@estifanos-sh/convex-auth 0.0.2 → 0.0.3

package/dist/server/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","names":[],"sources":["../../src/server/tokens.ts"],"sourcesContent":["import { SignJWT, createLocalJWKSet, importPKCS8, jwtVerify } from \"jose\";\n\nimport type { AccessToken } from \"../shared/brand\";\nimport { envOptionalString, requireAuthKey } from \"./env\";\nimport { generateRandomString } from \"./random\";\nimport { ConvexAuthConfig } from \"./types\";\nimport type { SessionTokenIdentityClaims } from \"./types\";\nimport { authUrlFromEnv } from \"./url\";\nimport { withSpan } from \"./utils/span\";\n\nconst DEFAULT_JWT_DURATION_MS = 1000 * 60 * 60;\nconst TOKEN_JTI_LENGTH = 24;\nconst TOKEN_JTI_ALPHABET = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\";\n\nlet cachedPrivateKeyPromise: Promise<Awaited<ReturnType<typeof importPKCS8>>> | null = null;\nconst cachedIssuers = new Map<string, string>();\n\nconst JWT_ALG = \"EdDSA\" as const;\n\nfunction normalizePkcs8Pem(value: string) {\n  const trimmed = value.trim();\n  if (!trimmed.includes(\"-----BEGIN PRIVATE KEY-----\")) {\n    return trimmed;\n  }\n\n  const withEscapedNewlines = trimmed.replace(/\\\\n/g, \"\\n\");\n  if (withEscapedNewlines.includes(\"\\n\")) {\n    return withEscapedNewlines;\n  }\n\n  const beginMarker = \"-----BEGIN PRIVATE KEY-----\";\n  const endMarker = \"-----END PRIVATE KEY-----\";\n  const body = trimmed.replace(beginMarker, \"\").replace(endMarker, \"\").trim().replace(/\\s+/g, \"\");\n\n  if (body.length === 0) {\n    return trimmed;\n  }\n\n  const wrappedBody = body.match(/.{1,64}/g)?.join(\"\\n\") ?? body;\n  return `${beginMarker}\\n${wrappedBody}\\n${endMarker}`;\n}\n\nconst getPrivateKey = () => {\n  if (cachedPrivateKeyPromise === null) {\n    try {\n      const pem = normalizePkcs8Pem(requireAuthKey(\"jwtPrivateKey\"));\n      cachedPrivateKeyPromise = importPKCS8(pem, JWT_ALG).catch((error) => {\n        cachedPrivateKeyPromise = null;\n        throw error;\n      });\n    } catch (error) {\n      cachedPrivateKeyPromise = null;\n      throw error;\n    }\n  }\n  return cachedPrivateKeyPromise;\n};\n\nconst getIssuer = (path?: string) => {\n  const key = path ?? \"\";\n  let issuer = cachedIssuers.get(key);\n  if (issuer === undefined) {\n    issuer = authUrlFromEnv(path);\n    cachedIssuers.set(key, issuer);\n  }\n  return issuer;\n};\n\nif (envOptionalString(\"AUTH_KEYS\")) {\n  try {\n    void getPrivateKey().catch((err) => {\n      console.error(\"[auth] JWT private key pre-warm failed\", { err });\n    });\n  } catch (err) {\n    console.error(\"[auth] JWT private key pre-warm threw synchronously\", { err });\n  }\n}\nif (envOptionalString(\"CONVEX_SITE_URL\")) {\n  try {\n    getIssuer();\n  } catch (err) {\n    console.error(\"[auth] JWT issuer pre-warm threw\", { err });\n  }\n}\n\n/** Lifetime of an issued OAuth access token, in seconds. Shared with the token endpoint's `expires_in`. */\nexport const OAUTH_ACCESS_TOKEN_DURATION_S = 900;\n\n/**\n * Sign an OAuth access token (EdDSA) for the given user, client, and scopes.\n *\n * The `aud` claim is `\"convex\"` so the token is a valid Convex identity\n * (`applicationID: \"convex\"`) — load-bearing: MCP tools run the user's queries\n * via `ctx.runQuery`, which requires Convex's identity layer to accept this\n * token. For that reason the access token must look like an ID-token-shaped JWT:\n * it carries NO `typ: \"at+jwt\"` header (Convex's validator rejects that RFC 9068\n * type), and is instead marked as an access token by a positive `token_use:\n * \"access\"` claim, which `verifyOAuthToken` checks (alongside the `client_id`\n * claim) to tell it apart from a session token. We don't issue OIDC ID tokens,\n * so there is no id-vs-access confusion for the `at+jwt` typ to guard against.\n *\n * When an RFC 8707 `resource` is supplied the token carries a `resource` claim\n * binding it to that protected resource; an MCP endpoint rejects tokens whose\n * `resource` does not match its own canonical resource.\n *\n * @internal\n */\nexport async function generateOAuthToken(args: {\n  userId: string;\n  clientId: string;\n  scopes: string[];\n  issuer?: string;\n  resource?: string;\n}): Promise<string> {\n  const privateKey = await withSpan(\"convex-auth.tokens.import-key\", { alg: JWT_ALG }, () =>\n    getPrivateKey(),\n  );\n  const exp = new Date(Date.now() + OAUTH_ACCESS_TOKEN_DURATION_S * 1000);\n  return await withSpan(\"convex-auth.tokens.sign-oauth\", { alg: JWT_ALG }, () =>\n    new SignJWT({\n      sub: args.userId,\n      aud: \"convex\",\n      token_use: \"access\",\n      scope: args.scopes.join(\" \"),\n      client_id: args.clientId,\n      ...(args.resource !== undefined ? { resource: args.resource } : null),\n    })\n      .setProtectedHeader({ alg: JWT_ALG })\n      .setIssuedAt()\n      .setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET))\n      .setIssuer(args.issuer ?? getIssuer())\n      .setExpirationTime(exp)\n      .sign(privateKey),\n  );\n}\n\nlet cachedKeySet: ReturnType<typeof createLocalJWKSet> | null = null;\n\n/**\n * The local JWKS keyset, built once and reused. `AUTH_KEYS` is static per\n * deployment, so caching also preserves jose's internal imported-key cache\n * across requests rather than re-importing keys on every verification.\n */\nfunction getJwkSet(): ReturnType<typeof createLocalJWKSet> {\n  if (cachedKeySet === null) {\n    cachedKeySet = createLocalJWKSet(requireAuthKey(\"jwks\"));\n  }\n  return cachedKeySet;\n}\n\n/**\n * Verify an OAuth access token against the local JWKS and issuer.\n *\n * When `opts.resource` is supplied, the token's RFC 8707 `resource` claim must\n * equal it exactly — a token bound to a different (or no) resource is rejected.\n * This is how an MCP endpoint enforces that a token was issued for *it*.\n *\n * @returns The token's user, client, scopes, and bound `resource`, or `null` if\n *   verification fails, the token is not an OAuth access token, or the resource\n *   assertion does not hold.\n * @internal\n */\nexport async function verifyOAuthToken(\n  token: string,\n  opts?: { issuer?: string; resource?: string },\n): Promise<{ userId: string; clientId: string; scopes: string[]; resource: string | null } | null> {\n  try {\n    const { payload } = await jwtVerify(token, getJwkSet(), {\n      issuer: opts?.issuer ?? getIssuer(),\n      audience: \"convex\",\n      // Defense-in-depth: pin the accepted JWS algorithm so a token can only be\n      // verified under EdDSA, never coerced to a different `alg` (algorithm\n      // substitution / confusion hardening).\n      algorithms: [JWT_ALG],\n      clockTolerance: 30,\n    });\n    if ((payload as { token_use?: string }).token_use !== \"access\") return null;\n    const userId = payload.sub;\n    const clientId = (payload as { client_id?: string }).client_id;\n    const scope = (payload as { scope?: string }).scope ?? \"\";\n    if (!userId || !clientId) return null;\n    const resourceClaim = (payload as { resource?: unknown }).resource;\n    const resource = typeof resourceClaim === \"string\" ? resourceClaim : null;\n    if (opts?.resource !== undefined && resource !== opts.resource) return null;\n    // NOTE: the returned `scopes` are ADVISORY, not a Convex-enforced capability\n    // boundary. Because `aud` is \"convex\", Convex's identity layer accepts this\n    // token as the user's full identity — any query/mutation the user could run,\n    // a client bearing this token can run via `ctx.runQuery`/`ctx.runMutation`,\n    // regardless of `scope`. Integrators MUST enforce these scopes app-side\n    // (e.g. inside each MCP tool handler) for them to actually restrict access.\n    return { userId, clientId, scopes: scope ? scope.split(\" \") : [], resource };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Sign a session access token (EdDSA) carrying the identity claims, audienced to Convex.\n *\n * Expiry is `config.jwt.durationMs` from now, defaulting to one hour.\n *\n * @internal\n */\nexport async function generateToken(\n  args: {\n    identity: SessionTokenIdentityClaims;\n  },\n  config: ConvexAuthConfig,\n): Promise<AccessToken> {\n  const privateKey = await withSpan(\"convex-auth.tokens.import-key\", { alg: JWT_ALG }, () =>\n    getPrivateKey(),\n  );\n  const expirationTime = new Date(Date.now() + (config.jwt?.durationMs ?? DEFAULT_JWT_DURATION_MS));\n  const claims = {\n    sub: args.identity.subject,\n    sid: args.identity.sessionId,\n    ...(args.identity.name !== undefined ? { name: args.identity.name } : null),\n    ...(args.identity.email !== undefined ? { email: args.identity.email } : null),\n    ...(args.identity.emailVerified !== undefined\n      ? { email_verified: args.identity.emailVerified }\n      : null),\n    ...(args.identity.picture !== undefined ? { picture: args.identity.picture } : null),\n    ...(args.identity.phoneNumber !== undefined\n      ? { phone_number: args.identity.phoneNumber }\n      : null),\n    ...(args.identity.phoneNumberVerified !== undefined\n      ? { phone_number_verified: args.identity.phoneNumberVerified }\n      : null),\n  };\n  return (await withSpan(\"convex-auth.tokens.sign\", { alg: JWT_ALG }, () =>\n    new SignJWT(claims)\n      .setProtectedHeader({ alg: JWT_ALG })\n      .setIssuedAt()\n      .setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET))\n      .setIssuer(getIssuer(config.path))\n      .setAudience(\"convex\")\n      .setExpirationTime(expirationTime)\n      .sign(privateKey),\n  )) as AccessToken;\n}\n"],"mappings":";;;;;;;AAUA,MAAM,0BAA0B,MAAO,KAAK;AAC5C,MAAM,mBAAmB;AACzB,MAAM,qBAAqB;AAE3B,IAAI,0BAAmF;AACvF,MAAM,gCAAgB,IAAI,KAAqB;AAE/C,MAAM,UAAU;AAEhB,SAAS,kBAAkB,OAAe;CACxC,MAAM,UAAU,MAAM,MAAM;AAC5B,KAAI,CAAC,QAAQ,SAAS,8BAA8B,CAClD,QAAO;CAGT,MAAM,sBAAsB,QAAQ,QAAQ,QAAQ,KAAK;AACzD,KAAI,oBAAoB,SAAS,KAAK,CACpC,QAAO;CAGT,MAAM,cAAc;CACpB,MAAM,YAAY;CAClB,MAAM,OAAO,QAAQ,QAAQ,aAAa,GAAG,CAAC,QAAQ,WAAW,GAAG,CAAC,MAAM,CAAC,QAAQ,QAAQ,GAAG;AAE/F,KAAI,KAAK,WAAW,EAClB,QAAO;AAIT,QAAO,GAAG,YAAY,IADF,KAAK,MAAM,WAAW,EAAE,KAAK,KAAK,IAAI,KACpB,IAAI;;AAG5C,MAAM,sBAAsB;AAC1B,KAAI,4BAA4B,KAC9B,KAAI;AAEF,4BAA0B,YADd,kBAAkB,eAAe,gBAAgB,CAAC,EACnB,QAAQ,CAAC,OAAO,UAAU;AACnE,6BAA0B;AAC1B,SAAM;IACN;UACK,OAAO;AACd,4BAA0B;AAC1B,QAAM;;AAGV,QAAO;;AAGT,MAAM,aAAa,SAAkB;CACnC,MAAM,MAAM,QAAQ;CACpB,IAAI,SAAS,cAAc,IAAI,IAAI;AACnC,KAAI,WAAW,QAAW;AACxB,WAAS,eAAe,KAAK;AAC7B,gBAAc,IAAI,KAAK,OAAO;;AAEhC,QAAO;;AAGT,IAAI,kBAAkB,YAAY,CAChC,KAAI;AACF,CAAK,eAAe,CAAC,OAAO,QAAQ;AAClC,UAAQ,MAAM,0CAA0C,EAAE,KAAK,CAAC;GAChE;SACK,KAAK;AACZ,SAAQ,MAAM,uDAAuD,EAAE,KAAK,CAAC;;AAGjF,IAAI,kBAAkB,kBAAkB,CACtC,KAAI;AACF,YAAW;SACJ,KAAK;AACZ,SAAQ,MAAM,oCAAoC,EAAE,KAAK,CAAC;;;AAK9D,MAAa,gCAAgC;;;;;;;;;;;;;;;;;;;;AAqB7C,eAAsB,mBAAmB,MAMrB;CAClB,MAAM,aAAa,MAAM,SAAS,iCAAiC,EAAE,KAAK,SAAS,QACjF,eAAe,CAChB;CACD,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK,GAAG,gCAAgC,IAAK;AACvE,QAAO,MAAM,SAAS,iCAAiC,EAAE,KAAK,SAAS,QACrE,IAAI,QAAQ;EACV,KAAK,KAAK;EACV,KAAK;EACL,WAAW;EACX,OAAO,KAAK,OAAO,KAAK,IAAI;EAC5B,WAAW,KAAK;EAChB,GAAI,KAAK,aAAa,SAAY,EAAE,UAAU,KAAK,UAAU,GAAG;EACjE,CAAC,CACC,mBAAmB,EAAE,KAAK,SAAS,CAAC,CACpC,aAAa,CACb,OAAO,qBAAqB,kBAAkB,mBAAmB,CAAC,CAClE,UAAU,KAAK,UAAU,WAAW,CAAC,CACrC,kBAAkB,IAAI,CACtB,KAAK,WAAW,CACpB;;AAGH,IAAI,eAA4D;;;;;;AAOhE,SAAS,YAAkD;AACzD,KAAI,iBAAiB,KACnB,gBAAe,kBAAkB,eAAe,OAAO,CAAC;AAE1D,QAAO;;;;;;;;;;;;;;AAeT,eAAsB,iBACpB,OACA,MACiG;AACjG,KAAI;EACF,MAAM,EAAE,YAAY,MAAM,UAAU,OAAO,WAAW,EAAE;GACtD,QAAQ,MAAM,UAAU,WAAW;GACnC,UAAU;GAIV,YAAY,CAAC,QAAQ;GACrB,gBAAgB;GACjB,CAAC;AACF,MAAK,QAAmC,cAAc,SAAU,QAAO;EACvE,MAAM,SAAS,QAAQ;EACvB,MAAM,WAAY,QAAmC;EACrD,MAAM,QAAS,QAA+B,SAAS;AACvD,MAAI,CAAC,UAAU,CAAC,SAAU,QAAO;EACjC,MAAM,gBAAiB,QAAmC;EAC1D,MAAM,WAAW,OAAO,kBAAkB,WAAW,gBAAgB;AACrE,MAAI,MAAM,aAAa,UAAa,aAAa,KAAK,SAAU,QAAO;AAOvE,SAAO;GAAE;GAAQ;GAAU,QAAQ,QAAQ,MAAM,MAAM,IAAI,GAAG,EAAE;GAAE;GAAU;SACtE;AACN,SAAO;;;;;;;;;;AAWX,eAAsB,cACpB,MAGA,QACsB;CACtB,MAAM,aAAa,MAAM,SAAS,iCAAiC,EAAE,KAAK,SAAS,QACjF,eAAe,CAChB;CACD,MAAM,iBAAiB,IAAI,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK,cAAc,yBAAyB;CACjG,MAAM,SAAS;EACb,KAAK,KAAK,SAAS;EACnB,KAAK,KAAK,SAAS;EACnB,GAAI,KAAK,SAAS,SAAS,SAAY,EAAE,MAAM,KAAK,SAAS,MAAM,GAAG;EACtE,GAAI,KAAK,SAAS,UAAU,SAAY,EAAE,OAAO,KAAK,SAAS,OAAO,GAAG;EACzE,GAAI,KAAK,SAAS,kBAAkB,SAChC,EAAE,gBAAgB,KAAK,SAAS,eAAe,GAC/C;EACJ,GAAI,KAAK,SAAS,YAAY,SAAY,EAAE,SAAS,KAAK,SAAS,SAAS,GAAG;EAC/E,GAAI,KAAK,SAAS,gBAAgB,SAC9B,EAAE,cAAc,KAAK,SAAS,aAAa,GAC3C;EACJ,GAAI,KAAK,SAAS,wBAAwB,SACtC,EAAE,uBAAuB,KAAK,SAAS,qBAAqB,GAC5D;EACL;AACD,QAAQ,MAAM,SAAS,2BAA2B,EAAE,KAAK,SAAS,QAChE,IAAI,QAAQ,OAAO,CAChB,mBAAmB,EAAE,KAAK,SAAS,CAAC,CACpC,aAAa,CACb,OAAO,qBAAqB,kBAAkB,mBAAmB,CAAC,CAClE,UAAU,UAAU,OAAO,KAAK,CAAC,CACjC,YAAY,SAAS,CACrB,kBAAkB,eAAe,CACjC,KAAK,WAAW,CACpB"}
