@robelest/convex-auth 0.0.4-preview.13 → 0.0.4-preview.16

package/dist/server/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../src/server/types.ts"],"sourcesContent":["import {\n  AnyDataModel,\n  DataModelFromSchemaDefinition,\n  DocumentByName,\n  FunctionReference,\n  GenericActionCtx,\n  GenericDataModel,\n  GenericMutationCtx,\n  GenericQueryCtx,\n  RegisteredAction,\n  RegisteredMutation,\n  RegisteredQuery,\n  TableNamesInDataModel,\n} from \"convex/server\";\nimport { GenericId, Value } from \"convex/values\";\n\nimport schema from \"../component/schema\";\nimport { CredentialsUserConfig } from \"../providers/credentials\";\n\n// ============================================================================\n// Utility types\n// ============================================================================\n\n/** A value that is either `T` or a `PromiseLike<T>`. */\nexport type Awaitable<T> = T | PromiseLike<T>;\n\n/**\n * The config for the Convex Auth library, passed to `createAuth`.\n */\nexport type ConvexAuthConfig = {\n  /**\n   * A list of authentication provider configs.\n   *\n   * You can import existing configs from\n   * `@robelest/convex-auth/providers/<provider-name>`\n   */\n  providers: AuthProviderConfig[];\n  /**\n   * Auth component reference from `components.auth`.\n   *\n   * Core auth storage operations are executed through\n   * the component API boundary.\n   */\n  component: AuthComponentApi;\n  /**\n   * Session configuration.\n   */\n  session?: {\n    /**\n     * How long can a user session last without the user reauthenticating.\n     *\n     * Defaults to 30 days.\n     */\n    totalDurationMs?: number;\n    /**\n     * How long can a user session last without the user being active.\n     *\n     * Defaults to 30 days.\n     */\n    inactiveDurationMs?: number;\n  };\n  /**\n   * JWT configuration.\n   */\n  jwt?: {\n    /**\n     * How long is the JWT valid for after it is signed initially.\n     *\n     * Defaults to 1 hour.\n     */\n    durationMs?: number;\n  };\n  /**\n   * Sign-in configuration.\n   */\n  signIn?: {\n    /**\n     * How many times can the user fail to provide the correct credentials\n     * (password, OTP) per hour.\n     *\n     * Defaults to 10 times per hour (that is 10 failed attempts, and then\n     * allow another one every 6 minutes).\n     */\n    maxFailedAttemptsPerHour?: number;\n  };\n  /**\n   * Lifecycle callbacks for customizing sign-in behavior.\n   *\n   * Use `redirect` to control post-OAuth redirect URLs, and\n   * `createOrUpdateUser` or `afterUserCreatedOrUpdated` to\n   * customize account linking and user document creation.\n   */\n  callbacks?: {\n    /**\n     * Control which URLs are allowed as a destination after OAuth sign-in\n     * and for magic links:\n     *\n     * ```ts\n     * import { createAuth } from \"@robelest/convex-auth/component\";\n     * import { components } from \"./_generated/api\";\n     *\n     * const auth = createAuth(components.auth, {\n     *   providers: [google],\n     *   callbacks: {\n     *     async redirect({ redirectTo }) {\n     *       // Check that redirectTo is valid\n     *       // and return the relative or absolute URL\n     *       // to redirect to.\n     *     },\n     *   },\n     * });\n     * ```\n     *\n     * Convex Auth performs redirect only during OAuth sign-in. By default,\n     * it redirects back to the URL specified via the `SITE_URL` environment\n     * variable. Similarly magic links link to `SITE_URL`.\n     *\n     * You can customize that behavior by providing a `redirectTo` param\n     * to the `signIn` function:\n     *\n     * ```ts\n     * signIn(\"google\", { redirectTo: \"/dashboard\" })\n     * ```\n     *\n     * You can even redirect to a different site.\n     *\n     * This callback, if specified, is then called with the provided\n     * `redirectTo` param. Otherwise, only query params, relative paths\n     * and URLs starting with `SITE_URL` are allowed.\n     */\n    redirect?: (params: {\n      /**\n       * The param value passed to the `signIn` function.\n       */\n      redirectTo: string;\n    }) => Promise<string>;\n    /**\n     * Completely control account linking via this callback.\n     *\n     * This callback is called during the sign-in process,\n     * before account creation and token generation.\n     * If specified, this callback is responsible for creating\n     * or updating the user document.\n     *\n     * For \"credentials\" providers, the callback is only called\n     * when `createAccount` is called.\n     */\n    createOrUpdateUser?: (\n      ctx: GenericMutationCtx<AnyDataModel>,\n      args: {\n        /**\n         * If this is a sign-in to an existing account,\n         * this is the existing user ID linked to that account.\n         */\n        existingUserId: GenericId<\"User\"> | null;\n        /**\n         * The provider type or \"verification\" if this callback is called\n         * after an email or phone token verification.\n         */\n        type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n        /**\n         * The provider used for the sign-in, or the provider\n         * tied to the account which is having the email or phone verified.\n         */\n        provider: AuthProviderMaterializedConfig;\n        /**\n         * - The profile returned by the OAuth provider's `profile` method.\n         * - The profile passed to `createAccount` from a ConvexCredentials\n         * config.\n         * - The email address to which an email will be sent.\n         * - The phone number to which a text will be sent.\n         */\n        profile: Record<string, unknown> & {\n          email?: string;\n          phone?: string;\n          emailVerified?: boolean;\n          phoneVerified?: boolean;\n        };\n        /**\n         * The `shouldLink` argument passed to `createAccount`.\n         */\n        shouldLink?: boolean;\n      },\n    ) => Promise<GenericId<\"User\">>;\n    /**\n     * Perform additional writes after a user is created.\n     *\n     * This callback is called during the sign-in process,\n     * after the user is created or updated,\n     * before account creation and token generation.\n     *\n     * **This callback is only called if `createOrUpdateUser`\n     * is not specified.** If `createOrUpdateUser` is specified,\n     * you can perform any additional writes in that callback.\n     *\n     * For \"credentials\" providers, the callback is only called\n     * when `createAccount` is called.\n     */\n    afterUserCreatedOrUpdated?: (\n      ctx: GenericMutationCtx<AnyDataModel>,\n      args: {\n        /**\n         * The ID of the user that is being signed in.\n         */\n        userId: GenericId<\"User\">;\n        /**\n         * If this is a sign-in to an existing account,\n         * this is the existing user ID linked to that account.\n         */\n        existingUserId: GenericId<\"User\"> | null;\n        /**\n         * The provider type or \"verification\" if this callback is called\n         * after an email or phone token verification.\n         */\n        type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n        /**\n         * The provider used for the sign-in, or the provider\n         * tied to the account which is having the email or phone verified.\n         */\n        provider: AuthProviderMaterializedConfig;\n        /**\n         * - The profile returned by the OAuth provider's `profile` method.\n         * - The profile passed to `createAccount` from a ConvexCredentials\n         * config.\n         * - The email address to which an email will be sent.\n         * - The phone number to which a text will be sent.\n         */\n        profile: Record<string, unknown> & {\n          email?: string;\n          phone?: string;\n          emailVerified?: boolean;\n          phoneVerified?: boolean;\n        };\n        /**\n         * The `shouldLink` argument passed to `createAccount`.\n         */\n        shouldLink?: boolean;\n      },\n    ) => Promise<void>;\n  };\n};\n\n/**\n * Union of all supported auth provider config types.\n *\n * Includes Arctic-based OAuth providers (via the `OAuth()` factory),\n * plus library-native providers: credentials, email, phone, passkey\n * (WebAuthn), and TOTP (2FA). Each can be passed as a config object\n * or a factory function.\n */\nexport type AuthProviderConfig =\n  | import(\"../providers/oauth\").OAuthProviderInstance\n  | import(\"../providers/password\").Password\n  | import(\"../providers/passkey\").Passkey\n  | import(\"../providers/totp\").Totp\n  | import(\"../providers/anonymous\").Anonymous\n  | import(\"../providers/device\").Device\n  | import(\"../providers/sso\").SSO\n  | import(\"../providers/email\").Email\n  | import(\"../providers/phone\").Phone\n  | OAuthMaterializedConfig\n  | ConvexCredentialsConfig\n  | ((...args: any) => ConvexCredentialsConfig)\n  | EmailConfig\n  | ((...args: any) => EmailConfig)\n  | PhoneConfig\n  | ((...args: any) => PhoneConfig)\n  | PasskeyProviderConfig\n  | ((...args: any) => PasskeyProviderConfig)\n  | TotpProviderConfig\n  | ((...args: any) => TotpProviderConfig)\n  | DeviceProviderConfig\n  | ((...args: any) => DeviceProviderConfig)\n  | SSOProviderConfig;\n\n/**\n * Minimal config stored for the SSO provider at runtime.\n * No options — enterprise configuration is entirely per-tenant runtime state.\n */\nexport interface SSOProviderConfig {\n  id: string;\n  type: \"sso\";\n}\n\n/**\n * Email provider config for magic link / OTP sign-in.\n */\nexport interface EmailConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  /** Provider identifier (e.g. `\"email\"`, `\"resend\"`). */\n  id: string;\n  /** Discriminant for provider type routing. */\n  type: \"email\";\n  /** Display name for this provider. */\n  name?: string;\n  /** Sender address (e.g. `\"My App <noreply@example.com>\"`). */\n  from?: string;\n  /** Token expiration in seconds. Defaults to 86 400 (24 hours). */\n  maxAge?: number;\n  /**\n   * Send the verification token to the user.\n   *\n   * Accepts an optional Convex action context as the second argument,\n   * enabling use with Convex components like `@convex-dev/resend`.\n   */\n  sendVerificationRequest: (\n    params: {\n      identifier: string;\n      url: string;\n      expires: Date;\n      provider: EmailConfig;\n      token: string;\n      request: Request;\n    },\n    ctx?: GenericActionCtx<AnyDataModel>,\n  ) => Awaitable<void>;\n  /**\n   * Override to generate a custom verification token.\n   * Tokens shorter than 24 characters are treated as OTPs and\n   * require the original email to be re-submitted for verification.\n   */\n  generateVerificationToken?: () => Awaitable<string>;\n  /**\n   * Normalize the email address before storage / lookup.\n   * Defaults to lowercasing and trimming whitespace.\n   */\n  normalizeIdentifier?: (identifier: string) => string;\n  /**\n   * Before the token is verified, check other\n   * provided parameters.\n   *\n   * Used to make sure that OTPs are accompanied\n   * with the correct email address.\n   */\n  authorize?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    account: GenericDoc<DataModel, \"Account\">,\n  ) => Promise<void>;\n  /** Raw user options before merging with defaults. */\n  options: EmailUserConfig<DataModel>;\n}\n\n/**\n * Configurable options for an email provider config.\n */\nexport type EmailUserConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> = Omit<Partial<EmailConfig<DataModel>>, \"options\" | \"type\">;\n\n/**\n * Same as email provider config, but verifies\n * phone number instead of the email address.\n */\nexport interface PhoneConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  id: string;\n  type: \"phone\";\n  /**\n   * Token expiration in seconds.\n   */\n  maxAge: number;\n  /**\n   * Send the phone number verification request.\n   */\n  sendVerificationRequest: (\n    params: {\n      identifier: string;\n      url: string;\n      expires: Date;\n      provider: PhoneConfig;\n      token: string;\n    },\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => Promise<void>;\n  /**\n   * Defaults to `process.env.AUTH_<PROVIDER_ID>_KEY`.\n   */\n  apiKey?: string;\n  /**\n   * Override this to generate a custom token.\n   * Note that the tokens are assumed to be cryptographically secure.\n   * Any tokens shorter than 24 characters are assumed to not\n   * be secure enough on their own, and require providing\n   * the original `phone` used in the initial `signIn` call.\n   * @returns\n   */\n  generateVerificationToken?: () => Promise<string>;\n  /**\n   * Normalize the phone number.\n   * @param identifier Passed as `phone` in params of `signIn`.\n   * @returns The phone number used in `sendVerificationRequest`.\n   */\n  normalizeIdentifier?: (identifier: string) => string;\n  /**\n   * Before the token is verified, check other\n   * provided parameters.\n   *\n   * Used to make sure tha OTPs are accompanied\n   * with the correct phone number.\n   */\n  authorize?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    account: GenericDoc<DataModel, \"Account\">,\n  ) => Promise<void>;\n  options: PhoneUserConfig<DataModel>;\n}\n\n/**\n * Configurable options for a phone provider config.\n */\nexport type PhoneUserConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> = Omit<Partial<PhoneConfig<DataModel>>, \"options\" | \"type\">;\n\n/**\n * Credentials provider config used by Convex Auth.\n */\nexport type ConvexCredentialsConfig = CredentialsUserConfig<any> & {\n  type: \"credentials\";\n  id: string;\n};\n\n/**\n * Configuration for the passkey (WebAuthn) provider.\n */\nexport interface PasskeyProviderConfig {\n  id: string;\n  type: \"passkey\";\n  options: {\n    /** Relying Party display name. Defaults to SITE_URL hostname. */\n    rpName?: string;\n    /** Relying Party ID (hostname). Defaults to SITE_URL hostname. */\n    rpId?: string;\n    /** Allowed origins for credential verification. Defaults to SITE_URL. */\n    origin?: string | string[];\n    /** Attestation conveyance preference. Defaults to \"none\". */\n    attestation?: \"none\" | \"direct\";\n    /** User verification requirement. Defaults to \"required\". */\n    userVerification?: \"required\" | \"preferred\" | \"discouraged\";\n    /** Resident key (discoverable credential) preference. Defaults to \"preferred\". */\n    residentKey?: \"required\" | \"preferred\" | \"discouraged\";\n    /** Restrict to platform or cross-platform authenticators. */\n    authenticatorAttachment?: \"platform\" | \"cross-platform\";\n    /** Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)]. */\n    algorithms?: number[];\n    /** Challenge expiration in ms. Defaults to 300_000 (5 minutes). */\n    challengeExpirationMs?: number;\n  };\n}\n\n/**\n * Configuration for the TOTP two-factor authentication provider.\n */\nexport interface TotpProviderConfig {\n  id: string;\n  type: \"totp\";\n  options: {\n    /** Issuer name shown in authenticator apps (e.g. \"My App\"). */\n    issuer: string;\n    /** Number of digits in each code (default: 6). */\n    digits: number;\n    /** Time period in seconds for code rotation (default: 30). */\n    period: number;\n  };\n}\n\n// ============================================================================\n// OAuth types (Arctic-based)\n// ============================================================================\n\n/**\n * Normalized user profile returned by an OAuth provider.\n *\n * `id` is the provider-specific account identifier (e.g. GitHub user ID).\n */\nexport interface OAuthProfile {\n  id: string;\n  name?: string;\n  email?: string;\n  image?: string;\n  /** Additional claims from the ID token or userinfo endpoint. */\n  [key: string]: unknown;\n}\n\n/**\n * Internal config shape for an OAuth provider after normalization.\n *\n * This is what the OAuth flow code receives — it maps to the user-facing\n * `OAuthConfig` from `@robelest/convex-auth/providers`.\n *\n * @internal\n */\nexport interface OAuthProviderConfig {\n  /** OAuth scopes to request. */\n  scopes?: string[];\n  /** User-provided profile extraction callback. */\n  profile?: (tokens: import(\"arctic\").OAuth2Tokens) => Promise<OAuthProfile>;\n}\n\n/** Credentials identifying a provider account (e.g. email + hashed password). */\nexport type AuthAccountCredentials = {\n  /** Provider-specific account identifier (e.g. email address). */\n  id: string;\n  /** Optional secret (e.g. hashed password). */\n  secret?: string;\n};\n\n/** Arguments for `auth.account.create()`. */\nexport type AuthCreateAccountArgs = {\n  provider: string;\n  account: AuthAccountCredentials;\n  profile: Record<string, unknown> & {\n    email?: string;\n    phone?: string;\n    emailVerified?: boolean;\n    phoneVerified?: boolean;\n  };\n  shouldLinkViaEmail?: boolean;\n  shouldLinkViaPhone?: boolean;\n};\n\n/** Arguments for `auth.account.get()`. */\nexport type AuthRetrieveAccountArgs = {\n  provider: string;\n  account: AuthAccountCredentials;\n};\n\n/** Arguments for `auth.account.update()`. */\nexport type AuthUpdateAccountArgs = {\n  provider: string;\n  account: {\n    id: string;\n    secret: string;\n  };\n};\n\n/** Arguments for `auth.session.invalidate()`. */\nexport type AuthInvalidateSessionsArgs = {\n  userId: GenericId<\"User\">;\n  except?: GenericId<\"Session\">[];\n};\n\n/** Arguments for `auth.provider.signIn()`. */\nexport type AuthProviderSignInArgs = {\n  accountId?: GenericId<\"Account\">;\n  params?: Record<string, Value | undefined>;\n};\n\n/** Return type of `auth.provider.signIn()` — user and session IDs, or `null` on failure. */\nexport type AuthProviderSignInResult = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n} | null;\n\n/** Server-side auth helpers available on enriched action contexts. */\nexport type AuthServerHelpers = {\n  account: {\n    create: (\n      ctx: GenericActionCtx<any>,\n      args: AuthCreateAccountArgs,\n    ) => Promise<{\n      account: GenericDoc<GenericDataModel, \"Account\">;\n      user: GenericDoc<GenericDataModel, \"User\">;\n    }>;\n    get: (\n      ctx: GenericActionCtx<any>,\n      args: AuthRetrieveAccountArgs,\n    ) => Promise<{\n      account: GenericDoc<GenericDataModel, \"Account\">;\n      user: GenericDoc<GenericDataModel, \"User\">;\n    }>;\n    update: (\n      ctx: GenericActionCtx<any>,\n      args: AuthUpdateAccountArgs,\n    ) => Promise<void>;\n  };\n  session: {\n    current: (ctx: {\n      auth: GenericActionCtx<GenericDataModel>[\"auth\"];\n    }) => Promise<GenericId<\"Session\"> | null>;\n    invalidate: (\n      ctx: GenericActionCtx<any>,\n      args: AuthInvalidateSessionsArgs,\n    ) => Promise<void>;\n  };\n  provider: {\n    signIn: (\n      ctx: GenericActionCtx<any>,\n      provider: AuthProviderConfig,\n      args: AuthProviderSignInArgs,\n    ) => Promise<AuthProviderSignInResult>;\n  };\n};\n\n/**\n * Your `ActionCtx` enriched with `ctx.auth.config` field with\n * the config passed to `createAuth`.\n */\nexport type GenericActionCtxWithAuthConfig<DataModel extends GenericDataModel> =\n  GenericActionCtx<DataModel> & {\n    auth: GenericActionCtx<DataModel>[\"auth\"] & {\n      config: ConvexAuthMaterializedConfig;\n    } & AuthServerHelpers;\n  };\n\n/**\n * The config for the Convex Auth library, passed to `createAuth`,\n * with defaults and initialized providers.\n *\n * See {@link ConvexAuthConfig}\n */\nexport type ConvexAuthMaterializedConfig = {\n  providers: AuthProviderMaterializedConfig[];\n} & Pick<\n  ConvexAuthConfig,\n  \"component\" | \"session\" | \"jwt\" | \"signIn\" | \"callbacks\"\n>;\n\nexport interface SAMLAttributeMapping {\n  subject?: string;\n  email?: string;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n}\n\n/**\n * Materialized OAuth provider config (Arctic-based).\n *\n * Carries the Arctic provider instance along with scopes and profile config.\n * Produced by materializing an `OAuthProviderInstance` during `configDefaults`.\n */\nexport interface OAuthMaterializedConfig {\n  readonly id: string;\n  readonly type: \"oauth\";\n  /** The Arctic provider instance. */\n  readonly provider: any;\n  /** OAuth scopes to request. */\n  readonly scopes: string[];\n  /** User-provided profile extraction callback. */\n  readonly profile?: (\n    tokens: import(\"arctic\").OAuth2Tokens,\n  ) => Promise<OAuthProfile>;\n  /** Account-linking policy for OAuth identities. Defaults to verified email linking. */\n  readonly accountLinking?: \"verifiedEmail\" | \"none\";\n}\n\n/**\n * Device authorization provider config (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short code that the user enters on a secondary device.\n */\nexport interface DeviceProviderConfig {\n  id: string;\n  type: \"device\";\n  /** User code character set. Default: `\"BCDFGHJKLMNPQRSTVWXZ\"` (base-20, no vowels). */\n  charset: string;\n  /** User code length. Default: 8. */\n  userCodeLength: number;\n  /** Device code + user code lifetime in seconds. Default: 900 (15 min). */\n  expiresIn: number;\n  /** Minimum polling interval in seconds. Default: 5. */\n  interval: number;\n  /**\n   * Base URL for the verification page (e.g. `\"http://localhost:3000/device\"`).