@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/shared/event/kinds.d.ts

@@ -0,0 +1,188 @@
+//#region src/shared/event/kinds.d.ts
+/**
+ * Single source of truth for the auth event taxonomy.
+ *
+ * Every auth event kind and its category is declared once in {@link EVENT_KINDS}.
+ * The server ({@link file://../../server/events.ts}) derives the `AuthEventKind`
+ * TS union, the `EVENT_KIND_CATEGORY` map, and the compile-time-exhaustive
+ * handler selector table; the component ({@link file://../../component/model.ts})
+ * derives the `vAuthEventKind` / `vAuthEventCategory` validators. This module
+ * holds no Convex imports so both sides can import it without crossing the
+ * component/server boundary.
+ *
+ * @module
+ */
+declare const EVENT_CATEGORIES: readonly ["user", "session", "account", "password", "passkey", "totp", "email", "phone", "api_key", "oauth", "connection", "scim", "webhook", "security"];
+/** High-level category grouping for an auth event. */
+type AuthEventCategory = (typeof EVENT_CATEGORIES)[number];
+/**
+ * The auth event taxonomy: every emitted kind mapped to its category.
+ *
+ * This is the one place kinds and their categories are declared. Do not change
+ * which kinds exist or their categories without intent; this is the
+ * load-bearing audit taxonomy consumed by the projection, webhook dispatch,
+ * and every event handler.
+ */
+declare const EVENT_KINDS: {
+  readonly "user.created": {
+    readonly category: "user";
+  };
+  readonly "user.updated": {
+    readonly category: "user";
+  };
+  readonly "session.signed_in": {
+    readonly category: "session";
+  };
+  readonly "session.signed_out": {
+    readonly category: "session";
+  };
+  readonly "session.invalidated": {
+    readonly category: "session";
+  };
+  readonly "session.refresh_exchanged": {
+    readonly category: "session";
+  };
+  readonly "session.refresh_reuse_detected": {
+    readonly category: "session";
+  };
+  readonly "account.linked": {
+    readonly category: "account";
+  };
+  readonly "account.unlinked": {
+    readonly category: "account";
+  };
+  readonly "password.changed": {
+    readonly category: "password";
+  };
+  readonly "passkey.added": {
+    readonly category: "passkey";
+  };
+  readonly "passkey.removed": {
+    readonly category: "passkey";
+  };
+  readonly "totp.enrolled": {
+    readonly category: "totp";
+  };
+  readonly "totp.removed": {
+    readonly category: "totp";
+  };
+  readonly "email.verified": {
+    readonly category: "email";
+  };
+  readonly "phone.verified": {
+    readonly category: "phone";
+  };
+  readonly "api_key.created": {
+    readonly category: "api_key";
+  };
+  readonly "api_key.revoked": {
+    readonly category: "api_key";
+  };
+  readonly "oauth.client.created": {
+    readonly category: "oauth";
+  };
+  readonly "oauth.client.revoked": {
+    readonly category: "oauth";
+  };
+  readonly "oauth.code.created": {
+    readonly category: "oauth";
+  };
+  readonly "oauth.token.created": {
+    readonly category: "oauth";
+  };
+  readonly "oauth.token.exchanged": {
+    readonly category: "oauth";
+  };
+  readonly "oauth.refresh.reuse_detected": {
+    readonly category: "oauth";
+  };
+  readonly "oauth.refresh.revoked": {
+    readonly category: "oauth";
+  };
+  readonly "connection.created": {
+    readonly category: "connection";
+  };
+  readonly "connection.updated": {
+    readonly category: "connection";
+  };
+  readonly "connection.removed": {
+    readonly category: "connection";
+  };
+  readonly "connection.login.succeeded": {
+    readonly category: "connection";
+  };
+  readonly "connection.login.failed": {
+    readonly category: "connection";
+  };
+  readonly "connection.domain.verification_requested": {
+    readonly category: "connection";
+  };
+  readonly "connection.domain.verified": {
+    readonly category: "connection";
+  };
+  readonly "connection.policy.updated": {
+    readonly category: "connection";
+  };
+  readonly "connection.saml.set": {
+    readonly category: "connection";
+  };
+  readonly "connection.saml.refreshed": {
+    readonly category: "connection";
+  };
+  readonly "connection.oidc.set": {
+    readonly category: "connection";
+  };
+  readonly "connection.scim.set": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.read": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.user.provisioned": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.user.updated": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.user.deactivated": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.user.reactivated": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.group.provisioned": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.group.updated": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.group.deactivated": {
+    readonly category: "scim";
+  };
+  readonly "connection.scim.group.reactivated": {
+    readonly category: "scim";
+  };
+  readonly "webhook.endpoint.created": {
+    readonly category: "webhook";
+  };
+  readonly "webhook.endpoint.disabled": {
+    readonly category: "webhook";
+  };
+  readonly "webhook.delivery.created": {
+    readonly category: "webhook";
+  };
+  readonly "webhook.delivery.attempted": {
+    readonly category: "webhook";
+  };
+  readonly "webhook.delivery.succeeded": {
+    readonly category: "webhook";
+  };
+  readonly "webhook.delivery.failed": {
+    readonly category: "webhook";
+  };
+};
+/** Discriminator naming the specific auth event that occurred. */
+type AuthEventKind = keyof typeof EVENT_KINDS;
+//#endregion
+export { AuthEventCategory, AuthEventKind };
+//# sourceMappingURL=kinds.d.ts.map

