@korajs/auth 0.3.0 → 0.3.1

package/dist/server.d.cts

@@ -296,15 +296,70 @@ interface AuthDevice {
 declare class DuplicateEmailError extends KoraError {
     constructor();
 }
+/**
+ * Generic interface for user and device persistence.
+ *
+ * Implement this interface to provide database-backed user storage for
+ * the built-in auth provider. All methods are async to support both
+ * synchronous (in-memory, SQLite) and asynchronous (PostgreSQL) backends.
+ *
+ * Built-in implementations:
+ * - {@link InMemoryUserStore} — development and testing (no persistence)
+ * - `SqliteUserStore` — SQLite via better-sqlite3 (from `@korajs/auth/server`)
+ * - `PostgresUserStore` — PostgreSQL via postgres-js (from `@korajs/auth/server`)
+ *
+ * @example
+ * ```typescript
+ * import { BuiltInAuthRoutes, SqliteUserStore } from '@korajs/auth/server'
+ *
+ * const userStore = await createSqliteUserStore({ filename: './auth.db' })
+ * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+ * ```
+ */
+interface UserStore {
+    /** Create a new user account. Throws DuplicateEmailError if email exists. */
+    createUser(params: {
+        email: string;
+        passwordHash: string;
+        salt: string;
+        name: string;
+    }): Promise<AuthUser>;
+    /** Find a user by email address (case-insensitive). */
+    findByEmail(email: string): Promise<StoredUser | null>;
+    /** Find a user by ID. */
+    findById(id: string): Promise<StoredUser | null>;
+    /** Register a device for a user. Idempotent if device already exists and is not revoked. */
+    registerDevice(params: {
+        id: string;
+        userId: string;
+        publicKey: string;
+        name: string;
+    }): Promise<AuthDevice>;
+    /** Find a device by its ID. */
+    findDevice(deviceId: string): Promise<AuthDevice | null>;
+    /** List all devices registered for a user (includes revoked). */
+    listDevices(userId: string): Promise<AuthDevice[]>;
+    /** Soft-revoke a device. No-op if device does not exist. */
+    revokeDevice(deviceId: string): Promise<void>;
+    /** Set a user's email verification status. */
+    setEmailVerified(userId: string, verified: boolean): Promise<void>;
+    /** Update a user's password hash and salt. */
+    updatePassword(userId: string, passwordHash: string, salt: string): Promise<void>;
+    /** List all users. For admin/development use. */
+    listAll(): Promise<StoredUser[]>;
+    /** Update a stored user record. */
+    update(user: StoredUser): Promise<void>;
+    /** Delete a user and all associated devices. */
+    delete(userId: string): Promise<void>;
+    /** Update the last-seen timestamp for a device. No-op if device does not exist. */
+    touchDevice(deviceId: string): Promise<void>;
+}
 /**
  * In-memory user and device store for the built-in auth provider.
  *
  * This is a simple implementation suitable for development and testing.
- * Production applications should replace this with a database-backed store
- * implementing the same interface.
- *
- * All methods are async to match the interface that a real database store
- * would expose, even though the in-memory operations are synchronous.
+ * Production applications should use {@link SqliteUserStore} or
+ * {@link PostgresUserStore} for persistent storage.
  *
  * @example
  * ```typescript
@@ -317,7 +372,7 @@ declare class DuplicateEmailError extends KoraError {
  * })
  * ```
  */
-declare class InMemoryUserStore {
+declare class InMemoryUserStore implements UserStore {
     /** Users indexed by ID */
     private readonly usersById;
     /** Users indexed by email (lowercase) for fast lookup */
@@ -522,7 +577,7 @@ declare class InMemoryRateLimiter implements RateLimiter {
  */
 interface AuthRoutesConfig {
     /** The user/device store backing the auth routes */
-    userStore: InMemoryUserStore;
+    userStore: UserStore;
     /** The token manager for issuing and validating JWTs */
     tokenManager: TokenManager;
     /**
@@ -973,7 +1028,7 @@ interface PasswordResetStore {
  */
 interface PasswordResetConfig {
     /** User store for looking up users and updating passwords */
-    userStore: InMemoryUserStore;
+    userStore: UserStore;
     /** Store for reset tokens. Defaults to InMemoryPasswordResetStore. */
     resetStore?: PasswordResetStore;
     /** Token TTL in milliseconds. Defaults to 1 hour. */
@@ -1116,7 +1171,7 @@ interface EmailVerificationStore {
  */
 interface EmailVerificationConfig {
     /** User store for looking up users */
-    userStore: InMemoryUserStore;
+    userStore: UserStore;
     /** Store for verification tokens. Defaults to InMemoryEmailVerificationStore. */
     verificationStore?: EmailVerificationStore;
     /** Token TTL in milliseconds. Defaults to 24 hours. */
@@ -1220,6 +1275,148 @@ declare class EmailVerificationManager {
     }>;
 }
 
+/**
+ * Minimal better-sqlite3 subset to avoid a hard dependency on the package.
