@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/mutations/register.js

@@ -0,0 +1,93 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { ErrorCode } from "../../shared/codes.js";
+import { authDb } from "../db.js";
+import { log, maybeRedact } from "../log.js";
+import { getAuthSessionId } from "../session/lifecycle.js";
+import { hash, verify } from "../crypto.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { upsertUserAndAccount } from "../user/account.js";
+import { vPayloadRecord } from "../payloads.js";
+import { ConvexError, v } from "convex/values";
+
+//#region src/server/mutations/register.ts
+const vCreateAccountFromCredentialsArgs = v.object({
+	provider: v.string(),
+	account: v.object({
+		id: v.string(),
+		secret: v.optional(v.string())
+	}),
+	profile: vPayloadRecord,
+	shouldLinkViaEmail: v.optional(v.boolean()),
+	shouldLinkViaPhone: v.optional(v.boolean())
+});
+async function createAccountFromCredentialsImpl(ctx, args, getProviderOrThrow, config) {
+	log(LOG_LEVELS.DEBUG, "createAccountFromCredentialsImpl args:", {
+		provider: args.provider,
+		account: {
+			id: args.account.id,
+			secret: maybeRedact(args.account.secret ?? "")
+		}
+	});
+	const { provider: providerId, account, profile, shouldLinkViaEmail, shouldLinkViaPhone } = args;
+	const db = authDb(ctx, config);
+	const provider = getProviderOrThrow(providerId);
+	const typedProfile = profile;
+	const existingAccount = await db.accounts.get({
+		provider: provider.id,
+		providerAccountId: account.id
+	});
+	if (existingAccount === null) {
+		const accountSecret = account.secret;
+		const secret = accountSecret === void 0 ? void 0 : await hash(provider, accountSecret);
+		const { userId, accountId } = await upsertUserAndAccount(ctx, await getAuthSessionId(ctx), {
+			providerAccountId: account.id,
+			secret
+		}, {
+			type: "credentials",
+			provider,
+			profile: typedProfile,
+			shouldLinkViaEmail,
+			shouldLinkViaPhone
+		}, config);
+		const [createdAccount, createdUser] = await Promise.all([db.accounts.get({ id: accountId }), db.users.get({ id: userId })]);
+		if (createdAccount === null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "Created account was not found."
+		});
+		if (createdUser === null) throw new ConvexError({
+			code: ErrorCode.USER_UPDATE_FAILED,
+			message: "Created user was not found."
+		});
+		return {
+			account: createdAccount,
+			user: createdUser
+		};
+	} else {
+		if (account.secret !== void 0) {
+			const accountSecret = account.secret;
+			if (!await verify(provider, accountSecret, existingAccount.secret ?? "")) throw new ConvexError({
+				code: ErrorCode.INVALID_CREDENTIALS,
+				message: "Invalid credentials."
+			});
+		}
+		const user = await db.users.get({ id: existingAccount.userId });
+		if (user === null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: `Linked user for account ${account.id} was not found.`
+		});
+		return {
+			account: existingAccount,
+			user
+		};
+	}
+}
+const callCreateAccountFromCredentials = async (ctx, args) => {
+	return ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "createAccountFromCredentials",
+		...args
+	} });
+};
+
+//#endregion
+export { callCreateAccountFromCredentials, createAccountFromCredentialsImpl, vCreateAccountFromCredentialsArgs };
+//# sourceMappingURL=register.js.map

