@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/factors/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","names":[],"sources":["../../src/client/factors/passkey.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\n\nimport { base64urlDecode, base64urlEncode } from \"../runtime/browser\";\nimport type {\n  AuthSession,\n  ConvexTransport,\n  PasskeyClient,\n  SignInActionResult,\n  SignInResult,\n} from \"../core/types\";\n\ntype PasskeyDeps = {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => { signIn: any };\n  proxyFetch: (body: Record<string, unknown>) => Promise<any>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthSession | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: string } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n};\n\n/** @internal */\nexport function createPasskeyClient(deps: PasskeyDeps): PasskeyClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } =\n    deps;\n\n  const handleSignedInResult = async (\n    result: SignInActionResult,\n    flow: string,\n  ): Promise<SignInResult> => {\n    return Fx.run(\n      Fx.match(result, result.kind, {\n        signedIn: (signedInResult) =>\n          Fx.from({\n            ok: async () => {\n              const signingIn = await setTokenAndMaybeWait(\n                proxy\n                  ? {\n                      shouldStore: false as const,\n                      tokens:\n                        signedInResult.tokens === null\n                          ? null\n                          : { token: signedInResult.tokens.token },\n                      waitForHandshake: true,\n                      context: { provider: \"passkey\", flow },\n                    }\n                  : {\n                      shouldStore: true as const,\n                      tokens: signedInResult.tokens,\n                      waitForHandshake: true,\n                      context: { provider: \"passkey\", flow },\n                    },\n              );\n              return signingIn\n                ? ({ kind: \"signedIn\" as const } as SignInResult)\n                : ({ kind: \"started\" as const } as SignInResult);\n            },\n            err: (e) => e as never,\n          }),\n        redirect: () => Fx.succeed({ kind: \"started\" as const }),\n        started: () => Fx.succeed({ kind: \"started\" as const }),\n        passkeyOptions: () => Fx.succeed({ kind: \"started\" as const }),\n        totpRequired: () => Fx.succeed({ kind: \"started\" as const }),\n        totpSetup: () => Fx.succeed({ kind: \"started\" as const }),\n        deviceCode: () => Fx.succeed({ kind: \"started\" as const }),\n      }),\n    );\n  };\n\n  return {\n    isSupported: (): boolean => {\n      return (\n        typeof window !== \"undefined\" &&\n        typeof window.PublicKeyCredential !== \"undefined\"\n      );\n    },\n\n    isAutofillSupported: async (): Promise<boolean> => {\n      if (typeof window === \"undefined\") return false;\n      if (typeof window.PublicKeyCredential === \"undefined\") return false;\n      if (\n        typeof (window.PublicKeyCredential as any)\n          .isConditionalMediationAvailable !== \"function\"\n      ) {\n        return false;\n      }\n      return (\n        window.PublicKeyCredential as any\n      ).isConditionalMediationAvailable();\n    },\n\n    register: async (opts?: {\n      name?: string;\n      email?: string;\n      userName?: string;\n      userDisplayName?: string;\n    }): Promise<SignInResult> => {\n      const phase1Params = {\n        flow: \"registerOptions\",\n        email: opts?.email,\n        userName: opts?.userName,\n        userDisplayName: opts?.userDisplayName,\n      };\n\n      let phase1Result: SignInActionResult;\n      if (proxy) {\n        phase1Result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"passkey\", params: phase1Params },\n        })) as SignInActionResult;\n      } else {\n        phase1Result = (await convex.action(requireApiRefs().signIn, {\n          provider: \"passkey\",\n          params: phase1Params,\n        })) as SignInActionResult;\n      }\n\n      if (phase1Result.kind !