+ * The real Database instance satisfies this at runtime.
+ */
+interface SqliteDatabase {
+    pragma(source: string): unknown;
+    exec(source: string): void;
+    prepare(source: string): {
+        run(...params: unknown[]): unknown;
+        get(...params: unknown[]): unknown;
+        all(...params: unknown[]): unknown[];
+    };
+    transaction<T>(fn: () => T): () => T;
+}
+/**
+ * SQLite-backed user and device store using better-sqlite3.
+ *
+ * Provides persistent user storage suitable for single-server deployments,
+ * Electron apps, and development environments. Uses WAL mode for concurrent
+ * read/write performance.
+ *
+ * This implementation uses dynamic imports for better-sqlite3 so projects
+ * that do not use SQLite server-side do not need to install it.
+ *
+ * @example
+ * ```typescript
+ * import { createSqliteUserStore } from '@korajs/auth/server'
+ *
+ * const userStore = await createSqliteUserStore({ filename: './auth.db' })
+ * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+ * ```
+ */
+declare class SqliteUserStore implements UserStore {
+    private readonly db;
+    constructor(db: SqliteDatabase);
+    private ensureTables;
+    createUser(params: {
+        email: string;
+        passwordHash: string;
+        salt: string;
+        name: string;
+    }): Promise<AuthUser>;
+    findByEmail(email: string): Promise<StoredUser | null>;
+    findById(id: string): Promise<StoredUser | null>;
+    registerDevice(params: {
+        id: string;
+        userId: string;
+        publicKey: string;
+        name: string;
+    }): Promise<AuthDevice>;
+    findDevice(deviceId: string): Promise<AuthDevice | null>;
+    listDevices(userId: string): Promise<AuthDevice[]>;
+    revokeDevice(deviceId: string): Promise<void>;
+    setEmailVerified(userId: string, verified: boolean): Promise<void>;
+    updatePassword(userId: string, passwordHash: string, salt: string): Promise<void>;
+    listAll(): Promise<StoredUser[]>;
+    update(user: StoredUser): Promise<void>;
+    delete(userId: string): Promise<void>;
+    touchDevice(deviceId: string): Promise<void>;
+}
+/**
+ * Creates a SqliteUserStore from a file path.
+ *
+ * Uses runtime dynamic imports so projects that do not use SQLite server-side
+ * do not need to install `better-sqlite3`.
+ *
+ * @param options.filename - Path to the SQLite database file, or `:memory:` for in-memory
+ */
+declare function createSqliteUserStore(options: {
+    filename: string;
+}): Promise<SqliteUserStore>;
+
+/**
+ * Minimal typed subset of a postgres-js SQL tag for our queries.
+ * Avoids a hard dependency on the postgres package.
+ * Uses Record<string, unknown>[] for result type to match postgres-js return shape.
+ */
+interface PostgresClient {
+    begin<T>(fn: (sql: PostgresClient) => Promise<T>): Promise<T>;
+    (template: TemplateStringsArray, ...args: unknown[]): Promise<Record<string, unknown>[]>;
+}
+/**
+ * PostgreSQL-backed user and device store using postgres-js.
+ *
+ * Provides persistent user storage suitable for production multi-server
+ * deployments. Uses parameterized queries for SQL injection safety and
+ * transactions for atomic operations.
+ *
+ * This implementation uses dynamic imports for postgres so projects
+ * that do not use PostgreSQL do not need to install it.
+ *
+ * @example
+ * ```typescript
+ * import { createPostgresUserStore } from '@korajs/auth/server'
+ *
+ * const userStore = await createPostgresUserStore({
+ *   connectionString: 'postgres://user:pass@localhost:5432/mydb',
+ * })
+ * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+ * ```
+ */
+declare class PostgresUserStore implements UserStore {
+    private readonly sql;
+    private readonly ready;
+    constructor(sql: PostgresClient);
+    private ensureTables;
+    createUser(params: {
+        email: string;
+        passwordHash: string;
+        salt: string;
+        name: string;
+    }): Promise<AuthUser>;
+    findByEmail(email: string): Promise<StoredUser | null>;
+    findById(id: string): Promise<StoredUser | null>;
+    registerDevice(params: {
+        id: string;
+        userId: string;
+        publicKey: string;
+        name: string;
+    }): Promise<AuthDevice>;
+    findDevice(deviceId: string): Promise<AuthDevice | null>;
+    listDevices(userId: string): Promise<AuthDevice[]>;
+    revokeDevice(deviceId: string): Promise<void>;
+    setEmailVerified(userId: string, verified: boolean): Promise<void>;
+    updatePassword(userId: string, passwordHash: string, salt: string): Promise<void>;
+    listAll(): Promise<StoredUser[]>;
+    update(user: StoredUser): Promise<void>;
+    delete(userId: string): Promise<void>;
+    touchDevice(deviceId: string): Promise<void>;
+}
+/**
+ * Creates a PostgresUserStore from a connection string.
