@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/public/security/limits.js

@@ -0,0 +1,169 @@
+import { mutation, query } from "../../functions.js";
+import { vRateLimitResult } from "../../model.js";
+import { v } from "convex/values";
+
+//#region src/component/public/security/limits.ts
+/**
+* Look up a rate limit entry by its string identifier.
+*
+* Queries the `RateLimit` table using the `by_identifier` unique index.
+* Returns the rate limit state with camelCase field names (`attemptsLeft`,
+* `lastAttemptTime`) mapped from the snake_case storage format. Used to
+* check whether an action should be allowed or throttled.
+*
+* @param identifier - Unique string identifying the rate limit bucket
+*   (e.g. `"login:user@example.com"` or `"api:sk_live_abc123"`).
+* @returns The rate limit state object (including `attemptsLeft` and
+*   `lastAttemptTime`), or `null` if no entry exists for the identifier.
+*
+* @example
+* ```ts
+* const limit = await ctx.runQuery(
+*   components.auth.security.limits.rateLimitGet,
+*   { identifier: `login:${email}` },
+* );
+* if (limit !== null && limit.attemptsLeft <= 0) {
+*   throw new Error("Too many login attempts. Please try again later.");
+* }
+* ```
+*/
+const rateLimitGet = query({
+	args: { identifier: v.string() },
+	returns: v.union(vRateLimitResult, v.null()),
+	handler: async (ctx, { identifier }) => {
+		const row = await ctx.db.query("RateLimit").withIndex("by_identifier", (q) => q.eq("identifier", identifier)).unique();
+		if (row === null) return null;
+		return {
+			...row,
+			attemptsLeft: row.attempts_left,
+			lastAttemptTime: row.last_attempt_time
+		};
+	}
+});
+/**
+* Create a new rate limit entry in the `RateLimit` table.
+*
+* Initializes a rate limit bucket for a given identifier. The entry
+* tracks remaining attempts and the timestamp of the last attempt,
+* storing them in snake_case format internally. Call this when the
+* first rate-limited action occurs for an identifier that does not
+* yet have an entry.
+*
+* @param identifier - Unique string identifying the rate limit bucket
+*   (e.g. `"login:user@example.com"` or `"otp:+15551234567"`).
+* @param attemptsLeft - Number of remaining attempts before the action
+*   is throttled.
+* @param lastAttemptTime - Unix timestamp (in milliseconds) of the
+*   initial attempt.
+* @returns The `_id` of the newly created `RateLimit` document.
+*
+* @example
+* ```ts
+* const rateLimitId = await ctx.runMutation(
+*   components.auth.security.limits.rateLimitCreate,
+*   {
+*     identifier: `login:${email}`,
+*     attemptsLeft: 4, // 5 max minus this attempt
+*     lastAttemptTime: Date.now(),
+*   },
+* );
+* ```
+*/
+const rateLimitCreate = mutation({
+	args: {
+		identifier: v.string(),
+		attemptsLeft: v.number(),
+		lastAttemptTime: v.number()
+	},
+	returns: v.id("RateLimit"),
+	handler: async (ctx, { identifier, attemptsLeft, lastAttemptTime }) => {
+		return await ctx.db.insert("RateLimit", {
+			identifier,
+			attempts_left: attemptsLeft,
+			last_attempt_time: lastAttemptTime
+		});
+	}
+});
+/**
+* Patch a rate limit entry with partial data.
+*
+* Updates an existing `RateLimit` document with the provided fields.
+* Automatically maps camelCase field names (`attemptsLeft`,
+* `lastAttemptTime`) to the snake_case storage format before writing.
+* Typically called to decrement remaining attempts or to reset the
+* bucket after a cooldown window has elapsed.
+*
+* @param rateLimitId - The `_id` of the `RateLimit` document to update.
+* @param data - An object containing the fields to patch. Supports
+*   camelCase names which are transparently converted:
+*   - `attemptsLeft` -- Updated number of remaining attempts.
