kavachos 0.1.5 → 0.2.0

package/dist/index.js

@@ -1798,7 +1798,7 @@ function createAdminModule(config, db, sessionManager) {
     const url = new URL(request.url);
     const { pathname } = url;
     const { method } = request;
-    const json3 = (data, status = 200) => new Response(JSON.stringify(data), {
+    const json2 = (data, status = 200) => new Response(JSON.stringify(data), {
       status,
       headers: { "Content-Type": "application/json" }
     });
@@ -1807,14 +1807,14 @@ function createAdminModule(config, db, sessionManager) {
       const offset = url.searchParams.get("offset") ? Number(url.searchParams.get("offset")) : void 0;
       const search = url.searchParams.get("search") ?? void 0;
       const result = await listUsers({ limit, offset, search });
-      return json3(result);
+      return json2(result);
     }
     const userMatch = /^\/auth\/admin\/users\/([^/]+)$/.exec(pathname);
     if (method === "GET" && userMatch) {
       const userId = decodeURIComponent(userMatch[1] ?? "");
       const user = await getUser(userId);
-      if (!user) return json3({ error: "User not found" }, 404);
-      return json3(user);
+      if (!user) return json2({ error: "User not found" }, 404);
+      return json2(user);
     }
     const banMatch = /^\/auth\/admin\/users\/([^/]+)\/ban$/.exec(pathname);
     if (method === "POST" && banMatch) {
@@ -1827,19 +1827,19 @@ function createAdminModule(config, db, sessionManager) {
       const reason = typeof body.reason === "string" ? body.reason : void 0;
       const expiresAt = body.expiresAt ? new Date(body.expiresAt) : void 0;
       await banUser(userId, reason, expiresAt);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const unbanMatch = /^\/auth\/admin\/users\/([^/]+)\/unban$/.exec(pathname);
     if (method === "POST" && unbanMatch) {
       const userId = decodeURIComponent(unbanMatch[1] ?? "");
       await unbanUser(userId);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const deleteMatch = /^\/auth\/admin\/users\/([^/]+)$/.exec(pathname);
     if (method === "DELETE" && deleteMatch) {
       const userId = decodeURIComponent(deleteMatch[1] ?? "");
       await deleteUser(userId);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const impersonateMatch = /^\/auth\/admin\/impersonate\/([^/]+)$/.exec(pathname);
     if (method === "POST" && impersonateMatch) {
@@ -1848,28 +1848,28 @@ function createAdminModule(config, db, sessionManager) {
       try {
         body = await request.json();
       } catch {
-        return json3({ error: "Invalid JSON body" }, 400);
+        return json2({ error: "Invalid JSON body" }, 400);
       }
       const adminUserId = body.adminUserId;
       if (typeof adminUserId !== "string") {
-        return json3({ error: "Missing required field: adminUserId" }, 400);
+        return json2({ error: "Missing required field: adminUserId" }, 400);
       }
       try {
         const result = await impersonate(adminUserId, targetUserId);
-        return json3(result);
+        return json2(result);
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 403);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 403);
       }
     }
     if (method === "POST" && pathname === "/auth/admin/stop-impersonation") {
       const auth = request.headers.get("Authorization");
       const token = auth?.startsWith("Bearer ") ? auth.slice(7) : null;
-      if (!token) return json3({ error: "Missing Authorization header" }, 401);
+      if (!token) return json2({ error: "Missing Authorization header" }, 401);
       try {
         await stopImpersonation(token);
-        return json3({ success: true });
+        return json2({ success: true });
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
       }
     }
     return null;
@@ -1887,78 +1887,9 @@ function createAdminModule(config, db, sessionManager) {
     handleRequest
   };
 }
-var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
-function createSessionManager(config, db) {
-  if (!config.secret || config.secret.length < 32) {
-    throw new Error("SessionManager: secret must be at least 32 characters.");
-  }
-  const maxAge = config.maxAge ?? DEFAULT_MAX_AGE_SECONDS;
-  const keyObject = new TextEncoder().encode(config.secret);
-  function rowToSession2(row) {
-    return {
-      id: row.id,
-      userId: row.userId,
-      expiresAt: row.expiresAt,
-      createdAt: row.createdAt,
-      ...row.metadata !== null && { metadata: row.metadata }
-    };
-  }
-  async function create(userId, metadata) {
-    const id = generateId();
-    const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + maxAge * 1e3);
-    await db.insert(sessions).values({
-      id,
-      userId,
-      expiresAt,
-      metadata: metadata ?? null,
-      createdAt: now
-    });
-    const token = await new SignJWT({ sub: id }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(Math.floor(expiresAt.getTime() / 1e3)).sign(keyObject);
-    const session = {
-      id,
-      userId,
-      expiresAt,
-      createdAt: now,
-      ...metadata !== void 0 && { metadata }
-    };
-    return { session, token };
-  }
-  async function validate(token) {
-    let sessionId;
-    try {
-      const { payload } = await jwtVerify(token, keyObject);
-      if (typeof payload.sub !== "string" || !payload.sub) return null;
-      sessionId = payload.sub;
-    } catch {
-      return null;
-    }
-    const now = /* @__PURE__ */ new Date();
-    const rows = await db.select().from(sessions).where(and(eq(sessions.id, sessionId)));
-    const row = rows[0];
-    if (!row) return null;
-    if (row.expiresAt <= now) {
-      await db.delete(sessions).where(eq(sessions.id, sessionId));
-      return null;
-    }
-    return rowToSession2(row);
-  }
-  async function revoke(sessionId) {
-    await db.delete(sessions).where(eq(sessions.id, sessionId));
-  }
-  async function revokeAll(userId) {
-    await db.delete(sessions).where(eq(sessions.userId, userId));
-  }
-  async function list(userId) {
-    const now = /* @__PURE__ */ new Date();
-    const rows = await db.select().from(sessions).where(and(eq(sessions.userId, userId)));
-    return rows.filter((row) => row.expiresAt > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime()).map(rowToSession2);
-  }
-  return { create, validate, revoke, revokeAll, list };
-}
 
-// src/auth/admin-plugin.ts
-function jsonResponse2(body, status = 200) {
+// src/plugin/helpers.ts
+function json(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -1966,18 +1897,41 @@ function jsonResponse2(body, status = 200) {
 }
 async function parseBody(request) {
   try {
-    return await request.json();
+    const data = await request.json();
+    return { ok: true, data };
   } catch {
-    return {};
+    return {
+      ok: false,
+      response: json({ error: "Invalid JSON body" }, 400)
+    };
+  }
+}
+function getCookie(request, name) {
+  const header = request.headers.get("cookie");
+  if (!header) return null;
+  const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match?.[1] ? decodeURIComponent(match[1]) : null;
+}
+function buildSetCookie(name, value, maxAge, path = "/") {
+  return `${name}=${encodeURIComponent(value)}; HttpOnly; Secure; SameSite=Lax; Path=${path}; Max-Age=${maxAge}`;
+}
+function buildClearCookie(name, path = "/") {
+  return `${name}=; HttpOnly; Secure; SameSite=Lax; Path=${path}; Max-Age=0`;
+}
+function extractToken(request, cookieName = "kavach_session") {
+  const authHeader = request.headers.get("authorization");
+  if (authHeader?.startsWith("Bearer ")) {
+    return authHeader.slice(7);
   }
+  return getCookie(request, cookieName);
 }
+
+// src/auth/admin-plugin.ts
 function admin(config) {
   return {
     id: "kavach-admin",
     async init(ctx) {
-      const sessionConfig = ctx.config.auth?.session;
-      const sessionManager = sessionConfig ? createSessionManager(sessionConfig, ctx.db) : null;
-      const module = createAdminModule(config ?? {}, ctx.db, sessionManager);
+      const module = createAdminModule(config ?? {}, ctx.db, ctx.sessionManager ?? null);
       ctx.addEndpoint({
         method: "GET",
         path: "/auth/admin/users",
@@ -1988,11 +1942,11 @@ function admin(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const isAdminUser = await module.isAdmin(user.id);
           if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
+            return json({ error: "Admin access required" }, 403);
           }
           const url = new URL(request.url);
           const limitParam = url.searchParams.get("limit");
@@ -2003,7 +1957,7 @@ function admin(config) {
             offset: offsetParam ? Number(offsetParam) : void 0,
             search
           });
-          return jsonResponse2(result);
+          return json(result);
         }
       });
       ctx.addEndpoint({
@@ -2016,23 +1970,23 @@ function admin(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const isAdminUser = await module.isAdmin(user.id);
           if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
+            return json({ error: "Admin access required" }, 403);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const targetId = segments[3];
           if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
+            return json({ error: "Missing user ID in path" }, 400);
           }
           const found = await module.getUser(decodeURIComponent(targetId));
           if (!found) {
-            return jsonResponse2({ error: "User not found" }, 404);
+            return json({ error: "User not found" }, 404);
           }
-          return jsonResponse2(found);
+          return json(found);
         }
       });
       ctx.addEndpoint({
@@ -2045,23 +1999,24 @@ function admin(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const isAdminUser = await module.isAdmin(user.id);
           if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
+            return json({ error: "Admin access required" }, 403);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const targetId = segments[3];
           if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
+            return json({ error: "Missing user ID in path" }, 400);
           }
-          const body = await parseBody(request);
-          const reason = typeof body.reason === "string" ? body.reason : void 0;
-          const expiresAt = body.expiresAt ? new Date(body.expiresAt) : void 0;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const reason = typeof bodyResult.data.reason === "string" ? bodyResult.data.reason : void 0;
+          const expiresAt = bodyResult.data.expiresAt ? new Date(bodyResult.data.expiresAt) : void 0;
           await module.banUser(decodeURIComponent(targetId), reason, expiresAt);
-          return jsonResponse2({ success: true });
+          return json({ success: true });
         }
       });
       ctx.addEndpoint({
@@ -2074,20 +2029,20 @@ function admin(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const isAdminUser = await module.isAdmin(user.id);
           if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
+            return json({ error: "Admin access required" }, 403);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const targetId = segments[3];
           if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
+            return json({ error: "Missing user ID in path" }, 400);
           }
           await module.unbanUser(decodeURIComponent(targetId));
-          return jsonResponse2({ success: true });
+          return json({ success: true });
         }
       });
       ctx.addEndpoint({
@@ -2100,20 +2055,20 @@ function admin(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const isAdminUser = await module.isAdmin(user.id);
           if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
+            return json({ error: "Admin access required" }, 403);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const targetId = segments[3];
           if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
+            return json({ error: "Missing user ID in path" }, 400);
           }
           await module.deleteUser(decodeURIComponent(targetId));
-          return jsonResponse2({ success: true });
+          return json({ success: true });
         }
       });
       ctx.addEndpoint({
@@ -2126,23 +2081,23 @@ function admin(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const isAdminUser = await module.isAdmin(user.id);
           if (!isAdminUser) {
-            return jsonResponse2({ error: "Admin access required" }, 403);
+            return json({ error: "Admin access required" }, 403);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const targetId = segments[3];
           if (!targetId) {
-            return jsonResponse2({ error: "Missing user ID in path" }, 400);
+            return json({ error: "Missing user ID in path" }, 400);
           }
           try {
             const result = await module.impersonate(user.id, decodeURIComponent(targetId));
-            return jsonResponse2(result);
+            return json(result);
           } catch (err2) {
-            return jsonResponse2(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Impersonation failed" },
               403
             );
@@ -2221,29 +2176,14 @@ function createAnonymousAuthModule(config, db, sessionManager) {
 }
 
 // src/auth/anonymous-plugin.ts
-function jsonResponse3(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody2(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function anonymousAuth(config) {
   return {
     id: "kavach-anonymous",
     async init(ctx) {
-      const sessionSecret = ctx.config.auth?.session?.secret;
-      if (!sessionSecret) {
+      if (!ctx.sessionManager) {
         throw new Error("anonymousAuth plugin requires auth.session.secret to be configured");
       }
-      const sessionManager = createSessionManager({ secret: sessionSecret }, ctx.db);
-      const mod = createAnonymousAuthModule(config ?? {}, ctx.db, sessionManager);
+      const mod = createAnonymousAuthModule(config ?? {}, ctx.db, ctx.sessionManager);
       ctx.addEndpoint({
         method: "POST",
         path: "/auth/anonymous",
@@ -2254,9 +2194,9 @@ function anonymousAuth(config) {
         async handler(_request, _endpointCtx) {
           try {
             const result = await mod.createAnonymousUser();
-            return jsonResponse3({ userId: result.userId, sessionToken: result.sessionToken });
+            return json({ userId: result.userId, sessionToken: result.sessionToken });
           } catch (err2) {
-            return jsonResponse3(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Failed to create anonymous user" },
               500
             );
@@ -2273,21 +2213,22 @@ function anonymousAuth(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse3({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody2(request);
-          const email = typeof body.email === "string" ? body.email.trim() : null;
-          const name = typeof body.name === "string" ? body.name.trim() : void 0;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const email = typeof bodyResult.data.email === "string" ? bodyResult.data.email.trim() : null;
+          const name = typeof bodyResult.data.name === "string" ? bodyResult.data.name.trim() : void 0;
           if (!email) {
-            return jsonResponse3({ error: "Missing required field: email" }, 400);
+            return json({ error: "Missing required field: email" }, 400);
           }
           try {
             await mod.upgradeUser(user.id, { email, name });
-            return jsonResponse3({ upgraded: true });
+            return json({ upgraded: true });
           } catch (err2) {
             const message = err2 instanceof Error ? err2.message : "Upgrade failed";
             const status = message.includes("not an anonymous user") ? 400 : 500;
-            return jsonResponse3({ error: message }, status);
+            return json({ error: message }, status);
           }
         }
       });
@@ -2301,10 +2242,10 @@ function anonymousAuth(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse3({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const anonymous = await mod.isAnonymous(user.id);
-          return jsonResponse3({ anonymous });
+          return json({ anonymous });
         }
       });
     }
@@ -2410,7 +2351,7 @@ function createApiKeyManagerModule(config, db) {
     const url = new URL(request.url);
     const { pathname } = url;
     const { method } = request;
-    const json3 = (data, status = 200) => new Response(JSON.stringify(data), {
+    const json2 = (data, status = 200) => new Response(JSON.stringify(data), {
       status,
       headers: { "Content-Type": "application/json" }
     });
@@ -2419,11 +2360,11 @@ function createApiKeyManagerModule(config, db) {
       try {
         body = await request.json();
       } catch {
-        return json3({ error: "Invalid JSON body" }, 400);
+        return json2({ error: "Invalid JSON body" }, 400);
       }
       const b = body;
       if (typeof b.userId !== "string" || typeof b.name !== "string" || !Array.isArray(b.permissions)) {
-        return json3({ error: "Missing required fields: userId, name, permissions" }, 400);
+        return json2({ error: "Missing required fields: userId, name, permissions" }, 400);
       }
       const expiresAt = b.expiresAt ? new Date(b.expiresAt) : void 0;
       const result = await create({
@@ -2432,28 +2373,28 @@ function createApiKeyManagerModule(config, db) {
         permissions: b.permissions,
         expiresAt
       });
-      return json3(result, 201);
+      return json2(result, 201);
     }
     const listMatch = /^\/auth\/api-keys\/([^/]+)$/.exec(pathname);
     if (method === "GET" && listMatch) {
       const userId = decodeURIComponent(listMatch[1] ?? "");
       const keys = await list(userId);
-      return json3(keys);
+      return json2(keys);
     }
     const deleteMatch = /^\/auth\/api-keys\/([^/]+)$/.exec(pathname);
     if (method === "DELETE" && deleteMatch) {
       const keyId = decodeURIComponent(deleteMatch[1] ?? "");
       await revoke(keyId);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const rotateMatch = /^\/auth\/api-keys\/([^/]+)\/rotate$/.exec(pathname);
     if (method === "POST" && rotateMatch) {
       const keyId = decodeURIComponent(rotateMatch[1] ?? "");
       try {
         const result = await rotate(keyId);
-        return json3(result);
+        return json2(result);
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 404);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 404);
       }
     }
     return null;
@@ -2470,19 +2411,6 @@ function createApiKeyManagerModule(config, db) {
 }
 
