@estifanos-sh/convex-auth 0.0.2 → 0.0.3

package/dist/browser/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["createClient"],"sources":["../../src/browser/index.ts"],"sourcesContent":["/**\n * Browser-first auth client for `@estifanos-sh/convex-auth/browser`.\n *\n * This entrypoint wraps the framework-agnostic `client(...)`\n * helper with browser defaults such as `ConvexHttpClient`, local storage, URL\n * replacement, OAuth launching, and WebAuthn adapters.\n *\n * @module\n */\n\nimport { ConvexHttpClient } from \"convex/browser\";\n\nimport {\n  client as createClient,\n  resolveUrl,\n  type AuthApiRefs,\n  type ClientOptions,\n  type PlatformAuthClient,\n} from \"../client/index\";\nimport { createWebAuthnClient } from \"./webauthn\";\nimport { createBrowserRuntime } from \"./runtime\";\n\nexport type { AuthApiRefs, PlatformAuthClient as AuthClient, ClientOptions } from \"../client/index\";\n\n/**\n * Create a browser-configured auth client.\n *\n * Applies browser runtime defaults (`ConvexHttpClient` transport, local\n * storage, URL cleanup, OAuth launch, WebAuthn support) on top of the\n * framework-agnostic `client(...)` helper, then returns it directly — the core\n * owns OAuth launch/completion and initialization, driven by the injected\n * browser runtime.\n *\n * @param options - Browser client configuration. See {@link ClientOptions}.\n * @typeParam Api - Auth API references that control which factor helpers are\n *   available on the returned client.\n * @returns A browser auth client with the configured auth helpers.\n */\nexport function client<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs>(\n  options: ClientOptions<Api>,\n): PlatformAuthClient<Api> {\n  const proxyMode = options.proxyPath !== undefined;\n  const url = proxyMode ? undefined : (options.url ?? resolveUrl(options.convex));\n\n  return createClient({\n    ...options,\n    storage: options.storage === undefined && proxyMode ? null : options.storage,\n    runtime: mergeBrowserRuntime(options.runtime),\n    adapterFactories: {\n      ...options.adapterFactories,\n      webauthn: options.adapterFactories?.webauthn ?? ((deps) => createWebAuthnClient(deps)),\n    },\n    httpClient: proxyMode ? null : (options.httpClient ?? (url ? new ConvexHttpClient(url) : null)),\n  }) as PlatformAuthClient<Api>;\n}\n\nfunction mergeBrowserRuntime(\n  runtime: ClientOptions[\"runtime\"],\n): NonNullable<ClientOptions[\"runtime\"]> {\n  const defaults = createBrowserRuntime();\n  return {\n    ...defaults,\n    ...runtime,\n    environment: runtime?.environment ?? defaults.environment,\n    proxy: runtime?.proxy ?? defaults.proxy,\n    storage: runtime?.storage === undefined ? defaults.storage : runtime.storage,\n    location: runtime?.location ?? defaults.location,\n    oauth: runtime?.oauth ?? defaults.oauth,\n    sync: runtime?.sync ?? defaults.sync,\n    mutex: runtime?.mutex ?? defaults.mutex,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,OACd,SACyB;CACzB,MAAM,YAAY,QAAQ,cAAc;CACxC,MAAM,MAAM,YAAY,SAAa,QAAQ,OAAO,WAAW,QAAQ,OAAO;AAE9E,QAAOA,SAAa;EAClB,GAAG;EACH,SAAS,QAAQ,YAAY,UAAa,YAAY,OAAO,QAAQ;EACrE,SAAS,oBAAoB,QAAQ,QAAQ;EAC7C,kBAAkB;GAChB,GAAG,QAAQ;GACX,UAAU,QAAQ,kBAAkB,cAAc,SAAS,qBAAqB,KAAK;GACtF;EACD,YAAY,YAAY,OAAQ,QAAQ,eAAe,MAAM,IAAI,iBAAiB,IAAI,GAAG;EAC1F,CAAC;;AAGJ,SAAS,oBACP,SACuC;CACvC,MAAM,WAAW,sBAAsB;AACvC,QAAO;EACL,GAAG;EACH,GAAG;EACH,aAAa,SAAS,eAAe,SAAS;EAC9C,OAAO,SAAS,SAAS,SAAS;EAClC,SAAS,SAAS,YAAY,SAAY,SAAS,UAAU,QAAQ;EACrE,UAAU,SAAS,YAAY,SAAS;EACxC,OAAO,SAAS,SAAS,SAAS;EAClC,MAAM,SAAS,QAAQ,SAAS;EAChC,OAAO,SAAS,SAAS,SAAS;EACnC"}
+{"version":3,"file":"index.js","names":["createClient"],"sources":["../../src/browser/index.ts"],"sourcesContent":["/**\n * Browser-first auth client for `@estifanos-sh/convex-auth/browser`.\n *\n * This entrypoint wraps the framework-agnostic `client(...)`\n * helper with browser defaults such as `ConvexHttpClient`, local storage, URL\n * replacement, OAuth launching, and WebAuthn adapters.\n *\n * @module\n */\n\nimport { ConvexHttpClient } from \"convex/browser\";\n\nimport {\n  client as createClient,\n  resolveUrl,\n  type ClientOptions,\n  type PlatformAuthClient,\n} from \"../client/index\";\nimport type { AuthApiRefs } from \"../client/core/types\";\nimport { createWebAuthnClient } from \"./webauthn\";\nimport { createBrowserRuntime } from \"./runtime\";\n\nexport type { PlatformAuthClient as AuthClient, ClientOptions } from \"../client/index\";\n\n/**\n * Create a browser-configured auth client.\n *\n * Applies browser runtime defaults (`ConvexHttpClient` transport, local\n * storage, URL cleanup, OAuth launch, WebAuthn support) on top of the\n * framework-agnostic `client(...)` helper, then returns it directly — the core\n * owns OAuth launch/completion and initialization, driven by the injected\n * browser runtime.\n *\n * @param options - Browser client configuration. See {@link ClientOptions}.\n * @typeParam Api - Auth API references that control which factor helpers are\n *   available on the returned client.\n * @returns A browser auth client with the configured auth helpers.\n */\nexport function client<Api extends AuthApiRefs = AuthApiRefs>(\n  options: ClientOptions<Api>,\n): PlatformAuthClient<Api> {\n  const proxyMode = options.proxyPath !== undefined;\n  const url = proxyMode ? undefined : (options.url ?? resolveUrl(options.convex));\n\n  return createClient({\n    ...options,\n    storage: options.storage === undefined && proxyMode ? null : options.storage,\n    runtime: mergeBrowserRuntime(options.runtime),\n    adapterFactories: {\n      ...options.adapterFactories,\n      webauthn: options.adapterFactories?.webauthn ?? ((deps) => createWebAuthnClient(deps)),\n    },\n    httpClient: proxyMode ? null : (options.httpClient ?? (url ? new ConvexHttpClient(url) : null)),\n  }) as PlatformAuthClient<Api>;\n}\n\nfunction mergeBrowserRuntime(\n  runtime: ClientOptions[\"runtime\"],\n): NonNullable<ClientOptions[\"runtime\"]> {\n  const defaults = createBrowserRuntime();\n  return {\n    ...defaults,\n    ...runtime,\n    environment: runtime?.environment ?? defaults.environment,\n    proxy: runtime?.proxy ?? defaults.proxy,\n    storage: runtime?.storage === undefined ? defaults.storage : runtime.storage,\n    location: runtime?.location ?? defaults.location,\n    oauth: runtime?.oauth ?? defaults.oauth,\n    sync: runtime?.sync ?? defaults.sync,\n    mutex: runtime?.mutex ?? defaults.mutex,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,OACd,SACyB;CACzB,MAAM,YAAY,QAAQ,cAAc;CACxC,MAAM,MAAM,YAAY,SAAa,QAAQ,OAAO,WAAW,QAAQ,OAAO;AAE9E,QAAOA,SAAa;EAClB,GAAG;EACH,SAAS,QAAQ,YAAY,UAAa,YAAY,OAAO,QAAQ;EACrE,SAAS,oBAAoB,QAAQ,QAAQ;EAC7C,kBAAkB;GAChB,GAAG,QAAQ;GACX,UAAU,QAAQ,kBAAkB,cAAc,SAAS,qBAAqB,KAAK;GACtF;EACD,YAAY,YAAY,OAAQ,QAAQ,eAAe,MAAM,IAAI,iBAAiB,IAAI,GAAG;EAC1F,CAAC;;AAGJ,SAAS,oBACP,SACuC;CACvC,MAAM,WAAW,sBAAsB;AACvC,QAAO;EACL,GAAG;EACH,GAAG;EACH,aAAa,SAAS,eAAe,SAAS;EAC9C,OAAO,SAAS,SAAS,SAAS;EAClC,SAAS,SAAS,YAAY,SAAY,SAAS,UAAU,QAAQ;EACrE,UAAU,SAAS,YAAY,SAAS;EACxC,OAAO,SAAS,SAAS,SAAS;EAClC,MAAM,SAAS,QAAQ,SAAS;EAChC,OAAO,SAAS,SAAS,SAAS;EACnC"}

package/dist/client/core/types.d.ts

@@ -1,7 +1,8 @@
+import { AnonymousParams, CodeParams, ConnectionParams, EmailParams, OAuthParams, PasswordParams } from "../../shared/params.js";
 import { AuthParameters } from "../../shared/results.js";
 import { ErrorCode } from "../../shared/codes.js";
 import { Value } from "convex/values";
-import { FunctionReference } from "convex/server";
+import { FunctionArgs, FunctionReference } from "convex/server";
 
 //#region src/client/core/types.d.ts
 /**
@@ -141,8 +142,17 @@ type AuthSubscriber = (state: AuthState) => void;
  * @typeParam HasTotp - Whether the TOTP provider is configured.
  * @typeParam HasDevice - Whether the device provider is configured.
  */
-type AuthApiRefs<HasWebAuthn extends boolean = boolean, HasTotp extends boolean = boolean, HasDevice extends boolean = boolean> = {
-  signIn: FunctionReference<"action", "public", Record<string, Value>, unknown>;
+type DefaultSignInReference = FunctionReference<"action", "public", {
+  provider?: string;
+  params?: AuthParameters;
+  verifier?: string;
+  continuation?: string;
+  refreshToken?: string;
+  calledBy?: string;
+}, unknown>;
+type AnySignInReference = FunctionReference<"action", "public", any, any>;
+type AuthApiRefs<SignIn extends AnySignInReference = DefaultSignInReference> = {
+  signIn: SignIn;
   signOut: FunctionReference<"action", "public", Record<string, Value>, unknown>;
 };
 /**
@@ -379,14 +389,12 @@ interface DeviceClient {
  *
  * @typeParam Api - An AuthApiRefs type to extract capability flags from.
  */
-type InferCaps<Api extends AuthApiRefs<boolean, boolean, boolean>> = Api extends AuthApiRefs<infer P, infer T, infer D> ? {
-  webauthn: P;
-  totp: T;
-  device: D;
-} : {
-  webauthn: boolean;
-  totp: boolean;
-  device: boolean;
+type ProviderIds<Api extends AuthApiRefs> = [Api["signIn"]] extends [never] ? string : FunctionArgs<Api["signIn"]> extends infer Args ? Args extends unknown ? "provider" extends keyof Args ? Exclude<Args[keyof Args & "provider"], undefined> : never : never : never;
+type HasProvider<Api extends AuthApiRefs, Id extends string> = string extends ProviderIds<Api> ? boolean : Id extends ProviderIds<Api> ? true : false;
+type InferCaps<Api extends AuthApiRefs> = {
+  webauthn: HasProvider<Api, "webauthn">;
+  totp: HasProvider<Api, "totp">;
+  device: HasProvider<Api, "device">;
 };
 /**
  * Include a capability when configured, omit it when disabled, and keep it
@@ -415,72 +423,16 @@ interface PendingInvite {
     token: string;
   }>;
 }
-/**
- * Discriminated union of params for the password provider's flows.
- *
- * Each branch maps to one of the six password flows: `signUp`, `signIn`,
- * `reset`, `recover`, `verify`, `change`. Selecting a `flow` literal narrows the
- * accepted params automatically.
- */
-type PasswordParams = {
-  flow: "signUp";
-  email: string;
-  password: string;
-  redirectTo?: string;
-} | {
-  flow: "signIn";
-  email: string;
-  password: string;
-  redirectTo?: string;
-} | {
-  flow: "reset";
-  email: string;
-  redirectTo?: string;
-} | {
-  flow: "recover";
-  email: string;
-  code: string;
-  newPassword: string;
-  redirectTo?: string;
-} | {
-  flow: "verify";
-  email: string;
-  code: string;
-  redirectTo?: string;
-} | {
-  flow: "change";
-  email: string;
-  currentPassword: string;
-  newPassword: string;
-  redirectTo?: string;
-};
 /** Params for the email (magic link) provider's initiation step. */
-type EmailInitiateParams = {
-  email: string;
-  redirectTo?: string;
-};
+type EmailInitiateParams = EmailParams;
 /**
  * Params for completing a code-based flow (no provider). Used to finalise
  * email magic-link sign-ins and other provider-owned code flows when the
  * verification call is made without re-specifying the originating provider.
  */
-type CodeCompletionParams = {
-  code: string;
-  redirectTo?: string;
-};
-/** Params for the `connection` provider — requires a connection ID. */
-type ConnectionParams = {
-  connectionId: string;
-  redirectTo?: string;
-};
-/** Params for the anonymous provider. Empty / `redirectTo` only. */
-type AnonymousParams = {
-  redirectTo?: string;
-};
+type CodeCompletionParams = CodeParams;
 /** Default params shape for OAuth-style providers (google, github, etc.). */
-type OAuthSignInParams = {
-  redirectTo?: string;
-};
+type OAuthSignInParams = OAuthParams;
 /**
  * Resolves the `params` argument shape from the `provider` literal.