+*   - `lastAttemptTime` -- Updated timestamp of the most recent attempt.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* // Decrement attempts after a failed login
+* await ctx.runMutation(
+*   components.auth.security.limits.rateLimitPatch,
+*   {
+*     rateLimitId: limit._id,
+*     data: {
+*       attemptsLeft: limit.attemptsLeft - 1,
+*       lastAttemptTime: Date.now(),
+*     },
+*   },
+* );
+* ```
+*/
+const rateLimitPatch = mutation({
+	args: {
+		rateLimitId: v.id("RateLimit"),
+		data: v.any()
+	},
+	returns: v.null(),
+	handler: async (ctx, { rateLimitId, data }) => {
+		const nextData = { ...data };
+		if (nextData.attemptsLeft !== void 0) {
+			nextData.attempts_left = nextData.attemptsLeft;
+			delete nextData.attemptsLeft;
+		}
+		if (nextData.lastAttemptTime !== void 0) {
+			nextData.last_attempt_time = nextData.lastAttemptTime;
+			delete nextData.lastAttemptTime;
+		}
+		await ctx.db.patch("RateLimit", rateLimitId, nextData);
+		return null;
+	}
+});
+/**
+* Delete a rate limit entry from the `RateLimit` table.
+*
+* Permanently removes the rate limit bucket. This effectively resets
+* rate limiting for the associated identifier, allowing the next
+* action to proceed without throttling. Useful for administrative
+* resets or cleanup of expired buckets.
+*
+* @param rateLimitId - The `_id` of the `RateLimit` document to delete.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* // Admin resets a user's login rate limit
+* await ctx.runMutation(
+*   components.auth.security.limits.rateLimitDelete,
+*   { rateLimitId: limit._id },
+* );
+* ```
+*/
+const rateLimitDelete = mutation({
+	args: { rateLimitId: v.id("RateLimit") },
+	returns: v.null(),
+	handler: async (ctx, { rateLimitId }) => {
+		await ctx.db.delete("RateLimit", rateLimitId);
+		return null;
+	}
+});
+
+//#endregion
+export { rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch };
+//# sourceMappingURL=limits.js.map

package/dist/component/public/security/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","names":[],"sources":["../../../../src/component/public/security/limits.ts"],"sourcesContent":["import { v } from \"convex/values\";\nimport { mutation, query } from \"../../functions\";\nimport { vRateLimitResult } from \"../../model\";\n\n/**\n * Look up a rate limit entry by its string identifier.\n *\n * Queries the `RateLimit` table using the `by_identifier` unique index.\n * Returns the rate limit state with camelCase field names (`attemptsLeft`,\n * `lastAttemptTime`) mapped from the snake_case storage format. Used to\n * check whether an action should be allowed or throttled.\n *\n * @param identifier - Unique string identifying the rate limit bucket\n *   (e.g. `\"login:user@example.com\"` or `\"api:sk_live_abc123\"`).\n * @returns The rate limit state object (including `attemptsLeft` and\n *   `lastAttemptTime`), or `null` if no entry exists for the identifier.\n *\n * @example\n * ```ts\n * const limit = await ctx.runQuery(\n *   components.auth.security.limits.rateLimitGet,\n *   { identifier: `login:${email}` },\n * );\n * if (limit !== null && limit.attemptsLeft <= 0) {\n *   throw new Error(\"Too many login attempts. Please try again later.\");\n * }\n * ```\n */\nexport const rateLimitGet = query({\n  args: { identifier: v.string() },\n  returns: v.union(vRateLimitResult, v.null()),\n  handler: async (ctx, { identifier }) => {\n    const row = await ctx.db\n      .query(\"RateLimit\")\n      .withIndex(\"by_identifier\", (q) => q.eq(\"identifier\", identifier))\n      .unique();\n    if (row === null) {\n      return null;\n    }\n    return {\n      ...row,\n      attemptsLeft: row.attempts_left,\n      lastAttemptTime: row.last_attempt_time,\n    };\n  },\n});\n\n/**\n * Create a new rate limit entry in the `RateLimit` table.\n *\n * Initializes a rate limit bucket for a given identifier. The entry\n * tracks remaining attempts and the timestamp of the last attempt,\n * storing them in snake_case format internally. Call this when the\n * first rate-limited action occurs for an identifier that does not\n * yet have an entry.\n *\n * @param identifier - Unique string identifying the rate limit bucket\n *   (e.g. `\"login:user@example.com\"` or `\"otp:+15551234567\"`).\n * @param attemptsLeft - Number of remaining attempts before the action\n *   is throttled.