@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/dist/server/index.d.ts

@@ -1,705 +1,4 @@
-import { AuthAuthorizationConfig, AuthRoleId } from "./types.js";
-import { AuthApi } from "./auth.js";
-import * as convex_server3 from "convex/server";
-
-//#region src/server/index.d.ts
-type EnterpriseAdminPermission = "sso.connection.create" | "sso.connection.read" | "sso.connection.manage" | "sso.domain.manage" | "sso.protocol.manage" | "sso.policy.manage" | "sso.audit.read" | "sso.webhook.manage" | "scim.manage";
-type EnterpriseAdminAuthorizationInput = {
-  userId: string;
-  permission: EnterpriseAdminPermission;
-  enterpriseId?: string;
-  groupId?: string;
-  resolvedGroupId: string | null;
-};
-type EnterpriseAuthorizer = (ctx: {
-  auth: convex_server3.Auth;
-}, input: EnterpriseAdminAuthorizationInput) => Promise<void | {
-  ok: false;
-}>;
-type RoleRef<TRoleId extends string> = {
-  id: TRoleId;
-};
-type MountedEnterpriseOptions<TRoleId extends string = string> = {
-  admin?: {
-    authorized?: EnterpriseAuthorizer;
-    roles?: Array<TRoleId | RoleRef<TRoleId>>;
-  };
-};
-type EnterpriseMountOptions<TRoleId extends string = string> = {
-  admin: {
-    authorized: EnterpriseAuthorizer;
-    roles?: Array<TRoleId | RoleRef<TRoleId>>;
-  };
-};
-/**
- * Build optional public SSO management actions that apps can mount under
- * `convex/auth/sso/**` when they want client-callable enterprise APIs.
- *
- * `admin` is for tenant-admin control-plane operations and should be mounted
- * with an explicit authorization policy. `client` is for end-user sign-in
- * helpers and does not require tenant-admin authorization.
- */
-declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "group" | "member" | "sso" | "user">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
-  admin: {
-    connection: {
-      create: convex_server3.RegisteredMutation<"public", {
-        name?: string | undefined;
-        status?: "draft" | "active" | "disabled" | undefined;
-        slug?: string | undefined;
-        groupId?: string | undefined;
-        domain?: string | undefined;
-      }, Promise<any>>;
-      get: convex_server3.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      getByGroup: convex_server3.RegisteredQuery<"public", {
-        groupId: string;
-      }, Promise<any>>;
-      getByDomain: convex_server3.RegisteredQuery<"public", {
-        domain: string;
-      }, Promise<any>>;
-      list: convex_server3.RegisteredQuery<"public", {
-        limit?: number | undefined;
-        where?: {
-          status?: "draft" | "active" | "disabled" | undefined;
-          slug?: string | undefined;
-          groupId?: string | undefined;
-        } | undefined;
-        cursor?: string | null | undefined;
-        orderBy?: string | undefined;
-        order?: "asc" | "desc" | undefined;
-      }, Promise<any>>;
-      update: convex_server3.RegisteredMutation<"public", {
-        enterpriseId: string;
-        data: {
-          name?: string | undefined;
-          status?: "draft" | "active" | "disabled" | undefined;
-          slug?: string | undefined;
-        };
-      }, Promise<{
-        ok: false;
-        code: "NOT_SIGNED_IN" | "FORBIDDEN";
-        enterpriseId?: undefined;
-      } | {
-        ok: true;
-        enterpriseId: string;
-        code?: undefined;
-      }>>;
-      delete: convex_server3.RegisteredMutation<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      status: convex_server3.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      domain: {
-        list: convex_server3.RegisteredQuery<"public", {
-          enterpriseId: string;
-        }, Promise<any>>;
-        validate: convex_server3.RegisteredQuery<"public", {
-          enterpriseId: string;
-        }, Promise<any>>;
-        set: convex_server3.RegisteredMutation<"public", {
-          enterpriseId: string;
-          domains: {
-            isPrimary?: boolean | undefined;
-            domain: string;
-          }[];
-        }, Promise<any>>;
-        verification: {
-          request: convex_server3.RegisteredMutation<"public", {
-            enterpriseId: string;
-            domain: string;
-          }, Promise<any>>;
-          confirm: convex_server3.RegisteredAction<"public", {
-            enterpriseId: string;
-            domain: string;
-          }, Promise<any>>;
-        };
-      };
-    };
-    oidc: {
-      configure: convex_server3.RegisteredMutation<"public", {
-        scopes?: string[] | undefined;
-        issuer?: string | undefined;
-        discoveryUrl?: string | undefined;
-        clientSecret?: string | undefined;
-        authorizationParams?: Record<string, string> | undefined;
-        clockToleranceSeconds?: number | undefined;
