@korajs/auth 0.3.3 → 0.5.0

package/dist/index.d.cts

@@ -1,148 +1,107 @@
-export { A as AuthClient, a as AuthClientConfig, b as AuthError, c as AuthState, d as AuthUser, C as ClientInvitation, e as ClientMembership, f as ClientOrganization, O as OrgClient, g as OrgClientConfig, h as OrgClientError } from './org-client-BVTLKcIk.cjs';
+import { A as AuthClientConfig, a as AuthTokenStorage, b as AuthKeyValueStorage, c as AuthDeviceIdentityProvider, D as DeviceKeyStore, d as AuthClient, e as AuthState } from './org-client-q2u55qod.cjs';
+export { f as AuthDeviceIdentity, g as AuthDeviceIdentityError, h as AuthError, i as AuthTokenStorageOptions, j as AuthUser, C as ClientInvitation, k as ClientMembership, l as ClientOrganization, m as DeviceKeyStoreError, I as InMemoryDeviceKeyStore, n as IndexedDBDeviceKeyStore, L as LinkedOAuthAccount, O as OAuthAuthorizationOptions, o as OAuthAuthorizationResult, p as OAuthCallbackParams, q as OrgClient, r as OrgClientConfig, s as OrgClientError, P as PersistentDeviceIdentityOptions, t as createAuthTokenStorage, u as createDeviceKeyStore, v as createMemoryAuthTokenStorage, w as createPersistentDeviceIdentity, x as createWebStorageAuthTokenStorage } from './org-client-q2u55qod.cjs';
+import { SchemaDefinition, ScopeMap, KoraError } from '@korajs/core';
 import { A as AuthTokens } from './operation-encryptor-DRmKNWpF.cjs';
 export { a as AuthConfig, b as AuthEvent, c as AuthEventType, d as AuthStatus, C as CryptoUnavailableError, D as DeviceIdentityError, O as OperationEncryptionError, e as OperationEncryptor, f as OperationEncryptorConfig, T as TokenPayload, g as TokenType, h as computePublicKeyThumbprint, i as exportPublicKeyJwk, j as fromBase64Url, k as generateDeviceKeyPair, l as isEncryptedField, s as signChallenge, t as toBase64Url, v as verifyChallenge } from './operation-encryptor-DRmKNWpF.cjs';
-import { KoraError } from '@korajs/core';
 
-/**
- * Thrown when a device key store operation fails.
- * Provides context about the operation and the underlying cause.
- */
-declare class DeviceKeyStoreError extends KoraError {
-    constructor(message: string, context?: Record<string, unknown>);
-}
-/**
- * Persistent storage interface for ECDSA P-256 device key pairs.
- *
- * Device key pairs are used for proof-of-possession authentication:
- * the private key never leaves the device, and the public key is
- * registered with the server. This store persists key pairs across
- * page reloads and app restarts.
- *
- * In the browser, CryptoKey objects are structured-cloneable, so they
- * can be stored directly in IndexedDB without serialization. In Node.js
- * or test environments, an in-memory implementation is used instead.
- */
-interface DeviceKeyStore {
+interface CreateKoraAuthOptions extends Omit<AuthClientConfig, 'storage' | 'deviceIdentity'> {
     /**
-     * Persist a key pair for the given device.
-     *
-     * Overwrites any previously stored key pair for the same device ID.
-     *
-     * @param deviceId - The unique device identifier (typically a UUID v7)
-     * @param keyPair - The ECDSA P-256 CryptoKeyPair to store
-     * @throws {DeviceKeyStoreError} If the storage operation fails
+     * Complete token storage adapter. Use this for fully custom runtimes.
+     * If omitted, `credentialStore` is adapted automatically.
      */
-    saveKeyPair(deviceId: string, keyPair: CryptoKeyPair): Promise<void>;
+    storage?: AuthTokenStorage;
     /**
-     * Load a previously stored key pair for the given device.
-     *
-     * @param deviceId - The unique device identifier
-     * @returns The stored CryptoKeyPair, or null if no key pair exists for the device
-     * @throws {DeviceKeyStoreError} If the storage operation fails
+     * Runtime credential store used for tokens and stable device ID.
+     * Examples: Tauri secure storage, Expo SecureStore, iOS Keychain, Android Keystore.
      */
-    loadKeyPair(deviceId: string): Promise<CryptoKeyPair | null>;
+    credentialStore?: AuthKeyValueStorage;
     /**
-     * Delete a stored key pair for the given device.
