@estifanos-sh/convex-auth 0.0.7 → 0.0.8

package/dist/client/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/client/core/types.ts"],"mappings":";;;;;;;;;AA6BA;;;;;;;UAAiB,eAAA;EACf,MAAA,CAAO,MAAA,WAAiB,IAAA,YAAgB,OAAA,CAAQ,KAAA;EAChD,OAAA,CACE,UAAA,GAAa,IAAA;IAAQ,iBAAA;EAAA,MAAiC,OAAA,6BACtD,QAAA,IAAY,eAAA;EAEd,SAAA;AAAA;;UAIe,eAAA;EACf,MAAA,CAAO,MAAA,WAAiB,IAAA,YAAgB,OAAA,CAAQ,KAAA;AAAA;;UAOjC,OAAA;EACf,OAAA,CAAQ,GAAA,uCAA0C,OAAA;EAClD,OAAA,CAAQ,GAAA,UAAa,KAAA,kBAAuB,OAAA;EAC5C,UAAA,CAAW,GAAA,kBAAqB,OAAA;AAAA;;UAIxB,eAAA;EACR,GAAA,IAAO,GAAA;EACP,OAAA,CAAQ,WAAA,kBAA6B,OAAA;AAAA;;;;;;AATvC;;;UAoBU,YAAA;EACR,IAAA,CAAK,GAAA,EAAK,GAAA,mBAAsB,GAAA,GAAM,OAAA,iBAAwB,GAAA;AAAA;;UAItD,WAAA;EACR,SAAA,CACE,GAAA,UACA,QAAA,GAAW,KAAA,2BAAgC,OAAA;AAAA;;UAKrC,YAAA;EACR,OAAA,IAAW,GAAA,UAAa,QAAA,QAAgB,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;AAAA;;UAIrD,YAAA;EACR,KAAA,CAAM,IAAA,EAAM,cAAA,EAAgB,SAAA,WAAoB,OAAA,CAAQ,QAAA;AAAA;;;AAnCzD;;;;UA4CgB,aAAA;EACf,WAAA;EACA,OAAA,GAAU,OAAA;EACV,QAAA,GAAW,eAAA;EACX,KAAA,GAAQ,YAAA;EACR,IAAA,GAAO,WAAA;EACP,KAAA,GAAQ,YAAA;EACR,KAAA,GAAQ,YAAA;AAAA;;UAIO,cAAA;EACf,QAAA,GAAW,cAAA;EACX,IAAA,GAAO,UAAA;EACP,MAAA,GAAS,YAAA;AAAA;;;;KA8DC,gBAAA;EACV,UAAA;EACA,QAAA;EACA,eAAA;EACA,uBAAA;EACA,SAAA;EACA,QAAA;AAAA;;;;;;;;;;AAtG0D;;;KAqHhD,YAAA;EACN,IAAA;AAAA;EACA,IAAA;EAAkB,QAAA,EAAU,GAAA;EAAK,QAAA;AAAA;EACjC,IAAA;EAAsB,QAAA;AAAA;EACtB,IAAA;EAAoB,UAAA,EAAY,gBAAA;AAAA;EAChC,IAAA;AAAA;EACA,IAAA;EAAgB,IAAA,EAAM,SAAA;AAAA;;KAWhB,SAAA;EACN,MAAA;EAAmB,KAAA;AAAA;EACnB,MAAA;EAAqB,KAAA;AAAA;EACrB,MAAA;EAAoB,KAAA;AAAA;;KAGd,cAAA,IAAkB,KAAA,EAAO,SAAA;;AAxHrC;;;;;;;KAkIK,sBAAA,GAAyB,iBAAA;EAI1B,OAAA;IACE,QAAA;IACA,MAAA,GAAS,cAAA;IACT,YAAA;EAAA;EAEF,QAAA;EACA,YAAA;EACA,QAAA;AAAA;AAAA,KAKC,kBAAA,GAAqB,iBAAA;AAAA,KAEd,WAAA,gBAA2B,kBAAA,GAAqB,sBAAA;EAC1D,MAAA,EAAQ,MAAA;EACR,OAAA,EAAS,iBAAA,qBAAsC,MAAA,SAAe,KAAA;AAAA;;;;KAMpD,uBAAA;EAjJK,uEAmJf,IAAA;EAEA,QAAA,WAnJO;EAqJP,eAAA;AAAA;;;;KAMU,qBAAA;EA3JH,qDA6JP,KAAA,WA5JS;EA8JT,QAAA;AAAA;AAhGF;;;;;;AAAA,UAyGiB,cAAA;EArGf;;;;;AAiBF;;;;;;;EAiGE,WAAA;EAhGI;;;;;;;;;;;;EA8GJ,mBAAA,IAAuB,OAAA;EAzGG;;;AAW5B;;;;;;;;;;;;AAMA;EA0GE,QAAA,CAAS,IAAA,GAAO,uBAAA,GAA0B,OAAA,CAAQ,YAAA;;;;AA1GI;;;;;;;;;;EA+HtD,MAAA,CAAO,IAAA,GAAO,qBAAA,GAAwB,OAAA,CAAQ,YAAA;AAAA;;;;KAMpC,gBAAA;EA3GW,kDA6GrB,IAAA,WA7GwB;EA+GxB,WAAA;AAAA;;KAIU,eAAA;EAjH2B,8CAmHrC,GAAA,UAlHQ;EAoHR,MAAA,UAnH+C;EAqH/C,QAAA,UArH0B;EAuH1B,MAAA;AAAA;;KAIU,iBAAA;EA5HV,gDA8HA,IAAA,UA7HA;EA+HA,QAAA,UA/H+C;EAiI/C,MAAA;AAAA;;KAIU,gBAAA;EA/HuB,gDAiIjC,IAAA,UAjIiC;EAmIjC,QAAA;AAAA;;;;AAvHF;;;UAgIiB,UAAA;EA5HP;AASV;;;;;;;;;;;;;;;;;EAsIE,KAAA,CAAM,IAAA,GAAO,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EAzFE;;;;;;;;;AA2B5C;;;;;AAQA;;;;EA0EE,OAAA,CAAQ,IAAA,EAAM,iBAAA,GAAoB,OAAA,CAAQ,YAAA;EAtE1C;;;;;AAQF;;;;;;;;;AAUA;;;;;AAaA;EA6DE,MAAA,CAAO,IAAA,EAAM,gBAAA,GAAmB,OAAA,CAAQ,YAAA;AAAA;;KAI9B,gBAAA;EACV,IAAA,EAAM,gBAAA,EA3BQ;EA6Bd,MAAA,GAAS,WAAA;AAAA;;KAIC,kBAAA;EAAuB,IAAA;AAAA;;;;;;;UAQlB,YAAA;EAzCD;;;;;;;;;;;AA0BhB;;;;;;;;;;AAOA;;EAgCE,IAAA,CAAK,IAAA,EAAM,gBAAA,GAAmB,OAAA;EAhCG;;AAQnC;;;;;;;;;;;;;EAyCE,MAAA,CAAO,IAAA,EAAM,kBAAA,GAAqB,OAAA;AAAA;;;;;AACnC;KAOI,aAAA,aAA0B,WAAA,IAC7B,YAAA,CAAa,GAAA,iCACT,IAAA;EAAe,OAAA;AAAA,IACb,OAAA,GACA,IAAA;AAAA,KAGH,WAAA,aAAwB,WAAA,KAAgB,GAAA,uCAEzC,aAAA,CAAc,GAAA,uBACZ,IAAA,4CAC2B,IAAA,GACvB,OAAA,CAAQ,IAAA,OAAW,IAAA;AAAA,KAKxB,WAAA,aAAwB,WAAA,sCACZ,WAAA,CAAY,GAAA,cAAiB,EAAA,SAAW,WAAA,CAAY,GAAA;AAAA,KAEhE,SAAA,aAAsB,WAAA;EACzB,QAAA,EAAU,WAAA,CAAY,GAAA;EACtB,IAAA,EAAM,WAAA,CAAY,GAAA;EAClB,MAAA,EAAQ,WAAA,CAAY,GAAA;AAAA;;;;;KAOjB,gBAAA,0DAA0E,OAAA,4CAIxD,OAAA,cACP,IAAA,IAAQ,MAAA,eACR,IAAA,GAAO,MAAA;;UAGN,aAAA;EAhC4B;;;;EAAA,SAqClC,KAAA;EAhCkB;;;;EAAA,SAqClB,KAAA;EA1CkB;;;;;;EAiD3B,MAAA,IAAU,OAAA;IAAU,KAAA;EAAA;AAAA;;KAaV,mBAAA,GAAsB,WAAA;;;;;;KAOtB,oBAAA,GAAuB,UAAA;;KASvB,iBAAA,GAAoB,WAAA;;AAnEwC;;;;;;KA4EnE,wBAAA,MAA8B,CAAA,sBAC/B,cAAA,GACA,CAAA,mBACE,mBAAA,GACA,CAAA,uBACE,eAAA,eACA,CAAA,wBACE,gBAAA,GACA,CAAA,8BAEE,CAAA,qBACE,oBAAA,GACA,iBAAA;AAAA,KAET,sBAAA,aAAmC,WAAA,OACtC,aAAA,CAAc,GAAA,wBAA2B,IAAA;EAAe,QAAA,EAAU,CAAA;AAAA,IAAM,IAAA;;KAG9D,iBAAA,aAA8B,WAAA,sBACzB,WAAA,CAAY,GAAA,IACvB,wBAAA,CAAyB,CAAA,IACzB,CAAA,kDAEE,CAAA,wBACE,gBAAA,IACC,CAAA,wBACC,oBAAA,GACA,sBAAA,CAAuB,GAAA,EAAK,CAAA,wBACzB,IAAA,4BAEC,IAAA;EAAe,MAAA;AAAA,IACb,MAAA,GACA,IAAA;EAAe,MAAA;AAAA,IACb,MAAA;;;;;KAQR,UAAA,aAAuB,WAAA,yBACf,iBAAA,CAAkB,GAAA,EAAK,CAAA,KACpC,MAAA,GAAS,iBAAA,CAAkB,GAAA,EAAK,CAAA,MAChC,MAAA,EAAQ,iBAAA,CAAkB,GAAA,EAAK,CAAA;;;;;AAnHb;;;;;;;;KAiIb,eAAA,aAA4B,WAAA,GAAc,WAAA,qBACpC,WAAA,CAAY,GAAA,eAE5B,QAAA,EAAU,CAAA,KACP,IAAA,EAAM,UAAA,CAAW,GAAA,EAAK,CAAA,MACtB,OAAA,CAAQ,YAAA;;UAYH,cAAA,aAA2B,WAAA;EA3If;EA6IpB,UAAA,QAAkB,OAAA;EA7IgD;EA+IlE,KAAA,GAAQ,IAAA;EA3Ia;;;;EAAA,SAgJZ,MAAA,EAAQ,aAAA;EA9IH;EAgJd,aAAA,GAAgB,KAAA,EAAO,GAAA;IAAiB,IAAA;EAAA,MAAmB,OAAA,CAAQ,qBAAA;EA7IpD;EA+If,MAAA,EAAQ,eAAA,CAAgB,GAAA;;EAExB,OAAA,QAAe,OAAA;EA5IN;EA8IT,SAAA,GAAY,OAAA,EAAS,cAAA;EAlIrB;EAoIA,WAAA,QAAmB,SAAA;EApIC;EAsIpB,OAAA;AAAA;AAzHF;;;;;AAOA;;;;AAPA,KAqIY,UAAA,aAAuB,WAAA,GAAc,WAAA,IAAe,cAAA,CAAe,GAAA,IAC7E,gBAAA,CAAiB,SAAA,CAAU,GAAA,mBAAsB,UAAA,IACjD,gBAAA,CAAiB,SAAA,CAAU,GAAA,uBAA0B,YAAA;AAvHvD;;;;;AAA4C;;;AAA5C,KAiIY,kBAAA,aAA+B,WAAA,GAAc,WAAA,IAAe,UAAA,CAAW,GAAA,IACjF,gBAAA,CAAiB,SAAA,CAAU,GAAA,2BAA8B,cAAA;;;;;;KAOtD,iBAAA;EAzHK,iEA2HR,MAAA,EAAQ,eAAA,EAxHE;EA0HV,OAAA,GAAU,aAAA,EAxHE;EA0HZ,QAAA,GAAW,cAAA,EA1HkB;EA4H7B,gBAAA,GAAmB,sBAAA,EAxIc;EA0IjC,GAAA;EAxIE;;;;;EA8IF,OAAA,GAAU,OAAA;EAxIF;;;;;;AAIqB;;EA6I7B,KAAA,kBA3IsC;EA6ItC,QAAA,GAAW,GAAA,UAAa,GAAA;EA5IxB;;;;;EAkJA,eAAA;EAnJmD;;;;;EAyJnD,kBAAA;AAAA;;KAIU,mBAAA,aAAgC,WAAA,GAAc,WAAA,IAAe,iBAAA;EA5JK,8EA8J5E,GAAA,EAAK,GAAA,EA3JsB;EA6J3B,SAAA;EA7JwC;;;;EAkKxC,UAAA,GAAa,eAAA;AAAA;;KAIH,kBAAA,GAAqB,iBAAA;EA/JtB,+DAiKT,SAAA,UA/JiC;EAiKjC,GAAA,UAjKU;EAmKV,UAAA;AAAA;;;;;KAOU,aAAA,aAA0B,WAAA,GAAc,WAAA,IAChD,mBAAA,CAAoB,GAAA,IACpB,kBAAA;AAAA,KAEQ,qBAAA;EAA0B,OAAA;AAAA;EAAqB,OAAA;EAAe,UAAA,EAAY,GAAA;AAAA"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/client/core/types.ts"],"mappings":";;;;;;;;;AA6BA;;;;;;;UAAiB,eAAA;EACf,MAAA,CAAO,MAAA,WAAiB,IAAA,YAAgB,OAAA,CAAQ,KAAA;EAChD,OAAA,CACE,UAAA,GAAa,IAAA;IAAQ,iBAAA;EAAA,MAAiC,OAAA,6BACtD,QAAA,IAAY,eAAA;EAEd,SAAA;AAAA;;UAIe,eAAA;EACf,MAAA,CAAO,MAAA,WAAiB,IAAA,YAAgB,OAAA,CAAQ,KAAA;AAAA;;UAOjC,OAAA;EACf,OAAA,CAAQ,GAAA,uCAA0C,OAAA;EAClD,OAAA,CAAQ,GAAA,UAAa,KAAA,kBAAuB,OAAA;EAC5C,UAAA,CAAW,GAAA,kBAAqB,OAAA;AAAA;;UAIxB,eAAA;EACR,GAAA,IAAO,GAAA;EACP,OAAA,CAAQ,WAAA,kBAA6B,OAAA;AAAA;;;;;;AATvC;;;UAoBU,YAAA;EACR,IAAA,CAAK,GAAA,EAAK,GAAA,mBAAsB,GAAA,GAAM,OAAA,iBAAwB,GAAA;AAAA;;UAItD,WAAA;EACR,SAAA,CACE,GAAA,UACA,QAAA,GAAW,KAAA,2BAAgC,OAAA;AAAA;;UAKrC,YAAA;EACR,OAAA,IAAW,GAAA,UAAa,QAAA,QAAgB,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;AAAA;;UAIrD,YAAA;EACR,KAAA,CAAM,IAAA,EAAM,cAAA,EAAgB,SAAA,WAAoB,OAAA,CAAQ,QAAA;AAAA;;;AAnCzD;;;;UA4CgB,aAAA;EACf,WAAA;EACA,OAAA,GAAU,OAAA;EACV,QAAA,GAAW,eAAA;EACX,KAAA,GAAQ,YAAA;EACR,IAAA,GAAO,WAAA;EACP,KAAA,GAAQ,YAAA;EACR,KAAA,GAAQ,YAAA;AAAA;;UAIO,cAAA;EACf,QAAA,GAAW,cAAA;EACX,IAAA,GAAO,UAAA;EACP,MAAA,GAAS,YAAA;AAAA;;;;KA8DC,gBAAA;EACV,UAAA;EACA,QAAA;EACA,eAAA;EACA,uBAAA;EACA,SAAA;EACA,QAAA;AAAA;;;;;;;;;;AAtG0D;;;KAqHhD,YAAA;EACN,IAAA;AAAA;EACA,IAAA;EAAkB,QAAA,EAAU,GAAA;EAAK,QAAA;AAAA;EACjC,IAAA;EAAsB,QAAA;AAAA;EACtB,IAAA;EAAoB,UAAA,EAAY,gBAAA;AAAA;EAChC,IAAA;AAAA;EACA,IAAA;EAAgB,IAAA,EAAM,SAAA;AAAA;;KAWhB,SAAA;EACN,MAAA;EAAmB,KAAA;AAAA;EACnB,MAAA;EAAqB,KAAA;AAAA;EACrB,MAAA;EAAoB,KAAA;AAAA;;KAGd,cAAA,IAAkB,KAAA,EAAO,SAAA;;AAxHrC;;;;;;;KAkIK,sBAAA,GAAyB,iBAAA;EAI1B,OAAA;IACE,QAAA;IACA,MAAA,GAAS,cAAA;IACT,YAAA;EAAA;EAEF,QAAA;EACA,YAAA;EACA,QAAA;AAAA;AAAA,KAKC,kBAAA,GAAqB,iBAAA;AAAA,KAEd,WAAA,gBAA2B,kBAAA,GAAqB,sBAAA;EAC1D,MAAA,EAAQ,MAAA;EACR,OAAA,EAAS,iBAAA,qBAAsC,MAAA,SAAe,KAAA;AAAA;;;;KAMpD,uBAAA;EAjJK,uEAmJf,IAAA;EAEA,QAAA,WAnJO;EAqJP,eAAA;AAAA;;;;KAMU,qBAAA;EA3JH,qDA6JP,KAAA,WA5JS;EA8JT,QAAA;AAAA;AAhGF;;;;;;AAAA,UAyGiB,cAAA;EArGf;;;;;AAiBF;;;;;;;EAiGE,WAAA;EAhGI;;;;;;;;;;;;EA8GJ,mBAAA,IAAuB,OAAA;EAzGG;;;AAW5B;;;;;;;;;;;;AAMA;EA0GE,QAAA,CAAS,IAAA,GAAO,uBAAA,GAA0B,OAAA,CAAQ,YAAA;;;;AA1GI;;;;;;;;;;EA+HtD,MAAA,CAAO,IAAA,GAAO,qBAAA,GAAwB,OAAA,CAAQ,YAAA;AAAA;;;;KAMpC,gBAAA;EA3GW,kDA6GrB,IAAA,WA7GwB;EA+GxB,WAAA;AAAA;;KAIU,eAAA;EAjH2B,8CAmHrC,GAAA,UAlHQ;EAoHR,MAAA,UAnH+C;EAqH/C,QAAA,UArH0B;EAuH1B,MAAA;AAAA;;KAIU,iBAAA;EA5HV,gDA8HA,IAAA,UA7HA;EA+HA,QAAA,UA/H+C;EAiI/C,MAAA;AAAA;;KAIU,gBAAA;EA/HuB,gDAiIjC,IAAA,UAjIiC;EAmIjC,QAAA;AAAA;;;;AAvHF;;;UAgIiB,UAAA;EA5HP;AASV;;;;;;;;;;;;;;;;;EAsIE,KAAA,CAAM,IAAA,GAAO,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EAzFE;;;;;;;;;AA2B5C;;;;;AAQA;;;;EA0EE,OAAA,CAAQ,IAAA,EAAM,iBAAA,GAAoB,OAAA,CAAQ,YAAA;EAtE1C;;;;;AAQF;;;;;;;;;AAUA;;;;;AAaA;EA6DE,MAAA,CAAO,IAAA,EAAM,gBAAA,GAAmB,OAAA,CAAQ,YAAA;AAAA;;KAI9B,gBAAA;EACV,IAAA,EAAM,gBAAA,EA3BQ;EA6Bd,MAAA,GAAS,WAAA;AAAA;;KAIC,kBAAA;EAAuB,IAAA;AAAA;;;;;;;UAQlB,YAAA;EAzCD;;;;;;;;;;;AA0BhB;;;;;;;;;;AAOA;;EAgCE,IAAA,CAAK,IAAA,EAAM,gBAAA,GAAmB,OAAA;EAhCG;;AAQnC;;;;;;;;;;;;;EAyCE,MAAA,CAAO,IAAA,EAAM,kBAAA,GAAqB,OAAA;AAAA;;;;;AACnC;KAOI,aAAA,aAA0B,WAAA,IAC7B,YAAA,CAAa,GAAA,iCACT,IAAA;EAAe,OAAA;AAAA,IACb,OAAA,GACA,IAAA;AAAA,KAGH,WAAA,aAAwB,WAAA,KAAgB,GAAA,uCAEzC,aAAA,CAAc,GAAA,uBACZ,IAAA,4CAC2B,IAAA,GACvB,OAAA,CAAQ,IAAA,OAAW,IAAA;AAAA,KAKxB,WAAA,aAAwB,WAAA,sCACZ,WAAA,CAAY,GAAA,cAAiB,EAAA,SAAW,WAAA,CAAY,GAAA;AAAA,KAEhE,SAAA,aAAsB,WAAA;EACzB,QAAA,EAAU,WAAA,CAAY,GAAA;EACtB,IAAA,EAAM,WAAA,CAAY,GAAA;EAClB,MAAA,EAAQ,WAAA,CAAY,GAAA;AAAA;;;;;KAOjB,gBAAA,0DAA0E,OAAA,4CAIxD,OAAA,cACP,IAAA,IAAQ,MAAA,eACR,IAAA,GAAO,MAAA;;UAGN,aAAA;EAhC4B;;;;EAAA,SAqClC,KAAA;EAhCkB;;;;EAAA,SAqClB,KAAA;EA1CkB;;;;;;EAiD3B,MAAA,IAAU,OAAA;IAAU,KAAA;EAAA;AAAA;;KAaV,mBAAA,GAAsB,WAAA;;;;;;KAOtB,oBAAA,GAAuB,UAAA;;KASvB,iBAAA,GAAoB,WAAA;;AAnEwC;;;;;;KA4EnE,wBAAA,MAA8B,CAAA,sBAC/B,cAAA,GACA,CAAA,mBACE,mBAAA,GACA,CAAA,uBACE,eAAA,eACA,CAAA,wBACE,gBAAA,GACA,CAAA,8BAEE,CAAA,qBACE,oBAAA,GACA,iBAAA;AAAA,KAET,sBAAA,aAAmC,WAAA,OACtC,aAAA,CAAc,GAAA,wBAA2B,IAAA;EAAe,QAAA,EAAU,CAAA;AAAA,IAAM,IAAA;;KAG9D,iBAAA,aAA8B,WAAA,sBACzB,WAAA,CAAY,GAAA,IACvB,wBAAA,CAAyB,CAAA,IACzB,CAAA,kDAEE,CAAA,wBACE,gBAAA,IACC,CAAA,wBACC,oBAAA,GACA,sBAAA,CAAuB,GAAA,EAAK,CAAA,wBACzB,IAAA,4BAEC,IAAA;EAAe,MAAA;AAAA,IACb,MAAA,GACA,IAAA;EAAe,MAAA;AAAA,IACb,MAAA;;;;;KAQR,UAAA,aAAuB,WAAA,yBACf,iBAAA,CAAkB,GAAA,EAAK,CAAA,KACpC,MAAA,GAAS,iBAAA,CAAkB,GAAA,EAAK,CAAA,MAChC,MAAA,EAAQ,iBAAA,CAAkB,GAAA,EAAK,CAAA;;;;;AAnHb;;;;;;;;KAiIb,eAAA,aAA4B,WAAA,GAAc,WAAA,qBACpC,WAAA,CAAY,GAAA,eAE5B,QAAA,EAAU,CAAA,KACP,IAAA,EAAM,UAAA,CAAW,GAAA,EAAK,CAAA,MACtB,OAAA,CAAQ,YAAA;;UAGH,cAAA,aAA2B,WAAA;EAlIf;EAoIpB,UAAA,QAAkB,OAAA;EApIgD;EAsIlE,KAAA,GAAQ,IAAA;EAlIa;;;;EAAA,SAuIZ,MAAA,EAAQ,aAAA;EArIH;EAuId,aAAA,GAAgB,KAAA,EAAO,GAAA;IAAiB,IAAA;EAAA,MAAmB,OAAA,CAAQ,qBAAA;EApIpD;EAsIf,MAAA,EAAQ,eAAA,CAAgB,GAAA;;EAExB,OAAA,QAAe,OAAA;EAnIN;EAqIT,SAAA,GAAY,OAAA,EAAS,cAAA;EAzHrB;EA2HA,WAAA,QAAmB,SAAA;EA3HC;EA6HpB,OAAA;AAAA;AAhHF;;;;;AAOA;;;;AAPA,KA4HY,UAAA,aAAuB,WAAA,GAAc,WAAA,IAAe,cAAA,CAAe,GAAA,IAC7E,gBAAA,CAAiB,SAAA,CAAU,GAAA,mBAAsB,UAAA,IACjD,gBAAA,CAAiB,SAAA,CAAU,GAAA,uBAA0B,YAAA;AA9GvD;;;;;AAA4C;;;AAA5C,KAwHY,kBAAA,aAA+B,WAAA,GAAc,WAAA,IAAe,UAAA,CAAW,GAAA,IACjF,gBAAA,CAAiB,SAAA,CAAU,GAAA,2BAA8B,cAAA;;;;;;KAOtD,iBAAA;EAhHK,iEAkHR,MAAA,EAAQ,eAAA,EA/GE;EAiHV,OAAA,GAAU,aAAA,EA/GE;EAiHZ,QAAA,GAAW,cAAA,EAjHkB;EAmH7B,gBAAA,GAAmB,sBAAA,EA/Hc;EAiIjC,GAAA;EA/HE;;;;;EAqIF,OAAA,GAAU,OAAA;EA/HF;;;;;;AAIqB;;EAoI7B,KAAA,kBAlIsC;EAoItC,QAAA,GAAW,GAAA,UAAa,GAAA;EAnIxB;;;;;EAyIA,eAAA;EA1ImD;;;;;EAgJnD,kBAAA;AAAA;;KAIU,mBAAA,aAAgC,WAAA,GAAc,WAAA,IAAe,iBAAA;EAnJK,8EAqJ5E,GAAA,EAAK,GAAA,EAlJsB;EAoJ3B,SAAA;EApJwC;;;;EAyJxC,UAAA,GAAa,eAAA;AAAA;;KAIH,kBAAA,GAAqB,iBAAA;EAtJtB,+DAwJT,SAAA,UAtJiC;EAwJjC,GAAA,UAxJU;EA0JV,UAAA;AAAA;;;;;KAOU,aAAA,aAA0B,WAAA,GAAc,WAAA,IAChD,mBAAA,CAAoB,GAAA,IACpB,kBAAA;AAAA,KAEQ,qBAAA;EAA0B,OAAA;AAAA;EAAqB,OAAA;EAAe,UAAA,EAAY,GAAA;AAAA"}

