@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/domain.d.ts

@@ -0,0 +1,878 @@
+import { EncryptedSecret } from "../../shared/brand.js";
+import { AuthEventKind } from "../../shared/event/kinds.js";
+import { ComponentActionCtx, ComponentCtx, ComponentReadCtx } from "../component/context.js";
+import { ConvexAuthMaterializedConfig, GroupConnectionPolicy, GroupConnectionPolicyPatch, OIDCClaimMapping } from "../types.js";
+import { ScimIdentityRecord, getGroupConnection, getGroupConnectionByDomain } from "../contract.js";
+import { EmitGroupAuthEventInput } from "./group/service.js";
+import { SamlConfigShape } from "./saml.js";
+import "../index.js";
+import { GenericActionCtx, GenericDataModel } from "convex/server";
+
+//#region src/server/connection/domain.d.ts
+type DomainDeps = {
+  config: ConvexAuthMaterializedConfig & {
+    extraProviders?: unknown[];
+  };
+  connectionNotFoundError: string;
+  GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND: "oidc_client_secret";
+  requireEnv: (name: string) => string;
+  generateRandomString: (length: number, alphabet: string) => string;
+  INVITE_TOKEN_ALPHABET: string;
+  sha256: (input: string) => Promise<string>;
+  encryptSecret: (value: string) => Promise<EncryptedSecret>;
+  sharedOidcRedirectURI?: string;
+  getGroupConnectionSecret: (ctx: ComponentReadCtx, connectionId: string, kind: "oidc_client_secret") => Promise<Record<string, unknown> | null>;
+  loadConnectionOrThrow: (ctx: ComponentReadCtx, connectionId: string) => Promise<{
+    _id: string;
+    groupId: string;
+    protocol: "oidc" | "saml";
+    status: "draft" | "active" | "disabled";
+    config?: unknown;
+  }>;
+  validateGroupConnectionPolicy: (policy: GroupConnectionPolicy) => Array<{
+    name: string;
+    ok: boolean;
+    message?: string;
+  }>;
+  emitGroupAuthEvent: (ctx: ComponentCtx, data: EmitGroupAuthEventInput) => Promise<string>;
+  loadGroupPolicyOrThrow: (ctx: ComponentReadCtx, groupId: string) => Promise<GroupConnectionPolicy>;
+};
+/**
+ * Build the connection and Connection management domain.
+ */
+declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDeps): {
+  connection: {
+    create: (ctx: ComponentCtx, data: {
+      groupId: string;
+      protocol: "oidc" | "saml";
+      slug?: string;
+      name?: string;
+      status?: "draft" | "active" | "disabled";
+      config?: Record<string, unknown>;
+      extend?: Record<string, unknown>;
+    }) => Promise<{
+      connectionId: string;
+      groupId: string;
+    }>;
+    get: {
+      (ctx: ComponentReadCtx, args: {
+        id: string;
+      }): Promise<Awaited<ReturnType<typeof getGroupConnection>>>;
+      (ctx: ComponentReadCtx, args: {
+        domain: string;
+      }): Promise<Awaited<ReturnType<typeof getGroupConnectionByDomain>>>;
+    };
+    list: (ctx: ComponentReadCtx, opts: {
+      where?: {
+        groupId?: string;
+        slug?: string;
+        status?: "draft" | "active" | "disabled";
+      };
+      paginationOpts: {
+        numItems: number;
+        cursor: string | null;
+      };
+      orderBy?: "_creationTime" | "name" | "slug" | "status";
+      order?: "asc" | "desc";
+    }) => Promise<{
+      page: {
+        config: Record<string, unknown>;
+        _id: string;
+        _creationTime: number;
+        groupId: string;
+        slug?: string;
+        name?: string;
+        protocol: "oidc" | "saml";
+        status: "draft" | "active" | "disabled";
+        extend?: unknown;
+      }[];
+      isDone: boolean;
+      continueCursor: string;
+    }>;
+    update: (ctx: ComponentCtx, args: {
+      id: string;
+      patch: Record<string, unknown>;
+    }) => Promise<{
+      connectionId: string;
+    }>;
+    remove: (ctx: ComponentCtx, args: {
+      id: string;
+    }) => Promise<{
+      connectionId: string;
+    }>;
+    /**
+     * Aggregate readiness status across all configured protocols for an
+     * group connection.
