@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/SpanProcessor.d.ts

@@ -0,0 +1,43 @@
+import { ReadableSpan } from "./export/ReadableSpan.js";
+import { Span as Span$1 } from "./Span.js";
+import { Context } from "@opentelemetry/api";
+
+//#region ../../node_modules/.pnpm/@opentelemetry+sdk-trace-base@2.6.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/SpanProcessor.d.ts
+/**
+ * SpanProcessor is the interface Tracer SDK uses to allow synchronous hooks
+ * for when a {@link Span} is started or when a {@link Span} is ended.
+ */
+interface SpanProcessor {
+  /**
+   * Forces to export all finished spans
+   */
+  forceFlush(): Promise<void>;
+  /**
+   * Called when a {@link Span} is started, if the `span.isRecording()`
+   * returns true.
+   * @param span the Span that just started.
+   */
+  onStart(span: Span$1, parentContext: Context): void;
+  /**
+   * Called when a {@link Span} is ending, if the `span.isRecording()`
+   * returns true.
+   * @param span the Span that is ending.
+   *
+   * @experimental This method is experimental and may break in minor versions of this package
+   */
+  onEnding?(span: Span$1): void;
+  /**
+   * Called when a {@link ReadableSpan} is ended, if the `span.isRecording()`
+   * returns true.
+   * @param span the Span that just ended.
+   */
+  onEnd(span: ReadableSpan): void;
+  /**
+   * Shuts down the processor. Called when SDK is shut down. This is an
+   * opportunity for processor to do any cleanup required.
+   */
+  shutdown(): Promise<void>;
+}
+//#endregion
+export { SpanProcessor };
+//# sourceMappingURL=SpanProcessor.d.ts.map

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/TimedEvent.d.ts

@@ -0,0 +1,19 @@
+import { Attributes, HrTime } from "@opentelemetry/api";
+
+//#region ../../node_modules/.pnpm/@opentelemetry+sdk-trace-base@2.6.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/TimedEvent.d.ts
+/**
+ * Represents a timed event.
+ * A timed event is an event with a timestamp.
+ */
+interface TimedEvent {
+  time: HrTime;
+  /** The name of the event. */
+  name: string;
+  /** The attributes of the event. */
+  attributes?: Attributes;
+  /** Count of attributes of the event that were dropped due to collection limits */
+  droppedAttributesCount?: number;
+}
+//#endregion
+export { TimedEvent };
+//# sourceMappingURL=TimedEvent.d.ts.map

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/BatchSpanProcessorBase.d.ts

@@ -0,0 +1,6 @@
+import "./ReadableSpan.js";
+import "../Span.js";
+import "../SpanProcessor.js";
+import "../types.js";
+import "./SpanExporter.js";
+import { Context } from "@opentelemetry/api";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/ConsoleSpanExporter.d.ts

@@ -0,0 +1,3 @@
+import "../../../../../../../@opentelemetry_core@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/core/build/src/index.js";
+import "./ReadableSpan.js";
+import "./SpanExporter.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/InMemorySpanExporter.d.ts

@@ -0,0 +1,3 @@
+import "../../../../../../../@opentelemetry_core@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/core/build/src/index.js";
+import "./ReadableSpan.js";
+import "./SpanExporter.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/NoopSpanProcessor.d.ts

@@ -0,0 +1,4 @@
+import "./ReadableSpan.js";
+import "../Span.js";
+import "../SpanProcessor.js";
+import { Context } from "@opentelemetry/api";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/ReadableSpan.d.ts

@@ -0,0 +1,29 @@
+import { InstrumentationScope } from "../../../../../../../@opentelemetry_core@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/core/build/src/common/types.js";
+import "../../../../../../../@opentelemetry_core@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/core/build/src/index.js";
+import { TimedEvent } from "../TimedEvent.js";
+import { Attributes, HrTime, Link, SpanContext, SpanKind, SpanStatus } from "@opentelemetry/api";
+import { Resource } from "@opentelemetry/resources";
+
+//#region ../../node_modules/.pnpm/@opentelemetry+sdk-trace-base@2.6.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/ReadableSpan.d.ts
+interface ReadableSpan {
+  readonly name: string;
+  readonly kind: SpanKind;
+  readonly spanContext: () => SpanContext;
+  readonly parentSpanContext?: SpanContext;
+  readonly startTime: HrTime;
+  readonly endTime: HrTime;
+  readonly status: SpanStatus;
+  readonly attributes: Attributes;
+  readonly links: Link[];
+  readonly events: TimedEvent[];
+  readonly duration: HrTime;
+  readonly ended: boolean;
+  readonly resource: Resource;
+  readonly instrumentationScope: InstrumentationScope;
+  readonly droppedAttributesCount: number;
+  readonly droppedEventsCount: number;
+  readonly droppedLinksCount: number;
+}
+//#endregion
+export { ReadableSpan };
+//# sourceMappingURL=ReadableSpan.d.ts.map