package/dist/client/core/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../../src/client/core/types.ts"],"sourcesContent":["import type { FunctionArgs, FunctionReference } from \"convex/server\";\nimport type { ConvexError, Value } from \"convex/values\";\n\nimport type { AccessToken } from \"../../shared/brand\";\nimport type {\n  AnonymousParams,\n  CodeParams,\n  ConnectionParams,\n  EmailParams,\n  OAuthParams,\n  PasswordParams,\n} from \"../../shared/params\";\nimport type {\n  AuthParameters,\n  AuthTokens,\n  SignInFlowResult,\n  SignInWebAuthnOptionsResult,\n} from \"../../shared/results\";\nimport type { ErrorCode } from \"../../shared/codes\";\n\n/**\n * Structural interface for any Convex client.\n * Satisfied by `ConvexClient` (`convex/browser`),\n * `ConvexReactClient` (`convex/react`), and similar transports.\n *\n * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`\n * but not on the simplified `ConvexClient`. When available we call it\n * during sign-out for a clean deauthentication.\n */\nexport interface ConvexTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n  setAuth(\n    fetchToken: (args: { forceRefreshToken: boolean }) => Promise<string | null | undefined>,\n    onChange?: (isAuthenticated: boolean) => void,\n  ): void;\n  clearAuth?(): void;\n}\n\n/** Minimal action-only transport used for unauthenticated auth flows. */\nexport interface ActionTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n}\n\n/** @internal */\nexport type SignInApiRef = { signIn: AuthApiRefs[\"signIn\"] };\n\n/** Pluggable key-value storage supplied by the host runtime. */\nexport interface Storage {\n  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\n/** Platform-neutral location/navigation hooks. */\ninterface LocationRuntime {\n  get(): URL | null;\n  replace(relativeUrl: string): void | Promise<void>;\n}\n\n/**\n * Platform-specific OAuth launch primitive.\n *\n * `open` receives the provider authorization URL. Platforms that navigate the\n * whole page away (browser) return nothing; platforms that run the flow in an\n * in-app session (Expo) return the callback URL so the core can complete the\n * exchange inline.\n */\ninterface OAuthRuntime {\n  open(url: URL): void | string | URL | Promise<void | string | URL>;\n}\n\n/** Cross-context synchronization hooks, such as browser storage events. */\ninterface SyncRuntime {\n  subscribe(\n    key: string,\n    callback: (value: string | null) => void | Promise<void>,\n  ): (() => void) | null;\n}\n\n/** Cross-context mutex/locking primitive. */\ninterface MutexRuntime {\n  withKey<T>(key: string, callback: () => Promise<T>): Promise<T>;\n}\n\n/** Proxy request execution supplied by the host runtime. */\ninterface ProxyRuntime {\n  fetch(body: AuthParameters, proxyPath: string): Promise<Response>;\n}\n\n/**\n * Platform-neutral client runtime dependencies.\n *\n * The core `client` package should depend only on these interfaces, while the\n * browser package can provide concrete implementations backed by DOM APIs.\n */\nexport interface ClientRuntime {\n  environment?: \"client\" | \"server\";\n  storage?: Storage | null;\n  location?: LocationRuntime;\n  oauth?: OAuthRuntime;\n  sync?: SyncRuntime;\n  mutex?: MutexRuntime;\n  proxy?: ProxyRuntime;\n}\n\n/** Platform-specific factor adapters injected by entrypoints like `browser`. */\nexport interface ClientAdapters {\n  webauthn?: WebAuthnClient;\n  totp?: TotpClient;\n  device?: DeviceClient;\n}\n\n/**\n * Shared dependencies threaded into every factor client (`totp`, `device`,\n * `webauthn`). The core `client` builds one of these and passes it to each\n * factor factory.\n *\n * @internal\n */\nexport interface FactorDeps {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => SignInApiRef;\n  proxyFetch: (body: AuthParameters) => Promise<Value>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthTokens | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: AccessToken } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n}\n\n/**\n * Dependencies provided to platform-specific factor adapters.\n *\n * @internal\n */\nexport type ClientAdapterDeps = FactorDeps;\n\n/**\n * Factory overrides for platform-specific factor adapters.\n *\n * @internal\n */\nexport interface ClientAdapterFactories {\n  webauthn?: (deps: ClientAdapterDeps) => WebAuthnClient;\n}\n\n/** @internal */\nexport type SignInActionResult = SignInFlowResult<AuthTokens | null>;\n\n/** @internal */\nexport type WebAuthnRotationResult = Extract<SignInWebAuthnOptionsResult, { operation: \"rotate\" }>;\n/** @internal Passkey sign-in options returned by a provider continuation. */\nexport type WebAuthnContinuationSignInResult = Extract<\n  SignInWebAuthnOptionsResult,\n  { operation: \"signIn\" }\n>;\n\n/**\n * Device authorization payload returned from the `deviceCode` sign-in flow.\n */\nexport type DeviceCodeResult = {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string;\n  expiresIn: number;\n  interval: number;\n};\n\n/**\n * Result of a `signIn` call.\n *\n * - `kind: \"signedIn\"` — credentials were accepted and a client session is now available.\n * - `kind: \"redirect\"` — OAuth flow initiated; redirect the user to `redirect.toString()`.\n * - `kind: \"totpRequired\"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.\n * - `kind: \"deviceCode\"` — device flow initiated; display the code and poll via `auth.device.poll()`.\n * - `kind: \"started\"` — a non-immediate flow started (for example email/phone verification).\n * - `kind: \"failed\"` — the flow did not complete; `code` is the typed {@link ErrorCode}.\n *\n * @see {@link AuthState}\n */\nexport type SignInResult =\n  | { kind: \"signedIn\" }\n  | { kind: \"redirect\"; redirect: URL; verifier: string }\n  | { kind: \"totpRequired\"; verifier: string }\n  | { kind: \"deviceCode\"; deviceCode: DeviceCodeResult }\n  | { kind: \"started\" }\n  | { kind: \"failed\"; code: ErrorCode };\n\n/** @internal */\nexport type AuthSnapshot = {\n  phase: \"loading\" | \"handshake\" | \"authenticated\" | \"unauthenticated\";\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  token: string | null;\n};\n\n/** Reactive auth state. `token` is non-null only after Convex confirms auth. */\nexport type AuthState =\n  | { status: \"loading\"; token: null }\n  | { status: \"signedOut\"; token: null }\n  | { status: \"signedIn\"; token: string };\n\n/** Handler for `auth.subscribe`. */\nexport type AuthSubscriber = (state: AuthState) => void;\n\n/**\n * Typed Convex API references for the auth functions.\n * Pass these from your generated `api` object.\n *\n * @typeParam HasWebAuthn - Whether the WebAuthn provider is configured.\n * @typeParam HasTotp - Whether the TOTP provider is configured.\n * @typeParam HasDevice - Whether the device provider is configured.\n */\ntype DefaultSignInReference = FunctionReference<\n  \"action\",\n  \"public\",\n  {\n    request: {\n      provider?: string;\n      params?: AuthParameters;\n      refreshToken?: string;\n    };\n    verifier?: string;\n    continuation?: string;\n    calledBy?: string;\n  },\n  unknown\n>;\n\ntype AnySignInReference = FunctionReference<\"action\", \"public\", any, any>;\n\nexport type AuthApiRefs<SignIn extends AnySignInReference = DefaultSignInReference> = {\n  signIn: SignIn;\n  signOut: FunctionReference<\"action\", \"public\", Record<string, Value>, unknown>;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.register}.\n */\nexport type WebAuthnRegisterOptions = {\n  /** Human-readable label for this credential (e.g. `\"MacBook Pro\"`). */\n  name?: string;\n  /** WebAuthn `user.name` override. */\n  userName?: string;\n  /** WebAuthn `user.displayName` override. */\n  userDisplayName?: string;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.signIn}.\n */\nexport type WebAuthnSignInOptions = {\n  /** Email hint to filter discoverable credentials. */\n  email?: string;\n  /** Set to `true` for conditional UI (autofill) mode. */\n  autofill?: boolean;\n};\n\n/**\n * WebAuthn client-side helpers.\n *\n * @see {@link TotpClient}\n * @see {@link DeviceClient}\n */\nexport interface WebAuthnClient {\n  /**\n   * Check whether the current runtime exposes WebAuthn passkey APIs.\n   *\n   * @returns `true` when `navigator.credentials` is available.\n   *\n   * @example\n   * ```ts\n   * if (auth.webauthn.isSupported()) {\n   *   // Show passkey registration button\n   * }\n   * ```\n   */\n  isSupported(): boolean;\n\n  /**\n   * Check whether conditional mediation (autofill-style passkeys) is available.\n   *\n   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.\n   *\n   * @example\n   * ```ts\n   * if (await auth.webauthn.isAutofillSupported()) {\n   *   await auth.webauthn.signIn({ autofill: true });\n   * }\n   * ```\n   */\n  isAutofillSupported(): Promise<boolean>;\n\n  /**\n   * Start a passkey registration flow and complete the WebAuthn ceremony.