+     *
+     * Returns a structured result indicating whether the connection is
+     * ready, with per-protocol checks so callers can surface actionable
+     * diagnostics without running full network validation.
+     */
+    status: (ctx: ComponentReadCtx, args: {
+      id: string;
+    }) => Promise<{
+      connectionId: string;
+      status: "draft" | "active" | "disabled";
+      ready: boolean;
+      domainCount: number;
+      protocols: {
+        oidc: {
+          configured: boolean;
+          ready: boolean;
+          clientId: string | null;
+          issuer: string | null;
+        };
+        saml: {
+          configured: boolean;
+          ready: boolean;
+          entityId: string | null;
+        };
+        scim: {
+          configured: boolean;
+          ready: boolean;
+          basePath: string | null;
+          deprovisionMode: "soft" | "hard";
+        };
+      };
+    }>;
+  };
+  domain: {
+    create: (ctx: ComponentCtx, data: {
+      connectionId: string;
+      groupId: string;
+      domain: string;
+      isPrimary?: boolean;
+    }) => Promise<string>;
+    list: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      _id: string;
+      _creationTime: number;
+      connectionId: string;
+      groupId: string;
+      domain: string;
+      isPrimary: boolean;
+      verifiedAt?: number;
+    }[]>;
+    validate: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      connectionId: string;
+      ready: boolean;
+      summary: {
+        domainCount: number;
+        primaryCount: number;
+        verifiedCount: number;
+      };
+      domains: {
+        domainId: string;
+        domain: string;
+        isPrimary: boolean;
+        verified: boolean;
+        verifiedAt: number | null;
+      }[];
+      warnings: string[];
+    }>;
+    status: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      connectionId: string;
+      ready: boolean;
+      primaryDomain: {
+        domainId: string;
+        domain: string;
+        isPrimary: boolean;
+        verified: boolean;
+        verifiedAt: number | null;
+      } | null;
+      trustedDomains: {
+        domainId: string;
+        domain: string;
+        isPrimary: boolean;
+        verified: boolean;
+        verifiedAt: number | null;
+      }[];
+      pendingChallenges: {
+        domain: string;
+        recordName: string;
+        expiresAt: number;
+      }[];
+      trust: {
+        domainDiscoveryReady: boolean;
+        primaryDomainVerified: boolean;
+        automaticLinkingEligible: boolean;
+      };
+      warnings: string[];
+      nextSteps: string[];
+    }>;
+    remove: (ctx: ComponentCtx, args: {
+      id: string;
+    }) => Promise<void>;
+    verification: {
+      request: (ctx: ComponentCtx, args: {
+        connectionId: string;
+        domain: string;
+      }) => Promise<{
+        connectionId: string;
+        domain: string;
+        requestedAt: number;
+        expiresAt: number;
+        challenge: {
+          recordType: "TXT";
+          recordName: string;
+          recordValue: string;
+        };
+      }>;
+      confirm: (ctx: ComponentCtx, args: {
+        connectionId: string;
+        domain: string;
+      }) => Promise<{
+        connectionId: string;
+        domain: string;
+        checks: {
+          name: string;
+          ok: boolean;
+          message?: string;
+        }[];
+        verifiedAt?: undefined;
+      } | {
+        connectionId: string;
+        domain: string;
+        verifiedAt: number;
+        checks: {
+          name: string;
+          ok: boolean;
+          message?: string;
+        }[];
+      }>;
+    };
+  };
+  saml: {
+    upsert: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, data: {
+      connectionId: string;
+      metadata: {
+        xml?: string;
+        url?: string;
+      };
+      domains?: string[];
+      request?: {
+        signAuthnRequests?: boolean;
+        nameIdFormat?: string;
+        forceAuthn?: boolean;
+        authnContextClassRefs?: string[];
+      };
+      security?: {