package/dist/shared/event/kinds.js

@@ -0,0 +1,103 @@
+//#region src/shared/event/kinds.ts
+/**
+* Single source of truth for the auth event taxonomy.
+*
+* Every auth event kind and its category is declared once in {@link EVENT_KINDS}.
+* The server ({@link file://../../server/events.ts}) derives the `AuthEventKind`
+* TS union, the `EVENT_KIND_CATEGORY` map, and the compile-time-exhaustive
+* handler selector table; the component ({@link file://../../component/model.ts})
+* derives the `vAuthEventKind` / `vAuthEventCategory` validators. This module
+* holds no Convex imports so both sides can import it without crossing the
+* component/server boundary.
+*
+* @module
+*/
+const EVENT_CATEGORIES = [
+	"user",
+	"session",
+	"account",
+	"password",
+	"passkey",
+	"totp",
+	"email",
+	"phone",
+	"api_key",
+	"oauth",
+	"connection",
+	"scim",
+	"webhook",
+	"security"
+];
+/**
+* The auth event taxonomy: every emitted kind mapped to its category.
+*
+* This is the one place kinds and their categories are declared. Do not change
+* which kinds exist or their categories without intent; this is the
+* load-bearing audit taxonomy consumed by the projection, webhook dispatch,
+* and every event handler.
+*/
+const EVENT_KINDS = {
+	"user.created": { category: "user" },
+	"user.updated": { category: "user" },
+	"session.signed_in": { category: "session" },
+	"session.signed_out": { category: "session" },
+	"session.invalidated": { category: "session" },
+	"session.refresh_exchanged": { category: "session" },
+	"session.refresh_reuse_detected": { category: "session" },
+	"account.linked": { category: "account" },
+	"account.unlinked": { category: "account" },
+	"password.changed": { category: "password" },
+	"passkey.added": { category: "passkey" },
+	"passkey.removed": { category: "passkey" },
+	"totp.enrolled": { category: "totp" },
+	"totp.removed": { category: "totp" },
+	"email.verified": { category: "email" },
+	"phone.verified": { category: "phone" },
+	"api_key.created": { category: "api_key" },
+	"api_key.revoked": { category: "api_key" },
+	"oauth.client.created": { category: "oauth" },
+	"oauth.client.revoked": { category: "oauth" },
+	"oauth.code.created": { category: "oauth" },
+	"oauth.token.created": { category: "oauth" },
+	"oauth.token.exchanged": { category: "oauth" },
+	"oauth.refresh.reuse_detected": { category: "oauth" },
+	"oauth.refresh.revoked": { category: "oauth" },
+	"connection.created": { category: "connection" },
+	"connection.updated": { category: "connection" },
+	"connection.removed": { category: "connection" },
+	"connection.login.succeeded": { category: "connection" },
+	"connection.login.failed": { category: "connection" },
+	"connection.domain.verification_requested": { category: "connection" },
+	"connection.domain.verified": { category: "connection" },
+	"connection.policy.updated": { category: "connection" },
+	"connection.saml.set": { category: "connection" },
+	"connection.saml.refreshed": { category: "connection" },
+	"connection.oidc.set": { category: "connection" },
+	"connection.scim.set": { category: "scim" },
+	"connection.scim.read": { category: "scim" },
+	"connection.scim.user.provisioned": { category: "scim" },
+	"connection.scim.user.updated": { category: "scim" },
+	"connection.scim.user.deactivated": { category: "scim" },
+	"connection.scim.user.reactivated": { category: "scim" },
+	"connection.scim.group.provisioned": { category: "scim" },
+	"connection.scim.group.updated": { category: "scim" },
+	"connection.scim.group.deactivated": { category: "scim" },
+	"connection.scim.group.reactivated": { category: "scim" },
+	"webhook.endpoint.created": { category: "webhook" },
+	"webhook.endpoint.disabled": { category: "webhook" },
+	"webhook.delivery.created": { category: "webhook" },
+	"webhook.delivery.attempted": { category: "webhook" },
+	"webhook.delivery.succeeded": { category: "webhook" },
+	"webhook.delivery.failed": { category: "webhook" }
+};
+/** Ordered tuple of every {@link AuthEventKind}, for deriving validators. */
+const AUTH_EVENT_KINDS = Object.keys(EVENT_KINDS);
+/**
+* Map from every {@link AuthEventKind} to its {@link AuthEventCategory},
+* derived from {@link EVENT_KINDS}.
+*/
+const EVENT_KIND_CATEGORY = Object.fromEntries(AUTH_EVENT_KINDS.map((kind) => [kind, EVENT_KINDS[kind].category]));
+
+//#endregion
+export { AUTH_EVENT_KINDS, EVENT_CATEGORIES, EVENT_KINDS, EVENT_KIND_CATEGORY };
+//# sourceMappingURL=kinds.js.map