  *
@@ -488,12 +440,21 @@ type OAuthSignInParams = {
  * Any other string falls back to OAuth-style params, since custom OAuth
  * providers can be registered under arbitrary IDs.
  */
-type ParamsForProvider<P> = P extends "password" ? PasswordParams : P extends "email" ? EmailInitiateParams : P extends "anonymous" ? AnonymousParams | undefined : P extends "connection" ? ConnectionParams : P extends "webauthn" ? never : P extends undefined ? CodeCompletionParams : OAuthSignInParams | undefined;
+type DefaultParamsForProvider<P> = P extends "password" ? PasswordParams : P extends "email" ? EmailInitiateParams : P extends "anonymous" ? AnonymousParams | undefined : P extends "connection" ? ConnectionParams : P extends "webauthn" ? never : P extends undefined ? CodeCompletionParams : OAuthSignInParams | undefined;
+type ConfiguredProviderArgs<Api extends AuthApiRefs, P> = FunctionArgs<Api["signIn"]> extends infer Args ? Args extends {
+  provider: P;
+} ? Args : never : never;
+/** Resolve a provider's exact params from the generated auth action reference. */
+type ParamsForProvider<Api extends AuthApiRefs, P> = string extends ProviderIds<Api> ? DefaultParamsForProvider<P> : P extends "webauthn" | "totp" | "device" ? never : P extends "connection" ? ConnectionParams : [P] extends [undefined] ? CodeCompletionParams : ConfiguredProviderArgs<Api, P> extends infer Args ? [Args] extends [never] ? never : Args extends {
+  params: infer Params;
+} ? Params : Args extends {
+  params?: infer Params;
+} ? Params | undefined : undefined : never;
 /**
  * Tuple-rest helper that flips `params` between required and optional based
  * on whether `undefined` is in its resolved type.
  */
-type SignInArgs<P> = undefined extends ParamsForProvider<P> ? [params?: ParamsForProvider<P>] : [params: ParamsForProvider<P>];
+type SignInArgs<Api extends AuthApiRefs, P> = undefined extends ParamsForProvider<Api, P> ? [params?: ParamsForProvider<Api, P>] : [params: ParamsForProvider<Api, P>];
 /**
  * Public signature for `auth.signIn`. The provider literal discriminates the
  * params shape via {@link ParamsForProvider}, and the params slot is
@@ -506,9 +467,9 @@ type SignInArgs<P> = undefined extends ParamsForProvider<P> ? [params?: ParamsFo
  * auth.signIn("anonymous"); // params optional
  * ```
  */
-type SignInOverloads = <const P extends string | undefined>(provider: P, ...args: SignInArgs<P>) => Promise<SignInResult>;
+type SignInOverloads<Api extends AuthApiRefs = AuthApiRefs> = <const P extends ProviderIds<Api> | undefined>(provider: P, ...args: SignInArgs<Api, P>) => Promise<SignInResult>;
 /** Base auth client — always present. */
-interface AuthClientBase {
+interface AuthClientBase<Api extends AuthApiRefs> {
   /** Restore initial auth state for the current runtime. */
   initialize: () => Promise<void>;
   /** SSR-safe query-param reader. */
@@ -523,7 +484,7 @@ interface AuthClientBase {
     code: string;
   }) => Promise<OAuthCompletionResult>;
   /** Start a sign-in flow for a provider. */
-  signIn: SignInOverloads;
+  signIn: SignInOverloads<Api>;
   /** Sign out and clear local auth state. */
   signOut: () => Promise<void>;
   /** Subscribe to auth state changes; returns an unsubscribe. */
@@ -542,7 +503,7 @@ interface AuthClientBase {
  *
  * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.
  */
-type AuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = AuthClientBase & CapabilityClient<InferCaps<Api>["totp"], "totp", TotpClient> & CapabilityClient<InferCaps<Api>["device"], "device", DeviceClient>;
+type AuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClientBase<Api> & CapabilityClient<InferCaps<Api>["totp"], "totp", TotpClient> & CapabilityClient<InferCaps<Api>["device"], "device", DeviceClient>;
 /**
  * Browser auth client return type.
  *
@@ -551,13 +512,13 @@ type AuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs
  *
  * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.
  */
-type PlatformAuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = AuthClient<Api> & CapabilityClient<InferCaps<Api>["webauthn"], "webauthn", WebAuthnClient>;
+type PlatformAuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClient<Api> & CapabilityClient<InferCaps<Api>["webauthn"], "webauthn", WebAuthnClient>;
 /**
  * Options for {@link client}.
  *
  * @typeParam Api - An AuthApiRefs type.
  */
-type ClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = {
+type ClientOptions<Api extends AuthApiRefs = AuthApiRefs> = {
   /** Any Convex client implementation used to run auth actions. */convex: ConvexTransport; /** Platform runtime implementation used by the client core. */
   runtime?: ClientRuntime; /** Platform-specific factor adapters supplied by higher-level entrypoints. */
   adapters?: ClientAdapters; /** Platform-specific adapter factories supplied by higher-level entrypoints. */
@@ -615,5 +576,5 @@ type OAuthCompletionResult = {
   cleanupUrl: URL | null;
 };
 //#endregion
-export { AnonymousParams, AuthApiRefs, AuthClient, AuthState, ClientOptions, ClientRuntime, CodeCompletionParams, ConnectionParams, DeviceClient, DeviceCodeResult, DevicePollParams, DeviceVerifyParams, EmailInitiateParams, OAuthCompletionResult, OAuthSignInParams, ParamsForProvider, PasswordParams, PendingInvite, PlatformAuthClient, SignInOverloads, SignInResult, Storage, TotpClient, TotpConfirmParams, TotpSetupOptions, TotpSetupResult, TotpVerifyParams, WebAuthnClient, WebAuthnRegisterOptions, WebAuthnSignInOptions };
+export { AuthApiRefs, AuthClient, AuthState, AuthSubscriber, ClientOptions, ClientRuntime, CodeCompletionParams, DeviceClient, DeviceCodeResult, DevicePollParams, DeviceVerifyParams, EmailInitiateParams, OAuthCompletionResult, OAuthSignInParams, PendingInvite, PlatformAuthClient, SignInResult, Storage, TotpClient, TotpConfirmParams, TotpSetupOptions, TotpSetupResult, TotpVerifyParams, WebAuthnClient, WebAuthnRegisterOptions, WebAuthnSignInOptions };
 //# sourceMappingURL=types.d.ts.map

package/dist/client/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/client/core/types.ts"],"mappings":";;;;;;;;AAqBA;;;;;;;UAAiB,eAAA;EACf,MAAA,CAAO,MAAA,WAAiB,IAAA,YAAgB,OAAA,CAAQ,KAAA;EAChD,OAAA,CACE,UAAA,GAAa,IAAA;IAAQ,iBAAA;EAAA,MAAiC,OAAA,6BACtD,QAAA,IAAY,eAAA;EAEd,SAAA;AAAA;;UAIe,eAAA;EACf,MAAA,CAAO,MAAA,WAAiB,IAAA,YAAgB,OAAA,CAAQ,KAAA;AAAA;;UAOjC,OAAA;EACf,OAAA,CAAQ,GAAA,uCAA0C,OAAA;EAClD,OAAA,CAAQ,GAAA,UAAa,KAAA,kBAAuB,OAAA;EAC5C,UAAA,CAAW,GAAA,kBAAqB,OAAA;AAAA;;UAIxB,eAAA;EACR,GAAA,IAAO,GAAA;EACP,OAAA,CAAQ,WAAA,kBAA6B,OAAA;AAAA;;;;;;AATvC;;;UAoBU,YAAA;EACR,IAAA,CAAK,GAAA,EAAK,GAAA,mBAAsB,GAAA,GAAM,OAAA,iBAAwB,GAAA;AAAA;;UAItD,WAAA;EACR,SAAA,CACE,GAAA,UACA,QAAA,GAAW,KAAA,2BAAgC,OAAA;AAAA;;UAKrC,YAAA;EACR,OAAA,IAAW,GAAA,UAAa,QAAA,QAAgB,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;AAAA;;UAIrD,YAAA;EACR,KAAA,CAAM,IAAA,EAAM,cAAA,EAAgB,SAAA,WAAoB,OAAA,CAAQ,QAAA;AAAA;;;AAnCzD;;;;UA4CgB,aAAA;EACf,WAAA;EACA,OAAA,GAAU,OAAA;EACV,QAAA,GAAW,eAAA;EACX,KAAA,GAAQ,YAAA;EACR,IAAA,GAAO,WAAA;EACP,KAAA,GAAQ,YAAA;EACR,KAAA,GAAQ,YAAA;AAAA;;UAIO,cAAA;EACf,QAAA,GAAW,cAAA;EACX,IAAA,GAAO,UAAA;EACP,MAAA,GAAS,YAAA;AAAA;;;;KAyDC,gBAAA;EACV,UAAA;EACA,QAAA;EACA,eAAA;EACA,uBAAA;EACA,SAAA;EACA,QAAA;AAAA;;;;;;;;;;AAjG0D;;;KAgHhD,YAAA;EACN,IAAA;AAAA;EACA,IAAA;EAAkB,QAAA,EAAU,GAAA;EAAK,QAAA;AAAA;EACjC,IAAA;EAAsB,QAAA;AAAA;EACtB,IAAA;EAAoB,UAAA,EAAY,gBAAA;AAAA;EAChC,IAAA;AAAA;EACA,IAAA;EAAgB,IAAA,EAAM,SAAA;AAAA;;KAWhB,SAAA;EACN,MAAA;EAAmB,KAAA;AAAA;EACnB,MAAA;EAAqB,KAAA;AAAA;EACrB,MAAA;EAAoB,KAAA;AAAA;;KAGd,cAAA,IAAkB,KAAA,EAAO,SAAA;;AAnHrC;;;;;;;KA6HY,WAAA;EAKV,MAAA,EAAQ,iBAAA,qBAAsC,MAAA,SAAe,KAAA;EAC7D,OAAA,EAAS,iBAAA,qBAAsC,MAAA,SAAe,KAAA;AAAA;;;;KAYpD,uBAAA;EA5IC,uEA8IX,IAAA,WA7IQ;EA+IR,QAAA,WA9IO;EAgJP,eAAA;AAAA;;;;KAMU,qBAAA;EAhJK,qDAkJf,KAAA;EAEA,QAAA;AAAA;;;;;;;UASe,cAAA;EA1Jf;;;;AAyDF;;;;;;;;EA8GE,WAAA;EAxGA;;;AAeF;;;;;;;;;EAuGE,mBAAA,IAAuB,OAAA;EArGD;;;;;;;;;;;;;;AAexB;;EAwGE,QAAA,CAAS,IAAA,GAAO,uBAAA,GAA0B,OAAA,CAAQ,YAAA;EAxG/B;;;;;;;;;AAMrB;;;;EAoHE,MAAA,CAAO,IAAA,GAAO,qBAAA,GAAwB,OAAA,CAAQ,YAAA;AAAA;;;;KAMpC,gBAAA;EA3GF,kDA6GR,IAAA,WA5G+C;EA8G/C,WAAA;AAAA;;KAIU,eAAA;EAtHV,8CAwHA,GAAA,UArHA;EAuHA,MAAA,UAvH8C;EAyH9C,QAAA,UAxHA;EA0HA,MAAA;AAAA;;KAIU,iBAAA;EA9HyD,gDAgInE,IAAA,UApHiC;EAsHjC,QAAA,UAtHiC;EAwHjC,MAAA;AAAA;;KAIU,gBAAA;EAtHK,gDAwHf,IAAA,UAlH+B;EAoH/B,QAAA;AAAA;;AAvGF;;;;;UAgHiB,UAAA;EAnE2B;;;;;;;;;;;;;;;;;;EAsF1C,KAAA,CAAM,IAAA,GAAO,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EApEkB;;AAM5D;;;;;AAQA;;;;;;;;;;AAYA;EA8DE,OAAA,CAAQ,IAAA,EAAM,iBAAA,GAAoB,OAAA,CAAQ,YAAA;;;;;;;;AApD5C;;;;;AAaA;;;;;;;;EA6DE,MAAA,CAAO,IAAA,EAAM,gBAAA,GAAmB,OAAA,CAAQ,YAAA;AAAA;;KAI9B,gBAAA;EACV,IAAA,EAAM,gBAAA,EALiC;EAOvC,MAAA,GAAS,WAAA;AAAA;;KAIC,kBAAA;EAAuB,IAAA;AAAA;;;;;;;UAQlB,YAAA;EAnBiB;;;;AAIlC;;;;;;;;;;AAOA;;;;;AAQA;;;;EAwBE,IAAA,CAAK,IAAA,EAAM,gBAAA,GAAmB,OAAA;EAiBjB;;;;;;;;;;;;;;AACd;EADC,MAAA,CAAO,IAAA,EAAM,kBAAA,GAAqB,OAAA;AAAA;;;;;;KAQ/B,SAAA,aAAsB,WAAA,+BACzB,GAAA,SAAY,WAAA;EACN,QAAA,EAAU,CAAA;EAAG,IAAA,EAAM,CAAA;EAAG,MAAA,EAAQ,CAAA;AAAA;EAC9B,QAAA;EAAmB,IAAA;EAAe,MAAA;AAAA;;;;;KAMrC,gBAAA,0DAA0E,OAAA,4CAIxD,OAAA,cACP,IAAA,IAAQ,MAAA,eACR,IAAA,GAAO,MAAA;;UAGN,aAAA;EATI;;;;EAAA,SAcV,KAAA;EATa;;;;EAAA,SAcb,KAAA;EAnBW;;;;;;EA0BpB,MAAA,IAAU,OAAA;IAAU,KAAA;EAAA;AAAA;;;;AAjBtB;;;;KA2BY,cAAA;EACN,IAAA;EAAgB,KAAA;EAAe,QAAA;EAAkB,UAAA;AAAA;EACjD,IAAA;EAAgB,KAAA;EAAe,QAAA;EAAkB,UAAA;AAAA;EACjD,IAAA;EAAe,KAAA;EAAe,UAAA;AAAA;EAC9B,IAAA;EAAiB,KAAA;EAAe,IAAA;EAAc,WAAA;EAAqB,UAAA;AAAA;EACnE,IAAA;EAAgB,KAAA;EAAe,IAAA;EAAc,UAAA;AAAA;EAE7C,IAAA;EACA,KAAA;EACA,eAAA;EACA,WAAA;EACA,UAAA;AAAA;;KAIM,mBAAA;EAAwB,KAAA;EAAe,UAAA;AAAA;;AAAnD;;;;KAOY,oBAAA;EAAyB,IAAA;EAAc,UAAA;AAAA;;KAGvC,gBAAA;EAAqB,YAAA;EAAsB,UAAA;AAAA;;KAG3C,eAAA;EAAoB,UAAA;AAAA;;KAGpB,iBAAA;EAAsB,UAAA;AAAA;;;;;AASlC;;;KAAY,iBAAA,MAAuB,CAAA,sBAC/B,cAAA,GACA,CAAA,mBACE,mBAAA,GACA,CAAA,uBACE,eAAA,eACA,CAAA,wBACE,gBAAA,GACA,CAAA,8BAEE,CAAA,qBACE,oBAAA,GACA,iBAAA;;;;;KAMF,UAAA,wBACQ,iBAAA,CAAkB,CAAA,KAC/B,MAAA,GAAS,iBAAA,CAAkB,CAAA,MAC3B,MAAA,EAAQ,iBAAA,CAAkB,CAAA;;;;;;;;;;;;;KAcrB,eAAA,wCACV,QAAA,EAAU,CAAA,KACP,IAAA,EAAM,UAAA,CAAW,CAAA,MACjB,OAAA,CAAQ,YAAA;;UAYH,cAAA;EA5CF;EA8CN,UAAA,QAAkB,OAAA;EA5CV;EA8CR,KAAA,GAAQ,IAAA;EA3CI;;;;EAAA,SAgDH,MAAA,EAAQ,aAAA;EAzCG;EA2CpB,aAAA,GAAgB,KAAA,EAAO,GAAA;IAAiB,IAAA;EAAA,MAAmB,OAAA,CAAQ,qBAAA;EAzCnC;EA2ChC,MAAA,EAAQ,eAAA;EA1CuB;EA4C/B,OAAA,QAAe,OAAA;EA5Ce;EA8C9B,SAAA,GAAY,OAAA,EAAS,cAAA;EAjDA;EAmDrB,WAAA,QAAmB,SAAA;EAlDiB;EAoDpC,OAAA;AAAA;;;;;;;AApCF;;;KAgDY,UAAA,aAAuB,WAAA,8BAAyC,WAAA,IAC1E,cAAA,GACE,gBAAA,CAAiB,SAAA,CAAU,GAAA,mBAAsB,UAAA,IACjD,gBAAA,CAAiB,SAAA,CAAU,GAAA,uBAA0B,YAAA;;;;;;;;;KAU7C,kBAAA,aAA+B,WAAA,8BAAyC,WAAA,IAClF,UAAA,CAAW,GAAA,IAAO,gBAAA,CAAiB,SAAA,CAAU,GAAA,2BAA8B,cAAA;;;;;;KAOjE,aAAA,aAA0B,WAAA,8BAAyC,WAAA;EAlEtD,iEAoEvB,MAAA,EAAQ,eAAA,EAxDc;EA0DtB,OAAA,GAAU,aAAA,EAxDQ;EA0DlB,QAAA,GAAW,cAAA,EAjDY;EAmDvB,gBAAA,GAAmB,sBAAA;EAnDwC;;;;EAwD3D,GAAA,GAAM,GAAA,EAhDsB;EAkD5B,GAAA;EAnEA;;;;EAwEA,UAAA,GAAa,eAAA;EAjEI;;;;;EAuEjB,OAAA,GAAU,OAAA;EArEyD;;;;;;;;EA8EnE,KAAA;EAtEmB;;;;AAcrB;EA8DE,SAAA,WA9DoB;EAgEpB,QAAA,GAAW,GAAA,UAAa,GAAA;EAhEkD;;;;;EAsE1E,eAAA;EAnE6B;;;;;EAyE7B,kBAAA;AAAA;AAAA,KAGU,qBAAA;EAA0B,OAAA;AAAA;EAAqB,OAAA;EAAe,UAAA,EAAY,GAAA;AAAA"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/client/core/types.ts"],"mappings":";;;;;;;;;AA6BA;;;;;;;UAAiB,eAAA;EACf,MAAA,CAAO,MAAA,WAAiB,IAAA,YAAgB,OAAA,CAAQ,KAAA;EAChD,OAAA,CACE,UAAA,GAAa,IAAA;IAAQ,iBAAA;EAAA,MAAiC,OAAA,6BACtD,QAAA,IAAY,eAAA;EAEd,SAAA;AAAA;;UAIe,eAAA;EACf,MAAA,CAAO,MAAA,WAAiB,IAAA,YAAgB,OAAA,CAAQ,KAAA;AAAA;;UAOjC,OAAA;EACf,OAAA,CAAQ,GAAA,uCAA0