@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/wellknown.d.ts

@@ -0,0 +1,74 @@
+//#region src/server/wellknown.d.ts
+/**
+ * Content generator for cross-platform `.well-known` endpoints.
+ *
+ * The helper produces the exact response shape expected by Apple, Google,
+ * browsers, and password managers. It reads convention env vars but accepts
+ * explicit overrides; if an endpoint is not configured, it returns `null` so
+ * the caller can serve a 404.
+ *
+ * These endpoints must be reachable from the public app/RP ID origin at root
+ * `/.well-known/*`. `auth.http()` serves them from Convex; apps using a
+ * separate frontend domain should route those root paths to Convex or adapt
+ * this helper in their framework route handlers.
+ *
+ * @module
+ */
+/** Uniform shape returned by the well-known helper. Adapt to any framework. */
+type WellKnownResponse = {
+  status: number;
+  headers: Record<string, string>;
+  body: string;
+};
+/** Supported `/.well-known/*` endpoint names, without the `/.well-known/` prefix. */
+type WellKnownEndpoint = "apple-app-site-association" | "assetlinks.json" | "webauthn" | "security.txt" | "change-password";
+/** Explicit per-endpoint overrides for {@link wellKnown}, bypassing env vars. */
+type WellKnownOptions = {
+  /** Options for `/.well-known/apple-app-site-association`. */appleAppSiteAssociation?: {
+    /** Override `IOS_APP_IDS`; e.g., `["ABC123DEF.com.example.app"]`. */appIds?: string[]; /** Override `IOS_APPLINK_PATHS`; default `["/auth/*", "/callback/*"]`. */
+    applinkPaths?: string[];
+  }; /** Options for `/.well-known/assetlinks.json`. */
+  assetLinks?: {
+    apps?: Array<{
+      packageName: string;
+      sha256Fingerprints: string[];
+    }>;
+  }; /** Options for `/.well-known/security.txt`. */
+  securityTxt?: {
+    /** Override `SECURITY_CONTACT`. Should be a `mailto:` or `https:` URI. */contact?: string; /** Override `SECURITY_TXT_EXPIRES_DAYS`. Default 365 days from now. */
+    expiresInDays?: number; /** RFC 5646 language tags, e.g., `["en"]`. */
+    preferredLanguages?: string[]; /** Optional canonical URL of the security.txt file (for signed copies). */
+    canonical?: string; /** Optional public key URL for encrypted reports. */
+    encryption?: string; /** Optional acknowledgments URL. */
+    acknowledgments?: string; /** Optional policy URL. */
+    policy?: string; /** Optional hiring URL. */
+    hiring?: string;
+  }; /** Options for `/.well-known/change-password`. */
+  changePassword?: {
+    /** Override `CHANGE_PASSWORD_URL`. */targetUrl?: string;
+  };
+};
+/**
+ * Generate a standard `/.well-known/*` response.
+ *
+ * @param endpoint The well-known endpoint name, without the `/.well-known/` prefix.
+ * @param options Optional explicit configuration. When omitted, the helper reads
+ * convention environment variables for the selected endpoint.
+ * @returns A framework-neutral response descriptor, or `null` when the endpoint
+ * is not configured.
+ *
+ * @example
+ * ```ts
+ * import { wellKnown } from "@estifanos-sh/convex-auth/server";
+ *
+ * export const GET = () => {
+ *   const r = wellKnown("assetlinks.json");
+ *   if (r === null) return new Response(null, { status: 404 });
+ *   return new Response(r.body, { status: r.status, headers: r.headers });
+ * };
+ * ```
+ */
+declare function wellKnown(endpoint: WellKnownEndpoint, options?: WellKnownOptions): WellKnownResponse | null;
+//#endregion
+export { WellKnownEndpoint, WellKnownOptions, WellKnownResponse, wellKnown };
+//# sourceMappingURL=wellknown.d.ts.map