\n   *\n   * This is where users go to enter the device code. If not provided,\n   * falls back to `SITE_URL + \"/device\"`.\n   */\n  verificationUri?: string;\n}\n\n/**\n * Materialized auth provider config — the fully resolved form stored at runtime.\n */\nexport type AuthProviderMaterializedConfig =\n  | OAuthMaterializedConfig\n  | EmailConfig\n  | PhoneConfig\n  | ConvexCredentialsConfig\n  | PasskeyProviderConfig\n  | TotpProviderConfig\n  | DeviceProviderConfig\n  | SSOProviderConfig;\n\n/**\n * Resolves to `true` when the providers list includes `SSO`, otherwise `false`.\n *\n * Used to make `auth.sso` conditionally present on the `createAuth`\n * return type — it only appears when `new SSO()` is in the providers array.\n */\nexport type HasSSO<P extends AuthProviderConfig[]> =\n  import(\"../providers/sso\").SSO extends P[number] ? true : false;\n\nexport type HasPasskeyProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/passkey\").Passkey extends P[number] ? true : false;\n\nexport type HasTotpProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/totp\").Totp extends P[number] ? true : false;\n\nexport type HasDeviceProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/device\").Device extends P[number] ? true : false;\n\n// ============================================================================\n// API Key types\n// ============================================================================\n\n/**\n * A single scope entry stored per API key.\n * Uses a resource:action pattern for structured permissions.\n *\n * ```ts\n * { resource: \"users\", actions: [\"read\", \"list\"] }\n * ```\n */\nexport interface KeyScope {\n  resource: string;\n  actions: string[];\n}\n\n/**\n * Result of scope verification. Provides a `.can()` helper\n * for checking if a key has a specific permission.\n *\n * ```ts\n * const result = await auth.key.verify(ctx, rawKey);\n * if (result.scopes.can(\"users\", \"read\")) {\n *   // authorized\n * }\n * ```\n */\nexport interface ScopeChecker {\n  /** Check if the key has permission for a given resource:action. */\n  can(resource: string, action: string): boolean;\n  /** The raw scope entries from the key. */\n  scopes: KeyScope[];\n}\n\n/**\n * An API key record as returned by `auth.key.list()` and `auth.key.get()`.\n * Never includes the raw key material — only the display prefix.\n */\nexport interface KeyRecord {\n  /** Document ID. */\n  _id: string;\n  /** Owner user ID. */\n  userId: string;\n  /** Display prefix (e.g. `\"sk_abc1\"`). Safe to show in UIs. */\n  prefix: string;\n  /** Human-readable name (e.g. \"CI Pipeline\"). */\n  name: string;\n  /** Resource:action permissions granted to this key. */\n  scopes: KeyScope[];\n  /** Per-key rate limit, if configured. */\n  rateLimit?: { maxRequests: number; windowMs: number };\n  /** Expiration timestamp (ms since epoch), or `undefined` for no expiry. */\n  expiresAt?: number;\n  /** Timestamp of last successful verification, or `undefined` if never used. */\n  lastUsedAt?: number;\n  /** Creation timestamp (ms since epoch). */\n  createdAt: number;\n  /** `true` when the key has been revoked (soft-deleted). */\n  revoked: boolean;\n  /** Arbitrary app-specific metadata attached to the key. */\n  metadata?: Record<string, unknown>;\n}\n\n// ============================================================================\n// Unified List API types\n// ============================================================================\n\n/**\n * Options for paginated list queries. Every entity list method uses this\n * same shape with entity-specific `TWhere` and `TOrderBy` type parameters.\n *\n * ```ts\n * const result = await auth.group.list(ctx, {\n *   where: { type: \"team\" },\n *   limit: 20,\n *   orderBy: \"name\",\n *   order: \"asc\",\n * });\n * ```\n */\nexport type ListOptions<\n  TWhere extends Record<string, unknown>,\n  TOrderBy extends string,\n> = {\n  /** Serializable filter — only known fields for the entity. */\n  where?: TWhere;\n  /** Maximum number of items to return. Defaults to 50, max 100. */\n  limit?: number;\n  /** Opaque cursor from a previous `ListResult.nextCursor`. */\n  cursor?: string | null;\n  /** Field to sort by. Defaults to `\"_creationTime\"`. */\n  orderBy?: TOrderBy;\n  /** Sort direction. Defaults to `\"desc\"`. */\n  order?: \"asc\" | \"desc\";\n};\n\n/**\n * Paginated list result returned by every entity list method.\n */\nexport type ListResult<T> = {\n  /** The page of items. */\n  items: T[];\n  /** Opaque cursor for the next page, or `null` when exhausted. */\n  nextCursor: string | null;\n};\n\n// -- Per-entity Where / OrderBy types --\n\n/**\n * A single key/value tag for group classification.\n *\n * Tags are normalized at write time: both `key` and `value` are\n * trimmed and lowercased. Filtering is strict exact-match only.\n */\nexport type GroupTag = {\n  key: string;\n  value: string;\n};\n\n/** Filter fields for `auth.group.list()`. All optional. */\nexport type GroupWhere = {\n  slug?: string;\n  type?: string;\n  parentGroupId?: string;\n  name?: string;\n  /** When `true`, return only root groups (no parent). When `false`, only non-root. */\n  isRoot?: boolean;\n  /**\n   * Return only groups that have **all** of the specified tags.\n   * Each tag is matched exactly on normalized `(key, value)`.\n   */\n  tagsAll?: GroupTag[];\n  /**\n   * Return only groups that have **at least one** of the specified tags.\n   * Each tag is matched exactly on normalized `(key, value)`.\n   */\n  tagsAny?: GroupTag[];\n};\n\n/** Sortable fields for `auth.group.list()`. */\nexport type GroupOrderBy = \"_creationTime\" | \"name\" | \"slug\" | \"type\";\n\n/** Filter fields for `auth.member.list()`. All optional. */\nexport type MemberWhere = {\n  groupId?: string;\n  userId?: string;\n  role?: string;\n  status?: string;\n};\n\n/** Sortable fields for `auth.member.list()`. */\nexport type MemberOrderBy = \"_creationTime\" | \"role\" | \"status\";\n\n/** Filter fields for `auth.invite.list()`. All optional. */\nexport type InviteWhere = {\n  tokenHash?: string;\n  groupId?: string;\n  status?: \"pending\" | \"accepted\" | \"revoked\" | \"expired\";\n  email?: string;\n  invitedByUserId?: string;\n  role?: string;\n  acceptedByUserId?: string;\n};\n\n/** Sortable fields for `auth.invite.list()`. */\nexport type InviteOrderBy =\n  | \"_creationTime\"\n  | \"status\"\n  | \"email\"\n  | \"expiresTime\"\n  | \"acceptedTime\";\n\n/** Filter fields for `auth.key.list()`. All optional. */\nexport type KeyWhere = {\n  userId?: string;\n  revoked?: boolean;\n  name?: string;\n  prefix?: string;\n};\n\n/** Sortable fields for `auth.key.list()`. */\nexport type KeyOrderBy =\n  | \"_creationTime\"\n  | \"name\"\n  | \"lastUsedAt\"\n  | \"expiresAt\"\n  | \"revoked\";\n\n/** Filter fields for `auth.user.list()`. All optional. */\nexport type UserWhere = {\n  email?: string;\n  phone?: string;\n  isAnonymous?: boolean;\n  name?: string;\n};\n\n/** Sortable fields for `auth.user.list()`. */\nexport type UserOrderBy = \"_creationTime\" | \"name\" | \"email\" | \"phone\";\n\n// ============================================================================\n// HTTP Bearer Auth types\n// ============================================================================\n\n/**\n * Context injected into `auth.http.action()` and `auth.http.route()` handlers.\n *\n * The handler's `ctx` receives these fields after Bearer token verification:\n *\n * ```ts\n * auth.http.route(http, {\n *   path: \"/api/data\",\n *   method: \"GET\",\n *   handler: async (ctx, request) => {\n *     ctx.key.userId;               // owner of the API key\n *     ctx.key.keyId;                // the key document ID\n *     ctx.key.scopes.can(\"data\", \"read\"); // scope check\n *   },\n * });\n * ```\n */\nexport interface HttpKeyContext {\n  key: {\n    /** The user ID that owns the verified API key. */\n    userId: string;\n    /** The API key document ID. */\n    keyId: string;\n    /** Scope checker for the verified key's permissions. */\n    scopes: ScopeChecker;\n  };\n}\n\n/**\n * CORS configuration for Bearer-authenticated HTTP endpoints.\n */\nexport interface CorsConfig {\n  /** Allowed origin(s). Defaults to `\"*\"`. */\n  origin?: string;\n  /** Allowed HTTP methods. Defaults to `\"GET,POST,PUT,PATCH,DELETE,OPTIONS\"`. */\n  methods?: string;\n  /** Allowed request headers. Defaults to `\"Content-Type,Authorization\"`. */\n  headers?: string;\n}\n\n/**\n * Component function references required by core auth runtime.\n *\n * @internal Consumers should not depend on this shape — it may change\n * between minor versions. Pass `components.auth` directly to `createAuth`.\n */\nexport type AuthComponentApi = {\n  public: {\n    userGetById: FunctionReference<\"query\", \"internal\">;\n    userList: FunctionReference<\"query\", \"internal\">;\n    userFindByVerifiedEmail: FunctionReference<\"query\", \"internal\">;\n    userFindByVerifiedPhone: FunctionReference<\"query\", \"internal\">;\n    userInsert: FunctionReference<\"mutation\", \"internal\">;\n    userUpsert: FunctionReference<\"mutation\", \"internal\">;\n    userPatch: FunctionReference<\"mutation\", \"internal\">;\n    userDelete: FunctionReference<\"mutation\", \"internal\">;\n    accountGet: FunctionReference<\"query\", \"internal\">;\n    accountGetById: FunctionReference<\"query\", \"internal\">;\n    accountInsert: FunctionReference<\"mutation\", \"internal\">;\n    accountListByUser: FunctionReference<\"query\", \"internal\">;\n    accountPatch: FunctionReference<\"mutation\", \"internal\">;\n    accountDelete: FunctionReference<\"mutation\", \"internal\">;\n    sessionCreate: FunctionReference<\"mutation\", \"internal\">;\n    sessionGetById: FunctionReference<\"query\", \"internal\">;\n    sessionDelete: FunctionReference<\"mutation\", \"internal\">;\n    sessionListByUser: FunctionReference<\"query\", \"internal\">;\n    verifierCreate: FunctionReference<\"mutation\", \"internal\">;\n    verifierGetById: FunctionReference<\"query\", \"internal\">;\n    verifierGetBySignature: FunctionReference<\"query\", \"internal\">;\n    verifierPatch: FunctionReference<\"mutation\", \"internal\">;\n    verifierDelete: FunctionReference<\"mutation\", \"internal\">;\n    verificationCodeGetByAccountId: FunctionReference<\"query\", \"internal\">;\n    verificationCodeGetByCode: FunctionReference<\"query\", \"internal\">;\n    verificationCodeCreate: FunctionReference<\"mutation\", \"internal\">;\n    verificationCodeDelete: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenCreate: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetById: FunctionReference<\"query\", \"internal\">;\n    refreshTokenPatch: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetChildren: FunctionReference<\"query\", \"internal\">;\n    refreshTokenListBySession: FunctionReference<\"query\", \"internal\">;\n    refreshTokenDeleteAll: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetActive: FunctionReference<\"query\", \"internal\">;\n    rateLimitGet: FunctionReference<\"query\", \"internal\">;\n    rateLimitCreate: FunctionReference<\"mutation\", \"internal\">;\n    rateLimitPatch: FunctionReference<\"mutation\", \"internal\">;\n    rateLimitDelete: FunctionReference<\"mutation\", \"internal\">;\n    groupCreate: FunctionReference<\"mutation\", \"internal\">;\n    groupGet: FunctionReference<\"query\", \"internal\">;\n    groupList: FunctionReference<\"query\", \"internal\">;\n    groupUpdate: FunctionReference<\"mutation\", \"internal\">;\n    groupDelete: FunctionReference<\"mutation\", \"internal\">;\n    memberAdd: FunctionReference<\"mutation\", \"internal\">;\n    memberGet: FunctionReference<\"query\", \"internal\">;\n    memberList: FunctionReference<\"query\", \"internal\">;\n    memberListByUser: FunctionReference<\"query\", \"internal\">;\n    memberGetByGroupAndUser: FunctionReference<\"query\", \"internal\">;\n    memberRemove: FunctionReference<\"mutation\", \"internal\">;\n    memberUpdate: FunctionReference<\"mutation\", \"internal\">;\n    inviteCreate: FunctionReference<\"mutation\", \"internal\">;\n    inviteGet: FunctionReference<\"query\", \"internal\">;\n    inviteGetByTokenHash: FunctionReference<\"query\", \"internal\">;\n    inviteList: FunctionReference<\"query\", \"internal\">;\n    inviteAccept: FunctionReference<\"mutation\", \"internal\">;\n    inviteAcceptByToken: FunctionReference<\"mutation\", \"internal\">;\n    inviteRevoke: FunctionReference<\"mutation\", \"internal\">;\n    keyInsert: FunctionReference<\"mutation\", \"internal\">;\n    keyGetByHashedKey: FunctionReference<\"query\", \"internal\">;\n    keyGetById: FunctionReference<\"query\", \"internal\">;\n    keyList: FunctionReference<\"query\", \"internal\">;\n    keyListByUserId: FunctionReference<\"query\", \"internal\">;\n    keyPatch: FunctionReference<\"mutation\", \"internal\">;\n    keyDelete: FunctionReference<\"mutation\", \"internal\">;\n    passkeyInsert: FunctionReference<\"mutation\", \"internal\">;\n    passkeyGetByCredentialId: FunctionReference<\"query\", \"internal\">;\n    passkeyListByUserId: FunctionReference<\"query\", \"internal\">;\n    passkeyUpdateCounter: FunctionReference<\"mutation\", \"internal\">;\n    passkeyUpdateMeta: FunctionReference<\"mutation\", \"internal\">;\n    passkeyDelete: FunctionReference<\"mutation\", \"internal\">;\n    totpInsert: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpGetVerifiedByUserId: FunctionReference<\"query\", \"internal\", any, any>;\n    totpListByUserId: FunctionReference<\"query\", \"internal\", any, any>;\n    totpGetById: FunctionReference<\"query\", \"internal\", any, any>;\n    totpMarkVerified: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpUpdateLastUsed: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceInsert: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceGetByCodeHash: FunctionReference<\"query\", \"internal\", any, any>;\n    deviceGetByUserCode: FunctionReference<\"query\", \"internal\", any, any>;\n    deviceAuthorize: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceUpdateLastPolled: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseCreate: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseGet: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseGetByGroup: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseGetByDomain: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseUpdate: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDomainAdd: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDomainList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseDomainDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseScimConfigUpsert: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimConfigGetByEnterprise: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimConfigGetByTokenHash: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityGet: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseScimIdentityGetByUser: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityGetByMappedGroup: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityListByEnterprise: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityUpsert: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityDelete: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseAuditEventCreate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseAuditEventList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseWebhookEndpointCreate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookEndpointList: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookEndpointUpdate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryEnqueue: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryListReady: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryPatch: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n  };\n};\n\n// ============================================================================\n// Convex document types (merged from convex_types)\n// ============================================================================\n\n/**\n * Convex document from a given table.\n */\nexport type GenericDoc<\n  DataModel extends GenericDataModel,\n  TableName extends TableNamesInDataModel<DataModel>,\n> = DocumentByName<DataModel, TableName> & {\n  _id: GenericId<TableName>;\n  _creationTime: number;\n};\n\n/**\n * @internal\n */\nexport type FunctionReferenceFromExport<Export> =\n  Export extends RegisteredQuery<infer Visibility, infer Args, infer Output>\n    ? FunctionReference<\"query\", Visibility, Args, ConvertReturnType<Output>>\n    : Export extends RegisteredMutation<\n          infer Visibility,\n          infer Args,\n          infer Output\n        >\n      ? FunctionReference<\n          \"mutation\",\n          Visibility,\n          Args,\n          ConvertReturnType<Output>\n        >\n      : Export extends RegisteredAction<\n            infer Visibility,\n            infer Args,\n            infer Output\n          >\n        ? FunctionReference<\n            \"action\",\n            Visibility,\n            Args,\n            ConvertReturnType<Output>\n          >\n        : never;\n\ntype ConvertReturnType<T> = UndefinedToNull<Awaited<T>>;\n\ntype UndefinedToNull<T> = T extends void ? null : T;\n\n// Internal server data-model types (merged from former internalTypes.ts)\n\n/** Data model derived from the component schema. */\nexport type AuthDataModel = DataModelFromSchemaDefinition<typeof schema>;\n\n/** Action context typed to the auth component's data model. */\nexport type ActionCtx = GenericActionCtx<AuthDataModel>;\n\n/** Mutation context typed to the auth component's data model. */\nexport type MutationCtx = GenericMutationCtx<AuthDataModel>;\n\n/** Query context typed to the auth component's data model. */\nexport type QueryCtx = GenericQueryCtx<AuthDataModel>;\n\n/** A document from any table in the auth component schema. */\nexport type Doc<T extends TableNamesInDataModel<AuthDataModel>> = GenericDoc<\n  AuthDataModel,\n  T\n>;\n\n/** A pair of JWT access token and refresh token. */\nexport type Tokens = { token: string; refreshToken: string };\n\n/** Session information returned after authentication. */\nexport type SessionInfo = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n  tokens: Tokens | null;\n};\n\n/** Session information with guaranteed non-null tokens. */\nexport type SessionInfoWithTokens = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n  tokens: Tokens;\n};\n\n// ---------------------------------------------------------------------------\n// Cross-component document shapes\n// ---------------------------------------------------------------------------\n// These mirror the component schema tables. They exist so that server-side\n// code can work with typed results from cross-component queries/mutations\n// instead of casting to `any` at every field access.\n\nexport interface TotpDoc {\n  _id: string;\n  _creationTime: number;\n  userId: string;\n  secret: ArrayBuffer;\n  digits: number;\n  period: number;\n  verified: boolean;\n  name?: string;\n  createdAt: number;\n  lastUsedAt?: number;\n}\n\nexport interface PasskeyDoc {\n  _id: string;\n  _creationTime: number;\n  userId: string;\n  credentialId: string;\n  publicKey: ArrayBuffer;\n  algorithm: number;\n  counter: number;\n  transports?: string[];\n  deviceType: string;\n  backedUp: boolean;\n  name?: string;\n  createdAt: number;\n  lastUsedAt?: number;\n}\n\nexport interface VerifierDoc {\n  _id: string;\n  _creationTime: number;\n  signature?: string;\n  sessionId?: string;\n}\n\n/**\n * Plain cross-component user document shape with `string` IDs.\n *\n * Used by internal typed wrappers (`queryUserById`, etc.) that operate\n * across the component boundary where Convex `Id<\"User\">` is erased\n * to a plain string. Not intended for consumer use — consumers should\n * use `UserDoc` (exported from `@robelest/convex-auth/component`)\n * which preserves typed `Id<\"User\">`.\n *\n * @internal\n */\nexport interface CrossComponentUserDoc {\n  _id: string;\n  _creationTime: number;\n  email?: string;\n  emailVerificationTime?: number;\n  phone?: string;\n  phoneVerificationTime?: number;\n  name?: string;\n  image?: string;\n  isAnonymous?: boolean;\n}\n\nexport interface KeyDoc {\n  _id: string;\n  _creationTime: number;\n  userId: string;\n  prefix: string;\n  hashedKey: string;\n  name: string;\n  scopes: Array<{ resource: string; actions: string[] }>;\n  rateLimit?: { maxRequests: number; windowMs: number };\n  rateLimitState?: { attemptsLeft: number; lastAttemptTime: number };\n  expiresAt?: number;\n  lastUsedAt?: number;\n  createdAt: number;\n  revoked: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Cross-component wrapper context\n// ---------------------------------------------------------------------------\n// Structural type accepted by all wrappers below.  Works for both action and\n// mutation contexts — the only capabilities we need are runQuery / runMutation\n// and access to the component API via `auth.config.component`.