kavachos 0.1.5 → 0.2.0

package/dist/auth/index.js

@@ -954,7 +954,7 @@ function createAdminModule(config, db, sessionManager) {
     const url = new URL(request.url);
     const { pathname } = url;
     const { method } = request;
-    const json3 = (data, status = 200) => new Response(JSON.stringify(data), {
+    const json2 = (data, status = 200) => new Response(JSON.stringify(data), {
       status,
       headers: { "Content-Type": "application/json" }
     });
@@ -963,14 +963,14 @@ function createAdminModule(config, db, sessionManager) {
       const offset = url.searchParams.get("offset") ? Number(url.searchParams.get("offset")) : void 0;
       const search = url.searchParams.get("search") ?? void 0;
       const result = await listUsers({ limit, offset, search });
-      return json3(result);
+      return json2(result);
     }
     const userMatch = /^\/auth\/admin\/users\/([^/]+)$/.exec(pathname);
     if (method === "GET" && userMatch) {
       const userId = decodeURIComponent(userMatch[1] ?? "");
       const user = await getUser(userId);
-      if (!user) return json3({ error: "User not found" }, 404);
-      return json3(user);
+      if (!user) return json2({ error: "User not found" }, 404);
+      return json2(user);
     }
     const banMatch = /^\/auth\/admin\/users\/([^/]+)\/ban$/.exec(pathname);
     if (method === "POST" && banMatch) {
@@ -983,19 +983,19 @@ function createAdminModule(config, db, sessionManager) {
       const reason = typeof body.reason === "string" ? body.reason : void 0;
       const expiresAt = body.expiresAt ? new Date(body.expiresAt) : void 0;
       await banUser(userId, reason, expiresAt);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const unbanMatch = /^\/auth\/admin\/users\/([^/]+)\/unban$/.exec(pathname);
     if (method === "POST" && unbanMatch) {
       const userId = decodeURIComponent(unbanMatch[1] ?? "");
       await unbanUser(userId);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const deleteMatch = /^\/auth\/admin\/users\/([^/]+)$/.exec(pathname);
     if (method === "DELETE" && deleteMatch) {
       const userId = decodeURIComponent(deleteMatch[1] ?? "");
       await deleteUser(userId);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const impersonateMatch = /^\/auth\/admin\/impersonate\/([^/]+)$/.exec(pathname);
     if (method === "POST" && impersonateMatch) {
@@ -1004,28 +1004,28 @@ function createAdminModule(config, db, sessionManager) {
       try {
         body = await request.json();
       } catch {
-        return json3({ error: "Invalid JSON body" }, 400);
+        return json2({ error: "Invalid JSON body" }, 400);
       }
       const adminUserId = body.adminUserId;
       if (typeof adminUserId !== "string") {
-        return json3({ error: "Missing required field: adminUserId" }, 400);
+        return json2({ error: "Missing required field: adminUserId" }, 400);
       }
       try {
         const result = await impersonate(adminUserId, targetUserId);
-        return json3(result);
+        return json2(result);
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 403);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 403);
       }
     }
     if (method === "POST" && pathname === "/auth/admin/stop-impersonation") {
       const auth = request.headers.get("Authorization");
       const token = auth?.startsWith("Bearer ") ? auth.slice(7) : null;
-      if (!token) return json3({ error: "Missing Authorization header" }, 401);
+      if (!token) return json2({ error: "Missing Authorization header" }, 401);
       try {
         await stopImpersonation(token);
-        return json3({ success: true });
+        return json2({ success: true });
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
       }
     }
     return null;
@@ -1044,6 +1044,210 @@ function createAdminModule(config, db, sessionManager) {
   };
 }
 
+// src/plugin/helpers.ts
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+async function parseBody(request) {
+  try {
+    const data = await request.json();
+    return { ok: true, data };
+  } catch {
+    return {
+      ok: false,
+      response: json({ error: "Invalid JSON body" }, 400)
+    };
+  }
+}
+function buildSetCookie(name, value, maxAge, path = "/") {
+  return `${name}=${encodeURIComponent(value)}; HttpOnly; Secure; SameSite=Lax; Path=${path}; Max-Age=${maxAge}`;
+}
+
+// src/auth/admin-plugin.ts
+function admin(config) {
+  return {
+    id: "kavach-admin",
+    async init(ctx) {
+      const module = createAdminModule(config ?? {}, ctx.db, ctx.sessionManager ?? null);
+      ctx.addEndpoint({
+        method: "GET",
+        path: "/auth/admin/users",
+        metadata: {
+          requireAuth: true,
+          description: "List all users (admin only)"
+        },
+        async handler(request, endpointCtx) {
+          const user = await endpointCtx.getUser(request);
+          if (!user) {
+            return json({ error: "Authentication required" }, 401);
+          }
+          const isAdminUser = await module.isAdmin(user.id);
+          if (!isAdminUser) {
+            return json({ error: "Admin access required" }, 403);
+          }
+          const url = new URL(request.url);
+          const limitParam = url.searchParams.get("limit");
+          const offsetParam = url.searchParams.get("offset");
+          const search = url.searchParams.get("search") ?? void 0;
+          const result = await module.listUsers({
+            limit: limitParam ? Number(limitParam) : void 0,
+            offset: offsetParam ? Number(offsetParam) : void 0,
+            search
+          });
+          return json(result);
+        }
+      });
+      ctx.addEndpoint({
+        method: "GET",
+        path: "/auth/admin/users/:id",
+        metadata: {
+          requireAuth: true,
+          description: "Get a user by ID (admin only)"
+        },
+        async handler(request, endpointCtx) {
+          const user = await endpointCtx.getUser(request);
+          if (!user) {
+            return json({ error: "Authentication required" }, 401);
+          }
+          const isAdminUser = await module.isAdmin(user.id);
+          if (!isAdminUser) {
+            return json({ error: "Admin access required" }, 403);
+          }
+          const url = new URL(request.url);
+          const segments = url.pathname.split("/").filter(Boolean);
+          const targetId = segments[3];
+          if (!targetId) {
+            return json({ error: "Missing user ID in path" }, 400);
+          }
+          const found = await module.getUser(decodeURIComponent(targetId));
+          if (!found) {
+            return json({ error: "User not found" }, 404);
+          }
+          return json(found);
+        }
+      });
+      ctx.addEndpoint({
+        method: "POST",
+        path: "/auth/admin/users/:id/ban",
+        metadata: {
+          requireAuth: true,
+          description: "Ban a user (admin only)"
+        },
+        async handler(request, endpointCtx) {
+          const user = await endpointCtx.getUser(request);
+          if (!user) {
+            return json({ error: "Authentication required" }, 401);
+          }
+          const isAdminUser = await module.isAdmin(user.id);
+          if (!isAdminUser) {
+            return json({ error: "Admin access required" }, 403);
+          }
+          const url = new URL(request.url);
+          const segments = url.pathname.split("/").filter(Boolean);
+          const targetId = segments[3];
+          if (!targetId) {
+            return json({ error: "Missing user ID in path" }, 400);
+          }
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const reason = typeof bodyResult.data.reason === "string" ? bodyResult.data.reason : void 0;
+          const expiresAt = bodyResult.data.expiresAt ? new Date(bodyResult.data.expiresAt) : void 0;
+          await module.banUser(decodeURIComponent(targetId), reason, expiresAt);
+          return json({ success: true });
+        }
+      });
+      ctx.addEndpoint({
+        method: "POST",
+        path: "/auth/admin/users/:id/unban",
+        metadata: {
+          requireAuth: true,
+          description: "Unban a user (admin only)"
+        },
+        async handler(request, endpointCtx) {
+          const user = await endpointCtx.getUser(request);
+          if (!user) {
+            return json({ error: "Authentication required" }, 401);
+          }
+          const isAdminUser = await module.isAdmin(user.id);
+          if (!isAdminUser) {
+            return json({ error: "Admin access required" }, 403);
+          }
+          const url = new URL(request.url);
+          const segments = url.pathname.split("/").filter(Boolean);
+          const targetId = segments[3];
+          if (!targetId) {
+            return json({ error: "Missing user ID in path" }, 400);
+          }
+          await module.unbanUser(decodeURIComponent(targetId));
+          return json({ success: true });
+        }
+      });
+      ctx.addEndpoint({
+        method: "DELETE",
+        path: "/auth/admin/users/:id",
+        metadata: {
+          requireAuth: true,
+          description: "Delete a user (admin only)"
+        },
+        async handler(request, endpointCtx) {
+          const user = await endpointCtx.getUser(request);
+          if (!user) {
+            return json({ error: "Authentication required" }, 401);
+          }
+          const isAdminUser = await module.isAdmin(user.id);
+          if (!isAdminUser) {
+            return json({ error: "Admin access required" }, 403);
+          }
+          const url = new URL(request.url);
+          const segments = url.pathname.split("/").filter(Boolean);
+          const targetId = segments[3];
+          if (!targetId) {
+            return json({ error: "Missing user ID in path" }, 400);
+          }
+          await module.deleteUser(decodeURIComponent(targetId));
+          return json({ success: true });
+        }
+      });
+      ctx.addEndpoint({
+        method: "POST",
+        path: "/auth/admin/users/:id/impersonate",
+        metadata: {
+          requireAuth: true,
+          description: "Start an impersonation session as a target user (admin only)"
+        },
+        async handler(request, endpointCtx) {
+          const user = await endpointCtx.getUser(request);
+          if (!user) {
+            return json({ error: "Authentication required" }, 401);
+          }
+          const isAdminUser = await module.isAdmin(user.id);
+          if (!isAdminUser) {
+            return json({ error: "Admin access required" }, 403);
+          }
+          const url = new URL(request.url);
+          const segments = url.pathname.split("/").filter(Boolean);
+          const targetId = segments[3];
+          if (!targetId) {
+            return json({ error: "Missing user ID in path" }, 400);
+          }
+          try {
+            const result = await module.impersonate(user.id, decodeURIComponent(targetId));
+            return json(result);
+          } catch (err2) {
+            return json(
+              { error: err2 instanceof Error ? err2.message : "Impersonation failed" },
+              403
+            );
+          }
+        }
+      });
+    }
+  };
+}
+
 // src/crypto/web-crypto.ts
 var HEX_CHARS = "0123456789abcdef";
 function toHex(bytes) {
@@ -1222,272 +1426,7 @@ function constantTimeEqual(a, b) {
   return diff === 0;
 }
 
-// src/session/session.ts
-var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
-function createSessionManager(config, db) {
-  if (!config.secret || config.secret.length < 32) {
-    throw new Error("SessionManager: secret must be at least 32 characters.");
-  }
-  const maxAge = config.maxAge ?? DEFAULT_MAX_AGE_SECONDS;
-  const keyObject = new TextEncoder().encode(config.secret);
-  function rowToSession2(row) {
-    return {
-      id: row.id,
-      userId: row.userId,
-      expiresAt: row.expiresAt,
-      createdAt: row.createdAt,
-      ...row.metadata !== null && { metadata: row.metadata }
-    };
-  }
-  async function create(userId, metadata) {
-    const id = generateId();
-    const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + maxAge * 1e3);
-    await db.insert(sessions).values({
-      id,
-      userId,
-      expiresAt,
-      metadata: metadata ?? null,
-      createdAt: now
-    });
-    const token = await new SignJWT({ sub: id }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(Math.floor(expiresAt.getTime() / 1e3)).sign(keyObject);
-    const session = {
-      id,
-      userId,
-      expiresAt,
-      createdAt: now,
-      ...metadata !== void 0 && { metadata }
-    };
-    return { session, token };
-  }
-  async function validate(token) {
-    let sessionId;
-    try {
-      const { payload } = await jwtVerify(token, keyObject);
-      if (typeof payload.sub !== "string" || !payload.sub) return null;
-      sessionId = payload.sub;
-    } catch {
-      return null;
-    }
-    const now = /* @__PURE__ */ new Date();
-    const rows = await db.select().from(sessions).where(and(eq(sessions.id, sessionId)));
-    const row = rows[0];
-    if (!row) return null;
-    if (row.expiresAt <= now) {
-      await db.delete(sessions).where(eq(sessions.id, sessionId));
-      return null;
-    }
-    return rowToSession2(row);
-  }
-  async function revoke(sessionId) {
-    await db.delete(sessions).where(eq(sessions.id, sessionId));
-  }
-  async function revokeAll(userId) {
-    await db.delete(sessions).where(eq(sessions.userId, userId));
-  }
-  async function list(userId) {
-    const now = /* @__PURE__ */ new Date();
-    const rows = await db.select().from(sessions).where(and(eq(sessions.userId, userId)));
-    return rows.filter((row) => row.expiresAt > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime()).map(rowToSession2);
-  }
-  return { create, validate, revoke, revokeAll, list };
-}
-
-// src/auth/admin-plugin.ts
-function jsonResponse2(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
-function admin(config) {
-  return {
-    id: "kavach-admin",
-    async init(ctx) {
-      const sessionConfig = ctx.config.auth?.session;
-      const sessionManager = sessionConfig ? createSessionManager(sessionConfig, ctx.db) : null;
-      const module = createAdminModule(config ?? {}, ctx.db, sessionManager);
-      ctx.addEndpoint({
-        method: "GET",
-        path: "/auth/admin/users",
-        metadata: {
-          requireAuth: true,
-          description: "List all users (admin only)"
-        },
-        async handler(request, endpointCtx) {
