@korajs/auth 1.0.0-beta.12 → 1.0.0-beta.14

package/README.md

@@ -6,25 +6,29 @@ Offline-first authentication for Kora.js applications.
 
 `@korajs/auth` provides a complete authentication system designed for offline-first applications. It includes:
 
-- **Client-side auth management** -- token storage, session restoration, sign-up/sign-in/sign-out
-- **React hooks** -- `useAuth()`, `useCurrentUser()`, `useAuthStatus()`, `useOrg()`, `usePermission()`
-- **Server-side auth routes** -- email/password authentication with JWT tokens
-- **Device identity** -- ECDSA P-256 key pairs for proof-of-possession
-- **Token management** -- access/refresh token lifecycle with rotation and revocation detection
-- **Session management** -- server-side sessions with idle timeout, max limits, and MFA awareness
-- **Multi-factor authentication** -- TOTP (authenticator apps) with recovery codes
-- **Organizations and RBAC** -- multi-tenant orgs with role hierarchy and permission checks
-- **Passkeys (WebAuthn)** -- passwordless authentication with platform authenticators
-- **Encrypted token storage** -- AES-256-GCM encryption for sensitive environments
-- **End-to-end encryption** -- encrypt operation data before sync with `OperationEncryptor`
-- **Sync auth binding** -- `createKoraAuthSync()` wires tokens, JWT scopes, and device node ids to `createApp`
+- **Client-side auth management**: token storage, session restoration, sign-up/sign-in/sign-out
+- **React hooks**: `useAuth()`, `useCurrentUser()`, `useAuthStatus()`, `useOrg()`, `usePermission()`
+- **Server-side auth routes**: email/password authentication with JWT tokens
+- **Device identity**: ECDSA P-256 key pairs for proof-of-possession
+- **Token management**: access/refresh token lifecycle with rotation and revocation detection
+- **Session management**: server-side sessions with idle timeout, max limits, and MFA awareness
+- **Multi-factor authentication**: TOTP (authenticator apps) with recovery codes
+- **Organizations and RBAC**: multi-tenant orgs with role hierarchy and permission checks
+- **Passkeys (WebAuthn)**: passwordless authentication with platform authenticators
+- **Encrypted token storage**: AES-256-GCM encryption for sensitive environments
+- **Local encryption helpers**: AES-256-GCM keys, PBKDF2 key derivation and auto-lock (end-to-end encryption of synced data is `sync.encryption` in `korajs`)
+- **Sync auth binding**: `createKoraAuthSync()` binds sync to the signed-in user: per-user writes, token refresh, suspension while signed out, and scope hints
 
 The client APIs work in browser, Tauri desktop WebView, and mobile JavaScript environments. For desktop apps, run auth routes on your remote sync/auth server and point `AuthClient.serverUrl` at that server. Email/password auth, token refresh, sync authorization, MFA, organizations, and RBAC work across web and desktop clients. Passkeys should be feature-detected because WebAuthn support depends on the operating system WebView.
 
 For production desktop and mobile apps, pass a custom token storage adapter backed by the platform credential store and attach a stable device identity:
 
+<!-- docs-check: standalone -->
 ```typescript
-import { createKoraAuth } from '@korajs/auth'
+import { createKoraAuth, type AuthKeyValueStorage, type DeviceKeyStore } from '@korajs/auth'
+
+declare const secureStore: AuthKeyValueStorage // Keychain, Keystore, a Tauri secure-storage plugin
+declare const deviceKeyStore: DeviceKeyStore
 
 const authClient = createKoraAuth({
   serverUrl: 'https://acme.example.com',
@@ -38,20 +42,21 @@ const authClient = createKoraAuth({
 ## Installation
 
 ```bash
-pnpm add @korajs/auth
+pnpm add @korajs/auth@beta
 ```
 
 ## Quick Start
 
 ### Client-side (React)
 
+<!-- docs-check: file auth-client.tsx -->
 ```tsx
 import { createKoraAuth } from '@korajs/auth'
 import { AuthProvider, useAuth } from '@korajs/auth/react'
 