\n * @param lastAttemptTime - Unix timestamp (in milliseconds) of the\n *   initial attempt.\n * @returns The `_id` of the newly created `RateLimit` document.\n *\n * @example\n * ```ts\n * const rateLimitId = await ctx.runMutation(\n *   components.auth.security.limits.rateLimitCreate,\n *   {\n *     identifier: `login:${email}`,\n *     attemptsLeft: 4, // 5 max minus this attempt\n *     lastAttemptTime: Date.now(),\n *   },\n * );\n * ```\n */\nexport const rateLimitCreate = mutation({\n  args: {\n    identifier: v.string(),\n    attemptsLeft: v.number(),\n    lastAttemptTime: v.number(),\n  },\n  returns: v.id(\"RateLimit\"),\n  handler: async (ctx, { identifier, attemptsLeft, lastAttemptTime }) => {\n    return await ctx.db.insert(\"RateLimit\", {\n      identifier,\n      attempts_left: attemptsLeft,\n      last_attempt_time: lastAttemptTime,\n    });\n  },\n});\n\n/**\n * Patch a rate limit entry with partial data.\n *\n * Updates an existing `RateLimit` document with the provided fields.\n * Automatically maps camelCase field names (`attemptsLeft`,\n * `lastAttemptTime`) to the snake_case storage format before writing.\n * Typically called to decrement remaining attempts or to reset the\n * bucket after a cooldown window has elapsed.\n *\n * @param rateLimitId - The `_id` of the `RateLimit` document to update.\n * @param data - An object containing the fields to patch. Supports\n *   camelCase names which are transparently converted:\n *   - `attemptsLeft` -- Updated number of remaining attempts.\n *   - `lastAttemptTime` -- Updated timestamp of the most recent attempt.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // Decrement attempts after a failed login\n * await ctx.runMutation(\n *   components.auth.security.limits.rateLimitPatch,\n *   {\n *     rateLimitId: limit._id,\n *     data: {\n *       attemptsLeft: limit.attemptsLeft - 1,\n *       lastAttemptTime: Date.now(),\n *     },\n *   },\n * );\n * ```\n */\nexport const rateLimitPatch = mutation({\n  args: { rateLimitId: v.id(\"RateLimit\"), data: v.any() },\n  returns: v.null(),\n  handler: async (ctx, { rateLimitId, data }) => {\n    const nextData: Record<string, unknown> = { ...data };\n    if (nextData.attemptsLeft !== undefined) {\n      nextData.attempts_left = nextData.attemptsLeft;\n      delete nextData.attemptsLeft;\n    }\n    if (nextData.lastAttemptTime !== undefined) {\n      nextData.last_attempt_time = nextData.lastAttemptTime;\n      delete nextData.lastAttemptTime;\n    }\n    await ctx.db.patch(\"RateLimit\", rateLimitId, nextData);\n    return null;\n  },\n});\n\n/**\n * Delete a rate limit entry from the `RateLimit` table.\n *\n * Permanently removes the rate limit bucket. This effectively resets\n * rate limiting for the associated identifier, allowing the next\n * action to proceed without throttling. Useful for administrative\n * resets or cleanup of expired buckets.\n *\n * @param rateLimitId - The `_id` of the `RateLimit` document to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // Admin resets a user's login rate limit\n * await ctx.runMutation(\n *   components.auth.security.limits.rateLimitDelete,\n *   { rateLimitId: limit._id },\n * );\n * ```\n */\nexport const rateLimitDelete = mutation({\n  args: { rateLimitId: v.id(\"RateLimit\") },\n  returns: v.null(),\n  handler: async (ctx, { rateLimitId }) => {\n    await ctx.db.delete(\"RateLimit\", rateLimitId);\n    return null;\n  },\n});\n\n// ============================================================================\n// Device Authorization (RFC 8628)\n// ============================================================================\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,eAAe,MAAM;CAChC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE;CAChC,SAAS,EAAE,MAAM,kBAAkB,EAAE,MAAM,CAAC;CAC5C,SAAS,OAAO,KAAK,EAAE,iBAAiB;EACtC,MAAM,MAAM,MAAM,IAAI,GACnB,MAAM,YAAY,CAClB,UAAU,kBAAkB,MAAM,EAAE,GAAG,cAAc,WAAW,CAAC,CACjE,QAAQ;AACX,MAAI,QAAQ,KACV,QAAO;AAET,SAAO;GACL,GAAG;GACH,cAAc,IAAI;GAClB,iBAAiB,IAAI;GACtB;;CAEJ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BF,MAAa,kBAAkB,SAAS;CACtC,MAAM;EACJ,YAAY,EAAE,QAAQ;EACtB,cAAc,EAAE,QAAQ;EACxB,iBAAiB,EAAE,QAAQ;EAC5B;CACD,SAAS,EAAE,GAAG,YAAY;CAC1B,SAAS,OAAO,KAAK,EAAE,YAAY,cAAc,sBAAsB;AACrE,SAAO,MAAM,IAAI,GAAG,OAAO,aAAa;GACtC;GACA,eAAe;GACf,mBAAmB;GACpB,CAAC;;CAEL,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCF,MAAa,iBAAiB,SAAS;CACrC,MAAM;EAAE,aAAa,EAAE,GAAG,YAAY;EAAE,MAAM,EAAE,KAAK;EAAE;CACvD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,aAAa,WAAW;EAC7C,MAAM,WAAoC,EAAE,GAAG,MAAM;AACrD,MAAI,SAAS,iBAAiB,QAAW;AACvC,YAAS,gBAAgB,SAAS;AAClC,UAAO,SAAS;;AAElB,MAAI,SAAS,oBAAoB,QAAW;AAC1C,YAAS,oBAAoB,SAAS;AACtC,UAAO,SAAS;;AAElB,QAAM,IAAI,GAAG,MAAM,aAAa,aAAa,SAAS;AACtD,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,kBAAkB,SAAS;CACtC,MAAM,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE;CACxC,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,kBAAkB;AACvC,QAAM,IAAI,GAAG,OAAO,aAAa,YAAY;AAC7C,SAAO;;CAEV,CAAC"}

package/dist/component/public.d.ts

@@ -1,275 +1,28 @@
+import { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch } from "./public/identity/accounts.js";
+import { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled } from "./public/factors/devices.js";
+import { enterpriseAuditEventCreate, enterpriseAuditEventList } from "./public/enterprise/audit.js";
+import { enterpriseCreate, enterpriseDelete, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseUpdate } from "./public/enterprise/core.js";
+import { enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify } from "./public/enterprise/domains.js";
+import { enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert } from "./public/enterprise/scim.js";
+import { enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert } from "./public/enterprise/secrets.js";
+import { enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate } from "./public/enterprise/webhooks.js";
+import { groupCreate, groupDelete, groupGet, groupList, groupUpdate } from "./public/groups/core.js";
+import { inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke } from "./public/groups/invites.js";
+import { memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate } from "./public/groups/members.js";
+import { keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch } from "./public/security/keys.js";
+import { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta } from "./public/factors/passkeys.js";
+import { rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch } from "./public/security/limits.js";
+import { refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch } from "./public/identity/tokens.js";
+import { sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser } from "./public/identity/sessions.js";
+import { totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed } from "./public/factors/totp.js";
+import { userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert } from "./public/identity/users.js";
+import { verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode } from "./public/identity/codes.js";
+import { verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch } from "./public/identity/verifiers.js";
+
+//#region src/component/public.d.ts
 declare namespace public_d_exports {
-  export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, groupCreate, groupDelete, groupGet, groupList, groupUpdate, inviteAccept, inviteCreate, inviteGet, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyListByUserId, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberListByUser, memberRemove, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };
+  export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate, groupCreate, groupDelete, groupGet, groupList, groupUpdate, inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };
 }
-/**
- * List users with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }` — pass `nextCursor` back as `cursor`
- * for the next page, or `null` when exhausted.
- */
-declare const userList: any;
-/** Retrieve a user by their document ID. */
-declare const userGetById: any;
-/**
- * Find a user by their verified email address. Returns `null` if no user
- * has this email verified, or if multiple users share the same verified email
- * (ambiguous — should not happen in normal operation).
- */
-declare const userFindByVerifiedEmail: any;
-/**
- * Find a user by their verified phone number. Returns `null` if no user
- * has this phone verified, or if multiple users share the same verified phone
- * (ambiguous — should not happen in normal operation).