C,OAAA;EAClD,OAAA,CAAQ,GAAA,UAAa,KAAA,kBAAuB,OAAA;EAC5C,UAAA,CAAW,GAAA,kBAAqB,OAAA;AAAA;;UAIxB,eAAA;EACR,GAAA,IAAO,GAAA;EACP,OAAA,CAAQ,WAAA,kBAA6B,OAAA;AAAA;;;;;;AATvC;;;UAoBU,YAAA;EACR,IAAA,CAAK,GAAA,EAAK,GAAA,mBAAsB,GAAA,GAAM,OAAA,iBAAwB,GAAA;AAAA;;UAItD,WAAA;EACR,SAAA,CACE,GAAA,UACA,QAAA,GAAW,KAAA,2BAAgC,OAAA;AAAA;;UAKrC,YAAA;EACR,OAAA,IAAW,GAAA,UAAa,QAAA,QAAgB,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;AAAA;;UAIrD,YAAA;EACR,KAAA,CAAM,IAAA,EAAM,cAAA,EAAgB,SAAA,WAAoB,OAAA,CAAQ,QAAA;AAAA;;;AAnCzD;;;;UA4CgB,aAAA;EACf,WAAA;EACA,OAAA,GAAU,OAAA;EACV,QAAA,GAAW,eAAA;EACX,KAAA,GAAQ,YAAA;EACR,IAAA,GAAO,WAAA;EACP,KAAA,GAAQ,YAAA;EACR,KAAA,GAAQ,YAAA;AAAA;;UAIO,cAAA;EACf,QAAA,GAAW,cAAA;EACX,IAAA,GAAO,UAAA;EACP,MAAA,GAAS,YAAA;AAAA;;;;KAyDC,gBAAA;EACV,UAAA;EACA,QAAA;EACA,eAAA;EACA,uBAAA;EACA,SAAA;EACA,QAAA;AAAA;;;;;;;;;;AAjG0D;;;KAgHhD,YAAA;EACN,IAAA;AAAA;EACA,IAAA;EAAkB,QAAA,EAAU,GAAA;EAAK,QAAA;AAAA;EACjC,IAAA;EAAsB,QAAA;AAAA;EACtB,IAAA;EAAoB,UAAA,EAAY,gBAAA;AAAA;EAChC,IAAA;AAAA;EACA,IAAA;EAAgB,IAAA,EAAM,SAAA;AAAA;;KAWhB,SAAA;EACN,MAAA;EAAmB,KAAA;AAAA;EACnB,MAAA;EAAqB,KAAA;AAAA;EACrB,MAAA;EAAoB,KAAA;AAAA;;KAGd,cAAA,IAAkB,KAAA,EAAO,SAAA;;AAnHrC;;;;;;;KA6HK,sBAAA,GAAyB,iBAAA;EAI1B,QAAA;EACA,MAAA,GAAS,cAAA;EACT,QAAA;EACA,YAAA;EACA,YAAA;EACA,QAAA;AAAA;AAAA,KAKC,kBAAA,GAAqB,iBAAA;AAAA,KAEd,WAAA,gBAA2B,kBAAA,GAAqB,sBAAA;EAC1D,MAAA,EAAQ,MAAA;EACR,OAAA,EAAS,iBAAA,qBAAsC,MAAA,SAAe,KAAA;AAAA;;;;KAMpD,uBAAA;EA9IU,uEAgJpB,IAAA,WA5Ie;EA8If,QAAA;EAEA,eAAA;AAAA;;;;KAMU,qBAAA;EArJC,qDAuJX,KAAA,WAtJO;EAwJP,QAAA;AAAA;;;AA9FF;;;;UAuGiB,cAAA;EArGf;;;;;;;AAmBF;;;;;EA+FE,WAAA;EAzFmC;;;;;;;;;;;;EAuGnC,mBAAA,IAAuB,OAAA;EAvGnB;;;;;AAWN;;;;;;;;;;;EA8GE,QAAA,CAAS,IAAA,GAAO,uBAAA,GAA0B,OAAA,CAAQ,YAAA;EAxGxC;;;;;AAA4C;;;;;;;;EA0HtD,MAAA,CAAO,IAAA,GAAO,qBAAA,GAAwB,OAAA,CAAQ,YAAA;AAAA;;;;KAMpC,gBAAA;EAxGP,kDA0GH,IAAA;EAEA,WAAA;AAAA;AA1GF;AAAA,KA8GY,eAAA;EA9GW,8CAgHrB,GAAA,UAhH0D;EAkH1D,MAAA,UAhH8D;EAkH9D,QAAA,UAlHS;EAoHT,MAAA;AAAA;;KAIU,iBAAA;EA1HgD,gDA4H1D,IAAA,UA3HQ;EA6HR,QAAA,UA5HS;EA8HT,MAAA;AAAA;;KAIU,gBAAA;EA5HA,gDA8HV,IAAA;EAEA,QAAA;AAAA;;;;;AApHF;;UA6HiB,UAAA;EA3Hf;;AAWF;;;;;;;;;;;;;;;;EAmIE,KAAA,CAAM,IAAA,GAAO,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EAtF/B;;;;;;;;;;AAwBX;;;;;AAQA;;;EA0EE,OAAA,CAAQ,IAAA,EAAM,iBAAA,GAAoB,OAAA,CAAQ,YAAA;EAxE1C;;;;;;AAUF;;;;;;;;;AAUA;;;;;EA0EE,MAAA,CAAO,IAAA,EAAM,gBAAA,GAAmB,OAAA,CAAQ,YAAA;AAAA;;KAI9B,gBAAA;EACV,IAAA,EAAM,gBAAA,EA/C0B;EAiDhC,MAAA,GAAS,WAAA;AAAA;;KAIC,kBAAA;EAAuB,IAAA;AAAA;;;;;;;UAQlB,YAAA;EAzCf;;;;;;;;;;;;AA0BF;;;;;;;;;;AAOA;EAgCE,IAAA,CAAK,IAAA,EAAM,gBAAA,GAAmB,OAAA;;;;AAxBhC;;;;;;;;;;;;EAyCE,MAAA,CAAO,IAAA,EAAM,kBAAA,GAAqB,OAAA;AAAA;;;;;;KAQ/B,WAAA,aAAwB,WAAA,KAAgB,GAAA,uCAEzC,YAAA,CAAa,GAAA,iCACX,IAAA,4CAC2B,IAAA,GACvB,OAAA,CAAQ,IAAA,OAAW,IAAA;AAAA,KAKxB,WAAA,aAAwB,WAAA,sCACZ,WAAA,CAAY,GAAA,cAAiB,EAAA,SAAW,WAAA,CAAY,GAAA;AAAA,KAEhE,SAAA,aAAsB,WAAA;EACzB,QAAA,EAAU,WAAA,CAAY,GAAA;EACtB,IAAA,EAAM,WAAA,CAAY,GAAA;EAClB,MAAA,EAAQ,WAAA,CAAY,GAAA;AAAA;;;;;KAOjB,gBAAA,0DAA0E,OAAA,4CAIxD,OAAA,cACP,IAAA,IAAQ,MAAA,eACR,IAAA,GAAO,MAAA;;UAGN,aAAA;EA5BgB;;;;EAAA,SAiCtB,KAAA;EAhCsB;AAAA;;;EAAA,SAqCtB,KAAA;EA/BkB;;;;;;EAsC3B,MAAA,IAAU,OAAA;IAAU,KAAA;EAAA;AAAA;;KAaV,mBAAA,GAAsB,WAAA;;;;;;KAOtB,oBAAA,GAAuB,UAAA;;KASvB,iBAAA,GAAoB,WAAA;;;;;;;;KAS3B,wBAAA,MAA8B,CAAA,sBAC/B,cAAA,GACA,CAAA,mBACE,mBAAA,GACA,CAAA,uBACE,eAAA,eACA,CAAA,wBACE,gBAAA,GACA,CAAA,8BAEE,CAAA,qBACE,oBAAA,GACA,iBAAA;AAAA,KAET,sBAAA,aAAmC,WAAA,OACtC,YAAA,CAAa,GAAA,iCACT,IAAA;EAAe,QAAA,EAAU,CAAA;AAAA,IACvB,IAAA;;KAKI,iBAAA,aAA8B,WAAA,sBACzB,WAAA,CAAY,GAAA,IACvB,wBAAA,CAAyB,CAAA,IACzB,CAAA,kDAEE,CAAA,wBACE,gBAAA,IACC,CAAA,wBACC,oBAAA,GACA,sBAAA,CAAuB,GAAA,EAAK,CAAA,wBACzB,IAAA,4BAEC,IAAA;EAAe,MAAA;AAAA,IACb,MAAA,GACA,IAAA;EAAe,MAAA;AAAA,IACb,MAAA;;;;;KAQR,UAAA,aAAuB,WAAA,yBACf,iBAAA,CAAkB,GAAA,EAAK,CAAA,KACpC,MAAA,GAAS,iBAAA,CAAkB,GAAA,EAAK,CAAA,MAChC,MAAA,EAAQ,iBAAA,CAAkB,GAAA,EAAK,CAAA;;;;;;;;;;;;;KAc1B,eAAA,aAA4B,WAAA,GAAc,WAAA,qBACpC,WAAA,CAAY,GAAA,eAE5B,QAAA,EAAU,CAAA,KACP,IAAA,EAAM,UAAA,CAAW,GAAA,EAAK,CAAA,MACtB,OAAA,CAAQ,YAAA;;UAYH,cAAA,aAA2B,WAAA;EArHlB;EAuHjB,UAAA,QAAkB,OAAA;EA9HT;EAgIT,KAAA,GAAQ,IAAA;EAzHE;;;;EAAA,SA8HD,MAAA,EAAQ,aAAA;EAjHY;EAmH7B,aAAA,GAAgB,KAAA,EAAO,GAAA;IAAiB,IAAA;EAAA,MAAmB,OAAA,CAAQ,qBAAA;EA5GzD;EA8GV,MAAA,EAAQ,eAAA,CAAgB,GAAA;;EAExB,OAAA,QAAe,OAAA;EAhH4B;EAkH3C,SAAA,GAAY,OAAA,EAAS,cAAA;EAzGM;EA2G3B,WAAA,QAAmB,SAAA;EA3GW;EA6G9B,OAAA;AAAA;;;;;;;;;;KAYU,UAAA,aAAuB,WAAA,GAAc,WAAA,IAAe,cAAA,CAAe,GAAA,IAC7E,gBAAA,CAAiB,SAAA,CAAU,GAAA,mBAAsB,UAAA,IACjD,gBAAA,CAAiB,SAAA,CAAU,GAAA,uBAA0B,YAAA;;;;;;;;;KAU3C,kBAAA,aAA+B,WAAA,GAAc,WAAA,IAAe,UAAA,CAAW,GAAA,IACjF,gBAAA,CAAiB,SAAA,CAAU,GAAA,2BAA8B,cAAA;;;;;;KAO/C,aAAA,aAA0B,WAAA,GAAc,WAAA;EA5H1C,iEA8HR,MAAA,EAAQ,eAAA,EA3HI;EA6HZ,OAAA,GAAU,aAAA,EA5HmB;EA8H7B,QAAA,GAAW,cAAA,EA5HR;EA8HH,gBAAA,GAAmB,sBAAA;EA9HM;;;;EAmIzB,GAAA,GAAM,GAAA,EAjIwB;EAmI9B,GAAA;EArI0B;;;;EA0I1B,UAAA,GAAa,eAAA;EAzI6B;;;;;EA+I1C,OAAA,GAAU,OAAA;EA7IA;AAKZ;;;;;;;EAiJE,KAAA;EA9II;;;;;EAoJJ,SAAA,WA9IsC;EAgJtC,QAAA,GAAW,GAAA,UAAa,GAAA;EA/IX;;;;;EAqJb,eAAA;EA/JqD;;;;;EAqKrD,kBAAA;AAAA;AAAA,KAGU,qBAAA;EAA0B,OAAA;AAAA;EAAqB,OAAA;EAAe,UAAA,EAAY,GAAA;AAAA"}

package/dist/client/core/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../../src/client/core/types.ts"],"sourcesContent":["import type { FunctionReference } from \"convex/server\";\nimport type { ConvexError, Value } from \"convex/values\";\n\nimport type { AccessToken } from \"../../shared/brand\";\nimport type {\n  AuthParameters,\n  AuthTokens,\n  SignInFlowResult,\n  SignInWebAuthnOptionsResult,\n} from \"../../shared/results\";\nimport type { ErrorCode } from \"../../shared/codes\";\n\n/**\n * Structural interface for any Convex client.\n * Satisfied by `ConvexClient` (`convex/browser`),\n * `ConvexReactClient` (`convex/react`), and similar transports.\n *\n * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`\n * but not on the simplified `ConvexClient`. When available we call it\n * during sign-out for a clean deauthentication.\n */\nexport interface ConvexTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n  setAuth(\n    fetchToken: (args: { forceRefreshToken: boolean }) => Promise<string | null | undefined>,\n    onChange?: (isAuthenticated: boolean) => void,\n  ): void;\n  clearAuth?(): void;\n}\n\n/** Minimal action-only transport used for unauthenticated auth flows. */\nexport interface ActionTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n}\n\n/** @internal */\nexport type SignInApiRef = { signIn: AuthApiRefs[\"signIn\"] };\n\n/** Pluggable key-value storage supplied by the host runtime. */\nexport interface Storage {\n  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\n/** Platform-neutral location/navigation hooks. */\ninterface LocationRuntime {\n  get(): URL | null;\n  replace(relativeUrl: string): void | Promise<void>;\n}\n\n/**\n * Platform-specific OAuth launch primitive.\n *\n * `open` receives the provider authorization URL. Platforms that navigate the\n * whole page away (browser) return nothing; platforms that run the flow in an\n * in-app session (Expo) return the callback URL so the core can complete the\n * exchange inline.\n */\ninterface OAuthRuntime {\n  open(url: URL): void | string | URL | Promise<void | string | URL>;\n}\n\n/** Cross-context synchronization hooks, such as browser storage events. */\ninterface SyncRuntime {\n  subscribe(\n    key: string,\n    callback: (value: string | null) => void | Promise<void>,\n  ): (() => void) | null;\n}\n\n/** Cross-context mutex/locking primitive. */\ninterface MutexRuntime {\n  withKey<T>(key: string, callback: () => Promise<T>): Promise<T>;\n}\n\n/** Proxy request execution supplied by the host runtime. */\ninterface ProxyRuntime {\n  fetch(body: AuthParameters, proxyPath: string): Promise<Response>;\n}\n\n/**\n * Platform-neutral client runtime dependencies.\n *\n * The core `client` package should depend only on these interfaces, while the\n * browser package can provide concrete implementations backed by DOM APIs.\n */\nexport interface ClientRuntime {\n  environment?: \"client\" | \"server\";\n  storage?: Storage | null;\n  location?: LocationRuntime;\n  oauth?: OAuthRuntime;\n  sync?: SyncRuntime;\n  mutex?: MutexRuntime;\n  proxy?: ProxyRuntime;\n}\n\n/** Platform-specific factor adapters injected by entrypoints like `browser`. */\nexport interface ClientAdapters {\n  webauthn?: WebAuthnClient;\n  totp?: TotpClient;\n  device?: DeviceClient;\n}\n\n/**\n * Shared dependencies threaded into every factor client (`totp`, `device`,\n * `webauthn`). The core `client` builds one of these and passes it to each\n * factor factory.\n *\n * @internal\n */\nexport interface FactorDeps {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => SignInApiRef;\n  proxyFetch: (body: AuthParameters) => Promise<Value>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthTokens | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: AccessToken } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n}\n\n/**\n * Dependencies provided to platform-specific factor adapters.\n *\n * @internal\n */\nexport type ClientAdapterDeps = FactorDeps;\n\n/**\n * Factory overrides for platform-specific factor adapters.\n *\n * @internal\n */\nexport interface ClientAdapterFactories {\n  webauthn?: (deps: ClientAdapterDeps) => WebAuthnClient;\n}\n\n/** @internal */\nexport type SignInActionResult = SignInFlowResult<AuthTokens | null>;\n\n/** @internal */\nexport type WebAuthnRotationResult = Extract<SignInWebAuthnOptionsResult, { operation: \"rotate\" }>;\n\n/**\n * Device authorization payload returned from the `deviceCode` sign-in flow.\n */\nexport type DeviceCodeResult = {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string;\n  expiresIn: number;\n  interval: number;\n};\n\n/**\n * Result of a `signIn` call.\n *\n * - `kind: \"signedIn\"` — credentials were accepted and a client session is now available.\n * - `kind: \"redirect\"` — OAuth flow initiated; redirect the user to `redirect.toString()`.\n * - `kind: \"totpRequired\"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.\n * - `kind: \"deviceCode\"` — device flow initiated; display the code and poll via `auth.device.poll()`.\n * - `kind: \"started\"` — a non-immediate flow started (for example email/phone verification).\n * - `kind: \"failed\"` — the flow did not complete; `code` is the typed {@link ErrorCode}.\n *\n * @see {@link AuthState}\n */\nexport type SignInResult =\n  | { kind: \"signedIn\" }\n  | { kind: \"redirect\"; redirect: URL; verifier: string }\n  | { kind: \"totpRequired\"; verifier: string }\n  | { kind: \"deviceCode\"; deviceCode: DeviceCodeResult }\n  | { kind: \"started\" }\n  | { kind: \"failed\"; code: ErrorCode };\n\n/** @internal */\nexport type AuthSnapshot = {\n  phase: \"loading\" | \"handshake\" | \"authenticated\" | \"unauthenticated\";\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  token: string | null;\n};\n\n/** Reactive auth state. `token` is non-null only after Convex confirms auth. */\nexport type AuthState =\n  | { status: \"loading\"; token: null }\n  | { status: \"signedOut\"; token: null }\n  | { status: \"signedIn\"; token: string };\n\n/** Handler for `auth.subscribe`. */\nexport type AuthSubscriber = (state: AuthState) => void;\n\n/**\n * Typed Convex API references for the auth functions.\n * Pass these from your generated `api` object.\n *\n * @typeParam HasWebAuthn - Whether the WebAuthn provider is configured.\n * @typeParam HasTotp - Whether the TOTP provider is configured.\n * @typeParam HasDevice - Whether the device provider is configured.