@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/component/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":["schema"],"sources":["../../src/component/user.ts"],"sourcesContent":["/**\n * `component.user.*` — the User entity surface.\n *\n * Reads collapse into one overloaded `get`; the rest are 1:1 verbs.\n *\n * @module\n */\n\nimport { stream } from \"convex-helpers/server/stream\";\nimport { partial } from \"convex-helpers/validators\";\nimport { paginationOptsValidator } from \"convex/server\";\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../shared/codes\";\n\nimport { mutation, query } from \"./functions\";\nimport { vPaginated, vUserDoc } from \"./model\";\nimport schema from \"./schema\";\n\nconst vUserInsertData = v.object(schema.tables.User.validator.fields);\n\nconst vUserPatchData = v.object(partial(schema.tables.User.validator.fields));\n\nconst CASCADE_MAX = 1000;\n\nconst tooMany = (count: number) => count > CASCADE_MAX;\n\n/**\n * Read a user by identity. One overloaded function (single Convex\n * function with a unioned `args`/`returns`). Accepts exactly one\n * selector:\n *\n * - `{ id }`           → `Doc<\"User\"> | null`\n * - `{ ids }`          → `(Doc<\"User\"> | null)[]` (order preserved, deduped)\n * - `{ verifiedEmail }`→ `Doc<\"User\"> | null` (exactly-one-or-null)\n * - `{ verifiedPhone }`→ `Doc<\"User\"> | null` (exactly-one-or-null)\n *\n * @example\n * ```ts\n * await ctx.runQuery(component.user.get, { id: userId });\n * await ctx.runQuery(component.user.get, { ids: memberIds });\n * await ctx.runQuery(component.user.get, { verifiedEmail: \"a@b.com\" });\n * ```\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"User\")),\n    ids: v.optional(v.array(v.id(\"User\"))),\n    verifiedEmail: v.optional(v.string()),\n    verifiedPhone: v.optional(v.string()),\n  },\n  returns: v.union(vUserDoc, v.null(), v.array(v.union(vUserDoc, v.null()))),\n  handler: async (ctx, args) => {\n    if (args.ids !== undefined) {\n      if (args.ids.length === 0) return [];\n      const unique = Array.from(new Set(args.ids));\n      const docs = await Promise.all(unique.map((id) => ctx.db.get(\"User\", id)));\n      const byId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));\n      return args.ids.map((id) => byId.get(id) ?? null);\n    }\n    if (args.verifiedEmail !== undefined) {\n      const users = await ctx.db\n        .query(\"User\")\n        .withIndex(\"email_verified\", (q) =>\n          q.eq(\"email\", args.verifiedEmail!).gt(\"emailVerificationTime\", undefined),\n        )\n        .take(2);\n      return users.length === 1 ? users[0] : null;\n    }\n    if (args.verifiedPhone !== undefined) {\n      const users = await ctx.db\n        .query(\"User\")\n        .withIndex(\"phone_verified\", (q) =>\n          q.eq(\"phone\", args.verifiedPhone!).gt(\"phoneVerificationTime\", undefined),\n        )\n        .take(2);\n      return users.length === 1 ? users[0] : null;\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"User\", args.id);\n  },\n});\n\n/** List users, paginated, with optional `where` filters and ordering. */\nexport const list = query({\n  args: {\n    where: v.optional(\n      v.object({\n        email: v.optional(v.string()),\n        phone: v.optional(v.string()),\n        isAnonymous: v.optional(v.boolean()),\n        name: v.optional(v.string()),\n      }),\n    ),\n    paginationOpts: paginationOptsValidator,\n    orderBy: v.optional(\n      v.union(\n        v.literal(\"_creationTime\"),\n        v.literal(\"name\"),\n        v.literal(\"email\"),\n        v.literal(\"phone\"),\n      ),\n    ),\n    order: v.optional(v.union(v.literal(\"asc\"), v.literal(\"desc\"))),\n  },\n  returns: vPaginated(vUserDoc),\n  handler: async (ctx, args) => {\n    const where = args.where ?? {};\n    const order = args.order ?? \"desc\";\n    const orderBy = args.orderBy ?? \"_creationTime\";\n\n    const base = stream(ctx.db, schema).query(\"User\");\n    let q;\n    if (orderBy === \"email\" || where.email !== undefined) {\n      q =\n        where.email !== undefined\n          ? base.withIndex(\"email\", (idx) => idx.eq(\"email\", where.email!))\n          : base.withIndex(\"email\");\n    } else if (orderBy === \"phone\" || where.phone !== undefined) {\n      q =\n        where.phone !== undefined\n          ? base.withIndex(\"phone\", (idx) => idx.eq(\"phone\", where.phone!))\n          : base.withIndex(\"phone\");\n    } else {\n      q = base;\n    }\n\n    return await q\n      .order(order)\n      .filterWith(\n        async (d) =>\n          (where.isAnonymous === undefined || d.isAnonymous === where.isAnonymous) &&\n          (where.name === undefined || d.name === where.name) &&\n          (where.email === undefined || d.email === where.email) &&\n          (where.phone === undefined || d.phone === where.phone),\n      )\n      .paginate(args.paginationOpts);\n  },\n});\n\n/** Insert a new user. */\nexport const create = mutation({\n  args: { data: vUserInsertData },\n  returns: v.id(\"User\"),\n  handler: async (ctx, { data }) => {\n    return await ctx.db.insert(\"User\", data);\n  },\n});\n\n/** Insert a user, or patch it when `id` is supplied. Returns the user id. */\nexport const upsert = mutation({\n  args: { id: v.optional(v.id(\"User\")), data: vUserInsertData },\n  returns: v.id(\"User\"),\n  handler: async (ctx, { id, data }) => {\n    if (id !== undefined) {\n      await ctx.db.patch(\"User\", id, data);\n      return id;\n    }\n    return await ctx.db.insert(\"User\", data);\n  },\n});\n\n/** Patch fields on a user. */\nexport const update = mutation({\n  args: { id: v.id(\"User\"), patch: vUserPatchData },\n  returns: v.null(),\n  handler: async (ctx, { id, patch }) => {\n    await ctx.db.patch(\"User\", id, patch);\n    return null;\n  },\n});\n\n/** Delete a user and all auth-owned child rows, bounded per table. */\nconst remove = mutation({\n  args: { id: v.id(\"User\") },\n  returns: v.null(),\n  handler: async (ctx, { id: userId }) => {\n    const user = await ctx.db.get(\"User\", userId);\n    if (user === null) return null;\n    const [sessions, accounts, keys, members, passkeys, totps] = await Promise.all([\n      ctx.db\n        .query(\"Session\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"Account\")\n        .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"ApiKey\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"GroupMember\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"Passkey\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"TotpFactor\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n    ]);\n    if (\n      tooMany(sessions.length) ||\n      tooMany(accounts.length) ||\n      tooMany(keys.length) ||\n      tooMany(members.length) ||\n      tooMany(passkeys.length) ||\n      tooMany(totps.length)\n    ) {\n      throw new ConvexError({\n        code: ErrorCode.CASCADE_TOO_LARGE,\n        message: `User has more than ${CASCADE_MAX} child rows in one or more tables; cascade delete is not safe in a single mutation. Delete child rows in bounded batches, then retry.`,\n      });\n    }\n    const refreshTokens =\n      sessions.length > 0\n        ? (\n            await Promise.all(\n              sessions.map((s) =>\n                ctx.db\n                  .query(\"RefreshToken\")\n                  .withIndex(\"session_id\", (q) => q.eq(\"sessionId\", s._id))\n                  .take(CASCADE_MAX + 1),\n              ),\n            )\n          ).flat()\n        : [];\n    if (tooMany(refreshTokens.length)) {\n      throw new ConvexError({\n        code: ErrorCode.CASCADE_TOO_LARGE,\n        message: `User has more than ${CASCADE_MAX} refresh tokens across sessions; cascade delete is not safe in a single mutation.`,\n      });\n    }\n    await Promise.all([\n      ...sessions.map((s) => ctx.db.delete(\"Session\", s._id)),\n      ...refreshTokens.map((r) => ctx.db.delete(\"RefreshToken\", r._id)),\n      ...accounts.map((a) => ctx.db.delete(\"Account\", a._id)),\n      ...keys.map((k) => ctx.db.delete(\"ApiKey\", k._id)),\n      ...members.map((m) => ctx.db.delete(\"GroupMember\", m._id)),\n      ...passkeys.map((p) => ctx.db.delete(\"Passkey\", p._id)),\n      ...totps.map((t) => ctx.db.delete(\"TotpFactor\", t._id)),\n    ]);\n    const ownedEmails = await ctx.db\n      .query(\"UserEmail\")\n      .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n      .take(CASCADE_MAX + 1);\n    if (tooMany(ownedEmails.length)) {\n      throw new ConvexError({\n        code: ErrorCode.CASCADE_TOO_LARGE,\n        message: `User has more than ${CASCADE_MAX} emails; cascade delete is not safe in a single mutation.`,\n      });\n    }\n    await Promise.all(ownedEmails.map((e) => ctx.db.delete(\"UserEmail\", e._id)));\n\n    await ctx.db.delete(\"User\", userId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,MAAM,kBAAkB,EAAE,OAAOA,eAAO,OAAO,KAAK,UAAU,OAAO;AAErE,MAAM,iBAAiB,EAAE,OAAO,QAAQA,eAAO,OAAO,KAAK,UAAU,OAAO,CAAC;AAE7E,MAAM,cAAc;AAEpB,MAAM,WAAW,UAAkB,QAAQ;;;;;;;;;;;;;;;;;;AAmB3C,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAC5B,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;EACtC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACtC;CACD,SAAS,EAAE,MAAM,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1E,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,QAAQ,QAAW;AAC1B,OAAI,KAAK,IAAI,WAAW,EAAG,QAAO,EAAE;GACpC,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC;GAC5C,MAAM,OAAO,MAAM,QAAQ,IAAI,OAAO,KAAK,OAAO,IAAI,GAAG,IAAI,QAAQ,GAAG,CAAC,CAAC;GAC1E,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC;AAClE,UAAO,KAAK,IAAI,KAAK,OAAO,KAAK,IAAI,GAAG,IAAI,KAAK;;AAEnD,MAAI,KAAK,kBAAkB,QAAW;GACpC,MAAM,QAAQ,MAAM,IAAI,GACrB,MAAM,OAAO,CACb,UAAU,mBAAmB,MAC5B,EAAE,GAAG,SAAS,KAAK,cAAe,CAAC,GAAG,yBAAyB,OAAU,CAC1E,CACA,KAAK,EAAE;AACV,UAAO,MAAM,WAAW,IAAI,MAAM,KAAK;;AAEzC,MAAI,KAAK,kBAAkB,QAAW;GACpC,MAAM,QAAQ,MAAM,IAAI,GACrB,MAAM,OAAO,CACb,UAAU,mBAAmB,MAC5B,EAAE,GAAG,SAAS,KAAK,cAAe,CAAC,GAAG,yBAAyB,OAAU,CAC1E,CACA,KAAK,EAAE;AACV,UAAO,MAAM,WAAW,IAAI,MAAM,KAAK;;AAEzC,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,QAAQ,KAAK,GAAG;;CAE3C,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,OAAO,EAAE,SACP,EAAE,OAAO;GACP,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC7B,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;GACpC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC7B,CAAC,CACH;EACD,gBAAgB;EAChB,SAAS,EAAE,SACT,EAAE,MACA,EAAE,QAAQ,gBAAgB,EAC1B,EAAE,QAAQ,OAAO,EACjB,EAAE,QAAQ,QAAQ,EAClB,EAAE,QAAQ,QAAQ,CACnB,CACF;EACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,CAAC,CAAC;EAChE;CACD,SAAS,WAAW,SAAS;CAC7B,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,QAAQ,KAAK,SAAS,EAAE;EAC9B,MAAM,QAAQ,KAAK,SAAS;EAC5B,MAAM,UAAU,KAAK,WAAW;EAEhC,MAAM,OAAO,OAAO,IAAI,IAAIA,eAAO,CAAC,MAAM,OAAO;EACjD,IAAI;AACJ,MAAI,YAAY,WAAW,MAAM,UAAU,OACzC,KACE,MAAM,UAAU,SACZ,KAAK,UAAU,UAAU,QAAQ,IAAI,GAAG,SAAS,MAAM,MAAO,CAAC,GAC/D,KAAK,UAAU,QAAQ;WACpB,YAAY,WAAW,MAAM,UAAU,OAChD,KACE,MAAM,UAAU,SACZ,KAAK,UAAU,UAAU,QAAQ,IAAI,GAAG,SAAS,MAAM,MAAO,CAAC,GAC/D,KAAK,UAAU,QAAQ;MAE7B,KAAI;AAGN,SAAO,MAAM,EACV,MAAM,MAAM,CACZ,WACC,OAAO,OACJ,MAAM,gBAAgB,UAAa,EAAE,gBAAgB,MAAM,iBAC3D,MAAM,SAAS,UAAa,EAAE,SAAS,MAAM,UAC7C,MAAM,UAAU,UAAa,EAAE,UAAU,MAAM,WAC/C,MAAM,UAAU,UAAa,EAAE,UAAU,MAAM,OACnD,CACA,SAAS,KAAK,eAAe;;CAEnC,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM,EAAE,MAAM,iBAAiB;CAC/B,SAAS,EAAE,GAAG,OAAO;CACrB,SAAS,OAAO,KAAK,EAAE,WAAW;AAChC,SAAO,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK;;CAE3C,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAAE,MAAM;EAAiB;CAC7D,SAAS,EAAE,GAAG,OAAO;CACrB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW;AACpC,MAAI,OAAO,QAAW;AACpB,SAAM,IAAI,GAAG,MAAM,QAAQ,IAAI,KAAK;AACpC,UAAO;;AAET,SAAO,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK;;CAE3C,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EAAE,IAAI,EAAE,GAAG,OAAO;EAAE,OAAO;EAAgB;CACjD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,YAAY;AACrC,QAAM,IAAI,GAAG,MAAM,QAAQ,IAAI,MAAM;AACrC,SAAO;;CAEV,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE;CAC1B,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,aAAa;AAEtC,MADa,MAAM,IAAI,GAAG,IAAI,QAAQ,OAAO,KAChC,KAAM,QAAO;EAC1B,MAAM,CAAC,UAAU,UAAU,MAAM,SAAS,UAAU,SAAS,MAAM,QAAQ,IAAI;GAC7E,IAAI,GACD,MAAM,UAAU,CAChB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CAC5D,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,SAAS,CACf,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,cAAc,CACpB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,UAAU,CAChB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACzB,CAAC;AACF,MACE,QAAQ,SAAS,OAAO,IACxB,QAAQ,SAAS,OAAO,IACxB,QAAQ,KAAK,OAAO,IACpB,QAAQ,QAAQ,OAAO,IACvB,QAAQ,SAAS,OAAO,IACxB,QAAQ,MAAM,OAAO,CAErB,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,sBAAsB,YAAY;GAC5C,CAAC;EAEJ,MAAM,gBACJ,SAAS,SAAS,KAEZ,MAAM,QAAQ,IACZ,SAAS,KAAK,MACZ,IAAI,GACD,MAAM,eAAe,CACrB,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,EAAE,IAAI,CAAC,CACxD,KAAK,cAAc,EAAE,CACzB,CACF,EACD,MAAM,GACR,EAAE;AACR,MAAI,QAAQ,cAAc,OAAO,CAC/B,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,sBAAsB,YAAY;GAC5C,CAAC;AAEJ,QAAM,QAAQ,IAAI;GAChB,GAAG,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC;GACvD,GAAG,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,gBAAgB,EAAE,IAAI,CAAC;GACjE,GAAG,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC;GACvD,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG,OAAO,UAAU,EAAE,IAAI,CAAC;GAClD,GAAG,QAAQ,KAAK,MAAM,IAAI,GAAG,OAAO,eAAe,EAAE,IAAI,CAAC;GAC1D,GAAG,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC;GACvD,GAAG,MAAM,KAAK,MAAM,IAAI,GAAG,OAAO,cAAc,EAAE,IAAI,CAAC;GACxD,CAAC;EACF,MAAM,cAAc,MAAM,IAAI,GAC3B,MAAM,YAAY,CAClB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;AACxB,MAAI,QAAQ,YAAY,OAAO,CAC7B,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,sBAAsB,YAAY;GAC5C,CAAC;AAEJ,QAAM,QAAQ,IAAI,YAAY,KAAK,MAAM,IAAI,GAAG,OAAO,aAAa,EAAE,IAAI,CAAC,CAAC;AAE5E,QAAM,IAAI,GAAG,OAAO,QAAQ,OAAO;AACnC,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"user.js","names":["schema"],"sources":["../../src/component/user.ts"],"sourcesContent":["/**\n * `component.user.