@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/client/core/types.d.ts

@@ -0,0 +1,615 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { Value } from "convex/values";
+import { FunctionReference } from "convex/server";
+
+//#region src/client/core/types.d.ts
+/**
+ * Structural interface for any Convex client.
+ * Satisfied by `ConvexClient` (`convex/browser`),
+ * `ConvexReactClient` (`convex/react`), and similar transports.
+ *
+ * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`
+ * but not on the simplified `ConvexClient`. When available we call it
+ * during sign-out for a clean deauthentication.
+ */
+interface ConvexTransport {
+  action(action: unknown, args: unknown): Promise<unknown>;
+  setAuth(fetchToken: (args: {
+    forceRefreshToken: boolean;
+  }) => Promise<string | null | undefined>, onChange?: (isAuthenticated: boolean) => void): void;
+  clearAuth?(): void;
+}
+/** Minimal action-only transport used for unauthenticated auth flows. */
+interface ActionTransport {
+  action(action: unknown, args: unknown): Promise<unknown>;
+}
+/** Pluggable key-value storage supplied by the host runtime. */
+interface Storage {
+  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;
+  setItem(key: string, value: string): void | Promise<void>;
+  removeItem(key: string): void | Promise<void>;
+}
+/** Platform-neutral location/navigation hooks. */
+interface LocationRuntime {
+  get(): URL | null;
+  replace(relativeUrl: string): void | Promise<void>;
+}
+/**
+ * Platform-specific OAuth launch primitive.
+ *
+ * `open` receives the provider authorization URL. Platforms that navigate the
+ * whole page away (browser) return nothing; platforms that run the flow in an
+ * in-app session (Expo) return the callback URL so the core can complete the
+ * exchange inline.
+ */
+interface OAuthRuntime {
+  open(url: URL): void | string | URL | Promise<void | string | URL>;
+}
+/** Cross-context synchronization hooks, such as browser storage events. */
+interface SyncRuntime {
+  subscribe(key: string, callback: (value: string | null) => void | Promise<void>): (() => void) | null;
+}
+/** Cross-context mutex/locking primitive. */
+interface MutexRuntime {
+  withKey<T>(key: string, callback: () => Promise<T>): Promise<T>;
+}
+/** Proxy request execution supplied by the host runtime. */
+interface ProxyRuntime {
+  fetch(body: Record<string, unknown>, proxyPath: string): Promise<Response>;
+}
+/**
+ * Platform-neutral client runtime dependencies.
+ *
+ * The core `client` package should depend only on these interfaces, while the
+ * browser package can provide concrete implementations backed by DOM APIs.
+ */
+interface ClientRuntime {
+  environment?: "client" | "server";
+  storage?: Storage | null;
+  location?: LocationRuntime;
+  oauth?: OAuthRuntime;
+  sync?: SyncRuntime;
+  mutex?: MutexRuntime;
+  proxy?: ProxyRuntime;
+}
+/** Platform-specific factor adapters injected by entrypoints like `browser`. */
+interface ClientAdapters {
+  webauthn?: WebAuthnClient;
+  totp?: TotpClient;
+  device?: DeviceClient;
+}
+/**
+ * Device authorization payload returned from the `deviceCode` sign-in flow.
+ */
+type DeviceCodeResult = {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete: string;
+  expiresIn: number;
+  interval: number;
+};
+/**
+ * Result of a `signIn` call.
+ *
+ * - `kind: "signedIn"` — credentials were accepted and a client session is now available.
+ * - `kind: "redirect"` — OAuth flow initiated; redirect the user to `redirect.toString()`.
+ * - `kind: "totpRequired"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.
+ * - `kind: "deviceCode"` — device flow initiated; display the code and poll via `auth.device.poll()`.
+ * - `kind: "started"` — a non-immediate flow started (for example email/phone verification).
+ * - `kind: "failed"` — the flow did not complete; `code` is the typed {@link ErrorCode}.