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/SimpleSpanProcessor.d.ts

@@ -0,0 +1,5 @@
+import "./ReadableSpan.js";
+import "../Span.js";
+import "../SpanProcessor.js";
+import "./SpanExporter.js";
+import { Context } from "@opentelemetry/api";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/SpanExporter.d.ts

@@ -0,0 +1,2 @@
+import "../../../../../../../@opentelemetry_core@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/core/build/src/index.js";
+import "./ReadableSpan.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/index.d.ts

@@ -0,0 +1,18 @@
+import { IdGenerator } from "./IdGenerator.js";
+import { Sampler, SamplingDecision, SamplingResult } from "./Sampler.js";
+import { TimedEvent } from "./TimedEvent.js";
+import { ReadableSpan } from "./export/ReadableSpan.js";
+import { Span } from "./Span.js";
+import { SpanProcessor } from "./SpanProcessor.js";
+import { GeneralLimits, SpanLimits, TracerConfig } from "./types.js";
+import "./BasicTracerProvider.js";
+import "./export/SpanExporter.js";
+import "./platform/index.js";
+import "./export/ConsoleSpanExporter.js";
+import "./export/InMemorySpanExporter.js";
+import "./export/SimpleSpanProcessor.js";
+import "./export/NoopSpanProcessor.js";
+import "./sampler/AlwaysOffSampler.js";
+import "./sampler/AlwaysOnSampler.js";
+import "./sampler/ParentBasedSampler.js";
+import "./sampler/TraceIdRatioBasedSampler.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/platform/index.d.ts

@@ -0,0 +1 @@
+import "./node/index.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/platform/node/export/BatchSpanProcessor.d.ts

@@ -0,0 +1,2 @@
+import "../../../types.js";
+import "../../../export/BatchSpanProcessorBase.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/platform/node/index.d.ts

@@ -0,0 +1 @@
+import "./export/BatchSpanProcessor.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/sampler/AlwaysOffSampler.d.ts

@@ -0,0 +1 @@
+import "../Sampler.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/sampler/AlwaysOnSampler.d.ts

@@ -0,0 +1 @@
+import "../Sampler.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/sampler/ParentBasedSampler.d.ts

@@ -0,0 +1,2 @@
+import "../Sampler.js";
+import { Attributes, Context, Link, SpanKind } from "@opentelemetry/api";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/sampler/TraceIdRatioBasedSampler.d.ts

@@ -0,0 +1 @@
+import "../Sampler.js";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/types.d.ts