== \"passkeyOptions\") {\n        throw new Error(\"Server did not return passkey registration options\");\n      }\n\n      const options = phase1Result.options;\n      const createOptions: CredentialCreationOptions = {\n        publicKey: {\n          rp: options.rp,\n          user: {\n            id: base64urlDecode(options.user.id).buffer as ArrayBuffer,\n            name: options.user.name,\n            displayName: options.user.displayName,\n          },\n          challenge: base64urlDecode(options.challenge).buffer as ArrayBuffer,\n          pubKeyCredParams: options.pubKeyCredParams,\n          timeout: options.timeout,\n          attestation: options.attestation,\n          authenticatorSelection: options.authenticatorSelection,\n          excludeCredentials: (options.excludeCredentials ?? []).map(\n            (cred: any) => ({\n              type: cred.type ?? \"public-key\",\n              id: base64urlDecode(cred.id).buffer as ArrayBuffer,\n              transports: cred.transports,\n            }),\n          ),\n        },\n      };\n\n      const credential = (await navigator.credentials.create(\n        createOptions,\n      )) as PublicKeyCredential | null;\n      if (!credential) {\n        throw new Error(\"Passkey registration was cancelled\");\n      }\n\n      const response = credential.response as AuthenticatorAttestationResponse;\n      const transports =\n        typeof response.getTransports === \"function\"\n          ? response.getTransports()\n          : undefined;\n\n      const phase2Params = {\n        flow: \"registerVerify\",\n        clientDataJSON: base64urlEncode(response.clientDataJSON),\n        attestationObject: base64urlEncode(response.attestationObject),\n        transports,\n        passkeyName: opts?.name,\n        email: opts?.email,\n      };\n\n      let phase2Result: SignInActionResult;\n      if (proxy) {\n        phase2Result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: {\n            provider: \"passkey\",\n            params: phase2Params,\n            verifier: phase1Result.verifier,\n          },\n        })) as SignInActionResult;\n      } else {\n        phase2Result = (await convex.action(requireApiRefs().signIn, {\n          provider: \"passkey\",\n          params: phase2Params,\n          verifier: phase1Result.verifier,\n        })) as SignInActionResult;\n      }\n\n      return handleSignedInResult(phase2Result, \"registerVerify\");\n    },\n\n    authenticate: async (opts?: {\n      email?: string;\n      autofill?: boolean;\n    }): Promise<SignInResult> => {\n      const phase1Params = {\n        flow: \"authOptions\",\n        email: opts?.email,\n      };\n\n      let phase1Result: SignInActionResult;\n      if (proxy) {\n        phase1Result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"passkey\", params: phase1Params },\n        })) as SignInActionResult;\n      } else {\n        phase1Result = (await convex.action(requireApiRefs().signIn, {\n          provider: \"passkey\",\n          params: phase1Params,\n        })) as SignInActionResult;\n      }\n\n      if (phase1Result.kind !== \"passkeyOptions\") {\n        throw new Error(\"Server did not return passkey authentication options\");\n      }\n\n      const options = phase1Result.options;\n      const getOptions: CredentialRequestOptions = {\n        publicKey: {\n          challenge: base64urlDecode(options.challenge).buffer as ArrayBuffer,\n          timeout: options.timeout,\n          rpId: options.rpId,\n          userVerification: options.userVerification,\n          allowCredentials: (options.allowCredentials ?? []).map(\n            (cred: any) => ({\n              type: cred.type ?? \"public-key\",\n              id: base64urlDecode(cred.id).buffer as ArrayBuffer,\n              transports: cred.transports,\n            }),\n          ),\n        },\n        ...