- */
-declare const userFindByVerifiedPhone: any;
-/** Insert a new user document. */
-declare const userInsert: any;
-/** Insert a new user or update an existing one. */
-declare const userUpsert: any;
-/** Patch an existing user document with partial data. */
-declare const userPatch: any;
-/** List all accounts for a user. */
-declare const accountListByUser: any;
-/** Look up an account by provider and provider-specific account ID. */
-declare const accountGet: any;
-/** Retrieve an account by its document ID. */
-declare const accountGetById: any;
-/** Create a new account linking a user to an auth provider. */
-declare const accountInsert: any;
-/** Patch an existing account document with partial data. */
-declare const accountPatch: any;
-/** Delete an account document. */
-declare const accountDelete: any;
-/**
- * List sessions with optional filtering and pagination.
- *
- * Returns `{ items, nextCursor }`.
- */
-declare const sessionList: any;
-/** Create a new session for a user with an expiration time. */
-declare const sessionCreate: any;
-/** Retrieve a session by its document ID. */
-declare const sessionGetById: any;
-/** Delete a session. No-op if the session does not exist. */
-declare const sessionDelete: any;
-/** List all sessions for a user. */
-declare const sessionListByUser: any;
-/** Create a new PKCE verifier, optionally linked to a session. */
-declare const verifierCreate: any;
-/** Retrieve a verifier by its document ID. */
-declare const verifierGetById: any;
-/** Look up a verifier by its cryptographic signature. */
-declare const verifierGetBySignature: any;
-/** Patch a verifier document with partial data. */
-declare const verifierPatch: any;
-/** Delete a verifier document. */
-declare const verifierDelete: any;
-/** Find a verification code by its associated account ID. */
-declare const verificationCodeGetByAccountId: any;
-/** Find a verification code by its code string. */
-declare const verificationCodeGetByCode: any;
-/** Create a new verification code for OTP, magic link, or OAuth flows. */
-declare const verificationCodeCreate: any;
-/** Delete a verification code document. */
-declare const verificationCodeDelete: any;
-/** Create a new refresh token for a session. */
-declare const refreshTokenCreate: any;
-/** Retrieve a refresh token by its document ID. */
-declare const refreshTokenGetById: any;
-/** Patch a refresh token document with partial data. */
-declare const refreshTokenPatch: any;
-/** Get child tokens that were created by exchanging a specific parent token. */
-declare const refreshTokenGetChildren: any;
-/** List all refresh tokens for a session. */
-declare const refreshTokenListBySession: any;
-/** Delete all refresh tokens for a session. */
-declare const refreshTokenDeleteAll: any;
-/** Get the active (unused) refresh token for a session. */
-declare const refreshTokenGetActive: any;
-/** Store a new passkey credential for a user. */
-declare const passkeyInsert: any;
-/** Look up a passkey by its credential ID. */
-declare const passkeyGetByCredentialId: any;
-/** List all passkeys for a user. */
-declare const passkeyListByUserId: any;
-/** Update a passkey's counter and last used timestamp after authentication. */
-declare const passkeyUpdateCounter: any;
-/** Update a passkey's metadata (name). */
-declare const passkeyUpdateMeta: any;
-/** Delete a passkey credential. */
-declare const passkeyDelete: any;
-/** Store a new TOTP enrollment for a user. */
-declare const totpInsert: any;
-/** Get a verified TOTP enrollment for a user (returns first match). */
-declare const totpGetVerifiedByUserId: any;
-/** List all TOTP enrollments for a user. */
-declare const totpListByUserId: any;
-/** Get a TOTP enrollment by its ID. */
-declare const totpGetById: any;
-/** Mark a TOTP enrollment as verified (setup complete). */
-declare const totpMarkVerified: any;
-/** Update a TOTP enrollment's last used timestamp. */
-declare const totpUpdateLastUsed: any;
-/** Delete a TOTP enrollment. */
-declare const totpDelete: any;
-/** Look up a rate limit entry by its identifier. */
-declare const rateLimitGet: any;
-/** Create a new rate limit entry. */
-declare const rateLimitCreate: any;
-/** Patch a rate limit entry with partial data. */
-declare const rateLimitPatch: any;
-/** Delete a rate limit entry. */
-declare const rateLimitDelete: any;
-/**
- * Create a new group. Groups are hierarchical — set `parentGroupId` to nest
- * under an existing group, or omit it to create a root-level group.
- *
- * @returns The ID of the newly created group.