\n */\nexport type AuthApiRefs<\n  HasWebAuthn extends boolean = boolean,\n  HasTotp extends boolean = boolean,\n  HasDevice extends boolean = boolean,\n> = {\n  signIn: FunctionReference<\"action\", \"public\", Record<string, Value>, unknown>;\n  signOut: FunctionReference<\"action\", \"public\", Record<string, Value>, unknown>;\n  /** @internal Set automatically by `defineAuth` — do not set manually. */\n  _capabilities?: {\n    webauthn: HasWebAuthn;\n    totp: HasTotp;\n    device: HasDevice;\n  };\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.register}.\n */\nexport type WebAuthnRegisterOptions = {\n  /** Human-readable label for this credential (e.g. `\"MacBook Pro\"`). */\n  name?: string;\n  /** WebAuthn `user.name` override. */\n  userName?: string;\n  /** WebAuthn `user.displayName` override. */\n  userDisplayName?: string;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.signIn}.\n */\nexport type WebAuthnSignInOptions = {\n  /** Email hint to filter discoverable credentials. */\n  email?: string;\n  /** Set to `true` for conditional UI (autofill) mode. */\n  autofill?: boolean;\n};\n\n/**\n * WebAuthn client-side helpers.\n *\n * @see {@link TotpClient}\n * @see {@link DeviceClient}\n */\nexport interface WebAuthnClient {\n  /**\n   * Check whether the current runtime exposes WebAuthn passkey APIs.\n   *\n   * @returns `true` when `navigator.credentials` is available.\n   *\n   * @example\n   * ```ts\n   * if (auth.webauthn.isSupported()) {\n   *   // Show passkey registration button\n   * }\n   * ```\n   */\n  isSupported(): boolean;\n\n  /**\n   * Check whether conditional mediation (autofill-style passkeys) is available.\n   *\n   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.\n   *\n   * @example\n   * ```ts\n   * if (await auth.webauthn.isAutofillSupported()) {\n   *   await auth.webauthn.signIn({ autofill: true });\n   * }\n   * ```\n   */\n  isAutofillSupported(): Promise<boolean>;\n\n  /**\n   * Start a passkey registration flow and complete the WebAuthn ceremony.\n   *\n   * Creates a new credential bound to the current user's account.\n   *\n   * @param opts - Optional registration hints.\n   * @param opts.name - Human-readable name for the passkey (e.g. `\"MacBook Pro\"`).\n   * @param opts.userName - WebAuthn `user.name` override.\n   * @param opts.userDisplayName - WebAuthn `user.displayName` override.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.register({ name: \"My laptop\" });\n   * ```\n   */\n  register(opts?: WebAuthnRegisterOptions): Promise<SignInResult>;\n\n  /** @internal Complete registration options returned by a provider continuation. */\n  completeRegistration(result: WebAuthnRotationResult): Promise<SignInResult>;\n\n  /**\n   * Sign in with an existing passkey and complete the WebAuthn ceremony.\n   *\n   * @param opts - Optional sign-in hints.\n   * @param opts.email - Email hint to filter discoverable credentials.\n   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.signIn();\n   * ```\n   */\n  signIn(opts?: WebAuthnSignInOptions): Promise<SignInResult>;\n}\n\n/**\n * Optional hints for {@link TotpClient.setup}.\n */\nexport type TotpSetupOptions = {\n  /** Issuer name shown in the authenticator app. */\n  name?: string;\n  /** Account label shown in the authenticator app. */\n  accountName?: string;\n};\n\n/** Result of {@link TotpClient.setup}. */\nexport type TotpSetupResult = {\n  /** `otpauth://` URL — render as a QR code. */\n  uri: string;\n  /** Raw base32-encoded shared secret. */\n  secret: string;\n  /** Verifier token to pass to {@link TotpClient.confirm}. */\n  verifier: string;\n  /** Factor ID to pass to {@link TotpClient.confirm}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.confirm}. */\nexport type TotpConfirmParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from {@link TotpSetupResult.verifier}. */\n  verifier: string;\n  /** Factor ID from {@link TotpSetupResult.totpId}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.verify}. */\nexport type TotpVerifyParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from a `totpRequired` sign-in result. */\n  verifier: string;\n};\n\n/**\n * TOTP two-factor authentication client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link DeviceClient}\n */\nexport interface TotpClient {\n  /**\n   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.\n   *\n   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code\n   * for the user to scan with their authenticator app.\n   *\n   * @param opts - Optional setup hints.\n   * @param opts.name - Issuer name shown in the authenticator app.\n   * @param opts.accountName - Account label in the authenticator app.\n   * @returns An object with `{ uri, secret, verifier, totpId }`.\n   *\n   * @example\n   * ```ts\n   * const { uri, secret, verifier, totpId } = await auth.totp.setup();\n   * // Render `uri` as a QR code, then confirm:\n   * await auth.totp.confirm({ code: userCode, verifier, totpId });\n   * ```\n   */\n  setup(opts?: TotpSetupOptions): Promise<TotpSetupResult>;\n\n  /**\n   * Confirm a newly created TOTP factor with the first authenticator code.\n   *\n   * Call this after the user scans the QR code and enters the first OTP.\n   *\n   * @param opts - Confirmation parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.\n   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.totp.confirm({ code: \"123456\", verifier, totpId });\n   * if (result.kind === \"failed\") showError(result.code);\n   * ```\n   */\n  confirm(opts: TotpConfirmParams): Promise<SignInResult>;\n\n  /**\n   * Complete a sign-in that is waiting on TOTP verification.\n   *\n   * Called when `signIn()` returns `{ kind: \"totpRequired\" }`.\n   *\n   * @param opts - Verification parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string from the `totpRequired` result.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.signIn(\"password\", { email, password });\n   * if (result.kind === \"totpRequired\") {\n   *   const totp = await auth.totp.verify({ code: totpCode, verifier: result.verifier });\n   *   if (totp.kind === \"failed\") showError(totp.code);\n   * }\n   * ```\n   */\n  verify(opts: TotpVerifyParams): Promise<SignInResult>;\n}\n\n/** Params for {@link DeviceClient.poll}. */\nexport type DevicePollParams = {\n  code: DeviceCodeResult;\n  /** Aborts the poll loop cleanly, e.g. on UI unmount. */\n  signal?: AbortSignal;\n};\n\n/** Params for {@link DeviceClient.verify}. */\nexport type DeviceVerifyParams = { code: string };\n\n/**\n * Device authorization (RFC 8628) client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link TotpClient}\n */\nexport interface DeviceClient {\n  /**\n   * Poll until a device flow is approved or expires.\n   *\n   * Polls the server at the interval specified in the {@link DeviceCodeResult}\n   * until the user authorizes the device or the code expires.\n   *\n   * @param opts - Poll options.\n   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn(\"device\")`.\n   * @param opts.signal - Optional {@link AbortSignal}; aborting returns cleanly\n   *   at the next loop boundary (e.g. on UI unmount).\n   * @throws `ConvexError({ code: \"DEVICE_CODE_EXPIRED\" })` when the code expires before authorization.\n   *\n   * @example\n   * ```ts\n   * const controller = new AbortController();\n   * const result = await auth.signIn(\"device\");\n   * if (result.kind === \"deviceCode\") {\n   *   // Display result.deviceCode.userCode to the user\n   *   await auth.device.poll({ code: result.deviceCode, signal: controller.signal });\n   *   console.log(\"Device authorized!\");\n   * }\n   * ```\n   */\n  poll(opts: DevicePollParams): Promise<void>;\n\n  /**\n   * Approve a device flow from the verification page using the displayed user code.\n   *\n   * Call this on the authorization page where the user enters the short code\n   * shown on the device screen.\n   *\n   * @param opts - Verification options.\n   * @param opts.code - The user code string (e.g. `\"WDJB-MJHT\"`).\n   * @throws `ConvexError({ code: \"DEVICE_AUTHORIZATION_FAILED\" })` when verification fails.\n   *\n   * @example\n   * ```ts\n   * await auth.device.verify({ code: \"WDJB-MJHT\" });\n   * ```\n   */\n  verify(opts: DeviceVerifyParams): Promise<void>;\n}\n\n/**\n * Extract capability flags from an AuthApiRefs type.\n *\n * @typeParam Api - An AuthApiRefs type to extract capability flags from.\n */\ntype InferCaps<Api extends AuthApiRefs<boolean, boolean, boolean>> =\n  Api extends AuthApiRefs<infer P, infer T, infer D>\n    ? { webauthn: P; totp: T; device: D }\n    : { webauthn: boolean; totp: boolean; device: boolean };\n\n/**\n * Include a capability when configured, omit it when disabled, and keep it\n * optional when a framework binding cannot know the capability.\n */\ntype CapabilityClient<Enabled extends boolean, Name extends string, Client> = [Enabled] extends [\n  false,\n]\n  ? {}\n  : [boolean] extends [Enabled]\n    ? { [Key in Name]?: Client }\n    : { [Key in Name]: Client };\n\n/** Pending invite detected from URL or recovered from storage after redirect. */\nexport interface PendingInvite {\n  /**\n   * Raw one-time invite token. Pass to your invite acceptance mutation.\n   * @readonly\n   */\n  readonly token: string;\n  /**\n   * Invite email from the URL or stored redirect state, if available.\n   * @readonly\n   */\n  readonly email: string | null;\n  /**\n   * Consume the invite: clears storage/URL params and returns the token.\n   *\n   * @returns The invite token.\n   * @throws When there is no pending invite to accept.\n   */\n  accept(): Promise<{ token: string }>;\n}\n\n/**\n * Discriminated union of params for the password provider's flows.\n *\n * Each branch maps to one of the six password flows: `signUp`, `signIn`,\n * `reset`, `recover`, `verify`, `change`. Selecting a `flow` literal narrows the\n * accepted params automatically.\n */\nexport type PasswordParams =\n  | { flow: \"signUp\"; email: string; password: string; redirectTo?: string }\n  | { flow: \"signIn\"; email: string; password: string; redirectTo?: string }\n  | { flow: \"reset\"; email: string; redirectTo?: string }\n  | { flow: \"recover\"; email: string; code: string; newPassword: string; redirectTo?: string }\n  | { flow: \"verify\"; email: string; code: string; redirectTo?: string }\n  | {\n      flow: \"change\";\n      email: string;\n      currentPassword: string;\n      newPassword: string;\n      redirectTo?: string;\n    };\n\n/** Params for the email (magic link) provider's initiation step. */\nexport type EmailInitiateParams = { email: string; redirectTo?: string };\n\n/**\n * Params for completing a code-based flow (no provider). Used to finalise\n * email magic-link sign-ins and other provider-owned code flows when the\n * verification call is made without re-specifying the originating provider.\n */\nexport type CodeCompletionParams = { code: string; redirectTo?: string };\n\n/** Params for the `connection` provider — requires a connection ID. */\nexport type ConnectionParams = { connectionId: string; redirectTo?: string };\n\n/** Params for the anonymous provider. Empty / `redirectTo` only. */\nexport type AnonymousParams = { redirectTo?: string };\n\n/** Default params shape for OAuth-style providers (google, github, etc.). */\nexport type OAuthSignInParams = { redirectTo?: string };\n\n/**\n * Resolves the `params` argument shape from the `provider` literal.