package/dist/shared/fetch/guard.js

@@ -0,0 +1,189 @@
+//#region src/shared/fetch/guard.ts
+/**
+* Single canonical rejection reason for internal SSRF targets. Kept as one
+* constant so every branch returns byte-identical text (callers and tests match
+* on `/not allowed/`).
+*/
+const INTERNAL_TARGET_REASON = "URL host is not allowed (loopback, private, link-local, or internal target).";
+function classifyIpv4(host) {
+	const parts = host.split(".");
+	if (parts.length !== 4) return null;
+	const octets = parts.map((part) => Number(part));
+	if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return null;
+	const [a, b, c] = octets;
+	if (a === 127 || a === 0) return "loopback";
+	if (a === 169 && b === 254) return "linkLocal";
+	if (a === 10) return "private";
+	if (a === 172 && b >= 16 && b <= 31) return "private";
+	if (a === 192 && b === 168) return "private";
+	if (a === 100 && b >= 64 && b <= 127) return "private";
+	if (a === 192 && b === 0 && (c === 0 || c === 2) || a === 192 && b === 88 && c === 99 || a === 198 && (b === 18 || b === 19) || a === 198 && b === 51 && c === 100 || a === 203 && b === 0 && c === 113 || a >= 224) return "nonRoutable";
+	return "public";
+}
+function ipv4KindFromMappedIpv6(inner) {
+	if (inner.includes(".")) return classifyIpv4(inner);
+	const hexGroups = inner.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+	if (!hexGroups) return null;
+	const high = parseInt(hexGroups[1], 16);
+	const low = parseInt(hexGroups[2], 16);
+	return classifyIpv4(`${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`);
+}
+/** True when an IPv4 classification is a blocked (non-public) SSRF target. */
+function isBlockedIpv4Kind(kind) {
+	return kind === "loopback" || kind === "linkLocal" || kind === "private" || kind === "nonRoutable";
+}
+/**
+* Best-effort detection of an IPv4 address embedded in a multi-label hostname,
+* as produced by wildcard-DNS "IP-in-hostname" services (nip.io / sslip.io) that
+* resolve a public-looking name to an operator-chosen A record — e.g.
+* `169-254-169-254.nip.io` → `169.254.169.254`, `10.0.0.1.nip.io` → `10.0.0.1`,
+* or the prefixed `www-10-0-0-1.sslip.io` form.
+*
+* This is a literal scan of the NAME, not DNS resolution. It matches only the
+* two encodings these services use: four consecutive purely-numeric dot-labels
+* (`10.0.0.1.nip.io`), or four consecutive purely-numeric dash-groups inside a
+* single label (`169-254-169-254.nip.io`, `www-10-0-0-1.sslip.io`). Requiring
+* purely-numeric, contiguous octets avoids false positives on public hostnames
+* whose separate labels merely contain digits (e.g. `v10.node0.pool0.dc1.example
+* .com`). Public-IP encodings (ordinary AWS/GCP public reverse DNS such as
+* `ec2-52-1-2-3.compute-1.amazonaws.com`) classify as public and are allowed;
+* only windows forming a private/loopback/link-local/CGNAT address are rejected
+* (fail-closed on the rare collision). A name that resolves to a private address
+* without encoding it in the label (ordinary DNS rebinding) is not detectable
+* here — see the module note. Hex-encoded (`0a000801.nip.io`) and IPv6 wildcard
+* forms are also out of scope.
+*/
+function embeddedInternalIpv4Reason(hostname) {
+	if (hostname.includes(":")) return null;
