@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/client/core/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../../src/client/core/types.ts"],"sourcesContent":["import type { FunctionReference } from \"convex/server\";\nimport type { ConvexError, Value } from \"convex/values\";\n\nimport type { AccessToken } from \"../../shared/brand\";\nimport type {\n  AuthParameters,\n  AuthTokens,\n  SignInFlowResult,\n  SignInWebAuthnOptionsResult,\n} from \"../../shared/results\";\nimport type { ErrorCode } from \"../../shared/codes\";\n\n/**\n * Structural interface for any Convex client.\n * Satisfied by `ConvexClient` (`convex/browser`),\n * `ConvexReactClient` (`convex/react`), and similar transports.\n *\n * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`\n * but not on the simplified `ConvexClient`. When available we call it\n * during sign-out for a clean deauthentication.\n */\nexport interface ConvexTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n  setAuth(\n    fetchToken: (args: { forceRefreshToken: boolean }) => Promise<string | null | undefined>,\n    onChange?: (isAuthenticated: boolean) => void,\n  ): void;\n  clearAuth?(): void;\n}\n\n/** Minimal action-only transport used for unauthenticated auth flows. */\nexport interface ActionTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n}\n\n/** @internal */\nexport type SignInApiRef = { signIn: AuthApiRefs[\"signIn\"] };\n\n/** Pluggable key-value storage supplied by the host runtime. */\nexport interface Storage {\n  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\n/** Platform-neutral location/navigation hooks. */\ninterface LocationRuntime {\n  get(): URL | null;\n  replace(relativeUrl: string): void | Promise<void>;\n}\n\n/**\n * Platform-specific OAuth launch primitive.\n *\n * `open` receives the provider authorization URL. Platforms that navigate the\n * whole page away (browser) return nothing; platforms that run the flow in an\n * in-app session (Expo) return the callback URL so the core can complete the\n * exchange inline.\n */\ninterface OAuthRuntime {\n  open(url: URL): void | string | URL | Promise<void | string | URL>;\n}\n\n/** Cross-context synchronization hooks, such as browser storage events. */\ninterface SyncRuntime {\n  subscribe(\n    key: string,\n    callback: (value: string | null) => void | Promise<void>,\n  ): (() => void) | null;\n}\n\n/** Cross-context mutex/locking primitive. */\ninterface MutexRuntime {\n  withKey<T>(key: string, callback: () => Promise<T>): Promise<T>;\n}\n\n/** Proxy request execution supplied by the host runtime. */\ninterface ProxyRuntime {\n  fetch(body: AuthParameters, proxyPath: string): Promise<Response>;\n}\n\n/**\n * Platform-neutral client runtime dependencies.\n *\n * The core `client` package should depend only on these interfaces, while the\n * browser package can provide concrete implementations backed by DOM APIs.\n */\nexport interface ClientRuntime {\n  environment?: \"client\" | \"server\";\n  storage?: Storage | null;\n  location?: LocationRuntime;\n  oauth?: OAuthRuntime;\n  sync?: SyncRuntime;\n  mutex?: MutexRuntime;\n  proxy?: ProxyRuntime;\n}\n\n/** Platform-specific factor adapters injected by entrypoints like `browser`. */\nexport interface ClientAdapters {\n  webauthn?: WebAuthnClient;\n  totp?: TotpClient;\n  device?: DeviceClient;\n}\n\n/**\n * Shared dependencies threaded into every factor client (`totp`, `device`,\n * `webauthn`). The core `client` builds one of these and passes it to each\n * factor factory.\n *\n * @internal\n */\nexport interface FactorDeps {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => SignInApiRef;\n  proxyFetch: (body: AuthParameters) => Promise<Value>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthTokens | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: AccessToken } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n}\n\n/**\n * Dependencies provided to platform-specific factor adapters.\n *\n * @internal\n */\nexport type ClientAdapterDeps = FactorDeps;\n\n/**\n * Factory overrides for platform-specific factor adapters.\n *\n * @internal\n */\nexport interface ClientAdapterFactories {\n  webauthn?: (deps: ClientAdapterDeps) => WebAuthnClient;\n}\n\n/** @internal */\nexport type SignInActionResult = SignInFlowResult<AuthTokens | null>;\n\n/** @internal */\nexport type WebAuthnRotationResult = Extract<SignInWebAuthnOptionsResult, { operation: \"rotate\" }>;\n\n/**\n * Device authorization payload returned from the `deviceCode` sign-in flow.\n */\nexport type DeviceCodeResult = {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string;\n  expiresIn: number;\n  interval: number;\n};\n\n/**\n * Result of a `signIn` call.\n *\n * - `kind: \"signedIn\"` — credentials were accepted and a client session is now available.\n * - `kind: \"redirect\"` — OAuth flow initiated; redirect the user to `redirect.toString()`.\n * - `kind: \"totpRequired\"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.\n * - `kind: \"deviceCode\"` — device flow initiated; display the code and poll via `auth.device.poll()`.\n * - `kind: \"started\"` — a non-immediate flow started (for example email/phone verification).\n * - `kind: \"failed\"` — the flow did not complete; `code` is the typed {@link ErrorCode}.\n *\n * @see {@link AuthState}\n */\nexport type SignInResult =\n  | { kind: \"signedIn\" }\n  | { kind: \"redirect\"; redirect: URL; verifier: string }\n  | { kind: \"totpRequired\"; verifier: string }\n  | { kind: \"deviceCode\"; deviceCode: DeviceCodeResult }\n  | { kind: \"started\" }\n  | { kind: \"failed\"; code: ErrorCode };\n\n/** @internal */\nexport type AuthSnapshot = {\n  phase: \"loading\" | \"handshake\" | \"authenticated\" | \"unauthenticated\";\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  token: string | null;\n};\n\n/** Reactive auth state. `token` is non-null only after Convex confirms auth. */\nexport type AuthState =\n  | { status: \"loading\"; token: null }\n  | { status: \"signedOut\"; token: null }\n  | { status: \"signedIn\"; token: string };\n\n/** Handler for `auth.subscribe`. */\nexport type AuthSubscriber = (state: AuthState) => void;\n\n/**\n * Typed Convex API references for the auth functions.\n * Pass these from your generated `api` object.\n *\n * @typeParam HasWebAuthn - Whether the WebAuthn provider is configured.\n * @typeParam HasTotp - Whether the TOTP provider is configured.\n * @typeParam HasDevice - Whether the device provider is configured.\n */\nexport type AuthApiRefs<\n  HasWebAuthn extends boolean = boolean,\n  HasTotp extends boolean = boolean,\n  HasDevice extends boolean = boolean,\n> = {\n  signIn: FunctionReference<\"action\", \"public\", Record<string, Value>, unknown>;\n  signOut: FunctionReference<\"action\", \"public\", Record<string, Value>, unknown>;\n  /** @internal Set automatically by `defineAuth` — do not set manually. */\n  _capabilities?: {\n    webauthn: HasWebAuthn;\n    totp: HasTotp;\n    device: HasDevice;\n  };\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.register}.\n */\nexport type WebAuthnRegisterOptions = {\n  /** Human-readable label for this credential (e.g. `\"MacBook Pro\"`). */\n  name?: string;\n  /** WebAuthn `user.name` override. */\n  userName?: string;\n  /** WebAuthn `user.displayName` override. */\n  userDisplayName?: string;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.signIn}.\n */\nexport type WebAuthnSignInOptions = {\n  /** Email hint to filter discoverable credentials. */\n  email?: string;\n  /** Set to `true` for conditional UI (autofill) mode. */\n  autofill?: boolean;\n};\n\n/**\n * WebAuthn client-side helpers.\n *\n * @see {@link TotpClient}\n * @see {@link DeviceClient}\n */\nexport interface WebAuthnClient {\n  /**\n   * Check whether the current runtime exposes WebAuthn passkey APIs.\n   *\n   * @returns `true` when `navigator.credentials` is available.\n   *\n   * @example\n   * ```ts\n   * if (auth.webauthn.isSupported()) {\n   *   // Show passkey registration button\n   * }\n   * ```\n   */\n  isSupported(): boolean;\n\n  /**\n   * Check whether conditional mediation (autofill-style passkeys) is available.\n   *\n   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.\n   *\n   * @example\n   * ```ts\n   * if (await auth.webauthn.isAutofillSupported()) {\n   *   await auth.webauthn.signIn({ autofill: true });\n   * }\n   * ```\n   */\n  isAutofillSupported(): Promise<boolean>;\n\n  /**\n   * Start a passkey registration flow and complete the WebAuthn ceremony.\n   *\n   * Creates a new credential bound to the current user's account.\n   *\n   * @param opts - Optional registration hints.\n   * @param opts.name - Human-readable name for the passkey (e.g. `\"MacBook Pro\"`).\n   * @param opts.userName - WebAuthn `user.name` override.\n   * @param opts.userDisplayName - WebAuthn `user.displayName` override.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.register({ name: \"My laptop\" });\n   * ```\n   */\n  register(opts?: WebAuthnRegisterOptions): Promise<SignInResult>;\n\n  /** @internal Complete registration options returned by a provider continuation. */\n  completeRegistration(result: WebAuthnRotationResult): Promise<SignInResult>;\n\n  /**\n   * Sign in with an existing passkey and complete the WebAuthn ceremony.\n   *\n   * @param opts - Optional sign-in hints.\n   * @param opts.email - Email hint to filter discoverable credentials.\n   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.signIn();\n   * ```\n   */\n  signIn(opts?: WebAuthnSignInOptions): Promise<SignInResult>;\n}\n\n/**\n * Optional hints for {@link TotpClient.setup}.\n */\nexport type TotpSetupOptions = {\n  /** Issuer name shown in the authenticator app. */\n  name?: string;\n  /** Account label shown in the authenticator app. */\n  accountName?: string;\n};\n\n/** Result of {@link TotpClient.setup}. */\nexport type TotpSetupResult = {\n  /** `otpauth://` URL — render as a QR code. */\n  uri: string;\n  /** Raw base32-encoded shared secret. */\n  secret: string;\n  /** Verifier token to pass to {@link TotpClient.confirm}. */\n  verifier: string;\n  /** Factor ID to pass to {@link TotpClient.confirm}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.confirm}. */\nexport type TotpConfirmParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from {@link TotpSetupResult.verifier}. */\n  verifier: string;\n  /** Factor ID from {@link TotpSetupResult.totpId}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.verify}. */\nexport type TotpVerifyParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from a `totpRequired` sign-in result. */\n  verifier: string;\n};\n\n/**\n * TOTP two-factor authentication client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link DeviceClient}\n */\nexport interface TotpClient {\n  /**\n   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.\n   *\n   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code\n   * for the user to scan with their authenticator app.\n   *\n   * @param opts - Optional setup hints.\n   * @param opts.name - Issuer name shown in the authenticator app.\n   * @param opts.accountName - Account label in the authenticator app.\n   * @returns An object with `{ uri, secret, verifier, totpId }`.\n   *\n   * @example\n   * ```ts\n   * const { uri, secret, verifier, totpId } = await auth.totp.setup();\n   * // Render `uri` as a QR code, then confirm:\n   * await auth.totp.confirm({ code: userCode, verifier, totpId });\n   * ```\n   */\n  setup(opts?: TotpSetupOptions): Promise<TotpSetupResult>;\n\n  /**\n   * Confirm a newly created TOTP factor with the first authenticator code.\n   *\n   * Call this after the user scans the QR code and enters the first OTP.\n   *\n   * @param opts - Confirmation parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.\n   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.totp.confirm({ code: \"123456\", verifier, totpId });\n   * if (result.kind === \"failed\") showError(result.code);\n   * ```\n   */\n  confirm(opts: TotpConfirmParams): Promise<SignInResult>;\n\n  /**\n   * Complete a sign-in that is waiting on TOTP verification.\n   *\n   * Called when `signIn()` returns `{ kind: \"totpRequired\" }`.\n   *\n   * @param opts - Verification parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string from the `totpRequired` result.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.signIn(\"password\", { email, password });\n   * if (result.kind === \"totpRequired\") {\n   *   const totp = await auth.totp.verify({ code: totpCode, verifier: result.verifier });\n   *   if (totp.kind === \"failed\") showError(totp.code);\n   * }\n   * ```\n   */\n  verify(opts: TotpVerifyParams): Promise<SignInResult>;\n}\n\n/** Params for {@link DeviceClient.poll}. */\nexport type DevicePollParams = {\n  code: DeviceCodeResult;\n  /** Aborts the poll loop cleanly, e.g. on UI unmount. */\n  signal?: AbortSignal;\n};\n\n/** Params for {@link DeviceClient.verify}. */\nexport type DeviceVerifyParams = { code: string };\n\n/**\n * Device authorization (RFC 8628) client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link TotpClient}\n */\nexport interface DeviceClient {\n  /**\n   * Poll until a device flow is approved or expires.\n   *\n   * Polls the server at the interval specified in the {@link DeviceCodeResult}\n   * until the user authorizes the device or the code expires.\n   *\n   * @param opts - Poll options.\n   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn(\"device\")`.\n   * @param opts.signal - Optional {@link AbortSignal}; aborting returns cleanly\n   *   at the next loop boundary (e.g. on UI unmount).\n   * @throws `ConvexError({ code: \"DEVICE_CODE_EXPIRED\" })` when the code expires before authorization.\n   *\n   * @example\n   * ```ts\n   * const controller = new AbortController();\n   * const result = await auth.signIn(\"device\");\n   * if (result.kind === \"deviceCode\") {\n   *   // Display result.deviceCode.userCode to the user\n   *   await auth.device.poll({ code: result.deviceCode, signal: controller.signal });\n   *   console.log(\"Device authorized!\");\n   * }\n   * ```\n   */\n  poll(opts: DevicePollParams): Promise<void>;\n\n  /**\n   * Approve a device flow from the verification page using the displayed user code.\n   *\n   * Call this on the authorization page where the user enters the short code\n   * shown on the device screen.\n   *\n   * @param opts - Verification options.\n   * @param opts.code - The user code string (e.g. `\"WDJB-MJHT\"`).\n   * @throws `ConvexError({ code: \"DEVICE_AUTHORIZATION_FAILED\" })` when verification fails.\n   *\n   * @example\n   * ```ts\n   * await auth.device.verify({ code: \"WDJB-MJHT\" });\n   * ```\n   */\n  verify(opts: DeviceVerifyParams): Promise<void>;\n}\n\n/**\n * Extract capability flags from an AuthApiRefs type.\n *\n * @typeParam Api - An AuthApiRefs type to extract capability flags from.\n */\ntype InferCaps<Api extends AuthApiRefs<boolean, boolean, boolean>> =\n  Api extends AuthApiRefs<infer P, infer T, infer D>\n    ? { webauthn: P; totp: T; device: D }\n    : { webauthn: boolean; totp: boolean; device: boolean };\n\n/**\n * Include a capability when configured, omit it when disabled, and keep it\n * optional when a framework binding cannot know the capability.\n */\ntype CapabilityClient<Enabled extends boolean, Name extends string, Client> = [Enabled] extends [\n  false,\n]\n  ? {}\n  : [boolean] extends [Enabled]\n    ? { [Key in Name]?: Client }\n    : { [Key in Name]: Client };\n\n/** Pending invite detected from URL or recovered from storage after redirect. */\nexport interface PendingInvite {\n  /**\n   * Raw one-time invite token. Pass to your invite acceptance mutation.\n   * @readonly\n   */\n  readonly token: string;\n  /**\n   * Invite email from the URL or stored redirect state, if available.\n   * @readonly\n   */\n  readonly email: string | null;\n  /**\n   * Consume the invite: clears storage/URL params and returns the token.\n   *\n   * @returns The invite token.\n   * @throws When there is no pending invite to accept.\n   */\n  accept(): Promise<{ token: string }>;\n}\n\n/**\n * Discriminated union of params for the password provider's flows.\n *\n * Each branch maps to one of the six password flows: `signUp`, `signIn`,\n * `reset`, `recover`, `verify`, `change`. Selecting a `flow` literal narrows the\n * accepted params automatically.\n */\nexport type PasswordParams =\n  | { flow: \"signUp\"; email: string; password: string; redirectTo?: string }\n  | { flow: \"signIn\"; email: string; password: string; redirectTo?: string }\n  | { flow: \"reset\"; email: string; redirectTo?: string }\n  | { flow: \"recover\"; email: string; code: string; newPassword: string; redirectTo?: string }\n  | { flow: \"verify\"; email: string; code: string; redirectTo?: string }\n  | {\n      flow: \"change\";\n      email: string;\n      currentPassword: string;\n      newPassword: string;\n      redirectTo?: string;\n    };\n\n/** Params for the email (magic link) provider's initiation step. */\nexport type EmailInitiateParams = { email: string; redirectTo?: string };\n\n/**\n * Params for completing a code-based flow (no provider). Used to finalise\n * email magic-link sign-ins and other provider-owned code flows when the\n * verification call is made without re-specifying the originating provider.\n */\nexport type CodeCompletionParams = { code: string; redirectTo?: string };\n\n/** Params for the `connection` provider — requires a connection ID. */\nexport type ConnectionParams = { connectionId: string; redirectTo?: string };\n\n/** Params for the anonymous provider. Empty / `redirectTo` only. */\nexport type AnonymousParams = { redirectTo?: string };\n\n/** Default params shape for OAuth-style providers (google, github, etc.). */\nexport type OAuthSignInParams = { redirectTo?: string };\n\n/**\n * Resolves the `params` argument shape from the `provider` literal.