-     *
-     * No-op if no key pair exists for the device ID.
-     *
-     * @param deviceId - The unique device identifier
-     * @throws {DeviceKeyStoreError} If the storage operation fails
+     * Explicit device identity provider. Set to `false` to disable automatic
+     * device binding during sign-up/sign-in.
      */
-    deleteKeyPair(deviceId: string): Promise<void>;
+    deviceIdentity?: AuthDeviceIdentityProvider | false;
     /**
-     * Check whether a key pair exists for the given device.
-     *
-     * @param deviceId - The unique device identifier
-     * @returns True if a key pair is stored for the device, false otherwise
-     * @throws {DeviceKeyStoreError} If the storage operation fails
+     * Device key store for runtimes without IndexedDB, such as React Native.
      */
-    hasKeyPair(deviceId: string): Promise<boolean>;
+    deviceKeyStore?: DeviceKeyStore;
 }
 /**
- * Browser-based device key store backed by IndexedDB.
- *
- * CryptoKey objects are structured-cloneable, so they can be stored
- * directly in IndexedDB without needing to export/import them as JWK.
- * This preserves the non-extractable flag on private keys, ensuring
- * they cannot be read even from storage.
- *
- * The database uses a single object store (`keypairs`) with the device ID
- * as the key and the full CryptoKeyPair as the value.
+ * Create a production-shaped Kora auth client with minimal setup.
  *
- * @example
- * ```typescript
- * const store = new IndexedDBDeviceKeyStore()
- * const keyPair = await generateDeviceKeyPair()
- * await store.saveKeyPair('device-123', keyPair)
- *
- * const loaded = await store.loadKeyPair('device-123')
- * // loaded.privateKey is still non-extractable
- * ```
+ * Defaults:
+ * - browser/Tauri WebView: localStorage for tokens, IndexedDB for device keys
+ * - desktop/mobile: pass `credentialStore` and optionally `deviceKeyStore`
+ * - automatic device identity is enabled when a persistent device ID store exists
+ */
+declare function createKoraAuth(options: CreateKoraAuthOptions): AuthClient;
+
+/**
+ * Minimal auth client surface required for sync integration.
+ * Matches {@link AuthClient} without importing implementation details.
+ */
+interface AuthSyncClient {
+    getAccessToken(): Promise<string | null>;
+    onAuthChange?(callback: (state: AuthState) => void): () => void;
+}
+/**
+ * Sync binding returned by {@link createKoraAuthSync}.
+ * Passed to `createApp({ sync: { authClient } })` in korajs.
  */
-declare class IndexedDBDeviceKeyStore implements DeviceKeyStore {
-    private dbPromise;
+interface KoraAuthSyncBinding {
+    /** Returns the access token for sync handshake (empty string when signed out). */
+    auth: () => Promise<{
+        token: string;
+    }>;
+    /** Builds a scope map from the current token and schema. */
+    resolveScopeMap?: () => Promise<ScopeMap | undefined>;
     /**
-     * Opens (or creates) the IndexedDB database.
-     *
-     * The database connection is lazily initialized on first use and
-     * reused for subsequent operations. If the database does not exist,
-     * it is created with the `keypairs` object store.
+     * Returns the device-bound sync node id from the token `dev` claim.
+     * Separate from the user id (`sub`).
      */
-    private openDatabase;
-    /** @inheritdoc */
-    saveKeyPair(deviceId: string, keyPair: CryptoKeyPair): Promise<void>;
-    /** @inheritdoc */
-    loadKeyPair(deviceId: string): Promise<CryptoKeyPair | null>;
-    /** @inheritdoc */
-    deleteKeyPair(deviceId: string): Promise<void>;
-    /** @inheritdoc */
-    hasKeyPair(deviceId: string): Promise<boolean>;
+    resolveNodeId?: () => Promise<string | undefined>;
+    /** Notifies when auth state changes so sync can refresh scope or reconnect. */
+    subscribe?: (listener: () => void) => () => void;
 }
 /**
- * In-memory device key store for Node.js and testing environments.
- *
- * Key pairs are stored in a plain Map and do not survive process restarts.
- * This is suitable for server-side rendering, Node.js scripts, and unit tests
- * where IndexedDB is not available.
- *
- * @example
- * ```typescript
- * const store = new InMemoryDeviceKeyStore()
- * const keyPair = await generateDeviceKeyPair()
- * await store.saveKeyPair('device-123', keyPair)
- *
- * const loaded = await store.loadKeyPair('device-123')
- * ```
+ * Configuration for {@link createKoraAuthSync}.