+        requireSignedAssertions?: boolean;
+        requireTimestamps?: boolean;
+        clockSkewSeconds?: number;
+        weakAlgorithmHandling?: "warn" | "reject";
+        maxMetadataSize?: number;
+        maxResponseSize?: number;
+      };
+      serviceProvider?: {
+        entityId?: string;
+        acsUrl?: string;
+        sloUrl?: string;
+        signingCert?: string | string[];
+        encryptCert?: string | string[];
+        privateKey?: string;
+        privateKeyPass?: string;
+        encPrivateKey?: string;
+        encPrivateKeyPass?: string;
+      };
+      profile?: {
+        mapping?: {
+          subject?: string;
+          email?: string;
+          name?: string;
+          firstName?: string;
+          lastName?: string;
+          image?: string;
+          groups?: string;
+          roles?: string;
+        };
+        extraFields?: Record<string, string>;
+      };
+    }) => Promise<{
+      connectionId: string;
+      groupId: string;
+    }>;
+    refresh: (ctx: ComponentActionCtx, data: {
+      connectionId: string;
+    }) => Promise<{
+      connectionId: string;
+      groupId: string;
+    }>;
+    get: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<SamlConfigShape>;
+    status: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      connectionId: string;
+      configured: boolean;
+      ready: boolean;
+      config: SamlConfigShape;
+      checks: {
+        name: string;
+        ok: boolean;
+        message: string | undefined;
+      }[];
+    }>;
+    metadata: (ctx: ComponentReadCtx, opts: {
+      connectionId: string;
+      entityId?: string;
+      acsUrl?: string;
+      sloUrl?: string;
+    }) => Promise<string>;
+    /**
+     * Validate the stored SAML config for an group connection.
+     *
+     * Re-parses IdP metadata, checks signing cert presence, and verifies
+     * SP metadata can be generated. Returns a structured result with
+     * per-check details rather than throwing on first failure.
+     */
+    validate: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      ok: boolean;
+      connectionId: string;
+      checks: {
+        name: string;
+        ok: boolean;
+        message?: string;
+      }[];
+    }>;
+  };
+  policy: {
+    get: (ctx: ComponentReadCtx, args: {
+      groupId: string;
+    }) => Promise<GroupConnectionPolicy>;
+    update: (ctx: ComponentCtx, args: {
+      groupId: string;
+      patch: GroupConnectionPolicyPatch;
+    }) => Promise<GroupConnectionPolicy>;
+    validate: (ctx: ComponentReadCtx, args: {
+      groupId: string;
+    }) => Promise<{
+      ok: boolean;
+      groupId: string;
+      checks: {
+        name: string;
+        ok: boolean;
+        message: string;
+      }[];
+      policy?: undefined;
+    } | {
+      ok: boolean;
+      groupId: string;
+      policy: GroupConnectionPolicy;
+      checks: {
+        name: string;
+        ok: boolean;
+        message?: string;
+      }[];
+    }>;
+  };
+  oidc: {
+    /**
+     * Register or update connection OIDC connection settings.
+     *
+     * Persists protocol config under `connection.config.protocols.oidc` and
+     * emits a `connection.oidc.set` auth event.
+     */
+    upsert: (ctx: ComponentCtx, data: {
+      connectionId: string;
+      discovery: {
+        issuer?: string;
+        discoveryUrl?: string;
+        jwksUri?: string;
+        audience?: string | string[];
+      };
+      client: {
+        id: string;
+        secret?: string;
+        authMethod?: "client_secret_post" | "client_secret_basic";
+      };
+      request?: {
+        scopes?: string[];
+        loginHint?: string;
+        authorizationParams?: Record<string, string>;
+      };
+      security?: {
+        clockToleranceSeconds?: number;
+        strictIssuer?: boolean;
+      };
+      profile?: {
+        mapping?: OIDCClaimMapping;
+        extraFields?: Record<string, string>;
+      };
+    }) => Promise<{
+      hasClientSecret: boolean;
+    }>;
+    /**
+     * Fetch the stored OIDC config for an connection.
