@korajs/auth 0.4.0 → 0.5.0

package/dist/server.d.ts

@@ -33,6 +33,12 @@ interface TokenRevocationStore {
      * @param deviceId - The device ID whose tokens should be revoked
      */
     revokeAllForDevice(deviceId: string): Promise<void>;
+    /**
+     * Check whether all tokens for a device have been revoked.
+     * @param deviceId - The device ID to check
+     * @returns true if the device's token family has been revoked
+     */
+    isDeviceRevoked(deviceId: string): Promise<boolean>;
 }
 /**
  * In-memory token revocation store.
@@ -53,7 +59,7 @@ declare class InMemoryTokenRevocationStore implements TokenRevocationStore {
     /**
      * Check if a device has been revoked.
      */
-    isDeviceRevoked(deviceId: string): boolean;
+    isDeviceRevoked(deviceId: string): Promise<boolean>;
     /**
      * Remove expired revocations to prevent unbounded memory growth.
      * Call periodically (e.g., every hour) in long-running servers.
@@ -201,7 +207,7 @@ declare class TokenManager {
      * Validate a token and check it against the revocation store.
      *
      * Like {@link validateToken}, but also checks whether the token's `jti` has been
-     * revoked. Requires a revocation store to be configured.
+     * revoked or belongs to a revoked device. Requires a revocation store to be configured.
      *
      * @param token - The JWT string to validate
      * @returns The decoded {@link TokenPayload} if valid and not revoked, or null otherwise
@@ -857,6 +863,332 @@ declare class BuiltInAuthRoutes {
     };
 }
 
+/**
+ * Configuration for an OAuth 2.0 provider.
+ */
+interface OAuthProviderConfig {
+    /** Provider identifier (e.g., 'google', 'github', 'microsoft') */
+    providerId: string;
+    /** OAuth client ID */
+    clientId: string;
+    /** OAuth client secret. Required for confidential server-side clients. */
+    clientSecret?: string;
+    /** Authorization endpoint URL */
+    authorizationUrl: string;
+    /** Token exchange endpoint URL */
+    tokenUrl: string;
+    /** User info endpoint URL */
+    userInfoUrl: string;
+    /** OAuth scopes to request */
+    scopes: string[];
+    /** Redirect URI for the callback */
+    redirectUri: string;
+    /**
+     * Enable PKCE (Proof Key for Code Exchange).
+     *
+     * Required for public clients such as desktop and mobile apps, and recommended
+     * whenever the provider supports it.
+     */
+    pkce?: boolean;
+}
+/**
+ * Tokens returned by the OAuth provider after code exchange.
+ */
+interface OAuthTokens {
+    /** OAuth access token */
+    accessToken: string;
+    /** Token type (usually 'Bearer') */
+    tokenType: string;
+    /** Access token expiry in seconds (if provided) */
+    expiresIn?: number;
+    /** Refresh token (if provided) */
+    refreshToken?: string;
+    /** ID token (if provided, e.g., OpenID Connect) */
+    idToken?: string;
+    /** Granted scopes (may differ from requested scopes) */
+    scope?: string;
+}
+/**
+ * User information from the OAuth provider.
+ */
+interface OAuthUserInfo {
+    /** Provider-specific user ID */
+    providerId: string;
+    /** Provider name (e.g., 'google', 'github') */
+    provider: string;
+    /** User's email address (may be null if not granted) */
+    email: string | null;
+    /** Whether the email is verified by the provider */
+    emailVerified: boolean;
+    /** User's display name */
+    name: string | null;
+    /** URL to the user's avatar/profile picture */
+    avatarUrl: string | null;
+    /** Raw profile data from the provider */
+    rawProfile: Record<string, unknown>;
+}
+/**
+ * State stored during the OAuth flow for CSRF protection.
+ */
+interface OAuthState {
+    /** Random state parameter for CSRF protection */
+    state: string;
+    /** Provider ID */
+    provider: string;
+    /** Redirect URI used for this flow */
+    redirectUri: string;
+    /** When this state was created (ms since epoch) */
+    createdAt: number;
+    /** When this state expires (ms since epoch) */
+    expiresAt: number;
+    /** Optional: user-defined data to pass through the flow */
+    metadata?: Record<string, unknown>;
+    /** PKCE code verifier, stored server-side until the callback is consumed. */
+    codeVerifier?: string;
+}
+/**
+ * Store for OAuth state parameters.