(opts?.autofill ? { mediation: \"conditional\" as any } : {}),\n      };\n\n      const credential = (await navigator.credentials.get(\n        getOptions,\n      )) as PublicKeyCredential | null;\n      if (!credential) {\n        throw new Error(\"Passkey authentication was cancelled\");\n      }\n\n      const response = credential.response as AuthenticatorAssertionResponse;\n      const phase2Params = {\n        flow: \"authVerify\",\n        credentialId: base64urlEncode(credential.rawId),\n        clientDataJSON: base64urlEncode(response.clientDataJSON),\n        authenticatorData: base64urlEncode(response.authenticatorData),\n        signature: base64urlEncode(response.signature),\n      };\n\n      let phase2Result: SignInActionResult;\n      if (proxy) {\n        phase2Result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: {\n            provider: \"passkey\",\n            params: phase2Params,\n            verifier: phase1Result.verifier,\n          },\n        })) as SignInActionResult;\n      } else {\n        phase2Result = (await convex.action(requireApiRefs().signIn, {\n          provider: \"passkey\",\n          params: phase2Params,\n          verifier: phase1Result.verifier,\n        })) as SignInActionResult;\n      }\n\n      return handleSignedInResult(phase2Result, \"authVerify\");\n    },\n  };\n}\n"],"mappings":";;;;;AAkCA,SAAgB,oBAAoB,MAAkC;CACpE,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBACjD;CAEF,MAAM,uBAAuB,OAC3B,QACA,SAC0B;AAC1B,SAAO,GAAG,IACR,GAAG,MAAM,QAAQ,OAAO,MAAM;GAC5B,WAAW,mBACT,GAAG,KAAK;IACN,IAAI,YAAY;AAmBd,YAlBkB,MAAM,qBACtB,QACI;MACE,aAAa;MACb,QACE,eAAe,WAAW,OACtB,OACA,EAAE,OAAO,eAAe,OAAO,OAAO;MAC5C,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAW;OAAM;MACvC,GACD;MACE,aAAa;MACb,QAAQ,eAAe;MACvB,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAW;OAAM;MACvC,CACN,GAEI,EAAE,MAAM,YAAqB,GAC7B,EAAE,MAAM,WAAoB;;IAEnC,MAAM,MAAM;IACb,CAAC;GACJ,gBAAgB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GACxD,eAAe,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GACvD,sBAAsB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GAC9D,oBAAoB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GAC5D,iBAAiB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GACzD,kBAAkB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GAC3D,CAAC,CACH;;AAGH,QAAO;EACL,mBAA4B;AAC1B,UACE,OAAO,WAAW,eAClB,OAAO,OAAO,wBAAwB;;EAI1C,qBAAqB,YAA8B;AACjD,OAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,OAAI,OAAO,OAAO,wBAAwB,YAAa,QAAO;AAC9D,OACE,OAAQ,OAAO,oBACZ,oCAAoC,WAEvC,QAAO;AAET,UACE,OAAO,oBACP,iCAAiC;;EAGrC,UAAU,OAAO,SAKY;GAC3B,MAAM,eAAe;IACnB,MAAM;IACN,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,iBAAiB,MAAM;IACxB;GAED,IAAI;AACJ,OAAI,MACF,gBAAgB,MAAM,WAAW;IAC/B,QAAQ;IACR,MAAM;KAAE,UAAU;KAAW,QAAQ;KAAc;IACpD,CAAC;OAEF,gBAAgB,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV,QAAQ;IACT,CAAC;AAGJ,OAAI,aAAa,SAAS,iBACxB,OAAM,IAAI,MAAM,qDAAqD;GAGvE,MAAM,UAAU,aAAa;GAC7B,MAAM,gBAA2C,EAC/C,WAAW;IACT,IAAI,QAAQ;IACZ,MAAM;KACJ,IAAI,gBAAgB,QAAQ,KAAK,GAAG,CAAC;KACrC,MAAM,QAAQ,KAAK;KACnB,aAAa,QAAQ,KAAK;KAC3B;IACD,WAAW,gBAAgB,QAAQ,UAAU,CAAC;IAC9C,kBAAkB,QAAQ;IAC1B,SAAS,QAAQ;IACjB,aAAa,QAAQ;IACrB,wBAAwB,QAAQ;IAChC,qBAAqB,QAAQ,sBAAsB,EAAE,EAAE,KACpD,UAAe;KACd,MAAM,KAAK,QAAQ;KACnB,IAAI,gBAAgB,KAAK,GAAG,CAAC;KAC7B,YAAY,KAAK;KAClB,EACF;IACF,EACF;GAED,MAAM,aAAc,MAAM,UAAU,YAAY,OAC9C,cACD;AACD,OAAI,CAAC,WACH,OAAM,IAAI,MAAM,qCAAqC;GAGvD,MAAM,WAAW,WAAW;GAC5B,MAAM,aACJ,OAAO,SAAS,kBAAkB,aAC9B,SAAS,eAAe,GACxB;GAEN,MAAM,eAAe;IACnB,MAAM;IACN,gBAAgB,gBAAgB,SAAS,eAAe;IACxD,mBAAmB,gBAAgB,SAAS,kBAAkB;IAC9D;IACA,aAAa,MAAM;IACnB,OAAO,MAAM;IACd;GAED,IAAI;AACJ,OAAI,MACF,gBAAgB,MAAM,WAAW;IAC/B,QAAQ;IACR,MAAM;KACJ,UAAU;KACV,QAAQ;KACR,UAAU,aAAa;KACxB;IACF,CAAC;OAEF,gBAAgB,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV,QAAQ;IACR,UAAU,aAAa;IACxB,CAAC;AAGJ,UAAO,qBAAqB,cAAc,iBAAiB;;EAG7D,cAAc,OAAO,SAGQ;GAC3B,MAAM,eAAe;IACnB,MAAM;IACN,OAAO,MAAM;IACd;GAED,IAAI;AACJ,OAAI,MACF,gBAAgB,MAAM,WAAW;IAC/B,QAAQ;IACR,MAAM;KAAE,UAAU;KAAW,QAAQ;KAAc;IACpD,CAAC;OAEF,gBAAgB,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV,QAAQ;IACT,CAAC;AAGJ,OAAI,aAAa,SAAS,iBACxB,OAAM,IAAI,MAAM,uDAAuD;GAGzE,MAAM,UAAU,aAAa;GAC7B,MAAM,aAAuC;IAC3C,WAAW;KACT,WAAW,gBAAgB,QAAQ,UAAU,CAAC;KAC9C,SAAS,QAAQ;KACjB,MAAM,QAAQ;KACd,kBAAkB,QAAQ;KAC1B,mBAAmB,QAAQ,oBAAoB,EAAE,EAAE,KAChD,UAAe;MACd,MAAM,KAAK,QAAQ;MACnB,IAAI,gBAAgB,KAAK,GAAG,CAAC;MAC7B,YAAY,KAAK;MAClB,EACF;KACF;IACD,GAAI,MAAM,WAAW,EAAE,WAAW,eAAsB,GAAG,EAAE;IAC9D;GAED,MAAM,aAAc,MAAM,UAAU,YAAY,IAC9C,WACD;AACD,OAAI,CAAC,WACH,OAAM,IAAI,MAAM,uCAAuC;GAGzD,MAAM,WAAW,WAAW;GAC5B,MAAM,eAAe;IACnB,MAAM;IACN,cAAc,gBAAgB,WAAW,MAAM;IAC/C,gBAAgB,gBAAgB,SAAS,eAAe;IACxD,mBAAmB,gBAAgB,SAAS,kBAAkB;IAC9D,WAAW,gBAAgB,SAAS,UAAU;IAC/C;GAED,IAAI;AACJ,OAAI,MACF,gBAAgB,MAAM,WAAW;IAC/B,QAAQ;IACR,MAAM;KACJ,UAAU;KACV,QAAQ;KACR,UAAU,aAAa;KACxB;IACF,CAAC;OAEF,gBAAgB,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV,QAAQ;IACR,UAAU,aAAa;IACxB,CAAC;AAGJ,UAAO,qBAAqB,cAAc,aAAa;;EAE1D"}