-          const user = await endpointCtx.getUser(request);
-          if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
-          }
-          const isAdminUser = await module.isAdmin(user.id);
-          if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
-          }
-          const url = new URL(request.url);
-          const limitParam = url.searchParams.get("limit");
-          const offsetParam = url.searchParams.get("offset");
-          const search = url.searchParams.get("search") ?? void 0;
-          const result = await module.listUsers({
-            limit: limitParam ? Number(limitParam) : void 0,
-            offset: offsetParam ? Number(offsetParam) : void 0,
-            search
-          });
-          return jsonResponse2(result);
-        }
-      });
-      ctx.addEndpoint({
-        method: "GET",
-        path: "/auth/admin/users/:id",
-        metadata: {
-          requireAuth: true,
-          description: "Get a user by ID (admin only)"
-        },
-        async handler(request, endpointCtx) {
-          const user = await endpointCtx.getUser(request);
-          if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
-          }
-          const isAdminUser = await module.isAdmin(user.id);
-          if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
-          }
-          const url = new URL(request.url);
-          const segments = url.pathname.split("/").filter(Boolean);
-          const targetId = segments[3];
-          if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
-          }
-          const found = await module.getUser(decodeURIComponent(targetId));
-          if (!found) {
-            return jsonResponse2({ error: "User not found" }, 404);
-          }
-          return jsonResponse2(found);
-        }
-      });
-      ctx.addEndpoint({
-        method: "POST",
-        path: "/auth/admin/users/:id/ban",
-        metadata: {
-          requireAuth: true,
-          description: "Ban a user (admin only)"
-        },
-        async handler(request, endpointCtx) {
-          const user = await endpointCtx.getUser(request);
-          if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
-          }
-          const isAdminUser = await module.isAdmin(user.id);
-          if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
-          }
-          const url = new URL(request.url);
-          const segments = url.pathname.split("/").filter(Boolean);
-          const targetId = segments[3];
-          if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
-          }
-          const body = await parseBody(request);
-          const reason = typeof body.reason === "string" ? body.reason : void 0;
-          const expiresAt = body.expiresAt ? new Date(body.expiresAt) : void 0;
-          await module.banUser(decodeURIComponent(targetId), reason, expiresAt);
-          return jsonResponse2({ success: true });
-        }
-      });
-      ctx.addEndpoint({
-        method: "POST",
-        path: "/auth/admin/users/:id/unban",
-        metadata: {
-          requireAuth: true,
-          description: "Unban a user (admin only)"
-        },
-        async handler(request, endpointCtx) {
-          const user = await endpointCtx.getUser(request);
-          if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
-          }
-          const isAdminUser = await module.isAdmin(user.id);
-          if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
-          }
-          const url = new URL(request.url);
-          const segments = url.pathname.split("/").filter(Boolean);
-          const targetId = segments[3];
-          if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
-          }
-          await module.unbanUser(decodeURIComponent(targetId));
-          return jsonResponse2({ success: true });
-        }
-      });
-      ctx.addEndpoint({
-        method: "DELETE",
-        path: "/auth/admin/users/:id",
-        metadata: {
-          requireAuth: true,
-          description: "Delete a user (admin only)"
-        },
-        async handler(request, endpointCtx) {
-          const user = await endpointCtx.getUser(request);
-          if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
-          }
-          const isAdminUser = await module.isAdmin(user.id);
-          if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
-          }
-          const url = new URL(request.url);
-          const segments = url.pathname.split("/").filter(Boolean);
-          const targetId = segments[3];
-          if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
-          }
-          await module.deleteUser(decodeURIComponent(targetId));
-          return jsonResponse2({ success: true });
-        }
-      });
-      ctx.addEndpoint({
-        method: "POST",
-        path: "/auth/admin/users/:id/impersonate",
-        metadata: {
-          requireAuth: true,
-          description: "Start an impersonation session as a target user (admin only)"
-        },
-        async handler(request, endpointCtx) {
-          const user = await endpointCtx.getUser(request);
-          if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
-          }
-          const isAdminUser = await module.isAdmin(user.id);
-          if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
-          }
-          const url = new URL(request.url);
-          const segments = url.pathname.split("/").filter(Boolean);
-          const targetId = segments[3];
-          if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
-          }
-          try {
-            const result = await module.impersonate(user.id, decodeURIComponent(targetId));
-            return jsonResponse2(result);
-          } catch (err2) {
-            return jsonResponse2(
-              { error: err2 instanceof Error ? err2.message : "Impersonation failed" },
-              403
-            );
-          }
-        }
-      });
-    }
-  };
-}
+// src/auth/anonymous.ts
 var DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24;
 var DEFAULT_MAX_AGE_MS = 1e3 * 60 * 60 * 24;
 var ANONYMOUS_EMAIL_DOMAIN = "kavachos.anonymous";
@@ -1557,29 +1496,14 @@ function createAnonymousAuthModule(config, db, sessionManager) {
 }
 
 // src/auth/anonymous-plugin.ts
-function jsonResponse3(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody2(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function anonymousAuth(config) {
   return {
     id: "kavach-anonymous",
     async init(ctx) {
-      const sessionSecret = ctx.config.auth?.session?.secret;
-      if (!sessionSecret) {
+      if (!ctx.sessionManager) {
         throw new Error("anonymousAuth plugin requires auth.session.secret to be configured");
       }
-      const sessionManager = createSessionManager({ secret: sessionSecret }, ctx.db);
-      const mod = createAnonymousAuthModule(config ?? {}, ctx.db, sessionManager);
+      const mod = createAnonymousAuthModule(config ?? {}, ctx.db, ctx.sessionManager);
       ctx.addEndpoint({
         method: "POST",
         path: "/auth/anonymous",
@@ -1590,9 +1514,9 @@ function anonymousAuth(config) {
         async handler(_request, _endpointCtx) {
           try {
             const result = await mod.createAnonymousUser();
-            return jsonResponse3({ userId: result.userId, sessionToken: result.sessionToken });
+            return json({ userId: result.userId, sessionToken: result.sessionToken });
           } catch (err2) {
-            return jsonResponse3(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Failed to create anonymous user" },
               500
             );
@@ -1609,21 +1533,22 @@ function anonymousAuth(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse3({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody2(request);
-          const email = typeof body.email === "string" ? body.email.trim() : null;
-          const name = typeof body.name === "string" ? body.name.trim() : void 0;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const email = typeof bodyResult.data.email === "string" ? bodyResult.data.email.trim() : null;
+          const name = typeof bodyResult.data.name === "string" ? bodyResult.data.name.trim() : void 0;
           if (!email) {
-            return jsonResponse3({ error: "Missing required field: email" }, 400);
+            return json({ error: "Missing required field: email" }, 400);
           }
           try {
             await mod.upgradeUser(user.id, { email, name });
-            return jsonResponse3({ upgraded: true });
+            return json({ upgraded: true });
           } catch (err2) {
             const message = err2 instanceof Error ? err2.message : "Upgrade failed";
             const status = message.includes("not an anonymous user") ? 400 : 500;
-            return jsonResponse3({ error: message }, status);
+            return json({ error: message }, status);
           }
         }
       });
@@ -1637,10 +1562,10 @@ function anonymousAuth(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse3({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const anonymous = await mod.isAnonymous(user.id);
-          return jsonResponse3({ anonymous });
+          return json({ anonymous });
         }
       });
     }
@@ -1746,7 +1671,7 @@ function createApiKeyManagerModule(config, db) {
     const url = new URL(request.url);
     const { pathname } = url;
     const { method } = request;
-    const json3 = (data, status = 200) => new Response(JSON.stringify(data), {
+    const json2 = (data, status = 200) => new Response(JSON.stringify(data), {
       status,
       headers: { "Content-Type": "application/json" }
     });
@@ -1755,11 +1680,11 @@ function createApiKeyManagerModule(config, db) {
       try {
         body = await request.json();
       } catch {
-        return json3({ error: "Invalid JSON body" }, 400);
+        return json2({ error: "Invalid JSON body" }, 400);
       }
       const b = body;
       if (typeof b.userId !== "string" || typeof b.name !== "string" || !Array.isArray(b.permissions)) {
-        return json3({ error: "Missing required fields: userId, name, permissions" }, 400);
+        return json2({ error: "Missing required fields: userId, name, permissions" }, 400);
       }
       const expiresAt = b.expiresAt ? new Date(b.expiresAt) : void 0;
       const result = await create({
@@ -1768,28 +1693,28 @@ function createApiKeyManagerModule(config, db) {
         permissions: b.permissions,
         expiresAt
       });
-      return json3(result, 201);
+      return json2(result, 201);
     }
     const listMatch = /^\/auth\/api-keys\/([^/]+)$/.exec(pathname);
     if (method === "GET" && listMatch) {
       const userId = decodeURIComponent(listMatch[1] ?? "");
       const keys = await list(userId);
-      return json3(keys);
+      return json2(keys);
     }
     const deleteMatch = /^\/auth\/api-keys\/([^/]+)$/.exec(pathname);
     if (method === "DELETE" && deleteMatch) {
       const keyId = decodeURIComponent(deleteMatch[1] ?? "");
       await revoke(keyId);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const rotateMatch = /^\/auth\/api-keys\/([^/]+)\/rotate$/.exec(pathname);
     if (method === "POST" && rotateMatch) {
       const keyId = decodeURIComponent(rotateMatch[1] ?? "");
       try {
         const result = await rotate(keyId);
-        return json3(result);
+        return json2(result);
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 404);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 404);
       }
     }
     return null;
@@ -1806,19 +1731,6 @@ function createApiKeyManagerModule(config, db) {
 }
 
 // src/auth/api-key-plugin.ts
-function jsonResponse4(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody3(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function apiKeys2(config) {
   return {
     id: "kavach-api-key",
@@ -1834,15 +1746,16 @@ function apiKeys2(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse4({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody3(request);
-          const name = typeof body.name === "string" ? body.name.trim() : null;
-          const permissions2 = Array.isArray(body.permissions) ? body.permissions : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const name = typeof bodyResult.data.name === "string" ? bodyResult.data.name.trim() : null;
+          const permissions2 = Array.isArray(bodyResult.data.permissions) ? bodyResult.data.permissions : null;
           if (!name || !permissions2) {
-            return jsonResponse4({ error: "Missing required fields: name, permissions" }, 400);
+            return json({ error: "Missing required fields: name, permissions" }, 400);
           }
-          const expiresAt = body.expiresAt ? new Date(body.expiresAt) : void 0;
+          const expiresAt = bodyResult.data.expiresAt ? new Date(bodyResult.data.expiresAt) : void 0;
           try {
             const result = await module.create({
               userId: user.id,
@@ -1850,9 +1763,9 @@ function apiKeys2(config) {
               permissions: permissions2,
               expiresAt
             });
-            return jsonResponse4(result, 201);
+            return json(result, 201);
           } catch (err2) {
-            return jsonResponse4(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Failed to create API key" },
               500
             );
@@ -1869,10 +1782,10 @@ function apiKeys2(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse4({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const keys = await module.list(user.id);
-          return jsonResponse4({ apiKeys: keys });
+          return json({ apiKeys: keys });
         }
       });
       ctx.addEndpoint({
@@ -1885,21 +1798,21 @@ function apiKeys2(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse4({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const keyId = segments[2];
           if (!keyId) {
-            return jsonResponse4({ error: "Missing API key ID in path" }, 400);
+            return json({ error: "Missing API key ID in path" }, 400);
           }
           const keys = await module.list(user.id);
           const owned = keys.some((k) => k.id === decodeURIComponent(keyId));
           if (!owned) {
-            return jsonResponse4({ error: "API key not found" }, 404);
+            return json({ error: "API key not found" }, 404);
           }
           await module.revoke(decodeURIComponent(keyId));
-          return jsonResponse4({ revoked: true });
+          return json({ revoked: true });
         }
       });
       ctx.addEndpoint({