+ */
+interface OAuthStateStore {
+    /** Store a state parameter for later validation. */
+    store(state: OAuthState): Promise<void>;
+    /** Consume a state parameter (single-use). Returns null if not found or expired. */
+    consume(stateValue: string): Promise<OAuthState | null>;
+    /** Clean up expired states. */
+    cleanExpired(): Promise<number>;
+}
+/**
+ * A linked OAuth identity for a user.
+ * Users can have multiple linked identities (e.g., Google + GitHub).
+ */
+interface LinkedIdentity {
+    /** Unique ID of this link */
+    id: string;
+    /** Kora user ID */
+    userId: string;
+    /** OAuth provider name */
+    provider: string;
+    /** Provider-specific user ID */
+    providerUserId: string;
+    /** Provider email (at time of linking) */
+    email: string | null;
+    /** When this identity was linked */
+    linkedAt: number;
+}
+declare class OAuthError extends KoraError {
+    constructor(message: string, code: string, context?: Record<string, unknown>);
+}
+declare class OAuthStateMismatchError extends OAuthError {
+    constructor();
+}
+declare class OAuthCodeExchangeError extends OAuthError {
+    constructor(details?: string);
+}
+declare class OAuthUserInfoError extends OAuthError {
+    constructor(details?: string);
+}
+declare class OAuthProviderNotFoundError extends OAuthError {
+    constructor(provider: string);
+}
+
+interface LinkedIdentityStore {
+    findByProvider(provider: string, providerUserId: string): Promise<LinkedIdentity | null>;
+    findByUser(userId: string): Promise<LinkedIdentity[]>;
+    create(params: {
+        userId: string;
+        provider: string;
+        providerUserId: string;
+        email: string | null;
+    }): Promise<LinkedIdentity>;
+    delete(userId: string, provider: string): Promise<void>;
+}
+declare class DuplicateLinkedIdentityError extends KoraError {
+    constructor(provider: string);
+}
+declare class InMemoryLinkedIdentityStore implements LinkedIdentityStore {
+    private readonly identitiesById;
+    private readonly identityIdByProvider;
+    private readonly identityIdsByUser;
+    private readonly identityIdByUserProvider;
+    findByProvider(provider: string, providerUserId: string): Promise<LinkedIdentity | null>;
+    findByUser(userId: string): Promise<LinkedIdentity[]>;
+    create(params: {
+        userId: string;
+        provider: string;
+        providerUserId: string;
+        email: string | null;
+    }): Promise<LinkedIdentity>;
+    delete(userId: string, provider: string): Promise<void>;
+}
+
+/**
+ * In-memory OAuth state store for development.
+ * Use Redis or a database in production for multi-server deployments.
+ */
+declare class InMemoryOAuthStateStore implements OAuthStateStore {
+    private readonly states;
+    store(state: OAuthState): Promise<void>;
+    consume(stateValue: string): Promise<OAuthState | null>;
+    cleanExpired(): Promise<number>;
+}
+/**
+ * Configuration for the OAuth manager.
+ */
+interface OAuthManagerConfig {
+    /** Registered OAuth providers */
+    providers: OAuthProviderConfig[];
+    /** State store. Defaults to InMemoryOAuthStateStore. */
+    stateStore?: OAuthStateStore;
+    /** State TTL in milliseconds. Defaults to 10 minutes. */
+    stateTtlMs?: number;
+    /**
+     * Custom fetch function. Defaults to global fetch.
+     * Useful for testing or custom HTTP clients.
+     */
+    fetch?: typeof globalThis.fetch;
+}
+/**
+ * Manages the OAuth 2.0 authorization code flow.
+ *
+ * Supports any standard OAuth 2.0 / OpenID Connect provider.
+ * Pre-built configurations available for Google, GitHub, and Microsoft.
+ *
+ * @example
+ * ```typescript
+ * const oauth = new OAuthManager({
+ *   providers: [
+ *     googleProvider({ clientId: '...', clientSecret: '...', redirectUri: '...' }),
+ *     githubProvider({ clientId: '...', clientSecret: '...', redirectUri: '...' }),
+ *   ],
+ * })
+ *
+ * // Step 1: Generate authorization URL
+ * const { url, state } = await oauth.getAuthorizationUrl('google')
+ * // Redirect user to url...
+ *
+ * // Step 2: Handle callback
+ * const { tokens, userInfo } = await oauth.handleCallback('google', code, stateParam)
+ * ```
+ */
+declare class OAuthManager {
+    private readonly providers;
+    private readonly stateStore;
+    private readonly stateTtlMs;
+    private readonly fetchFn;
+    constructor(config: OAuthManagerConfig);
+    /**
+     * Generate an authorization URL for the user to visit.