  */
-declare class InMemoryDeviceKeyStore implements DeviceKeyStore {
-    private readonly store;
-    /** @inheritdoc */
-    saveKeyPair(deviceId: string, keyPair: CryptoKeyPair): Promise<void>;
-    /** @inheritdoc */
-    loadKeyPair(deviceId: string): Promise<CryptoKeyPair | null>;
-    /** @inheritdoc */
-    deleteKeyPair(deviceId: string): Promise<void>;
-    /** @inheritdoc */
-    hasKeyPair(deviceId: string): Promise<boolean>;
+interface CreateKoraAuthSyncOptions {
+    /** Kora auth client from `createKoraAuth()`. */
+    authClient: AuthSyncClient;
+    /**
+     * Application schema. When provided, scope maps are built automatically
+     * from JWT claims and schema scope declarations.
+     */
+    schema?: SchemaDefinition;
+    /**
+     * Custom claim → flat scope value mapping.
+     * Defaults to {@link extractScopeValuesFromClaims}.
+     */
+    scopeFromClaims?: (claims: Record<string, unknown>) => Record<string, unknown>;
 }
 /**
- * Creates a DeviceKeyStore appropriate for the current environment.
- *
- * In browsers where IndexedDB is available, returns an {@link IndexedDBDeviceKeyStore}
- * that persists CryptoKeyPair objects as structured clones. In Node.js, SSR,
- * or environments without IndexedDB, returns an {@link InMemoryDeviceKeyStore}.
+ * Creates a sync auth binding for `createApp({ sync: { authClient: binding } })`.
  *
- * @returns A DeviceKeyStore instance for the current environment
+ * Wires token refresh, automatic scope maps from JWT claims, and device-bound
+ * sync node ids (`dev` claim) separate from the user id (`sub`).
  *
  * @example
  * ```typescript
- * const store = createDeviceKeyStore()
- * const keyPair = await generateDeviceKeyPair()
- * await store.saveKeyPair(deviceId, keyPair)
+ * import { createKoraAuth, createKoraAuthSync } from '@korajs/auth'
+ * import { createApp } from 'korajs'
+ *
+ * const authClient = createKoraAuth({ serverUrl: 'https://api.example.com' })
+ *
+ * const app = createApp({
+ *   schema,
+ *   sync: {
+ *     url: 'wss://api.example.com/kora-sync',
+ *     authClient: createKoraAuthSync({ authClient, schema }),
+ *   },
+ * })
  * ```
  */
-declare function createDeviceKeyStore(): DeviceKeyStore;
+declare function createKoraAuthSync(options: CreateKoraAuthSyncOptions): KoraAuthSyncBinding;
 
 /**
  * Client-side token storage for Kora auth tokens.
@@ -780,4 +739,4 @@ declare class AutoLockManager {
     private _clearTimer;
 }
 
-export { AuthTokens, type AutoLockConfig, AutoLockManager, type DeviceKeyStore, DeviceKeyStoreError, EncryptedTokenStore, type EncryptedTokenStoreConfig, EncryptedTokenStoreError, EncryptionError, InMemoryDeviceKeyStore, IndexedDBDeviceKeyStore, KeyDerivationError, type PasskeyAuthenticationResponse, PasskeyError, type PasskeyRegistrationResponse, PasskeyUnsupportedError, TokenStore, authenticateWithPasskey, createDeviceKeyStore, createPasskeyCredential, decryptData, deriveEncryptionKey, encryptData, exportKey, generateEncryptionKey, generateSalt, importKey, isPasskeySupported, isPlatformAuthenticatorAvailable };
+export { AuthClient, AuthClientConfig, AuthDeviceIdentityProvider, AuthKeyValueStorage, AuthState, type AuthSyncClient, AuthTokenStorage, AuthTokens, type AutoLockConfig, AutoLockManager, type CreateKoraAuthOptions, type CreateKoraAuthSyncOptions, DeviceKeyStore, EncryptedTokenStore, type EncryptedTokenStoreConfig, EncryptedTokenStoreError, EncryptionError, KeyDerivationError, type KoraAuthSyncBinding, type PasskeyAuthenticationResponse, PasskeyError, type PasskeyRegistrationResponse, PasskeyUnsupportedError, TokenStore, authenticateWithPasskey, createKoraAuth, createKoraAuthSync, createPasskeyCredential, decryptData, deriveEncryptionKey, encryptData, exportKey, generateEncryptionKey, generateSalt, importKey, isPasskeySupported, isPlatformAuthenticatorAvailable };

package/dist/index.d.ts

@@ -1,148 +1,107 @@