@@ -1912,24 +1825,24 @@ function apiKeys2(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse4({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const keyId = segments[2];
           if (!keyId) {
-            return jsonResponse4({ error: "Missing API key ID in path" }, 400);
+            return json({ error: "Missing API key ID in path" }, 400);
           }
           const keys = await module.list(user.id);
           const owned = keys.some((k) => k.id === decodeURIComponent(keyId));
           if (!owned) {
-            return jsonResponse4({ error: "API key not found" }, 404);
+            return json({ error: "API key not found" }, 404);
           }
           try {
             const result = await module.rotate(decodeURIComponent(keyId));
-            return jsonResponse4(result);
+            return json(result);
           } catch (err2) {
-            return jsonResponse4(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Failed to rotate API key" },
               400
             );
@@ -2319,13 +2232,13 @@ function customSession(config = {}) {
           const url = new URL(request.url);
           const sessionId = url.searchParams.get("sessionId");
           if (!sessionId) {
-            return jsonResponse5({ error: "Missing required query parameter: sessionId" }, 400);
+            return jsonResponse2({ error: "Missing required query parameter: sessionId" }, 400);
           }
           try {
             const fields = await mod.getSessionFields(sessionId);
-            return jsonResponse5({ fields: fields ?? {} });
+            return jsonResponse2({ fields: fields ?? {} });
           } catch (err2) {
-            return jsonResponse5(
+            return jsonResponse2(
               { error: err2 instanceof Error ? err2.message : "Failed to get session fields" },
               500
             );
@@ -2344,23 +2257,23 @@ function customSession(config = {}) {
           try {
             body = await request.json();
           } catch {
-            return jsonResponse5({ error: "Invalid JSON body" }, 400);
+            return jsonResponse2({ error: "Invalid JSON body" }, 400);
           }
           const sessionId = typeof body.sessionId === "string" ? body.sessionId : null;
           if (!sessionId) {
-            return jsonResponse5({ error: "Missing required field: sessionId" }, 400);
+            return jsonResponse2({ error: "Missing required field: sessionId" }, 400);
           }
           const fields = body.fields !== null && body.fields !== void 0 && typeof body.fields === "object" && !Array.isArray(body.fields) ? body.fields : null;
           if (!fields) {
-            return jsonResponse5({ error: "Missing or invalid field: fields" }, 400);
+            return jsonResponse2({ error: "Missing or invalid field: fields" }, 400);
           }
           try {
             await mod.updateSessionFields(sessionId, fields);
-            return jsonResponse5({ updated: true });
+            return jsonResponse2({ updated: true });
           } catch (err2) {
             const message = err2 instanceof Error ? err2.message : "Update failed";
             const status = message.includes("not found") ? 404 : 500;
-            return jsonResponse5({ error: message }, status);
+            return jsonResponse2({ error: message }, status);
           }
         }
       });
@@ -2370,7 +2283,7 @@ function customSession(config = {}) {
     }
   };
 }
-function jsonResponse5(body, status = 200) {
+function jsonResponse2(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -2383,13 +2296,13 @@ var DEFAULT_CODE_EXPIRY_SECONDS = 900;
 var DEFAULT_POLL_INTERVAL_SECONDS = 5;
 var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
 var SLOW_DOWN_THRESHOLD_MS = 4e3;
-function jsonResponse6(body, status = 200) {
+function jsonResponse3(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody4(request) {
+async function parseBody2(request) {
   try {
     return await request.json();
   } catch {
@@ -2513,7 +2426,7 @@ function createDeviceAuthModule(config) {
     const { method, pathname } = { method: request.method, pathname: url.pathname };
     if (method === "POST" && pathname.endsWith("/auth/device/code")) {
       const response = await requestCode();
-      return jsonResponse6({
+      return jsonResponse3({
         device_code: response.deviceCode,
         user_code: response.userCode,
         verification_uri: response.verificationUri,
@@ -2523,17 +2436,17 @@ function createDeviceAuthModule(config) {
       });
     }
     if (method === "POST" && pathname.endsWith("/auth/device/token")) {
-      const body = await parseBody4(request);
+      const body = await parseBody2(request);
       const deviceCode = typeof body.device_code === "string" ? body.device_code : null;
       if (!deviceCode) {
-        return jsonResponse6(
+        return jsonResponse3(
           { error: "invalid_request", error_description: "Missing device_code" },
           400
         );
       }
       const grant = grantsByDevice.get(deviceCode);
       if (grant?.lastPolledAt && Date.now() - grant.lastPolledAt < SLOW_DOWN_THRESHOLD_MS) {
-        return jsonResponse6(
+        return jsonResponse3(
           {
             error: "slow_down",
             error_description: "Polling too frequently",
@@ -2544,10 +2457,10 @@ function createDeviceAuthModule(config) {
       }
       const status = await checkAuthorization(deviceCode);
       if (status.status === "authorized") {
-        return jsonResponse6({ authorized: true, user_id: status.userId });
+        return jsonResponse3({ authorized: true, user_id: status.userId });
       }
       if (status.status === "pending") {
-        return jsonResponse6(
+        return jsonResponse3(
           {
             error: "authorization_pending",
             error_description: "The user has not yet authorized the device"
@@ -2556,7 +2469,7 @@ function createDeviceAuthModule(config) {
         );
       }
       if (status.status === "denied") {
-        return jsonResponse6(
+        return jsonResponse3(
           {
             error: "access_denied",
             error_description: "The user denied the authorization request"
@@ -2564,7 +2477,7 @@ function createDeviceAuthModule(config) {
           400
         );
       }
-      return jsonResponse6(
+      return jsonResponse3(
         {
           error: "expired_token",
           error_description: "The device code has expired"
@@ -2573,12 +2486,12 @@ function createDeviceAuthModule(config) {
       );
     }
     if (method === "POST" && pathname.endsWith("/auth/device/authorize")) {
-      const body = await parseBody4(request);
+      const body = await parseBody2(request);
       const userCode = typeof body.user_code === "string" ? body.user_code : null;
       const userId = typeof body.user_id === "string" ? body.user_id : null;
       const action = typeof body.action === "string" ? body.action : "approve";
       if (!userCode || !userId) {
-        return jsonResponse6(
+        return jsonResponse3(
           { error: "invalid_request", error_description: "Missing user_code or user_id" },
           400
         );
@@ -2586,12 +2499,12 @@ function createDeviceAuthModule(config) {
       try {
         if (action === "deny") {
           await deny(userCode);
-          return jsonResponse6({ denied: true });
+          return jsonResponse3({ denied: true });
         }
         await authorize(userCode, userId);
-        return jsonResponse6({ authorized: true });
+        return jsonResponse3({ authorized: true });
       } catch (err2) {
-        return jsonResponse6(
+        return jsonResponse3(
           {
             error: "invalid_request",
             error_description: err2 instanceof Error ? err2.message : "Authorization failed"
@@ -2872,31 +2785,16 @@ function createEmailOtpModule(config, db, sessionManager) {
 }
 
 // src/auth/email-otp-plugin.ts
-function jsonResponse7(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody5(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function emailOtp(config) {
   return {
     id: "kavach-email-otp",
     async init(ctx) {
-      const sessionConfig = ctx.config.auth?.session;
-      if (!sessionConfig) {
+      if (!ctx.sessionManager) {
         throw new Error(
           "kavach-email-otp plugin requires auth.session to be configured so that sessions can be issued on successful verification."
         );
       }
-      const sessionManager = createSessionManager(sessionConfig, ctx.db);
-      const module = createEmailOtpModule(config, ctx.db, sessionManager);
+      const module = createEmailOtpModule(config, ctx.db, ctx.sessionManager);
       ctx.addEndpoint({
         method: "POST",
         path: "/auth/email-otp/send",
@@ -2905,19 +2803,17 @@ function emailOtp(config) {
           description: "Send a one-time passcode to the provided email address"
         },
         async handler(request) {
-          const body = await parseBody5(request);
-          const rawEmail = typeof body.email === "string" ? body.email.trim().toLowerCase() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const rawEmail = typeof bodyResult.data.email === "string" ? bodyResult.data.email.trim().toLowerCase() : null;
           if (!rawEmail) {
-            return jsonResponse7({ error: "Missing required field: email" }, 400);
+            return json({ error: "Missing required field: email" }, 400);
           }
           try {
             const result = await module.sendCode(rawEmail);
-            return jsonResponse7(result);
+            return json(result);
           } catch (err2) {
-            return jsonResponse7(
-              { error: err2 instanceof Error ? err2.message : "Failed to send OTP" },
-              500
-            );
+            return json({ error: err2 instanceof Error ? err2.message : "Failed to send OTP" }, 500);
           }
         }
       });
@@ -2929,17 +2825,18 @@ function emailOtp(config) {
           description: "Verify an OTP code and return a session on success"
         },
         async handler(request) {
-          const body = await parseBody5(request);
-          const rawEmail = typeof body.email === "string" ? body.email.trim().toLowerCase() : null;
-          const code = typeof body.code === "string" ? body.code.trim() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const rawEmail = typeof bodyResult.data.email === "string" ? bodyResult.data.email.trim().toLowerCase() : null;
+          const code = typeof bodyResult.data.code === "string" ? bodyResult.data.code.trim() : null;
           if (!rawEmail || !code) {
-            return jsonResponse7({ error: "Missing required fields: email, code" }, 400);
+            return json({ error: "Missing required fields: email, code" }, 400);
           }
           const result = await module.verifyCode(rawEmail, code);
           if (!result) {
-            return jsonResponse7({ error: "Invalid or expired OTP code" }, 401);
+            return json({ error: "Invalid or expired OTP code" }, 401);
           }
-          return jsonResponse7(result);
+          return json(result);
         }
       });
     }
@@ -2950,7 +2847,7 @@ var TOKEN_PURPOSE = "email-verify";
 function makeError(code, message, details) {
   return { code, message, ...details !== void 0 ? { details } : {} };
 }
-function jsonResponse8(body, status = 200) {
+function jsonResponse4(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -3042,29 +2939,29 @@ function createEmailVerificationModule(config, db, tokenModule) {
     try {
       body = await request.json();
     } catch {
-      return jsonResponse8({ error: "Invalid JSON body" }, 400);
+      return jsonResponse4({ error: "Invalid JSON body" }, 400);
     }
     const b = body;
     if (pathname === "/auth/verify-email/send") {
       if (typeof b.userId !== "string" || typeof b.email !== "string") {
-        return jsonResponse8({ error: "Missing required fields: userId, email" }, 400);
+        return jsonResponse4({ error: "Missing required fields: userId, email" }, 400);
       }
       const result = await sendVerification(b.userId, b.email);
       if (!result.success) {
         const status = result.error.code === "USER_NOT_FOUND" ? 404 : 500;
-        return jsonResponse8({ error: result.error.message }, status);
+        return jsonResponse4({ error: result.error.message }, status);
       }
       return new Response(null, { status: 204 });
     }
     if (pathname === "/auth/verify-email/confirm") {
       if (typeof b.token !== "string") {
-        return jsonResponse8({ error: "Missing required field: token" }, 400);
+        return jsonResponse4({ error: "Missing required field: token" }, 400);
       }
       const result = await verify(b.token);
       if (!result.success) {
-        return jsonResponse8({ error: result.error.message }, 400);
+        return jsonResponse4({ error: result.error.message }, 400);
       }
-      return jsonResponse8({ userId: result.data.userId, email: result.data.email });
+      return jsonResponse4({ userId: result.data.userId, email: result.data.email });
     }
     return null;
   }
@@ -4098,19 +3995,6 @@ function createGdprModule(db) {
 }
 
 // src/auth/gdpr-plugin.ts
-function jsonResponse9(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody6(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function gdpr() {
   return {
     id: "kavach-gdpr",
@@ -4126,16 +4010,13 @@ function gdpr() {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse9({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           try {
             const data = await module.exportUserData(user.id);
-            return jsonResponse9(data);
+            return json(data);
           } catch (err2) {
-            return jsonResponse9(
-              { error: err2 instanceof Error ? err2.message : "Export failed" },
-              500
-            );
+            return json({ error: err2 instanceof Error ? err2.message : "Export failed" }, 500);
           }
         }
       });
@@ -4149,30 +4030,28 @@ function gdpr() {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse9({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody6(request);
-          if (body.confirm !== "delete my account") {
-            return jsonResponse9(
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          if (bodyResult.data.confirm !== "delete my account") {
+            return json(
               {
                 error: 'Confirmation required. Send { "confirm": "delete my account" } in the request body.'