\n   *\n   * Creates a new credential bound to the current user's account.\n   *\n   * @param opts - Optional registration hints.\n   * @param opts.name - Human-readable name for the passkey (e.g. `\"MacBook Pro\"`).\n   * @param opts.userName - WebAuthn `user.name` override.\n   * @param opts.userDisplayName - WebAuthn `user.displayName` override.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.register({ name: \"My laptop\" });\n   * ```\n   */\n  register(opts?: WebAuthnRegisterOptions): Promise<SignInResult>;\n\n  /** @internal Complete registration options returned by a provider continuation. */\n  completeRegistration(result: WebAuthnRotationResult): Promise<SignInResult>;\n\n  /** @internal Complete passkey sign-in options returned by a provider continuation. */\n  completeSignIn(result: WebAuthnContinuationSignInResult): Promise<SignInResult>;\n\n  /**\n   * Sign in with an existing passkey and complete the WebAuthn ceremony.\n   *\n   * @param opts - Optional sign-in hints.\n   * @param opts.email - Email hint to filter discoverable credentials.\n   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.signIn();\n   * ```\n   */\n  signIn(opts?: WebAuthnSignInOptions): Promise<SignInResult>;\n}\n\n/**\n * Optional hints for {@link TotpClient.setup}.\n */\nexport type TotpSetupOptions = {\n  /** Issuer name shown in the authenticator app. */\n  name?: string;\n  /** Account label shown in the authenticator app. */\n  accountName?: string;\n};\n\n/** Result of {@link TotpClient.setup}. */\nexport type TotpSetupResult = {\n  /** `otpauth://` URL — render as a QR code. */\n  uri: string;\n  /** Raw base32-encoded shared secret. */\n  secret: string;\n  /** Verifier token to pass to {@link TotpClient.confirm}. */\n  verifier: string;\n  /** Factor ID to pass to {@link TotpClient.confirm}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.confirm}. */\nexport type TotpConfirmParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from {@link TotpSetupResult.verifier}. */\n  verifier: string;\n  /** Factor ID from {@link TotpSetupResult.totpId}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.verify}. */\nexport type TotpVerifyParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from a `totpRequired` sign-in result. */\n  verifier: string;\n};\n\n/**\n * TOTP two-factor authentication client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link DeviceClient}\n */\nexport interface TotpClient {\n  /**\n   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.\n   *\n   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code\n   * for the user to scan with their authenticator app.\n   *\n   * @param opts - Optional setup hints.\n   * @param opts.name - Issuer name shown in the authenticator app.\n   * @param opts.accountName - Account label in the authenticator app.\n   * @returns An object with `{ uri, secret, verifier, totpId }`.\n   *\n   * @example\n   * ```ts\n   * const { uri, secret, verifier, totpId } = await auth.totp.setup();\n   * // Render `uri` as a QR code, then confirm:\n   * await auth.totp.confirm({ code: userCode, verifier, totpId });\n   * ```\n   */\n  setup(opts?: TotpSetupOptions): Promise<TotpSetupResult>;\n\n  /**\n   * Confirm a newly created TOTP factor with the first authenticator code.\n   *\n   * Call this after the user scans the QR code and enters the first OTP.\n   *\n   * @param opts - Confirmation parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.\n   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.totp.confirm({ code: \"123456\", verifier, totpId });\n   * if (result.kind === \"failed\") showError(result.code);\n   * ```\n   */\n  confirm(opts: TotpConfirmParams): Promise<SignInResult>;\n\n  /**\n   * Complete a sign-in that is waiting on TOTP verification.\n   *\n   * Called when `signIn()` returns `{ kind: \"totpRequired\" }`.\n   *\n   * @param opts - Verification parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string from the `totpRequired` result.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.signIn(\"password\", { email, password });\n   * if (result.kind === \"totpRequired\") {\n   *   const totp = await auth.totp.verify({ code: totpCode, verifier: result.verifier });\n   *   if (totp.kind === \"failed\") showError(totp.code);\n   * }\n   * ```\n   */\n  verify(opts: TotpVerifyParams): Promise<SignInResult>;\n}\n\n/** Params for {@link DeviceClient.poll}. */\nexport type DevicePollParams = {\n  code: DeviceCodeResult;\n  /** Aborts the poll loop cleanly, e.g. on UI unmount. */\n  signal?: AbortSignal;\n};\n\n/** Params for {@link DeviceClient.verify}. */\nexport type DeviceVerifyParams = { code: string };\n\n/**\n * Device authorization (RFC 8628) client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link TotpClient}\n */\nexport interface DeviceClient {\n  /**\n   * Poll until a device flow is approved or expires.\n   *\n   * Polls the server at the interval specified in the {@link DeviceCodeResult}\n   * until the user authorizes the device or the code expires.\n   *\n   * @param opts - Poll options.\n   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn(\"device\")`.\n   * @param opts.signal - Optional {@link AbortSignal}; aborting returns cleanly\n   *   at the next loop boundary (e.g. on UI unmount).\n   * @throws `ConvexError({ code: \"DEVICE_CODE_EXPIRED\" })` when the code expires before authorization.\n   *\n   * @example\n   * ```ts\n   * const controller = new AbortController();\n   * const result = await auth.signIn(\"device\");\n   * if (result.kind === \"deviceCode\") {\n   *   // Display result.deviceCode.userCode to the user\n   *   await auth.device.poll({ code: result.deviceCode, signal: controller.signal });\n   *   console.log(\"Device authorized!\");\n   * }\n   * ```\n   */\n  poll(opts: DevicePollParams): Promise<void>;\n\n  /**\n   * Approve a device flow from the verification page using the displayed user code.\n   *\n   * Call this on the authorization page where the user enters the short code\n   * shown on the device screen.\n   *\n   * @param opts - Verification options.\n   * @param opts.code - The user code string (e.g. `\"WDJB-MJHT\"`).\n   * @throws `ConvexError({ code: \"DEVICE_AUTHORIZATION_FAILED\" })` when verification fails.\n   *\n   * @example\n   * ```ts\n   * await auth.device.verify({ code: \"WDJB-MJHT\" });\n   * ```\n   */\n  verify(opts: DeviceVerifyParams): Promise<void>;\n}\n\n/**\n * Extract capability flags from an AuthApiRefs type.\n *\n * @typeParam Api - An AuthApiRefs type to extract capability flags from.\n */\ntype SignInRequest<Api extends AuthApiRefs> =\n  FunctionArgs<Api[\"signIn\"]> extends infer Args\n    ? Args extends { request: infer Request }\n      ? Request\n      : Args\n    : never;\n\ntype ProviderIds<Api extends AuthApiRefs> = [Api[\"signIn\"]] extends [never]\n  ? string\n  : SignInRequest<Api> extends infer Args\n    ? Args extends unknown\n      ? \"provider\" extends keyof Args\n        ? Exclude<Args[keyof Args & \"provider\"], undefined>\n        : never\n      : never\n    : never;\n\ntype HasProvider<Api extends AuthApiRefs, Id extends string> =\n  string extends ProviderIds<Api> ? boolean : Id extends ProviderIds<Api> ? true : false;\n\ntype InferCaps<Api extends AuthApiRefs> = {\n  webauthn: HasProvider<Api, \"webauthn\">;\n  totp: HasProvider<Api, \"totp\">;\n  device: HasProvider<Api, \"device\">;\n};\n\n/**\n * Include a capability when configured, omit it when disabled, and keep it\n * optional when a framework binding cannot know the capability.\n */\ntype CapabilityClient<Enabled extends boolean, Name extends string, Client> = [Enabled] extends [\n  false,\n]\n  ? {}\n  : [boolean] extends [Enabled]\n    ? { [Key in Name]?: Client }\n    : { [Key in Name]: Client };\n\n/** Pending invite detected from URL or recovered from storage after redirect. */\nexport interface PendingInvite {\n  /**\n   * Raw one-time invite token. Pass to your invite acceptance mutation.\n   * @readonly\n   */\n  readonly token: string;\n  /**\n   * Invite email from the URL or stored redirect state, if available.\n   * @readonly\n   */\n  readonly email: string | null;\n  /**\n   * Consume the invite: clears storage/URL params and returns the token.\n   *\n   * @returns The invite token.\n   * @throws When there is no pending invite to accept.\n   */\n  accept(): Promise<{ token: string }>;\n}\n\n/**\n * Discriminated union of params for the password provider's flows.\n *\n * Each branch maps to one of the six password flows: `signUp`, `signIn`,\n * `reset`, `recover`, `verify`, `change`. Selecting a `flow` literal narrows the\n * accepted params automatically.\n */\nexport type { PasswordParams } from \"../../shared/params\";\n\n/** Params for the email (magic link) provider's initiation step. */\nexport type EmailInitiateParams = EmailParams;\n\n/**\n * Params for completing a code-based flow (no provider). Used to finalise\n * email magic-link sign-ins and other provider-owned code flows when the\n * verification call is made without re-specifying the originating provider.\n */\nexport type CodeCompletionParams = CodeParams;\n\n/** Params for the `connection` provider — requires a connection ID. */\nexport type { ConnectionParams } from \"../../shared/params\";\n\n/** Params for the anonymous provider. Empty / `redirectTo` only. */\nexport type { AnonymousParams } from \"../../shared/params\";\n\n/** Default params shape for OAuth-style providers (google, github, etc.). */\nexport type OAuthSignInParams = OAuthParams;\n\n/**\n * Resolves the `params` argument shape from the `provider` literal.\n *\n * Known special providers (`\"password\"`, `\"email\"`, etc.) get strict typing.\n * Any other string falls back to OAuth-style params, since custom OAuth\n * providers can be registered under arbitrary IDs.