\n *\n * Known special providers (`\"password\"`, `\"email\"`, etc.) get strict typing.\n * Any other string falls back to OAuth-style params, since custom OAuth\n * providers can be registered under arbitrary IDs.\n */\nexport type ParamsForProvider<P> = P extends \"password\"\n  ? PasswordParams\n  : P extends \"email\"\n    ? EmailInitiateParams\n    : P extends \"anonymous\"\n      ? AnonymousParams | undefined\n      : P extends \"connection\"\n        ? ConnectionParams\n        : P extends \"webauthn\"\n          ? never\n          : P extends undefined\n            ? CodeCompletionParams\n            : OAuthSignInParams | undefined;\n\n/**\n * Tuple-rest helper that flips `params` between required and optional based\n * on whether `undefined` is in its resolved type.\n */\nexport type SignInArgs<P> =\n  undefined extends ParamsForProvider<P>\n    ? [params?: ParamsForProvider<P>]\n    : [params: ParamsForProvider<P>];\n\n/**\n * Public signature for `auth.signIn`. The provider literal discriminates the\n * params shape via {@link ParamsForProvider}, and the params slot is\n * automatically optional when the resolved type permits `undefined`.\n *\n * @example\n * ```ts\n * auth.signIn(\"password\", { flow: \"signIn\", email, password });\n * auth.signIn(\"password\", { flow: \"change\", email, currentPassword, newPassword });\n * auth.signIn(\"anonymous\"); // params optional\n * ```\n */\nexport type SignInOverloads = <const P extends string | undefined>(\n  provider: P,\n  ...args: SignInArgs<P>\n) => Promise<SignInResult>;\n\n/**\n * Internal-only loose signature for the `signIn` value. Use this when\n * forwarding through wrappers where TypeScript cannot select an overload\n * from the wrapper's union-typed `provider` argument.\n *\n * @internal\n */\nexport type SignInImpl = (provider?: string, params?: AuthParameters) => Promise<SignInResult>;\n\n/** Base auth client — always present. */\ninterface AuthClientBase {\n  /** Restore initial auth state for the current runtime. */\n  initialize: () => Promise<void>;\n  /** SSR-safe query-param reader. */\n  param: (name: string) => string | null;\n  /**\n   * Pending invite recovered from the URL or storage, if present.\n   * @readonly\n   */\n  readonly invite: PendingInvite | null;\n  /** Complete an OAuth callback using a URL or authorization code. */\n  completeOAuth: (input: URL | string | { code: string }) => Promise<OAuthCompletionResult>;\n  /** Start a sign-in flow for a provider. */\n  signIn: SignInOverloads;\n  /** Sign out and clear local auth state. */\n  signOut: () => Promise<void>;\n  /** Subscribe to auth state changes; returns an unsubscribe. */\n  subscribe: (handler: AuthSubscriber) => () => void;\n  /** Read the current auth state synchronously, e.g. for `useSyncExternalStore`. */\n  getSnapshot: () => AuthState;\n  /** Tear down listeners and reject in-flight handshakes. */\n  destroy: () => void;\n}\n\n/**\n * Framework-agnostic auth client return type.\n *\n * Conditionally includes `totp` and `device` helpers based on the\n * capabilities in the `AuthApiRefs` type. Platform-specific `webauthn` helpers\n * are added by {@link PlatformAuthClient}.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type AuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> =\n  AuthClientBase &\n    CapabilityClient<InferCaps<Api>[\"totp\"], \"totp\", TotpClient> &\n    CapabilityClient<InferCaps<Api>[\"device\"], \"device\", DeviceClient>;\n\n/**\n * Browser auth client return type.\n *\n * Extends {@link AuthClient} with conditional WebAuthn helpers when the\n * generated auth API exposes WebAuthn capabilities.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type PlatformAuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> =\n  AuthClient<Api> & CapabilityClient<InferCaps<Api>[\"webauthn\"], \"webauthn\", WebAuthnClient>;\n\n/**\n * Options for {@link client}.\n *\n * @typeParam Api - An AuthApiRefs type.\n */\nexport type ClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = {\n  /** Any Convex client implementation used to run auth actions. */\n  convex: ConvexTransport;\n  /** Platform runtime implementation used by the client core. */\n  runtime?: ClientRuntime;\n  /** Platform-specific factor adapters supplied by higher-level entrypoints. */\n  adapters?: ClientAdapters;\n  /** Platform-specific adapter factories supplied by higher-level entrypoints. */\n  adapterFactories?: ClientAdapterFactories;\n  /**\n   * Typed auth function refs from your generated `api` object.\n   * Required outside proxy mode.\n   */\n  api?: Api;\n  /** Explicit Convex deployment URL when it cannot be inferred from the client. */\n  url?: string;\n  /**\n   * Optional action-only transport for direct code exchange outside proxy mode.\n   * Required in non-browser runtimes when `proxyPath` is not set.\n   */\n  httpClient?: ActionTransport | null;\n  /**\n   * Storage backend for persisted tokens.\n   *\n   * Defaults to `runtime.storage` when provided, otherwise `null`.\n   */\n  storage?: Storage | null;\n  /**\n   * Server-known auth used to seed the synchronous boot so SSR and hydration\n   * render the resolved state on first paint. A non-empty JWT boots signed in;\n   * `null` boots signed out. Providing this at all marks auth as resolved, so\n   * the client skips the loading phase. Omit it (leave `undefined`) to read the\n   * persisted value from `storage` instead. Ongoing persistence always uses\n   * `storage`.\n   */\n  token?: string | null;\n  /**\n   * Proxy endpoint used instead of direct Convex auth calls.\n   * When set, provide `runtime.proxy` and omit direct `api`/`httpClient`\n   * transport requirements.\n   */\n  proxyPath?: string;\n  /** SSR-safe URL source for reading query parameters. */\n  location?: URL | (() => URL | null);\n  /**\n   * Default OAuth `redirectTo` applied to `signIn` calls that omit it. Platform\n   * entrypoints set this (e.g. Expo passes its native redirect URI) so the core\n   * can build the authorization URL without a platform-specific `signIn` wrapper.\n   */\n  oauthRedirectTo?: string;\n  /**\n   * Milliseconds to wait for the Convex client to confirm a new token\n   * before a sign-in handshake rejects with `AUTH_HANDSHAKE_TIMEOUT`.\n   * Defaults to `5000`.\n   */\n  handshakeTimeoutMs?: number;\n};\n\nexport type OAuthCompletionResult = { handled: false } | { handled: true; cleanupUrl: URL | null };\n\n/**\n * Metadata describing the current auth flow for handshake diagnostics.\n *\n * @internal\n */\nexport type AuthFlowContext = {\n  provider?: string;\n  flow: string;\n};\n\n/**\n * A simple deferred promise that can be resolved or rejected externally.\n */\ninterface SimpleDeferred<T, E = unknown> {\n  readonly promise: Promise<T>;\n  resolve(value: T): void;\n  reject(error: E): void;\n}\n\n/**\n * Create a deferred promise that can be resolved or rejected externally.\n *\n * @returns A deferred object containing the promise and control methods.\n * @internal\n */\nexport function createDeferred<T, E = unknown>(): SimpleDeferred<T, E> {\n  let resolve!: (value: T) => void;\n  let reject!: (error: E) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej as (error: E) => void;\n  });\n  return { promise, resolve, reject };\n}\n\n/** @internal */\nexport type HandshakeWaiter = {\n  epoch: number;\n  context: AuthFlowContext;\n  deferred: SimpleDeferred<void, ConvexError<Value>>;\n  timeoutId: ReturnType<typeof setTimeout>;\n};\n"],"mappings":";;;;;;;AAkwBA,SAAgB,iBAAuD;CACrE,IAAI;CACJ,IAAI;AAKJ,QAAO;EAAE,SAJO,IAAI,SAAY,KAAK,QAAQ;AAC3C,aAAU;AACV,YAAS;IACT;EACgB;EAAS;EAAQ"}
+{"version":3,"file":"types.js","names":[],"sources":["../../../src/client/core/types.ts"],"sourcesContent":["import type { FunctionArgs, FunctionReference } from \"convex/server\";\nimport type { ConvexError, Value } from \"convex/values\";\n\nimport type { AccessToken } from \"../../shared/brand\";\nimport type {\n  AnonymousParams,\n  CodeParams,\n  ConnectionParams,\n  EmailParams,\n  OAuthParams,\n  PasswordParams,\n} from \"../../shared/params\";\nimport type {\n  AuthParameters,\n  AuthTokens,\n  SignInFlowResult,\n  SignInWebAuthnOptionsResult,\n} from \"../../shared/results\";\nimport type { ErrorCode } from \"../../shared/codes\";\n\n/**\n * Structural interface for any Convex client.\n * Satisfied by `ConvexClient` (`convex/browser`),\n * `ConvexReactClient` (`convex/react`), and similar transports.\n *\n * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`\n * but not on the simplified `ConvexClient`. When available we call it\n * during sign-out for a clean deauthentication.\n */\nexport interface ConvexTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n  setAuth(\n    fetchToken: (args: { forceRefreshToken: boolean }) => Promise<string | null | undefined>,\n    onChange?: (isAuthenticated: boolean) => void,\n  ): void;\n  clearAuth?(): void;\n}\n\n/** Minimal action-only transport used for unauthenticated auth flows. */\nexport interface ActionTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n}\n\n/** @internal */\nexport type SignInApiRef = { signIn: AuthApiRefs[\"signIn\"] };\n\n/** Pluggable key-value storage supplied by the host runtime. */\nexport interface Storage {\n  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\n/** Platform-neutral location/navigation hooks. */\ninterface LocationRuntime {\n  get(): URL | null;\n  replace(relativeUrl: string): void | Promise<void>;\n}\n\n/**\n * Platform-specific OAuth launch primitive.\n *\n * `open` receives the provider authorization URL. Platforms that navigate the\n * whole page away (browser) return nothing; platforms that run the flow in an\n * in-app session (Expo) return the callback URL so the core can complete the\n * exchange inline.\n */\ninterface OAuthRuntime {\n  open(url: URL): void | string | URL | Promise<void | string | URL>;\n}\n\n/** Cross-context synchronization hooks, such as browser storage events. */\ninterface SyncRuntime {\n  subscribe(\n    key: string,\n    callback: (value: string | null) => void | Promise<void>,\n  ): (() => void) | null;\n}\n\n/** Cross-context mutex/locking primitive. */\ninterface MutexRuntime {\n  withKey<T>(key: string, callback: () => Promise<T>): Promise<T>;\n}\n\n/** Proxy request execution supplied by the host runtime. */\ninterface ProxyRuntime {\n  fetch(body: AuthParameters, proxyPath: string): Promise<Response>;\n}\n\n/**\n * Platform-neutral client runtime dependencies.\n *\n * The core `client` package should depend only on these interfaces, while the\n * browser package can provide concrete implementations backed by DOM APIs.\n */\nexport interface ClientRuntime {\n  environment?: \"client\" | \"server\";\n  storage?: Storage | null;\n  location?: LocationRuntime;\n  oauth?: OAuthRuntime;\n  sync?: SyncRuntime;\n  mutex?: MutexRuntime;\n  proxy?: ProxyRuntime;\n}\n\n/** Platform-specific factor adapters injected by entrypoints like `browser`. */\nexport interface ClientAdapters {\n  webauthn?: WebAuthnClient;\n  totp?: TotpClient;\n  device?: DeviceClient;\n}\n\n/**\n * Shared dependencies threaded into every factor client (`totp`, `device`,\n * `webauthn`). The core `client` builds one of these and passes it to each\n * factor factory.\n *\n * @internal\n */\nexport interface FactorDeps {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => SignInApiRef;\n  proxyFetch: (body: AuthParameters) => Promise<Value>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthTokens | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: AccessToken } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n}\n\n/**\n * Dependencies provided to platform-specific factor adapters.\n *\n * @internal\n */\nexport type ClientAdapterDeps = FactorDeps;\n\n/**\n * Factory overrides for platform-specific factor adapters.\n *\n * @internal\n */\nexport interface ClientAdapterFactories {\n  webauthn?: (deps: ClientAdapterDeps) => WebAuthnClient;\n}\n\n/** @internal */\nexport type SignInActionResult = SignInFlowResult<AuthTokens | null>;\n\n/** @internal */\nexport type WebAuthnRotationResult = Extract<SignInWebAuthnOptionsResult, { operation: \"rotate\" }>;\n/** @internal Passkey sign-in options returned by a provider continuation. */\nexport type WebAuthnContinuationSignInResult = Extract<\n  SignInWebAuthnOptionsResult,\n  { operation: \"signIn\" }\n>;\n\n/**\n * Device authorization payload returned from the `deviceCode` sign-in flow.\n */\nexport type DeviceCodeResult = {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string;\n  expiresIn: number;\n  interval: number;\n};\n\n/**\n * Result of a `signIn` call.\n *\n * - `kind: \"signedIn\"` — credentials were accepted and a client session is now available.\n * - `kind: \"redirect\"` — OAuth flow initiated; redirect the user to `redirect.toString()`.\n * - `kind: \"totpRequired\"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.\n * - `kind: \"deviceCode\"` — device flow initiated; display the code and poll via `auth.device.poll()`.\n * - `kind: \"started\"` — a non-immediate flow started (for example email/phone verification).\n * - `kind: \"failed\"` — the flow did not complete; `code` is the typed {@link ErrorCode}.\n *\n * @see {@link AuthState}\n */\nexport type SignInResult =\n  | { kind: \"signedIn\" }\n  | { kind: \"redirect\"; redirect: URL; verifier: string }\n  | { kind: \"totpRequired\"; verifier: string }\n  | { kind: \"deviceCode\"; deviceCode: DeviceCodeResult }\n  | { kind: \"started\" }\n  | { kind: \"failed\"; code: ErrorCode };\n\n/** @internal */\nexport type AuthSnapshot = {\n  phase: \"loading\" | \"handshake\" | \"authenticated\" | \"unauthenticated\";\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  token: string | null;\n};\n\n/** Reactive auth state. `token` is non-null only after Convex confirms auth. */\nexport type AuthState =\n  | { status: \"loading\"; token: null }\n  | { status: \"signedOut\"; token: null }\n  | { status: \"signedIn\"; token: string };\n\n/** Handler for `auth.subscribe`. */\nexport type AuthSubscriber = (state: AuthState) => void;\n\n/**\n * Typed Convex API references for the auth functions.\n * Pass these from your generated `api` object.\n *\n * @typeParam HasWebAuthn - Whether the WebAuthn provider is configured.\n * @typeParam HasTotp - Whether the TOTP provider is configured.\n * @typeParam HasDevice - Whether the device provider is configured.\n */\ntype DefaultSignInReference = FunctionReference<\n  \"action\",\n  \"public\",\n  {\n    request: {\n      provider?: string;\n      params?: AuthParameters;\n      refreshToken?: string;\n    };\n    verifier?: string;\n    continuation?: string;\n    calledBy?: string;\n  },\n  unknown\n>;\n\ntype AnySignInReference = FunctionReference<\"action\", \"public\", any, any>;\n\nexport type AuthApiRefs<SignIn extends AnySignInReference = DefaultSignInReference> = {\n  signIn: SignIn;\n  signOut: FunctionReference<\"action\", \"public\", Record<string, Value>, unknown>;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.register}.\n */\nexport type WebAuthnRegisterOptions = {\n  /** Human-readable label for this credential (e.g. `\"MacBook Pro\"`). */\n  name?: string;\n  /** WebAuthn `user.name` override. */\n  userName?: string;\n  /** WebAuthn `user.displayName` override. */\n  userDisplayName?: string;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.signIn}.\n */\nexport type WebAuthnSignInOptions = {\n  /** Email hint to filter discoverable credentials. */\n  email?: string;\n  /** Set to `true` for conditional UI (autofill) mode. */\n  autofill?: boolean;\n};\n\n/**\n * WebAuthn client-side helpers.\n *\n * @see {@link TotpClient}\n * @see {@link DeviceClient}\n */\nexport interface WebAuthnClient {\n  /**\n   * Check whether the current runtime exposes WebAuthn passkey APIs.\n   *\n   * @returns `true` when `navigator.credentials` is available.\n   *\n   * @example\n   * ```ts\n   * if (auth.webauthn.isSupported()) {\n   *   // Show passkey registration button\n   * }\n   * ```\n   */\n  isSupported(): boolean;\n\n  /**\n   * Check whether conditional mediation (autofill-style passkeys) is available.\n   *\n   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.\n   *\n   * @example\n   * ```ts\n   * if (await auth.webauthn.isAutofillSupported()) {\n   *   await auth.webauthn.signIn({ autofill: true });\n   * }\n   * ```\n   */\n  isAutofillSupported(): Promise<boolean>;\n\n  /**\n   * Start a passkey registration flow and complete the WebAuthn ceremony.\n   *\n   * Creates a new credential bound to the current user's account.\n   *\n   * @param opts - Optional registration hints.\n   * @param opts.name - Human-readable name for the passkey (e.g. `\"MacBook Pro\"`).\n   * @param opts.userName - WebAuthn `user.name` override.\n   * @param opts.userDisplayName - WebAuthn `user.displayName` override.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.register({ name: \"My laptop\" });\n   * ```\n   */\n  register(opts?: WebAuthnRegisterOptions): Promise<SignInResult>;\n\n  /** @internal Complete registration options returned by a provider continuation. */\n  completeRegistration(result: WebAuthnRotationResult): Promise<SignInResult>;\n\n  /** @internal Complete passkey sign-in options returned by a provider continuation. */\n  completeSignIn(result: WebAuthnContinuationSignInResult): Promise<SignInResult>;\n\n  /**\n   * Sign in with an existing passkey and complete the WebAuthn ceremony.\n   *\n   * @param opts - Optional sign-in hints.\n   * @param opts.email - Email hint to filter discoverable credentials.