+     * Returns the URL and the state parameter for CSRF validation.
+     */
+    getAuthorizationUrl(providerId: string, metadata?: Record<string, unknown>): Promise<{
+        url: string;
+        state: string;
+    }>;
+    /**
+     * Handle the OAuth callback after the user authorizes.
+     * Validates the state parameter, exchanges the code for tokens,
+     * and fetches user info.
+     *
+     * @param providerId - The OAuth provider
+     * @param code - The authorization code from the callback
+     * @param state - The state parameter from the callback
+     * @returns Tokens and user info from the provider
+     */
+    handleCallback(providerId: string, code: string, state: string): Promise<{
+        tokens: OAuthTokens;
+        userInfo: OAuthUserInfo;
+        stateMetadata?: Record<string, unknown>;
+    }>;
+    /**
+     * Get a registered provider by ID.
+     */
+    getProvider(providerId: string): OAuthProviderConfig;
+    /**
+     * List all registered provider IDs.
+     */
+    getProviderIds(): string[];
+    private exchangeCodeForTokens;
+    private fetchUserInfo;
+}
+interface ProviderFactoryConfig {
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    scopes?: string[];
+    pkce?: boolean;
+}
+/**
+ * Create a Google OAuth provider configuration.
+ */
+declare function googleProvider(config: ProviderFactoryConfig): OAuthProviderConfig;
+/**
+ * Create a GitHub OAuth provider configuration.
+ */
+declare function githubProvider(config: ProviderFactoryConfig): OAuthProviderConfig;
+/**
+ * Create a Microsoft OAuth provider configuration.
+ */
+declare function microsoftProvider(config: ProviderFactoryConfig & {
+    tenantId?: string;
+}): OAuthProviderConfig;
+
+interface KoraAuthHttpRequest {
+    method: string;
+    path: string;
+    body?: unknown;
+    headers?: Record<string, string | string[] | undefined>;
+    query?: Record<string, string | string[] | undefined>;
+    ip?: string;
+}
+interface OAuthServerConfig extends Omit<OAuthManagerConfig, 'providers'> {
+    providers: OAuthProviderConfig[];
+    linkedIdentityStore?: LinkedIdentityStore;
+    /** Create a Kora user on first OAuth sign-in. Defaults to true. */
+    createNewUsers?: boolean;
+    /**
+     * Link OAuth identities to an existing Kora user with the same verified email.
+     * Defaults to false so apps choose this trust boundary explicitly.
+     */
+    autoLinkVerifiedEmail?: boolean;
+    /**
+     * Allow a user to unlink their last OAuth identity. Defaults to false to avoid
+     * locking out OAuth-created accounts that do not have a known password.
+     */
+    allowUnlinkLastIdentity?: boolean;
+}
+interface CreateKoraAuthServerOptions {
+    /** Existing user store. Defaults to InMemoryUserStore for development. */
+    userStore?: UserStore;
+    /** Existing token manager. Overrides `jwtSecret` and `tokenManager` options. */
+    tokenManager?: TokenManager;
+    /** JWT secret. Required in production when `tokenManager` is not provided. */
+    jwtSecret?: string | string[];
+    /** Additional TokenManager options. */
+    tokenManagerOptions?: Omit<TokenManagerConfig, 'secret'>;
+    /** Auth HTTP path prefix. Defaults to `/auth`. */
+    path?: string;
+    /** OAuth provider routes and account-linking storage. */
+    oauth?: OAuthServerConfig;
+    challengeStore?: ChallengeStore;
+    rateLimiter?: RateLimiter;
+}
+interface KoraAuthServer {
+    routes: BuiltInAuthRoutes;
+    userStore: UserStore;
+    tokenManager: TokenManager;
+    oauth?: OAuthManager;
+    linkedIdentityStore?: LinkedIdentityStore;
+    auth: ReturnType<BuiltInAuthRoutes['toSyncAuthProvider']>;
+    handleRequest(request: KoraAuthHttpRequest): Promise<AuthRouteResponse<unknown>>;
+}
+/**
+ * Create the built-in Kora auth server with production-shaped defaults.
+ *
+ * Simple apps can use `handleRequest()` for all `/auth/*` HTTP endpoints and
+ * pass `auth` directly to `createProductionServer({ syncOptions: { auth } })`.