+	const isOctet = (part) => /^[0-9]{1,3}$/.test(part);
+	const labels = hostname.split(".");
+	for (let index = 0; index + 4 <= labels.length; index += 1) {
+		const quad = labels.slice(index, index + 4);
+		if (quad.every(isOctet) && isBlockedIpv4Kind(classifyIpv4(quad.join(".")))) return INTERNAL_TARGET_REASON;
+	}
+	for (const label of labels) {
+		const groups = label.split("-");
+		for (let index = 0; index + 4 <= groups.length; index += 1) {
+			const quad = groups.slice(index, index + 4);
+			if (quad.every(isOctet) && isBlockedIpv4Kind(classifyIpv4(quad.join(".")))) return INTERNAL_TARGET_REASON;
+		}
+	}
+	return null;
+}
+function hasAsciiControlCharacter(value) {
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code <= 31 || code === 127) return true;
+	}
+	return false;
+}
+function unsafeHostValueReason(host) {
+	if (host.length === 0 || host.trim() !== host || hasAsciiControlCharacter(host) || host.includes("/") || host.includes("\\") || host.includes("@") || host.includes("://")) return "URL host must be a host value.";
+	let parsed;
+	try {
+		parsed = new URL(`http://${host}`);
+	} catch {
+		return "URL host must be a host value.";
+	}
+	if (parsed.hostname.length === 0 || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || parsed.username !== "" || parsed.password !== "") return "URL host must be a host value.";
+	return null;
+}
+function unsafeHostReason(host, policy) {
+	let hostname = host.toLowerCase();
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname.endsWith(".")) hostname = hostname.slice(0, -1);
+	if (hostname.length === 0) return "URL is missing a hostname.";
+	if (!policy.allowSingleLabelHosts && !hostname.includes(":") && !hostname.includes(".")) return INTERNAL_TARGET_REASON;
+	if (hostname === "localhost" || hostname.endsWith(".localhost")) return INTERNAL_TARGET_REASON;
+	if (hostname.endsWith(".internal") || hostname.endsWith(".local")) return INTERNAL_TARGET_REASON;
+	if (isBlockedIpv4Kind(classifyIpv4(hostname))) return INTERNAL_TARGET_REASON;
+	if (hostname === "::1" || hostname === "::" || hostname === "::0") return INTERNAL_TARGET_REASON;
+	const mapped = hostname.match(/^::ffff:(.+)$/);
+	if (mapped && isBlockedIpv4Kind(ipv4KindFromMappedIpv6(mapped[1]))) return INTERNAL_TARGET_REASON;
+	if (/^fe[89ab][0-9a-f]:/.test(hostname)) return INTERNAL_TARGET_REASON;
+	if (/^f[cd][0-9a-f]{2}:/.test(hostname)) return INTERNAL_TARGET_REASON;
+	if (/^fe[c-f][0-9a-f]:/.test(hostname) || /^ff[0-9a-f]{2}:/.test(hostname)) return INTERNAL_TARGET_REASON;
+	const embedded = embeddedInternalIpv4Reason(hostname);
+	if (embedded !== null) return embedded;
+	return null;
+}
+function unsafeFetchUrlReasonWithPolicy(url, policy) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return "URL is not a valid URL.";
+	}
+	if (parsed.protocol !== "https:" && !(policy.allowHttp && parsed.protocol === "http:")) return policy.allowHttp ? "URL must use the http: or https: scheme." : "URL must use the https: scheme.";
+	return unsafeHostReason(parsed.hostname, policy);
+}
+/**
+* Reason an operator-supplied URL is rejected as an SSRF risk, or `null` when it
+* is safe to fetch server-side. Requires the `https:` scheme and rejects