\n   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.signIn();\n   * ```\n   */\n  signIn(opts?: WebAuthnSignInOptions): Promise<SignInResult>;\n}\n\n/**\n * Optional hints for {@link TotpClient.setup}.\n */\nexport type TotpSetupOptions = {\n  /** Issuer name shown in the authenticator app. */\n  name?: string;\n  /** Account label shown in the authenticator app. */\n  accountName?: string;\n};\n\n/** Result of {@link TotpClient.setup}. */\nexport type TotpSetupResult = {\n  /** `otpauth://` URL — render as a QR code. */\n  uri: string;\n  /** Raw base32-encoded shared secret. */\n  secret: string;\n  /** Verifier token to pass to {@link TotpClient.confirm}. */\n  verifier: string;\n  /** Factor ID to pass to {@link TotpClient.confirm}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.confirm}. */\nexport type TotpConfirmParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from {@link TotpSetupResult.verifier}. */\n  verifier: string;\n  /** Factor ID from {@link TotpSetupResult.totpId}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.verify}. */\nexport type TotpVerifyParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from a `totpRequired` sign-in result. */\n  verifier: string;\n};\n\n/**\n * TOTP two-factor authentication client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link DeviceClient}\n */\nexport interface TotpClient {\n  /**\n   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.\n   *\n   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code\n   * for the user to scan with their authenticator app.\n   *\n   * @param opts - Optional setup hints.\n   * @param opts.name - Issuer name shown in the authenticator app.\n   * @param opts.accountName - Account label in the authenticator app.\n   * @returns An object with `{ uri, secret, verifier, totpId }`.\n   *\n   * @example\n   * ```ts\n   * const { uri, secret, verifier, totpId } = await auth.totp.setup();\n   * // Render `uri` as a QR code, then confirm:\n   * await auth.totp.confirm({ code: userCode, verifier, totpId });\n   * ```\n   */\n  setup(opts?: TotpSetupOptions): Promise<TotpSetupResult>;\n\n  /**\n   * Confirm a newly created TOTP factor with the first authenticator code.\n   *\n   * Call this after the user scans the QR code and enters the first OTP.\n   *\n   * @param opts - Confirmation parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.\n   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.totp.confirm({ code: \"123456\", verifier, totpId });\n   * if (result.kind === \"failed\") showError(result.code);\n   * ```\n   */\n  confirm(opts: TotpConfirmParams): Promise<SignInResult>;\n\n  /**\n   * Complete a sign-in that is waiting on TOTP verification.\n   *\n   * Called when `signIn()` returns `{ kind: \"totpRequired\" }`.\n   *\n   * @param opts - Verification parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string from the `totpRequired` result.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.signIn(\"password\", { email, password });\n   * if (result.kind === \"totpRequired\") {\n   *   const totp = await auth.totp.verify({ code: totpCode, verifier: result.verifier });\n   *   if (totp.kind === \"failed\") showError(totp.code);\n   * }\n   * ```\n   */\n  verify(opts: TotpVerifyParams): Promise<SignInResult>;\n}\n\n/** Params for {@link DeviceClient.poll}. */\nexport type DevicePollParams = {\n  code: DeviceCodeResult;\n  /** Aborts the poll loop cleanly, e.g. on UI unmount. */\n  signal?: AbortSignal;\n};\n\n/** Params for {@link DeviceClient.verify}. */\nexport type DeviceVerifyParams = { code: string };\n\n/**\n * Device authorization (RFC 8628) client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link TotpClient}\n */\nexport interface DeviceClient {\n  /**\n   * Poll until a device flow is approved or expires.\n   *\n   * Polls the server at the interval specified in the {@link DeviceCodeResult}\n   * until the user authorizes the device or the code expires.\n   *\n   * @param opts - Poll options.\n   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn(\"device\")`.\n   * @param opts.signal - Optional {@link AbortSignal}; aborting returns cleanly\n   *   at the next loop boundary (e.g. on UI unmount).\n   * @throws `ConvexError({ code: \"DEVICE_CODE_EXPIRED\" })` when the code expires before authorization.\n   *\n   * @example\n   * ```ts\n   * const controller = new AbortController();\n   * const result = await auth.signIn(\"device\");\n   * if (result.kind === \"deviceCode\") {\n   *   // Display result.deviceCode.userCode to the user\n   *   await auth.device.poll({ code: result.deviceCode, signal: controller.signal });\n   *   console.log(\"Device authorized!\");\n   * }\n   * ```\n   */\n  poll(opts: DevicePollParams): Promise<void>;\n\n  /**\n   * Approve a device flow from the verification page using the displayed user code.\n   *\n   * Call this on the authorization page where the user enters the short code\n   * shown on the device screen.\n   *\n   * @param opts - Verification options.\n   * @param opts.code - The user code string (e.g. `\"WDJB-MJHT\"`).\n   * @throws `ConvexError({ code: \"DEVICE_AUTHORIZATION_FAILED\" })` when verification fails.\n   *\n   * @example\n   * ```ts\n   * await auth.device.verify({ code: \"WDJB-MJHT\" });\n   * ```\n   */\n  verify(opts: DeviceVerifyParams): Promise<void>;\n}\n\n/**\n * Extract capability flags from an AuthApiRefs type.\n *\n * @typeParam Api - An AuthApiRefs type to extract capability flags from.\n */\ntype SignInRequest<Api extends AuthApiRefs> =\n  FunctionArgs<Api[\"signIn\"]> extends infer Args\n    ? Args extends { request: infer Request }\n      ? Request\n      : Args\n    : never;\n\ntype ProviderIds<Api extends AuthApiRefs> = [Api[\"signIn\"]] extends [never]\n  ? string\n  : SignInRequest<Api> extends infer Args\n    ? Args extends unknown\n      ? \"provider\" extends keyof Args\n        ? Exclude<Args[keyof Args & \"provider\"], undefined>\n        : never\n      : never\n    : never;\n\ntype HasProvider<Api extends AuthApiRefs, Id extends string> =\n  string extends ProviderIds<Api> ? boolean : Id extends ProviderIds<Api> ? true : false;\n\ntype InferCaps<Api extends AuthApiRefs> = {\n  webauthn: HasProvider<Api, \"webauthn\">;\n  totp: HasProvider<Api, \"totp\">;\n  device: HasProvider<Api, \"device\">;\n};\n\n/**\n * Include a capability when configured, omit it when disabled, and keep it\n * optional when a framework binding cannot know the capability.\n */\ntype CapabilityClient<Enabled extends boolean, Name extends string, Client> = [Enabled] extends [\n  false,\n]\n  ? {}\n  : [boolean] extends [Enabled]\n    ? { [Key in Name]?: Client }\n    : { [Key in Name]: Client };\n\n/** Pending invite detected from URL or recovered from storage after redirect. */\nexport interface PendingInvite {\n  /**\n   * Raw one-time invite token. Pass to your invite acceptance mutation.\n   * @readonly\n   */\n  readonly token: string;\n  /**\n   * Invite email from the URL or stored redirect state, if available.\n   * @readonly\n   */\n  readonly email: string | null;\n  /**\n   * Consume the invite: clears storage/URL params and returns the token.\n   *\n   * @returns The invite token.\n   * @throws When there is no pending invite to accept.\n   */\n  accept(): Promise<{ token: string }>;\n}\n\n/**\n * Discriminated union of params for the password provider's flows.\n *\n * Each branch maps to one of the six password flows: `signUp`, `signIn`,\n * `reset`, `recover`, `verify`, `change`. Selecting a `flow` literal narrows the\n * accepted params automatically.\n */\nexport type { PasswordParams } from \"../../shared/params\";\n\n/** Params for the email (magic link) provider's initiation step. */\nexport type EmailInitiateParams = EmailParams;\n\n/**\n * Params for completing a code-based flow (no provider). Used to finalise\n * email magic-link sign-ins and other provider-owned code flows when the\n * verification call is made without re-specifying the originating provider.\n */\nexport type CodeCompletionParams = CodeParams;\n\n/** Params for the `connection` provider — requires a connection ID. */\nexport type { ConnectionParams } from \"../../shared/params\";\n\n/** Params for the anonymous provider. Empty / `redirectTo` only. */\nexport type { AnonymousParams } from \"../../shared/params\";\n\n/** Default params shape for OAuth-style providers (google, github, etc.). */\nexport type OAuthSignInParams = OAuthParams;\n\n/**\n * Resolves the `params` argument shape from the `provider` literal.\n *\n * Known special providers (`\"password\"`, `\"email\"`, etc.) get strict typing.\n * Any other string falls back to OAuth-style params, since custom OAuth\n * providers can be registered under arbitrary IDs.\n */\ntype DefaultParamsForProvider<P> = P extends \"password\"\n  ? PasswordParams\n  : P extends \"email\"\n    ? EmailInitiateParams\n    : P extends \"anonymous\"\n      ? AnonymousParams | undefined\n      : P extends \"connection\"\n        ? ConnectionParams\n        : P extends \"webauthn\"\n          ? never\n          : P extends undefined\n            ? CodeCompletionParams\n            : OAuthSignInParams | undefined;\n\ntype ConfiguredProviderArgs<Api extends AuthApiRefs, P> =\n  SignInRequest<Api> extends infer Args ? (Args extends { provider: P } ? Args : never) : never;\n\n/** Resolve a provider's exact params from the generated auth action reference. */\nexport type ParamsForProvider<Api extends AuthApiRefs, P> =\n  string extends ProviderIds<Api>\n    ? DefaultParamsForProvider<P>\n    : P extends \"webauthn\" | \"totp\" | \"device\"\n      ? never\n      : P extends \"connection\"\n        ? ConnectionParams\n        : [P] extends [undefined]\n          ? CodeCompletionParams\n          : ConfiguredProviderArgs<Api, P> extends infer Args\n            ? [Args] extends [never]\n              ? never\n              : Args extends { params: infer Params }\n                ? Params\n                : Args extends { params?: infer Params }\n                  ? Params | undefined\n                  : undefined\n            : never;\n\n/**\n * Tuple-rest helper that flips `params` between required and optional based\n * on whether `undefined` is in its resolved type.\n */\nexport type SignInArgs<Api extends AuthApiRefs, P> =\n  undefined extends ParamsForProvider<Api, P>\n    ? [params?: ParamsForProvider<Api, P>]\n    : [params: ParamsForProvider<Api, P>];\n\n/**\n * Public signature for `auth.signIn`. The provider literal discriminates the\n * params shape via {@link ParamsForProvider}, and the params slot is\n * automatically optional when the resolved type permits `undefined`.\n *\n * @example\n * ```ts\n * auth.signIn(\"password\", { flow: \"signIn\", email, password });\n * auth.signIn(\"password\", { flow: \"change\", email, currentPassword, newPassword });\n * auth.signIn(\"anonymous\"); // params optional\n * ```\n */\nexport type SignInOverloads<Api extends AuthApiRefs = AuthApiRefs> = <\n  const P extends ProviderIds<Api> | undefined,\n>(\n  provider: P,\n  ...args: SignInArgs<Api, P>\n) => Promise<SignInResult>;\n\n/**\n * Internal-only loose signature for the `signIn` value. Use this when\n * forwarding through wrappers where TypeScript cannot select an overload\n * from the wrapper's union-typed `provider` argument.\n *\n * @internal\n */\nexport type SignInImpl = (provider?: string, params?: AuthParameters) => Promise<SignInResult>;\n\n/** Base auth client — always present. */\ninterface AuthClientBase<Api extends AuthApiRefs> {\n  /** Restore initial auth state for the current runtime. */\n  initialize: () => Promise<void>;\n  /** SSR-safe query-param reader. */\n  param: (name: string) => string | null;\n  /**\n   * Pending invite recovered from the URL or storage, if present.\n   * @readonly\n   */\n  readonly invite: PendingInvite | null;\n  /** Complete an OAuth callback using a URL or authorization code. */\n  completeOAuth: (input: URL | string | { code: string }) => Promise<OAuthCompletionResult>;\n  /** Start a sign-in flow for a provider. */\n  signIn: SignInOverloads<Api>;\n  /** Sign out and clear local auth state. */\n  signOut: () => Promise<void>;\n  /** Subscribe to auth state changes; returns an unsubscribe. */\n  subscribe: (handler: AuthSubscriber) => () => void;\n  /** Read the current auth state synchronously, e.g. for `useSyncExternalStore`. */\n  getSnapshot: () => AuthState;\n  /** Tear down listeners and reject in-flight handshakes. */\n  destroy: () => void;\n}\n\n/**\n * Framework-agnostic auth client return type.\n *\n * Conditionally includes `totp` and `device` helpers based on the\n * capabilities in the `AuthApiRefs` type. Platform-specific `webauthn` helpers\n * are added by {@link PlatformAuthClient}.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type AuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClientBase<Api> &\n  CapabilityClient<InferCaps<Api>[\"totp\"], \"totp\", TotpClient> &\n  CapabilityClient<InferCaps<Api>[\"device\"], \"device\", DeviceClient>;\n\n/**\n * Browser auth client return type.\n *\n * Extends {@link AuthClient} with conditional WebAuthn helpers when the\n * generated auth API exposes WebAuthn capabilities.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type PlatformAuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClient<Api> &\n  CapabilityClient<InferCaps<Api>[\"webauthn\"], \"webauthn\", WebAuthnClient>;\n\n/**\n * Options for {@link client}.\n *\n * @typeParam Api - An AuthApiRefs type.\n */\ntype ClientOptionsBase = {\n  /** Any Convex client implementation used to run auth actions. */\n  convex: ConvexTransport;\n  /** Platform runtime implementation used by the client core. */\n  runtime?: ClientRuntime;\n  /** Platform-specific factor adapters supplied by higher-level entrypoints. */\n  adapters?: ClientAdapters;\n  /** Platform-specific adapter factories supplied by higher-level entrypoints. */\n  adapterFactories?: ClientAdapterFactories;\n  /** Explicit Convex deployment URL when it cannot be inferred from the client. */\n  url?: string;\n  /**\n   * Storage backend for persisted tokens.\n   *\n   * Defaults to `runtime.storage` when provided, otherwise `null`.\n   */\n  storage?: Storage | null;\n  /**\n   * Server-known auth used to seed the synchronous boot so SSR and hydration\n   * render the resolved state on first paint. A non-empty JWT boots signed in;\n   * `null` boots signed out. Providing this at all marks auth as resolved, so\n   * the client skips the loading phase. Omit it (leave `undefined`) to read the\n   * persisted value from `storage` instead. Ongoing persistence always uses\n   * `storage`.\n   */\n  token?: string | null;\n  /** SSR-safe URL source for reading query parameters. */\n  location?: URL | (() => URL | null);\n  /**\n   * Default OAuth `redirectTo` applied to `signIn` calls that omit it. Platform\n   * entrypoints set this (e.g. Expo passes its native redirect URI) so the core\n   * can build the authorization URL without a platform-specific `signIn` wrapper.\n   */\n  oauthRedirectTo?: string;\n  /**\n   * Milliseconds to wait for the Convex client to confirm a new token\n   * before a sign-in handshake rejects with `AUTH_HANDSHAKE_TIMEOUT`.\n   * Defaults to `5000`.\n   */\n  handshakeTimeoutMs?: number;\n};\n\n/** Direct Convex mode. Generated auth references are the client contract. */\nexport type DirectClientOptions<Api extends AuthApiRefs = AuthApiRefs> = ClientOptionsBase & {\n  /** Typed auth function refs from the application's generated `api` object. */\n  api: Api;\n  /** Proxy transport and direct transport are mutually exclusive. */\n  proxyPath?: never;\n  /**\n   * Action-only transport used for direct code exchange. Browser and Expo\n   * entrypoints provide one automatically; headless runtimes must inject it.\n   */\n  httpClient?: ActionTransport | null;\n};\n\n/** HTTP proxy mode. The proxy owns the Convex function references. */\nexport type ProxyClientOptions = ClientOptionsBase & {\n  /** Proxy endpoint used instead of direct Convex auth calls. */\n  proxyPath: string;\n  /** Generated references belong to direct mode and cannot be mixed with a proxy. */\n  api?: never;\n  /** Direct action transports belong to direct mode. */\n  httpClient?: never;\n};\n\n/**\n * Client configuration. Selecting direct or proxy mode makes every required\n * transport explicit and prevents the two modes from being combined.\n */\nexport type ClientOptions<Api extends AuthApiRefs = AuthApiRefs> =\n  | DirectClientOptions<Api>\n  | ProxyClientOptions;\n\nexport type OAuthCompletionResult = { handled: false } | { handled: true; cleanupUrl: URL | null };\n\n/**\n * Metadata describing the current auth flow for handshake diagnostics.\n *\n * @internal\n */\nexport type AuthFlowContext = {\n  provider?: string;\n  flow: string;\n};\n\n/**\n * A simple deferred promise that can be resolved or rejected externally.\n */\ninterface SimpleDeferred<T, E = unknown> {\n  readonly promise: Promise<T>;\n  resolve(value: T): void;\n  reject(error: E): void;\n}\n\n/**\n * Create a deferred promise that can be resolved or rejected externally.\n *\n * @returns A deferred object containing the promise and control methods.\n * @internal\n */\nexport function createDeferred<T, E = unknown>(): SimpleDeferred<T, E> {\n  let resolve!: (value: T) => void;\n  let reject!: (error: E) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej as (error: E) => void;\n  });\n  return { promise, resolve, reject };\n}\n\n/** @internal */\nexport type HandshakeWaiter = {\n  epoch: number;\n  context: AuthFlowContext;\n  deferred: SimpleDeferred<void, ConvexError<Value>>;\n  timeoutId: ReturnType<typeof setTimeout>;\n};\n"],"mappings":";;;;;;;AA00BA,SAAgB,iBAAuD;CACrE,IAAI;CACJ,IAAI;AAKJ,QAAO;EAAE,SAJO,IAAI,SAAY,KAAK,QAAQ;AAC3C,aAAU;AACV,YAAS;IACT;EACgB;EAAS;EAAQ"}