+ *
+ * Uses runtime dynamic imports so projects that do not use PostgreSQL
+ * do not need to install `postgres`.
+ *
+ * @param options.connectionString - PostgreSQL connection URL (e.g., `postgres://user:pass@host:5432/db`)
+ */
+declare function createPostgresUserStore(options: {
+    connectionString: string;
+}): Promise<PostgresUserStore>;
+
 /**
  * Parameters for signing up a new user.
  */
@@ -3505,7 +3702,7 @@ declare class AuditLogger {
  */
 interface AdminApiConfig {
     /** User store for managing users */
-    userStore: InMemoryUserStore;
+    userStore: UserStore;
     /** Session store for managing sessions (optional) */
     sessionStore?: SessionStore;
     /** Audit logger (optional) */
@@ -3787,4 +3984,4 @@ declare class WebhookManager {
  */
 declare function verifyWebhookSignature(payload: string, signature: string, secret: string): Promise<boolean>;
 
-export { AdminApi, type AdminApiConfig, AdminApiError, AdminUnauthorizedError, AdminUserNotFoundError, type AdminUserUpdate, type AuditAction, type AuditEntry, AuditLogError, type AuditLogQuery, type AuditLogStore, AuditLogger, type AuthDevice, type AuthProviderAdapter, AuthProviderError, type AuthRouteResponse, type AuthRoutesConfig, type AuthUser, type AuthenticationOptions, type AuthenticationVerificationResult, BUILT_IN_ROLES, BuiltInAuthRoutes, BuiltInProvider, CannotRemoveOwnerError, type ChallengeStore, CircularInheritanceError, type ClerkAdapterConfig, type CollectionScopeResolver, type CreateInvitationParams, type CreateOrgParams, type CreateSessionParams, DuplicateEmailError, type EmailVerificationConfig, EmailVerificationError, EmailVerificationManager, type EmailVerificationStore, type EmailVerificationToken, ExternalAuthOperationNotSupportedError, ExternalJwtProvider, type ExternalJwtProviderConfig, ExternalTokenValidationError, type ExternalUserInfo, INVITATION_STATUSES, InMemoryAuditLogStore, InMemoryChallengeStore, InMemoryEmailVerificationStore, InMemoryOAuthStateStore, InMemoryOrgStore, InMemoryPasswordResetStore, InMemoryRateLimiter, InMemorySessionStore, InMemoryTokenRevocationStore, InMemoryTotpStore, InMemoryUserStore, InMemoryWebhookStore, InsufficientRoleError, InvalidPermissionError, InvitationExpiredError, InvitationNotFoundError, type InvitationStatus, type LinkedIdentity, MemberAlreadyExistsError, type Membership, MembershipNotFoundError, OAuthCodeExchangeError, OAuthError, OAuthManager, type OAuthManagerConfig, type OAuthProviderConfig, OAuthProviderNotFoundError, type OAuthState, OAuthStateMismatchError, type OAuthStateStore, type OAuthTokens, type OAuthUserInfo, OAuthUserInfoError, ORG_ROLES, OrgError, type OrgInvitation, OrgNotFoundError, type OrgRole, type OrgRouteResponse, OrgRoutes, type OrgRoutesConfig, OrgScopeResolver, OrgSlugTakenError, type OrgStore, type Organization, type PaginatedResult, PasskeyVerificationError, type PasswordResetConfig, PasswordResetError, PasswordResetManager, type PasswordResetStore, type PasswordResetToken, type Permission, ROLE_HIERARCHY, type RateLimiter, type RbacConfig, RbacEngine, RbacError, type RegistrationOptions, type RegistrationVerificationResult, ResetRateLimitedError, ResetTokenExpiredError, ResetTokenNotFoundError, type RoleDefinition, RoleNotFoundError, type ScopeContext, type ScopeFilter, type Session, SessionError, SessionExpiredError, SessionLimitExceededError, SessionManager, type SessionManagerConfig, SessionMfaRequiredError, SessionNotFoundError, type SessionStore, type SignInParams, type SignUpParams, type StoredUser, type SupabaseAdapterConfig, type SyncScopes, TokenManager, type TokenManagerConfig, type TokenRevocationStore, TotpAlreadyEnabledError, type TotpConfig, TotpError, TotpInvalidCodeError, TotpManager, TotpNotEnabledError, TotpNotVerifiedError, TotpRecoveryExhaustedError, type TotpSecret, type TotpSetupResult, type TotpStore, type UpdateOrgParams, type UserListQuery, VerificationTokenExpiredError, VerificationTokenNotFoundError, type WebhookDelivery, type WebhookEndpoint, WebhookEndpointNotFoundError, WebhookError, type WebhookEvent, WebhookManager, type WebhookPayload, type WebhookStore, base32Decode, base32Encode, createClerkAdapter, createSupabaseAdapter, decodeJwt, defineRoles, encodeJwt, generateAuthenticationOptions, generateRegistrationOptions, githubProvider, googleProvider, hasRoleLevel, hashPassword, isExpired, microsoftProvider, parsePermission, permissionCovers, verifyAuthenticationResponse, verifyJwt, verifyPassword, verifyRegistrationResponse, verifyWebhookSignature };