\n *\n * Known special providers (`\"password\"`, `\"email\"`, etc.) get strict typing.\n * Any other string falls back to OAuth-style params, since custom OAuth\n * providers can be registered under arbitrary IDs.\n */\nexport type ParamsForProvider<P> = P extends \"password\"\n  ? PasswordParams\n  : P extends \"email\"\n    ? EmailInitiateParams\n    : P extends \"anonymous\"\n      ? AnonymousParams | undefined\n      : P extends \"connection\"\n        ? ConnectionParams\n        : P extends \"webauthn\"\n          ? never\n          : P extends undefined\n            ? CodeCompletionParams\n            : OAuthSignInParams | undefined;\n\n/**\n * Tuple-rest helper that flips `params` between required and optional based\n * on whether `undefined` is in its resolved type.\n */\nexport type SignInArgs<P> =\n  undefined extends ParamsForProvider<P>\n    ? [params?: ParamsForProvider<P>]\n    : [params: ParamsForProvider<P>];\n\n/**\n * Public signature for `auth.signIn`. The provider literal discriminates the\n * params shape via {@link ParamsForProvider}, and the params slot is\n * automatically optional when the resolved type permits `undefined`.\n *\n * @example\n * ```ts\n * auth.signIn(\"password\", { flow: \"signIn\", email, password });\n * auth.signIn(\"password\", { flow: \"change\", email, currentPassword, newPassword });\n * auth.signIn(\"anonymous\"); // params optional\n * ```\n */\nexport type SignInOverloads = <const P extends string | undefined>(\n  provider: P,\n  ...args: SignInArgs<P>\n) => Promise<SignInResult>;\n\n/**\n * Internal-only loose signature for the `signIn` value. Use this when\n * forwarding through wrappers where TypeScript cannot select an overload\n * from the wrapper's union-typed `provider` argument.\n *\n * @internal\n */\nexport type SignInImpl = (provider?: string, params?: AuthParameters) => Promise<SignInResult>;\n\n/** Base auth client — always present. */\ninterface AuthClientBase {\n  /** Restore initial auth state for the current runtime. */\n  initialize: () => Promise<void>;\n  /** SSR-safe query-param reader. */\n  param: (name: string) => string | null;\n  /**\n   * Pending invite recovered from the URL or storage, if present.\n   * @readonly\n   */\n  readonly invite: PendingInvite | null;\n  /** Complete an OAuth callback using a URL or authorization code. */\n  completeOAuth: (input: URL | string | { code: string }) => Promise<OAuthCompletionResult>;\n  /** Start a sign-in flow for a provider. */\n  signIn: SignInOverloads;\n  /** Sign out and clear local auth state. */\n  signOut: () => Promise<void>;\n  /** Subscribe to auth state changes; returns an unsubscribe. */\n  subscribe: (handler: AuthSubscriber) => () => void;\n  /** Read the current auth state synchronously, e.g. for `useSyncExternalStore`. */\n  getSnapshot: () => AuthState;\n  /** Tear down listeners and reject in-flight handshakes. */\n  destroy: () => void;\n}\n\n/**\n * Framework-agnostic auth client return type.\n *\n * Conditionally includes `totp` and `device` helpers based on the\n * capabilities in the `AuthApiRefs` type. Platform-specific `webauthn` helpers\n * are added by {@link PlatformAuthClient}.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type AuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> =\n  AuthClientBase &\n    CapabilityClient<InferCaps<Api>[\"totp\"], \"totp\", TotpClient> &\n    CapabilityClient<InferCaps<Api>[\"device\"], \"device\", DeviceClient>;\n\n/**\n * Browser auth client return type.\n *\n * Extends {@link AuthClient} with conditional WebAuthn helpers when the\n * generated auth API exposes WebAuthn capabilities.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type PlatformAuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> =\n  AuthClient<Api> & CapabilityClient<InferCaps<Api>[\"webauthn\"], \"webauthn\", WebAuthnClient>;\n\n/**\n * Options for {@link client}.\n *\n * @typeParam Api - An AuthApiRefs type.\n */\nexport type ClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = {\n  /** Any Convex client implementation used to run auth actions. */\n  convex: ConvexTransport;\n  /** Platform runtime implementation used by the client core. */\n  runtime?: ClientRuntime;\n  /** Platform-specific factor adapters supplied by higher-level entrypoints. */\n  adapters?: ClientAdapters;\n  /** Platform-specific adapter factories supplied by higher-level entrypoints. */\n  adapterFactories?: ClientAdapterFactories;\n  /**\n   * Typed auth function refs from your generated `api` object.\n   * Required outside proxy mode.\n   */\n  api?: Api;\n  /** Explicit Convex deployment URL when it cannot be inferred from the client. */\n  url?: string;\n  /**\n   * Optional action-only transport for direct code exchange outside proxy mode.\n   * Required in non-browser runtimes when `proxyPath` is not set.\n   */\n  httpClient?: ActionTransport | null;\n  /**\n   * Storage backend for persisted tokens.\n   *\n   * Defaults to `runtime.storage` when provided, otherwise `null`.\n   */\n  storage?: Storage | null;\n  /**\n   * Server-known auth used to seed the synchronous boot so SSR and hydration\n   * render the resolved state on first paint. A non-empty JWT boots signed in;\n   * `null` boots signed out. Providing this at all marks auth as resolved, so\n   * the client skips the loading phase. Omit it (leave `undefined`) to read the\n   * persisted value from `storage` instead. Ongoing persistence always uses\n   * `storage`.\n   */\n  token?: string | null;\n  /**\n   * Proxy endpoint used instead of direct Convex auth calls.\n   * When set, provide `runtime.proxy` and omit direct `api`/`httpClient`\n   * transport requirements.\n   */\n  proxyPath?: string;\n  /** SSR-safe URL source for reading query parameters. */\n  location?: URL | (() => URL | null);\n  /**\n   * Default OAuth `redirectTo` applied to `signIn` calls that omit it. Platform\n   * entrypoints set this (e.g. Expo passes its native redirect URI) so the core\n   * can build the authorization URL without a platform-specific `signIn` wrapper.\n   */\n  oauthRedirectTo?: string;\n  /**\n   * Milliseconds to wait for the Convex client to confirm a new token\n   * before a sign-in handshake rejects with `AUTH_HANDSHAKE_TIMEOUT`.\n   * Defaults to `5000`.\n   */\n  handshakeTimeoutMs?: number;\n};\n\nexport type OAuthCompletionResult = { handled: false } | { handled: true; cleanupUrl: URL | null };\n\n/**\n * Metadata describing the current auth flow for handshake diagnostics.\n *\n * @internal\n */\nexport type AuthFlowContext = {\n  provider?: string;\n  flow: string;\n};\n\n/**\n * A simple deferred promise that can be resolved or rejected externally.\n */\ninterface SimpleDeferred<T, E = unknown> {\n  readonly promise: Promise<T>;\n  resolve(value: T): void;\n  reject(error: E): void;\n}\n\n/**\n * Create a deferred promise that can be resolved or rejected externally.\n *\n * @returns A deferred object containing the promise and control methods.\n * @internal\n */\nexport function createDeferred<T, E = unknown>(): SimpleDeferred<T, E> {\n  let resolve!: (value: T) => void;\n  let reject!: (error: E) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej as (error: E) => void;\n  });\n  return { promise, resolve, reject };\n}\n\n/** @internal */\nexport type HandshakeWaiter = {\n  epoch: number;\n  context: AuthFlowContext;\n  deferred: SimpleDeferred<void, ConvexError<Value>>;\n  timeoutId: ReturnType<typeof setTimeout>;\n};\n"],"mappings":";;;;;;;AAkwBA,SAAgB,iBAAuD;CACrE,IAAI;CACJ,IAAI;AAKJ,QAAO;EAAE,SAJO,IAAI,SAAY,KAAK,QAAQ;AAC3C,aAAU;AACV,YAAS;IACT;EACgB;EAAS;EAAQ"}
+{"version":3,"file":"types.js","names":[],"sources":["../../../src/client/core/types.ts"],"sourcesContent":["import type { FunctionArgs, FunctionReference } from \"convex/server\";\nimport type { ConvexError, Value } from \"convex/values\";\n\nimport type { AccessToken } from \"../../shared/brand\";\nimport type {\n  AnonymousParams,\n  CodeParams,\n  ConnectionParams,\n  EmailParams,\n  OAuthParams,\n  PasswordParams,\n} from \"../../shared/params\";\nimport type {\n  AuthParameters,\n  AuthTokens,\n  SignInFlowResult,\n  SignInWebAuthnOptionsResult,\n} from \"../../shared/results\";\nimport type { ErrorCode } from \"../../shared/codes\";\n\n/**\n * Structural interface for any Convex client.\n * Satisfied by `ConvexClient` (`convex/browser`),\n * `ConvexReactClient` (`convex/react`), and similar transports.\n *\n * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`\n * but not on the simplified `ConvexClient`. When available we call it\n * during sign-out for a clean deauthentication.\n */\nexport interface ConvexTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n  setAuth(\n    fetchToken: (args: { forceRefreshToken: boolean }) => Promise<string | null | undefined>,\n    onChange?: (isAuthenticated: boolean) => void,\n  ): void;\n  clearAuth?(): void;\n}\n\n/** Minimal action-only transport used for unauthenticated auth flows. */\nexport interface ActionTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n}\n\n/** @internal */\nexport type SignInApiRef = { signIn: AuthApiRefs[\"signIn\"] };\n\n/** Pluggable key-value storage supplied by the host runtime. */\nexport interface Storage {\n  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\n/** Platform-neutral location/navigation hooks. */\ninterface LocationRuntime {\n  get(): URL | null;\n  replace(relativeUrl: string): void | Promise<void>;\n}\n\n/**\n * Platform-specific OAuth launch primitive.\n *\n * `open` receives the provider authorization URL. Platforms that navigate the\n * whole page away (browser) return nothing; platforms that run the flow in an\n * in-app session (Expo) return the callback URL so the core can complete the\n * exchange inline.\n */\ninterface OAuthRuntime {\n  open(url: URL): void | string | URL | Promise<void | string | URL>;\n}\n\n/** Cross-context synchronization hooks, such as browser storage events. */\ninterface SyncRuntime {\n  subscribe(\n    key: string,\n    callback: (value: string | null) => void | Promise<void>,\n  ): (() => void) | null;\n}\n\n/** Cross-context mutex/locking primitive. */\ninterface MutexRuntime {\n  withKey<T>(key: string, callback: () => Promise<T>): Promise<T>;\n}\n\n/** Proxy request execution supplied by the host runtime. */\ninterface ProxyRuntime {\n  fetch(body: AuthParameters, proxyPath: string): Promise<Response>;\n}\n\n/**\n * Platform-neutral client runtime dependencies.\n *\n * The core `client` package should depend only on these interfaces, while the\n * browser package can provide concrete implementations backed by DOM APIs.\n */\nexport interface ClientRuntime {\n  environment?: \"client\" | \"server\";\n  storage?: Storage | null;\n  location?: LocationRuntime;\n  oauth?: OAuthRuntime;\n  sync?: SyncRuntime;\n  mutex?: MutexRuntime;\n  proxy?: ProxyRuntime;\n}\n\n/** Platform-specific factor adapters injected by entrypoints like `browser`. */\nexport interface ClientAdapters {\n  webauthn?: WebAuthnClient;\n  totp?: TotpClient;\n  device?: DeviceClient;\n}\n\n/**\n * Shared dependencies threaded into every factor client (`totp`, `device`,\n * `webauthn`). The core `client` builds one of these and passes it to each\n * factor factory.\n *\n * @internal\n */\nexport interface FactorDeps {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => SignInApiRef;\n  proxyFetch: (body: AuthParameters) => Promise<Value>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthTokens | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: AccessToken } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n}\n\n/**\n * Dependencies provided to platform-specific factor adapters.