\n\n/** @internal */\nexport type ComponentCallCtx = {\n  runQuery: GenericActionCtx<AuthDataModel>[\"runQuery\"];\n  runMutation: GenericActionCtx<AuthDataModel>[\"runMutation\"];\n  auth: { config: { component: AuthComponentApi } };\n};\n\n// ---------------------------------------------------------------------------\n// Typed wrappers for cross-component calls\n// ---------------------------------------------------------------------------\n// Each wrapper encapsulates the single `as any` cast at the component\n// boundary so that callers get full type safety on both args and return\n// values.\n\n// -- User queries --\n\nexport async function queryUserById(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<CrossComponentUserDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.userGetById, {\n    userId,\n  })) as CrossComponentUserDoc | null;\n}\n\nexport async function queryUserByVerifiedEmail(\n  ctx: ComponentCallCtx,\n  email: string,\n): Promise<CrossComponentUserDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.userFindByVerifiedEmail,\n    { email },\n  )) as CrossComponentUserDoc | null;\n}\n\n// -- Verifier queries / mutations --\n\nexport async function queryVerifierById(\n  ctx: ComponentCallCtx,\n  verifierId: string,\n): Promise<VerifierDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.verifierGetById, {\n    verifierId,\n  })) as VerifierDoc | null;\n}\n\nexport async function mutateVerifierDelete(\n  ctx: ComponentCallCtx,\n  verifierId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.verifierDelete, {\n    verifierId,\n  });\n}\n\n// -- TOTP queries / mutations --\n\nexport async function queryTotpById(\n  ctx: ComponentCallCtx,\n  totpId: string,\n): Promise<TotpDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.totpGetById, {\n    totpId,\n  })) as TotpDoc | null;\n}\n\nexport async function queryTotpVerifiedByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<TotpDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.totpGetVerifiedByUserId,\n    { userId },\n  )) as TotpDoc | null;\n}\n\nexport async function mutateTotpInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    secret: ArrayBuffer;\n    digits: number;\n    period: number;\n    verified: boolean;\n    name?: string;\n    createdAt: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.totpInsert,\n    args,\n  )) as string;\n}\n\nexport async function mutateTotpMarkVerified(\n  ctx: ComponentCallCtx,\n  totpId: string,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.totpMarkVerified, {\n    totpId,\n    lastUsedAt,\n  });\n}\n\nexport async function mutateTotpUpdateLastUsed(\n  ctx: ComponentCallCtx,\n  totpId: string,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.totpUpdateLastUsed, {\n    totpId,\n    lastUsedAt,\n  });\n}\n\n// -- Passkey queries / mutations --\n\nexport async function queryPasskeysByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<PasskeyDoc[]> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.passkeyListByUserId,\n    { userId },\n  )) as PasskeyDoc[];\n}\n\nexport async function queryPasskeyByCredentialId(\n  ctx: ComponentCallCtx,\n  credentialId: string,\n): Promise<PasskeyDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.passkeyGetByCredentialId,\n    { credentialId },\n  )) as PasskeyDoc | null;\n}\n\nexport async function mutatePasskeyInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    credentialId: string;\n    publicKey: ArrayBuffer | ArrayBufferLike;\n    algorithm: number;\n    counter: number;\n    transports?: string[];\n    deviceType: string;\n    backedUp: boolean;\n    name?: string;\n    createdAt: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.passkeyInsert,\n    args,\n  )) as string;\n}\n\nexport async function mutatePasskeyUpdateCounter(\n  ctx: ComponentCallCtx,\n  passkeyId: string,\n  counter: number,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.passkeyUpdateCounter, {\n    passkeyId,\n    counter,\n    lastUsedAt,\n  });\n}\n\n// -- Key queries / mutations --\n\nexport async function mutateKeyInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    prefix: string;\n    hashedKey: string;\n    name: string;\n    scopes: Array<{ resource: string; actions: string[] }>;\n    rateLimit?: { maxRequests: number; windowMs: number };\n    expiresAt?: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.keyInsert,\n    args,\n  )) as string;\n}\n\nexport async function queryKeysByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<KeyDoc[]> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.keyListByUserId, {\n    userId,\n  })) as KeyDoc[];\n}\n\nexport async function queryKeyById(\n  ctx: ComponentCallCtx,\n  keyId: string,\n): Promise<KeyDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.keyGetById, {\n    keyId,\n  })) as KeyDoc | null;\n}\n\nexport async function mutateKeyPatch(\n  ctx: ComponentCallCtx,\n  keyId: string,\n  data: Record<string, unknown>,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.keyPatch, {\n    keyId,\n    data,\n  });\n}\n\nexport async function mutateKeyDelete(\n  ctx: ComponentCallCtx,\n  keyId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.keyDelete, { keyId });\n}\n\n// -- Device authorization queries / mutations --\n\nexport interface DeviceDoc {\n  _id: string;\n  _creationTime: number;\n  deviceCodeHash: string;\n  userCode: string;\n  expiresAt: number;\n  interval: number;\n  status: \"pending\" | \"authorized\" | \"denied\";\n  userId?: string;\n  sessionId?: string;\n  lastPolledAt?: number;\n}\n\nexport async function mutateDeviceInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    deviceCodeHash: string;\n    userCode: string;\n    expiresAt: number;\n    interval: number;\n    status: \"pending\" | \"authorized\" | \"denied\";\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.deviceInsert,\n    args,\n  )) as string;\n}\n\nexport async function queryDeviceByCodeHash(\n  ctx: ComponentCallCtx,\n  deviceCodeHash: string,\n): Promise<DeviceDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.deviceGetByCodeHash,\n    { deviceCodeHash },\n  )) as DeviceDoc | null;\n}\n\nexport async function queryDeviceByUserCode(\n  ctx: ComponentCallCtx,\n  userCode: string,\n): Promise<DeviceDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.deviceGetByUserCode,\n    { userCode },\n  )) as DeviceDoc | null;\n}\n\nexport async function mutateDeviceAuthorize(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n  userId: string,\n  sessionId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.deviceAuthorize, {\n    deviceId,\n    userId,\n    sessionId,\n  });\n}\n\nexport async function mutateDeviceUpdateLastPolled(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n  lastPolledAt: number,\n): Promise<void> {\n  await ctx.runMutation(\n    ctx.auth.config.component.public.deviceUpdateLastPolled,\n    { deviceId, lastPolledAt },\n  );\n}\n\nexport async function mutateDeviceDelete(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.deviceDelete, {\n    deviceId,\n  });\n}\n"],"mappings":";AA+zCA,eAAsB,cACpB,KACA,QACuC;AACvC,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,aAAa,EACvE,QACD,CAAC;;AAGJ,eAAsB,yBACpB,KACA,OACuC;AACvC,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,yBACjC,EAAE,OAAO,CACV;;AAKH,eAAsB,kBACpB,KACA,YAC6B;AAC7B,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,iBAAiB,EAC3E,YACD,CAAC;;AAGJ,eAAsB,qBACpB,KACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,gBAAgB,EACrE,YACD,CAAC;;AAKJ,eAAsB,cACpB,KACA,QACyB;AACzB,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,aAAa,EACvE,QACD,CAAC;;AAGJ,eAAsB,0BACpB,KACA,QACyB;AACzB,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,yBACjC,EAAE,QAAQ,CACX;;AAGH,eAAsB,iBACpB,KACA,MASiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,YACjC,KACD;;AAGH,eAAsB,uBACpB,KACA,QACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,kBAAkB;EACvE;EACA;EACD,CAAC;;AAGJ,eAAsB,yBACpB,KACA,QACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,oBAAoB;EACzE;EACA;EACD,CAAC;;AAKJ,eAAsB,sBACpB,KACA,QACuB;AACvB,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,QAAQ,CACX;;AAGH,eAAsB,2BACpB,KACA,cAC4B;AAC5B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,0BACjC,EAAE,cAAc,CACjB;;AAGH,eAAsB,oBACpB,KACA,MAYiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,eACjC,KACD;;AAGH,eAAsB,2BACpB,KACA,WACA,SACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,sBAAsB;EAC3E;EACA;EACA;EACD,CAAC;;AAKJ,eAAsB,gBACpB,KACA,MASiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,WACjC,KACD;;AAGH,eAAsB,kBACpB,KACA,QACmB;AACnB,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,iBAAiB,EAC3E,QACD,CAAC;;AAGJ,eAAsB,aACpB,KACA,OACwB;AACxB,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,YAAY,EACtE,OACD,CAAC;;AAGJ,eAAsB,eACpB,KACA,OACA,MACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,UAAU;EAC/D;EACA;EACD,CAAC;;AAGJ,eAAsB,gBACpB,KACA,OACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,WAAW,EAAE,OAAO,CAAC;;AAkB9E,eAAsB,mBACpB,KACA,MAOiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,cACjC,KACD;;AAGH,eAAsB,sBACpB,KACA,gBAC2B;AAC3B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,gBAAgB,CACnB;;AAGH,eAAsB,sBACpB,KACA,UAC2B;AAC3B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,UAAU,CACb;;AAGH,eAAsB,sBACpB,KACA,UACA,QACA,WACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,iBAAiB;EACtE;EACA;EACA;EACD,CAAC;;AAGJ,eAAsB,6BACpB,KACA,UACA,cACe;AACf,OAAM,IAAI,YACR,IAAI,KAAK,OAAO,UAAU,OAAO,wBACjC;EAAE;EAAU;EAAc,CAC3B;;AAGH,eAAsB,mBACpB,KACA,UACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,cAAc,EACnE,UACD,CAAC"}
+{"version":3,"file":"types.js","names":[],"sources":["../../src/server/types.ts"],"sourcesContent":["import {\n  AnyDataModel,\n  DataModelFromSchemaDefinition,\n  DocumentByName,\n  FunctionReference,\n  GenericActionCtx,\n  GenericDataModel,\n  GenericMutationCtx,\n  GenericQueryCtx,\n  RegisteredAction,\n  RegisteredMutation,\n  RegisteredQuery,\n  TableNamesInDataModel,\n} from \"convex/server\";\nimport type { Infer } from \"convex/values\";\nimport { GenericId, Value } from \"convex/values\";\n\nimport {\n  vApiKeyDoc,\n  vAuthVerifierDoc,\n  vDeviceCodeDoc,\n  vPasskeyDoc,\n  vTotpFactorDoc,\n  vUserDoc,\n} from \"../component/model\";\nimport schema from \"../component/schema\";\nimport { CredentialsUserConfig } from \"../providers/credentials\";\n\n// ============================================================================\n// Utility types\n// ============================================================================\n\n/** A value that is either `T` or a `PromiseLike<T>`. */\nexport type Awaitable<T> = T | PromiseLike<T>;\n\nexport type AuthRoleDefinition = {\n  id?: string;\n  label?: string;\n  grants: string[];\n};\n\nexport type AuthAuthorizationConfig = {\n  roles: Record<string, AuthRoleDefinition>;\n};\n\nexport type AuthRoleId<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = TAuthorization extends { roles: infer TRoles extends Record<string, any> }\n  ? keyof TRoles & string\n  : string;\n\nexport type AuthGrant<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = TAuthorization extends {\n  roles: infer TRoles extends Record<string, { grants: readonly any[] }>;\n}\n  ? TRoles[keyof TRoles][\"grants\"][number] & string\n  : string;\n\n/**\n * The config for the Convex Auth library, passed to `createAuth`.\n */\nexport type ConvexAuthConfig = {\n  /**\n   * A list of authentication provider configs.\n   *\n   * You can import existing configs from\n   * `@robelest/convex-auth/providers/<provider-name>`\n   */\n  providers: AuthProviderConfig[];\n  /**\n   * Auth component reference from `components.auth`.\n   *\n   * Core auth storage operations are executed through\n   * the component API boundary.\n   */\n  component: AuthComponentApi;\n  /**\n   * Session configuration.\n   */\n  session?: {\n    /**\n     * How long can a user session last without the user reauthenticating.\n     *\n     * Defaults to 30 days.\n     */\n    totalDurationMs?: number;\n    /**\n     * How long can a user session last without the user being active.\n     *\n     * Defaults to 30 days.\n     */\n    inactiveDurationMs?: number;\n  };\n  /**\n   * JWT configuration.\n   */\n  jwt?: {\n    /**\n     * How long is the JWT valid for after it is signed initially.\n     *\n     * Defaults to 1 hour.\n     */\n    durationMs?: number;\n  };\n  /**\n   * Sign-in configuration.\n   */\n  signIn?: {\n    /**\n     * How many times can the user fail to provide the correct credentials\n     * (password, OTP) per hour.\n     *\n     * Defaults to 10 times per hour (that is 10 failed attempts, and then\n     * allow another one every 6 minutes).\n     */\n    maxFailedAttemptsPerHour?: number;\n  };\n  /**\n   * Lifecycle callbacks for customizing sign-in behavior.\n   *\n   * Use `redirect` to control post-OAuth redirect URLs, and\n   * `createOrUpdateUser` or `afterUserCreatedOrUpdated` to\n   * customize account linking and user document creation.\n   */\n  callbacks?: {\n    /**\n     * Control which URLs are allowed as a destination after OAuth sign-in\n     * and for magic links:\n     *\n     * ```ts\n     * import { createAuth } from \"@robelest/convex-auth/component\";\n     * import { components } from \"./_generated/api\";\n     *\n     * const auth = createAuth(components.auth, {\n     *   providers: [google],\n     *   callbacks: {\n     *     async redirect({ redirectTo }) {\n     *       // Check that redirectTo is valid\n     *       // and return the relative or absolute URL\n     *       // to redirect to.\n     *     },\n     *   },\n     * });\n     * ```\n     *\n     * Convex Auth performs redirect only during OAuth sign-in. By default,\n     * it redirects back to the URL specified via the `SITE_URL` environment\n     * variable. Similarly magic links link to `SITE_URL`.\n     *\n     * You can customize that behavior by providing a `redirectTo` param\n     * to the `signIn` function:\n     *\n     * ```ts\n     * signIn(\"google\", { redirectTo: \"/dashboard\" })\n     * ```\n     *\n     * You can even redirect to a different site.\n     *\n     * This callback, if specified, is then called with the provided\n     * `redirectTo` param. Otherwise, only query params, relative paths\n     * and URLs starting with `SITE_URL` are allowed.\n     */\n    redirect?: (params: {\n      /**\n       * The param value passed to the `signIn` function.\n       */\n      redirectTo: string;\n    }) => Promise<string>;\n    /**\n     * Completely control account linking via this callback.\n     *\n     * This callback is called during the sign-in process,\n     * before account creation and token generation.\n     * If specified, this callback is responsible for creating\n     * or updating the user document.\n     *\n     * For \"credentials\" providers, the callback is only called\n     * when `createAccount` is called.\n     */\n    createOrUpdateUser?: (\n      ctx: GenericMutationCtx<AnyDataModel>,\n      args: {\n        /**\n         * If this is a sign-in to an existing account,\n         * this is the existing user ID linked to that account.\n         */\n        existingUserId: GenericId<\"User\"> | null;\n        /**\n         * The provider type or \"verification\" if this callback is called\n         * after an email or phone token verification.\n         */\n        type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n        /**\n         * The provider used for the sign-in, or the provider\n         * tied to the account which is having the email or phone verified.\n         */\n        provider: AuthProviderMaterializedConfig;\n        /**\n         * - The profile returned by the OAuth provider's `profile` method.\n         * - The profile passed to `createAccount` from a ConvexCredentials\n         * config.\n         * - The email address to which an email will be sent.\n         * - The phone number to which a text will be sent.\n         */\n        profile: Record<string, unknown> & {\n          email?: string;\n          phone?: string;\n          emailVerified?: boolean;\n          phoneVerified?: boolean;\n        };\n        /**\n         * The `shouldLink` argument passed to `createAccount`.\n         */\n        shouldLink?: boolean;\n      },\n    ) => Promise<GenericId<\"User\">>;\n    /**\n     * Perform additional writes after a user is created.\n     *\n     * This callback is called during the sign-in process,\n     * after the user is created or updated,\n     * before account creation and token generation.\n     *\n     * **This callback is only called if `createOrUpdateUser`\n     * is not specified.** If `createOrUpdateUser` is specified,\n     * you can perform any additional writes in that callback.\n     *\n     * For \"credentials\" providers, the callback is only called\n     * when `createAccount` is called.\n     */\n    afterUserCreatedOrUpdated?: (\n      ctx: GenericMutationCtx<AnyDataModel>,\n      args: {\n        /**\n         * The ID of the user that is being signed in.\n         */\n        userId: GenericId<\"User\">;\n        /**\n         * If this is a sign-in to an existing account,\n         * this is the existing user ID linked to that account.\n         */\n        existingUserId: GenericId<\"User\"> | null;\n        /**\n         * The provider type or \"verification\" if this callback is called\n         * after an email or phone token verification.\n         */\n        type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n        /**\n         * The provider used for the sign-in, or the provider\n         * tied to the account which is having the email or phone verified.\n         */\n        provider: AuthProviderMaterializedConfig;\n        /**\n         * - The profile returned by the OAuth provider's `profile` method.\n         * - The profile passed to `createAccount` from a ConvexCredentials\n         * config.\n         * - The email address to which an email will be sent.\n         * - The phone number to which a text will be sent.\n         */\n        profile: Record<string, unknown> & {\n          email?: string;\n          phone?: string;\n          emailVerified?: boolean;\n          phoneVerified?: boolean;\n        };\n        /**\n         * The `shouldLink` argument passed to `createAccount`.\n         */\n        shouldLink?: boolean;\n      },\n    ) => Promise<void>;\n  };\n  /**\n   * Application-defined role and grant model used by membership access checks.\n   */\n  authorization?: {\n    roles: Record<\n      string,\n      {\n        label?: string;\n        grants: string[];\n      }\n    >;\n  };\n};\n\n/**\n * Union of all supported auth provider config types.\n *\n * Includes Arctic-based OAuth providers (via the `OAuth()` factory),\n * plus library-native providers: credentials, email, phone, passkey\n * (WebAuthn), and TOTP (2FA). Each can be passed as a config object\n * or a factory function.\n */\nexport type AuthProviderConfig =\n  | import(\"../providers/oauth\").OAuthProviderInstance\n  | import(\"../providers/password\").Password\n  | import(\"../providers/passkey\").Passkey\n  | import(\"../providers/totp\").Totp\n  | import(\"../providers/anonymous\").Anonymous\n  | import(\"../providers/device\").Device\n  | import(\"../providers/sso\").SSO\n  | import(\"../providers/email\").Email\n  | import(\"../providers/phone\").Phone\n  | OAuthMaterializedConfig\n  | ConvexCredentialsConfig\n  | ((...args: any) => ConvexCredentialsConfig)\n  | EmailConfig\n  | ((...args: any) => EmailConfig)\n  | PhoneConfig\n  | ((...args: any) => PhoneConfig)\n  | PasskeyProviderConfig\n  | ((...args: any) => PasskeyProviderConfig)\n  | TotpProviderConfig\n  | ((...args: any) => TotpProviderConfig)\n  | DeviceProviderConfig\n  | ((...args: any) => DeviceProviderConfig)\n  | SSOProviderConfig;\n\n/**\n * Minimal config stored for the SSO provider at runtime.\n * No options — enterprise configuration is entirely per-tenant runtime state.\n */\nexport interface SSOProviderConfig {\n  id: string;\n  type: \"sso\";\n}\n\nexport type EnterpriseAccountLinkingPolicy = \"verifiedEmail\" | \"none\";\n\nexport type EnterpriseScimReuseUserPolicy = \"externalId\" | \"none\";\n\nexport type EnterpriseJitProvisioningMode =\n  | \"off\"\n  | \"createUser\"\n  | \"createUserAndMembership\";\n\nexport type EnterpriseDeprovisionMode = \"soft\" | \"hard\";\n\nexport interface EnterprisePolicy {\n  version: 1;\n  identity: {\n    accountLinking: {\n      oidc: EnterpriseAccountLinkingPolicy;\n      saml: EnterpriseAccountLinkingPolicy;\n    };\n  };\n  provisioning: {\n    scimReuse: {\n      user: EnterpriseScimReuseUserPolicy;\n    };\n    jit: {\n      mode: EnterpriseJitProvisioningMode;\n      defaultRoleIds: string[];\n    };\n    deprovision: {\n      mode: EnterpriseDeprovisionMode;\n    };\n  };\n  extend?: Record<string, unknown>;\n}\n\nexport interface EnterprisePolicyPatch {\n  identity?: {\n    accountLinking?: {\n      oidc?: EnterpriseAccountLinkingPolicy;\n      saml?: EnterpriseAccountLinkingPolicy;\n    };\n  };\n  provisioning?: {\n    scimReuse?: {\n      user?: EnterpriseScimReuseUserPolicy;\n    };\n    jit?: {\n      mode?: EnterpriseJitProvisioningMode;\n      defaultRoleIds?: string[];\n    };\n    deprovision?: {\n      mode?: EnterpriseDeprovisionMode;\n    };\n  };\n  extend?: Record<string, unknown>;\n}\n\n/**\n * Email provider config for magic link / OTP sign-in.