package/dist/client/errors.d.ts

@@ -0,0 +1,15 @@
+import { ErrorCode } from "../shared/codes.js";
+
+//#region src/client/errors.d.ts
+/**
+ * Codes emitted only by the client during the Convex confirmation handshake.
+ */
+declare const HandshakeErrorCode: {
+  readonly AUTH_HANDSHAKE_TIMEOUT: "AUTH_HANDSHAKE_TIMEOUT";
+  readonly AUTH_HANDSHAKE_REJECTED: "AUTH_HANDSHAKE_REJECTED";
+};
+/** Union of every client-only handshake code. */
+type HandshakeErrorCode = (typeof HandshakeErrorCode)[keyof typeof HandshakeErrorCode];
+//#endregion
+export { HandshakeErrorCode };
+//# sourceMappingURL=errors.d.ts.map

package/dist/client/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","names":[],"sources":["../../src/client/errors.ts"],"mappings":";;;;;;cAqBa,kBAAA;EAAA,SAGH,sBAAA;EAAA,SAAA,uBAAA;AAAA;;KAGE,kBAAA,WAA6B,kBAAA,eAAiC,kBAAA"}

package/dist/client/errors.js

@@ -12,6 +12,13 @@ import { ConvexError } from "convex/values";
 *
 * @module
 */
+/**
+* Codes emitted only by the client during the Convex confirmation handshake.
+*/
+const HandshakeErrorCode = {
+	AUTH_HANDSHAKE_TIMEOUT: "AUTH_HANDSHAKE_TIMEOUT",
+	AUTH_HANDSHAKE_REJECTED: "AUTH_HANDSHAKE_REJECTED"
+};
 const HANDSHAKE_ERROR_MESSAGES = {
 	AUTH_HANDSHAKE_TIMEOUT: "Sign-in succeeded but authentication confirmation timed out.",
 	AUTH_HANDSHAKE_REJECTED: "Authentication was rejected while confirming the session."
@@ -27,5 +34,5 @@ const createHandshakeError = (code, context) => {
 };
 
 //#endregion
-export { createHandshakeError };
+export { HandshakeErrorCode, createHandshakeError };
 //# sourceMappingURL=errors.js.map

package/dist/client/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":[],"sources":["../../src/client/errors.ts"],"sourcesContent":["/**\n * Client-side error-code registry.\n *\n * Re-exports the shared {@link ErrorCode} registry and adds the handshake codes\n * that are meaningful only in the client (they describe the browser⇄Convex\n * confirmation handshake, not a server outcome), so client code has a single\n * import surface for every code it can surface.\n *\n * @module\n */\n\nimport { ConvexError, Value } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\n\nexport { ErrorCode };\nexport type { ErrorCode as ErrorCodeValue } from \"../shared/codes\";\n\n/**\n * Codes emitted only by the client during the Convex confirmation handshake.\n */\nexport const HandshakeErrorCode = {\n  AUTH_HANDSHAKE_TIMEOUT: \"AUTH_HANDSHAKE_TIMEOUT\",\n  AUTH_HANDSHAKE_REJECTED: \"AUTH_HANDSHAKE_REJECTED\",\n} as const;\n\n/** Union of every client-only handshake code. */\nexport type HandshakeErrorCode = (typeof HandshakeErrorCode)[keyof typeof HandshakeErrorCode];\n\ntype HandshakeErrorContext = Record<string, Value | undefined>;\n\nconst HANDSHAKE_ERROR_MESSAGES = {\n  AUTH_HANDSHAKE_TIMEOUT: \"Sign-in succeeded but authentication confirmation timed out.\",\n  AUTH_HANDSHAKE_REJECTED: \"Authentication was rejected while confirming the session.\",\n} as const satisfies Record<HandshakeErrorCode, string>;\n\ntype HandshakeErrorData = {\n  code: HandshakeErrorCode;\n  message: string;\n} & Record<string, Value>;\n\n/** @internal */\nexport const createHandshakeError = (code: HandshakeErrorCode, context: HandshakeErrorContext) => {\n  const data: HandshakeErrorData = {\n    code,\n    message: HANDSHAKE_ERROR_MESSAGES[code],\n  };\n  for (const [key, value] of Object.entries(context)) {\n    if (value !== undefined) data[key] = value;\n  }\n  return new ConvexError(data);\n};\n"],"mappings":";;;;;;;;;;;;;;AA+BA,MAAM,2BAA2B;CAC/B,wBAAwB;CACxB,yBAAyB;CAC1B;;AAQD,MAAa,wBAAwB,MAA0B,YAAmC;CAChG,MAAM,OAA2B;EAC/B;EACA,SAAS,yBAAyB;EACnC;AACD,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,CAChD,KAAI,UAAU,OAAW,MAAK,OAAO;AAEvC,QAAO,IAAI,YAAY,KAAK"}
+{"version":3,"file":"errors.js","names":[],"sources":["../../src/client/errors.ts"],"sourcesContent":["/**\n * Client-side error-code registry.\n *\n * Re-exports the shared {@link ErrorCode} registry and adds the handshake codes\n * that are meaningful only in the client (they describe the browser⇄Convex\n * confirmation handshake, not a server outcome), so client code has a single\n * import surface for every code it can surface.\n *\n * @module\n */\n\nimport { ConvexError, Value } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\n\nexport { ErrorCode };\nexport type { ErrorCode as ErrorCodeValue } from \"../shared/codes\";\n\n/**\n * Codes emitted only by the client during the Convex confirmation handshake.\n */\nexport const HandshakeErrorCode = {\n  AUTH_HANDSHAKE_TIMEOUT: \"AUTH_HANDSHAKE_TIMEOUT\",\n  AUTH_HANDSHAKE_REJECTED: \"AUTH_HANDSHAKE_REJECTED\",\n} as const;\n\n/** Union of every client-only handshake code. */\nexport type HandshakeErrorCode = (typeof HandshakeErrorCode)[keyof typeof HandshakeErrorCode];\n\ntype HandshakeErrorContext = Record<string, Value | undefined>;\n\nconst HANDSHAKE_ERROR_MESSAGES = {\n  AUTH_HANDSHAKE_TIMEOUT: \"Sign-in succeeded but authentication confirmation timed out.\",\n  AUTH_HANDSHAKE_REJECTED: \"Authentication was rejected while confirming the session.\",\n} as const satisfies Record<HandshakeErrorCode, string>;\n\ntype HandshakeErrorData = {\n  code: HandshakeErrorCode;\n  message: string;\n} & Record<string, Value>;\n\n/** @internal */\nexport const createHandshakeError = (code: HandshakeErrorCode, context: HandshakeErrorContext) => {\n  const data: HandshakeErrorData = {\n    code,\n    message: HANDSHAKE_ERROR_MESSAGES[code],\n  };\n  for (const [key, value] of Object.entries(context)) {\n    if (value !== undefined) data[key] = value;\n  }\n  return new ConvexError(data);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAqBA,MAAa,qBAAqB;CAChC,wBAAwB;CACxB,yBAAyB;CAC1B;AAOD,MAAM,2BAA2B;CAC/B,wBAAwB;CACxB,yBAAyB;CAC1B;;AAQD,MAAa,wBAAwB,MAA0B,YAAmC;CAChG,MAAM,OAA2B;EAC/B;EACA,SAAS,yBAAyB;EACnC;AACD,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,CAChD,KAAI,UAAU,OAAW,MAAK,OAAO;AAEvC,QAAO,IAAI,YAAY,KAAK"}