+export { AdminApi, type AdminApiConfig, AdminApiError, AdminUnauthorizedError, AdminUserNotFoundError, type AdminUserUpdate, type AuditAction, type AuditEntry, AuditLogError, type AuditLogQuery, type AuditLogStore, AuditLogger, type AuthDevice, type AuthProviderAdapter, AuthProviderError, type AuthRouteResponse, type AuthRoutesConfig, type AuthUser, type AuthenticationOptions, type AuthenticationVerificationResult, BUILT_IN_ROLES, BuiltInAuthRoutes, BuiltInProvider, CannotRemoveOwnerError, type ChallengeStore, CircularInheritanceError, type ClerkAdapterConfig, type CollectionScopeResolver, type CreateInvitationParams, type CreateOrgParams, type CreateSessionParams, DuplicateEmailError, type EmailVerificationConfig, EmailVerificationError, EmailVerificationManager, type EmailVerificationStore, type EmailVerificationToken, ExternalAuthOperationNotSupportedError, ExternalJwtProvider, type ExternalJwtProviderConfig, ExternalTokenValidationError, type ExternalUserInfo, INVITATION_STATUSES, InMemoryAuditLogStore, InMemoryChallengeStore, InMemoryEmailVerificationStore, InMemoryOAuthStateStore, InMemoryOrgStore, InMemoryPasswordResetStore, InMemoryRateLimiter, InMemorySessionStore, InMemoryTokenRevocationStore, InMemoryTotpStore, InMemoryUserStore, InMemoryWebhookStore, InsufficientRoleError, InvalidPermissionError, InvitationExpiredError, InvitationNotFoundError, type InvitationStatus, type LinkedIdentity, MemberAlreadyExistsError, type Membership, MembershipNotFoundError, OAuthCodeExchangeError, OAuthError, OAuthManager, type OAuthManagerConfig, type OAuthProviderConfig, OAuthProviderNotFoundError, type OAuthState, OAuthStateMismatchError, type OAuthStateStore, type OAuthTokens, type OAuthUserInfo, OAuthUserInfoError, ORG_ROLES, OrgError, type OrgInvitation, OrgNotFoundError, type OrgRole, type OrgRouteResponse, OrgRoutes, type OrgRoutesConfig, OrgScopeResolver, OrgSlugTakenError, type OrgStore, type Organization, type PaginatedResult, PasskeyVerificationError, type PasswordResetConfig, PasswordResetError, PasswordResetManager, type PasswordResetStore, type PasswordResetToken, type Permission, PostgresUserStore, ROLE_HIERARCHY, type RateLimiter, type RbacConfig, RbacEngine, RbacError, type RegistrationOptions, type RegistrationVerificationResult, ResetRateLimitedError, ResetTokenExpiredError, ResetTokenNotFoundError, type RoleDefinition, RoleNotFoundError, type ScopeContext, type ScopeFilter, type Session, SessionError, SessionExpiredError, SessionLimitExceededError, SessionManager, type SessionManagerConfig, SessionMfaRequiredError, SessionNotFoundError, type SessionStore, type SignInParams, type SignUpParams, SqliteUserStore, type StoredUser, type SupabaseAdapterConfig, type SyncScopes, TokenManager, type TokenManagerConfig, type TokenRevocationStore, TotpAlreadyEnabledError, type TotpConfig, TotpError, TotpInvalidCodeError, TotpManager, TotpNotEnabledError, TotpNotVerifiedError, TotpRecoveryExhaustedError, type TotpSecret, type TotpSetupResult, type TotpStore, type UpdateOrgParams, type UserListQuery, type UserStore, VerificationTokenExpiredError, VerificationTokenNotFoundError, type WebhookDelivery, type WebhookEndpoint, WebhookEndpointNotFoundError, WebhookError, type WebhookEvent, WebhookManager, type WebhookPayload, type WebhookStore, base32Decode, base32Encode, createClerkAdapter, createPostgresUserStore, createSqliteUserStore, createSupabaseAdapter, decodeJwt, defineRoles, encodeJwt, generateAuthenticationOptions, generateRegistrationOptions, githubProvider, googleProvider, hasRoleLevel, hashPassword, isExpired, microsoftProvider, parsePermission, permissionCovers, verifyAuthenticationResponse, verifyJwt, verifyPassword, verifyRegistrationResponse, verifyWebhookSignature };

package/dist/server.d.ts

@@ -296,15 +296,70 @@ interface AuthDevice {
 declare class DuplicateEmailError extends KoraError {
     constructor();
 }
+/**
+ * Generic interface for user and device persistence.