\n */\nexport interface EmailConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  /** Provider identifier (e.g. `\"email\"`, `\"resend\"`). */\n  id: string;\n  /** Discriminant for provider type routing. */\n  type: \"email\";\n  /** Display name for this provider. */\n  name?: string;\n  /** Sender address (e.g. `\"My App <noreply@example.com>\"`). */\n  from?: string;\n  /** Token expiration in seconds. Defaults to 86 400 (24 hours). */\n  maxAge?: number;\n  /**\n   * Send the verification token to the user.\n   *\n   * Accepts an optional Convex action context as the second argument,\n   * enabling use with Convex components like `@convex-dev/resend`.\n   */\n  sendVerificationRequest: (\n    params: {\n      identifier: string;\n      url: string;\n      expires: Date;\n      provider: EmailConfig;\n      token: string;\n      request: Request;\n    },\n    ctx?: GenericActionCtx<AnyDataModel>,\n  ) => Awaitable<void>;\n  /**\n   * Override to generate a custom verification token.\n   * Tokens shorter than 24 characters are treated as OTPs and\n   * require the original email to be re-submitted for verification.\n   */\n  generateVerificationToken?: () => Awaitable<string>;\n  /**\n   * Normalize the email address before storage / lookup.\n   * Defaults to lowercasing and trimming whitespace.\n   */\n  normalizeIdentifier?: (identifier: string) => string;\n  /**\n   * Before the token is verified, check other\n   * provided parameters.\n   *\n   * Used to make sure that OTPs are accompanied\n   * with the correct email address.\n   */\n  authorize?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    account: GenericDoc<DataModel, \"Account\">,\n  ) => Promise<void>;\n  /** Raw user options before merging with defaults. */\n  options: EmailUserConfig<DataModel>;\n}\n\n/**\n * Configurable options for an email provider config.\n */\nexport type EmailUserConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> = Omit<Partial<EmailConfig<DataModel>>, \"options\" | \"type\">;\n\n/**\n * Same as email provider config, but verifies\n * phone number instead of the email address.\n */\nexport interface PhoneConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  id: string;\n  type: \"phone\";\n  /**\n   * Token expiration in seconds.\n   */\n  maxAge: number;\n  /**\n   * Send the phone number verification request.\n   */\n  sendVerificationRequest: (\n    params: {\n      identifier: string;\n      url: string;\n      expires: Date;\n      provider: PhoneConfig;\n      token: string;\n    },\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => Promise<void>;\n  /**\n   * Defaults to `process.env.AUTH_<PROVIDER_ID>_KEY`.\n   */\n  apiKey?: string;\n  /**\n   * Override this to generate a custom token.\n   * Note that the tokens are assumed to be cryptographically secure.\n   * Any tokens shorter than 24 characters are assumed to not\n   * be secure enough on their own, and require providing\n   * the original `phone` used in the initial `signIn` call.\n   * @returns\n   */\n  generateVerificationToken?: () => Promise<string>;\n  /**\n   * Normalize the phone number.\n   * @param identifier Passed as `phone` in params of `signIn`.\n   * @returns The phone number used in `sendVerificationRequest`.\n   */\n  normalizeIdentifier?: (identifier: string) => string;\n  /**\n   * Before the token is verified, check other\n   * provided parameters.\n   *\n   * Used to make sure tha OTPs are accompanied\n   * with the correct phone number.\n   */\n  authorize?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    account: GenericDoc<DataModel, \"Account\">,\n  ) => Promise<void>;\n  options: PhoneUserConfig<DataModel>;\n}\n\n/**\n * Configurable options for a phone provider config.\n */\nexport type PhoneUserConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> = Omit<Partial<PhoneConfig<DataModel>>, \"options\" | \"type\">;\n\n/**\n * Credentials provider config used by Convex Auth.\n */\nexport type ConvexCredentialsConfig = CredentialsUserConfig<any> & {\n  type: \"credentials\";\n  id: string;\n};\n\n/**\n * Configuration for the passkey (WebAuthn) provider.\n */\nexport interface PasskeyProviderConfig {\n  id: string;\n  type: \"passkey\";\n  options: {\n    /** Relying Party display name. Defaults to SITE_URL hostname. */\n    rpName?: string;\n    /** Relying Party ID (hostname). Defaults to SITE_URL hostname. */\n    rpId?: string;\n    /** Allowed origins for credential verification. Defaults to SITE_URL. */\n    origin?: string | string[];\n    /** Attestation conveyance preference. Defaults to \"none\". */\n    attestation?: \"none\" | \"direct\";\n    /** User verification requirement. Defaults to \"required\". */\n    userVerification?: \"required\" | \"preferred\" | \"discouraged\";\n    /** Resident key (discoverable credential) preference. Defaults to \"preferred\". */\n    residentKey?: \"required\" | \"preferred\" | \"discouraged\";\n    /** Restrict to platform or cross-platform authenticators. */\n    authenticatorAttachment?: \"platform\" | \"cross-platform\";\n    /** Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)]. */\n    algorithms?: number[];\n    /** Challenge expiration in ms. Defaults to 300_000 (5 minutes). */\n    challengeExpirationMs?: number;\n  };\n}\n\n/**\n * Configuration for the TOTP two-factor authentication provider.\n */\nexport interface TotpProviderConfig {\n  id: string;\n  type: \"totp\";\n  options: {\n    /** Issuer name shown in authenticator apps (e.g. \"My App\"). */\n    issuer: string;\n    /** Number of digits in each code (default: 6). */\n    digits: number;\n    /** Time period in seconds for code rotation (default: 30). */\n    period: number;\n  };\n}\n\n// ============================================================================\n// OAuth types (Arctic-based)\n// ============================================================================\n\n/**\n * Normalized user profile returned by an OAuth provider.\n *\n * `id` is the provider-specific account identifier (e.g. GitHub user ID).\n */\nexport interface OAuthProfile {\n  id: string;\n  name?: string;\n  email?: string;\n  image?: string;\n  /** Additional claims from the ID token or userinfo endpoint. */\n  [key: string]: unknown;\n}\n\n/**\n * Internal config shape for an OAuth provider after normalization.\n *\n * This is what the OAuth flow code receives — it maps to the user-facing\n * `OAuthConfig` from `@robelest/convex-auth/providers`.\n *\n * @internal\n */\nexport interface OAuthProviderConfig {\n  /** OAuth scopes to request. */\n  scopes?: string[];\n  /** User-provided profile extraction callback. */\n  profile?: (tokens: import(\"arctic\").OAuth2Tokens) => Promise<OAuthProfile>;\n}\n\n/** Credentials identifying a provider account (e.g. email + hashed password). */\nexport type AuthAccountCredentials = {\n  /** Provider-specific account identifier (e.g. email address). */\n  id: string;\n  /** Optional secret (e.g. hashed password). */\n  secret?: string;\n};\n\n/** Arguments for `auth.account.create()`. */\nexport type AuthCreateAccountArgs = {\n  provider: string;\n  account: AuthAccountCredentials;\n  profile: Record<string, unknown> & {\n    email?: string;\n    phone?: string;\n    emailVerified?: boolean;\n    phoneVerified?: boolean;\n  };\n  shouldLinkViaEmail?: boolean;\n  shouldLinkViaPhone?: boolean;\n};\n\n/** Arguments for `auth.account.get()`. */\nexport type AuthRetrieveAccountArgs = {\n  provider: string;\n  account: AuthAccountCredentials;\n};\n\n/** Arguments for `auth.account.update()`. */\nexport type AuthUpdateAccountArgs = {\n  provider: string;\n  account: {\n    id: string;\n    secret: string;\n  };\n};\n\n/** Arguments for `auth.session.invalidate()`. */\nexport type AuthInvalidateSessionsArgs = {\n  userId: GenericId<\"User\">;\n  except?: GenericId<\"Session\">[];\n};\n\n/** Arguments for `auth.provider.signIn()`. */\nexport type AuthProviderSignInArgs = {\n  accountId?: GenericId<\"Account\">;\n  params?: Record<string, Value | undefined>;\n};\n\n/** Return type of `auth.provider.signIn()` — user and session IDs, or `null` on failure. */\nexport type AuthProviderSignInResult = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n} | null;\n\n/** Server-side auth helpers available on enriched action contexts. */\nexport type AuthServerHelpers = {\n  account: {\n    create: (\n      ctx: GenericActionCtx<any>,\n      args: AuthCreateAccountArgs,\n    ) => Promise<{\n      ok: true;\n      account: GenericDoc<GenericDataModel, \"Account\">;\n      user: GenericDoc<GenericDataModel, \"User\">;\n    }>;\n    get: (\n      ctx: GenericActionCtx<any>,\n      args: AuthRetrieveAccountArgs,\n    ) => Promise<{\n      account: GenericDoc<GenericDataModel, \"Account\">;\n      user: GenericDoc<GenericDataModel, \"User\">;\n    }>;\n    update: (\n      ctx: GenericActionCtx<any>,\n      args: AuthUpdateAccountArgs,\n    ) => Promise<{ ok: true; accountId: GenericId<\"Account\"> }>;\n  };\n  session: {\n    current: (ctx: {\n      auth: GenericActionCtx<GenericDataModel>[\"auth\"];\n    }) => Promise<GenericId<\"Session\"> | null>;\n    invalidate: (\n      ctx: GenericActionCtx<any>,\n      args: AuthInvalidateSessionsArgs,\n    ) => Promise<{\n      ok: true;\n      userId: GenericId<\"User\">;\n      except: GenericId<\"Session\">[];\n    }>;\n  };\n  access: {\n    check: (\n      ctx: GenericActionCtx<any>,\n      args: {\n        userId: GenericId<\"User\">;\n        groupId: GenericId<\"Group\">;\n        grants: string[];\n        maxDepth?: number;\n      },\n    ) => Promise<{\n      ok: boolean;\n      grants: string[];\n      missingGrants: string[];\n      roleIds: string[];\n      matchedGroupId: GenericId<\"Group\"> | null;\n      membership: GenericDoc<GenericDataModel, \"GroupMember\"> | null;\n      isDirect: boolean;\n      isInherited: boolean;\n      depth: number | null;\n    }>;\n  };\n  provider: {\n    signIn: (\n      ctx: GenericActionCtx<any>,\n      provider: AuthProviderConfig,\n      args: AuthProviderSignInArgs,\n    ) => Promise<AuthProviderSignInResult>;\n  };\n};\n\n/**\n * Your `ActionCtx` enriched with `ctx.auth.config` field with\n * the config passed to `createAuth`.\n */\nexport type GenericActionCtxWithAuthConfig<DataModel extends GenericDataModel> =\n  GenericActionCtx<DataModel> & {\n    auth: GenericActionCtx<DataModel>[\"auth\"] & {\n      config: ConvexAuthMaterializedConfig;\n    } & AuthServerHelpers;\n  };\n\n/**\n * The config for the Convex Auth library, passed to `createAuth`,\n * with defaults and initialized providers.\n *\n * See {@link ConvexAuthConfig}\n */\nexport type ConvexAuthMaterializedConfig = {\n  providers: AuthProviderMaterializedConfig[];\n} & Pick<\n  ConvexAuthConfig,\n  \"component\" | \"session\" | \"jwt\" | \"signIn\" | \"callbacks\" | \"authorization\"\n>;\n\nexport interface SAMLAttributeMapping {\n  subject?: string;\n  email?: string;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n}\n\n/**\n * Materialized OAuth provider config (Arctic-based).\n *\n * Carries the Arctic provider instance along with scopes and profile config.\n * Produced by materializing an `OAuthProviderInstance` during `configDefaults`.\n */\nexport interface OAuthMaterializedConfig {\n  readonly id: string;\n  readonly type: \"oauth\";\n  /** The Arctic provider instance. */\n  readonly provider: any;\n  /** OAuth scopes to request. */\n  readonly scopes: string[];\n  /** User-provided profile extraction callback. */\n  readonly profile?: (\n    tokens: import(\"arctic\").OAuth2Tokens,\n  ) => Promise<OAuthProfile>;\n  /** Account-linking policy for OAuth identities. Defaults to verified email linking. */\n  readonly accountLinking?: \"verifiedEmail\" | \"none\";\n}\n\n/**\n * Device authorization provider config (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short code that the user enters on a secondary device.\n */\nexport interface DeviceProviderConfig {\n  id: string;\n  type: \"device\";\n  /** User code character set. Default: `\"BCDFGHJKLMNPQRSTVWXZ\"` (base-20, no vowels). */\n  charset: string;\n  /** User code length. Default: 8. */\n  userCodeLength: number;\n  /** Device code + user code lifetime in seconds. Default: 900 (15 min). */\n  expiresIn: number;\n  /** Minimum polling interval in seconds. Default: 5. */\n  interval: number;\n  /**\n   * Base URL for the verification page (e.g. `\"http://localhost:3000/device\"`).\n   *\n   * This is where users go to enter the device code. If not provided,\n   * falls back to `SITE_URL + \"/device\"`.\n   */\n  verificationUri?: string;\n}\n\n/**\n * Materialized auth provider config — the fully resolved form stored at runtime.\n */\nexport type AuthProviderMaterializedConfig =\n  | OAuthMaterializedConfig\n  | EmailConfig\n  | PhoneConfig\n  | ConvexCredentialsConfig\n  | PasskeyProviderConfig\n  | TotpProviderConfig\n  | DeviceProviderConfig\n  | SSOProviderConfig;\n\n/**\n * Resolves to `true` when the providers list includes `SSO`, otherwise `false`.\n *\n * Used to make `auth.sso` conditionally present on the `createAuth`\n * return type — it only appears when `new SSO()` is in the providers array.\n */\nexport type HasSSO<P extends AuthProviderConfig[]> =\n  import(\"../providers/sso\").SSO extends P[number] ? true : false;\n\nexport type HasPasskeyProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/passkey\").Passkey extends P[number] ? true : false;\n\nexport type HasTotpProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/totp\").Totp extends P[number] ? true : false;\n\nexport type HasDeviceProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/device\").Device extends P[number] ? true : false;\n\n// ============================================================================\n// API Key types\n// ============================================================================\n\n/**\n * A single scope entry stored per API key.\n * Uses a resource:action pattern for structured permissions.\n *\n * ```ts\n * { resource: \"users\", actions: [\"read\", \"list\"] }\n * ```\n */\nexport interface KeyScope {\n  resource: string;\n  actions: string[];\n}\n\n/**\n * Result of scope verification. Provides a `.can()` helper\n * for checking if a key has a specific permission.\n *\n * ```ts\n * const result = await auth.key.verify(ctx, rawKey);\n * if (result.scopes.can(\"users\", \"read\")) {\n *   // authorized\n * }\n * ```\n */\nexport interface ScopeChecker {\n  /** Check if the key has permission for a given resource:action. */\n  can(resource: string, action: string): boolean;\n  /** The raw scope entries from the key. */\n  scopes: KeyScope[];\n}\n\n/**\n * An API key record as returned by `auth.key.list()` and `auth.key.get()`.\n * Never includes the raw key material — only the display prefix.\n */\nexport interface KeyRecord {\n  /** Document ID. */\n  _id: string;\n  /** Owner user ID. */\n  userId: string;\n  /** Display prefix (e.g. `\"sk_abc1\"`). Safe to show in UIs. */\n  prefix: string;\n  /** Human-readable name (e.g. \"CI Pipeline\"). */\n  name: string;\n  /** Resource:action permissions granted to this key. */\n  scopes: KeyScope[];\n  /** Per-key rate limit, if configured. */\n  rateLimit?: { maxRequests: number; windowMs: number };\n  /** Expiration timestamp (ms since epoch), or `undefined` for no expiry. */\n  expiresAt?: number;\n  /** Timestamp of last successful verification, or `undefined` if never used. */\n  lastUsedAt?: number;\n  /** Creation timestamp (ms since epoch). */\n  createdAt: number;\n  /** `true` when the key has been revoked (soft-deleted). */\n  revoked: boolean;\n  /** Arbitrary app-specific metadata attached to the key. */\n  metadata?: Record<string, unknown>;\n}\n\n// ============================================================================\n// Unified List API types\n// ============================================================================\n\n/**\n * Options for paginated list queries. Every entity list method uses this\n * same shape with entity-specific `TWhere` and `TOrderBy` type parameters.\n *\n * ```ts\n * const result = await auth.group.list(ctx, {\n *   where: { type: \"team\" },\n *   limit: 20,\n *   orderBy: \"name\",\n *   order: \"asc\",\n * });\n * ```\n */\nexport type ListOptions<\n  TWhere extends Record<string, unknown>,\n  TOrderBy extends string,\n> = {\n  /** Serializable filter — only known fields for the entity. */\n  where?: TWhere;\n  /** Maximum number of items to return. Defaults to 50, max 100. */\n  limit?: number;\n  /** Opaque cursor from a previous `ListResult.nextCursor`. */\n  cursor?: string | null;\n  /** Field to sort by. Defaults to `\"_creationTime\"`. */\n  orderBy?: TOrderBy;\n  /** Sort direction. Defaults to `\"desc\"`. */\n  order?: \"asc\" | \"desc\";\n};\n\n/**\n * Paginated list result returned by every entity list method.\n */\nexport type ListResult<T> = {\n  /** The page of items. */\n  items: T[];\n  /** Opaque cursor for the next page, or `null` when exhausted. */\n  nextCursor: string | null;\n};\n\n// -- Per-entity Where / OrderBy types --\n\n/**\n * A single key/value tag for group classification.\n *\n * Tags are normalized at write time: both `key` and `value` are\n * trimmed and lowercased. Filtering is strict exact-match only.\n */\nexport type GroupTag = {\n  key: string;\n  value: string;\n};\n\n/** Filter fields for `auth.group.list()`. All optional. */\nexport type GroupWhere = {\n  slug?: string;\n  type?: string;\n  parentGroupId?: string;\n  name?: string;\n  /** When `true`, return only root groups (no parent). When `false`, only non-root. */\n  isRoot?: boolean;\n  /**\n   * Return only groups that have **all** of the specified tags.\n   * Each tag is matched exactly on normalized `(key, value)`.\n   */\n  tagsAll?: GroupTag[];\n  /**\n   * Return only groups that have **at least one** of the specified tags.\n   * Each tag is matched exactly on normalized `(key, value)`.\n   */\n  tagsAny?: GroupTag[];\n};\n\n/** Sortable fields for `auth.group.list()`. */\nexport type GroupOrderBy = \"_creationTime\" | \"name\" | \"slug\" | \"type\";\n\n/** Filter fields for `auth.member.list()`. All optional. */\nexport type MemberWhere = {\n  groupId?: string;\n  userId?: string;\n  roleId?: string;\n  status?: string;\n};\n\n/** Sortable fields for `auth.member.list()`. */\nexport type MemberOrderBy = \"_creationTime\" | \"status\";\n\n/** Filter fields for `auth.invite.list()`. All optional. */\nexport type InviteWhere = {\n  tokenHash?: string;\n  groupId?: string;\n  status?: \"pending\" | \"accepted\" | \"revoked\" | \"expired\";\n  email?: string;\n  invitedByUserId?: string;\n  roleId?: string;\n  acceptedByUserId?: string;\n};\n\n/** Sortable fields for `auth.invite.list()`. */\nexport type InviteOrderBy =\n  | \"_creationTime\"\n  | \"status\"\n  | \"email\"\n  | \"expiresTime\"\n  | \"acceptedTime\";\n\n/** Filter fields for `auth.key.list()`. All optional. */\nexport type KeyWhere = {\n  userId?: string;\n  revoked?: boolean;\n  name?: string;\n  prefix?: string;\n};\n\n/** Sortable fields for `auth.key.list()`. */\nexport type KeyOrderBy =\n  | \"_creationTime\"\n  | \"name\"\n  | \"lastUsedAt\"\n  | \"expiresAt\"\n  | \"revoked\";\n\n/** Filter fields for `auth.user.list()`. All optional. */\nexport type UserWhere = {\n  email?: string;\n  phone?: string;\n  isAnonymous?: boolean;\n  name?: string;\n};\n\n/** Sortable fields for `auth.user.list()`. */\nexport type UserOrderBy = \"_creationTime\" | \"name\" | \"email\" | \"phone\";\n\n// ============================================================================\n// HTTP Bearer Auth types\n// ============================================================================\n\n/**\n * Context injected into `auth.http.action()` and `auth.http.route()` handlers.\n *\n * The handler's `ctx` receives these fields after Bearer token verification:\n *\n * ```ts\n * auth.http.route(http, {\n *   path: \"/api/data\",\n *   method: \"GET\",\n *   handler: async (ctx, request) => {\n *     ctx.key.userId;               // owner of the API key\n *     ctx.key.keyId;                // the key document ID\n *     ctx.key.scopes.can(\"data\", \"read\"); // scope check\n *   },\n * });\n * ```\n */\nexport interface HttpKeyContext {\n  key: {\n    /** The user ID that owns the verified API key. */\n    userId: string;\n    /** The API key document ID. */\n    keyId: string;\n    /** Scope checker for the verified key's permissions. */\n    scopes: ScopeChecker;\n  };\n}\n\n/**\n * CORS configuration for Bearer-authenticated HTTP endpoints.\n */\nexport interface CorsConfig {\n  /** Allowed origin(s). Defaults to `\"*\"`. */\n  origin?: string;\n  /** Allowed HTTP methods. Defaults to `\"GET,POST,PUT,PATCH,DELETE,OPTIONS\"`. */\n  methods?: string;\n  /** Allowed request headers. Defaults to `\"Content-Type,Authorization\"`. */\n  headers?: string;\n}\n\n/**\n * Component function references required by core auth runtime.\n *\n * @internal Consumers should not depend on this shape — it may change\n * between minor versions. Pass `components.auth` directly to `createAuth`.