+     */
+    get: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      hasClientSecret: boolean;
+    }>;
+    status: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      connectionId: string;
+      configured: boolean;
+      ready: boolean;
+      config: {
+        hasClientSecret: boolean;
+      };
+      checks: {
+        name: string;
+        ok: boolean;
+        message: string | undefined;
+      }[];
+    }>;
+    /**
+     * Resolve group Connection sign-in route from connection id, domain, or
+     * user email domain.
+     */
+    signIn: (ctx: ComponentReadCtx, data: {
+      connectionId?: string;
+      email?: string;
+      domain?: string;
+      redirectTo?: string;
+      loginHint?: string;
+    }) => Promise<{
+      connectionId: string;
+      protocol: "oidc" | "saml";
+      providerId: string;
+      signInPath: string;
+      callbackPath: string;
+      redirectTo: string | undefined;
+    }>;
+    /**
+     * Validate the stored OIDC config for an group connection.
+     *
+     * Fetches the OIDC discovery document from the configured issuer or
+     * discoveryUrl, verifies required fields are present, and checks that
+     * clientId is set. Returns a structured result with per-check details.
+     */
+    validate: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      ok: boolean;
+      connectionId: string;
+      checks: {
+        name: string;
+        ok: boolean;
+        message?: string;
+      }[];
+    }>;
+  };
+  scim: {
+    upsert: (ctx: ComponentCtx, data: {
+      connectionId: string;
+      status?: "draft" | "active" | "disabled";
+      security?: {
+        maxRequestSize?: number;
+      };
+      profile?: {
+        mapping?: {
+          subject?: string;
+          externalId?: string;
+          email?: string;
+          firstName?: string;
+          lastName?: string;
+          name?: string;
+          phone?: string;
+          active?: string;
+          groups?: string;
+          roles?: string;
+        };
+        extraFields?: Record<string, string>;
+      };
+    }) => Promise<{
+      connectionId: string;
+      configId: string;
+      basePath: string;
+      token: string;
+    }>;
+    get: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      security: {
+        maxRequestSize?: number;
+      } | undefined;
+      profile: {
+        mapping?: {
+          subject?: string;
+          externalId?: string;
+          email?: string;
+          firstName?: string;
+          lastName?: string;
+          name?: string;
+          phone?: string;
+          active?: string;
+          groups?: string;
+          roles?: string;
+        };
+        extraFields?: Record<string, string>;
+      } | undefined;
+      _creationTime: number;
+      extend?: unknown;
+      connectionId: string;
+      status: "draft" | "active" | "disabled";
+      groupId: string;
+      basePath: string;
+      lastRotatedAt?: number | undefined;
+      _id: string;
+      hasToken: boolean;
+    } | null>;
+    status: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      connectionId: string;
+      configured: boolean;
+      ready: boolean;
+      config: (Omit<{
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        groupId: string;
+        status: "draft" | "active" | "disabled";
+        basePath: string;
+        tokenHash: string;
+        lastRotatedAt?: number;
+        extend?: unknown;
+      }, "tokenHash"> & {
+        hasToken: boolean;
+      }) | null;
+      checks: {
+        name: string;
+        ok: boolean;
+        message?: string;
+      }[] | {
+        name: string;
+        ok: boolean;
+        message: string;
+      }[];
+      capabilities: {
+        users: boolean;
+        groups: boolean;
+        patch: boolean;
+        put: boolean;
+        filters: string[];
+        bulk: boolean;
+        etag: boolean;
+      } | undefined;
+    }>;
+    getConfigByToken: (ctx: ComponentReadCtx, args: {
+      token: string;
+    }) => Promise<{
+      _id: string;
+      _creationTime: number;
+      connectionId: string;
+      groupId: string;
+      status: "draft" | "active" | "disabled";
+      basePath: string;
+      tokenHash: string;
+      lastRotatedAt?: number;
+      extend?: unknown;
+    } | null>;
+    validate: (ctx: ComponentReadCtx, args: {
+      connectionId: string;
+    }) => Promise<{
+      ok: boolean;