+ *
+ * Implement this interface to provide database-backed user storage for
+ * the built-in auth provider. All methods are async to support both
+ * synchronous (in-memory, SQLite) and asynchronous (PostgreSQL) backends.
+ *
+ * Built-in implementations:
+ * - {@link InMemoryUserStore} — development and testing (no persistence)
+ * - `SqliteUserStore` — SQLite via better-sqlite3 (from `@korajs/auth/server`)
+ * - `PostgresUserStore` — PostgreSQL via postgres-js (from `@korajs/auth/server`)
+ *
+ * @example
+ * ```typescript
+ * import { BuiltInAuthRoutes, SqliteUserStore } from '@korajs/auth/server'
+ *
+ * const userStore = await createSqliteUserStore({ filename: './auth.db' })
+ * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+ * ```
+ */
+interface UserStore {
+    /** Create a new user account. Throws DuplicateEmailError if email exists. */
+    createUser(params: {
+        email: string;
+        passwordHash: string;
+        salt: string;
+        name: string;
+    }): Promise<AuthUser>;
+    /** Find a user by email address (case-insensitive). */
+    findByEmail(email: string): Promise<StoredUser | null>;
+    /** Find a user by ID. */
+    findById(id: string): Promise<StoredUser | null>;
+    /** Register a device for a user. Idempotent if device already exists and is not revoked. */
+    registerDevice(params: {
+        id: string;
+        userId: string;
+        publicKey: string;
+        name: string;
+    }): Promise<AuthDevice>;
+    /** Find a device by its ID. */
+    findDevice(deviceId: string): Promise<AuthDevice | null>;
+    /** List all devices registered for a user (includes revoked). */
+    listDevices(userId: string): Promise<AuthDevice[]>;
+    /** Soft-revoke a device. No-op if device does not exist. */
+    revokeDevice(deviceId: string): Promise<void>;
+    /** Set a user's email verification status. */
+    setEmailVerified(userId: string, verified: boolean): Promise<void>;
+    /** Update a user's password hash and salt. */
+    updatePassword(userId: string, passwordHash: string, salt: string): Promise<void>;
+    /** List all users. For admin/development use. */
+    listAll(): Promise<StoredUser[]>;
+    /** Update a stored user record. */
+    update(user: StoredUser): Promise<void>;
+    /** Delete a user and all associated devices. */
+    delete(userId: string): Promise<void>;
+    /** Update the last-seen timestamp for a device. No-op if device does not exist. */
+    touchDevice(deviceId: string): Promise<void>;
+}
 /**
  * In-memory user and device store for the built-in auth provider.
  *
  * This is a simple implementation suitable for development and testing.
- * Production applications should replace this with a database-backed store
- * implementing the same interface.
- *
- * All methods are async to match the interface that a real database store
- * would expose, even though the in-memory operations are synchronous.
+ * Production applications should use {@link SqliteUserStore} or
+ * {@link PostgresUserStore} for persistent storage.
  *
  * @example
  * ```typescript
@@ -317,7 +372,7 @@ declare class DuplicateEmailError extends KoraError {
  * })
  * ```
  */
-declare class InMemoryUserStore {
+declare class InMemoryUserStore implements UserStore {
     /** Users indexed by ID */
     private readonly usersById;
     /** Users indexed by email (lowercase) for fast lookup */
@@ -522,7 +577,7 @@ declare class InMemoryRateLimiter implements RateLimiter {
  */
 interface AuthRoutesConfig {
     /** The user/device store backing the auth routes */
-    userStore: InMemoryUserStore;
+    userStore: UserStore;
     /** The token manager for issuing and validating JWTs */
     tokenManager: TokenManager;
     /**
@@ -973,7 +1028,7 @@ interface PasswordResetStore {
  */
 interface PasswordResetConfig {
     /** User store for looking up users and updating passwords */
-    userStore: InMemoryUserStore;
+    userStore: UserStore;
     /** Store for reset tokens. Defaults to InMemoryPasswordResetStore. */
     resetStore?: PasswordResetStore;
     /** Token TTL in milliseconds. Defaults to 1 hour. */
@@ -1116,7 +1171,7 @@ interface EmailVerificationStore {
  */
 interface EmailVerificationConfig {
     /** User store for looking up users */
-    userStore: InMemoryUserStore;
+    userStore: UserStore;
     /** Store for verification tokens. Defaults to InMemoryEmailVerificationStore. */
     verificationStore?: EmailVerificationStore;
     /** Token TTL in milliseconds. Defaults to 24 hours. */
@@ -1220,6 +1275,148 @@ declare class EmailVerificationManager {
     }>;
 }
 
+/**
+ * Minimal better-sqlite3 subset to avoid a hard dependency on the package.