+ */
+declare function createKoraAuthServer(options?: CreateKoraAuthServerOptions): KoraAuthServer;
+
 /**
  * Creates a signed JWT (HS256) from a payload and secret.
  *
@@ -1279,7 +1611,7 @@ declare class EmailVerificationManager {
  * Minimal better-sqlite3 subset to avoid a hard dependency on the package.
  * The real Database instance satisfies this at runtime.
  */
-interface SqliteDatabase {
+interface SqliteDatabase$1 {
     pragma(source: string): unknown;
     exec(source: string): void;
     prepare(source: string): {
@@ -1309,7 +1641,7 @@ interface SqliteDatabase {
  */
 declare class SqliteUserStore implements UserStore {
     private readonly db;
-    constructor(db: SqliteDatabase);
+    constructor(db: SqliteDatabase$1);
     private ensureTables;
     createUser(params: {
         email: string;
@@ -1352,8 +1684,8 @@ declare function createSqliteUserStore(options: {
  * Avoids a hard dependency on the postgres package.
  * Uses Record<string, unknown>[] for result type to match postgres-js return shape.
  */
-interface PostgresClient {
-    begin<T>(fn: (sql: PostgresClient) => Promise<T>): Promise<T>;
+interface PostgresClient$1 {
+    begin<T>(fn: (sql: PostgresClient$1) => Promise<T>): Promise<T>;
     (template: TemplateStringsArray, ...args: unknown[]): Promise<Record<string, unknown>[]>;
 }
 /**
@@ -1379,7 +1711,7 @@ interface PostgresClient {
 declare class PostgresUserStore implements UserStore {
     private readonly sql;
     private readonly ready;
-    constructor(sql: PostgresClient);
+    constructor(sql: PostgresClient$1);
     private ensureTables;
     createUser(params: {
         email: string;
@@ -2960,234 +3292,93 @@ declare class OrgScopeResolver {
     private resolveCollectionScope;
 }
 
-/**
- * Configuration for an OAuth 2.0 provider.
- */
-interface OAuthProviderConfig {
-    /** Provider identifier (e.g., 'google', 'github', 'microsoft') */
-    providerId: string;
-    /** OAuth client ID */
-    clientId: string;
-    /** OAuth client secret */
-    clientSecret: string;
-    /** Authorization endpoint URL */
-    authorizationUrl: string;
-    /** Token exchange endpoint URL */
-    tokenUrl: string;
-    /** User info endpoint URL */
-    userInfoUrl: string;
-    /** OAuth scopes to request */
-    scopes: string[];
-    /** Redirect URI for the callback */
-    redirectUri: string;
-}
-/**
- * Tokens returned by the OAuth provider after code exchange.
- */
-interface OAuthTokens {
-    /** OAuth access token */
-    accessToken: string;
-    /** Token type (usually 'Bearer') */
-    tokenType: string;
-    /** Access token expiry in seconds (if provided) */
-    expiresIn?: number;
-    /** Refresh token (if provided) */
-    refreshToken?: string;
-    /** ID token (if provided, e.g., OpenID Connect) */
-    idToken?: string;
-    /** Granted scopes (may differ from requested scopes) */
-    scope?: string;
-}
-/**
- * User information from the OAuth provider.
- */
-interface OAuthUserInfo {
-    /** Provider-specific user ID */
-    providerId: string;
-    /** Provider name (e.g., 'google', 'github') */
-    provider: string;
-    /** User's email address (may be null if not granted) */
-    email: string | null;
-    /** Whether the email is verified by the provider */
-    emailVerified: boolean;
-    /** User's display name */
-    name: string | null;
-    /** URL to the user's avatar/profile picture */
-    avatarUrl: string | null;
-    /** Raw profile data from the provider */
-    rawProfile: Record<string, unknown>;
-}
-/**
- * State stored during the OAuth flow for CSRF protection.
- */
-interface OAuthState {
-    /** Random state parameter for CSRF protection */
-    state: string;
-    /** Provider ID */
-    provider: string;
-    /** Redirect URI used for this flow */
-    redirectUri: string;
-    /** When this state was created (ms since epoch) */
-    createdAt: number;
-    /** When this state expires (ms since epoch) */
-    expiresAt: number;
-    /** Optional: user-defined data to pass through the flow */
-    metadata?: Record<string, unknown>;
+interface SqliteDatabase {
+    pragma(source: string): unknown;
+    exec(source: string): void;
+    prepare(source: string): {
+        run(...params: unknown[]): {
+            changes?: number;
+        } | unknown;
+        get(...params: unknown[]): unknown;
+        all(...params: unknown[]): unknown[];
+    };
+    transaction<T>(fn: () => T): () => T;
 }
-/**
- * Store for OAuth state parameters.