\n */\ntype DefaultParamsForProvider<P> = P extends \"password\"\n  ? PasswordParams\n  : P extends \"email\"\n    ? EmailInitiateParams\n    : P extends \"anonymous\"\n      ? AnonymousParams | undefined\n      : P extends \"connection\"\n        ? ConnectionParams\n        : P extends \"webauthn\"\n          ? never\n          : P extends undefined\n            ? CodeCompletionParams\n            : OAuthSignInParams | undefined;\n\ntype ConfiguredProviderArgs<Api extends AuthApiRefs, P> =\n  SignInRequest<Api> extends infer Args ? (Args extends { provider: P } ? Args : never) : never;\n\n/** Resolve a provider's exact params from the generated auth action reference. */\nexport type ParamsForProvider<Api extends AuthApiRefs, P> =\n  string extends ProviderIds<Api>\n    ? DefaultParamsForProvider<P>\n    : P extends \"webauthn\" | \"totp\" | \"device\"\n      ? never\n      : P extends \"connection\"\n        ? ConnectionParams\n        : [P] extends [undefined]\n          ? CodeCompletionParams\n          : ConfiguredProviderArgs<Api, P> extends infer Args\n            ? [Args] extends [never]\n              ? never\n              : Args extends { params: infer Params }\n                ? Params\n                : Args extends { params?: infer Params }\n                  ? Params | undefined\n                  : undefined\n            : never;\n\n/**\n * Tuple-rest helper that flips `params` between required and optional based\n * on whether `undefined` is in its resolved type.\n */\nexport type SignInArgs<Api extends AuthApiRefs, P> =\n  undefined extends ParamsForProvider<Api, P>\n    ? [params?: ParamsForProvider<Api, P>]\n    : [params: ParamsForProvider<Api, P>];\n\n/**\n * Public signature for `auth.signIn`. The provider literal discriminates the\n * params shape via {@link ParamsForProvider}, and the params slot is\n * automatically optional when the resolved type permits `undefined`.\n *\n * @example\n * ```ts\n * auth.signIn(\"password\", { flow: \"signIn\", email, password });\n * auth.signIn(\"password\", { flow: \"change\", email, currentPassword, newPassword });\n * auth.signIn(\"anonymous\"); // params optional\n * ```\n */\nexport type SignInOverloads<Api extends AuthApiRefs = AuthApiRefs> = <\n  const P extends ProviderIds<Api> | undefined,\n>(\n  provider: P,\n  ...args: SignInArgs<Api, P>\n) => Promise<SignInResult>;\n\n/**\n * Internal-only loose signature for the `signIn` value. Use this when\n * forwarding through wrappers where TypeScript cannot select an overload\n * from the wrapper's union-typed `provider` argument.\n *\n * @internal\n */\nexport type SignInImpl = (provider?: string, params?: AuthParameters) => Promise<SignInResult>;\n\n/** Base auth client — always present. */\ninterface AuthClientBase<Api extends AuthApiRefs> {\n  /** Restore initial auth state for the current runtime. */\n  initialize: () => Promise<void>;\n  /** SSR-safe query-param reader. */\n  param: (name: string) => string | null;\n  /**\n   * Pending invite recovered from the URL or storage, if present.\n   * @readonly\n   */\n  readonly invite: PendingInvite | null;\n  /** Complete an OAuth callback using a URL or authorization code. */\n  completeOAuth: (input: URL | string | { code: string }) => Promise<OAuthCompletionResult>;\n  /** Start a sign-in flow for a provider. */\n  signIn: SignInOverloads<Api>;\n  /** Sign out and clear local auth state. */\n  signOut: () => Promise<void>;\n  /** Subscribe to auth state changes; returns an unsubscribe. */\n  subscribe: (handler: AuthSubscriber) => () => void;\n  /** Read the current auth state synchronously, e.g. for `useSyncExternalStore`. */\n  getSnapshot: () => AuthState;\n  /** Tear down listeners and reject in-flight handshakes. */\n  destroy: () => void;\n}\n\n/**\n * Framework-agnostic auth client return type.\n *\n * Conditionally includes `totp` and `device` helpers based on the\n * capabilities in the `AuthApiRefs` type. Platform-specific `webauthn` helpers\n * are added by {@link PlatformAuthClient}.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type AuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClientBase<Api> &\n  CapabilityClient<InferCaps<Api>[\"totp\"], \"totp\", TotpClient> &\n  CapabilityClient<InferCaps<Api>[\"device\"], \"device\", DeviceClient>;\n\n/**\n * Browser auth client return type.\n *\n * Extends {@link AuthClient} with conditional WebAuthn helpers when the\n * generated auth API exposes WebAuthn capabilities.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type PlatformAuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClient<Api> &\n  CapabilityClient<InferCaps<Api>[\"webauthn\"], \"webauthn\", WebAuthnClient>;\n\n/**\n * Options for {@link client}.\n *\n * @typeParam Api - An AuthApiRefs type.\n */\ntype ClientOptionsBase = {\n  /** Any Convex client implementation used to run auth actions. */\n  convex: ConvexTransport;\n  /** Platform runtime implementation used by the client core. */\n  runtime?: ClientRuntime;\n  /** Platform-specific factor adapters supplied by higher-level entrypoints. */\n  adapters?: ClientAdapters;\n  /** Platform-specific adapter factories supplied by higher-level entrypoints. */\n  adapterFactories?: ClientAdapterFactories;\n  /** Explicit Convex deployment URL when it cannot be inferred from the client. */\n  url?: string;\n  /**\n   * Storage backend for persisted tokens.\n   *\n   * Defaults to `runtime.storage` when provided, otherwise `null`.\n   */\n  storage?: Storage | null;\n  /**\n   * Server-known auth used to seed the synchronous boot so SSR and hydration\n   * render the resolved state on first paint. A non-empty JWT boots signed in;\n   * `null` boots signed out. Providing this at all marks auth as resolved, so\n   * the client skips the loading phase. Omit it (leave `undefined`) to read the\n   * persisted value from `storage` instead. Ongoing persistence always uses\n   * `storage`.\n   */\n  token?: string | null;\n  /** SSR-safe URL source for reading query parameters. */\n  location?: URL | (() => URL | null);\n  /**\n   * Default OAuth `redirectTo` applied to `signIn` calls that omit it. Platform\n   * entrypoints set this (e.g. Expo passes its native redirect URI) so the core\n   * can build the authorization URL without a platform-specific `signIn` wrapper.\n   */\n  oauthRedirectTo?: string;\n  /**\n   * Milliseconds to wait for the Convex client to confirm a new token\n   * before a sign-in handshake rejects with `AUTH_HANDSHAKE_TIMEOUT`.\n   * Defaults to `5000`.\n   */\n  handshakeTimeoutMs?: number;\n};\n\n/** Direct Convex mode. Generated auth references are the client contract. */\nexport type DirectClientOptions<Api extends AuthApiRefs = AuthApiRefs> = ClientOptionsBase & {\n  /** Typed auth function refs from the application's generated `api` object. */\n  api: Api;\n  /** Proxy transport and direct transport are mutually exclusive. */\n  proxyPath?: never;\n  /**\n   * Action-only transport used for direct code exchange. Browser and Expo\n   * entrypoints provide one automatically; headless runtimes must inject it.\n   */\n  httpClient?: ActionTransport | null;\n};\n\n/** HTTP proxy mode. The proxy owns the Convex function references. */\nexport type ProxyClientOptions = ClientOptionsBase & {\n  /** Proxy endpoint used instead of direct Convex auth calls. */\n  proxyPath: string;\n  /** Generated references belong to direct mode and cannot be mixed with a proxy. */\n  api?: never;\n  /** Direct action transports belong to direct mode. */\n  httpClient?: never;\n};\n\n/**\n * Client configuration. Selecting direct or proxy mode makes every required\n * transport explicit and prevents the two modes from being combined.\n */\nexport type ClientOptions<Api extends AuthApiRefs = AuthApiRefs> =\n  | DirectClientOptions<Api>\n  | ProxyClientOptions;\n\nexport type OAuthCompletionResult = { handled: false } | { handled: true; cleanupUrl: URL | null };\n\n/**\n * Metadata describing the current auth flow for handshake diagnostics.\n *\n * @internal\n */\nexport type AuthFlowContext = {\n  provider?: string;\n  flow: string;\n};\n\n/**\n * A simple deferred promise that can be resolved or rejected externally.\n */\ninterface SimpleDeferred<T, E = unknown> {\n  readonly promise: Promise<T>;\n  resolve(value: T): void;\n  reject(error: E): void;\n}\n\n/**\n * Create a deferred promise that can be resolved or rejected externally.\n *\n * @returns A deferred object containing the promise and control methods.\n * @internal\n */\nexport function createDeferred<T, E = unknown>(): SimpleDeferred<T, E> {\n  let resolve!: (value: T) => void;\n  let reject!: (error: E) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej as (error: E) => void;\n  });\n  return { promise, resolve, reject };\n}\n\n/** @internal */\nexport type HandshakeWaiter = {\n  epoch: number;\n  context: AuthFlowContext;\n  deferred: SimpleDeferred<void, ConvexError<Value>>;\n  timeoutId: ReturnType<typeof setTimeout>;\n};\n"],"mappings":";;;;;;;AA00BA,SAAgB,iBAAuD;CACrE,IAAI;CACJ,IAAI;AAKJ,QAAO;EAAE,SAJO,IAAI,SAAY,KAAK,QAAQ;AAC3C,aAAU;AACV,YAAS;IACT;EACgB;EAAS;EAAQ"}
