@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/domains/key.js

@@ -0,0 +1,253 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { emitAuthEvent } from "../events.js";
+import { createScopeChecker, generateApiKey, hashApiKey } from "../keys.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/domains/key.ts
+/**
+* Sampling window for the `lastUsedAt` touch in {@link createKeyDomain}'s
+* `verify`. Bearer verification runs on every authenticated API-key request, so
+* writing `lastUsedAt` unconditionally turns read-only traffic into a
+* per-request write on a single, potentially very hot `ApiKey` document — a
+* classic OCC contention point when one shared key drives high QPS. `lastUsedAt`
+* only needs coarse ("used ~this minute") accuracy, so the touch is coarsened:
+* skipped unless the stored value is unset or older than this window.
+*/
+const LAST_USED_COARSEN_MS = 6e4;
+/**
+* Public projection of a stored `ApiKey` document. Strips the sensitive
+* `hashedKey` (the SHA-256 lookup hash) and the mutable `rateLimitState`
+* (internal token-bucket counters) so `auth.key.get` / `auth.key.list` never
+* leak them to callers — the returned shape matches {@link KeyRecord}.
+* `auth.key.verify` reads the full component document directly and is
+* unaffected.
+*/
+function redactKeyRecord(doc) {
+	const { hashedKey: _hashedKey, rateLimitState: _rateLimitState, ...rest } = doc;
+	return rest;
+}
+function createKeyDomain(deps) {
+	const { config } = deps;
+	const emitCommittedKeyEvent = async (ctx, event) => {
+		try {
+			await emitAuthEvent(ctx, config, event);
+		} catch (err) {
+			console.error("[auth] API key committed but audit event emission failed", {
+				kind: event.kind,
+				err
+			});
+		}
+	};
+	return {
+		create: async (ctx, opts) => {
+			const data = opts.data;
+			const { raw, hashedKey, displayPrefix } = await generateApiKey("sk_");
+			const keyId = await ctx.runMutation(config.component.user.key.create, {
+				userId: data.userId,
+				prefix: displayPrefix,
+				hashedKey,
+				name: data.name,
+				scopes: data.scopes,
+				rateLimit: data.rateLimit,
+				expiresAt: data.expiresAt,
+				extend: data.extend
+			});
+			await emitCommittedKeyEvent(ctx, {
+				kind: "api_key.created",
+				actor: {
+					type: "user",
+					id: data.userId
+				},
+				subject: {
+					type: "user",
+					id: data.userId
+				},
+				targets: [{
+					kind: "user",
+					id: data.userId
+				}, {
+					kind: "api_key",
+					id: keyId
+				}],
+				outcome: "success",
+				data: {
+					keyId,
+					name: data.name,
+					prefix: displayPrefix
+				}
+			});
+			return {
+				id: keyId,
+				secret: raw
+			};
+		},
+		verify: async (ctx, opts) => {
+			const hashedKey = await hashApiKey(opts.secret);
+			const doc = await ctx.runQuery(config.component.user.key.get, { hashedKey });
+			if (!doc) throw new ConvexError({
+				code: ErrorCode.INVALID_API_KEY,
+				message: "Invalid API key."
+			});
+			const result = await ctx.runMutation(config.component.user.key.recordUse, {
+				id: doc._id,
+				now: Date.now(),
+				coarsenMs: LAST_USED_COARSEN_MS
+			});
+			switch (result.status) {
+				case "invalid": throw new ConvexError({
+					code: ErrorCode.INVALID_API_KEY,
+					message: "Invalid API key."
+				});
+				case "revoked": throw new ConvexError({
+					code: ErrorCode.API_KEY_REVOKED,
+					message: "This API key has been revoked."
+				});
+				case "expired": throw new ConvexError({
+					code: ErrorCode.API_KEY_EXPIRED,
+					message: "This API key has expired."