*` — the User entity surface.\n *\n * Reads collapse into one overloaded `get`; the rest are 1:1 verbs.\n *\n * @module\n */\n\nimport { stream } from \"convex-helpers/server/stream\";\nimport { paginationOptsValidator } from \"convex/server\";\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../shared/codes\";\n\nimport { mutation, query } from \"./_generated/server\";\nimport { assertBatchSelectorSize } from \"./batch\";\nimport type { Doc } from \"./_generated/dataModel\";\nimport { vUserDoc } from \"./documents\";\nimport { vPaginated } from \"./model\";\nimport schema from \"./schema\";\n\nconst vUserInsertData = schema.tables.User.validator.omit(\"sessionEpoch\");\n\nconst vUserPatchData = schema.tables.User.validator.partial();\n\n/**\n * Keep one complete user cascade within a single safe transaction.\n */\nconst CASCADE_MAX = 100;\n\nfunction assertCascadeSize(count: number) {\n  if (count > CASCADE_MAX) {\n    throw new ConvexError({\n      code: ErrorCode.CASCADE_TOO_LARGE,\n      message: `User cascade has more than ${CASCADE_MAX} dependent rows; delete child rows in bounded batches, then retry.`,\n    });\n  }\n}\n\nfunction uniqueRows<T extends { _id: string }>(rows: T[]) {\n  return Array.from(new Map(rows.map((row) => [row._id, row])).values());\n}\n\n/**\n * Read a user by identity. One overloaded function (single Convex\n * function with a unioned `args`/`returns`). Accepts exactly one\n * selector:\n *\n * - `{ id }`           → `Doc<\"User\"> | null`\n * - `{ ids }`          → `(Doc<\"User\"> | null)[]` (order preserved, deduped; max 100 IDs)\n * - `{ verifiedEmail }`→ `Doc<\"User\"> | null` (exactly-one-or-null)\n * - `{ verifiedPhone }`→ `Doc<\"User\"> | null` (exactly-one-or-null)\n *\n * @example\n * ```ts\n * await ctx.runQuery(component.user.get, { id: userId });\n * await ctx.runQuery(component.user.get, { ids: memberIds });\n * await ctx.runQuery(component.user.get, { verifiedEmail: \"a@b.com\" });\n * ```\n */\nexport const get = query({\n  args: {\n    id: v.optional(schema.id(\"User\")),\n    ids: v.optional(v.array(schema.id(\"User\"))),\n    verifiedEmail: v.optional(v.string()),\n    verifiedPhone: v.optional(v.string()),\n  },\n  returns: v.union(vUserDoc, v.null(), v.array(v.union(vUserDoc, v.null()))),\n  handler: async (ctx, args) => {\n    if (args.ids !== undefined) {\n      assertBatchSelectorSize(args.ids, \"ids\");\n      if (args.ids.length === 0) return [];\n      const unique = Array.from(new Set(args.ids));\n      const docs = await Promise.all(unique.map((id) => ctx.db.get(\"User\", id)));\n      const byId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));\n      return args.ids.map((id) => byId.get(id) ?? null);\n    }\n    if (args.verifiedEmail !== undefined) {\n      const users = await ctx.db\n        .query(\"User\")\n        .withIndex(\"email_verified\", (q) =>\n          q.eq(\"email\", args.verifiedEmail!).gt(\"emailVerificationTime\", undefined),\n        )\n        .take(2);\n      return users.length === 1 ? users[0] : null;\n    }\n    if (args.verifiedPhone !== undefined) {\n      const users = await ctx.db\n        .query(\"User\")\n        .withIndex(\"phone_verified\", (q) =>\n          q.eq(\"phone\", args.verifiedPhone!).gt(\"phoneVerificationTime\", undefined),\n        )\n        .take(2);\n      return users.length === 1 ? users[0] : null;\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"User\", args.id);\n  },\n});\n\n/** List users, paginated, with optional `where` filters and ordering. */\nexport const list = query({\n  args: {\n    where: v.optional(\n      v.object({\n        email: v.optional(v.string()),\n        phone: v.optional(v.string()),\n        isAnonymous: v.optional(v.boolean()),\n        name: v.optional(v.string()),\n      }),\n    ),\n    paginationOpts: paginationOptsValidator,\n    orderBy: v.optional(\n      v.union(\n        v.literal(\"_creationTime\"),\n        v.literal(\"name\"),\n        v.literal(\"email\"),\n        v.literal(\"phone\"),\n      ),\n    ),\n    order: v.optional(v.union(v.literal(\"asc\"), v.literal(\"desc\"))),\n  },\n  returns: vPaginated(vUserDoc),\n  handler: async (ctx, args) => {\n    const where = args.where ?? {};\n    const order = args.order ?? \"desc\";\n    const orderBy = args.orderBy ?? \"_creationTime\";\n\n    const base = stream(ctx.db, schema).query(\"User\");\n    let q;\n    if (orderBy === \"email\" || where.email !== undefined) {\n      q =\n        where.email !== undefined\n          ? base.withIndex(\"email\", (idx) => idx.eq(\"email\", where.email!))\n          : base.withIndex(\"email\");\n    } else if (orderBy === \"phone\" || where.phone !== undefined) {\n      q =\n        where.phone !== undefined\n          ? base.withIndex(\"phone\", (idx) => idx.eq(\"phone\", where.phone!))\n          : base.withIndex(\"phone\");\n    } else {\n      q = base;\n    }\n\n    return await q\n      .order(order)\n      .filterWith(\n        async (d) =>\n          (where.isAnonymous === undefined || d.isAnonymous === where.isAnonymous) &&\n          (where.name === undefined || d.name === where.name) &&\n          (where.email === undefined || d.email === where.email) &&\n          (where.phone === undefined || d.phone === where.phone),\n      )\n      .paginate(args.paginationOpts);\n  },\n});\n\n/** Insert a new user. */\nexport const create = mutation({\n  args: { data: vUserInsertData },\n  returns: schema.id(\"User\"),\n  handler: async (ctx, { data }) => {\n    return await ctx.db.insert(\"User\", { ...data, sessionEpoch: 0 });\n  },\n});\n\n/** Insert a user, or patch it when `id` is supplied. Returns the user id. */\nexport const upsert = mutation({\n  args: { id: v.optional(schema.id(\"User\")), data: vUserInsertData },\n  returns: schema.id(\"User\"),\n  handler: async (ctx, { id, data }) => {\n    if (id !== undefined) {\n      await ctx.db.patch(\"User\", id, data);\n      return id;\n    }\n    return await ctx.db.insert(\"User\", { ...data, sessionEpoch: 0 });\n  },\n});\n\n/** Patch fields on a user. */\nexport const update = mutation({\n  args: { id: schema.id(\"User\"), patch: vUserPatchData },\n  returns: v.null(),\n  handler: async (ctx, { id, patch }) => {\n    await ctx.db.patch(\"User\", id, patch);\n    return null;\n  },\n});\n\n/** Delete a user and every auth-owned credential row in one bounded transaction. */\nconst remove = mutation({\n  args: { id: schema.id(\"User\") },\n  returns: v.null(),\n  handler: async (ctx, { id: userId }) => {\n    const user = await ctx.db.get(\"User\", userId);\n    if (user === null) return null;\n    // Read the complete deletion plan before making any write. Every lookup is\n    // bounded; any over-limit path throws before the first delete/patch.\n    const [\n      sessions,\n      accounts,\n      keys,\n      members,\n      passkeys,\n      totps,\n      emails,\n      devicesByUser,\n      scimIdentities,\n      continuations,\n      oauthCodesByUser,\n      oauthGrantsByUser,\n      oauthClients,\n      invitesByAuthor,\n      invitesByAcceptor,\n      webhooks,\n    ] = await Promise.all([\n      ctx.db\n        .query(\"Session\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"Account\")\n        .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"ApiKey\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"GroupMember\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"Passkey\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"TotpFactor\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"UserEmail\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"DeviceCode\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"AuthContinuation\")\n        .withIndex(\"user_id_provider_operation_expiration_time\", (q) =>\n          q.eq(\"subject.userId\", userId),\n        )\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"OAuthCode\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"OAuthRefreshGrant\")\n        .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"OAuthClient\")\n        .withIndex(\"created_by\", (q) => q.eq(\"createdBy\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"GroupInvite\")\n        .withIndex(\"invited_by_user_id_status\", (q) => q.eq(\"invitedByUserId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"GroupInvite\")\n        .withIndex(\"accepted_by_user_id\", (q) => q.eq(\"acceptedByUserId\", userId))\n        .take(CASCADE_MAX + 1),\n      ctx.db\n        .query(\"GroupWebhookEndpoint\")\n        .withIndex(\"created_by_user_id\", (q) => q.eq(\"createdByUserId\", userId))\n        .take(CASCADE_MAX + 1),\n    ]);\n    assertCascadeSize(\n      [\n        ...sessions,\n        ...accounts,\n        ...keys,\n        ...members,\n        ...passkeys,\n        ...totps,\n        ...emails,\n        ...devicesByUser,\n        ...scimIdentities,\n        ...continuations,\n        ...oauthCodesByUser,\n        ...oauthGrantsByUser,\n        ...oauthClients,\n        ...invitesByAuthor,\n        ...invitesByAcceptor,\n        ...webhooks,\n      ].length,\n    );\n    let remaining =\n      CASCADE_MAX -\n      [\n        ...sessions,\n        ...accounts,\n        ...keys,\n        ...members,\n        ...passkeys,\n        ...totps,\n        ...emails,\n        ...devicesByUser,\n        ...scimIdentities,\n        ...continuations,\n        ...oauthCodesByUser,\n        ...oauthGrantsByUser,\n        ...oauthClients,\n        ...invitesByAuthor,\n        ...invitesByAcceptor,\n        ...webhooks,\n      ].length;\n    async function collect<T>(read: (limit: number) => Promise<T[]>): Promise<T[]> {\n      const rows = await read(remaining + 1);\n      if (rows.length > remaining) assertCascadeSize(CASCADE_MAX + 1);\n      remaining -= rows.length;\n      return rows;\n    }\n    const refreshTokens: Doc<\"RefreshToken\">[] = [];\n    const devicesBySession: Doc<\"DeviceCode\">[] = [];\n    const verificationCodes: Doc<\"VerificationCode\">[] = [];\n    const resetsByAccount: Doc<\"PasswordReset\">[] = [];\n    const resetsByContinuation: Doc<\"PasswordReset\">[] = [];\n    const verifiersBySession: Doc<\"AuthVerifier\">[] = [];\n    const verifiersByContinuation: Doc<\"AuthVerifier\">[] = [];\n    for (const session of sessions) {\n      refreshTokens.push(\n        ...(await collect((limit) =>\n          ctx.db\n            .query(\"RefreshToken\")\n            .withIndex(\"session_id\", (q) => q.eq(\"sessionId\", session._id))\n            .take(limit),\n        )),\n      );\n      devicesBySession.push(\n        ...(await collect((limit) =>\n          ctx.db\n            .query(\"DeviceCode\")\n            .withIndex(\"session_id\", (q) => q.eq(\"sessionId\", session._id))\n            .take(limit),\n        )),\n      );\n      verifiersBySession.push(\n        ...(await collect((limit) =>\n          ctx.db\n            .query(\"AuthVerifier\")\n            .withIndex(\"session_id\", (q) => q.eq(\"sessionId\", session._id))\n            .take(limit),\n        )),\n      );\n    }\n    for (const account of accounts) {\n      verificationCodes.push(\n        ...(await collect((limit) =>\n          ctx.db\n            .query(\"VerificationCode\")\n            .withIndex(\"account_id\", (q) => q.eq(\"accountId\", account._id))\n            .take(limit),\n        )),\n      );\n      resetsByAccount.push(\n        ...