+ *
+ * @see {@link AuthState}
+ */
+type SignInResult = {
+  kind: "signedIn";
+} | {
+  kind: "redirect";
+  redirect: URL;
+  verifier: string;
+} | {
+  kind: "totpRequired";
+  verifier: string;
+} | {
+  kind: "deviceCode";
+  deviceCode: DeviceCodeResult;
+} | {
+  kind: "started";
+} | {
+  kind: "failed";
+  code: ErrorCode;
+};
+/** Reactive auth state. `token` is non-null only after Convex confirms auth. */
+type AuthState = {
+  status: "loading";
+  token: null;
+} | {
+  status: "signedOut";
+  token: null;
+} | {
+  status: "signedIn";
+  token: string;
+};
+/** Handler for `auth.subscribe`. */
+type AuthSubscriber = (state: AuthState) => void;
+/**
+ * Typed Convex API references for the auth functions.
+ * Pass these from your generated `api` object.
+ *
+ * @typeParam HasWebAuthn - Whether the WebAuthn provider is configured.
+ * @typeParam HasTotp - Whether the TOTP provider is configured.
+ * @typeParam HasDevice - Whether the device provider is configured.
+ */
+type AuthApiRefs<HasWebAuthn extends boolean = boolean, HasTotp extends boolean = boolean, HasDevice extends boolean = boolean> = {
+  signIn: FunctionReference<"action", "public", Record<string, Value>, unknown>;
+  signOut: FunctionReference<"action", "public", Record<string, Value>, unknown>;
+};
+/**
+ * Optional hints for {@link WebAuthnClient.register}.
+ */
+type WebAuthnRegisterOptions = {
+  /** Human-readable label for this credential (e.g. `"MacBook Pro"`). */name?: string; /** WebAuthn `user.name` override. */
+  userName?: string; /** WebAuthn `user.displayName` override. */
+  userDisplayName?: string;
+};
+/**
+ * Optional hints for {@link WebAuthnClient.signIn}.
+ */
+type WebAuthnSignInOptions = {
+  /** Email hint to filter discoverable credentials. */email?: string; /** Set to `true` for conditional UI (autofill) mode. */
+  autofill?: boolean;
+};
+/**
+ * WebAuthn client-side helpers.
+ *
+ * @see {@link TotpClient}
+ * @see {@link DeviceClient}
+ */
+interface WebAuthnClient {
+  /**
+   * Check whether the current runtime exposes WebAuthn passkey APIs.
+   *
+   * @returns `true` when `navigator.credentials` is available.
+   *
+   * @example
+   * ```ts
+   * if (auth.webauthn.isSupported()) {
+   *   // Show passkey registration button
+   * }
+   * ```
+   */
+  isSupported(): boolean;
+  /**
+   * Check whether conditional mediation (autofill-style passkeys) is available.
+   *
+   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.
+   *
+   * @example
+   * ```ts
+   * if (await auth.webauthn.isAutofillSupported()) {
+   *   await auth.webauthn.signIn({ autofill: true });
+   * }
+   * ```
+   */
+  isAutofillSupported(): Promise<boolean>;
+  /**
+   * Start a passkey registration flow and complete the WebAuthn ceremony.
+   *
+   * Creates a new credential bound to the current user's account.
+   *
+   * @param opts - Optional registration hints.
+   * @param opts.name - Human-readable name for the passkey (e.g. `"MacBook Pro"`).
+   * @param opts.userName - WebAuthn `user.name` override.
+   * @param opts.userDisplayName - WebAuthn `user.displayName` override.
+   * @returns A {@link SignInResult} — typically `{ kind: "signedIn" }` once a client session is available.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.webauthn.register({ name: "My laptop" });
+   * ```
+   */
+  register(opts?: WebAuthnRegisterOptions): Promise<SignInResult>;
+  /**
+   * Sign in with an existing passkey and complete the WebAuthn ceremony.
+   *
+   * @param opts - Optional sign-in hints.
+   * @param opts.email - Email hint to filter discoverable credentials.
+   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.
+   * @returns A {@link SignInResult} — typically `{ kind: "signedIn" }` once a client session is available.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.webauthn.signIn();
+   * ```
+   */
+  signIn(opts?: WebAuthnSignInOptions): Promise<SignInResult>;
+}
+/**
+ * Optional hints for {@link TotpClient.setup}.