-const authClient = createKoraAuth({ serverUrl: 'http://localhost:3001' })
+export const authClient = createKoraAuth({ serverUrl: 'http://localhost:3001' })
 
-function App() {
+export function App() {
   return (
     <AuthProvider client={authClient}>
       <MyApp />
@@ -90,37 +95,47 @@ function MyApp() {
 
 ```tsx
 import { createKoraAuthSync } from '@korajs/auth'
-import { createApp } from 'korajs'
+import { createApp, defineSchema, t } from 'korajs'
+import { authClient } from './auth-client'
+
+const schema = defineSchema({ version: 1, collections: { todos: { fields: { title: t.string() } } } })
 
 const app = createApp({
   schema,
   sync: {
     url: 'ws://localhost:3001/kora-sync',
     authClient: createKoraAuthSync({ authClient, schema }),
+    autoConnect: true,
   },
 })
 ```
 
+Sync waits while nobody is signed in (`anonymous: 'allow'` syncs anonymously instead), and every
+local write belongs to the user who made it.
+
 ### Server-side
 
+<!-- docs-check: standalone -->
 ```typescript
 import {
   createKoraAuthServer,
   createSqliteOAuthStores,
+  createSqliteUserStore,
   googleProvider,
 } from '@korajs/auth/server'
+import { createProductionServer, createSqliteServerStore } from '@korajs/server'
 
-const oauthStores = await createSqliteOAuthStores({
-  filename: './auth.db',
-})
+const userStore = await createSqliteUserStore({ filename: './auth.db' })
+const oauthStores = await createSqliteOAuthStores({ filename: './auth.db' })
 
 const auth = createKoraAuthServer({
-  jwtSecret: process.env.KORA_AUTH_SECRET!,
+  jwtSecret: process.env.KORA_AUTH_SECRET, // required in production
+  userStore, // production refuses in-memory stores
   oauth: {
     providers: [
       googleProvider({
-        clientId: process.env.GOOGLE_CLIENT_ID!,
-        clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+        clientId: process.env.GOOGLE_CLIENT_ID ?? '',
+        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
         redirectUri: 'https://app.example.com/auth/oauth/google/callback',
       }),
     ],
@@ -129,24 +144,12 @@ const auth = createKoraAuthServer({
   },
 })
 
-// Wire into your HTTP server:
-app.all('/auth/*', async (req, res) => {
-  const result = await auth.handleRequest({
-    method: req.method,
-    path: req.path,
-    body: req.body,
-    headers: req.headers,
-    query: req.query,
-    ip: req.ip,
-  })
-  res.status(result.status).json(result.body)
-})
-
-// Bridge to Kora sync server:
-const syncServer = new KoraSyncServer({
-  store,
-  auth: auth.auth,
+const server = createProductionServer({
+  store: createSqliteServerStore({ filename: './kora-server.db' }),
+  httpRoutes: [{ path: '/auth', handle: auth.handleRequest }],
+  syncOptions: { auth: auth.auth }, // verified identity and server-granted scopes
 })
+await server.start()
 ```
 
 ## Exports
@@ -169,8 +172,8 @@ const syncServer = new KoraSyncServer({
 | `createPasskeyCredential` | Register a new passkey |
 | `authenticateWithPasskey` | Sign in with a passkey |
 | `encryptData` / `decryptData` | AES-256-GCM data encryption |
-| `OperationEncryptor` | E2E encryption for sync operations |
-| `AutoLockManager` | Auto-lock encryption keys after idle timeout |
+| `deriveEncryptionKey` / `generateEncryptionKey` | Local AES-256-GCM keys |
+| `AutoLockManager` | Lock after an idle timeout |
 