-        strictIssuer?: boolean | undefined;
-        extraFields?: Record<string, string> | undefined;
-        enterpriseId: string;
-        clientId: string;
-      }, Promise<any>>;
-      get: convex_server3.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      validate: convex_server3.RegisteredAction<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-    };
-    saml: {
-      configure: convex_server3.RegisteredAction<"public", {
-        domains?: string[] | undefined;
-        metadataXml?: string | undefined;
-        metadataUrl?: string | undefined;
-        signAuthnRequests?: boolean | undefined;
-        attributeMapping?: {
-          email?: string | undefined;
-          name?: string | undefined;
-          subject?: string | undefined;
-          firstName?: string | undefined;
-          lastName?: string | undefined;
-        } | undefined;
-        sp?: {
-          entityId?: string | undefined;
-          acsUrl?: string | undefined;
-          sloUrl?: string | undefined;
-          signingCert?: string | string[] | undefined;
-          encryptCert?: string | string[] | undefined;
-          privateKey?: string | undefined;
-          privateKeyPass?: string | undefined;
-          encPrivateKey?: string | undefined;
-          encPrivateKeyPass?: string | undefined;
-        } | undefined;
-        enterpriseId: string;
-      }, Promise<any>>;
-      validate: convex_server3.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-    };
-    policy: {
-      get: convex_server3.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      update: convex_server3.RegisteredMutation<"public", {
-        enterpriseId: string;
-        patch: {
-          identity?: {
-            accountLinking?: {
-              oidc?: "verifiedEmail" | "none" | undefined;
-              saml?: "verifiedEmail" | "none" | undefined;
-            } | undefined;
-          } | undefined;
-          provisioning?: {
-            scimReuse?: {
-              user?: "none" | "externalId" | undefined;
-            } | undefined;
-            jit?: {
-              mode?: "off" | "createUser" | "createUserAndMembership" | undefined;
-              defaultRoleIds?: string[] | undefined;
-            } | undefined;
-            deprovision?: {
-              mode?: "soft" | "hard" | undefined;
-            } | undefined;
-          } | undefined;
-        };
-      }, Promise<any>>;
-      validate: convex_server3.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-    };
-    audit: {
-      list: convex_server3.RegisteredQuery<"public", {
-        limit?: number | undefined;
-        groupId?: string | undefined;
-        enterpriseId?: string | undefined;
-      }, Promise<any>>;
-    };
-    webhook: {
-      delivery: {
-        list: convex_server3.RegisteredQuery<"public", {
-          limit?: number | undefined;
-          enterpriseId: string;
-        }, Promise<any>>;
-      };
-      endpoint: {
-        create: convex_server3.RegisteredMutation<"public", {
-          createdByUserId?: string | undefined;
-          secret: string;
-          enterpriseId: string;
-          url: string;
-          subscriptions: string[];
-        }, Promise<{
-          ok: false;
-          code: "NOT_SIGNED_IN" | "FORBIDDEN";
-          _id?: undefined;
-          enterpriseId?: undefined;
-          url?: undefined;
-          subscriptions?: undefined;
-          createdByUserId?: undefined;
-          status?: undefined;
-          failureCount?: undefined;
-        } | {
-          _id: any;
-          enterpriseId: string;
-          url: string;
-          subscriptions: string[];
-          createdByUserId: string;
-          status: string;
-          failureCount: number;
-          ok?: undefined;
-          code?: undefined;
-        }>>;
-        list: convex_server3.RegisteredQuery<"public", {
-          enterpriseId: string;
-        }, Promise<any>>;
-        disable: convex_server3.RegisteredMutation<"public", {
-          endpointId: string;
-        }, Promise<any>>;
-      };
-    };
-  };
-  client: {
-    signIn: convex_server3.RegisteredQuery<"public", {
-      email?: string | undefined;
-      enterpriseId?: string | undefined;
-      domain?: string | undefined;
-      redirectTo?: string | undefined;
-    }, Promise<any>>;
-    metadata: convex_server3.RegisteredQuery<"public", {
-      entityId?: string | undefined;
-      acsUrl?: string | undefined;
-      sloUrl?: string | undefined;
-      enterpriseId: string;
-    }, Promise<any>>;
-  };
-};
-/**
- * Build optional public SCIM management actions that apps can mount under
- * `convex/auth/scim/**` when they want client-callable enterprise admin APIs.