\n *\n * @internal\n */\nexport type ClientAdapterDeps = FactorDeps;\n\n/**\n * Factory overrides for platform-specific factor adapters.\n *\n * @internal\n */\nexport interface ClientAdapterFactories {\n  webauthn?: (deps: ClientAdapterDeps) => WebAuthnClient;\n}\n\n/** @internal */\nexport type SignInActionResult = SignInFlowResult<AuthTokens | null>;\n\n/** @internal */\nexport type WebAuthnRotationResult = Extract<SignInWebAuthnOptionsResult, { operation: \"rotate\" }>;\n\n/**\n * Device authorization payload returned from the `deviceCode` sign-in flow.\n */\nexport type DeviceCodeResult = {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string;\n  expiresIn: number;\n  interval: number;\n};\n\n/**\n * Result of a `signIn` call.\n *\n * - `kind: \"signedIn\"` — credentials were accepted and a client session is now available.\n * - `kind: \"redirect\"` — OAuth flow initiated; redirect the user to `redirect.toString()`.\n * - `kind: \"totpRequired\"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.\n * - `kind: \"deviceCode\"` — device flow initiated; display the code and poll via `auth.device.poll()`.\n * - `kind: \"started\"` — a non-immediate flow started (for example email/phone verification).\n * - `kind: \"failed\"` — the flow did not complete; `code` is the typed {@link ErrorCode}.\n *\n * @see {@link AuthState}\n */\nexport type SignInResult =\n  | { kind: \"signedIn\" }\n  | { kind: \"redirect\"; redirect: URL; verifier: string }\n  | { kind: \"totpRequired\"; verifier: string }\n  | { kind: \"deviceCode\"; deviceCode: DeviceCodeResult }\n  | { kind: \"started\" }\n  | { kind: \"failed\"; code: ErrorCode };\n\n/** @internal */\nexport type AuthSnapshot = {\n  phase: \"loading\" | \"handshake\" | \"authenticated\" | \"unauthenticated\";\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  token: string | null;\n};\n\n/** Reactive auth state. `token` is non-null only after Convex confirms auth. */\nexport type AuthState =\n  | { status: \"loading\"; token: null }\n  | { status: \"signedOut\"; token: null }\n  | { status: \"signedIn\"; token: string };\n\n/** Handler for `auth.subscribe`. */\nexport type AuthSubscriber = (state: AuthState) => void;\n\n/**\n * Typed Convex API references for the auth functions.\n * Pass these from your generated `api` object.\n *\n * @typeParam HasWebAuthn - Whether the WebAuthn provider is configured.\n * @typeParam HasTotp - Whether the TOTP provider is configured.\n * @typeParam HasDevice - Whether the device provider is configured.\n */\ntype DefaultSignInReference = FunctionReference<\n  \"action\",\n  \"public\",\n  {\n    provider?: string;\n    params?: AuthParameters;\n    verifier?: string;\n    continuation?: string;\n    refreshToken?: string;\n    calledBy?: string;\n  },\n  unknown\n>;\n\ntype AnySignInReference = FunctionReference<\"action\", \"public\", any, any>;\n\nexport type AuthApiRefs<SignIn extends AnySignInReference = DefaultSignInReference> = {\n  signIn: SignIn;\n  signOut: FunctionReference<\"action\", \"public\", Record<string, Value>, unknown>;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.register}.\n */\nexport type WebAuthnRegisterOptions = {\n  /** Human-readable label for this credential (e.g. `\"MacBook Pro\"`). */\n  name?: string;\n  /** WebAuthn `user.name` override. */\n  userName?: string;\n  /** WebAuthn `user.displayName` override. */\n  userDisplayName?: string;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.signIn}.\n */\nexport type WebAuthnSignInOptions = {\n  /** Email hint to filter discoverable credentials. */\n  email?: string;\n  /** Set to `true` for conditional UI (autofill) mode. */\n  autofill?: boolean;\n};\n\n/**\n * WebAuthn client-side helpers.\n *\n * @see {@link TotpClient}\n * @see {@link DeviceClient}\n */\nexport interface WebAuthnClient {\n  /**\n   * Check whether the current runtime exposes WebAuthn passkey APIs.\n   *\n   * @returns `true` when `navigator.credentials` is available.\n   *\n   * @example\n   * ```ts\n   * if (auth.webauthn.isSupported()) {\n   *   // Show passkey registration button\n   * }\n   * ```\n   */\n  isSupported(): boolean;\n\n  /**\n   * Check whether conditional mediation (autofill-style passkeys) is available.\n   *\n   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.\n   *\n   * @example\n   * ```ts\n   * if (await auth.webauthn.isAutofillSupported()) {\n   *   await auth.webauthn.signIn({ autofill: true });\n   * }\n   * ```\n   */\n  isAutofillSupported(): Promise<boolean>;\n\n  /**\n   * Start a passkey registration flow and complete the WebAuthn ceremony.\n   *\n   * Creates a new credential bound to the current user's account.\n   *\n   * @param opts - Optional registration hints.\n   * @param opts.name - Human-readable name for the passkey (e.g. `\"MacBook Pro\"`).\n   * @param opts.userName - WebAuthn `user.name` override.\n   * @param opts.userDisplayName - WebAuthn `user.displayName` override.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.register({ name: \"My laptop\" });\n   * ```\n   */\n  register(opts?: WebAuthnRegisterOptions): Promise<SignInResult>;\n\n  /** @internal Complete registration options returned by a provider continuation. */\n  completeRegistration(result: WebAuthnRotationResult): Promise<SignInResult>;\n\n  /**\n   * Sign in with an existing passkey and complete the WebAuthn ceremony.\n   *\n   * @param opts - Optional sign-in hints.\n   * @param opts.email - Email hint to filter discoverable credentials.\n   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.signIn();\n   * ```\n   */\n  signIn(opts?: WebAuthnSignInOptions): Promise<SignInResult>;\n}\n\n/**\n * Optional hints for {@link TotpClient.setup}.\n */\nexport type TotpSetupOptions = {\n  /** Issuer name shown in the authenticator app. */\n  name?: string;\n  /** Account label shown in the authenticator app. */\n  accountName?: string;\n};\n\n/** Result of {@link TotpClient.setup}. */\nexport type TotpSetupResult = {\n  /** `otpauth://` URL — render as a QR code. */\n  uri: string;\n  /** Raw base32-encoded shared secret. */\n  secret: string;\n  /** Verifier token to pass to {@link TotpClient.confirm}. */\n  verifier: string;\n  /** Factor ID to pass to {@link TotpClient.confirm}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.confirm}. */\nexport type TotpConfirmParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from {@link TotpSetupResult.verifier}. */\n  verifier: string;\n  /** Factor ID from {@link TotpSetupResult.totpId}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.verify}. */\nexport type TotpVerifyParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from a `totpRequired` sign-in result. */\n  verifier: string;\n};\n\n/**\n * TOTP two-factor authentication client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link DeviceClient}\n */\nexport interface TotpClient {\n  /**\n   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.\n   *\n   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code\n   * for the user to scan with their authenticator app.\n   *\n   * @param opts - Optional setup hints.\n   * @param opts.name - Issuer name shown in the authenticator app.\n   * @param opts.accountName - Account label in the authenticator app.\n   * @returns An object with `{ uri, secret, verifier, totpId }`.\n   *\n   * @example\n   * ```ts\n   * const { uri, secret, verifier, totpId } = await auth.totp.setup();\n   * // Render `uri` as a QR code, then confirm:\n   * await auth.totp.confirm({ code: userCode, verifier, totpId });\n   * ```\n   */\n  setup(opts?: TotpSetupOptions): Promise<TotpSetupResult>;\n\n  /**\n   * Confirm a newly created TOTP factor with the first authenticator code.\n   *\n   * Call this after the user scans the QR code and enters the first OTP.\n   *\n   * @param opts - Confirmation parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.\n   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.totp.confirm({ code: \"123456\", verifier, totpId });\n   * if (result.kind === \"failed\") showError(result.code);\n   * ```\n   */\n  confirm(opts: TotpConfirmParams): Promise<SignInResult>;\n\n  /**\n   * Complete a sign-in that is waiting on TOTP verification.\n   *\n   * Called when `signIn()` returns `{ kind: \"totpRequired\" }`.\n   *\n   * @param opts - Verification parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string from the `totpRequired` result.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.signIn(\"password\", { email, password });\n   * if (result.kind === \"totpRequired\") {\n   *   const totp = await auth.totp.verify({ code: totpCode, verifier: result.verifier });\n   *   if (totp.kind === \"failed\") showError(totp.code);\n   * }\n   * ```\n   */\n  verify(opts: TotpVerifyParams): Promise<SignInResult>;\n}\n\n/** Params for {@link DeviceClient.poll}. */\nexport type DevicePollParams = {\n  code: DeviceCodeResult;\n  /** Aborts the poll loop cleanly, e.g. on UI unmount. */\n  signal?: AbortSignal;\n};\n\n/** Params for {@link DeviceClient.verify}. */\nexport type DeviceVerifyParams = { code: string };\n\n/**\n * Device authorization (RFC 8628) client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link TotpClient}\n */\nexport interface DeviceClient {\n  /**\n   * Poll until a device flow is approved or expires.\n   *\n   * Polls the server at the interval specified in the {@link DeviceCodeResult}\n   * until the user authorizes the device or the code expires.\n   *\n   * @param opts - Poll options.\n   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn(\"device\")`.\n   * @param opts.signal - Optional {@link AbortSignal}; aborting returns cleanly\n   *   at the next loop boundary (e.g. on UI unmount).\n   * @throws `ConvexError({ code: \"DEVICE_CODE_EXPIRED\" })` when the code expires before authorization.\n   *\n   * @example\n   * ```ts\n   * const controller = new AbortController();\n   * const result = await auth.signIn(\"device\");\n   * if (result.kind === \"deviceCode\") {\n   *   // Display result.deviceCode.userCode to the user\n   *   await auth.device.poll({ code: result.deviceCode, signal: controller.signal });\n   *   console.log(\"Device authorized!\");\n   * }\n   * ```\n   */\n  poll(opts: DevicePollParams): Promise<void>;\n\n  /**\n   * Approve a device flow from the verification page using the displayed user code.\n   *\n   * Call this on the authorization page where the user enters the short code\n   * shown on the device screen.\n   *\n   * @param opts - Verification options.\n   * @param opts.code - The user code string (e.g. `\"WDJB-MJHT\"`).\n   * @throws `ConvexError({ code: \"DEVICE_AUTHORIZATION_FAILED\" })` when verification fails.\n   *\n   * @example\n   * ```ts\n   * await auth.device.verify({ code: \"WDJB-MJHT\" });\n   * ```\n   */\n  verify(opts: DeviceVerifyParams): Promise<void>;\n}\n\n/**\n * Extract capability flags from an AuthApiRefs type.\n *\n * @typeParam Api - An AuthApiRefs type to extract capability flags from.