+ * The real Database instance satisfies this at runtime.
+ */
+interface SqliteDatabase {
+    pragma(source: string): unknown;
+    exec(source: string): void;
+    prepare(source: string): {
+        run(...params: unknown[]): unknown;
+        get(...params: unknown[]): unknown;
+        all(...params: unknown[]): unknown[];
+    };
+    transaction<T>(fn: () => T): () => T;
+}
+/**
+ * SQLite-backed user and device store using better-sqlite3.
+ *
+ * Provides persistent user storage suitable for single-server deployments,
+ * Electron apps, and development environments. Uses WAL mode for concurrent
+ * read/write performance.
+ *
+ * This implementation uses dynamic imports for better-sqlite3 so projects
+ * that do not use SQLite server-side do not need to install it.
+ *
+ * @example
+ * ```typescript
+ * import { createSqliteUserStore } from '@korajs/auth/server'
+ *
+ * const userStore = await createSqliteUserStore({ filename: './auth.db' })
+ * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+ * ```
+ */
+declare class SqliteUserStore implements UserStore {
+    private readonly db;
+    constructor(db: SqliteDatabase);
+    private ensureTables;
+    createUser(params: {
+        email: string;
+        passwordHash: string;
+        salt: string;
+        name: string;
+    }): Promise<AuthUser>;
+    findByEmail(email: string): Promise<StoredUser | null>;
+    findById(id: string): Promise<StoredUser | null>;
+    registerDevice(params: {
+        id: string;
+        userId: string;
+        publicKey: string;
+        name: string;
+    }): Promise<AuthDevice>;
+    findDevice(deviceId: string): Promise<AuthDevice | null>;
+    listDevices(userId: string): Promise<AuthDevice[]>;
+    revokeDevice(deviceId: string): Promise<void>;
+    setEmailVerified(userId: string, verified: boolean): Promise<void>;
+    updatePassword(userId: string, passwordHash: string, salt: string): Promise<void>;
+    listAll(): Promise<StoredUser[]>;
+    update(user: StoredUser): Promise<void>;
+    delete(userId: string): Promise<void>;
+    touchDevice(deviceId: string): Promise<void>;
+}
+/**
+ * Creates a SqliteUserStore from a file path.
+ *
+ * Uses runtime dynamic imports so projects that do not use SQLite server-side
+ * do not need to install `better-sqlite3`.
+ *
+ * @param options.filename - Path to the SQLite database file, or `:memory:` for in-memory
+ */
+declare function createSqliteUserStore(options: {
+    filename: string;
+}): Promise<SqliteUserStore>;
+
+/**
+ * Minimal typed subset of a postgres-js SQL tag for our queries.
+ * Avoids a hard dependency on the postgres package.
+ * Uses Record<string, unknown>[] for result type to match postgres-js return shape.
+ */
+interface PostgresClient {
+    begin<T>(fn: (sql: PostgresClient) => Promise<T>): Promise<T>;
+    (template: TemplateStringsArray, ...args: unknown[]): Promise<Record<string, unknown>[]>;
+}
+/**
+ * PostgreSQL-backed user and device store using postgres-js.
+ *
+ * Provides persistent user storage suitable for production multi-server
+ * deployments. Uses parameterized queries for SQL injection safety and
+ * transactions for atomic operations.
+ *
+ * This implementation uses dynamic imports for postgres so projects
+ * that do not use PostgreSQL do not need to install it.
+ *
+ * @example
+ * ```typescript
+ * import { createPostgresUserStore } from '@korajs/auth/server'
+ *
+ * const userStore = await createPostgresUserStore({
+ *   connectionString: 'postgres://user:pass@localhost:5432/mydb',
+ * })
+ * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+ * ```
+ */
+declare class PostgresUserStore implements UserStore {
+    private readonly sql;
+    private readonly ready;
+    constructor(sql: PostgresClient);
+    private ensureTables;
+    createUser(params: {
+        email: string;
+        passwordHash: string;
+        salt: string;
+        name: string;
+    }): Promise<AuthUser>;
+    findByEmail(email: string): Promise<StoredUser | null>;
+    findById(id: string): Promise<StoredUser | null>;
+    registerDevice(params: {
+        id: string;
+        userId: string;
+        publicKey: string;
+        name: string;
+    }): Promise<AuthDevice>;
+    findDevice(deviceId: string): Promise<AuthDevice | null>;
+    listDevices(userId: string): Promise<AuthDevice[]>;
+    revokeDevice(deviceId: string): Promise<void>;
+    setEmailVerified(userId: string, verified: boolean): Promise<void>;
+    updatePassword(userId: string, passwordHash: string, salt: string): Promise<void>;
+    listAll(): Promise<StoredUser[]>;
+    update(user: StoredUser): Promise<void>;
+    delete(userId: string): Promise<void>;
+    touchDevice(deviceId: string): Promise<void>;
+}
+/**
+ * Creates a PostgresUserStore from a connection string.