(await collect((limit) =>\n          ctx.db\n            .query(\"PasswordReset\")\n            .withIndex(\"account_id\", (q) => q.eq(\"accountId\", account._id))\n            .take(limit),\n        )),\n      );\n    }\n    for (const continuation of continuations) {\n      resetsByContinuation.push(\n        ...(await collect((limit) =>\n          ctx.db\n            .query(\"PasswordReset\")\n            .withIndex(\"continuation_id\", (q) => q.eq(\"continuationId\", continuation._id))\n            .take(limit),\n        )),\n      );\n      verifiersByContinuation.push(\n        ...(await collect((limit) =>\n          ctx.db\n            .query(\"AuthVerifier\")\n            .withIndex(\"continuation_id\", (q) => q.eq(\"continuationId\", continuation._id))\n            .take(limit),\n        )),\n      );\n    }\n    const grants = oauthGrantsByUser;\n    const oauthTokens: Doc<\"OAuthRefreshToken\">[] = [];\n    for (const grant of grants) {\n      oauthTokens.push(\n        ...(await collect((limit) =>\n          ctx.db\n            .query(\"OAuthRefreshToken\")\n            .withIndex(\"grant_id\", (q) => q.eq(\"grantId\", grant._id))\n            .take(limit),\n        )),\n      );\n    }\n    const devices = uniqueRows([...devicesByUser, ...devicesBySession]);\n    const resets = uniqueRows([...resetsByAccount, ...resetsByContinuation]);\n    const verifiers = uniqueRows([...verifiersBySession, ...verifiersByContinuation]);\n    const oauthCodes = oauthCodesByUser;\n    const invites = uniqueRows([...invitesByAuthor, ...invitesByAcceptor]);\n    assertCascadeSize(\n      [\n        ...sessions,\n        ...accounts,\n        ...keys,\n        ...members,\n        ...passkeys,\n        ...totps,\n        ...emails,\n        ...devices,\n        ...scimIdentities,\n        ...continuations,\n        ...oauthCodes,\n        ...grants,\n        ...oauthClients,\n        ...invites,\n        ...webhooks,\n        ...refreshTokens,\n        ...verificationCodes,\n        ...resets,\n        ...verifiers,\n        ...oauthTokens,\n      ].length,\n    );\n    await Promise.all([\n      ...sessions.map((s) => ctx.db.delete(\"Session\", s._id)),\n      ...refreshTokens.map((r) => ctx.db.delete(\"RefreshToken\", r._id)),\n      ...accounts.map((a) => ctx.db.delete(\"Account\", a._id)),\n      ...keys.map((k) => ctx.db.delete(\"ApiKey\", k._id)),\n      ...members.map((m) => ctx.db.delete(\"GroupMember\", m._id)),\n      ...passkeys.map((p) => ctx.db.delete(\"Passkey\", p._id)),\n      ...totps.map((t) => ctx.db.delete(\"TotpFactor\", t._id)),\n      ...emails.map((email) => ctx.db.delete(\"UserEmail\", email._id)),\n      ...devices.map((device) => ctx.db.delete(\"DeviceCode\", device._id)),\n      ...scimIdentities.map((identity) =>\n        ctx.db.delete(\"GroupConnectionScimIdentity\", identity._id),\n      ),\n      ...continuations.map((continuation) => ctx.db.delete(\"AuthContinuation\", continuation._id)),\n      ...oauthCodes.map((code) => ctx.db.delete(\"OAuthCode\", code._id)),\n      ...grants.map((grant) => ctx.db.delete(\"OAuthRefreshGrant\", grant._id)),\n      ...oauthTokens.map((token) => ctx.db.delete(\"OAuthRefreshToken\", token._id)),\n      ...verificationCodes.map((code) => ctx.db.delete(\"VerificationCode\", code._id)),\n      ...resets.map((reset) => ctx.db.delete(\"PasswordReset\", reset._id)),\n      ...verifiers.map((verifier) => ctx.db.delete(\"AuthVerifier\", verifier._id)),\n      ...oauthClients.map((client) =>\n        ctx.db.patch(\"OAuthClient\", client._id, { createdBy: undefined }),\n      ),\n      ...invites.map((invite) =>\n        ctx.db.patch(\"GroupInvite\", invite._id, {\n          invitedByUserId: invite.invitedByUserId === userId ? undefined : invite.invitedByUserId,\n          acceptedByUserId:\n            invite.acceptedByUserId === userId ? undefined : invite.acceptedByUserId,\n        }),\n      ),\n      ...webhooks.map((webhook) =>\n        ctx.db.patch(\"GroupWebhookEndpoint\", webhook._id, { createdByUserId: undefined }),\n      ),\n    ]);\n    await ctx.db.delete(\"User\", userId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,MAAM,kBAAkBA,eAAO,OAAO,KAAK,UAAU,KAAK,eAAe;AAEzE,MAAM,iBAAiBA,eAAO,OAAO,KAAK,UAAU,SAAS;;;;AAK7D,MAAM,cAAc;AAEpB,SAAS,kBAAkB,OAAe;AACxC,KAAI,QAAQ,YACV,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SAAS,8BAA8B,YAAY;EACpD,CAAC;;AAIN,SAAS,WAAsC,MAAW;AACxD,QAAO,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;AAoBxE,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAASA,eAAO,GAAG,OAAO,CAAC;EACjC,KAAK,EAAE,SAAS,EAAE,MAAMA,eAAO,GAAG,OAAO,CAAC,CAAC;EAC3C,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACtC;CACD,SAAS,EAAE,MAAM,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1E,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,QAAQ,QAAW;AAC1B,2BAAwB,KAAK,KAAK,MAAM;AACxC,OAAI,KAAK,IAAI,WAAW,EAAG,QAAO,EAAE;GACpC,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC;GAC5C,MAAM,OAAO,MAAM,QAAQ,IAAI,OAAO,KAAK,OAAO,IAAI,GAAG,IAAI,QAAQ,GAAG,CAAC,CAAC;GAC1E,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC;AAClE,UAAO,KAAK,IAAI,KAAK,OAAO,KAAK,IAAI,GAAG,IAAI,KAAK;;AAEnD,MAAI,KAAK,kBAAkB,QAAW;GACpC,MAAM,QAAQ,MAAM,IAAI,GACrB,MAAM,OAAO,CACb,UAAU,mBAAmB,MAC5B,EAAE,GAAG,SAAS,KAAK,cAAe,CAAC,GAAG,yBAAyB,OAAU,CAC1E,CACA,KAAK,EAAE;AACV,UAAO,MAAM,WAAW,IAAI,MAAM,KAAK;;AAEzC,MAAI,KAAK,kBAAkB,QAAW;GACpC,MAAM,QAAQ,MAAM,IAAI,GACrB,MAAM,OAAO,CACb,UAAU,mBAAmB,MAC5B,EAAE,GAAG,SAAS,KAAK,cAAe,CAAC,GAAG,yBAAyB,OAAU,CAC1E,CACA,KAAK,EAAE;AACV,UAAO,MAAM,WAAW,IAAI,MAAM,KAAK;;AAEzC,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,QAAQ,KAAK,GAAG;;CAE3C,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,OAAO,EAAE,SACP,EAAE,OAAO;GACP,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC7B,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;GACpC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC7B,CAAC,CACH;EACD,gBAAgB;EAChB,SAAS,EAAE,SACT,EAAE,MACA,EAAE,QAAQ,gBAAgB,EAC1B,EAAE,QAAQ,OAAO,EACjB,EAAE,QAAQ,QAAQ,EAClB,EAAE,QAAQ,QAAQ,CACnB,CACF;EACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,CAAC,CAAC;EAChE;CACD,SAAS,WAAW,SAAS;CAC7B,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,QAAQ,KAAK,SAAS,EAAE;EAC9B,MAAM,QAAQ,KAAK,SAAS;EAC5B,MAAM,UAAU,KAAK,WAAW;EAEhC,MAAM,OAAO,OAAO,IAAI,IAAIA,eAAO,CAAC,MAAM,OAAO;EACjD,IAAI;AACJ,MAAI,YAAY,WAAW,MAAM,UAAU,OACzC,KACE,MAAM,UAAU,SACZ,KAAK,UAAU,UAAU,QAAQ,IAAI,GAAG,SAAS,MAAM,MAAO,CAAC,GAC/D,KAAK,UAAU,QAAQ;WACpB,YAAY,WAAW,MAAM,UAAU,OAChD,KACE,MAAM,UAAU,SACZ,KAAK,UAAU,UAAU,QAAQ,IAAI,GAAG,SAAS,MAAM,MAAO,CAAC,GAC/D,KAAK,UAAU,QAAQ;MAE7B,KAAI;AAGN,SAAO,MAAM,EACV,MAAM,MAAM,CACZ,WACC,OAAO,OACJ,MAAM,gBAAgB,UAAa,EAAE,gBAAgB,MAAM,iBAC3D,MAAM,SAAS,UAAa,EAAE,SAAS,MAAM,UAC7C,MAAM,UAAU,UAAa,EAAE,UAAU,MAAM,WAC/C,MAAM,UAAU,UAAa,EAAE,UAAU,MAAM,OACnD,CACA,SAAS,KAAK,eAAe;;CAEnC,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM,EAAE,MAAM,iBAAiB;CAC/B,SAASA,eAAO,GAAG,OAAO;CAC1B,SAAS,OAAO,KAAK,EAAE,WAAW;AAChC,SAAO,MAAM,IAAI,GAAG,OAAO,QAAQ;GAAE,GAAG;GAAM,cAAc;GAAG,CAAC;;CAEnE,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EAAE,IAAI,EAAE,SAASA,eAAO,GAAG,OAAO,CAAC;EAAE,MAAM;EAAiB;CAClE,SAASA,eAAO,GAAG,OAAO;CAC1B,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW;AACpC,MAAI,OAAO,QAAW;AACpB,SAAM,IAAI,GAAG,MAAM,QAAQ,IAAI,KAAK;AACpC,UAAO;;AAET,SAAO,MAAM,IAAI,GAAG,OAAO,QAAQ;GAAE,GAAG;GAAM,cAAc;GAAG,CAAC;;CAEnE,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EAAE,IAAIA,eAAO,GAAG,OAAO;EAAE,OAAO;EAAgB;CACtD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,YAAY;AACrC,QAAM,IAAI,GAAG,MAAM,QAAQ,IAAI,MAAM;AACrC,SAAO;;CAEV,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,IAAIA,eAAO,GAAG,OAAO,EAAE;CAC/B,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,aAAa;AAEtC,MADa,MAAM,IAAI,GAAG,IAAI,QAAQ,OAAO,KAChC,KAAM,QAAO;EAG1B,MAAM,CACJ,UACA,UACA,MACA,SACA,UACA,OACA,QACA,eACA,gBACA,eACA,kBACA,mBACA,cACA,iBACA,mBACA,YACE,MAAM,QAAQ,IAAI;GACpB,IAAI,GACD,MAAM,UAAU,CAChB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CAC5D,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,SAAS,CACf,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,cAAc,CACpB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,UAAU,CAChB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,YAAY,CAClB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,8BAA8B,CACpC,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,mBAAmB,CACzB,UAAU,+CAA+C,MACxD,EAAE,GAAG,kBAAkB,OAAO,CAC/B,CACA,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,YAAY,CAClB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,oBAAoB,CAC1B,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,cAAc,CACpB,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,OAAO,CAAC,CACzD,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,cAAc,CACpB,UAAU,8BAA8B,MAAM,EAAE,GAAG,mBAAmB,OAAO,CAAC,CAC9E,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,cAAc,CACpB,UAAU,wBAAwB,MAAM,EAAE,GAAG,oBAAoB,OAAO,CAAC,CACzE,KAAK,cAAc,EAAE;GACxB,IAAI,GACD,MAAM,uBAAuB,CAC7B,UAAU,uBAAuB,MAAM,EAAE,GAAG,mBAAmB,OAAO,CAAC,CACvE,KAAK,cAAc,EAAE;GACzB,CAAC;AACF,oBACE;GACE,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACJ,CAAC,OACH;EACD,IAAI,YACF,cACA;GACE,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACJ,CAAC;EACJ,eAAe,QAAW,MAAqD;GAC7E,MAAM,OAAO,MAAM,KAAK,YAAY,EAAE;AACtC,OAAI,KAAK,SAAS,UAAW,mBAAkB,cAAc,EAAE;AAC/D,gBAAa,KAAK;AAClB,UAAO;;EAET,MAAM,gBAAuC,EAAE;EAC/C,MAAM,mBAAwC,EAAE;EAChD,MAAM,oBAA+C,EAAE;EACvD,MAAM,kBAA0C,EAAE;EAClD,MAAM,uBAA+C,EAAE;EACvD,MAAM,qBAA4C,EAAE;EACpD,MAAM,0BAAiD,EAAE;AACzD,OAAK,MAAM,WAAW,UAAU;AAC9B,iBAAc,KACZ,GAAI,MAAM,SAAS,UACjB,IAAI,GACD,MAAM,eAAe,CACrB,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,QAAQ,IAAI,CAAC,CAC9D,KAAK,MAAM,CACf,CACF;AACD,oBAAiB,KACf,GAAI,MAAM,SAAS,UACjB,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,QAAQ,IAAI,CAAC,CAC9D,KAAK,MAAM,CACf,CACF;AACD,sBAAmB,KACjB,GAAI,MAAM,SAAS,UACjB,IAAI,GACD,MAAM,eAAe,CACrB,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,QAAQ,IAAI,CAAC,CAC9D,KAAK,MAAM,CACf,CACF;;AAEH,OAAK,MAAM,WAAW,UAAU;AAC9B,qBAAkB,KAChB,GAAI,MAAM,SAAS,UACjB,IAAI,GACD,MAAM,mBAAmB,CACzB,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,QAAQ,IAAI,CAAC,CAC9D,KAAK,MAAM,CACf,CACF;AACD,mBAAgB,KACd,GAAI,MAAM,SAAS,UACjB,IAAI,GACD,MAAM,gBAAgB,CACtB,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,QAAQ,IAAI,CAAC,CAC9D,KAAK,MAAM,CACf,CACF;;AAEH,OAAK,MAAM,gBAAgB,eAAe;AACxC,wBAAqB,KACnB,GAAI,MAAM,SAAS,UACjB,IAAI,GACD,MAAM,gBAAgB,CACtB,UAAU,oBAAoB,MAAM,EAAE,GAAG,kBAAkB,aAAa,IAAI,CAAC,CAC7E,KAAK,MAAM,CACf,CACF;AACD,2BAAwB,KACtB,GAAI,MAAM,SAAS,UACjB,IAAI,GACD,MAAM,eAAe,CACrB,UAAU,oBAAoB,MAAM,EAAE,GAAG,kBAAkB,aAAa,IAAI,CAAC,CAC7E,KAAK,MAAM,CACf,CACF;;EAEH,MAAM,SAAS;EACf,MAAM,cAA0C,EAAE;AAClD,OAAK,MAAM,SAAS,OAClB,aAAY,KACV,GAAI,MAAM,SAAS,UACjB,IAAI,GACD,MAAM,oBAAoB,CAC1B,UAAU,aAAa,MAAM,EAAE,GAAG,WAAW,MAAM,IAAI,CAAC,CACxD,KAAK,MAAM,CACf,CACF;EAEH,MAAM,UAAU,WAAW,CAAC,GAAG,eAAe,GAAG,iBAAiB,CAAC;EACnE,MAAM,SAAS,WAAW,CAAC,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;EACxE,MAAM,YAAY,WAAW,CAAC,GAAG,oBAAoB,GAAG,wBAAwB,CAAC;EACjF,MAAM,aAAa;EACnB,MAAM,UAAU,WAAW,CAAC,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AACtE,oBACE;GACE,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACH,GAAG;GACJ,CAAC,OACH;AACD,QAAM,QAAQ,IAAI;GAChB,GAAG,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC;GACvD,GAAG,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,gBAAgB,EAAE,IAAI,CAAC;GACjE,GAAG,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC;GACvD,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG,OAAO,UAAU,EAAE,IAAI,CAAC;GAClD,GAAG,QAAQ,KAAK,MAAM,IAAI,GAAG,OAAO,eAAe,EAAE,IAAI,CAAC;GAC1D,GAAG,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC;GACvD,GAAG,MAAM,KAAK,MAAM,IAAI,GAAG,OAAO,cAAc,EAAE,IAAI,CAAC;GACvD,GAAG,OAAO,KAAK,UAAU,IAAI,GAAG,OAAO,aAAa,MAAM,IAAI,CAAC;GAC/D,GAAG,QAAQ,KAAK,WAAW,IAAI,GAAG,OAAO,cAAc,OAAO,IAAI,CAAC;GACnE,GAAG,eAAe,KAAK,aACrB,IAAI,GAAG,OAAO,+BAA+B,SAAS,IAAI,CAC3D;GACD,GAAG,cAAc,KAAK,iBAAiB,IAAI,GAAG,OAAO,oBAAoB,aAAa,IAAI,CAAC;GAC3F,GAAG,WAAW,KAAK,SAAS,IAAI,GAAG,OAAO,aAAa,KAAK,IAAI,CAAC;GACjE,GAAG,OAAO,KAAK,UAAU,IAAI,GAAG,OAAO,qBAAqB,MAAM,IAAI,CAAC;GACvE,GAAG,YAAY,KAAK,UAAU,IAAI,GAAG,OAAO,qBAAqB,MAAM,IAAI,CAAC;GAC5E,GAAG,kBAAkB,KAAK,SAAS,IAAI,GAAG,OAAO,oBAAoB,KAAK,IAAI,CAAC;GAC/E,GAAG,OAAO,KAAK,UAAU,IAAI,GAAG,OAAO,iBAAiB,MAAM,IAAI,CAAC;GACnE,GAAG,UAAU,KAAK,aAAa,IAAI,GAAG,OAAO,gBAAgB,SAAS,IAAI,CAAC;GAC3E,GAAG,aAAa,KAAK,WACnB,IAAI,GAAG,MAAM,eAAe,OAAO,KAAK,EAAE,WAAW,QAAW,CAAC,CAClE;GACD,GAAG,QAAQ,KAAK,WACd,IAAI,GAAG,MAAM,eAAe,OAAO,KAAK;IACtC,iBAAiB,OAAO,oBAAoB,SAAS,SAAY,OAAO;IACxE,kBACE,OAAO,qBAAqB,SAAS,SAAY,OAAO;IAC3D,CAAC,CACH;GACD,GAAG,SAAS,KAAK,YACf,IAAI,GAAG,MAAM,wBAAwB,QAAQ,KAAK,EAAE,iBAAiB,QAAW,CAAC,CAClF;GACF,CAAC;AACF,QAAM,IAAI,GAAG,OAAO,QAAQ,OAAO;AACnC,SAAO;;CAEV,CAAC"}