 // src/auth/api-key-plugin.ts
-function jsonResponse4(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody3(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function apiKeys2(config) {
   return {
     id: "kavach-api-key",
@@ -2498,15 +2426,16 @@ function apiKeys2(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse4({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody3(request);
-          const name = typeof body.name === "string" ? body.name.trim() : null;
-          const permissions2 = Array.isArray(body.permissions) ? body.permissions : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const name = typeof bodyResult.data.name === "string" ? bodyResult.data.name.trim() : null;
+          const permissions2 = Array.isArray(bodyResult.data.permissions) ? bodyResult.data.permissions : null;
           if (!name || !permissions2) {
-            return jsonResponse4({ error: "Missing required fields: name, permissions" }, 400);
+            return json({ error: "Missing required fields: name, permissions" }, 400);
           }
-          const expiresAt = body.expiresAt ? new Date(body.expiresAt) : void 0;
+          const expiresAt = bodyResult.data.expiresAt ? new Date(bodyResult.data.expiresAt) : void 0;
           try {
             const result = await module.create({
               userId: user.id,
@@ -2514,9 +2443,9 @@ function apiKeys2(config) {
               permissions: permissions2,
               expiresAt
             });
-            return jsonResponse4(result, 201);
+            return json(result, 201);
           } catch (err2) {
-            return jsonResponse4(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Failed to create API key" },
               500
             );
@@ -2533,10 +2462,10 @@ function apiKeys2(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse4({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const keys = await module.list(user.id);
-          return jsonResponse4({ apiKeys: keys });
+          return json({ apiKeys: keys });
         }
       });
       ctx.addEndpoint({
@@ -2549,21 +2478,21 @@ function apiKeys2(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse4({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const keyId = segments[2];
           if (!keyId) {
-            return jsonResponse4({ error: "Missing API key ID in path" }, 400);
+            return json({ error: "Missing API key ID in path" }, 400);
           }
           const keys = await module.list(user.id);
           const owned = keys.some((k) => k.id === decodeURIComponent(keyId));
           if (!owned) {
-            return jsonResponse4({ error: "API key not found" }, 404);
+            return json({ error: "API key not found" }, 404);
           }
           await module.revoke(decodeURIComponent(keyId));
-          return jsonResponse4({ revoked: true });
+          return json({ revoked: true });
         }
       });
       ctx.addEndpoint({
@@ -2576,24 +2505,24 @@ function apiKeys2(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse4({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const keyId = segments[2];
           if (!keyId) {
-            return jsonResponse4({ error: "Missing API key ID in path" }, 400);
+            return json({ error: "Missing API key ID in path" }, 400);
           }
           const keys = await module.list(user.id);
           const owned = keys.some((k) => k.id === decodeURIComponent(keyId));
           if (!owned) {
-            return jsonResponse4({ error: "API key not found" }, 404);
+            return json({ error: "API key not found" }, 404);
           }
           try {
             const result = await module.rotate(decodeURIComponent(keyId));
-            return jsonResponse4(result);
+            return json(result);
           } catch (err2) {
-            return jsonResponse4(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Failed to rotate API key" },
               400
             );
@@ -2983,13 +2912,13 @@ function customSession(config = {}) {
           const url = new URL(request.url);
           const sessionId = url.searchParams.get("sessionId");
           if (!sessionId) {
-            return jsonResponse5({ error: "Missing required query parameter: sessionId" }, 400);
+            return jsonResponse2({ error: "Missing required query parameter: sessionId" }, 400);
           }
           try {
             const fields = await mod.getSessionFields(sessionId);
-            return jsonResponse5({ fields: fields ?? {} });
+            return jsonResponse2({ fields: fields ?? {} });
           } catch (err2) {
-            return jsonResponse5(
+            return jsonResponse2(
               { error: err2 instanceof Error ? err2.message : "Failed to get session fields" },
               500
             );
@@ -3008,23 +2937,23 @@ function customSession(config = {}) {
           try {
             body = await request.json();
           } catch {
-            return jsonResponse5({ error: "Invalid JSON body" }, 400);
+            return jsonResponse2({ error: "Invalid JSON body" }, 400);
           }
           const sessionId = typeof body.sessionId === "string" ? body.sessionId : null;
           if (!sessionId) {
-            return jsonResponse5({ error: "Missing required field: sessionId" }, 400);
+            return jsonResponse2({ error: "Missing required field: sessionId" }, 400);
           }
           const fields = body.fields !== null && body.fields !== void 0 && typeof body.fields === "object" && !Array.isArray(body.fields) ? body.fields : null;
           if (!fields) {
-            return jsonResponse5({ error: "Missing or invalid field: fields" }, 400);
+            return jsonResponse2({ error: "Missing or invalid field: fields" }, 400);
           }
           try {
             await mod.updateSessionFields(sessionId, fields);
-            return jsonResponse5({ updated: true });
+            return jsonResponse2({ updated: true });
           } catch (err2) {
             const message = err2 instanceof Error ? err2.message : "Update failed";
             const status = message.includes("not found") ? 404 : 500;
-            return jsonResponse5({ error: message }, status);
+            return jsonResponse2({ error: message }, status);
           }
         }
       });
@@ -3034,7 +2963,7 @@ function customSession(config = {}) {
     }
   };
 }
-function jsonResponse5(body, status = 200) {
+function jsonResponse2(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -3047,13 +2976,13 @@ var DEFAULT_CODE_EXPIRY_SECONDS = 900;
 var DEFAULT_POLL_INTERVAL_SECONDS = 5;
 var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
 var SLOW_DOWN_THRESHOLD_MS = 4e3;
-function jsonResponse6(body, status = 200) {
+function jsonResponse3(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody4(request) {
+async function parseBody2(request) {
   try {
     return await request.json();
   } catch {
@@ -3177,7 +3106,7 @@ function createDeviceAuthModule(config) {
     const { method, pathname } = { method: request.method, pathname: url.pathname };
     if (method === "POST" && pathname.endsWith("/auth/device/code")) {
       const response = await requestCode();
-      return jsonResponse6({
+      return jsonResponse3({
         device_code: response.deviceCode,
         user_code: response.userCode,
         verification_uri: response.verificationUri,
@@ -3187,17 +3116,17 @@ function createDeviceAuthModule(config) {
       });
     }
     if (method === "POST" && pathname.endsWith("/auth/device/token")) {
-      const body = await parseBody4(request);
+      const body = await parseBody2(request);
       const deviceCode = typeof body.device_code === "string" ? body.device_code : null;
       if (!deviceCode) {
-        return jsonResponse6(
+        return jsonResponse3(
           { error: "invalid_request", error_description: "Missing device_code" },
           400
         );
       }
       const grant = grantsByDevice.get(deviceCode);
       if (grant?.lastPolledAt && Date.now() - grant.lastPolledAt < SLOW_DOWN_THRESHOLD_MS) {
-        return jsonResponse6(
+        return jsonResponse3(
           {
             error: "slow_down",
             error_description: "Polling too frequently",
@@ -3208,10 +3137,10 @@ function createDeviceAuthModule(config) {
       }
       const status = await checkAuthorization(deviceCode);
       if (status.status === "authorized") {
-        return jsonResponse6({ authorized: true, user_id: status.userId });
+        return jsonResponse3({ authorized: true, user_id: status.userId });
       }
       if (status.status === "pending") {
-        return jsonResponse6(
+        return jsonResponse3(
           {
             error: "authorization_pending",
             error_description: "The user has not yet authorized the device"
@@ -3220,7 +3149,7 @@ function createDeviceAuthModule(config) {
         );
       }
       if (status.status === "denied") {
-        return jsonResponse6(
+        return jsonResponse3(
           {
             error: "access_denied",
             error_description: "The user denied the authorization request"
@@ -3228,7 +3157,7 @@ function createDeviceAuthModule(config) {
           400
         );
       }
-      return jsonResponse6(
+      return jsonResponse3(
         {
           error: "expired_token",
           error_description: "The device code has expired"
@@ -3237,12 +3166,12 @@ function createDeviceAuthModule(config) {
       );
     }
     if (method === "POST" && pathname.endsWith("/auth/device/authorize")) {
-      const body = await parseBody4(request);
+      const body = await parseBody2(request);
       const userCode = typeof body.user_code === "string" ? body.user_code : null;
       const userId = typeof body.user_id === "string" ? body.user_id : null;
       const action = typeof body.action === "string" ? body.action : "approve";
       if (!userCode || !userId) {
-        return jsonResponse6(
+        return jsonResponse3(
           { error: "invalid_request", error_description: "Missing user_code or user_id" },
           400
         );
@@ -3250,12 +3179,12 @@ function createDeviceAuthModule(config) {
       try {
         if (action === "deny") {
           await deny(userCode);
-          return jsonResponse6({ denied: true });
+          return jsonResponse3({ denied: true });
         }
         await authorize(userCode, userId);
-        return jsonResponse6({ authorized: true });
+        return jsonResponse3({ authorized: true });
       } catch (err2) {
-        return jsonResponse6(
+        return jsonResponse3(
           {
             error: "invalid_request",
             error_description: err2 instanceof Error ? err2.message : "Authorization failed"
@@ -3536,31 +3465,16 @@ function createEmailOtpModule(config, db, sessionManager) {
 }
 
 // src/auth/email-otp-plugin.ts
-function jsonResponse7(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody5(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function emailOtp(config) {
   return {
     id: "kavach-email-otp",
     async init(ctx) {
-      const sessionConfig = ctx.config.auth?.session;
-      if (!sessionConfig) {
+      if (!ctx.sessionManager) {
         throw new Error(
           "kavach-email-otp plugin requires auth.session to be configured so that sessions can be issued on successful verification."
         );
       }
-      const sessionManager = createSessionManager(sessionConfig, ctx.db);
-      const module = createEmailOtpModule(config, ctx.db, sessionManager);
+      const module = createEmailOtpModule(config, ctx.db, ctx.sessionManager);
       ctx.addEndpoint({
         method: "POST",
         path: "/auth/email-otp/send",
@@ -3569,19 +3483,17 @@ function emailOtp(config) {
           description: "Send a one-time passcode to the provided email address"
         },
         async handler(request) {
-          const body = await parseBody5(request);
-          const rawEmail = typeof body.email === "string" ? body.email.trim().toLowerCase() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const rawEmail = typeof bodyResult.data.email === "string" ? bodyResult.data.email.trim().toLowerCase() : null;
           if (!rawEmail) {
-            return jsonResponse7({ error: "Missing required field: email" }, 400);
+            return json({ error: "Missing required field: email" }, 400);
           }
           try {
             const result = await module.sendCode(rawEmail);
-            return jsonResponse7(result);
+            return json(result);
           } catch (err2) {
-            return jsonResponse7(
-              { error: err2 instanceof Error ? err2.message : "Failed to send OTP" },
-              500
-            );
+            return json({ error: err2 instanceof Error ? err2.message : "Failed to send OTP" }, 500);
           }
         }
       });
@@ -3593,17 +3505,18 @@ function emailOtp(config) {
           description: "Verify an OTP code and return a session on success"
         },
         async handler(request) {
-          const body = await parseBody5(request);
-          const rawEmail = typeof body.email === "string" ? body.email.trim().toLowerCase() : null;
-          const code2 = typeof body.code === "string" ? body.code.trim() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const rawEmail = typeof bodyResult.data.email === "string" ? bodyResult.data.email.trim().toLowerCase() : null;
+          const code2 = typeof bodyResult.data.code === "string" ? bodyResult.data.code.trim() : null;
           if (!rawEmail || !code2) {
-            return jsonResponse7({ error: "Missing required fields: email, code" }, 400);
+            return json({ error: "Missing required fields: email, code" }, 400);
           }
           const result = await module.verifyCode(rawEmail, code2);
           if (!result) {
-            return jsonResponse7({ error: "Invalid or expired OTP code" }, 401);
+            return json({ error: "Invalid or expired OTP code" }, 401);
           }
-          return jsonResponse7(result);
+          return json(result);
         }
       });
     }
@@ -3614,7 +3527,7 @@ var TOKEN_PURPOSE = "email-verify";
 function makeError(code2, message, details) {
   return { code: code2, message, ...details !== void 0 ? { details } : {} };
 }
-function jsonResponse8(body, status = 200) {
+function jsonResponse4(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -3706,29 +3619,29 @@ function createEmailVerificationModule(config, db, tokenModule) {
     try {
       body = await request.json();
     } catch {
-      return jsonResponse8({ error: "Invalid JSON body" }, 400);
+      return jsonResponse4({ error: "Invalid JSON body" }, 400);
     }
     const b = body;
     if (pathname === "/auth/verify-email/send") {
       if (typeof b.userId !== "string" || typeof b.email !== "string") {
-        return jsonResponse8({ error: "Missing required fields: userId, email" }, 400);
+        return jsonResponse4({ error: "Missing required fields: userId, email" }, 400);
       }
       const result = await sendVerification(b.userId, b.email);
       if (!result.success) {
         const status = result.error.code === "USER_NOT_FOUND" ? 404 : 500;
-        return jsonResponse8({ error: result.error.message }, status);
+        return jsonResponse4({ error: result.error.message }, status);
       }
       return new Response(null, { status: 204 });
     }
     if (pathname === "/auth/verify-email/confirm") {
       if (typeof b.token !== "string") {
-        return jsonResponse8({ error: "Missing required field: token" }, 400);
+        return jsonResponse4({ error: "Missing required field: token" }, 400);
       }
       const result = await verify(b.token);
       if (!result.success) {
-        return jsonResponse8({ error: result.error.message }, 400);
+        return jsonResponse4({ error: result.error.message }, 400);
       }
-      return jsonResponse8({ userId: result.data.userId, email: result.data.email });
+      return jsonResponse4({ userId: result.data.userId, email: result.data.email });
     }
     return null;
   }
@@ -4041,7 +3954,7 @@ data: ${data}
 