 ### `@korajs/auth/react`
 
@@ -191,8 +194,8 @@ const syncServer = new KoraSyncServer({
 | `createKoraAuthServer` | Quickstart server factory with auth routes and sync provider |
 | `BuiltInAuthRoutes` | HTTP route handlers for all auth operations |
 | `TokenManager` | JWT issuing, validation, refresh rotation, revocation |
+| `createSqliteUserStore` / `createPostgresUserStore` | Durable users and token revocations |
 | `InMemoryUserStore` | Dev/test user store |
-| `InMemoryTokenRevocationStore` | Dev/test token revocation store |
 | `OAuthManager` / provider helpers | OAuth authorization code flow and provider configs |
 | `InMemoryLinkedIdentityStore` | Dev/test OAuth account-linking store |
 | `createSqliteOAuthStores` / `createPostgresOAuthStores` | Durable OAuth state and linked identity stores |
@@ -210,13 +213,15 @@ const syncServer = new KoraSyncServer({
 
 - Passwords hashed with PBKDF2-SHA512 (600,000 iterations, 32-byte salt)
 - JWT tokens signed with HMAC-SHA256 with constant-time comparison
-- Refresh token rotation with replay detection and device-level revocation
+- Atomic refresh token rotation with reuse detection per token family
 - Device keys use ECDSA P-256 with non-extractable private keys (Web Crypto)
 - TOTP uses SHA-1 HMAC per RFC 6238 with 30-second time steps
-- Access tokens expire in 15 minutes (configurable), refresh tokens in 7 days
+- Access tokens expire in 15 minutes and refresh tokens in 90 days (configurable)
+- Revocation (sign-out, device, password change, admin) applies to every route and ends live sync sessions
+- Sign-in is rate limited per account and per IP; MFA at sign-in with TOTP (replay protection and lockout)
 - Session idle timeout with sliding window and configurable max concurrent sessions
 - Passkeys use WebAuthn L2 with platform authenticator support
-- Encrypted token store uses AES-256-GCM with PBKDF2-derived keys
+- The encrypted token store uses AES-256-GCM with a key you provide (generated or PBKDF2-derived)
 
 ## Architecture
 
@@ -241,7 +246,7 @@ Client                                 Server
 
 ## Documentation
 
-See the [Authentication Guide](https://ehoneahobed.github.io/kora/guide/authentication) and [Auth API Reference](https://ehoneahobed.github.io/kora/api/auth) for complete documentation.
+See the [Authentication Guide](https://korajs.dev/guide/authentication) and the [Auth API Reference](https://korajs.dev/api/auth).
 
 ## License
 

package/dist/{create-org-session-RsDj9cl4.d.cts → create-org-session-ChFdulEM.d.cts}