-export { A as AuthClient, a as AuthClientConfig, b as AuthError, c as AuthState, d as AuthUser, C as ClientInvitation, e as ClientMembership, f as ClientOrganization, O as OrgClient, g as OrgClientConfig, h as OrgClientError } from './org-client-BVTLKcIk.js';
+import { A as AuthClientConfig, a as AuthTokenStorage, b as AuthKeyValueStorage, c as AuthDeviceIdentityProvider, D as DeviceKeyStore, d as AuthClient, e as AuthState } from './org-client-q2u55qod.js';
+export { f as AuthDeviceIdentity, g as AuthDeviceIdentityError, h as AuthError, i as AuthTokenStorageOptions, j as AuthUser, C as ClientInvitation, k as ClientMembership, l as ClientOrganization, m as DeviceKeyStoreError, I as InMemoryDeviceKeyStore, n as IndexedDBDeviceKeyStore, L as LinkedOAuthAccount, O as OAuthAuthorizationOptions, o as OAuthAuthorizationResult, p as OAuthCallbackParams, q as OrgClient, r as OrgClientConfig, s as OrgClientError, P as PersistentDeviceIdentityOptions, t as createAuthTokenStorage, u as createDeviceKeyStore, v as createMemoryAuthTokenStorage, w as createPersistentDeviceIdentity, x as createWebStorageAuthTokenStorage } from './org-client-q2u55qod.js';
+import { SchemaDefinition, ScopeMap, KoraError } from '@korajs/core';
 import { A as AuthTokens } from './operation-encryptor-DRmKNWpF.js';
 export { a as AuthConfig, b as AuthEvent, c as AuthEventType, d as AuthStatus, C as CryptoUnavailableError, D as DeviceIdentityError, O as OperationEncryptionError, e as OperationEncryptor, f as OperationEncryptorConfig, T as TokenPayload, g as TokenType, h as computePublicKeyThumbprint, i as exportPublicKeyJwk, j as fromBase64Url, k as generateDeviceKeyPair, l as isEncryptedField, s as signChallenge, t as toBase64Url, v as verifyChallenge } from './operation-encryptor-DRmKNWpF.js';
-import { KoraError } from '@korajs/core';
 
-/**
- * Thrown when a device key store operation fails.
- * Provides context about the operation and the underlying cause.
- */
-declare class DeviceKeyStoreError extends KoraError {
-    constructor(message: string, context?: Record<string, unknown>);
-}
-/**
- * Persistent storage interface for ECDSA P-256 device key pairs.
- *
- * Device key pairs are used for proof-of-possession authentication:
- * the private key never leaves the device, and the public key is
- * registered with the server. This store persists key pairs across
- * page reloads and app restarts.
- *
- * In the browser, CryptoKey objects are structured-cloneable, so they
- * can be stored directly in IndexedDB without serialization. In Node.js
- * or test environments, an in-memory implementation is used instead.
- */
-interface DeviceKeyStore {
+interface CreateKoraAuthOptions extends Omit<AuthClientConfig, 'storage' | 'deviceIdentity'> {
     /**
-     * Persist a key pair for the given device.
-     *
-     * Overwrites any previously stored key pair for the same device ID.
-     *
-     * @param deviceId - The unique device identifier (typically a UUID v7)
-     * @param keyPair - The ECDSA P-256 CryptoKeyPair to store
-     * @throws {DeviceKeyStoreError} If the storage operation fails
+     * Complete token storage adapter. Use this for fully custom runtimes.
+     * If omitted, `credentialStore` is adapted automatically.
      */
-    saveKeyPair(deviceId: string, keyPair: CryptoKeyPair): Promise<void>;
+    storage?: AuthTokenStorage;
     /**
-     * Load a previously stored key pair for the given device.
-     *
-     * @param deviceId - The unique device identifier
-     * @returns The stored CryptoKeyPair, or null if no key pair exists for the device
-     * @throws {DeviceKeyStoreError} If the storage operation fails
+     * Runtime credential store used for tokens and stable device ID.
+     * Examples: Tauri secure storage, Expo SecureStore, iOS Keychain, Android Keystore.
      */
-    loadKeyPair(deviceId: string): Promise<CryptoKeyPair | null>;
+    credentialStore?: AuthKeyValueStorage;
     /**
-     * Delete a stored key pair for the given device.
-     *
-     * No-op if no key pair exists for the device ID.