 `;
 }
-function extractToken(request) {
+function extractToken2(request) {
   const auth = request.headers.get("authorization");
   if (auth?.startsWith("Bearer ")) {
     return auth.slice(7).trim() || null;
@@ -4157,7 +4070,7 @@ function createEventStreamModule(config) {
       start(controller) {
         void (async () => {
           if (requireAuth) {
-            const token = extractToken(request) ?? params.token ?? null;
+            const token = extractToken2(request) ?? params.token ?? null;
             if (!token) {
               controller.enqueue(
                 new TextEncoder().encode(
@@ -4762,19 +4675,6 @@ function createGdprModule(db) {
 }
 
 // src/auth/gdpr-plugin.ts
-function jsonResponse9(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody6(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function gdpr() {
   return {
     id: "kavach-gdpr",
@@ -4790,16 +4690,13 @@ function gdpr() {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse9({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           try {
             const data = await module.exportUserData(user.id);
-            return jsonResponse9(data);
+            return json(data);
           } catch (err2) {
-            return jsonResponse9(
-              { error: err2 instanceof Error ? err2.message : "Export failed" },
-              500
-            );
+            return json({ error: err2 instanceof Error ? err2.message : "Export failed" }, 500);
           }
         }
       });
@@ -4813,30 +4710,28 @@ function gdpr() {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse9({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody6(request);
-          if (body.confirm !== "delete my account") {
-            return jsonResponse9(
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          if (bodyResult.data.confirm !== "delete my account") {
+            return json(
               {
                 error: 'Confirmation required. Send { "confirm": "delete my account" } in the request body.'
               },
               400
             );
           }
-          const keepAuditLogs = typeof body.keepAuditLogs === "boolean" ? body.keepAuditLogs : true;
-          const deleteOrganizations = typeof body.deleteOrganizations === "boolean" ? body.deleteOrganizations : false;
+          const keepAuditLogs = typeof bodyResult.data.keepAuditLogs === "boolean" ? bodyResult.data.keepAuditLogs : true;
+          const deleteOrganizations = typeof bodyResult.data.deleteOrganizations === "boolean" ? bodyResult.data.deleteOrganizations : false;
           try {
             const result = await module.deleteUser(user.id, {
               keepAuditLogs,
               deleteOrganizations
             });
-            return jsonResponse9({ success: true, ...result });
+            return json({ success: true, ...result });
           } catch (err2) {
-            return jsonResponse9(
-              { error: err2 instanceof Error ? err2.message : "Deletion failed" },
-              500
-            );
+            return json({ error: err2 instanceof Error ? err2.message : "Deletion failed" }, 500);
           }
         }
       });
@@ -4850,13 +4745,13 @@ function gdpr() {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse9({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           try {
             await module.anonymizeUser(user.id);
-            return jsonResponse9({ success: true });
+            return json({ success: true });
           } catch (err2) {
-            return jsonResponse9(
+            return json(
               { error: err2 instanceof Error ? err2.message : "Anonymization failed" },
               500
             );
@@ -5492,14 +5387,12 @@ function magicLink(config) {
   return {
     id: "kavach-magic-link",
     async init(ctx) {
-      const sessionConfig = ctx.config.auth?.session;
-      if (!sessionConfig) {
+      if (!ctx.sessionManager) {
         throw new Error(
           "kavach-magic-link plugin requires auth.session to be configured so that sessions can be issued on successful verification."
         );
       }
-      const sessionManager = createSessionManager(sessionConfig, ctx.db);
-      const module = createMagicLinkModule(config, ctx.db, sessionManager);
+      const module = createMagicLinkModule(config, ctx.db, ctx.sessionManager);
       const sendLimiter = createRateLimiter({ max: 5, window: 60 });
       ctx.addEndpoint({
         method: "POST",
@@ -5509,35 +5402,19 @@ function magicLink(config) {
           description: "Send a magic link to the provided email address"
         },
         handler: withRateLimit(async (request) => {
-          let body;
-          try {
-            body = await request.json();
-          } catch {
-            return new Response(JSON.stringify({ error: "Invalid JSON body" }), {
-              status: 400,
-              headers: { "Content-Type": "application/json" }
-            });
-          }
-          const b = body;
-          const rawEmail = typeof b.email === "string" ? b.email.trim().toLowerCase() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const rawEmail = typeof bodyResult.data.email === "string" ? bodyResult.data.email.trim().toLowerCase() : null;
           if (!rawEmail) {
-            return new Response(JSON.stringify({ error: "Missing required field: email" }), {
-              status: 400,
-              headers: { "Content-Type": "application/json" }
-            });
+            return json({ error: "Missing required field: email" }, 400);
           }
           try {
             const result = await module.sendLink(rawEmail);
-            return new Response(JSON.stringify(result), {
-              status: 200,
-              headers: { "Content-Type": "application/json" }
-            });
+            return json(result);
           } catch (err2) {
-            return new Response(
-              JSON.stringify({
-                error: err2 instanceof Error ? err2.message : "Failed to send magic link"
-              }),
-              { status: 500, headers: { "Content-Type": "application/json" } }
+            return json(
+              { error: err2 instanceof Error ? err2.message : "Failed to send magic link" },
+              500
             );
           }
         }, sendLimiter)
@@ -5552,22 +5429,13 @@ function magicLink(config) {
           const url = new URL(request.url);
           const token = url.searchParams.get("token");
           if (!token) {
-            return new Response(JSON.stringify({ error: "Missing token query parameter" }), {
-              status: 400,
-              headers: { "Content-Type": "application/json" }
-            });
+            return json({ error: "Missing token query parameter" }, 400);
           }
           const result = await module.verify(token);
           if (!result) {
-            return new Response(JSON.stringify({ error: "Invalid or expired magic link" }), {
-              status: 401,
-              headers: { "Content-Type": "application/json" }
-            });
+            return json({ error: "Invalid or expired magic link" }, 401);
           }
-          return new Response(JSON.stringify(result), {
-            status: 200,
-            headers: { "Content-Type": "application/json" }
-          });
+          return json(result);
         }
       });
     }
@@ -5792,7 +5660,7 @@ function createOAuthModule(db, config) {
     pruneExpiredStates
   };
 }
-function jsonResponse10(body, status = 200) {
+function jsonResponse5(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -5810,8 +5678,12 @@ function oauth(config) {
     async init(ctx) {
       const module = createOAuthModule(ctx.db, config);
       const baseUrl = ctx.config.baseUrl ?? "";
-      const sessionConfig = ctx.config.auth?.session;
-      const sessionManager = sessionConfig ? createSessionManager(sessionConfig, ctx.db) : null;
+      const sessionManager = ctx.sessionManager;
+      if (!sessionManager) {
+        throw new Error(
+          "kavach-oauth plugin requires auth.session to be configured so that sessions can be issued on successful OAuth callback."
+        );
+      }
       const authorizeLimiter = createRateLimiter({ max: 20, window: 60 });
       function getRedirectUri(provider) {
         if (config.buildRedirectUri) {
@@ -5830,14 +5702,14 @@ function oauth(config) {
           const url = new URL(request.url);
           const provider = url.searchParams.get("_param_provider");
           if (!provider) {
-            return jsonResponse10({ error: "Missing provider parameter" }, 400);
+            return jsonResponse5({ error: "Missing provider parameter" }, 400);
           }
           const redirectUri = getRedirectUri(provider);
           try {
             const { url: authUrl } = await module.getAuthorizationUrl(provider, redirectUri);
             return redirectResponse(authUrl);
           } catch (err2) {
-            return jsonResponse10(
+            return jsonResponse5(
               { error: err2 instanceof Error ? err2.message : "Failed to build authorization URL" },
               400
             );
@@ -5854,10 +5726,10 @@ function oauth(config) {
           const code2 = url.searchParams.get("code");
           const state = url.searchParams.get("state");
           if (!provider) {
-            return jsonResponse10({ error: "Missing provider parameter" }, 400);
+            return jsonResponse5({ error: "Missing provider parameter" }, 400);
           }
           if (!code2 || !state) {
-            return jsonResponse10({ error: "Missing code or state query parameter" }, 400);
+            return jsonResponse5({ error: "Missing code or state query parameter" }, 400);
           }
           const redirectUri = getRedirectUri(provider);
           try {
@@ -5889,18 +5761,27 @@ function oauth(config) {
                 raw: {}
               });
             }
-            if (sessionManager && userId !== "__pending__") {
+            if (userId !== "__pending__") {
               const { session, token } = await sessionManager.create(userId);
-              const callbackUrl = `${baseUrl}/?session=${encodeURIComponent(JSON.stringify({ token, user: { id: userId, email }, expiresAt: session.expiresAt }))}`;
-              return redirectResponse(callbackUrl);
+              const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
+              const cookie = buildSetCookie("kavach_session", token, maxAge);
+              const userInfo = encodeURIComponent(JSON.stringify({ id: userId, email }));
+              const callbackUrl = `${baseUrl}/?auth_user=${userInfo}`;
+              return new Response(null, {
+                status: 302,
+                headers: {
+                  Location: callbackUrl,
+                  "Set-Cookie": cookie
+                }
+              });
             }
-            return jsonResponse10({
+            return jsonResponse5({
               isNewAccount: result.isNewAccount,
               account: result.account,
               userInfo: result.userInfo
             });
           } catch (err2) {
-            return jsonResponse10(
+            return jsonResponse5(
               { error: err2 instanceof Error ? err2.message : "OAuth callback failed" },
               400
             );
@@ -5917,29 +5798,29 @@ function oauth(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse10({ error: "Authentication required" }, 401);
+            return jsonResponse5({ error: "Authentication required" }, 401);
           }
           let body;
           try {
             body = await request.json();
           } catch {
-            return jsonResponse10({ error: "Invalid JSON body" }, 400);
+            return jsonResponse5({ error: "Invalid JSON body" }, 400);
           }
           const b = body;
           const provider = typeof b.provider === "string" ? b.provider : null;
           const userInfo = typeof b.userInfo === "object" && b.userInfo !== null ? b.userInfo : null;
           const tokens = typeof b.tokens === "object" && b.tokens !== null ? b.tokens : null;
           if (!provider || !userInfo || !tokens) {
-            return jsonResponse10(
+            return jsonResponse5(
               { error: "Missing required fields: provider, userInfo, tokens" },
               400
             );
           }
           try {
             const account = await module.linkAccount(user.id, provider, userInfo, tokens);
-            return jsonResponse10({ account });
+            return jsonResponse5({ account });
           } catch (err2) {
-            return jsonResponse10(
+            return jsonResponse5(
               { error: err2 instanceof Error ? err2.message : "Failed to link account" },
               400
             );
@@ -5955,7 +5836,7 @@ function oauth(config) {
             id: p2.id,
             name: p2.name
           }));
-          return jsonResponse10({ providers });
+          return jsonResponse5({ providers });
         }
       });
     }
@@ -7752,25 +7633,25 @@ function createOneTapModule(config, db, sessionManager) {
       const text3 = await request.text();
       formData = new URLSearchParams(text3);
     } catch {
-      return jsonResponse11({ error: "Failed to parse request body" }, 400);
+      return jsonResponse6({ error: "Failed to parse request body" }, 400);
     }
     const credential = formData.get("credential");
     const bodyToken = formData.get(csrfCookieName);
     if (!credential) {
-      return jsonResponse11({ error: "Missing credential field" }, 400);
+      return jsonResponse6({ error: "Missing credential field" }, 400);
     }
     const cookieToken = getCsrfCookie(request);
     if (!cookieToken || !bodyToken || cookieToken !== bodyToken) {
-      return jsonResponse11({ error: "CSRF token mismatch" }, 403);
+      return jsonResponse6({ error: "CSRF token mismatch" }, 403);
     }
     let googleUser;
     try {
       googleUser = await verify(credential);
     } catch (err2) {
       if (err2 instanceof OneTapVerifyError && err2.code === "USER_NOT_FOUND") {
-        return jsonResponse11({ error: err2.message }, 403);
+        return jsonResponse6({ error: err2.message }, 403);
       }
-      return jsonResponse11(
+      return jsonResponse6(
         { error: err2 instanceof Error ? err2.message : "Token verification failed" },
         401
       );
@@ -7780,27 +7661,96 @@ function createOneTapModule(config, db, sessionManager) {
       user = await findOrCreateUser(googleUser);
     } catch (err2) {
       if (err2 instanceof OneTapVerifyError && err2.code === "USER_NOT_FOUND") {
-        return jsonResponse11({ error: err2.message }, 403);
+        return jsonResponse6({ error: err2.message }, 403);
       }
-      return jsonResponse11(
+      return jsonResponse6(
         { error: err2 instanceof Error ? err2.message : "Failed to resolve user" },
         500
       );
     }
     const { token: sessionToken, session } = await sessionManager.create(user.id);
-    return jsonResponse11({
+    return jsonResponse6({
       user: { id: user.id, email: user.email },
       session: { token: sessionToken, expiresAt: session.expiresAt }
     });
   }
   return { verify, handleRequest };
 }
-function jsonResponse11(body, status = 200) {
+function jsonResponse6(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
+var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
+function createSessionManager(config, db) {
+  if (!config.secret || config.secret.length < 32) {
+    throw new Error("SessionManager: secret must be at least 32 characters.");
+  }
+  const maxAge = config.maxAge ?? DEFAULT_MAX_AGE_SECONDS;
+  const keyObject = new TextEncoder().encode(config.secret);
+  function rowToSession2(row) {
+    return {
+      id: row.id,
+      userId: row.userId,
+      expiresAt: row.expiresAt,
+      createdAt: row.createdAt,
+      ...row.metadata !== null && { metadata: row.metadata }
+    };
+  }
+  async function create(userId, metadata) {
+    const id = generateId();
+    const now = /* @__PURE__ */ new Date();
+    const expiresAt = new Date(now.getTime() + maxAge * 1e3);
+    await db.insert(sessions).values({
+      id,
+      userId,
+      expiresAt,
+      metadata: metadata ?? null,
+      createdAt: now
+    });
+    const token = await new SignJWT({ sub: id }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(Math.floor(expiresAt.getTime() / 1e3)).sign(keyObject);
+    const session = {
+      id,
+      userId,
+      expiresAt,
+      createdAt: now,
+      ...metadata !== void 0 && { metadata }
+    };
+    return { session, token };
+  }
+  async function validate(token) {
+    let sessionId;
+    try {
+      const { payload } = await jwtVerify(token, keyObject);
+      if (typeof payload.sub !== "string" || !payload.sub) return null;
+      sessionId = payload.sub;
+    } catch {
+      return null;
+    }
+    const now = /* @__PURE__ */ new Date();
+    const rows = await db.select().from(sessions).where(and(eq(sessions.id, sessionId)));
+    const row = rows[0];
+    if (!row) return null;
+    if (row.expiresAt <= now) {
+      await db.delete(sessions).where(eq(sessions.id, sessionId));
+      return null;
+    }
+    return rowToSession2(row);
+  }
+  async function revoke(sessionId) {
+    await db.delete(sessions).where(eq(sessions.id, sessionId));
+  }
+  async function revokeAll(userId) {
+    await db.delete(sessions).where(eq(sessions.userId, userId));
+  }
+  async function list(userId) {
+    const now = /* @__PURE__ */ new Date();
+    const rows = await db.select().from(sessions).where(and(eq(sessions.userId, userId)));
+    return rows.filter((row) => row.expiresAt > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime()).map(rowToSession2);
+  }
+  return { create, validate, revoke, revokeAll, list };
+}
 
