    if (!token) {
+      throw new AuthError("You must be signed in to perform this action.", "AUTH_REQUIRED");
+    }
+    return token;
+  }
   /**
    * Execute the token refresh network request.
    */
@@ -385,10 +541,10 @@ var AuthClient = class {
         method: "POST",
         body: { refreshToken }
       });
-      this.storage.setTokens(response.accessToken, response.refreshToken);
+      await this.storage.setTokens(response.accessToken, response.refreshToken);
       return response.accessToken;
     } catch {
-      this.storage.clear();
+      await this.storage.clear();
       this.setState("unauthenticated", null);
       return null;
     }
@@ -412,7 +568,7 @@ var AuthClient = class {
     }
     let response;
     try {
-      response = await fetch(url, {
+      response = await this.fetchFn(url, {
         method: options.method,
         headers,
         body: options.body ? JSON.stringify(options.body) : void 0
@@ -424,35 +580,475 @@ var AuthClient = class {
         { path, cause: cause instanceof Error ? cause.message : String(cause) }
       );
     }
-    if (!response.ok) {
-      let errorMessage = `Auth server returned HTTP ${response.status}`;
-      let serverError;
-      try {
-        const body = await response.json();
-        if (typeof body.error === "string") {
-          errorMessage = body.error;
-          serverError = errorMessage;
-        } else if (typeof body.message === "string") {
-          errorMessage = body.message;
-          serverError = errorMessage;
-        }
-      } catch {
+    if (!response.ok) {
+      let errorMessage = `Auth server returned HTTP ${response.status}`;
+      let serverError;
+      try {
+        const body = await response.json();
+        if (typeof body.error === "string") {
+          errorMessage = body.error;
+          serverError = errorMessage;
+        } else if (typeof body.message === "string") {
+          errorMessage = body.message;
+          serverError = errorMessage;
+        }
+      } catch {
+      }
+      throw new AuthError(errorMessage, "AUTH_SERVER_ERROR", {
+        path,
+        status: response.status,
+        serverError
+      });
+    }
+    const json = await response.json();
+    const data = json.data !== void 0 ? json.data : json;
+    return data;
+  }
+};
+
+// src/client/device-session.ts
+import { KoraError as KoraError3 } from "@korajs/core";
+
+// src/device/device-store.ts
+import { KoraError as KoraError2 } from "@korajs/core";
+var DeviceKeyStoreError = class extends KoraError2 {
+  constructor(message, context) {
+    super(message, "DEVICE_KEY_STORE_ERROR", context);
+    this.name = "DeviceKeyStoreError";
+  }
+};
+var IDB_DATABASE_NAME = "kora_device_keys";
+var IDB_STORE_NAME = "keypairs";
+var IDB_VERSION = 1;
+var IndexedDBDeviceKeyStore = class {
+  dbPromise = null;
+  /**
+   * Opens (or creates) the IndexedDB database.
+   *
+   * The database connection is lazily initialized on first use and
+   * reused for subsequent operations. If the database does not exist,
+   * it is created with the `keypairs` object store.
+   */
+  openDatabase() {
+    if (this.dbPromise !== null) {
+      return this.dbPromise;
+    }
+    this.dbPromise = new Promise((resolve, reject) => {
+      let request;
+      try {
+        request = globalThis.indexedDB.open(IDB_DATABASE_NAME, IDB_VERSION);
+      } catch (cause) {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError(
+            "Failed to open IndexedDB database for device key storage. IndexedDB may be unavailable or access may be denied.",
+            { cause: cause instanceof Error ? cause.message : String(cause) }
+          )
+        );
+        return;
+      }
+      request.onupgradeneeded = () => {
+        const db = request.result;
+        if (!db.objectStoreNames.contains(IDB_STORE_NAME)) {
+          db.createObjectStore(IDB_STORE_NAME);
+        }
+      };
+      request.onsuccess = () => {
+        resolve(request.result);
+      };
+      request.onerror = () => {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError("Failed to open IndexedDB database for device key storage.", {
+            error: request.error?.message
+          })
+        );
+      };
+      request.onblocked = () => {
+        this.dbPromise = null;
+        reject(
+          new DeviceKeyStoreError(
+            "IndexedDB database open was blocked. Another tab may have an older version of the database open. Close other tabs and try again."