package/dist/factors/totp.js

@@ -0,0 +1,122 @@
+//#region src/client/factors/totp.ts
+/** @internal */
+function createTotpClient(deps) {
+	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
+	return {
+		setup: async (opts) => {
+			const params = { flow: "setup" };
+			if (opts?.name) params.name = opts.name;
+			if (opts?.accountName) params.accountName = opts.accountName;
+			if (proxy) {
+				const result$1 = await proxyFetch({
+					action: "auth:signIn",
+					args: {
+						provider: "totp",
+						params
+					}
+				});
+				return {
+					uri: result$1.totpSetup.uri,
+					secret: result$1.totpSetup.secret,
+					verifier: result$1.verifier,
+					totpId: result$1.totpSetup.totpId
+				};
+			}
+			const result = await convex.action(requireApiRefs().signIn, {
+				provider: "totp",
+				params
+			});
+			return {
+				uri: result.totpSetup.uri,
+				secret: result.totpSetup.secret,
+				verifier: result.verifier,
+				totpId: result.totpSetup.totpId
+			};
+		},
+		confirm: async (opts) => {
+			const params = {
+				flow: "confirm",
+				code: opts.code,
+				totpId: opts.totpId
+			};
+			if (proxy) {
+				const result$1 = await proxyFetch({
+					action: "auth:signIn",
+					args: {
+						provider: "totp",
+						params,
+						verifier: opts.verifier
+					}
+				});
+				if (result$1.tokens) await setTokenAndMaybeWait({
+					shouldStore: false,
+					tokens: result$1.tokens === null ? null : { token: result$1.tokens.token },
+					waitForHandshake: true,
+					context: {
+						provider: "totp",
+						flow: "confirm"
+					}
+				});
+				return;
+			}
+			const result = await convex.action(requireApiRefs().signIn, {
+				provider: "totp",
+				params,
+				verifier: opts.verifier
+			});
+			if (result.tokens) await setTokenAndMaybeWait({
+				shouldStore: true,
+				tokens: result.tokens ?? null,
+				waitForHandshake: true,
+				context: {
+					provider: "totp",
+					flow: "confirm"
+				}
+			});
+		},
+		verify: async (opts) => {
+			const params = {
+				flow: "verify",
+				code: opts.code
+			};
+			if (proxy) {
+				const result$1 = await proxyFetch({
+					action: "auth:signIn",
+					args: {
+						provider: "totp",
+						params,
+						verifier: opts.verifier
+					}
+				});
+				if (result$1.tokens) await setTokenAndMaybeWait({
+					shouldStore: false,
+					tokens: result$1.tokens === null ? null : { token: result$1.tokens.token },
+					waitForHandshake: true,
+					context: {
+						provider: "totp",
+						flow: "verify"
+					}
+				});
+				return;
+			}
+			const result = await convex.action(requireApiRefs().signIn, {
+				provider: "totp",
+				params,
+				verifier: opts.verifier
+			});
+			if (result.tokens) await setTokenAndMaybeWait({
+				shouldStore: true,
+				tokens: result.tokens ?? null,
+				waitForHandshake: true,
+				context: {
+					provider: "totp",
+					flow: "verify"
+				}
+			});
+		}
+	};
+}
+
+//#endregion
+export { createTotpClient };
+//# sourceMappingURL=totp.js.map