@@ -218,13 +218,46 @@ declare function createPersistentDeviceIdentity(options: PersistentDeviceIdentit
 declare class AuthError extends KoraError {
     constructor(message: string, code: string, context?: Record<string, unknown>);
 }
+/**
+ * Thrown by sign-in when the account requires a second factor (AUTH-10).
+ * Complete it with {@link AuthClient.verifyMfa} using {@link mfaToken}.
+ */
+declare class MfaRequiredError extends AuthError {
+    readonly mfaToken: string;
+    constructor(mfaToken: string);
+}
 /**
  * Possible authentication states for the client.
  * - 'loading': Initial state while restoring tokens from storage
- * - 'authenticated': User is signed in with a valid session
- * - 'unauthenticated': No valid session exists
+ * - 'authenticated': A session exists. It may be fresh or offline; see
+ *   {@link AuthClient.session} for the freshness of its credentials.
+ * - 'unauthenticated': No session exists (never signed in, signed out, or the
+ *   auth server definitively rejected the session)
  */
 type AuthState = 'loading' | 'authenticated' | 'unauthenticated';
+/**
+ * Freshness of an authenticated session.
+ * - 'fresh': the last refresh or profile request reached the auth server
+ * - 'offline': authenticated-offline. The identity is known from stored
+ *   credentials, but no fresh access token can be minted right now (network,
+ *   timeout, 5xx, captive portal...). Local data stays available; sync waits.
+ * - 'locked': offline for longer than `maxOfflineGraceMs`, or the device clock
+ *   moved backwards. The UI should lock; local data is never wiped.
+ */
+type AuthSessionStatus = 'fresh' | 'offline' | 'locked';
+/**
+ * The identity of the stored session, independent of token freshness.
+ */
+interface AuthClientSession {
+    /** User id (`sub` of the stored credentials). */
+    userId: string;
+    /** Device id (`dev` of the stored credentials), when known. */
+    deviceId: string | null;
+    /** Freshness of the credentials. */
+    status: AuthSessionStatus;
+    /** Last successful contact with the auth server (ms since epoch). */
+    lastServerContactAt: number;
+}
 /**
  * Authenticated user information.
  */
@@ -247,6 +280,12 @@ interface LinkedOAuthAccount {
 interface OAuthAuthorizationResult {
     url: string;
     state: string;
+    /**
+     * Client binding for this flow (AUTH-3). The client keeps it (session storage
+     * on the web, memory on native) and presents it with the callback; a callback
+     * carrying someone else's code and state is then refused.
+     */
+    binding?: string;
 }
 interface OAuthAuthorizationOptions {
     /**
@@ -268,6 +307,8 @@ interface OAuthAuthorizationOptions {
 interface OAuthCallbackParams {
     code: string;
     state: string;
+    /** Flow binding; looked up from the started flow when omitted. */
+    binding?: string;
     deviceId?: string;
     devicePublicKey?: string;
 }
@@ -299,6 +340,28 @@ interface AuthClientConfig {
      * `deviceId` and `devicePublicKey` fields unless the caller provides them.
      */
     deviceIdentity?: AuthDeviceIdentityProvider;
+    /**
+     * Timeout for every auth request, in milliseconds. A request that has not
+     * answered by then is aborted and treated as a transient failure.
+     * @default 20000
+     */
+    requestTimeoutMs?: number;
+    /**
+     * How long a session may stay authenticated-offline (no successful contact
+     * with the auth server) before it is `locked`. Locking never wipes local data
+     * or tokens; it only tells the UI to ask the user to reconnect.
+     * Defaults to no limit beyond the refresh token's own expiry.
+     */
+    maxOfflineGraceMs?: number;
+    /**
+     * Backoff between refresh attempts after transient failures. The first retry
+     * after a failure is immediate (it recovers a response lost on the wire);
+     * later ones back off exponentially with jitter, honouring `Retry-After`.
+     */
+    refreshBackoff?: {
+        baseDelayMs?: number;
+        maxDelayMs?: number;
+    };
 }
 type MaybePromise<T> = T | Promise<T>;
 interface AuthTokenStorage {
@@ -314,6 +377,15 @@ interface AuthTokenStorage {
  * token refresh, and auth state change notifications. Framework-agnostic --
  * works in any JavaScript environment with `fetch` and optionally `localStorage`.
  *
+ * Offline-first session rules (AUTH-13):
+ * - Only the auth server ends a session: tokens are cleared only on a 401 (or a