               },
               400
             );
           }
-          const keepAuditLogs = typeof body.keepAuditLogs === "boolean" ? body.keepAuditLogs : true;
-          const deleteOrganizations = typeof body.deleteOrganizations === "boolean" ? body.deleteOrganizations : false;
+          const keepAuditLogs = typeof bodyResult.data.keepAuditLogs === "boolean" ? bodyResult.data.keepAuditLogs : true;
+          const deleteOrganizations = typeof bodyResult.data.deleteOrganizations === "boolean" ? bodyResult.data.deleteOrganizations : false;
           try {
             const result = await module.deleteUser(user.id, {
               keepAuditLogs,
               deleteOrganizations
             });
-            return jsonResponse9({ success: true, ...result });
+            return json({ success: true, ...result });
           } catch (err2) {
-            return jsonResponse9(
-              { error: err2 instanceof Error ? err2.message : "Deletion failed" },
-              500
-            );
+            return json({ error: err2 instanceof Error ? err2.message : "Deletion failed" }, 500);
           }
         }
       });
@@ -4186,13 +4065,13 @@ function gdpr() {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse9({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           try {
             await module.anonymizeUser(user.id);
-            return jsonResponse9({ success: true });
+            return json({ success: true });
           } catch (err2) {
-            return jsonResponse9(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Anonymization failed" },
               500
             );
@@ -4828,14 +4707,12 @@ function magicLink(config) {
   return {
     id: "kavach-magic-link",
     async init(ctx) {
-      const sessionConfig = ctx.config.auth?.session;
-      if (!sessionConfig) {
+      if (!ctx.sessionManager) {
         throw new Error(
           "kavach-magic-link plugin requires auth.session to be configured so that sessions can be issued on successful verification."
         );
       }
-      const sessionManager = createSessionManager(sessionConfig, ctx.db);
-      const module = createMagicLinkModule(config, ctx.db, sessionManager);
+      const module = createMagicLinkModule(config, ctx.db, ctx.sessionManager);
       const sendLimiter = createRateLimiter({ max: 5, window: 60 });
       ctx.addEndpoint({
         method: "POST",
@@ -4845,35 +4722,19 @@ function magicLink(config) {
           description: "Send a magic link to the provided email address"
         },
         handler: withRateLimit(async (request) => {
-          let body;
-          try {
-            body = await request.json();
-          } catch {
-            return new Response(JSON.stringify({ error: "Invalid JSON body" }), {
-              status: 400,
-              headers: { "Content-Type": "application/json" }
-            });
-          }
-          const b = body;
-          const rawEmail = typeof b.email === "string" ? b.email.trim().toLowerCase() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const rawEmail = typeof bodyResult.data.email === "string" ? bodyResult.data.email.trim().toLowerCase() : null;
           if (!rawEmail) {
-            return new Response(JSON.stringify({ error: "Missing required field: email" }), {
-              status: 400,
-              headers: { "Content-Type": "application/json" }
-            });
+            return json({ error: "Missing required field: email" }, 400);
           }
           try {
             const result = await module.sendLink(rawEmail);
-            return new Response(JSON.stringify(result), {
-              status: 200,
-              headers: { "Content-Type": "application/json" }
-            });
+            return json(result);
           } catch (err2) {
-            return new Response(
-              JSON.stringify({
-                error: err2 instanceof Error ? err2.message : "Failed to send magic link"
-              }),
-              { status: 500, headers: { "Content-Type": "application/json" } }
+            return json(
+              { error: err2 instanceof Error ? err2.message : "Failed to send magic link" },
+              500
             );
           }
         }, sendLimiter)
@@ -4888,22 +4749,13 @@ function magicLink(config) {
           const url = new URL(request.url);
           const token = url.searchParams.get("token");
           if (!token) {
-            return new Response(JSON.stringify({ error: "Missing token query parameter" }), {
-              status: 400,
-              headers: { "Content-Type": "application/json" }
-            });
+            return json({ error: "Missing token query parameter" }, 400);
           }
           const result = await module.verify(token);
           if (!result) {
-            return new Response(JSON.stringify({ error: "Invalid or expired magic link" }), {
-              status: 401,
-              headers: { "Content-Type": "application/json" }
-            });
+            return json({ error: "Invalid or expired magic link" }, 401);
           }
-          return new Response(JSON.stringify(result), {
-            status: 200,
-            headers: { "Content-Type": "application/json" }
-          });
+          return json(result);
         }
       });
     }
@@ -5128,7 +4980,7 @@ function createOAuthModule(db, config) {
     pruneExpiredStates
   };
 }
-function jsonResponse10(body, status = 200) {
+function jsonResponse5(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -5146,8 +4998,12 @@ function oauth(config) {
     async init(ctx) {
       const module = createOAuthModule(ctx.db, config);
       const baseUrl = ctx.config.baseUrl ?? "";
-      const sessionConfig = ctx.config.auth?.session;
-      const sessionManager = sessionConfig ? createSessionManager(sessionConfig, ctx.db) : null;
+      const sessionManager = ctx.sessionManager;
+      if (!sessionManager) {
+        throw new Error(
+          "kavach-oauth plugin requires auth.session to be configured so that sessions can be issued on successful OAuth callback."
+        );
+      }
       const authorizeLimiter = createRateLimiter({ max: 20, window: 60 });
       function getRedirectUri(provider) {
         if (config.buildRedirectUri) {
@@ -5166,14 +5022,14 @@ function oauth(config) {
           const url = new URL(request.url);
           const provider = url.searchParams.get("_param_provider");
           if (!provider) {
-            return jsonResponse10({ error: "Missing provider parameter" }, 400);
+            return jsonResponse5({ error: "Missing provider parameter" }, 400);
           }
           const redirectUri = getRedirectUri(provider);
           try {
             const { url: authUrl } = await module.getAuthorizationUrl(provider, redirectUri);
             return redirectResponse(authUrl);
           } catch (err2) {
-            return jsonResponse10(
+            return jsonResponse5(
               { error: err2 instanceof Error ? err2.message : "Failed to build authorization URL" },
               400
             );
@@ -5190,10 +5046,10 @@ function oauth(config) {
           const code = url.searchParams.get("code");
           const state = url.searchParams.get("state");
           if (!provider) {
-            return jsonResponse10({ error: "Missing provider parameter" }, 400);
+            return jsonResponse5({ error: "Missing provider parameter" }, 400);
           }
           if (!code || !state) {
-            return jsonResponse10({ error: "Missing code or state query parameter" }, 400);
+            return jsonResponse5({ error: "Missing code or state query parameter" }, 400);
           }
           const redirectUri = getRedirectUri(provider);
           try {
@@ -5225,18 +5081,27 @@ function oauth(config) {
                 raw: {}
               });
             }
-            if (sessionManager && userId !== "__pending__") {
+            if (userId !== "__pending__") {
               const { session, token } = await sessionManager.create(userId);
-              const callbackUrl = `${baseUrl}/?session=${encodeURIComponent(JSON.stringify({ token, user: { id: userId, email }, expiresAt: session.expiresAt }))}`;
-              return redirectResponse(callbackUrl);
+              const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
+              const cookie = buildSetCookie("kavach_session", token, maxAge);
+              const userInfo = encodeURIComponent(JSON.stringify({ id: userId, email }));
+              const callbackUrl = `${baseUrl}/?auth_user=${userInfo}`;
+              return new Response(null, {
+                status: 302,
+                headers: {
+                  Location: callbackUrl,
+                  "Set-Cookie": cookie
+                }
+              });
             }
-            return jsonResponse10({
+            return jsonResponse5({
               isNewAccount: result.isNewAccount,
               account: result.account,
               userInfo: result.userInfo
             });
           } catch (err2) {
-            return jsonResponse10(
+            return jsonResponse5(
               { error: err2 instanceof Error ? err2.message : "OAuth callback failed" },
               400
             );
@@ -5253,29 +5118,29 @@ function oauth(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse10({ error: "Authentication required" }, 401);
+            return jsonResponse5({ error: "Authentication required" }, 401);
           }
           let body;
           try {
             body = await request.json();
           } catch {
-            return jsonResponse10({ error: "Invalid JSON body" }, 400);
+            return jsonResponse5({ error: "Invalid JSON body" }, 400);
           }
           const b = body;
           const provider = typeof b.provider === "string" ? b.provider : null;
           const userInfo = typeof b.userInfo === "object" && b.userInfo !== null ? b.userInfo : null;
           const tokens = typeof b.tokens === "object" && b.tokens !== null ? b.tokens : null;
           if (!provider || !userInfo || !tokens) {
-            return jsonResponse10(
+            return jsonResponse5(
               { error: "Missing required fields: provider, userInfo, tokens" },
               400
             );
           }
           try {
             const account = await module.linkAccount(user.id, provider, userInfo, tokens);
-            return jsonResponse10({ account });
+            return jsonResponse5({ account });
           } catch (err2) {
-            return jsonResponse10(
+            return jsonResponse5(
               { error: err2 instanceof Error ? err2.message : "Failed to link account" },
               400
             );
@@ -5291,7 +5156,7 @@ function oauth(config) {
             id: p.id,
             name: p.name
           }));
-          return jsonResponse10({ providers });
+          return jsonResponse5({ providers });
         }
       });
     }
@@ -7088,25 +6953,25 @@ function createOneTapModule(config, db, sessionManager) {
       const text3 = await request.text();
       formData = new URLSearchParams(text3);
     } catch {
-      return jsonResponse11({ error: "Failed to parse request body" }, 400);
+      return jsonResponse6({ error: "Failed to parse request body" }, 400);
     }
     const credential = formData.get("credential");
     const bodyToken = formData.get(csrfCookieName);
     if (!credential) {
-      return jsonResponse11({ error: "Missing credential field" }, 400);
+      return jsonResponse6({ error: "Missing credential field" }, 400);
     }
     const cookieToken = getCsrfCookie(request);
     if (!cookieToken || !bodyToken || cookieToken !== bodyToken) {
-      return jsonResponse11({ error: "CSRF token mismatch" }, 403);
+      return jsonResponse6({ error: "CSRF token mismatch" }, 403);
     }
     let googleUser;
     try {
       googleUser = await verify(credential);
     } catch (err2) {
       if (err2 instanceof OneTapVerifyError && err2.code === "USER_NOT_FOUND") {
-        return jsonResponse11({ error: err2.message }, 403);
+        return jsonResponse6({ error: err2.message }, 403);
       }
-      return jsonResponse11(
+      return jsonResponse6(
         { error: err2 instanceof Error ? err2.message : "Token verification failed" },
         401
       );
@@ -7116,27 +6981,96 @@ function createOneTapModule(config, db, sessionManager) {
       user = await findOrCreateUser(googleUser);
     } catch (err2) {
       if (err2 instanceof OneTapVerifyError && err2.code === "USER_NOT_FOUND") {
-        return jsonResponse11({ error: err2.message }, 403);
+        return jsonResponse6({ error: err2.message }, 403);
       }
-      return jsonResponse11(
+      return jsonResponse6(
         { error: err2 instanceof Error ? err2.message : "Failed to resolve user" },
         500
       );
     }
     const { token: sessionToken, session } = await sessionManager.create(user.id);
-    return jsonResponse11({
+    return jsonResponse6({
       user: { id: user.id, email: user.email },
       session: { token: sessionToken, expiresAt: session.expiresAt }
     });
   }
   return { verify, handleRequest };
 }
-function jsonResponse11(body, status = 200) {
+function jsonResponse6(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
+var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
+function createSessionManager(config, db) {