package/dist/expo/index.d.ts

@@ -12,7 +12,7 @@ import * as AuthSession from "expo-auth-session";
  * @typeParam Api - An AuthApiRefs type that controls which factor helpers are
  *   available on the returned client.
  */
-interface ExpoClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> extends ClientOptions<Api> {
+type ExpoClientOptions<Api extends AuthApiRefs = AuthApiRefs> = ClientOptions<Api> & {
   /**
    * Expo auth-session options. `redirectUri` overrides the auto-derived
    * redirect URI; `preferEphemeralSession` requests a private browser session.
@@ -21,7 +21,7 @@ interface ExpoClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> =
     redirectUri?: string;
     preferEphemeralSession?: boolean;
   };
-}
+};
 /**
  * Create an Expo-configured auth client.
  *
@@ -37,7 +37,7 @@ interface ExpoClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> =
  *   available on the returned client.
  * @returns An Expo auth client with the configured auth helpers.
  */
-declare function client<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs>(options: ExpoClientOptions<Api>): PlatformAuthClient<Api>;
+declare function client<Api extends AuthApiRefs = AuthApiRefs>(options: ExpoClientOptions<Api>): PlatformAuthClient<Api>;
 //#endregion
-export { type AuthApiRefs, type PlatformAuthClient as AuthClient, ExpoClientOptions, client };
+export { type PlatformAuthClient as AuthClient, ExpoClientOptions, client };
 //# sourceMappingURL=index.d.ts.map

package/dist/expo/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/expo/index.ts"],"mappings":";;;;;;;;;;;;;;UAuCiB,iBAAA,aACH,WAAA,8BAAyC,WAAA,UAC7C,aAAA,CAAc,GAAA;EAOE;;AAgD1B;;EAlDE,WAAA,GAAc,WAAA,CAAY,6BAAA;IACxB,WAAA;IACA,sBAAA;EAAA;AAAA;;;;;;;;;;;;;;;;iBAgDY,MAAA,aAAmB,WAAA,8BAAyC,WAAA,CAAA,CAC1E,OAAA,EAAS,iBAAA,CAAkB,GAAA,IAC1B,kBAAA,CAAmB,GAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/expo/index.ts"],"mappings":";;;;;;;;;;;;;;KAuCY,iBAAA,aAA8B,WAAA,GAAc,WAAA,IAAe,aAAA,CAAc,GAAA;EAO3D;AAgD1B;;;EAlDE,WAAA,GAAc,WAAA,CAAY,6BAAA;IACxB,WAAA;IACA,sBAAA;EAAA;AAAA;;;;;;;;;;;;;;;;iBAgDY,MAAA,aAAmB,WAAA,GAAc,WAAA,CAAA,CAC/C,OAAA,EAAS,iBAAA,CAAkB,GAAA,IAC1B,kBAAA,CAAmB,GAAA"}

package/dist/expo/index.js

@@ -72,23 +72,30 @@ const secureStoreStorage = {
 */
 function client(options) {
 	if (isWebRuntime()) return client$2(options);
-	const proxyMode = options.proxyPath !== void 0;
-	const url = proxyMode ? void 0 : options.url ?? resolveUrl(options.convex);
 	const redirectUri = resolveRedirectUri(options.authSession);
+	const runtime = mergeExpoRuntime(options.runtime, {
+		redirectUri,
+		preferEphemeralSession: options.authSession?.preferEphemeralSession,
+		proxyMode: options.proxyPath !== void 0
+	});
+	const adapterFactories = {
+		...options.adapterFactories,
+		webauthn: options.adapterFactories?.webauthn ?? ((deps) => createExpoWebAuthnClient(deps))
+	};
+	if (options.proxyPath !== void 0) return client$1({
+		...options,
+		oauthRedirectTo: options.oauthRedirectTo ?? redirectUri,
+		storage: options.storage ?? null,
+		runtime,
+		adapterFactories
+	});
+	const url = options.url ?? resolveUrl(options.convex);
 	return client$1({
 		...options,
 		oauthRedirectTo: options.oauthRedirectTo ?? redirectUri,
-		storage: options.storage === void 0 && proxyMode ? null : options.storage,
-		runtime: mergeExpoRuntime(options.runtime, {
-			redirectUri,
-			preferEphemeralSession: options.authSession?.preferEphemeralSession,
-			proxyMode
-		}),
-		adapterFactories: {
-			...options.adapterFactories,
-			webauthn: options.adapterFactories?.webauthn ?? ((deps) => createExpoWebAuthnClient(deps))
-		},
-		httpClient: proxyMode ? null : options.httpClient ?? (url ? new ConvexHttpClient(url) : null)
+		runtime,
+		adapterFactories,
+		httpClient: options.httpClient ?? new ConvexHttpClient(url)
 	});
 }
 function isWebRuntime() {