+ *   400 `invalid_grant`) carrying a Kora JSON error, on an explicit sign-out, or
+ *   when the refresh token itself has expired.
+ * - Every other failure (no network, timeout, abort, 5xx, 429, 511, HTML from a
+ *   captive portal) keeps the tokens, keeps the user signed in as
+ *   authenticated-offline and retries with jittered backoff.
+ * - One tab refreshes at a time (Web Locks); the others adopt its result.
+ *
  * @example
  * ```typescript
  * const auth = new AuthClient({ serverUrl: 'http://localhost:3001' })
@@ -334,10 +406,22 @@ declare class AuthClient {
     private readonly fetchFn;
     private readonly deviceIdentity;
     private readonly listeners;
+    private readonly sessionListeners;
+    private readonly requestTimeoutMs;
+    private readonly maxOfflineGraceMs;
+    private readonly backoffBaseMs;
+    private readonly backoffMaxMs;
+    private readonly lockName;
     private _state;
     private _user;
     private _refreshPromise;
     private _initialized;
+    private sessionStatus;
+    private lastServerContactAt;
+    private failureCount;
+    private nextAttemptAt;
+    private retryTimer;
+    private readonly detachEnvironment;
     /**
      * Creates a new AuthClient.
      *
@@ -348,13 +432,37 @@ declare class AuthClient {
     get state(): AuthState;
     /** Current authenticated user, or null if not signed in. */
     get currentUser(): AuthUser | null;
-    /** Whether the user is currently authenticated. */
+    /** Whether the user is currently authenticated (fresh or offline). */
     get isAuthenticated(): boolean;
+    /**
+     * The stored session identity and its freshness, or null when signed out.
+     * Unlike {@link getAccessToken}, this is available offline: the identity is
+     * decoupled from whether a fresh access token can be minted right now.
+     */
+    get session(): AuthClientSession | null;
+    private cachedDeviceId;
+    /**
+     * Read the stored session identity (user id and device id) from storage,
+     * without any network request. Returns null when no usable session is stored.
+     */
+    getStoredIdentity(): Promise<{
+        userId: string;
+        deviceId: string | null;
+    } | null>;
+    /**
+     * Decoded (unverified) claims of the stored credentials, preferring the access
+     * token even when it has expired. For client-side hints only (local database
+     * name, sync node id, handshake scope narrowing); the server re-derives
+     * everything it authorizes from a verified token.
+     */
+    getStoredClaims(): Promise<Record<string, unknown> | null>;
     /**
      * Initialize the auth client by restoring a session from stored tokens.
      *
      * Loads tokens from storage, validates the access token, and attempts a
      * refresh if the access token is expired but a refresh token is available.
+     * When the auth server cannot be reached, the stored session is restored as
+     * authenticated-offline instead of being discarded.
      * Safe to call multiple times -- subsequent calls are no-ops once initialized.
      */
     initialize(): Promise<void>;
@@ -385,6 +493,19 @@ declare class AuthClient {
         deviceId?: string;
         devicePublicKey?: string;
     }): Promise<AuthUser>;
+    /**
+     * Finish a sign-in that required a second factor.
+     *
+     * @param mfaToken - From the {@link MfaRequiredError} thrown by sign-in
+     * @param proof - A current TOTP code, or a recovery code
+     * @returns The authenticated AuthUser
+     * @throws {AuthError} If the code or the MFA session is invalid
+     */
+    verifyMfa(mfaToken: string, proof: {
+        code: string;
+    } | {
+        recoveryCode: string;
+    }): Promise<AuthUser>;
     /**
      * Create an OAuth authorization URL and optionally redirect the current window.
      *
@@ -400,7 +521,7 @@ declare class AuthClient {
     /**
      * Create an OAuth authorization URL for linking another provider to the current user.
      */
-    getOAuthAuthorizationUrl(provider: string, options?: OAuthAuthorizationOptions): Promise<OAuthAuthorizationResult>;
+    getOAuthAuthorizationUrl(provider: string, _options?: OAuthAuthorizationOptions): Promise<OAuthAuthorizationResult>;
     /**
      * Link an OAuth provider to the current authenticated user.
      */
@@ -424,10 +545,26 @@ declare class AuthClient {
     /**
      * Get a valid access token, automatically refreshing if expired.
      *