+          )
+        );
+      };
+    });
+    return this.dbPromise;
+  }
+  /** @inheritdoc */
+  async saveKeyPair(deviceId, keyPair) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        store.put(keyPair, deviceId);
+        tx.oncomplete = () => {
+          resolve();
+        };
+        tx.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
+              deviceId,
+              error: tx.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
+    });
+  }
+  /** @inheritdoc */
+  async loadKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readonly");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        const request = store.get(deviceId);
+        request.onsuccess = () => {
+          const result = request.result;
+          resolve(result ?? null);
+        };
+        request.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
+              deviceId,
+              error: request.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
+    });
+  }
+  /** @inheritdoc */
+  async deleteKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        store.delete(deviceId);
+        tx.oncomplete = () => {
+          resolve();
+        };
+        tx.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
+              deviceId,
+              error: tx.error?.message
+            })
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
+    });
+  }
+  /** @inheritdoc */
+  async hasKeyPair(deviceId) {
+    const db = await this.openDatabase();
+    return new Promise((resolve, reject) => {
+      try {
+        const tx = db.transaction(IDB_STORE_NAME, "readonly");
+        const store = tx.objectStore(IDB_STORE_NAME);
+        const request = store.count(deviceId);
+        request.onsuccess = () => {
+          resolve(request.result > 0);
+        };
+        request.onerror = () => {
+          reject(
+            new DeviceKeyStoreError(
+              `Failed to check if key pair exists for device "${deviceId}".`,
+              { deviceId, error: request.error?.message }
+            )
+          );
+        };
+      } catch (cause) {
+        reject(
+          new DeviceKeyStoreError(`Failed to check if key pair exists for device "${deviceId}".`, {
+            deviceId,
+            cause: cause instanceof Error ? cause.message : String(cause)
+          })
+        );
+      }
+    });
+  }
+};
+var InMemoryDeviceKeyStore = class {
+  store = /* @__PURE__ */ new Map();
+  /** @inheritdoc */
+  async saveKeyPair(deviceId, keyPair) {
+    this.store.set(deviceId, keyPair);
+  }
+  /** @inheritdoc */
+  async loadKeyPair(deviceId) {
+    return this.store.get(deviceId) ?? null;
+  }
+  /** @inheritdoc */
+  async deleteKeyPair(deviceId) {
+    this.store.delete(deviceId);
+  }
+  /** @inheritdoc */
+  async hasKeyPair(deviceId) {
+    return this.store.has(deviceId);
+  }
+};
+function createDeviceKeyStore() {
+  if (typeof globalThis.indexedDB !== "undefined") {
+    return new IndexedDBDeviceKeyStore();
+  }
+  return new InMemoryDeviceKeyStore();
+}
+
+// src/client/device-session.ts
+var DEFAULT_DEVICE_ID_KEY = "kora_auth_device_id";
+var AuthDeviceIdentityError = class extends KoraError3 {
+  constructor(message, context) {
+    super(message, "AUTH_DEVICE_IDENTITY_ERROR", context);
+    this.name = "AuthDeviceIdentityError";
+  }
+};
+function createPersistentDeviceIdentity(options) {
+  const storage = options.storage;
+  const keyStore = options.keyStore ?? createDefaultPersistentKeyStore();
+  const deviceIdKey = options.deviceIdKey ?? DEFAULT_DEVICE_ID_KEY;
+  const generateDeviceId = options.generateDeviceId ?? defaultDeviceId;
+  return {
+    async getDeviceIdentity() {
+      let deviceId = await storage.getItem(deviceIdKey);
+      if (!deviceId) {
+        deviceId = generateDeviceId();
+        await storage.setItem(deviceIdKey, deviceId);
+      }
+      let keyPair = await keyStore.loadKeyPair(deviceId);
+      if (!keyPair) {
+        keyPair = await generateDeviceKeyPair();
+        await keyStore.saveKeyPair(deviceId, keyPair);
+      }
+      const publicKey = await exportPublicKeyJwk(keyPair);
+      return {
+        deviceId,
+        devicePublicKey: JSON.stringify(publicKey)
+      };
+    }
+  };
+}
+function createDefaultPersistentKeyStore() {
+  if (typeof globalThis.indexedDB !== "undefined") {
+    return createDeviceKeyStore();
+  }
+  throw new AuthDeviceIdentityError(
+    "No persistent device key store is available in this runtime. Pass `keyStore` to createPersistentDeviceIdentity()."