@@ -0,0 +1,66 @@
+import { IdGenerator } from "./IdGenerator.js";
+import { Sampler } from "./Sampler.js";
+import { SpanProcessor } from "./SpanProcessor.js";
+import { MeterProvider } from "@opentelemetry/api";
+import { Resource } from "@opentelemetry/resources";
+
+//#region ../../node_modules/.pnpm/@opentelemetry+sdk-trace-base@2.6.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/types.d.ts
+/**
+ * TracerConfig provides an interface for configuring a Basic Tracer.
+ */
+interface TracerConfig {
+  /**
+   * Sampler determines if a span should be recorded or should be a NoopSpan.
+   */
+  sampler?: Sampler;
+  /** General Limits */
+  generalLimits?: GeneralLimits;
+  /** Span Limits */
+  spanLimits?: SpanLimits;
+  /** Resource associated with trace telemetry  */
+  resource?: Resource;
+  /**
+   * Generator of trace and span IDs
+   * The default idGenerator generates random ids
+   */
+  idGenerator?: IdGenerator;
+  /**
+   * How long the forceFlush can run before it is cancelled.
+   * The default value is 30000ms
+   */
+  forceFlushTimeoutMillis?: number;
+  /**
+   * List of SpanProcessor for the tracer
+   */
+  spanProcessors?: SpanProcessor[];
+  /**
+   * A meter provider to record trace SDK metrics to.
+   * @experimental This option is experimental and is subject to breaking changes in minor releases.
+   */
+  meterProvider?: MeterProvider;
+}
+/** Global configuration limits of trace service */
+interface GeneralLimits {
+  /** attributeValueLengthLimit is maximum allowed attribute value size */
+  attributeValueLengthLimit?: number;
+  /** attributeCountLimit is number of attributes per trace */
+  attributeCountLimit?: number;
+}
+/** Global configuration of trace service */
+interface SpanLimits {
+  /** attributeValueLengthLimit is maximum allowed attribute value size */
+  attributeValueLengthLimit?: number;
+  /** attributeCountLimit is number of attributes per span */
+  attributeCountLimit?: number;
+  /** linkCountLimit is number of links per span */
+  linkCountLimit?: number;
+  /** eventCountLimit is number of message events per span */
+  eventCountLimit?: number;
+  /** attributePerEventCountLimit is the maximum number of attributes allowed per span event */
+  attributePerEventCountLimit?: number;
+  /** attributePerLinkCountLimit is the maximum number of attributes allowed per span link */
+  attributePerLinkCountLimit?: number;
+}
+//#endregion
+export { GeneralLimits, SpanLimits, TracerConfig };
+//# sourceMappingURL=types.d.ts.map

package/dist/otel.d.ts

@@ -0,0 +1,73 @@
+import { LogRecordProcessor } from "./node_modules/.pnpm/@opentelemetry_sdk-logs@0.214.0_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-logs/build/src/LogRecordProcessor.js";
+import "./node_modules/.pnpm/@opentelemetry_sdk-logs@0.214.0_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-logs/build/src/index.js";
+import { MetricReader } from "./node_modules/.pnpm/@opentelemetry_sdk-metrics@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-metrics/build/src/export/MetricReader.js";
+import "./node_modules/.pnpm/@opentelemetry_sdk-metrics@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-metrics/build/src/index.js";
+import { SpanProcessor } from "./node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/SpanProcessor.js";
+import { TracerConfig } from "./node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/types.js";
+import "./node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/index.js";
+import { Attributes } from "@opentelemetry/api";
+import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
+import { WebTracerProvider } from "@opentelemetry/sdk-trace-web";
+
+//#region src/otel.d.ts
+/**
+ * Consumer-provided telemetry configuration for Convex Auth spans.
+ *
+ * The host application decides the service name, exporters, processors, and
+ * readers.
+ */
+type TelemetryConfig = {
+  /** Service name reported to the telemetry backend. */serviceName: string; /** Optional service version reported alongside the service name. */
+  serviceVersion?: string; /** Additional OpenTelemetry resource attributes to attach to all spans. */
+  attributes?: Attributes; /** Span processor or processors used for tracing export. */
+  spanProcessor?: SpanProcessor | ReadonlyArray<SpanProcessor>; /** Optional tracer configuration forwarded to the underlying SDK. */
+  tracerConfig?: Omit<TracerConfig, "resource">; /** Metric reader or readers used for metrics export. */
+  metricReader?: MetricReader | ReadonlyArray<MetricReader>; /** Log record processor or processors used for logs export. */
+  logRecordProcessor?: LogRecordProcessor | ReadonlyArray<LogRecordProcessor>;
+};
+/**
+ * Build a Node.js OpenTelemetry tracer provider for an app using Convex Auth.
+ *
+ * Convex Auth does not install this provider automatically. Provide it from your
+ * application runtime when you want server-side spans, metrics, or logs to be
+ * exported.
+ *
+ * @param config - Telemetry configuration supplied by the host application.
+ * @returns A registered {@link NodeTracerProvider}.
+ *
+ * @example
+ * ```ts
+ * import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
+ * import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+ * import { nodeTelemetry } from "@estifanos-sh/convex-auth/otel";
+ *
+ * const provider = nodeTelemetry({
+ *   serviceName: "my-app",
+ *   spanProcessor: new BatchSpanProcessor(new OTLPTraceExporter()),
+ * });
+ * ```
+ */
+declare function nodeTelemetry(config: TelemetryConfig): NodeTracerProvider;
+/**
+ * Build a browser OpenTelemetry tracer provider for an app using Convex Auth.
+ *
+ * Convex Auth does not install this provider automatically. Provide it from your
+ * browser runtime when you want client-side Convex Auth spans to be exported.
+ *
+ * @param config - Telemetry configuration supplied by the host application.
+ * @returns A registered {@link WebTracerProvider}.
+ *
+ * @example
+ * ```ts
+ * import { browserTelemetry } from "@estifanos-sh/convex-auth/otel";
+ *
+ * const provider = browserTelemetry({
+ *   serviceName: "my-web-app",
+ *   attributes: { deployment: "production" },
+ * });
+ * ```
+ */
+declare function browserTelemetry(config: TelemetryConfig): WebTracerProvider;
+//#endregion
+export { TelemetryConfig, browserTelemetry, nodeTelemetry };
+//# sourceMappingURL=otel.d.ts.map