\n */\ntype ProviderIds<Api extends AuthApiRefs> = [Api[\"signIn\"]] extends [never]\n  ? string\n  : FunctionArgs<Api[\"signIn\"]> extends infer Args\n    ? Args extends unknown\n      ? \"provider\" extends keyof Args\n        ? Exclude<Args[keyof Args & \"provider\"], undefined>\n        : never\n      : never\n    : never;\n\ntype HasProvider<Api extends AuthApiRefs, Id extends string> =\n  string extends ProviderIds<Api> ? boolean : Id extends ProviderIds<Api> ? true : false;\n\ntype InferCaps<Api extends AuthApiRefs> = {\n  webauthn: HasProvider<Api, \"webauthn\">;\n  totp: HasProvider<Api, \"totp\">;\n  device: HasProvider<Api, \"device\">;\n};\n\n/**\n * Include a capability when configured, omit it when disabled, and keep it\n * optional when a framework binding cannot know the capability.\n */\ntype CapabilityClient<Enabled extends boolean, Name extends string, Client> = [Enabled] extends [\n  false,\n]\n  ? {}\n  : [boolean] extends [Enabled]\n    ? { [Key in Name]?: Client }\n    : { [Key in Name]: Client };\n\n/** Pending invite detected from URL or recovered from storage after redirect. */\nexport interface PendingInvite {\n  /**\n   * Raw one-time invite token. Pass to your invite acceptance mutation.\n   * @readonly\n   */\n  readonly token: string;\n  /**\n   * Invite email from the URL or stored redirect state, if available.\n   * @readonly\n   */\n  readonly email: string | null;\n  /**\n   * Consume the invite: clears storage/URL params and returns the token.\n   *\n   * @returns The invite token.\n   * @throws When there is no pending invite to accept.\n   */\n  accept(): Promise<{ token: string }>;\n}\n\n/**\n * Discriminated union of params for the password provider's flows.\n *\n * Each branch maps to one of the six password flows: `signUp`, `signIn`,\n * `reset`, `recover`, `verify`, `change`. Selecting a `flow` literal narrows the\n * accepted params automatically.\n */\nexport type { PasswordParams } from \"../../shared/params\";\n\n/** Params for the email (magic link) provider's initiation step. */\nexport type EmailInitiateParams = EmailParams;\n\n/**\n * Params for completing a code-based flow (no provider). Used to finalise\n * email magic-link sign-ins and other provider-owned code flows when the\n * verification call is made without re-specifying the originating provider.\n */\nexport type CodeCompletionParams = CodeParams;\n\n/** Params for the `connection` provider — requires a connection ID. */\nexport type { ConnectionParams } from \"../../shared/params\";\n\n/** Params for the anonymous provider. Empty / `redirectTo` only. */\nexport type { AnonymousParams } from \"../../shared/params\";\n\n/** Default params shape for OAuth-style providers (google, github, etc.). */\nexport type OAuthSignInParams = OAuthParams;\n\n/**\n * Resolves the `params` argument shape from the `provider` literal.\n *\n * Known special providers (`\"password\"`, `\"email\"`, etc.) get strict typing.\n * Any other string falls back to OAuth-style params, since custom OAuth\n * providers can be registered under arbitrary IDs.\n */\ntype DefaultParamsForProvider<P> = P extends \"password\"\n  ? PasswordParams\n  : P extends \"email\"\n    ? EmailInitiateParams\n    : P extends \"anonymous\"\n      ? AnonymousParams | undefined\n      : P extends \"connection\"\n        ? ConnectionParams\n        : P extends \"webauthn\"\n          ? never\n          : P extends undefined\n            ? CodeCompletionParams\n            : OAuthSignInParams | undefined;\n\ntype ConfiguredProviderArgs<Api extends AuthApiRefs, P> =\n  FunctionArgs<Api[\"signIn\"]> extends infer Args\n    ? Args extends { provider: P }\n      ? Args\n      : never\n    : never;\n\n/** Resolve a provider's exact params from the generated auth action reference. */\nexport type ParamsForProvider<Api extends AuthApiRefs, P> =\n  string extends ProviderIds<Api>\n    ? DefaultParamsForProvider<P>\n    : P extends \"webauthn\" | \"totp\" | \"device\"\n      ? never\n      : P extends \"connection\"\n        ? ConnectionParams\n        : [P] extends [undefined]\n          ? CodeCompletionParams\n          : ConfiguredProviderArgs<Api, P> extends infer Args\n            ? [Args] extends [never]\n              ? never\n              : Args extends { params: infer Params }\n                ? Params\n                : Args extends { params?: infer Params }\n                  ? Params | undefined\n                  : undefined\n            : never;\n\n/**\n * Tuple-rest helper that flips `params` between required and optional based\n * on whether `undefined` is in its resolved type.\n */\nexport type SignInArgs<Api extends AuthApiRefs, P> =\n  undefined extends ParamsForProvider<Api, P>\n    ? [params?: ParamsForProvider<Api, P>]\n    : [params: ParamsForProvider<Api, P>];\n\n/**\n * Public signature for `auth.signIn`. The provider literal discriminates the\n * params shape via {@link ParamsForProvider}, and the params slot is\n * automatically optional when the resolved type permits `undefined`.\n *\n * @example\n * ```ts\n * auth.signIn(\"password\", { flow: \"signIn\", email, password });\n * auth.signIn(\"password\", { flow: \"change\", email, currentPassword, newPassword });\n * auth.signIn(\"anonymous\"); // params optional\n * ```\n */\nexport type SignInOverloads<Api extends AuthApiRefs = AuthApiRefs> = <\n  const P extends ProviderIds<Api> | undefined,\n>(\n  provider: P,\n  ...args: SignInArgs<Api, P>\n) => Promise<SignInResult>;\n\n/**\n * Internal-only loose signature for the `signIn` value. Use this when\n * forwarding through wrappers where TypeScript cannot select an overload\n * from the wrapper's union-typed `provider` argument.\n *\n * @internal\n */\nexport type SignInImpl = (provider?: string, params?: AuthParameters) => Promise<SignInResult>;\n\n/** Base auth client — always present. */\ninterface AuthClientBase<Api extends AuthApiRefs> {\n  /** Restore initial auth state for the current runtime. */\n  initialize: () => Promise<void>;\n  /** SSR-safe query-param reader. */\n  param: (name: string) => string | null;\n  /**\n   * Pending invite recovered from the URL or storage, if present.\n   * @readonly\n   */\n  readonly invite: PendingInvite | null;\n  /** Complete an OAuth callback using a URL or authorization code. */\n  completeOAuth: (input: URL | string | { code: string }) => Promise<OAuthCompletionResult>;\n  /** Start a sign-in flow for a provider. */\n  signIn: SignInOverloads<Api>;\n  /** Sign out and clear local auth state. */\n  signOut: () => Promise<void>;\n  /** Subscribe to auth state changes; returns an unsubscribe. */\n  subscribe: (handler: AuthSubscriber) => () => void;\n  /** Read the current auth state synchronously, e.g. for `useSyncExternalStore`. */\n  getSnapshot: () => AuthState;\n  /** Tear down listeners and reject in-flight handshakes. */\n  destroy: () => void;\n}\n\n/**\n * Framework-agnostic auth client return type.\n *\n * Conditionally includes `totp` and `device` helpers based on the\n * capabilities in the `AuthApiRefs` type. Platform-specific `webauthn` helpers\n * are added by {@link PlatformAuthClient}.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type AuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClientBase<Api> &\n  CapabilityClient<InferCaps<Api>[\"totp\"], \"totp\", TotpClient> &\n  CapabilityClient<InferCaps<Api>[\"device\"], \"device\", DeviceClient>;\n\n/**\n * Browser auth client return type.\n *\n * Extends {@link AuthClient} with conditional WebAuthn helpers when the\n * generated auth API exposes WebAuthn capabilities.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type PlatformAuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClient<Api> &\n  CapabilityClient<InferCaps<Api>[\"webauthn\"], \"webauthn\", WebAuthnClient>;\n\n/**\n * Options for {@link client}.\n *\n * @typeParam Api - An AuthApiRefs type.\n */\nexport type ClientOptions<Api extends AuthApiRefs = AuthApiRefs> = {\n  /** Any Convex client implementation used to run auth actions. */\n  convex: ConvexTransport;\n  /** Platform runtime implementation used by the client core. */\n  runtime?: ClientRuntime;\n  /** Platform-specific factor adapters supplied by higher-level entrypoints. */\n  adapters?: ClientAdapters;\n  /** Platform-specific adapter factories supplied by higher-level entrypoints. */\n  adapterFactories?: ClientAdapterFactories;\n  /**\n   * Typed auth function refs from your generated `api` object.\n   * Required outside proxy mode.\n   */\n  api?: Api;\n  /** Explicit Convex deployment URL when it cannot be inferred from the client. */\n  url?: string;\n  /**\n   * Optional action-only transport for direct code exchange outside proxy mode.\n   * Required in non-browser runtimes when `proxyPath` is not set.\n   */\n  httpClient?: ActionTransport | null;\n  /**\n   * Storage backend for persisted tokens.\n   *\n   * Defaults to `runtime.storage` when provided, otherwise `null`.\n   */\n  storage?: Storage | null;\n  /**\n   * Server-known auth used to seed the synchronous boot so SSR and hydration\n   * render the resolved state on first paint. A non-empty JWT boots signed in;\n   * `null` boots signed out. Providing this at all marks auth as resolved, so\n   * the client skips the loading phase. Omit it (leave `undefined`) to read the\n   * persisted value from `storage` instead. Ongoing persistence always uses\n   * `storage`.\n   */\n  token?: string | null;\n  /**\n   * Proxy endpoint used instead of direct Convex auth calls.\n   * When set, provide `runtime.proxy` and omit direct `api`/`httpClient`\n   * transport requirements.\n   */\n  proxyPath?: string;\n  /** SSR-safe URL source for reading query parameters. */\n  location?: URL | (() => URL | null);\n  /**\n   * Default OAuth `redirectTo` applied to `signIn` calls that omit it. Platform\n   * entrypoints set this (e.g. Expo passes its native redirect URI) so the core\n   * can build the authorization URL without a platform-specific `signIn` wrapper.\n   */\n  oauthRedirectTo?: string;\n  /**\n   * Milliseconds to wait for the Convex client to confirm a new token\n   * before a sign-in handshake rejects with `AUTH_HANDSHAKE_TIMEOUT`.\n   * Defaults to `5000`.\n   */\n  handshakeTimeoutMs?: number;\n};\n\nexport type OAuthCompletionResult = { handled: false } | { handled: true; cleanupUrl: URL | null };\n\n/**\n * Metadata describing the current auth flow for handshake diagnostics.\n *\n * @internal\n */\nexport type AuthFlowContext = {\n  provider?: string;\n  flow: string;\n};\n\n/**\n * A simple deferred promise that can be resolved or rejected externally.\n */\ninterface SimpleDeferred<T, E = unknown> {\n  readonly promise: Promise<T>;\n  resolve(value: T): void;\n  reject(error: E): void;\n}\n\n/**\n * Create a deferred promise that can be resolved or rejected externally.\n *\n * @returns A deferred object containing the promise and control methods.\n * @internal\n */\nexport function createDeferred<T, E = unknown>(): SimpleDeferred<T, E> {\n  let resolve!: (value: T) => void;\n  let reject!: (error: E) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej as (error: E) => void;\n  });\n  return { promise, resolve, reject };\n}\n\n/** @internal */\nexport type HandshakeWaiter = {\n  epoch: number;\n  context: AuthFlowContext;\n  deferred: SimpleDeferred<void, ConvexError<Value>>;\n  timeoutId: ReturnType<typeof setTimeout>;\n};\n"],"mappings":";;;;;;;AA8yBA,SAAgB,iBAAuD;CACrE,IAAI;CACJ,IAAI;AAKJ,QAAO;EAAE,SAJO,IAAI,SAAY,KAAK,QAAQ;AAC3C,aAAU;AACV,YAAS;IACT;EACgB;EAAS;EAAQ"}

package/dist/client/errors.d.ts

@@ -0,0 +1,15 @@
+import { ErrorCode } from "../shared/codes.js";
+
+//#region src/client/errors.d.ts
+/**
+ * Codes emitted only by the client during the Convex confirmation handshake.