+  if (!config.secret || config.secret.length < 32) {
+    throw new Error("SessionManager: secret must be at least 32 characters.");
+  }
+  const maxAge = config.maxAge ?? DEFAULT_MAX_AGE_SECONDS;
+  const keyObject = new TextEncoder().encode(config.secret);
+  function rowToSession2(row) {
+    return {
+      id: row.id,
+      userId: row.userId,
+      expiresAt: row.expiresAt,
+      createdAt: row.createdAt,
+      ...row.metadata !== null && { metadata: row.metadata }
+    };
+  }
+  async function create(userId, metadata) {
+    const id = generateId();
+    const now = /* @__PURE__ */ new Date();
+    const expiresAt = new Date(now.getTime() + maxAge * 1e3);
+    await db.insert(sessions).values({
+      id,
+      userId,
+      expiresAt,
+      metadata: metadata ?? null,
+      createdAt: now
+    });
+    const token = await new SignJWT({ sub: id }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(Math.floor(expiresAt.getTime() / 1e3)).sign(keyObject);
+    const session = {
+      id,
+      userId,
+      expiresAt,
+      createdAt: now,
+      ...metadata !== void 0 && { metadata }
+    };
+    return { session, token };
+  }
+  async function validate(token) {
+    let sessionId;
+    try {
+      const { payload } = await jwtVerify(token, keyObject);
+      if (typeof payload.sub !== "string" || !payload.sub) return null;
+      sessionId = payload.sub;
+    } catch {
+      return null;
+    }
+    const now = /* @__PURE__ */ new Date();
+    const rows = await db.select().from(sessions).where(and(eq(sessions.id, sessionId)));
+    const row = rows[0];
+    if (!row) return null;
+    if (row.expiresAt <= now) {
+      await db.delete(sessions).where(eq(sessions.id, sessionId));
+      return null;
+    }
+    return rowToSession2(row);
+  }
+  async function revoke(sessionId) {
+    await db.delete(sessions).where(eq(sessions.id, sessionId));
+  }
+  async function revokeAll(userId) {
+    await db.delete(sessions).where(eq(sessions.userId, userId));
+  }
+  async function list(userId) {
+    const now = /* @__PURE__ */ new Date();
+    const rows = await db.select().from(sessions).where(and(eq(sessions.userId, userId)));
+    return rows.filter((row) => row.expiresAt > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime()).map(rowToSession2);
+  }
+  return { create, validate, revoke, revokeAll, list };
+}
 
 // src/auth/one-tap-plugin.ts
 function oneTap(config) {
@@ -8428,14 +8362,14 @@ function rowToInvitation(row) {
     createdAt: row.createdAt
   };
 }
-function jsonResponse12(body, status = 200) {
+function jsonResponse7(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
 function errorResponse(message, status) {
-  return jsonResponse12({ error: message }, status);
+  return jsonResponse7({ error: message }, status);
 }
 function createOrgModule(config, db) {
   const maxMembers = config.maxMembers ?? DEFAULT_MAX_MEMBERS;
@@ -8741,7 +8675,7 @@ function createOrgModule(config, db) {
       try {
         const body = await request.json();
         const org = await create(body);
-        return jsonResponse12(org, 201);
+        return jsonResponse7(org, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -8751,7 +8685,7 @@ function createOrgModule(config, db) {
       const userId = userOrgMatch[1];
       if (!userId) return errorResponse("Missing userId", 400);
       const orgs = await list(userId);
-      return jsonResponse12(orgs);
+      return jsonResponse7(orgs);
     }
     const orgBaseMatch = pathname.match(/^\/auth\/org\/([^/]+)(\/.*)?$/);
     if (!orgBaseMatch) return null;
@@ -8761,13 +8695,13 @@ function createOrgModule(config, db) {
     if (method === "GET" && subPath === "") {
       const org = await get(orgId);
       if (!org) return errorResponse("Organization not found", 404);
-      return jsonResponse12(org);
+      return jsonResponse7(org);
     }
     if (method === "PATCH" && subPath === "") {
       try {
         const body = await request.json();
         const org = await update(orgId, body);
-        return jsonResponse12(org);
+        return jsonResponse7(org);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -8775,7 +8709,7 @@ function createOrgModule(config, db) {
     if (method === "DELETE" && subPath === "") {
       try {
         await remove(orgId);
-        return jsonResponse12({ success: true });
+        return jsonResponse7({ success: true });
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -8784,14 +8718,14 @@ function createOrgModule(config, db) {
       try {
         const body = await request.json();
         const member = await addMember(orgId, body.userId, body.role);
-        return jsonResponse12(member, 201);
+        return jsonResponse7(member, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
     }
     if (method === "GET" && subPath === "/members") {
       const members = await getMembers(orgId);
-      return jsonResponse12(members);
+      return jsonResponse7(members);
     }
     const memberMatch = subPath.match(/^\/members\/([^/]+)$/);
     if (method === "PATCH" && memberMatch) {
@@ -8800,7 +8734,7 @@ function createOrgModule(config, db) {
       try {
         const body = await request.json();
         const member = await updateMemberRole(orgId, userId, body.role);
-        return jsonResponse12(member);
+        return jsonResponse7(member);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -8809,20 +8743,20 @@ function createOrgModule(config, db) {
       const userId = memberMatch[1];
       if (!userId) return errorResponse("Missing userId", 400);
       await removeMember(orgId, userId);
-      return jsonResponse12({ success: true });
+      return jsonResponse7({ success: true });
     }
     if (method === "POST" && subPath === "/invite") {
       try {
         const body = await request.json();
         const invitation = await invite({ orgId, ...body });
-        return jsonResponse12(invitation, 201);
+        return jsonResponse7(invitation, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
     }
     if (method === "GET" && subPath === "/invitations") {
       const invitations = await listInvitations(orgId);
-      return jsonResponse12(invitations);
+      return jsonResponse7(invitations);
     }
     const permMatch = subPath.match(/^\/permissions\/([^/]+)\/([^/]+)$/);
     if (method === "GET" && permMatch) {
@@ -8830,20 +8764,20 @@ function createOrgModule(config, db) {
       const permission = permMatch[2];
       if (!userId || !permission) return errorResponse("Missing userId or permission", 400);
       const allowed = await hasPermission(orgId, userId, permission);
-      return jsonResponse12({ allowed });
+      return jsonResponse7({ allowed });
     }
     if (method === "POST" && subPath === "/roles") {
       try {
         const body = await request.json();
         const role = await createRole(orgId, body);
-        return jsonResponse12(role, 201);
+        return jsonResponse7(role, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
     }
     if (method === "GET" && subPath === "/roles") {
       const roles = await getRoles(orgId);
-      return jsonResponse12(roles);
+      return jsonResponse7(roles);
     }
     return null;
   }
@@ -8858,7 +8792,7 @@ function createOrgModule(config, db) {
       try {
         const body = await request.json();
         const member = await acceptInvitation(invitationId, body.userId);
-        return jsonResponse12(member, 201);
+        return jsonResponse7(member, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -8868,7 +8802,7 @@ function createOrgModule(config, db) {
       const invitationId = revokeMatch[1];
       if (!invitationId) return errorResponse("Missing invitationId", 400);
       await revokeInvitation(invitationId);
-      return jsonResponse12({ success: true });
+      return jsonResponse7({ success: true });
     }
     return handleRequest(request);
   }
@@ -8899,13 +8833,13 @@ function createOrgModule(config, db) {
 }
 
 // src/auth/organization-plugin.ts
-function jsonResponse13(body, status = 200) {
+function jsonResponse8(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody7(request) {
+async function parseBody3(request) {
   try {
     return await request.json();
   } catch {
@@ -8928,20 +8862,20 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody7(request);
+          const body = await parseBody3(request);
           const name = typeof body.name === "string" ? body.name.trim() : null;
           const slug = typeof body.slug === "string" ? body.slug.trim() : null;
           if (!name || !slug) {
-            return jsonResponse13({ error: "Missing required fields: name, slug" }, 400);
+            return jsonResponse8({ error: "Missing required fields: name, slug" }, 400);
           }
           const metadata = body.metadata !== void 0 && typeof body.metadata === "object" && body.metadata !== null ? body.metadata : void 0;
           try {
             const org = await module.create({ name, slug, ownerId: user.id, metadata });
-            return jsonResponse13(org, 201);
+            return jsonResponse8(org, 201);
           } catch (err2) {
-            return jsonResponse13(
+            return jsonResponse8(
               { error: err2 instanceof Error ? err2.message : "Failed to create organization" },
               400
             );
@@ -8958,10 +8892,10 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const orgs = await module.list(user.id);
-          return jsonResponse13({ organizations: orgs });
+          return jsonResponse8({ organizations: orgs });
         }
       });
       ctx.addEndpoint({
@@ -8974,23 +8908,23 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const orgId = segments[2];
           if (!orgId) {
-            return jsonResponse13({ error: "Missing organization ID in path" }, 400);
+            return jsonResponse8({ error: "Missing organization ID in path" }, 400);
           }
           const member = await module.getMember(orgId, user.id);
           if (!member || !ADMIN_ROLES.has(member.role)) {
-            return jsonResponse13({ error: "Admin or owner role required" }, 403);
+            return jsonResponse8({ error: "Admin or owner role required" }, 403);
           }
-          const body = await parseBody7(request);
+          const body = await parseBody3(request);
           const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : null;
           const role = typeof body.role === "string" ? body.role : "member";
           if (!email) {
-            return jsonResponse13({ error: "Missing required field: email" }, 400);
+            return jsonResponse8({ error: "Missing required field: email" }, 400);
           }
           try {
             const invitation = await module.invite({
@@ -8999,9 +8933,9 @@ function organization(config) {
               role,
               invitedBy: user.id
             });
-            return jsonResponse13(invitation, 201);
+            return jsonResponse8(invitation, 201);
           } catch (err2) {
-            return jsonResponse13(
+            return jsonResponse8(
               { error: err2 instanceof Error ? err2.message : "Failed to send invitation" },
               400
             );
@@ -9018,20 +8952,20 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const orgId = segments[2];
           if (!orgId) {
-            return jsonResponse13({ error: "Missing organization ID in path" }, 400);
+            return jsonResponse8({ error: "Missing organization ID in path" }, 400);
           }
           const callerMember = await module.getMember(orgId, user.id);
           if (!callerMember) {
-            return jsonResponse13({ error: "You are not a member of this organization" }, 403);
+            return jsonResponse8({ error: "You are not a member of this organization" }, 403);
           }
           const members = await module.getMembers(orgId);
-          return jsonResponse13({ members });
+          return jsonResponse8({ members });
         }
       });
       ctx.addEndpoint({
@@ -9044,29 +8978,29 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const orgId = segments[2];
           const targetUserId = segments[4];
           if (!orgId || !targetUserId) {
-            return jsonResponse13({ error: "Missing organization ID or user ID in path" }, 400);
+            return jsonResponse8({ error: "Missing organization ID or user ID in path" }, 400);
           }
           const callerMember = await module.getMember(orgId, user.id);
           if (!callerMember || !ADMIN_ROLES.has(callerMember.role)) {
-            return jsonResponse13({ error: "Admin or owner role required" }, 403);
+            return jsonResponse8({ error: "Admin or owner role required" }, 403);
           }
-          const body = await parseBody7(request);
+          const body = await parseBody3(request);
           const role = typeof body.role === "string" ? body.role : null;
           if (!role) {
-            return jsonResponse13({ error: "Missing required field: role" }, 400);
+            return jsonResponse8({ error: "Missing required field: role" }, 400);
           }
           try {
             const member = await module.updateMemberRole(orgId, targetUserId, role);
-            return jsonResponse13(member);
+            return jsonResponse8(member);
           } catch (err2) {
-            return jsonResponse13(
+            return jsonResponse8(
               { error: err2 instanceof Error ? err2.message : "Failed to update member role" },
               400
             );
@@ -9083,24 +9017,24 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const orgId = segments[2];
           const targetUserId = segments[4];
           if (!orgId || !targetUserId) {
-            return jsonResponse13({ error: "Missing organization ID or user ID in path" }, 400);
+            return jsonResponse8({ error: "Missing organization ID or user ID in path" }, 400);
           }
           const callerMember = await module.getMember(orgId, user.id);
           if (!callerMember || !ADMIN_ROLES.has(callerMember.role)) {
-            return jsonResponse13({ error: "Admin or owner role required" }, 403);
+            return jsonResponse8({ error: "Admin or owner role required" }, 403);
           }
           try {
             await module.removeMember(orgId, targetUserId);
-            return jsonResponse13({ removed: true });
+            return jsonResponse8({ removed: true });
           } catch (err2) {
-            return jsonResponse13(
+            return jsonResponse8(
               { error: err2 instanceof Error ? err2.message : "Failed to remove member" },
               400
             );
@@ -9505,13 +9439,13 @@ function parseAuthData(authData) {
   }
   return { rpIdHash, flags, signCount, attestedCredentialData };
 }
-function jsonResponse14(body, status = 200) {
+function jsonResponse9(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody8(request) {
+async function parseBody4(request) {
   try {
     return await request.json();
   } catch {
@@ -9849,84 +9783,84 @@ function createPasskeyModule(config, db) {
     const method = request.method.toUpperCase();
     const segments = getPathSegments(url);
     if (method === "POST" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "register" && segments[3] === "options") {
-      const body = await parseBody8(request);
+      const body = await parseBody4(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const userName = typeof body.userName === "string" ? body.userName : null;
       if (!userId || !userName) {
-        return jsonResponse14({ error: "userId and userName required" }, 400);
+        return jsonResponse9({ error: "userId and userName required" }, 400);
       }
       try {
         const options = await getRegistrationOptions(userId, userName);
-        return jsonResponse14(options);
+        return jsonResponse9(options);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Failed to generate options";
         const code = err2 instanceof PasskeyError ? err2.code : "INTERNAL_ERROR";
-        return jsonResponse14({ error: message, code }, 500);
+        return jsonResponse9({ error: message, code }, 500);
       }
     }
     if (method === "POST" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "register" && segments[3] === "verify") {
-      const body = await parseBody8(request);
+      const body = await parseBody4(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
-      if (!userId) return jsonResponse14({ error: "userId required" }, 400);
+      if (!userId) return jsonResponse9({ error: "userId required" }, 400);
       const resp = body.response;
-      if (!resp) return jsonResponse14({ error: "response required" }, 400);
+      if (!resp) return jsonResponse9({ error: "response required" }, 400);
       try {
         const result = await verifyRegistration(userId, resp);
-        return jsonResponse14(result);
+        return jsonResponse9(result);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Registration failed";
         const code = err2 instanceof PasskeyError ? err2.code : "INTERNAL_ERROR";
-        return jsonResponse14({ error: message, code }, 400);
+        return jsonResponse9({ error: message, code }, 400);
       }
     }
     if (method === "POST" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "login" && segments[3] === "options") {
-      const body = await parseBody8(request);
+      const body = await parseBody4(request);
       const userId = typeof body.userId === "string" ? body.userId : void 0;
       try {
         const options = await getAuthenticationOptions(userId);
-        return jsonResponse14(options);
+        return jsonResponse9(options);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Failed to generate options";
         const code = err2 instanceof PasskeyError ? err2.code : "INTERNAL_ERROR";
-        return jsonResponse14({ error: message, code }, 500);
+        return jsonResponse9({ error: message, code }, 500);
       }
     }
     if (method === "POST" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "login" && segments[3] === "verify") {
-      const body = await parseBody8(request);
+      const body = await parseBody4(request);
       const resp = body.response;
-      if (!resp) return jsonResponse14({ error: "response required" }, 400);
+      if (!resp) return jsonResponse9({ error: "response required" }, 400);
       try {
         const result = await verifyAuthentication(resp);
-        return jsonResponse14(result);
+        return jsonResponse9(result);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Authentication failed";
         const code = err2 instanceof PasskeyError ? err2.code : "INTERNAL_ERROR";
-        return jsonResponse14({ error: message, code }, 401);
+        return jsonResponse9({ error: message, code }, 401);
       }
     }
     if (method === "GET" && segments.length === 3 && segments[1] === "passkey" && segments[2] === "credentials") {
       const userId = url.searchParams.get("userId");
-      if (!userId) return jsonResponse14({ error: "userId query param required" }, 400);
+      if (!userId) return jsonResponse9({ error: "userId query param required" }, 400);
       try {
         const creds = await listCredentials(userId);
-        return jsonResponse14({ credentials: creds });
+        return jsonResponse9({ credentials: creds });
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Failed to list credentials";
-        return jsonResponse14({ error: message }, 500);
+        return jsonResponse9({ error: message }, 500);
       }
     }
     if (method === "DELETE" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "credentials") {
       const credentialId = segments[3];
-      if (!credentialId) return jsonResponse14({ error: "Credential ID required" }, 400);
-      const body = await parseBody8(request);
+      if (!credentialId) return jsonResponse9({ error: "Credential ID required" }, 400);
+      const body = await parseBody4(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
-      if (!userId) return jsonResponse14({ error: "userId required" }, 400);
+      if (!userId) return jsonResponse9({ error: "userId required" }, 400);
       try {
         await removeCredential(credentialId, userId);
-        return jsonResponse14({ removed: true });
+        return jsonResponse9({ removed: true });
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Failed to remove credential";
-        return jsonResponse14({ error: message }, 500);
+        return jsonResponse9({ error: message }, 500);
       }
     }
     return null;
@@ -9943,13 +9877,13 @@ function createPasskeyModule(config, db) {
 }
 
 // src/auth/passkey-plugin.ts
-function jsonResponse15(body, status = 200) {
+function jsonResponse10(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody9(request) {
+async function parseBody5(request) {
   try {
     return await request.json();
   } catch {
@@ -9971,16 +9905,16 @@ function passkey(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse15({ error: "Authentication required" }, 401);
+            return jsonResponse10({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody9(request);
+          const body = await parseBody5(request);
           const userId = typeof body.userId === "string" ? body.userId : user.id;
           const userName = typeof body.userName === "string" ? body.userName : user.email ?? user.id;
           try {
             const options = await module.getRegistrationOptions(userId, userName);
-            return jsonResponse15(options);
+            return jsonResponse10(options);
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Failed to generate options" },
               500
             );
@@ -9997,19 +9931,19 @@ function passkey(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse15({ error: "Authentication required" }, 401);
+            return jsonResponse10({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody9(request);
+          const body = await parseBody5(request);
           const userId = typeof body.userId === "string" ? body.userId : user.id;
           const response = body.response;
           if (!response) {
-            return jsonResponse15({ error: "Missing required field: response" }, 400);
+            return jsonResponse10({ error: "Missing required field: response" }, 400);
           }
           try {
             const result = await module.verifyRegistration(userId, response);
-            return jsonResponse15(result);
+            return jsonResponse10(result);
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Registration failed" },
               400
             );
@@ -10023,13 +9957,13 @@ function passkey(config) {
           description: "Get WebAuthn authentication options"
         },
         async handler(request) {
-          const body = await parseBody9(request);
+          const body = await parseBody5(request);
           const userId = typeof body.userId === "string" ? body.userId : void 0;
           try {
             const options = await module.getAuthenticationOptions(userId);
-            return jsonResponse15(options);
+            return jsonResponse10(options);
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Failed to generate options" },
               500
             );
@@ -10043,19 +9977,37 @@ function passkey(config) {
           description: "Verify a WebAuthn assertion and return the authenticated user"
         },
         async handler(request) {
-          const body = await parseBody9(request);
+          const body = await parseBody5(request);
           const response = body.response;
           if (!response) {
-            return jsonResponse15({ error: "Missing required field: response" }, 400);
+            return jsonResponse10({ error: "Missing required field: response" }, 400);
           }
           try {
             const result = await module.verifyAuthentication(response);
             if (!result) {
-              return jsonResponse15({ error: "Authentication failed" }, 401);
+              return jsonResponse10({ error: "Authentication failed" }, 401);
             }
-            return jsonResponse15(result);
+            if (ctx.sessionManager) {
+              const { session, token } = await ctx.sessionManager.create(result.userId);
+              const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
+              return new Response(
+                JSON.stringify({
+                  user: { id: result.userId },
+                  session: { token, expiresAt: session.expiresAt },
+                  credential: result.credential
+                }),
+                {
+                  status: 200,
+                  headers: {
+                    "Content-Type": "application/json",
+                    "Set-Cookie": buildSetCookie("kavach_session", token, maxAge)
+                  }
+                }
+              );
+            }
+            return jsonResponse10(result);
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Authentication failed" },
               401
             );
@@ -10072,13 +10024,13 @@ function passkey(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse15({ error: "Authentication required" }, 401);
+            return jsonResponse10({ error: "Authentication required" }, 401);
           }
           try {
             const credentials = await module.listCredentials(user.id);
-            return jsonResponse15({ credentials });
+            return jsonResponse10({ credentials });
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Failed to list credentials" },
               500
             );
@@ -10095,19 +10047,19 @@ function passkey(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse15({ error: "Authentication required" }, 401);
+            return jsonResponse10({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const credentialId = segments[3];
           if (!credentialId) {
-            return jsonResponse15({ error: "Missing credential ID in path" }, 400);
+            return jsonResponse10({ error: "Missing credential ID in path" }, 400);
           }
           try {
             await module.removeCredential(credentialId, user.id);
-            return jsonResponse15({ removed: true });
+            return jsonResponse10({ removed: true });
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Failed to remove credential" },
               500
             );
@@ -10124,7 +10076,7 @@ var TOKEN_PURPOSE2 = "password-reset";
 function makeError7(code, message, details) {
   return { code, message, ...details !== void 0 ? { details } : {} };
 }
-function jsonResponse16(body, status = 200) {
+function jsonResponse11(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -10240,27 +10192,27 @@ function createPasswordResetModule(config, db, sessionManager, tokenModule) {
     try {
       body = await request.json();
     } catch {
-      return jsonResponse16({ error: "Invalid JSON body" }, 400);
+      return jsonResponse11({ error: "Invalid JSON body" }, 400);
     }
     const b = body;
     if (pathname === "/auth/forgot-password") {
       if (typeof b.email !== "string") {
-        return jsonResponse16({ error: "Missing required field: email" }, 400);
+        return jsonResponse11({ error: "Missing required field: email" }, 400);
       }
       const result = await requestReset(b.email);
       if (!result.success) {
-        return jsonResponse16({ error: result.error.message }, 500);
+        return jsonResponse11({ error: result.error.message }, 500);
       }
       return new Response(null, { status: 204 });
     }
     if (pathname === "/auth/reset-password") {
       if (typeof b.token !== "string" || typeof b.password !== "string") {
-        return jsonResponse16({ error: "Missing required fields: token, password" }, 400);
+        return jsonResponse11({ error: "Missing required fields: token, password" }, 400);
       }
       const result = await resetPassword(b.token, b.password);
       if (!result.success) {
         const status = result.error.code === "INVALID_PASSWORD" ? 400 : 400;
-        return jsonResponse16({ error: result.error.message }, status);
+        return jsonResponse11({ error: result.error.message }, status);
       }
       return new Response(null, { status: 204 });
     }
@@ -10295,7 +10247,7 @@ function generateNumericCode2(length) {
 function normalisePhone(phone) {
   return phone.replace(/\s+/g, "");
 }
-function jsonResponse17(body, status = 200) {
+function jsonResponse12(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -10367,25 +10319,25 @@ function createPhoneAuthModule(config, db, sessionManager) {
     try {
       body = await request.json();
     } catch {
-      return jsonResponse17({ error: "Invalid JSON body" }, 400);
+      return jsonResponse12({ error: "Invalid JSON body" }, 400);
     }
     const b = body;
     if (pathname === "/auth/phone/send-code") {
       if (typeof b.phoneNumber !== "string") {
-        return jsonResponse17({ error: "Missing required field: phoneNumber" }, 400);
+        return jsonResponse12({ error: "Missing required field: phoneNumber" }, 400);
       }
       const result = await sendCode(b.phoneNumber);
-      return jsonResponse17(result);
+      return jsonResponse12(result);
     }
     if (pathname === "/auth/phone/verify") {
       if (typeof b.phoneNumber !== "string" || typeof b.code !== "string") {
-        return jsonResponse17({ error: "Missing required fields: phoneNumber, code" }, 400);
+        return jsonResponse12({ error: "Missing required fields: phoneNumber, code" }, 400);
       }
       const result = await verifyCode(b.phoneNumber, b.code);
       if (!result) {
-        return jsonResponse17({ error: "Invalid or expired code" }, 401);
+        return jsonResponse12({ error: "Invalid or expired code" }, 401);
       }
-      return jsonResponse17(result);
+      return jsonResponse12(result);
     }
     return null;
   }
@@ -10405,12 +10357,12 @@ async function polarRequest(accessToken, baseUrl, method, path, body) {
     headers,
     body: body !== void 0 ? JSON.stringify(body) : void 0
   });
-  const json3 = await response.json();
+  const json2 = await response.json();
   if (!response.ok) {
-    const message = json3.detail ?? json3.message ?? `Polar API error: ${response.status}`;
+    const message = json2.detail ?? json2.message ?? `Polar API error: ${response.status}`;
     throw new Error(message);
   }
-  return json3;
+  return json2;
 }
 async function verifyWebhookSignature(payload, signatureHeader, webhookSecret) {
   const prefix = "sha256=";
@@ -10633,19 +10585,6 @@ function createPolarModule(config, db) {
 }
 
 // src/auth/polar-plugin.ts
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody10(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function polar(config) {
   return {
     id: "kavach-polar",
@@ -10663,13 +10602,14 @@ function polar(config) {
           if (!user) {
             return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody10(request);
-          const productId = typeof body.productId === "string" ? body.productId.trim() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const productId = typeof bodyResult.data.productId === "string" ? bodyResult.data.productId.trim() : null;
           if (!productId) {
             return json({ error: "Missing required field: productId" }, 400);
           }
-          const successUrl = typeof body.successUrl === "string" ? body.successUrl : void 0;
-          const customerEmail = typeof body.customerEmail === "string" ? body.customerEmail : void 0;
+          const successUrl = typeof bodyResult.data.successUrl === "string" ? bodyResult.data.successUrl : void 0;
+          const customerEmail = typeof bodyResult.data.customerEmail === "string" ? bodyResult.data.customerEmail : void 0;
           try {
             const result = await module.createCheckout(user.id, productId, {
               successUrl,
@@ -12114,13 +12054,13 @@ function scim(config) {
 // src/auth/siwe.ts
 var DEFAULT_NONCE_TTL_SECONDS = 300;
 var SIWE_VERSION = "1";
-function jsonResponse18(body, status = 200) {
+function jsonResponse13(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody11(request) {
+async function parseBody6(request) {
   try {
     return await request.json();
   } catch {
@@ -12255,20 +12195,20 @@ function createSiweModule(config) {
     const { method, pathname } = { method: request.method, pathname: url.pathname };
     if (method === "GET" && pathname.endsWith("/auth/siwe/nonce")) {
       const nonce = await generateNonce();
-      return jsonResponse18({ nonce });
+      return jsonResponse13({ nonce });
     }
     if (method === "POST" && pathname.endsWith("/auth/siwe/verify")) {
-      const body = await parseBody11(request);
+      const body = await parseBody6(request);
       const message = typeof body.message === "string" ? body.message : null;
       const signature = typeof body.signature === "string" ? body.signature : null;
       if (!message || !signature) {
-        return jsonResponse18({ error: "Missing required fields: message, signature" }, 400);
+        return jsonResponse13({ error: "Missing required fields: message, signature" }, 400);
       }
       try {
         const result = await verify(message, signature);
-        return jsonResponse18({ address: result.address, chainId: result.chainId });
+        return jsonResponse13({ address: result.address, chainId: result.chainId });
       } catch (err2) {
-        return jsonResponse18(
+        return jsonResponse13(
           { error: err2 instanceof Error ? err2.message : "Verification failed" },
           400
         );
@@ -13305,7 +13245,7 @@ function createSsoModule(config, db) {
     const url = new URL(request.url);
     const { pathname } = url;
     const { method } = request;
-    const json3 = (data, status = 200) => new Response(JSON.stringify(data), {
+    const json2 = (data, status = 200) => new Response(JSON.stringify(data), {
       status,
       headers: { "Content-Type": "application/json" }
     });
@@ -13314,14 +13254,14 @@ function createSsoModule(config, db) {
       try {
         body = await request.json();
       } catch {
-        return json3({ error: "Invalid JSON body" }, 400);
+        return json2({ error: "Invalid JSON body" }, 400);
       }
       const b = body;
       if (typeof b.orgId !== "string" || typeof b.providerId !== "string" || typeof b.type !== "string" || typeof b.domain !== "string") {
-        return json3({ error: "Missing required fields: orgId, providerId, type, domain" }, 400);
+        return json2({ error: "Missing required fields: orgId, providerId, type, domain" }, 400);
       }
       if (b.type !== "saml" && b.type !== "oidc") {
-        return json3({ error: "type must be 'saml' or 'oidc'" }, 400);
+        return json2({ error: "type must be 'saml' or 'oidc'" }, 400);
       }
       const conn = await createConnection({
         orgId: b.orgId,
@@ -13329,19 +13269,19 @@ function createSsoModule(config, db) {
         type: b.type,
         domain: b.domain
       });
-      return json3(conn, 201);
+      return json2(conn, 201);
     }
     const listMatch = /^\/auth\/sso\/connections\/([^/]+)$/.exec(pathname);
     if (method === "GET" && listMatch) {
       const orgId = decodeURIComponent(listMatch[1] ?? "");
       const conns = await listConnections(orgId);
-      return json3(conns);
+      return json2(conns);
     }
     const deleteMatch = /^\/auth\/sso\/connections\/([^/]+)$/.exec(pathname);
     if (method === "DELETE" && deleteMatch) {
       const connId = decodeURIComponent(deleteMatch[1] ?? "");
       await removeConnection(connId);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const samlInitMatch = /^\/auth\/sso\/saml\/([^/]+)$/.exec(pathname);
     if (method === "GET" && samlInitMatch) {
@@ -13351,7 +13291,7 @@ function createSsoModule(config, db) {
         const authUrl = await getSamlAuthUrl(connId, relayState);
         return new Response(null, { status: 302, headers: { Location: authUrl } });
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
       }
     }
     const samlAcsMatch = /^\/auth\/sso\/saml\/([^/]+)\/acs$/.exec(pathname);
@@ -13364,14 +13304,14 @@ function createSsoModule(config, db) {
         if (typeof val !== "string") throw new Error("Missing SAMLResponse");
         samlResponse = val;
       } catch {
-        return json3({ error: "Missing or invalid SAMLResponse" }, 400);
+        return json2({ error: "Missing or invalid SAMLResponse" }, 400);
       }
       try {
         const result = await handleSamlResponse(connId, samlResponse);
-        return json3(result);
+        return json2(result);
       } catch (err2) {
         const status = err2 instanceof SsoError && err2.code === SSO_ERROR.RATE_LIMITED ? 429 : 401;
-        return json3(
+        return json2(
           {
             error: err2 instanceof Error ? err2.message : "SAML error",
             code: err2 instanceof SsoError ? err2.code : "SAML_ERROR"
@@ -13389,20 +13329,20 @@ function createSsoModule(config, db) {
         const authUrl = await getOidcAuthUrl(connId, state, nonce);
         return new Response(null, { status: 302, headers: { Location: authUrl } });
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
       }
     }
     const oidcCbMatch = /^\/auth\/sso\/oidc\/([^/]+)\/callback$/.exec(pathname);
     if (method === "GET" && oidcCbMatch) {
       const connId = decodeURIComponent(oidcCbMatch[1] ?? "");
       const code = url.searchParams.get("code");
-      if (!code) return json3({ error: "Missing code parameter" }, 400);
+      if (!code) return json2({ error: "Missing code parameter" }, 400);
       try {
         const result = await handleOidcCallback(connId, code);
-        return json3(result);
+        return json2(result);
       } catch (err2) {
         const status = err2 instanceof SsoError && err2.code === SSO_ERROR.RATE_LIMITED ? 429 : 401;
-        return json3(
+        return json2(
           {
             error: err2 instanceof Error ? err2.message : "OIDC error",
             code: err2 instanceof SsoError ? err2.code : "OIDC_ERROR"
@@ -13503,12 +13443,12 @@ async function stripeRequest(secretKey, apiVersion, method, path, body) {
     headers,
     body: bodyStr
   });
-  const json3 = await response.json();
+  const json2 = await response.json();
   if (!response.ok) {
-    const message = json3.error?.message ?? `Stripe API error: ${response.status}`;
+    const message = json2.error?.message ?? `Stripe API error: ${response.status}`;
     throw new Error(message);
   }
-  return json3;
+  return json2;
 }
 async function verifyWebhookSignature2(payload, signatureHeader, webhookSecret) {
   const parts = {};
@@ -13818,19 +13758,6 @@ function createStripeModule(config, db) {
 }
 
 // src/auth/stripe-plugin.ts
-function json2(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody12(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function stripe(config) {
   return {
     id: "kavach-stripe",
@@ -13846,17 +13773,18 @@ function stripe(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return json2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody12(request);
-          const priceId = typeof body.priceId === "string" ? body.priceId.trim() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const priceId = typeof bodyResult.data.priceId === "string" ? bodyResult.data.priceId.trim() : null;
           if (!priceId) {
-            return json2({ error: "Missing required field: priceId" }, 400);
+            return json({ error: "Missing required field: priceId" }, 400);
           }
-          const successUrl = typeof body.successUrl === "string" ? body.successUrl : void 0;
-          const cancelUrl = typeof body.cancelUrl === "string" ? body.cancelUrl : void 0;
-          const trialDays = typeof body.trialDays === "number" ? body.trialDays : void 0;
-          const metadata = body.metadata != null && typeof body.metadata === "object" && !Array.isArray(body.metadata) ? body.metadata : void 0;
+          const successUrl = typeof bodyResult.data.successUrl === "string" ? bodyResult.data.successUrl : void 0;
+          const cancelUrl = typeof bodyResult.data.cancelUrl === "string" ? bodyResult.data.cancelUrl : void 0;
+          const trialDays = typeof bodyResult.data.trialDays === "number" ? bodyResult.data.trialDays : void 0;
+          const metadata = bodyResult.data.metadata != null && typeof bodyResult.data.metadata === "object" && !Array.isArray(bodyResult.data.metadata) ? bodyResult.data.metadata : void 0;
           try {
             const result = await module.createCheckoutSession(user.id, priceId, {
               successUrl,
@@ -13864,9 +13792,9 @@ function stripe(config) {
               trialDays,
               metadata
             });
-            return json2(result);
+            return json(result);
           } catch (err2) {
-            return json2(
+            return json(
               {
                 error: err2 instanceof Error ? err2.message : "Failed to create checkout session"
               },
@@ -13885,18 +13813,19 @@ function stripe(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return json2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody12(request);
-          const returnUrl = typeof body.returnUrl === "string" ? body.returnUrl.trim() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const returnUrl = typeof bodyResult.data.returnUrl === "string" ? bodyResult.data.returnUrl.trim() : null;
           if (!returnUrl) {
-            return json2({ error: "Missing required field: returnUrl" }, 400);
+            return json({ error: "Missing required field: returnUrl" }, 400);
           }
           try {
             const result = await module.createPortalSession(user.id, returnUrl);
-            return json2(result);
+            return json(result);
           } catch (err2) {
-            return json2(
+            return json(
               {
                 error: err2 instanceof Error ? err2.message : "Failed to create portal session"
               },
@@ -13915,10 +13844,10 @@ function stripe(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return json2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const subscription = await module.getSubscription(user.id);
-          return json2({ subscription });
+          return json({ subscription });
         }
       });
       ctx.addEndpoint({
@@ -14020,13 +13949,13 @@ async function generateBackupCodes(count) {
   }
   return { plain, hashed };
 }
-function jsonResponse19(body, status = 200) {
+function jsonResponse14(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody13(request) {
+async function parseBody7(request) {
   try {
     return await request.json();
   } catch {
@@ -14124,50 +14053,50 @@ function createTotpModule(config, db) {
     const method = request.method.toUpperCase();
     if (method !== "POST") return null;
     if (path === "/auth/2fa/setup") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
-      if (!userId) return jsonResponse19({ error: "userId required" }, 400);
+      if (!userId) return jsonResponse14({ error: "userId required" }, 400);
       try {
         const result = await setup(userId);
-        return jsonResponse19(result);
+        return jsonResponse14(result);
       } catch (err2) {
-        return jsonResponse19({ error: err2 instanceof Error ? err2.message : "Setup failed" }, 500);
+        return jsonResponse14({ error: err2 instanceof Error ? err2.message : "Setup failed" }, 500);
       }
     }
     if (path === "/auth/2fa/enable") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const code = typeof body.code === "string" ? body.code : null;
-      if (!userId || !code) return jsonResponse19({ error: "userId and code required" }, 400);
+      if (!userId || !code) return jsonResponse14({ error: "userId and code required" }, 400);
       const result = await enable(userId, code);
-      return jsonResponse19(result);
+      return jsonResponse14(result);
     }
     if (path === "/auth/2fa/verify") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const code = typeof body.code === "string" ? body.code : null;
-      if (!userId || !code) return jsonResponse19({ error: "userId and code required" }, 400);
+      if (!userId || !code) return jsonResponse14({ error: "userId and code required" }, 400);
       const result = await verify(userId, code);
-      return jsonResponse19(result);
+      return jsonResponse14(result);
     }
     if (path === "/auth/2fa/disable") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const code = typeof body.code === "string" ? body.code : null;
-      if (!userId || !code) return jsonResponse19({ error: "userId and code required" }, 400);
+      if (!userId || !code) return jsonResponse14({ error: "userId and code required" }, 400);
       const result = await disable(userId, code);
-      return jsonResponse19(result);
+      return jsonResponse14(result);
     }
     if (path === "/auth/2fa/backup-codes") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const code = typeof body.code === "string" ? body.code : null;
-      if (!userId || !code) return jsonResponse19({ error: "userId and code required" }, 400);
+      if (!userId || !code) return jsonResponse14({ error: "userId and code required" }, 400);
       try {
         const result = await regenerateBackupCodes(userId, code);
-        return jsonResponse19(result);
+        return jsonResponse14(result);
       } catch (err2) {
-        return jsonResponse19(
+        return jsonResponse14(
           { error: err2 instanceof Error ? err2.message : "Failed to regenerate codes" },
           400
         );
@@ -14187,13 +14116,13 @@ function createTotpModule(config, db) {
 }
 
 // src/auth/totp-plugin.ts
-function jsonResponse20(body, status = 200) {
+function jsonResponse15(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody14(request) {
+async function parseBody8(request) {
   try {
     return await request.json();
   } catch {
@@ -14215,13 +14144,13 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
           try {
             const setup = await module.setup(user.id);
-            return jsonResponse20(setup);
+            return jsonResponse15(setup);
           } catch (err2) {
-            return jsonResponse20(
+            return jsonResponse15(
               { error: err2 instanceof Error ? err2.message : "Enrollment failed" },
               500
             );
@@ -14238,23 +14167,23 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody14(request);
+          const body = await parseBody8(request);
           const code = typeof body.code === "string" ? body.code : null;
           if (!code) {
-            return jsonResponse20({ error: "Missing required field: code" }, 400);
+            return jsonResponse15({ error: "Missing required field: code" }, 400);
           }
           const enabled = await module.isEnabled(user.id);
           if (!enabled) {
             const result2 = await module.enable(user.id, code);
             if (!result2.enabled) {
-              return jsonResponse20({ error: "Invalid TOTP code" }, 400);
+              return jsonResponse15({ error: "Invalid TOTP code" }, 400);
             }
-            return jsonResponse20({ valid: true, activated: true });
+            return jsonResponse15({ valid: true, activated: true });
           }
           const result = await module.verify(user.id, code);
-          return jsonResponse20(result);
+          return jsonResponse15(result);
         }
       });
       ctx.addEndpoint({
@@ -14267,18 +14196,18 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody14(request);
+          const body = await parseBody8(request);
           const code = typeof body.code === "string" ? body.code : null;
           if (!code) {
-            return jsonResponse20({ error: "Missing required field: code" }, 400);
+            return jsonResponse15({ error: "Missing required field: code" }, 400);
           }
           const result = await module.disable(user.id, code);
           if (!result.disabled) {
-            return jsonResponse20({ error: "Invalid TOTP code" }, 400);
+            return jsonResponse15({ error: "Invalid TOTP code" }, 400);
           }
-          return jsonResponse20(result);
+          return jsonResponse15(result);
         }
       });
       ctx.addEndpoint({
@@ -14291,10 +14220,10 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
           const enabled = await module.isEnabled(user.id);
-          return jsonResponse20({ enabled });
+          return jsonResponse15({ enabled });
         }
       });
       ctx.addEndpoint({
@@ -14307,18 +14236,18 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody14(request);
+          const body = await parseBody8(request);
           const code = typeof body.code === "string" ? body.code : null;
           if (!code) {
-            return jsonResponse20({ error: "Missing required field: code" }, 400);
+            return jsonResponse15({ error: "Missing required field: code" }, 400);
           }
           try {
             const result = await module.regenerateBackupCodes(user.id, code);
-            return jsonResponse20(result);
+            return jsonResponse15(result);
           } catch (err2) {
-            return jsonResponse20(
+            return jsonResponse15(
               { error: err2 instanceof Error ? err2.message : "Failed to regenerate backup codes" },
               400
             );
@@ -14437,7 +14366,7 @@ async function hashPassword(password) {
 async function verifyPassword(stored, candidate) {
   return pbkdf2Verify(candidate, stored);
 }
-function jsonResponse21(body, status = 200) {
+function jsonResponse16(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -14561,12 +14490,12 @@ function createUsernameAuthModule(config, db, sessionManager) {
     try {
       body = await request.json();
     } catch {
-      return jsonResponse21({ error: "Invalid JSON body" }, 400);
+      return jsonResponse16({ error: "Invalid JSON body" }, 400);
     }
     const b = body;
     if (pathname === "/auth/username/sign-up") {
       if (typeof b.username !== "string" || typeof b.password !== "string") {
-        return jsonResponse21({ error: "Missing required fields: username, password" }, 400);
+        return jsonResponse16({ error: "Missing required fields: username, password" }, 400);
       }
       try {
         const result = await signUp({
@@ -14574,21 +14503,21 @@ function createUsernameAuthModule(config, db, sessionManager) {
           password: b.password,
           name: typeof b.name === "string" ? b.name : void 0
         });
-        return jsonResponse21(result, 201);
+        return jsonResponse16(result, 201);
       } catch (err2) {
-        return jsonResponse21({ error: err2 instanceof Error ? err2.message : "Sign-up failed" }, 400);
+        return jsonResponse16({ error: err2 instanceof Error ? err2.message : "Sign-up failed" }, 400);
       }
     }
     if (pathname === "/auth/username/sign-in") {
       if (typeof b.username !== "string" || typeof b.password !== "string") {
-        return jsonResponse21({ error: "Missing required fields: username, password" }, 400);
+        return jsonResponse16({ error: "Missing required fields: username, password" }, 400);
       }
       try {
         const result = await signIn({ username: b.username, password: b.password });
-        return jsonResponse21(result);
+        return jsonResponse16(result);
       } catch (err2) {
         if (err2 instanceof Error && err2.message === "Password reset required") {
-          return jsonResponse21(
+          return jsonResponse16(
             {
               error: {
                 code: "PASSWORD_RESET_REQUIRED",
@@ -14598,21 +14527,21 @@ function createUsernameAuthModule(config, db, sessionManager) {
             403
           );
         }
-        return jsonResponse21({ error: "Invalid username or password" }, 401);
+        return jsonResponse16({ error: "Invalid username or password" }, 401);
       }
     }
     if (pathname === "/auth/username/change-password") {
       if (typeof b.userId !== "string" || typeof b.current !== "string" || typeof b.newPassword !== "string") {
-        return jsonResponse21(
+        return jsonResponse16(
           { error: "Missing required fields: userId, current, newPassword" },
           400
         );
       }
       try {
         const result = await changePassword(b.userId, b.current, b.newPassword);
-        return jsonResponse21(result);
+        return jsonResponse16(result);
       } catch (err2) {
-        return jsonResponse21(
+        return jsonResponse16(
           { error: err2 instanceof Error ? err2.message : "Change password failed" },
           400
         );
@@ -14620,13 +14549,13 @@ function createUsernameAuthModule(config, db, sessionManager) {
     }
     if (pathname === "/auth/username/change-username") {
       if (typeof b.userId !== "string" || typeof b.newUsername !== "string") {
-        return jsonResponse21({ error: "Missing required fields: userId, newUsername" }, 400);
+        return jsonResponse16({ error: "Missing required fields: userId, newUsername" }, 400);
       }
       try {
         const result = await changeUsername(b.userId, b.newUsername);
-        return jsonResponse21(result);
+        return jsonResponse16(result);
       } catch (err2) {
-        return jsonResponse21(
+        return jsonResponse16(
           { error: err2 instanceof Error ? err2.message : "Change username failed" },
           400
         );