+				});
+				case "limited": throw new ConvexError({
+					code: ErrorCode.API_KEY_RATE_LIMITED,
+					message: "API key rate limit exceeded. Please try again later."
+				});
+			}
+			return {
+				userId: result.userId,
+				keyId: result.keyId,
+				scopes: createScopeChecker(result.scopes)
+			};
+		},
+		list: async (ctx, opts) => {
+			const result = await ctx.runQuery(config.component.user.key.list, {
+				where: opts?.where,
+				paginationOpts: opts?.paginationOpts ?? {
+					numItems: 50,
+					cursor: null
+				},
+				orderBy: opts?.orderBy,
+				order: opts?.order
+			});
+			return {
+				...result,
+				page: result.page.map(redactKeyRecord)
+			};
+		},
+		get: async (ctx, opts) => {
+			const doc = await ctx.runQuery(config.component.user.key.get, { id: opts.id });
+			return doc === null ? null : redactKeyRecord(doc);
+		},
+		update: async (ctx, opts) => {
+			await ctx.runMutation(config.component.user.key.update, {
+				id: opts.id,
+				patch: opts.patch
+			});
+			return null;
+		},
+		revoke: async (ctx, opts) => {
+			const key = await ctx.runQuery(config.component.user.key.get, { id: opts.id });
+			await ctx.runMutation(config.component.user.key.update, {
+				id: opts.id,
+				patch: { revoked: true }
+			});
+			if (key !== null) await emitAuthEvent(ctx, config, {
+				kind: "api_key.revoked",
+				actor: {
+					type: "user",
+					id: key.userId
+				},
+				subject: {
+					type: "user",
+					id: key.userId
+				},
+				targets: [{
+					kind: "user",
+					id: key.userId
+				}, {
+					kind: "api_key",
+					id: opts.id
+				}],
+				outcome: "success",
+				data: { keyId: opts.id }
+			});
+			return null;
+		},
+		remove: async (ctx, opts) => {
+			await ctx.runMutation(config.component.user.key.remove, { id: opts.id });
+			return null;
+		},
+		rotate: async (ctx, opts) => {
+			const { raw, hashedKey, displayPrefix } = await generateApiKey("sk_");
+			const result = await ctx.runMutation(config.component.user.key.rotate, {
+				id: opts.id,
+				prefix: displayPrefix,
+				hashedKey,
+				name: opts.name,
+				expiresAt: opts.expiresAt
+			});
+			if (result.status === "invalid") throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "The provided parameters are invalid."
+			});
+			if (result.status === "revoked") throw new ConvexError({
+				code: ErrorCode.API_KEY_REVOKED,
+				message: "This API key has been revoked."
+			});
+			if (result.status === "invalid_rate_limit") throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "The API key has an invalid rate limit configuration."
+			});
+			await emitCommittedKeyEvent(ctx, {
+				kind: "api_key.revoked",
+				actor: {
+					type: "user",
+					id: result.userId
+				},
+				subject: {
+					type: "user",
+					id: result.userId
+				},
+				targets: [{
+					kind: "user",
+					id: result.userId
+				}, {
+					kind: "api_key",
+					id: opts.id
+				}],
+				outcome: "success",
+				data: { keyId: opts.id }
+			});
+			await emitCommittedKeyEvent(ctx, {
+				kind: "api_key.created",
+				actor: {
+					type: "user",
+					id: result.userId
+				},
+				subject: {
+					type: "user",
+					id: result.userId
+				},
+				targets: [{
+					kind: "user",
+					id: result.userId
+				}, {
+					kind: "api_key",
+					id: result.id
+				}],
+				outcome: "success",
+				data: {
+					keyId: result.id,
+					name: result.name,
+					prefix: displayPrefix
+				}
+			});
+			return {
+				id: result.id,
+				secret: raw
+			};
+		}
+	};
+}
+
+//#endregion
+export { createKeyDomain };
+//# sourceMappingURL=key.js.map

package/dist/server/domains/member.js

@@ -0,0 +1,149 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { cached, ctxCacheHas, invalidateCtxCache } from "../cache/context.js";