package/dist/otel.js

@@ -0,0 +1,82 @@
+import { resourceFromAttributes } from "@opentelemetry/resources";
+import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
+import { WebTracerProvider } from "@opentelemetry/sdk-trace-web";
+import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
+
+//#region src/otel.ts
+function resolveProcessors(input) {
+	if (input === void 0) return [];
+	if (Array.isArray(input)) return [...input];
+	return [input];
+}
+/**
+* Build a Node.js OpenTelemetry tracer provider for an app using Convex Auth.
+*
+* Convex Auth does not install this provider automatically. Provide it from your
+* application runtime when you want server-side spans, metrics, or logs to be
+* exported.
+*
+* @param config - Telemetry configuration supplied by the host application.
+* @returns A registered {@link NodeTracerProvider}.
+*
+* @example
+* ```ts
+* import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
+* import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+* import { nodeTelemetry } from "@estifanos-sh/convex-auth/otel";
+*
+* const provider = nodeTelemetry({
+*   serviceName: "my-app",
+*   spanProcessor: new BatchSpanProcessor(new OTLPTraceExporter()),
+* });
+* ```
+*/
+function nodeTelemetry(config) {
+	const provider = new NodeTracerProvider({
+		resource: resourceFromAttributes({
+			[ATTR_SERVICE_NAME]: config.serviceName,
+			...config.serviceVersion ? { [ATTR_SERVICE_VERSION]: config.serviceVersion } : {},
+			...config.attributes
+		}),
+		spanProcessors: resolveProcessors(config.spanProcessor),
+		...config.tracerConfig
+	});
+	provider.register();
+	return provider;
+}
+/**
+* Build a browser OpenTelemetry tracer provider for an app using Convex Auth.
+*
+* Convex Auth does not install this provider automatically. Provide it from your
+* browser runtime when you want client-side Convex Auth spans to be exported.
+*
+* @param config - Telemetry configuration supplied by the host application.
+* @returns A registered {@link WebTracerProvider}.
+*
+* @example
+* ```ts
+* import { browserTelemetry } from "@estifanos-sh/convex-auth/otel";
+*
+* const provider = browserTelemetry({
+*   serviceName: "my-web-app",
+*   attributes: { deployment: "production" },
+* });
+* ```
+*/
+function browserTelemetry(config) {
+	const provider = new WebTracerProvider({
+		resource: resourceFromAttributes({
+			[ATTR_SERVICE_NAME]: config.serviceName,
+			...config.serviceVersion ? { [ATTR_SERVICE_VERSION]: config.serviceVersion } : {},
+			...config.attributes
+		}),
+		spanProcessors: resolveProcessors(config.spanProcessor),
+		...config.tracerConfig
+	});
+	provider.register();
+	return provider;
+}
+
+//#endregion
+export { browserTelemetry, nodeTelemetry };
+//# sourceMappingURL=otel.js.map