+{"version":3,"file":"tokens.js","names":[],"sources":["../../src/server/tokens.ts"],"sourcesContent":["import { SignJWT, createLocalJWKSet, importPKCS8, jwtVerify } from \"jose\";\n\nimport type { AccessToken } from \"../shared/brand\";\nimport { envOptionalString, requireAuthKey } from \"./env\";\nimport { generateRandomString } from \"./random\";\nimport { ConvexAuthConfig } from \"./types\";\nimport type { SessionTokenIdentityClaims } from \"./types\";\nimport { authUrlFromEnv } from \"./url\";\nimport { withSpan } from \"./utils/span\";\n\nconst DEFAULT_JWT_DURATION_MS = 1000 * 60 * 60;\nconst TOKEN_JTI_LENGTH = 24;\nconst TOKEN_JTI_ALPHABET = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\";\n\nlet cachedPrivateKeyPromise: Promise<Awaited<ReturnType<typeof importPKCS8>>> | null = null;\nconst cachedIssuers = new Map<string, string>();\n\nconst JWT_ALG = \"EdDSA\" as const;\n\nfunction normalizePkcs8Pem(value: string) {\n  const trimmed = value.trim();\n  if (!trimmed.includes(\"-----BEGIN PRIVATE KEY-----\")) {\n    return trimmed;\n  }\n\n  const withEscapedNewlines = trimmed.replace(/\\\\n/g, \"\\n\");\n  if (withEscapedNewlines.includes(\"\\n\")) {\n    return withEscapedNewlines;\n  }\n\n  const beginMarker = \"-----BEGIN PRIVATE KEY-----\";\n  const endMarker = \"-----END PRIVATE KEY-----\";\n  const body = trimmed.replace(beginMarker, \"\").replace(endMarker, \"\").trim().replace(/\\s+/g, \"\");\n\n  if (body.length === 0) {\n    return trimmed;\n  }\n\n  const wrappedBody = body.match(/.{1,64}/g)?.join(\"\\n\") ?? body;\n  return `${beginMarker}\\n${wrappedBody}\\n${endMarker}`;\n}\n\nconst getPrivateKey = () => {\n  if (cachedPrivateKeyPromise === null) {\n    try {\n      const pem = normalizePkcs8Pem(requireAuthKey(\"jwtPrivateKey\"));\n      cachedPrivateKeyPromise = importPKCS8(pem, JWT_ALG).catch((error) => {\n        cachedPrivateKeyPromise = null;\n        throw error;\n      });\n    } catch (error) {\n      cachedPrivateKeyPromise = null;\n      throw error;\n    }\n  }\n  return cachedPrivateKeyPromise;\n};\n\nconst getIssuer = (path?: string) => {\n  const key = path ?? \"\";\n  let issuer = cachedIssuers.get(key);\n  if (issuer === undefined) {\n    issuer = authUrlFromEnv(path);\n    cachedIssuers.set(key, issuer);\n  }\n  return issuer;\n};\n\nif (envOptionalString(\"AUTH_KEYS\")) {\n  try {\n    void getPrivateKey().catch((err) => {\n      console.error(\"[auth] JWT private key pre-warm failed\", { err });\n    });\n  } catch (err) {\n    console.error(\"[auth] JWT private key pre-warm threw synchronously\", { err });\n  }\n}\nif (envOptionalString(\"CONVEX_SITE_URL\")) {\n  try {\n    getIssuer();\n  } catch (err) {\n    console.error(\"[auth] JWT issuer pre-warm threw\", { err });\n  }\n}\n\n/** Lifetime of an issued OAuth access token, in seconds. Shared with the token endpoint's `expires_in`. */\nexport const OAUTH_ACCESS_TOKEN_DURATION_S = 900;\n\n/**\n * Sign an OAuth access token (EdDSA) for the given user, client, and scopes.\n *\n * The `aud` claim is `\"convex\"` so the token is a valid Convex identity\n * (`applicationID: \"convex\"`) — load-bearing: MCP tools run the user's queries\n * via `ctx.runQuery`, which requires Convex's identity layer to accept this\n * token. For that reason the access token must look like an ID-token-shaped JWT:\n * it carries NO `typ: \"at+jwt\"` header (Convex's validator rejects that RFC 9068\n * type), and is instead marked as an access token by a positive `token_use:\n * \"access\"` claim, which `verifyOAuthToken` checks (alongside the `client_id`\n * claim) to tell it apart from a session token. We don't issue OIDC ID tokens,\n * so there is no id-vs-access confusion for the `at+jwt` typ to guard against.\n *\n * When an RFC 8707 `resource` is supplied the token carries a `resource` claim\n * binding it to that protected resource; an MCP endpoint rejects tokens whose\n * `resource` does not match its own canonical resource.\n *\n * @internal\n */\nexport async function generateOAuthToken(args: {\n  userId: string;\n  clientId: string;\n  scopes: string[];\n  issuer?: string;\n  resource?: string;\n}): Promise<string> {\n  const privateKey = await withSpan(\"convex-auth.tokens.import-key\", { alg: JWT_ALG }, () =>\n    getPrivateKey(),\n  );\n  const exp = new Date(Date.now() + OAUTH_ACCESS_TOKEN_DURATION_S * 1000);\n  return await withSpan(\"convex-auth.tokens.sign-oauth\", { alg: JWT_ALG }, () =>\n    new SignJWT({\n      sub: args.userId,\n      aud: \"convex\",\n      token_use: \"access\",\n      scope: args.scopes.join(\" \"),\n      client_id: args.clientId,\n      ...(args.resource !== undefined ? { resource: args.resource } : null),\n    })\n      .setProtectedHeader({ alg: JWT_ALG })\n      .setIssuedAt()\n      .setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET))\n      .setIssuer(args.issuer ?? getIssuer())\n      .setExpirationTime(exp)\n      .sign(privateKey),\n  );\n}\n\nlet cachedKeySet: ReturnType<typeof createLocalJWKSet> | null = null;\n\n/**\n * The local JWKS keyset, built once and reused. `AUTH_KEYS` is static per\n * deployment, so caching also preserves jose's internal imported-key cache\n * across requests rather than re-importing keys on every verification.\n */\nfunction getJwkSet(): ReturnType<typeof createLocalJWKSet> {\n  if (cachedKeySet === null) {\n    cachedKeySet = createLocalJWKSet(requireAuthKey(\"jwks\"));\n  }\n  return cachedKeySet;\n}\n\n/**\n * Verify an OAuth access token against the local JWKS and issuer.\n *\n * When `opts.resource` is supplied, the token's RFC 8707 `resource` claim must\n * equal it exactly — a token bound to a different (or no) resource is rejected.\n * This is how an MCP endpoint enforces that a token was issued for *it*.\n *\n * @returns The token's user, client, scopes, and bound `resource`, or `null` if\n *   verification fails, the token is not an OAuth access token, or the resource\n *   assertion does not hold.\n * @internal\n */\nexport async function verifyOAuthToken(\n  token: string,\n  opts?: { issuer?: string; resource?: string },\n): Promise<{ userId: string; clientId: string; scopes: string[]; resource: string | null } | null> {\n  try {\n    const { payload } = await jwtVerify(token, getJwkSet(), {\n      issuer: opts?.issuer ?? getIssuer(),\n      audience: \"convex\",\n      // Defense-in-depth: pin the accepted JWS algorithm so a token can only be\n      // verified under EdDSA, never coerced to a different `alg` (algorithm\n      // substitution / confusion hardening).\n      algorithms: [JWT_ALG],\n      clockTolerance: 30,\n    });\n    if ((payload as { token_use?: string }).token_use !== \"access\") return null;\n    const userId = payload.sub;\n    const clientId = (payload as { client_id?: string }).client_id;\n    const scope = (payload as { scope?: string }).scope ?? \"\";\n    if (!userId || !clientId) return null;\n    const resourceClaim = (payload as { resource?: unknown }).resource;\n    const resource = typeof resourceClaim === \"string\" ? resourceClaim : null;\n    if (opts?.resource !== undefined && resource !== opts.resource) return null;\n    // NOTE: the returned `scopes` are ADVISORY, not a Convex-enforced capability\n    // boundary. Because `aud` is \"convex\", Convex's identity layer accepts this\n    // token as the user's full identity — any query/mutation the user could run,\n    // a client bearing this token can run via `ctx.runQuery`/`ctx.runMutation`,\n    // regardless of `scope`. Integrators MUST enforce these scopes app-side\n    // (e.g. inside each MCP tool handler) for them to actually restrict access.\n    return { userId, clientId, scopes: scope ? scope.split(\" \") : [], resource };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Sign a session access token (EdDSA) carrying the identity claims, audienced to Convex.\n *\n * Expiry is `config.jwt.durationMs` from now, defaulting to one hour.\n *\n * @internal\n */\nexport async function generateToken(\n  args: {\n    identity: SessionTokenIdentityClaims;\n  },\n  config: ConvexAuthConfig,\n): Promise<AccessToken> {\n  const privateKey = await withSpan(\"convex-auth.tokens.import-key\", { alg: JWT_ALG }, () =>\n    getPrivateKey(),\n  );\n  const expirationTime = new Date(Date.now() + (config.jwt?.durationMs ?? DEFAULT_JWT_DURATION_MS));\n  const claims = {\n    sub: args.identity.subject,\n    sid: args.identity.sessionId,\n    session_epoch: args.identity.sessionEpoch,\n    ...(args.identity.name !== undefined ? { name: args.identity.name } : null),\n    ...(args.identity.email !== undefined ? { email: args.identity.email } : null),\n    ...(args.identity.emailVerified !== undefined\n      ? { email_verified: args.identity.emailVerified }\n      : null),\n    ...(args.identity.picture !== undefined ? { picture: args.identity.picture } : null),\n    ...(args.identity.phoneNumber !== undefined\n      ? { phone_number: args.identity.phoneNumber }\n      : null),\n    ...(args.identity.phoneNumberVerified !== undefined\n      ? { phone_number_verified: args.identity.phoneNumberVerified }\n      : null),\n  };\n  return (await withSpan(\"convex-auth.tokens.sign\", { alg: JWT_ALG }, () =>\n    new SignJWT(claims)\n      .setProtectedHeader({ alg: JWT_ALG })\n      .setIssuedAt()\n      .setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET))\n      .setIssuer(getIssuer(config.path))\n      .setAudience(\"convex\")\n      .setExpirationTime(expirationTime)\n      .sign(privateKey),\n  )) as AccessToken;\n}\n"],"mappings":";;;;;;;AAUA,MAAM,0BAA0B,MAAO,KAAK;AAC5C,MAAM,mBAAmB;AACzB,MAAM,qBAAqB;AAE3B,IAAI,0BAAmF;AACvF,MAAM,gCAAgB,IAAI,KAAqB;AAE/C,MAAM,UAAU;AAEhB,SAAS,kBAAkB,OAAe;CACxC,MAAM,UAAU,MAAM,MAAM;AAC5B,KAAI,CAAC,QAAQ,SAAS,8BAA8B,CAClD,QAAO;CAGT,MAAM,sBAAsB,QAAQ,QAAQ,QAAQ,KAAK;AACzD,KAAI,oBAAoB,SAAS,KAAK,CACpC,QAAO;CAGT,MAAM,cAAc;CACpB,MAAM,YAAY;CAClB,MAAM,OAAO,QAAQ,QAAQ,aAAa,GAAG,CAAC,QAAQ,WAAW,GAAG,CAAC,MAAM,CAAC,QAAQ,QAAQ,GAAG;AAE/F,KAAI,KAAK,WAAW,EAClB,QAAO;AAIT,QAAO,GAAG,YAAY,IADF,KAAK,MAAM,WAAW,EAAE,KAAK,KAAK,IAAI,KACpB,IAAI;;AAG5C,MAAM,sBAAsB;AAC1B,KAAI,4BAA4B,KAC9B,KAAI;AAEF,4BAA0B,YADd,kBAAkB,eAAe,gBAAgB,CAAC,EACnB,QAAQ,CAAC,OAAO,UAAU;AACnE,6BAA0B;AAC1B,SAAM;IACN;UACK,OAAO;AACd,4BAA0B;AAC1B,QAAM;;AAGV,QAAO;;AAGT,MAAM,aAAa,SAAkB;CACnC,MAAM,MAAM,QAAQ;CACpB,IAAI,SAAS,cAAc,IAAI,IAAI;AACnC,KAAI,WAAW,QAAW;AACxB,WAAS,eAAe,KAAK;AAC7B,gBAAc,IAAI,KAAK,OAAO;;AAEhC,QAAO;;AAGT,IAAI,kBAAkB,YAAY,CAChC,KAAI;AACF,CAAK,eAAe,CAAC,OAAO,QAAQ;AAClC,UAAQ,MAAM,0CAA0C,EAAE,KAAK,CAAC;GAChE;SACK,KAAK;AACZ,SAAQ,MAAM,uDAAuD,EAAE,KAAK,CAAC;;AAGjF,IAAI,kBAAkB,kBAAkB,CACtC,KAAI;AACF,YAAW;SACJ,KAAK;AACZ,SAAQ,MAAM,oCAAoC,EAAE,KAAK,CAAC;;;AAK9D,MAAa,gCAAgC;;;;;;;;;;;;;;;;;;;;AAqB7C,eAAsB,mBAAmB,MAMrB;CAClB,MAAM,aAAa,MAAM,SAAS,iCAAiC,EAAE,KAAK,SAAS,QACjF,eAAe,CAChB;CACD,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK,GAAG,gCAAgC,IAAK;AACvE,QAAO,MAAM,SAAS,iCAAiC,EAAE,KAAK,SAAS,QACrE,IAAI,QAAQ;EACV,KAAK,KAAK;EACV,KAAK;EACL,WAAW;EACX,OAAO,KAAK,OAAO,KAAK,IAAI;EAC5B,WAAW,KAAK;EAChB,GAAI,KAAK,aAAa,SAAY,EAAE,UAAU,KAAK,UAAU,GAAG;EACjE,CAAC,CACC,mBAAmB,EAAE,KAAK,SAAS,CAAC,CACpC,aAAa,CACb,OAAO,qBAAqB,kBAAkB,mBAAmB,CAAC,CAClE,UAAU,KAAK,UAAU,WAAW,CAAC,CACrC,kBAAkB,IAAI,CACtB,KAAK,WAAW,CACpB;;AAGH,IAAI,eAA4D;;;;;;AAOhE,SAAS,YAAkD;AACzD,KAAI,iBAAiB,KACnB,gBAAe,kBAAkB,eAAe,OAAO,CAAC;AAE1D,QAAO;;;;;;;;;;;;;;AAeT,eAAsB,iBACpB,OACA,MACiG;AACjG,KAAI;EACF,MAAM,EAAE,YAAY,MAAM,UAAU,OAAO,WAAW,EAAE;GACtD,QAAQ,MAAM,UAAU,WAAW;GACnC,UAAU;GAIV,YAAY,CAAC,QAAQ;GACrB,gBAAgB;GACjB,CAAC;AACF,MAAK,QAAmC,cAAc,SAAU,QAAO;EACvE,MAAM,SAAS,QAAQ;EACvB,MAAM,WAAY,QAAmC;EACrD,MAAM,QAAS,QAA+B,SAAS;AACvD,MAAI,CAAC,UAAU,CAAC,SAAU,QAAO;EACjC,MAAM,gBAAiB,QAAmC;EAC1D,MAAM,WAAW,OAAO,kBAAkB,WAAW,gBAAgB;AACrE,MAAI,MAAM,aAAa,UAAa,aAAa,KAAK,SAAU,QAAO;AAOvE,SAAO;GAAE;GAAQ;GAAU,QAAQ,QAAQ,MAAM,MAAM,IAAI,GAAG,EAAE;GAAE;GAAU;SACtE;AACN,SAAO;;;;;;;;;;AAWX,eAAsB,cACpB,MAGA,QACsB;CACtB,MAAM,aAAa,MAAM,SAAS,iCAAiC,EAAE,KAAK,SAAS,QACjF,eAAe,CAChB;CACD,MAAM,iBAAiB,IAAI,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK,cAAc,yBAAyB;CACjG,MAAM,SAAS;EACb,KAAK,KAAK,SAAS;EACnB,KAAK,KAAK,SAAS;EACnB,eAAe,KAAK,SAAS;EAC7B,GAAI,KAAK,SAAS,SAAS,SAAY,EAAE,MAAM,KAAK,SAAS,MAAM,GAAG;EACtE,GAAI,KAAK,SAAS,UAAU,SAAY,EAAE,OAAO,KAAK,SAAS,OAAO,GAAG;EACzE,GAAI,KAAK,SAAS,kBAAkB,SAChC,EAAE,gBAAgB,KAAK,SAAS,eAAe,GAC/C;EACJ,GAAI,KAAK,SAAS,YAAY,SAAY,EAAE,SAAS,KAAK,SAAS,SAAS,GAAG;EAC/E,GAAI,KAAK,SAAS,gBAAgB,SAC9B,EAAE,cAAc,KAAK,SAAS,aAAa,GAC3C;EACJ,GAAI,KAAK,SAAS,wBAAwB,SACtC,EAAE,uBAAuB,KAAK,SAAS,qBAAqB,GAC5D;EACL;AACD,QAAQ,MAAM,SAAS,2BAA2B,EAAE,KAAK,SAAS,QAChE,IAAI,QAAQ,OAAO,CAChB,mBAAmB,EAAE,KAAK,SAAS,CAAC,CACpC,aAAa,CACb,OAAO,qBAAqB,kBAAkB,mBAAmB,CAAC,CAClE,UAAU,UAAU,OAAO,KAAK,CAAC,CACjC,YAAY,SAAS,CACrB,kBAAkB,eAAe,CACjC,KAAK,WAAW,CACpB"}

package/dist/server/totp.js

@@ -3,7 +3,7 @@ import { getAuthenticatedUserIdOrNull } from "./identity/claims.js";
 import { queueAuthEvent } from "./events.js";
 import { encodeRefreshToken, refreshTokenExpirationTime } from "./token/refresh.js";
 import { setActiveSpanAttributes } from "./utils/span.js";
-import { buildSessionIdentity, finalizeSessionIssuance, getAuthSessionId, sessionExpirationTime } from "./session/lifecycle.js";
+import { buildSessionIdentity, finalizeSessionIssuance, getAuthSessionReplacement, sessionExpirationTime } from "./session/lifecycle.js";
 import { authFlowError } from "../shared/errors.js";
 import { toConvexError } from "./errors.js";
 import { maxSignInAttempts } from "./limits.js";
@@ -194,13 +194,13 @@ const handleTotp = async (ctx, provider, args) => {
 		if (begun.status === "not_found") throw convexError(input.intent === "enrollment" ? ErrorCode.TOTP_NOT_FOUND : ErrorCode.TOTP_NO_ENROLLMENT, input.intent === "enrollment" ? "TOTP enrollment not found." : "No verified TOTP enrollment found.");
 		if (begun.status !== "ready") throw convexError(ErrorCode.INTERNAL_ERROR, "Unexpected TOTP verification state.");
 		if (!verifyTOTPWithGracePeriod(await decryptTotpSecret(begun.factor.secret), begun.factor.period, begun.factor.digits, input.code, 30)) throw convexError(ErrorCode.TOTP_INVALID_CODE, "Invalid TOTP code.");
-		const replaceSessionId = await getAuthSessionId(ctx) ?? void 0;
+		const replaceSession = await getAuthSessionReplacement(ctx);
 		const completed = await ctx.runMutation(ctx.auth.config.component.factor.totp.completeVerification, {
 			verifierId: input.verifier,
 			intent: input.intent,
 			authenticatedUserId: input.authenticatedUserId,
 			totpId: input.totpId,
-			replaceSessionId,
+			replaceSession,
 			sessionExpirationTime: sessionExpirationTime(ctx.auth.config),
 			refreshTokenExpirationTime: refreshTokenExpirationTime(ctx.auth.config),
 			now: Date.now()

package/dist/server/totp.js.map

@@ -1 +1 @@