- */
-interface OAuthStateStore {
-    /** Store a state parameter for later validation. */
+declare class SqliteOAuthStateStore implements OAuthStateStore {
+    private readonly db;
+    constructor(db: SqliteDatabase);
     store(state: OAuthState): Promise<void>;
-    /** Consume a state parameter (single-use). Returns null if not found or expired. */
     consume(stateValue: string): Promise<OAuthState | null>;
-    /** Clean up expired states. */
     cleanExpired(): Promise<number>;
+    private ensureTables;
 }
-/**
- * A linked OAuth identity for a user.
- * Users can have multiple linked identities (e.g., Google + GitHub).
- */
-interface LinkedIdentity {
-    /** Unique ID of this link */
-    id: string;
-    /** Kora user ID */
-    userId: string;
-    /** OAuth provider name */
-    provider: string;
-    /** Provider-specific user ID */
-    providerUserId: string;
-    /** Provider email (at time of linking) */
-    email: string | null;
-    /** When this identity was linked */
-    linkedAt: number;
-}
-declare class OAuthError extends KoraError {
-    constructor(message: string, code: string, context?: Record<string, unknown>);
-}
-declare class OAuthStateMismatchError extends OAuthError {
-    constructor();
-}
-declare class OAuthCodeExchangeError extends OAuthError {
-    constructor(details?: string);
-}
-declare class OAuthUserInfoError extends OAuthError {
-    constructor(details?: string);
-}
-declare class OAuthProviderNotFoundError extends OAuthError {
-    constructor(provider: string);
+declare class SqliteLinkedIdentityStore implements LinkedIdentityStore {
+    private readonly db;
+    constructor(db: SqliteDatabase);
+    findByProvider(provider: string, providerUserId: string): Promise<LinkedIdentity | null>;
+    findByUser(userId: string): Promise<LinkedIdentity[]>;
+    create(params: {
+        userId: string;
+        provider: string;
+        providerUserId: string;
+        email: string | null;
+    }): Promise<LinkedIdentity>;
+    delete(userId: string, provider: string): Promise<void>;
+    private ensureTables;
 }
+declare function createSqliteOAuthStateStore(options: {
+    filename: string;
+}): Promise<SqliteOAuthStateStore>;
+declare function createSqliteLinkedIdentityStore(options: {
+    filename: string;
+}): Promise<SqliteLinkedIdentityStore>;
+declare function createSqliteOAuthStores(options: {
+    filename: string;
+}): Promise<{
+    stateStore: SqliteOAuthStateStore;
+    linkedIdentityStore: SqliteLinkedIdentityStore;
+}>;
 
-/**
- * In-memory OAuth state store for development.
- * Use Redis or a database in production for multi-server deployments.
- */
-declare class InMemoryOAuthStateStore implements OAuthStateStore {
-    private readonly states;
+interface PostgresClient {
+    begin<T>(fn: (sql: PostgresClient) => Promise<T>): Promise<T>;
+    (template: TemplateStringsArray, ...args: unknown[]): Promise<Record<string, unknown>[]>;
+}
+declare class PostgresOAuthStateStore implements OAuthStateStore {
+    private readonly sql;
+    private readonly ready;
+    constructor(sql: PostgresClient);
     store(state: OAuthState): Promise<void>;
     consume(stateValue: string): Promise<OAuthState | null>;
     cleanExpired(): Promise<number>;
+    private ensureTables;
 }
-/**
- * Configuration for the OAuth manager.
- */
-interface OAuthManagerConfig {
-    /** Registered OAuth providers */
-    providers: OAuthProviderConfig[];
-    /** State store. Defaults to InMemoryOAuthStateStore. */
-    stateStore?: OAuthStateStore;
-    /** State TTL in milliseconds. Defaults to 10 minutes. */
-    stateTtlMs?: number;
-    /**
-     * Custom fetch function. Defaults to global fetch.
-     * Useful for testing or custom HTTP clients.
-     */
-    fetch?: typeof globalThis.fetch;
-}
-/**
- * Manages the OAuth 2.0 authorization code flow.
- *
- * Supports any standard OAuth 2.0 / OpenID Connect provider.