+import { capGrantsForCaller, resolveOAuthCaller } from "./access.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/domains/member.ts
+function createMemberDomain(deps) {
+	const { config, normalizeRoleIds, resolveGrantedPermissions } = deps;
+	async function memberInspect(ctx, opts) {
+		const oauthCaller = await resolveOAuthCaller(ctx);
+		if ("groupIds" in opts) {
+			const { userId, groupIds } = opts;
+			if (groupIds.length === 0) return [];
+			const unique = Array.from(new Set(groupIds));
+			const toFetch = [];
+			for (const groupId of unique) if (!ctxCacheHas(ctx, `member-inspect:${userId}:${groupId}:n`)) toFetch.push(groupId);
+			if (toFetch.length > 0) {
+				const docs = await ctx.runQuery(config.component.group.member.get, {
+					userId,
+					groupIds: toFetch
+				});
+				for (let i = 0; i < toFetch.length; i += 1) {
+					const groupId = toFetch[i];
+					const value = docs[i] ?? null;
+					cached(ctx, `member-inspect:${userId}:${groupId}:n`, () => Promise.resolve(value));
+				}
+			}
+			return await Promise.all(groupIds.map(async (groupId) => {
+				const membership$1 = await cached(ctx, `member-inspect:${userId}:${groupId}:n`, () => ctx.runQuery(config.component.group.member.get, {
+					userId,
+					groupId
+				}));
+				if (membership$1 === null) return {
+					membership: null,
+					roleIds: [],
+					grants: []
+				};
+				const membershipRoleIds$1 = membership$1.roleIds ?? [];
+				return {
+					membership: membership$1,
+					roleIds: membershipRoleIds$1,
+					grants: capGrantsForCaller(oauthCaller, userId, resolveGrantedPermissions(membershipRoleIds$1))
+				};
+			}));
+		}
+		const membership = await cached(ctx, `member-inspect:${opts.userId}:${opts.groupId}:n`, () => ctx.runQuery(config.component.group.member.get, {
+			userId: opts.userId,
+			groupId: opts.groupId
+		}));
+		if (membership === null) return {
+			membership: null,
+			roleIds: [],
+			grants: []
+		};
+		const membershipRoleIds = membership.roleIds ?? [];
+		return {
+			membership,
+			roleIds: membershipRoleIds,
+			grants: capGrantsForCaller(oauthCaller, opts.userId, resolveGrantedPermissions(membershipRoleIds))
+		};
+	}
+	return {
+		create: async (ctx, opts) => {
+			const data = opts.data;
+			const roleIds = normalizeRoleIds(data.roleIds);
+			const memberId = await ctx.runMutation(config.component.group.member.create, {
+				...data,
+				roleIds
+			});
+			invalidateCtxCache(ctx, `member-inspect:${data.userId}:${data.groupId}`);
+			return memberId;
+		},
+		list: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.group.member.list, {
+				where: opts?.where,
+				paginationOpts: opts?.paginationOpts ?? {
+					numItems: 50,
+					cursor: null
+				},
+				orderBy: opts?.orderBy,
+				order: opts?.order
+			});
+		},
+		remove: async (ctx, opts) => {
+			await ctx.runMutation(config.component.group.member.remove, { id: opts.id });
+			invalidateCtxCache(ctx, "member");
+			invalidateCtxCache(ctx, "member-inspect");
+			return null;
+		},
+		update: async (ctx, opts) => {
+			const nextData = { ...opts.patch };
+			if ("roleIds" in nextData) nextData.roleIds = normalizeRoleIds(Array.isArray(nextData.roleIds) ? nextData.roleIds : void 0);
+			await ctx.runMutation(config.component.group.member.update, {
+				id: opts.id,
+				patch: nextData
+			});
+			invalidateCtxCache(ctx, `member:${opts.id}`);
+			invalidateCtxCache(ctx, "member-inspect");
+			return null;
+		},
+		get: memberInspect,
+		resolve: async (ctx, opts) => {
+			const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
+			const result = await ctx.runQuery(config.component.group.member.resolve, {
+				userId: opts.userId,
+				groupId: opts.groupId,
+				maxDepth
+			});
+			const roleIds = result.membership?.roleIds ?? [];
+			const caller = await resolveOAuthCaller(ctx);