package/dist/server/mutations/retrieve.js

@@ -0,0 +1,66 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { log, maybeRedact } from "../log.js";
+import { withSpan } from "../utils/span.js";
+import { verify } from "../crypto.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { maxSignInAttempts } from "../limits.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/retrieve.ts
+const vRetrieveAccountWithCredentialsArgs = v.object({
+	provider: v.string(),
+	account: v.object({
+		id: v.string(),
+		secret: v.optional(v.string())
+	})
+});
+async function retrieveAccountWithCredentialsImpl(ctx, args, getProviderOrThrow, config) {
+	const { provider: providerId, account } = args;
+	log(LOG_LEVELS.DEBUG, "retrieveAccountWithCredentialsImpl args:", {
+		provider: providerId,
+		account: {
+			id: account.id,
+			secret: maybeRedact(account.secret ?? "")
+		}
+	});
+	try {
+		const begun = await ctx.runMutation(config.component.account.beginCredentialsSignIn, {
+			provider: providerId,
+			providerAccountId: account.id,
+			maxAttemptsPerHour: maxSignInAttempts(config),
+			reserveAttempt: account.secret !== void 0,
+			includeTotp: false
+		});
+		if (begun.status === "invalid") return "InvalidAccountId";
+		if (begun.status === "limited") return "TooManyFailedAttempts";
+		if (begun.status !== "ready") return "InvalidAccountId";
+		const existingAccount = begun.account;
+		if (account.secret !== void 0) {
+			const accountSecret = account.secret;
+			if (!await withSpan("convex-auth.credentials.verify", { providerId }, () => verify(getProviderOrThrow(providerId), accountSecret, existingAccount.secret ?? ""))) return "InvalidSecret";
+			await ctx.runMutation(config.component.account.completeCredentialsSignIn, {
+				accountId: existingAccount._id,
+				issueSession: false,
+				generateTokens: false,
+				sessionExpirationTime: 0,
+				refreshTokenExpirationTime: 0
+			});
+		}
+		return {
+			account: existingAccount,
+			user: begun.user
+		};
+	} catch {
+		return "InvalidAccountId";
+	}
+}
+const callRetrieveAccountWithCredentials = async (ctx, args) => {
+	return ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "retrieveAccountWithCredentials",
+		...args
+	} });
+};
+
+//#endregion
+export { callRetrieveAccountWithCredentials, retrieveAccountWithCredentialsImpl, vRetrieveAccountWithCredentialsArgs };
+//# sourceMappingURL=retrieve.js.map

package/dist/server/mutations/signature.js

@@ -0,0 +1,36 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { authDb } from "../db.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { ConvexError, v } from "convex/values";
+
+//#region src/server/mutations/signature.ts
+const vVerifierSignatureArgs = v.object({
+	verifier: v.string(),
+	signature: v.string()
+});
+async function verifierSignatureImpl(ctx, args, config) {
+	const { verifier, signature } = args;
+	const db = authDb(ctx, config);
+	const invalidVerifierError = new ConvexError({
+		code: ErrorCode.INVALID_VERIFIER,
+		message: "Invalid or expired verifier."
+	});
+	let verifierDoc;
+	try {
+		verifierDoc = await db.verifiers.get({ id: verifier });
+	} catch {
+		throw invalidVerifierError;
+	}
+	if (verifierDoc == null) throw invalidVerifierError;
+	await db.verifiers.update(verifierDoc._id, { signature });
+}
+const callVerifierSignature = async (ctx, args) => {
+	return ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "verifierSignature",
+		...args
+	} });
+};
+
+//#endregion
+export { callVerifierSignature, vVerifierSignatureArgs, verifierSignatureImpl };
+//# sourceMappingURL=signature.js.map

package/dist/server/mutations/signin.js

@@ -0,0 +1,81 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { queueAuthEvent } from "../events.js";
+import { log } from "../log.js";
+import { setActiveSpanAttributes, withSpan } from "../utils/span.js";
+import { finalizeSessionIssuance, getAuthSessionId, issueSession } from "../session/lifecycle.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { buildKnownSignInIdentityAttributes } from "../telemetry.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/signin.ts
+const vSignInArgs = v.object({
+	userId: v.string(),
+	sessionId: v.optional(v.string()),
+	generateTokens: v.boolean()
+});
+async function signInSessionImpl(ctx, args, config) {
+	return withSpan("convex-auth.mutations.signIn", {
+		"auth.flow": "signIn",
+		hasExistingSession: args.sessionId !== void 0,
+		generateTokens: args.generateTokens
+	}, async () => {
+		log(LOG_LEVELS.DEBUG, "signInSessionImpl args:", args);
+		const { userId, sessionId: existingSessionId, generateTokens } = args;
+		const issuance = await issueSession(ctx, config, {
+			userId,
+			existingSessionId,
+			replaceSessionId: existingSessionId === void 0 ? await getAuthSessionId(ctx) ?? void 0 : void 0,
+			generateTokens
+		});
+		setActiveSpanAttributes({
+			"auth.signin.result": "success",
+			...buildKnownSignInIdentityAttributes(config, {
+				userId: issuance.userId,
+				sessionId: issuance.sessionId
+			}, issuance.identity.email)
+		});
+		await queueAuthEvent(ctx, config, {
+			kind: "session.signed_in",
+			actor: {
+				type: "user",
+				id: issuance.userId
+			},
+			subject: {
+				type: "session",
+				id: issuance.sessionId
+			},
+			targets: [{
+				kind: "user",
+				id: issuance.userId
+			}, {
+				kind: "session",
+				id: issuance.sessionId
+			}],
+			outcome: "success",
+			data: { provider: "session" }
+		});
+		return issuance;
+	});
+}
+/**
+* Run the sign-in mutation, then sign the JWT on the action side.
+*
+* Splitting the work like this keeps the 5–30ms of RSA-2048 CPU out of the
+* mutation transaction so the mutation can commit quickly even on a cold
+* worker. The refresh-token string itself is cheap to compute and stays
+* inside the mutation (returned on the {@link SessionIssuance}); only the
+* JWT signing moves here.
+*
+* @internal
+*/
+const callSignIn = async (ctx, args) => {
+	const issuance = await ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "signIn",
+		...args
+	} });
+	return await finalizeSessionIssuance(ctx.auth.config, issuance);
+};
+
+//#endregion
+export { callSignIn, signInSessionImpl, vSignInArgs };
+//# sourceMappingURL=signin.js.map