package/dist/permissions/index.d.ts

@@ -0,0 +1,81 @@
+//#region src/permissions/index.d.ts
+/**
+ * Lightweight permissions helpers.
+ *
+ * @module
+ */
+/**
+ * Define typed permissions for Convex Auth.
+ *
+ * Grants are the atomic permissions your app checks at runtime. Roles are
+ * named bundles of those grants that can be assigned to group memberships.
+ * The returned object preserves literal role IDs and grant strings so
+ * `member.get()` / `member.assert()` and `member.create()` calls can be
+ * checked at compile time.
+ *
+ * @param config - Permission config with optional top-level `grants` and
+ *   required role definitions.
+ * @typeParam TGrants - The declared grant strings.
+ * @typeParam TRoles - The object literal shape of your role definitions.
+ * @returns A normalized permissions config with `roles.<id>.id` populated.
+ *
+ * @example
+ * ```ts
+ * import { definePermissions } from "@estifanos-sh/convex-auth/permissions";
+ *
+ * const permissions = definePermissions({
+ *   grants: ["issues:read", "issues:write", "members:manage"],
+ *   roles: {
+ *     admin: { label: "Administrator", grants: ["issues:write", "members:manage"] },
+ *     member: { label: "Member", grants: ["issues:write"] },
+ *     viewer: { grants: ["issues:read"] },
+ *   },
+ * });
+ *
+ * // permissions.roles.admin.id === "admin"
+ *
+ * // Pass to defineAuth:
+ * const auth = defineAuth(components.auth, {
+ *   providers: [...],
+ *   permissions,
+ * });
+ * ```
+ *
+ * @example
+ * ```ts
+ * type RoleId = keyof typeof permissions.roles;
+ * // RoleId = "admin" | "member" | "viewer"
+ * ```
+ *
+ * @see {@link ConvexAuthConfig}
+ */
+declare function definePermissions<const TRoles extends Record<string, {
+  label?: string;
+  grants: readonly string[];
+}>>(config: {
+  roles: TRoles;
+}): {
+  grants: [];
+  roles: NormalizedRoles<TRoles>;
+};
+declare function definePermissions<const TGrants extends readonly string[], const TRoles extends Record<string, {
+  label?: string;
+  grants: readonly TGrants[number][];
+}>>(config: {
+  grants: TGrants;
+  roles: TRoles;
+}): {
+  grants: Array<TGrants[number] & string>;
+  roles: NormalizedRoles<TRoles>;
+};
+type NormalizedRoles<TRoles extends Record<string, {
+  label?: string;
+  grants: readonly string[];
+}>> = { [K in keyof TRoles]: {
+  id: K & string;
+  label?: TRoles[K]["label"];
+  grants: Array<TRoles[K]["grants"][number] & string>;
+} };
+//#endregion
+export { definePermissions };
+//# sourceMappingURL=index.d.ts.map

package/dist/permissions/index.js

@@ -0,0 +1,18 @@
+//#region src/permissions/index.ts
+function definePermissions(config) {
+	return {
+		grants: [...config.grants ?? []],
+		roles: normalizeRoles(config.roles)
+	};
+}
+function normalizeRoles(roles) {
+	return Object.fromEntries(Object.entries(roles).map(([id, role]) => [id, {
+		id,
+		...role.label ? { label: role.label } : {},
+		grants: [...role.grants]
+	}]));
+}
+
+//#endregion
+export { definePermissions };
+//# sourceMappingURL=index.js.map

package/dist/providers/anonymous.d.ts

@@ -0,0 +1,35 @@
+import { ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
+import { Value } from "convex/values";
+import { DocumentByName, GenericDataModel, WithoutSystemFields } from "convex/server";
+
+//#region src/providers/anonymous.d.ts
+/** Configuration for the {@link anonymous} provider. */
+interface AnonymousConfig<DataModel extends GenericDataModel> {
+  /** Stable provider identifier used in `signIn("<id>")`. */
+  id?: string;
+  /**
+   * Optional profile factory used when creating the anonymous user document.
+   * Must return a profile that includes `isAnonymous: true`.
+   */
+  profile?: (params: Record<string, Value | undefined>, ctx: GenericActionCtxWithAuthConfig<DataModel>) => WithoutSystemFields<DocumentByName<DataModel, "User">> & {
+    isAnonymous: true;
+  };
+}
+/**
+ * Create an anonymous sign-in provider.
+ *
+ * @typeParam DataModel - The Convex data model used by the auth context.
+ * @param config - Optional provider id and profile customization.
+ * @returns A configured anonymous provider for `defineAuth`.
+ *
+ * @example
+ * ```ts
+ * import { anonymous } from "@estifanos-sh/convex-auth/providers";
+ *
+ * anonymous()
+ * ```
+ */
+declare function anonymous<DataModel extends GenericDataModel = GenericDataModel>(config?: AnonymousConfig<DataModel>): ConvexCredentialsConfig;
+//#endregion
+export { AnonymousConfig, anonymous };
+//# sourceMappingURL=anonymous.d.ts.map