package/dist/server/wellknown.js

@@ -0,0 +1,195 @@
+import { envOptionalNumber, envOptionalString } from "./env.js";
+import { appUrlFromEnv } from "./url.js";
+
+//#region src/server/wellknown.ts
+/**
+* Content generator for cross-platform `.well-known` endpoints.
+*
+* The helper produces the exact response shape expected by Apple, Google,
+* browsers, and password managers. It reads convention env vars but accepts
+* explicit overrides; if an endpoint is not configured, it returns `null` so
+* the caller can serve a 404.
+*
+* These endpoints must be reachable from the public app/RP ID origin at root
+* `/.well-known/*`. `auth.http()` serves them from Convex; apps using a
+* separate frontend domain should route those root paths to Convex or adapt
+* this helper in their framework route handlers.
+*
+* @module
+*/
+const STATIC_CACHE = "public, max-age=300, stale-while-revalidate=3600, stale-if-error=86400";
+function parseList(value) {
+	if (value === void 0) return [];
+	return value.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
+}
+function ok(body, contentType) {
+	return {
+		status: 200,
+		headers: {
+			"Content-Type": contentType,
+			"Cache-Control": STATIC_CACHE
+		},
+		body
+	};
+}
+function appleAppSiteAssociationResponse(opts) {
+	const appIds = opts?.appIds ?? parseList(envOptionalString("IOS_APP_IDS"));
+	if (appIds.length === 0) return null;
+	const applinkPaths = opts?.applinkPaths ?? parseList(envOptionalString("IOS_APPLINK_PATHS"));
+	const components = applinkPaths.length > 0 ? applinkPaths.map((path) => ({ "/": path })) : [{ "/": "/auth/*" }, { "/": "/callback/*" }];
+	return ok(JSON.stringify({
+		applinks: { details: [{
+			appIDs: appIds,
+			components
+		}] },
+		webcredentials: { apps: appIds }
+	}), "application/json");
+}
+/**
+* Generate `/.well-known/assetlinks.json` content for Android.
+*
+* Required for Android Credential Manager to surface passkeys for the app,
+* and for App Link verification (`autoVerify="true"` intent filters). Google
+* fetches this file from the WebAuthn RP ID host.
+*
+* Reads {@link ANDROID_APP_LINKS} in the format
+* `package1:FP1:FP2;package2:FP1:FP2` where each fingerprint is a colon-
+* separated SHA-256 hex string. Use `;` between apps and `:` to separate
+* package name from fingerprints (and fingerprints share the standard
+* `AA:BB:CC:...` colon format — split on `:`, the first segment is the
+* package, the rest is the fingerprint reassembled).
+*
+* For programmatic config, prefer the `apps` option which avoids parsing.
+*
+* @example Direct config
+* ```ts
+* wellKnown("assetlinks.json", { assetLinks: {
+*   apps: [{
+*     packageName: "com.example.app",
+*     sha256Fingerprints: ["AA:BB:CC:..."],
+*   }],
+* }});
+* ```
+*/
+function assetLinksResponse(opts) {
+	const apps = opts?.apps ?? parseAndroidAppLinksEnv(envOptionalString("ANDROID_APP_LINKS"));
+	if (apps.length === 0) return null;
+	return ok(JSON.stringify(apps.map((app) => ({
+		relation: ["delegate_permission/common.get_login_creds", "delegate_permission/common.handle_all_urls"],
+		target: {
+			namespace: "android_app",
+			package_name: app.packageName,
+			sha256_cert_fingerprints: app.sha256Fingerprints
+		}
+	}))), "application/json");
+}
+function parseAndroidAppLinksEnv(raw) {
+	if (raw === void 0) return [];
+	const apps = [];
+	for (const entry of raw.split(";")) {
+		const trimmed = entry.trim();
+		if (trimmed.length === 0) continue;
+		const firstColon = trimmed.indexOf(":");
+		if (firstColon === -1) continue;
+		const packageName = trimmed.slice(0, firstColon).trim();
+		const fingerprintsRaw = trimmed.slice(firstColon + 1).trim();
+		if (packageName.length === 0 || fingerprintsRaw.length === 0) continue;