+      connectionId: string;
+      checks: {
+        name: string;
+        ok: boolean;
+        message: string;
+      }[];
+      basePath?: undefined;
+      deprovisionMode?: undefined;
+      capabilities?: undefined;
+    } | {
+      ok: boolean;
+      connectionId: string;
+      basePath: string;
+      deprovisionMode: "soft" | "hard";
+      capabilities: {
+        users: boolean;
+        groups: boolean;
+        patch: boolean;
+        put: boolean;
+        filters: string[];
+        bulk: boolean;
+        etag: boolean;
+      };
+      checks: {
+        name: string;
+        ok: boolean;
+        message?: string;
+      }[];
+    }>;
+    identity: {
+      get: (ctx: ComponentReadCtx, data: {
+        connectionId: string;
+        resourceType: "user" | "group";
+        externalId: string;
+      }) => Promise<ScimIdentityRecord | null>;
+      upsert: (ctx: ComponentCtx, data: {
+        connectionId: string;
+        groupId: string;
+        resourceType: "user" | "group";
+        externalId: string;
+        userId?: string;
+        mappedGroupId?: string;
+        active?: boolean;
+        raw?: Record<string, unknown>;
+      }) => Promise<string>;
+    };
+  };
+  audit: {
+    list: (ctx: ComponentReadCtx, data: {
+      connectionId?: string;
+      groupId?: string;
+      paginationOpts: {
+        numItems: number;
+        cursor: string | null;
+      };
+    }) => Promise<{
+      continueCursor: string;
+      isDone: boolean;
+      page: Array<{
+        _creationTime: number;
+        _id: string;
+        actorId?: string;
+        actorType: "user" | "system" | "scim" | "api_key" | "oauth_client" | "webhook" | "anonymous";
+        category: "user" | "session" | "account" | "password" | "passkey" | "totp" | "email" | "phone" | "api_key" | "oauth" | "connection" | "scim" | "webhook" | "security";
+        data?: {
+          existingUserId?: string;
+          profile?: Record<string, any>;
+          provider?: string;
+          type?: string;
+        } | {
+          method?: string;
+          provider: string;
+        } | {
+          flow?: "reset" | "change";
+          reason?: string;
+          refreshTokenId?: string;
+          sessionId?: string;
+          userId?: string;
+        } | {
+          accountId?: string;
+          provider?: string;
+          providerAccountId?: string;
+        } | {
+          credentialId?: string;
+          keyId?: string;
+          name?: string;
+          passkeyId?: string;
+          prefix?: string;
+          reason?: string;
+          totpId?: string;
+        } | {
+          email?: string;
+          phone?: string;
+          userId?: string;
+        } | {
+          clientId?: string;
+          codeId?: string;
+          grantType?: string;
+          name?: string;
+          redirectUri?: string;
+          resource?: string;
+          scopes?: Array<string>;
+          userId?: string;
+        } | {
+          audience?: string | Array<string>;
+          changed?: Array<string>;
+          connectionId?: string;
+          discoveryUrl?: string;
+          domain?: string;
+          domains?: Array<string>;
+          errorCode?: string;
+          expiresAt?: number;
+          issuer?: string;
+          jwksUri?: string;
+          metadataUrl?: string;
+          protocol?: "oidc" | "saml";
+          recordName?: string;
+          tokenEndpointAuthMethod?: string;
+          userId?: string;
+          verifiedAt?: number;
+          version?: number;
+        } | {
+          active?: boolean;
+          externalId?: string;
+          groupId?: string;
+          operation?: string;
+          resourceId?: string;
+          resourceType?: "user" | "group";
+          scimConfigId?: string;
+          userId?: string;
+        } | {
+          attemptCount?: number;
+          deliveryId?: string;
+          endpointId?: string;
+          error?: string;
+          sourceEventId?: string;
+          sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
+          status?: number;
+        };
+        errorCode?: string;
+        eventId: string;
+        ip?: string;
+        kind: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
+        occurredAt: number;
+        outcome: "success" | "failure";
+        requestId?: string;
+        subjectId?: string;