+			return {
+				...result,
+				roleIds,
+				grants: capGrantsForCaller(caller, opts.userId, resolveGrantedPermissions(roleIds))
+			};
+		},
+		assert: async (ctx, opts) => {
+			const validatedRoleIds = normalizeRoleIds(opts.roleIds);
+			const requiredGrants = Array.from(new Set(opts.grants ?? []));
+			const roleFilter = validatedRoleIds.length > 0 ? new Set(validatedRoleIds) : null;
+			const result = await memberInspect(ctx, {
+				userId: opts.userId,
+				groupId: opts.groupId
+			});
+			if (result.membership === null) throw new ConvexError({
+				code: ErrorCode.NOT_A_MEMBER,
+				message: "User is not a member of this group.",
+				groupId: opts.groupId
+			});
+			if (roleFilter !== null && !result.roleIds.some((roleId) => roleFilter.has(roleId))) throw new ConvexError({
+				code: ErrorCode.NOT_A_MEMBER,
+				message: "User is not a member of this group.",
+				groupId: opts.groupId
+			});
+			const missingGrants = requiredGrants.filter((grant) => !result.grants.includes(grant));
+			if (missingGrants.length > 0) throw new ConvexError({
+				code: ErrorCode.MISSING_GRANTS,
+				message: "User is missing required grants.",
+				groupId: opts.groupId,
+				missingGrants
+			});
+			return result;
+		}
+	};
+}
+
+//#endregion
+export { createMemberDomain };
+//# sourceMappingURL=member.js.map

package/dist/server/domains/session.js

@@ -0,0 +1,29 @@
+import { cached } from "../cache/context.js";
+import { getAuthSessionId } from "../session/lifecycle.js";
+
+//#region src/server/domains/session.ts
+function createSessionDomain(deps) {
+	const { config, callInvalidateSessions } = deps;
+	return {
+		revoke: async (ctx, args) => {
+			await callInvalidateSessions(ctx, args);
+			return {
+				userId: args.userId,
+				except: args.except ?? []
+			};
+		},
+		get: async (ctx, opts) => {
+			return await cached(ctx, `session:${opts.id}`, () => ctx.runQuery(config.component.session.get, { id: opts.id }));
+		},
+		id: async (ctx) => {
+			return await getAuthSessionId(ctx);
+		},
+		list: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.session.list, { userId: opts.userId });
+		}
+	};
+}
+
+//#endregion
+export { createSessionDomain };
+//# sourceMappingURL=session.js.map

package/dist/server/domains/user.js

@@ -0,0 +1,119 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { getSessionUserId } from "../context.js";
+import { cached, ctxCacheHas, invalidateCtxCache } from "../cache/context.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/domains/user.ts
+function createUserDomain(deps) {
+	const { config } = deps;
+	async function userGet(ctx, opts) {
+		if ("id" in opts) return await cached(ctx, `user:${opts.id}`, () => ctx.runQuery(config.component.user.get, { id: opts.id }));
+		const userIds = opts.ids;
+		if (userIds.length === 0) return [];
+		const unique = Array.from(new Set(userIds));
+		const toFetch = [];
+		for (const id of unique) if (!ctxCacheHas(ctx, `user:${id}`)) toFetch.push(id);
+		if (toFetch.length > 0) {
+			const docs = await ctx.runQuery(config.component.user.get, { ids: toFetch });
+			for (let i = 0; i < toFetch.length; i += 1) {
+				const id = toFetch[i];
+				const value = docs[i] ?? null;
+				cached(ctx, `user:${id}`, () => Promise.resolve(value));
+			}
+		}
+		return await Promise.all(userIds.map((id) => cached(ctx, `user:${id}`, () => ctx.runQuery(config.component.user.get, { id }))));
+	}
+	async function emailPrimary(ctx, emailOrOpts, maybeOpts) {
+		const setting = typeof emailOrOpts === "string";
+		const userId = (setting ? maybeOpts : emailOrOpts)?.userId ?? await getSessionUserId(ctx);
+		if (userId === null || userId === void 0) {
+			if (setting) throw new ConvexError({
+				code: ErrorCode.NOT_SIGNED_IN,
+				message: "Authentication required."