package/dist/server/mutations/signout.js

@@ -0,0 +1,61 @@
+import { emitAuthEvent } from "../events.js";
+import { authDb } from "../db.js";
+import { setActiveSpanAttributes, withSpan } from "../utils/span.js";
+import { deleteSession, getAuthSessionId } from "../session/lifecycle.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { buildSignOutIdentityAttributes } from "../telemetry.js";
+
+//#region src/server/mutations/signout.ts
+async function signOutImpl(ctx, config) {
+	return withSpan("convex-auth.mutations.signOut", { "auth.flow": "signOut" }, async () => {
+		const db = authDb(ctx, config);
+		const sessionId = await getAuthSessionId(ctx);
+		if (sessionId == null) {
+			setActiveSpanAttributes({ "auth.signout.result": "no_session" });
+			return null;
+		}
+		const session = await db.sessions.get(sessionId);
+		if (session == null) {
+			setActiveSpanAttributes({ "auth.signout.result": "session_missing" });
+			return null;
+		}
+		await deleteSession(ctx, session, config);
+		setActiveSpanAttributes({
+			"auth.signout.result": "success",
+			...await buildSignOutIdentityAttributes(ctx, config, {
+				userId: session.userId,
+				sessionId: session._id
+			})
+		});
+		await emitAuthEvent(ctx, config, {
+			kind: "session.signed_out",
+			actor: {
+				type: "user",
+				id: session.userId
+			},
+			subject: {
+				type: "session",
+				id: session._id
+			},
+			targets: [{
+				kind: "user",
+				id: session.userId
+			}, {
+				kind: "session",
+				id: session._id
+			}],
+			outcome: "success"
+		});
+		return {
+			userId: session.userId,
+			sessionId: session._id
+		};
+	});
+}
+const callSignOut = async (ctx) => {
+	return ctx.runMutation(AUTH_STORE_REF, { args: { type: "signOut" } });
+};
+
+//#endregion
+export { callSignOut, signOutImpl };
+//# sourceMappingURL=signout.js.map

package/dist/server/mutations/store/refs.js

@@ -0,0 +1,15 @@
+import { makeFunctionReference } from "convex/server";
+
+//#region src/server/mutations/store/refs.ts
+/**
+* Internal function reference for the library's store dispatch mutation.
+*
+* The package cannot import the consumer app's generated `api` module,
+* so it uses a canonical function reference name that matches the app-level
+* `export const { store } = auth` surface.
+*/
+const AUTH_STORE_REF = makeFunctionReference("auth:store");
+
+//#endregion
+export { AUTH_STORE_REF };
+//# sourceMappingURL=refs.js.map