package/dist/client/factors/device.js

@@ -11,14 +11,14 @@ function createDeviceClient(deps) {
 	const requestDeviceSignIn = async (params) => {
 		return proxy ? await proxyFetch({
 			action: "auth:signIn",
-			args: {
+			args: { request: {
 				provider: "device",
 				params
-			}
-		}) : await convex.action(requireApiRefs().signIn, {
+			} }
+		}) : await convex.action(requireApiRefs().signIn, { request: {
 			provider: "device",
 			params
-		});
+		} });
 	};
 	return {
 		poll: async (opts) => {

package/dist/client/factors/device.js.map

@@ -1 +1 @@
-{"version":3,"file":"device.js","names":[],"sources":["../../../src/client/factors/device.ts"],"sourcesContent":["import { ConvexError } from \"convex/values\";\n\nimport type { DeviceClient, DevicePollParams, FactorDeps, SignInActionResult } from \"../core/types\";\nimport type { AuthTokens } from \"../../shared/results\";\nimport type { AuthParameters } from \"../../shared/results\";\nimport { ErrorCode } from \"../../shared/codes\";\n\nfunction isSignedInResult(\n  result: SignInActionResult,\n): result is Extract<SignInActionResult, { kind: \"signedIn\" }> {\n  return result.kind === \"signedIn\";\n}\n\n/** @internal */\nexport function createDeviceClient(deps: FactorDeps): DeviceClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;\n\n  const requestDeviceSignIn = async (params: AuthParameters): Promise<SignInActionResult> => {\n    return (\n      proxy\n        ? await proxyFetch({\n            action: \"auth:signIn\",\n            args: { provider: \"device\", params },\n          })\n        : await convex.action(requireApiRefs().signIn, {\n            provider: \"device\",\n            params,\n          })\n    ) as SignInActionResult;\n  };\n\n  return {\n    poll: async (opts: DevicePollParams): Promise<void> => {\n      const { code, signal } = opts;\n      const MAX_POLL_DURATION_MS = 30 * 60 * 1000;\n      const SLOW_DOWN_INCREMENT_MS = 5 * 1000;\n      let currentIntervalMs = code.interval * 1000;\n      const startedAt = Date.now();\n      const expiresAt = Math.min(\n        startedAt + code.expiresIn * 1000,\n        startedAt + MAX_POLL_DURATION_MS,\n      );\n\n      while (Date.now() < expiresAt) {\n        if (signal?.aborted) return;\n        await new Promise((resolve) => setTimeout(resolve, currentIntervalMs));\n        if (signal?.aborted) return;\n\n        const params: AuthParameters = {\n          flow: \"poll\",\n          deviceCode: code.deviceCode,\n        };\n\n        let pollResult: SignInActionResult | null;\n        try {\n          pollResult = await requestDeviceSignIn(params);\n        } catch (error) {\n          if (error instanceof ConvexError) {\n            const errorCode = (error.data as { code?: unknown } | undefined)?.code;\n            if (errorCode === \"DEVICE_AUTHORIZATION_PENDING\") {\n              continue;\n            }\n            if (errorCode === \"DEVICE_SLOW_DOWN\") {\n              currentIntervalMs += SLOW_DOWN_INCREMENT_MS;\n              continue;\n            }\n          }\n          throw error;\n        }\n\n        if (pollResult === null) {\n          continue;\n        }\n\n        if (isSignedInResult(pollResult) && pollResult.session) {\n          if (proxy) {\n            await setTokenAndMaybeWait({\n              shouldStore: false,\n              tokens: pollResult.session === null ? null : { token: pollResult.session.token },\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          } else {\n            await setTokenAndMaybeWait({\n              shouldStore: true,\n              tokens: (pollResult.session as AuthTokens | null) ?? null,\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          }\n          return;\n        }\n      }\n\n      throw new ConvexError({\n        code: ErrorCode.DEVICE_CODE_EXPIRED,\n        message: \"Device code expired before authorization was completed.\",\n      });\n    },\n\n    verify: async (opts: { code: string }): Promise<void> => {\n      const params: AuthParameters = {\n        flow: \"verify\",\n        userCode: opts.code,\n      };\n\n      try {\n        await requestDeviceSignIn(params);\n      } catch (error) {\n        throw new ConvexError({\n          code: ErrorCode.DEVICE_AUTHORIZATION_FAILED,\n          message: error instanceof Error ? error.message : \"Invalid or expired code.\",\n        });\n      }\n    },\n  };\n}\n"],"mappings":";;;;AAOA,SAAS,iBACP,QAC6D;AAC7D,QAAO,OAAO,SAAS;;;AAIzB,SAAgB,mBAAmB,MAAgC;CACjE,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBAAyB;CAE5E,MAAM,sBAAsB,OAAO,WAAwD;AACzF,SACE,QACI,MAAM,WAAW;GACf,QAAQ;GACR,MAAM;IAAE,UAAU;IAAU;IAAQ;GACrC,CAAC,GACF,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;GAC3C,UAAU;GACV;GACD,CAAC;;AAIV,QAAO;EACL,MAAM,OAAO,SAA0C;GACrD,MAAM,EAAE,MAAM,WAAW;GACzB,MAAM,uBAAuB,OAAU;GACvC,MAAM,yBAAyB,IAAI;GACnC,IAAI,oBAAoB,KAAK,WAAW;GACxC,MAAM,YAAY,KAAK,KAAK;GAC5B,MAAM,YAAY,KAAK,IACrB,YAAY,KAAK,YAAY,KAC7B,YAAY,qBACb;AAED,UAAO,KAAK,KAAK,GAAG,WAAW;AAC7B,QAAI,QAAQ,QAAS;AACrB,UAAM,IAAI,SAAS,YAAY,WAAW,SAAS,kBAAkB,CAAC;AACtE,QAAI,QAAQ,QAAS;IAErB,MAAM,SAAyB;KAC7B,MAAM;KACN,YAAY,KAAK;KAClB;IAED,IAAI;AACJ,QAAI;AACF,kBAAa,MAAM,oBAAoB,OAAO;aACvC,OAAO;AACd,SAAI,iBAAiB,aAAa;MAChC,MAAM,YAAa,MAAM,MAAyC;AAClE,UAAI,cAAc,+BAChB;AAEF,UAAI,cAAc,oBAAoB;AACpC,4BAAqB;AACrB;;;AAGJ,WAAM;;AAGR,QAAI,eAAe,KACjB;AAGF,QAAI,iBAAiB,WAAW,IAAI,WAAW,SAAS;AACtD,SAAI,MACF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAQ,WAAW,YAAY,OAAO,OAAO,EAAE,OAAO,WAAW,QAAQ,OAAO;MAChF,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;SAEF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAS,WAAW,WAAiC;MACrD,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;AAEJ;;;AAIJ,SAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;;EAGJ,QAAQ,OAAO,SAA0C;GACvD,MAAM,SAAyB;IAC7B,MAAM;IACN,UAAU,KAAK;IAChB;AAED,OAAI;AACF,UAAM,oBAAoB,OAAO;YAC1B,OAAO;AACd,UAAM,IAAI,YAAY;KACpB,MAAM,UAAU;KAChB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;KACnD,CAAC;;;EAGP"}
+{"version":3,"file":"device.js","names":[],"sources":["../../../src/client/factors/device.ts"],"sourcesContent":["import { ConvexError } from \"convex/values\";\n\nimport type { DeviceClient, DevicePollParams, FactorDeps, SignInActionResult } from \"../core/types\";\nimport type { AuthTokens } from \"../../shared/results\";\nimport type { AuthParameters } from \"../../shared/results\";\nimport { ErrorCode } from \"../../shared/codes\";\n\nfunction isSignedInResult(\n  result: SignInActionResult,\n): result is Extract<SignInActionResult, { kind: \"signedIn\" }> {\n  return result.kind === \"signedIn\";\n}\n\n/** @internal */\nexport function createDeviceClient(deps: FactorDeps): DeviceClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;\n\n  const requestDeviceSignIn = async (params: AuthParameters): Promise<SignInActionResult> => {\n    return (\n      proxy\n        ? await proxyFetch({\n            action: \"auth:signIn\",\n            args: { request: { provider: \"device\", params } },\n          })\n        : await convex.action(requireApiRefs().signIn, {\n            request: { provider: \"device\", params },\n          })\n    ) as SignInActionResult;\n  };\n\n  return {\n    poll: async (opts: DevicePollParams): Promise<void> => {\n      const { code, signal } = opts;\n      const MAX_POLL_DURATION_MS = 30 * 60 * 1000;\n      const SLOW_DOWN_INCREMENT_MS = 5 * 1000;\n      let currentIntervalMs = code.interval * 1000;\n      const startedAt = Date.now();\n      const expiresAt = Math.min(\n        startedAt + code.expiresIn * 1000,\n        startedAt + MAX_POLL_DURATION_MS,\n      );\n\n      while (Date.now() < expiresAt) {\n        if (signal?.aborted) return;\n        await new Promise((resolve) => setTimeout(resolve, currentIntervalMs));\n        if (signal?.aborted) return;\n\n        const params: AuthParameters = {\n          flow: \"poll\",\n          deviceCode: code.deviceCode,\n        };\n\n        let pollResult: SignInActionResult | null;\n        try {\n          pollResult = await requestDeviceSignIn(params);\n        } catch (error) {\n          if (error instanceof ConvexError) {\n            const errorCode = (error.data as { code?: unknown } | undefined)?.code;\n            if (errorCode === \"DEVICE_AUTHORIZATION_PENDING\") {\n              continue;\n            }\n            if (errorCode === \"DEVICE_SLOW_DOWN\") {\n              currentIntervalMs += SLOW_DOWN_INCREMENT_MS;\n              continue;\n            }\n          }\n          throw error;\n        }\n\n        if (pollResult === null) {\n          continue;\n        }\n\n        if (isSignedInResult(pollResult) && pollResult.session) {\n          if (proxy) {\n            await setTokenAndMaybeWait({\n              shouldStore: false,\n              tokens: pollResult.session === null ? null : { token: pollResult.session.token },\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          } else {\n            await setTokenAndMaybeWait({\n              shouldStore: true,\n              tokens: (pollResult.session as AuthTokens | null) ?? null,\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          }\n          return;\n        }\n      }\n\n      throw new ConvexError({\n        code: ErrorCode.DEVICE_CODE_EXPIRED,\n        message: \"Device code expired before authorization was completed.\",\n      });\n    },\n\n    verify: async (opts: { code: string }): Promise<void> => {\n      const params: AuthParameters = {\n        flow: \"verify\",\n        userCode: opts.code,\n      };\n\n      try {\n        await requestDeviceSignIn(params);\n      } catch (error) {\n        throw new ConvexError({\n          code: ErrorCode.DEVICE_AUTHORIZATION_FAILED,\n          message: error instanceof Error ? error.message : \"Invalid or expired code.\",\n        });\n      }\n    },\n  };\n}\n"],"mappings":";;;;AAOA,SAAS,iBACP,QAC6D;AAC7D,QAAO,OAAO,SAAS;;;AAIzB,SAAgB,mBAAmB,MAAgC;CACjE,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBAAyB;CAE5E,MAAM,sBAAsB,OAAO,WAAwD;AACzF,SACE,QACI,MAAM,WAAW;GACf,QAAQ;GACR,MAAM,EAAE,SAAS;IAAE,UAAU;IAAU;IAAQ,EAAE;GAClD,CAAC,GACF,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ,EAC3C,SAAS;GAAE,UAAU;GAAU;GAAQ,EACxC,CAAC;;AAIV,QAAO;EACL,MAAM,OAAO,SAA0C;GACrD,MAAM,EAAE,MAAM,WAAW;GACzB,MAAM,uBAAuB,OAAU;GACvC,MAAM,yBAAyB,IAAI;GACnC,IAAI,oBAAoB,KAAK,WAAW;GACxC,MAAM,YAAY,KAAK,KAAK;GAC5B,MAAM,YAAY,KAAK,IACrB,YAAY,KAAK,YAAY,KAC7B,YAAY,qBACb;AAED,UAAO,KAAK,KAAK,GAAG,WAAW;AAC7B,QAAI,QAAQ,QAAS;AACrB,UAAM,IAAI,SAAS,YAAY,WAAW,SAAS,kBAAkB,CAAC;AACtE,QAAI,QAAQ,QAAS;IAErB,MAAM,SAAyB;KAC7B,MAAM;KACN,YAAY,KAAK;KAClB;IAED,IAAI;AACJ,QAAI;AACF,kBAAa,MAAM,oBAAoB,OAAO;aACvC,OAAO;AACd,SAAI,iBAAiB,aAAa;MAChC,MAAM,YAAa,MAAM,MAAyC;AAClE,UAAI,cAAc,+BAChB;AAEF,UAAI,cAAc,oBAAoB;AACpC,4BAAqB;AACrB;;;AAGJ,WAAM;;AAGR,QAAI,eAAe,KACjB;AAGF,QAAI,iBAAiB,WAAW,IAAI,WAAW,SAAS;AACtD,SAAI,MACF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAQ,WAAW,YAAY,OAAO,OAAO,EAAE,OAAO,WAAW,QAAQ,OAAO;MAChF,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;SAEF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAS,WAAW,WAAiC;MACrD,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;AAEJ;;;AAIJ,SAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;;EAGJ,QAAQ,OAAO,SAA0C;GACvD,MAAM,SAAyB;IAC7B,MAAM;IACN,UAAU,KAAK;IAChB;AAED,OAAI;AACF,UAAM,oBAAoB,OAAO;YAC1B,OAAO;AACd,UAAM,IAAI,YAAY;KACpB,MAAM,UAAU;KAChB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;KACnD,CAAC;;;EAGP"}