+* single-label hosts plus hostnames that are obviously internal targets:
+* `localhost` and `*.localhost`, `*.internal`, `*.local`, IP literals in
+* loopback/private/link-local/CGNAT ranges (`127.0.0.0/8`, `0.0.0.0/8`, `10/8`,
+* `172.16/12`, `192.168/16`, `100.64/10`, `169.254/16`, protocol/test,
+* benchmarking, multicast, and reserved ranges including the
+* `169.254.169.254` cloud-metadata address, `::1`, `fc00::/7`, `fe80::/10`, and
+* `::ffff:`-mapped IPv4, site-local and multicast IPv6), and IPv4 addresses embedded in wildcard-DNS hostnames
+* (e.g. `169-254-169-254.nip.io`).
+*
+* This is literal validation only; see the module note for the residual
+* DNS-rebinding window it cannot close. Reasons begin with `"URL "` so callers
+* can prefix a subject (e.g. `` `Webhook ${reason}` ``).
+*/
+function unsafeFetchUrlReason(url) {
+	return unsafeFetchUrlReasonWithPolicy(url, {
+		allowHttp: false,
+		allowSingleLabelHosts: false
+	});
+}
+/**
+* Reason an IdP discovery/metadata URL is rejected, or `null` when it is safe
+* to fetch server-side.
+*
+* IdP metadata may be served over `http:` by self-hosted deployments, so the
+* `http:` scheme is permitted here (unlike {@link unsafeFetchUrlReason}). Every
+* internal-target host rule still applies, and — hardened for SSRF —
+* single-label hosts are now REJECTED by default (`allowSingleLabelHosts:
+* false`), matching the strict profile. They were previously allowed to support
+* referencing a Dockerized IdP by bare service name (e.g. `http://zitadel:8080`);
+* such deployments must now use a resolvable dotted hostname, because a bare
+* single-label name is an SSRF vector this guard cannot vet without DNS
+* resolution (it can point at internal infra, or via a search domain at a cloud
+* metadata endpoint). `http:` is intentionally kept: it is a transport concern
+* orthogonal to the host-based SSRF filtering above, and dropping it would break
+* legitimate self-hosted-over-http IdPs without closing an SSRF hole. A
+* deployment that wants to forbid `http:` should gate the scheme at its call
+* site.
+*/
+function unsafeIdpFetchUrlReason(url) {
+	return unsafeFetchUrlReasonWithPolicy(url, {
+		allowHttp: true,
+		allowSingleLabelHosts: false
+	});
+}
+/**
+* Throw when `url` is an unsafe IdP discovery/metadata fetch target.
+*/
+function assertSafeIdpFetchUrl(url) {
+	const reason = unsafeIdpFetchUrlReason(url);
+	if (reason !== null) throw new Error(`Refusing to fetch ${reason}`);
+}
+/**
+* Throw when `host` is unsafe to send as a proxy-mode IdP `Host` header. This is
+* a header-value check (reject header injection / malformed values), not an SSRF
+* target check: the Host header is metadata on a request whose actual target
+* (the rewritten URL) is guarded separately by {@link assertSafeIdpFetchUrl}, so
+* loopback/private host values (e.g. a self-hosted IdP issuer on `127.0.0.1`) are
+* allowed — blocking them adds no SSRF protection and breaks self-hosted IdPs.
+*/
+function assertSafeIdpHost(host) {
+	const reason = unsafeHostValueReason(host);
+	if (reason !== null) throw new Error(`Refusing to fetch ${reason}`);
+}
+
+//#endregion
+export { assertSafeIdpFetchUrl, assertSafeIdpHost, unsafeFetchUrlReason };
+//# sourceMappingURL=guard.js.map