package/dist/expo/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["createBrowserClient","createClient"],"sources":["../../src/expo/index.ts"],"sourcesContent":["/**\n * Expo-first auth client for `@estifanos-sh/convex-auth/expo`.\n *\n * This entrypoint wraps the framework-agnostic `client(...)` helper with\n * Expo-native defaults such as SecureStore-backed token persistence, auth\n * session launching, and native passkey support.\n *\n * OAuth in Expo uses direct mode only. Do not configure `proxyPath` for Expo\n * OAuth flows because the proxy flow depends on browser cookies and HTML\n * redirects.\n *\n * @module\n */\n\nimport * as AuthSession from \"expo-auth-session\";\nimport * as SecureStore from \"expo-secure-store\";\nimport * as WebBrowser from \"expo-web-browser\";\nimport { ConvexHttpClient } from \"convex/browser\";\n\nimport {\n  client as createClient,\n  resolveUrl,\n  type AuthApiRefs,\n  type ClientOptions,\n  type ClientRuntime,\n  type PlatformAuthClient,\n} from \"../client/index\";\nimport { client as createBrowserClient } from \"../browser/index\";\nimport { createExpoWebAuthnClient } from \"./webauthn\";\n\n/**\n * Options for the Expo {@link client}.\n *\n * Extends {@link ClientOptions} with Expo auth-session settings used to launch\n * the OAuth flow and resolve the native redirect URI.\n *\n * @typeParam Api - An AuthApiRefs type that controls which factor helpers are\n *   available on the returned client.\n */\nexport interface ExpoClientOptions<\n  Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs,\n> extends ClientOptions<Api> {\n  /**\n   * Expo auth-session options. `redirectUri` overrides the auto-derived\n   * redirect URI; `preferEphemeralSession` requests a private browser session.\n   */\n  authSession?: AuthSession.AuthSessionRedirectUriOptions & {\n    redirectUri?: string;\n    preferEphemeralSession?: boolean;\n  };\n}\n\nexport type { AuthApiRefs, PlatformAuthClient as AuthClient } from \"../client/index\";\n\nconst secureStoreStorage = {\n  async getItem(key: string): Promise<string | null> {\n    try {\n      return await SecureStore.getItemAsync(key);\n    } catch (err) {\n      console.error(\"[auth] Expo SecureStore.getItemAsync failed\", { key, err });\n      return null;\n    }\n  },\n  async setItem(key: string, value: string): Promise<void> {\n    try {\n      await SecureStore.setItemAsync(key, value);\n    } catch (err) {\n      console.error(\"[auth] Expo SecureStore.setItemAsync failed\", { key, err });\n      throw err;\n    }\n  },\n  async removeItem(key: string): Promise<void> {\n    try {\n      await SecureStore.deleteItemAsync(key);\n    } catch (err) {\n      console.error(\"[auth] Expo SecureStore.deleteItemAsync failed\", { key, err });\n      throw err;\n    }\n  },\n};\n\n/**\n * Create an Expo-configured auth client.\n *\n * Native Expo defaults include SecureStore persistence, auth session launch,\n * and native passkey support. Web falls back to the browser entrypoint.\n *\n * OAuth launch and completion are owned by the core client, driven by the Expo\n * `runtime.oauth` provided here: it opens the in-app auth session and returns\n * the callback URL for the core to complete inline.\n *\n * @param options - Expo client configuration. See {@link ExpoClientOptions}.\n * @typeParam Api - Auth API references that control which factor helpers are\n *   available on the returned client.\n * @returns An Expo auth client with the configured auth helpers.\n */\nexport function client<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs>(\n  options: ExpoClientOptions<Api>,\n): PlatformAuthClient<Api> {\n  if (isWebRuntime()) {\n    return createBrowserClient(options) as PlatformAuthClient<Api>;\n  }\n\n  const proxyMode = options.proxyPath !== undefined;\n  const url = proxyMode ? undefined : (options.url ?? resolveUrl(options.convex));\n  const redirectUri = resolveRedirectUri(options.authSession);\n\n  return createClient({\n    ...options,\n    oauthRedirectTo: options.oauthRedirectTo ?? redirectUri,\n    storage: options.storage === undefined && proxyMode ? null : options.storage,\n    runtime: mergeExpoRuntime(options.runtime, {\n      redirectUri,\n      preferEphemeralSession: options.authSession?.preferEphemeralSession,\n      proxyMode,\n    }),\n    adapterFactories: {\n      ...options.adapterFactories,\n      webauthn: options.adapterFactories?.webauthn ?? ((deps) => createExpoWebAuthnClient(deps)),\n    },\n    httpClient: proxyMode ? null : (options.httpClient ?? (url ? new ConvexHttpClient(url) : null)),\n  }) as PlatformAuthClient<Api>;\n}\n\nfunction isWebRuntime() {\n  return typeof window !== \"undefined\" && typeof document !== \"undefined\";\n}\n\n/**\n * Build the Expo runtime, layering caller overrides over native defaults.\n *\n * Expo intentionally omits `sync` and `mutex` (the cross-tab storage-event\n * bridge and cross-context lock the browser provides). React Native is\n * single-process with no `storage` event and no `navigator.locks`, so both\n * would be no-ops; token refresh falls back to the in-process `localMutex` in\n * the core. This parity gap is deliberate — do not add stubs.\n */\nfunction mergeExpoRuntime(\n  runtime: ClientRuntime | undefined,\n  oauth: { redirectUri: string; preferEphemeralSession: boolean | undefined; proxyMode: boolean },\n): ClientRuntime {\n  const defaults: ClientRuntime = {\n    environment: \"client\",\n    storage: secureStoreStorage,\n    oauth: {\n      open: async (authorizeUrl) => {\n        if (oauth.proxyMode) {\n          throw new Error(\n            \"Expo OAuth is not supported when `proxyPath` is set. Use direct mode with `api` and an Expo redirect URI.\",\n          );\n        }\n        const authResult = await WebBrowser.openAuthSessionAsync(\n          authorizeUrl.toString(),\n          oauth.redirectUri,\n          { preferEphemeralSession: oauth.preferEphemeralSession },\n        );\n        return authResult.type === \"success\" ? authResult.url : undefined;\n      },\n    },\n  };\n  return {\n    ...defaults,\n    ...runtime,\n    environment: runtime?.environment ?? defaults.environment,\n    storage: runtime?.storage === undefined ? defaults.storage : runtime.storage,\n    oauth: runtime?.oauth ?? defaults.oauth,\n  };\n}\n\nfunction resolveRedirectUri(options: ExpoClientOptions[\"authSession\"]): string {\n  if (options?.redirectUri) {\n    return options.redirectUri;\n  }\n  return AuthSession.makeRedirectUri(options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAsDA,MAAM,qBAAqB;CACzB,MAAM,QAAQ,KAAqC;AACjD,MAAI;AACF,UAAO,MAAM,YAAY,aAAa,IAAI;WACnC,KAAK;AACZ,WAAQ,MAAM,+CAA+C;IAAE;IAAK;IAAK,CAAC;AAC1E,UAAO;;;CAGX,MAAM,QAAQ,KAAa,OAA8B;AACvD,MAAI;AACF,SAAM,YAAY,aAAa,KAAK,MAAM;WACnC,KAAK;AACZ,WAAQ,MAAM,+CAA+C;IAAE;IAAK;IAAK,CAAC;AAC1E,SAAM;;;CAGV,MAAM,WAAW,KAA4B;AAC3C,MAAI;AACF,SAAM,YAAY,gBAAgB,IAAI;WAC/B,KAAK;AACZ,WAAQ,MAAM,kDAAkD;IAAE;IAAK;IAAK,CAAC;AAC7E,SAAM;;;CAGX;;;;;;;;;;;;;;;;AAiBD,SAAgB,OACd,SACyB;AACzB,KAAI,cAAc,CAChB,QAAOA,SAAoB,QAAQ;CAGrC,MAAM,YAAY,QAAQ,cAAc;CACxC,MAAM,MAAM,YAAY,SAAa,QAAQ,OAAO,WAAW,QAAQ,OAAO;CAC9E,MAAM,cAAc,mBAAmB,QAAQ,YAAY;AAE3D,QAAOC,SAAa;EAClB,GAAG;EACH,iBAAiB,QAAQ,mBAAmB;EAC5C,SAAS,QAAQ,YAAY,UAAa,YAAY,OAAO,QAAQ;EACrE,SAAS,iBAAiB,QAAQ,SAAS;GACzC;GACA,wBAAwB,QAAQ,aAAa;GAC7C;GACD,CAAC;EACF,kBAAkB;GAChB,GAAG,QAAQ;GACX,UAAU,QAAQ,kBAAkB,cAAc,SAAS,yBAAyB,KAAK;GAC1F;EACD,YAAY,YAAY,OAAQ,QAAQ,eAAe,MAAM,IAAI,iBAAiB,IAAI,GAAG;EAC1F,CAAC;;AAGJ,SAAS,eAAe;AACtB,QAAO,OAAO,WAAW,eAAe,OAAO,aAAa;;;;;;;;;;;AAY9D,SAAS,iBACP,SACA,OACe;CACf,MAAM,WAA0B;EAC9B,aAAa;EACb,SAAS;EACT,OAAO,EACL,MAAM,OAAO,iBAAiB;AAC5B,OAAI,MAAM,UACR,OAAM,IAAI,MACR,4GACD;GAEH,MAAM,aAAa,MAAM,WAAW,qBAClC,aAAa,UAAU,EACvB,MAAM,aACN,EAAE,wBAAwB,MAAM,wBAAwB,CACzD;AACD,UAAO,WAAW,SAAS,YAAY,WAAW,MAAM;KAE3D;EACF;AACD,QAAO;EACL,GAAG;EACH,GAAG;EACH,aAAa,SAAS,eAAe,SAAS;EAC9C,SAAS,SAAS,YAAY,SAAY,SAAS,UAAU,QAAQ;EACrE,OAAO,SAAS,SAAS,SAAS;EACnC;;AAGH,SAAS,mBAAmB,SAAmD;AAC7E,KAAI,SAAS,YACX,QAAO,QAAQ;AAEjB,QAAO,YAAY,gBAAgB,QAAQ"}
+{"version":3,"file":"index.js","names":["createBrowserClient","createClient"],"sources":["../../src/expo/index.ts"],"sourcesContent":["/**\n * Expo-first auth client for `@estifanos-sh/convex-auth/expo`.\n *\n * This entrypoint wraps the framework-agnostic `client(...)` helper with\n * Expo-native defaults such as SecureStore-backed token persistence, auth\n * session launching, and native passkey support.\n *\n * OAuth in Expo uses direct mode only. Do not configure `proxyPath` for Expo\n * OAuth flows because the proxy flow depends on browser cookies and HTML\n * redirects.\n *\n * @module\n */\n\nimport * as AuthSession from \"expo-auth-session\";\nimport * as SecureStore from \"expo-secure-store\";\nimport * as WebBrowser from \"expo-web-browser\";\nimport { ConvexHttpClient } from \"convex/browser\";\n\nimport {\n  client as createClient,\n  resolveUrl,\n  type ClientOptions,\n  type ClientRuntime,\n  type PlatformAuthClient,\n} from \"../client/index\";\nimport type { AuthApiRefs } from \"../client/core/types\";\nimport { client as createBrowserClient } from \"../browser/index\";\nimport { createExpoWebAuthnClient } from \"./webauthn\";\n\n/**\n * Options for the Expo {@link client}.\n *\n * Extends {@link ClientOptions} with Expo auth-session settings used to launch\n * the OAuth flow and resolve the native redirect URI.\n *\n * @typeParam Api - An AuthApiRefs type that controls which factor helpers are\n *   available on the returned client.\n */\nexport type ExpoClientOptions<Api extends AuthApiRefs = AuthApiRefs> = ClientOptions<Api> & {\n  /**\n   * Expo auth-session options. `redirectUri` overrides the auto-derived\n   * redirect URI; `preferEphemeralSession` requests a private browser session.\n   */\n  authSession?: AuthSession.AuthSessionRedirectUriOptions & {\n    redirectUri?: string;\n    preferEphemeralSession?: boolean;\n  };\n};\n\nexport type { PlatformAuthClient as AuthClient } from \"../client/index\";\n\nconst secureStoreStorage = {\n  async getItem(key: string): Promise<string | null> {\n    try {\n      return await SecureStore.getItemAsync(key);\n    } catch (err) {\n      console.error(\"[auth] Expo SecureStore.getItemAsync failed\", { key, err });\n      return null;\n    }\n  },\n  async setItem(key: string, value: string): Promise<void> {\n    try {\n      await SecureStore.setItemAsync(key, value);\n    } catch (err) {\n      console.error(\"[auth] Expo SecureStore.setItemAsync failed\", { key, err });\n      throw err;\n    }\n  },\n  async removeItem(key: string): Promise<void> {\n    try {\n      await SecureStore.deleteItemAsync(key);\n    } catch (err) {\n      console.error(\"[auth] Expo SecureStore.deleteItemAsync failed\", { key, err });\n      throw err;\n    }\n  },\n};\n\n/**\n * Create an Expo-configured auth client.\n *\n * Native Expo defaults include SecureStore persistence, auth session launch,\n * and native passkey support. Web falls back to the browser entrypoint.\n *\n * OAuth launch and completion are owned by the core client, driven by the Expo\n * `runtime.oauth` provided here: it opens the in-app auth session and returns\n * the callback URL for the core to complete inline.\n *\n * @param options - Expo client configuration. See {@link ExpoClientOptions}.\n * @typeParam Api - Auth API references that control which factor helpers are\n *   available on the returned client.\n * @returns An Expo auth client with the configured auth helpers.\n */\nexport function client<Api extends AuthApiRefs = AuthApiRefs>(\n  options: ExpoClientOptions<Api>,\n): PlatformAuthClient<Api> {\n  if (isWebRuntime()) {\n    return createBrowserClient<Api>(options);\n  }\n\n  const redirectUri = resolveRedirectUri(options.authSession);\n  const runtime = mergeExpoRuntime(options.runtime, {\n    redirectUri,\n    preferEphemeralSession: options.authSession?.preferEphemeralSession,\n    proxyMode: options.proxyPath !== undefined,\n  });\n  const adapterFactories = {\n    ...options.adapterFactories,\n    webauthn: options.adapterFactories?.webauthn ?? ((deps) => createExpoWebAuthnClient(deps)),\n  };\n\n  if (options.proxyPath !== undefined) {\n    return createClient<Api>({\n      ...options,\n      oauthRedirectTo: options.oauthRedirectTo ?? redirectUri,\n      storage: options.storage ?? null,\n      runtime,\n      adapterFactories,\n    }) as unknown as PlatformAuthClient<Api>;\n  }\n\n  const url = options.url ?? resolveUrl(options.convex);\n  return createClient<Api>({\n    ...options,\n    oauthRedirectTo: options.oauthRedirectTo ?? redirectUri,\n    runtime,\n    adapterFactories,\n    httpClient: options.httpClient ?? new ConvexHttpClient(url),\n  }) as unknown as PlatformAuthClient<Api>;\n}\n\nfunction isWebRuntime() {\n  return typeof window !== \"undefined\" && typeof document !== \"undefined\";\n}\n\n/**\n * Build the Expo runtime, layering caller overrides over native defaults.\n *\n * Expo intentionally omits `sync` and `mutex` (the cross-tab storage-event\n * bridge and cross-context lock the browser provides). React Native is\n * single-process with no `storage` event and no `navigator.locks`, so both\n * would be no-ops; token refresh falls back to the in-process `localMutex` in\n * the core. This parity gap is deliberate — do not add stubs.\n */\nfunction mergeExpoRuntime(\n  runtime: ClientRuntime | undefined,\n  oauth: { redirectUri: string; preferEphemeralSession: boolean | undefined; proxyMode: boolean },\n): ClientRuntime {\n  const defaults: ClientRuntime = {\n    environment: \"client\",\n    storage: secureStoreStorage,\n    oauth: {\n      open: async (authorizeUrl) => {\n        if (oauth.proxyMode) {\n          throw new Error(\n            \"Expo OAuth is not supported when `proxyPath` is set. Use direct mode with `api` and an Expo redirect URI.\",\n          );\n        }\n        const authResult = await WebBrowser.openAuthSessionAsync(\n          authorizeUrl.toString(),\n          oauth.redirectUri,\n          { preferEphemeralSession: oauth.preferEphemeralSession },\n        );\n        return authResult.type === \"success\" ? authResult.url : undefined;\n      },\n    },\n  };\n  return {\n    ...defaults,\n    ...runtime,\n    environment: runtime?.environment ?? defaults.environment,\n    storage: runtime?.storage === undefined ? defaults.storage : runtime.storage,\n    oauth: runtime?.oauth ?? defaults.oauth,\n  };\n}\n\nfunction resolveRedirectUri(options: ExpoClientOptions[\"authSession\"]): string {\n  if (options?.redirectUri) {\n    return options.redirectUri;\n  }\n  return AuthSession.makeRedirectUri(options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAoDA,MAAM,qBAAqB;CACzB,MAAM,QAAQ,KAAqC;AACjD,MAAI;AACF,UAAO,MAAM,YAAY,aAAa,IAAI;WACnC,KAAK;AACZ,WAAQ,MAAM,+CAA+C;IAAE;IAAK;IAAK,CAAC;AAC1E,UAAO;;;CAGX,MAAM,QAAQ,KAAa,OAA8B;AACvD,MAAI;AACF,SAAM,YAAY,aAAa,KAAK,MAAM;WACnC,KAAK;AACZ,WAAQ,MAAM,+CAA+C;IAAE;IAAK;IAAK,CAAC;AAC1E,SAAM;;;CAGV,MAAM,WAAW,KAA4B;AAC3C,MAAI;AACF,SAAM,YAAY,gBAAgB,IAAI;WAC/B,KAAK;AACZ,WAAQ,MAAM,kDAAkD;IAAE;IAAK;IAAK,CAAC;AAC7E,SAAM;;;CAGX;;;;;;;;;;;;;;;;AAiBD,SAAgB,OACd,SACyB;AACzB,KAAI,cAAc,CAChB,QAAOA,SAAyB,QAAQ;CAG1C,MAAM,cAAc,mBAAmB,QAAQ,YAAY;CAC3D,MAAM,UAAU,iBAAiB,QAAQ,SAAS;EAChD;EACA,wBAAwB,QAAQ,aAAa;EAC7C,WAAW,QAAQ,cAAc;EAClC,CAAC;CACF,MAAM,mBAAmB;EACvB,GAAG,QAAQ;EACX,UAAU,QAAQ,kBAAkB,cAAc,SAAS,yBAAyB,KAAK;EAC1F;AAED,KAAI,QAAQ,cAAc,OACxB,QAAOC,SAAkB;EACvB,GAAG;EACH,iBAAiB,QAAQ,mBAAmB;EAC5C,SAAS,QAAQ,WAAW;EAC5B;EACA;EACD,CAAC;CAGJ,MAAM,MAAM,QAAQ,OAAO,WAAW,QAAQ,OAAO;AACrD,QAAOA,SAAkB;EACvB,GAAG;EACH,iBAAiB,QAAQ,mBAAmB;EAC5C;EACA;EACA,YAAY,QAAQ,cAAc,IAAI,iBAAiB,IAAI;EAC5D,CAAC;;AAGJ,SAAS,eAAe;AACtB,QAAO,OAAO,WAAW,eAAe,OAAO,aAAa;;;;;;;;;;;AAY9D,SAAS,iBACP,SACA,OACe;CACf,MAAM,WAA0B;EAC9B,aAAa;EACb,SAAS;EACT,OAAO,EACL,MAAM,OAAO,iBAAiB;AAC5B,OAAI,MAAM,UACR,OAAM,IAAI,MACR,4GACD;GAEH,MAAM,aAAa,MAAM,WAAW,qBAClC,aAAa,UAAU,EACvB,MAAM,aACN,EAAE,wBAAwB,MAAM,wBAAwB,CACzD;AACD,UAAO,WAAW,SAAS,YAAY,WAAW,MAAM;KAE3D;EACF;AACD,QAAO;EACL,GAAG;EACH,GAAG;EACH,aAAa,SAAS,eAAe,SAAS;EAC9C,SAAS,SAAS,YAAY,SAAY,SAAS,UAAU,QAAQ;EACrE,OAAO,SAAS,SAAS,SAAS;EACnC;;AAGH,SAAS,mBAAmB,SAAmD;AAC7E,KAAI,SAAS,YACX,QAAO,QAAQ;AAEjB,QAAO,YAAY,gBAAgB,QAAQ"}

package/dist/node_modules/.pnpm/@opentelemetry_sdk-logs@0.214.0_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-logs/build/src/export/ReadableLogRecord.d.ts

@@ -1,2 +1,2 @@
-import { HrTime, SpanContext } from "@opentelemetry/api";
-import { Resource } from "@opentelemetry/resources";
+import { Resource } from "@opentelemetry/resources";
+import { HrTime, SpanContext } from "@opentelemetry/api";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-logs@0.214.0_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-logs/build/src/export/SdkLogRecord.d.ts

@@ -1,8 +1,8 @@
 import { AnyValue } from "../../../../../../../@opentelemetry_api-logs@0.214.0/node_modules/@opentelemetry/api-logs/build/src/types/AnyValue.js";
 import { LogAttributes, LogBody, SeverityNumber } from "../../../../../../../@opentelemetry_api-logs@0.214.0/node_modules/@opentelemetry/api-logs/build/src/types/LogRecord.js";
 import { InstrumentationScope } from "../../../../../../../@opentelemetry_core@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/core/build/src/common/types.js";
-import { HrTime, SpanContext } from "@opentelemetry/api";
 import { Resource } from "@opentelemetry/resources";
+import { HrTime, SpanContext } from "@opentelemetry/api";
 
 //#region ../../node_modules/.pnpm/@opentelemetry+sdk-logs@0.214.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-logs/build/src/export/SdkLogRecord.d.ts
 /**

package/dist/node_modules/.pnpm/@opentelemetry_sdk-metrics@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-metrics/build/src/MeterProvider.d.ts

@@ -1,4 +1,4 @@
 import "./view/View.js";
 import "./export/MetricReader.js";
-import { MeterProvider } from "@opentelemetry/api";
-import { Resource } from "@opentelemetry/resources";
+import { Resource } from "@opentelemetry/resources";
+import { MeterProvider } from "@opentelemetry/api";

package/dist/node_modules/.pnpm/@opentelemetry_sdk-metrics@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-metrics/build/src/export/MetricData.d.ts

@@ -1,8 +1,8 @@
 import { InstrumentationScope } from "../../../../../../../@opentelemetry_core@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/core/build/src/common/types.js";
 import { AggregationTemporality } from "./AggregationTemporality.js";
 import { ExponentialHistogram, Histogram } from "../aggregator/types.js";
-import { Attributes, HrTime, ValueType } from "@opentelemetry/api";
 import { Resource } from "@opentelemetry/resources";
+import { Attributes, HrTime, ValueType } from "@opentelemetry/api";
 
 //#region ../../node_modules/.pnpm/@opentelemetry+sdk-metrics@2.6.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-metrics/build/src/export/MetricData.d.ts
 /**