 // src/auth/one-tap-plugin.ts
 function oneTap(config) {
@@ -9092,14 +9042,14 @@ function rowToInvitation(row) {
     createdAt: row.createdAt
   };
 }
-function jsonResponse12(body, status = 200) {
+function jsonResponse7(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
 function errorResponse(message, status) {
-  return jsonResponse12({ error: message }, status);
+  return jsonResponse7({ error: message }, status);
 }
 function createOrgModule(config, db) {
   const maxMembers = config.maxMembers ?? DEFAULT_MAX_MEMBERS;
@@ -9405,7 +9355,7 @@ function createOrgModule(config, db) {
       try {
         const body = await request.json();
         const org = await create(body);
-        return jsonResponse12(org, 201);
+        return jsonResponse7(org, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -9415,7 +9365,7 @@ function createOrgModule(config, db) {
       const userId = userOrgMatch[1];
       if (!userId) return errorResponse("Missing userId", 400);
       const orgs = await list(userId);
-      return jsonResponse12(orgs);
+      return jsonResponse7(orgs);
     }
     const orgBaseMatch = pathname.match(/^\/auth\/org\/([^/]+)(\/.*)?$/);
     if (!orgBaseMatch) return null;
@@ -9425,13 +9375,13 @@ function createOrgModule(config, db) {
     if (method === "GET" && subPath === "") {
       const org = await get(orgId);
       if (!org) return errorResponse("Organization not found", 404);
-      return jsonResponse12(org);
+      return jsonResponse7(org);
     }
     if (method === "PATCH" && subPath === "") {
       try {
         const body = await request.json();
         const org = await update(orgId, body);
-        return jsonResponse12(org);
+        return jsonResponse7(org);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -9439,7 +9389,7 @@ function createOrgModule(config, db) {
     if (method === "DELETE" && subPath === "") {
       try {
         await remove(orgId);
-        return jsonResponse12({ success: true });
+        return jsonResponse7({ success: true });
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -9448,14 +9398,14 @@ function createOrgModule(config, db) {
       try {
         const body = await request.json();
         const member = await addMember(orgId, body.userId, body.role);
-        return jsonResponse12(member, 201);
+        return jsonResponse7(member, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
     }
     if (method === "GET" && subPath === "/members") {
       const members = await getMembers(orgId);
-      return jsonResponse12(members);
+      return jsonResponse7(members);
     }
     const memberMatch = subPath.match(/^\/members\/([^/]+)$/);
     if (method === "PATCH" && memberMatch) {
@@ -9464,7 +9414,7 @@ function createOrgModule(config, db) {
       try {
         const body = await request.json();
         const member = await updateMemberRole(orgId, userId, body.role);
-        return jsonResponse12(member);
+        return jsonResponse7(member);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -9473,20 +9423,20 @@ function createOrgModule(config, db) {
       const userId = memberMatch[1];
       if (!userId) return errorResponse("Missing userId", 400);
       await removeMember(orgId, userId);
-      return jsonResponse12({ success: true });
+      return jsonResponse7({ success: true });
     }
     if (method === "POST" && subPath === "/invite") {
       try {
         const body = await request.json();
         const invitation = await invite({ orgId, ...body });
-        return jsonResponse12(invitation, 201);
+        return jsonResponse7(invitation, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
     }
     if (method === "GET" && subPath === "/invitations") {
       const invitations = await listInvitations(orgId);
-      return jsonResponse12(invitations);
+      return jsonResponse7(invitations);
     }
     const permMatch = subPath.match(/^\/permissions\/([^/]+)\/([^/]+)$/);
     if (method === "GET" && permMatch) {
@@ -9494,20 +9444,20 @@ function createOrgModule(config, db) {
       const permission = permMatch[2];
       if (!userId || !permission) return errorResponse("Missing userId or permission", 400);
       const allowed = await hasPermission(orgId, userId, permission);
-      return jsonResponse12({ allowed });
+      return jsonResponse7({ allowed });
     }
     if (method === "POST" && subPath === "/roles") {
       try {
         const body = await request.json();
         const role = await createRole(orgId, body);
-        return jsonResponse12(role, 201);
+        return jsonResponse7(role, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
     }
     if (method === "GET" && subPath === "/roles") {
       const roles = await getRoles(orgId);
-      return jsonResponse12(roles);
+      return jsonResponse7(roles);
     }
     return null;
   }
@@ -9522,7 +9472,7 @@ function createOrgModule(config, db) {
       try {
         const body = await request.json();
         const member = await acceptInvitation(invitationId, body.userId);
-        return jsonResponse12(member, 201);
+        return jsonResponse7(member, 201);
       } catch (err2) {
         return errorResponse(err2 instanceof Error ? err2.message : "Unknown error", 400);
       }
@@ -9532,7 +9482,7 @@ function createOrgModule(config, db) {
       const invitationId = revokeMatch[1];
       if (!invitationId) return errorResponse("Missing invitationId", 400);
       await revokeInvitation(invitationId);
-      return jsonResponse12({ success: true });
+      return jsonResponse7({ success: true });
     }
     return handleRequest(request);
   }
@@ -9563,13 +9513,13 @@ function createOrgModule(config, db) {
 }
 
 // src/auth/organization-plugin.ts
-function jsonResponse13(body, status = 200) {
+function jsonResponse8(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody7(request) {
+async function parseBody3(request) {
   try {
     return await request.json();
   } catch {
@@ -9592,20 +9542,20 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody7(request);
+          const body = await parseBody3(request);
           const name = typeof body.name === "string" ? body.name.trim() : null;
           const slug = typeof body.slug === "string" ? body.slug.trim() : null;
           if (!name || !slug) {
-            return jsonResponse13({ error: "Missing required fields: name, slug" }, 400);
+            return jsonResponse8({ error: "Missing required fields: name, slug" }, 400);
           }
           const metadata = body.metadata !== void 0 && typeof body.metadata === "object" && body.metadata !== null ? body.metadata : void 0;
           try {
             const org = await module.create({ name, slug, ownerId: user.id, metadata });
-            return jsonResponse13(org, 201);
+            return jsonResponse8(org, 201);
           } catch (err2) {
-            return jsonResponse13(
+            return jsonResponse8(
               { error: err2 instanceof Error ? err2.message : "Failed to create organization" },
               400
             );
@@ -9622,10 +9572,10 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const orgs = await module.list(user.id);
-          return jsonResponse13({ organizations: orgs });
+          return jsonResponse8({ organizations: orgs });
         }
       });
       ctx.addEndpoint({
@@ -9638,23 +9588,23 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const orgId = segments[2];
           if (!orgId) {
-            return jsonResponse13({ error: "Missing organization ID in path" }, 400);
+            return jsonResponse8({ error: "Missing organization ID in path" }, 400);
           }
           const member = await module.getMember(orgId, user.id);
           if (!member || !ADMIN_ROLES.has(member.role)) {
-            return jsonResponse13({ error: "Admin or owner role required" }, 403);
+            return jsonResponse8({ error: "Admin or owner role required" }, 403);
           }
-          const body = await parseBody7(request);
+          const body = await parseBody3(request);
           const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : null;
           const role = typeof body.role === "string" ? body.role : "member";
           if (!email) {
-            return jsonResponse13({ error: "Missing required field: email" }, 400);
+            return jsonResponse8({ error: "Missing required field: email" }, 400);
           }
           try {
             const invitation = await module.invite({
@@ -9663,9 +9613,9 @@ function organization(config) {
               role,
               invitedBy: user.id
             });
-            return jsonResponse13(invitation, 201);
+            return jsonResponse8(invitation, 201);
           } catch (err2) {
-            return jsonResponse13(
+            return jsonResponse8(
               { error: err2 instanceof Error ? err2.message : "Failed to send invitation" },
               400
             );
@@ -9682,20 +9632,20 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const orgId = segments[2];
           if (!orgId) {
-            return jsonResponse13({ error: "Missing organization ID in path" }, 400);
+            return jsonResponse8({ error: "Missing organization ID in path" }, 400);
           }
           const callerMember = await module.getMember(orgId, user.id);
           if (!callerMember) {
-            return jsonResponse13({ error: "You are not a member of this organization" }, 403);
+            return jsonResponse8({ error: "You are not a member of this organization" }, 403);
           }
           const members = await module.getMembers(orgId);
-          return jsonResponse13({ members });
+          return jsonResponse8({ members });
         }
       });
       ctx.addEndpoint({
@@ -9708,29 +9658,29 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const orgId = segments[2];
           const targetUserId = segments[4];
           if (!orgId || !targetUserId) {
-            return jsonResponse13({ error: "Missing organization ID or user ID in path" }, 400);
+            return jsonResponse8({ error: "Missing organization ID or user ID in path" }, 400);
           }
           const callerMember = await module.getMember(orgId, user.id);
           if (!callerMember || !ADMIN_ROLES.has(callerMember.role)) {
-            return jsonResponse13({ error: "Admin or owner role required" }, 403);
+            return jsonResponse8({ error: "Admin or owner role required" }, 403);
           }
-          const body = await parseBody7(request);
+          const body = await parseBody3(request);
           const role = typeof body.role === "string" ? body.role : null;
           if (!role) {
-            return jsonResponse13({ error: "Missing required field: role" }, 400);
+            return jsonResponse8({ error: "Missing required field: role" }, 400);
           }
           try {
             const member = await module.updateMemberRole(orgId, targetUserId, role);
-            return jsonResponse13(member);
+            return jsonResponse8(member);
           } catch (err2) {
-            return jsonResponse13(
+            return jsonResponse8(
               { error: err2 instanceof Error ? err2.message : "Failed to update member role" },
               400
             );
@@ -9747,24 +9697,24 @@ function organization(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse13({ error: "Authentication required" }, 401);
+            return jsonResponse8({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const orgId = segments[2];
           const targetUserId = segments[4];
           if (!orgId || !targetUserId) {
-            return jsonResponse13({ error: "Missing organization ID or user ID in path" }, 400);
+            return jsonResponse8({ error: "Missing organization ID or user ID in path" }, 400);
           }
           const callerMember = await module.getMember(orgId, user.id);
           if (!callerMember || !ADMIN_ROLES.has(callerMember.role)) {
-            return jsonResponse13({ error: "Admin or owner role required" }, 403);
+            return jsonResponse8({ error: "Admin or owner role required" }, 403);
           }
           try {
             await module.removeMember(orgId, targetUserId);
-            return jsonResponse13({ removed: true });
+            return jsonResponse8({ removed: true });
           } catch (err2) {
-            return jsonResponse13(
+            return jsonResponse8(
               { error: err2 instanceof Error ? err2.message : "Failed to remove member" },
               400
             );
@@ -10169,13 +10119,13 @@ function parseAuthData(authData) {
   }
   return { rpIdHash, flags, signCount, attestedCredentialData };
 }
-function jsonResponse14(body, status = 200) {
+function jsonResponse9(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody8(request) {
+async function parseBody4(request) {
   try {
     return await request.json();
   } catch {
@@ -10513,84 +10463,84 @@ function createPasskeyModule(config, db) {
     const method = request.method.toUpperCase();
     const segments = getPathSegments(url);
     if (method === "POST" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "register" && segments[3] === "options") {
-      const body = await parseBody8(request);
+      const body = await parseBody4(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const userName = typeof body.userName === "string" ? body.userName : null;
       if (!userId || !userName) {
-        return jsonResponse14({ error: "userId and userName required" }, 400);
+        return jsonResponse9({ error: "userId and userName required" }, 400);
       }
       try {
         const options = await getRegistrationOptions(userId, userName);
-        return jsonResponse14(options);
+        return jsonResponse9(options);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Failed to generate options";
         const code2 = err2 instanceof PasskeyError ? err2.code : "INTERNAL_ERROR";
-        return jsonResponse14({ error: message, code: code2 }, 500);
+        return jsonResponse9({ error: message, code: code2 }, 500);
       }
     }
     if (method === "POST" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "register" && segments[3] === "verify") {
-      const body = await parseBody8(request);
+      const body = await parseBody4(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
-      if (!userId) return jsonResponse14({ error: "userId required" }, 400);
+      if (!userId) return jsonResponse9({ error: "userId required" }, 400);
       const resp = body.response;
-      if (!resp) return jsonResponse14({ error: "response required" }, 400);
+      if (!resp) return jsonResponse9({ error: "response required" }, 400);
       try {
         const result = await verifyRegistration(userId, resp);
-        return jsonResponse14(result);
+        return jsonResponse9(result);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Registration failed";
         const code2 = err2 instanceof PasskeyError ? err2.code : "INTERNAL_ERROR";
-        return jsonResponse14({ error: message, code: code2 }, 400);
+        return jsonResponse9({ error: message, code: code2 }, 400);
       }
     }
     if (method === "POST" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "login" && segments[3] === "options") {
-      const body = await parseBody8(request);
+      const body = await parseBody4(request);
       const userId = typeof body.userId === "string" ? body.userId : void 0;
       try {
         const options = await getAuthenticationOptions(userId);
-        return jsonResponse14(options);
+        return jsonResponse9(options);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Failed to generate options";
         const code2 = err2 instanceof PasskeyError ? err2.code : "INTERNAL_ERROR";
-        return jsonResponse14({ error: message, code: code2 }, 500);
+        return jsonResponse9({ error: message, code: code2 }, 500);
       }
     }
     if (method === "POST" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "login" && segments[3] === "verify") {
-      const body = await parseBody8(request);
+      const body = await parseBody4(request);
       const resp = body.response;
-      if (!resp) return jsonResponse14({ error: "response required" }, 400);
+      if (!resp) return jsonResponse9({ error: "response required" }, 400);
       try {
         const result = await verifyAuthentication(resp);
-        return jsonResponse14(result);
+        return jsonResponse9(result);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Authentication failed";
         const code2 = err2 instanceof PasskeyError ? err2.code : "INTERNAL_ERROR";
-        return jsonResponse14({ error: message, code: code2 }, 401);
+        return jsonResponse9({ error: message, code: code2 }, 401);
       }
     }
     if (method === "GET" && segments.length === 3 && segments[1] === "passkey" && segments[2] === "credentials") {
       const userId = url.searchParams.get("userId");
-      if (!userId) return jsonResponse14({ error: "userId query param required" }, 400);
+      if (!userId) return jsonResponse9({ error: "userId query param required" }, 400);
       try {
         const creds = await listCredentials(userId);
-        return jsonResponse14({ credentials: creds });
+        return jsonResponse9({ credentials: creds });
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Failed to list credentials";
-        return jsonResponse14({ error: message }, 500);
+        return jsonResponse9({ error: message }, 500);
       }
     }
     if (method === "DELETE" && segments.length === 4 && segments[1] === "passkey" && segments[2] === "credentials") {
       const credentialId = segments[3];
-      if (!credentialId) return jsonResponse14({ error: "Credential ID required" }, 400);
-      const body = await parseBody8(request);
+      if (!credentialId) return jsonResponse9({ error: "Credential ID required" }, 400);
+      const body = await parseBody4(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
-      if (!userId) return jsonResponse14({ error: "userId required" }, 400);
+      if (!userId) return jsonResponse9({ error: "userId required" }, 400);
       try {
         await removeCredential(credentialId, userId);
-        return jsonResponse14({ removed: true });
+        return jsonResponse9({ removed: true });
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : "Failed to remove credential";
-        return jsonResponse14({ error: message }, 500);
+        return jsonResponse9({ error: message }, 500);
       }
     }
     return null;
@@ -10607,13 +10557,13 @@ function createPasskeyModule(config, db) {
 }
 