-{"version":3,"file":"totp.js","names":[],"sources":["../../src/server/totp.ts"],"sourcesContent":["/**\n * Server-side TOTP ceremony logic for two-factor authentication.\n *\n * Two single-word flows:\n *\n * - `setup`  — generate a TOTP secret and `otpauth://` URI for enrollment.\n * - `verify` — consume a TOTP code. Auto-detects:\n *     - first-time enrollment confirmation (caller passes `totpId`), or\n *     - 2FA sign-in challenge (no `totpId`).\n */\n\nimport {\n  decodeBase64urlIgnorePadding,\n  encodeBase32LowerCaseNoPadding,\n  encodeBase64urlNoPadding,\n} from \"@oslojs/encoding\";\nimport { createTOTPKeyURI, verifyTOTPWithGracePeriod } from \"@oslojs/otp\";\nimport { ConvexError, GenericId } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\nimport { authFlowError } from \"../shared/errors\";\nimport type { AuthTokens, SignInSessionResult, SignInTotpSetupResult } from \"../shared/results\";\nimport type { AuthErrorData } from \"./errors\";\nimport { toConvexError } from \"./errors\";\nimport { queueAuthEvent } from \"./events\";\nimport { getAuthenticatedUserIdOrNull } from \"./identity/claims\";\nimport { maxSignInAttempts } from \"./limits\";\nimport { decryptSecret, encryptSecret } from \"./secret\";\nimport {\n  buildSessionIdentity,\n  finalizeSessionIssuance,\n  getAuthSessionId,\n  sessionExpirationTime,\n} from \"./session/lifecycle\";\nimport { encodeRefreshToken, refreshTokenExpirationTime } from \"./token/refresh\";\nimport { buildKnownSignInIdentityAttributes } from \"./telemetry\";\nimport {\n  AuthDataModel,\n  type CrossComponentUserDoc,\n  GenericActionCtxWithAuthConfig,\n  SessionInfo,\n  TotpProviderConfig,\n} from \"./types\";\nimport { setActiveSpanAttributes } from \"./utils/span\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\ntype TotpResult =\n  | SignInSessionResult<SessionInfo<AuthTokens | null> | null>\n  | SignInTotpSetupResult;\n\nconst TOTP_FLOWS = { setup: true, verify: true } as const;\n\ntype TotpFlow = keyof typeof TOTP_FLOWS;\n\nfunction isTotpFlow(value: unknown): value is TotpFlow {\n  return typeof value === \"string\" && Object.hasOwn(TOTP_FLOWS, value);\n}\n\ntype TotpDispatch =\n  | { flow: \"setup\"; params: Record<string, unknown> }\n  /** Enrollment confirmation — `totpId` distinguishes from a 2FA challenge. */\n  | { flow: \"verify\"; code: string; verifier: string; totpId: string; intent: \"enrollment\" }\n  /** 2FA challenge during sign-in. */\n  | { flow: \"verify\"; code: string; verifier: string; totpId?: undefined; intent: \"challenge\" };\n\nconst convexError = (code: ErrorCode, message: string) =>\n  toConvexError(authFlowError(code, message));\n\nconst asConvexError = (\n  error: unknown,\n  code: ErrorCode,\n  message: string,\n): ConvexError<AuthErrorData> =>\n  error instanceof ConvexError\n    ? error\n    : error instanceof Error\n      ? toConvexError(authFlowError(code, error.message || message))\n      : convexError(code, message);\n\n/**\n * Encrypt a raw TOTP secret for storage. The secret bytes are base64url-encoded\n * and sealed with the server's {@link encryptSecret} (AES-GCM); the resulting\n * ciphertext string is stored UTF-8-encoded in the `TotpFactor.secret` bytes\n * field. Runs server-side because component functions cannot read\n * the secret-encryption key from `AUTH_KEYS`.\n */\nasync function encryptTotpSecret(secret: Uint8Array): Promise<ArrayBuffer> {\n  const ciphertext = await encryptSecret(encodeBase64urlNoPadding(secret));\n  const encoded = new TextEncoder().encode(ciphertext);\n  return encoded.buffer.slice(\n    encoded.byteOffset,\n    encoded.byteOffset + encoded.byteLength,\n  ) as ArrayBuffer;\n}\n\n/**\n * Reverse {@link encryptTotpSecret}: decode the stored ciphertext bytes, decrypt\n * to the base64url secret, and return the raw secret bytes for verification.\n */\nasync function decryptTotpSecret(stored: ArrayBuffer): Promise<Uint8Array> {\n  const ciphertext = new TextDecoder().decode(stored);\n  const secretB64 = await decryptSecret(ciphertext);\n  return decodeBase64urlIgnorePadding(secretB64);\n}\n\nfunction resolveTotpFlow(params: Record<string, unknown>): TotpFlow {\n  const flow = params.flow;\n  if (isTotpFlow(flow)) {\n    return flow;\n  }\n  throw convexError(\n    ErrorCode.TOTP_MISSING_FLOW,\n    \"Missing `flow` parameter. Expected one of: \" + Object.keys(TOTP_FLOWS).join(\", \"),\n  );\n}\n\nfunction requireTotpVerifier(verifier: string | undefined): string {\n  if (verifier != null) {\n    return verifier;\n  }\n  throw convexError(ErrorCode.TOTP_MISSING_VERIFIER, \"Missing verifier for TOTP operation.\");\n}\n\nfunction requireTotpCode(params: Record<string, unknown>): string {\n  if (typeof params.code === \"string\") {\n    return params.code;\n  }\n  throw convexError(ErrorCode.TOTP_MISSING_CODE, \"Missing TOTP code.\");\n}\n\nfunction resolveTotpDispatch(\n  params: Record<string, unknown>,\n  verifier: string | undefined,\n): TotpDispatch {\n  const flow = resolveTotpFlow(params);\n  if (flow === \"setup\") {\n    return { flow, params };\n  }\n  const resolvedVerifier = requireTotpVerifier(verifier);\n  const code = requireTotpCode(params);\n  if (typeof params.totpId === \"string\" && params.totpId.length > 0) {\n    return {\n      flow,\n      code,\n      totpId: params.totpId,\n      verifier: resolvedVerifier,\n      intent: \"enrollment\",\n    };\n  }\n  return {\n    flow,\n    code,\n    verifier: resolvedVerifier,\n    intent: \"challenge\",\n  };\n}\n\nasync function requireAuthenticatedUserId(ctx: EnrichedActionCtx): Promise<string> {\n  try {\n    const userId = await getAuthenticatedUserIdOrNull(ctx);\n    if (userId === null) {\n      throw convexError(\n        ErrorCode.TOTP_AUTH_REQUIRED,\n        \"Sign in first, then set up two-factor authentication.\",\n      );\n    }\n    return userId;\n  } catch (error) {\n    if (error instanceof ConvexError) {\n      throw error;\n    }\n    throw asConvexError(error, ErrorCode.INTERNAL_ERROR, String(error));\n  }\n}\n\n/**\n * Drive the TOTP provider's `setup` / `verify` flow.\n *\n * `setup` issues an enrollment secret and `otpauth://` URI; `verify` either\n * confirms a first-time enrollment (when `params.totpId` is present) or\n * completes a 2FA challenge during sign-in.\n *\n * @internal\n */\nexport const handleTotp = async (\n  ctx: EnrichedActionCtx,\n  provider: TotpProviderConfig,\n  args: { params?: Record<string, unknown>; verifier?: string },\n): Promise<TotpResult> => {\n  const params = args.params ?? {};\n  const dispatch = resolveTotpDispatch(params, args.verifier);\n\n  async function setup(setupParams: Record<string, unknown>): Promise<TotpResult> {\n    const userId = await requireAuthenticatedUserId(ctx);\n    const secret = new Uint8Array(20);\n    crypto.getRandomValues(secret);\n    const base32Secret = encodeBase32LowerCaseNoPadding(secret);\n    let enrollment: { user: CrossComponentUserDoc; totpId: string; verifierId: string };\n    try {\n      enrollment = (await ctx.runMutation(ctx.auth.config.component.factor.totp.createEnrollment, {\n        userId,\n        secret: await encryptTotpSecret(secret),\n        digits: provider.options.digits,\n        period: provider.options.period,\n        name: typeof setupParams.name === \"string\" ? setupParams.name : undefined,\n        createdAt: Date.now(),\n      })) as typeof enrollment;\n    } catch (error) {\n      throw asConvexError(error, ErrorCode.INTERNAL_ERROR, `TOTP setup failed: ${String(error)}`);\n    }\n    const accountName =\n      typeof setupParams.accountName === \"string\" && setupParams.accountName.length > 0\n        ? setupParams.accountName\n        : (enrollment.user.email ?? \"user\");\n    const uri = createTOTPKeyURI(\n      provider.options.issuer,\n      accountName,\n      secret,\n      provider.options.period,\n      provider.options.digits,\n    );\n\n    return {\n      kind: \"totpSetup\" as const,\n      totpSetup: { uri, secret: base32Secret, totpId: enrollment.totpId },\n      verifier: enrollment.verifierId,\n    };\n  }\n\n  /**\n   * `verify` with `totpId`: completes a first-time enrollment after `setup`.\n   * Marks the TOTP factor as verified and signs the user in.\n   */\n  async function confirmEnrollment(\n    code: string,\n    totpId: string,\n    verifier: string,\n  ): Promise<TotpResult> {\n    const userId = await requireAuthenticatedUserId(ctx);\n    const result = await verifyTotp({\n      code,\n      verifier,\n      intent: \"enrollment\",\n      authenticatedUserId: userId,\n      totpId,\n    });\n    await queueAuthEvent(ctx, ctx.auth.config, {\n      kind: \"totp.enrolled\",\n      actor: { type: \"user\", id: userId },\n      subject: { type: \"totp\", id: totpId },\n      targets: [{ kind: \"user\", id: userId }],\n      outcome: \"success\",\n      data: { totpId },\n    });\n    return result;\n  }\n\n  /**\n   * `verify` without `totpId`: completes a 2FA challenge during sign-in.\n   * Looks up the user's verified TOTP factor, validates the code, signs in.\n   */\n  async function verifyChallenge(code: string, verifier: string): Promise<TotpResult> {\n    return await verifyTotp({ code, verifier, intent: \"challenge\" });\n  }\n\n  async function verifyTotp(input: {\n    code: string;\n    verifier: string;\n    intent: \"enrollment\" | \"challenge\";\n    authenticatedUserId?: string;\n    totpId?: string;\n  }): Promise<TotpResult> {\n    const begun = (await ctx.runMutation(ctx.auth.config.component.factor.totp.beginVerification, {\n      verifierId: input.verifier,\n      intent: input.intent,\n      authenticatedUserId: input.authenticatedUserId,\n      totpId: input.totpId,\n      maxAttemptsPerHour: maxSignInAttempts(ctx.auth.config),\n    })) as\n      | { status: \"invalid_verifier\" | \"limited\" | \"not_found\" | \"already_verified\" }\n      | {\n          status: \"ready\";\n          userId: string;\n          factor: {\n            _id: string;\n            secret: ArrayBuffer;\n            period: number;\n            digits: number;\n          };\n        };\n\n    if (begun.status === \"invalid_verifier\") {\n      throw convexError(ErrorCode.TOTP_INVALID_VERIFIER, \"Invalid or expired TOTP verifier.\");\n    }\n    if (begun.status === \"limited\") {\n      throw convexError(ErrorCode.RATE_LIMITED, \"Too many TOTP attempts. Try again later.\");\n    }\n    if (begun.status === \"already_verified\") {\n      throw convexError(ErrorCode.TOTP_ALREADY_VERIFIED, \"TOTP enrollment is already verified.\");\n    }\n    if (begun.status === \"not_found\") {\n      throw convexError(\n        input.intent === \"enrollment\" ? ErrorCode.TOTP_NOT_FOUND : ErrorCode.TOTP_NO_ENROLLMENT,\n        input.intent === \"enrollment\"\n          ? \"TOTP enrollment not found.\"\n          : \"No verified TOTP enrollment found.\",\n      );\n    }\n    if (begun.status !== \"ready\") {\n      throw convexError(ErrorCode.INTERNAL_ERROR, \"Unexpected TOTP verification state.\");\n    }\n\n    const secret = await decryptTotpSecret(begun.factor.secret);\n    if (\n      !verifyTOTPWithGracePeriod(secret, begun.factor.period, begun.factor.digits, input.code, 30)\n    ) {\n      throw convexError(ErrorCode.TOTP_INVALID_CODE, \"Invalid TOTP code.\");\n    }\n\n    const replaceSessionId = (await getAuthSessionId(ctx)) ?? undefined;\n    const completed = (await ctx.runMutation(\n      ctx.auth.config.component.factor.totp.completeVerification,\n      {\n        verifierId: input.verifier,\n        intent: input.intent,\n        authenticatedUserId: input.authenticatedUserId,\n        totpId: input.totpId,\n        replaceSessionId,\n        sessionExpirationTime: sessionExpirationTime(ctx.auth.config),\n        refreshTokenExpirationTime: refreshTokenExpirationTime(ctx.auth.config),\n        now: Date.now(),\n      },\n    )) as\n      | { status: \"rejected\" }\n      | {\n          status: \"accepted\";\n          user: CrossComponentUserDoc;\n          factorId: string;\n          sessionId: string;\n          refreshTokenId: string;\n          replacedSessionId?: string;\n        };\n    if (completed.status !== \"accepted\") {\n      throw convexError(ErrorCode.TOTP_INVALID_VERIFIER, \"Invalid or expired TOTP verifier.\");\n    }\n\n    const userId = completed.user._id as GenericId<\"User\">;\n    const sessionId = completed.sessionId as GenericId<\"Session\">;\n    setActiveSpanAttributes({\n      \"auth.signin.result\": \"success\",\n      ...buildKnownSignInIdentityAttributes(\n        ctx.auth.config,\n        { userId, sessionId },\n        completed.user.email,\n      ),\n    });\n    if (completed.replacedSessionId !== undefined) {\n      const replacedSessionId = completed.replacedSessionId as GenericId<\"Session\">;\n      await queueAuthEvent(ctx, ctx.auth.config, {\n        kind: \"session.invalidated\",\n        actor: { type: \"system\" },\n        subject: { type: \"session\", id: replacedSessionId },\n        targets: [\n          { kind: \"user\", id: userId },\n          { kind: \"session\", id: replacedSessionId },\n        ],\n        outcome: \"success\",\n        data: { userId, reason: \"replaced\" },\n      });\n    }\n    await queueAuthEvent(ctx, ctx.auth.config, {\n      kind: \"session.signed_in\",\n      actor: { type: \"user\", id: userId },\n      subject: { type: \"session\", id: sessionId },\n      targets: [\n        { kind: \"user\", id: userId },\n        { kind: \"session\", id: sessionId },\n      ],\n      outcome: \"success\",\n      data: { provider: \"session\", method: provider.id },\n    });\n    const session = await finalizeSessionIssuance(ctx.auth.config, {\n      userId,\n      sessionId,\n      identity: buildSessionIdentity(userId, sessionId, completed.user),\n      refreshToken: encodeRefreshToken(\n        completed.refreshTokenId as GenericId<\"RefreshToken\">,\n        sessionId,\n      ),\n    });\n    return { kind: \"signedIn\" as const, session };\n  }\n\n  if (dispatch.flow === \"setup\") {\n    return await setup(dispatch.params);\n  }\n  if (dispatch.intent === \"enrollment\") {\n    return await confirmEnrollment(dispatch.code, dispatch.totpId, dispatch.verifier);\n  }\n  return await