+ */
+type TotpSetupOptions = {
+  /** Issuer name shown in the authenticator app. */name?: string; /** Account label shown in the authenticator app. */
+  accountName?: string;
+};
+/** Result of {@link TotpClient.setup}. */
+type TotpSetupResult = {
+  /** `otpauth://` URL — render as a QR code. */uri: string; /** Raw base32-encoded shared secret. */
+  secret: string; /** Verifier token to pass to {@link TotpClient.confirm}. */
+  verifier: string; /** Factor ID to pass to {@link TotpClient.confirm}. */
+  totpId: string;
+};
+/** Params for {@link TotpClient.confirm}. */
+type TotpConfirmParams = {
+  /** Six-digit OTP from the authenticator app. */code: string; /** Verifier token from {@link TotpSetupResult.verifier}. */
+  verifier: string; /** Factor ID from {@link TotpSetupResult.totpId}. */
+  totpId: string;
+};
+/** Params for {@link TotpClient.verify}. */
+type TotpVerifyParams = {
+  /** Six-digit OTP from the authenticator app. */code: string; /** Verifier token from a `totpRequired` sign-in result. */
+  verifier: string;
+};
+/**
+ * TOTP two-factor authentication client-side helpers.
+ *
+ * @see {@link WebAuthnClient}
+ * @see {@link DeviceClient}
+ */
+interface TotpClient {
+  /**
+   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.
+   *
+   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code
+   * for the user to scan with their authenticator app.
+   *
+   * @param opts - Optional setup hints.
+   * @param opts.name - Issuer name shown in the authenticator app.
+   * @param opts.accountName - Account label in the authenticator app.
+   * @returns An object with `{ uri, secret, verifier, totpId }`.
+   *
+   * @example
+   * ```ts
+   * const { uri, secret, verifier, totpId } = await auth.totp.setup();
+   * // Render `uri` as a QR code, then confirm:
+   * await auth.totp.confirm({ code: userCode, verifier, totpId });
+   * ```
+   */
+  setup(opts?: TotpSetupOptions): Promise<TotpSetupResult>;
+  /**
+   * Confirm a newly created TOTP factor with the first authenticator code.
+   *
+   * Call this after the user scans the QR code and enters the first OTP.
+   *
+   * @param opts - Confirmation parameters.
+   * @param opts.code - The 6-digit TOTP code from the authenticator app.
+   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.
+   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.
+   * @returns A {@link SignInResult} — `{ kind: "signedIn" }` on success, or
+   *   `{ kind: "failed", code }` when the code is rejected.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.totp.confirm({ code: "123456", verifier, totpId });
+   * if (result.kind === "failed") showError(result.code);
+   * ```
+   */
+  confirm(opts: TotpConfirmParams): Promise<SignInResult>;
+  /**
+   * Complete a sign-in that is waiting on TOTP verification.
+   *
+   * Called when `signIn()` returns `{ kind: "totpRequired" }`.
+   *
+   * @param opts - Verification parameters.
+   * @param opts.code - The 6-digit TOTP code from the authenticator app.
+   * @param opts.verifier - The verifier string from the `totpRequired` result.
+   * @returns A {@link SignInResult} — `{ kind: "signedIn" }` on success, or
+   *   `{ kind: "failed", code }` when the code is rejected.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.signIn("password", { email, password });
+   * if (result.kind === "totpRequired") {
+   *   const totp = await auth.totp.verify({ code: totpCode, verifier: result.verifier });
+   *   if (totp.kind === "failed") showError(totp.code);
+   * }
+   * ```
+   */
+  verify(opts: TotpVerifyParams): Promise<SignInResult>;
+}
+/** Params for {@link DeviceClient.poll}. */
+type DevicePollParams = {
+  code: DeviceCodeResult; /** Aborts the poll loop cleanly, e.g. on UI unmount. */
+  signal?: AbortSignal;
+};
+/** Params for {@link DeviceClient.verify}. */
+type DeviceVerifyParams = {
+  code: string;
+};
+/**
+ * Device authorization (RFC 8628) client-side helpers.
+ *
+ * @see {@link WebAuthnClient}
+ * @see {@link TotpClient}
+ */
+interface DeviceClient {
+  /**
+   * Poll until a device flow is approved or expires.
+   *
+   * Polls the server at the interval specified in the {@link DeviceCodeResult}
+   * until the user authorizes the device or the code expires.
+   *
+   * @param opts - Poll options.
+   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn("device")`.
+   * @param opts.signal - Optional {@link AbortSignal}; aborting returns cleanly
+   *   at the next loop boundary (e.g. on UI unmount).
+   * @throws `ConvexError({ code: "DEVICE_CODE_EXPIRED" })` when the code expires before authorization.