+  );
+}
+function defaultDeviceId() {
+  if (typeof globalThis.crypto?.randomUUID === "function") {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = new Uint8Array(16);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) {
+      bytes[i] = Math.floor(Math.random() * 256);
+    }
+  }
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
+// src/client/storage.ts
+function createAuthTokenStorage(options) {
+  const prefix = options.prefix ?? "kora_auth";
+  const accessKey = `${prefix}_access_token`;
+  const refreshKey = `${prefix}_refresh_token`;
+  const store = options.store;
+  return {
+    getAccessToken: () => store.getItem(accessKey),
+    getRefreshToken: () => store.getItem(refreshKey),
+    async setTokens(accessToken, refreshToken) {
+      await store.setItem(accessKey, accessToken);
+      await store.setItem(refreshKey, refreshToken);
+    },
+    async clear() {
+      await store.removeItem(accessKey);
+      await store.removeItem(refreshKey);
+    }
+  };
+}
+function createMemoryAuthTokenStorage() {
+  let accessToken = null;
+  let refreshToken = null;
+  return {
+    getAccessToken: () => accessToken,
+    getRefreshToken: () => refreshToken,
+    setTokens(access, refresh) {
+      accessToken = access;
+      refreshToken = refresh;
+    },
+    clear() {
+      accessToken = null;
+      refreshToken = null;
+    }
+  };
+}
+function createWebStorageAuthTokenStorage(storage, prefix) {
+  return createAuthTokenStorage({
+    prefix,
+    store: {
+      getItem: (key) => storage.getItem(key),
+      setItem: (key, value) => {
+        storage.setItem(key, value);
+      },
+      removeItem: (key) => {
+        storage.removeItem(key);
+      }
+    }
+  });
+}
+
+// src/client/quickstart.ts
+function createKoraAuth(options) {
+  const storage = options.storage ?? (options.credentialStore ? createAuthTokenStorage({
+    store: options.credentialStore,
+    prefix: options.storageKey
+  }) : tryCreateDefaultTokenStorage(options.storageKey));
+  const deviceIdentity = options.deviceIdentity === false ? void 0 : options.deviceIdentity ?? tryCreateDefaultDeviceIdentity(options.credentialStore, options.deviceKeyStore);
+  return new AuthClient({
+    serverUrl: options.serverUrl,
+    storageKey: options.storageKey,
+    storage,
+    fetch: options.fetch,
+    deviceIdentity
+  });
+}
+function tryCreateDefaultTokenStorage(storageKey) {
+  const storage = tryGetBrowserStorage();
+  return storage ? createWebStorageAuthTokenStorage(storage, storageKey) : void 0;
+}
+function tryCreateDefaultDeviceIdentity(credentialStore, deviceKeyStore) {
+  const storage = credentialStore ?? tryGetBrowserStorage();
+  if (!storage) {
+    return void 0;
+  }
+  try {
+    return createPersistentDeviceIdentity({
+      storage,
+      keyStore: deviceKeyStore
+    });
+  } catch {
+    return void 0;
+  }
+}
+function tryGetBrowserStorage() {
+  try {
+    if (typeof globalThis.localStorage === "undefined") {
+      return null;
+    }
+    const key = "__kora_auth_quickstart_test__";
+    globalThis.localStorage.setItem(key, "1");
+    globalThis.localStorage.removeItem(key);
+    return globalThis.localStorage;
+  } catch {
+    return null;
+  }
+}
+
+// src/client/auth-sync.ts
+import {
+  buildScopeMap,
+  extractScopeValuesFromClaims
+} from "@korajs/core";
+function decodeJwtPayload2(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const payloadSegment = parts[1];
+  if (payloadSegment === void 0) {
+    return null;
+  }
+  try {
+    const base64 = payloadSegment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+    const json = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf-8");
+    const parsed = JSON.parse(json);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function readDeviceIdFromClaims(claims) {
+  const dev = claims.dev;
+  return typeof dev === "string" && dev.length > 0 ? dev : void 0;
+}
+function createKoraAuthSync(options) {