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/Span.d.ts

@@ -1,8 +1,8 @@
 import { ReadableSpan } from "./export/ReadableSpan.js";
 import "./SpanProcessor.js";
 import "./types.js";
-import { Attributes, Context, HrTime, Link, Span, SpanContext, SpanKind, SpanStatus } from "@opentelemetry/api";
 import { Resource } from "@opentelemetry/resources";
+import { Attributes, Context, HrTime, Link, Span, SpanContext, SpanKind, SpanStatus } from "@opentelemetry/api";
 
 //#region ../../node_modules/.pnpm/@opentelemetry+sdk-trace-base@2.6.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/Span.d.ts
 /**

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/ReadableSpan.d.ts

@@ -1,7 +1,7 @@
 import { InstrumentationScope } from "../../../../../../../@opentelemetry_core@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/core/build/src/common/types.js";
 import { TimedEvent } from "../TimedEvent.js";
-import { Attributes, HrTime, Link, SpanContext, SpanKind, SpanStatus } from "@opentelemetry/api";
 import { Resource } from "@opentelemetry/resources";
+import { Attributes, HrTime, Link, SpanContext, SpanKind, SpanStatus } from "@opentelemetry/api";
 
 //#region ../../node_modules/.pnpm/@opentelemetry+sdk-trace-base@2.6.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/export/ReadableSpan.d.ts
 interface ReadableSpan {

package/dist/node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/types.d.ts

@@ -1,8 +1,8 @@
 import { IdGenerator } from "./IdGenerator.js";
 import { Sampler } from "./Sampler.js";
 import { SpanProcessor } from "./SpanProcessor.js";
-import { MeterProvider } from "@opentelemetry/api";
 import { Resource } from "@opentelemetry/resources";
+import { MeterProvider } from "@opentelemetry/api";
 
 //#region ../../node_modules/.pnpm/@opentelemetry+sdk-trace-base@2.6.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/types.d.ts
 /**

package/dist/otel.d.ts

@@ -5,9 +5,9 @@ import "./node_modules/.pnpm/@opentelemetry_sdk-metrics@2.6.1_@opentelemetry_api
 import { SpanProcessor } from "./node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/SpanProcessor.js";
 import { TracerConfig } from "./node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/types.js";
 import "./node_modules/.pnpm/@opentelemetry_sdk-trace-base@2.6.1_@opentelemetry_api@1.9.1/node_modules/@opentelemetry/sdk-trace-base/build/src/index.js";
-import { Attributes } from "@opentelemetry/api";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { WebTracerProvider } from "@opentelemetry/sdk-trace-web";
+import { Attributes } from "@opentelemetry/api";
 
 //#region src/otel.d.ts
 /**

package/dist/providers/anonymous.d.ts

@@ -1,17 +1,23 @@
+import { AnonymousParams } from "../shared/params.js";
 import { ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
-import { Value } from "convex/values";
+import * as convex_values795 from "convex/values";
 import { DocumentByName, GenericDataModel, WithoutSystemFields } from "convex/server";
 
 //#region src/providers/anonymous.d.ts
+declare const vAnonymousParams: convex_values795.VObject<{
+  redirectTo?: string | undefined;
+} | undefined, {
+  redirectTo: convex_values795.VString<string | undefined, "optional">;
+}, "optional", "redirectTo">;
 /** Configuration for the {@link anonymous} provider. */
-interface AnonymousConfig<DataModel extends GenericDataModel> {
+interface AnonymousConfig<DataModel extends GenericDataModel, Id extends string = "anonymous"> {
   /** Stable provider identifier used in `signIn("<id>")`. */
-  id?: string;
+  id?: Id;
   /**
    * Optional profile factory used when creating the anonymous user document.
    * Must return a profile that includes `isAnonymous: true`.
    */
-  profile?: (params: Record<string, Value | undefined>, ctx: GenericActionCtxWithAuthConfig<DataModel>) => WithoutSystemFields<DocumentByName<DataModel, "User">> & {
+  profile?: (params: AnonymousParams, ctx: GenericActionCtxWithAuthConfig<DataModel>) => WithoutSystemFields<DocumentByName<DataModel, "User">> & {
     isAnonymous: true;
   };
 }
@@ -29,7 +35,7 @@ interface AnonymousConfig<DataModel extends GenericDataModel> {
  * anonymous()
  * ```
  */
-declare function anonymous<DataModel extends GenericDataModel = GenericDataModel>(config?: AnonymousConfig<DataModel>): ConvexCredentialsConfig;
+declare function anonymous<DataModel extends GenericDataModel = GenericDataModel, const Id extends string = "anonymous">(config?: AnonymousConfig<DataModel, Id>): ConvexCredentialsConfig<DataModel, typeof vAnonymousParams, Id>;
 //#endregion
 export { AnonymousConfig, anonymous };
 //# sourceMappingURL=anonymous.d.ts.map

package/dist/providers/anonymous.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous.d.ts","names":[],"sources":["../../src/providers/anonymous.ts"],"mappings":";;;;;;UAmBiB,eAAA,mBAAkC,gBAAA;EAUzB;EARxB,EAAA;EAF+B;;;;EAO/B,OAAA,IACE,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,mBAAA,CAAoB,cAAA,CAAe,SAAA;IACtC,WAAA;EAAA;AAAA;;;;;;;;;AA0BJ;;;;;;iBAAgB,SAAA,mBAA4B,gBAAA,GAAmB,gBAAA,CAAA,CAC7D,MAAA,GAAQ,eAAA,CAAgB,SAAA,IACvB,uBAAA"}
+{"version":3,"file":"anonymous.d.ts","names":[],"sources":["../../src/providers/anonymous.ts"],"mappings":";;;;;;cAmBM,gBAAA,EAA+E,gBAAA,CAA/D,OAAA;;;cAA+D,gBAAA,CAAA,OAAA;AAAA;;UAGpE,eAAA,mBACG,gBAAA;EAUR;EANV,EAAA,GAAK,EAAA;EAOE;;;;EAFP,OAAA,IACE,MAAA,EAAQ,eAAA,EACR,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,mBAAA,CAAoB,cAAA,CAAe,SAAA;IACtC,WAAA;EAAA;AAAA;;;;;;;;;;;;;;;iBA0BY,SAAA,mBACI,gBAAA,GAAmB,gBAAA,wCAAA,CAGrC,MAAA,GAAQ,eAAA,CAAgB,SAAA,EAAW,EAAA,IAClC,uBAAA,CAAwB,SAAA,SAAkB,gBAAA,EAAkB,EAAA"}

package/dist/providers/anonymous.js

@@ -1,6 +1,8 @@
 import { credentials } from "./credentials.js";
+import { v } from "convex/values";
 
 //#region src/providers/anonymous.ts
+const vAnonymousParams = v.optional(v.object({ redirectTo: v.optional(v.string()) }));
 function defaultAnonymousProfile() {
 	return { isAnonymous: true };
 }
@@ -22,8 +24,9 @@ function anonymous(config = {}) {
 	const provider = config.id ?? "anonymous";
 	return credentials({
 		id: provider,
+		params: vAnonymousParams,
 		authorize: async (params, ctx) => {
-			const profile = config.profile?.(params, ctx) ?? defaultAnonymousProfile();
+			const profile = config.profile?.(params ?? {}, ctx) ?? defaultAnonymousProfile();
 			const { user } = await ctx.auth.account.create(ctx, {
 				provider,
 				account: { id: crypto.randomUUID() },

package/dist/providers/anonymous.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous.js","names":[],"sources":["../../src/providers/anonymous.ts"],"sourcesContent":["/**\n * Anonymous authentication provider.\n *\n * ```ts\n * import { anonymous } from \"@estifanos-sh/convex-auth/providers\";\n *\n * anonymous()\n * ```\n *\n * @module\n */\n\nimport { DocumentByName, GenericDataModel, WithoutSystemFields } from \"convex/server\";\nimport { Value } from \"convex/values\";\n\nimport type { ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from \"../server/types\";\nimport { credentials } from \"./credentials\";\n\n/** Configuration for the {@link anonymous} provider. */\nexport interface AnonymousConfig<DataModel extends GenericDataModel> {\n  /** Stable provider identifier used in `signIn(\"<id>\")`. */\n  id?: string;\n  /**\n   * Optional profile factory used when creating the anonymous user document.\n   * Must return a profile that includes `isAnonymous: true`.\n   */\n  profile?: (\n    params: Record<string, Value | undefined>,\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => WithoutSystemFields<DocumentByName<DataModel, \"User\">> & {\n    isAnonymous: true;\n  };\n}\n\nfunction defaultAnonymousProfile<DataModel extends GenericDataModel>() {\n  return {\n    isAnonymous: true,\n  } as WithoutSystemFields<DocumentByName<DataModel, \"User\">> & {\n    isAnonymous: true;\n  };\n}\n\n/**\n * Create an anonymous sign-in provider.\n *\n * @typeParam DataModel - The Convex data model used by the auth context.\n * @param config - Optional provider id and profile customization.\n * @returns A configured anonymous provider for `defineAuth`.\n *\n * @example\n * ```ts\n * import { anonymous } from \"@estifanos-sh/convex-auth/providers\";\n *\n * anonymous()\n * ```\n */\nexport function anonymous<DataModel extends GenericDataModel = GenericDataModel>(\n  config: AnonymousConfig<DataModel> = {} as AnonymousConfig<DataModel>,\n): ConvexCredentialsConfig {\n  const provider = config.id ?? \"anonymous\";\n\n  return credentials<DataModel>({\n    id: provider,\n    authorize: async (params, ctx) => {\n      const profile = config.profile?.(params, ctx) ?? defaultAnonymousProfile<DataModel>();\n      const { user } = await ctx.auth.account.create(ctx, {\n        provider,\n        account: { id: crypto.randomUUID() },\n        profile,\n      });\n      return { userId: user._id };\n    },\n    ...config,\n  });\n}\n"],"mappings":";;;AAkCA,SAAS,0BAA8D;AACrE,QAAO,EACL,aAAa,MACd;;;;;;;;;;;;;;;;AAmBH,SAAgB,UACd,SAAqC,EAAE,EACd;CACzB,MAAM,WAAW,OAAO,MAAM;AAE9B,QAAO,YAAuB;EAC5B,IAAI;EACJ,WAAW,OAAO,QAAQ,QAAQ;GAChC,MAAM,UAAU,OAAO,UAAU,QAAQ,IAAI,IAAI,yBAAoC;GACrF,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;IAClD;IACA,SAAS,EAAE,IAAI,OAAO,YAAY,EAAE;IACpC;IACD,CAAC;AACF,UAAO,EAAE,QAAQ,KAAK,KAAK;;EAE7B,GAAG;EACJ,CAAC"}
+{"version":3,"file":"anonymous.js","names":[],"sources":["../../src/providers/anonymous.ts"],"sourcesContent":["/**\n * Anonymous authentication provider.\n *\n * ```ts\n * import { anonymous } from \"@estifanos-sh/convex-auth/providers\";\n *\n * anonymous()\n * ```\n *\n * @module\n */\n\nimport type { DocumentByName, GenericDataModel, WithoutSystemFields } from \"convex/server\";\nimport { v } from \"convex/values\";\n\nimport type { AnonymousParams } from \"../shared/params\";\nimport type { ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from \"../server/types\";\nimport { credentials } from \"./credentials\";\n\nconst vAnonymousParams = v.optional(v.object({ redirectTo: v.optional(v.string()) }));\n\n/** Configuration for the {@link anonymous} provider. */\nexport interface AnonymousConfig<\n  DataModel extends GenericDataModel,\n  Id extends string = \"anonymous\",\n> {\n  /** Stable provider identifier used in `signIn(\"<id>\")`. */\n  id?: Id;\n  /**\n   * Optional profile factory used when creating the anonymous user document.\n   * Must return a profile that includes `isAnonymous: true`.\n   */\n  profile?: (\n    params: AnonymousParams,\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => WithoutSystemFields<DocumentByName<DataModel, \"User\">> & {\n    isAnonymous: true;\n  };\n}\n\nfunction defaultAnonymousProfile<DataModel extends GenericDataModel>() {\n  return {\n    isAnonymous: true,\n  } as WithoutSystemFields<DocumentByName<DataModel, \"User\">> & {\n    isAnonymous: true;\n  };\n}\n\n/**\n * Create an anonymous sign-in provider.\n *\n * @typeParam DataModel - The Convex data model used by the auth context.\n * @param config - Optional provider id and profile customization.\n * @returns A configured anonymous provider for `defineAuth`.\n *\n * @example\n * ```ts\n * import { anonymous } from \"@estifanos-sh/convex-auth/providers\";\n *\n * anonymous()\n * ```\n */\nexport function anonymous<\n  DataModel extends GenericDataModel = GenericDataModel,\n  const Id extends string = \"anonymous\",\n>(\n  config: AnonymousConfig<DataModel, Id> = {} as AnonymousConfig<DataModel, Id>,\n): ConvexCredentialsConfig<DataModel, typeof vAnonymousParams, Id> {\n  const provider = (config.id ?? \"anonymous\") as Id;\n\n  return credentials<typeof vAnonymousParams, DataModel, Id>({\n    id: provider,\n    params: vAnonymousParams,\n    authorize: async (params, ctx) => {\n      const profile = config.profile?.(params ?? {}, ctx) ?? defaultAnonymousProfile<DataModel>();\n      const { user } = await ctx.auth.account.create(ctx, {\n        provider,\n        account: { id: crypto.randomUUID() },\n        profile,\n      });\n      return { userId: user._id };\n    },\n    ...config,\n  });\n}\n"],"mappings":";;;;AAmBA,MAAM,mBAAmB,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;AAqBrF,SAAS,0BAA8D;AACrE,QAAO,EACL,aAAa,MACd;;;;;;;;;;;;;;;;AAmBH,SAAgB,UAId,SAAyC,EAAE,EACsB;CACjE,MAAM,WAAY,OAAO,MAAM;AAE/B,QAAO,YAAoD;EACzD,IAAI;EACJ,QAAQ;EACR,WAAW,OAAO,QAAQ,QAAQ;GAChC,MAAM,UAAU,OAAO,UAAU,UAAU,EAAE,EAAE,IAAI,IAAI,yBAAoC;GAC3F,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;IAClD;IACA,SAAS,EAAE,IAAI,OAAO,YAAY,EAAE;IACpC;IACD,CAAC;AACF,UAAO,EAAE,QAAQ,KAAK,KAAK;;EAE7B,GAAG;EACJ,CAAC"}

package/dist/providers/apple.d.ts

@@ -55,7 +55,7 @@ interface AppleConfig {
  * })
  * ```
  */
-declare function apple(config: AppleConfig): OAuthMaterializedConfig;
+declare function apple(config: AppleConfig): OAuthMaterializedConfig<"apple">;
 //#endregion
 export { AppleConfig, apple };
 //# sourceMappingURL=apple.d.ts.map

package/dist/providers/apple.js

@@ -1,6 +1,6 @@
-import { createArcticOAuthClient, createOAuthProvider } from "../server/oauth/factory.js";
+import { createOAuthClient, createOAuthProvider } from "../server/oauth/factory.js";
 import { defaultOAuthRedirectUri } from "./redirect.js";
-import { Apple } from "arctic";
+import { SignJWT, importPKCS8 } from "jose";
 