- */
-declare function scim<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "scim" | "sso" | "user">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
-  admin: {
-    configure: convex_server3.RegisteredMutation<"public", {
-      status?: "draft" | "active" | "disabled" | undefined;
-      basePath?: string | undefined;
-      enterpriseId: string;
-    }, Promise<any>>;
-    get: convex_server3.RegisteredQuery<"public", {
-      enterpriseId: string;
-    }, Promise<any>>;
-    validate: convex_server3.RegisteredQuery<"public", {
-      enterpriseId: string;
-    }, Promise<any>>;
-  };
-};
-/**
- * Build a flat mounted enterprise API surface for app-owned Convex exports.
- *
- * The returned object contains tenant-admin SSO and SCIM control-plane
- * functions plus end-user enterprise sign-in helpers. The `authorized`
- * callback is required for admin operations.
- */
-declare function enterprise<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "group" | "member" | "scim" | "sso" | "user">, options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>): {
-  createConnection: convex_server3.RegisteredMutation<"public", {
-    name?: string | undefined;
-    status?: "draft" | "active" | "disabled" | undefined;
-    slug?: string | undefined;
-    groupId?: string | undefined;
-    domain?: string | undefined;
-  }, Promise<any>>;
-  getConnection: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  getConnectionByGroup: convex_server3.RegisteredQuery<"public", {
-    groupId: string;
-  }, Promise<any>>;
-  getConnectionByDomain: convex_server3.RegisteredQuery<"public", {
-    domain: string;
-  }, Promise<any>>;
-  listConnections: convex_server3.RegisteredQuery<"public", {
-    limit?: number | undefined;
-    where?: {
-      status?: "draft" | "active" | "disabled" | undefined;
-      slug?: string | undefined;
-      groupId?: string | undefined;
-    } | undefined;
-    cursor?: string | null | undefined;
-    orderBy?: string | undefined;
-    order?: "asc" | "desc" | undefined;
-  }, Promise<any>>;
-  updateConnection: convex_server3.RegisteredMutation<"public", {
-    enterpriseId: string;
-    data: {
-      name?: string | undefined;
-      status?: "draft" | "active" | "disabled" | undefined;
-      slug?: string | undefined;
-    };
-  }, Promise<{
-    ok: false;
-    code: "NOT_SIGNED_IN" | "FORBIDDEN";
-    enterpriseId?: undefined;
-  } | {
-    ok: true;
-    enterpriseId: string;
-    code?: undefined;
-  }>>;
-  deleteConnection: convex_server3.RegisteredMutation<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  getConnectionStatus: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  listDomains: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  validateDomains: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  setDomains: convex_server3.RegisteredMutation<"public", {
-    enterpriseId: string;
-    domains: {
-      isPrimary?: boolean | undefined;
-      domain: string;
-    }[];
-  }, Promise<any>>;
-  requestDomainVerification: convex_server3.RegisteredMutation<"public", {
-    enterpriseId: string;
-    domain: string;
-  }, Promise<any>>;
-  confirmDomainVerification: convex_server3.RegisteredAction<"public", {
-    enterpriseId: string;
-    domain: string;
-  }, Promise<any>>;
-  configureOidc: convex_server3.RegisteredMutation<"public", {
-    scopes?: string[] | undefined;
-    issuer?: string | undefined;
-    discoveryUrl?: string | undefined;
-    clientSecret?: string | undefined;
-    authorizationParams?: Record<string, string> | undefined;
-    clockToleranceSeconds?: number | undefined;
-    strictIssuer?: boolean | undefined;
-    extraFields?: Record<string, string> | undefined;
-    enterpriseId: string;
-    clientId: string;
-  }, Promise<any>>;
-  getOidc: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  validateOidc: convex_server3.RegisteredAction<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  configureSaml: convex_server3.RegisteredAction<"public", {
-    domains?: string[] | undefined;
-    metadataXml?: string | undefined;
-    metadataUrl?: string | undefined;
-    signAuthnRequests?: boolean | undefined;
-    attributeMapping?: {
-      email?: string | undefined;
-      name?: string | undefined;
-      subject?: string | undefined;
-      firstName?: string | undefined;