-     * @returns A valid access token string, or null if the user is not
-     *          authenticated and refresh is not possible
+     * Returns null when no fresh token can be obtained right now. That does NOT
+     * mean the user is signed out: check {@link state} / {@link session}. A
+     * transient failure keeps the session (authenticated-offline) and later calls
+     * retry with backoff.
+     *
+     * @returns A valid access token string, or null if none is available now
      */
     getAccessToken(): Promise<string | null>;
+    /**
+     * Refresh the session now, even when the cached access token has not expired
+     * locally. Used after the sync server ended a session with `AUTH_EXPIRED` or
+     * `AUTH_REVOKED`: the server's clock or a revocation says the cached token is
+     * no longer good. Concurrent calls (and other tabs) share one refresh.
+     *
+     * A transient failure keeps the session (authenticated-offline) and returns
+     * null; only a definitive server rejection signs the user out.
+     *
+     * @returns The refreshed access token, or null if none could be obtained now
+     */
+    refreshAccessToken(): Promise<string | null>;
     /**
      * Get a valid token for the sync engine handshake.
      * Alias for {@link getAccessToken}.
@@ -435,6 +572,15 @@ declare class AuthClient {
      * @returns A valid access token string, or null if unavailable
      */
     getSyncToken(): Promise<string | null>;
+    /**
+     * Retry immediately: clears the refresh backoff and attempts a refresh if the
+     * session is offline. Call it when connectivity is known to be back (for
+     * example when a sync transport opens). Also wired to the browser `online`
+     * and `visibilitychange` events automatically.
+     */
+    retryNow(): Promise<void>;
+    /** Remove environment listeners and timers (for tests and teardown). */
+    destroy(): void;
     /**
      * Subscribe to authentication state changes.
      *
@@ -453,39 +599,86 @@ declare class AuthClient {
      * ```
      */
     onAuthChange(callback: (state: AuthState) => void): () => void;
+    /**
+     * Subscribe to session freshness changes (fresh, authenticated-offline,
+     * locked). Fires in addition to {@link onAuthChange}, including when the
+     * state stays 'authenticated' but connectivity to the auth server changes.
+     *
+     * @param callback - Called with the current session (null when signed out)
+     * @returns An unsubscribe function
+     */
+    onSessionChange(callback: (session: AuthClientSession | null) => void): () => void;
     /**
      * Update internal state and notify all listeners.
      */
     private setState;
+    private setSessionStatus;
+    private notifySession;
+    private completeSignIn;
     /**
      * Restore a session from a valid access token by fetching the user profile.
-     * Falls back to extracting the user ID from the token payload if the
-     * /auth/me request fails (offline scenario).
+     * A definitive 401 from `/auth/me` ends the session (NEW-AUTH-4); any other
+     * failure restores it as authenticated-offline from the stored identity.
      */
     private restoreSession;
+    /**
+     * Restore the session from stored credentials while the auth server is
+     * unreachable. Signs out only when the stored refresh token is unusable.
+     */
+    private enterOfflineSession;
+    /** Offline, or locked when the grace period ran out or the clock went backwards. */
+    private offlineStatus;
+    private endSession;
+    /** The refresh token's issue time is the server's clock at the last rotation. */
+    private noteIssuedCredential;
+    private markFresh;
+    private markOffline;
     /**
      * Fetch the current user profile from the server.
      */
     private fetchUserProfile;
     private createOAuthAuthorization;
+    /** Bindings of flows this client started, by state (survives the redirect on web). */
+    private readonly oauthBindings;
+    private rememberOAuthBinding;
+    private takeOAuthBinding;
     private withDeviceIdentity;
     /**
-     * Refresh the access token using a refresh token.
-     * De-duplicates concurrent refresh calls so only one network request is made.
+     * Refresh the session's tokens. De-duplicates concurrent calls in this
+     * client, serializes refreshes across tabs, and applies backoff after
+     * transient failures.
      */
-    private refreshAccessToken;