+   *
+   * @example
+   * ```ts
+   * const controller = new AbortController();
+   * const result = await auth.signIn("device");
+   * if (result.kind === "deviceCode") {
+   *   // Display result.deviceCode.userCode to the user
+   *   await auth.device.poll({ code: result.deviceCode, signal: controller.signal });
+   *   console.log("Device authorized!");
+   * }
+   * ```
+   */
+  poll(opts: DevicePollParams): Promise<void>;
+  /**
+   * Approve a device flow from the verification page using the displayed user code.
+   *
+   * Call this on the authorization page where the user enters the short code
+   * shown on the device screen.
+   *
+   * @param opts - Verification options.
+   * @param opts.code - The user code string (e.g. `"WDJB-MJHT"`).
+   * @throws `ConvexError({ code: "DEVICE_AUTHORIZATION_FAILED" })` when verification fails.
+   *
+   * @example
+   * ```ts
+   * await auth.device.verify({ code: "WDJB-MJHT" });
+   * ```
+   */
+  verify(opts: DeviceVerifyParams): Promise<void>;
+}
+/**
+ * Extract capability flags from an AuthApiRefs type.
+ *
+ * @typeParam Api - An AuthApiRefs type to extract capability flags from.
+ */
+type InferCaps<Api extends AuthApiRefs<boolean, boolean, boolean>> = Api extends AuthApiRefs<infer P, infer T, infer D> ? {
+  webauthn: P;
+  totp: T;
+  device: D;
+} : {
+  webauthn: boolean;
+  totp: boolean;
+  device: boolean;
+};
+/**
+ * Include a capability when configured, omit it when disabled, and keep it
+ * optional when a framework binding cannot know the capability.
+ */
+type CapabilityClient<Enabled extends boolean, Name extends string, Client> = [Enabled] extends [false] ? {} : [boolean] extends [Enabled] ? { [Key in Name]?: Client } : { [Key in Name]: Client };
+/** Pending invite detected from URL or recovered from storage after redirect. */
+interface PendingInvite {
+  /**
+   * Raw one-time invite token. Pass to your invite acceptance mutation.
+   * @readonly
+   */
+  readonly token: string;
+  /**
+   * Invite email from the URL or stored redirect state, if available.
+   * @readonly
+   */
+  readonly email: string | null;
+  /**
+   * Consume the invite: clears storage/URL params and returns the token.
+   *
+   * @returns The invite token.
+   * @throws When there is no pending invite to accept.
+   */
+  accept(): Promise<{
+    token: string;
+  }>;
+}
+/**
+ * Discriminated union of params for the password provider's flows.
+ *
+ * Each branch maps to one of the five password flows: `signUp`, `signIn`,
+ * `reset`, `verify`, `change`. Selecting a `flow` literal narrows the
+ * accepted params automatically.
+ */
+type PasswordParams = {
+  flow: "signUp";
+  email: string;
+  password: string;
+  redirectTo?: string;
+} | {
+  flow: "signIn";
+  email: string;
+  password: string;
+  redirectTo?: string;
+} | {
+  flow: "reset";
+  email: string;
+  redirectTo?: string;
+} | {
+  flow: "verify";
+  email: string;
+  code: string; /** When set, completes a `reset` flow by updating the password. Otherwise confirms email. */
+  newPassword?: string;
+  redirectTo?: string;
+} | {
+  flow: "change";
+  email: string;
+  currentPassword: string;
+  newPassword: string;
+  redirectTo?: string;
+};
+/** Params for the email (magic link) provider's initiation step. */
+type EmailInitiateParams = {
+  email: string;
+  redirectTo?: string;
+};
+/**
+ * Params for completing a code-based flow (no provider). Used to finalise
+ * email magic-link sign-ins and password-reset OTPs when the verification
+ * call is made without re-specifying the originating provider.
+ */
+type CodeCompletionParams = {
+  code: string;
+  redirectTo?: string;
+};
+/** Params for the `connection` provider — requires a connection ID. */
+type ConnectionParams = {
+  connectionId: string;
+  redirectTo?: string;
+};
+/** Params for the anonymous provider. Empty / `redirectTo` only. */
+type AnonymousParams = {
+  redirectTo?: string;
+};
+/** Default params shape for OAuth-style providers (google, github, etc.). */
+type OAuthSignInParams = {
+  redirectTo?: string;
+};
+/**
+ * Resolves the `params` argument shape from the `provider` literal.
