@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/auth.d.ts

@@ -0,0 +1,443 @@
+import { AuthApiRefs } from "../client/core/types.js";
+import "../client/index.js";
+import { AuthMemberInspectResult, AuthProviderConfig, ConvexAuthConfig, Doc, Grant, HasDeviceProvider, HasTotpProvider, HasWebAuthnProvider, PermissionsConfig, RoleId } from "./types.js";
+import { AuthContext, AuthContextConfig, OptionalAuthContext, UserDoc } from "./context.js";
+import { AuthConfig, AuthContextFactory, AuthContextResolver, InferAuth, OptionalAuthContextFactory, OptionalAuthContextResolver } from "./facade.js";
+import { McpToolDef } from "./mcp.js";
+import { Auth } from "./runtime.js";
+import { AuthExtendValidators, AuthValidators } from "./validators.js";
+import { GenericValidator } from "convex/values";
+import { HttpRouter } from "convex/server";
+
+//#region src/server/auth.d.ts
+/**
+ * `member.get`/`member.assert` result with `roleIds`/`grants` narrowed
+ * from `string[]` to the permission-typed literal unions.
+ */
+type MemberAccessResult<TPermissions extends PermissionsConfig | undefined> = Omit<AuthMemberInspectResult, "roleIds" | "grants"> & {
+  roleIds: RoleId<TPermissions>[];
+  grants: Grant<TPermissions>[];
+};
+type MemberResolutionResult<TPermissions extends PermissionsConfig | undefined> = MemberAccessResult<TPermissions> & {
+  matchedGroupId: string | null;
+  depth: number | null;
+  isDirect: boolean;
+  isInherited: boolean;
+  traversedGroupIds: string[];
+};
+type MemberApiWithPermissions<TPermissions extends PermissionsConfig | undefined> = Omit<ReturnType<typeof Auth>["auth"]["member"], "create" | "list" | "update" | "get" | "resolve" | "assert"> & {
+  create: (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["create"]>[0], args: {
+    data: {
+      groupId: string;
+      userId: string;
+      roleIds?: RoleId<TPermissions>[];
+      status?: string;
+      extend?: Record<string, unknown>;
+    };
+  }) => Promise<string>;
+  list: (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["list"]>[0], opts?: {
+    where?: {
+      groupId?: string;
+      userId?: string;
+      status?: string;
+    };
+    paginationOpts?: {
+      numItems: number;
+      cursor: string | null;
+    };
+    orderBy?: "_creationTime" | "status";
+    order?: "asc" | "desc";
+  }) => Promise<{
+    page: Doc<"GroupMember">[];
+    isDone: boolean;
+    continueCursor: string;
+    splitCursor?: string | null;
+    pageStatus?: "SplitRecommended" | "SplitRequired" | null;
+  }>;
+  update: (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["update"]>[0], args: {
+    id: string;
+    patch: Record<string, unknown> & {
+      roleIds?: RoleId<TPermissions>[];
+    };
+  }) => Promise<null>;
+  get: {
+    (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["get"]>[0], args: {
+      userId: string;
+      groupId: string;
+    }): Promise<MemberAccessResult<TPermissions>>;
+    (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["get"]>[0], args: {
+      userId: string;
+      groupIds: readonly string[];
+    }): Promise<MemberAccessResult<TPermissions>[]>;
+  };
+  resolve: (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["resolve"]>[0], args: {
+    userId: string;
+    groupId: string;
+    maxDepth?: number;
+  }) => Promise<MemberResolutionResult<TPermissions>>;
+  assert: (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["assert"]>[0], opts: {
+    userId: string;
+    groupId: string;
+    roleIds?: RoleId<TPermissions>[];
+    grants?: Grant<TPermissions>[];
+  }) => Promise<MemberAccessResult<TPermissions>>;
+};
+type RuntimeAuthApi = ReturnType<typeof Auth>["auth"];
+/** App-facing account management. Provider credential internals remain on provider callback ctx. */
+type PublicAccountApi = RuntimeAuthApi["accountManagement"];
+/** App-facing OAuth administration and consent; wire-protocol helpers stay runtime-internal. */
+type PublicOAuthApi = {
+  authorize: RuntimeAuthApi["oauth"]["authorize"];
+  client: Omit<RuntimeAuthApi["oauth"]["client"], "verify" | "verifyRegistrationToken">;
+};
+/** Audit event read/write surface for app-owned domain events. */
+type PublicEventApi = RuntimeAuthApi["event"];
+/**
+ * `request.mcp` with each tool's `scope` narrowed from `string` to the
+ * permission-typed grant union — a tool may only require a declared grant, so a
+ * typo or stale scope is a compile error.