- * Pre-built configurations available for Google, GitHub, and Microsoft.
- *
- * @example
- * ```typescript
- * const oauth = new OAuthManager({
- *   providers: [
- *     googleProvider({ clientId: '...', clientSecret: '...', redirectUri: '...' }),
- *     githubProvider({ clientId: '...', clientSecret: '...', redirectUri: '...' }),
- *   ],
- * })
- *
- * // Step 1: Generate authorization URL
- * const { url, state } = await oauth.getAuthorizationUrl('google')
- * // Redirect user to url...
- *
- * // Step 2: Handle callback
- * const { tokens, userInfo } = await oauth.handleCallback('google', code, stateParam)
- * ```
- */
-declare class OAuthManager {
-    private readonly providers;
-    private readonly stateStore;
-    private readonly stateTtlMs;
-    private readonly fetchFn;
-    constructor(config: OAuthManagerConfig);
-    /**
-     * Generate an authorization URL for the user to visit.
-     * Returns the URL and the state parameter for CSRF validation.
-     */
-    getAuthorizationUrl(providerId: string, metadata?: Record<string, unknown>): Promise<{
-        url: string;
-        state: string;
-    }>;
-    /**
-     * Handle the OAuth callback after the user authorizes.
-     * Validates the state parameter, exchanges the code for tokens,
-     * and fetches user info.
-     *
-     * @param providerId - The OAuth provider
-     * @param code - The authorization code from the callback
-     * @param state - The state parameter from the callback
-     * @returns Tokens and user info from the provider
-     */
-    handleCallback(providerId: string, code: string, state: string): Promise<{
-        tokens: OAuthTokens;
-        userInfo: OAuthUserInfo;
-        stateMetadata?: Record<string, unknown>;
-    }>;
-    /**
-     * Get a registered provider by ID.
-     */
-    getProvider(providerId: string): OAuthProviderConfig;
-    /**
-     * List all registered provider IDs.
-     */
-    getProviderIds(): string[];
-    private exchangeCodeForTokens;
-    private fetchUserInfo;
-}
-interface ProviderFactoryConfig {
-    clientId: string;
-    clientSecret: string;
-    redirectUri: string;
-    scopes?: string[];
+declare class PostgresLinkedIdentityStore implements LinkedIdentityStore {
+    private readonly sql;
+    private readonly ready;
+    constructor(sql: PostgresClient);
+    findByProvider(provider: string, providerUserId: string): Promise<LinkedIdentity | null>;
+    findByUser(userId: string): Promise<LinkedIdentity[]>;
+    create(params: {
+        userId: string;
+        provider: string;
+        providerUserId: string;
+        email: string | null;
+    }): Promise<LinkedIdentity>;
+    delete(userId: string, provider: string): Promise<void>;
+    private ensureTables;
 }
-/**
- * Create a Google OAuth provider configuration.
- */
-declare function googleProvider(config: ProviderFactoryConfig): OAuthProviderConfig;
-/**
- * Create a GitHub OAuth provider configuration.
- */
-declare function githubProvider(config: ProviderFactoryConfig): OAuthProviderConfig;
-/**
- * Create a Microsoft OAuth provider configuration.
- */
-declare function microsoftProvider(config: ProviderFactoryConfig & {
-    tenantId?: string;
-}): OAuthProviderConfig;
+declare function createPostgresOAuthStateStore(options: {
+    connectionString: string;
+}): Promise<PostgresOAuthStateStore>;
+declare function createPostgresLinkedIdentityStore(options: {
+    connectionString: string;
+}): Promise<PostgresLinkedIdentityStore>;
+declare function createPostgresOAuthStores(options: {
+    connectionString: string;
+}): Promise<{
+    stateStore: PostgresOAuthStateStore;
+    linkedIdentityStore: PostgresLinkedIdentityStore;
+}>;
 
 /**
  * A user session with metadata.