+			});
+			return null;
+		}
+		if (setting) {
+			await ctx.runMutation(config.component.user.email.promote, {
+				userId,
+				email: emailOrOpts.toLowerCase()
+			});
+			return { email: emailOrOpts.toLowerCase() };
+		}
+		return (await ctx.runQuery(config.component.user.email.list, { userId })).find((r) => r.isPrimary) ?? null;
+	}
+	return {
+		get: userGet,
+		id: async (ctx) => {
+			return await getSessionUserId(ctx);
+		},
+		list: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.user.list, {
+				where: opts.where,
+				paginationOpts: opts.paginationOpts,
+				orderBy: opts.orderBy,
+				order: opts.order
+			});
+		},
+		viewer: async (ctx) => {
+			const userId = await getSessionUserId(ctx);
+			if (userId === null) return null;
+			return await userGet(ctx, { id: userId });
+		},
+		email: {
+			list: async (ctx, opts) => {
+				const userId = opts?.userId ?? await getSessionUserId(ctx);
+				if (userId === null || userId === void 0) return [];
+				return await ctx.runQuery(config.component.user.email.list, { userId });
+			},
+			create: async (ctx, args) => {
+				const userId = args.userId ?? await getSessionUserId(ctx);
+				if (userId === null || userId === void 0) throw new ConvexError({
+					code: ErrorCode.NOT_SIGNED_IN,
+					message: "Authentication required."
+				});
+				const addr = args.email.toLowerCase();
+				await ctx.runMutation(config.component.user.email.upsert, {
+					userId,
+					email: addr,
+					verified: false,
+					isPrimary: false,
+					source: "password"
+				});
+				return { email: addr };
+			},
+			remove: async (ctx, args) => {
+				const userId = args.userId ?? await getSessionUserId(ctx);
+				if (userId === null || userId === void 0) throw new ConvexError({
+					code: ErrorCode.NOT_SIGNED_IN,
+					message: "Authentication required."
+				});
+				const addr = args.email.toLowerCase();
+				await ctx.runMutation(config.component.user.email.remove, {
+					userId,
+					email: addr
+				});
+				return { email: addr };
+			},
+			promote: (ctx, args) => emailPrimary(ctx, args.email, args.userId === void 0 ? void 0 : { userId: args.userId }),
+			primary: { get: (ctx, opts) => emailPrimary(ctx, opts) }
+		},
+		update: async (ctx, opts) => {
+			await ctx.runMutation(config.component.user.update, {
+				id: opts.id,
+				patch: opts.patch
+			});
+			invalidateCtxCache(ctx, `user:${opts.id}`);
+			return null;
+		},
+		remove: async (ctx, opts) => {
+			await ctx.runMutation(config.component.user.remove, { id: opts.id });
+			invalidateCtxCache(ctx);
+			return null;
+		}
+	};
+}
+
+//#endregion
+export { createUserDomain };
+//# sourceMappingURL=user.js.map

package/dist/server/env.d.ts

@@ -0,0 +1,46 @@
+import * as convex_values1042 from "convex/values";
+import { EnvFromDefinition } from "convex/server";
+
+//#region src/server/env.d.ts
+/**
+ * Convex app environment variables used by Convex Auth.