+ */
+type RequestApiWithPermissions<TPermissions extends PermissionsConfig | undefined> = Omit<ReturnType<typeof Auth>["auth"]["request"], "mcp" | "router"> & {
+  mcp: <T extends Record<string, GenericValidator>>(http: HttpRouter, tools: { [K in keyof T]: McpToolDef<T[K], Grant<TPermissions>> }, opts?: {
+    name?: string;
+    version?: string;
+  }) => void;
+};
+/**
+ * The base auth API surface returned by {@link defineAuth}.
+ *
+ * Provides core namespaces — `signIn`, `signOut`, `user`, `session`,
+ * `member`, `invite`, `group`, `key`, and `request` — that are
+ * always available regardless of which providers are configured.
+ * Use this type when you want to describe code that only depends on the
+ * standard auth surface and should not assume group connection features exist.
+ *
+ * @typeParam TPermissions - The permissions config, used to narrow
+ *   role IDs and grant strings on the `member` API.
+ */
+type AuthApiBase<TPermissions extends PermissionsConfig | undefined = undefined, TExtend extends AuthExtendValidators = {}> = {
+  /**
+   * Convex `returns:` validators for the auth read surface.
+   *
+   * Set these as a function's `returns:` so client-side `useQuery`
+   * inference flows end-to-end without hand-rolled validators or DTO
+   * mappers. The `extend` field of each document carries the shape
+   * supplied via `defineAuth({ extend: { ... } })`.
+   *
+   * Available validators:
+   * - `v.user` / `v.group` / `v.member` — single documents (extend-aware).
+   * - `v.invite` — a single group invite document.
+   * - `v.viewer` — `User | null`, for a current-user query.
+   * - `v.connection.*` — group connection admin facade results.
+   * - `v.list(item)` — wraps an item validator in Convex's
+   *   `{ page, isDone, continueCursor }` pagination result shape.
+   *
+   * Compose these for richer reads — e.g. a current user plus their
+   * memberships and groups — using the existing `auth.user.viewer`,
+   * `auth.member.list`, and `auth.group.get` facade methods.
+   *
+   * @example
+   * ```ts
+   * export const viewer = authQuery({
+   *   returns: auth.v.viewer,
+   *   handler: (ctx) => ctx.auth.user.viewer(ctx),
+   * });
+   *
+   * export const groups = authQuery({
+   *   returns: v.union(
+   *     v.object({
+   *       ...auth.v.user.fields,
+   *       memberships: v.array(auth.v.member),
+   *       groups: v.array(auth.v.group),
+   *     }),
+   *     v.null(),
+   *   ),
+   *   handler: async (ctx) => {
+   *     const me = await ctx.auth.user.viewer(ctx);
+   *     if (me === null) return null;
+   *     const { page: memberships } = await ctx.auth.member.list(ctx, {
+   *       where: { userId: me._id },
+   *       paginationOpts: { cursor: null, numItems: 25 },
+   *     });
+   *     const groups = await ctx.auth.group.get(ctx, {
+   *       ids: memberships.map((m) => m.groupId),
+   *     });
+   *     return { ...me, memberships, groups };
+   *   },
+   * });
+   * ```
+   */
+  v: AuthValidators<TExtend>;
+  signIn: ReturnType<typeof Auth>["signIn"];
+  signOut: ReturnType<typeof Auth>["signOut"];
+  store: ReturnType<typeof Auth>["store"];
+  http: ReturnType<typeof Auth>["http"];
+  user: ReturnType<typeof Auth>["auth"]["user"];
+  session: ReturnType<typeof Auth>["auth"]["session"];
+  account: PublicAccountApi;
+  factor: RuntimeAuthApi["factor"];
+  group: ReturnType<typeof Auth>["auth"]["group"] & {
+    /** Current user's active-group selection (`get` / `update` / `reset`). */active: ReturnType<typeof Auth>["auth"]["active"];
+  };
+  member: MemberApiWithPermissions<TPermissions>;
+  invite: ReturnType<typeof Auth>["auth"]["invite"];
+  key: ReturnType<typeof Auth>["auth"]["key"];
+  provider: ReturnType<typeof Auth>["auth"]["provider"];
+  oauth: PublicOAuthApi;
+  event: PublicEventApi;
+  request: RequestApiWithPermissions<TPermissions>;
+  /**
+   * Build app-owned public RPCs for group Connection admin screens.