package/dist/client/factors/totp.js

@@ -41,10 +41,10 @@ function createTotpClient(deps) {
 			if (proxy) {
 				const result$1 = await proxyFetch({
 					action: "auth:signIn",
-					args: {
+					args: { request: {
 						provider: "totp",
 						params
-					}
+					} }
 				});
 				if (!isTotpSetupResult(result$1)) throw new Error("Server did not return TOTP setup data.");
 				return {
@@ -54,10 +54,10 @@ function createTotpClient(deps) {
 					totpId: result$1.totpSetup.totpId
 				};
 			}
-			const result = await convex.action(requireApiRefs().signIn, {
+			const result = await convex.action(requireApiRefs().signIn, { request: {
 				provider: "totp",
 				params
-			});
+			} });
 			if (!isTotpSetupResult(result)) throw new Error("Server did not return TOTP setup data.");
 			return {
 				uri: result.totpSetup.uri,
@@ -75,13 +75,17 @@ function createTotpClient(deps) {
 			return completeSignIn(proxy ? await proxyFetch({
 				action: "auth:signIn",
 				args: {
-					provider: "totp",
-					params,
+					request: {
+						provider: "totp",
+						params
+					},
 					verifier: opts.verifier
 				}
 			}) : await convex.action(requireApiRefs().signIn, {
-				provider: "totp",
-				params,
+				request: {
+					provider: "totp",
+					params
+				},
 				verifier: opts.verifier
 			}), "confirm");
 		},
@@ -93,13 +97,17 @@ function createTotpClient(deps) {
 			return completeSignIn(proxy ? await proxyFetch({
 				action: "auth:signIn",
 				args: {
-					provider: "totp",
-					params,
+					request: {
+						provider: "totp",
+						params
+					},
 					verifier: opts.verifier
 				}
 			}) : await convex.action(requireApiRefs().signIn, {
-				provider: "totp",
-				params,
+				request: {
+					provider: "totp",
+					params
+				},
 				verifier: opts.verifier
 			}), "verify");
 		}

package/dist/client/factors/totp.js.map

@@ -1 +1 @@
-{"version":3,"file":"totp.js","names":["result"],"sources":["../../../src/client/factors/totp.ts"],"sourcesContent":["import type { FactorDeps, SignInActionResult, SignInResult, TotpClient } from \"../core/types\";\nimport { ErrorCode } from \"../../shared/codes\";\nimport type { AuthParameters } from \"../../shared/results\";\n\nfunction isSignedInResult(\n  result: SignInActionResult,\n): result is Extract<SignInActionResult, { kind: \"signedIn\" }> {\n  return result.kind === \"signedIn\";\n}\n\nfunction isTotpSetupResult(\n  result: SignInActionResult,\n): result is Extract<SignInActionResult, { kind: \"totpSetup\" }> {\n  return result.kind === \"totpSetup\";\n}\n\n/** @internal */\nexport function createTotpClient(deps: FactorDeps): TotpClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;\n\n  const completeSignIn = async (\n    result: SignInActionResult,\n    flow: \"confirm\" | \"verify\",\n  ): Promise<SignInResult> => {\n    if (!isSignedInResult(result) || !result.session) {\n      return { kind: \"failed\", code: ErrorCode.TOTP_INVALID_CODE };\n    }\n    const established = await setTokenAndMaybeWait(\n      proxy\n        ? {\n            shouldStore: false,\n            tokens: { token: result.session.token },\n            waitForHandshake: true,\n            context: { provider: \"totp\", flow },\n          }\n        : {\n            shouldStore: true,\n            tokens: result.session,\n            waitForHandshake: true,\n            context: { provider: \"totp\", flow },\n          },\n    );\n    return established ? { kind: \"signedIn\" } : { kind: \"started\" };\n  };\n\n  return {\n    setup: async (opts?: {\n      name?: string;\n      accountName?: string;\n    }): Promise<{\n      uri: string;\n      secret: string;\n      verifier: string;\n      totpId: string;\n    }> => {\n      const params: AuthParameters = { flow: \"setup\" };\n      if (opts?.name) params.name = opts.name;\n      if (opts?.accountName) params.accountName = opts.accountName;\n\n      if (proxy) {\n        const result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"totp\", params },\n        })) as SignInActionResult;\n        if (!isTotpSetupResult(result)) {\n          throw new Error(\"Server did not return TOTP setup data.\");\n        }\n        return {\n          uri: result.totpSetup.uri,\n          secret: result.totpSetup.secret,\n          verifier: result.verifier,\n          totpId: result.totpSetup.totpId,\n        };\n      }\n\n      const result = (await convex.action(requireApiRefs().signIn, {\n        provider: \"totp\",\n        params,\n      })) as SignInActionResult;\n      if (!isTotpSetupResult(result)) {\n        throw new Error(\"Server did not return TOTP setup data.\");\n      }\n      return {\n        uri: result.totpSetup.uri,\n        secret: result.totpSetup.secret,\n        verifier: result.verifier,\n        totpId: result.totpSetup.totpId,\n      };\n    },\n\n    confirm: async (opts: {\n      code: string;\n      verifier: string;\n      totpId: string;\n    }): Promise<SignInResult> => {\n      const params: AuthParameters = {\n        flow: \"verify\",\n        code: opts.code,\n        totpId: opts.totpId,\n      };\n\n      const result = (\n        proxy\n          ? await proxyFetch({\n              action: \"auth:signIn\",\n              args: { provider: \"totp\", params, verifier: opts.verifier },\n            })\n          : await convex.action(requireApiRefs().signIn, {\n              provider: \"totp\",\n              params,\n              verifier: opts.verifier,\n            })\n      ) as SignInActionResult;\n      return completeSignIn(result, \"confirm\");\n    },\n\n    verify: async (opts: { code: string; verifier: string }): Promise<SignInResult> => {\n      const params: AuthParameters = {\n        flow: \"verify\",\n        code: opts.code,\n      };\n\n      const result = (\n        proxy\n          ? await proxyFetch({\n              action: \"auth:signIn\",\n              args: { provider: \"totp\", params, verifier: opts.verifier },\n            })\n          : await convex.action(requireApiRefs().signIn, {\n              provider: \"totp\",\n              params,\n              verifier: opts.verifier,\n            })\n      ) as SignInActionResult;\n      return completeSignIn(result, \"verify\");\n    },\n  };\n}\n"],"mappings":";;;AAIA,SAAS,iBACP,QAC6D;AAC7D,QAAO,OAAO,SAAS;;AAGzB,SAAS,kBACP,QAC8D;AAC9D,QAAO,OAAO,SAAS;;;AAIzB,SAAgB,iBAAiB,MAA8B;CAC7D,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBAAyB;CAE5E,MAAM,iBAAiB,OACrB,QACA,SAC0B;AAC1B,MAAI,CAAC,iBAAiB,OAAO,IAAI,CAAC,OAAO,QACvC,QAAO;GAAE,MAAM;GAAU,MAAM,UAAU;GAAmB;AAiB9D,SAfoB,MAAM,qBACxB,QACI;GACE,aAAa;GACb,QAAQ,EAAE,OAAO,OAAO,QAAQ,OAAO;GACvC,kBAAkB;GAClB,SAAS;IAAE,UAAU;IAAQ;IAAM;GACpC,GACD;GACE,aAAa;GACb,QAAQ,OAAO;GACf,kBAAkB;GAClB,SAAS;IAAE,UAAU;IAAQ;IAAM;GACpC,CACN,GACoB,EAAE,MAAM,YAAY,GAAG,EAAE,MAAM,WAAW;;AAGjE,QAAO;EACL,OAAO,OAAO,SAQR;GACJ,MAAM,SAAyB,EAAE,MAAM,SAAS;AAChD,OAAI,MAAM,KAAM,QAAO,OAAO,KAAK;AACnC,OAAI,MAAM,YAAa,QAAO,cAAc,KAAK;AAEjD,OAAI,OAAO;IACT,MAAMA,WAAU,MAAM,WAAW;KAC/B,QAAQ;KACR,MAAM;MAAE,UAAU;MAAQ;MAAQ;KACnC,CAAC;AACF,QAAI,CAAC,kBAAkBA,SAAO,CAC5B,OAAM,IAAI,MAAM,yCAAyC;AAE3D,WAAO;KACL,KAAKA,SAAO,UAAU;KACtB,QAAQA,SAAO,UAAU;KACzB,UAAUA,SAAO;KACjB,QAAQA,SAAO,UAAU;KAC1B;;GAGH,MAAM,SAAU,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV;IACD,CAAC;AACF,OAAI,CAAC,kBAAkB,OAAO,CAC5B,OAAM,IAAI,MAAM,yCAAyC;AAE3D,UAAO;IACL,KAAK,OAAO,UAAU;IACtB,QAAQ,OAAO,UAAU;IACzB,UAAU,OAAO;IACjB,QAAQ,OAAO,UAAU;IAC1B;;EAGH,SAAS,OAAO,SAIa;GAC3B,MAAM,SAAyB;IAC7B,MAAM;IACN,MAAM,KAAK;IACX,QAAQ,KAAK;IACd;AAcD,UAAO,eAXL,QACI,MAAM,WAAW;IACf,QAAQ;IACR,MAAM;KAAE,UAAU;KAAQ;KAAQ,UAAU,KAAK;KAAU;IAC5D,CAAC,GACF,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3C,UAAU;IACV;IACA,UAAU,KAAK;IAChB,CAAC,EAEsB,UAAU;;EAG1C,QAAQ,OAAO,SAAoE;GACjF,MAAM,SAAyB;IAC7B,MAAM;IACN,MAAM,KAAK;IACZ;AAcD,UAAO,eAXL,QACI,MAAM,WAAW;IACf,QAAQ;IACR,MAAM;KAAE,UAAU;KAAQ;KAAQ,UAAU,KAAK;KAAU;IAC5D,CAAC,GACF,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3C,UAAU;IACV;IACA,UAAU,KAAK;IAChB,CAAC,EAEsB,SAAS;;EAE1C"}
+{"version":3,"file":"totp.js","names":["result"],"sources":["../../../src/client/factors/totp.ts"],"sourcesContent":["import type { FactorDeps, SignInActionResult, SignInResult, TotpClient } from \"../core/types\";\nimport { ErrorCode } from \"../../shared/codes\";\nimport type { AuthParameters } from \"../../shared/results\";\n\nfunction isSignedInResult(\n  result: SignInActionResult,\n): result is Extract<SignInActionResult, { kind: \"signedIn\" }> {\n  return result.kind === \"signedIn\";\n}\n\nfunction isTotpSetupResult(\n  result: SignInActionResult,\n): result is Extract<SignInActionResult, { kind: \"totpSetup\" }> {\n  return result.kind === \"totpSetup\";\n}\n\n/** @internal */\nexport function createTotpClient(deps: FactorDeps): TotpClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;\n\n  const completeSignIn = async (\n    result: SignInActionResult,\n    flow: \"confirm\" | \"verify\",\n  ): Promise<SignInResult> => {\n    if (!isSignedInResult(result) || !result.session) {\n      return { kind: \"failed\", code: ErrorCode.TOTP_INVALID_CODE };\n    }\n    const established = await setTokenAndMaybeWait(\n      proxy\n        ? {\n            shouldStore: false,\n            tokens: { token: result.session.token },\n            waitForHandshake: true,\n            context: { provider: \"totp\", flow },\n          }\n        : {\n            shouldStore: true,\n            tokens: result.session,\n            waitForHandshake: true,\n            context: { provider: \"totp\", flow },\n          },\n    );\n    return established ? { kind: \"signedIn\" } : { kind: \"started\" };\n  };\n\n  return {\n    setup: async (opts?: {\n      name?: string;\n      accountName?: string;\n    }): Promise<{\n      uri: string;\n      secret: string;\n      verifier: string;\n      totpId: string;\n    }> => {\n      const params: AuthParameters = { flow: \"setup\" };\n      if (opts?.name) params.name = opts.name;\n      if (opts?.accountName) params.accountName = opts.accountName;\n\n      if (proxy) {\n        const result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: { request: { provider: \"totp\", params } },\n        })) as SignInActionResult;\n        if (!isTotpSetupResult(result)) {\n          throw new Error(\"Server did not return TOTP setup data.\");\n        }\n        return {\n          uri: result.totpSetup.uri,\n          secret: result.totpSetup.secret,\n          verifier: result.verifier,\n          totpId: result.totpSetup.totpId,\n        };\n      }\n\n      const result = (await convex.action(requireApiRefs().signIn, {\n        request: { provider: \"totp\", params },\n      })) as SignInActionResult;\n      if (!isTotpSetupResult(result)) {\n        throw new Error(\"Server did not return TOTP setup data.\");\n      }\n      return {\n        uri: result.totpSetup.uri,\n        secret: result.totpSetup.secret,\n        verifier: result.verifier,\n        totpId: result.totpSetup.totpId,\n      };\n    },\n\n    confirm: async (opts: {\n      code: string;\n      verifier: string;\n      totpId: string;\n    }): Promise<SignInResult> => {\n      const params: AuthParameters = {\n        flow: \"verify\",\n        code: opts.code,\n        totpId: opts.totpId,\n      };\n\n      const result = (\n        proxy\n          ? await proxyFetch({\n              action: \"auth:signIn\",\n              args: { request: { provider: \"totp\", params }, verifier: opts.verifier },\n            })\n          : await convex.action(requireApiRefs().signIn, {\n              request: { provider: \"totp\", params },\n              verifier: opts.verifier,\n            })\n      ) as SignInActionResult;\n      return completeSignIn(result, \"confirm\");\n    },\n\n    verify: async (opts: { code: string; verifier: string }): Promise<SignInResult> => {\n      const params: AuthParameters = {\n        flow: \"verify\",\n        code: opts.code,\n      };\n\n      const result = (\n        proxy\n          ? await proxyFetch({\n              action: \"auth:signIn\",\n              args: { request: { provider: \"totp\", params }, verifier: opts.verifier },\n            })\n          : await convex.action(requireApiRefs().signIn, {\n              request: { provider: \"totp\", params },\n              verifier: opts.verifier,\n            })\n      ) as SignInActionResult;\n      return completeSignIn(result, \"verify\");\n    },\n  };\n}\n"],"mappings":";;;AAIA,SAAS,iBACP,QAC6D;AAC7D,QAAO,OAAO,SAAS;;AAGzB,SAAS,kBACP,QAC8D;AAC9D,QAAO,OAAO,SAAS;;;AAIzB,SAAgB,iBAAiB,MAA8B;CAC7D,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBAAyB;CAE5E,MAAM,iBAAiB,OACrB,QACA,SAC0B;AAC1B,MAAI,CAAC,iBAAiB,OAAO,IAAI,CAAC,OAAO,QACvC,QAAO;GAAE,MAAM;GAAU,MAAM,UAAU;GAAmB;AAiB9D,SAfoB,MAAM,qBACxB,QACI;GACE,aAAa;GACb,QAAQ,EAAE,OAAO,OAAO,QAAQ,OAAO;GACvC,kBAAkB;GAClB,SAAS;IAAE,UAAU;IAAQ;IAAM;GACpC,GACD;GACE,aAAa;GACb,QAAQ,OAAO;GACf,kBAAkB;GAClB,SAAS;IAAE,UAAU;IAAQ;IAAM;GACpC,CACN,GACoB,EAAE,MAAM,YAAY,GAAG,EAAE,MAAM,WAAW;;AAGjE,QAAO;EACL,OAAO,OAAO,SAQR;GACJ,MAAM,SAAyB,EAAE,MAAM,SAAS;AAChD,OAAI,MAAM,KAAM,QAAO,OAAO,KAAK;AACnC,OAAI,MAAM,YAAa,QAAO,cAAc,KAAK;AAEjD,OAAI,OAAO;IACT,MAAMA,WAAU,MAAM,WAAW;KAC/B,QAAQ;KACR,MAAM,EAAE,SAAS;MAAE,UAAU;MAAQ;MAAQ,EAAE;KAChD,CAAC;AACF,QAAI,CAAC,kBAAkBA,SAAO,CAC5B,OAAM,IAAI,MAAM,yCAAyC;AAE3D,WAAO;KACL,KAAKA,SAAO,UAAU;KACtB,QAAQA,SAAO,UAAU;KACzB,UAAUA,SAAO;KACjB,QAAQA,SAAO,UAAU;KAC1B;;GAGH,MAAM,SAAU,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ,EAC3D,SAAS;IAAE,UAAU;IAAQ;IAAQ,EACtC,CAAC;AACF,OAAI,CAAC,kBAAkB,OAAO,CAC5B,OAAM,IAAI,MAAM,yCAAyC;AAE3D,UAAO;IACL,KAAK,OAAO,UAAU;IACtB,QAAQ,OAAO,UAAU;IACzB,UAAU,OAAO;IACjB,QAAQ,OAAO,UAAU;IAC1B;;EAGH,SAAS,OAAO,SAIa;GAC3B,MAAM,SAAyB;IAC7B,MAAM;IACN,MAAM,KAAK;IACX,QAAQ,KAAK;IACd;AAaD,UAAO,eAVL,QACI,MAAM,WAAW;IACf,QAAQ;IACR,MAAM;KAAE,SAAS;MAAE,UAAU;MAAQ;MAAQ;KAAE,UAAU,KAAK;KAAU;IACzE,CAAC,GACF,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3C,SAAS;KAAE,UAAU;KAAQ;KAAQ;IACrC,UAAU,KAAK;IAChB,CAAC,EAEsB,UAAU;;EAG1C,QAAQ,OAAO,SAAoE;GACjF,MAAM,SAAyB;IAC7B,MAAM;IACN,MAAM,KAAK;IACZ;AAaD,UAAO,eAVL,QACI,MAAM,WAAW;IACf,QAAQ;IACR,MAAM;KAAE,SAAS;MAAE,UAAU;MAAQ;MAAQ;KAAE,UAAU,KAAK;KAAU;IACzE,CAAC,GACF,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3C,SAAS;KAAE,UAAU;KAAQ;KAAQ;IACrC,UAAU,KAAK;IAChB,CAAC,EAEsB,SAAS;;EAE1C"}