@@ -3984,4 +4175,4 @@ declare class WebhookManager {
  */
 declare function verifyWebhookSignature(payload: string, signature: string, secret: string): Promise<boolean>;
 
-export { AdminApi, type AdminApiConfig, AdminApiError, AdminUnauthorizedError, AdminUserNotFoundError, type AdminUserUpdate, type AuditAction, type AuditEntry, AuditLogError, type AuditLogQuery, type AuditLogStore, AuditLogger, type AuthDevice, type AuthProviderAdapter, AuthProviderError, type AuthRouteResponse, type AuthRoutesConfig, type AuthUser, type AuthenticationOptions, type AuthenticationVerificationResult, BUILT_IN_ROLES, BuiltInAuthRoutes, BuiltInProvider, CannotRemoveOwnerError, type ChallengeStore, CircularInheritanceError, type ClerkAdapterConfig, type CollectionScopeResolver, type CreateInvitationParams, type CreateOrgParams, type CreateSessionParams, DuplicateEmailError, type EmailVerificationConfig, EmailVerificationError, EmailVerificationManager, type EmailVerificationStore, type EmailVerificationToken, ExternalAuthOperationNotSupportedError, ExternalJwtProvider, type ExternalJwtProviderConfig, ExternalTokenValidationError, type ExternalUserInfo, INVITATION_STATUSES, InMemoryAuditLogStore, InMemoryChallengeStore, InMemoryEmailVerificationStore, InMemoryOAuthStateStore, InMemoryOrgStore, InMemoryPasswordResetStore, InMemoryRateLimiter, InMemorySessionStore, InMemoryTokenRevocationStore, InMemoryTotpStore, InMemoryUserStore, InMemoryWebhookStore, InsufficientRoleError, InvalidPermissionError, InvitationExpiredError, InvitationNotFoundError, type InvitationStatus, type LinkedIdentity, MemberAlreadyExistsError, type Membership, MembershipNotFoundError, OAuthCodeExchangeError, OAuthError, OAuthManager, type OAuthManagerConfig, type OAuthProviderConfig, OAuthProviderNotFoundError, type OAuthState, OAuthStateMismatchError, type OAuthStateStore, type OAuthTokens, type OAuthUserInfo, OAuthUserInfoError, ORG_ROLES, OrgError, type OrgInvitation, OrgNotFoundError, type OrgRole, type OrgRouteResponse, OrgRoutes, type OrgRoutesConfig, OrgScopeResolver, OrgSlugTakenError, type OrgStore, type Organization, type PaginatedResult, PasskeyVerificationError, type PasswordResetConfig, PasswordResetError, PasswordResetManager, type PasswordResetStore, type PasswordResetToken, type Permission, PostgresUserStore, ROLE_HIERARCHY, type RateLimiter, type RbacConfig, RbacEngine, RbacError, type RegistrationOptions, type RegistrationVerificationResult, ResetRateLimitedError, ResetTokenExpiredError, ResetTokenNotFoundError, type RoleDefinition, RoleNotFoundError, type ScopeContext, type ScopeFilter, type Session, SessionError, SessionExpiredError, SessionLimitExceededError, SessionManager, type SessionManagerConfig, SessionMfaRequiredError, SessionNotFoundError, type SessionStore, type SignInParams, type SignUpParams, SqliteUserStore, type StoredUser, type SupabaseAdapterConfig, type SyncScopes, TokenManager, type TokenManagerConfig, type TokenRevocationStore, TotpAlreadyEnabledError, type TotpConfig, TotpError, TotpInvalidCodeError, TotpManager, TotpNotEnabledError, TotpNotVerifiedError, TotpRecoveryExhaustedError, type TotpSecret, type TotpSetupResult, type TotpStore, type UpdateOrgParams, type UserListQuery, type UserStore, VerificationTokenExpiredError, VerificationTokenNotFoundError, type WebhookDelivery, type WebhookEndpoint, WebhookEndpointNotFoundError, WebhookError, type WebhookEvent, WebhookManager, type WebhookPayload, type WebhookStore, base32Decode, base32Encode, createClerkAdapter, createPostgresUserStore, createSqliteUserStore, createSupabaseAdapter, decodeJwt, defineRoles, encodeJwt, generateAuthenticationOptions, generateRegistrationOptions, githubProvider, googleProvider, hasRoleLevel, hashPassword, isExpired, microsoftProvider, parsePermission, permissionCovers, verifyAuthenticationResponse, verifyJwt, verifyPassword, verifyRegistrationResponse, verifyWebhookSignature };