+   *
+   * This mirrors Convex component setup: start from the configured auth
+   * handle, then mount the Connection routes/functions from that handle.
+   */
+  connection: PublicGroupConnectionApi;
+  /**
+   * Resolve the current request's auth context. Framework-agnostic — use
+   * this in custom wrappers, middleware, or anywhere you need the current
+   * `{ userId, user, groupId, role, grants }` object.
+   *
+   * This is the authorization-enrichment path. For native identity claims
+   * already present on the JWT, prefer `ctx.auth.getUserIdentity()`.
+   *
+   * Throws a structured `ConvexError` when unauthenticated by default.
+   * Use `auth.context.optional(ctx)` to get a null-shaped auth object instead.
+   *
+   * @param ctx - Convex query, mutation, or action context.
+   * @param config - Optional auth resolution config. Supports `require`,
+   *   `active`, and `resolve`.
+   * @returns The current auth context.
+   *
+   * @example Direct usage in a handler
+   * ```ts
+   * const authContext = await auth.context(ctx);
+   * const { userId, grants } = authContext;
+   * ```
+   *
+   * @example Optional usage
+   * ```ts
+   * const authContext = await auth.context.optional(ctx);
+   * if (authContext.userId === null) {
+   *   return null;
+   * }
+   * ```
+   *
+   * @example With resolve
+   * ```ts
+   * const authContext = await auth.context(ctx, {
+   *   resolve: async (_ctx, user, state) => ({
+   *     email: user.email,
+   *     canWrite: state.grants.includes("posts.write"),
+   *   }),
+   * });
+   * ```
+   */
+  context: AuthContextResolver & {
+    optional: OptionalAuthContextResolver;
+  };
+  /**
+   * Context enrichment for convex-helpers `customQuery` / `customMutation` /
+   * `customAction`.
+   *
+   * Resolves the current user's identity, active group, membership role,
+   * and grants, then attaches them to `ctx.auth`. Returns a `Customization`
+   * object compatible with convex-helpers' custom function builders.
+   *
+   * `ctx.auth` is the current request auth context.
+   * By default this throws when unauthenticated so handlers can assume
+   * `ctx.auth.userId` and `ctx.auth.user` exist.
+   *
+   * @returns A convex-helpers `Customization` object.
+   *
+   * @example One-time setup in `convex/functions.ts`
+   * ```ts
+   * import { query, mutation, action } from "./_generated/server";
+   * import { customQuery, customMutation, customAction } from "convex-helpers/server/customFunctions";
+   * import { auth } from "./auth";
+   *
+   * export const authQuery = customQuery(query, auth.ctx());
+   * export const authMutation = customMutation(mutation, auth.ctx());
+   * export const authAction = customAction(action, auth.ctx());
+   * ```
+   *
+   * @example Per-function usage
+   * ```ts
+   * import { authQuery } from "./functions";
+   *
+   * export const list = authQuery({
+   *   args: { workspaceId: v.string() },
+   *   handler: async (ctx, args) => {
+   *     const { userId, groupId, grants } = ctx.auth;
+   *     // business logic
+   *   },
+   * });
+   * ```
+   */
+  ctx: AuthContextFactory & {
+    optional: OptionalAuthContextFactory;
+  };
+};
+type InternalConnectionApi = ReturnType<typeof Auth>["auth"]["connection"];
+type PublicGroupConnectionApi = InternalConnectionApi["connection"] & {
+  signIn: (ctx: Parameters<InternalConnectionApi["oidc"]["signIn"]>[0], data: {
+    connectionId?: string;
+    email?: string;
+    domain?: string;
+    redirectTo?: string;
+    loginHint?: string;
+  }) => Promise<{
+    connectionId: string;
+    protocol: "oidc" | "saml";
+    providerId: string;
+    signInPath: string;
+    callbackPath: string;
+    redirectTo?: string;
+  }>;