\n */\nexport type AuthComponentApi = {\n  public: {\n    userGetById: FunctionReference<\"query\", \"internal\">;\n    userList: FunctionReference<\"query\", \"internal\">;\n    userFindByVerifiedEmail: FunctionReference<\"query\", \"internal\">;\n    userFindByVerifiedPhone: FunctionReference<\"query\", \"internal\">;\n    userInsert: FunctionReference<\"mutation\", \"internal\">;\n    userUpsert: FunctionReference<\"mutation\", \"internal\">;\n    userPatch: FunctionReference<\"mutation\", \"internal\">;\n    userDelete: FunctionReference<\"mutation\", \"internal\">;\n    accountGet: FunctionReference<\"query\", \"internal\">;\n    accountGetById: FunctionReference<\"query\", \"internal\">;\n    accountInsert: FunctionReference<\"mutation\", \"internal\">;\n    accountListByUser: FunctionReference<\"query\", \"internal\">;\n    accountPatch: FunctionReference<\"mutation\", \"internal\">;\n    accountDelete: FunctionReference<\"mutation\", \"internal\">;\n    sessionCreate: FunctionReference<\"mutation\", \"internal\">;\n    sessionGetById: FunctionReference<\"query\", \"internal\">;\n    sessionDelete: FunctionReference<\"mutation\", \"internal\">;\n    sessionListByUser: FunctionReference<\"query\", \"internal\">;\n    verifierCreate: FunctionReference<\"mutation\", \"internal\">;\n    verifierGetById: FunctionReference<\"query\", \"internal\">;\n    verifierGetBySignature: FunctionReference<\"query\", \"internal\">;\n    verifierPatch: FunctionReference<\"mutation\", \"internal\">;\n    verifierDelete: FunctionReference<\"mutation\", \"internal\">;\n    verificationCodeGetByAccountId: FunctionReference<\"query\", \"internal\">;\n    verificationCodeGetByCode: FunctionReference<\"query\", \"internal\">;\n    verificationCodeCreate: FunctionReference<\"mutation\", \"internal\">;\n    verificationCodeDelete: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenCreate: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetById: FunctionReference<\"query\", \"internal\">;\n    refreshTokenPatch: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetChildren: FunctionReference<\"query\", \"internal\">;\n    refreshTokenListBySession: FunctionReference<\"query\", \"internal\">;\n    refreshTokenDeleteAll: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetActive: FunctionReference<\"query\", \"internal\">;\n    rateLimitGet: FunctionReference<\"query\", \"internal\">;\n    rateLimitCreate: FunctionReference<\"mutation\", \"internal\">;\n    rateLimitPatch: FunctionReference<\"mutation\", \"internal\">;\n    rateLimitDelete: FunctionReference<\"mutation\", \"internal\">;\n    groupCreate: FunctionReference<\"mutation\", \"internal\">;\n    groupGet: FunctionReference<\"query\", \"internal\">;\n    groupList: FunctionReference<\"query\", \"internal\">;\n    groupUpdate: FunctionReference<\"mutation\", \"internal\">;\n    groupDelete: FunctionReference<\"mutation\", \"internal\">;\n    memberAdd: FunctionReference<\"mutation\", \"internal\">;\n    memberGet: FunctionReference<\"query\", \"internal\">;\n    memberList: FunctionReference<\"query\", \"internal\">;\n    memberListByUser: FunctionReference<\"query\", \"internal\">;\n    memberGetByGroupAndUser: FunctionReference<\"query\", \"internal\">;\n    memberRemove: FunctionReference<\"mutation\", \"internal\">;\n    memberUpdate: FunctionReference<\"mutation\", \"internal\">;\n    inviteCreate: FunctionReference<\"mutation\", \"internal\">;\n    inviteGet: FunctionReference<\"query\", \"internal\">;\n    inviteGetByTokenHash: FunctionReference<\"query\", \"internal\">;\n    inviteList: FunctionReference<\"query\", \"internal\">;\n    inviteAccept: FunctionReference<\"mutation\", \"internal\">;\n    inviteAcceptByToken: FunctionReference<\"mutation\", \"internal\">;\n    inviteRevoke: FunctionReference<\"mutation\", \"internal\">;\n    keyInsert: FunctionReference<\"mutation\", \"internal\">;\n    keyGetByHashedKey: FunctionReference<\"query\", \"internal\">;\n    keyGetById: FunctionReference<\"query\", \"internal\">;\n    keyList: FunctionReference<\"query\", \"internal\">;\n    keyListByUserId: FunctionReference<\"query\", \"internal\">;\n    keyPatch: FunctionReference<\"mutation\", \"internal\">;\n    keyDelete: FunctionReference<\"mutation\", \"internal\">;\n    passkeyInsert: FunctionReference<\"mutation\", \"internal\">;\n    passkeyGetByCredentialId: FunctionReference<\"query\", \"internal\">;\n    passkeyListByUserId: FunctionReference<\"query\", \"internal\">;\n    passkeyUpdateCounter: FunctionReference<\"mutation\", \"internal\">;\n    passkeyUpdateMeta: FunctionReference<\"mutation\", \"internal\">;\n    passkeyDelete: FunctionReference<\"mutation\", \"internal\">;\n    totpInsert: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpGetVerifiedByUserId: FunctionReference<\"query\", \"internal\", any, any>;\n    totpListByUserId: FunctionReference<\"query\", \"internal\", any, any>;\n    totpGetById: FunctionReference<\"query\", \"internal\", any, any>;\n    totpMarkVerified: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpUpdateLastUsed: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceInsert: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceGetByCodeHash: FunctionReference<\"query\", \"internal\", any, any>;\n    deviceGetByUserCode: FunctionReference<\"query\", \"internal\", any, any>;\n    deviceAuthorize: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceUpdateLastPolled: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseCreate: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseGet: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseGetByGroup: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseGetByDomain: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseUpdate: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDomainAdd: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDomainList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseDomainDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDomainVerificationGet: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseDomainVerificationUpsert: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseDomainVerificationDelete: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseDomainVerify: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseSecretUpsert: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseSecretGet: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseSecretDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseScimConfigUpsert: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimConfigGetByEnterprise: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimConfigGetByTokenHash: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityGet: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseScimIdentityGetByUser: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityGetByEnterpriseAndUser: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityGetByMappedGroup: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityListByEnterprise: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityUpsert: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityDelete: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseAuditEventCreate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseAuditEventList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseWebhookEndpointCreate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookEndpointList: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookEndpointGet: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookEndpointUpdate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryEnqueue: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryListReady: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryPatch: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n  };\n};\n\n// ============================================================================\n// Convex document types (merged from convex_types)\n// ============================================================================\n\n/**\n * Convex document from a given table.\n */\nexport type GenericDoc<\n  DataModel extends GenericDataModel,\n  TableName extends TableNamesInDataModel<DataModel>,\n> = DocumentByName<DataModel, TableName> & {\n  _id: GenericId<TableName>;\n  _creationTime: number;\n};\n\n/**\n * @internal\n */\nexport type FunctionReferenceFromExport<Export> =\n  Export extends RegisteredQuery<infer Visibility, infer Args, infer Output>\n    ? FunctionReference<\"query\", Visibility, Args, ConvertReturnType<Output>>\n    : Export extends RegisteredMutation<\n          infer Visibility,\n          infer Args,\n          infer Output\n        >\n      ? FunctionReference<\n          \"mutation\",\n          Visibility,\n          Args,\n          ConvertReturnType<Output>\n        >\n      : Export extends RegisteredAction<\n            infer Visibility,\n            infer Args,\n            infer Output\n          >\n        ? FunctionReference<\n            \"action\",\n            Visibility,\n            Args,\n            ConvertReturnType<Output>\n          >\n        : never;\n\ntype ConvertReturnType<T> = UndefinedToNull<Awaited<T>>;\n\ntype UndefinedToNull<T> = T extends void ? null : T;\n\n// Internal server data-model types (merged from former internalTypes.ts)\n\n/** Data model derived from the component schema. */\nexport type AuthDataModel = DataModelFromSchemaDefinition<typeof schema>;\n\n/** Action context typed to the auth component's data model. */\nexport type ActionCtx = GenericActionCtx<AuthDataModel>;\n\n/** Mutation context typed to the auth component's data model. */\nexport type MutationCtx = GenericMutationCtx<AuthDataModel>;\n\n/** Query context typed to the auth component's data model. */\nexport type QueryCtx = GenericQueryCtx<AuthDataModel>;\n\n/** A document from any table in the auth component schema. */\nexport type Doc<T extends TableNamesInDataModel<AuthDataModel>> = GenericDoc<\n  AuthDataModel,\n  T\n>;\n\n/** A pair of JWT access token and refresh token. */\nexport type Tokens = { token: string; refreshToken: string };\n\n/** Session information returned after authentication. */\nexport type SessionInfo = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n  tokens: Tokens | null;\n};\n\n/** Session information with guaranteed non-null tokens. */\nexport type SessionInfoWithTokens = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n  tokens: Tokens;\n};\n\n// ---------------------------------------------------------------------------\n// Cross-component document shapes\n// ---------------------------------------------------------------------------\n// These mirror the component schema tables. They exist so that server-side\n// code can work with typed results from cross-component queries/mutations\n// instead of casting to `any` at every field access.\n\nexport type TotpDoc = Infer<typeof vTotpFactorDoc>;\n\nexport type PasskeyDoc = Infer<typeof vPasskeyDoc>;\n\nexport type VerifierDoc = Infer<typeof vAuthVerifierDoc>;\n\n/**\n * Cross-component user document shape inferred from the component validator.\n *\n * Used by internal typed wrappers (`queryUserById`, etc.) so server code stays\n * aligned with the component runtime contract. Not intended for consumer use —\n * consumers should use `UserDoc` (exported from\n * `@robelest/convex-auth/component`).\n *\n * @internal\n */\nexport type CrossComponentUserDoc = Infer<typeof vUserDoc>;\n\nexport type KeyDoc = Infer<typeof vApiKeyDoc>;\n\n// ---------------------------------------------------------------------------\n// Cross-component wrapper context\n// ---------------------------------------------------------------------------\n// Structural type accepted by all wrappers below.  Works for both action and\n// mutation contexts — the only capabilities we need are runQuery / runMutation\n// and access to the component API via `auth.config.component`.\n\n/** @internal */\nexport type ComponentCallCtx = {\n  runQuery: GenericActionCtx<AuthDataModel>[\"runQuery\"];\n  runMutation: GenericActionCtx<AuthDataModel>[\"runMutation\"];\n  auth: { config: { component: AuthComponentApi } };\n};\n\n// ---------------------------------------------------------------------------\n// Typed wrappers for cross-component calls\n// ---------------------------------------------------------------------------\n// Each wrapper encapsulates the single `as any` cast at the component\n// boundary so that callers get full type safety on both args and return\n// values.\n\n// -- User queries --\n\nexport async function queryUserById(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<CrossComponentUserDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.userGetById, {\n    userId,\n  })) as CrossComponentUserDoc | null;\n}\n\nexport async function queryUserByVerifiedEmail(\n  ctx: ComponentCallCtx,\n  email: string,\n): Promise<CrossComponentUserDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.userFindByVerifiedEmail,\n    { email },\n  )) as CrossComponentUserDoc | null;\n}\n\n// -- Verifier queries / mutations --\n\nexport async function queryVerifierById(\n  ctx: ComponentCallCtx,\n  verifierId: string,\n): Promise<VerifierDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.verifierGetById, {\n    verifierId,\n  })) as VerifierDoc | null;\n}\n\nexport async function mutateVerifierDelete(\n  ctx: ComponentCallCtx,\n  verifierId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.verifierDelete, {\n    verifierId,\n  });\n}\n\n// -- TOTP queries / mutations --\n\nexport async function queryTotpById(\n  ctx: ComponentCallCtx,\n  totpId: string,\n): Promise<TotpDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.totpGetById, {\n    totpId,\n  })) as TotpDoc | null;\n}\n\nexport async function queryTotpVerifiedByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<TotpDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.totpGetVerifiedByUserId,\n    { userId },\n  )) as TotpDoc | null;\n}\n\nexport async function mutateTotpInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    secret: ArrayBuffer;\n    digits: number;\n    period: number;\n    verified: boolean;\n    name?: string;\n    createdAt: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.totpInsert,\n    args,\n  )) as string;\n}\n\nexport async function mutateTotpMarkVerified(\n  ctx: ComponentCallCtx,\n  totpId: string,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.totpMarkVerified, {\n    totpId,\n    lastUsedAt,\n  });\n}\n\nexport async function mutateTotpUpdateLastUsed(\n  ctx: ComponentCallCtx,\n  totpId: string,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.totpUpdateLastUsed, {\n    totpId,\n    lastUsedAt,\n  });\n}\n\n// -- Passkey queries / mutations --\n\nexport async function queryPasskeysByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<PasskeyDoc[]> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.passkeyListByUserId,\n    { userId },\n  )) as PasskeyDoc[];\n}\n\nexport async function queryPasskeyByCredentialId(\n  ctx: ComponentCallCtx,\n  credentialId: string,\n): Promise<PasskeyDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.passkeyGetByCredentialId,\n    { credentialId },\n  )) as PasskeyDoc | null;\n}\n\nexport async function mutatePasskeyInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    credentialId: string;\n    publicKey: ArrayBuffer | ArrayBufferLike;\n    algorithm: number;\n    counter: number;\n    transports?: string[];\n    deviceType: string;\n    backedUp: boolean;\n    name?: string;\n    createdAt: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.passkeyInsert,\n    args,\n  )) as string;\n}\n\nexport async function mutatePasskeyUpdateCounter(\n  ctx: ComponentCallCtx,\n  passkeyId: string,\n  counter: number,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.passkeyUpdateCounter, {\n    passkeyId,\n    counter,\n    lastUsedAt,\n  });\n}\n\n// -- Key queries / mutations --\n\nexport async function mutateKeyInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    prefix: string;\n    hashedKey: string;\n    name: string;\n    scopes: Array<{ resource: string; actions: string[] }>;\n    rateLimit?: { maxRequests: number; windowMs: number };\n    expiresAt?: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.keyInsert,\n    args,\n  )) as string;\n}\n\nexport async function queryKeysByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<KeyDoc[]> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.keyListByUserId, {\n    userId,\n  })) as KeyDoc[];\n}\n\nexport async function queryKeyById(\n  ctx: ComponentCallCtx,\n  keyId: string,\n): Promise<KeyDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.keyGetById, {\n    keyId,\n  })) as KeyDoc | null;\n}\n\nexport async function mutateKeyPatch(\n  ctx: ComponentCallCtx,\n  keyId: string,\n  data: Record<string, unknown>,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.keyPatch, {\n    keyId,\n    data,\n  });\n}\n\nexport async function mutateKeyDelete(\n  ctx: ComponentCallCtx,\n  keyId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.keyDelete, { keyId });\n}\n\n// -- Device authorization queries / mutations --\n\nexport type DeviceDoc = Infer<typeof vDeviceCodeDoc>;\n\nexport async function mutateDeviceInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    deviceCodeHash: string;\n    userCode: string;\n    expiresAt: number;\n    interval: number;\n    status: \"pending\" | \"authorized\" | \"denied\";\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.deviceInsert,\n    args,\n  )) as string;\n}\n\nexport async function queryDeviceByCodeHash(\n  ctx: ComponentCallCtx,\n  deviceCodeHash: string,\n): Promise<DeviceDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.deviceGetByCodeHash,\n    { deviceCodeHash },\n  )) as DeviceDoc | null;\n}\n\nexport async function queryDeviceByUserCode(\n  ctx: ComponentCallCtx,\n  userCode: string,\n): Promise<DeviceDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.deviceGetByUserCode,\n    { userCode },\n  )) as DeviceDoc | null;\n}\n\nexport async function mutateDeviceAuthorize(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n  userId: string,\n  sessionId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.deviceAuthorize, {\n    deviceId,\n    userId,\n    sessionId,\n  });\n}\n\nexport async function mutateDeviceUpdateLastPolled(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n  lastPolledAt: number,\n): Promise<void> {\n  await ctx.runMutation(\n    ctx.auth.config.component.public.deviceUpdateLastPolled,\n    { deviceId, lastPolledAt },\n  );\n}\n\nexport async function mutateDeviceDelete(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.deviceDelete, {\n    deviceId,\n  });\n}\n"],"mappings":";AAy6CA,eAAsB,cACpB,KACA,QACuC;AACvC,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,aAAa,EACvE,QACD,CAAC;;AAGJ,eAAsB,yBACpB,KACA,OACuC;AACvC,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,yBACjC,EAAE,OAAO,CACV;;AAKH,eAAsB,kBACpB,KACA,YAC6B;AAC7B,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,iBAAiB,EAC3E,YACD,CAAC;;AAGJ,eAAsB,qBACpB,KACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,gBAAgB,EACrE,YACD,CAAC;;AAKJ,eAAsB,cACpB,KACA,QACyB;AACzB,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,aAAa,EACvE,QACD,CAAC;;AAGJ,eAAsB,0BACpB,KACA,QACyB;AACzB,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,yBACjC,EAAE,QAAQ,CACX;;AAGH,eAAsB,iBACpB,KACA,MASiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,YACjC,KACD;;AAGH,eAAsB,uBACpB,KACA,QACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,kBAAkB;EACvE;EACA;EACD,CAAC;;AAGJ,eAAsB,yBACpB,KACA,QACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,oBAAoB;EACzE;EACA;EACD,CAAC;;AAKJ,eAAsB,sBACpB,KACA,QACuB;AACvB,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,QAAQ,CACX;;AAGH,eAAsB,2BACpB,KACA,cAC4B;AAC5B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,0BACjC,EAAE,cAAc,CACjB;;AAGH,eAAsB,oBACpB,KACA,MAYiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,eACjC,KACD;;AAGH,eAAsB,2BACpB,KACA,WACA,SACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,sBAAsB;EAC3E;EACA;EACA;EACD,CAAC;;AAKJ,eAAsB,gBACpB,KACA,MASiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,WACjC,KACD;;AAGH,eAAsB,kBACpB,KACA,QACmB;AACnB,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,iBAAiB,EAC3E,QACD,CAAC;;AAGJ,eAAsB,aACpB,KACA,OACwB;AACxB,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,YAAY,EACtE,OACD,CAAC;;AAGJ,eAAsB,eACpB,KACA,OACA,MACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,UAAU;EAC/D;EACA;EACD,CAAC;;AAGJ,eAAsB,gBACpB,KACA,OACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,WAAW,EAAE,OAAO,CAAC;;AAO9E,eAAsB,mBACpB,KACA,MAOiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,cACjC,KACD;;AAGH,eAAsB,sBACpB,KACA,gBAC2B;AAC3B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,gBAAgB,CACnB;;AAGH,eAAsB,sBACpB,KACA,UAC2B;AAC3B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,UAAU,CACb;;AAGH,eAAsB,sBACpB,KACA,UACA,QACA,WACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,iBAAiB;EACtE;EACA;EACA;EACD,CAAC;;AAGJ,eAAsB,6BACpB,KACA,UACA,cACe;AACf,OAAM,IAAI,YACR,IAAI,KAAK,OAAO,UAAU,OAAO,wBACjC;EAAE;EAAU;EAAc,CAC3B;;AAGH,eAAsB,mBACpB,KACA,UACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,cAAc,EACnE,UACD,CAAC"}