verifyChallenge(dispatch.code, dispatch.verifier);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,aAAa;CAAE,OAAO;CAAM,QAAQ;CAAM;AAIhD,SAAS,WAAW,OAAmC;AACrD,QAAO,OAAO,UAAU,YAAY,OAAO,OAAO,YAAY,MAAM;;AAUtE,MAAM,eAAe,MAAiB,YACpC,cAAc,cAAc,MAAM,QAAQ,CAAC;AAE7C,MAAM,iBACJ,OACA,MACA,YAEA,iBAAiB,cACb,QACA,iBAAiB,QACf,cAAc,cAAc,MAAM,MAAM,WAAW,QAAQ,CAAC,GAC5D,YAAY,MAAM,QAAQ;;;;;;;;AASlC,eAAe,kBAAkB,QAA0C;CACzE,MAAM,aAAa,MAAM,cAAc,yBAAyB,OAAO,CAAC;CACxE,MAAM,UAAU,IAAI,aAAa,CAAC,OAAO,WAAW;AACpD,QAAO,QAAQ,OAAO,MACpB,QAAQ,YACR,QAAQ,aAAa,QAAQ,WAC9B;;;;;;AAOH,eAAe,kBAAkB,QAA0C;AAGzE,QAAO,6BADW,MAAM,cADL,IAAI,aAAa,CAAC,OAAO,OAAO,CACF,CACH;;AAGhD,SAAS,gBAAgB,QAA2C;CAClE,MAAM,OAAO,OAAO;AACpB,KAAI,WAAW,KAAK,CAClB,QAAO;AAET,OAAM,YACJ,UAAU,mBACV,gDAAgD,OAAO,KAAK,WAAW,CAAC,KAAK,KAAK,CACnF;;AAGH,SAAS,oBAAoB,UAAsC;AACjE,KAAI,YAAY,KACd,QAAO;AAET,OAAM,YAAY,UAAU,uBAAuB,uCAAuC;;AAG5F,SAAS,gBAAgB,QAAyC;AAChE,KAAI,OAAO,OAAO,SAAS,SACzB,QAAO,OAAO;AAEhB,OAAM,YAAY,UAAU,mBAAmB,qBAAqB;;AAGtE,SAAS,oBACP,QACA,UACc;CACd,MAAM,OAAO,gBAAgB,OAAO;AACpC,KAAI,SAAS,QACX,QAAO;EAAE;EAAM;EAAQ;CAEzB,MAAM,mBAAmB,oBAAoB,SAAS;CACtD,MAAM,OAAO,gBAAgB,OAAO;AACpC,KAAI,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,EAC9D,QAAO;EACL;EACA;EACA,QAAQ,OAAO;EACf,UAAU;EACV,QAAQ;EACT;AAEH,QAAO;EACL;EACA;EACA,UAAU;EACV,QAAQ;EACT;;AAGH,eAAe,2BAA2B,KAAyC;AACjF,KAAI;EACF,MAAM,SAAS,MAAM,6BAA6B,IAAI;AACtD,MAAI,WAAW,KACb,OAAM,YACJ,UAAU,oBACV,wDACD;AAEH,SAAO;UACA,OAAO;AACd,MAAI,iBAAiB,YACnB,OAAM;AAER,QAAM,cAAc,OAAO,UAAU,gBAAgB,OAAO,MAAM,CAAC;;;;;;;;;;;;AAavE,MAAa,aAAa,OACxB,KACA,UACA,SACwB;CAExB,MAAM,WAAW,oBADF,KAAK,UAAU,EAAE,EACa,KAAK,SAAS;CAE3D,eAAe,MAAM,aAA2D;EAC9E,MAAM,SAAS,MAAM,2BAA2B,IAAI;EACpD,MAAM,SAAS,IAAI,WAAW,GAAG;AACjC,SAAO,gBAAgB,OAAO;EAC9B,MAAM,eAAe,+BAA+B,OAAO;EAC3D,IAAI;AACJ,MAAI;AACF,gBAAc,MAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,KAAK,kBAAkB;IAC1F;IACA,QAAQ,MAAM,kBAAkB,OAAO;IACvC,QAAQ,SAAS,QAAQ;IACzB,QAAQ,SAAS,QAAQ;IACzB,MAAM,OAAO,YAAY,SAAS,WAAW,YAAY,OAAO;IAChE,WAAW,KAAK,KAAK;IACtB,CAAC;WACK,OAAO;AACd,SAAM,cAAc,OAAO,UAAU,gBAAgB,sBAAsB,OAAO,MAAM,GAAG;;EAE7F,MAAM,cACJ,OAAO,YAAY,gBAAgB,YAAY,YAAY,YAAY,SAAS,IAC5E,YAAY,cACX,WAAW,KAAK,SAAS;AAShC,SAAO;GACL,MAAM;GACN,WAAW;IAAE,KAVH,iBACV,SAAS,QAAQ,QACjB,aACA,QACA,SAAS,QAAQ,QACjB,SAAS,QAAQ,OAClB;IAImB,QAAQ;IAAc,QAAQ,WAAW;IAAQ;GACnE,UAAU,WAAW;GACtB;;;;;;CAOH,eAAe,kBACb,MACA,QACA,UACqB;EACrB,MAAM,SAAS,MAAM,2BAA2B,IAAI;EACpD,MAAM,SAAS,MAAM,WAAW;GAC9B;GACA;GACA,QAAQ;GACR,qBAAqB;GACrB;GACD,CAAC;AACF,QAAM,eAAe,KAAK,IAAI,KAAK,QAAQ;GACzC,MAAM;GACN,OAAO;IAAE,MAAM;IAAQ,IAAI;IAAQ;GACnC,SAAS;IAAE,MAAM;IAAQ,IAAI;IAAQ;GACrC,SAAS,CAAC;IAAE,MAAM;IAAQ,IAAI;IAAQ,CAAC;GACvC,SAAS;GACT,MAAM,EAAE,QAAQ;GACjB,CAAC;AACF,SAAO;;;;;;CAOT,eAAe,gBAAgB,MAAc,UAAuC;AAClF,SAAO,MAAM,WAAW;GAAE;GAAM;GAAU,QAAQ;GAAa,CAAC;;CAGlE,eAAe,WAAW,OAMF;EACtB,MAAM,QAAS,MAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,KAAK,mBAAmB;GAC5F,YAAY,MAAM;GAClB,QAAQ,MAAM;GACd,qBAAqB,MAAM;GAC3B,QAAQ,MAAM;GACd,oBAAoB,kBAAkB,IAAI,KAAK,OAAO;GACvD,CAAC;AAaF,MAAI,MAAM,WAAW,mBACnB,OAAM,YAAY,UAAU,uBAAuB,oCAAoC;AAEzF,MAAI,MAAM,WAAW,UACnB,OAAM,YAAY,UAAU,cAAc,2CAA2C;AAEvF,MAAI,MAAM,WAAW,mBACnB,OAAM,YAAY,UAAU,uBAAuB,uCAAuC;AAE5F,MAAI,MAAM,WAAW,YACnB,OAAM,YACJ,MAAM,WAAW,eAAe,UAAU,iBAAiB,UAAU,oBACrE,MAAM,WAAW,eACb,+BACA,qCACL;AAEH,MAAI,MAAM,WAAW,QACnB,OAAM,YAAY,UAAU,gBAAgB,sCAAsC;AAIpF,MACE,CAAC,0BAFY,MAAM,kBAAkB,MAAM,OAAO,OAAO,EAEtB,MAAM,OAAO,QAAQ,MAAM,OAAO,QAAQ,MAAM,MAAM,GAAG,CAE5F,OAAM,YAAY,UAAU,mBAAmB,qBAAqB;EAGtE,MAAM,mBAAoB,MAAM,iBAAiB,IAAI,IAAK;EAC1D,MAAM,YAAa,MAAM,IAAI,YAC3B,IAAI,KAAK,OAAO,UAAU,OAAO,KAAK,sBACtC;GACE,YAAY,MAAM;GAClB,QAAQ,MAAM;GACd,qBAAqB,MAAM;GAC3B,QAAQ,MAAM;GACd;GACA,uBAAuB,sBAAsB,IAAI,KAAK,OAAO;GAC7D,4BAA4B,2BAA2B,IAAI,KAAK,OAAO;GACvE,KAAK,KAAK,KAAK;GAChB,CACF;AAUD,MAAI,UAAU,WAAW,WACvB,OAAM,YAAY,UAAU,uBAAuB,oCAAoC;EAGzF,MAAM,SAAS,UAAU,KAAK;EAC9B,MAAM,YAAY,UAAU;AAC5B,0BAAwB;GACtB,sBAAsB;GACtB,GAAG,mCACD,IAAI,KAAK,QACT;IAAE;IAAQ;IAAW,EACrB,UAAU,KAAK,MAChB;GACF,CAAC;AACF,MAAI,UAAU,sBAAsB,QAAW;GAC7C,MAAM,oBAAoB,UAAU;AACpC,SAAM,eAAe,KAAK,IAAI,KAAK,QAAQ;IACzC,MAAM;IACN,OAAO,EAAE,MAAM,UAAU;IACzB,SAAS;KAAE,MAAM;KAAW,IAAI;KAAmB;IACnD,SAAS,CACP;KAAE,MAAM;KAAQ,IAAI;KAAQ,EAC5B;KAAE,MAAM;KAAW,IAAI;KAAmB,CAC3C;IACD,SAAS;IACT,MAAM;KAAE;KAAQ,QAAQ;KAAY;IACrC,CAAC;;AAEJ,QAAM,eAAe,KAAK,IAAI,KAAK,QAAQ;GACzC,MAAM;GACN,OAAO;IAAE,MAAM;IAAQ,IAAI;IAAQ;GACnC,SAAS;IAAE,MAAM;IAAW,IAAI;IAAW;GAC3C,SAAS,CACP;IAAE,MAAM;IAAQ,IAAI;IAAQ,EAC5B;IAAE,MAAM;IAAW,IAAI;IAAW,CACnC;GACD,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,QAAQ,SAAS;IAAI;GACnD,CAAC;AAUF,SAAO;GAAE,MAAM;GAAqB,SATpB,MAAM,wBAAwB,IAAI,KAAK,QAAQ;IAC7D;IACA;IACA,UAAU,qBAAqB,QAAQ,WAAW,UAAU,KAAK;IACjE,cAAc,mBACZ,UAAU,gBACV,UACD;IACF,CAAC;GAC2C;;AAG/C,KAAI,SAAS,SAAS,QACpB,QAAO,MAAM,MAAM,SAAS,OAAO;AAErC,KAAI,SAAS,WAAW,aACtB,QAAO,MAAM,kBAAkB,SAAS,MAAM,SAAS,QAAQ,SAAS,SAAS;AAEnF,QAAO,MAAM,gBAAgB,SAAS,MAAM,SAAS,SAAS"}
+{"version":3,"file":"totp.js","names":[],"sources":["../../src/server/totp.ts"],"sourcesContent":["/**\n * Server-side TOTP ceremony logic for two-factor authentication.\n *\n * Two single-word flows:\n *\n * - `setup`  — generate a TOTP secret and `otpauth://` URI for enrollment.\n * - `verify` — consume a TOTP code. Auto-detects:\n *     - first-time enrollment confirmation (caller passes `totpId`), or\n *     - 2FA sign-in challenge (no `totpId`).\n */\n\nimport {\n  decodeBase64urlIgnorePadding,\n  encodeBase32LowerCaseNoPadding,\n  encodeBase64urlNoPadding,\n} from \"@oslojs/encoding\";\nimport { createTOTPKeyURI, verifyTOTPWithGracePeriod } from \"@oslojs/otp\";\nimport { ConvexError, GenericId } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\nimport { authFlowError } from \"../shared/errors\";\nimport type { AuthTokens, SignInSessionResult, SignInTotpSetupResult } from \"../shared/results\";\nimport type { AuthErrorData } from \"./errors\";\nimport { toConvexError } from \"./errors\";\nimport { queueAuthEvent } from \"./events\";\nimport { getAuthenticatedUserIdOrNull } from \"./identity/claims\";\nimport { maxSignInAttempts } from \"./limits\";\nimport { decryptSecret, encryptSecret } from \"./secret\";\nimport {\n  buildSessionIdentity,\n  finalizeSessionIssuance,\n  getAuthSessionReplacement,\n  sessionExpirationTime,\n} from \"./session/lifecycle\";\nimport { encodeRefreshToken, refreshTokenExpirationTime } from \"./token/refresh\";\nimport { buildKnownSignInIdentityAttributes } from \"./telemetry\";\nimport {\n  AuthDataModel,\n  type CrossComponentUserDoc,\n  GenericActionCtxWithAuthConfig,\n  SessionInfo,\n  TotpProviderConfig,\n} from \"./types\";\nimport { setActiveSpanAttributes } from \"./utils/span\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\ntype TotpResult =\n  | SignInSessionResult<SessionInfo<AuthTokens | null> | null>\n  | SignInTotpSetupResult;\n\nconst TOTP_FLOWS = { setup: true, verify: true } as const;\n\ntype TotpFlow = keyof typeof TOTP_FLOWS;\n\nfunction isTotpFlow(value: unknown): value is TotpFlow {\n  return typeof value === \"string\" && Object.hasOwn(TOTP_FLOWS, value);\n}\n\ntype TotpDispatch =\n  | { flow: \"setup\"; params: Record<string, unknown> }\n  /** Enrollment confirmation — `totpId` distinguishes from a 2FA challenge. */\n  | { flow: \"verify\"; code: string; verifier: string; totpId: string; intent: \"enrollment\" }\n  /** 2FA challenge during sign-in. */\n  | { flow: \"verify\"; code: string; verifier: string; totpId?: undefined; intent: \"challenge\" };\n\nconst convexError = (code: ErrorCode, message: string) =>\n  toConvexError(authFlowError(code, message));\n\nconst asConvexError = (\n  error: unknown,\n  code: ErrorCode,\n  message: string,\n): ConvexError<AuthErrorData> =>\n  error instanceof ConvexError\n    ? error\n    : error instanceof Error\n      ? toConvexError(authFlowError(code, error.message || message))\n      : convexError(code, message);\n\n/**\n * Encrypt a raw TOTP secret for storage. The secret bytes are base64url-encoded\n * and sealed with the server's {@link encryptSecret} (AES-GCM); the resulting\n * ciphertext string is stored UTF-8-encoded in the `TotpFactor.secret` bytes\n * field. Runs server-side because component functions cannot read\n * the secret-encryption key from `AUTH_KEYS`.\n */\nasync function encryptTotpSecret(secret: Uint8Array): Promise<ArrayBuffer> {\n  const ciphertext = await encryptSecret(encodeBase64urlNoPadding(secret));\n  const encoded = new TextEncoder().encode(ciphertext);\n  return encoded.buffer.slice(\n    encoded.byteOffset,\n    encoded.byteOffset + encoded.byteLength,\n  ) as ArrayBuffer;\n}\n\n/**\n * Reverse {@link encryptTotpSecret}: decode the stored ciphertext bytes, decrypt\n * to the base64url secret, and return the raw secret bytes for verification.\n */\nasync function decryptTotpSecret(stored: ArrayBuffer): Promise<Uint8Array> {\n  const ciphertext = new TextDecoder().decode(stored);\n  const secretB64 = await decryptSecret(ciphertext);\n  return decodeBase64urlIgnorePadding(secretB64);\n}\n\nfunction resolveTotpFlow(params: Record<string, unknown>): TotpFlow {\n  const flow = params.flow;\n  if (isTotpFlow(flow)) {\n    return flow;\n  }\n  throw convexError(\n    ErrorCode.TOTP_MISSING_FLOW,\n    \"Missing `flow` parameter. Expected one of: \" + Object.keys(TOTP_FLOWS).join(\", \"),\n  );\n}\n\nfunction requireTotpVerifier(verifier: string | undefined): string {\n  if (verifier != null) {\n    return verifier;\n  }\n  throw convexError(ErrorCode.TOTP_MISSING_VERIFIER, \"Missing verifier for TOTP operation.\");\n}\n\nfunction requireTotpCode(params: Record<string, unknown>): string {\n  if (typeof params.code === \"string\") {\n    return params.code;\n  }\n  throw convexError(ErrorCode.TOTP_MISSING_CODE, \"Missing TOTP code.\");\n}\n\nfunction resolveTotpDispatch(\n  params: Record<string, unknown>,\n  verifier: string | undefined,\n): TotpDispatch {\n  const flow = resolveTotpFlow(params);\n  if (flow === \"setup\") {\n    return { flow, params };\n  }\n  const resolvedVerifier = requireTotpVerifier(verifier);\n  const code = requireTotpCode(params);\n  if (typeof params.totpId === \"string\" && params.totpId.length > 0) {\n    return {\n      flow,\n      code,\n      totpId: params.totpId,\n      verifier: resolvedVerifier,\n      intent: \"enrollment\",\n    };\n  }\n  return {\n    flow,\n    code,\n    verifier: resolvedVerifier,\n    intent: \"challenge\",\n  };\n}\n\nasync function requireAuthenticatedUserId(ctx: EnrichedActionCtx): Promise<string> {\n  try {\n    const userId = await getAuthenticatedUserIdOrNull(ctx);\n    if (userId === null) {\n      throw convexError(\n        ErrorCode.TOTP_AUTH_REQUIRED,\n        \"Sign in first, then set up two-factor authentication.\",\n      );\n    }\n    return userId;\n  } catch (error) {\n    if (error instanceof ConvexError) {\n      throw error;\n    }\n    throw asConvexError(error, ErrorCode.INTERNAL_ERROR, String(error));\n  }\n}\n\n/**\n * Drive the TOTP provider's `setup` / `verify` flow.\n *\n * `setup` issues an enrollment secret and `otpauth://` URI; `verify` either\n * confirms a first-time enrollment (when `params.totpId` is present) or\n * completes a 2FA challenge during sign-in.\n *\n * @internal\n */\nexport const handleTotp = async (\n  ctx: EnrichedActionCtx,\n  provider: TotpProviderConfig,\n  args: { params?: Record<string, unknown>; verifier?: string },\n): Promise<TotpResult> => {\n  const params = args.params ?? {};\n  const dispatch = resolveTotpDispatch(params, args.verifier);\n\n  async function setup(setupParams: Record<string, unknown>): Promise<TotpResult> {\n    const userId = await requireAuthenticatedUserId(ctx);\n    const secret = new Uint8Array(20);\n    crypto.getRandomValues(secret);\n    const base32Secret = encodeBase32LowerCaseNoPadding(secret);\n    let enrollment: { user: CrossComponentUserDoc; totpId: string; verifierId: string };\n    try {\n      enrollment = (await ctx.runMutation(ctx.auth.config.component.factor.totp.createEnrollment, {\n        userId,\n        secret: await encryptTotpSecret(secret),\n        digits: provider.options.digits,\n        period: provider.options.period,\n        name: typeof setupParams.name === \"string\" ? setupParams.name : undefined,\n        createdAt: Date.now(),\n      })) as typeof enrollment;\n    } catch (error) {\n      throw asConvexError(error, ErrorCode.INTERNAL_ERROR, `TOTP setup failed: ${String(error)}`);\n    }\n    const accountName =\n      typeof setupParams.accountName === \"string\" && setupParams.accountName.length > 0\n        ? setupParams.accountName\n        : (enrollment.user.email ?? \"user\");\n    const uri = createTOTPKeyURI(\n      provider.options.issuer,\n      accountName,\n      secret,\n      provider.options.period,\n      provider.options.digits,\n    );\n\n    return {\n      kind: \"totpSetup\" as const,\n      totpSetup: { uri, secret: base32Secret, totpId: enrollment.totpId },\n      verifier: enrollment.verifierId,\n    };\n  }\n\n  /**\n   * `verify` with `totpId`: completes a first-time enrollment after `setup`.\n   * Marks the TOTP factor as verified and signs the user in.\n   */\n  async function confirmEnrollment(\n    code: string,\n    totpId: string,\n    verifier: string,\n  ): Promise<TotpResult> {\n    const userId = await requireAuthenticatedUserId(ctx);\n    const result = await verifyTotp({\n      code,\n      verifier,\n      intent: \"enrollment\",\n      authenticatedUserId: userId,\n      totpId,\n    });\n    await queueAuthEvent(ctx, ctx.auth.config, {\n      kind: \"totp.enrolled\",\n      actor: { type: \"user\", id: userId },\n      subject: { type: \"totp\", id: totpId },\n      targets: [{ kind: \"user\", id: userId }],\n      outcome: \"success\",\n      data: { totpId },\n    });\n    return result;\n  }\n\n  /**\n   * `verify` without `totpId`: completes a 2FA challenge during sign-in.\n   * Looks up the user's verified TOTP factor, validates the code, signs in.\n   */\n  async function verifyChallenge(code: string, verifier: string): Promise<TotpResult> {\n    return await verifyTotp({ code, verifier, intent: \"challenge\" });\n  }\n\n  async function verifyTotp(input: {\n    code: string;\n    verifier: string;\n    intent: \"enrollment\" | \"challenge\";\n    authenticatedUserId?: string;\n    totpId?: string;\n  }): Promise<TotpResult> {\n    const begun = (await ctx.runMutation(ctx.auth.config.component.factor.totp.beginVerification, {\n      verifierId: input.verifier,\n      intent: input.intent,\n      authenticatedUserId: input.authenticatedUserId,\n      totpId: input.totpId,\n      maxAttemptsPerHour: maxSignInAttempts(ctx.auth.config),\n    })) as\n      | { status: \"invalid_verifier\" | \"limited\" | \"not_found\" | \"already_verified\" }\n      | {\n          status: \"ready\";\n          userId: string;\n          factor: {\n            _id: string;\n            secret: ArrayBuffer;\n            period: number;\n            digits: number;\n          };\n        };\n\n    if (begun.status === \"invalid_verifier\") {\n      throw convexError(ErrorCode.TOTP_INVALID_VERIFIER, \"Invalid or expired TOTP verifier.\");\n    }\n    if (begun.status === \"limited\") {\n      throw convexError(ErrorCode.RATE_LIMITED, \"Too many TOTP attempts. Try again later.\");\n    }\n    if (begun.status === \"already_verified\") {\n      throw convexError(ErrorCode.TOTP_ALREADY_VERIFIED, \"TOTP enrollment is already verified.