+  metadata: InternalConnectionApi["saml"]["metadata"];
+  domain: {
+    list: InternalConnectionApi["domain"]["list"];
+    validate: InternalConnectionApi["domain"]["validate"];
+    status: InternalConnectionApi["domain"]["status"];
+    upsert: (ctx: Parameters<InternalConnectionApi["connection"]["create"]>[0], args: {
+      connectionId: string;
+      domains: Array<{
+        domain: string;
+        isPrimary?: boolean;
+      }>;
+    }) => Promise<{
+      connectionId: string;
+      domains: Array<{
+        domainId: string;
+        domain: string;
+        isPrimary: boolean;
+        verified: boolean;
+        verifiedAt: number | null;
+      }>;
+    }>;
+    verification: {
+      request: (ctx: Parameters<InternalConnectionApi["connection"]["create"]>[0], args: {
+        connectionId: string;
+        domain: string;
+      }) => Promise<{
+        connectionId: string;
+        domain: string;
+        requestedAt: number;
+        expiresAt: number;
+        challenge: {
+          recordType: "TXT";
+          recordName: string;
+          recordValue: string;
+        };
+      }>;
+      confirm: (ctx: Parameters<InternalConnectionApi["connection"]["create"]>[0], args: {
+        connectionId: string;
+        domain: string;
+      }) => Promise<{
+        connectionId: string;
+        domain: string;
+        verifiedAt?: number;
+        checks: Array<{
+          name: string;
+          ok: boolean;
+          message?: string;
+        }>;
+      }>;
+    };
+  };
+  oidc: Omit<InternalConnectionApi["oidc"], "signIn">;
+  saml: InternalConnectionApi["saml"];
+  policy: InternalConnectionApi["policy"];
+  audit: {
+    list: InternalConnectionApi["audit"]["list"];
+  };
+  webhook: {
+    endpoint: InternalConnectionApi["webhook"]["endpoint"];
+    delivery: {
+      list: InternalConnectionApi["webhook"]["delivery"]["list"];
+    };
+  };
+  scim: Omit<InternalConnectionApi["scim"], "getConfigByToken" | "identity">;
+};
+/**
+ * Auth API returned by {@link defineAuth}.
+ *
+ * @typeParam TPermissions - The permissions config, forwarded to
+ *   {@link AuthApiBase} for typed role IDs and grant strings.
+ */
+type AuthApi<TPermissions extends PermissionsConfig | undefined = undefined, TExtend extends AuthExtendValidators = {}> = AuthApiBase<TPermissions, TExtend>;
+/**
+ * The return type of {@link defineAuth}.
+ *
+ * This lets application code keep a single `defineAuth()` call while getting
+ * the canonical auth namespaces, including the flat `auth.connection.*` admin
+ * facade for group connections.
+ *
+ * @typeParam P - The tuple of provider configs passed to `defineAuth`.
+ * @typeParam TPermissions - Optional permissions config for typed roles/grants.
+ */
+type ConvexAuthResult<P extends AuthProviderConfig[], TPermissions extends PermissionsConfig | undefined = undefined, TExtend extends AuthExtendValidators = {}> = AuthApi<TPermissions, TExtend>;
+/**
+ * Infer the typed `AuthApiRefs` for the client SDK from a `defineAuth` call.
+ *
+ * Use this as the generic parameter for `client()` on the frontend:
+ *
+ * ```ts
+ * // convex/auth.ts
+ * export const auth = defineAuth(components.auth, { providers: [...] });
+ *
+ * // Frontend
+ * import type { auth } from "../convex/auth";
+ * import type { InferClientApi } from "@estifanos-sh/convex-auth/server";
+ * const c = client<InferClientApi<typeof auth>>({ convex, api: api.auth });
+ * ```
+ *
+ * @typeParam T - A ConvexAuthResult to extract the client API from.
+ */
+type InferClientApi<T> = T extends ConvexAuthResult<infer P> ? AuthApiRefs<HasWebAuthnProvider<P>, HasTotpProvider<P>, HasDeviceProvider<P>> : AuthApiRefs;
+/**
+ * Define an auth API object.