-     *
-     * @param deviceId - The unique device identifier
-     * @throws {DeviceKeyStoreError} If the storage operation fails
+     * Explicit device identity provider. Set to `false` to disable automatic
+     * device binding during sign-up/sign-in.
      */
-    deleteKeyPair(deviceId: string): Promise<void>;
+    deviceIdentity?: AuthDeviceIdentityProvider | false;
     /**
-     * Check whether a key pair exists for the given device.
-     *
-     * @param deviceId - The unique device identifier
-     * @returns True if a key pair is stored for the device, false otherwise
-     * @throws {DeviceKeyStoreError} If the storage operation fails
+     * Device key store for runtimes without IndexedDB, such as React Native.
      */
-    hasKeyPair(deviceId: string): Promise<boolean>;
+    deviceKeyStore?: DeviceKeyStore;
 }
 /**
- * Browser-based device key store backed by IndexedDB.
- *
- * CryptoKey objects are structured-cloneable, so they can be stored
- * directly in IndexedDB without needing to export/import them as JWK.
- * This preserves the non-extractable flag on private keys, ensuring
- * they cannot be read even from storage.
- *
- * The database uses a single object store (`keypairs`) with the device ID
- * as the key and the full CryptoKeyPair as the value.
+ * Create a production-shaped Kora auth client with minimal setup.
  *
- * @example
- * ```typescript
- * const store = new IndexedDBDeviceKeyStore()
- * const keyPair = await generateDeviceKeyPair()
- * await store.saveKeyPair('device-123', keyPair)
- *
- * const loaded = await store.loadKeyPair('device-123')
- * // loaded.privateKey is still non-extractable
- * ```
+ * Defaults:
+ * - browser/Tauri WebView: localStorage for tokens, IndexedDB for device keys
+ * - desktop/mobile: pass `credentialStore` and optionally `deviceKeyStore`
+ * - automatic device identity is enabled when a persistent device ID store exists
+ */
+declare function createKoraAuth(options: CreateKoraAuthOptions): AuthClient;
+
+/**
+ * Minimal auth client surface required for sync integration.
+ * Matches {@link AuthClient} without importing implementation details.
+ */
+interface AuthSyncClient {
+    getAccessToken(): Promise<string | null>;
+    onAuthChange?(callback: (state: AuthState) => void): () => void;
+}
+/**
+ * Sync binding returned by {@link createKoraAuthSync}.
+ * Passed to `createApp({ sync: { authClient } })` in korajs.
  */
-declare class IndexedDBDeviceKeyStore implements DeviceKeyStore {
-    private dbPromise;
+interface KoraAuthSyncBinding {
+    /** Returns the access token for sync handshake (empty string when signed out). */
+    auth: () => Promise<{
+        token: string;
+    }>;
+    /** Builds a scope map from the current token and schema. */
+    resolveScopeMap?: () => Promise<ScopeMap | undefined>;
     /**
-     * Opens (or creates) the IndexedDB database.
-     *
-     * The database connection is lazily initialized on first use and
-     * reused for subsequent operations. If the database does not exist,
-     * it is created with the `keypairs` object store.
+     * Returns the device-bound sync node id from the token `dev` claim.
+     * Separate from the user id (`sub`).
      */
-    private openDatabase;
-    /** @inheritdoc */
-    saveKeyPair(deviceId: string, keyPair: CryptoKeyPair): Promise<void>;
-    /** @inheritdoc */
-    loadKeyPair(deviceId: string): Promise<CryptoKeyPair | null>;
-    /** @inheritdoc */
-    deleteKeyPair(deviceId: string): Promise<void>;
-    /** @inheritdoc */
-    hasKeyPair(deviceId: string): Promise<boolean>;
+    resolveNodeId?: () => Promise<string | undefined>;
+    /** Notifies when auth state changes so sync can refresh scope or reconnect. */
+    subscribe?: (listener: () => void) => () => void;
 }
 /**
- * In-memory device key store for Node.js and testing environments.
- *
- * Key pairs are stored in a plain Map and do not survive process restarts.
- * This is suitable for server-side rendering, Node.js scripts, and unit tests
- * where IndexedDB is not available.
- *
- * @example
- * ```typescript
- * const store = new InMemoryDeviceKeyStore()
- * const keyPair = await generateDeviceKeyPair()
- * await store.saveKeyPair('device-123', keyPair)
- *
- * const loaded = await store.loadKeyPair('device-123')
- * ```
+ * Configuration for {@link createKoraAuthSync}.