package/dist/factors/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","names":["result"],"sources":["../../src/client/factors/totp.ts"],"sourcesContent":["import type { AuthSession, ConvexTransport, TotpClient } from \"../core/types\";\n\ntype TotpDeps = {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => { signIn: any };\n  proxyFetch: (body: Record<string, unknown>) => Promise<any>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthSession | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: string } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n};\n\n/** @internal */\nexport function createTotpClient(deps: TotpDeps): TotpClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } =\n    deps;\n\n  return {\n    setup: async (opts?: {\n      name?: string;\n      accountName?: string;\n    }): Promise<{\n      uri: string;\n      secret: string;\n      verifier: string;\n      totpId: string;\n    }> => {\n      const params: Record<string, any> = { flow: \"setup\" };\n      if (opts?.name) params.name = opts.name;\n      if (opts?.accountName) params.accountName = opts.accountName;\n\n      if (proxy) {\n        const result = await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"totp\", params },\n        });\n        return {\n          uri: result.totpSetup.uri,\n          secret: result.totpSetup.secret,\n          verifier: result.verifier,\n          totpId: result.totpSetup.totpId,\n        };\n      }\n\n      const result = await convex.action(requireApiRefs().signIn, {\n        provider: \"totp\",\n        params,\n      });\n      return {\n        uri: result.totpSetup.uri,\n        secret: result.totpSetup.secret,\n        verifier: result.verifier,\n        totpId: result.totpSetup.totpId,\n      };\n    },\n\n    confirm: async (opts: {\n      code: string;\n      verifier: string;\n      totpId: string;\n    }): Promise<void> => {\n      const params: Record<string, any> = {\n        flow: \"confirm\",\n        code: opts.code,\n        totpId: opts.totpId,\n      };\n\n      if (proxy) {\n        const result = await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"totp\", params, verifier: opts.verifier },\n        });\n        if (result.tokens) {\n          await setTokenAndMaybeWait({\n            shouldStore: false,\n            tokens:\n              result.tokens === null ? null : { token: result.tokens.token },\n            waitForHandshake: true,\n            context: { provider: \"totp\", flow: \"confirm\" },\n          });\n        }\n        return;\n      }\n\n      const result = await convex.action(requireApiRefs().signIn, {\n        provider: \"totp\",\n        params,\n        verifier: opts.verifier,\n      });\n      if (result.tokens) {\n        await setTokenAndMaybeWait({\n          shouldStore: true,\n          tokens: (result.tokens as AuthSession | null) ?? null,\n          waitForHandshake: true,\n          context: { provider: \"totp\", flow: \"confirm\" },\n        });\n      }\n    },\n\n    verify: async (opts: { code: string; verifier: string }): Promise<void> => {\n      const params: Record<string, any> = {\n        flow: \"verify\",\n        code: opts.code,\n      };\n\n      if (proxy) {\n        const result = await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"totp\", params, verifier: opts.verifier },\n        });\n        if (result.tokens) {\n          await setTokenAndMaybeWait({\n            shouldStore: false,\n            tokens:\n              result.tokens === null ? null : { token: result.tokens.token },\n            waitForHandshake: true,\n            context: { provider: \"totp\", flow: \"verify\" },\n          });\n        }\n        return;\n      }\n\n      const result = await convex.action(requireApiRefs().signIn, {\n        provider: \"totp\",\n        params,\n        verifier: opts.verifier,\n      });\n      if (result.tokens) {\n        await setTokenAndMaybeWait({\n          shouldStore: true,\n          tokens: (result.tokens as AuthSession | null) ?? null,\n          waitForHandshake: true,\n          context: { provider: \"totp\", flow: \"verify\" },\n        });\n      }\n    },\n  };\n}\n"],"mappings":";;AAyBA,SAAgB,iBAAiB,MAA4B;CAC3D,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBACjD;AAEF,QAAO;EACL,OAAO,OAAO,SAQR;GACJ,MAAM,SAA8B,EAAE,MAAM,SAAS;AACrD,OAAI,MAAM,KAAM,QAAO,OAAO,KAAK;AACnC,OAAI,MAAM,YAAa,QAAO,cAAc,KAAK;AAEjD,OAAI,OAAO;IACT,MAAMA,WAAS,MAAM,WAAW;KAC9B,QAAQ;KACR,MAAM;MAAE,UAAU;MAAQ;MAAQ;KACnC,CAAC;AACF,WAAO;KACL,KAAKA,SAAO,UAAU;KACtB,QAAQA,SAAO,UAAU;KACzB,UAAUA,SAAO;KACjB,QAAQA,SAAO,UAAU;KAC1B;;GAGH,MAAM,SAAS,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC1D,UAAU;IACV;IACD,CAAC;AACF,UAAO;IACL,KAAK,OAAO,UAAU;IACtB,QAAQ,OAAO,UAAU;IACzB,UAAU,OAAO;IACjB,QAAQ,OAAO,UAAU;IAC1B;;EAGH,SAAS,OAAO,SAIK;GACnB,MAAM,SAA8B;IAClC,MAAM;IACN,MAAM,KAAK;IACX,QAAQ,KAAK;IACd;AAED,OAAI,OAAO;IACT,MAAMA,WAAS,MAAM,WAAW;KAC9B,QAAQ;KACR,MAAM;MAAE,UAAU;MAAQ;MAAQ,UAAU,KAAK;MAAU;KAC5D,CAAC;AACF,QAAIA,SAAO,OACT,OAAM,qBAAqB;KACzB,aAAa;KACb,QACEA,SAAO,WAAW,OAAO,OAAO,EAAE,OAAOA,SAAO,OAAO,OAAO;KAChE,kBAAkB;KAClB,SAAS;MAAE,UAAU;MAAQ,MAAM;MAAW;KAC/C,CAAC;AAEJ;;GAGF,MAAM,SAAS,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC1D,UAAU;IACV;IACA,UAAU,KAAK;IAChB,CAAC;AACF,OAAI,OAAO,OACT,OAAM,qBAAqB;IACzB,aAAa;IACb,QAAS,OAAO,UAAiC;IACjD,kBAAkB;IAClB,SAAS;KAAE,UAAU;KAAQ,MAAM;KAAW;IAC/C,CAAC;;EAIN,QAAQ,OAAO,SAA4D;GACzE,MAAM,SAA8B;IAClC,MAAM;IACN,MAAM,KAAK;IACZ;AAED,OAAI,OAAO;IACT,MAAMA,WAAS,MAAM,WAAW;KAC9B,QAAQ;KACR,MAAM;MAAE,UAAU;MAAQ;MAAQ,UAAU,KAAK;MAAU;KAC5D,CAAC;AACF,QAAIA,SAAO,OACT,OAAM,qBAAqB;KACzB,aAAa;KACb,QACEA,SAAO,WAAW,OAAO,OAAO,EAAE,OAAOA,SAAO,OAAO,OAAO;KAChE,kBAAkB;KAClB,SAAS;MAAE,UAAU;MAAQ,MAAM;MAAU;KAC9C,CAAC;AAEJ;;GAGF,MAAM,SAAS,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC1D,UAAU;IACV;IACA,UAAU,KAAK;IAChB,CAAC;AACF,OAAI,OAAO,OACT,OAAM,qBAAqB;IACzB,aAAa;IACb,QAAS,OAAO,UAAiC;IACjD,kBAAkB;IAClB,SAAS;KAAE,UAAU;KAAQ,MAAM;KAAU;IAC9C,CAAC;;EAGP"}

package/dist/providers/anonymous.d.ts

@@ -1,4 +1,4 @@
-import { ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
+import { GenericActionCtxWithAuthConfig } from "../server/types.js";
 import { DocumentByName, GenericDataModel, WithoutSystemFields } from "convex/server";
 import { Value } from "convex/values";
 
@@ -25,7 +25,7 @@ interface AnonymousConfig<DataModel extends GenericDataModel> {
    * Convex ActionCtx in case you want to read from or write to
    * the database.
    */
-  ctx: GenericActionCtxWithAuthConfig<DataModel>) => WithoutSystemFields<DocumentByName<DataModel, "user">> & {
+  ctx: GenericActionCtxWithAuthConfig<DataModel>) => WithoutSystemFields<DocumentByName<DataModel, "User">> & {
     isAnonymous: true;
   };
 }
@@ -48,13 +48,7 @@ declare class Anonymous<DataModel extends GenericDataModel = GenericDataModel> {
   readonly type: "credentials";
   readonly config: AnonymousConfig<DataModel>;
   constructor(config?: AnonymousConfig<DataModel>);
-  /** @internal Convert to the internal materialized config shape. */
-  _toMaterialized(): ConvexCredentialsConfig;
 }
-/**
- * @deprecated Use `new Anonymous(config)` instead.
- */
-declare function anonymous<DataModel extends GenericDataModel>(config?: AnonymousConfig<DataModel>): ConvexCredentialsConfig;
 //#endregion
-export { Anonymous, AnonymousConfig, anonymous as default };
+export { Anonymous, AnonymousConfig };
 //# sourceMappingURL=anonymous.d.ts.map