-      lastName?: string | undefined;
-    } | undefined;
-    sp?: {
-      entityId?: string | undefined;
-      acsUrl?: string | undefined;
-      sloUrl?: string | undefined;
-      signingCert?: string | string[] | undefined;
-      encryptCert?: string | string[] | undefined;
-      privateKey?: string | undefined;
-      privateKeyPass?: string | undefined;
-      encPrivateKey?: string | undefined;
-      encPrivateKeyPass?: string | undefined;
-    } | undefined;
-    enterpriseId: string;
-  }, Promise<any>>;
-  validateSaml: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  getPolicy: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  updatePolicy: convex_server3.RegisteredMutation<"public", {
-    enterpriseId: string;
-    patch: {
-      identity?: {
-        accountLinking?: {
-          oidc?: "verifiedEmail" | "none" | undefined;
-          saml?: "verifiedEmail" | "none" | undefined;
-        } | undefined;
-      } | undefined;
-      provisioning?: {
-        scimReuse?: {
-          user?: "none" | "externalId" | undefined;
-        } | undefined;
-        jit?: {
-          mode?: "off" | "createUser" | "createUserAndMembership" | undefined;
-          defaultRoleIds?: string[] | undefined;
-        } | undefined;
-        deprovision?: {
-          mode?: "soft" | "hard" | undefined;
-        } | undefined;
-      } | undefined;
-    };
-  }, Promise<any>>;
-  validatePolicy: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  listAudit: convex_server3.RegisteredQuery<"public", {
-    limit?: number | undefined;
-    groupId?: string | undefined;
-    enterpriseId?: string | undefined;
-  }, Promise<any>>;
-  createWebhookEndpoint: convex_server3.RegisteredMutation<"public", {
-    createdByUserId?: string | undefined;
-    secret: string;
-    enterpriseId: string;
-    url: string;
-    subscriptions: string[];
-  }, Promise<{
-    ok: false;
-    code: "NOT_SIGNED_IN" | "FORBIDDEN";
-    _id?: undefined;
-    enterpriseId?: undefined;
-    url?: undefined;
-    subscriptions?: undefined;
-    createdByUserId?: undefined;
-    status?: undefined;
-    failureCount?: undefined;
-  } | {
-    _id: any;
-    enterpriseId: string;
-    url: string;
-    subscriptions: string[];
-    createdByUserId: string;
-    status: string;
-    failureCount: number;
-    ok?: undefined;
-    code?: undefined;
-  }>>;
-  listWebhookEndpoints: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  listWebhookDeliveries: convex_server3.RegisteredQuery<"public", {
-    limit?: number | undefined;
-    enterpriseId: string;
-  }, Promise<any>>;
-  disableWebhookEndpoint: convex_server3.RegisteredMutation<"public", {
-    endpointId: string;
-  }, Promise<any>>;
-  configureScim: convex_server3.RegisteredMutation<"public", {
-    status?: "draft" | "active" | "disabled" | undefined;
-    basePath?: string | undefined;
-    enterpriseId: string;
-  }, Promise<any>>;
-  getScim: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  validateScim: convex_server3.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  signIn: convex_server3.RegisteredQuery<"public", {
-    email?: string | undefined;
-    enterpriseId?: string | undefined;
-    domain?: string | undefined;
-    redirectTo?: string | undefined;
-  }, Promise<any>>;
-  metadata: convex_server3.RegisteredQuery<"public", {
-    entityId?: string | undefined;
-    acsUrl?: string | undefined;
-    sloUrl?: string | undefined;
-    enterpriseId: string;
-  }, Promise<any>>;
-};
-/** Cookie lifetime configuration for auth tokens. */
-type AuthCookieConfig = {
-  /** Maximum age in seconds, or `null` for session cookies. */maxAge: number | null;
-};
-/** Raw cookie values extracted from a request. */
-type AuthCookies = {
-  /** The JWT access token, or `null` when absent. */token: string | null; /** The refresh token, or `null` when absent. */
-  refreshToken: string | null; /** The OAuth PKCE verifier, or `null` when absent. */
-  verifier: string | null;
-};
-/** A structured cookie ready to be set via any framework's cookie API. */
-type AuthCookie = {
-  name: string;
-  value: string;
-  options: {
-    path: string;
-    httpOnly: boolean;
-    secure: boolean;
-    sameSite: "lax" | "strict" | "none";
-    maxAge?: number;
-    expires?: Date;
-  };
-};
-/**
- * Options for the SSR auth helper returned by {@link server}.