-    private requireAccessToken;
+    private refresh;
+    private refreshOnce;
     /**
-     * Execute the token refresh network request.
+     * Execute the token refresh network request and classify the answer.
      */
     private performRefresh;
+    private withRefreshLock;
+    /**
+     * Schedule the next allowed refresh attempt. The first retry after a failure
+     * is immediate (it recovers a rotation response lost on the wire); after
+     * that, exponential backoff with equal jitter, never earlier than Retry-After.
+     */
+    private registerFailure;
+    private resetBackoff;
+    /** Background retry so an offline session recovers without the app calling in. */
+    private scheduleRetry;
+    private clearRetryTimer;
+    private attachEnvironmentListeners;
+    private requireAccessToken;
+    /**
+     * Send one request with a timeout and return status plus parsed JSON (if any).
+     * Throws only for transport failures (network, abort, timeout).
+     */
+    private rawRequest;
     /**
      * Make an HTTP request to the auth server.
      *
      * @param path - URL path relative to serverUrl (e.g. '/auth/signin')
      * @param options - Request options
      * @returns Parsed JSON response body
-     * @throws {AuthError} On network failure or non-2xx response
+     * @throws {AuthError} On network failure, timeout, or non-2xx response
      */
     private request;
 }
@@ -689,9 +882,10 @@ declare class OrgClient {
      */
     revokeInvitation(orgId: string, invitationId: string): Promise<void>;
     /**
-     * List pending invitations for the current user's email.
+     * List pending invitations addressed to the signed-in user's verified email.
+     * The server resolves the email from the session; tokens are never returned.
      */
-    listMyInvitations(email: string): Promise<ClientInvitation[]>;
+    listMyInvitations(): Promise<Array<Omit<ClientInvitation, 'token'>>>;
     /**
      * Subscribe to active org changes.
      * @returns Unsubscribe function
@@ -719,4 +913,4 @@ declare function checkOrgPermission(currentRole: string | null, requiredRole: st
  */
 declare function createOrgSession(client: OrgClient): OrgSession;
 
-export { type AuthClientConfig as A, createDeviceKeyStore as B, type ClientInvitation as C, type DeviceKeyStore as D, createMemoryAuthTokenStorage as E, createOrgSession as F, createPersistentDeviceIdentity as G, createWebStorageAuthTokenStorage as H, InMemoryDeviceKeyStore as I, type LinkedOAuthAccount as L, type OAuthAuthorizationOptions as O, type PersistentDeviceIdentityOptions as P, type AuthTokenStorage as a, type AuthKeyValueStorage as b, type AuthDeviceIdentityProvider as c, AuthClient as d, type AuthState as e, type AuthDeviceIdentity as f, AuthDeviceIdentityError as g, AuthError as h, type AuthSession as i, type AuthSessionSnapshot as j, type AuthTokenStorageOptions as k, type AuthUser as l, type ClientMembership as m, type ClientOrganization as n, DeviceKeyStoreError as o, IndexedDBDeviceKeyStore as p, type OAuthAuthorizationResult as q, type OAuthCallbackParams as r, OrgClient as s, type OrgClientConfig as t, OrgClientError as u, type OrgSession as v, type OrgSnapshot as w, checkOrgPermission as x, createAuthSession as y, createAuthTokenStorage as z };
+export { type AuthClientConfig as A, createAuthSession as B, type ClientInvitation as C, type DeviceKeyStore as D, createAuthTokenStorage as E, createDeviceKeyStore as F, createMemoryAuthTokenStorage as G, createOrgSession as H, InMemoryDeviceKeyStore as I, createPersistentDeviceIdentity as J, createWebStorageAuthTokenStorage as K, type LinkedOAuthAccount as L, MfaRequiredError as M, type OAuthAuthorizationOptions as O, type PersistentDeviceIdentityOptions as P, type AuthTokenStorage as a, type AuthKeyValueStorage as b, type AuthDeviceIdentityProvider as c, AuthClient as d, type AuthState as e, type AuthClientSession as f, type AuthDeviceIdentity as g, AuthDeviceIdentityError as h, AuthError as i, type AuthSession as j, type AuthSessionSnapshot as k, type AuthSessionStatus as l, type AuthTokenStorageOptions as m, type AuthUser as n, type ClientMembership as o, type ClientOrganization as p, DeviceKeyStoreError as q, IndexedDBDeviceKeyStore as r, type OAuthAuthorizationResult as s, type OAuthCallbackParams as t, OrgClient as u, type OrgClientConfig as v, OrgClientError as w, type OrgSession as x, type OrgSnapshot as y, checkOrgPermission as z };