  */
-declare class InMemoryDeviceKeyStore implements DeviceKeyStore {
-    private readonly store;
-    /** @inheritdoc */
-    saveKeyPair(deviceId: string, keyPair: CryptoKeyPair): Promise<void>;
-    /** @inheritdoc */
-    loadKeyPair(deviceId: string): Promise<CryptoKeyPair | null>;
-    /** @inheritdoc */
-    deleteKeyPair(deviceId: string): Promise<void>;
-    /** @inheritdoc */
-    hasKeyPair(deviceId: string): Promise<boolean>;
+interface CreateKoraAuthSyncOptions {
+    /** Kora auth client from `createKoraAuth()`. */
+    authClient: AuthSyncClient;
+    /**
+     * Application schema. When provided, scope maps are built automatically
+     * from JWT claims and schema scope declarations.
+     */
+    schema?: SchemaDefinition;
+    /**
+     * Custom claim → flat scope value mapping.
+     * Defaults to {@link extractScopeValuesFromClaims}.
+     */
+    scopeFromClaims?: (claims: Record<string, unknown>) => Record<string, unknown>;
 }
 /**
- * Creates a DeviceKeyStore appropriate for the current environment.
- *
- * In browsers where IndexedDB is available, returns an {@link IndexedDBDeviceKeyStore}
- * that persists CryptoKeyPair objects as structured clones. In Node.js, SSR,
- * or environments without IndexedDB, returns an {@link InMemoryDeviceKeyStore}.
+ * Creates a sync auth binding for `createApp({ sync: { authClient: binding } })`.
  *
- * @returns A DeviceKeyStore instance for the current environment
+ * Wires token refresh, automatic scope maps from JWT claims, and device-bound
+ * sync node ids (`dev` claim) separate from the user id (`sub`).
  *
  * @example
  * ```typescript
- * const store = createDeviceKeyStore()
- * const keyPair = await generateDeviceKeyPair()
- * await store.saveKeyPair(deviceId, keyPair)
+ * import { createKoraAuth, createKoraAuthSync } from '@korajs/auth'
+ * import { createApp } from 'korajs'
+ *
+ * const authClient = createKoraAuth({ serverUrl: 'https://api.example.com' })
+ *
+ * const app = createApp({
+ *   schema,
+ *   sync: {
+ *     url: 'wss://api.example.com/kora-sync',
+ *     authClient: createKoraAuthSync({ authClient, schema }),
+ *   },
+ * })
  * ```
  */
-declare function createDeviceKeyStore(): DeviceKeyStore;
+declare function createKoraAuthSync(options: CreateKoraAuthSyncOptions): KoraAuthSyncBinding;
 
 /**
  * Client-side token storage for Kora auth tokens.
@@ -780,4 +739,4 @@ declare class AutoLockManager {
     private _clearTimer;
 }
 
-export { AuthTokens, type AutoLockConfig, AutoLockManager, type DeviceKeyStore, DeviceKeyStoreError, EncryptedTokenStore, type EncryptedTokenStoreConfig, EncryptedTokenStoreError, EncryptionError, InMemoryDeviceKeyStore, IndexedDBDeviceKeyStore, KeyDerivationError, type PasskeyAuthenticationResponse, PasskeyError, type PasskeyRegistrationResponse, PasskeyUnsupportedError, TokenStore, authenticateWithPasskey, createDeviceKeyStore, createPasskeyCredential, decryptData, deriveEncryptionKey, encryptData, exportKey, generateEncryptionKey, generateSalt, importKey, isPasskeySupported, isPlatformAuthenticatorAvailable };
+export { AuthClient, AuthClientConfig, AuthDeviceIdentityProvider, AuthKeyValueStorage, AuthState, type AuthSyncClient, AuthTokenStorage, AuthTokens, type AutoLockConfig, AutoLockManager, type CreateKoraAuthOptions, type CreateKoraAuthSyncOptions, DeviceKeyStore, EncryptedTokenStore, type EncryptedTokenStoreConfig, EncryptedTokenStoreError, EncryptionError, KeyDerivationError, type KoraAuthSyncBinding, type PasskeyAuthenticationResponse, PasskeyError, type PasskeyRegistrationResponse, PasskeyUnsupportedError, TokenStore, authenticateWithPasskey, createKoraAuth, createKoraAuthSync, createPasskeyCredential, decryptData, deriveEncryptionKey, encryptData, exportKey, generateEncryptionKey, generateSalt, importKey, isPasskeySupported, isPlatformAuthenticatorAvailable };