- */
-type ServerOptions = {
-  /** Convex deployment API URL (e.g. `https://your-app.convex.cloud`). */url: string;
-  /**
-   * Accepted JWT issuers for `refresh()` and `verify()`.
-   *
-   * By default, this is derived from `url`. If `url` ends with
-   * `.convex.cloud`, the matching `.convex.site` issuer is also accepted.
-   */
-  acceptedIssuers?: string[];
-  /**
-   * Path the client POSTs auth actions to. Defaults to `"/api/auth"`.
-   * Must match the `proxyPath` option on the client.
-   */
-  apiRoute?: string; /** Cookie `maxAge` in seconds, or `null` for session cookies. */
-  cookieMaxAge?: number | null; /** Enable verbose debug logging for token refresh and cookie operations. */
-  verbose?: boolean;
-  /**
-   * Optional namespace for auth cookie names.
-   *
-   * Use this to isolate auth cookies between multiple local apps on the same host.
-   * If omitted, a deterministic deployment-scoped namespace is derived from `url`.
-   */
-  cookieNamespace?: string;
-  /**
-   * Control whether `refresh()` handles OAuth `?code=` query parameters.
-   *
-   * - `true` (default): always exchange the code on GET requests with `text/html` accept.
-   * - `false`: never exchange — useful when only the client handles codes.
-   * - A function: called with the `Request` for per-request decisions.
-   */
-  shouldHandleCode?: ((request: Request) => boolean | Promise<boolean>) | boolean;
-};
-type RefreshResult = {
-  /** Code exchange occurred — return the pre-built redirect `Response`. */redirect: true; /** 302 redirect with Set-Cookie headers already serialized. */
-  response: Response;
-} | {
-  /** No redirect — apply cookies and read the token. */redirect: false; /** Structured cookies to set on the response. */
-  cookies: AuthCookie[]; /** JWT for SSR hydration, or `null` if not authenticated. */
-  token: string | null;
-};
-/**
- * Derive the cookie names used for auth tokens.
- *
- * On localhost the names are unprefixed; on production hosts they
- * use the `__Host-` prefix for tighter security.
- *
- * @param host - The `Host` header value. Omit to use unprefixed names.
- * @param cookieNamespace - Optional namespace suffix for cookie isolation.
- * @returns An object with `token`, `refreshToken`, and `verifier` cookie names.
- */
-declare function authCookieNames(host?: string, cookieNamespace?: string | null): {
-  token: string;
-  refreshToken: string;
-  verifier: string;
-};
-/**
- * Parse auth cookie values from a raw `Cookie` header string.
- *
- * @param cookieHeader - The raw `Cookie` header, or `null`/`undefined`.
- * @param host - The `Host` header, used to determine cookie name prefixes.
- * @param cookieNamespace - Optional namespace suffix for cookie isolation.
- * @returns Parsed {@link AuthCookies} with `token`, `refreshToken`, and `verifier`.
- */
-declare function parseAuthCookies(cookieHeader: string | null | undefined, host?: string, cookieNamespace?: string | null): AuthCookies;
-/**
- * Serialize auth cookies into `Set-Cookie` header strings.
- *
- * Nulled-out values produce deletion cookies (maxAge 0, expired date).
- *
- * @param cookies - The auth cookie values to serialize.
- * @param host - The `Host` header, used for cookie name prefixes and `Secure` flag.
- * @param config - Cookie lifetime config. Defaults to session cookies.
- * @param cookieNamespace - Optional namespace suffix for cookie isolation.
- * @returns An array of three `Set-Cookie` header strings.
- */
-declare function serializeAuthCookies(cookies: AuthCookies, host?: string, config?: AuthCookieConfig, cookieNamespace?: string | null): string[];
-/**
- * Build structured cookie objects for any SSR framework.
- *
- * Use with SvelteKit's `event.cookies.set()`, TanStack Start's `setCookie()`,
- * Next.js's `cookies().set()`, or any other framework cookie API.
- */
-declare function structuredAuthCookies(cookies: AuthCookies, host?: string, config?: AuthCookieConfig, cookieNamespace?: string | null): AuthCookie[];
-/**
- * Check whether a request pathname matches the auth proxy route.
- *
- * Handles trailing-slash ambiguity: both `/api/auth` and `/api/auth/`
- * match regardless of how `apiRoute` is configured.
- *
- * @param pathname - The request URL pathname.