package/dist/providers/anonymous.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous.d.ts","names":[],"sources":["../../src/providers/anonymous.ts"],"mappings":";;;;;;;;UA2BiB,eAAA,mBAAkC,gBAAA;EAAlB;;;;EAK/B,EAAA;EASyB;;;;EAJzB,OAAA;EAUK;;;EANH,MAAA,EAAQ,MAAA,SAAe,KAAA;EAOZ;;AAkBf;;EApBI,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,mBAAA,CAAoB,cAAA,CAAe,SAAA;IACtC,WAAA;EAAA;AAAA;;;;;;;;;;;;;;;cAkBS,SAAA,mBAA4B,gBAAA,GAAmB,gBAAA;EAAA,SACjD,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,eAAA,CAAgB,SAAA;cAErB,MAAA,GAAQ,eAAA,CAAgB,SAAA;EAMjB;EAAnB,eAAA,CAAA,GAAmB,uBAAA;AAAA;AAkBpB;;;AAAA,iBASuB,SAAA,mBAA4B,gBAAA,CAAA,CAClD,MAAA,GAAQ,eAAA,CAAgB,SAAA,IACvB,uBAAA"}
+{"version":3,"file":"anonymous.d.ts","names":[],"sources":["../../src/providers/anonymous.ts"],"mappings":";;;;;;;;UA4BiB,eAAA,mBAAkC,gBAAA;EAAlB;;;;EAK/B,EAAA;EASyB;;;;EAJzB,OAAA;EAUK;;;EANH,MAAA,EAAQ,MAAA,SAAe,KAAA;EAOZ;;AAkBf;;EApBI,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,mBAAA,CAAoB,cAAA,CAAe,SAAA;IACtC,WAAA;EAAA;AAAA;;;;;;;;;;;;;;;cAkBS,SAAA,mBAA4B,gBAAA,GAAmB,gBAAA;EAAA,SACjD,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,eAAA,CAAgB,SAAA;cAG/B,MAAA,GAAQ,eAAA,CAAgB,SAAA;AAAA"}

package/dist/providers/anonymous.js

@@ -4,17 +4,6 @@ import { Credentials } from "./credentials.js";
 /**
 * Anonymous authentication provider.
 *
-* ```ts
-* import { Anonymous } from "@robelest/convex-auth/providers";
-*
-* new Anonymous()
-* ```
-*
-* @module
-*/
-/**
-* Anonymous authentication provider.
-*
 * Creates a new anonymous user account without requiring any
 * user-provided information. Useful for guest access or
 * progressive profiling.
@@ -53,13 +42,7 @@ var Anonymous = class {
 		})._toMaterialized();
 	}
 };
-/**
-* @deprecated Use `new Anonymous(config)` instead.
-*/
-function anonymous(config = {}) {
-	return new Anonymous(config)._toMaterialized();
-}
 
 //#endregion
-export { Anonymous, anonymous as default };
+export { Anonymous };
 //# sourceMappingURL=anonymous.js.map