+ *
+ * Connection admin RPCs are exposed by wrapping the `auth.connection.*`
+ * facade in your own `authMutation`/`authQuery` functions (authorize with
+ * `auth.member.assert`), the same pattern as every other namespace.
+ *
+ * @param component - The installed auth component reference from
+ *   `components.auth` in your Convex app definition.
+ * @param config - Auth configuration including `providers` and optional
+ *   `permissions`. All fields from {@link AuthConfig} are accepted
+ *   except `component` (passed as the first argument).
+ * @returns A {@link ConvexAuthResult} — the full auth API surface
+ *   ({@link AuthApiBase}) plus the `connection` group-admin facade.
+ *
+ * @example
+ * ```ts
+ * export const auth = defineAuth(components.auth, {
+ *   providers: [password(), google()],
+ *   permissions,
+ * });
+ * ```
+ *
+ * @see {@link AuthContextConfig}
+ */
+declare function defineAuth<P extends AuthProviderConfig[], TPermissions extends PermissionsConfig | undefined = undefined, TExtend extends AuthExtendValidators = {}>(component: ConvexAuthConfig<TExtend>["component"], config: Omit<AuthConfig<TExtend>, "providers" | "permissions"> & {
+  providers: P;
+  permissions?: TPermissions;
+  /**
+   * Validators for the `extend` field of each table. Drives both the
+   * inferred type of `auth.v.*` (so `viewer.extend.<field>` is typed)
+   * and runtime validation of consumer return shapes.
+   *
+   * @example
+   * ```ts
+   * defineAuth(components.auth, {
+   *   providers: [password()],
+   *   extend: { User: v.object({ stripeCustomerId: v.optional(v.string()) }) },
+   * });
+   * ```
+   */
+  extend?: TExtend;
+}): ConvexAuthResult<P, TPermissions, TExtend>;
+//#endregion
+export { AuthApi, AuthApiBase, ConvexAuthResult, InferClientApi, defineAuth };
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.js

@@ -0,0 +1,178 @@
+import { ErrorCode } from "../shared/codes.js";
+import { createAuthContextFacade } from "./facade.js";
+import { Auth } from "./runtime.js";
+import { createAuthValidators } from "./validators.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/auth.ts
+/**
+* Define an auth API object.
+*
+* Connection admin RPCs are exposed by wrapping the `auth.connection.*`
+* facade in your own `authMutation`/`authQuery` functions (authorize with
+* `auth.member.assert`), the same pattern as every other namespace.
+*
+* @param component - The installed auth component reference from
+*   `components.auth` in your Convex app definition.
+* @param config - Auth configuration including `providers` and optional
+*   `permissions`. All fields from {@link AuthConfig} are accepted
+*   except `component` (passed as the first argument).
+* @returns A {@link ConvexAuthResult} — the full auth API surface
+*   ({@link AuthApiBase}) plus the `connection` group-admin facade.
+*
+* @example
+* ```ts
+* export const auth = defineAuth(components.auth, {
+*   providers: [password(), google()],
+*   permissions,
+* });
+* ```
+*
+* @see {@link AuthContextConfig}
+*/
+function defineAuth(component, config) {
+	const authResult = Auth({
+		...config,
+		component,
+		providers: [...config.providers]
+	});
+	const { domain: domainApi, scim: scimApi, connection: connectionApi, audit: auditApi, webhook: webhookApi, oidc: oidcApi, saml: samlApi, ...restConnection } = authResult.auth.connection;
+	const setGroupConnectionDomains = async (ctx, args) => {
+		const { connectionId } = args;
+		const domains = args.domains;
+		const connection = await connectionApi.get(ctx, { id: connectionId });
+		if (connection === null) throw new ConvexError({
+			code: ErrorCode.INVALID_PARAMETERS,
+			message: "Connection not found."
+		});
+		const normalized = domains.map((entry) => ({
+			...entry,
+			domain: entry.domain.trim().toLowerCase()
+		}));
+		const deduped = /* @__PURE__ */ new Map();
+		for (const entry of normalized) {
+			if (entry.domain.length === 0) throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "Domain must not be empty."