+		apps.push({
+			packageName,
+			sha256Fingerprints: [fingerprintsRaw]
+		});
+	}
+	return apps;
+}
+/**
+* Generate `/.well-known/webauthn` content (W3C WebAuthn Level 3).
+*
+* The happy path is the app's single frontend origin. Multi-origin RP support
+* should be handled explicitly by the app instead of hidden deployment envs.
+*/
+function webAuthnResponse() {
+	let appUrl;
+	try {
+		appUrl = appUrlFromEnv();
+	} catch {
+		return null;
+	}
+	return ok(JSON.stringify({ origins: [appUrl] }), "application/json");
+}
+/**
+* Generate `/.well-known/security.txt` content (RFC 9116).
+*
+* Plain-text contact info for security researchers. Reads {@link SECURITY_CONTACT}
+* (e.g., `mailto:security@example.com` or `https://example.com/security`) and
+* optional {@link SECURITY_TXT_EXPIRES_DAYS} (default 365).
+*/
+function securityTxtResponse(opts) {
+	const contact = opts?.contact ?? envOptionalString("SECURITY_CONTACT");
+	if (contact === void 0 || contact.length === 0) return null;
+	const days = opts?.expiresInDays ?? envOptionalNumber("SECURITY_TXT_EXPIRES_DAYS") ?? 365;
+	const expires = new Date(Date.now() + days * 24 * 60 * 60 * 1e3).toISOString();
+	const lines = [`Contact: ${contact}`, `Expires: ${expires}`];
+	const langs = opts?.preferredLanguages;
+	if (langs && langs.length > 0) lines.push(`Preferred-Languages: ${langs.join(", ")}`);
+	if (opts?.canonical) lines.push(`Canonical: ${opts.canonical}`);
+	if (opts?.encryption) lines.push(`Encryption: ${opts.encryption}`);
+	if (opts?.acknowledgments) lines.push(`Acknowledgments: ${opts.acknowledgments}`);
+	if (opts?.policy) lines.push(`Policy: ${opts.policy}`);
+	if (opts?.hiring) lines.push(`Hiring: ${opts.hiring}`);
+	return ok(`${lines.join("\n")}\n`, "text/plain; charset=utf-8");
+}
+/**
+* Generate a 302 redirect for `/.well-known/change-password` (RFC 8615).
+*
+* Password managers (1Password, iCloud Keychain, Bitwarden, Chrome) deep-link
+* here when the user picks "Change password". The route should redirect to
+* the actual change-password UI in your app.
+*
+* Reads {@link CHANGE_PASSWORD_URL}.
+*/
+function changePasswordResponse(opts) {
+	const target = opts?.targetUrl ?? envOptionalString("CHANGE_PASSWORD_URL");
+	if (target === void 0 || target.length === 0) return null;
+	return {
+		status: 302,
+		headers: {
+			Location: target,
+			"Cache-Control": "public, max-age=300"
+		},
+		body: ""
+	};
+}
+/**
+* Generate a standard `/.well-known/*` response.
+*
+* @param endpoint The well-known endpoint name, without the `/.well-known/` prefix.
+* @param options Optional explicit configuration. When omitted, the helper reads
+* convention environment variables for the selected endpoint.
+* @returns A framework-neutral response descriptor, or `null` when the endpoint
+* is not configured.
+*
+* @example
+* ```ts
+* import { wellKnown } from "@estifanos-sh/convex-auth/server";
+*
+* export const GET = () => {
+*   const r = wellKnown("assetlinks.json");
+*   if (r === null) return new Response(null, { status: 404 });
+*   return new Response(r.body, { status: r.status, headers: r.headers });
+* };
+* ```
+*/
+function wellKnown(endpoint, options) {
+	return WELL_KNOWN_HANDLERS[endpoint](options);
+}
+const WELL_KNOWN_HANDLERS = {
+	"apple-app-site-association": (options) => appleAppSiteAssociationResponse(options?.appleAppSiteAssociation),
+	"assetlinks.json": (options) => assetLinksResponse(options?.assetLinks),
+	webauthn: () => webAuthnResponse(),
+	"security.txt": (options) => securityTxtResponse(options?.securityTxt),
+	"change-password": (options) => changePasswordResponse(options?.changePassword)
+};
+
+//#endregion
+export { wellKnown };
+//# sourceMappingURL=wellknown.js.map

package/dist/shared/brand.d.ts

@@ -0,0 +1,28 @@
+//#region src/shared/brand.d.ts
+/**
+ * Nominal ("branded") types. `Brand<string, "X">` is a `string` at runtime but
+ * is only assignable FROM a `string` via an explicit cast, so the compiler
+ * stops you from mixing values that share a primitive shape but not a meaning —
+ * an access token vs a refresh token, a raw secret vs its hash, a user-supplied
+ * code vs an internal one. Brands erase at runtime (zero cost).
+ *
+ * @module
+ */
+declare const brand: unique symbol;
+/** Tag a base type `T` with a compile-time-only nominal `Tag`. */
+type Brand<T, Tag extends string> = T & {
+  readonly [brand]: Tag;
+};
+/** Opaque encoded refresh token — `${refreshTokenId}|${sessionId}`. */
+type RefreshToken = Brand<string, "RefreshToken">;
+/**
+ * A one-way hash of some plaintext `TOf` (e.g. `Hashed<"Password">`,
+ * `Hashed<"ApiKeySecret">`, `Hashed<"VerificationCode">`). Distinct from the
+ * plaintext it was derived from so the two can't be swapped at a boundary.
+ */
+type Hashed<TOf extends string> = Brand<string, `Hashed:${TOf}`>;
+/** AES-GCM ciphertext produced by `encryptSecret` (`${iv}.${payload}`). */
+type EncryptedSecret = Brand<string, "EncryptedSecret">;
+//#endregion
+export { EncryptedSecret, Hashed, RefreshToken };
+//# sourceMappingURL=brand.d.ts.map

package/dist/shared/brand.js

@@ -0,0 +1,13 @@
+//#region src/shared/brand.ts
+/**
+* Exhaustiveness guard for discriminated unions. Put it in the `default`
+* branch (or after an `if`/`switch` chain) so adding a new variant becomes a
+* compile error until every case is handled.
+*/
+function assertNever(value, message = "Unhandled case") {
+	throw new Error(`${message}: ${String(value)}`);
+}
+
+//#endregion
+export { assertNever };
+//# sourceMappingURL=brand.js.map

package/dist/shared/codes.d.ts

@@ -0,0 +1,99 @@
+//#region src/shared/codes.d.ts
+/**
+ * Centralized registry of every `ConvexError` code thrown by the auth
+ * package. Use `ErrorCode.<NAME>` instead of inline string literals so
+ * typos surface at compile time and consumers can pattern-match on the
+ * union type.
+ *
+ * Naming: SCREAMING_SNAKE_CASE, scoped by domain prefix where useful
+ * (e.g. `OAUTH_*`, `INVITE_*`, `API_KEY_*`).
+ *
+ * @module
+ */
+declare const ErrorCode: {
+  readonly INTERNAL_ERROR: "INTERNAL_ERROR";
+  readonly INVALID_PARAMETERS: "INVALID_PARAMETERS";
+  readonly INVALID_REDIRECT: "INVALID_REDIRECT";
+  readonly FORBIDDEN: "FORBIDDEN";
+  readonly NOT_AUTHORIZED: "NOT_AUTHORIZED";
+  readonly NOT_SIGNED_IN: "NOT_SIGNED_IN";
+  readonly RATE_LIMITED: "RATE_LIMITED";
+  readonly MISSING_ENV_VAR: "MISSING_ENV_VAR";
+  readonly CASCADE_TOO_LARGE: "CASCADE_TOO_LARGE";
+  readonly PROVIDER_NOT_CONFIGURED: "PROVIDER_NOT_CONFIGURED";
+  readonly INVALID_CREDENTIALS_PROVIDER: "INVALID_CREDENTIALS_PROVIDER";
+  readonly MISSING_CRYPTO_FUNCTION: "MISSING_CRYPTO_FUNCTION";
+  readonly ACCOUNT_ALREADY_LINKED: "ACCOUNT_ALREADY_LINKED";
+  readonly ACCOUNT_NOT_FOUND: "ACCOUNT_NOT_FOUND";
+  readonly AMBIGUOUS_USER_LINK: "AMBIGUOUS_USER_LINK";
+  readonly USER_UPDATE_FAILED: "USER_UPDATE_FAILED";
+  readonly INVALID_CREDENTIALS: "INVALID_CREDENTIALS";
+  readonly INVALID_VERIFIER: "INVALID_VERIFIER";
+  readonly VERIFICATION_CODE_COLLISION: "VERIFICATION_CODE_COLLISION";
+  readonly API_KEY_EXPIRED: "API_KEY_EXPIRED";
+  readonly API_KEY_RATE_LIMITED: "API_KEY_RATE_LIMITED";
+  readonly API_KEY_REVOKED: "API_KEY_REVOKED";
+  readonly INVALID_API_KEY: "INVALID_API_KEY";
+  readonly KEY_NOT_FOUND: "KEY_NOT_FOUND";
+  readonly MISSING_BEARER_TOKEN: "MISSING_BEARER_TOKEN";
+  readonly SCOPE_CHECK_FAILED: "SCOPE_CHECK_FAILED";
+  readonly INVALID_REFRESH_TOKEN: "INVALID_REFRESH_TOKEN";
+  readonly OAUTH_CLIENT_NOT_FOUND: "OAUTH_CLIENT_NOT_FOUND";
+  readonly OAUTH_CODE_ALREADY_USED: "OAUTH_CODE_ALREADY_USED";
+  readonly OAUTH_CODE_EXPIRED: "OAUTH_CODE_EXPIRED";
+  readonly OAUTH_GRANT_TYPE_NOT_ALLOWED: "OAUTH_GRANT_TYPE_NOT_ALLOWED";
+  readonly OAUTH_INVALID_PROFILE: "OAUTH_INVALID_PROFILE";
+  readonly OAUTH_INVALID_REFRESH_TOKEN: "OAUTH_INVALID_REFRESH_TOKEN";
+  readonly OAUTH_INVALID_STATE: "OAUTH_INVALID_STATE";
+  readonly OAUTH_MISSING_PROVIDER: "OAUTH_MISSING_PROVIDER";
+  readonly OAUTH_MISSING_VERIFIER: "OAUTH_MISSING_VERIFIER";
+  readonly OAUTH_PROVIDER_ERROR: "OAUTH_PROVIDER_ERROR";
+  readonly OAUTH_REDIRECT_URI_MISMATCH: "OAUTH_REDIRECT_URI_MISMATCH";
+  readonly OAUTH_SCOPE_NOT_ALLOWED: "OAUTH_SCOPE_NOT_ALLOWED";
+  readonly DEVICE_AUTHORIZATION_FAILED: "DEVICE_AUTHORIZATION_FAILED";
+  readonly DEVICE_CODE_EXPIRED: "DEVICE_CODE_EXPIRED";
+  readonly PASSKEY_NOT_FOUND: "PASSKEY_NOT_FOUND";
+  readonly PASSKEY_AUTH_REQUIRED: "PASSKEY_AUTH_REQUIRED";
+  readonly PASSKEY_COUNTER_ERROR: "PASSKEY_COUNTER_ERROR";
+  readonly PASSKEY_INVALID_CHALLENGE: "PASSKEY_INVALID_CHALLENGE";
+  readonly PASSKEY_INVALID_CLIENT_DATA: "PASSKEY_INVALID_CLIENT_DATA";
+  readonly PASSKEY_INVALID_ORIGIN: "PASSKEY_INVALID_ORIGIN";
+  readonly PASSKEY_INVALID_SIGNATURE: "PASSKEY_INVALID_SIGNATURE";
+  readonly PASSKEY_INVALID_VERIFY: "PASSKEY_INVALID_VERIFY";
+  readonly PASSKEY_MISSING_CONFIG: "PASSKEY_MISSING_CONFIG";
+  readonly PASSKEY_MISSING_FLOW: "PASSKEY_MISSING_FLOW";
+  readonly PASSKEY_MISSING_VERIFIER: "PASSKEY_MISSING_VERIFIER";
+  readonly PASSKEY_NO_CREDENTIAL: "PASSKEY_NO_CREDENTIAL";
+  readonly PASSKEY_RP_MISMATCH: "PASSKEY_RP_MISMATCH";
+  readonly PASSKEY_UNKNOWN_CREDENTIAL: "PASSKEY_UNKNOWN_CREDENTIAL";
+  readonly PASSKEY_UNTRUSTED_ATTESTATION: "PASSKEY_UNTRUSTED_ATTESTATION";
+  readonly PASSKEY_UNSUPPORTED_ALGORITHM: "PASSKEY_UNSUPPORTED_ALGORITHM";
+  readonly PASSKEY_USER_PRESENCE: "PASSKEY_USER_PRESENCE";
+  readonly PASSKEY_USER_VERIFICATION: "PASSKEY_USER_VERIFICATION";
+  readonly TOTP_NOT_FOUND: "TOTP_NOT_FOUND";
+  readonly TOTP_ALREADY_VERIFIED: "TOTP_ALREADY_VERIFIED";
+  readonly TOTP_AUTH_REQUIRED: "TOTP_AUTH_REQUIRED";
+  readonly TOTP_INVALID_CODE: "TOTP_INVALID_CODE";
+  readonly TOTP_INVALID_VERIFIER: "TOTP_INVALID_VERIFIER";
+  readonly TOTP_MISSING_CODE: "TOTP_MISSING_CODE";
+  readonly TOTP_MISSING_FLOW: "TOTP_MISSING_FLOW";
+  readonly TOTP_MISSING_VERIFIER: "TOTP_MISSING_VERIFIER";
+  readonly TOTP_NO_ENROLLMENT: "TOTP_NO_ENROLLMENT";
+  readonly DUPLICATE_INVITE: "DUPLICATE_INVITE";
+  readonly DUPLICATE_MEMBERSHIP: "DUPLICATE_MEMBERSHIP";
+  readonly INVITE_ALREADY_ACCEPTED: "INVITE_ALREADY_ACCEPTED";
+  readonly INVITE_EMAIL_MISMATCH: "INVITE_EMAIL_MISMATCH";
+  readonly INVITE_EXPIRED: "INVITE_EXPIRED";
+  readonly INVITE_NOT_FOUND: "INVITE_NOT_FOUND";
+  readonly INVITE_NOT_PENDING: "INVITE_NOT_PENDING";
+  readonly INVALID_ROLE_IDS: "INVALID_ROLE_IDS";
+  readonly MISSING_GRANTS: "MISSING_GRANTS";
+  readonly NO_ACTIVE_GROUP: "NO_ACTIVE_GROUP";
+  readonly NOT_A_MEMBER: "NOT_A_MEMBER";
+  readonly GROUP_CONNECTION_DOMAIN_TAKEN: "GROUP_CONNECTION_DOMAIN_TAKEN";
+};
+/** Union of every {@link ErrorCode} value. */
+type ErrorCode = (typeof ErrorCode)[keyof typeof ErrorCode];
+//#endregion
+export { ErrorCode };
+//# sourceMappingURL=codes.d.ts.map

package/dist/shared/codes.js

@@ -0,0 +1,98 @@
+//#region src/shared/codes.ts
+/**
+* Centralized registry of every `ConvexError` code thrown by the auth
+* package. Use `ErrorCode.<NAME>` instead of inline string literals so
+* typos surface at compile time and consumers can pattern-match on the
+* union type.
+*
+* Naming: SCREAMING_SNAKE_CASE, scoped by domain prefix where useful
+* (e.g. `OAUTH_*`, `INVITE_*`, `API_KEY_*`).
+*
+* @module
+*/
+const ErrorCode = {
+	INTERNAL_ERROR: "INTERNAL_ERROR",
+	INVALID_PARAMETERS: "INVALID_PARAMETERS",
+	INVALID_REDIRECT: "INVALID_REDIRECT",
+	FORBIDDEN: "FORBIDDEN",
+	NOT_AUTHORIZED: "NOT_AUTHORIZED",
+	NOT_SIGNED_IN: "NOT_SIGNED_IN",
+	RATE_LIMITED: "RATE_LIMITED",
+	MISSING_ENV_VAR: "MISSING_ENV_VAR",
+	CASCADE_TOO_LARGE: "CASCADE_TOO_LARGE",
+	PROVIDER_NOT_CONFIGURED: "PROVIDER_NOT_CONFIGURED",
+	INVALID_CREDENTIALS_PROVIDER: "INVALID_CREDENTIALS_PROVIDER",
+	MISSING_CRYPTO_FUNCTION: "MISSING_CRYPTO_FUNCTION",
+	ACCOUNT_ALREADY_LINKED: "ACCOUNT_ALREADY_LINKED",
+	ACCOUNT_NOT_FOUND: "ACCOUNT_NOT_FOUND",
+	AMBIGUOUS_USER_LINK: "AMBIGUOUS_USER_LINK",
+	USER_UPDATE_FAILED: "USER_UPDATE_FAILED",
+	INVALID_CREDENTIALS: "INVALID_CREDENTIALS",
+	INVALID_VERIFIER: "INVALID_VERIFIER",
+	VERIFICATION_CODE_COLLISION: "VERIFICATION_CODE_COLLISION",
+	API_KEY_EXPIRED: "API_KEY_EXPIRED",
+	API_KEY_RATE_LIMITED: "API_KEY_RATE_LIMITED",
+	API_KEY_REVOKED: "API_KEY_REVOKED",
+	INVALID_API_KEY: "INVALID_API_KEY",
+	KEY_NOT_FOUND: "KEY_NOT_FOUND",
+	MISSING_BEARER_TOKEN: "MISSING_BEARER_TOKEN",
+	SCOPE_CHECK_FAILED: "SCOPE_CHECK_FAILED",
+	INVALID_REFRESH_TOKEN: "INVALID_REFRESH_TOKEN",
+	OAUTH_CLIENT_NOT_FOUND: "OAUTH_CLIENT_NOT_FOUND",
+	OAUTH_CODE_ALREADY_USED: "OAUTH_CODE_ALREADY_USED",
+	OAUTH_CODE_EXPIRED: "OAUTH_CODE_EXPIRED",
+	OAUTH_GRANT_TYPE_NOT_ALLOWED: "OAUTH_GRANT_TYPE_NOT_ALLOWED",
+	OAUTH_INVALID_PROFILE: "OAUTH_INVALID_PROFILE",
+	OAUTH_INVALID_REFRESH_TOKEN: "OAUTH_INVALID_REFRESH_TOKEN",
+	OAUTH_INVALID_STATE: "OAUTH_INVALID_STATE",
+	OAUTH_MISSING_PROVIDER: "OAUTH_MISSING_PROVIDER",
+	OAUTH_MISSING_VERIFIER: "OAUTH_MISSING_VERIFIER",
+	OAUTH_PROVIDER_ERROR: "OAUTH_PROVIDER_ERROR",
+	OAUTH_REDIRECT_URI_MISMATCH: "OAUTH_REDIRECT_URI_MISMATCH",
+	OAUTH_SCOPE_NOT_ALLOWED: "OAUTH_SCOPE_NOT_ALLOWED",
+	DEVICE_AUTHORIZATION_FAILED: "DEVICE_AUTHORIZATION_FAILED",
+	DEVICE_CODE_EXPIRED: "DEVICE_CODE_EXPIRED",
+	PASSKEY_NOT_FOUND: "PASSKEY_NOT_FOUND",
+	PASSKEY_AUTH_REQUIRED: "PASSKEY_AUTH_REQUIRED",
+	PASSKEY_COUNTER_ERROR: "PASSKEY_COUNTER_ERROR",
+	PASSKEY_INVALID_CHALLENGE: "PASSKEY_INVALID_CHALLENGE",
+	PASSKEY_INVALID_CLIENT_DATA: "PASSKEY_INVALID_CLIENT_DATA",
+	PASSKEY_INVALID_ORIGIN: "PASSKEY_INVALID_ORIGIN",
+	PASSKEY_INVALID_SIGNATURE: "PASSKEY_INVALID_SIGNATURE",
+	PASSKEY_INVALID_VERIFY: "PASSKEY_INVALID_VERIFY",
+	PASSKEY_MISSING_CONFIG: "PASSKEY_MISSING_CONFIG",
+	PASSKEY_MISSING_FLOW: "PASSKEY_MISSING_FLOW",
+	PASSKEY_MISSING_VERIFIER: "PASSKEY_MISSING_VERIFIER",
+	PASSKEY_NO_CREDENTIAL: "PASSKEY_NO_CREDENTIAL",
+	PASSKEY_RP_MISMATCH: "PASSKEY_RP_MISMATCH",
+	PASSKEY_UNKNOWN_CREDENTIAL: "PASSKEY_UNKNOWN_CREDENTIAL",
+	PASSKEY_UNTRUSTED_ATTESTATION: "PASSKEY_UNTRUSTED_ATTESTATION",
+	PASSKEY_UNSUPPORTED_ALGORITHM: "PASSKEY_UNSUPPORTED_ALGORITHM",
+	PASSKEY_USER_PRESENCE: "PASSKEY_USER_PRESENCE",
+	PASSKEY_USER_VERIFICATION: "PASSKEY_USER_VERIFICATION",
+	TOTP_NOT_FOUND: "TOTP_NOT_FOUND",
+	TOTP_ALREADY_VERIFIED: "TOTP_ALREADY_VERIFIED",
+	TOTP_AUTH_REQUIRED: "TOTP_AUTH_REQUIRED",
+	TOTP_INVALID_CODE: "TOTP_INVALID_CODE",
+	TOTP_INVALID_VERIFIER: "TOTP_INVALID_VERIFIER",
+	TOTP_MISSING_CODE: "TOTP_MISSING_CODE",
+	TOTP_MISSING_FLOW: "TOTP_MISSING_FLOW",
+	TOTP_MISSING_VERIFIER: "TOTP_MISSING_VERIFIER",
+	TOTP_NO_ENROLLMENT: "TOTP_NO_ENROLLMENT",
+	DUPLICATE_INVITE: "DUPLICATE_INVITE",
+	DUPLICATE_MEMBERSHIP: "DUPLICATE_MEMBERSHIP",
+	INVITE_ALREADY_ACCEPTED: "INVITE_ALREADY_ACCEPTED",
+	INVITE_EMAIL_MISMATCH: "INVITE_EMAIL_MISMATCH",
+	INVITE_EXPIRED: "INVITE_EXPIRED",
+	INVITE_NOT_FOUND: "INVITE_NOT_FOUND",
+	INVITE_NOT_PENDING: "INVITE_NOT_PENDING",
+	INVALID_ROLE_IDS: "INVALID_ROLE_IDS",
+	MISSING_GRANTS: "MISSING_GRANTS",
+	NO_ACTIVE_GROUP: "NO_ACTIVE_GROUP",
+	NOT_A_MEMBER: "NOT_A_MEMBER",
+	GROUP_CONNECTION_DOMAIN_TAKEN: "GROUP_CONNECTION_DOMAIN_TAKEN"
+};
+
+//#endregion
+export { ErrorCode };
+//# sourceMappingURL=codes.js.map

package/dist/shared/compare.js

@@ -0,0 +1,23 @@
+//#region src/shared/compare.ts
+/**
+* Constant-time comparisons for secret material.
+*
+* @module
+*/
+/**
+* Constant-time comparison for hex-encoded strings (e.g. SHA-256 hashes).
+*
+* Returns `false` for differing lengths and otherwise compares every character
+* without short-circuiting, so timing does not reveal how much of the input
+* matched.
+*/
+function constantTimeEqualHex(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+
+//#endregion
+export { constantTimeEqualHex };
+//# sourceMappingURL=compare.js.map

package/dist/shared/errors.js

@@ -0,0 +1,24 @@
+//#region src/shared/errors.ts
+/**
+* Sign-in flow error type shared between client and server.
+*
+* @module
+*/
+/** Error raised during a sign-in flow, carrying a machine-readable `code`. */
+var AuthFlowError = class extends Error {
+	code;
+	constructor({ code, message }) {
+		super(message);
+		this.code = code;
+		this.name = "AuthFlowError";
+	}
+};
+/** @internal */
+const authFlowError = (code, message) => new AuthFlowError({
+	code,
+	message
+});
+
+//#endregion
+export { AuthFlowError, authFlowError };
+//# sourceMappingURL=errors.js.map