+ *
+ * Uses runtime dynamic imports so projects that do not use PostgreSQL
+ * do not need to install `postgres`.
+ *
+ * @param options.connectionString - PostgreSQL connection URL (e.g., `postgres://user:pass@host:5432/db`)
+ */
+declare function createPostgresUserStore(options: {
+    connectionString: string;
+}): Promise<PostgresUserStore>;
+
 /**
  * Parameters for signing up a new user.
  */
@@ -3505,7 +3702,7 @@ declare class AuditLogger {
  */
 interface AdminApiConfig {
     /** User store for managing users */
-    userStore: InMemoryUserStore;
+    userStore: UserStore;
     /** Session store for managing sessions (optional) */
     sessionStore?: SessionStore;
     /** Audit logger (optional) */
@@ -3787,4 +3984,4 @@ declare class WebhookManager {
  */
 declare function verifyWebhookSignature(payload: string, signature: string, secret: string): Promise<boolean>;
 
-export { AdminApi, type AdminApiConfig, AdminApiError, AdminUnauthorizedError, AdminUserNotFoundError, type AdminUserUpdate, type AuditAction, type AuditEntry, AuditLogError, type AuditLogQuery, type AuditLogStore, AuditLogger, type AuthDevice, type AuthProviderAdapter, AuthProviderError, type AuthRouteResponse, type AuthRoutesConfig, type AuthUser, type AuthenticationOptions, type AuthenticationVerificationResult, BUILT_IN_ROLES, BuiltInAuthRoutes, BuiltInProvider, CannotRemoveOwnerError, type ChallengeStore, CircularInheritanceError, type ClerkAdapterConfig, type CollectionScopeResolver, type CreateInvitationParams, type CreateOrgParams, type CreateSessionParams, DuplicateEmailError, type EmailVerificationConfig, EmailVerificationError, EmailVerificationManager, type EmailVerificationStore, type EmailVerificationToken, ExternalAuthOperationNotSupportedError, ExternalJwtProvider, type ExternalJwtProviderConfig, ExternalTokenValidationError, type ExternalUserInfo, INVITATION_STATUSES, InMemoryAuditLogStore, InMemoryChallengeStore, InMemoryEmailVerificationStore, InMemoryOAuthStateStore, InMemoryOrgStore, InMemoryPasswordResetStore, InMemoryRateLimiter, InMemorySessionStore, InMemoryTokenRevocationStore, InMemoryTotpStore, InMemoryUserStore, InMemoryWebhookStore, InsufficientRoleError, InvalidPermissionError, InvitationExpiredError, InvitationNotFoundError, type InvitationStatus, type LinkedIdentity, MemberAlreadyExistsError, type Membership, MembershipNotFoundError, OAuthCodeExchangeError, OAuthError, OAuthManager, type OAuthManagerConfig, type OAuthProviderConfig, OAuthProviderNotFoundError, type OAuthState, OAuthStateMismatchError, type OAuthStateStore, type OAuthTokens, type OAuthUserInfo, OAuthUserInfoError, ORG_ROLES, OrgError, type OrgInvitation, OrgNotFoundError, type OrgRole, type OrgRouteResponse, OrgRoutes, type OrgRoutesConfig, OrgScopeResolver, OrgSlugTakenError, type OrgStore, type Organization, type PaginatedResult, PasskeyVerificationError, type PasswordResetConfig, PasswordResetError, PasswordResetManager, type PasswordResetStore, type PasswordResetToken, type Permission, ROLE_HIERARCHY, type RateLimiter, type RbacConfig, RbacEngine, RbacError, type RegistrationOptions, type RegistrationVerificationResult, ResetRateLimitedError, ResetTokenExpiredError, ResetTokenNotFoundError, type RoleDefinition, RoleNotFoundError, type ScopeContext, type ScopeFilter, type Session, SessionError, SessionExpiredError, SessionLimitExceededError, SessionManager, type SessionManagerConfig, SessionMfaRequiredError, SessionNotFoundError, type SessionStore, type SignInParams, type SignUpParams, type StoredUser, type SupabaseAdapterConfig, type SyncScopes, TokenManager, type TokenManagerConfig, type TokenRevocationStore, TotpAlreadyEnabledError, type TotpConfig, TotpError, TotpInvalidCodeError, TotpManager, TotpNotEnabledError, TotpNotVerifiedError, TotpRecoveryExhaustedError, type TotpSecret, type TotpSetupResult, type TotpStore, type UpdateOrgParams, type UserListQuery, VerificationTokenExpiredError, VerificationTokenNotFoundError, type WebhookDelivery, type WebhookEndpoint, WebhookEndpointNotFoundError, WebhookError, type WebhookEvent, WebhookManager, type WebhookPayload, type WebhookStore, base32Decode, base32Encode, createClerkAdapter, createSupabaseAdapter, decodeJwt, defineRoles, encodeJwt, generateAuthenticationOptions, generateRegistrationOptions, githubProvider, googleProvider, hasRoleLevel, hashPassword, isExpired, microsoftProvider, parsePermission, permissionCovers, verifyAuthenticationResponse, verifyJwt, verifyPassword, verifyRegistrationResponse, verifyWebhookSignature };