 // src/auth/passkey-plugin.ts
-function jsonResponse15(body, status = 200) {
+function jsonResponse10(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody9(request) {
+async function parseBody5(request) {
   try {
     return await request.json();
   } catch {
@@ -10635,16 +10585,16 @@ function passkey(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse15({ error: "Authentication required" }, 401);
+            return jsonResponse10({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody9(request);
+          const body = await parseBody5(request);
           const userId = typeof body.userId === "string" ? body.userId : user.id;
           const userName = typeof body.userName === "string" ? body.userName : user.email ?? user.id;
           try {
             const options = await module.getRegistrationOptions(userId, userName);
-            return jsonResponse15(options);
+            return jsonResponse10(options);
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Failed to generate options" },
               500
             );
@@ -10661,19 +10611,19 @@ function passkey(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse15({ error: "Authentication required" }, 401);
+            return jsonResponse10({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody9(request);
+          const body = await parseBody5(request);
           const userId = typeof body.userId === "string" ? body.userId : user.id;
           const response = body.response;
           if (!response) {
-            return jsonResponse15({ error: "Missing required field: response" }, 400);
+            return jsonResponse10({ error: "Missing required field: response" }, 400);
           }
           try {
             const result = await module.verifyRegistration(userId, response);
-            return jsonResponse15(result);
+            return jsonResponse10(result);
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Registration failed" },
               400
             );
@@ -10687,13 +10637,13 @@ function passkey(config) {
           description: "Get WebAuthn authentication options"
         },
         async handler(request) {
-          const body = await parseBody9(request);
+          const body = await parseBody5(request);
           const userId = typeof body.userId === "string" ? body.userId : void 0;
           try {
             const options = await module.getAuthenticationOptions(userId);
-            return jsonResponse15(options);
+            return jsonResponse10(options);
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Failed to generate options" },
               500
             );
@@ -10707,19 +10657,37 @@ function passkey(config) {
           description: "Verify a WebAuthn assertion and return the authenticated user"
         },
         async handler(request) {
-          const body = await parseBody9(request);
+          const body = await parseBody5(request);
           const response = body.response;
           if (!response) {
-            return jsonResponse15({ error: "Missing required field: response" }, 400);
+            return jsonResponse10({ error: "Missing required field: response" }, 400);
           }
           try {
             const result = await module.verifyAuthentication(response);
             if (!result) {
-              return jsonResponse15({ error: "Authentication failed" }, 401);
+              return jsonResponse10({ error: "Authentication failed" }, 401);
             }
-            return jsonResponse15(result);
+            if (ctx.sessionManager) {
+              const { session, token } = await ctx.sessionManager.create(result.userId);
+              const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
+              return new Response(
+                JSON.stringify({
+                  user: { id: result.userId },
+                  session: { token, expiresAt: session.expiresAt },
+                  credential: result.credential
+                }),
+                {
+                  status: 200,
+                  headers: {
+                    "Content-Type": "application/json",
+                    "Set-Cookie": buildSetCookie("kavach_session", token, maxAge)
+                  }
+                }
+              );
+            }
+            return jsonResponse10(result);
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Authentication failed" },
               401
             );
@@ -10736,13 +10704,13 @@ function passkey(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse15({ error: "Authentication required" }, 401);
+            return jsonResponse10({ error: "Authentication required" }, 401);
           }
           try {
             const credentials = await module.listCredentials(user.id);
-            return jsonResponse15({ credentials });
+            return jsonResponse10({ credentials });
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Failed to list credentials" },
               500
             );
@@ -10759,19 +10727,19 @@ function passkey(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse15({ error: "Authentication required" }, 401);
+            return jsonResponse10({ error: "Authentication required" }, 401);
           }
           const url = new URL(request.url);
           const segments = url.pathname.split("/").filter(Boolean);
           const credentialId = segments[3];
           if (!credentialId) {
-            return jsonResponse15({ error: "Missing credential ID in path" }, 400);
+            return jsonResponse10({ error: "Missing credential ID in path" }, 400);
           }
           try {
             await module.removeCredential(credentialId, user.id);
-            return jsonResponse15({ removed: true });
+            return jsonResponse10({ removed: true });
           } catch (err2) {
-            return jsonResponse15(
+            return jsonResponse10(
               { error: err2 instanceof Error ? err2.message : "Failed to remove credential" },
               500
             );
@@ -10788,7 +10756,7 @@ var TOKEN_PURPOSE2 = "password-reset";
 function makeError7(code2, message, details) {
   return { code: code2, message, ...details !== void 0 ? { details } : {} };
 }
-function jsonResponse16(body, status = 200) {
+function jsonResponse11(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -10904,27 +10872,27 @@ function createPasswordResetModule(config, db, sessionManager, tokenModule) {
     try {
       body = await request.json();
     } catch {
-      return jsonResponse16({ error: "Invalid JSON body" }, 400);
+      return jsonResponse11({ error: "Invalid JSON body" }, 400);
     }
     const b = body;
     if (pathname === "/auth/forgot-password") {
       if (typeof b.email !== "string") {
-        return jsonResponse16({ error: "Missing required field: email" }, 400);
+        return jsonResponse11({ error: "Missing required field: email" }, 400);
       }
       const result = await requestReset(b.email);
       if (!result.success) {
-        return jsonResponse16({ error: result.error.message }, 500);
+        return jsonResponse11({ error: result.error.message }, 500);
       }
       return new Response(null, { status: 204 });
     }
     if (pathname === "/auth/reset-password") {
       if (typeof b.token !== "string" || typeof b.password !== "string") {
-        return jsonResponse16({ error: "Missing required fields: token, password" }, 400);
+        return jsonResponse11({ error: "Missing required fields: token, password" }, 400);
       }
       const result = await resetPassword(b.token, b.password);
       if (!result.success) {
         const status = result.error.code === "INVALID_PASSWORD" ? 400 : 400;
-        return jsonResponse16({ error: result.error.message }, status);
+        return jsonResponse11({ error: result.error.message }, status);
       }
       return new Response(null, { status: 204 });
     }
@@ -10959,7 +10927,7 @@ function generateNumericCode2(length) {
 function normalisePhone(phone) {
   return phone.replace(/\s+/g, "");
 }
-function jsonResponse17(body, status = 200) {
+function jsonResponse12(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -11031,25 +10999,25 @@ function createPhoneAuthModule(config, db, sessionManager) {
     try {
       body = await request.json();
     } catch {
-      return jsonResponse17({ error: "Invalid JSON body" }, 400);
+      return jsonResponse12({ error: "Invalid JSON body" }, 400);
     }
     const b = body;
     if (pathname === "/auth/phone/send-code") {
       if (typeof b.phoneNumber !== "string") {
-        return jsonResponse17({ error: "Missing required field: phoneNumber" }, 400);
+        return jsonResponse12({ error: "Missing required field: phoneNumber" }, 400);
       }
       const result = await sendCode(b.phoneNumber);
-      return jsonResponse17(result);
+      return jsonResponse12(result);
     }
     if (pathname === "/auth/phone/verify") {
       if (typeof b.phoneNumber !== "string" || typeof b.code !== "string") {
-        return jsonResponse17({ error: "Missing required fields: phoneNumber, code" }, 400);
+        return jsonResponse12({ error: "Missing required fields: phoneNumber, code" }, 400);
       }
       const result = await verifyCode(b.phoneNumber, b.code);
       if (!result) {
-        return jsonResponse17({ error: "Invalid or expired code" }, 401);
+        return jsonResponse12({ error: "Invalid or expired code" }, 401);
       }
-      return jsonResponse17(result);
+      return jsonResponse12(result);
     }
     return null;
   }
@@ -11069,12 +11037,12 @@ async function polarRequest(accessToken, baseUrl, method, path, body) {
     headers,
     body: body !== void 0 ? JSON.stringify(body) : void 0
   });
-  const json3 = await response.json();
+  const json2 = await response.json();
   if (!response.ok) {
-    const message = json3.detail ?? json3.message ?? `Polar API error: ${response.status}`;
+    const message = json2.detail ?? json2.message ?? `Polar API error: ${response.status}`;
     throw new Error(message);
   }
-  return json3;
+  return json2;
 }
 async function verifyWebhookSignature(payload, signatureHeader, webhookSecret) {
   const prefix = "sha256=";
@@ -11297,19 +11265,6 @@ function createPolarModule(config, db) {
 }
 
 // src/auth/polar-plugin.ts
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody10(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function polar(config) {
   return {
     id: "kavach-polar",
@@ -11327,13 +11282,14 @@ function polar(config) {
           if (!user) {
             return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody10(request);
-          const productId = typeof body.productId === "string" ? body.productId.trim() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const productId = typeof bodyResult.data.productId === "string" ? bodyResult.data.productId.trim() : null;
           if (!productId) {
             return json({ error: "Missing required field: productId" }, 400);
           }
-          const successUrl = typeof body.successUrl === "string" ? body.successUrl : void 0;
-          const customerEmail = typeof body.customerEmail === "string" ? body.customerEmail : void 0;
+          const successUrl = typeof bodyResult.data.successUrl === "string" ? bodyResult.data.successUrl : void 0;
+          const customerEmail = typeof bodyResult.data.customerEmail === "string" ? bodyResult.data.customerEmail : void 0;
           try {
             const result = await module.createCheckout(user.id, productId, {
               successUrl,
@@ -12778,13 +12734,13 @@ function scim(config) {
 // src/auth/siwe.ts
 var DEFAULT_NONCE_TTL_SECONDS = 300;
 var SIWE_VERSION = "1";
-function jsonResponse18(body, status = 200) {
+function jsonResponse13(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody11(request) {
+async function parseBody6(request) {
   try {
     return await request.json();
   } catch {
@@ -12919,20 +12875,20 @@ function createSiweModule(config) {
     const { method, pathname } = { method: request.method, pathname: url.pathname };
     if (method === "GET" && pathname.endsWith("/auth/siwe/nonce")) {
       const nonce = await generateNonce();
-      return jsonResponse18({ nonce });
+      return jsonResponse13({ nonce });
     }
     if (method === "POST" && pathname.endsWith("/auth/siwe/verify")) {
-      const body = await parseBody11(request);
+      const body = await parseBody6(request);
       const message = typeof body.message === "string" ? body.message : null;
       const signature = typeof body.signature === "string" ? body.signature : null;
       if (!message || !signature) {
-        return jsonResponse18({ error: "Missing required fields: message, signature" }, 400);
+        return jsonResponse13({ error: "Missing required fields: message, signature" }, 400);
       }
       try {
         const result = await verify(message, signature);
-        return jsonResponse18({ address: result.address, chainId: result.chainId });
+        return jsonResponse13({ address: result.address, chainId: result.chainId });
       } catch (err2) {
-        return jsonResponse18(
+        return jsonResponse13(
           { error: err2 instanceof Error ? err2.message : "Verification failed" },
           400
         );
@@ -13969,7 +13925,7 @@ function createSsoModule(config, db) {
     const url = new URL(request.url);
     const { pathname } = url;
     const { method } = request;
-    const json3 = (data, status = 200) => new Response(JSON.stringify(data), {
+    const json2 = (data, status = 200) => new Response(JSON.stringify(data), {
       status,
       headers: { "Content-Type": "application/json" }
     });
@@ -13978,14 +13934,14 @@ function createSsoModule(config, db) {
       try {
         body = await request.json();
       } catch {
-        return json3({ error: "Invalid JSON body" }, 400);
+        return json2({ error: "Invalid JSON body" }, 400);
       }
       const b = body;
       if (typeof b.orgId !== "string" || typeof b.providerId !== "string" || typeof b.type !== "string" || typeof b.domain !== "string") {
-        return json3({ error: "Missing required fields: orgId, providerId, type, domain" }, 400);
+        return json2({ error: "Missing required fields: orgId, providerId, type, domain" }, 400);
       }
       if (b.type !== "saml" && b.type !== "oidc") {
-        return json3({ error: "type must be 'saml' or 'oidc'" }, 400);
+        return json2({ error: "type must be 'saml' or 'oidc'" }, 400);
       }
       const conn = await createConnection({
         orgId: b.orgId,
@@ -13993,19 +13949,19 @@ function createSsoModule(config, db) {
         type: b.type,
         domain: b.domain
       });
-      return json3(conn, 201);
+      return json2(conn, 201);
     }
     const listMatch = /^\/auth\/sso\/connections\/([^/]+)$/.exec(pathname);
     if (method === "GET" && listMatch) {
       const orgId = decodeURIComponent(listMatch[1] ?? "");
       const conns = await listConnections(orgId);
-      return json3(conns);
+      return json2(conns);
     }
     const deleteMatch = /^\/auth\/sso\/connections\/([^/]+)$/.exec(pathname);
     if (method === "DELETE" && deleteMatch) {
       const connId = decodeURIComponent(deleteMatch[1] ?? "");
       await removeConnection(connId);
-      return json3({ success: true });
+      return json2({ success: true });
     }
     const samlInitMatch = /^\/auth\/sso\/saml\/([^/]+)$/.exec(pathname);
     if (method === "GET" && samlInitMatch) {
@@ -14015,7 +13971,7 @@ function createSsoModule(config, db) {
         const authUrl = await getSamlAuthUrl(connId, relayState);
         return new Response(null, { status: 302, headers: { Location: authUrl } });
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
       }
     }
     const samlAcsMatch = /^\/auth\/sso\/saml\/([^/]+)\/acs$/.exec(pathname);
@@ -14028,14 +13984,14 @@ function createSsoModule(config, db) {
         if (typeof val !== "string") throw new Error("Missing SAMLResponse");
         samlResponse = val;
       } catch {
-        return json3({ error: "Missing or invalid SAMLResponse" }, 400);
+        return json2({ error: "Missing or invalid SAMLResponse" }, 400);
       }
       try {
         const result = await handleSamlResponse(connId, samlResponse);
-        return json3(result);
+        return json2(result);
       } catch (err2) {
         const status = err2 instanceof SsoError && err2.code === SSO_ERROR.RATE_LIMITED ? 429 : 401;
-        return json3(
+        return json2(
           {
             error: err2 instanceof Error ? err2.message : "SAML error",
             code: err2 instanceof SsoError ? err2.code : "SAML_ERROR"
@@ -14053,20 +14009,20 @@ function createSsoModule(config, db) {
         const authUrl = await getOidcAuthUrl(connId, state, nonce);
         return new Response(null, { status: 302, headers: { Location: authUrl } });
       } catch (err2) {
-        return json3({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
+        return json2({ error: err2 instanceof Error ? err2.message : "Unknown error" }, 400);
       }
     }
     const oidcCbMatch = /^\/auth\/sso\/oidc\/([^/]+)\/callback$/.exec(pathname);
     if (method === "GET" && oidcCbMatch) {
       const connId = decodeURIComponent(oidcCbMatch[1] ?? "");
       const code2 = url.searchParams.get("code");
-      if (!code2) return json3({ error: "Missing code parameter" }, 400);
+      if (!code2) return json2({ error: "Missing code parameter" }, 400);
       try {
         const result = await handleOidcCallback(connId, code2);
-        return json3(result);
+        return json2(result);
       } catch (err2) {
         const status = err2 instanceof SsoError && err2.code === SSO_ERROR.RATE_LIMITED ? 429 : 401;
-        return json3(
+        return json2(
           {
             error: err2 instanceof Error ? err2.message : "OIDC error",
             code: err2 instanceof SsoError ? err2.code : "OIDC_ERROR"
@@ -14167,12 +14123,12 @@ async function stripeRequest(secretKey, apiVersion, method, path, body) {
     headers,
     body: bodyStr
   });
-  const json3 = await response.json();
+  const json2 = await response.json();
   if (!response.ok) {
-    const message = json3.error?.message ?? `Stripe API error: ${response.status}`;
+    const message = json2.error?.message ?? `Stripe API error: ${response.status}`;
     throw new Error(message);
   }
-  return json3;
+  return json2;
 }
 async function verifyWebhookSignature2(payload, signatureHeader, webhookSecret) {
   const parts = {};
@@ -14482,19 +14438,6 @@ function createStripeModule(config, db) {
 }
 