package/dist/client/factors/webauthn.js

@@ -7,10 +7,10 @@
 function createWebAuthnClientCore(deps, ceremony) {
 	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
 	const requestSignIn = async (params, verifier, continuation) => {
-		const args = {
+		const args = { request: {
 			provider: "webauthn",
 			params
-		};
+		} };
 		if (verifier !== void 0) args.verifier = verifier;
 		if (continuation !== void 0) args.continuation = continuation;
 		if (proxy) return await proxyFetch({
@@ -42,6 +42,9 @@ function createWebAuthnClientCore(deps, ceremony) {
 	const completeRegistration = async (result, opts) => {
 		return await handleSignedInResult(await requestSignIn(await ceremony.register(result.options, opts), result.verifier, result.continuation), "rotate");
 	};
+	const completeSignIn = async (result, opts) => {
+		return await handleSignedInResult(await requestSignIn(await ceremony.signIn(result.options, opts), result.verifier, result.continuation), "signIn");
+	};
 	return {
 		isSupported: () => ceremony.isSupported(),
 		isAutofillSupported: () => ceremony.isAutofillSupported(),
@@ -55,6 +58,7 @@ function createWebAuthnClientCore(deps, ceremony) {
 			return handleSignedInResult(await requestSignIn(await ceremony.register(phase1.options, opts), phase1.verifier), "verify");
 		},
 		completeRegistration,
+		completeSignIn,
 		signIn: async (opts) => {
 			const phase1 = await requestSignIn({
 				flow: "signIn",

package/dist/client/factors/webauthn.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.js","names":[],"sources":["../../../src/client/factors/webauthn.ts"],"sourcesContent":["/**\n * Platform-neutral WebAuthn client core.\n *\n * Owns the two-phase server handshake shared by every platform: request the\n * ceremony options, run the platform's WebAuthn ceremony via the injected\n * {@link WebAuthnCeremony} hook, then submit the ceremony result. Platform\n * entrypoints (`browser`, `expo`) supply only the ceremony.\n *\n * @module\n */\n\nimport type {\n  FactorDeps,\n  WebAuthnClient,\n  WebAuthnRegisterOptions,\n  WebAuthnSignInOptions,\n  WebAuthnRotationResult,\n  SignInActionResult,\n  SignInResult,\n} from \"../core/types\";\nimport type { AuthParameters } from \"../../shared/results\";\n\ntype WebAuthnSignInRequest = {\n  provider: \"webauthn\";\n  params: AuthParameters;\n  verifier?: string;\n  continuation?: string;\n};\n\n/**\n * Platform-specific WebAuthn ceremony hooks. Each returns the phase-2 params\n * submitted to the server verifier for the corresponding flow.\n *\n * @internal\n */\nexport interface WebAuthnCeremony {\n  /** Runtime capability probes surfaced on the {@link WebAuthnClient}. */\n  isSupported(): boolean;\n  isAutofillSupported(): Promise<boolean>;\n  /**\n   * Run the credential-creation ceremony for the given server options and\n   * registration hints, returning the phase-2 verification params.\n   */\n  register(options: unknown, opts: WebAuthnRegisterOptions | undefined): Promise<AuthParameters>;\n  /**\n   * Run the credential-assertion ceremony for the given server options and\n   * sign-in hints, returning the phase-2 verification params.\n   */\n  signIn(options: unknown, opts: WebAuthnSignInOptions | undefined): Promise<AuthParameters>;\n}\n\n/**\n * Build the platform-neutral passkey client around a platform ceremony.\n *\n * @internal\n */\nexport function createWebAuthnClientCore(\n  deps: FactorDeps,\n  ceremony: WebAuthnCeremony,\n): WebAuthnClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;\n\n  const requestSignIn = async (\n    params: AuthParameters,\n    verifier?: string,\n    continuation?: string,\n  ): Promise<SignInActionResult> => {\n    const args: WebAuthnSignInRequest = { provider: \"webauthn\", params };\n    if (verifier !== undefined) args.verifier = verifier;\n    if (continuation !== undefined) args.continuation = continuation;\n    if (proxy) {\n      return (await proxyFetch({\n        action: \"auth:signIn\",\n        args,\n      })) as SignInActionResult;\n    }\n    return (await convex.action(requireApiRefs().signIn, args)) as SignInActionResult;\n  };\n\n  const handleSignedInResult = async (\n    result: SignInActionResult,\n    flow: string,\n  ): Promise<SignInResult> => {\n    if (result.kind !== \"signedIn\") {\n      return { kind: \"started\" as const };\n    }\n\n    const sessionEstablished = await setTokenAndMaybeWait(\n      proxy\n        ? {\n            shouldStore: false as const,\n            tokens: result.session === null ? null : { token: result.session.token },\n            waitForHandshake: true,\n            context: { provider: \"webauthn\", flow },\n          }\n        : {\n            shouldStore: true as const,\n            tokens: result.session,\n            waitForHandshake: true,\n            context: { provider: \"webauthn\", flow },\n          },\n    );\n\n    return sessionEstablished\n      ? ({ kind: \"signedIn\" as const } satisfies SignInResult)\n      : ({ kind: \"started\" as const } satisfies SignInResult);\n  };\n\n  const completeRegistration = async (\n    result: WebAuthnRotationResult,\n    opts?: WebAuthnRegisterOptions,\n  ) => {\n    const phase2Params = await ceremony.register(result.options, opts);\n    const phase2 = await requestSignIn(phase2Params, result.verifier, result.continuation);\n    return await handleSignedInResult(phase2, \"rotate\");\n  };\n\n  return {\n    isSupported: () => ceremony.isSupported(),\n    isAutofillSupported: () => ceremony.isAutofillSupported(),\n\n    register: async (opts?: WebAuthnRegisterOptions): Promise<SignInResult> => {\n      const phase1 = await requestSignIn({\n        flow: \"register\",\n        userName: opts?.userName,\n        userDisplayName: opts?.userDisplayName,\n      });\n      if (phase1.kind !== \"webauthnOptions\") {\n        throw new Error(\"Server did not return WebAuthn registration options\");\n      }\n      const phase2Params = await ceremony.register(phase1.options, opts);\n      const phase2 = await requestSignIn(phase2Params, phase1.verifier);\n      return handleSignedInResult(phase2, \"verify\");\n    },\n\n    completeRegistration,\n\n    signIn: async (opts?: WebAuthnSignInOptions): Promise<SignInResult> => {\n      const phase1 = await requestSignIn({ flow: \"signIn\", email: opts?.email });\n      if (phase1.kind !== \"webauthnOptions\") {\n        throw new Error(\"Server did not return WebAuthn authentication options\");\n      }\n      const phase2Params = await ceremony.signIn(phase1.options, opts);\n      const phase2 = await requestSignIn(phase2Params, phase1.verifier);\n      return handleSignedInResult(phase2, \"verify\");\n    },\n  };\n}\n"],"mappings":";;;;;;AAwDA,SAAgB,yBACd,MACA,UACgB;CAChB,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBAAyB;CAE5E,MAAM,gBAAgB,OACpB,QACA,UACA,iBACgC;EAChC,MAAM,OAA8B;GAAE,UAAU;GAAY;GAAQ;AACpE,MAAI,aAAa,OAAW,MAAK,WAAW;AAC5C,MAAI,iBAAiB,OAAW,MAAK,eAAe;AACpD,MAAI,MACF,QAAQ,MAAM,WAAW;GACvB,QAAQ;GACR;GACD,CAAC;AAEJ,SAAQ,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ,KAAK;;CAG5D,MAAM,uBAAuB,OAC3B,QACA,SAC0B;AAC1B,MAAI,OAAO,SAAS,WAClB,QAAO,EAAE,MAAM,WAAoB;AAmBrC,SAhB2B,MAAM,qBAC/B,QACI;GACE,aAAa;GACb,QAAQ,OAAO,YAAY,OAAO,OAAO,EAAE,OAAO,OAAO,QAAQ,OAAO;GACxE,kBAAkB;GAClB,SAAS;IAAE,UAAU;IAAY;IAAM;GACxC,GACD;GACE,aAAa;GACb,QAAQ,OAAO;GACf,kBAAkB;GAClB,SAAS;IAAE,UAAU;IAAY;IAAM;GACxC,CACN,GAGI,EAAE,MAAM,YAAqB,GAC7B,EAAE,MAAM,WAAoB;;CAGnC,MAAM,uBAAuB,OAC3B,QACA,SACG;AAGH,SAAO,MAAM,qBADE,MAAM,cADA,MAAM,SAAS,SAAS,OAAO,SAAS,KAAK,EACjB,OAAO,UAAU,OAAO,aAAa,EAC5C,SAAS;;AAGrD,QAAO;EACL,mBAAmB,SAAS,aAAa;EACzC,2BAA2B,SAAS,qBAAqB;EAEzD,UAAU,OAAO,SAA0D;GACzE,MAAM,SAAS,MAAM,cAAc;IACjC,MAAM;IACN,UAAU,MAAM;IAChB,iBAAiB,MAAM;IACxB,CAAC;AACF,OAAI,OAAO,SAAS,kBAClB,OAAM,IAAI,MAAM,sDAAsD;AAIxE,UAAO,qBADQ,MAAM,cADA,MAAM,SAAS,SAAS,OAAO,SAAS,KAAK,EACjB,OAAO,SAAS,EAC7B,SAAS;;EAG/C;EAEA,QAAQ,OAAO,SAAwD;GACrE,MAAM,SAAS,MAAM,cAAc;IAAE,MAAM;IAAU,OAAO,MAAM;IAAO,CAAC;AAC1E,OAAI,OAAO,SAAS,kBAClB,OAAM,IAAI,MAAM,wDAAwD;AAI1E,UAAO,qBADQ,MAAM,cADA,MAAM,SAAS,OAAO,OAAO,SAAS,KAAK,EACf,OAAO,SAAS,EAC7B,SAAS;;EAEhD"}
+{"version":3,"file":"webauthn.js","names":[],"sources":["../../../src/client/factors/webauthn.ts"],"sourcesContent":["/**\n * Platform-neutral WebAuthn client core.\n *\n * Owns the two-phase server handshake shared by every platform: request the\n * ceremony options, run the platform's WebAuthn ceremony via the injected\n * {@link WebAuthnCeremony} hook, then submit the ceremony result. Platform\n * entrypoints (`browser`, `expo`) supply only the ceremony.\n *\n * @module\n */\n\nimport type {\n  FactorDeps,\n  WebAuthnClient,\n  WebAuthnRegisterOptions,\n  WebAuthnSignInOptions,\n  WebAuthnRotationResult,\n  WebAuthnContinuationSignInResult,\n  SignInActionResult,\n  SignInResult,\n} from \"../core/types\";\nimport type { AuthParameters } from \"../../shared/results\";\n\ntype WebAuthnSignInRequest = {\n  request: { provider: \"webauthn\"; params: AuthParameters };\n  verifier?: string;\n  continuation?: string;\n};\n\n/**\n * Platform-specific WebAuthn ceremony hooks. Each returns the phase-2 params\n * submitted to the server verifier for the corresponding flow.\n *\n * @internal\n */\nexport interface WebAuthnCeremony {\n  /** Runtime capability probes surfaced on the {@link WebAuthnClient}. */\n  isSupported(): boolean;\n  isAutofillSupported(): Promise<boolean>;\n  /**\n   * Run the credential-creation ceremony for the given server options and\n   * registration hints, returning the phase-2 verification params.\n   */\n  register(options: unknown, opts: WebAuthnRegisterOptions | undefined): Promise<AuthParameters>;\n  /**\n   * Run the credential-assertion ceremony for the given server options and\n   * sign-in hints, returning the phase-2 verification params.\n   */\n  signIn(options: unknown, opts: WebAuthnSignInOptions | undefined): Promise<AuthParameters>;\n}\n\n/**\n * Build the platform-neutral passkey client around a platform ceremony.\n *\n * @internal\n */\nexport function createWebAuthnClientCore(\n  deps: FactorDeps,\n  ceremony: WebAuthnCeremony,\n): WebAuthnClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;\n\n  const requestSignIn = async (\n    params: AuthParameters,\n    verifier?: string,\n    continuation?: string,\n  ): Promise<SignInActionResult> => {\n    const args: WebAuthnSignInRequest = { request: { provider: \"webauthn\", params } };\n    if (verifier !== undefined) args.verifier = verifier;\n    if (continuation !== undefined) args.continuation = continuation;\n    if (proxy) {\n      return (await proxyFetch({\n        action: \"auth:signIn\",\n        args,\n      })) as SignInActionResult;\n    }\n    return (await convex.action(requireApiRefs().signIn, args)) as SignInActionResult;\n  };\n\n  const handleSignedInResult = async (\n    result: SignInActionResult,\n    flow: string,\n  ): Promise<SignInResult> => {\n    if (result.kind !== \"signedIn\") {\n      return { kind: \"started\" as const };\n    }\n\n    const sessionEstablished = await setTokenAndMaybeWait(\n      proxy\n        ? {\n            shouldStore: false as const,\n            tokens: result.session === null ? null : { token: result.session.token },\n            waitForHandshake: true,\n            context: { provider: \"webauthn\", flow },\n          }\n        : {\n            shouldStore: true as const,\n            tokens: result.session,\n            waitForHandshake: true,\n            context: { provider: \"webauthn\", flow },\n          },\n    );\n\n    return sessionEstablished\n      ? ({ kind: \"signedIn\" as const } satisfies SignInResult)\n      : ({ kind: \"started\" as const } satisfies SignInResult);\n  };\n\n  const completeRegistration = async (\n    result: WebAuthnRotationResult,\n    opts?: WebAuthnRegisterOptions,\n  ) => {\n    const phase2Params = await ceremony.register(result.options, opts);\n    const phase2 = await requestSignIn(phase2Params, result.verifier, result.continuation);\n    return await handleSignedInResult(phase2, \"rotate\");\n  };\n\n  const completeSignIn = async (\n    result: WebAuthnContinuationSignInResult,\n    opts?: WebAuthnSignInOptions,\n  ) => {\n    const phase2Params = await ceremony.signIn(result.options, opts);\n    const phase2 = await requestSignIn(phase2Params, result.verifier, result.continuation);\n    return await handleSignedInResult(phase2, \"signIn\");\n  };\n\n  return {\n    isSupported: () => ceremony.isSupported(),\n    isAutofillSupported: () => ceremony.isAutofillSupported(),\n\n    register: async (opts?: WebAuthnRegisterOptions): Promise<SignInResult> => {\n      const phase1 = await requestSignIn({\n        flow: \"register\",\n        userName: opts?.userName,\n        userDisplayName: opts?.userDisplayName,\n      });\n      if (phase1.kind !== \"webauthnOptions\") {\n        throw new Error(\"Server did not return WebAuthn registration options\");\n      }\n      const phase2Params = await ceremony.register(phase1.options, opts);\n      const phase2 = await requestSignIn(phase2Params, phase1.verifier);\n      return handleSignedInResult(phase2, \"verify\");\n    },\n\n    completeRegistration,\n    completeSignIn,\n\n    signIn: async (opts?: WebAuthnSignInOptions): Promise<SignInResult> => {\n      const phase1 = await requestSignIn({ flow: \"signIn\", email: opts?.email });\n      if (phase1.kind !== \"webauthnOptions\") {\n        throw new Error(\"Server did not return WebAuthn authentication options\");\n      }\n      const phase2Params = await ceremony.signIn(phase1.options, opts);\n      const phase2 = await requestSignIn(phase2Params, phase1.verifier);\n      return handleSignedInResult(phase2, \"verify\");\n    },\n  };\n}\n"],"mappings":";;;;;;AAwDA,SAAgB,yBACd,MACA,UACgB;CAChB,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBAAyB;CAE5E,MAAM,gBAAgB,OACpB,QACA,UACA,iBACgC;EAChC,MAAM,OAA8B,EAAE,SAAS;GAAE,UAAU;GAAY;GAAQ,EAAE;AACjF,MAAI,aAAa,OAAW,MAAK,WAAW;AAC5C,MAAI,iBAAiB,OAAW,MAAK,eAAe;AACpD,MAAI,MACF,QAAQ,MAAM,WAAW;GACvB,QAAQ;GACR;GACD,CAAC;AAEJ,SAAQ,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ,KAAK;;CAG5D,MAAM,uBAAuB,OAC3B,QACA,SAC0B;AAC1B,MAAI,OAAO,SAAS,WAClB,QAAO,EAAE,MAAM,WAAoB;AAmBrC,SAhB2B,MAAM,qBAC/B,QACI;GACE,aAAa;GACb,QAAQ,OAAO,YAAY,OAAO,OAAO,EAAE,OAAO,OAAO,QAAQ,OAAO;GACxE,kBAAkB;GAClB,SAAS;IAAE,UAAU;IAAY;IAAM;GACxC,GACD;GACE,aAAa;GACb,QAAQ,OAAO;GACf,kBAAkB;GAClB,SAAS;IAAE,UAAU;IAAY;IAAM;GACxC,CACN,GAGI,EAAE,MAAM,YAAqB,GAC7B,EAAE,MAAM,WAAoB;;CAGnC,MAAM,uBAAuB,OAC3B,QACA,SACG;AAGH,SAAO,MAAM,qBADE,MAAM,cADA,MAAM,SAAS,SAAS,OAAO,SAAS,KAAK,EACjB,OAAO,UAAU,OAAO,aAAa,EAC5C,SAAS;;CAGrD,MAAM,iBAAiB,OACrB,QACA,SACG;AAGH,SAAO,MAAM,qBADE,MAAM,cADA,MAAM,SAAS,OAAO,OAAO,SAAS,KAAK,EACf,OAAO,UAAU,OAAO,aAAa,EAC5C,SAAS;;AAGrD,QAAO;EACL,mBAAmB,SAAS,aAAa;EACzC,2BAA2B,SAAS,qBAAqB;EAEzD,UAAU,OAAO,SAA0D;GACzE,MAAM,SAAS,MAAM,cAAc;IACjC,MAAM;IACN,UAAU,MAAM;IAChB,iBAAiB,MAAM;IACxB,CAAC;AACF,OAAI,OAAO,SAAS,kBAClB,OAAM,IAAI,MAAM,sDAAsD;AAIxE,UAAO,qBADQ,MAAM,cADA,MAAM,SAAS,SAAS,OAAO,SAAS,KAAK,EACjB,OAAO,SAAS,EAC7B,SAAS;;EAG/C;EACA;EAEA,QAAQ,OAAO,SAAwD;GACrE,MAAM,SAAS,MAAM,cAAc;IAAE,MAAM;IAAU,OAAO,MAAM;IAAO,CAAC;AAC1E,OAAI,OAAO,SAAS,kBAClB,OAAM,IAAI,MAAM,wDAAwD;AAI1E,UAAO,qBADQ,MAAM,cADA,MAAM,SAAS,OAAO,OAAO,SAAS,KAAK,EACf,OAAO,SAAS,EAC7B,SAAS;;EAEhD"}