package/dist/providers/anonymous.js

@@ -0,0 +1,40 @@
+import { credentials } from "./credentials.js";
+
+//#region src/providers/anonymous.ts
+function defaultAnonymousProfile() {
+	return { isAnonymous: true };
+}
+/**
+* Create an anonymous sign-in provider.
+*
+* @typeParam DataModel - The Convex data model used by the auth context.
+* @param config - Optional provider id and profile customization.
+* @returns A configured anonymous provider for `defineAuth`.
+*
+* @example
+* ```ts
+* import { anonymous } from "@estifanos-sh/convex-auth/providers";
+*
+* anonymous()
+* ```
+*/
+function anonymous(config = {}) {
+	const provider = config.id ?? "anonymous";
+	return credentials({
+		id: provider,
+		authorize: async (params, ctx) => {
+			const profile = config.profile?.(params, ctx) ?? defaultAnonymousProfile();
+			const { user } = await ctx.auth.account.create(ctx, {
+				provider,
+				account: { id: crypto.randomUUID() },
+				profile
+			});
+			return { userId: user._id };
+		},
+		...config
+	});
+}
+
+//#endregion
+export { anonymous };
+//# sourceMappingURL=anonymous.js.map

package/dist/providers/apple.d.ts

@@ -0,0 +1,61 @@
+import { OAuthMaterializedConfig } from "../server/types.js";
+
+//#region src/providers/apple.d.ts
+/**
+ * Apple OAuth provider.
+ *
+ * ```ts
+ * import { apple } from "@estifanos-sh/convex-auth/providers/apple";
+ *
+ * apple({
+ *   clientId: env.AUTH_APPLE_ID!,
+ *   teamId: env.AUTH_APPLE_TEAM_ID!,
+ *   keyId: env.AUTH_APPLE_KEY_ID!,
+ *   privateKey: env.AUTH_APPLE_PRIVATE_KEY!,
+ * })
+ * ```
+ *
+ * @module
+ */
+/** Configuration for the {@link apple} provider. */
+interface AppleConfig {
+  /** Services ID or app bundle identifier registered with Sign in with Apple. */
+  clientId: string;
+  /** Apple Developer team identifier used to sign client secrets. */
+  teamId: string;
+  /** Apple private key identifier. */
+  keyId: string;
+  /** Apple private key PEM contents or bytes. */
+  privateKey: string | Uint8Array;
+  /** Optional callback URL override. Defaults to the auth site URL plus `/callback/apple`. */
+  redirectUri?: string;
+  /** Optional OAuth scopes. Defaults to `name email`. */
+  scopes?: string[];
+  /** Account-linking strategy for existing users with matching email addresses. */
+  accountLinking?: "verifiedEmail" | "none";
+  /** On returning sign-in, refresh `User.name`/`image`/`email` from the new profile. Defaults to `true`. */
+  updateProfileOnLogin?: boolean;
+}
+/**
+ * Create an Apple OAuth provider.
+ *
+ * @param config - Apple Sign In client settings and signing key material.
+ * @returns A configured Apple OAuth provider for `defineAuth`.
+ * @throws {Error} When no callback URL can be derived and `redirectUri` is omitted.
+ *
+ * @example
+ * ```ts
+ * import { apple } from "@estifanos-sh/convex-auth/providers/apple";
+ *
+ * apple({
+ *   clientId: env.AUTH_APPLE_ID!,
+ *   teamId: env.AUTH_APPLE_TEAM_ID!,
+ *   keyId: env.AUTH_APPLE_KEY_ID!,
+ *   privateKey: env.AUTH_APPLE_PRIVATE_KEY!,
+ * })
+ * ```
+ */
+declare function apple(config: AppleConfig): OAuthMaterializedConfig;
+//#endregion
+export { AppleConfig, apple };
+//# sourceMappingURL=apple.d.ts.map