\");\n    }\n    if (begun.status === \"not_found\") {\n      throw convexError(\n        input.intent === \"enrollment\" ? ErrorCode.TOTP_NOT_FOUND : ErrorCode.TOTP_NO_ENROLLMENT,\n        input.intent === \"enrollment\"\n          ? \"TOTP enrollment not found.\"\n          : \"No verified TOTP enrollment found.\",\n      );\n    }\n    if (begun.status !== \"ready\") {\n      throw convexError(ErrorCode.INTERNAL_ERROR, \"Unexpected TOTP verification state.\");\n    }\n\n    const secret = await decryptTotpSecret(begun.factor.secret);\n    if (\n      !verifyTOTPWithGracePeriod(secret, begun.factor.period, begun.factor.digits, input.code, 30)\n    ) {\n      throw convexError(ErrorCode.TOTP_INVALID_CODE, \"Invalid TOTP code.\");\n    }\n\n    const replaceSession = await getAuthSessionReplacement(ctx);\n    const completed = (await ctx.runMutation(\n      ctx.auth.config.component.factor.totp.completeVerification,\n      {\n        verifierId: input.verifier,\n        intent: input.intent,\n        authenticatedUserId: input.authenticatedUserId,\n        totpId: input.totpId,\n        replaceSession,\n        sessionExpirationTime: sessionExpirationTime(ctx.auth.config),\n        refreshTokenExpirationTime: refreshTokenExpirationTime(ctx.auth.config),\n        now: Date.now(),\n      },\n    )) as\n      | { status: \"rejected\" }\n      | {\n          status: \"accepted\";\n          user: CrossComponentUserDoc;\n          factorId: string;\n          sessionId: string;\n          refreshTokenId: string;\n          replacedSessionId?: string;\n        };\n    if (completed.status !== \"accepted\") {\n      throw convexError(ErrorCode.TOTP_INVALID_VERIFIER, \"Invalid or expired TOTP verifier.\");\n    }\n\n    const userId = completed.user._id as GenericId<\"User\">;\n    const sessionId = completed.sessionId as GenericId<\"Session\">;\n    setActiveSpanAttributes({\n      \"auth.signin.result\": \"success\",\n      ...buildKnownSignInIdentityAttributes(\n        ctx.auth.config,\n        { userId, sessionId },\n        completed.user.email,\n      ),\n    });\n    if (completed.replacedSessionId !== undefined) {\n      const replacedSessionId = completed.replacedSessionId as GenericId<\"Session\">;\n      await queueAuthEvent(ctx, ctx.auth.config, {\n        kind: \"session.invalidated\",\n        actor: { type: \"system\" },\n        subject: { type: \"session\", id: replacedSessionId },\n        targets: [\n          { kind: \"user\", id: userId },\n          { kind: \"session\", id: replacedSessionId },\n        ],\n        outcome: \"success\",\n        data: { userId, reason: \"replaced\" },\n      });\n    }\n    await queueAuthEvent(ctx, ctx.auth.config, {\n      kind: \"session.signed_in\",\n      actor: { type: \"user\", id: userId },\n      subject: { type: \"session\", id: sessionId },\n      targets: [\n        { kind: \"user\", id: userId },\n        { kind: \"session\", id: sessionId },\n      ],\n      outcome: \"success\",\n      data: { provider: \"session\", method: provider.id },\n    });\n    const session = await finalizeSessionIssuance(ctx.auth.config, {\n      userId,\n      sessionId,\n      identity: buildSessionIdentity(userId, sessionId, completed.user),\n      refreshToken: encodeRefreshToken(\n        completed.refreshTokenId as GenericId<\"RefreshToken\">,\n        sessionId,\n      ),\n    });\n    return { kind: \"signedIn\" as const, session };\n  }\n\n  if (dispatch.flow === \"setup\") {\n    return await setup(dispatch.params);\n  }\n  if (dispatch.intent === \"enrollment\") {\n    return await confirmEnrollment(dispatch.code, dispatch.totpId, dispatch.verifier);\n  }\n  return await verifyChallenge(dispatch.code, dispatch.verifier);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,aAAa;CAAE,OAAO;CAAM,QAAQ;CAAM;AAIhD,SAAS,WAAW,OAAmC;AACrD,QAAO,OAAO,UAAU,YAAY,OAAO,OAAO,YAAY,MAAM;;AAUtE,MAAM,eAAe,MAAiB,YACpC,cAAc,cAAc,MAAM,QAAQ,CAAC;AAE7C,MAAM,iBACJ,OACA,MACA,YAEA,iBAAiB,cACb,QACA,iBAAiB,QACf,cAAc,cAAc,MAAM,MAAM,WAAW,QAAQ,CAAC,GAC5D,YAAY,MAAM,QAAQ;;;;;;;;AASlC,eAAe,kBAAkB,QAA0C;CACzE,MAAM,aAAa,MAAM,cAAc,yBAAyB,OAAO,CAAC;CACxE,MAAM,UAAU,IAAI,aAAa,CAAC,OAAO,WAAW;AACpD,QAAO,QAAQ,OAAO,MACpB,QAAQ,YACR,QAAQ,aAAa,QAAQ,WAC9B;;;;;;AAOH,eAAe,kBAAkB,QAA0C;AAGzE,QAAO,6BADW,MAAM,cADL,IAAI,aAAa,CAAC,OAAO,OAAO,CACF,CACH;;AAGhD,SAAS,gBAAgB,QAA2C;CAClE,MAAM,OAAO,OAAO;AACpB,KAAI,WAAW,KAAK,CAClB,QAAO;AAET,OAAM,YACJ,UAAU,mBACV,gDAAgD,OAAO,KAAK,WAAW,CAAC,KAAK,KAAK,CACnF;;AAGH,SAAS,oBAAoB,UAAsC;AACjE,KAAI,YAAY,KACd,QAAO;AAET,OAAM,YAAY,UAAU,uBAAuB,uCAAuC;;AAG5F,SAAS,gBAAgB,QAAyC;AAChE,KAAI,OAAO,OAAO,SAAS,SACzB,QAAO,OAAO;AAEhB,OAAM,YAAY,UAAU,mBAAmB,qBAAqB;;AAGtE,SAAS,oBACP,QACA,UACc;CACd,MAAM,OAAO,gBAAgB,OAAO;AACpC,KAAI,SAAS,QACX,QAAO;EAAE;EAAM;EAAQ;CAEzB,MAAM,mBAAmB,oBAAoB,SAAS;CACtD,MAAM,OAAO,gBAAgB,OAAO;AACpC,KAAI,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,EAC9D,QAAO;EACL;EACA;EACA,QAAQ,OAAO;EACf,UAAU;EACV,QAAQ;EACT;AAEH,QAAO;EACL;EACA;EACA,UAAU;EACV,QAAQ;EACT;;AAGH,eAAe,2BAA2B,KAAyC;AACjF,KAAI;EACF,MAAM,SAAS,MAAM,6BAA6B,IAAI;AACtD,MAAI,WAAW,KACb,OAAM,YACJ,UAAU,oBACV,wDACD;AAEH,SAAO;UACA,OAAO;AACd,MAAI,iBAAiB,YACnB,OAAM;AAER,QAAM,cAAc,OAAO,UAAU,gBAAgB,OAAO,MAAM,CAAC;;;;;;;;;;;;AAavE,MAAa,aAAa,OACxB,KACA,UACA,SACwB;CAExB,MAAM,WAAW,oBADF,KAAK,UAAU,EAAE,EACa,KAAK,SAAS;CAE3D,eAAe,MAAM,aAA2D;EAC9E,MAAM,SAAS,MAAM,2BAA2B,IAAI;EACpD,MAAM,SAAS,IAAI,WAAW,GAAG;AACjC,SAAO,gBAAgB,OAAO;EAC9B,MAAM,eAAe,+BAA+B,OAAO;EAC3D,IAAI;AACJ,MAAI;AACF,gBAAc,MAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,KAAK,kBAAkB;IAC1F;IACA,QAAQ,MAAM,kBAAkB,OAAO;IACvC,QAAQ,SAAS,QAAQ;IACzB,QAAQ,SAAS,QAAQ;IACzB,MAAM,OAAO,YAAY,SAAS,WAAW,YAAY,OAAO;IAChE,WAAW,KAAK,KAAK;IACtB,CAAC;WACK,OAAO;AACd,SAAM,cAAc,OAAO,UAAU,gBAAgB,sBAAsB,OAAO,MAAM,GAAG;;EAE7F,MAAM,cACJ,OAAO,YAAY,gBAAgB,YAAY,YAAY,YAAY,SAAS,IAC5E,YAAY,cACX,WAAW,KAAK,SAAS;AAShC,SAAO;GACL,MAAM;GACN,WAAW;IAAE,KAVH,iBACV,SAAS,QAAQ,QACjB,aACA,QACA,SAAS,QAAQ,QACjB,SAAS,QAAQ,OAClB;IAImB,QAAQ;IAAc,QAAQ,WAAW;IAAQ;GACnE,UAAU,WAAW;GACtB;;;;;;CAOH,eAAe,kBACb,MACA,QACA,UACqB;EACrB,MAAM,SAAS,MAAM,2BAA2B,IAAI;EACpD,MAAM,SAAS,MAAM,WAAW;GAC9B;GACA;GACA,QAAQ;GACR,qBAAqB;GACrB;GACD,CAAC;AACF,QAAM,eAAe,KAAK,IAAI,KAAK,QAAQ;GACzC,MAAM;GACN,OAAO;IAAE,MAAM;IAAQ,IAAI;IAAQ;GACnC,SAAS;IAAE,MAAM;IAAQ,IAAI;IAAQ;GACrC,SAAS,CAAC;IAAE,MAAM;IAAQ,IAAI;IAAQ,CAAC;GACvC,SAAS;GACT,MAAM,EAAE,QAAQ;GACjB,CAAC;AACF,SAAO;;;;;;CAOT,eAAe,gBAAgB,MAAc,UAAuC;AAClF,SAAO,MAAM,WAAW;GAAE;GAAM;GAAU,QAAQ;GAAa,CAAC;;CAGlE,eAAe,WAAW,OAMF;EACtB,MAAM,QAAS,MAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,KAAK,mBAAmB;GAC5F,YAAY,MAAM;GAClB,QAAQ,MAAM;GACd,qBAAqB,MAAM;GAC3B,QAAQ,MAAM;GACd,oBAAoB,kBAAkB,IAAI,KAAK,OAAO;GACvD,CAAC;AAaF,MAAI,MAAM,WAAW,mBACnB,OAAM,YAAY,UAAU,uBAAuB,oCAAoC;AAEzF,MAAI,MAAM,WAAW,UACnB,OAAM,YAAY,UAAU,cAAc,2CAA2C;AAEvF,MAAI,MAAM,WAAW,mBACnB,OAAM,YAAY,UAAU,uBAAuB,uCAAuC;AAE5F,MAAI,MAAM,WAAW,YACnB,OAAM,YACJ,MAAM,WAAW,eAAe,UAAU,iBAAiB,UAAU,oBACrE,MAAM,WAAW,eACb,+BACA,qCACL;AAEH,MAAI,MAAM,WAAW,QACnB,OAAM,YAAY,UAAU,gBAAgB,sCAAsC;AAIpF,MACE,CAAC,0BAFY,MAAM,kBAAkB,MAAM,OAAO,OAAO,EAEtB,MAAM,OAAO,QAAQ,MAAM,OAAO,QAAQ,MAAM,MAAM,GAAG,CAE5F,OAAM,YAAY,UAAU,mBAAmB,qBAAqB;EAGtE,MAAM,iBAAiB,MAAM,0BAA0B,IAAI;EAC3D,MAAM,YAAa,MAAM,IAAI,YAC3B,IAAI,KAAK,OAAO,UAAU,OAAO,KAAK,sBACtC;GACE,YAAY,MAAM;GAClB,QAAQ,MAAM;GACd,qBAAqB,MAAM;GAC3B,QAAQ,MAAM;GACd;GACA,uBAAuB,sBAAsB,IAAI,KAAK,OAAO;GAC7D,4BAA4B,2BAA2B,IAAI,KAAK,OAAO;GACvE,KAAK,KAAK,KAAK;GAChB,CACF;AAUD,MAAI,UAAU,WAAW,WACvB,OAAM,YAAY,UAAU,uBAAuB,oCAAoC;EAGzF,MAAM,SAAS,UAAU,KAAK;EAC9B,MAAM,YAAY,UAAU;AAC5B,0BAAwB;GACtB,sBAAsB;GACtB,GAAG,mCACD,IAAI,KAAK,QACT;IAAE;IAAQ;IAAW,EACrB,UAAU,KAAK,MAChB;GACF,CAAC;AACF,MAAI,UAAU,sBAAsB,QAAW;GAC7C,MAAM,oBAAoB,UAAU;AACpC,SAAM,eAAe,KAAK,IAAI,KAAK,QAAQ;IACzC,MAAM;IACN,OAAO,EAAE,MAAM,UAAU;IACzB,SAAS;KAAE,MAAM;KAAW,IAAI;KAAmB;IACnD,SAAS,CACP;KAAE,MAAM;KAAQ,IAAI;KAAQ,EAC5B;KAAE,MAAM;KAAW,IAAI;KAAmB,CAC3C;IACD,SAAS;IACT,MAAM;KAAE;KAAQ,QAAQ;KAAY;IACrC,CAAC;;AAEJ,QAAM,eAAe,KAAK,IAAI,KAAK,QAAQ;GACzC,MAAM;GACN,OAAO;IAAE,MAAM;IAAQ,IAAI;IAAQ;GACnC,SAAS;IAAE,MAAM;IAAW,IAAI;IAAW;GAC3C,SAAS,CACP;IAAE,MAAM;IAAQ,IAAI;IAAQ,EAC5B;IAAE,MAAM;IAAW,IAAI;IAAW,CACnC;GACD,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,QAAQ,SAAS;IAAI;GACnD,CAAC;AAUF,SAAO;GAAE,MAAM;GAAqB,SATpB,MAAM,wBAAwB,IAAI,KAAK,QAAQ;IAC7D;IACA;IACA,UAAU,qBAAqB,QAAQ,WAAW,UAAU,KAAK;IACjE,cAAc,mBACZ,UAAU,gBACV,UACD;IACF,CAAC;GAC2C;;AAG/C,KAAI,SAAS,SAAS,QACpB,QAAO,MAAM,MAAM,SAAS,OAAO;AAErC,KAAI,SAAS,WAAW,aACtB,QAAO,MAAM,kBAAkB,SAAS,MAAM,SAAS,QAAQ,SAAS,SAAS;AAEnF,QAAO,MAAM,gBAAgB,SAAS,MAAM,SAAS,SAAS"}

package/dist/server/types.d.ts

@@ -1,11 +1,12 @@
+import { EmailParams, OAuthParams, PhoneParams, ProviderParams } from "../shared/params.js";
 import { SignInFlowResult } from "../shared/results.js";
-import "../component/model.js";
 import { _default } from "../component/schema.js";
+import "../component/model.js";
 import { AuthComponentApi } from "./component/api.js";
 import { CredentialsConfig } from "../providers/credentials.js";
 import { AuthEventHandlerMap, OidcClaims, SamlClaims, ScimRawAttributes } from "./events.js";
-import { GenericId, Infer, Value } from "convex/values";
-import { AnyDataModel, DataModelFromSchemaDefinition, DocumentByName, GenericActionCtx, GenericDataModel, GenericMutationCtx, TableNamesInDataModel } from "convex/server";
+import { GenericId, GenericValidator, Infer, Value } from "convex/values";
+import { AnyDataModel, DataModelFromSchemaDefinition, DocumentByName, GenericActionCtx, GenericDataModel, GenericMutationCtx, RegisteredAction, TableNamesInDataModel } from "convex/server";
 
 //#region src/server/types.d.ts
 /**
@@ -146,7 +147,7 @@ type ConvexAuthConfig<TExtend = {}> = {
         protocol: ConnectionHookProtocol;
         connectionId?: string;
         profile: ConnectionHookProfile;
-        userId: string;
+        userId: GenericId<"User">;
       }) => Awaitable<void>;
       /**
        * Gate linking a sign-in onto an EXISTING user. Called when an SSO
@@ -161,7 +162,7 @@ type ConvexAuthConfig<TExtend = {}> = {
         protocol: ConnectionHookProtocol | "credentials";
         connectionId?: string;
         profile: ConnectionHookProfile;
-        userId: string;
+        userId: GenericId<"User">;
       }) => Awaitable<boolean | void>;
     };
   };
@@ -273,13 +274,13 @@ type ConvexAuthConfig<TExtend = {}> = {
  *
  * Includes materialized provider configs plus optional config factories.
  */
-type AuthProviderConfig = OAuthMaterializedConfig | ConvexCredentialsConfig | (() => ConvexCredentialsConfig) | EmailConfig | (() => EmailConfig) | PhoneConfig | (() => PhoneConfig) | WebAuthnProviderConfig | (() => WebAuthnProviderConfig) | TotpProviderConfig | (() => TotpProviderConfig) | DeviceProviderConfig | (() => DeviceProviderConfig) | ConnectionProviderConfig;
+type AuthProviderConfig = OAuthMaterializedConfig | ConvexCredentialsConfig<GenericDataModel, GenericValidator, string> | (() => ConvexCredentialsConfig<GenericDataModel, GenericValidator, string>) | EmailConfig<any, string> | (() => EmailConfig<any, string>) | PhoneConfig<any, string> | (() => PhoneConfig<any, string>) | WebAuthnProviderConfig | (() => WebAuthnProviderConfig) | TotpProviderConfig | (() => TotpProviderConfig) | DeviceProviderConfig | (() => DeviceProviderConfig) | ConnectionProviderConfig;
 /**
  * Minimal config stored for the Connection provider at runtime.
  * No options — connection configuration is entirely per-tenant runtime state.
  */
 interface ConnectionProviderConfig {
-  id: string;
+  id: "connection";
   type: "connection";
   /**
    * Optional shared callback URI for all OIDC group connections.
@@ -305,7 +306,6 @@ type GroupConnectionAccountLinkingPolicy = "verifiedEmail" | "none" | "sameConne
  * - `"externalId"` — match by the SCIM `externalId` to reuse a previously provisioned user.
  * - `"none"` — always create a new user for each SCIM provision request.
  */
-type GroupConnectionScimReuseUserPolicy = "externalId" | "none";
 /**
  * Just-in-time provisioning mode for group Connection.
  *
@@ -322,13 +322,14 @@ type GroupConnectionJitProvisioningMode = "off" | "createUser" | "createUserAndM
  */
 type GroupConnectionDeprovisionMode = "soft" | "hard";
 type GroupConnectionProfileUpdateMode = "never" | "missing" | "always";
-type GroupConnectionProvisioningAuthority = "app" | "connection" | "scim";
+/** The authority allowed to create and maintain identities for a connection. */
+type GroupConnectionProvisioningAuthority = "app" | "scim";
 type GroupConnectionGroupSyncMode = "ignore" | "sync";
 type GroupConnectionRoleSyncMode = "ignore" | "map";
 /**
  * Effective group policy document stored for an Connection/SCIM tenant.
  *
- * Controls account linking, JIT provisioning, SCIM reuse behavior,
+ * Controls account linking, JIT provisioning, directory-managed identity lifecycle,
  * deprovisioning, and any app-defined extension metadata.
  *
  * @see {@link GroupConnectionPolicyPatch}
@@ -348,9 +349,6 @@ interface GroupConnectionPolicy {
       updateProfileFromScim: GroupConnectionProfileUpdateMode;
       authority: GroupConnectionProvisioningAuthority;
     };
-    scimReuse: {
-      user: GroupConnectionScimReuseUserPolicy;
-    };
     jit: {
       mode: GroupConnectionJitProvisioningMode;
       defaultRoleIds: string[];
@@ -391,9 +389,6 @@ interface GroupConnectionPolicyPatch {
       updateProfileFromScim?: GroupConnectionProfileUpdateMode;
       authority?: GroupConnectionProvisioningAuthority;
     };
-    scimReuse?: {
-      user?: GroupConnectionScimReuseUserPolicy;
-    };
     jit?: {
       mode?: GroupConnectionJitProvisioningMode;
       defaultRoleIds?: string[];
@@ -419,9 +414,9 @@ interface GroupConnectionPolicyPatch {
  *
  * @typeParam DataModel - The Convex data model for typed action contexts.
  */
-interface EmailConfig<DataModel extends GenericDataModel = GenericDataModel> {
+interface EmailConfig<DataModel extends GenericDataModel = GenericDataModel, Id extends string = string> {
   /** Provider identifier (e.g. `"email"`, `"resend"`). */
-  id: string;
+  id: Id;
   /** Discriminant for provider type routing. */
   type: "email";
   /** Display name for this provider. */
@@ -489,8 +484,8 @@ type EmailUserConfig<DataModel extends GenericDataModel = GenericDataModel> = Om
  *
  * @typeParam DataModel - The Convex data model for typed action contexts.