+ *
+ * Known special providers (`"password"`, `"email"`, etc.) get strict typing.
+ * Any other string falls back to OAuth-style params, since custom OAuth
+ * providers can be registered under arbitrary IDs.
+ */
+type ParamsForProvider<P> = P extends "password" ? PasswordParams : P extends "email" ? EmailInitiateParams : P extends "anonymous" ? AnonymousParams | undefined : P extends "connection" ? ConnectionParams : P extends "webauthn" ? never : P extends undefined ? CodeCompletionParams : OAuthSignInParams | undefined;
+/**
+ * Tuple-rest helper that flips `params` between required and optional based
+ * on whether `undefined` is in its resolved type.
+ */
+type SignInArgs<P> = undefined extends ParamsForProvider<P> ? [params?: ParamsForProvider<P>] : [params: ParamsForProvider<P>];
+/**
+ * Public signature for `auth.signIn`. The provider literal discriminates the
+ * params shape via {@link ParamsForProvider}, and the params slot is
+ * automatically optional when the resolved type permits `undefined`.
+ *
+ * @example
+ * ```ts
+ * auth.signIn("password", { flow: "signIn", email, password });
+ * auth.signIn("password", { flow: "change", email, currentPassword, newPassword });
+ * auth.signIn("anonymous"); // params optional
+ * ```
+ */
+type SignInOverloads = <const P extends string | undefined>(provider: P, ...args: SignInArgs<P>) => Promise<SignInResult>;
+/** Base auth client — always present. */
+interface AuthClientBase {
+  /** Restore initial auth state for the current runtime. */
+  initialize: () => Promise<void>;
+  /** SSR-safe query-param reader. */
+  param: (name: string) => string | null;
+  /**
+   * Pending invite recovered from the URL or storage, if present.
+   * @readonly
+   */
+  readonly invite: PendingInvite | null;
+  /** Complete an OAuth callback using a URL or authorization code. */
+  completeOAuth: (input: URL | string | {
+    code: string;
+  }) => Promise<OAuthCompletionResult>;
+  /** Start a sign-in flow for a provider. */
+  signIn: SignInOverloads;
+  /** Sign out and clear local auth state. */
+  signOut: () => Promise<void>;
+  /** Subscribe to auth state changes; returns an unsubscribe. */
+  subscribe: (handler: AuthSubscriber) => () => void;
+  /** Read the current auth state synchronously, e.g. for `useSyncExternalStore`. */
+  getSnapshot: () => AuthState;
+  /** Tear down listeners and reject in-flight handshakes. */
+  destroy: () => void;
+}
+/**
+ * Framework-agnostic auth client return type.
+ *
+ * Conditionally includes `totp` and `device` helpers based on the
+ * capabilities in the `AuthApiRefs` type. Platform-specific `webauthn` helpers
+ * are added by {@link PlatformAuthClient}.
+ *
+ * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.
+ */
+type AuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = AuthClientBase & CapabilityClient<InferCaps<Api>["totp"], "totp", TotpClient> & CapabilityClient<InferCaps<Api>["device"], "device", DeviceClient>;
+/**
+ * Browser auth client return type.
+ *
+ * Extends {@link AuthClient} with conditional WebAuthn helpers when the
+ * generated auth API exposes WebAuthn capabilities.
+ *
+ * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.
+ */
+type PlatformAuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = AuthClient<Api> & CapabilityClient<InferCaps<Api>["webauthn"], "webauthn", WebAuthnClient>;
+/** @deprecated Use `PlatformAuthClient`. */
+type BrowserAuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = PlatformAuthClient<Api>;
+/**
+ * Options for {@link client}.
+ *
+ * @typeParam Api - An AuthApiRefs type.
+ */
+type ClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = {
+  /** Any Convex client implementation used to run auth actions. */convex: ConvexTransport; /** Platform runtime implementation used by the client core. */
+  runtime?: ClientRuntime; /** Platform-specific factor adapters supplied by higher-level entrypoints. */
+  adapters?: ClientAdapters; /** Platform-specific adapter factories supplied by higher-level entrypoints. */
+  adapterFactories?: ClientAdapterFactories;
+  /**
+   * Typed auth function refs from your generated `api` object.
+   * Required outside proxy mode.
+   */
+  api?: Api; /** Explicit Convex deployment URL when it cannot be inferred from the client. */
+  url?: string;
+  /**
+   * Optional action-only transport for direct code exchange outside proxy mode.