package/dist/client/index.d.ts

@@ -1,4 +1,7 @@
-import { AnonymousParams, AuthApiRefs, AuthClient, AuthState, ClientOptions, ClientRuntime, CodeCompletionParams, ConnectionParams, DeviceClient, DeviceCodeResult, DevicePollParams, DeviceVerifyParams, EmailInitiateParams, OAuthCompletionResult, OAuthSignInParams, ParamsForProvider, PasswordParams, PendingInvite, PlatformAuthClient, SignInOverloads, SignInResult, Storage, TotpClient, TotpConfirmParams, TotpSetupOptions, TotpSetupResult, TotpVerifyParams, WebAuthnClient, WebAuthnRegisterOptions, WebAuthnSignInOptions } from "./core/types.js";
+import { AnonymousParams, ConnectionParams, PasswordParams } from "../shared/params.js";
+import { ErrorCode } from "../shared/codes.js";
+import { AuthApiRefs, AuthClient, AuthState, ClientOptions, ClientRuntime, CodeCompletionParams, DeviceClient, DeviceCodeResult, DevicePollParams, DeviceVerifyParams, EmailInitiateParams, OAuthCompletionResult, OAuthSignInParams, PendingInvite, PlatformAuthClient, SignInResult, Storage, TotpClient, TotpConfirmParams, TotpSetupOptions, TotpSetupResult, TotpVerifyParams, WebAuthnClient, WebAuthnRegisterOptions, WebAuthnSignInOptions } from "./core/types.js";
+import { HandshakeErrorCode } from "./errors.js";
 
 //#region src/client/index.d.ts
 /**
@@ -54,7 +57,7 @@ import { AnonymousParams, AuthApiRefs, AuthClient, AuthState, ClientOptions, Cli
  * @throws {Error} When `token` has leading or trailing whitespace. An empty or
  *   whitespace-only string is treated as an explicit signed-out seed, not an error.
  */
-declare function client<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs>(options: ClientOptions<Api>): AuthClient<Api>;
+declare function client<Api extends AuthApiRefs = AuthApiRefs>(options: ClientOptions<Api>): AuthClient<Api>;
 //#endregion
-export { type AnonymousParams, type AuthApiRefs, type AuthClient, type AuthState, type ClientOptions, type ClientRuntime, type CodeCompletionParams, type ConnectionParams, type DeviceClient, type DeviceCodeResult, type DevicePollParams, type DeviceVerifyParams, type EmailInitiateParams, type OAuthCompletionResult, type OAuthSignInParams, type ParamsForProvider, type PasswordParams, type PendingInvite, type PlatformAuthClient, type SignInOverloads, type SignInResult, type Storage, type TotpClient, type TotpConfirmParams, type TotpSetupOptions, type TotpSetupResult, type TotpVerifyParams, type WebAuthnClient, type WebAuthnRegisterOptions, type WebAuthnSignInOptions, client };
+export { type AnonymousParams, type AuthClient, type AuthState, type ClientOptions, type ClientRuntime, type CodeCompletionParams, type ConnectionParams, type DeviceClient, type DeviceCodeResult, type DevicePollParams, type DeviceVerifyParams, type EmailInitiateParams, ErrorCode, type ErrorCode as ErrorCodeValue, HandshakeErrorCode, type HandshakeErrorCode as HandshakeErrorCodeValue, type OAuthCompletionResult, type OAuthSignInParams, type PasswordParams, type PendingInvite, type PlatformAuthClient, type SignInResult, type Storage, type TotpClient, type TotpConfirmParams, type TotpSetupOptions, type TotpSetupResult, type TotpVerifyParams, type WebAuthnClient, type WebAuthnRegisterOptions, type WebAuthnSignInOptions, client };
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/client/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsQgB,MAAA,aAAmB,WAAA,8BAAyC,WAAA,CAAA,CAC1E,OAAA,EAAS,aAAA,CAAc,GAAA,IACtB,UAAA,CAAW,GAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/client/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqQgB,MAAA,aAAmB,WAAA,GAAc,WAAA,CAAA,CAC/C,OAAA,EAAS,aAAA,CAAc,GAAA,IACtB,UAAA,CAAW,GAAA"}

package/dist/client/index.js

@@ -1,7 +1,8 @@
 import { LOG_LEVELS, logMessage } from "../shared/log.js";
 import { retryWithBackoff } from "../shared/retry.js";
 import { createDeferred } from "./core/types.js";
-import { createHandshakeError } from "./errors.js";
+import { ErrorCode } from "../shared/codes.js";
+import { HandshakeErrorCode, createHandshakeError } from "./errors.js";
 import { createDeviceClient } from "./factors/device.js";
 import { createTotpClient } from "./factors/totp.js";
 import { createInviteManager } from "./runtime/invite.js";
@@ -498,9 +499,9 @@ function client(options) {
 	const webauthnAdapter = adapters.webauthn ?? adapterFactories.webauthn?.(adapterDeps);
 	const verifyCode = async (args) => {
 		return retryWithJitteredBackoff(() => requireHttpClient().action(requireApiRefs().signIn, "code" in args ? {
-			params: { code: args.code },
+			request: { params: { code: args.code } },
 			verifier: args.verifier
-		} : args), isTransientNetworkError);
+		} : { request: args }), isTransientNetworkError);
 	};
 	const normalizeDeviceCodeResult = (device_code) => {
 		const input = device_code;
@@ -597,7 +598,7 @@ function client(options) {
 			};
 			if (result.kind === "webauthnOptions" && "operation" in result) {
 				if (!webauthnAdapter) throw new Error("This client does not support WebAuthn continuations.");
-				return await webauthnAdapter.completeRegistration(result);
+				return result.operation === "rotate" ? await webauthnAdapter.completeRegistration(result) : await webauthnAdapter.completeSignIn(result);
 			}
 			if (result.kind === "signedIn") return await setTokenAndMaybeWait(resultOptions.shouldStore ? {
 				shouldStore: true,
@@ -625,10 +626,10 @@ function client(options) {
 		const runSignInAction = async () => {
 			if (proxy) return await handleSignInActionResult(await proxyFetch({
 				action: "auth:signIn",
-				args: {
+				args: { request: provider === void 0 ? { params } : {
 					provider,
 					params
-				}
+				} }
 			}), {
 				shouldStore: false,
 				persistVerifier: false
@@ -636,8 +637,10 @@ function client(options) {
 			const verifier = await storageGet(VERIFIER_STORAGE_KEY) ?? void 0;
 			try {
 				const result = await convex.action(requireApiRefs().signIn, {
-					provider,
-					params,
+					request: provider === void 0 ? { params } : {
+						provider,
+						params
+					},
 					verifier
 				});
 				if (params.code !== void 0) await storageRemove(VERIFIER_STORAGE_KEY);
@@ -724,7 +727,7 @@ function client(options) {
 				try {
 					const result = await retryWithJitteredBackoff(() => proxyFetch({
 						action: "auth:signIn",
-						args: { refreshToken: true }
+						args: { request: { refreshToken: true } }
 					}), isRetriableProxyRefreshError);
 					if (destroyed || authEpoch !== epochAtRefreshStart) return token;
 					if (isSignedInResult(result) && result.session) {
@@ -977,5 +980,5 @@ function client(options) {
 }
 
 //#endregion
-export { client, resolveUrl };
+export { ErrorCode, HandshakeErrorCode, client, resolveUrl };
 //# sourceMappingURL=index.js.map