  */
-interface PhoneConfig<DataModel extends GenericDataModel = GenericDataModel> {
-  id: string;
+interface PhoneConfig<DataModel extends GenericDataModel = GenericDataModel, Id extends string = string> {
+  id: Id;
   type: "phone";
   /**
    * Token expiration in seconds.
@@ -553,9 +548,9 @@ type PhoneUserConfig<DataModel extends GenericDataModel = GenericDataModel> = Om
  *
  * @typeParam DataModel - The Convex data model used by the auth context.
  */
-type ConvexCredentialsConfig<DataModel extends GenericDataModel = GenericDataModel> = CredentialsConfig<DataModel> & {
+type ConvexCredentialsConfig<DataModel extends GenericDataModel = GenericDataModel, ParamsValidator extends GenericValidator = GenericValidator, Id extends string = string> = CredentialsConfig<ParamsValidator, DataModel, Id> & {
   type: "credentials";
-  id: string;
+  id: Id;
 };
 /** Persisted proof that a WebAuthn credential passed a trusted attestation policy. */
 interface WebAuthnAttestationEvidence {
@@ -581,7 +576,7 @@ interface WebAuthnAttestationPolicy {
  * Normalized configuration for the WebAuthn provider.
  */
 interface WebAuthnProviderConfig {
-  id: string;
+  id: "webauthn";
   type: "webauthn";
   /**
    * Create a typed operation that replaces a user's passkeys during a provider
@@ -630,7 +625,7 @@ type WebAuthnRotateOperation = Readonly<{
  * Configuration for the TOTP two-factor authentication provider.
  */
 interface TotpProviderConfig {
-  id: string;
+  id: "totp";
   type: "totp";
   options: {
     /** Issuer name shown in authenticator apps (e.g. "My App"). */issuer: string;
@@ -943,12 +938,12 @@ interface OIDCClaimMapping extends Pick<ConnectionProfileMapping, "subject" | "e
 /**
  * Materialized OAuth provider config.
  */
-interface OAuthMaterializedConfig {
+interface OAuthMaterializedConfig<Id extends string = string> {
   /**
    * Provider identifier (e.g. `"google"`, `"github"`).
    * @readonly
    */
-  readonly id: string;
+  readonly id: Id;
   /**
    * Discriminant for provider type routing.
    * @readonly
@@ -999,7 +994,7 @@ interface OAuthMaterializedConfig {
  * by displaying a short code that the user enters on a secondary device.
  */
 interface DeviceProviderConfig {
-  id: string;
+  id: "device";
   type: "device";
   /** User code character set. Default: `"BCDFGHJKLMNPQRSTVWXZ"` (base-20, no vowels). */
   charset: string;
@@ -1020,16 +1015,40 @@ interface DeviceProviderConfig {
 /**
  * Materialized auth provider config — the fully resolved form stored at runtime.
  */
-type AuthProviderMaterializedConfig = OAuthMaterializedConfig | EmailConfig | PhoneConfig | ConvexCredentialsConfig | WebAuthnProviderConfig | TotpProviderConfig | DeviceProviderConfig | ConnectionProviderConfig;
-type HasWebAuthnProvider<P extends AuthProviderConfig[]> = Extract<P[number], {
-  type: "webauthn";
-}> extends never ? false : true;
-type HasTotpProvider<P extends AuthProviderConfig[]> = Extract<P[number], {
-  type: "totp";
-}> extends never ? false : true;
-type HasDeviceProvider<P extends AuthProviderConfig[]> = Extract<P[number], {
-  type: "device";
-}> extends never ? false : true;
+type AuthProviderMaterializedConfig = OAuthMaterializedConfig | EmailConfig<any, string> | PhoneConfig<any, string> | ConvexCredentialsConfig<GenericDataModel, GenericValidator, string> | WebAuthnProviderConfig | TotpProviderConfig | DeviceProviderConfig | ConnectionProviderConfig;
+type MaterializedProvider<P> = P extends (() => infer Provider) ? Provider : P;
+/** Parameters accepted by one configured provider at the public sign-in boundary. */
+type ProviderSignInParams<P> = MaterializedProvider<P> extends infer Provider ? Provider extends {
+  type: "credentials";
+  params: infer Params extends GenericValidator;
+} ? Infer<Params> : Provider extends EmailConfig<any, any> ? EmailParams : Provider extends PhoneConfig<any, any> ? PhoneParams : Provider extends OAuthMaterializedConfig ? OAuthParams | undefined : Provider extends ConnectionProviderConfig ? ProviderParams | undefined : Provider extends DeviceProviderConfig ? ProviderParams | undefined : Provider extends WebAuthnProviderConfig | TotpProviderConfig ? ProviderParams | undefined : never : never;
+type ProviderSignInEntry<P> = P extends unknown ? MaterializedProvider<P> extends infer Provider extends {
+  id: string;
+} ? ProviderSignInParams<Provider> extends infer Params ? [Params] extends [never] ? {
+  provider: Provider["id"];
+  params: never;
+} : undefined extends Params ? {
+  provider: Provider["id"];
+  params?: Exclude<Params, undefined>;
+  verifier?: string;
+  continuation?: string;
+  calledBy?: string;
+} : {
+  provider: Provider["id"];
+  params: Params;
+  verifier?: string;
+  continuation?: string;
+  calledBy?: string;
+} : never : never : never;
+/** Provider-derived arguments exported by the configured `signIn` action. */
+type AuthSignInArgs<P extends readonly AuthProviderConfig[]> = ProviderSignInEntry<P[number]> | {
+  provider?: undefined;
+  params?: ProviderParams;
+  verifier?: string;
+  continuation?: string;
+  refreshToken?: string;
+  calledBy?: string;
+};
 /**
  * A single scope entry stored per API key.
  * Uses a resource:action pattern for structured permissions.
@@ -1072,9 +1091,9 @@ interface ScopeChecker {
  */
 interface KeyRecord {
   /** Document ID. */
-  _id: string;
+  _id: GenericId<"ApiKey">;
   /** Owner user ID. */
-  userId: string;
+  userId: GenericId<"User">;
   /** Display prefix (e.g. `"sk_abc1"`). Safe to show in UIs. */
   prefix: string;
   /** Human-readable name (e.g. "CI Pipeline"). */
@@ -1131,8 +1150,8 @@ type UserOrderBy = "_creationTime" | "email" | "phone";
  */
 interface HttpKeyContext {
   key: {
-    /** The user ID that owns the verified API key. */userId: string; /** The API key document ID. */
-    keyId: string; /** Scope checker for the verified key's permissions. */
+    /** The user ID that owns the verified API key. */userId: GenericId<"User">; /** The API key document ID. */
+    keyId: GenericId<"ApiKey">; /** Scope checker for the verified key's permissions. */
     scopes: ScopeChecker;
   };
 }
@@ -1163,7 +1182,8 @@ type Doc<T extends TableNamesInDataModel<AuthDataModel>> = GenericDoc<AuthDataMo
 /** Canonical identity claims mirrored into access tokens for Convex auth. */
 type SessionTokenIdentityClaims = {
   subject: GenericId<"User">;
-  sessionId: GenericId<"Session">;
+  sessionId: GenericId<"Session">; /** Session epoch captured when this access token was issued. */
+  sessionEpoch: number;
   name?: string;
   email?: string;
   emailVerified?: boolean;
@@ -1172,5 +1192,5 @@ type SessionTokenIdentityClaims = {
   phoneNumberVerified?: boolean;
 };
 //#endregion
-export { AuthDataModel, AuthProviderConfig, AuthProviderContinueArgs, ConnectionProviderConfig, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, GenericActionCtxWithAuthConfig, GenericDoc, Grant, GroupConnectionPolicy, GroupConnectionPolicyPatch, HasDeviceProvider, HasTotpProvider, HasWebAuthnProvider, HttpKeyContext, KeyRecord, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PermissionsConfig, PhoneConfig, PhoneUserConfig, RoleId, SAMLAttributeMapping, ScopeChecker, SessionTokenIdentityClaims, TotpProviderConfig, UserOrderBy, UserWhere, WebAuthnAttestationEvidence, WebAuthnAttestationPolicy, WebAuthnProviderConfig, WebAuthnRotateOperation };
+export { AuthDataModel, AuthProviderConfig, AuthProviderContinueArgs, AuthSignInArgs, ConnectionProviderConfig, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, GenericActionCtxWithAuthConfig, GenericDoc, Grant, GroupConnectionPolicy, GroupConnectionPolicyPatch, HttpKeyContext, KeyRecord, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PermissionsConfig, PhoneConfig, PhoneUserConfig, RoleId, SAMLAttributeMapping, ScopeChecker, SessionTokenIdentityClaims, TotpProviderConfig, UserOrderBy, UserWhere, WebAuthnAttestationEvidence, WebAuthnAttestationPolicy, WebAuthnProviderConfig, WebAuthnRotateOperation };
 //# sourceMappingURL=types.d.ts.map

package/dist/server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/server/types.ts"],"mappings":";;;;;;;;;;;AAqBsE;;;;KAOjE,SAAA,MAAe,CAAA,GAAI,WAAA,CAAY,CAAA;;;;;;;;;KAU/B,wBAAA;EAAA,+DAEH,EAAA;EAEA,KAAA,WAFA;EAIA,MAAA;AAAA;;;AAaF;;;;;;;;KAAY,iBAAA;EACV,MAAA;EACA,KAAA,EAAO,MAAA,SAAe,wBAAA;AAAA;;KAInB,yBAAA;;KAGA,2BAAA;EACH,MAAA;EACA,SAAA;EACA,cAAA;EACA,KAAA;EACA,eAAA;AAAA;;KAIU,0BAAA,SAAmC,2BAAA;;;AAA/C;;;KAOY,mBAAA;EAP8D;AAO1E;;;;EAME,eAAA,GAAkB,yBAAA;EAaoB;;;;;EAPtC,cAAA,GAAiB,2BAAA;EAAA;;;;;;EAOjB,YAAA,IAAgB,KAAA,UAAe,KAAA,EAAO,0BAAA;AAAA;;;;;;;;;;;KAa5B,MAAA,sBAA4B,iBAAA,gBAAiC,YAAA;EACvE,KAAA,uBAA4B,MAAA;AAAA,UAEpB,MAAA;;;;;AAcV;;;;;;;KAAY,KAAA,sBAA2B,iBAAA,gBACrC,YAAA,SAAqB,iBAAA,IAEZ,YAAA;EAAuB,MAAA;AAAA,IACpB,YAAA,wCAEH,YAAA;EACC,KAAA,uBAA4B,MAAA;IAAiB,MAAA;EAAA;AAAA,IAE3C,MAAA,OAAa,MAAA;AAAA,KAIf,sBAAA;AAAA,KAEA,qBAAA,mBACQ,sBAAA,GAAyB,sBAAA,IACzC,SAAA,kBACA,UAAA,GACA,SAAA,kBACE,UAAA,GACA,iBAAA;;;;KAKM,gBAAA;EAtBE;;;;;;EA6BZ,SAAA,EAAW,kBAAA;EAxBc;;;AAI3B;;;EA2BE,IAAA;EACA,UAAA;IACE,KAAA;MACE,eAAA,IAAmB,IAAA;QACjB,QAAA,EAAU,sBAAA;QACV,YAAA;QACA,OAAA,EAAS,qBAAA;MAAA,MACL,SAAA,CAAU,qBAAA;MAChB,eAAA,IAAmB,IAAA;QACjB,QAAA,EAAU,sBAAA;QACV,YAAA;QACA,OAAA,EAAS,qBAAA;MAAA,MACL,SAAA,CAAU,qBAAA;MAChB,cAAA,IAAkB,IAAA;QAChB,QAAA,EAAU,sBAAA;QACV,YAAA;QACA,OAAA,EAAS,qBAAA;QACT,MAAA;MAAA,MACI,SAAA;MAvCR;;;;;AAOJ;;;;MA0CM,SAAA,IAAa,IAAA;QACX,QAAA,EAAU,sBAAA;QACV,YAAA;QACA,OAAA,EAAS,qBAAA;QACT,MAAA;MAAA,MACI,SAAA;IAAA;EAAA;EAnBM;;;;;;EA4BhB,KAAA;IA0E6B;;;;;;IAnE3B,KAAA;MACE,KAAA;MACA,OAAA;IAAA;EAAA;EAjDF;;;;;;EA0DF,SAAA,EAAW,gBAAA;EAzDY;;;EA6DvB,OAAA;IAvDM;;;;;;;IA+DJ,eAAA;IA3DE;;;;;;;IAmEF,kBAAA;EAAA;EApDE;;;EAyDJ,GAAA;IAtDM;;;;;;;IA8DJ,UAAA;EAAA;EAjCF;;;EAsCA,MAAA;IAlBE;;;;;;;;;IA4BA,wBAAA;EAAA;EAkBO;;;;;;EAVT,MAAA,GAAS,mBAAA,CAAoB,OAAA;EAgCnB;;;;;;;EAxBV,WAAA;IACE,MAAA;IACA,KAAA,EAAO,MAAA;MAGH,KAAA;MACA,MAAA;IAAA;EAAA;EA8BJ;;;;;;EApBF,SAAA,GAAY,mBAAA;AAAA;;;;;;KAQF,kBAAA,GACR,uBAAA,GACA,uBAAA,UACO,uBAAA,IACP,WAAA,UACO,WAAA,IACP,WAAA,UACO,WAAA,IACP,sBAAA,UACO,sBAAA,IACP,kBAAA,UACO,kBAAA,IACP,oBAAA,UACO,oBAAA,IACP,wBAAA;;;;;UAMa,wBAAA;EACf,EAAA;EACA,IAAA;EAFe;;;;EAOf,WAAA;AAAA;;;;AACD;;;;;AAauC;;;KAAnC,mCAAA;;AAQkC;;;;;KAAlC,kCAAA;;;;;AAiB8B;;;KAR9B,kCAAA;;AAUgC;;;