+export { AdminApi, type AdminApiConfig, AdminApiError, AdminUnauthorizedError, AdminUserNotFoundError, type AdminUserUpdate, type AuditAction, type AuditEntry, AuditLogError, type AuditLogQuery, type AuditLogStore, AuditLogger, type AuthDevice, type AuthProviderAdapter, AuthProviderError, type AuthRouteResponse, type AuthRoutesConfig, type AuthUser, type AuthenticationOptions, type AuthenticationVerificationResult, BUILT_IN_ROLES, BuiltInAuthRoutes, BuiltInProvider, CannotRemoveOwnerError, type ChallengeStore, CircularInheritanceError, type ClerkAdapterConfig, type CollectionScopeResolver, type CreateInvitationParams, type CreateOrgParams, type CreateSessionParams, DuplicateEmailError, type EmailVerificationConfig, EmailVerificationError, EmailVerificationManager, type EmailVerificationStore, type EmailVerificationToken, ExternalAuthOperationNotSupportedError, ExternalJwtProvider, type ExternalJwtProviderConfig, ExternalTokenValidationError, type ExternalUserInfo, INVITATION_STATUSES, InMemoryAuditLogStore, InMemoryChallengeStore, InMemoryEmailVerificationStore, InMemoryOAuthStateStore, InMemoryOrgStore, InMemoryPasswordResetStore, InMemoryRateLimiter, InMemorySessionStore, InMemoryTokenRevocationStore, InMemoryTotpStore, InMemoryUserStore, InMemoryWebhookStore, InsufficientRoleError, InvalidPermissionError, InvitationExpiredError, InvitationNotFoundError, type InvitationStatus, type LinkedIdentity, MemberAlreadyExistsError, type Membership, MembershipNotFoundError, OAuthCodeExchangeError, OAuthError, OAuthManager, type OAuthManagerConfig, type OAuthProviderConfig, OAuthProviderNotFoundError, type OAuthState, OAuthStateMismatchError, type OAuthStateStore, type OAuthTokens, type OAuthUserInfo, OAuthUserInfoError, ORG_ROLES, OrgError, type OrgInvitation, OrgNotFoundError, type OrgRole, type OrgRouteResponse, OrgRoutes, type OrgRoutesConfig, OrgScopeResolver, OrgSlugTakenError, type OrgStore, type Organization, type PaginatedResult, PasskeyVerificationError, type PasswordResetConfig, PasswordResetError, PasswordResetManager, type PasswordResetStore, type PasswordResetToken, type Permission, PostgresUserStore, ROLE_HIERARCHY, type RateLimiter, type RbacConfig, RbacEngine, RbacError, type RegistrationOptions, type RegistrationVerificationResult, ResetRateLimitedError, ResetTokenExpiredError, ResetTokenNotFoundError, type RoleDefinition, RoleNotFoundError, type ScopeContext, type ScopeFilter, type Session, SessionError, SessionExpiredError, SessionLimitExceededError, SessionManager, type SessionManagerConfig, SessionMfaRequiredError, SessionNotFoundError, type SessionStore, type SignInParams, type SignUpParams, SqliteUserStore, type StoredUser, type SupabaseAdapterConfig, type SyncScopes, TokenManager, type TokenManagerConfig, type TokenRevocationStore, TotpAlreadyEnabledError, type TotpConfig, TotpError, TotpInvalidCodeError, TotpManager, TotpNotEnabledError, TotpNotVerifiedError, TotpRecoveryExhaustedError, type TotpSecret, type TotpSetupResult, type TotpStore, type UpdateOrgParams, type UserListQuery, type UserStore, VerificationTokenExpiredError, VerificationTokenNotFoundError, type WebhookDelivery, type WebhookEndpoint, WebhookEndpointNotFoundError, WebhookError, type WebhookEvent, WebhookManager, type WebhookPayload, type WebhookStore, base32Decode, base32Encode, createClerkAdapter, createPostgresUserStore, createSqliteUserStore, createSupabaseAdapter, decodeJwt, defineRoles, encodeJwt, generateAuthenticationOptions, generateRegistrationOptions, githubProvider, googleProvider, hasRoleLevel, hashPassword, isExpired, microsoftProvider, parsePermission, permissionCovers, verifyAuthenticationResponse, verifyJwt, verifyPassword, verifyRegistrationResponse, verifyWebhookSignature };