+ *
+ * Pass this to `defineApp({ env: authEnv })` to get Convex deployment-time
+ * validation and generated `env` typing in the parent app.
+ */
+declare const authEnv: {
+  readonly ANDROID_APP_LINKS: convex_values1042.VString<string | undefined, "optional">;
+  readonly APP_URL: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_APPLE_ID: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_APPLE_KEY_ID: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_APPLE_PRIVATE_KEY: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_APPLE_TEAM_ID: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_EMAIL: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_GITHUB_ID: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_GITHUB_SECRET: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_GOOGLE_ID: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_GOOGLE_SECRET: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_LOG_LEVEL: convex_values1042.VUnion<"DEBUG" | "INFO" | "WARN" | "ERROR" | undefined, [convex_values1042.VLiteral<"DEBUG", "required">, convex_values1042.VLiteral<"INFO", "required">, convex_values1042.VLiteral<"WARN", "required">, convex_values1042.VLiteral<"ERROR", "required">], "optional", never>;
+  readonly AUTH_LOG_SECRETS: convex_values1042.VUnion<"true" | "false" | undefined, [convex_values1042.VLiteral<"true", "required">, convex_values1042.VLiteral<"false", "required">], "optional", never>;
+  readonly AUTH_MICROSOFT_ID: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_MICROSOFT_SECRET: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_MICROSOFT_TENANT_ID: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_PASSWORD_EMAIL_VERIFICATION: convex_values1042.VUnion<"true" | "false" | undefined, [convex_values1042.VLiteral<"true", "required">, convex_values1042.VLiteral<"false", "required">], "optional", never>;
+  readonly AUTH_SECRET_ENCRYPTION_KEY: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_SESSION_INACTIVE_DURATION_MS: convex_values1042.VString<string | undefined, "optional">;
+  readonly AUTH_SESSION_TOTAL_DURATION_MS: convex_values1042.VString<string | undefined, "optional">;
+  readonly CHANGE_PASSWORD_URL: convex_values1042.VString<string | undefined, "optional">;
+  readonly CONVEX_SITE_URL: convex_values1042.VString<string | undefined, "optional">;
+  readonly IOS_APP_IDS: convex_values1042.VString<string | undefined, "optional">;
+  readonly IOS_APPLINK_PATHS: convex_values1042.VString<string | undefined, "optional">;
+  readonly JWKS: convex_values1042.VString<string | undefined, "optional">;
+  readonly JWT_PRIVATE_KEY: convex_values1042.VString<string | undefined, "optional">;
+  readonly RESEND_API_KEY: convex_values1042.VString<string | undefined, "optional">;
+  readonly SECURITY_CONTACT: convex_values1042.VString<string | undefined, "optional">;
+  readonly SECURITY_TXT_EXPIRES_DAYS: convex_values1042.VString<string | undefined, "optional">;
+};
+/** Inferred type of the validated auth environment from {@link authEnv}. */
+type AuthEnv = EnvFromDefinition<typeof authEnv>;
+//#endregion
+export { AuthEnv, authEnv };
+//# sourceMappingURL=env.d.ts.map

package/dist/server/env.js

@@ -0,0 +1,96 @@
+import { ErrorCode } from "../shared/codes.js";
+import { ConvexError, v } from "convex/values";
+
+//#region src/server/env.ts
+const vOptionalBooleanString = v.optional(v.union(v.literal("true"), v.literal("false")));
+/**
+* Convex app environment variables used by Convex Auth.
+*
+* Pass this to `defineApp({ env: authEnv })` to get Convex deployment-time
+* validation and generated `env` typing in the parent app.