package/dist/server/mutations/store.js

@@ -0,0 +1,82 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { log } from "../log.js";
+import { modifyAccountImpl, vModifyAccountArgs } from "./account.js";
+import { createVerificationCodeImpl, vCreateVerificationCodeArgs } from "./code.js";
+import { credentialsSignInImpl, vCredentialsSignInArgs } from "./credentials/signin.js";
+import { invalidateSessionsImpl, vInvalidateSessionsArgs } from "./invalidate.js";
+import { userOAuthImpl, vUserOAuthArgs } from "./oauth.js";
+import { refreshSessionImpl, vRefreshSessionArgs } from "./refresh.js";
+import { createAccountFromCredentialsImpl, vCreateAccountFromCredentialsArgs } from "./register.js";
+import { retrieveAccountWithCredentialsImpl, vRetrieveAccountWithCredentialsArgs } from "./retrieve.js";
+import { vVerifierSignatureArgs, verifierSignatureImpl } from "./signature.js";
+import { signInSessionImpl, vSignInArgs } from "./signin.js";
+import { signOutImpl } from "./signout.js";
+import { vVerifierArgs, verifierImpl } from "./verifier.js";
+import { vVerifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from "./verify.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/store.ts
+const vStoreArgs = v.object({ args: v.union(v.object({
+	type: v.literal("signIn"),
+	...vSignInArgs.fields
+}), v.object({ type: v.literal("signOut") }), v.object({
+	type: v.literal("refreshSession"),
+	...vRefreshSessionArgs.fields
+}), v.object({
+	type: v.literal("verifyCodeAndSignIn"),
+	...vVerifyCodeAndSignInArgs.fields
+}), v.object({
+	type: v.literal("verifier"),
+	...vVerifierArgs.fields
+}), v.object({
+	type: v.literal("verifierSignature"),
+	...vVerifierSignatureArgs.fields
+}), v.object({
+	type: v.literal("userOAuth"),
+	...vUserOAuthArgs.fields
+}), v.object({
+	type: v.literal("createVerificationCode"),
+	...vCreateVerificationCodeArgs.fields
+}), v.object({
+	type: v.literal("createAccountFromCredentials"),
+	...vCreateAccountFromCredentialsArgs.fields
+}), v.object({
+	type: v.literal("retrieveAccountWithCredentials"),
+	...vRetrieveAccountWithCredentialsArgs.fields
+}), v.object({
+	type: v.literal("credentialsSignIn"),
+	...vCredentialsSignInArgs.fields
+}), v.object({
+	type: v.literal("modifyAccount"),
+	...vModifyAccountArgs.fields
+}), v.object({
+	type: v.literal("invalidateSessions"),
+	...vInvalidateSessionsArgs.fields
+})) });
+const storeImpl = async (ctx, fnArgs, services) => {
+	const args = fnArgs.args;
+	const config = services.config;
+	const getProviderOrThrow = services.providerRegistry.getProviderOrThrow;
+	if (args.type !== "refreshSession") log(LOG_LEVELS.DEBUG, `\`auth:store\` type: ${args.type}`);
+	const handler = {
+		signIn: (a) => signInSessionImpl(ctx, a, config),
+		signOut: () => signOutImpl(ctx, config),
+		refreshSession: (a) => refreshSessionImpl(ctx, a, config),
+		verifyCodeAndSignIn: (a) => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
+		verifier: (a) => verifierImpl(ctx, a, config),
+		verifierSignature: (a) => verifierSignatureImpl(ctx, a, config),
+		userOAuth: (a) => userOAuthImpl(ctx, a, getProviderOrThrow, config),
+		createVerificationCode: (a) => createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
+		createAccountFromCredentials: (a) => createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),
+		retrieveAccountWithCredentials: (a) => retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
+		credentialsSignIn: (a) => credentialsSignInImpl(ctx, a, getProviderOrThrow, config),
+		modifyAccount: (a) => modifyAccountImpl(ctx, a, getProviderOrThrow, config),
+		invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config)
+	}[args.type];
+	if (!handler) throw new Error(`Unknown store type: "${args.type}"`);
+	return await handler(args);
+};
+
+//#endregion
+export { storeImpl, vStoreArgs };
+//# sourceMappingURL=store.js.map