+        subjectType: "user" | "session" | "account" | "passkey" | "totp" | "email" | "phone" | "api_key" | "oauth_client" | "oauth_code" | "group" | "connection" | "scim_identity" | "webhook_endpoint" | "webhook_delivery" | "system";
+        targetId: string;
+        targetKind: "user" | "session" | "group" | "connection" | "oauth_client" | "api_key" | "global";
+      }>;
+      pageStatus?: "SplitRecommended" | "SplitRequired" | null;
+      splitCursor?: string | null;
+    }>;
+  };
+  webhook: {
+    endpoint: {
+      get: (ctx: ComponentReadCtx, args: {
+        id: string;
+      }) => Promise<(Omit<{
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        groupId: string;
+        url: string;
+        status: "active" | "disabled";
+        secretCiphertext?: string;
+        secretHash?: string;
+        subscriptions: string[];
+        createdByUserId?: string;
+        lastSuccessAt?: number;
+        lastFailureAt?: number;
+        failureCount: number;
+        extend?: unknown;
+      }, "status" | "secretCiphertext" | "secretHash" | "subscriptions"> & {
+        status: "active" | "disabled";
+        subscriptions: AuthEventKind[];
+        hasSecret: boolean;
+      }) | null>;
+      create: (ctx: ComponentCtx, data: {
+        connectionId: string;
+        url: string;
+        secret: string;
+        subscriptions: AuthEventKind[];
+        createdByUserId?: string;
+      }) => Promise<{
+        endpointId: string;
+      }>;
+      list: (ctx: ComponentReadCtx, args: {
+        connectionId: string;
+      }) => Promise<(Omit<{
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        groupId: string;
+        url: string;
+        status: "active" | "disabled";
+        secretCiphertext?: string;
+        secretHash?: string;
+        subscriptions: string[];
+        createdByUserId?: string;
+        lastSuccessAt?: number;
+        lastFailureAt?: number;
+        failureCount: number;
+        extend?: unknown;
+      }, "status" | "secretCiphertext" | "secretHash" | "subscriptions"> & {
+        status: "active" | "disabled";
+        subscriptions: AuthEventKind[];
+        hasSecret: boolean;
+      })[]>;
+      update: (ctx: ComponentCtx, args: {
+        id: string;
+        patch: {
+          url?: string;
+          status?: "active" | "disabled";
+          secret?: string;
+          subscriptions?: AuthEventKind[];
+        };
+      }) => Promise<{
+        endpointId: string;
+      }>;
+      revoke: (ctx: ComponentCtx, args: {
+        id: string;
+      }) => Promise<{
+        endpointId: string;
+      }>;
+    };
+    delivery: {
+      list: (ctx: ComponentReadCtx, data: {
+        connectionId: string;
+        paginationOpts: {
+          numItems: number;
+          cursor: string | null;
+        };
+      }) => Promise<{
+        page: {
+          _id: string;
+          _creationTime: number;
+          connectionId: string;
+          endpointId: string;
+          eventId: string;
+          kind: AuthEventKind;
+          status: "pending" | "processing" | "delivered" | "failed";
+          attemptCount: number;
+          nextAttemptAt: number;
+          lastAttemptAt?: number;
+          lastResponseStatus?: number;
+          lastError?: string;
+          signedAt: number;
+        }[];
+        isDone: boolean;
+        continueCursor: string;
+      }>;
+      listReady: (ctx: ComponentReadCtx, args?: {
+        limit?: number;
+      }) => Promise<({
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        endpointId: string;
+        eventId: string;
+        kind: AuthEventKind;
+        status: "pending" | "processing" | "delivered" | "failed";
+        attemptCount: number;
+        nextAttemptAt: number;
+        lastAttemptAt?: number;
+        lastResponseStatus?: number;
+        lastError?: string;
+        signedAt: number;
+      } & {
+        payload: unknown;
+        signature: string;
+      })[]>;
+      markDelivered: (ctx: ComponentCtx, args: {
+        id: string;
+        responseStatus?: number;
+      }) => Promise<void>;
+      markFailed: (ctx: ComponentCtx, args: {
+        id: string;
+        data: {
+          attemptCount: number;
+          responseStatus?: number;
+          error?: string;
+          retryAt?: number;
+        };
+      }) => Promise<void>;
+    };
+  };
+};
+//#endregion
+export { createGroupConnectionDomain };
+//# sourceMappingURL=domain.d.ts.map