package/dist/server/users.d.ts

@@ -1,31 +1 @@
-import { AuthProviderMaterializedConfig, ConvexAuthConfig, Doc, MutationCtx } from "./types.js";
-import { GenericId } from "convex/values";
-
-//#region src/server/users.d.ts
-type CreateOrUpdateUserArgs = {
-  type: "oauth" | "credentials" | "email" | "phone" | "verification";
-  provider: AuthProviderMaterializedConfig;
-  profile: Record<string, unknown> & {
-    email?: string;
-    phone?: string;
-    emailVerified?: boolean;
-    phoneVerified?: boolean;
-  };
-  accountExtend?: Record<string, unknown>;
-  shouldLinkViaEmail?: boolean;
-  shouldLinkViaPhone?: boolean;
-};
-declare function upsertUserAndAccount(ctx: MutationCtx, sessionId: GenericId<"Session"> | null, account: {
-  existingAccount: Doc<"Account">;
-} | {
-  providerAccountId: string;
-  secret?: string;
-}, args: CreateOrUpdateUserArgs, config: ConvexAuthConfig, opts?: {
-  existingUserId?: GenericId<"User">;
-}): Promise<{
-  userId: GenericId<"User">;
-  accountId: GenericId<"Account">;
-}>;
-//#endregion
-export { upsertUserAndAccount };
-//# sourceMappingURL=users.d.ts.map
+export { };

package/dist/server/users.js

@@ -12,6 +12,7 @@ function mergeExtend(existing, incoming) {
 		...incoming
 	} : incoming;
 }
+/** @internal */
 async function upsertUserAndAccount(ctx, sessionId, account, args, config, opts) {
 	const userId = await defaultCreateOrUpdateUser(ctx, sessionId, "existingAccount" in account ? account.existingAccount : null, args, config, opts?.existingUserId ?? null);
 	return {