package/dist/providers/anonymous.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous.js","names":[],"sources":["../../src/providers/anonymous.ts"],"sourcesContent":["/**\n * Anonymous authentication provider.\n *\n * ```ts\n * import { Anonymous } from \"@robelest/convex-auth/providers\";\n *\n * new Anonymous()\n * ```\n *\n * @module\n */\n\nimport { Credentials } from \"./credentials\";\nimport type {\n  GenericActionCtxWithAuthConfig,\n  ConvexCredentialsConfig,\n} from \"../server/types\";\nimport {\n  DocumentByName,\n  GenericDataModel,\n  WithoutSystemFields,\n} from \"convex/server\";\nimport { Value } from \"convex/values\";\n\n/**\n * The available options to an {@link Anonymous} provider for Convex Auth.\n */\nexport interface AnonymousConfig<DataModel extends GenericDataModel> {\n  /**\n   * Uniquely identifies the provider, allowing to use\n   * multiple different {@link Anonymous} providers.\n   */\n  id?: string;\n  /**\n   * Perform checks on provided params and customize the user\n   * information stored after sign in.\n   */\n  profile?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    /**\n     * Convex ActionCtx in case you want to read from or write to\n     * the database.\n     */\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => WithoutSystemFields<DocumentByName<DataModel, \"user\">> & {\n    isAnonymous: true;\n  };\n}\n\n/**\n * Anonymous authentication provider.\n *\n * Creates a new anonymous user account without requiring any\n * user-provided information. Useful for guest access or\n * progressive profiling.\n *\n * @example\n * ```ts\n * import { Anonymous } from \"@robelest/convex-auth/providers\";\n *\n * new Anonymous()\n * ```\n */\nexport class Anonymous<DataModel extends GenericDataModel = GenericDataModel> {\n  readonly id: string;\n  readonly type = \"credentials\" as const;\n  readonly config: AnonymousConfig<DataModel>;\n\n  constructor(config: AnonymousConfig<DataModel> = {} as AnonymousConfig<DataModel>) {\n    this.id = config.id ?? \"anonymous\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): ConvexCredentialsConfig {\n    const config = this.config;\n    const provider = this.id;\n\n    return new Credentials<DataModel>({\n      id: \"anonymous\",\n      authorize: async (params, ctx) => {\n        const profile = config.profile?.(params, ctx) ?? { isAnonymous: true };\n        const { user } = await ctx.auth.account.create(ctx, {\n          provider,\n          account: { id: crypto.randomUUID() },\n          profile: profile as any,\n        });\n        return { userId: user._id };\n      },\n      ...config,\n    })._toMaterialized();\n  }\n}\n\n// ============================================================================\n// Backward-compatible default export\n// ============================================================================\n\n/**\n * @deprecated Use `new Anonymous(config)` instead.\n */\nexport default function anonymous<DataModel extends GenericDataModel>(\n  config: AnonymousConfig<DataModel> = {} as AnonymousConfig<DataModel>,\n): ConvexCredentialsConfig {\n  return new Anonymous(config)._toMaterialized();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,IAAa,YAAb,MAA8E;CAC5E,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,SAAqC,EAAE,EAAgC;AACjF,OAAK,KAAK,OAAO,MAAM;AACvB,OAAK,SAAS;;;CAIhB,kBAA2C;EACzC,MAAM,SAAS,KAAK;EACpB,MAAM,WAAW,KAAK;AAEtB,SAAO,IAAI,YAAuB;GAChC,IAAI;GACJ,WAAW,OAAO,QAAQ,QAAQ;IAChC,MAAM,UAAU,OAAO,UAAU,QAAQ,IAAI,IAAI,EAAE,aAAa,MAAM;IACtE,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;KAClD;KACA,SAAS,EAAE,IAAI,OAAO,YAAY,EAAE;KAC3B;KACV,CAAC;AACF,WAAO,EAAE,QAAQ,KAAK,KAAK;;GAE7B,GAAG;GACJ,CAAC,CAAC,iBAAiB;;;;;;AAWxB,SAAwB,UACtB,SAAqC,EAAE,EACd;AACzB,QAAO,IAAI,UAAU,OAAO,CAAC,iBAAiB"}
+{"version":3,"file":"anonymous.js","names":[],"sources":["../../src/providers/anonymous.ts"],"sourcesContent":["/**\n * Anonymous authentication provider.\n *\n * ```ts\n * import { Anonymous } from \"@robelest/convex-auth/providers\";\n *\n * new Anonymous()\n * ```\n *\n * @module\n */\n\nimport {\n  DocumentByName,\n  GenericDataModel,\n  WithoutSystemFields,\n} from \"convex/server\";\nimport { Value } from \"convex/values\";\n\nimport type {\n  GenericActionCtxWithAuthConfig,\n  ConvexCredentialsConfig,\n} from \"../server/types\";\nimport { Credentials } from \"./credentials\";\n\n/**\n * The available options to an {@link Anonymous} provider for Convex Auth.\n */\nexport interface AnonymousConfig<DataModel extends GenericDataModel> {\n  /**\n   * Uniquely identifies the provider, allowing to use\n   * multiple different {@link Anonymous} providers.\n   */\n  id?: string;\n  /**\n   * Perform checks on provided params and customize the user\n   * information stored after sign in.\n   */\n  profile?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    /**\n     * Convex ActionCtx in case you want to read from or write to\n     * the database.\n     */\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => WithoutSystemFields<DocumentByName<DataModel, \"User\">> & {\n    isAnonymous: true;\n  };\n}\n\n/**\n * Anonymous authentication provider.\n *\n * Creates a new anonymous user account without requiring any\n * user-provided information. Useful for guest access or\n * progressive profiling.\n *\n * @example\n * ```ts\n * import { Anonymous } from \"@robelest/convex-auth/providers\";\n *\n * new Anonymous()\n * ```\n */\nexport class Anonymous<DataModel extends GenericDataModel = GenericDataModel> {\n  readonly id: string;\n  readonly type = \"credentials\" as const;\n  readonly config: AnonymousConfig<DataModel>;\n\n  constructor(\n    config: AnonymousConfig<DataModel> = {} as AnonymousConfig<DataModel>,\n  ) {\n    this.id = config.id ?? \"anonymous\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): ConvexCredentialsConfig {\n    const config = this.config;\n    const provider = this.id;\n\n    return new Credentials<DataModel>({\n      id: \"anonymous\",\n      authorize: async (params, ctx) => {\n        const profile = config.profile?.(params, ctx) ?? { isAnonymous: true };\n        const { user } = await ctx.auth.account.create(ctx, {\n          provider,\n          account: { id: crypto.randomUUID() },\n          profile: profile as any,\n        });\n        return { userId: user._id };\n      },\n      ...config,\n    })._toMaterialized();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAmEA,IAAa,YAAb,MAA8E;CAC5E,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YACE,SAAqC,EAAE,EACvC;AACA,OAAK,KAAK,OAAO,MAAM;AACvB,OAAK,SAAS;;;CAIhB,kBAA2C;EACzC,MAAM,SAAS,KAAK;EACpB,MAAM,WAAW,KAAK;AAEtB,SAAO,IAAI,YAAuB;GAChC,IAAI;GACJ,WAAW,OAAO,QAAQ,QAAQ;IAChC,MAAM,UAAU,OAAO,UAAU,QAAQ,IAAI,IAAI,EAAE,aAAa,MAAM;IACtE,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;KAClD;KACA,SAAS,EAAE,IAAI,OAAO,YAAY,EAAE;KAC3B;KACV,CAAC;AACF,WAAO,EAAE,QAAQ,KAAK,KAAK;;GAE7B,GAAG;GACJ,CAAC,CAAC,iBAAiB"}

package/dist/providers/credentials.d.ts

@@ -1,11 +1,12 @@
-import "../component/index.js";
-import { AuthProviderConfig, ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
+import { AuthProviderConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
 import { GenericDataModel } from "convex/server";
 import { GenericId, Value } from "convex/values";
 