- */
-declare const groupCreate: any;
-/** Retrieve a group by its document ID. Returns `null` if not found. */
-declare const groupGet: any;
-/**
- * List groups with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Empty `where` returns **all** groups.
- */
-declare const groupList: any;
-/** Update a group's fields (name, slug, tags, extend, parentGroupId). */
-declare const groupUpdate: any;
-/**
- * Delete a group and all of its descendants. This cascades to:
- * - All child groups (recursively)
- * - All members of this group and its descendants
- * - All invites for this group and its descendants
- */
-declare const groupDelete: any;
-/**
- * Add a user as a member of a group.
- *
- * The `role` field is an application-defined string (e.g. "owner", "admin",
- * "member", "viewer"). The auth component stores it but does not enforce
- * access control — your application defines what each role means.
- *
- * Throws `ConvexError` with code `DUPLICATE_MEMBERSHIP` when the user is
- * already a member of the target group.
- *
- * @returns The ID of the new member record.
- */
-declare const memberAdd: any;
-/** Retrieve a member record by its document ID. Returns `null` if not found. */
-declare const memberGet: any;
-/**
- * List members with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Supports filtering by `groupId`,
- * `userId`, `role`, and `status`.
- */
-declare const memberList: any;
-/**
- * @deprecated Use `memberList` with `where: { userId }` instead.
- * Kept for backward compatibility with generated component types.
- */
-declare const memberListByUser: any;
-/**
- * Look up a specific user's membership in a specific group.
- * Returns `null` if the user is not a member of the group.
- */
-declare const memberGetByGroupAndUser: any;
-/** Remove a member from a group by deleting the member record. */
-declare const memberRemove: any;
-/**
- * Update a member record's fields (role, status, extend).
- *
- * Common usage: `memberUpdate({ memberId, data: { role: "admin" } })`
- */
-declare const memberUpdate: any;
-/**
- * Create a new platform-level invitation. Optionally set `groupId` to tie
- * the invite to a specific group. The invitation is sent to an email address
- * and includes a hashed token for secure acceptance.
- *
- * Throws `ConvexError` with code `DUPLICATE_INVITE` when a pending invite
- * already exists for the same email and scope:
- * - group invite: same `email` + same `groupId`
- * - platform invite: same `email` with no `groupId`
- *
- * @returns The ID of the new invite record.
- */
-declare const inviteCreate: any;
-/** Retrieve an invite by its document ID. Returns `null` if not found. */
-declare const inviteGet: any;
-/**
- * List invites with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Supports filtering by `groupId`,
- * `status`, `email`, `invitedByUserId`, `role`, `acceptedByUserId`, and `tokenHash`.
- */
-declare const inviteList: any;
-/**
- * Accept a pending invitation.
- *
- * Marks the invite as "accepted" and records the acceptance timestamp.
- * Throws a structured `ConvexError` when the invite doesn't exist or is not
- * currently pending.
- *
- * The caller is responsible for creating the corresponding member record.
- */
-declare const inviteAccept: any;
-/**
- * Revoke a pending invitation.
- *
- * Marks the invite as "revoked". Throws a structured `ConvexError` when the
- * invite doesn't exist or is not currently pending.
- */
-declare const inviteRevoke: any;
-/**
- * Insert a new API key record.
- *
- * The caller is responsible for hashing the raw key before passing it here —
- * this function only stores the hash and metadata.
- */
-declare const keyInsert: any;
-/**
- * Look up an API key by its SHA-256 hash.
- *
- * Used during Bearer token verification. Returns the full key record
- * (including rate limit state) or `null` if not found.
- */
-declare const keyGetByHashedKey: any;
-/**
- * @deprecated Use `keyList` with `where: { userId }` instead.
- * Kept for backward compatibility with generated component types.
- */
-declare const keyListByUserId: any;
-/**
- * List API keys with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Supports filtering by `userId`,
- * `revoked`, `name`, and `prefix`.
- */
-declare const keyList: any;
-/** Get a single API key by document ID. */
-declare const keyGetById: any;
-/**
- * Patch an API key record. Used for updating name, scopes, rate limit config,
- * revocation, and lastUsedAt / rate limit state tracking.