 // src/auth/stripe-plugin.ts
-function json2(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function parseBody12(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function stripe(config) {
   return {
     id: "kavach-stripe",
@@ -14510,17 +14453,18 @@ function stripe(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return json2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody12(request);
-          const priceId = typeof body.priceId === "string" ? body.priceId.trim() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const priceId = typeof bodyResult.data.priceId === "string" ? bodyResult.data.priceId.trim() : null;
           if (!priceId) {
-            return json2({ error: "Missing required field: priceId" }, 400);
+            return json({ error: "Missing required field: priceId" }, 400);
           }
-          const successUrl = typeof body.successUrl === "string" ? body.successUrl : void 0;
-          const cancelUrl = typeof body.cancelUrl === "string" ? body.cancelUrl : void 0;
-          const trialDays = typeof body.trialDays === "number" ? body.trialDays : void 0;
-          const metadata = body.metadata != null && typeof body.metadata === "object" && !Array.isArray(body.metadata) ? body.metadata : void 0;
+          const successUrl = typeof bodyResult.data.successUrl === "string" ? bodyResult.data.successUrl : void 0;
+          const cancelUrl = typeof bodyResult.data.cancelUrl === "string" ? bodyResult.data.cancelUrl : void 0;
+          const trialDays = typeof bodyResult.data.trialDays === "number" ? bodyResult.data.trialDays : void 0;
+          const metadata = bodyResult.data.metadata != null && typeof bodyResult.data.metadata === "object" && !Array.isArray(bodyResult.data.metadata) ? bodyResult.data.metadata : void 0;
           try {
             const result = await module.createCheckoutSession(user.id, priceId, {
               successUrl,
@@ -14528,9 +14472,9 @@ function stripe(config) {
               trialDays,
               metadata
             });
-            return json2(result);
+            return json(result);
           } catch (err2) {
-            return json2(
+            return json(
               {
                 error: err2 instanceof Error ? err2.message : "Failed to create checkout session"
               },
@@ -14549,18 +14493,19 @@ function stripe(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return json2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody12(request);
-          const returnUrl = typeof body.returnUrl === "string" ? body.returnUrl.trim() : null;
+          const bodyResult = await parseBody(request);
+          if (!bodyResult.ok) return bodyResult.response;
+          const returnUrl = typeof bodyResult.data.returnUrl === "string" ? bodyResult.data.returnUrl.trim() : null;
           if (!returnUrl) {
-            return json2({ error: "Missing required field: returnUrl" }, 400);
+            return json({ error: "Missing required field: returnUrl" }, 400);
           }
           try {
             const result = await module.createPortalSession(user.id, returnUrl);
-            return json2(result);
+            return json(result);
           } catch (err2) {
-            return json2(
+            return json(
               {
                 error: err2 instanceof Error ? err2.message : "Failed to create portal session"
               },
@@ -14579,10 +14524,10 @@ function stripe(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return json2({ error: "Authentication required" }, 401);
+            return json({ error: "Authentication required" }, 401);
           }
           const subscription = await module.getSubscription(user.id);
-          return json2({ subscription });
+          return json({ subscription });
         }
       });
       ctx.addEndpoint({
@@ -14684,13 +14629,13 @@ async function generateBackupCodes(count) {
   }
   return { plain, hashed };
 }
-function jsonResponse19(body, status = 200) {
+function jsonResponse14(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody13(request) {
+async function parseBody7(request) {
   try {
     return await request.json();
   } catch {
@@ -14788,50 +14733,50 @@ function createTotpModule(config, db) {
     const method = request.method.toUpperCase();
     if (method !== "POST") return null;
     if (path === "/auth/2fa/setup") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
-      if (!userId) return jsonResponse19({ error: "userId required" }, 400);
+      if (!userId) return jsonResponse14({ error: "userId required" }, 400);
       try {
         const result = await setup(userId);
-        return jsonResponse19(result);
+        return jsonResponse14(result);
       } catch (err2) {
-        return jsonResponse19({ error: err2 instanceof Error ? err2.message : "Setup failed" }, 500);
+        return jsonResponse14({ error: err2 instanceof Error ? err2.message : "Setup failed" }, 500);
       }
     }
     if (path === "/auth/2fa/enable") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const code2 = typeof body.code === "string" ? body.code : null;
-      if (!userId || !code2) return jsonResponse19({ error: "userId and code required" }, 400);
+      if (!userId || !code2) return jsonResponse14({ error: "userId and code required" }, 400);
       const result = await enable(userId, code2);
-      return jsonResponse19(result);
+      return jsonResponse14(result);
     }
     if (path === "/auth/2fa/verify") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const code2 = typeof body.code === "string" ? body.code : null;
-      if (!userId || !code2) return jsonResponse19({ error: "userId and code required" }, 400);
+      if (!userId || !code2) return jsonResponse14({ error: "userId and code required" }, 400);
       const result = await verify(userId, code2);
-      return jsonResponse19(result);
+      return jsonResponse14(result);
     }
     if (path === "/auth/2fa/disable") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const code2 = typeof body.code === "string" ? body.code : null;
-      if (!userId || !code2) return jsonResponse19({ error: "userId and code required" }, 400);
+      if (!userId || !code2) return jsonResponse14({ error: "userId and code required" }, 400);
       const result = await disable(userId, code2);
-      return jsonResponse19(result);
+      return jsonResponse14(result);
     }
     if (path === "/auth/2fa/backup-codes") {
-      const body = await parseBody13(request);
+      const body = await parseBody7(request);
       const userId = typeof body.userId === "string" ? body.userId : null;
       const code2 = typeof body.code === "string" ? body.code : null;
-      if (!userId || !code2) return jsonResponse19({ error: "userId and code required" }, 400);
+      if (!userId || !code2) return jsonResponse14({ error: "userId and code required" }, 400);
       try {
         const result = await regenerateBackupCodes(userId, code2);
-        return jsonResponse19(result);
+        return jsonResponse14(result);
       } catch (err2) {
-        return jsonResponse19(
+        return jsonResponse14(
           { error: err2 instanceof Error ? err2.message : "Failed to regenerate codes" },
           400
         );
@@ -14851,13 +14796,13 @@ function createTotpModule(config, db) {
 }
 