package/dist/server/mutations/verifier.js

@@ -0,0 +1,25 @@
+import { authDb } from "../db.js";
+import { getAuthSessionId } from "../session/lifecycle.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/verifier.ts
+const vVerifierArgs = v.object({
+	signature: v.optional(v.string()),
+	expirationTime: v.optional(v.number())
+});
+async function verifierImpl(ctx, args, config) {
+	const sessionId = await getAuthSessionId(ctx);
+	return await authDb(ctx, config).verifiers.create(sessionId ?? void 0, args.signature, args.expirationTime);
+}
+const callVerifier = async (ctx, signature, expirationTime) => {
+	return ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "verifier",
+		...signature === void 0 ? {} : { signature },
+		...expirationTime === void 0 ? {} : { expirationTime }
+	} });
+};
+
+//#endregion
+export { callVerifier, vVerifierArgs, verifierImpl };
+//# sourceMappingURL=verifier.js.map

package/dist/server/mutations/verify.js

@@ -0,0 +1,199 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { requireEnv } from "../env.js";
+import { sha256 } from "../random.js";
+import { queueAuthEvent } from "../events.js";
+import { log } from "../log.js";
+import { encodeRefreshToken, refreshTokenExpirationTime } from "../token/refresh.js";
+import { setActiveSpanAttributes, withSpan } from "../utils/span.js";
+import { buildSessionIdentity, finalizeSessionIssuance, getAuthSessionId, sessionExpirationTime } from "../session/lifecycle.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { upsertUserAndAccount } from "../user/account.js";
+import { maxSignInAttempts } from "../limits.js";
+import { buildKnownSignInIdentityAttributes } from "../telemetry.js";
+import { vPayloadRecord } from "../payloads.js";
+import { isGroupProviderId } from "../connection/shared.js";
+import { createSyntheticOAuthMaterializedConfig } from "../connection/oidc.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/verify.ts
+const vVerifyCodeAndSignInArgs = v.object({
+	params: vPayloadRecord,
+	provider: v.optional(v.string()),
+	verifier: v.optional(v.string()),
+	generateTokens: v.boolean(),
+	allowExtraProviders: v.boolean()
+});
+async function verifyCodeAndSignInImpl(ctx, args, getProviderOrThrow, config) {
+	return withSpan("convex-auth.mutations.verifyCodeAndSignIn", {
+		provider: args.provider ?? "",
+		generateTokens: args.generateTokens
+	}, () => verifyCodeAndSignInImplInner(ctx, args, getProviderOrThrow, config));
+}
+async function verifyCodeAndSignInImplInner(ctx, args, getProviderOrThrow, config) {
+	const params = args.params;
+	const { generateTokens, provider, allowExtraProviders } = args;
+	const identifier = typeof params.email === "string" ? params.email : typeof params.phone === "string" ? params.phone : void 0;
+	let resolvedAccountId;
+	try {
+		log(LOG_LEVELS.DEBUG, "verifyCodeAndSignInImpl args:", {
+			params: {
+				email: params.email,
+				phone: params.phone
+			},
+			provider: args.provider,
+			verifier: args.verifier,
+			generateTokens: args.generateTokens,
+			allowExtraProviders: args.allowExtraProviders
+		});
+		if (generateTokens) {
+			requireEnv("JWT_PRIVATE_KEY");
+			requireEnv("JWKS");
+			requireEnv("CONVEX_SITE_URL");
+		}
+		const verifier = args.verifier;
+		const codeValue = params.code;
+		const hash = await sha256(typeof codeValue === "string" ? codeValue : "__invalid_verification_code__");
+		const begun = await ctx.runMutation(config.component.token.verification.beginVerification, {
+			code: hash,
+			identifier,
+			verifier,
+			provider,
+			maxAttemptsPerHour: maxSignInAttempts(config),
+			now: Date.now()
+		});
+		if (typeof codeValue !== "string" || begun.status !== "ready") throw new VerifyFailure(begun.status === "limited" ? "Too many failed attempts to verify code" : "Invalid code");
+		const { code, account } = begun;
+		resolvedAccountId = account._id;
+		const codeProvider = isGroupProviderId(code.provider) ? createSyntheticOAuthMaterializedConfig(code.provider) : getProviderOrThrow(code.provider, allowExtraProviders);
+		if (codeProvider !== null && (codeProvider.type === "email" || codeProvider.type === "phone") && codeProvider.authorize !== void 0) await codeProvider.authorize(params, account);