+  const { authClient, schema, scopeFromClaims } = options;
+  const binding = {
+    auth: async () => {
+      const token = await authClient.getAccessToken();
+      return { token: token ?? "" };
+    }
+  };
+  if (schema) {
+    binding.resolveScopeMap = async () => {
+      const token = await authClient.getAccessToken();
+      if (!token) {
+        return void 0;
       }
-      throw new AuthError(errorMessage, "AUTH_SERVER_ERROR", {
-        path,
-        status: response.status,
-        serverError
-      });
+      const claims = decodeJwtPayload2(token);
+      if (!claims) {
+        return void 0;
+      }
+      const scopeValues = scopeFromClaims ? scopeFromClaims(claims) : extractScopeValuesFromClaims(schema, claims);
+      return buildScopeMap(schema, scopeValues);
+    };
+  }
+  binding.resolveNodeId = async () => {
+    const token = await authClient.getAccessToken();
+    if (!token) {
+      return void 0;
     }
-    const json = await response.json();
-    const data = json.data !== void 0 ? json.data : json;
-    return data;
+    const claims = decodeJwtPayload2(token);
+    if (!claims) {
+      return void 0;
+    }
+    return readDeviceIdFromClaims(claims);
+  };
+  if (authClient.onAuthChange) {
+    binding.subscribe = (listener) => authClient.onAuthChange?.(() => listener()) ?? (() => {
+    });
   }
-};
+  return binding;
+}
 
 // src/client/org-client.ts
-import { KoraError as KoraError2 } from "@korajs/core";
-var OrgClientError = class extends KoraError2 {
+import { KoraError as KoraError4 } from "@korajs/core";
+var OrgClientError = class extends KoraError4 {
   constructor(message, code, context) {
     super(message, code, context);
     this.name = "OrgClientError";
@@ -711,216 +1307,6 @@ var OrgClient = class {
   }
 };
 
-// src/device/device-store.ts
-import { KoraError as KoraError3 } from "@korajs/core";
-var DeviceKeyStoreError = class extends KoraError3 {
-  constructor(message, context) {
-    super(message, "DEVICE_KEY_STORE_ERROR", context);
-    this.name = "DeviceKeyStoreError";
-  }
-};
-var IDB_DATABASE_NAME = "kora_device_keys";
-var IDB_STORE_NAME = "keypairs";
-var IDB_VERSION = 1;
-var IndexedDBDeviceKeyStore = class {
-  dbPromise = null;
-  /**
-   * Opens (or creates) the IndexedDB database.
-   *
-   * The database connection is lazily initialized on first use and
-   * reused for subsequent operations. If the database does not exist,
-   * it is created with the `keypairs` object store.
-   */
-  openDatabase() {
-    if (this.dbPromise !== null) {
-      return this.dbPromise;
-    }
-    this.dbPromise = new Promise((resolve, reject) => {
-      let request;
-      try {
-        request = globalThis.indexedDB.open(IDB_DATABASE_NAME, IDB_VERSION);
-      } catch (cause) {
-        this.dbPromise = null;
-        reject(
-          new DeviceKeyStoreError(
-            "Failed to open IndexedDB database for device key storage. IndexedDB may be unavailable or access may be denied.",
-            { cause: cause instanceof Error ? cause.message : String(cause) }
-          )
-        );
-        return;
-      }
-      request.onupgradeneeded = () => {
-        const db = request.result;
-        if (!db.objectStoreNames.contains(IDB_STORE_NAME)) {
-          db.createObjectStore(IDB_STORE_NAME);
-        }
-      };
-      request.onsuccess = () => {
-        resolve(request.result);
-      };
-      request.onerror = () => {
-        this.dbPromise = null;
-        reject(
-          new DeviceKeyStoreError("Failed to open IndexedDB database for device key storage.", {
-            error: request.error?.message
-          })
-        );
-      };
-      request.onblocked = () => {
-        this.dbPromise = null;
-        reject(
-          new DeviceKeyStoreError(
-            "IndexedDB database open was blocked. Another tab may have an older version of the database open. Close other tabs and try again."