+			});
+			if (deduped.has(entry.domain)) throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: `Duplicate domain: ${entry.domain}`
+			});
+			deduped.set(entry.domain, entry);
+		}
+		const nextDomains = [...deduped.values()];
+		const primaryCount = nextDomains.filter((entry) => entry.isPrimary).length;
+		if (primaryCount > 1) throw new ConvexError({
+			code: ErrorCode.INVALID_PARAMETERS,
+			message: "Only one primary domain may be set."
+		});
+		if (nextDomains.length > 0 && primaryCount === 0) nextDomains[0] = {
+			...nextDomains[0],
+			isPrimary: true
+		};
+		const currentDomains = await domainApi.list(ctx, { connectionId });
+		const currentByDomain = new Map(currentDomains.map((entry) => [entry.domain.toLowerCase(), entry]));
+		for (const existing of currentDomains) if (!deduped.has(existing.domain.toLowerCase())) await domainApi.remove(ctx, { id: existing._id });
+		for (const nextDomain of nextDomains) {
+			const current = currentByDomain.get(nextDomain.domain);
+			if (current && current.isPrimary === Boolean(nextDomain.isPrimary)) continue;
+			if (current) await domainApi.remove(ctx, { id: current._id });
+			const domainId = await domainApi.create(ctx, {
+				connectionId: connection._id,
+				groupId: connection.groupId,
+				domain: nextDomain.domain,
+				isPrimary: Boolean(nextDomain.isPrimary)
+			});
+			if (current?.verifiedAt !== void 0) await ctx.runMutation(component.connection.domain.verify, {
+				id: domainId,
+				verifiedAt: current.verifiedAt
+			});
+		}
+		return {
+			connectionId,
+			domains: (await domainApi.list(ctx, { connectionId })).map((domain) => ({
+				domainId: domain._id,
+				domain: domain.domain,
+				isPrimary: Boolean(domain.isPrimary),
+				verified: domain.verifiedAt !== void 0,
+				verifiedAt: domain.verifiedAt ?? null
+			}))
+		};
+	};
+	const publicGroupConnection = {
+		...restConnection,
+		...connectionApi,
+		signIn: oidcApi.signIn,
+		metadata: samlApi.metadata,
+		oidc: { ...oidcApi },
+		saml: { ...samlApi },
+		domain: {
+			list: domainApi.list,
+			validate: domainApi.validate,
+			status: domainApi.status,
+			upsert: setGroupConnectionDomains,
+			verification: {
+				request: domainApi.verification.request,
+				confirm: domainApi.verification.confirm
+			}
+		},
+		policy: restConnection.policy,
+		audit: { list: auditApi.list },
+		webhook: {
+			endpoint: webhookApi.endpoint,
+			delivery: { list: webhookApi.delivery.list }
+		},
+		scim: {
+			upsert: scimApi.upsert,
+			get: scimApi.get,
+			status: scimApi.status,
+			validate: scimApi.validate
+		}
+	};
+	const groupApi = {
+		...authResult.auth.group,
+		active: {
+			get: authResult.auth.active.get,
+			update: authResult.auth.active.update,
+			reset: authResult.auth.active.reset
+		}
+	};
+	const accountApi = authResult.auth.accountManagement;
+	const oauthApi = {
+		authorize: authResult.auth.oauth.authorize,
+		client: {
+			create: authResult.auth.oauth.client.create,
+			get: authResult.auth.oauth.client.get,
+			list: authResult.auth.oauth.client.list,
+			update: authResult.auth.oauth.client.update,
+			revoke: authResult.auth.oauth.client.revoke
+		}
+	};
+	const eventApi = authResult.auth.event;
+	return {
+		v: createAuthValidators(config.extend ?? {}),
+		signIn: authResult.signIn,
+		signOut: authResult.signOut,
+		store: authResult.store,
+		http: authResult.http,
+		user: authResult.auth.user,
+		session: authResult.auth.session,
+		account: accountApi,
+		factor: authResult.auth.factor,
+		group: groupApi,
+		member: authResult.auth.member,
+		invite: authResult.auth.invite,
+		key: authResult.auth.key,
+		provider: authResult.auth.provider,
+		oauth: oauthApi,
+		event: eventApi,
+		request: authResult.auth.request,
+		connection: publicGroupConnection,
+		...createAuthContextFacade(authResult.auth)
+	};
+}
+
+//#endregion
+export { defineAuth };
+//# sourceMappingURL=auth.js.map