+		const methodProvider = isGroupProviderId(account.provider) ? createSyntheticOAuthMaterializedConfig(account.provider) : getProviderOrThrow(account.provider);
+		const replaceSessionId = await getAuthSessionId(ctx);
+		const userId = methodProvider.type === "oauth" ? account.userId : (await upsertUserAndAccount(ctx, replaceSessionId, { existingAccount: account }, {
+			type: "verification",
+			provider: methodProvider,
+			profile: {
+				...code.emailVerified !== void 0 ? {
+					email: code.emailVerified,
+					emailVerified: true
+				} : {},
+				...code.phoneVerified !== void 0 ? {
+					phone: code.phoneVerified,
+					phoneVerified: true
+				} : {}
+			}
+		}, config)).userId;
+		const completed = await ctx.runMutation(config.component.token.verification.completeVerification, {
+			codeId: code._id,
+			userId,
+			identifier,
+			replaceSessionId: replaceSessionId ?? void 0,
+			generateTokens,
+			sessionExpirationTime: sessionExpirationTime(config),
+			refreshTokenExpirationTime: refreshTokenExpirationTime(config)
+		});
+		if (completed.status !== "accepted") throw new VerifyFailure("Invalid code");
+		const typedUserId = completed.user._id;
+		const sessionId = completed.sessionId;
+		setActiveSpanAttributes({
+			"auth.signin.result": "success",
+			...buildKnownSignInIdentityAttributes(config, {
+				userId: typedUserId,
+				sessionId
+			}, completed.user.email)
+		});
+		if (completed.replacedSessionId !== void 0) {
+			const replacedSessionId = completed.replacedSessionId;
+			await queueAuthEvent(ctx, config, {
+				kind: "session.invalidated",
+				actor: { type: "system" },
+				subject: {
+					type: "session",
+					id: replacedSessionId
+				},
+				targets: [{
+					kind: "user",
+					id: typedUserId
+				}, {
+					kind: "session",
+					id: replacedSessionId
+				}],
+				outcome: "success",
+				data: {
+					userId: typedUserId,
+					reason: "replaced"
+				}
+			});
+		}
+		await queueAuthEvent(ctx, config, {
+			kind: "session.signed_in",
+			actor: {
+				type: "user",
+				id: typedUserId
+			},
+			subject: {
+				type: "session",
+				id: sessionId
+			},
+			targets: [{
+				kind: "user",
+				id: typedUserId
+			}, {
+				kind: "session",
+				id: sessionId
+			}],
+			outcome: "success",
+			data: { provider: code.provider }
+		});
+		const refreshTokenId = completed.refreshTokenId;
+		return {
+			userId: typedUserId,
+			sessionId,
+			identity: buildSessionIdentity(typedUserId, sessionId, completed.user),
+			refreshToken: generateTokens && refreshTokenId !== void 0 ? encodeRefreshToken(refreshTokenId, sessionId) : null
+		};
+	} catch (error) {
+		if (error instanceof VerifyFailure) {
+			log(LOG_LEVELS.ERROR, error.reason);
+			return null;
+		}
+		if (resolvedAccountId !== void 0) try {
+			await ctx.runMutation(config.component.token.verification.resetVerificationLimits, {
+				accountId: resolvedAccountId,
+				identifier
+			});
+		} catch (resetError) {
+			log(LOG_LEVELS.ERROR, "Failed to refund verification rate limit", resetError);
+		}
+		throw error;
+	}
+}
+/** A soft verification failure -- logged and collapsed to null at the boundary. */
+var VerifyFailure = class extends Error {
+	_tag = "VerifyFailure";
+	reason;
+	constructor(reason) {
+		super(reason);
+		this.reason = reason;
+		this.name = "VerifyFailure";
+	}
+};
+/**
+* Run the verify-code-and-sign-in mutation, then sign the JWT on the action
+* side. See {@link callSignIn} for the rationale — the mutation returns
+* `SessionIssuance` (cheap string-encoded refresh token + IDs), and this
+* wrapper does the RSA-2048 work outside the mutation transaction.
+*
+* @internal
+*/
+const callVerifyCodeAndSignIn = async (ctx, args) => {
+	const issuance = await ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "verifyCodeAndSignIn",
+		...args
+	} });
+	if (issuance === null) return null;
+	return await finalizeSessionIssuance(ctx.auth.config, issuance);
+};
+
+//#endregion
+export { callVerifyCodeAndSignIn, vVerifyCodeAndSignInArgs, verifyCodeAndSignInImpl };
+//# sourceMappingURL=verify.js.map