package/dist/server/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","names":[],"sources":["../../src/server/users.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./fx\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { AuthProviderMaterializedConfig, ConvexAuthConfig } from \"./types\";\nimport { LOG_LEVELS, logWithLevel } from \"./utils\";\n\ntype CreateOrUpdateUserArgs = {\n  type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n  provider: AuthProviderMaterializedConfig;\n  profile: Record<string, unknown> & {\n    email?: string;\n    phone?: string;\n    emailVerified?: boolean;\n    phoneVerified?: boolean;\n  };\n  accountExtend?: Record<string, unknown>;\n  shouldLinkViaEmail?: boolean;\n  shouldLinkViaPhone?: boolean;\n};\n\nfunction mergeExtend(\n  existing: unknown,\n  incoming: Record<string, unknown> | undefined,\n) {\n  if (!incoming) {\n    return undefined;\n  }\n  const existingRecord =\n    typeof existing === \"object\" &&\n    existing !== null &&\n    !Array.isArray(existing)\n      ? (existing as Record<string, unknown>)\n      : undefined;\n  return existingRecord ? { ...existingRecord, ...incoming } : incoming;\n}\n\nexport async function upsertUserAndAccount(\n  ctx: MutationCtx,\n  sessionId: GenericId<\"Session\"> | null,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  opts?: { existingUserId?: GenericId<\"User\"> },\n): Promise<{\n  userId: GenericId<\"User\">;\n  accountId: GenericId<\"Account\">;\n}> {\n  const userId = await defaultCreateOrUpdateUser(\n    ctx,\n    sessionId,\n    \"existingAccount\" in account ? account.existingAccount : null,\n    args,\n    config,\n    opts?.existingUserId ?? null,\n  );\n  const accountId = await createOrUpdateAccount(\n    ctx,\n    userId,\n    account,\n    args,\n    config,\n  );\n  return { userId, accountId };\n}\n\nasync function defaultCreateOrUpdateUser(\n  ctx: MutationCtx,\n  existingSessionId: GenericId<\"Session\"> | null,\n  existingAccount: Doc<\"Account\"> | null,\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  existingUserIdOverride: GenericId<\"User\"> | null,\n) {\n  logWithLevel(LOG_LEVELS.DEBUG, \"defaultCreateOrUpdateUser args:\", {\n    existingAccountId: existingAccount?._id,\n    existingSessionId,\n    args,\n  });\n  const existingUserId = existingAccount?.userId ?? null;\n  const db = authDb(ctx, config);\n  if (config.callbacks?.createOrUpdateUser !== undefined) {\n    logWithLevel(LOG_LEVELS.DEBUG, \"Using custom createOrUpdateUser callback\");\n    return await config.callbacks.createOrUpdateUser(ctx, {\n      existingUserId,\n      ...args,\n    });\n  }\n\n  const {\n    provider,\n    profile: {\n      id: _profileId,\n      emailVerified: profileEmailVerified,\n      phoneVerified: profilePhoneVerified,\n      ...profile\n    },\n  } = args;\n  const emailVerified =\n    profileEmailVerified ??\n    (provider.type === \"oauth\" && provider.accountLinking !== \"none\");\n  const phoneVerified = profilePhoneVerified ?? false;\n  const shouldLinkViaEmail =\n    args.shouldLinkViaEmail || emailVerified || provider.type === \"email\";\n  const shouldLinkViaPhone =\n    args.shouldLinkViaPhone || phoneVerified || provider.type === \"phone\";\n\n  let userId = existingUserId ?? existingUserIdOverride;\n  if (existingUserId === null) {\n    const existingUserWithVerifiedEmailId =\n      typeof profile.email === \"string\" && shouldLinkViaEmail\n        ? ((await uniqueUserWithVerifiedEmail(ctx, profile.email, config))\n            ?._id ?? null)\n        : null;\n\n    const existingUserWithVerifiedPhoneId =\n      typeof profile.phone === \"string\" && shouldLinkViaPhone\n        ? ((await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))\n            ?._id ?? null)\n        : null;\n    const linkDispatch = {\n      tag:\n        existingUserWithVerifiedEmailId !== null &&\n        existingUserWithVerifiedPhoneId !== null\n          ? \"both\"\n          : existingUserWithVerifiedEmailId !== null\n            ? \"email\"\n            : existingUserWithVerifiedPhoneId !== null\n              ? \"phone\"\n              : \"none\",\n      existingUserWithVerifiedEmailId,\n      existingUserWithVerifiedPhoneId,\n    } as const;\n\n    const linkHandlers = {\n      both: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email and phone verified users, so not linking: email: ${linkDispatch.existingUserWithVerifiedEmailId}, phone: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return null;\n        }),\n      email: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email verified user, linking: ${linkDispatch.existingUserWithVerifiedEmailId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedEmailId;\n        }),\n      phone: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing phone verified user, linking: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedPhoneId;\n        }),\n      none: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            \"No existing verified users found, creating new user\",\n          );\n          return null;\n        }),\n    } as const;\n\n    userId = await Fx.run(linkHandlers[linkDispatch.tag]());\n  }\n  const userData = {\n    ...(emailVerified ? { emailVerificationTime: Date.now() } : null),\n    ...(phoneVerified ? { phoneVerificationTime: Date.now() } : null),\n    ...profile,\n  };\n  const existingOrLinkedUserId = userId;\n  if (userId !== null) {\n    await Fx.run(\n      Fx.from({\n        ok: () => db.users.patch(userId!, userData),\n        err: (error) =>\n          new AuthError(\n            \"USER_UPDATE_FAILED\",\n            `Could not update user document with ID \\`${userId}\\`, ` +\n              `either the user has been deleted but their account has not, ` +\n              `or the profile data doesn't match the \\`users\\` table schema: ` +\n              `${(error as Error).message}`,\n          ),\n      }).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),\n    );\n  } else {\n    userId = (await db.users.insert(userData)) as GenericId<\"User\">;\n  }\n  const afterUserCreatedOrUpdated = config.callbacks?.afterUserCreatedOrUpdated;\n  if (afterUserCreatedOrUpdated !== undefined) {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"Calling custom afterUserCreatedOrUpdated callback\",\n    );\n    await afterUserCreatedOrUpdated(ctx, {\n      userId,\n      existingUserId: existingOrLinkedUserId,\n      ...args,\n    });\n  } else {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"No custom afterUserCreatedOrUpdated callback, skipping\",\n    );\n  }\n  return userId;\n}\n\nasync function uniqueUserWithVerifiedEmail(\n  ctx: MutationCtx,\n  email: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedEmail(email)) as Doc<\"User\"> | null;\n}\n\nasync function uniqueUserWithVerifiedPhone(\n  ctx: MutationCtx,\n  phone: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedPhone(phone)) as Doc<\"User\"> | null;\n}\n\nasync function createOrUpdateAccount(\n  ctx: MutationCtx,\n  userId: GenericId<\"User\">,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  const mergedExtend =\n    \"existingAccount\" in account\n      ? mergeExtend(account.existingAccount.extend, args.accountExtend)\n      : args.accountExtend;\n  const accountId =\n    \"existingAccount\" in account\n      ? account.existingAccount._id\n      : ((await db.accounts.create({\n          userId,\n          provider: args.provider.id,\n          providerAccountId: account.providerAccountId,\n          secret: account.secret,\n          extend: mergedExtend,\n        })) as GenericId<\"Account\">);\n  // This is never used with the default `createOrUpdateUser` implementation,\n  // but it is used for manual linking via custom `createOrUpdateUser`:\n  if (\n    \"existingAccount\" in account &&\n    account.existingAccount.userId !== userId\n  ) {\n    await db.accounts.patch(accountId, { userId });\n  }\n  const accountPatchData: Record<string, unknown> = {};\n  if (mergedExtend) {\n    accountPatchData.extend = mergedExtend;\n  }\n  if (args.profile.emailVerified) {\n    accountPatchData.emailVerified = args.profile.email;\n  }\n  if (args.profile.phoneVerified) {\n    accountPatchData.phoneVerified = args.profile.phone;\n  }\n  if (Object.keys(accountPatchData).length > 0) {\n    await db.accounts.patch(accountId, accountPatchData);\n  }\n  return accountId;\n}\n"],"mappings":";;;;;;AAuBA,SAAS,YACP,UACA,UACA;AACA,KAAI,CAAC,SACH;CAEF,MAAM,iBACJ,OAAO,aAAa,YACpB,aAAa,QACb,CAAC,MAAM,QAAQ,SAAS,GACnB,WACD;AACN,QAAO,iBAAiB;EAAE,GAAG;EAAgB,GAAG;EAAU,GAAG;;AAG/D,eAAsB,qBACpB,KACA,WACA,SAMA,MACA,QACA,MAIC;CACD,MAAM,SAAS,MAAM,0BACnB,KACA,WACA,qBAAqB,UAAU,QAAQ,kBAAkB,MACzD,MACA,QACA,MAAM,kBAAkB,KACzB;AAQD,QAAO;EAAE;EAAQ,WAPC,MAAM,sBACtB,KACA,QACA,SACA,MACA,OACD;EAC2B;;AAG9B,eAAe,0BACb,KACA,mBACA,iBACA,MACA,QACA,wBACA;AACA,cAAa,WAAW,OAAO,mCAAmC;EAChE,mBAAmB,iBAAiB;EACpC;EACA;EACD,CAAC;CACF,MAAM,iBAAiB,iBAAiB,UAAU;CAClD,MAAM,KAAK,OAAO,KAAK,OAAO;AAC9B,KAAI,OAAO,WAAW,uBAAuB,QAAW;AACtD,eAAa,WAAW,OAAO,2CAA2C;AAC1E,SAAO,MAAM,OAAO,UAAU,mBAAmB,KAAK;GACpD;GACA,GAAG;GACJ,CAAC;;CAGJ,MAAM,EACJ,UACA,SAAS,EACP,IAAI,YACJ,eAAe,sBACf,eAAe,sBACf,GAAG,cAEH;CACJ,MAAM,gBACJ,yBACC,SAAS,SAAS,WAAW,SAAS,mBAAmB;CAC5D,MAAM,gBAAgB,wBAAwB;CAC9C,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAChE,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAEhE,IAAI,SAAS,kBAAkB;AAC/B,KAAI,mBAAmB,MAAM;EAC3B,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EAEN,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EACN,MAAM,eAAe;GACnB,KACE,oCAAoC,QACpC,oCAAoC,OAChC,SACA,oCAAoC,OAClC,UACA,oCAAoC,OAClC,UACA;GACV;GACA;GACD;AAqCD,WAAS,MAAM,GAAG,IAnCG;GACnB,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,yEAAyE,aAAa,gCAAgC,WAAW,aAAa,kCAC/I;AACD,WAAO;KACP;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,sDACD;AACD,WAAO;KACP;GACL,CAEkC,aAAa,MAAM,CAAC;;CAEzD,MAAM,WAAW;EACf,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAG;EACJ;CACD,MAAM,yBAAyB;AAC/B,KAAI,WAAW,KACb,OAAM,GAAG,IACP,GAAG,KAAK;EACN,UAAU,GAAG,MAAM,MAAM,QAAS,SAAS;EAC3C,MAAM,UACJ,IAAI,UACF,sBACA,4CAA4C,OAAO,gIAG7C,MAAgB,UACvB;EACJ,CAAC,CAAC,KAAK,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CACxD;KAED,UAAU,MAAM,GAAG,MAAM,OAAO,SAAS;CAE3C,MAAM,4BAA4B,OAAO,WAAW;AACpD,KAAI,8BAA8B,QAAW;AAC3C,eACE,WAAW,OACX,oDACD;AACD,QAAM,0BAA0B,KAAK;GACnC;GACA,gBAAgB;GAChB,GAAG;GACJ,CAAC;OAEF,cACE,WAAW,OACX,yDACD;AAEH,QAAO;;AAGT,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,sBACb,KACA,QACA,SAMA,MACA,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,eACJ,qBAAqB,UACjB,YAAY,QAAQ,gBAAgB,QAAQ,KAAK,cAAc,GAC/D,KAAK;CACX,MAAM,YACJ,qBAAqB,UACjB,QAAQ,gBAAgB,MACtB,MAAM,GAAG,SAAS,OAAO;EACzB;EACA,UAAU,KAAK,SAAS;EACxB,mBAAmB,QAAQ;EAC3B,QAAQ,QAAQ;EAChB,QAAQ;EACT,CAAC;AAGR,KACE,qBAAqB,WACrB,QAAQ,gBAAgB,WAAW,OAEnC,OAAM,GAAG,SAAS,MAAM,WAAW,EAAE,QAAQ,CAAC;CAEhD,MAAM,mBAA4C,EAAE;AACpD,KAAI,aACF,kBAAiB,SAAS;AAE5B,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,OAAO,KAAK,iBAAiB,CAAC,SAAS,EACzC,OAAM,GAAG,SAAS,MAAM,WAAW,iBAAiB;AAEtD,QAAO"}
+{"version":3,"file":"users.js","names":[],"sources":["../../src/server/users.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./fx\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { AuthProviderMaterializedConfig, ConvexAuthConfig } from \"./types\";\nimport { LOG_LEVELS, logWithLevel } from \"./utils\";\n\ntype CreateOrUpdateUserArgs = {\n  type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n  provider: AuthProviderMaterializedConfig;\n  profile: Record<string, unknown> & {\n    email?: string;\n    phone?: string;\n    emailVerified?: boolean;\n    phoneVerified?: boolean;\n  };\n  accountExtend?: Record<string, unknown>;\n  shouldLinkViaEmail?: boolean;\n  shouldLinkViaPhone?: boolean;\n};\n\nfunction mergeExtend(\n  existing: unknown,\n  incoming: Record<string, unknown> | undefined,\n) {\n  if (!incoming) {\n    return undefined;\n  }\n  const existingRecord =\n    typeof existing === \"object\" &&\n    existing !== null &&\n    !Array.isArray(existing)\n      ? (existing as Record<string, unknown>)\n      : undefined;\n  return existingRecord ? { ...existingRecord, ...incoming } : incoming;\n}\n\n/** @internal */\nexport async function upsertUserAndAccount(\n  ctx: MutationCtx,\n  sessionId: GenericId<\"Session\"> | null,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  opts?: { existingUserId?: GenericId<\"User\"> },\n): Promise<{\n  userId: GenericId<\"User\">;\n  accountId: GenericId<\"Account\">;\n}> {\n  const userId = await defaultCreateOrUpdateUser(\n    ctx,\n    sessionId,\n    \"existingAccount\" in account ? account.existingAccount : null,\n    args,\n    config,\n    opts?.existingUserId ?? null,\n  );\n  const accountId = await createOrUpdateAccount(\n    ctx,\n    userId,\n    account,\n    args,\n    config,\n  );\n  return { userId, accountId };\n}\n\nasync function defaultCreateOrUpdateUser(\n  ctx: MutationCtx,\n  existingSessionId: GenericId<\"Session\"> | null,\n  existingAccount: Doc<\"Account\"> | null,\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  existingUserIdOverride: GenericId<\"User\"> | null,\n) {\n  logWithLevel(LOG_LEVELS.DEBUG, \"defaultCreateOrUpdateUser args:\", {\n    existingAccountId: existingAccount?._id,\n    existingSessionId,\n    args,\n  });\n  const existingUserId = existingAccount?.userId ?? null;\n  const db = authDb(ctx, config);\n  if (config.callbacks?.createOrUpdateUser !== undefined) {\n    logWithLevel(LOG_LEVELS.DEBUG, \"Using custom createOrUpdateUser callback\");\n    return await config.callbacks.createOrUpdateUser(ctx, {\n      existingUserId,\n      ...args,\n    });\n  }\n\n  const {\n    provider,\n    profile: {\n      id: _profileId,\n      emailVerified: profileEmailVerified,\n      phoneVerified: profilePhoneVerified,\n      ...profile\n    },\n  } = args;\n  const emailVerified =\n    profileEmailVerified ??\n    (provider.type === \"oauth\" && provider.accountLinking !== \"none\");\n  const phoneVerified = profilePhoneVerified ?? false;\n  const shouldLinkViaEmail =\n    args.shouldLinkViaEmail || emailVerified || provider.type === \"email\";\n  const shouldLinkViaPhone =\n    args.shouldLinkViaPhone || phoneVerified || provider.type === \"phone\";\n\n  let userId = existingUserId ?? existingUserIdOverride;\n  if (existingUserId === null) {\n    const existingUserWithVerifiedEmailId =\n      typeof profile.email === \"string\" && shouldLinkViaEmail\n        ? ((await uniqueUserWithVerifiedEmail(ctx, profile.email, config))\n            ?._id ?? null)\n        : null;\n\n    const existingUserWithVerifiedPhoneId =\n      typeof profile.phone === \"string\" && shouldLinkViaPhone\n        ? ((await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))\n            ?._id ?? null)\n        : null;\n    const linkDispatch = {\n      tag:\n        existingUserWithVerifiedEmailId !== null &&\n        existingUserWithVerifiedPhoneId !== null\n          ? \"both\"\n          : existingUserWithVerifiedEmailId !== null\n            ? \"email\"\n            : existingUserWithVerifiedPhoneId !== null\n              ? \"phone\"\n              : \"none\",\n      existingUserWithVerifiedEmailId,\n      existingUserWithVerifiedPhoneId,\n    } as const;\n\n    const linkHandlers = {\n      both: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email and phone verified users, so not linking: email: ${linkDispatch.existingUserWithVerifiedEmailId}, phone: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return null;\n        }),\n      email: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email verified user, linking: ${linkDispatch.existingUserWithVerifiedEmailId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedEmailId;\n        }),\n      phone: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing phone verified user, linking: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedPhoneId;\n        }),\n      none: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            \"No existing verified users found, creating new user\",\n          );\n          return null;\n        }),\n    } as const;\n\n    userId = await Fx.run(linkHandlers[linkDispatch.tag]());\n  }\n  const userData = {\n    ...(emailVerified ? { emailVerificationTime: Date.now() } : null),\n    ...(phoneVerified ? { phoneVerificationTime: Date.now() } : null),\n    ...profile,\n  };\n  const existingOrLinkedUserId = userId;\n  if (userId !== null) {\n    await Fx.run(\n      Fx.from({\n        ok: () => db.users.patch(userId!, userData),\n        err: (error) =>\n          new AuthError(\n            \"USER_UPDATE_FAILED\",\n            `Could not update user document with ID \\`${userId}\\`, ` +\n              `either the user has been deleted but their account has not, ` +\n              `or the profile data doesn't match the \\`users\\` table schema: ` +\n              `${(error as Error).message}`,\n          ),\n      }).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),\n    );\n  } else {\n    userId = (await db.users.insert(userData)) as GenericId<\"User\">;\n  }\n  const afterUserCreatedOrUpdated = config.callbacks?.afterUserCreatedOrUpdated;\n  if (afterUserCreatedOrUpdated !== undefined) {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"Calling custom afterUserCreatedOrUpdated callback\",\n    );\n    await afterUserCreatedOrUpdated(ctx, {\n      userId,\n      existingUserId: existingOrLinkedUserId,\n      ...args,\n    });\n  } else {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"No custom afterUserCreatedOrUpdated callback, skipping\",\n    );\n  }\n  return userId;\n}\n\nasync function uniqueUserWithVerifiedEmail(\n  ctx: MutationCtx,\n  email: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedEmail(email)) as Doc<\"User\"> | null;\n}\n\nasync function uniqueUserWithVerifiedPhone(\n  ctx: MutationCtx,\n  phone: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedPhone(phone)) as Doc<\"User\"> | null;\n}\n\nasync function createOrUpdateAccount(\n  ctx: MutationCtx,\n  userId: GenericId<\"User\">,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  const mergedExtend =\n    \"existingAccount\" in account\n      ? mergeExtend(account.existingAccount.extend, args.accountExtend)\n      : args.accountExtend;\n  const accountId =\n    \"existingAccount\" in account\n      ? account.existingAccount._id\n      : ((await db.accounts.create({\n          userId,\n          provider: args.provider.id,\n          providerAccountId: account.providerAccountId,\n          secret: account.secret,\n          extend: mergedExtend,\n        })) as GenericId<\"Account\">);\n  // This is never used with the default `createOrUpdateUser` implementation,\n  // but it is used for manual linking via custom `createOrUpdateUser`:\n  if (\n    \"existingAccount\" in account &&\n    account.existingAccount.userId !== userId\n  ) {\n    await db.accounts.patch(accountId, { userId });\n  }\n  const accountPatchData: Record<string, unknown> = {};\n  if (mergedExtend) {\n    accountPatchData.extend = mergedExtend;\n  }\n  if (args.profile.emailVerified) {\n    accountPatchData.emailVerified = args.profile.email;\n  }\n  if (args.profile.phoneVerified) {\n    accountPatchData.phoneVerified = args.profile.phone;\n  }\n  if (Object.keys(accountPatchData).length > 0) {\n    await db.accounts.patch(accountId, accountPatchData);\n  }\n  return accountId;\n}\n"],"mappings":";;;;;;AAuBA,SAAS,YACP,UACA,UACA;AACA,KAAI,CAAC,SACH;CAEF,MAAM,iBACJ,OAAO,aAAa,YACpB,aAAa,QACb,CAAC,MAAM,QAAQ,SAAS,GACnB,WACD;AACN,QAAO,iBAAiB;EAAE,GAAG;EAAgB,GAAG;EAAU,GAAG;;;AAI/D,eAAsB,qBACpB,KACA,WACA,SAMA,MACA,QACA,MAIC;CACD,MAAM,SAAS,MAAM,0BACnB,KACA,WACA,qBAAqB,UAAU,QAAQ,kBAAkB,MACzD,MACA,QACA,MAAM,kBAAkB,KACzB;AAQD,QAAO;EAAE;EAAQ,WAPC,MAAM,sBACtB,KACA,QACA,SACA,MACA,OACD;EAC2B;;AAG9B,eAAe,0BACb,KACA,mBACA,iBACA,MACA,QACA,wBACA;AACA,cAAa,WAAW,OAAO,mCAAmC;EAChE,mBAAmB,iBAAiB;EACpC;EACA;EACD,CAAC;CACF,MAAM,iBAAiB,iBAAiB,UAAU;CAClD,MAAM,KAAK,OAAO,KAAK,OAAO;AAC9B,KAAI,OAAO,WAAW,uBAAuB,QAAW;AACtD,eAAa,WAAW,OAAO,2CAA2C;AAC1E,SAAO,MAAM,OAAO,UAAU,mBAAmB,KAAK;GACpD;GACA,GAAG;GACJ,CAAC;;CAGJ,MAAM,EACJ,UACA,SAAS,EACP,IAAI,YACJ,eAAe,sBACf,eAAe,sBACf,GAAG,cAEH;CACJ,MAAM,gBACJ,yBACC,SAAS,SAAS,WAAW,SAAS,mBAAmB;CAC5D,MAAM,gBAAgB,wBAAwB;CAC9C,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAChE,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAEhE,IAAI,SAAS,kBAAkB;AAC/B,KAAI,mBAAmB,MAAM;EAC3B,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EAEN,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EACN,MAAM,eAAe;GACnB,KACE,oCAAoC,QACpC,oCAAoC,OAChC,SACA,oCAAoC,OAClC,UACA,oCAAoC,OAClC,UACA;GACV;GACA;GACD;AAqCD,WAAS,MAAM,GAAG,IAnCG;GACnB,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,yEAAyE,aAAa,gCAAgC,WAAW,aAAa,kCAC/I;AACD,WAAO;KACP;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,sDACD;AACD,WAAO;KACP;GACL,CAEkC,aAAa,MAAM,CAAC;;CAEzD,MAAM,WAAW;EACf,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAG;EACJ;CACD,MAAM,yBAAyB;AAC/B,KAAI,WAAW,KACb,OAAM,GAAG,IACP,GAAG,KAAK;EACN,UAAU,GAAG,MAAM,MAAM,QAAS,SAAS;EAC3C,MAAM,UACJ,IAAI,UACF,sBACA,4CAA4C,OAAO,gIAG7C,MAAgB,UACvB;EACJ,CAAC,CAAC,KAAK,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CACxD;KAED,UAAU,MAAM,GAAG,MAAM,OAAO,SAAS;CAE3C,MAAM,4BAA4B,OAAO,WAAW;AACpD,KAAI,8BAA8B,QAAW;AAC3C,eACE,WAAW,OACX,oDACD;AACD,QAAM,0BAA0B,KAAK;GACnC;GACA,gBAAgB;GAChB,GAAG;GACJ,CAAC;OAEF,cACE,WAAW,OACX,yDACD;AAEH,QAAO;;AAGT,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,sBACb,KACA,QACA,SAMA,MACA,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,eACJ,qBAAqB,UACjB,YAAY,QAAQ,gBAAgB,QAAQ,KAAK,cAAc,GAC/D,KAAK;CACX,MAAM,YACJ,qBAAqB,UACjB,QAAQ,gBAAgB,MACtB,MAAM,GAAG,SAAS,OAAO;EACzB;EACA,UAAU,KAAK,SAAS;EACxB,mBAAmB,QAAQ;EAC3B,QAAQ,QAAQ;EAChB,QAAQ;EACT,CAAC;AAGR,KACE,qBAAqB,WACrB,QAAQ,gBAAgB,WAAW,OAEnC,OAAM,GAAG,SAAS,MAAM,WAAW,EAAE,QAAQ,CAAC;CAEhD,MAAM,mBAA4C,EAAE;AACpD,KAAI,aACF,kBAAiB,SAAS;AAE5B,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,OAAO,KAAK,iBAAiB,CAAC,SAAS,EACzC,OAAM,GAAG,SAAS,MAAM,WAAW,iBAAiB;AAEtD,QAAO"}

package/dist/server/utils.d.ts

@@ -1,27 +1 @@
-//#region src/server/utils.d.ts
-/**
- * Require an environment variable to be set, throwing at config time if missing.
- *
- * Uses `AuthError.toConvexError()` directly since this is a synchronous guard
- * called inline in many expressions — not suitable for Fx pipeline wrapping.
- */
-declare function requireEnv(name: string): string;
-declare function isLocalHost(host?: string): boolean;
-declare const TOKEN_SUB_CLAIM_DIVIDER = "|";
-declare const REFRESH_TOKEN_DIVIDER = "|";
-declare function sha256(input: string): Promise<string>;
-declare function generateRandomString(length: number, alphabet: string): string;
-declare function errorMessage(error: unknown): string;
-declare function logError(error: unknown): void;
-declare const LOG_LEVELS: {
-  readonly ERROR: "ERROR";
-  readonly WARN: "WARN";
-  readonly INFO: "INFO";
-  readonly DEBUG: "DEBUG";
-};
-type LogLevel = keyof typeof LOG_LEVELS;
-declare function logWithLevel(level: LogLevel, ...args: unknown[]): void;
-declare function maybeRedact(value: string): string;
-//#endregion
-export { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, TOKEN_SUB_CLAIM_DIVIDER, errorMessage, generateRandomString, isLocalHost, logError, logWithLevel, maybeRedact, requireEnv, sha256 };
-//# sourceMappingURL=utils.d.ts.map
+export { };

package/dist/server/utils.js

@@ -1,7 +1,7 @@
 import { AuthError } from "./fx.js";
 import { generateRandomString as generateRandomString$1 } from "@oslojs/crypto/random";
 import { sha256 as sha256$1 } from "@oslojs/crypto/sha2";
-import { encodeHexLowerCase } from "@oslojs/encoding";
+import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding, encodeHexLowerCase } from "@oslojs/encoding";
 
 //#region src/server/utils.ts
 /**
@@ -10,11 +10,13 @@ import { encodeHexLowerCase } from "@oslojs/encoding";
 * Uses `AuthError.toConvexError()` directly since this is a synchronous guard
 * called inline in many expressions — not suitable for Fx pipeline wrapping.
 */
+/** @internal */
 function requireEnv(name) {
 	const value = process.env[name];
 	if (value === void 0) throw new AuthError("MISSING_ENV_VAR", `Missing environment variable \`${name}\``, { variable: name }).toConvexError();
 	return value;
 }
+/** @internal */
 function isLocalHost(host) {
 	if (host === void 0) return false;
 	const raw = host.includes("://") ? host : `http://${host}`;
@@ -26,28 +28,36 @@ function isLocalHost(host) {
 	}
 	return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
 }
+/** @internal */
 const TOKEN_SUB_CLAIM_DIVIDER = "|";
+/** @internal */
 const REFRESH_TOKEN_DIVIDER = "|";
+/** @internal */
 async function sha256(input) {
 	return encodeHexLowerCase(sha256$1(new TextEncoder().encode(input)));
 }
+/** @internal */
 function generateRandomString(length, alphabet) {
 	return generateRandomString$1({ read(bytes) {
 		crypto.getRandomValues(bytes);
 	} }, alphabet, length);
 }
+/** @internal */
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
+/** @internal */
 function logError(error) {
 	logWithLevel(LOG_LEVELS.ERROR, error instanceof Error ? error.message + "\n" + error.stack?.replace("\\n", "\n") : error);
 }
+/** @internal */
 const LOG_LEVELS = {
 	ERROR: "ERROR",
 	WARN: "WARN",
 	INFO: "INFO",
 	DEBUG: "DEBUG"
 };
+/** @internal */
 function logWithLevel(level, ...args) {
 	const configuredLogLevel = LOG_LEVELS[process.env.AUTH_LOG_LEVEL ?? "INFO"] ?? "INFO";
 	switch (level) {
@@ -66,6 +76,7 @@ function logWithLevel(level, ...args) {
 	}
 }
 const UNREDACTED_LENGTH = 5;
+/** @internal */
 function maybeRedact(value) {
 	if (value === "") return "";
 	if (process.env.AUTH_LOG_SECRETS !== "true") {
@@ -73,7 +84,38 @@ function maybeRedact(value) {
 		return value.substring(0, UNREDACTED_LENGTH) + "<redacted>" + value.substring(value.length - UNREDACTED_LENGTH);
 	} else return value;
 }
+const SECRET_KEY_ENV = "AUTH_SECRET_ENCRYPTION_KEY";
+const SECRET_IV_LENGTH = 12;
+function toArrayBuffer(bytes) {
+	return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+async function getSecretCryptoKey() {
+	const material = requireEnv(SECRET_KEY_ENV);
+	const rawKey = sha256$1(new TextEncoder().encode(material));
+	return await crypto.subtle.importKey("raw", toArrayBuffer(rawKey), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+/** @internal */
+async function encryptSecret(value) {
+	const key = await getSecretCryptoKey();
+	const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));
+	const encrypted = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(iv)
+	}, key, toArrayBuffer(new TextEncoder().encode(value)));
+	return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;
+}
+/** @internal */
+async function decryptSecret(ciphertext) {
+	const [ivEncoded, payloadEncoded] = ciphertext.split(".");
+	if (!ivEncoded || !payloadEncoded) throw new AuthError("INVALID_PARAMETERS", "Stored enterprise secret is malformed.").toConvexError();
+	const key = await getSecretCryptoKey();
+	const decrypted = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded))
+	}, key, toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)));
+	return new TextDecoder().decode(decrypted);
+}
 