+export { AdminApi, type AdminApiConfig, AdminApiError, AdminUnauthorizedError, AdminUserNotFoundError, type AdminUserUpdate, type AuditAction, type AuditEntry, AuditLogError, type AuditLogQuery, type AuditLogStore, AuditLogger, type AuthDevice, type AuthProviderAdapter, AuthProviderError, type AuthRouteResponse, type AuthRoutesConfig, type AuthUser, type AuthenticationOptions, type AuthenticationVerificationResult, BUILT_IN_ROLES, BuiltInAuthRoutes, BuiltInProvider, CannotRemoveOwnerError, type ChallengeStore, CircularInheritanceError, type ClerkAdapterConfig, type CollectionScopeResolver, type CreateInvitationParams, type CreateKoraAuthServerOptions, type CreateOrgParams, type CreateSessionParams, DuplicateEmailError, DuplicateLinkedIdentityError, type EmailVerificationConfig, EmailVerificationError, EmailVerificationManager, type EmailVerificationStore, type EmailVerificationToken, ExternalAuthOperationNotSupportedError, ExternalJwtProvider, type ExternalJwtProviderConfig, ExternalTokenValidationError, type ExternalUserInfo, INVITATION_STATUSES, InMemoryAuditLogStore, InMemoryChallengeStore, InMemoryEmailVerificationStore, InMemoryLinkedIdentityStore, InMemoryOAuthStateStore, InMemoryOrgStore, InMemoryPasswordResetStore, InMemoryRateLimiter, InMemorySessionStore, InMemoryTokenRevocationStore, InMemoryTotpStore, InMemoryUserStore, InMemoryWebhookStore, InsufficientRoleError, InvalidPermissionError, InvitationExpiredError, InvitationNotFoundError, type InvitationStatus, type KoraAuthHttpRequest, type KoraAuthServer, type LinkedIdentity, type LinkedIdentityStore, MemberAlreadyExistsError, type Membership, MembershipNotFoundError, OAuthCodeExchangeError, OAuthError, OAuthManager, type OAuthManagerConfig, type OAuthProviderConfig, OAuthProviderNotFoundError, type OAuthServerConfig, type OAuthState, OAuthStateMismatchError, type OAuthStateStore, type OAuthTokens, type OAuthUserInfo, OAuthUserInfoError, ORG_ROLES, OrgError, type OrgInvitation, OrgNotFoundError, type OrgRole, type OrgRouteResponse, OrgRoutes, type OrgRoutesConfig, OrgScopeResolver, OrgSlugTakenError, type OrgStore, type Organization, type PaginatedResult, PasskeyVerificationError, type PasswordResetConfig, PasswordResetError, PasswordResetManager, type PasswordResetStore, type PasswordResetToken, type Permission, PostgresLinkedIdentityStore, PostgresOAuthStateStore, PostgresUserStore, ROLE_HIERARCHY, type RateLimiter, type RbacConfig, RbacEngine, RbacError, type RegistrationOptions, type RegistrationVerificationResult, ResetRateLimitedError, ResetTokenExpiredError, ResetTokenNotFoundError, type RoleDefinition, RoleNotFoundError, type ScopeContext, type ScopeFilter, type Session, SessionError, SessionExpiredError, SessionLimitExceededError, SessionManager, type SessionManagerConfig, SessionMfaRequiredError, SessionNotFoundError, type SessionStore, type SignInParams, type SignUpParams, SqliteLinkedIdentityStore, SqliteOAuthStateStore, SqliteUserStore, type StoredUser, type SupabaseAdapterConfig, type SyncScopes, TokenManager, type TokenManagerConfig, type TokenRevocationStore, TotpAlreadyEnabledError, type TotpConfig, TotpError, TotpInvalidCodeError, TotpManager, TotpNotEnabledError, TotpNotVerifiedError, TotpRecoveryExhaustedError, type TotpSecret, type TotpSetupResult, type TotpStore, type UpdateOrgParams, type UserListQuery, type UserStore, VerificationTokenExpiredError, VerificationTokenNotFoundError, type WebhookDelivery, type WebhookEndpoint, WebhookEndpointNotFoundError, WebhookError, type WebhookEvent, WebhookManager, type WebhookPayload, type WebhookStore, base32Decode, base32Encode, createClerkAdapter, createKoraAuthServer, createPostgresLinkedIdentityStore, createPostgresOAuthStateStore, createPostgresOAuthStores, createPostgresUserStore, createSqliteLinkedIdentityStore, createSqliteOAuthStateStore, createSqliteOAuthStores, createSqliteUserStore, createSupabaseAdapter, decodeJwt, defineRoles, encodeJwt, generateAuthenticationOptions, generateRegistrationOptions, githubProvider, googleProvider, hasRoleLevel, hashPassword, isExpired, microsoftProvider, parsePermission, permissionCovers, verifyAuthenticationResponse, verifyJwt, verifyPassword, verifyRegistrationResponse, verifyWebhookSignature };