+{"version":3,"file":"types.js","names":[],"sources":["../../../src/client/core/types.ts"],"sourcesContent":["import type { FunctionArgs, FunctionReference } from \"convex/server\";\nimport type { ConvexError, Value } from \"convex/values\";\n\nimport type { AccessToken } from \"../../shared/brand\";\nimport type {\n  AnonymousParams,\n  CodeParams,\n  ConnectionParams,\n  EmailParams,\n  OAuthParams,\n  PasswordParams,\n} from \"../../shared/params\";\nimport type {\n  AuthParameters,\n  AuthTokens,\n  SignInFlowResult,\n  SignInWebAuthnOptionsResult,\n} from \"../../shared/results\";\nimport type { ErrorCode } from \"../../shared/codes\";\n\n/**\n * Structural interface for any Convex client.\n * Satisfied by `ConvexClient` (`convex/browser`),\n * `ConvexReactClient` (`convex/react`), and similar transports.\n *\n * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`\n * but not on the simplified `ConvexClient`. When available we call it\n * during sign-out for a clean deauthentication.\n */\nexport interface ConvexTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n  setAuth(\n    fetchToken: (args: { forceRefreshToken: boolean }) => Promise<string | null | undefined>,\n    onChange?: (isAuthenticated: boolean) => void,\n  ): void;\n  clearAuth?(): void;\n}\n\n/** Minimal action-only transport used for unauthenticated auth flows. */\nexport interface ActionTransport {\n  action(action: unknown, args: unknown): Promise<Value>;\n}\n\n/** @internal */\nexport type SignInApiRef = { signIn: AuthApiRefs[\"signIn\"] };\n\n/** Pluggable key-value storage supplied by the host runtime. */\nexport interface Storage {\n  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\n/** Platform-neutral location/navigation hooks. */\ninterface LocationRuntime {\n  get(): URL | null;\n  replace(relativeUrl: string): void | Promise<void>;\n}\n\n/**\n * Platform-specific OAuth launch primitive.\n *\n * `open` receives the provider authorization URL. Platforms that navigate the\n * whole page away (browser) return nothing; platforms that run the flow in an\n * in-app session (Expo) return the callback URL so the core can complete the\n * exchange inline.\n */\ninterface OAuthRuntime {\n  open(url: URL): void | string | URL | Promise<void | string | URL>;\n}\n\n/** Cross-context synchronization hooks, such as browser storage events. */\ninterface SyncRuntime {\n  subscribe(\n    key: string,\n    callback: (value: string | null) => void | Promise<void>,\n  ): (() => void) | null;\n}\n\n/** Cross-context mutex/locking primitive. */\ninterface MutexRuntime {\n  withKey<T>(key: string, callback: () => Promise<T>): Promise<T>;\n}\n\n/** Proxy request execution supplied by the host runtime. */\ninterface ProxyRuntime {\n  fetch(body: AuthParameters, proxyPath: string): Promise<Response>;\n}\n\n/**\n * Platform-neutral client runtime dependencies.\n *\n * The core `client` package should depend only on these interfaces, while the\n * browser package can provide concrete implementations backed by DOM APIs.\n */\nexport interface ClientRuntime {\n  environment?: \"client\" | \"server\";\n  storage?: Storage | null;\n  location?: LocationRuntime;\n  oauth?: OAuthRuntime;\n  sync?: SyncRuntime;\n  mutex?: MutexRuntime;\n  proxy?: ProxyRuntime;\n}\n\n/** Platform-specific factor adapters injected by entrypoints like `browser`. */\nexport interface ClientAdapters {\n  webauthn?: WebAuthnClient;\n  totp?: TotpClient;\n  device?: DeviceClient;\n}\n\n/**\n * Shared dependencies threaded into every factor client (`totp`, `device`,\n * `webauthn`). The core `client` builds one of these and passes it to each\n * factor factory.\n *\n * @internal\n */\nexport interface FactorDeps {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => SignInApiRef;\n  proxyFetch: (body: AuthParameters) => Promise<Value>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthTokens | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: AccessToken } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n}\n\n/**\n * Dependencies provided to platform-specific factor adapters.\n *\n * @internal\n */\nexport type ClientAdapterDeps = FactorDeps;\n\n/**\n * Factory overrides for platform-specific factor adapters.\n *\n * @internal\n */\nexport interface ClientAdapterFactories {\n  webauthn?: (deps: ClientAdapterDeps) => WebAuthnClient;\n}\n\n/** @internal */\nexport type SignInActionResult = SignInFlowResult<AuthTokens | null>;\n\n/** @internal */\nexport type WebAuthnRotationResult = Extract<SignInWebAuthnOptionsResult, { operation: \"rotate\" }>;\n/** @internal Passkey sign-in options returned by a provider continuation. */\nexport type WebAuthnContinuationSignInResult = Extract<\n  SignInWebAuthnOptionsResult,\n  { operation: \"signIn\" }\n>;\n\n/**\n * Device authorization payload returned from the `deviceCode` sign-in flow.\n */\nexport type DeviceCodeResult = {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string;\n  expiresIn: number;\n  interval: number;\n};\n\n/**\n * Result of a `signIn` call.\n *\n * - `kind: \"signedIn\"` — credentials were accepted and a client session is now available.\n * - `kind: \"redirect\"` — OAuth flow initiated; redirect the user to `redirect.toString()`.\n * - `kind: \"totpRequired\"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.\n * - `kind: \"deviceCode\"` — device flow initiated; display the code and poll via `auth.device.poll()`.\n * - `kind: \"started\"` — a non-immediate flow started (for example email/phone verification).\n * - `kind: \"failed\"` — the flow did not complete; `code` is the typed {@link ErrorCode}.\n *\n * @see {@link AuthState}\n */\nexport type SignInResult =\n  | { kind: \"signedIn\" }\n  | { kind: \"redirect\"; redirect: URL; verifier: string }\n  | { kind: \"totpRequired\"; verifier: string }\n  | { kind: \"deviceCode\"; deviceCode: DeviceCodeResult }\n  | { kind: \"started\" }\n  | { kind: \"failed\"; code: ErrorCode };\n\n/** @internal */\nexport type AuthSnapshot = {\n  phase: \"loading\" | \"handshake\" | \"authenticated\" | \"unauthenticated\";\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  token: string | null;\n};\n\n/** Reactive auth state. `token` is non-null only after Convex confirms auth. */\nexport type AuthState =\n  | { status: \"loading\"; token: null }\n  | { status: \"signedOut\"; token: null }\n  | { status: \"signedIn\"; token: string };\n\n/** Handler for `auth.subscribe`. */\nexport type AuthSubscriber = (state: AuthState) => void;\n\n/**\n * Typed Convex API references for the auth functions.\n * Pass these from your generated `api` object.\n *\n * @typeParam HasWebAuthn - Whether the WebAuthn provider is configured.\n * @typeParam HasTotp - Whether the TOTP provider is configured.\n * @typeParam HasDevice - Whether the device provider is configured.\n */\ntype DefaultSignInReference = FunctionReference<\n  \"action\",\n  \"public\",\n  {\n    request: {\n      provider?: string;\n      params?: AuthParameters;\n      refreshToken?: string;\n    };\n    verifier?: string;\n    continuation?: string;\n    calledBy?: string;\n  },\n  unknown\n>;\n\ntype AnySignInReference = FunctionReference<\"action\", \"public\", any, any>;\n\nexport type AuthApiRefs<SignIn extends AnySignInReference = DefaultSignInReference> = {\n  signIn: SignIn;\n  signOut: FunctionReference<\"action\", \"public\", Record<string, Value>, unknown>;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.register}.\n */\nexport type WebAuthnRegisterOptions = {\n  /** Human-readable label for this credential (e.g. `\"MacBook Pro\"`). */\n  name?: string;\n  /** WebAuthn `user.name` override. */\n  userName?: string;\n  /** WebAuthn `user.displayName` override. */\n  userDisplayName?: string;\n};\n\n/**\n * Optional hints for {@link WebAuthnClient.signIn}.\n */\nexport type WebAuthnSignInOptions = {\n  /** Email hint to filter discoverable credentials. */\n  email?: string;\n  /** Set to `true` for conditional UI (autofill) mode. */\n  autofill?: boolean;\n};\n\n/**\n * WebAuthn client-side helpers.\n *\n * @see {@link TotpClient}\n * @see {@link DeviceClient}\n */\nexport interface WebAuthnClient {\n  /**\n   * Check whether the current runtime exposes WebAuthn passkey APIs.\n   *\n   * @returns `true` when `navigator.credentials` is available.\n   *\n   * @example\n   * ```ts\n   * if (auth.webauthn.isSupported()) {\n   *   // Show passkey registration button\n   * }\n   * ```\n   */\n  isSupported(): boolean;\n\n  /**\n   * Check whether conditional mediation (autofill-style passkeys) is available.\n   *\n   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.\n   *\n   * @example\n   * ```ts\n   * if (await auth.webauthn.isAutofillSupported()) {\n   *   await auth.webauthn.signIn({ autofill: true });\n   * }\n   * ```\n   */\n  isAutofillSupported(): Promise<boolean>;\n\n  /**\n   * Start a passkey registration flow and complete the WebAuthn ceremony.\n   *\n   * Creates a new credential bound to the current user's account.\n   *\n   * @param opts - Optional registration hints.\n   * @param opts.name - Human-readable name for the passkey (e.g. `\"MacBook Pro\"`).\n   * @param opts.userName - WebAuthn `user.name` override.\n   * @param opts.userDisplayName - WebAuthn `user.displayName` override.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.register({ name: \"My laptop\" });\n   * ```\n   */\n  register(opts?: WebAuthnRegisterOptions): Promise<SignInResult>;\n\n  /** @internal Complete registration options returned by a provider continuation. */\n  completeRegistration(result: WebAuthnRotationResult): Promise<SignInResult>;\n\n  /** @internal Complete passkey sign-in options returned by a provider continuation. */\n  completeSignIn(result: WebAuthnContinuationSignInResult): Promise<SignInResult>;\n\n  /**\n   * Sign in with an existing passkey and complete the WebAuthn ceremony.\n   *\n   * @param opts - Optional sign-in hints.\n   * @param opts.email - Email hint to filter discoverable credentials.\n   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.\n   * @returns A {@link SignInResult} — typically `{ kind: \"signedIn\" }` once a client session is available.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.webauthn.signIn();\n   * ```\n   */\n  signIn(opts?: WebAuthnSignInOptions): Promise<SignInResult>;\n}\n\n/**\n * Optional hints for {@link TotpClient.setup}.\n */\nexport type TotpSetupOptions = {\n  /** Issuer name shown in the authenticator app. */\n  name?: string;\n  /** Account label shown in the authenticator app. */\n  accountName?: string;\n};\n\n/** Result of {@link TotpClient.setup}. */\nexport type TotpSetupResult = {\n  /** `otpauth://` URL — render as a QR code. */\n  uri: string;\n  /** Raw base32-encoded shared secret. */\n  secret: string;\n  /** Verifier token to pass to {@link TotpClient.confirm}. */\n  verifier: string;\n  /** Factor ID to pass to {@link TotpClient.confirm}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.confirm}. */\nexport type TotpConfirmParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from {@link TotpSetupResult.verifier}. */\n  verifier: string;\n  /** Factor ID from {@link TotpSetupResult.totpId}. */\n  totpId: string;\n};\n\n/** Params for {@link TotpClient.verify}. */\nexport type TotpVerifyParams = {\n  /** Six-digit OTP from the authenticator app. */\n  code: string;\n  /** Verifier token from a `totpRequired` sign-in result. */\n  verifier: string;\n};\n\n/**\n * TOTP two-factor authentication client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link DeviceClient}\n */\nexport interface TotpClient {\n  /**\n   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.