;;KAFhC,8BAAA;AAAA,KAEA,gCAAA;AAAA,KACA,oCAAA;AAAA,KACA,4BAAA;AAAA,KACA,2BAAA;AAD4B;;;;;AAWjC;;;AAXiC,UAWhB,qBAAA;EACf,OAAA;EACA,QAAA;IACE,cAAA;MACE,IAAA,EAAM,mCAAA;MACN,IAAA,EAAM,mCAAA;IAAA;EAAA;EAGV,YAAA;IACE,IAAA;MACE,cAAA;MACA,oBAAA,EAAsB,gCAAA;MACtB,qBAAA,EAAuB,gCAAA;MACvB,SAAA,EAAW,oCAAA;IAAA;IAEb,SAAA;MACE,IAAA,EAAM,kCAAA;IAAA;IAER,GAAA;MACE,IAAA,EAAM,kCAAA;MACN,cAAA;IAAA;IAEF,WAAA;MACE,IAAA,EAAM,8BAAA;IAAA;IAER,MAAA;MACE,IAAA,EAAM,4BAAA;MACN,MAAA;MACA,OAAA,GAAU,MAAA;IAAA;IAEZ,KAAA;MACE,IAAA,EAAM,2BAAA;MACN,MAAA;MACA,OAAA,GAAU,MAAA;IAAA;EAAA;EAGd,MAAA,GAAS,MAAA;AAAA;;;;;;;UASM,0BAAA;EACf,QAAA;IACE,cAAA;MACE,IAAA,GAAO,mCAAA;MACP,IAAA,GAAO,mCAAA;IAAA;EAAA;EAGX,YAAA;IACE,IAAA;MACE,cAAA;MACA,oBAAA,GAAuB,gCAAA;MACvB,qBAAA,GAAwB,gCAAA;MACxB,SAAA,GAAY,oCAAA;IAAA;IAEd,SAAA;MACE,IAAA,GAAO,kCAAA;IAAA;IAET,GAAA;MACE,IAAA,GAAO,kCAAA;MACP,cAAA;IAAA;IAEF,WAAA;MACE,IAAA,GAAO,8BAAA;IAAA;IAET,MAAA;MACE,IAAA,GAAO,4BAAA;MACP,MAAA;MACA,OAAA,GAAU,MAAA;IAAA;IAEZ,KAAA;MACE,IAAA,GAAO,2BAAA;MACP,MAAA;MACA,OAAA,GAAU,MAAA;IAAA;EAAA;EAGd,MAAA,GAAS,MAAA;AAAA;;;;;;UAQM,WAAA,mBAA8B,gBAAA,GAAmB,gBAAA;EAhCpC;EAkC5B,EAAA;EAjCgB;EAmChB,IAAA;EAhCI;EAkCJ,IAAA;EAhCE;EAkCF,IAAA;EAjCW;;;;;EAuCX,MAAA;EAhCI;;;;;;EAuCJ,uBAAA,GACE,MAAA;IACE,UAAA;IACA,GAAA;IACA,OAAA,EAAS,IAAA;IACT,QAAA,EAAU,WAAA;IACV,KAAA;IACA,OAAA,EAAS,OAAA;EAAA,GAEX,GAAA,GAAM,gBAAA,CAAiB,YAAA,MACpB,SAAA;EAvCU;AAQjB;;;;EAqCE,yBAAA,SAAkC,SAAA;EAZrB;;;;EAiBb,mBAAA,IAAuB,UAAA;EAXlB;;;;;;;EAmBL,SAAA;EAQS;;;;EAJP,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,OAAA,EAAS,UAAA,CAAW,SAAA,iBACjB,OAAA;EAxDwC;EA0D7C,OAAA,EAAS,eAAA,CAAgB,SAAA;AAAA;;;;;;;;KAUf,eAAA,mBAAkC,gBAAA,GAAmB,gBAAA,IAAoB,IAAA,CACnF,OAAA,CAAQ,WAAA,CAAY,SAAA;;;;;;;UAUL,WAAA,mBAA8B,gBAAA,GAAmB,gBAAA;EAChE,EAAA;EACA,IAAA;EAnDE;;;EAuDF,MAAA;EA3CA;;;EA+CA,uBAAA,GACE,MAAA;IACE,UAAA;IACA,GAAA;IACA,OAAA,EAAS,IAAA;IACT,QAAA,EAAU,WAAA;IACV,KAAA;EAAA,GAEF,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA;EAxCL;;;;;AAUF;;;;EAwCE,yBAAA,SAAkC,OAAA;EAvCd;;;;;EA6CpB,mBAAA,IAAuB,UAAA;EA9CG;;;;;;;EAsD1B,SAAA;EArD6B;AAU/B;;;EA+CI,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,OAAA,EAAS,UAAA,CAAW,SAAA,iBACjB,OAAA;EACL,OAAA,EAAS,eAAA,CAAgB,SAAA;AAAA;;;;;;;;KAUf,eAAA,mBAAkC,gBAAA,GAAmB,gBAAA,IAAoB,IAAA,CACnF,OAAA,CAAQ,WAAA,CAAY,SAAA;;;;;;;;;KAYV,uBAAA,mBAA0C,gBAAA,GAAmB,gBAAA,IACvE,iBAAA,CAAkB,SAAA;EAChB,IAAA;EACA,EAAA;AAAA;;UAIa,2BAAA;EApEX;EAsEJ,QAAA;EApEI;EAsEJ,MAAA;EArEI;EAuEJ,MAAA;EAtEI;EAwEJ,mBAAA;EAtEO;EAwEP,UAAA;EAxEE;EA0EF,MAAA;AAAA;;UA0Be,yBAAA;EAnFQ;EAqFvB,UAAA;AAAA;;;;UAQe,sBAAA;EACf,EAAA;EACA,IAAA;EAhFA;;;;;AAUF;;;;;;;EAmFE,MAAA,IAAU,uBAAA;EACV,OAAA;IApFuF,gEAsFrF,MAAA,WAtFwB;IAwFxB,IAAA,WAxF6D;IA0F7D,MAAA;IAzFF;;;;;IA+FE,qBAAA,WAnF+B;IAqF/B,gBAAA;IACA,YAAA;MACE,gBAAA;MACA,WAAA;MACA,uBAAA;MACA,KAAA,GAAQ,KAAA;MACR,UAAA,EAAY,KAAA;MACZ,WAAA,GAAc,yBAAA;IAAA;IAEhB,cAAA;MACE,gBAAA;MACA,KAAA,GAAQ,KAAA;IAAA;EAAA;AAAA;;KAMF,uBAAA,GAA0B,QAAA;EACpC,QAAA,EAAU,sBAAA;EACV,SAAA;AAAA;;;;UAMe,kBAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;IA9FM,+DAgGJ,MAAA;IAtEsC;;;;AAU1C;IAkEI,MAAA;IAlEmC;;;;;IAwEnC,MAAA;EAAA;AAAA;;;;;;UASa,YAAA;EACf,KAAA;EACA,OAAA;EACA,QAAA;AAAA;AAAA,UAGe,YAAA;EACf,EAAA;EACA,IAAA;EACA,KAAA;EAvDI;;;;;EA6DJ,MAAA,GAAS,YAAA;EACT,KAAA;EAzDI;EAAA,CA2DH,GAAA;AAAA;;;AApDH;;;;UA6DiB,WAAA;EACf,WAAA;EACA,YAAA;EACA,OAAA;EACA,oBAAA,GAAuB,IAAA;EACvB,qBAAA,GAAwB,IAAA;EACxB,MAAA;EACA,GAAA;AAAA;AAAA,UAGe,kBAAA;EAAA,SACN,IAAA;EACT,sBAAA,CAAuB,IAAA;IACrB,KAAA;IACA,YAAA;IACA,MAAA;IACA,KAAA;IACA,SAAA;IACA,WAAA;EAAA,IACE,GAAA;EACJ,yBAAA,CAA0B,IAAA;IACxB,IAAA;IACA,YAAA;IACA,WAAA;EAAA,IACE,OAAA,CAAQ,WAAA;AAAA;;KAIT,sBAAA;EAjDY,iEAmDf,EAAA;EAEA,MAAA;AAAA;;KAIG,qBAAA;EACH,QAAA;EACA,OAAA,EAAS,sBAAA;EACT,OAAA,EAAS,MAAA;IACP,KAAA;IACA,KAAA;IACA,aAAA;IACA,aAAA;EAAA;EAEF,kBAAA;EACA,kBAAA;AAAA;;KAIG,uBAAA;EACH,QAAA;EACA,OAAA,EAAS,sBAAA;AAAA;;KAIN,qBAAA;EACH,QAAA;EACA,OAAA;IACE,EAAA;IACA,MAAA;EAAA;AAAA;;KAKC,0BAAA;EACH,MAAA,EAAQ,SAAA;EACR,MAAA,GAAS,SAAA;AAAA;;KAIN,qBAAA;EACH,SAAA,EAAW,SAAA;AAAA;;KAIR,qBAAA;EACH,SAAA,EAAW,SAAA;AAAA;;KAIR,kBAAA;EACH,MAAA,EAAQ,SAAA;AAAA;;KAIL,sBAAA;EACH,QAAA,EAAU,kBAAA;EACV,SAAA,GAAY,SAAA;EACZ,MAAA,GAAS,MAAA,SAAe,KAAA;AAAA;AAAA,KAGrB,iCAAA;EACH,MAAA,EAAQ,SAAA;EACR,SAAA,EAAW,SAAA;AAAA;AAAA,KAGR,gCAAA,GAAmC,OAAA,CAAQ,gBAAA;EAA0B,IAAA;AAAA;;KAGrE,wBAAA,GACD,iCAAA,GACA,gCAAA;;KAIQ,wBAAA;EACV,MAAA,EAAQ,SAAA;EACR,SAAA,EAAW,uBAAA;AAAA;;KASR,qBAAA;EACH,MAAA,EAAQ,SAAA;EACR,OAAA,EAAS,SAAA;AAAA;;KAIC,uBAAA;EACV,UAAA,EAAY,UAAA,CAAW,gBAAA;EACvB,OAAA;EACA,MAAA;AAAA;;KAIU,uBAAA,GAA0B,uBAAA;EACpC,cAAA,EAAgB,SAAA;EAChB,KAAA;EACA,QAAA;EACA,WAAA;EACA,iBAAA,EAAmB,SAAA;AAAA;;KAIhB,oBAAA,GAAuB,qBAAA;EAC1B,OAAA;EACA,MAAA;AAAA;;;;;AAjFQ;;;;;;;;;;AAOU;;;;KA+Ff,iBAAA;EAtFA;;;;EA2FH,OAAA;IACE,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA;MACH,OAAA,EAAS,GAAA;MACT,IAAA,EAAM,GAAA;IAAA;IAER,GAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,uBAAA,KACH,OAAA;MACH,OAAA,EAAS,GAAA;MACT,IAAA,EAAM,GAAA;IAAA;IAER,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA;MAAU,SAAA,EAAW,SAAA;IAAA;IAhGnB;;;;IAqGP,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA;MACH,SAAA,EAAW,SAAA;MACX,MAAA,EAAQ,SAAA;MACR,QAAA;IAAA;EAAA,GA3GyB;EA+G7B,OAAA;IA5GG;;;;IAiHD,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA;MACH,SAAA,EAAW,SAAA;MACX,MAAA,EAAQ,SAAA;IAAA;EAAA,GApHQ;EAwHpB,IAAA;IArHmC;;;;IA0HjC,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,kBAAA,KACH,OAAA;MACH,MAAA,EAAQ,SAAA;MACR,MAAA,EAAQ,SAAA;IAAA;EAAA;EAGZ,OAAA;IACE,OAAA,GAAU,GAAA;MACR,IAAA,EAAM,gBAAA,CAAiB,gBAAA;IAAA,MACnB,OAAA,CAAQ,SAAA;IACd,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,0BAAA,KACH,OAAA;MACH,MAAA,EAAQ,SAAA;MACR,MAAA,EAAQ,SAAA;IAAA;EAAA;EAGZ,MAAA;IACE,GAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA,CAAQ,uBAAA;IACb,OAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA;MAA0B,QAAA;IAAA,MAC7B,OAAA,CAAQ,uBAAA;IACb,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,oBAAA,KACH,OAAA,CAAQ,uBAAA;EAAA;EAEf,QAAA;IACE,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,sBAAA,KACH,OAAA,CAAQ,wBAAA;IACb,QAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,wBAAA,KACH,OAAA,CAAQ,gCAAA;EAAA;AAAA;;;;AA1IjB;;;KAyJY,8BAAA,mBAAiD,gBAAA,IAC3D,gBAAA,CAAiB,SAAA;EACf,IAAA,EAAM,gBAAA,CAAiB,SAAA;IACrB,MAAA,EAAQ,4BAAA;EAAA,IACN,iBAAA;AAAA;;;;AAtJR;;;KA+JY,4BAAA;EACV,SAAA,EAAW,8BAAA;AAAA,IACT,IAAA,CACF,gBAAA;;;;;;;UAkBe,oBAAA;EAhLf;EAkLA,OAAA;EAjLmB;EAmLnB,KAAA;EAnL4B;EAqL5B,IAAA;EAjLuB;EAmLvB,SAAA;EAnL+C;EAqL/C,QAAA;EApLA;EAsLA,KAAA;EArLM;EAuLN,MAAA;EAlKG;EAoKH,KAAA;AAAA;AAAA,UAGQ,wBAAA;EACR,OAAA;EACA,KAAA;EACA,aAAA;EACA,IAAA;EACA,SAAA;EACA,QAAA;EACA,KAAA;EACA,KAAA;EACA,MAAA;EACA,UAAA;EACA,MAAA;EACA,KAAA;AAAA;AAAA,UAGe,gBAAA,SAAyB,IAAA,CACxC,wBAAA;;;;UAOe,uBAAA;EA9JA;;;;EAAA,SAmKN,EAAA;EAtJC;;;;EAAA,SA2JD,IAAA;EA9IA;;;;EAAA,SAmJA,QAAA,EAAU,kBAAA;EA1IQ;;;;EAAA,SA+IlB,MAAA;EA5IA;;;;EAAA,SAiJA,OAAA,IAAW,MAAA,EAAQ,WAAA,KAAgB,OAAA,CAAQ,YAAA;EAxI1B;EAAA,SA0IjB,KAAA;EAzIC;EAAA,SA2ID,cAAA,IAAkB,MAAA,EAAQ,WAAA,EAAa,GAAA;IAAO,KAAA;EAAA,MAAqB,OAAA;EAxInE;;;;EAAA,SA6IA,cAAA;EAzIA;;;;;;;;;;EAAA,SAoJA,oBAAA;AAAA;;;;;;;UASM,oBAAA;EACf,EAAA;EACA,IAAA;EA9OU;EAgPV,OAAA;EA/OO;EAiPP,cAAA;EAhPa;EAkPb,SAAA;EAjPU;EAmPV,QAAA;EAhPS;;;;;;EAuPT,eAAA;AAAA;;;;KAMU,8BAAA,GACR,uBAAA,GACA,WAAA,GACA,WAAA,GACA,uBAAA,GACA,sBAAA,GACA,kBAAA,GACA,oBAAA,GACA,wBAAA;AAAA,KAEQ,mBAAA,WAA8B,kBAAA,MACxC,OAAA,CAAQ,CAAA;EAAa,IAAA;AAAA;AAAA,KAEX,eAAA,WAA0B,kBAAA,MACpC,OAAA,CAAQ,CAAA;EAAa,IAAA;AAAA;AAAA,KAEX,iBAAA,WAA4B,kBAAA,MACtC,OAAA,CAAQ,CAAA;EAAa,IAAA;AAAA;;;;;;;;;UAUN,QAAA;EACf,QAAA;EACA,OAAA;AAAA;;;;;;;;;;;;UAce,YAAA;EA5PN;EA8PT,GAAA,CAAI,QAAA,UAAkB,MAAA;EA9PlB;EAgQJ,MAAA,EAAQ,QAAA;AAAA;;;;;;;;;;;;UAcO,SAAA;EApQC;EAsQhB,GAAA;EApQS;EAsQT,MAAA;EAtQI;EAwQJ,MAAA;EAvQI;EAyQJ,IAAA;EAvQI;EAyQJ,MAAA,EAAQ,QAAA;EAxQJ;EA0QJ,SAAA;IAAc,WAAA;IAAqB,QAAA;EAAA;EArQT;EAuQ1B,SAAA;EAtQU;EAwQV,UAAA;EAvQO;EAyQP,SAAA;EAxQE;EA0QF,OAAA;EAzQ0B;EA2Q1B,MAAA,GAAS,MAAA;AAAA;;KAIC,SAAA;EACV,KAAA;EACA,KAAA;EACA,WAAA;EACA,IAAA;AAAA;;;;;;;;KAUU,WAAA;;;;;;;;;;;;;;;;;AA9PZ;UAiRiB,cAAA;EACf,GAAA;IAlR2D,kDAoRzD,MAAA,UAnRF;IAqRE,KAAA,UApRM;IAsRN,MAAA,EAAQ,YAAA;EAAA;AAAA;;;;UAOK,UAAA;EA9RE;;;EAkSjB,OAAA;EAhSI;EAkSJ,OAAA;EAjSM;EAmSN,OAAA;AAAA;AA1RF;;;AAAA,KAgSY,UAAA,mBACQ,gBAAA,oBACA,qBAAA,CAAsB,SAAA,KACtC,cAAA,CAAe,SAAA,EAAW,SAAA;EAC5B,GAAA,EAAK,SAAA,CAAU,SAAA;EACf,aAAA;AAAA;;KAoBU,aAAA,GAAgB,6BAAA,QAAqC,QAAA;;KAMrD,GAAA,WAAc,qBAAA,CAAsB,aAAA,KAAkB,UAAA,CAAW,aAAA,EAAe,CAAA;;KAUhF,0BAAA;EACV,OAAA,EAAS,SAAA;EACT,SAAA,EAAW,SAAA;EACX,IAAA;EACA,KAAA;EACA,aAAA;EACA,OAAA;EACA,WAAA;EACA,mBAAA;AAAA"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/server/types.ts"],"mappings":";;;;;;;;;;;;AAsBsE;;;;KAOjE,SAAA,MAAe,CAAA,GAAI,WAAA,CAAY,CAAA;;;;;;;;;KAU/B,wBAAA;EAAA,+DAEH,EAAA;EAEA,KAAA,WAFA;EAIA,MAAA;AAAA;;;AAaF;;;;;;;;KAAY,iBAAA;EACV,MAAA;EACA,KAAA,EAAO,MAAA,SAAe,wBAAA;AAAA;;KAInB,yBAAA;;KAGA,2BAAA;EACH,MAAA;EACA,SAAA;EACA,cAAA;EACA,KAAA;EACA,eAAA;AAAA;;KAIU,0BAAA,SAAmC,2BAAA;;;AAA/C;;;KAOY,mBAAA;EAP8D;AAO1E;;;;EAME,eAAA,GAAkB,yBAAA;EAaoB;;;;;EAPtC,cAAA,GAAiB,2BAAA;EAAA;;;;;;EAOjB,YAAA,IAAgB,KAAA,UAAe,KAAA,EAAO,0BAAA;AAAA;;;;;;;;;;;KAa5B,MAAA,sBAA4B,iBAAA,gBAAiC,YAAA;EACvE,KAAA,uBAA4B,MAAA;AAAA,UAEpB,MAAA;;;;;AAcV;;;;;;;KAAY,KAAA,sBAA2B,iBAAA,gBACrC,YAAA,SAAqB,iBAAA,IAEZ,YAAA;EAAuB,MAAA;AAAA,IACpB,YAAA,wCAEH,YAAA;EACC,KAAA,uBAA4B,MAAA;IAAiB,MAAA;EAAA;AAAA,IAE3C,MAAA,OAAa,MAAA;AAAA,KAIf,sBAAA;AAAA,KAEA,qBAAA,mBACQ,sBAAA,GAAyB,sBAAA,IACzC,SAAA,kBACA,UAAA,GACA,SAAA,kBACE,UAAA,GACA,iBAAA;;;;KAKM,gBAAA;EAtBE;;;;;;EA6BZ,SAAA,EAAW,kBAAA;EAxBc;;;AAI3B;;;EA2BE,IAAA;EACA,UAAA;IACE,KAAA;MACE,eAAA,IAAmB,IAAA;QACjB,QAAA,EAAU,sBAAA;QACV,YAAA;QACA,OAAA,EAAS,qBAAA;MAAA,MACL,SAAA,CAAU,qBAAA;MAChB,eAAA,IAAmB,IAAA;QACjB,QAAA,EAAU,sBAAA;QACV,YAAA;QACA,OAAA,EAAS,qBAAA;MAAA,MACL,SAAA,CAAU,qBAAA;MAChB,cAAA,IAAkB,IAAA;QAChB,QAAA,EAAU,sBAAA;QACV,YAAA;QACA,OAAA,EAAS,qBAAA;QACT,MAAA,EAAQ,SAAA;MAAA,MACJ,SAAA;MAvCR;;;;;AAOJ;;;;MA0CM,SAAA,IAAa,IAAA;QACX,QAAA,EAAU,sBAAA;QACV,YAAA;QACA,OAAA,EAAS,qBAAA;QACT,MAAA,EAAQ,SAAA;MAAA,MACJ,SAAA;IAAA;EAAA;EAnBM;;;;;;EA4BhB,KAAA;IATU;;;;;;IAgBR,KAAA;MACE,KAAA;MACA,OAAA;IAAA;EAAA;EAnDJ;;;;;;EA4DA,SAAA,EAAW,gBAAA;EAtDL;;;EA0DN,OAAA;IAzDoB;;;;;;;IAiElB,eAAA;IA5DQ;;;;;;;IAoER,kBAAA;EAAA;EA/DY;;;EAoEd,GAAA;IAxDM;;;;;;;IAgEJ,UAAA;EAAA;EAnDF;;;EAwDA,MAAA;IAtCA;;;;;;;;;IAgDE,wBAAA;EAAA;EAQ2B;;;;;;EAA7B,MAAA,GAAS,mBAAA,CAAoB,OAAA;EAwB7B;;;;AAQF;;;EAxBE,WAAA;IACE,MAAA;IACA,KAAA,EAAO,MAAA;MAGH,KAAA;MACA,MAAA;IAAA;EAAA;EAsBJ;;;;;;EAZF,SAAA,GAAY,mBAAA;AAAA;;;;;;KAQF,kBAAA,GACR,uBAAA,GACA,uBAAA,CAAwB,gBAAA,EAAkB,gBAAA,mBACnC,uBAAA,CAAwB,gBAAA,EAAkB,gBAAA,aACjD,WAAA,uBACO,WAAA,iBACP,WAAA,uBACO,WAAA,iBACP,sBAAA,UACO,sBAAA,IACP,kBAAA,UACO,kBAAA,IACP,oBAAA,UACO,oBAAA,IACP,wBAAA;;;;;UAMa,wBAAA;EACf,EAAA;EACA,IAAA;EAjBS;;;;EAsBT,WAAA;AAAA;;;;;;;AAPF;;;;;KAqBK,mCAAA;;;;AAbJ;;;;;AAauC;;;;;KAgBnC,kCAAA;;;;;AAQ8B;;KAA9B,8BAAA;AAAA,KAEA,gCAAA;;KAEA,oCAAA;AAAA,KACA,4BAAA;AAAA,KACA,2BAAA;;;AAFoC;;;;;AACR;UAWhB,qBAAA;EACf,OAAA;EACA,QAAA;IACE,cAAA;MACE,IAAA,EAAM,mCAAA;MACN,IAAA,EAAM,mCAAA;IAAA;EAAA;EAGV,YAAA;IACE,IAAA;MACE,cAAA;MACA,oBAAA,EAAsB,gCAAA;MACtB,qBAAA,EAAuB,gCAAA;MACvB,SAAA,EAAW,oCAAA;IAAA;IAEb,GAAA;MACE,IAAA,EAAM,kCAAA;MACN,cAAA;IAAA;IAEF,WAAA;MACE,IAAA,EAAM,8BAAA;IAAA;IAER,MAAA;MACE,IAAA,EAAM,4BAAA;MACN,MAAA;MACA,OAAA,GAAU,MAAA;IAAA;IAEZ,KAAA;MACE,IAAA,EAAM,2BAAA;MACN,MAAA;MACA,OAAA,GAAU,MAAA;IAAA;EAAA;EAGd,MAAA,GAAS,MAAA;AAAA;;;;;;;UASM,0BAAA;EACf,QAAA;IACE,cAAA;MACE,IAAA,GAAO,mCAAA;MACP,IAAA,GAAO,mCAAA;IAAA;EAAA;EAGX,YAAA;IACE,IAAA;MACE,cAAA;MACA,oBAAA,GAAuB,gCAAA;MACvB,qBAAA,GAAwB,gCAAA;MACxB,SAAA,GAAY,oCAAA;IAAA;IAEd,GAAA;MACE,IAAA,GAAO,kCAAA;MACP,cAAA;IAAA;IAEF,WAAA;MACE,IAAA,GAAO,8BAAA;IAAA;IAET,MAAA;MACE,IAAA,GAAO,4BAAA;MACP,MAAA;MACA,OAAA,GAAU,MAAA;IAAA;IAEZ,KAAA;MACE,IAAA,GAAO,2BAAA;MACP,MAAA;MACA,OAAA,GAAU,MAAA;IAAA;EAAA;EAGd,MAAA,GAAS,MAAA;AAAA;;;;;;UAQM,WAAA,mBACG,gBAAA,GAAmB,gBAAA;EArCjC;EAyCJ,EAAA,EAAI,EAAA;EAtCJ;EAwCA,IAAA;EAtCI;EAwCJ,IAAA;EAvC2B;EAyC3B,IAAA;EAxC4B;;;;;EA8C5B,MAAA;EAzCI;;;;;;EAgDJ,uBAAA,GACE,MAAA;IACE,UAAA;IACA,GAAA;IACA,OAAA,EAAS,IAAA;IACT,QAAA,EAAU,WAAA;IACV,KAAA;IACA,OAAA,EAAS,OAAA;EAAA,GAEX,GAAA,GAAM,gBAAA,CAAiB,YAAA,MACpB,SAAA;EA7CD;;;;;EAmDJ,yBAAA,SAAkC,SAAA;EAxCnB;;;;EA6Cf,mBAAA,IAAuB,UAAA;EAxCnB;;;;;;;EAgDJ,SAAA;EAIyB;;;;EAAvB,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,OAAA,EAAS,UAAA,CAAW,SAAA,iBACjB,OAAA;EAAA;EAEL,OAAA,EAAS,eAAA,CAAgB,SAAA;AAAA;;;;;;;;KAUf,eAAA,mBAAkC,gBAAA,GAAmB,gBAAA,IAAoB,IAAA,CACnF,OAAA,CAAQ,WAAA,CAAY,SAAA;;;;;;;UAUL,WAAA,mBACG,gBAAA,GAAmB,gBAAA;EAGrC,EAAA,EAAI,EAAA;EACJ,IAAA;EA1DI;;;EA8DJ,MAAA;EA5Da;;;EAgEb,uBAAA,GACE,MAAA;IACE,UAAA;IACA,GAAA;IACA,OAAA,EAAS,IAAA;IACT,QAAA,EAAU,WAAA;IACV,KAAA;EAAA,GAEF,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA;EAnDL;;;;;;;;;EA6DA,yBAAA,SAAkC,OAAA;EArDT;;;AAU3B;;EAiDE,mBAAA,IAAuB,UAAA;EAjDqB;;;;;;;EAyD5C,SAAA;EAzD0B;;;;EA6DxB,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,OAAA,EAAS,UAAA,CAAW,SAAA,iBACjB,OAAA;EACL,OAAA,EAAS,eAAA,CAAgB,SAAA;AAAA;;;;AArD3B;;;;KA+DY,eAAA,mBAAkC,gBAAA,GAAmB,gBAAA,IAAoB,IAAA,CACnF,OAAA,CAAQ,WAAA,CAAY,SAAA;;;;;;;;;KAYV,uBAAA,mBACQ,gBAAA,GAAmB,gBAAA,0BACb,gBAAA,GAAmB,gBAAA,gCAEzC,iBAAA,CAAkB,eAAA,EAAiB,SAAA,EAAW,EAAA;EAChD,IAAA;EACA,EAAA,EAAI,EAAA;AAAA;;UAIW,2BAAA;EAjCS;EAmCxB,QAAA;EAvFA;EAyFA,MAAA;EAzFqC;EA2FrC,MAAA;EAxFA;EA0FA,mBAAA;EAzFA;EA2FA,UAAA;EAnFA;EAqFA,MAAA;AAAA;;UA0Be,yBAAA;EA1GX;EA4GJ,UAAA;AAAA;;;;UAQe,sBAAA;EACf,EAAA;EACA,IAAA;EAxGkC;;;;;;;;;;;;EAqHlC,MAAA,IAAU,uBAAA;EACV,OAAA;IAjGkC,gEAmGhC,MAAA,WAzFQ;IA2FR,IAAA,WA3FuB;IA6FvB,MAAA;IA7F6D;;;;;IAmG7D,qBAAA,WAnGqF;IAqGrF,gBAAA;IACA,YAAA;MACE,gBAAA;MACA,WAAA;MACA,uBAAA;MACA,KAAA,GAAQ,KAAA;MACR,UAAA,EAAY,KAAA;MACZ,WAAA,GAAc,yBAAA;IAAA;IAEhB,cAAA;MACE,gBAAA;MACA,KAAA,GAAQ,KAAA;IAAA;EAAA;AAAA;;KAMF,uBAAA,GAA0B,QAAA;EACpC,QAAA,EAAU,sBAAA;EACV,SAAA;AAAA;;;;UAMe,kBAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;IAlHwB,+DAoHtB,MAAA;IAnHF;;;;;IAyHE,MAAA;IAtHF;;;;AAIF;IAwHI,MAAA;EAAA;AAAA;;;;;;UASa,YAAA;EACf,KAAA;EACA,OAAA;EACA,QAAA;AAAA;AAAA,UAGe,YAAA;EACf,EAAA;EACA,IAAA;EACA,KAAA;EA1FqC;;;;;EAgGrC,MAAA,GAAS,YAAA;EACT,KAAA;EAxDiB;EAAA,CA0DhB,GAAA;AAAA;;;;;;;UASc,WAAA;EACf,WAAA;EACA,YAAA;EACA,OAAA;EACA,oBAAA,GAAuB,IAAA;EACvB,qBAAA,GAAwB,IAAA;EACxB,MAAA;EACA,GAAA;AAAA;AAAA,UAGe,kBAAA;EAAA,SACN,IAAA;EACT,sBAAA,CAAuB,IAAA;IACrB,KAAA;IACA,YAAA;IACA,MAAA;IACA,KAAA;IACA,SAAA;IACA,WAAA;EAAA,IACE,GAAA;EACJ,yBAAA,CAA0B,IAAA;IACxB,IAAA;IACA,YAAA;IACA,WAAA;EAAA,IACE,OAAA,CAAQ,WAAA;AAAA;;KAIT,sBAAA;EAvFM,iEAyFT,EAAA,UAnFe;EAqFf,MAAA;AAAA;;KAIG,qBAAA;EACH,QAAA;EACA,OAAA,EAAS,sBAAA;EACT,OAAA,EAAS,MAAA;IACP,KAAA;IACA,KAAA;IACA,aAAA;IACA,aAAA;EAAA;EAEF,kBAAA;EACA,kBAAA;AAAA;;KAIG,uBAAA;EACH,QAAA;EACA,OAAA,EAAS,sBAAA;AAAA;AAzEX;AAAA,KA6EK,qBAAA;EACH,QAAA;EACA,OAAA;IACE,EAAA;IACA,MAAA;EAAA;AAAA;;KAKC,0BAAA;EACH,MAAA,EAAQ,SAAA;EACR,MAAA,GAAS,SAAA;AAAA;AAnEX;AAAA,KAuEK,qBAAA;EACH,SAAA,EAAW,SAAA;AAAA;;KAIR,qBAAA;EACH,SAAA,EAAW,SAAA;AAAA;;KAIR,kBAAA;EACH,MAAA,EAAQ,SAAA;AAAA;;KAIL,sBAAA;EACH,QAAA,EAAU,kBAAA;EACV,SAAA,GAAY,SAAA;EACZ,MAAA,GAAS,MAAA,SAAe,KAAA;AAAA;AAAA,KAGrB,iCAAA;EACH,MAAA,EAAQ,SAAA;EACR,SAAA,EAAW,SAAA;AAAA;AAAA,KAGR,gCAAA,GAAmC,OAAA,CAAQ,gBAAA;EAA0B,IAAA;AAAA;;KAGrE,wBAAA,GACD,iCAAA,GACA,gCAAA;;KAIQ,wBAAA;EACV,MAAA,EAAQ,SAAA;EACR,SAAA,EAAW,uBAAA;AAAA;;KASR,qBAAA;EACH,MAAA,EAAQ,SAAA;EACR,OAAA,EAAS,SAAA;AAAA;;KAIC,uBAAA;EACV,UAAA,EAAY,UAAA,CAAW,gBAAA;EACvB,OAAA;EACA,MAAA;AAAA;;KAIU,uBAAA,GAA0B,uBAAA;EACpC,cAAA,EAAgB,SAAA;EAChB,KAAA;EACA,QAAA;EACA,WAAA;EACA,iBAAA,EAAmB,SAAA;AAAA;;KAIhB,oBAAA,GAAuB,qBAAA;EAC1B,OAAA;EACA,MAAA;AAAA;;;;;;;;;AA/FkB;;;;;;;;;AAMa;KA8G5B,iBAAA;;;;;EAKH,OAAA;IACE,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA;MACH,OAAA,EAAS,GAAA;MACT,IAAA,EAAM,GAAA;IAAA;IAER,GAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,uBAAA,KACH,OAAA;MACH,OAAA,EAAS,GAAA;MACT,IAAA,EAAM,GAAA;IAAA;IAER,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA;MAAU,SAAA,EAAW,SAAA;IAAA;IAtHV;;AAAA;;IA2HhB,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA;MACH,SAAA,EAAW,SAAA;MACX,MAAA,EAAQ,SAAA;MACR,QAAA;IAAA;EAAA,GAvHJ;EA2HA,OAAA;IAvHG;;;;IA4HD,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA;MACH,SAAA,EAAW,SAAA;MACX,MAAA,EAAQ,SAAA;IAAA;EAAA,GA1HA;EA8HZ,IAAA;IA7HS;;;;IAkIP,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,kBAAA,KACH,OAAA;MACH,MAAA,EAAQ,SAAA;MACR,MAAA,EAAQ,SAAA;IAAA;EAAA;EAGZ,OAAA;IACE,OAAA,GAAU,GAAA;MACR,IAAA,EAAM,gBAAA,CAAiB,gBAAA;IAAA,MACnB,OAAA,CAAQ,SAAA;IACd,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,0BAAA,KACH,OAAA;MACH,MAAA,EAAQ,SAAA;MACR,MAAA,EAAQ,SAAA;IAAA;EAAA;EAGZ,MAAA;IACE,GAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA,KACH,OAAA,CAAQ,uBAAA;IACb,OAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,qBAAA;MAA0B,QAAA;IAAA,MAC7B,OAAA,CAAQ,uBAAA;IACb,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,oBAAA,KACH,OAAA,CAAQ,uBAAA;EAAA;EAEf,QAAA;IACE,MAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,sBAAA,KACH,OAAA,CAAQ,wBAAA;IACb,QAAA,GACE,GAAA,EAAK,gBAAA,CAAiB,gBAAA,GACtB,IAAA,EAAM,wBAAA,KACH,OAAA,CAAQ,gCAAA;EAAA;AAAA;;AApK6D;;;;;KAmLlE,8BAAA,mBAAiD,gBAAA,IAC3D,gBAAA,CAAiB,SAAA;EACf,IAAA,EAAM,gBAAA,CAAiB,SAAA;IACrB,MAAA,EAAQ,4BAAA;EAAA,IACN,iBAAA;AAAA;;;;;;AA3KN;KAoLU,4BAAA;EACV,SAAA,EAAW,8BAAA;AAAA,IACT,IAAA,CACF,gBAAA;;;;;;;UAkBe,oBAAA;EA3LkB;EA6LjC,OAAA;EA5LsB;EA8LtB,KAAA;EA9LY;EAgMZ,IAAA;EA/LA;EAiMA,SAAA;EAhMM;EAkMN,QAAA;EA9LU;EAgMV,KAAA;;EAEA,MAAA;EAjMgB;EAmMhB,KAAA;AAAA;AAAA,UAGQ,wBAAA;EACR,OAAA;EACA,KAAA;EACA,aAAA;EACA,IAAA;EACA,SAAA;EACA,QAAA;EACA,KAAA;EACA,KAAA;EACA,MAAA;EACA,UAAA;EACA,MAAA;EACA,KAAA;AAAA;AAAA,UAGe,gBAAA,SAAyB,IAAA,CACxC,wBAAA;;;;UAOe,uBAAA;EA9LZ;;;;EAAA,SAmMM,EAAA,EAAI,EAAA;EA3LH;;;;EAAA,SAgMD,IAAA;EA1LA;;;;EAAA,SA+LA,QAAA,EAAU,kBAAA;EAxLO;;;;EAAA,SA6LjB,MAAA;EArLiB;;;;EAAA,SA0LjB,OAAA,IAAW,MAAA,EAAQ,WAAA,KAAgB,OAAA,CAAQ,YAAA;EAxL7C;EAAA,SA0LE,KAAA;EA7KA;EAAA,SA+KA,cAAA,IAAkB,MAAA,EAAQ,WAAA,EAAa,GAAA;IAAO,KAAA;EAAA,MAAqB,OAAA;EA7KrE;;;;EAAA,SAkLE,cAAA;EAlKG;;;;;;;;;;EAAA,SA6KH,oBAAA;AAAA;;;;;;;UASM,oBAAA;EACf,EAAA;EACA,IAAA;EAjKO;EAmKP,OAAA;EAjKS;EAmKT,cAAA;EAjKe;EAmKf,SAAA;EA/J0B;EAiK1B,QAAA;EAhKU;;;;;;EAuKV,eAAA;AAAA;;;;KAMU,8BAAA,GACR,uBAAA,GACA,WAAA,gBACA,WAAA,gBACA,uBAAA,CAAwB,gBAAA,EAAkB,gBAAA,YAC1C,sBAAA,GACA,kBAAA,GACA,oBAAA,GACA,wBAAA;AAAA,KAWC,oBAAA,MAA0B,CAAA,kCAAiC,QAAA,GAAW,CAAA;;KAG/D,oBAAA,MACV,oBAAA,CAAqB,CAAA,2BACjB,QAAA;EAAmB,IAAA;EAAqB,MAAA,uBAA6B,gBAAA;AAAA,IACnE,KAAA,CAAM,MAAA,IACN,QAAA,SAAiB,WAAA,aACf,WAAA,GACA,QAAA,SAAiB,WAAA,aACf,WAAA,GACA,QAAA,SAAiB,uBAAA,GACf,WAAA,eACA,QAAA,SAAiB,wBAAA,GACf,cAAA,eACA,QAAA,SAAiB,oBAAA,GACf,cAAA,eACA,QAAA,SAAiB,sBAAA,GAAyB,kBAAA,GACxC,cAAA;AAAA,KAIf,mBAAA,MAAyB,CAAA,mBAC1B,oBAAA,CAAqB,CAAA;EAAoC,EAAA;AAAA,IACvD,oBAAA,CAAqB,QAAA,0BAClB,MAAA;EACG,QAAA,EAAU,QAAA;EAAgB,MAAA;AAAA,sBACV,MAAA;EAEd,QAAA,EAAU,QAAA;EACV,MAAA,GAAS,OAAA,CAAQ,MAAA;EACjB,QAAA;EACA,YAAA;EACA,QAAA;AAAA;EAGA,QAAA,EAAU,QAAA;EACV,MAAA,EAAQ,MAAA;EACR,QAAA;EACA,YAAA;EACA,QAAA;AAAA;;KAOF,cAAA,oBAAkC,kBAAA,MAC1C,mBAAA,CAAoB,CAAA;EAElB,QAAA;EACA,MAAA,GAAS,cAAA;EACT,QAAA;EACA,YAAA;EACA,YAAA;EACA,QAAA;AAAA;;;;;;;;;UAkBW,QAAA;EACf,QAAA;EACA,OAAA;AAAA;;;;;;;;;;;;UAce,YAAA;EApTX;EAsTJ,GAAA,CAAI,QAAA,UAAkB,MAAA;EAtTK;EAwT3B,MAAA,EAAQ,QAAA;AAAA;;;;;;;;;;;;UAcO,SAAA;EA5Tf;EA8TA,GAAA,EAAK,SAAA;EA5TI;EA8TT,MAAA,EAAQ,SAAA;EA9TJ;EAgUJ,MAAA;EA/TI;EAiUJ,IAAA;EAhUe;EAkUf,MAAA,EAAQ,QAAA;EAhUC;EAkUT,SAAA;IAAc,WAAA;IAAqB,QAAA;EAAA;EAjU/B;EAmUJ,SAAA;EAlUe;EAoUf,UAAA;EAlUS;EAoUT,SAAA;EApUI;EAsUJ,OAAA;EArUI;EAuUJ,MAAA,GAAS,MAAA;AAAA;;KAIC,SAAA;EACV,KAAA;EACA,KAAA;EACA,WAAA;EACA,IAAA;AAAA;;;;;;;;KAUU,WAAA;;;;;AA/TZ;;;;;;;;;;;;;UAkViB,cAAA;EACf,GAAA;IAlViB,kDAoVf,MAAA,EAAQ,SAAA,UAnVF;IAqVN,KAAA,EAAO,SAAA,YApVL;IAsVF,MAAA,EAAQ,YAAA;EAAA;AAAA;;AA5UZ;;UAmViB,UAAA;EAlVJ;;;EAsVX,OAAA;EArVM;EAuVN,OAAA;EAxVW;EA0VX,OAAA;AAAA;;;AAtUF;KA4UY,UAAA,mBACQ,gBAAA,oBACA,qBAAA,CAAsB,SAAA,KACtC,cAAA,CAAe,SAAA,EAAW,SAAA;EAC5B,GAAA,EAAK,SAAA,CAAU,SAAA;EACf,aAAA;AAAA;;KAoBU,aAAA,GAAgB,6BAAA,QAAqC,QAAA;;KAMrD,GAAA,WAAc,qBAAA,CAAsB,aAAA,KAAkB,UAAA,CAAW,aAAA,EAAe,CAAA;;KAUhF,0BAAA;EACV,OAAA,EAAS,SAAA;EACT,SAAA,EAAW,SAAA,aAhWX;EAkWA,YAAA;EACA,IAAA;EACA,KAAA;EACA,aAAA;EACA,OAAA;EACA,WAAA;EACA,mBAAA;AAAA"}

package/dist/server/user/account.js

@@ -21,7 +21,6 @@ function effectiveUserUpdateMode(source, policy, providerUpdateProfileOnLogin) {
 	let mode = source === "login" ? policy?.updateProfileOnLogin ?? "missing" : policy?.updateProfileFromScim ?? "always";
 	if (source === "login" && policy === void 0 && providerUpdateProfileOnLogin !== void 0) mode = providerUpdateProfileOnLogin === false ? "never" : "always";
 	if (authority === "app") return mode === "never" ? "never" : "missing";
-	if (authority === "connection" && source === "scim") return mode === "never" ? "never" : "missing";
 	if (authority === "scim" && source === "login") return mode === "never" ? "never" : "missing";
 	return mode;
 }