+ */
+declare const HandshakeErrorCode: {
+  readonly AUTH_HANDSHAKE_TIMEOUT: "AUTH_HANDSHAKE_TIMEOUT";
+  readonly AUTH_HANDSHAKE_REJECTED: "AUTH_HANDSHAKE_REJECTED";
+};
+/** Union of every client-only handshake code. */
+type HandshakeErrorCode = (typeof HandshakeErrorCode)[keyof typeof HandshakeErrorCode];
+//#endregion
+export { HandshakeErrorCode };
+//# sourceMappingURL=errors.d.ts.map

package/dist/client/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","names":[],"sources":["../../src/client/errors.ts"],"mappings":";;;;;;cAqBa,kBAAA;EAAA,SAGH,sBAAA;EAAA,SAAA,uBAAA;AAAA;;KAGE,kBAAA,WAA6B,kBAAA,eAAiC,kBAAA"}

package/dist/client/errors.js

@@ -12,6 +12,13 @@ import { ConvexError } from "convex/values";
 *
 * @module
 */
+/**
+* Codes emitted only by the client during the Convex confirmation handshake.
+*/
+const HandshakeErrorCode = {
+	AUTH_HANDSHAKE_TIMEOUT: "AUTH_HANDSHAKE_TIMEOUT",
+	AUTH_HANDSHAKE_REJECTED: "AUTH_HANDSHAKE_REJECTED"
+};
 const HANDSHAKE_ERROR_MESSAGES = {
 	AUTH_HANDSHAKE_TIMEOUT: "Sign-in succeeded but authentication confirmation timed out.",
 	AUTH_HANDSHAKE_REJECTED: "Authentication was rejected while confirming the session."
@@ -27,5 +34,5 @@ const createHandshakeError = (code, context) => {
 };
 
 //#endregion
-export { createHandshakeError };
+export { HandshakeErrorCode, createHandshakeError };
 //# sourceMappingURL=errors.js.map

package/dist/client/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":[],"sources":["../../src/client/errors.ts"],"sourcesContent":["/**\n * Client-side error-code registry.\n *\n * Re-exports the shared {@link ErrorCode} registry and adds the handshake codes\n * that are meaningful only in the client (they describe the browser⇄Convex\n * confirmation handshake, not a server outcome), so client code has a single\n * import surface for every code it can surface.\n *\n * @module\n */\n\nimport { ConvexError, Value } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\n\nexport { ErrorCode };\nexport type { ErrorCode as ErrorCodeValue } from \"../shared/codes\";\n\n/**\n * Codes emitted only by the client during the Convex confirmation handshake.\n */\nexport const HandshakeErrorCode = {\n  AUTH_HANDSHAKE_TIMEOUT: \"AUTH_HANDSHAKE_TIMEOUT\",\n  AUTH_HANDSHAKE_REJECTED: \"AUTH_HANDSHAKE_REJECTED\",\n} as const;\n\n/** Union of every client-only handshake code. */\nexport type HandshakeErrorCode = (typeof HandshakeErrorCode)[keyof typeof HandshakeErrorCode];\n\ntype HandshakeErrorContext = Record<string, Value | undefined>;\n\nconst HANDSHAKE_ERROR_MESSAGES = {\n  AUTH_HANDSHAKE_TIMEOUT: \"Sign-in succeeded but authentication confirmation timed out.\",\n  AUTH_HANDSHAKE_REJECTED: \"Authentication was rejected while confirming the session.\",\n} as const satisfies Record<HandshakeErrorCode, string>;\n\ntype HandshakeErrorData = {\n  code: HandshakeErrorCode;\n  message: string;\n} & Record<string, Value>;\n\n/** @internal */\nexport const createHandshakeError = (code: HandshakeErrorCode, context: HandshakeErrorContext) => {\n  const data: HandshakeErrorData = {\n    code,\n    message: HANDSHAKE_ERROR_MESSAGES[code],\n  };\n  for (const [key, value] of Object.entries(context)) {\n    if (value !== undefined) data[key] = value;\n  }\n  return new ConvexError(data);\n};\n"],"mappings":";;;;;;;;;;;;;;AA+BA,MAAM,2BAA2B;CAC/B,wBAAwB;CACxB,yBAAyB;CAC1B;;AAQD,MAAa,wBAAwB,MAA0B,YAAmC;CAChG,MAAM,OAA2B;EAC/B;EACA,SAAS,yBAAyB;EACnC;AACD,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,CAChD,KAAI,UAAU,OAAW,MAAK,OAAO;AAEvC,QAAO,IAAI,YAAY,KAAK"}
+{"version":3,"file":"errors.js","names":[],"sources":["../../src/client/errors.ts"],"sourcesContent":["/**\n * Client-side error-code registry.\n *\n * Re-exports the shared {@link ErrorCode} registry and adds the handshake codes\n * that are meaningful only in the client (they describe the browser⇄Convex\n * confirmation handshake, not a server outcome), so client code has a single\n * import surface for every code it can surface.\n *\n * @module\n */\n\nimport { ConvexError, Value } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\n\nexport { ErrorCode };\nexport type { ErrorCode as ErrorCodeValue } from \"../shared/codes\";\n\n/**\n * Codes emitted only by the client during the Convex confirmation handshake.\n */\nexport const HandshakeErrorCode = {\n  AUTH_HANDSHAKE_TIMEOUT: \"AUTH_HANDSHAKE_TIMEOUT\",\n  AUTH_HANDSHAKE_REJECTED: \"AUTH_HANDSHAKE_REJECTED\",\n} as const;\n\n/** Union of every client-only handshake code. */\nexport type HandshakeErrorCode = (typeof HandshakeErrorCode)[keyof typeof HandshakeErrorCode];\n\ntype HandshakeErrorContext = Record<string, Value | undefined>;\n\nconst HANDSHAKE_ERROR_MESSAGES = {\n  AUTH_HANDSHAKE_TIMEOUT: \"Sign-in succeeded but authentication confirmation timed out.\",\n  AUTH_HANDSHAKE_REJECTED: \"Authentication was rejected while confirming the session.\",\n} as const satisfies Record<HandshakeErrorCode, string>;\n\ntype HandshakeErrorData = {\n  code: HandshakeErrorCode;\n  message: string;\n} & Record<string, Value>;\n\n/** @internal */\nexport const createHandshakeError = (code: HandshakeErrorCode, context: HandshakeErrorContext) => {\n  const data: HandshakeErrorData = {\n    code,\n    message: HANDSHAKE_ERROR_MESSAGES[code],\n  };\n  for (const [key, value] of Object.entries(context)) {\n    if (value !== undefined) data[key] = value;\n  }\n  return new ConvexError(data);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAqBA,MAAa,qBAAqB;CAChC,wBAAwB;CACxB,yBAAyB;CAC1B;AAOD,MAAM,2BAA2B;CAC/B,wBAAwB;CACxB,yBAAyB;CAC1B;;AAQD,MAAa,wBAAwB,MAA0B,YAAmC;CAChG,MAAM,OAA2B;EAC/B;EACA,SAAS,yBAAyB;EACnC;AACD,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,CAChD,KAAI,UAAU,OAAW,MAAK,OAAO;AAEvC,QAAO,IAAI,YAAY,KAAK"}

package/dist/client/index.d.ts

@@ -1,4 +1,7 @@
-import { AnonymousParams, AuthApiRefs, AuthClient, AuthState, ClientOptions, ClientRuntime, CodeCompletionParams, ConnectionParams, DeviceClient, DeviceCodeResult, DevicePollParams, DeviceVerifyParams, EmailInitiateParams, OAuthCompletionResult, OAuthSignInParams, ParamsForProvider, PasswordParams, PendingInvite, PlatformAuthClient, SignInOverloads, SignInResult, Storage, TotpClient, TotpConfirmParams, TotpSetupOptions, TotpSetupResult, TotpVerifyParams, WebAuthnClient, WebAuthnRegisterOptions, WebAuthnSignInOptions } from "./core/types.js";
+import { AnonymousParams, ConnectionParams, PasswordParams } from "../shared/params.js";
+import { ErrorCode } from "../shared/codes.js";
+import { AuthApiRefs, AuthClient, AuthState, ClientOptions, ClientRuntime, CodeCompletionParams, DeviceClient, DeviceCodeResult, DevicePollParams, DeviceVerifyParams, EmailInitiateParams, OAuthCompletionResult, OAuthSignInParams, PendingInvite, PlatformAuthClient, SignInResult, Storage, TotpClient, TotpConfirmParams, TotpSetupOptions, TotpSetupResult, TotpVerifyParams, WebAuthnClient, WebAuthnRegisterOptions, WebAuthnSignInOptions } from "./core/types.js";
+import { HandshakeErrorCode } from "./errors.js";
 
 //#region src/client/index.d.ts
 /**
@@ -54,7 +57,7 @@ import { AnonymousParams, AuthApiRefs, AuthClient, AuthState, ClientOptions, Cli
  * @throws {Error} When `token` has leading or trailing whitespace. An empty or
  *   whitespace-only string is treated as an explicit signed-out seed, not an error.
  */
-declare function client<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs>(options: ClientOptions<Api>): AuthClient<Api>;
+declare function client<Api extends AuthApiRefs = AuthApiRefs>(options: ClientOptions<Api>): AuthClient<Api>;
 //#endregion
-export { type AnonymousParams, type AuthApiRefs, type AuthClient, type AuthState, type ClientOptions, type ClientRuntime, type CodeCompletionParams, type ConnectionParams, type DeviceClient, type DeviceCodeResult, type DevicePollParams, type DeviceVerifyParams, type EmailInitiateParams, type OAuthCompletionResult, type OAuthSignInParams, type ParamsForProvider, type PasswordParams, type PendingInvite, type PlatformAuthClient, type SignInOverloads, type SignInResult, type Storage, type TotpClient, type TotpConfirmParams, type TotpSetupOptions, type TotpSetupResult, type TotpVerifyParams, type WebAuthnClient, type WebAuthnRegisterOptions, type WebAuthnSignInOptions, client };
+export { type AnonymousParams, type AuthClient, type AuthState, type ClientOptions, type ClientRuntime, type CodeCompletionParams, type ConnectionParams, type DeviceClient, type DeviceCodeResult, type DevicePollParams, type DeviceVerifyParams, type EmailInitiateParams, ErrorCode, type ErrorCode as ErrorCodeValue, HandshakeErrorCode, type HandshakeErrorCode as HandshakeErrorCodeValue, type OAuthCompletionResult, type OAuthSignInParams, type PasswordParams, type PendingInvite, type PlatformAuthClient, type SignInResult, type Storage, type TotpClient, type TotpConfirmParams, type TotpSetupOptions, type TotpSetupResult, type TotpVerifyParams, type WebAuthnClient, type WebAuthnRegisterOptions, type WebAuthnSignInOptions, client };
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/client/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsQgB,MAAA,aAAmB,WAAA,8BAAyC,WAAA,CAAA,CAC1E,OAAA,EAAS,aAAA,CAAc,GAAA,IACtB,UAAA,CAAW,GAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/client/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqQgB,MAAA,aAAmB,WAAA,GAAc,WAAA,CAAA,CAC/C,OAAA,EAAS,aAAA,CAAc,GAAA,IACtB,UAAA,CAAW,GAAA"}

package/dist/client/index.js

@@ -1,7 +1,8 @@
 import { LOG_LEVELS, logMessage } from "../shared/log.js";
 import { retryWithBackoff } from "../shared/retry.js";
 import { createDeferred } from "./core/types.js";
-import { createHandshakeError } from "./errors.js";
+import { ErrorCode } from "../shared/codes.js";
+import { HandshakeErrorCode, createHandshakeError } from "./errors.js";
 import { createDeviceClient } from "./factors/device.js";
 import { createTotpClient } from "./factors/totp.js";
 import { createInviteManager } from "./runtime/invite.js";
@@ -977,5 +978,5 @@ function client(options) {
 }
 
 //#endregion
-export { client, resolveUrl };
+export { ErrorCode, HandshakeErrorCode, client, resolveUrl };
 //# sourceMappingURL=index.js.map