+*/
+const authEnv = {
+	ANDROID_APP_LINKS: v.optional(v.string()),
+	APP_URL: v.optional(v.string()),
+	AUTH_APPLE_ID: v.optional(v.string()),
+	AUTH_APPLE_KEY_ID: v.optional(v.string()),
+	AUTH_APPLE_PRIVATE_KEY: v.optional(v.string()),
+	AUTH_APPLE_TEAM_ID: v.optional(v.string()),
+	AUTH_EMAIL: v.optional(v.string()),
+	AUTH_GITHUB_ID: v.optional(v.string()),
+	AUTH_GITHUB_SECRET: v.optional(v.string()),
+	AUTH_GOOGLE_ID: v.optional(v.string()),
+	AUTH_GOOGLE_SECRET: v.optional(v.string()),
+	AUTH_LOG_LEVEL: v.optional(v.union(v.literal("DEBUG"), v.literal("INFO"), v.literal("WARN"), v.literal("ERROR"))),
+	AUTH_LOG_SECRETS: vOptionalBooleanString,
+	AUTH_MICROSOFT_ID: v.optional(v.string()),
+	AUTH_MICROSOFT_SECRET: v.optional(v.string()),
+	AUTH_MICROSOFT_TENANT_ID: v.optional(v.string()),
+	AUTH_PASSWORD_EMAIL_VERIFICATION: vOptionalBooleanString,
+	AUTH_SECRET_ENCRYPTION_KEY: v.optional(v.string()),
+	AUTH_SESSION_INACTIVE_DURATION_MS: v.optional(v.string()),
+	AUTH_SESSION_TOTAL_DURATION_MS: v.optional(v.string()),
+	CHANGE_PASSWORD_URL: v.optional(v.string()),
+	CONVEX_SITE_URL: v.optional(v.string()),
+	IOS_APP_IDS: v.optional(v.string()),
+	IOS_APPLINK_PATHS: v.optional(v.string()),
+	JWKS: v.optional(v.string()),
+	JWT_PRIVATE_KEY: v.optional(v.string()),
+	RESEND_API_KEY: v.optional(v.string()),
+	SECURITY_CONTACT: v.optional(v.string()),
+	SECURITY_TXT_EXPIRES_DAYS: v.optional(v.string())
+};
+function readEnv(name) {
+	const value = typeof process === "undefined" ? void 0 : process.env?.[name];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/** Env vars whose absence points the user at the setup wizard rather than a bare miss. */
+const SETUP_WIZARD_ENV = new Set([
+	"JWT_PRIVATE_KEY",
+	"JWKS",
+	"AUTH_SECRET_ENCRYPTION_KEY"
+]);
+function missingEnvMessage(name) {
+	return SETUP_WIZARD_ENV.has(name) ? `Missing environment variable \`${name}\`. Run the convex-auth setup wizard to generate and configure auth keys.` : `Missing environment variable \`${name}\``;
+}
+/** @internal */
+const readConfigSync = (value) => value;
+/** @internal */
+const envString = (name) => {
+	const value = readEnv(name);
+	if (value === void 0) throw new Error(missingEnvMessage(name));
+	return value;
+};
+/** @internal */
+const envOptionalString = (name) => readEnv(name);
+/** @internal */
+const envOptionalNumber = (name) => {
+	const value = readEnv(name);
+	if (value === void 0) return;
+	const parsed = Number(value);
+	if (!Number.isFinite(parsed)) throw new Error(`Invalid numeric environment variable \`${name}\``);
+	return parsed;
+};
+/** @internal */
+const envBoolean = (name) => {
+	const value = readEnv(name);
+	if (value === void 0) return;
+	if (value === "true") return true;
+	if (value === "false") return false;
+	throw new Error(`Invalid boolean environment variable \`${name}\``);
+};
+/** @internal */
+function requireEnv(name) {
+	try {
+		return readConfigSync(envString(name));
+	} catch {
+		throw new ConvexError({
+			code: ErrorCode.MISSING_ENV_VAR,
+			message: missingEnvMessage(name)
+		});
+	}
+}
+
+//#endregion
+export { authEnv, envBoolean, envOptionalNumber, envOptionalString, readConfigSync, requireEnv };
+//# sourceMappingURL=env.js.map