 //#region src/providers/apple.ts
 /**
@@ -42,10 +42,25 @@ const DEFAULT_SCOPES = ["name", "email"];
 function apple(config) {
 	const privateKey = typeof config.privateKey === "string" ? config.privateKey : new TextDecoder().decode(config.privateKey);
 	const scopes = config.scopes ?? DEFAULT_SCOPES;
-	const createProvider = (redirectUri) => new Apple(config.clientId, config.teamId, config.keyId, new TextEncoder().encode(privateKey), config.redirectUri ?? defaultOAuthRedirectUri("apple", redirectUri));
 	return createOAuthProvider({
 		id: "apple",
-		provider: createArcticOAuthClient(createProvider, { pkce: "never" }),
+		provider: createOAuthClient({
+			clientId: config.clientId,
+			redirectUri: (redirectUri) => config.redirectUri ?? defaultOAuthRedirectUri("apple", redirectUri),
+			authorizationUrl: "https://appleid.apple.com/auth/authorize",
+			tokenUrl: "https://appleid.apple.com/auth/token",
+			pkce: "never",
+			tokenAuth: "body",
+			tokenParams: async () => ({ client_secret: await new SignJWT({
+				iss: config.teamId,
+				aud: "https://appleid.apple.com",
+				sub: config.clientId
+			}).setProtectedHeader({
+				alg: "ES256",
+				kid: config.keyId,
+				typ: "JWT"
+			}).setIssuedAt().setExpirationTime("5m").sign(await importPKCS8(privateKey, "ES256")) })
+		}),
 		scopes,
 		accountLinking: config.accountLinking,
 		updateProfileOnLogin: config.updateProfileOnLogin

package/dist/providers/apple.js.map

@@ -1 +1 @@
-{"version":3,"file":"apple.js","names":["ArcticApple"],"sources":["../../src/providers/apple.ts"],"sourcesContent":["/**\n * Apple OAuth provider.\n *\n * ```ts\n * import { apple } from \"@estifanos-sh/convex-auth/providers/apple\";\n *\n * apple({\n *   clientId: env.APPLE_CLIENT_ID,\n *   teamId: env.APPLE_TEAM_ID,\n *   keyId: env.APPLE_KEY_ID,\n *   privateKey: env.APPLE_PRIVATE_KEY,\n * })\n * ```\n *\n * @module\n */\n\nimport { Apple as ArcticApple } from \"arctic\";\n\nimport { createArcticOAuthClient, createOAuthProvider } from \"../server/oauth/factory\";\nimport { defaultOAuthRedirectUri } from \"./redirect\";\n\nconst DEFAULT_SCOPES = [\"name\", \"email\"];\n\n/** Configuration for the {@link apple} provider. */\nexport interface AppleConfig {\n  /** Services ID or app bundle identifier registered with Sign in with Apple. */\n  clientId: string;\n  /** Apple Developer team identifier used to sign client secrets. */\n  teamId: string;\n  /** Apple private key identifier. */\n  keyId: string;\n  /** Apple private key PEM contents or bytes. */\n  privateKey: string | Uint8Array;\n  /** Optional callback URL override. Defaults to the auth site URL plus `/callback/apple`. */\n  redirectUri?: string;\n  /** Optional OAuth scopes. Defaults to `name email`. */\n  scopes?: string[];\n  /** Account-linking strategy for existing users with matching email addresses. */\n  accountLinking?: \"verifiedEmail\" | \"none\";\n  /** On returning sign-in, refresh `User.name`/`image`/`email` from the new profile. Defaults to `true`. */\n  updateProfileOnLogin?: boolean;\n}\n\n/**\n * Create an Apple OAuth provider.\n *\n * @param config - Apple Sign In client settings and signing key material.\n * @returns A configured Apple OAuth provider for `defineAuth`.\n * @throws {Error} When no callback URL can be derived and `redirectUri` is omitted.\n *\n * @example\n * ```ts\n * import { apple } from \"@estifanos-sh/convex-auth/providers/apple\";\n *\n * apple({\n *   clientId: env.APPLE_CLIENT_ID,\n *   teamId: env.APPLE_TEAM_ID,\n *   keyId: env.APPLE_KEY_ID,\n *   privateKey: env.APPLE_PRIVATE_KEY,\n * })\n * ```\n */\nexport function apple(config: AppleConfig) {\n  const privateKey =\n    typeof config.privateKey === \"string\"\n      ? config.privateKey\n      : new TextDecoder().decode(config.privateKey);\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n  const createProvider = (redirectUri?: string) =>\n    new ArcticApple(\n      config.clientId,\n      config.teamId,\n      config.keyId,\n      new TextEncoder().encode(privateKey),\n      config.redirectUri ?? defaultOAuthRedirectUri(\"apple\", redirectUri),\n    );\n  return createOAuthProvider({\n    id: \"apple\",\n    provider: createArcticOAuthClient(createProvider, { pkce: \"never\" }),\n    scopes,\n    accountLinking: config.accountLinking,\n    updateProfileOnLogin: config.updateProfileOnLogin,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsBA,MAAM,iBAAiB,CAAC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;AAyCxC,SAAgB,MAAM,QAAqB;CACzC,MAAM,aACJ,OAAO,OAAO,eAAe,WACzB,OAAO,aACP,IAAI,aAAa,CAAC,OAAO,OAAO,WAAW;CACjD,MAAM,SAAS,OAAO,UAAU;CAChC,MAAM,kBAAkB,gBACtB,IAAIA,MACF,OAAO,UACP,OAAO,QACP,OAAO,OACP,IAAI,aAAa,CAAC,OAAO,WAAW,EACpC,OAAO,eAAe,wBAAwB,SAAS,YAAY,CACpE;AACH,QAAO,oBAAoB;EACzB,IAAI;EACJ,UAAU,wBAAwB,gBAAgB,EAAE,MAAM,SAAS,CAAC;EACpE;EACA,gBAAgB,OAAO;EACvB,sBAAsB,OAAO;EAC9B,CAAC"}
+{"version":3,"file":"apple.js","names":[],"sources":["../../src/providers/apple.ts"],"sourcesContent":["/**\n * Apple OAuth provider.\n *\n * ```ts\n * import { apple } from \"@estifanos-sh/convex-auth/providers/apple\";\n *\n * apple({\n *   clientId: env.APPLE_CLIENT_ID,\n *   teamId: env.APPLE_TEAM_ID,\n *   keyId: env.APPLE_KEY_ID,\n *   privateKey: env.APPLE_PRIVATE_KEY,\n * })\n * ```\n *\n * @module\n */\n\nimport { importPKCS8, SignJWT } from \"jose\";\n\nimport { createOAuthClient, createOAuthProvider } from \"../server/oauth/factory\";\nimport { defaultOAuthRedirectUri } from \"./redirect\";\n\nconst DEFAULT_SCOPES = [\"name\", \"email\"];\n\n/** Configuration for the {@link apple} provider. */\nexport interface AppleConfig {\n  /** Services ID or app bundle identifier registered with Sign in with Apple. */\n  clientId: string;\n  /** Apple Developer team identifier used to sign client secrets. */\n  teamId: string;\n  /** Apple private key identifier. */\n  keyId: string;\n  /** Apple private key PEM contents or bytes. */\n  privateKey: string | Uint8Array;\n  /** Optional callback URL override. Defaults to the auth site URL plus `/callback/apple`. */\n  redirectUri?: string;\n  /** Optional OAuth scopes. Defaults to `name email`. */\n  scopes?: string[];\n  /** Account-linking strategy for existing users with matching email addresses. */\n  accountLinking?: \"verifiedEmail\" | \"none\";\n  /** On returning sign-in, refresh `User.name`/`image`/`email` from the new profile. Defaults to `true`. */\n  updateProfileOnLogin?: boolean;\n}\n\n/**\n * Create an Apple OAuth provider.\n *\n * @param config - Apple Sign In client settings and signing key material.\n * @returns A configured Apple OAuth provider for `defineAuth`.\n * @throws {Error} When no callback URL can be derived and `redirectUri` is omitted.\n *\n * @example\n * ```ts\n * import { apple } from \"@estifanos-sh/convex-auth/providers/apple\";\n *\n * apple({\n *   clientId: env.APPLE_CLIENT_ID,\n *   teamId: env.APPLE_TEAM_ID,\n *   keyId: env.APPLE_KEY_ID,\n *   privateKey: env.APPLE_PRIVATE_KEY,\n * })\n * ```\n */\nexport function apple(config: AppleConfig) {\n  const privateKey =\n    typeof config.privateKey === \"string\"\n      ? config.privateKey\n      : new TextDecoder().decode(config.privateKey);\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n  return createOAuthProvider({\n    id: \"apple\",\n    provider: createOAuthClient({\n      clientId: config.clientId,\n      redirectUri: (redirectUri) =>\n        config.redirectUri ?? defaultOAuthRedirectUri(\"apple\", redirectUri),\n      authorizationUrl: \"https://appleid.apple.com/auth/authorize\",\n      tokenUrl: \"https://appleid.apple.com/auth/token\",\n      pkce: \"never\",\n      tokenAuth: \"body\",\n      tokenParams: async () => ({\n        client_secret: await new SignJWT({\n          iss: config.teamId,\n          aud: \"https://appleid.apple.com\",\n          sub: config.clientId,\n        })\n          .setProtectedHeader({ alg: \"ES256\", kid: config.keyId, typ: \"JWT\" })\n          .setIssuedAt()\n          .setExpirationTime(\"5m\")\n          .sign(await importPKCS8(privateKey, \"ES256\")),\n      }),\n    }),\n    scopes,\n    accountLinking: config.accountLinking,\n    updateProfileOnLogin: config.updateProfileOnLogin,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsBA,MAAM,iBAAiB,CAAC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;AAyCxC,SAAgB,MAAM,QAAqB;CACzC,MAAM,aACJ,OAAO,OAAO,eAAe,WACzB,OAAO,aACP,IAAI,aAAa,CAAC,OAAO,OAAO,WAAW;CACjD,MAAM,SAAS,OAAO,UAAU;AAChC,QAAO,oBAAoB;EACzB,IAAI;EACJ,UAAU,kBAAkB;GAC1B,UAAU,OAAO;GACjB,cAAc,gBACZ,OAAO,eAAe,wBAAwB,SAAS,YAAY;GACrE,kBAAkB;GAClB,UAAU;GACV,MAAM;GACN,WAAW;GACX,aAAa,aAAa,EACxB,eAAe,MAAM,IAAI,QAAQ;IAC/B,KAAK,OAAO;IACZ,KAAK;IACL,KAAK,OAAO;IACb,CAAC,CACC,mBAAmB;IAAE,KAAK;IAAS,KAAK,OAAO;IAAO,KAAK;IAAO,CAAC,CACnE,aAAa,CACb,kBAAkB,KAAK,CACvB,KAAK,MAAM,YAAY,YAAY,QAAQ,CAAC,EAChD;GACF,CAAC;EACF;EACA,gBAAgB,OAAO;EACvB,sBAAsB,OAAO;EAC9B,CAAC"}

package/dist/providers/credentials.d.ts

@@ -1,9 +1,9 @@
-import { Hashed } from "../shared/brand.js";
+import { ProviderParams } from "../shared/params.js";
 import { SignInFlowResult } from "../shared/results.js";
 import { SessionIssuance } from "../server/session/lifecycle.js";
 import { AuthProfile } from "../server/payloads.js";
 import { AuthProviderConfig, ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
-import { GenericId, Value } from "convex/values";
+import { GenericId, GenericValidator, Infer } from "convex/values";
 import { GenericDataModel } from "convex/server";
 
 //#region src/providers/credentials.d.ts
@@ -30,29 +30,35 @@ type CredentialsAuthorizeResult = {
    */
   issuance?: SessionIssuance;
 } | {
-  /** Provision or retrieve the provider account before issuing a session. */provision: CredentialsProvisioning; /** TOTP step-up hint for the resulting user. */
+  /** Stage a verified identity for atomic account + passkey enrollment. */provision: CredentialsProvisioning; /** TOTP step-up hint for the resulting user. */
   hasTotp?: boolean;
 } | Exclude<SignInFlowResult<null>, {
   kind: "signedIn";
 }> | null;
+type CredentialsParams<ParamsValidator extends GenericValidator> = Exclude<Infer<ParamsValidator>, undefined> extends infer Params extends ProviderParams ? Params : never;
+type CredentialsAuthorizeParams<ParamsValidator extends GenericValidator> = CredentialsParams<ParamsValidator> extends never ? never : Infer<ParamsValidator>;
 /** Configuration for the {@link credentials} provider. */
-interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataModel> {
-  /** Stable provider identifier used in `signIn("<id>")`. */
-  id?: string;
+type CredentialsConfig<ParamsValidator extends GenericValidator = GenericValidator, DataModel extends GenericDataModel = GenericDataModel, Id extends string = string> = CredentialsParams<ParamsValidator> extends never ? never : {
+  /** Stable provider identifier used in `signIn("<id>")`. */id?: Id;
+  /**
+   * Convex validator for the parameters accepted by this provider.
+   *
+   * The validator is the single source of truth for the callback parameter
+   * type, the generated `api.auth.signIn` reference, and runtime validation.
+   */
+  params: ParamsValidator;
   /**
    * Validate the submitted credentials and return the authenticated user or
    * verified identity to provision.
    * Return `null` to reject the sign-in attempt.
    */
-  authorize: (credentials: Partial<Record<string, Value | undefined>>, ctx: GenericActionCtxWithAuthConfig<DataModel>) => Promise<CredentialsAuthorizeResult>;
-  /** Optional hashing helpers for password-style credential verification. */
+  authorize: (credentials: CredentialsAuthorizeParams<ParamsValidator>, ctx: GenericActionCtxWithAuthConfig<DataModel>) => Promise<CredentialsAuthorizeResult>; /** Optional hashing helpers for password-style credential verification. */
   crypto?: {
-    hashSecret: (secret: string) => Promise<Hashed<"Password">>;
-    verifySecret: (secret: string, hash: Hashed<"Password">) => Promise<boolean>;
-  };
-  /** Additional providers to register alongside this credentials provider. */
+    hashSecret: (secret: string) => Promise<string>;
+    verifySecret: (secret: string, hash: string) => Promise<boolean>;
+  }; /** Additional providers to register alongside this credentials provider. */
   extraProviders?: (AuthProviderConfig | undefined)[];
-}
+};
 /**
  * Create a credentials provider for custom sign-in logic.
  *
@@ -63,8 +69,10 @@ interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataMode
  * @example
  * ```ts
  * import { credentials } from "@estifanos-sh/convex-auth/providers";
+ * import { v } from "convex/values";
  *
  * credentials({
+ *   params: v.object({ email: v.string(), password: v.string() }),
  *   authorize: async (params, ctx) => {
  *     const user = await lookupUser(params.email, params.password, ctx);
  *     return user ? { userId: user._id } : null;
@@ -72,7 +80,7 @@ interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataMode
  * })
  * ```
  */
-declare function credentials<DataModel extends GenericDataModel = GenericDataModel>(config: CredentialsConfig<DataModel>): ConvexCredentialsConfig<DataModel>;
+declare function credentials<const ParamsValidator extends GenericValidator = GenericValidator, DataModel extends GenericDataModel = GenericDataModel, const Id extends string = "credentials">(config: CredentialsConfig<ParamsValidator, DataModel, Id>): ConvexCredentialsConfig<DataModel, ParamsValidator, Id>;
 //#endregion
 export { CredentialsAuthorizeResult, CredentialsConfig, CredentialsProvisioning, credentials };
 //# sourceMappingURL=credentials.d.ts.map