- */
-declare const keyPatch: any;
-/** Hard delete an API key record. */
-declare const keyDelete: any;
-/** Insert a new device authorization record. */
-declare const deviceInsert: any;
-/** Look up a device authorization by its hashed device code. */
-declare const deviceGetByCodeHash: any;
-/** Look up a pending device authorization by its user code. */
-declare const deviceGetByUserCode: any;
-/** Authorize a device code — link it to a user and session. */
-declare const deviceAuthorize: any;
-/** Update the last-polled timestamp on a device authorization record. */
-declare const deviceUpdateLastPolled: any;
-/** Delete a device authorization record (cleanup after use or expiry). */
-declare const deviceDelete: any;
 //#endregion
-export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, groupCreate, groupDelete, groupGet, groupList, groupUpdate, inviteAccept, inviteCreate, inviteGet, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyListByUserId, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberListByUser, memberRemove, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, public_d_exports, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };
+export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate, groupCreate, groupDelete, groupGet, groupList, groupUpdate, inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, public_d_exports, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };
 //# sourceMappingURL=public.d.ts.map

package/dist/component/public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.ts","names":[],"sources":["../../src/component/public.ts"],"mappings":";;;;;;;;;cAgDa,QAAA;;cAyEA,WAAA;;;;;;cAYA,uBAAA;;;;;;cAiBA,uBAAA;;cAaA,UAAA;;cAQA,UAAA;;cAYA,SAAA;;cAYA,iBAAA;;cAWA,UAAA;;cAaA,cAAA;;cAQA,aAAA;;cAaA,YAAA;;cAQA,aAAA;;;;;;cAgBA,WAAA;;cA4CA,aAAA;;cAWA,cAAA;;cAQA,aAAA;;cAUA,iBAAA;;cAeA,cAAA;;cAQA,eAAA;;cAQA,sBAAA;;cAWA,aAAA;;cAQA,cAAA;;cAYA,8BAAA;;cAWA,yBAAA;;cAWA,sBAAA;;cAgBA,sBAAA;;cAYA,kBAAA;;cAYA,mBAAA;;cAQA,iBAAA;;cAQA,uBAAA;;cAkBA,yBAAA;;cAaA,qBAAA;;cAcA,qBAAA;;cAiBA,aAAA;;cAmBA,wBAAA;;cAWA,mBAAA;AAhcb;AAAA,cA2ca,oBAAA;;cAQA,iBAAA;;cAQA,aAAA;;cAYA,UAAA;;cAgBA,uBAAA;AA1db;AAAA,cAsea,gBAAA;;cAWA,WAAA;;cAQA,gBAAA;;cAQA,kBAAA;;cAQA,UAAA;AApfb;AAAA,cAggBa,YAAA;;cAWA,eAAA;;cAYA,cAAA;;cAQA,eAAA;;;AAvgBb;;;;cAwhBa,WAAA;AA7gBb;AAAA,cA4iBa,QAAA;;;;AA/hBb;;cA2iBa,SAAA;;cAsJA,WAAA;AAzrBb;;;;;AAaA;AAbA,cAkuBa,WAAA;;;;AA7sBb;;;;;AAgBA;;;;cAyvBa,SAAA;AA7sBb;AAAA,cA0uBa,SAAA;;;;AA/tBb;;;cA4uBa,UAAA;;AApuBb;;;cA8yBa,gBAAA;;AApyBb;;;cAkzBa,uBAAA;;cAaA,YAAA;;;;;AAxyBb;cAozBa,YAAA;;;;AA5yBb;;;;;AAWA;;;;cAwzBa,YAAA;AAhzBb;AAAA,cA82Ba,SAAA;;;;AAl2Bb;;;cA+2Ba,UAAA;;AAp2Bb;;;;;AAWA;;;cAw+Ba,YAAA;;AAx9Bb;;;;;cA4/Ba,YAAA;;;;;AAp+Bb;;cAqgCa,SAAA;;;AA7/Bb;;;;cAgiCa,iBAAA;AAxhCb;;;;AAAA,cAsiCa,eAAA;AAphCb;;;;;AAaA;AAbA,cAoiCa,OAAA;;cAkEA,UAAA;;AA3kCb;;;cAslCa,QAAA;;cA2CA,SAAA;;cAoBA,YAAA;;cAkBA,mBAAA;AAnoCb;AAAA,cA8oCa,mBAAA;;cAaA,eAAA;;cAgBA,sBAAA;;cAQA,YAAA"}
+{"version":3,"file":"public.d.ts","names":[],"sources":["../../src/component/public.ts"],"mappings":""}