package/dist/shared/log.js

@@ -0,0 +1,62 @@
+//#region src/shared/log.ts
+/**
+* Leveled console logging shared across auth internals.
+*
+* @module
+*/
+/** Supported log severities, ordered from most to least severe. */
+const LOG_LEVELS = {
+	ERROR: "ERROR",
+	WARN: "WARN",
+	INFO: "INFO",
+	DEBUG: "DEBUG"
+};
+function serialize(value) {
+	if (typeof value === "string") return value;
+	if (value instanceof Error) return `${value.message}${value.stack ? `\n${value.stack}` : ""}`;
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return String(value);
+	}
+}
+const LEVEL_SEVERITY = {
+	ERROR: 0,
+	WARN: 1,
+	INFO: 2,
+	DEBUG: 3
+};
+/**
+* Format and emit a log line, suppressing anything below `configuredLogLevel`.
+*
+* The level gate is checked before {@link serialize} runs, so a message gated
+* out by the configured level never pays the `JSON.stringify` cost of its args.
+*
+* @param module - Source module label included in the prefix.
+* @param level - Severity of this message.
+* @param args - Values to serialize and join into the message body.
+* @param configuredLogLevel - Minimum level to emit. Defaults to `"INFO"`.
+*/
+function logMessage(module, level, args, configuredLogLevel = "INFO") {
+	if (LEVEL_SEVERITY[level] > LEVEL_SEVERITY[configuredLogLevel]) return;
+	const message = args.map(serialize).join(" ");
+	const prefix = `[${module}] [${level}]`;
+	switch (level) {
+		case "ERROR":
+			console.error(prefix, message);
+			return;
+		case "WARN":
+			console.warn(prefix, message);
+			return;
+		case "INFO":
+			console.info(prefix, message);
+			return;
+		case "DEBUG":
+			console.debug(prefix, message);
+			return;
+	}
+}
+
+//#endregion
+export { LOG_LEVELS, logMessage };
+//# sourceMappingURL=log.js.map

package/dist/shared/results.d.ts

@@ -0,0 +1,58 @@
+//#region src/shared/results.d.ts
+/** Data needed to provision a TOTP authenticator (otpauth URI + shared secret). */
+type TotpSetupPayload = {
+  uri: string;
+  secret: string;
+  totpId: string;
+};
+/** Device authorization grant details returned to a polling device client. */
+type DeviceCodePayload = {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete: string;
+  expiresIn: number;
+  interval: number;
+};
+/** Terminal sign-in result: the user is authenticated and a session exists. */
+type SignInSessionResult<TSession> = {
+  kind: "signedIn";
+  session: TSession;
+};
+/** Sign-in result requiring the client to follow an OAuth redirect. */
+type SignInRedirectResult<TRedirect = string> = {
+  kind: "redirect";
+  redirect: TRedirect;
+  verifier: string;
+};
+/** Sign-in result indicating a verification flow was started (e.g. OTP sent). */
+type SignInStartResult = {
+  kind: "started";
+};
+/** Sign-in result carrying options for a WebAuthn ceremony. */
+type SignInWebAuthnOptionsResult = {
+  kind: "webauthnOptions";
+  options: Record<string, unknown>;
+  verifier: string;
+};
+/** Sign-in result requesting a TOTP code to complete two-factor sign-in. */
+type SignInTotpChallengeResult = {
+  kind: "totpRequired";
+  verifier: string;
+};
+/** Sign-in result requesting TOTP enrollment before sign-in can complete. */
+type SignInTotpSetupResult<TTotpSetup = TotpSetupPayload> = {
+  kind: "totpSetup";
+  totpSetup: TTotpSetup;
+  verifier: string;
+};
+/** Sign-in result returning a device code for the device authorization flow. */
+type SignInDeviceCodeResult<TDeviceCode = DeviceCodePayload> = {
+  kind: "deviceCode";
+  deviceCode: TDeviceCode;
+};
+/** Discriminated union of every possible sign-in flow outcome, keyed by `kind`. */
+type SignInFlowResult<TSession, TRedirect = string> = SignInSessionResult<TSession> | SignInRedirectResult<TRedirect> | SignInStartResult | SignInWebAuthnOptionsResult | SignInTotpChallengeResult | SignInTotpSetupResult | SignInDeviceCodeResult;
+//#endregion
+export { DeviceCodePayload, SignInDeviceCodeResult, SignInFlowResult, SignInRedirectResult, SignInStartResult, SignInTotpChallengeResult, SignInTotpSetupResult, SignInWebAuthnOptionsResult, TotpSetupPayload };
+//# sourceMappingURL=results.d.ts.map

package/dist/shared/retry.js

@@ -0,0 +1,27 @@
+//#region src/shared/retry.ts
+/**
+* Retry `fn` with exponential backoff until it succeeds or retries are
+* exhausted. On final failure the last error is re-thrown.
+*/
+async function retryWithBackoff(fn, opts = {}) {
+	const { maxRetries = 2, baseMs = 200, jitter = true, jitterMode = "additive", shouldRetry } = opts;
+	let lastError;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await fn();
+	} catch (error) {
+		lastError = error;
+		if (attempt >= maxRetries) break;
+		if (shouldRetry && !shouldRetry(error)) throw error;
+		const base = baseMs * 2 ** attempt;
+		let delay;
+		if (!jitter) delay = base;
+		else if (jitterMode === "centered") delay = base * (.5 + Math.random());
+		else delay = base + Math.random() * base;
+		await new Promise((resolve) => setTimeout(resolve, delay));
+	}
+	throw lastError;
+}
+
+//#endregion
+export { retryWithBackoff };
+//# sourceMappingURL=retry.js.map

package/dist/shared/webauthn.js

@@ -0,0 +1,9 @@
+//#region src/shared/webauthn.ts
+/** Maximum WebAuthn credentials stored for one user. */
+const MAX_WEBAUTHN_CREDENTIALS_PER_USER = 16;
+/** Maximum credential ID length accepted by WebAuthn Level 3. */
+const MAX_WEBAUTHN_CREDENTIAL_ID_LENGTH = 1023;
+
+//#endregion
+export { MAX_WEBAUTHN_CREDENTIALS_PER_USER, MAX_WEBAUTHN_CREDENTIAL_ID_LENGTH };
+//# sourceMappingURL=webauthn.js.map

package/dist/svelte/AuthLoading.svelte

@@ -0,0 +1,13 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+
+  import { useConvexAuth } from "./context.svelte.js";
+
+  let { children }: { children: Snippet } = $props();
+
+  const auth = useConvexAuth();
+</script>
+
+{#if auth.loading}
+  {@render children()}
+{/if}

package/dist/svelte/AuthLoading.svelte.d.ts

@@ -0,0 +1,8 @@
+import type { Snippet } from "svelte";
+type $$ComponentProps = {
+    children: Snippet;
+};
+declare const AuthLoading: import("svelte").Component<$$ComponentProps, {}, "">;
+type AuthLoading = ReturnType<typeof AuthLoading>;
+export default AuthLoading;
+//# sourceMappingURL=AuthLoading.svelte.d.ts.map

package/dist/svelte/SignedIn.svelte

@@ -0,0 +1,14 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+
+  import { useConvexAuth } from "./context.svelte.js";
+
+  let { children }: { children: Snippet<[string]> } = $props();
+
+  const auth = useConvexAuth();
+  const state = $derived(auth.state);
+</script>
+
+{#if state.status === "signedIn"}
+  {@render children(state.token)}
+{/if}