package/dist/providers/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","names":[],"sources":["../../src/providers/credentials.ts"],"mappings":";;;;;;;;;KA6BY,uBAAA;EAS0B,uEAPpC,OAAA;IAAW,EAAA;IAAY,MAAA;EAAA,GAyBR;EAvBf,OAAA,EAAS,WAAA,EA2BP;EAzBF,KAAA,GAAQ,KAAA;AAAA;AAAA,KAGE,0BAAA;EAEN,MAAA,EAAQ,SAAA;EACR,SAAA,GAAY,SAAA;EAAA;;;;EAKZ,OAAA;EAUW;;;;;EAJX,QAAA,GAAW,eAAA;AAAA;EAYA,2EARX,SAAA,EAAW,uBAAA,EAQiB;EAN5B,OAAA;AAAA,IAEF,OAAA,CAAQ,gBAAA;EAA0B,IAAA;AAAA;;UAIrB,iBAAA,mBAAoC,gBAAA,GAAmB,gBAAA;EAU/D;EARP,EAAA;EASK;;;;;EAHL,SAAA,GACE,WAAA,EAAa,OAAA,CAAQ,MAAA,SAAe,KAAA,gBACpC,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA,CAAQ,0BAAA;EAOuB;EALpC,MAAA;IACE,UAAA,GAAa,MAAA,aAAmB,OAAA,CAAQ,MAAA;IACxC,YAAA,GAAe,MAAA,UAAgB,IAAA,EAAM,MAAA,iBAAuB,OAAA;EAAA;EAb9D;EAgBA,cAAA,IAAkB,kBAAA;AAAA;;;;;;;;;;;;;;;;;;;;iBAsBJ,WAAA,mBAA8B,gBAAA,GAAmB,gBAAA,CAAA,CAC/D,MAAA,EAAQ,iBAAA,CAAkB,SAAA,IACzB,uBAAA,CAAwB,SAAA"}
+{"version":3,"file":"credentials.d.ts","names":[],"sources":["../../src/providers/credentials.ts"],"mappings":";;;;;;;;;KA+BY,uBAAA;EAWE,uEATZ,OAAA;IAAW,EAAA;IAAY,MAAA;EAAA,GA6BrB;EA3BF,OAAA,EAAS,WAAA,EA2BA;EAzBT,KAAA,GAAQ,KAAA;AAAA;AAAA,KAGE,0BAAA;EAEN,MAAA,EAAQ,SAAA;EACR,SAAA,GAAY,SAAA;EAWZ;;;;EANA,OAAA;EAcF;;;;;EARE,QAAA,GAAW,eAAA;AAAA;EAWK,yEAPhB,SAAA,EAAW,uBAAA,EAQD;EANV,OAAA;AAAA,IAEF,OAAA,CAAQ,gBAAA;EAA0B,IAAA;AAAA;AAAA,KAGjC,iBAAA,yBAA0C,gBAAA,IAC7C,OAAA,CAAQ,KAAA,CAAM,eAAA,2CAA0D,cAAA,GACpE,MAAA;AAAA,KAGD,0BAAA,yBAAmD,gBAAA,IACtD,iBAAA,CAAkB,eAAA,0BAAyC,KAAA,CAAM,eAAA;;KAGvD,iBAAA,yBACc,gBAAA,GAAmB,gBAAA,oBACzB,gBAAA,GAAmB,gBAAA,gCAGrC,iBAAA,CAAkB,eAAA;EAbV,2DAiBF,EAAA,GAAK,EAAA;EAjB8C;;;;;AAC/C;EAuBJ,MAAA,EAAQ,eAAA;EApBe;;;;;EA0BvB,SAAA,GACE,WAAA,EAAa,0BAAA,CAA2B,eAAA,GACxC,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA,CAAQ,0BAAA,GA5B6C;EA8B1D,MAAA;IACE,UAAA,GAAa,MAAA,aAAmB,OAAA;IAChC,YAAA,GAAe,MAAA,UAAgB,IAAA,aAAiB,OAAA;EAAA,GAhCtC;EAmCZ,cAAA,IAAkB,kBAAA;AAAA;;;AAhC1B;;;;;;;;;;;;;;;;;;;iBAwDgB,WAAA,+BACgB,gBAAA,GAAmB,gBAAA,oBAC/B,gBAAA,GAAmB,gBAAA,0CAAA,CAGrC,MAAA,EAAQ,iBAAA,CAAkB,eAAA,EAAiB,SAAA,EAAW,EAAA,IACrD,uBAAA,CAAwB,SAAA,EAAW,eAAA,EAAiB,EAAA"}

package/dist/providers/credentials.js

@@ -9,8 +9,10 @@
 * @example
 * ```ts
 * import { credentials } from "@estifanos-sh/convex-auth/providers";
+* import { v } from "convex/values";
 *
 * credentials({
+*   params: v.object({ email: v.string(), password: v.string() }),
 *   authorize: async (params, ctx) => {
 *     const user = await lookupUser(params.email, params.password, ctx);
 *     return user ? { userId: user._id } : null;

package/dist/providers/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../src/providers/credentials.ts"],"sourcesContent":["/**\n * Credentials provider for custom authentication flows.\n *\n * ```ts\n * import { credentials } from \"@estifanos-sh/convex-auth/providers\";\n *\n * credentials({\n *   authorize: async (credentials, ctx) => {\n *     // Your custom logic here...\n *   },\n * })\n * ```\n *\n * @module\n */\n\nimport { GenericDataModel } from \"convex/server\";\nimport { GenericId, Value } from \"convex/values\";\n\nimport type { Hashed } from \"../shared/brand\";\nimport type { SignInFlowResult } from \"../shared/results\";\nimport type { SessionIssuance } from \"../server/session/lifecycle\";\nimport type { AuthProfile } from \"../server/payloads\";\nimport type {\n  AuthProviderConfig,\n  ConvexCredentialsConfig,\n  GenericActionCtxWithAuthConfig,\n} from \"../server/types\";\n\nexport type CredentialsProvisioning = {\n  /** Stable provider-owned identifier and optional credential secret. */\n  account: { id: string; secret?: string };\n  /** User profile established by the provider's verified ceremony. */\n  profile: AuthProfile;\n  /** Verified profile fields that may safely match an existing user. */\n  match?: Array<\"email\" | \"phone\">;\n};\n\nexport type CredentialsAuthorizeResult =\n  | {\n      userId: GenericId<\"User\">;\n      sessionId?: GenericId<\"Session\">;\n      /**\n       * TOTP step-up hint. `false` skips the verified-TOTP lookup;\n       * `true`/`undefined` falls back to it.\n       */\n      hasTotp?: boolean;\n      /**\n       * Pre-issued session from a combined verify+issue mutation. When set,\n       * the framework skips the second `callSignIn` mutation and finalizes\n       * the issuance directly on the action side.\n       */\n      issuance?: SessionIssuance;\n    }\n  | {\n      /** Provision or retrieve the provider account before issuing a session. */\n      provision: CredentialsProvisioning;\n      /** TOTP step-up hint for the resulting user. */\n      hasTotp?: boolean;\n    }\n  | Exclude<SignInFlowResult<null>, { kind: \"signedIn\" }>\n  | null;\n\n/** Configuration for the {@link credentials} provider. */\nexport interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataModel> {\n  /** Stable provider identifier used in `signIn(\"<id>\")`. */\n  id?: string;\n  /**\n   * Validate the submitted credentials and return the authenticated user or\n   * verified identity to provision.\n   * Return `null` to reject the sign-in attempt.\n   */\n  authorize: (\n    credentials: Partial<Record<string, Value | undefined>>,\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => Promise<CredentialsAuthorizeResult>;\n  /** Optional hashing helpers for password-style credential verification. */\n  crypto?: {\n    hashSecret: (secret: string) => Promise<Hashed<\"Password\">>;\n    verifySecret: (secret: string, hash: Hashed<\"Password\">) => Promise<boolean>;\n  };\n  /** Additional providers to register alongside this credentials provider. */\n  extraProviders?: (AuthProviderConfig | undefined)[];\n}\n\n/**\n * Create a credentials provider for custom sign-in logic.\n *\n * @typeParam DataModel - The Convex data model used by the auth context.\n * @param config - Custom authorization and hashing hooks.\n * @returns A configured credentials provider for `defineAuth`.\n *\n * @example\n * ```ts\n * import { credentials } from \"@estifanos-sh/convex-auth/providers\";\n *\n * credentials({\n *   authorize: async (params, ctx) => {\n *     const user = await lookupUser(params.email, params.password, ctx);\n *     return user ? { userId: user._id } : null;\n *   },\n * })\n * ```\n */\nexport function credentials<DataModel extends GenericDataModel = GenericDataModel>(\n  config: CredentialsConfig<DataModel>,\n): ConvexCredentialsConfig<DataModel> {\n  return {\n    ...config,\n    id: config.id ?? \"credentials\",\n    type: \"credentials\",\n  } as ConvexCredentialsConfig<DataModel>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwGA,SAAgB,YACd,QACoC;AACpC,QAAO;EACL,GAAG;EACH,IAAI,OAAO,MAAM;EACjB,MAAM;EACP"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../src/providers/credentials.ts"],"sourcesContent":["/**\n * Credentials provider for custom authentication flows.\n *\n * ```ts\n * import { credentials } from \"@estifanos-sh/convex-auth/providers\";\n * import { v } from \"convex/values\";\n *\n * credentials({\n *   params: v.object({ email: v.string(), password: v.string() }),\n *   authorize: async (credentials, ctx) => {\n *     // Your custom logic here...\n *   },\n * })\n * ```\n *\n * @module\n */\n\nimport type { GenericDataModel } from \"convex/server\";\nimport type { GenericId, GenericValidator, Infer } from \"convex/values\";\n\nimport type { ProviderParams } from \"../shared/params\";\nimport type { SignInFlowResult } from \"../shared/results\";\nimport type { SessionIssuance } from \"../server/session/lifecycle\";\nimport type { AuthProfile } from \"../server/payloads\";\nimport type {\n  AuthProviderConfig,\n  ConvexCredentialsConfig,\n  GenericActionCtxWithAuthConfig,\n} from \"../server/types\";\n\nexport type CredentialsProvisioning = {\n  /** Stable provider-owned identifier and optional credential secret. */\n  account: { id: string; secret?: string };\n  /** User profile established by the provider's verified ceremony. */\n  profile: AuthProfile;\n  /** Verified profile fields that may safely match an existing user. */\n  match?: Array<\"email\" | \"phone\">;\n};\n\nexport type CredentialsAuthorizeResult =\n  | {\n      userId: GenericId<\"User\">;\n      sessionId?: GenericId<\"Session\">;\n      /**\n       * TOTP step-up hint. `false` skips the verified-TOTP lookup;\n       * `true`/`undefined` falls back to it.\n       */\n      hasTotp?: boolean;\n      /**\n       * Pre-issued session from a combined verify+issue mutation. When set,\n       * the framework skips the second `callSignIn` mutation and finalizes\n       * the issuance directly on the action side.\n       */\n      issuance?: SessionIssuance;\n    }\n  | {\n      /** Stage a verified identity for atomic account + passkey enrollment. */\n      provision: CredentialsProvisioning;\n      /** TOTP step-up hint for the resulting user. */\n      hasTotp?: boolean;\n    }\n  | Exclude<SignInFlowResult<null>, { kind: \"signedIn\" }>\n  | null;\n\ntype CredentialsParams<ParamsValidator extends GenericValidator> =\n  Exclude<Infer<ParamsValidator>, undefined> extends infer Params extends ProviderParams\n    ? Params\n    : never;\n\ntype CredentialsAuthorizeParams<ParamsValidator extends GenericValidator> =\n  CredentialsParams<ParamsValidator> extends never ? never : Infer<ParamsValidator>;\n\n/** Configuration for the {@link credentials} provider. */\nexport type CredentialsConfig<\n  ParamsValidator extends GenericValidator = GenericValidator,\n  DataModel extends GenericDataModel = GenericDataModel,\n  Id extends string = string,\n> =\n  CredentialsParams<ParamsValidator> extends never\n    ? never\n    : {\n        /** Stable provider identifier used in `signIn(\"<id>\")`. */\n        id?: Id;\n        /**\n         * Convex validator for the parameters accepted by this provider.\n         *\n         * The validator is the single source of truth for the callback parameter\n         * type, the generated `api.auth.signIn` reference, and runtime validation.\n         */\n        params: ParamsValidator;\n        /**\n         * Validate the submitted credentials and return the authenticated user or\n         * verified identity to provision.\n         * Return `null` to reject the sign-in attempt.\n         */\n        authorize: (\n          credentials: CredentialsAuthorizeParams<ParamsValidator>,\n          ctx: GenericActionCtxWithAuthConfig<DataModel>,\n        ) => Promise<CredentialsAuthorizeResult>;\n        /** Optional hashing helpers for password-style credential verification. */\n        crypto?: {\n          hashSecret: (secret: string) => Promise<string>;\n          verifySecret: (secret: string, hash: string) => Promise<boolean>;\n        };\n        /** Additional providers to register alongside this credentials provider. */\n        extraProviders?: (AuthProviderConfig | undefined)[];\n      };\n\n/**\n * Create a credentials provider for custom sign-in logic.\n *\n * @typeParam DataModel - The Convex data model used by the auth context.\n * @param config - Custom authorization and hashing hooks.\n * @returns A configured credentials provider for `defineAuth`.\n *\n * @example\n * ```ts\n * import { credentials } from \"@estifanos-sh/convex-auth/providers\";\n * import { v } from \"convex/values\";\n *\n * credentials({\n *   params: v.object({ email: v.string(), password: v.string() }),\n *   authorize: async (params, ctx) => {\n *     const user = await lookupUser(params.email, params.password, ctx);\n *     return user ? { userId: user._id } : null;\n *   },\n * })\n * ```\n */\nexport function credentials<\n  const ParamsValidator extends GenericValidator = GenericValidator,\n  DataModel extends GenericDataModel = GenericDataModel,\n  const Id extends string = \"credentials\",\n>(\n  config: CredentialsConfig<ParamsValidator, DataModel, Id>,\n): ConvexCredentialsConfig<DataModel, ParamsValidator, Id> {\n  return {\n    ...config,\n    id: config.id ?? \"credentials\",\n    type: \"credentials\",\n  } as ConvexCredentialsConfig<DataModel, ParamsValidator, Id>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkIA,SAAgB,YAKd,QACyD;AACzD,QAAO;EACL,GAAG;EACH,IAAI,OAAO,MAAM;EACjB,MAAM;EACP"}