+   * Required in non-browser runtimes when `proxyPath` is not set.
+   */
+  httpClient?: ActionTransport | null;
+  /**
+   * Storage backend for persisted tokens.
+   *
+   * Defaults to `runtime.storage` when provided, otherwise `null`.
+   */
+  storage?: Storage | null;
+  /**
+   * Server-known auth used to seed the synchronous boot so SSR and hydration
+   * render the resolved state on first paint. A non-empty JWT boots signed in;
+   * `null` boots signed out. Providing this at all marks auth as resolved, so
+   * the client skips the loading phase. Omit it (leave `undefined`) to read the
+   * persisted value from `storage` instead. Ongoing persistence always uses
+   * `storage`.
+   */
+  token?: string | null;
+  /**
+   * Proxy endpoint used instead of direct Convex auth calls.
+   * When set, provide `runtime.proxy` and omit direct `api`/`httpClient`
+   * transport requirements.
+   */
+  proxyPath?: string; /** SSR-safe URL source for reading query parameters. */
+  location?: URL | (() => URL | null);
+  /**
+   * Default OAuth `redirectTo` applied to `signIn` calls that omit it. Platform
+   * entrypoints set this (e.g. Expo passes its native redirect URI) so the core
+   * can build the authorization URL without a platform-specific `signIn` wrapper.
+   */
+  oauthRedirectTo?: string;
+  /**
+   * Milliseconds to wait for the Convex client to confirm a new token
+   * before a sign-in handshake rejects with `AUTH_HANDSHAKE_TIMEOUT`.
+   * Defaults to `5000`.
+   */
+  handshakeTimeoutMs?: number;
+};
+type OAuthCompletionResult = {
+  handled: false;
+} | {
+  handled: true;
+  cleanupUrl: URL | null;
+};
+//#endregion
+export { AnonymousParams, AuthApiRefs, AuthClient, AuthState, BrowserAuthClient, ClientOptions, ClientRuntime, CodeCompletionParams, ConnectionParams, DeviceClient, DeviceCodeResult, DevicePollParams, DeviceVerifyParams, EmailInitiateParams, OAuthCompletionResult, OAuthSignInParams, ParamsForProvider, PasswordParams, PendingInvite, PlatformAuthClient, SignInOverloads, SignInResult, Storage, TotpClient, TotpConfirmParams, TotpSetupOptions, TotpSetupResult, TotpVerifyParams, WebAuthnClient, WebAuthnRegisterOptions, WebAuthnSignInOptions };
+//# sourceMappingURL=types.d.ts.map

package/dist/client/core/types.js

@@ -0,0 +1,23 @@
+//#region src/client/core/types.ts
+/**
+* Create a deferred promise that can be resolved or rejected externally.
+*
+* @returns A deferred object containing the promise and control methods.
+* @internal
+*/
+function createDeferred() {
+	let resolve;
+	let reject;
+	return {
+		promise: new Promise((res, rej) => {
+			resolve = res;
+			reject = rej;
+		}),
+		resolve,
+		reject
+	};
+}
+
+//#endregion
+export { createDeferred };
+//# sourceMappingURL=types.js.map

package/dist/client/errors.js

@@ -0,0 +1,30 @@
+import { ErrorCode } from "../shared/codes.js";
+import { ConvexError } from "convex/values";
+
+//#region src/client/errors.ts
+/**
+* Client-side error-code registry.
+*
+* Re-exports the shared {@link ErrorCode} registry and adds the handshake codes
+* that are meaningful only in the client (they describe the browser⇄Convex
+* confirmation handshake, not a server outcome), so client code has a single
+* import surface for every code it can surface.
+*
+* @module
+*/
+const HANDSHAKE_ERROR_MESSAGES = {
+	AUTH_HANDSHAKE_TIMEOUT: "Sign-in succeeded but authentication confirmation timed out.",
+	AUTH_HANDSHAKE_REJECTED: "Authentication was rejected while confirming the session."
+};
+/** @internal */
+const createHandshakeError = (code, context) => {
+	return new ConvexError({
+		code,
+		message: HANDSHAKE_ERROR_MESSAGES[code],
+		...context
+	});
+};
+
+//#endregion
+export { createHandshakeError };
+//# sourceMappingURL=errors.js.map