-          )
-        );
-      };
-    });
-    return this.dbPromise;
-  }
-  /** @inheritdoc */
-  async saveKeyPair(deviceId, keyPair) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        store.put(keyPair, deviceId);
-        tx.oncomplete = () => {
-          resolve();
-        };
-        tx.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
-              deviceId,
-              error: tx.error?.message
-            })
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(`Failed to save key pair for device "${deviceId}".`, {
-            deviceId,
-            cause: cause instanceof Error ? cause.message : String(cause)
-          })
-        );
-      }
-    });
-  }
-  /** @inheritdoc */
-  async loadKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readonly");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        const request = store.get(deviceId);
-        request.onsuccess = () => {
-          const result = request.result;
-          resolve(result ?? null);
-        };
-        request.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
-              deviceId,
-              error: request.error?.message
-            })
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(`Failed to load key pair for device "${deviceId}".`, {
-            deviceId,
-            cause: cause instanceof Error ? cause.message : String(cause)
-          })
-        );
-      }
-    });
-  }
-  /** @inheritdoc */
-  async deleteKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readwrite");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        store.delete(deviceId);
-        tx.oncomplete = () => {
-          resolve();
-        };
-        tx.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
-              deviceId,
-              error: tx.error?.message
-            })
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(`Failed to delete key pair for device "${deviceId}".`, {
-            deviceId,
-            cause: cause instanceof Error ? cause.message : String(cause)
-          })
-        );
-      }
-    });
-  }
-  /** @inheritdoc */
-  async hasKeyPair(deviceId) {
-    const db = await this.openDatabase();
-    return new Promise((resolve, reject) => {
-      try {
-        const tx = db.transaction(IDB_STORE_NAME, "readonly");
-        const store = tx.objectStore(IDB_STORE_NAME);
-        const request = store.count(deviceId);
-        request.onsuccess = () => {
-          resolve(request.result > 0);
-        };
-        request.onerror = () => {
-          reject(
-            new DeviceKeyStoreError(
-              `Failed to check if key pair exists for device "${deviceId}".`,
-              { deviceId, error: request.error?.message }
-            )
-          );
-        };
-      } catch (cause) {
-        reject(
-          new DeviceKeyStoreError(`Failed to check if key pair exists for device "${deviceId}".`, {
-            deviceId,
-            cause: cause instanceof Error ? cause.message : String(cause)
-          })
-        );
-      }
-    });
-  }
-};
-var InMemoryDeviceKeyStore = class {
-  store = /* @__PURE__ */ new Map();
-  /** @inheritdoc */
-  async saveKeyPair(deviceId, keyPair) {
-    this.store.set(deviceId, keyPair);
-  }
-  /** @inheritdoc */
-  async loadKeyPair(deviceId) {
-    return this.store.get(deviceId) ?? null;
-  }
-  /** @inheritdoc */
-  async deleteKeyPair(deviceId) {
-    this.store.delete(deviceId);
-  }
-  /** @inheritdoc */
-  async hasKeyPair(deviceId) {
-    return this.store.has(deviceId);
-  }
-};
-function createDeviceKeyStore() {
-  if (typeof globalThis.indexedDB !== "undefined") {
-    return new IndexedDBDeviceKeyStore();
-  }
-  return new InMemoryDeviceKeyStore();
-}
-
 // src/tokens/token-store.ts
 var DEFAULT_STORAGE_KEY = "kora_auth_tokens";
 var MemoryStorage = class {
@@ -1044,8 +1430,8 @@ var TokenStore = class {
 };
 
 // src/tokens/encrypted-token-store.ts
-import { KoraError as KoraError4 } from "@korajs/core";
-var EncryptedTokenStoreError = class extends KoraError4 {
+import { KoraError as KoraError5 } from "@korajs/core";
+var EncryptedTokenStoreError = class extends KoraError5 {
   constructor(message, context) {
     super(message, "ENCRYPTED_TOKEN_STORE_ERROR", context);
     this.name = "EncryptedTokenStoreError";
@@ -1240,8 +1626,8 @@ var EncryptedTokenStore = class {
 };
 
 // src/encryption/key-derivation.ts
-import { KoraError as KoraError5 } from "@korajs/core";
-var KeyDerivationError = class extends KoraError5 {
+import { KoraError as KoraError6 } from "@korajs/core";
+var KeyDerivationError = class extends KoraError6 {
   constructor(message, context) {
     super(message, "KEY_DERIVATION_ERROR", context);
     this.name = "KeyDerivationError";
@@ -1421,6 +1807,7 @@ var AutoLockManager = class {
 };
 export {
   AuthClient,
+  AuthDeviceIdentityError,
   AuthError,
   AutoLockManager,
   CryptoUnavailableError,
@@ -1440,9 +1827,18 @@ export {
   PasskeyUnsupportedError,
   TokenStore,
   authenticateWithPasskey,
+  checkOrgPermission,
   computePublicKeyThumbprint,
+  createAuthSession,
+  createAuthTokenStorage,
   createDeviceKeyStore,
+  createKoraAuth,
+  createKoraAuthSync,
+  createMemoryAuthTokenStorage,
+  createOrgSession,
   createPasskeyCredential,
+  createPersistentDeviceIdentity,
+  createWebStorageAuthTokenStorage,
   decryptData,
   deriveEncryptionKey,
   encryptData,