- * @param apiRoute - The configured proxy route (e.g. `"/api/auth"`).
- * @returns `true` when the pathname matches the proxy route.
- */
-declare function shouldProxyAuthAction(pathname: string, apiRoute: string): boolean;
-/**
- * Create an SSR auth helper for server-side frameworks.
- *
- * Handles cookie-based token management, OAuth code exchange,
- * and automatic JWT refresh on page loads. Works with any
- * framework that gives you a `Request` object — SvelteKit,
- * TanStack Start, Remix, Next.js, etc.
- *
- * @param options - SSR configuration (Convex API URL, issuer rules, proxy route, cookie lifetime).
- * @returns An object with `token`, `verify`, `proxy`, and `refresh` methods.
- *
- * @example SvelteKit hooks
- * ```ts
- * // src/hooks.server.ts
- * import { server } from '@robelest/convex-auth/server';
- *
- * const auth = server({ url: CONVEX_URL });
- *
- * export const handle = async ({ event, resolve }) => {
- *   const { cookies, token } = await auth.refresh(event.request);
- *   for (const c of cookies) event.cookies.set(c.name, c.value, c.options);
- *   event.locals.token = token;
- *   return resolve(event);
- * };
- * ```
- *
- * @example Generic proxy endpoint
- * ```ts
- * if (shouldProxyAuthAction(url.pathname, '/api/auth')) {
- *   return auth.proxy(request);
- * }
- * ```
- */
-declare function server(options: ServerOptions): {
-  /**
-   * Read the JWT from the request cookies without any validation.
-   *
-   * @param request - The incoming HTTP request.
-   * @returns The raw JWT string, or `null` when no token cookie exists.
-   */
-  token(request: Request): string | null;
-  /**
-   * Check whether the request carries a non-expired JWT.
-   *
-   * Performs local expiration checking only (no network call).
-   * Use for lightweight auth guards in middleware.
-   *
-   * @param request - The incoming HTTP request.
-   * @returns `true` when a valid, non-expired JWT exists in the cookies.
-   */
-  verify(request: Request): Promise<boolean>;
-  /**
-   * Handle a proxied `signIn` or `signOut` POST from the client.
-   *
-   * Validates the route, method, and origin, then forwards the
-   * action to Convex and returns a `Response` with updated
-   * `Set-Cookie` headers. The client never sees the real
-   * refresh token — it stays in httpOnly cookies.
-   *
-   * @param request - The incoming POST request from the client.
-   * @returns A JSON `Response` with auth result and cookie headers.
-   */
-  proxy(request: Request): Promise<Response>;
-  /**
-   * Refresh auth tokens on page load.
-   *
-   * Call this in your server hooks/middleware on every request.
-   * It handles three scenarios:
-   *
-   * 1. **OAuth code exchange** — exchanges a `?code=` query param for tokens and returns a redirect URL.
-   * 2. **Token refresh** — refreshes the JWT if it's close to expiry.
-   * 3. **No-op** — returns the existing token when no refresh is needed.
-   *
-   * @param request - The incoming HTTP request.
-   * @returns Structured cookies to set on the response, an optional redirect URL, and the current JWT.
-   */
-  refresh(request: Request): Promise<RefreshResult>;
-};
-//#endregion
-export { AuthCookie, AuthCookieConfig, AuthCookies, EnterpriseAdminAuthorizationInput, EnterpriseAdminPermission, EnterpriseAuthorizer, EnterpriseMountOptions, RefreshResult, ServerOptions, authCookieNames, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };
-//# sourceMappingURL=index.d.ts.map
+import { AuthApi, AuthApiBase, AuthConfig, AuthCtx, ConvexAuthResult, InferAuth, InferClientApi, UserDoc, createAuth } from "./auth.js";
+import { EnterpriseAdminAuthorizationInput, EnterpriseAdminPermission, EnterpriseAuthorizer, EnterpriseMountOptions, enterprise, scim, sso } from "./mounts.js";
+import { AuthCookie, AuthCookieConfig, AuthCookies, RefreshResult, ServerOptions, authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./ssr.js";
+export { type AuthApi, type AuthApiBase, type AuthConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, AuthCtx, type ConvexAuthResult, type EnterpriseAdminAuthorizationInput, type EnterpriseAdminPermission, type EnterpriseAuthorizer, type EnterpriseMountOptions, type InferAuth, type InferClientApi, type RefreshResult, type ServerOptions, type UserDoc, authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };