@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/server/implementation/index.d.ts

@@ -1,870 +0,0 @@
-import { AuthProviderConfig, ConvexAuthConfig, CorsConfig, FunctionReferenceFromExport, HttpKeyContext, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "../types.js";
-import { Doc, KeyDoc, Tokens } from "./types.js";
-import * as convex_server16 from "convex/server";
-import { GenericActionCtx, GenericDataModel, HttpRouter } from "convex/server";
-import { GenericId } from "convex/values";
-
-//#region src/server/implementation/index.d.ts
-/**
- * The type of the signIn Convex Action returned from the auth() helper.
- *
- * This type is exported for implementors of other client integrations.
- * However it is not stable, and may change until this library reaches 1.0.
- */
-type SignInAction = FunctionReferenceFromExport<ReturnType<typeof Auth>["signIn"]>;
-/**
- * The type of the signOut Convex Action returned from the auth() helper.
- *
- * This type is exported for implementors of other client integrations.
- * However it is not stable, and may change until this library reaches 1.0.
- */
-type SignOutAction = FunctionReferenceFromExport<ReturnType<typeof Auth>["signOut"]>;
-/**
- * Configure the Convex Auth library. Returns an object with
- * functions and `auth` helper. You must export the functions
- * from `convex/auth.ts` to make them callable:
- *
- * ```ts filename="convex/auth.ts"
- * import { Auth } from "@robelest/convex-auth/component";
- * import { components } from "./_generated/api";
- *
- * export const { auth, signIn, signOut, store } = Auth({
- *   component: components.auth,
- *   providers: [],
- * });
- * ```
- *
- * @returns An object with fields you should reexport from your
- *          `convex/auth.ts` file.
- */
-declare function Auth(config_: ConvexAuthConfig): {
-  /**
-   * Helper for configuring HTTP actions.
-   */
-  auth: {
-    user: {
-      /**
-       * Get the current user's ID from the auth context, or `null` if
-       * not signed in.
-       *
-       * @param ctx - Any Convex context with an `auth` field (query, mutation, or action).
-       * @returns The user's `Id<"user">`, or `null` when unauthenticated.
-       */
-      current: (ctx: {
-        auth: Auth;
-      }) => Promise<GenericId<"user"> | null>;
-      /**
-       * Get the current user's ID, or throw if not signed in.
-       * Use this when authentication is required.
-       *
-       * @param ctx - Any Convex context with an `auth` field.
-       * @returns The user's `Id<"user">`.
-       * @throws `ConvexError` with code `NOT_SIGNED_IN` when unauthenticated.
-       */
-      require: (ctx: {
-        auth: Auth;
-      }) => Promise<GenericId<"user">>;
-      /**
-       * Retrieve a user document by their ID.
-       *
-       * @param ctx - Convex context with `runQuery`.
-       * @param userId - The user document ID.
-       * @returns The user document, or `null` if not found.
-       */
-      get: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, userId: string) => Promise<any>;
-      /**
-       * List users with optional filters, sorting, and pagination.
-       *
-       * @param opts.where - Optional filters (email, phone, name, anonymous).
-       * @param opts.limit - Max users to return (default 50).
-       * @param opts.cursor - Pagination cursor from a previous page.
-       * @param opts.orderBy - Sort field.
-       * @param opts.order - Sort direction.
-       * @returns `{ items, nextCursor }`.
-       */
-      list: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts?: {
-        where?: UserWhere;
-        limit?: number;
-        cursor?: string | null;
-        orderBy?: UserOrderBy;
-        order?: "asc" | "desc";
-      }) => Promise<any>;
-      /**
-       * Get the currently signed-in user's document, or `null` if not
-       * signed in. Convenience combining `current()` + `get()`.
-       *
-       * @param ctx - Convex context with `auth` and `runQuery`.
-       * @returns The user document, or `null` when unauthenticated.
-       */
-      viewer: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery"> & {
-        auth: Auth;
-      }) => Promise<any>;
-      /**
-       * Update a user document with partial data.
-       *
-       * @param ctx - Convex context with `runMutation`.
-       * @param userId - The user document ID.
-       * @param data - Partial data to merge into the user document.
-       */
-      patch: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, userId: string, data: Record<string, unknown>) => Promise<void>;
-      /**
-       * Query a user's group memberships.
-       */
-      group: {
-        /**
-         * List all groups a user belongs to. Returns member records which
-         * include the `groupId`, `role`, `status`, and `extend` for each.
-         *
-         * This is a convenience wrapper around `auth.group.member.list`
-         * with `where: { userId }`.
-         */
-        list: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts: {
-          userId: string;
-          limit?: number;
-          cursor?: string | null;
-          order?: "asc" | "desc";
-        }) => Promise<any>;
-        /**
-         * Look up a user's membership in a specific group. Returns the member
-         * record (with role, status, extend) or `null` if the user is not
-         * a member.
-         */
-        get: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts: {
-          userId: string;
-          groupId: string;
-        }) => Promise<any>;
-      };
-    };
-    session: {
-      /**
-       * Get the current session ID from the auth context, or `null` if
-       * not signed in.
-       *
-       * @param ctx - Any Convex context with an `auth` field.
-       * @returns The session's `Id<"session">`, or `null` when unauthenticated.
-       */
-      current: (ctx: {
-        auth: Auth;
-      }) => Promise<GenericId<"session"> | null>;
-      /**
-       * Invalidate sessions for a user, optionally preserving specific sessions.
-       *
-       * @param ctx - Convex action context.
-       * @param args.userId - The user whose sessions to invalidate.
-       * @param args.except - Session IDs to preserve (e.g. the current session).
-       */
-      invalidate: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: {
-        userId: GenericId<"user">;
-        except?: GenericId<"session">[];
-      }) => Promise<void>;
-    };
-    account: {
-      /**
-       * Create an account and user for a credentials provider.
-       *
-       * @param ctx - Convex action context.
-       * @param args - Provider ID, account credentials, profile data, and link flags.
-       * @returns `{ account, user }` — the created account and user documents.
-       */
-      create: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: {
-        provider: string;
-        account: {
-          id: string;
-          secret?: string;
-        };
-        profile: Record<string, unknown>;
-        shouldLinkViaEmail?: boolean;
-        shouldLinkViaPhone?: boolean;
-      }) => Promise<{
-        account: Doc<"account">;
-        user: Doc<"user">;
-      }>;
-      /**
-       * Retrieve an account and user for a credentials provider.
-       *
-       * @param ctx - Convex action context.
-       * @param args - Provider ID and account credentials (id, optional secret).
-       * @returns `{ account, user }` — the matched account and user documents.
-       * @throws `ConvexError` with code `ACCOUNT_NOT_FOUND` when no match exists.
-       */
-      get: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: {
-        provider: string;
-        account: {
-          id: string;
-          secret?: string;
-        };
-      }) => Promise<{
-        account: Doc<"account">;
-        user: Doc<"user">;
-      }>;
-      /**
-       * Update account credentials (secret) for an existing account.
-       *
-       * @param ctx - Convex action context.
-       * @param args - Provider ID and new account credentials (id + secret).
-       */
-      update: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: {
-        provider: string;
-        account: {
-          id: string;
-          secret: string;
-        };
-      }) => Promise<void>;
-    };
-    provider: {
-      /**
-       * Sign in via another provider, typically from a credentials flow.
-       *
-       * @param ctx - Convex action context.
-       * @param provider - The provider config to sign in with.
-       * @param args - Optional account ID and params.
-       * @returns `{ userId, sessionId }` on success, or `null`.
-       */
-      signIn: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, provider: AuthProviderConfig, args: {
-        accountId?: GenericId<"account">;
-        params?: Record<string, unknown>;
-      }) => Promise<{
-        userId: GenericId<"user">;
-        sessionId: GenericId<"session">;
-      } | null>;
-    };
-    /**
-     * Hierarchical group management. Groups can nest arbitrarily deep
-     * via `parentGroupId`. A root group has no parent.
-     *
-     * ```ts
-     * const groupId = await auth.group.create(ctx, { name: "Acme Corp" });
-     * const subGroupId = await auth.group.create(ctx, {
-     *   name: "Engineering",
-     *   parentGroupId: groupId,
-     * });
-     * ```
-     */
-    group: {
-      /**
-       * Create a new group. Omit `parentGroupId` for a root-level group,
-       * or provide it to create a nested group.
-       *
-       * @returns The ID of the newly created group.
-       */
-      create: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, data: {
-        name: string;
-        slug?: string;
-        type?: string;
-        parentGroupId?: string;
-        tags?: Array<{
-          key: string;
-          value: string;
-        }>;
-        extend?: Record<string, unknown>;
-      }) => Promise<string>;
-      /**
-       * Retrieve a group by its ID. Returns `null` if not found.
-       */
-      get: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, groupId: string) => Promise<any>;
-      /**
-       * List groups with optional filtering, sorting, and pagination.
-       *
-       * Empty `where` returns **all** groups.
-       *
-       * ```ts
-       * // All groups of type "team"
-       * await auth.group.list(ctx, { where: { type: "team" } });
-       *
-       * // Paginated
-       * const page1 = await auth.group.list(ctx, { limit: 10 });
-       * const page2 = await auth.group.list(ctx, { limit: 10, cursor: page1.nextCursor });
-       * ```
-       */
-      list: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts?: {
-        where?: {
-          slug?: string;
-          type?: string;
-          parentGroupId?: string;
-          name?: string;
-          isRoot?: boolean;
-          tagsAll?: Array<{
-            key: string;
-            value: string;
-          }>;
-          tagsAny?: Array<{
-            key: string;
-            value: string;
-          }>;
-        };
-        limit?: number;
-        cursor?: string | null;
-        orderBy?: "_creationTime" | "name" | "slug" | "type";
-        order?: "asc" | "desc";
-      }) => Promise<any>;
-      /**
-       * Update a group's fields (name, slug, tags, extend, parentGroupId).
-       */
-      update: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, groupId: string, data: Record<string, unknown>) => Promise<void>;
-      /**
-       * Delete a group and cascade to all descendants. Deletes child groups
-       * (recursively), all members, and all invites for this group and its
-       * descendants.
-       */
-      delete: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, groupId: string) => Promise<void>;
-      /**
-       * Manage group membership. A member links a user to a group with an
-       * application-defined role string (e.g. "owner", "admin", "member").
-       *
-       * The auth component stores roles but does not enforce access control.
-       * Your application defines what each role means.
-       */
-      member: {
-        /**
-         * Add a user as a member of a group.
-         *
-         * @param data.groupId - The group to add the member to.
-         * @param data.userId - The user to add.
-         * @param data.role - Application-defined role (e.g. "owner", "admin", "member").
-         * @param data.status - Optional membership status (e.g. "active", "suspended").
-         * @param data.extend - Optional arbitrary JSON extension data.
-         * @throws ConvexError with code `DUPLICATE_MEMBERSHIP` if the user is
-         * already a member of the target group.
-         * @returns The ID of the new member record.
-         */
-        add: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, data: {
-          groupId: string;
-          userId: string;
-          role?: string;
-          status?: string;
-          extend?: Record<string, unknown>;
-        }) => Promise<string>;
-        /**
-         * Retrieve a member record by its ID. Returns `null` if not found.
-         */
-        get: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, memberId: string) => Promise<any>;
-        /**
-         * List members with optional filtering, sorting, and pagination.
-         *
-         * ```ts
-         * // All members of a group
-         * await auth.group.member.list(ctx, { where: { groupId } });
-         *
-         * // Admins only
-         * await auth.group.member.list(ctx, { where: { groupId, role: "admin" } });
-         * ```
-         */
-        list: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts?: {
-          where?: {
-            groupId?: string;
-            userId?: string;
-            role?: string;
-            status?: string;
-          };
-          limit?: number;
-          cursor?: string | null;
-          orderBy?: "_creationTime" | "role" | "status";
-          order?: "asc" | "desc";
-        }) => Promise<any>;
-        /**
-         * Remove a member from a group by deleting the member record.
-         */
-        remove: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, memberId: string) => Promise<void>;
-        /**
-         * Update a member's fields (role, status, extend).
-         *
-         * ```ts
-         * await auth.group.member.update(ctx, memberId, { role: "admin" });
-         * ```
-         */
-        update: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, memberId: string, data: Record<string, unknown>) => Promise<void>;
-      };
-    };
-    /**
-     * Manage platform-level invitations.
-     *
-     * Invites can optionally target a group by setting `groupId`, but they do
-     * not require groups and can be used in apps with user-only collaboration.
-     */
-    invite: {
-      /**
-       * Create a new invitation.
-       *
-       * @param data.groupId - Optional group to invite the user into.
-       * @param data.invitedByUserId - Optional user sending the invitation
-       *   (omit for CLI-generated invites).
-       * @param data.email - Optional email of the invitee (omit for
-       *   CLI-generated invite links where the email is unknown upfront).
-       * @param data.tokenHash - Hashed token for secure acceptance.
-       * @param data.role - Optional role to assign on acceptance.
-       * @param data.status - Initial status (typically "pending").
-       * @param data.expiresTime - Optional expiration timestamp (omit for
-       *   single-use, non-expiring invites).
-       * @param data.extend - Optional arbitrary JSON extension data.
-       * @throws ConvexError with code `DUPLICATE_INVITE` if a pending invite
-       * already exists for this email and scope.
-       * @returns The ID of the new invite record.
-       */
-      create: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, data: {
-        groupId?: string;
-        invitedByUserId?: string;
-        email?: string;
-        tokenHash: string;
-        role?: string;
-        status: "pending" | "accepted" | "revoked" | "expired";
-        expiresTime?: number;
-        extend?: Record<string, unknown>;
-      }) => Promise<string>;
-      /**
-       * Retrieve an invite by its ID. Returns `null` if not found.
-       */
-      get: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, inviteId: string) => Promise<any>;
-      /**
-       * List invites with optional filtering, sorting, and pagination.
-       *
-       * ```ts
-       * // Pending invites for a group
-       * await auth.invite.list(ctx, { where: { groupId, status: "pending" } });
-       * ```
-       */
-      list: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts?: {
-        where?: {
-          tokenHash?: string;
-          groupId?: string;
-          status?: "pending" | "accepted" | "revoked" | "expired";
-          email?: string;
-          invitedByUserId?: string;
-          role?: string;
-          acceptedByUserId?: string;
-        };
-        limit?: number;
-        cursor?: string | null;
-        orderBy?: "_creationTime" | "status" | "email" | "expiresTime" | "acceptedTime";
-        order?: "asc" | "desc";
-      }) => Promise<any>;
-      /**
-       * Accept an invitation. Marks the invite as "accepted" and records
-       * the timestamp. If the invite has a group, the caller is responsible
-       * for creating the member record via `auth.group.member.add` in the
-       * same Convex mutation for transactional safety.
-       *
-       * @param ctx - Convex context with `runMutation`.
-       * @param inviteId - The invite document ID.
-       * @param acceptedByUserId - User accepting the invite (recorded for audit).
-       * @throws `ConvexError` with code `INVITE_NOT_FOUND` when the invite does not exist.
-       * @throws `ConvexError` with code `INVITE_NOT_PENDING` when the invite is not in `pending` status.
-       *
-       * @example
-       * ```ts
-       * export const acceptInvite = mutation({
-       *   args: { inviteId: v.string() },
-       *   handler: async (ctx, { inviteId }) => {
-       *     const userId = await auth.user.require(ctx);
-       *     const invite = await auth.invite.get(ctx, inviteId);
-       *     if (!invite) throw new Error("Invite not found");
-       *
-       *     await auth.invite.accept(ctx, inviteId);
-       *     if (invite.groupId) {
-       *       await auth.group.member.add(ctx, {
-       *         groupId: invite.groupId,
-       *         userId,
-       *         role: invite.role,
-       *       });
-       *     }
-       *   },
-       * });
-       * ```
-       */
-      accept: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, inviteId: string, acceptedByUserId?: string) => Promise<void>;
-      /**
-       * Revoke a pending invitation.
-       *
-       * @param ctx - Convex context with `runMutation`.
-       * @param inviteId - The invite document ID.
-       * @throws `ConvexError` with code `INVITE_NOT_FOUND` when the invite does not exist.
-       * @throws `ConvexError` with code `INVITE_NOT_PENDING` when the invite is not in `pending` status.
-       */
-      revoke: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, inviteId: string) => Promise<void>;
-    };
-    /**
-     * Manage passkey credentials for users.
-     *
-     * ```ts
-     * const passkeys = await auth.passkey.list(ctx, { userId });
-     * await auth.passkey.rename(ctx, passkeyId, "MacBook Touch ID");
-     * await auth.passkey.remove(ctx, passkeyId);
-     * ```
-     */
-    passkey: {
-      /**
-       * List all passkeys for a user.
-       *
-       * @param opts.userId - The user whose passkeys to list.
-       * @returns Array of passkey records with credentialId, name, deviceType,
-       * backedUp, createdAt, and lastUsedAt.
-       */
-      list: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts: {
-        userId: string;
-      }) => Promise<any>;
-      /**
-       * Rename a passkey (set a user-friendly display name).
-       *
-       * @param passkeyId - The passkey document ID.
-       * @param name - New display name (e.g. "MacBook Touch ID").
-       */
-      rename: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, passkeyId: string, name: string) => Promise<void>;
-      /**
-       * Delete a passkey credential.
-       *
-       * @param passkeyId - The passkey document ID to remove.
-       */
-      remove: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, passkeyId: string) => Promise<void>;
-    };
-    /**
-     * Manage TOTP two-factor authentication enrollments for users.
-     *
-     * ```ts
-     * const enrollments = await auth.totp.list(ctx, { userId });
-     * await auth.totp.remove(ctx, totpId);
-     * ```
-     */
-    totp: {
-      /**
-       * List all TOTP enrollments for a user.
-       *
-       * @param opts.userId - The user whose enrollments to list.
-       * @returns Array of TOTP enrollment records.
-       */
-      list: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts: {
-        userId: string;
-      }) => Promise<any>;
-      /**
-       * Delete a TOTP enrollment.
-       *
-       * @param totpId - The TOTP document ID to remove.
-       */
-      remove: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, totpId: string) => Promise<void>;
-    };
-    /**
-     * Manage API keys for programmatic access.
-     *
-     * Keys use SHA-256 hashing (via `@oslojs/crypto`) and support
-     * scoped resource:action permissions with optional per-key rate limiting.
-     *
-     * ```ts
-     * const { keyId, raw } = await auth.key.create(ctx, {
-     *   userId,
-     *   name: "CI Pipeline",
-     *   scopes: [{ resource: "users", actions: ["read", "list"] }],
-     * });
-     * // raw = "sk_live_abc123..." — show once, never stored
-     *
-     * const result = await auth.key.verify(ctx, rawKey);
-     * result.scopes.can("users", "read"); // true
-     * ```
-     */
-    key: {
-      /**
-       * Create a new API key. Returns the raw key **once** — it cannot
-       * be retrieved again after creation.
-       *
-       * @param opts.userId - The user this key belongs to.
-       * @param opts.name - Human-readable name (e.g. "CI Pipeline").
-       * @param opts.scopes - Resource:action permissions for this key.
-       * @param opts.rateLimit - Optional per-key rate limit override.
-       * @param opts.expiresAt - Optional expiration timestamp.
-       * @returns `{ keyId, raw }` where `raw` is the full key string.
-       */
-      create: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, opts: {
-        userId: string;
-        name: string;
-        scopes: KeyScope[];
-        rateLimit?: {
-          maxRequests: number;
-          windowMs: number;
-        };
-        expiresAt?: number;
-      }) => Promise<{
-        keyId: string;
-        raw: string;
-      }>;
-      /**
-       * Verify a raw API key string. Returns the userId and a scope checker
-       * if the key is valid, not revoked, not expired, and not rate-limited.
-       *
-       * Also updates `lastUsedAt` and rate limit state as a side effect.
-       *
-       * @throws Error if the key is invalid, revoked, expired, or rate-limited.
-       */
-      verify: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, rawKey: string) => Promise<{
-        userId: string;
-        keyId: string;
-        scopes: ScopeChecker;
-      }>;
-      /**
-       * List API keys with optional filtering, sorting, and pagination.
-       * Never includes the raw key — only the display prefix.
-       *
-       * ```ts
-       * // All keys for a user
-       * await auth.key.list(ctx, { where: { userId } });
-       *
-       * // Only active (non-revoked)
-       * await auth.key.list(ctx, { where: { userId, revoked: false } });
-       * ```
-       */
-      list: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, opts?: {
-        where?: {
-          userId?: string;
-          revoked?: boolean;
-          name?: string;
-          prefix?: string;
-        };
-        limit?: number;
-        cursor?: string | null;
-        orderBy?: "_creationTime" | "name" | "lastUsedAt" | "expiresAt" | "revoked";
-        order?: "asc" | "desc";
-      }) => Promise<any>;
-      /**
-       * Get a single API key by its document ID.
-       * Returns `null` if not found.
-       */
-      get: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery">, keyId: string) => Promise<KeyDoc | null>;
-      /**
-       * Update an API key's metadata (name, scopes, rate limit).
-       */
-      update: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, keyId: string, data: {
-        name?: string;
-        scopes?: KeyScope[];
-        rateLimit?: {
-          maxRequests: number;
-          windowMs: number;
-        };
-      }) => Promise<void>;
-      /**
-       * Revoke an API key (soft delete). The key record is preserved
-       * for audit purposes but can no longer be used for authentication.
-       */
-      revoke: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, keyId: string) => Promise<void>;
-      /**
-       * Hard delete an API key record.
-       */
-      remove: (ctx: Pick<GenericActionCtx<GenericDataModel>, "runQuery" | "runMutation">, keyId: string) => Promise<void>;
-    };
-    /**
-     * HTTP namespace — route registration and Bearer-authenticated endpoints.
-     */
-    http: {
-      /**
-       * Register core HTTP routes for JWT verification and OAuth sign-in.
-       *
-       * ```ts
-       * import { httpRouter } from "convex/server";
-       * import { auth } from "./auth";
-       *
-       * const http = httpRouter();
-       *
-       * auth.http.add(http);
-       *
-       * export default http;
-       * ```
-       *
-       * The following routes are handled always:
-       *
-       * - `/.well-known/openid-configuration`
-       * - `/.well-known/jwks.json`
-       *
-       * The following routes are handled if OAuth is configured:
-       *
-       * - `/api/auth/signin/*`
-       * - `/api/auth/callback/*`
-       *
-       * @param http your HTTP router
-       */
-      add: (http: HttpRouter) => void;
-      /**
-       * Wrap an HTTP action handler with Bearer token authentication.
-       *
-       * Extracts the `Authorization: Bearer <key>` header, verifies the
-       * API key via `auth.key.verify()`, and injects `ctx.key` with the
-       * verified key info. Returns structured JSON error responses for
-       * missing/invalid/revoked/expired/rate-limited keys.
-       *
-       * If the handler returns a plain object, it is auto-wrapped in a
-       * `200 JSON` response. If it returns a `Response`, CORS headers
-       * are merged and the response is passed through.
-       *
-       * ```ts
-       * const handler = auth.http.action(async (ctx, request) => {
-       *   const data = await ctx.runQuery(api.data.get, { userId: ctx.key.userId });
-       *   return { data };
-       * });
-       * http.route({ path: "/api/data", method: "GET", handler });
-       * ```
-       *
-       * @param handler - Receives enriched `ctx` (with `ctx.key`) and the raw `Request`.
-       * @param options.scope - Optional scope check; returns 403 if the key lacks permission.
-       * @param options.cors - CORS config; defaults to permissive (`*`).
-       */
-      action: (handler: (ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext, request: Request) => Promise<Response | Record<string, unknown>>, options?: {
-        scope?: {
-          resource: string;
-          action: string;
-        };
-        cors?: CorsConfig;
-      }) => convex_server16.PublicHttpAction;
-      /**
-       * Register a Bearer-authenticated route **and** its OPTIONS preflight
-       * in a single call.
-       *
-       * ```ts
-       * auth.http.route(http, {
-       *   path: "/api/messages",
-       *   method: "POST",
-       *   handler: async (ctx, request) => {
-       *     const { body } = await request.json();
-       *     await ctx.runMutation(internal.messages.sendAsUser, {
-       *       userId: ctx.key.userId,
-       *       body,
-       *     });
-       *     return { success: true };
-       *   },
-       * });
-       * ```
-       *
-       * @param http - The Convex HTTP router.
-       * @param routeConfig.path - The URL path to match.
-       * @param routeConfig.method - HTTP method (GET, POST, PUT, PATCH, DELETE).
-       * @param routeConfig.handler - Receives enriched `ctx` (with `ctx.key`) and the raw `Request`.
-       * @param routeConfig.scope - Optional scope check; returns 403 if the key lacks permission.
-       * @param routeConfig.cors - CORS config; defaults to permissive (`*`).
-       */
-      route: (http: HttpRouter, routeConfig: {
-        path: string;
-        method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-        handler: (ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext, request: Request) => Promise<Response | Record<string, unknown>>;
-        scope?: {
-          resource: string;
-          action: string;
-        };
-        cors?: CorsConfig;
-      }) => void;
-    };
-  };
-  /**
-   * Action called by the client to sign the user in.
-   *
-   * Also used for refreshing the session.
-   */
-  signIn: convex_server16.RegisteredAction<"public", {
-    provider?: string | undefined;
-    verifier?: string | undefined;
-    params?: any;
-    refreshToken?: string | undefined;
-    calledBy?: string | undefined;
-  }, Promise<{
-    redirect?: string;
-    verifier?: string;
-    tokens?: Tokens | null;
-    started?: boolean;
-    options?: Record<string, any>;
-    totpRequired?: boolean;
-    totpSetup?: {
-      uri: string;
-      secret: string;
-      totpId: string;
-    };
-    deviceCode?: {
-      deviceCode: string;
-      userCode: string;
-      verificationUri: string;
-      verificationUriComplete: string;
-      expiresIn: number;
-      interval: number;
-    };
-  }>>;
-  /**
-   * Action called by the client to invalidate the current session.
-   */
-  signOut: convex_server16.RegisteredAction<"public", {}, Promise<void>>;
-  /**
-   * Internal mutation used by the library to read and write
-   * to the database during signin and signout.
-   */
-  store: convex_server16.RegisteredMutation<"internal", {
-    args: {
-      sessionId?: string | undefined;
-      type: "signIn";
-      userId: string;
-      generateTokens: boolean;
-    } | {
-      type: "signOut";
-    } | {
-      type: "refreshSession";
-      refreshToken: string;
-    } | {
-      provider?: string | undefined;
-      verifier?: string | undefined;
-      type: "verifyCodeAndSignIn";
-      params: any;
-      generateTokens: boolean;
-      allowExtraProviders: boolean;
-    } | {
-      type: "verifier";
-    } | {
-      type: "verifierSignature";
-      verifier: string;
-      signature: string;
-    } | {
-      type: "userOAuth";
-      provider: string;
-      providerAccountId: string;
-      signature: string;
-      profile: any;
-    } | {
-      email?: string | undefined;
-      phone?: string | undefined;
-      accountId?: string | undefined;
-      type: "createVerificationCode";
-      expirationTime: number;
-      provider: string;
-      code: string;
-      allowExtraProviders: boolean;
-    } | {
-      shouldLinkViaEmail?: boolean | undefined;
-      shouldLinkViaPhone?: boolean | undefined;
-      type: "createAccountFromCredentials";
-      provider: string;
-      account: {
-        secret?: string | undefined;
-        id: string;
-      };
-      profile: any;
-    } | {
-      type: "retrieveAccountWithCredentials";
-      provider: string;
-      account: {
-        secret?: string | undefined;
-        id: string;
-      };
-    } | {
-      type: "modifyAccount";
-      provider: string;
-      account: {
-        id: string;
-        secret: string;
-      };
-    } | {
-      except?: string[] | undefined;
-      type: "invalidateSessions";
-      userId: string;
-    };
-  }, Promise<string | void | {
-    userId: GenericId<"user">;
-    sessionId: GenericId<"session">;
-  } | {
-    token: string;
-    refreshToken: string;
-  } | {
-    account: Doc<"account">;
-    user: Doc<"user">;
-  } | null>>;
-};
-//#endregion
-export { Auth, SignInAction, SignOutAction };
-//# sourceMappingURL=index.d.ts.map