 // src/auth/totp-plugin.ts
-function jsonResponse20(body, status = 200) {
+function jsonResponse15(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
   });
 }
-async function parseBody14(request) {
+async function parseBody8(request) {
   try {
     return await request.json();
   } catch {
@@ -14879,13 +14824,13 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
           try {
             const setup = await module.setup(user.id);
-            return jsonResponse20(setup);
+            return jsonResponse15(setup);
           } catch (err2) {
-            return jsonResponse20(
+            return jsonResponse15(
               { error: err2 instanceof Error ? err2.message : "Enrollment failed" },
               500
             );
@@ -14902,23 +14847,23 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody14(request);
+          const body = await parseBody8(request);
           const code2 = typeof body.code === "string" ? body.code : null;
           if (!code2) {
-            return jsonResponse20({ error: "Missing required field: code" }, 400);
+            return jsonResponse15({ error: "Missing required field: code" }, 400);
           }
           const enabled = await module.isEnabled(user.id);
           if (!enabled) {
             const result2 = await module.enable(user.id, code2);
             if (!result2.enabled) {
-              return jsonResponse20({ error: "Invalid TOTP code" }, 400);
+              return jsonResponse15({ error: "Invalid TOTP code" }, 400);
             }
-            return jsonResponse20({ valid: true, activated: true });
+            return jsonResponse15({ valid: true, activated: true });
           }
           const result = await module.verify(user.id, code2);
-          return jsonResponse20(result);
+          return jsonResponse15(result);
         }
       });
       ctx.addEndpoint({
@@ -14931,18 +14876,18 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody14(request);
+          const body = await parseBody8(request);
           const code2 = typeof body.code === "string" ? body.code : null;
           if (!code2) {
-            return jsonResponse20({ error: "Missing required field: code" }, 400);
+            return jsonResponse15({ error: "Missing required field: code" }, 400);
           }
           const result = await module.disable(user.id, code2);
           if (!result.disabled) {
-            return jsonResponse20({ error: "Invalid TOTP code" }, 400);
+            return jsonResponse15({ error: "Invalid TOTP code" }, 400);
           }
-          return jsonResponse20(result);
+          return jsonResponse15(result);
         }
       });
       ctx.addEndpoint({
@@ -14955,10 +14900,10 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
           const enabled = await module.isEnabled(user.id);
-          return jsonResponse20({ enabled });
+          return jsonResponse15({ enabled });
         }
       });
       ctx.addEndpoint({
@@ -14971,18 +14916,18 @@ function twoFactor(config) {
         async handler(request, endpointCtx) {
           const user = await endpointCtx.getUser(request);
           if (!user) {
-            return jsonResponse20({ error: "Authentication required" }, 401);
+            return jsonResponse15({ error: "Authentication required" }, 401);
           }
-          const body = await parseBody14(request);
+          const body = await parseBody8(request);
           const code2 = typeof body.code === "string" ? body.code : null;
           if (!code2) {
-            return jsonResponse20({ error: "Missing required field: code" }, 400);
+            return jsonResponse15({ error: "Missing required field: code" }, 400);
           }
           try {
             const result = await module.regenerateBackupCodes(user.id, code2);
-            return jsonResponse20(result);
+            return jsonResponse15(result);
           } catch (err2) {
-            return jsonResponse20(
+            return jsonResponse15(
               { error: err2 instanceof Error ? err2.message : "Failed to regenerate backup codes" },
               400
             );
@@ -15101,7 +15046,7 @@ async function hashPassword(password) {
 async function verifyPassword(stored, candidate) {
   return pbkdf2Verify(candidate, stored);
 }
-function jsonResponse21(body, status = 200) {
+function jsonResponse16(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "Content-Type": "application/json" }
@@ -15225,12 +15170,12 @@ function createUsernameAuthModule(config, db, sessionManager) {
     try {
       body = await request.json();
     } catch {
-      return jsonResponse21({ error: "Invalid JSON body" }, 400);
+      return jsonResponse16({ error: "Invalid JSON body" }, 400);
     }
     const b = body;
     if (pathname === "/auth/username/sign-up") {
       if (typeof b.username !== "string" || typeof b.password !== "string") {
-        return jsonResponse21({ error: "Missing required fields: username, password" }, 400);
+        return jsonResponse16({ error: "Missing required fields: username, password" }, 400);
       }
       try {
         const result = await signUp({
@@ -15238,21 +15183,21 @@ function createUsernameAuthModule(config, db, sessionManager) {
           password: b.password,
           name: typeof b.name === "string" ? b.name : void 0
         });
-        return jsonResponse21(result, 201);
+        return jsonResponse16(result, 201);
       } catch (err2) {
-        return jsonResponse21({ error: err2 instanceof Error ? err2.message : "Sign-up failed" }, 400);
+        return jsonResponse16({ error: err2 instanceof Error ? err2.message : "Sign-up failed" }, 400);
       }
     }
     if (pathname === "/auth/username/sign-in") {
       if (typeof b.username !== "string" || typeof b.password !== "string") {
-        return jsonResponse21({ error: "Missing required fields: username, password" }, 400);
+        return jsonResponse16({ error: "Missing required fields: username, password" }, 400);
       }
       try {
         const result = await signIn({ username: b.username, password: b.password });
-        return jsonResponse21(result);
+        return jsonResponse16(result);
       } catch (err2) {
         if (err2 instanceof Error && err2.message === "Password reset required") {
-          return jsonResponse21(
+          return jsonResponse16(
             {
               error: {
                 code: "PASSWORD_RESET_REQUIRED",
@@ -15262,21 +15207,21 @@ function createUsernameAuthModule(config, db, sessionManager) {
             403
           );
         }
-        return jsonResponse21({ error: "Invalid username or password" }, 401);
+        return jsonResponse16({ error: "Invalid username or password" }, 401);
       }
     }
     if (pathname === "/auth/username/change-password") {
       if (typeof b.userId !== "string" || typeof b.current !== "string" || typeof b.newPassword !== "string") {
-        return jsonResponse21(
+        return jsonResponse16(
           { error: "Missing required fields: userId, current, newPassword" },
           400
         );
       }
       try {
         const result = await changePassword(b.userId, b.current, b.newPassword);
-        return jsonResponse21(result);
+        return jsonResponse16(result);
       } catch (err2) {
-        return jsonResponse21(
+        return jsonResponse16(
           { error: err2 instanceof Error ? err2.message : "Change password failed" },
           400
         );
@@ -15284,13 +15229,13 @@ function createUsernameAuthModule(config, db, sessionManager) {
     }
     if (pathname === "/auth/username/change-username") {
       if (typeof b.userId !== "string" || typeof b.newUsername !== "string") {
-        return jsonResponse21({ error: "Missing required fields: userId, newUsername" }, 400);
+        return jsonResponse16({ error: "Missing required fields: userId, newUsername" }, 400);
       }
       try {
         const result = await changeUsername(b.userId, b.newUsername);
-        return jsonResponse21(result);
+        return jsonResponse16(result);
       } catch (err2) {
-        return jsonResponse21(
+        return jsonResponse16(
           { error: err2 instanceof Error ? err2.message : "Change username failed" },
           400
         );
@@ -15472,7 +15417,7 @@ function buildStatements(provider) {
   const isMysql = provider === "mysql";
   const ts = isPostgres ? "TIMESTAMPTZ" : isMysql ? "DATETIME(3)" : "INTEGER";
   const tsNull = ts;
-  const json3 = isPostgres ? "JSONB" : isMysql ? "JSON" : "TEXT";
+  const json2 = isPostgres ? "JSONB" : isMysql ? "JSON" : "TEXT";
   const bool = isPostgres ? "BOOLEAN" : isMysql ? "TINYINT(1)" : "INTEGER";
   const ifne = "IF NOT EXISTS";
   return [
@@ -15486,7 +15431,7 @@ function buildStatements(provider) {
   name                 TEXT,
   external_id          TEXT,
   external_provider    TEXT,
-  metadata             ${json3},
+  metadata             ${json2},
   banned               ${bool}     NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   ban_reason           TEXT,
   ban_expires_at       ${tsNull},
@@ -15514,7 +15459,7 @@ function buildStatements(provider) {
   id         TEXT NOT NULL PRIMARY KEY,
   name       TEXT NOT NULL,
   slug       TEXT NOT NULL UNIQUE,
-  settings   ${json3},
+  settings   ${json2},
   status     TEXT NOT NULL DEFAULT 'active',
   created_at ${ts} NOT NULL,
   updated_at ${ts} NOT NULL
@@ -15533,7 +15478,7 @@ function buildStatements(provider) {
   token_prefix    TEXT  NOT NULL,
   expires_at      ${tsNull},
   last_active_at  ${tsNull},
-  metadata        ${json3},
+  metadata        ${json2},
   created_at      ${ts} NOT NULL,
   updated_at      ${ts} NOT NULL
 )`,
@@ -15544,8 +15489,8 @@ function buildStatements(provider) {
   id          TEXT  NOT NULL PRIMARY KEY,
   agent_id    TEXT  NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
   resource    TEXT  NOT NULL,
-  actions     ${json3} NOT NULL,
-  constraints ${json3},
+  actions     ${json2} NOT NULL,
+  constraints ${json2},
   created_at  ${ts} NOT NULL
 )`,
     // ------------------------------------------------------------------
@@ -15555,7 +15500,7 @@ function buildStatements(provider) {
   id            TEXT    NOT NULL PRIMARY KEY,
   from_agent_id TEXT    NOT NULL REFERENCES kavach_agents(id),
   to_agent_id   TEXT    NOT NULL REFERENCES kavach_agents(id),
-  permissions   ${json3} NOT NULL,
+  permissions   ${json2} NOT NULL,
   depth         INTEGER NOT NULL DEFAULT 1,
   max_depth     INTEGER NOT NULL DEFAULT 3,
   status        TEXT    NOT NULL DEFAULT 'active',
@@ -15571,7 +15516,7 @@ function buildStatements(provider) {
   user_id      TEXT    NOT NULL REFERENCES kavach_users(id),
   action       TEXT    NOT NULL,
   resource     TEXT    NOT NULL,
-  parameters   ${json3},
+  parameters   ${json2},
   result       TEXT    NOT NULL,
   reason       TEXT,
   duration_ms  INTEGER NOT NULL,
@@ -15597,7 +15542,7 @@ function buildStatements(provider) {
   id               TEXT    NOT NULL PRIMARY KEY,
   name             TEXT    NOT NULL,
   endpoint         TEXT    NOT NULL UNIQUE,
-  tools            ${json3} NOT NULL,
+  tools            ${json2} NOT NULL,
   auth_required    ${bool} NOT NULL DEFAULT ${isPostgres ? "TRUE" : "1"},
   rate_limit_rpm   INTEGER,
   status           TEXT    NOT NULL DEFAULT 'active',
@@ -15611,7 +15556,7 @@ function buildStatements(provider) {
   id         TEXT    NOT NULL PRIMARY KEY,
   user_id    TEXT    NOT NULL REFERENCES kavach_users(id),
   expires_at ${ts}   NOT NULL,
-  metadata   ${json3},
+  metadata   ${json2},
   created_at ${ts}   NOT NULL
 )`,
     // ------------------------------------------------------------------
@@ -15623,13 +15568,13 @@ function buildStatements(provider) {
   client_secret               TEXT,
   client_name                 TEXT,
   client_uri                  TEXT,
-  redirect_uris               ${json3} NOT NULL,
-  grant_types                 ${json3} NOT NULL,
-  response_types              ${json3} NOT NULL,
+  redirect_uris               ${json2} NOT NULL,
+  grant_types                 ${json2} NOT NULL,
+  response_types              ${json2} NOT NULL,
   token_endpoint_auth_method  TEXT    NOT NULL DEFAULT 'client_secret_basic',
   type                        TEXT    NOT NULL DEFAULT 'confidential',
   disabled                    ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
-  metadata                    ${json3},
+  metadata                    ${json2},
   created_at                  ${ts}   NOT NULL,
   updated_at                  ${ts}   NOT NULL
 )`,
@@ -15697,8 +15642,8 @@ function buildStatements(provider) {
   agent_id      TEXT    REFERENCES kavach_agents(id) ON DELETE CASCADE,
   user_id       TEXT    REFERENCES kavach_users(id),
   tenant_id     TEXT    REFERENCES kavach_tenants(id),
-  limits        ${json3} NOT NULL,
-  current_usage ${json3} NOT NULL,
+  limits        ${json2} NOT NULL,
+  current_usage ${json2} NOT NULL,
   action        TEXT    NOT NULL DEFAULT 'warn',
   status        TEXT    NOT NULL DEFAULT 'active',
   created_at    ${ts}   NOT NULL
@@ -15712,11 +15657,11 @@ function buildStatements(provider) {
   name              TEXT    NOT NULL,
   description       TEXT,
   version           TEXT    NOT NULL,
-  protocols         ${json3} NOT NULL,
-  capabilities      ${json3} NOT NULL,
-  auth_requirements ${json3} NOT NULL,
+  protocols         ${json2} NOT NULL,
+  capabilities      ${json2} NOT NULL,
+  auth_requirements ${json2} NOT NULL,
   endpoint          TEXT,
-  metadata          ${json3},
+  metadata          ${json2},
   created_at        ${ts}   NOT NULL,
   updated_at        ${ts}   NOT NULL
 )`,
@@ -15729,7 +15674,7 @@ function buildStatements(provider) {
   user_id       TEXT NOT NULL REFERENCES kavach_users(id),
   action        TEXT NOT NULL,
   resource      TEXT NOT NULL,
-  arguments     ${json3},
+  arguments     ${json2},
   status        TEXT NOT NULL DEFAULT 'pending',
   expires_at    ${ts} NOT NULL,
   responded_at  ${tsNull},
@@ -15743,7 +15688,7 @@ function buildStatements(provider) {
   agent_id    TEXT    NOT NULL PRIMARY KEY REFERENCES kavach_agents(id) ON DELETE CASCADE,
   score       INTEGER NOT NULL,
   level       TEXT    NOT NULL,
-  factors     ${json3} NOT NULL,
+  factors     ${json2} NOT NULL,
   computed_at ${ts}   NOT NULL
 )`,
     // ------------------------------------------------------------------
@@ -15754,7 +15699,7 @@ function buildStatements(provider) {
   name       TEXT    NOT NULL,
   slug       TEXT    NOT NULL UNIQUE,
   owner_id   TEXT    NOT NULL REFERENCES kavach_users(id),
-  metadata   ${json3},
+  metadata   ${json2},
   created_at ${ts}   NOT NULL,
   updated_at ${ts}   NOT NULL
 )`,
@@ -15789,7 +15734,7 @@ function buildStatements(provider) {
   id          TEXT    NOT NULL PRIMARY KEY,
   org_id      TEXT    NOT NULL REFERENCES kavach_organizations(id) ON DELETE CASCADE,
   name        TEXT    NOT NULL,
-  permissions ${json3} NOT NULL,
+  permissions ${json2} NOT NULL,
   UNIQUE(org_id, name)
 )`,
     // ------------------------------------------------------------------
@@ -15825,7 +15770,7 @@ function buildStatements(provider) {
   token_hash  TEXT    NOT NULL UNIQUE,
   purpose     TEXT    NOT NULL,
   identifier  TEXT    NOT NULL,
-  metadata    ${json3},
+  metadata    ${json2},
   used        ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   expires_at  ${ts}   NOT NULL,
   created_at  ${ts}   NOT NULL
@@ -15870,7 +15815,7 @@ function buildStatements(provider) {
   user_id      TEXT    NOT NULL PRIMARY KEY REFERENCES kavach_users(id),
   secret       TEXT    NOT NULL,
   enabled      ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
-  backup_codes ${json3} NOT NULL,
+  backup_codes ${json2} NOT NULL,
   created_at   ${ts}   NOT NULL,
   updated_at   ${ts}   NOT NULL
 )`,
@@ -15895,7 +15840,7 @@ function buildStatements(provider) {
   name         TEXT    NOT NULL,
   key_hash     TEXT    NOT NULL,
   key_prefix   TEXT    NOT NULL,
-  permissions  ${json3} NOT NULL,
+  permissions  ${json2} NOT NULL,
   expires_at   ${tsNull},
   last_used_at ${tsNull},
   created_at   ${ts}   NOT NULL
@@ -15954,10 +15899,10 @@ function buildStatements(provider) {
   client_id                   TEXT    NOT NULL UNIQUE,
   client_secret_hash          TEXT    NOT NULL,
   client_name                 TEXT    NOT NULL,
-  redirect_uris               ${json3} NOT NULL,
-  grant_types                 ${json3} NOT NULL,
-  response_types              ${json3} NOT NULL,
-  scopes                      ${json3} NOT NULL,
+  redirect_uris               ${json2} NOT NULL,
+  grant_types                 ${json2} NOT NULL,
+  response_types              ${json2} NOT NULL,
+  scopes                      ${json2} NOT NULL,
   token_endpoint_auth_method  TEXT    NOT NULL DEFAULT 'client_secret_post',
   created_at                  ${ts}   NOT NULL,
   updated_at                  ${ts}   NOT NULL
@@ -16003,7 +15948,7 @@ function buildStatements(provider) {
   output_tokens       INTEGER,
   cost_micros         INTEGER NOT NULL,
   currency            TEXT    NOT NULL DEFAULT 'USD',
-  metadata            ${json3},
+  metadata            ${json2},
   delegation_chain_id TEXT,
   recorded_at         ${ts}   NOT NULL
 )`,
@@ -16051,7 +15996,7 @@ function buildStatements(provider) {
   id        TEXT    NOT NULL PRIMARY KEY,
   type      TEXT    NOT NULL,
   timestamp ${ts}   NOT NULL,
-  data      ${json3} NOT NULL,
+  data      ${json2} NOT NULL,
   agent_id  TEXT,
   user_id   TEXT
 )`,
@@ -16112,7 +16057,7 @@ function buildStatements(provider) {
   source_instance_id  TEXT    NOT NULL,
   target_instance_id  TEXT,
   direction           TEXT    NOT NULL,
-  permissions         ${json3} NOT NULL,
+  permissions         ${json2} NOT NULL,
   trust_score         INTEGER,
   expires_at          ${ts}   NOT NULL,
   created_at          ${ts}   NOT NULL
@@ -17430,6 +17375,18 @@ function matchPath(pattern, pathname) {
   return params;
 }
 function createPluginRouter(endpoints) {
+  const rateLimitStore = /* @__PURE__ */ new Map();
+  function checkRateLimit2(key, windowSeconds, max) {
+    const now = Date.now();
+    const entry = rateLimitStore.get(key);
+    if (!entry || now > entry.resetAt) {
+      rateLimitStore.set(key, { count: 1, resetAt: now + windowSeconds * 1e3 });
+      return true;
+    }
+    if (entry.count >= max) return false;
+    entry.count++;
+    return true;
+  }
   return {
     async handle(request, basePath, endpointCtx) {
       const url = new URL(request.url);
@@ -17449,6 +17406,20 @@ function createPluginRouter(endpoints) {
         if (endpoint.method !== method) continue;
         const params = matchPath(endpoint.path, pathname);
         if (params === null) continue;
+        if (endpoint.metadata?.rateLimit) {
+          const { window: windowSec, max } = endpoint.metadata.rateLimit;
+          const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip") ?? "unknown";
+          const key = `${ip}:${endpoint.path}`;
+          if (!checkRateLimit2(key, windowSec, max)) {
+            return json({ error: "Rate limit exceeded" }, 429);
+          }
+        }
+        if (endpoint.metadata?.requireAuth) {
+          const user = await endpointCtx.getUser(request);
+          if (!user) {
+            return json({ error: "Authentication required" }, 401);
+          }
+        }
         const enrichedUrl = new URL(request.url);
         for (const [key, value] of Object.entries(params)) {
           enrichedUrl.searchParams.set(`_param_${key}`, value);
@@ -17506,7 +17477,7 @@ async function runMigrations(db, provider, statements) {
   }
   throw new Error(`runMigrations: unsupported provider "${provider}"`);
 }
-async function initializePlugins(plugins, db, config) {
+async function initializePlugins(plugins, db, config, sessionManager) {
   const registry = {
     endpoints: [],
     migrations: [],
@@ -17523,6 +17494,7 @@ async function initializePlugins(plugins, db, config) {
     const ctx = {
       db,
       config,
+      sessionManager,
       addEndpoint(endpoint) {
         registry.endpoints.push(endpoint);
       },
@@ -17763,8 +17735,8 @@ var DEFAULT_EXCLUDE_PATHS = [
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 function encodeState2(state) {
-  const json3 = JSON.stringify(state);
-  const bytes = encoder.encode(json3);
+  const json2 = JSON.stringify(state);
+  const bytes = encoder.encode(json2);
   let binary = "";
   for (let i = 0; i < bytes.length; i++) {
     binary += String.fromCharCode(bytes[i]);
@@ -17782,8 +17754,8 @@ function decodeState(encoded) {
     for (let i = 0; i < binary.length; i++) {
       bytes[i] = binary.charCodeAt(i);
     }
-    const json3 = decoder.decode(bytes);
-    const parsed = JSON.parse(json3);
+    const json2 = decoder.decode(bytes);
+    const parsed = JSON.parse(json2);
     if (!isValidChainState(parsed)) return null;
     return parsed;
   } catch {
@@ -17855,7 +17827,7 @@ function createRedirectChain(config) {
     if (cookieOpts.domain) parts.push(`Domain=${cookieOpts.domain}`);
     return parts.join("; ");
   }
-  function buildClearCookie() {
+  function buildClearCookie2() {
     return buildCookieHeader("", 0);
   }
   function serializeAndSetCookie(state) {
@@ -17965,7 +17937,7 @@ function createRedirectChain(config) {
     pop(request) {
       const state = parseFromRequest(request);
       if (!state) {
-        return { url: defaultPath, done: true, clearCookie: buildClearCookie() };
+        return { url: defaultPath, done: true, clearCookie: buildClearCookie2() };
       }
       if (state.steps.length > 0) {
         const next = state.steps.shift();
@@ -17989,7 +17961,7 @@ function createRedirectChain(config) {
       return {
         url,
         done: true,
-        clearCookie: buildClearCookie()
+        clearCookie: buildClearCookie2()
       };
     },
     peek(request) {
@@ -18015,7 +17987,7 @@ function createRedirectChain(config) {
     },
     clear() {
       currentState = null;
-      return buildClearCookie();
+      return buildClearCookie2();
     },
     parse(request) {
       return parseFromRequest(request);
@@ -18348,12 +18320,33 @@ async function createKavach(config) {
   const captchaModule = config.captcha ? createCaptchaModule(config.captcha) : null;
   const redirectChain = createRedirectChain(config.redirects);
   const webhookModule = config.webhooks && config.webhooks.length > 0 ? createWebhookModule(config.webhooks) : null;
-  const pluginRegistry = await initializePlugins(config.plugins ?? [], db, config);
+  const pluginRegistry = await initializePlugins(config.plugins ?? [], db, config, sessionManager);
   const endpointCtx = {
     db,
     async getUser(request) {
-      if (!authAdapter) return null;
-      return authAdapter.resolveUser(request);
+      if (authAdapter) {
+        const user = await authAdapter.resolveUser(request);
+        if (user) return user;
+      }
+      if (sessionManager) {
+        const token = extractToken(request);
+        if (!token) return null;
+        try {
+          const session = await sessionManager.validate(token);
+          if (!session) return null;
+          const userRows = await db.select().from(users).where(eq(users.id, session.userId));
+          const user = userRows[0];
+          if (!user) return null;
+          return {
+            id: user.id,
+            email: user.email ?? void 0,
+            name: user.name ?? void 0
+          };
+        } catch {
+          return null;
+        }
+      }
+      return null;
     },
     async getSession(token) {
       if (!sessionManager) return null;
@@ -18361,6 +18354,46 @@ async function createKavach(config) {
     }
   };
   const pluginRouter = createPluginRouter(pluginRegistry.endpoints);
+  if (sessionManager) {
+    pluginRegistry.endpoints.push({
+      method: "POST",
+      path: "/auth/sign-out",
+      metadata: { description: "Revoke the current session and clear cookie" },
+      async handler(request) {
+        const token = extractToken(request);
+        if (!token) return json({ error: "No session" }, 401);
+        try {
+          const session = await sessionManager.validate(token);
+          if (session) {
+            await sessionManager.revoke(session.id);
+          }
+        } catch {
+        }
+        return new Response(JSON.stringify({ success: true }), {
+          status: 200,
+          headers: {
+            "Content-Type": "application/json",
+            "Set-Cookie": buildClearCookie("kavach_session")
+          }
+        });
+      }
+    });
+    pluginRegistry.endpoints.push({
+      method: "GET",
+      path: "/auth/session",
+      metadata: { description: "Get current session and user info" },
+      async handler(request) {
+        const user = await endpointCtx.getUser(request);
+        if (!user) return json({ error: "Not authenticated" }, 401);
+        const token = extractToken(request);
+        const session = token ? await sessionManager.validate(token) : null;
+        return json({
+          user,
+          session: session ? { id: session.id, expiresAt: session.expiresAt } : null
+        });
+      }
+    });
+  }
   async function authorize(agentId, request, context) {
     if (hooks.beforeAuthorize) {
       const verdict = await hooks.beforeAuthorize({
@@ -19432,7 +19465,7 @@ function parseCookies2(header) {
   }
   return result;
 }
-function getCookie(header, name) {
+function getCookie2(header, name) {
   return parseCookies2(header)[name];
 }
 function parseCookiesFromRequest(request) {
@@ -19553,7 +19586,7 @@ function createCookieSessionManager(config, db) {
     ...config.cookieOptions,
     maxAge: maxAgeSecs
   };
-  function buildSetCookie(token) {
+  function buildSetCookie2(token) {
     return serializeCookie(sessionName, token, baseCookieOpts);
   }
   function buildDeleteCookie() {
@@ -19562,10 +19595,10 @@ function createCookieSessionManager(config, db) {
   }
   async function createSession(userId, metadata) {
     const { session, token } = await raw.create(userId, metadata);
-    return { session, setCookieHeader: buildSetCookie(token) };
+    return { session, setCookieHeader: buildSetCookie2(token) };
   }
   async function validateSession(cookieHeader) {
-    const token = getCookie(cookieHeader, sessionName);
+    const token = getCookie2(cookieHeader, sessionName);
     if (!token) {
       return { session: null, refreshCookieHeader: null };
     }
@@ -19591,7 +19624,7 @@ function createCookieSessionManager(config, db) {
       row.userId,
       row.metadata ?? void 0
     );
-    return { session: newSession, setCookieHeader: buildSetCookie(newToken) };
+    return { session: newSession, setCookieHeader: buildSetCookie2(newToken) };
   }
   async function revokeSession(sessionId) {
     await raw.revoke(sessionId);
@@ -19935,7 +19968,7 @@ function createSessionRefresher(config) {
   }
   async function handleRequest(request) {
     const cookieHeader = request.headers.get("cookie") ?? "";
-    let rawToken = getCookie(cookieHeader, refreshCookieName);
+    let rawToken = getCookie2(cookieHeader, refreshCookieName);
     if (!rawToken) {
       try {
         const body = await request.clone().json();
@@ -20666,6 +20699,6 @@ async function verifyWebhookSignature3(secret, rawBody, signature) {
   return diff === 0;
 }
 
-export { CredentialStatusSchema, CredentialSubjectSchema, EVENT_TYPES, HibpApiError, HibpBreachedError, KAVACH_AGENT_CREDENTIAL, KAVACH_DELEGATION_CREDENTIAL, KAVACH_PERMISSION_CREDENTIAL, KVStore, MemoryStore, MultiSessionLimitError, OAuthProxyError, OneTapVerifyError, ProofSchema, RefreshTokenError, SSO_ERROR, SsoError, VC_CONTEXT_V1, VC_CONTEXT_V2, VC_TYPE_CREDENTIAL, VC_TYPE_PRESENTATION, VerifiableCredentialSchema, VerifiablePresentationSchema, additionalFields, admin, agentCards, agentDids, agents, anonymousAuth, apiKeys2 as apiKeys, apiKeys as apiKeysTable, approvalRequests, auditLogs, bearerAuth, budgetPolicies, buildDidDocument, buildSessionMetadata, classifyViolation, constantTimeEqual, createAdditionalFieldsModule, createAdminModule, createAgentModule, createAnonymousAuthModule, createApiKeyManagerModule, createAppleProvider, createApprovalModule, createAuditModule, createCaptchaModule, createCookieSessionManager, createCostAttributionModule, createCustomSessionModule, createDatabase, createDatabaseSync, createDelegationModule, createDeviceAuthModule, createDidModule, createDiscordProvider, createEmailOtpModule, createEmailTemplates, createEmailVerificationModule, createEphemeralSessionModule, createEventStreamModule, createFederationModule, createGdprModule, createGithubProvider, createGitlabProvider, createGoogleProvider, createHibpModule, createI18n, createJwtSessionModule, createKavach, createLastLoginModule, createLinkedInProvider, createMagicLinkModule, createMicrosoftProvider, createMultiSessionModule, createOAuthModule, createOAuthProxyModule, createOidcProviderModule, createOneTapModule, createOneTimeTokenModule, createOpenApiModule, createOrgModule, createPasskeyModule, createPasswordResetModule, createPermissionEngine, createPhoneAuthModule, createPluginRouter, createPolarModule, createPolicyModule, createPresentation, createPrivilegeAnalyzer, createRateLimiter, createReBACModule, createRedirectChain, createScimModule, createSessionFreshnessModule, createSessionManager, createSessionRefresher, createSiweModule, createSlackProvider, createSsoModule, createStripeModule, createTables, createTenantModule, createTokenFamilyStore, createTotpModule, createTrustModule, createTrustedDeviceModule, createTwitterProvider, createUsernameAuthModule, createVCIssuer, createVCVerifier, createWebhookModule2 as createWebhookModule, customAuth, customSession, de, delegationChains, deviceAuth, deviceLabelFromRequest, emailOtp, emailOtps, en, es, fr, fromBase64Url, fromHex, gdpr, generateCsrfToken, generateDidKey, generateDidWeb, generateId, generateOpenAPISpec, getCookie, getDidWebUrl, getPermissionTemplate, headerAuth, hmacSha1Raw, hmacSha256, hmacSha256Raw, importHmacKey, initializePlugins, ja, kvStore, magicLink, magicLinks, mcpServers, oauth, oauthAccessTokens, oauthAuthorizationCodes, oauthClients, oauthProxy, oneTap, orgInvitations, orgMembers, orgRoles, organization, organizations, parseCookies2 as parseCookies, parseCookiesFromRequest, passkey, passkeyChallenges, passkeyCredentials, pbkdf2Hash, pbkdf2Verify, permissionTemplates, permissions, polar, randomBytes, randomBytesHex, rateLimit, rateLimits, resolveDidKey, resolveDidWeb, scim, serializeCookie, serializeCookieDeletion, sessions, sha1, sha256, sha256Raw, signPayload2 as signPayload, siwe, ssoConnections, stripe, tenants, toBase64Url, toHex, totpRecords, trustScores, twoFactor, users, validateCsrfToken, validateOrigin, verifyPayload, verifyPresentation, verifyWebhookSignature3 as verifyWebhookSignature, withRateLimit, zh };
+export { CredentialStatusSchema, CredentialSubjectSchema, EVENT_TYPES, HibpApiError, HibpBreachedError, KAVACH_AGENT_CREDENTIAL, KAVACH_DELEGATION_CREDENTIAL, KAVACH_PERMISSION_CREDENTIAL, KVStore, MemoryStore, MultiSessionLimitError, OAuthProxyError, OneTapVerifyError, ProofSchema, RefreshTokenError, SSO_ERROR, SsoError, VC_CONTEXT_V1, VC_CONTEXT_V2, VC_TYPE_CREDENTIAL, VC_TYPE_PRESENTATION, VerifiableCredentialSchema, VerifiablePresentationSchema, additionalFields, admin, agentCards, agentDids, agents, anonymousAuth, apiKeys2 as apiKeys, apiKeys as apiKeysTable, approvalRequests, auditLogs, bearerAuth, budgetPolicies, buildDidDocument, buildSessionMetadata, classifyViolation, constantTimeEqual, createAdditionalFieldsModule, createAdminModule, createAgentModule, createAnonymousAuthModule, createApiKeyManagerModule, createAppleProvider, createApprovalModule, createAuditModule, createCaptchaModule, createCookieSessionManager, createCostAttributionModule, createCustomSessionModule, createDatabase, createDatabaseSync, createDelegationModule, createDeviceAuthModule, createDidModule, createDiscordProvider, createEmailOtpModule, createEmailTemplates, createEmailVerificationModule, createEphemeralSessionModule, createEventStreamModule, createFederationModule, createGdprModule, createGithubProvider, createGitlabProvider, createGoogleProvider, createHibpModule, createI18n, createJwtSessionModule, createKavach, createLastLoginModule, createLinkedInProvider, createMagicLinkModule, createMicrosoftProvider, createMultiSessionModule, createOAuthModule, createOAuthProxyModule, createOidcProviderModule, createOneTapModule, createOneTimeTokenModule, createOpenApiModule, createOrgModule, createPasskeyModule, createPasswordResetModule, createPermissionEngine, createPhoneAuthModule, createPluginRouter, createPolarModule, createPolicyModule, createPresentation, createPrivilegeAnalyzer, createRateLimiter, createReBACModule, createRedirectChain, createScimModule, createSessionFreshnessModule, createSessionManager, createSessionRefresher, createSiweModule, createSlackProvider, createSsoModule, createStripeModule, createTables, createTenantModule, createTokenFamilyStore, createTotpModule, createTrustModule, createTrustedDeviceModule, createTwitterProvider, createUsernameAuthModule, createVCIssuer, createVCVerifier, createWebhookModule2 as createWebhookModule, customAuth, customSession, de, delegationChains, deviceAuth, deviceLabelFromRequest, emailOtp, emailOtps, en, es, fr, fromBase64Url, fromHex, gdpr, generateCsrfToken, generateDidKey, generateDidWeb, generateId, generateOpenAPISpec, getCookie2 as getCookie, getDidWebUrl, getPermissionTemplate, headerAuth, hmacSha1Raw, hmacSha256, hmacSha256Raw, importHmacKey, initializePlugins, ja, kvStore, magicLink, magicLinks, mcpServers, oauth, oauthAccessTokens, oauthAuthorizationCodes, oauthClients, oauthProxy, oneTap, orgInvitations, orgMembers, orgRoles, organization, organizations, parseCookies2 as parseCookies, parseCookiesFromRequest, passkey, passkeyChallenges, passkeyCredentials, pbkdf2Hash, pbkdf2Verify, permissionTemplates, permissions, polar, randomBytes, randomBytesHex, rateLimit, rateLimits, resolveDidKey, resolveDidWeb, scim, serializeCookie, serializeCookieDeletion, sessions, sha1, sha256, sha256Raw, signPayload2 as signPayload, siwe, ssoConnections, stripe, tenants, toBase64Url, toHex, totpRecords, trustScores, twoFactor, users, validateCsrfToken, validateOrigin, verifyPayload, verifyPresentation, verifyWebhookSignature3 as verifyWebhookSignature, withRateLimit, zh };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map