 //#endregion
-export { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, TOKEN_SUB_CLAIM_DIVIDER, errorMessage, generateRandomString, isLocalHost, logError, logWithLevel, maybeRedact, requireEnv, sha256 };
+export { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, TOKEN_SUB_CLAIM_DIVIDER, decryptSecret, encryptSecret, errorMessage, generateRandomString, isLocalHost, logError, logWithLevel, maybeRedact, requireEnv, sha256 };
 //# sourceMappingURL=utils.js.map

package/dist/server/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["rawSha256","osloGenerateRandomString"],"sources":["../../src/server/utils.ts"],"sourcesContent":["import {\n  RandomReader,\n  generateRandomString as osloGenerateRandomString,\n} from \"@oslojs/crypto/random\";\nimport { sha256 as rawSha256 } from \"@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"@oslojs/encoding\";\n\nimport { AuthError } from \"./fx\";\n\n/**\n * Require an environment variable to be set, throwing at config time if missing.\n *\n * Uses `AuthError.toConvexError()` directly since this is a synchronous guard\n * called inline in many expressions — not suitable for Fx pipeline wrapping.\n */\nexport function requireEnv(name: string) {\n  const value = process.env[name];\n  if (value === undefined) {\n    throw new AuthError(\n      \"MISSING_ENV_VAR\",\n      `Missing environment variable \\`${name}\\``,\n      { variable: name },\n    ).toConvexError();\n  }\n  return value;\n}\n\nexport function isLocalHost(host?: string) {\n  if (host === undefined) {\n    return false;\n  }\n  const raw = host.includes(\"://\") ? host : `http://${host}`;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return false;\n  }\n  return (\n    url.hostname === \"localhost\" ||\n    url.hostname === \"127.0.0.1\" ||\n    url.hostname === \"::1\"\n  );\n}\n\n// Internal server utilities (merged from former internalUtils.ts)\n\nexport const TOKEN_SUB_CLAIM_DIVIDER = \"|\";\nexport const REFRESH_TOKEN_DIVIDER = \"|\";\n\nexport async function sha256(input: string) {\n  return encodeHexLowerCase(rawSha256(new TextEncoder().encode(input)));\n}\n\nexport function generateRandomString(length: number, alphabet: string) {\n  const random: RandomReader = {\n    read(bytes) {\n      crypto.getRandomValues(bytes as Uint8Array<ArrayBuffer>);\n    },\n  };\n\n  return osloGenerateRandomString(random, alphabet, length);\n}\n\nexport function errorMessage(error: unknown) {\n  return error instanceof Error ? error.message : String(error);\n}\n\nexport function logError(error: unknown) {\n  logWithLevel(\n    LOG_LEVELS.ERROR,\n    error instanceof Error\n      ? error.message + \"\\n\" + error.stack?.replace(\"\\\\n\", \"\\n\")\n      : error,\n  );\n}\n\nexport const LOG_LEVELS = {\n  ERROR: \"ERROR\",\n  WARN: \"WARN\",\n  INFO: \"INFO\",\n  DEBUG: \"DEBUG\",\n} as const;\ntype LogLevel = keyof typeof LOG_LEVELS;\n\nexport function logWithLevel(level: LogLevel, ...args: unknown[]) {\n  const configuredLogLevel =\n    LOG_LEVELS[\n      (process.env.AUTH_LOG_LEVEL as LogLevel | undefined) ?? \"INFO\"\n    ] ?? \"INFO\";\n  switch (level) {\n    case \"ERROR\":\n      console.error(...args);\n      break;\n    case \"WARN\":\n      if (configuredLogLevel !== \"ERROR\") {\n        console.warn(...args);\n      }\n      break;\n    case \"INFO\":\n      if (configuredLogLevel === \"INFO\" || configuredLogLevel === \"DEBUG\") {\n        console.info(...args);\n      }\n      break;\n    case \"DEBUG\":\n      if (configuredLogLevel === \"DEBUG\") {\n        console.debug(...args);\n      }\n      break;\n  }\n}\n\nconst UNREDACTED_LENGTH = 5;\nexport function maybeRedact(value: string) {\n  if (value === \"\") {\n    return \"\";\n  }\n  const shouldRedact = process.env.AUTH_LOG_SECRETS !== \"true\";\n  if (shouldRedact) {\n    if (value.length < UNREDACTED_LENGTH * 2) {\n      return \"<redacted>\";\n    }\n    return (\n      value.substring(0, UNREDACTED_LENGTH) +\n      \"<redacted>\" +\n      value.substring(value.length - UNREDACTED_LENGTH)\n    );\n  } else {\n    return value;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,SAAgB,WAAW,MAAc;CACvC,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,UAAU,OACZ,OAAM,IAAI,UACR,mBACA,kCAAkC,KAAK,KACvC,EAAE,UAAU,MAAM,CACnB,CAAC,eAAe;AAEnB,QAAO;;AAGT,SAAgB,YAAY,MAAe;AACzC,KAAI,SAAS,OACX,QAAO;CAET,MAAM,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,UAAU;CACpD,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,IAAI;SACZ;AACN,SAAO;;AAET,QACE,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa;;AAMrB,MAAa,0BAA0B;AACvC,MAAa,wBAAwB;AAErC,eAAsB,OAAO,OAAe;AAC1C,QAAO,mBAAmBA,SAAU,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAAC;;AAGvE,SAAgB,qBAAqB,QAAgB,UAAkB;AAOrE,QAAOC,uBANsB,EAC3B,KAAK,OAAO;AACV,SAAO,gBAAgB,MAAiC;IAE3D,EAEuC,UAAU,OAAO;;AAG3D,SAAgB,aAAa,OAAgB;AAC3C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG/D,SAAgB,SAAS,OAAgB;AACvC,cACE,WAAW,OACX,iBAAiB,QACb,MAAM,UAAU,OAAO,MAAM,OAAO,QAAQ,OAAO,KAAK,GACxD,MACL;;AAGH,MAAa,aAAa;CACxB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACR;AAGD,SAAgB,aAAa,OAAiB,GAAG,MAAiB;CAChE,MAAM,qBACJ,WACG,QAAQ,IAAI,kBAA2C,WACrD;AACP,SAAQ,OAAR;EACE,KAAK;AACH,WAAQ,MAAM,GAAG,KAAK;AACtB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,UAAU,uBAAuB,QAC1D,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,MAAM,GAAG,KAAK;AAExB;;;AAIN,MAAM,oBAAoB;AAC1B,SAAgB,YAAY,OAAe;AACzC,KAAI,UAAU,GACZ,QAAO;AAGT,KADqB,QAAQ,IAAI,qBAAqB,QACpC;AAChB,MAAI,MAAM,SAAS,oBAAoB,EACrC,QAAO;AAET,SACE,MAAM,UAAU,GAAG,kBAAkB,GACrC,eACA,MAAM,UAAU,MAAM,SAAS,kBAAkB;OAGnD,QAAO"}
+{"version":3,"file":"utils.js","names":["rawSha256","osloGenerateRandomString"],"sources":["../../src/server/utils.ts"],"sourcesContent":["import {\n  RandomReader,\n  generateRandomString as osloGenerateRandomString,\n} from \"@oslojs/crypto/random\";\nimport { sha256 as rawSha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  decodeBase64urlIgnorePadding,\n  encodeBase64urlNoPadding,\n  encodeHexLowerCase,\n} from \"@oslojs/encoding\";\n\nimport { AuthError } from \"./fx\";\n\n/**\n * Require an environment variable to be set, throwing at config time if missing.\n *\n * Uses `AuthError.toConvexError()` directly since this is a synchronous guard\n * called inline in many expressions — not suitable for Fx pipeline wrapping.\n */\n/** @internal */\nexport function requireEnv(name: string) {\n  const value = process.env[name];\n  if (value === undefined) {\n    throw new AuthError(\n      \"MISSING_ENV_VAR\",\n      `Missing environment variable \\`${name}\\``,\n      { variable: name },\n    ).toConvexError();\n  }\n  return value;\n}\n\n/** @internal */\nexport function isLocalHost(host?: string) {\n  if (host === undefined) {\n    return false;\n  }\n  const raw = host.includes(\"://\") ? host : `http://${host}`;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return false;\n  }\n  return (\n    url.hostname === \"localhost\" ||\n    url.hostname === \"127.0.0.1\" ||\n    url.hostname === \"::1\"\n  );\n}\n\n// Internal server utilities (merged from former internalUtils.ts)\n\n/** @internal */\nexport const TOKEN_SUB_CLAIM_DIVIDER = \"|\";\n/** @internal */\nexport const REFRESH_TOKEN_DIVIDER = \"|\";\n\n/** @internal */\nexport async function sha256(input: string) {\n  return encodeHexLowerCase(rawSha256(new TextEncoder().encode(input)));\n}\n\n/** @internal */\nexport function generateRandomString(length: number, alphabet: string) {\n  const random: RandomReader = {\n    read(bytes) {\n      crypto.getRandomValues(bytes as Uint8Array<ArrayBuffer>);\n    },\n  };\n\n  return osloGenerateRandomString(random, alphabet, length);\n}\n\n/** @internal */\nexport function errorMessage(error: unknown) {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** @internal */\nexport function logError(error: unknown) {\n  logWithLevel(\n    LOG_LEVELS.ERROR,\n    error instanceof Error\n      ? error.message + \"\\n\" + error.stack?.replace(\"\\\\n\", \"\\n\")\n      : error,\n  );\n}\n\n/** @internal */\nexport const LOG_LEVELS = {\n  ERROR: \"ERROR\",\n  WARN: \"WARN\",\n  INFO: \"INFO\",\n  DEBUG: \"DEBUG\",\n} as const;\ntype LogLevel = keyof typeof LOG_LEVELS;\n\n/** @internal */\nexport function logWithLevel(level: LogLevel, ...args: unknown[]) {\n  const configuredLogLevel =\n    LOG_LEVELS[\n      (process.env.AUTH_LOG_LEVEL as LogLevel | undefined) ?? \"INFO\"\n    ] ?? \"INFO\";\n  switch (level) {\n    case \"ERROR\":\n      console.error(...args);\n      break;\n    case \"WARN\":\n      if (configuredLogLevel !== \"ERROR\") {\n        console.warn(...args);\n      }\n      break;\n    case \"INFO\":\n      if (configuredLogLevel === \"INFO\" || configuredLogLevel === \"DEBUG\") {\n        console.info(...args);\n      }\n      break;\n    case \"DEBUG\":\n      if (configuredLogLevel === \"DEBUG\") {\n        console.debug(...args);\n      }\n      break;\n  }\n}\n\nconst UNREDACTED_LENGTH = 5;\n/** @internal */\nexport function maybeRedact(value: string) {\n  if (value === \"\") {\n    return \"\";\n  }\n  const shouldRedact = process.env.AUTH_LOG_SECRETS !== \"true\";\n  if (shouldRedact) {\n    if (value.length < UNREDACTED_LENGTH * 2) {\n      return \"<redacted>\";\n    }\n    return (\n      value.substring(0, UNREDACTED_LENGTH) +\n      \"<redacted>\" +\n      value.substring(value.length - UNREDACTED_LENGTH)\n    );\n  } else {\n    return value;\n  }\n}\n\nconst SECRET_KEY_ENV = \"AUTH_SECRET_ENCRYPTION_KEY\";\nconst SECRET_IV_LENGTH = 12;\n\nfunction toArrayBuffer(bytes: Uint8Array) {\n  return bytes.buffer.slice(\n    bytes.byteOffset,\n    bytes.byteOffset + bytes.byteLength,\n  ) as ArrayBuffer;\n}\n\nasync function getSecretCryptoKey() {\n  const material = requireEnv(SECRET_KEY_ENV);\n  const rawKey = rawSha256(new TextEncoder().encode(material));\n  return await crypto.subtle.importKey(\n    \"raw\",\n    toArrayBuffer(rawKey),\n    { name: \"AES-GCM\" },\n    false,\n    [\"encrypt\", \"decrypt\"],\n  );\n}\n\n/** @internal */\nexport async function encryptSecret(value: string) {\n  const key = await getSecretCryptoKey();\n  const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));\n  const encrypted = await crypto.subtle.encrypt(\n    { name: \"AES-GCM\", iv: toArrayBuffer(iv) },\n    key,\n    toArrayBuffer(new TextEncoder().encode(value)),\n  );\n  return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;\n}\n\n/** @internal */\nexport async function decryptSecret(ciphertext: string) {\n  const [ivEncoded, payloadEncoded] = ciphertext.split(\".\");\n  if (!ivEncoded || !payloadEncoded) {\n    throw new AuthError(\n      \"INVALID_PARAMETERS\",\n      \"Stored enterprise secret is malformed.\",\n    ).toConvexError();\n  }\n  const key = await getSecretCryptoKey();\n  const decrypted = await crypto.subtle.decrypt(\n    {\n      name: \"AES-GCM\",\n      iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded)),\n    },\n    key,\n    toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)),\n  );\n  return new TextDecoder().decode(decrypted);\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,SAAgB,WAAW,MAAc;CACvC,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,UAAU,OACZ,OAAM,IAAI,UACR,mBACA,kCAAkC,KAAK,KACvC,EAAE,UAAU,MAAM,CACnB,CAAC,eAAe;AAEnB,QAAO;;;AAIT,SAAgB,YAAY,MAAe;AACzC,KAAI,SAAS,OACX,QAAO;CAET,MAAM,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,UAAU;CACpD,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,IAAI;SACZ;AACN,SAAO;;AAET,QACE,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa;;;AAOrB,MAAa,0BAA0B;;AAEvC,MAAa,wBAAwB;;AAGrC,eAAsB,OAAO,OAAe;AAC1C,QAAO,mBAAmBA,SAAU,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAAC;;;AAIvE,SAAgB,qBAAqB,QAAgB,UAAkB;AAOrE,QAAOC,uBANsB,EAC3B,KAAK,OAAO;AACV,SAAO,gBAAgB,MAAiC;IAE3D,EAEuC,UAAU,OAAO;;;AAI3D,SAAgB,aAAa,OAAgB;AAC3C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;;AAI/D,SAAgB,SAAS,OAAgB;AACvC,cACE,WAAW,OACX,iBAAiB,QACb,MAAM,UAAU,OAAO,MAAM,OAAO,QAAQ,OAAO,KAAK,GACxD,MACL;;;AAIH,MAAa,aAAa;CACxB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACR;;AAID,SAAgB,aAAa,OAAiB,GAAG,MAAiB;CAChE,MAAM,qBACJ,WACG,QAAQ,IAAI,kBAA2C,WACrD;AACP,SAAQ,OAAR;EACE,KAAK;AACH,WAAQ,MAAM,GAAG,KAAK;AACtB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,UAAU,uBAAuB,QAC1D,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,MAAM,GAAG,KAAK;AAExB;;;AAIN,MAAM,oBAAoB;;AAE1B,SAAgB,YAAY,OAAe;AACzC,KAAI,UAAU,GACZ,QAAO;AAGT,KADqB,QAAQ,IAAI,qBAAqB,QACpC;AAChB,MAAI,MAAM,SAAS,oBAAoB,EACrC,QAAO;AAET,SACE,MAAM,UAAU,GAAG,kBAAkB,GACrC,eACA,MAAM,UAAU,MAAM,SAAS,kBAAkB;OAGnD,QAAO;;AAIX,MAAM,iBAAiB;AACvB,MAAM,mBAAmB;AAEzB,SAAS,cAAc,OAAmB;AACxC,QAAO,MAAM,OAAO,MAClB,MAAM,YACN,MAAM,aAAa,MAAM,WAC1B;;AAGH,eAAe,qBAAqB;CAClC,MAAM,WAAW,WAAW,eAAe;CAC3C,MAAM,SAASD,SAAU,IAAI,aAAa,CAAC,OAAO,SAAS,CAAC;AAC5D,QAAO,MAAM,OAAO,OAAO,UACzB,OACA,cAAc,OAAO,EACrB,EAAE,MAAM,WAAW,EACnB,OACA,CAAC,WAAW,UAAU,CACvB;;;AAIH,eAAsB,cAAc,OAAe;CACjD,MAAM,MAAM,MAAM,oBAAoB;CACtC,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,iBAAiB,CAAC;CACnE,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EAAE,MAAM;EAAW,IAAI,cAAc,GAAG;EAAE,EAC1C,KACA,cAAc,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAC/C;AACD,QAAO,GAAG,yBAAyB,GAAG,CAAC,GAAG,yBAAyB,IAAI,WAAW,UAAU,CAAC;;;AAI/F,eAAsB,cAAc,YAAoB;CACtD,MAAM,CAAC,WAAW,kBAAkB,WAAW,MAAM,IAAI;AACzD,KAAI,CAAC,aAAa,CAAC,eACjB,OAAM,IAAI,UACR,sBACA,yCACD,CAAC,eAAe;CAEnB,MAAM,MAAM,MAAM,oBAAoB;CACtC,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EACE,MAAM;EACN,IAAI,cAAc,6BAA6B,UAAU,CAAC;EAC3D,EACD,KACA,cAAc,6BAA6B,eAAe,CAAC,CAC5D;AACD,QAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}

package/dist/server/version.d.ts

@@ -1,5 +1,5 @@
 //#region src/server/version.d.ts
-declare const AUTH_VERSION = "0.0.4-preview.13";
+declare const AUTH_VERSION = "0.0.4-preview.16";
 //#endregion
 export { AUTH_VERSION };
 //# sourceMappingURL=version.d.ts.map

package/dist/server/version.js

@@ -1,5 +1,5 @@
 //#region src/server/version.ts
-const AUTH_VERSION = "0.0.4-preview.13";
+const AUTH_VERSION = "0.0.4-preview.16";
 
 //#endregion
 export { AUTH_VERSION };

package/dist/server/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","names":[],"sources":["../../src/server/version.ts"],"sourcesContent":["// Auto-generated by scripts/generate-version.js — do not edit.\nexport const AUTH_VERSION = \"0.0.4-preview.13\";\n"],"mappings":";AACA,MAAa,eAAe"}
+{"version":3,"file":"version.js","names":[],"sources":["../../src/server/version.ts"],"sourcesContent":["// Auto-generated by scripts/generate-version.js — do not edit.\nexport const AUTH_VERSION = \"0.0.4-preview.16\";\n"],"mappings":";AACA,MAAa,eAAe"}