\n   *\n   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code\n   * for the user to scan with their authenticator app.\n   *\n   * @param opts - Optional setup hints.\n   * @param opts.name - Issuer name shown in the authenticator app.\n   * @param opts.accountName - Account label in the authenticator app.\n   * @returns An object with `{ uri, secret, verifier, totpId }`.\n   *\n   * @example\n   * ```ts\n   * const { uri, secret, verifier, totpId } = await auth.totp.setup();\n   * // Render `uri` as a QR code, then confirm:\n   * await auth.totp.confirm({ code: userCode, verifier, totpId });\n   * ```\n   */\n  setup(opts?: TotpSetupOptions): Promise<TotpSetupResult>;\n\n  /**\n   * Confirm a newly created TOTP factor with the first authenticator code.\n   *\n   * Call this after the user scans the QR code and enters the first OTP.\n   *\n   * @param opts - Confirmation parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.\n   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.totp.confirm({ code: \"123456\", verifier, totpId });\n   * if (result.kind === \"failed\") showError(result.code);\n   * ```\n   */\n  confirm(opts: TotpConfirmParams): Promise<SignInResult>;\n\n  /**\n   * Complete a sign-in that is waiting on TOTP verification.\n   *\n   * Called when `signIn()` returns `{ kind: \"totpRequired\" }`.\n   *\n   * @param opts - Verification parameters.\n   * @param opts.code - The 6-digit TOTP code from the authenticator app.\n   * @param opts.verifier - The verifier string from the `totpRequired` result.\n   * @returns A {@link SignInResult} — `{ kind: \"signedIn\" }` on success, or\n   *   `{ kind: \"failed\", code }` when the code is rejected.\n   *\n   * @example\n   * ```ts\n   * const result = await auth.signIn(\"password\", { email, password });\n   * if (result.kind === \"totpRequired\") {\n   *   const totp = await auth.totp.verify({ code: totpCode, verifier: result.verifier });\n   *   if (totp.kind === \"failed\") showError(totp.code);\n   * }\n   * ```\n   */\n  verify(opts: TotpVerifyParams): Promise<SignInResult>;\n}\n\n/** Params for {@link DeviceClient.poll}. */\nexport type DevicePollParams = {\n  code: DeviceCodeResult;\n  /** Aborts the poll loop cleanly, e.g. on UI unmount. */\n  signal?: AbortSignal;\n};\n\n/** Params for {@link DeviceClient.verify}. */\nexport type DeviceVerifyParams = { code: string };\n\n/**\n * Device authorization (RFC 8628) client-side helpers.\n *\n * @see {@link WebAuthnClient}\n * @see {@link TotpClient}\n */\nexport interface DeviceClient {\n  /**\n   * Poll until a device flow is approved or expires.\n   *\n   * Polls the server at the interval specified in the {@link DeviceCodeResult}\n   * until the user authorizes the device or the code expires.\n   *\n   * @param opts - Poll options.\n   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn(\"device\")`.\n   * @param opts.signal - Optional {@link AbortSignal}; aborting returns cleanly\n   *   at the next loop boundary (e.g. on UI unmount).\n   * @throws `ConvexError({ code: \"DEVICE_CODE_EXPIRED\" })` when the code expires before authorization.\n   *\n   * @example\n   * ```ts\n   * const controller = new AbortController();\n   * const result = await auth.signIn(\"device\");\n   * if (result.kind === \"deviceCode\") {\n   *   // Display result.deviceCode.userCode to the user\n   *   await auth.device.poll({ code: result.deviceCode, signal: controller.signal });\n   *   console.log(\"Device authorized!\");\n   * }\n   * ```\n   */\n  poll(opts: DevicePollParams): Promise<void>;\n\n  /**\n   * Approve a device flow from the verification page using the displayed user code.\n   *\n   * Call this on the authorization page where the user enters the short code\n   * shown on the device screen.\n   *\n   * @param opts - Verification options.\n   * @param opts.code - The user code string (e.g. `\"WDJB-MJHT\"`).\n   * @throws `ConvexError({ code: \"DEVICE_AUTHORIZATION_FAILED\" })` when verification fails.\n   *\n   * @example\n   * ```ts\n   * await auth.device.verify({ code: \"WDJB-MJHT\" });\n   * ```\n   */\n  verify(opts: DeviceVerifyParams): Promise<void>;\n}\n\n/**\n * Extract capability flags from an AuthApiRefs type.\n *\n * @typeParam Api - An AuthApiRefs type to extract capability flags from.\n */\ntype SignInRequest<Api extends AuthApiRefs> =\n  FunctionArgs<Api[\"signIn\"]> extends infer Args\n    ? Args extends { request: infer Request }\n      ? Request\n      : Args\n    : never;\n\ntype ProviderIds<Api extends AuthApiRefs> = [Api[\"signIn\"]] extends [never]\n  ? string\n  : SignInRequest<Api> extends infer Args\n    ? Args extends unknown\n      ? \"provider\" extends keyof Args\n        ? Exclude<Args[keyof Args & \"provider\"], undefined>\n        : never\n      : never\n    : never;\n\ntype HasProvider<Api extends AuthApiRefs, Id extends string> =\n  string extends ProviderIds<Api> ? boolean : Id extends ProviderIds<Api> ? true : false;\n\ntype InferCaps<Api extends AuthApiRefs> = {\n  webauthn: HasProvider<Api, \"webauthn\">;\n  totp: HasProvider<Api, \"totp\">;\n  device: HasProvider<Api, \"device\">;\n};\n\n/**\n * Include a capability when configured, omit it when disabled, and keep it\n * optional when a framework binding cannot know the capability.\n */\ntype CapabilityClient<Enabled extends boolean, Name extends string, Client> = [Enabled] extends [\n  false,\n]\n  ? {}\n  : [boolean] extends [Enabled]\n    ? { [Key in Name]?: Client }\n    : { [Key in Name]: Client };\n\n/** Pending invite detected from URL or recovered from storage after redirect. */\nexport interface PendingInvite {\n  /**\n   * Raw one-time invite token. Pass to your invite acceptance mutation.\n   * @readonly\n   */\n  readonly token: string;\n  /**\n   * Invite email from the URL or stored redirect state, if available.\n   * @readonly\n   */\n  readonly email: string | null;\n  /**\n   * Consume the invite: clears storage/URL params and returns the token.\n   *\n   * @returns The invite token.\n   * @throws When there is no pending invite to accept.\n   */\n  accept(): Promise<{ token: string }>;\n}\n\n/**\n * Discriminated union of params for the password provider's flows.\n *\n * Each branch maps to one of the six password flows: `signUp`, `signIn`,\n * `reset`, `recover`, `verify`, `change`. Selecting a `flow` literal narrows the\n * accepted params automatically.\n */\nexport type { PasswordParams } from \"../../shared/params\";\n\n/** Params for the email (magic link) provider's initiation step. */\nexport type EmailInitiateParams = EmailParams;\n\n/**\n * Params for completing a code-based flow (no provider). Used to finalise\n * email magic-link sign-ins and other provider-owned code flows when the\n * verification call is made without re-specifying the originating provider.\n */\nexport type CodeCompletionParams = CodeParams;\n\n/** Params for the `connection` provider — requires a connection ID. */\nexport type { ConnectionParams } from \"../../shared/params\";\n\n/** Params for the anonymous provider. Empty / `redirectTo` only. */\nexport type { AnonymousParams } from \"../../shared/params\";\n\n/** Default params shape for OAuth-style providers (google, github, etc.). */\nexport type OAuthSignInParams = OAuthParams;\n\n/**\n * Resolves the `params` argument shape from the `provider` literal.\n *\n * Known special providers (`\"password\"`, `\"email\"`, etc.) get strict typing.\n * Any other string falls back to OAuth-style params, since custom OAuth\n * providers can be registered under arbitrary IDs.\n */\ntype DefaultParamsForProvider<P> = P extends \"password\"\n  ? PasswordParams\n  : P extends \"email\"\n    ? EmailInitiateParams\n    : P extends \"anonymous\"\n      ? AnonymousParams | undefined\n      : P extends \"connection\"\n        ? ConnectionParams\n        : P extends \"webauthn\"\n          ? never\n          : P extends undefined\n            ? CodeCompletionParams\n            : OAuthSignInParams | undefined;\n\ntype ConfiguredProviderArgs<Api extends AuthApiRefs, P> =\n  SignInRequest<Api> extends infer Args ? (Args extends { provider: P } ? Args : never) : never;\n\n/** Resolve a provider's exact params from the generated auth action reference. */\nexport type ParamsForProvider<Api extends AuthApiRefs, P> =\n  string extends ProviderIds<Api>\n    ? DefaultParamsForProvider<P>\n    : P extends \"webauthn\" | \"totp\" | \"device\"\n      ? never\n      : P extends \"connection\"\n        ? ConnectionParams\n        : [P] extends [undefined]\n          ? CodeCompletionParams\n          : ConfiguredProviderArgs<Api, P> extends infer Args\n            ? [Args] extends [never]\n              ? never\n              : Args extends { params: infer Params }\n                ? Params\n                : Args extends { params?: infer Params }\n                  ? Params | undefined\n                  : undefined\n            : never;\n\n/**\n * Tuple-rest helper that flips `params` between required and optional based\n * on whether `undefined` is in its resolved type.\n */\nexport type SignInArgs<Api extends AuthApiRefs, P> =\n  undefined extends ParamsForProvider<Api, P>\n    ? [params?: ParamsForProvider<Api, P>]\n    : [params: ParamsForProvider<Api, P>];\n\n/**\n * Public signature for `auth.signIn`. The provider literal discriminates the\n * params shape via {@link ParamsForProvider}, and the params slot is\n * automatically optional when the resolved type permits `undefined`.\n *\n * @example\n * ```ts\n * auth.signIn(\"password\", { flow: \"signIn\", email, password });\n * auth.signIn(\"password\", { flow: \"change\", email, currentPassword, newPassword });\n * auth.signIn(\"anonymous\"); // params optional\n * ```\n */\nexport type SignInOverloads<Api extends AuthApiRefs = AuthApiRefs> = <\n  const P extends ProviderIds<Api> | undefined,\n>(\n  provider: P,\n  ...args: SignInArgs<Api, P>\n) => Promise<SignInResult>;\n\n/** Base auth client — always present. */\ninterface AuthClientBase<Api extends AuthApiRefs> {\n  /** Restore initial auth state for the current runtime. */\n  initialize: () => Promise<void>;\n  /** SSR-safe query-param reader. */\n  param: (name: string) => string | null;\n  /**\n   * Pending invite recovered from the URL or storage, if present.\n   * @readonly\n   */\n  readonly invite: PendingInvite | null;\n  /** Complete an OAuth callback using a URL or authorization code. */\n  completeOAuth: (input: URL | string | { code: string }) => Promise<OAuthCompletionResult>;\n  /** Start a sign-in flow for a provider. */\n  signIn: SignInOverloads<Api>;\n  /** Sign out and clear local auth state. */\n  signOut: () => Promise<void>;\n  /** Subscribe to auth state changes; returns an unsubscribe. */\n  subscribe: (handler: AuthSubscriber) => () => void;\n  /** Read the current auth state synchronously, e.g. for `useSyncExternalStore`. */\n  getSnapshot: () => AuthState;\n  /** Tear down listeners and reject in-flight handshakes. */\n  destroy: () => void;\n}\n\n/**\n * Framework-agnostic auth client return type.\n *\n * Conditionally includes `totp` and `device` helpers based on the\n * capabilities in the `AuthApiRefs` type. Platform-specific `webauthn` helpers\n * are added by {@link PlatformAuthClient}.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type AuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClientBase<Api> &\n  CapabilityClient<InferCaps<Api>[\"totp\"], \"totp\", TotpClient> &\n  CapabilityClient<InferCaps<Api>[\"device\"], \"device\", DeviceClient>;\n\n/**\n * Browser auth client return type.\n *\n * Extends {@link AuthClient} with conditional WebAuthn helpers when the\n * generated auth API exposes WebAuthn capabilities.\n *\n * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.\n */\nexport type PlatformAuthClient<Api extends AuthApiRefs = AuthApiRefs> = AuthClient<Api> &\n  CapabilityClient<InferCaps<Api>[\"webauthn\"], \"webauthn\", WebAuthnClient>;\n\n/**\n * Options for {@link client}.\n *\n * @typeParam Api - An AuthApiRefs type.\n */\ntype ClientOptionsBase = {\n  /** Any Convex client implementation used to run auth actions. */\n  convex: ConvexTransport;\n  /** Platform runtime implementation used by the client core. */\n  runtime?: ClientRuntime;\n  /** Platform-specific factor adapters supplied by higher-level entrypoints. */\n  adapters?: ClientAdapters;\n  /** Platform-specific adapter factories supplied by higher-level entrypoints. */\n  adapterFactories?: ClientAdapterFactories;\n  /** Explicit Convex deployment URL when it cannot be inferred from the client. */\n  url?: string;\n  /**\n   * Storage backend for persisted tokens.\n   *\n   * Defaults to `runtime.storage` when provided, otherwise `null`.\n   */\n  storage?: Storage | null;\n  /**\n   * Server-known auth used to seed the synchronous boot so SSR and hydration\n   * render the resolved state on first paint. A non-empty JWT boots signed in;\n   * `null` boots signed out. Providing this at all marks auth as resolved, so\n   * the client skips the loading phase. Omit it (leave `undefined`) to read the\n   * persisted value from `storage` instead. Ongoing persistence always uses\n   * `storage`.\n   */\n  token?: string | null;\n  /** SSR-safe URL source for reading query parameters. */\n  location?: URL | (() => URL | null);\n  /**\n   * Default OAuth `redirectTo` applied to `signIn` calls that omit it. Platform\n   * entrypoints set this (e.g. Expo passes its native redirect URI) so the core\n   * can build the authorization URL without a platform-specific `signIn` wrapper.\n   */\n  oauthRedirectTo?: string;\n  /**\n   * Milliseconds to wait for the Convex client to confirm a new token\n   * before a sign-in handshake rejects with `AUTH_HANDSHAKE_TIMEOUT`.\n   * Defaults to `5000`.\n   */\n  handshakeTimeoutMs?: number;\n};\n\n/** Direct Convex mode. Generated auth references are the client contract. */\nexport type DirectClientOptions<Api extends AuthApiRefs = AuthApiRefs> = ClientOptionsBase & {\n  /** Typed auth function refs from the application's generated `api` object. */\n  api: Api;\n  /** Proxy transport and direct transport are mutually exclusive. */\n  proxyPath?: never;\n  /**\n   * Action-only transport used for direct code exchange. Browser and Expo\n   * entrypoints provide one automatically; headless runtimes must inject it.\n   */\n  httpClient?: ActionTransport | null;\n};\n\n/** HTTP proxy mode. The proxy owns the Convex function references. */\nexport type ProxyClientOptions = ClientOptionsBase & {\n  /** Proxy endpoint used instead of direct Convex auth calls. */\n  proxyPath: string;\n  /** Generated references belong to direct mode and cannot be mixed with a proxy. */\n  api?: never;\n  /** Direct action transports belong to direct mode. */\n  httpClient?: never;\n};\n\n/**\n * Client configuration. Selecting direct or proxy mode makes every required\n * transport explicit and prevents the two modes from being combined.\n */\nexport type ClientOptions<Api extends AuthApiRefs = AuthApiRefs> =\n  | DirectClientOptions<Api>\n  | ProxyClientOptions;\n\nexport type OAuthCompletionResult = { handled: false } | { handled: true; cleanupUrl: URL | null };\n\n/**\n * Metadata describing the current auth flow for handshake diagnostics.\n *\n * @internal\n */\nexport type AuthFlowContext = {\n  provider?: string;\n  flow: string;\n};\n\n/**\n * A simple deferred promise that can be resolved or rejected externally.\n */\ninterface SimpleDeferred<T, E = unknown> {\n  readonly promise: Promise<T>;\n  resolve(value: T): void;\n  reject(error: E): void;\n}\n\n/**\n * Create a deferred promise that can be resolved or rejected externally.\n *\n * @returns A deferred object containing the promise and control methods.\n * @internal\n */\nexport function createDeferred<T, E = unknown>(): SimpleDeferred<T, E> {\n  let resolve!: (value: T) => void;\n  let reject!: (error: E) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej as (error: E) => void;\n  });\n  return { promise, resolve, reject };\n}\n\n/** @internal */\nexport type HandshakeWaiter = {\n  epoch: number;\n  context: AuthFlowContext;\n  deferred: SimpleDeferred<void, ConvexError<Value>>;\n  timeoutId: ReturnType<typeof setTimeout>;\n};\n"],"mappings":";;;;;;;AAi0BA,SAAgB,iBAAuD;CACrE,IAAI;CACJ,IAAI;AAKJ,QAAO;EAAE,SAJO,IAAI,SAAY,KAAK,QAAQ;AAC3C,aAAU;AACV,YAAS;IACT;EACgB;EAAS;EAAQ"}

package/dist/component/account.d.ts

@@ -1,6 +1,6 @@
 import { SessionRows } from "./session.js";
-import * as convex_values1512 from "convex/values";
-import * as convex_server83 from "convex/server";
+import * as convex_values2300 from "convex/values";
+import * as convex_server56 from "convex/server";
 
 //#region src/component/account.d.ts
 declare namespace account_d_exports {
@@ -10,7 +10,7 @@ type AcceptedCredentialsSignIn = Omit<SessionRows, "epoch"> & {
   status: "accepted";
 };
 /** Reserve a password attempt and load all sign-in state in one transaction. */
-declare const beginCredentialsSignIn: convex_server83.RegisteredMutation<"public", {
+declare const beginCredentialsSignIn: convex_server56.RegisteredMutation<"public", {
   provider: string;
   providerAccountId: string;
   limitIdentifier: string;
@@ -30,22 +30,22 @@ declare const beginCredentialsSignIn: convex_server83.RegisteredMutation<"public
 } | {
   status: "ready";
   account: {
-    _id: convex_values1512.GenericId<"Account">;
+    _id: convex_values2300.GenericId<"Account">;
     _creationTime: number;
     extend?: any;
     secret?: string | undefined;
     emailVerified?: string | undefined;
     phoneVerified?: string | undefined;
-    userId: convex_values1512.GenericId<"User">;
+    userId: convex_values2300.GenericId<"User">;
     provider: string;
     providerAccountId: string;
   };
   user: {
-    _id: convex_values1512.GenericId<"User">;
+    _id: convex_values2300.GenericId<"User">;
     _creationTime: number;
-    extend?: any;
     email?: string | undefined;
     phone?: string | undefined;
+    extend?: any;
     name?: string | undefined;
     firstName?: string | undefined;
     lastName?: string | undefined;
@@ -53,20 +53,20 @@ declare const beginCredentialsSignIn: convex_server83.RegisteredMutation<"public
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
-    lastActiveGroup?: convex_values1512.GenericId<"Group"> | undefined;
+    lastActiveGroup?: convex_values2300.GenericId<"Group"> | undefined;
     sessionEpoch: number;
   };
   hasTotp: boolean;
 }>>;
 /** Refund a verified password attempt and optionally issue its session atomically. */
-declare const completeCredentialsSignIn: convex_server83.RegisteredMutation<"public", {
+declare const completeCredentialsSignIn: convex_server56.RegisteredMutation<"public", {
   replaceSession?: {
-    sessionId: convex_values1512.GenericId<"Session">;
-    authenticatedUserId: convex_values1512.GenericId<"User">;
+    sessionId: convex_values2300.GenericId<"Session">;
+    authenticatedUserId: convex_values2300.GenericId<"User">;
   } | undefined;
   sessionExpirationTime: number;
   refreshTokenExpirationTime: number;
-  accountId: convex_values1512.GenericId<"Account">;
+  accountId: convex_values2300.GenericId<"Account">;
   limitIdentifier: string;
   issueSession: boolean;
   generateTokens: boolean;
@@ -79,18 +79,18 @@ declare const completeCredentialsSignIn: convex_server83.RegisteredMutation<"pub
  * Read an account by id, or by `{ provider, providerAccountId }` when both
  * are given. Returns `null` when no selector matches.
  */
-declare const get: convex_server83.RegisteredQuery<"public", {
-  id?: convex_values1512.GenericId<"Account"> | undefined;
+declare const get: convex_server56.RegisteredQuery<"public", {
+  id?: convex_values2300.GenericId<"Account"> | undefined;
   provider?: string | undefined;
   providerAccountId?: string | undefined;
 }, Promise<{
-  _id: convex_values1512.GenericId<"Account">;
+  _id: convex_values2300.GenericId<"Account">;
   _creationTime: number;
   extend?: any;
   secret?: string | undefined;
   emailVerified?: string | undefined;
   phoneVerified?: string | undefined;
-  userId: convex_values1512.GenericId<"User">;
+  userId: convex_values2300.GenericId<"User">;
   provider: string;
   providerAccountId: string;
 } | null>>;
@@ -101,35 +101,35 @@ declare const get: convex_server83.RegisteredQuery<"public", {
  * public server facade projects these raw records into safe capability
  * summaries before exposing them to application code.
  */
-declare const list: convex_server83.RegisteredQuery<"public", {
-  userId?: convex_values1512.GenericId<"User"> | undefined;
+declare const list: convex_server56.RegisteredQuery<"public", {
+  userId?: convex_values2300.GenericId<"User"> | undefined;
   provider?: string | undefined;
-  userIds?: convex_values1512.GenericId<"User">[] | undefined;
+  userIds?: convex_values2300.GenericId<"User">[] | undefined;
 }, Promise<{
-  _id: convex_values1512.GenericId<"Account">;
+  _id: convex_values2300.GenericId<"Account">;
   _creationTime: number;
   extend?: any;
   secret?: string | undefined;
   emailVerified?: string | undefined;
   phoneVerified?: string | undefined;
-  userId: convex_values1512.GenericId<"User">;
+  userId: convex_values2300.GenericId<"User">;
   provider: string;
   providerAccountId: string;
 }[]>>;
 /** Insert a new account. */
-declare const create: convex_server83.RegisteredMutation<"public", {
+declare const create: convex_server56.RegisteredMutation<"public", {
   extend?: any;
   secret?: string | undefined;
-  userId: convex_values1512.GenericId<"User">;
+  userId: convex_values2300.GenericId<"User">;
   provider: string;
   providerAccountId: string;
-}, Promise<convex_values1512.GenericId<"Account">>>;
+}, Promise<convex_values2300.GenericId<"Account">>>;
 /** Patch fields on an account. */
-declare const update: convex_server83.RegisteredMutation<"public", {
-  id: convex_values1512.GenericId<"Account">;
+declare const update: convex_server56.RegisteredMutation<"public", {
+  id: convex_values2300.GenericId<"Account">;
   patch: {
+    userId?: convex_values2300.GenericId<"User"> | undefined;
     extend?: any;
-    userId?: convex_values1512.GenericId<"User"> | undefined;
     provider?: string | undefined;
     providerAccountId?: string | undefined;
     secret?: string | undefined;
@@ -141,10 +141,10 @@ declare const update: convex_server83.RegisteredMutation<"public", {
  * Delete an account. When `requireOtherAccount` is set, refuses to delete the
  * user's last remaining account so they are never left with none.
  */
-declare const remove: convex_server83.RegisteredMutation<"public", {
-  userId?: convex_values1512.GenericId<"User"> | undefined;
+declare const remove: convex_server56.RegisteredMutation<"public", {
+  userId?: convex_values2300.GenericId<"User"> | undefined;
   requireOtherAccount?: boolean | undefined;
-  id: convex_values1512.GenericId<"Account">;
+  id: convex_values2300.GenericId<"Account">;
 }, Promise<null>>;
 //#endregion
 export { account_d_exports };

package/dist/component/connection/audit.d.ts

@@ -1,22 +1,21 @@
-import * as convex_values1847 from "convex/values";
-import * as convex_server186 from "convex/server";
+import * as convex_values2754 from "convex/values";
+import * as convex_server172 from "convex/server";
 
 //#region src/component/connection/audit.d.ts
 declare namespace audit_d_exports {
   export { list };
 }
 /**
- * `component.connection.audit.*` - Connection audit projections backed by auth events.
+ * `component.connection.audit.*` - Auth events scoped to a connection or group.
  *
  * @module
  */
 /**
- * List audit-event projections for a connection or a group, newest first and
- * paginated. Rows are redacted to public fields (IP dropped, `data` narrowed to
- * an allowlist). Requires exactly one of `connectionId` or `groupId` — passing
- * neither throws rather than scanning the entire audit log.
+ * List auth events scoped to a connection or a group, newest first and
+ * paginated. Requires exactly one of `connectionId` or `groupId`, so a caller
+ * cannot scan the whole event log by omitting the scope.
  */
-declare const list: convex_server186.RegisteredQuery<"public", {
+declare const list: convex_server172.RegisteredQuery<"public", {
   paginationOpts: {
     id?: number;
     endCursor?: string | null;
@@ -26,109 +25,104 @@ declare const list: convex_server186.RegisteredQuery<"public", {
     cursor: string | null;
   };
   scope: {
-    connectionId: convex_values1847.GenericId<"GroupConnection">;
+    connectionId: convex_values2754.GenericId<"GroupConnection">;
   } | {
-    groupId: convex_values1847.GenericId<"Group">;
+    groupId: convex_values2754.GenericId<"Group">;
   };
-}, Promise<{
-  page: {
-    _id: convex_values1847.GenericId<"AuthEventProjection">;
-    _creationTime: number;
-    eventId: string;
-    targetKind: "user" | "group" | "session" | "api_key" | "connection" | "oauth_client" | "global";
-    targetId: string;
-    kind: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
-    category: "email" | "user" | "session" | "account" | "password" | "passkey" | "totp" | "phone" | "api_key" | "oauth" | "connection" | "scim" | "webhook" | "security";
-    occurredAt: number;
-    actorType: "user" | "api_key" | "scim" | "webhook" | "system" | "oauth_client" | "anonymous";
-    actorId: string | undefined;
-    subjectType: "email" | "user" | "group" | "session" | "account" | "passkey" | "totp" | "phone" | "api_key" | "connection" | "system" | "oauth_client" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery";
-    subjectId: string | undefined;
-    outcome: "success" | "failure";
-    errorCode: string | undefined;
-    requestId: string | undefined;
-    ip: undefined;
-    data: {
-      type?: string | undefined;
-      profile?: Record<string, any> | undefined;
-      provider?: string | undefined;
-      existingUserId?: string | undefined;
-    } | {
-      method?: string | undefined;
-      provider: string;
-    } | {
-      userId?: string | undefined;
-      sessionId?: string | undefined;
-      reason?: string | undefined;
-      refreshTokenId?: string | undefined;
-      flow?: "reset" | "change" | undefined;
-    } | {
-      provider?: string | undefined;
-      providerAccountId?: string | undefined;
-      accountId?: string | undefined;
-    } | {
-      reason?: string | undefined;
-      passkeyId?: string | undefined;
-      credentialId?: string | undefined;
-      totpId?: string | undefined;
-      keyId?: string | undefined;
-      name?: string | undefined;
-      prefix?: string | undefined;
-    } | {
-      email?: string | undefined;
-      userId?: string | undefined;
-      phone?: string | undefined;
-    } | {
-      userId?: string | undefined;
-      name?: string | undefined;
-      clientId?: string | undefined;
-      codeId?: string | undefined;
-      scopes?: string[] | undefined;
-      redirectUri?: string | undefined;
-      grantType?: string | undefined;
-      resource?: string | undefined;
-    } | {
-      userId?: string | undefined;
-      errorCode?: string | undefined;
-      connectionId?: string | undefined;
-      changed?: string[] | undefined;
-      protocol?: "oidc" | "saml" | undefined;
-      domain?: string | undefined;
-      recordName?: string | undefined;
-      expiresAt?: number | undefined;
-      verifiedAt?: number | undefined;
-      metadataUrl?: string | undefined;
-      domains?: string[] | undefined;
-      issuer?: string | undefined;
-      discoveryUrl?: string | undefined;
-      jwksUri?: string | undefined;
-      audience?: string | string[] | undefined;
-      tokenEndpointAuthMethod?: string | undefined;
-      version?: number | undefined;
-    } | {
-      userId?: string | undefined;
-      scimConfigId?: string | undefined;
-      resourceType?: "user" | "group" | undefined;
-      resourceId?: string | undefined;
-      operation?: string | undefined;
-      externalId?: string | undefined;
-      active?: boolean | undefined;
-      groupId?: string | undefined;
-    } | {
-      endpointId?: string | undefined;
-      deliveryId?: string | undefined;
-      sourceEventId?: string | undefined;
-      sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
-      attemptCount?: number | undefined;
-      status?: number | undefined;
-      error?: string | undefined;
-    } | undefined;
-  }[];
-  isDone: boolean;
-  continueCursor: convex_server186.Cursor;
-  splitCursor?: convex_server186.Cursor | null;
-  pageStatus?: "SplitRecommended" | "SplitRequired" | null;
-}>>;
+}, Promise<convex_server172.PaginationResult<{
+  _id: convex_values2754.GenericId<"AuthEventProjection">;
+  _creationTime: number;
+  requestId?: string | undefined;
+  ip?: string | undefined;
+  userAgent?: string | undefined;
+  errorCode?: string | undefined;
+  data?: {
+    type?: string | undefined;
+    provider?: string | undefined;
+    profile?: Record<string, any> | undefined;
+    existingUserId?: string | undefined;
+  } | {
+    method?: string | undefined;
+    provider: string;
+  } | {
+    userId?: string | undefined;
+    sessionId?: string | undefined;
+    reason?: string | undefined;
+    refreshTokenId?: string | undefined;
+    flow?: "reset" | "change" | undefined;
+  } | {
+    provider?: string | undefined;
+    providerAccountId?: string | undefined;
+    accountId?: string | undefined;
+  } | {
+    reason?: string | undefined;
+    passkeyId?: string | undefined;
+    credentialId?: string | undefined;
+    totpId?: string | undefined;
+    keyId?: string | undefined;
+    name?: string | undefined;
+    prefix?: string | undefined;
+  } | {
+    userId?: string | undefined;
+    email?: string | undefined;
+    phone?: string | undefined;
+  } | {
+    userId?: string | undefined;
+    name?: string | undefined;
+    clientId?: string | undefined;
+    codeId?: string | undefined;
+    scopes?: string[] | undefined;
+    redirectUri?: string | undefined;
+    grantType?: string | undefined;
+    resource?: string | undefined;
+  } | {
+    userId?: string | undefined;
+    errorCode?: string | undefined;
+    connectionId?: string | undefined;
+    changed?: string[] | undefined;
+    protocol?: "oidc" | "saml" | undefined;
+    domain?: string | undefined;
+    recordName?: string | undefined;
+    expiresAt?: number | undefined;
+    verifiedAt?: number | undefined;
+    metadataUrl?: string | undefined;
+    domains?: string[] | undefined;
+    issuer?: string | undefined;
+    discoveryUrl?: string | undefined;
+    jwksUri?: string | undefined;
+    audience?: string | string[] | undefined;
+    tokenEndpointAuthMethod?: string | undefined;
+    version?: number | undefined;
+  } | {
+    userId?: string | undefined;
+    scimConfigId?: string | undefined;
+    resourceType?: "user" | "group" | undefined;
+    resourceId?: string | undefined;
+    operation?: string | undefined;
+    externalId?: string | undefined;
+    active?: boolean | undefined;
+    groupId?: string | undefined;
+  } | {
+    endpointId?: string | undefined;
+    deliveryId?: string | undefined;
+    sourceEventId?: string | undefined;
+    sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
+    attemptCount?: number | undefined;
+    status?: number | undefined;
+    error?: string | undefined;
+  } | undefined;
+  actorId?: string | undefined;
+  subjectId?: string | undefined;
+  eventId: string;
+  kind: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
+  category: "user" | "session" | "account" | "password" | "passkey" | "totp" | "email" | "phone" | "api_key" | "oauth" | "connection" | "scim" | "webhook" | "security";
+  occurredAt: number;
+  outcome: "success" | "failure";
+  targetKind: "user" | "group" | "session" | "api_key" | "connection" | "oauth_client" | "global";
+  actorType: "user" | "api_key" | "scim" | "webhook" | "system" | "oauth_client" | "anonymous";
+  subjectType: "user" | "group" | "session" | "account" | "passkey" | "totp" | "email" | "phone" | "api_key" | "connection" | "system" | "oauth_client" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery";
+  targetId: string;
+}>>>;
 //#endregion
 export { audit_d_exports };
 //# sourceMappingURL=audit.d.ts.map

package/dist/component/connection/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","names":[],"sources":["../../../src/component/connection/audit.ts"],"mappings":";;;;;;;;;;;;;AA8GA;;;;;cAAa,IAAA,mBAAI,eAAA;;;;;;;;;;kBA6Bf,iBAAA,CAAA,SAAA;EAAA"}
+{"version":3,"file":"audit.d.ts","names":[],"sources":["../../../src/component/connection/audit.ts"],"mappings":";;;;;;;;;;;;;AAoBA;;;;cAAa,IAAA,mBAAI,eAAA;;;;;;;;;;kBA6Bf,iBAAA,CAAA,SAAA;EAAA"}