 //#region src/providers/credentials.d.ts
 /**
  * Configuration for the Credentials provider.
+ *
+ * @typeParam DataModel - The Convex data model.
  */
 interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataModel> {
   /** Uniquely identifies the provider. Defaults to `"credentials"`. */
@@ -16,8 +17,8 @@ interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataMode
    * @returns A user ID for successful login, or `null` to reject.
    */
   authorize: (credentials: Partial<Record<string, Value | undefined>>, ctx: GenericActionCtxWithAuthConfig<DataModel>) => Promise<{
-    userId: GenericId<"user">;
-    sessionId?: GenericId<"session">;
+    userId: GenericId<"User">;
+    sessionId?: GenericId<"Session">;
   } | null>;
   /**
    * Provide hashing and verification functions for account secrets.
@@ -38,6 +39,8 @@ interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataMode
  * This is the escape hatch for fully custom auth logic. For email/password
  * flows, use the `Password` class instead.
  *
+ * @typeParam DataModel - The Convex data model.
+ *
  * @example
  * ```ts
  * import { Credentials } from "@robelest/convex-auth/providers";
@@ -55,12 +58,7 @@ declare class Credentials<DataModel extends GenericDataModel = GenericDataModel>
   readonly type: "credentials";
   readonly config: CredentialsConfig<DataModel>;
   constructor(config: CredentialsConfig<DataModel>);
-  /** @internal Convert to the internal materialized config shape. */
-  _toMaterialized(): ConvexCredentialsConfig;
 }
-/** @deprecated Use `new Credentials(config)` instead. */
-declare function credentials<DataModel extends GenericDataModel>(config: CredentialsConfig<DataModel>): ConvexCredentialsConfig;
-type CredentialsUserConfig<DataModel extends GenericDataModel = GenericDataModel> = CredentialsConfig<DataModel>;
 //#endregion
-export { Credentials, CredentialsConfig, CredentialsUserConfig, credentials as default };
+export { Credentials, CredentialsConfig };
 //# sourceMappingURL=credentials.d.ts.map

package/dist/providers/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","names":[],"sources":["../../src/providers/credentials.ts"],"mappings":";;;;;;;;;UA2BiB,iBAAA,mBACG,gBAAA,GAAmB,gBAAA;EA2BD;EAxBpC,EAAA;EAHA;;;;;EASA,SAAA,GACE,WAAA,EAAa,OAAA,CAAQ,MAAA,SAAe,KAAA,gBACpC,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA;IACH,MAAA,EAAQ,SAAA;IACR,SAAA,GAAY,SAAA;EAAA;EAHP;;;EAQP,MAAA;IACE,UAAA,GAAa,MAAA,aAAmB,OAAA;IAChC,YAAA,GAAe,MAAA,UAAgB,IAAA,aAAiB,OAAA;EAAA;EAPpC;;;;EAad,cAAA,IAAkB,kBAAA;AAAA;;;;;;;;AAqBpB;;;;;;;;;;;cAAa,WAAA,mBAA8B,gBAAA,GAAmB,gBAAA;EAAA,SACnD,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,iBAAA,CAAkB,SAAA;cAEvB,MAAA,EAAQ,iBAAA,CAAkB,SAAA;EAH7B;EAST,eAAA,CAAA,GAAmB,uBAAA;AAAA;;iBAaG,WAAA,mBAA8B,gBAAA,CAAA,CACpD,MAAA,EAAQ,iBAAA,CAAkB,SAAA,IACzB,uBAAA;AAAA,KAKS,qBAAA,mBACQ,gBAAA,GAAmB,gBAAA,IACnC,iBAAA,CAAkB,SAAA"}
+{"version":3,"file":"credentials.d.ts","names":[],"sources":["../../src/providers/credentials.ts"],"mappings":";;;;;;;;;;UA8BiB,iBAAA,mBACG,gBAAA,GAAmB,gBAAA;EAAnB;EAGlB,EAAA;EAAA;;;;;EAMA,SAAA,GACE,WAAA,EAAa,OAAA,CAAQ,MAAA,SAAe,KAAA,gBACpC,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA;IACH,MAAA,EAAQ,SAAA;IACR,SAAA,GAAY,SAAA;EAAA;EAFT;;;EAOL,MAAA;IACE,UAAA,GAAa,MAAA,aAAmB,OAAA;IAChC,YAAA,GAAe,MAAA,UAAgB,IAAA,aAAiB,OAAA;EAAA;EADnC;;;;EAOf,cAAA,IAAkB,kBAAA;AAAA;;;;;AAuBpB;;;;;;;;;;;;;;;;cAAa,WAAA,mBACO,gBAAA,GAAmB,gBAAA;EAAA,SAE5B,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,iBAAA,CAAkB,SAAA;cAEvB,MAAA,EAAQ,iBAAA,CAAkB,SAAA;AAAA"}

package/dist/providers/credentials.js

@@ -5,6 +5,8 @@
 * This is the escape hatch for fully custom auth logic. For email/password
 * flows, use the `Password` class instead.
 *
+* @typeParam DataModel - The Convex data model.
+*
 * @example
 * ```ts
 * import { Credentials } from "@robelest/convex-auth/providers";
@@ -34,11 +36,7 @@ var Credentials = class {
 		};
 	}
 };
-/** @deprecated Use `new Credentials(config)` instead. */
-function credentials(config) {
-	return new Credentials(config)._toMaterialized();
-}
 
 //#endregion
-export { Credentials, credentials as default };
+export { Credentials };
 //# sourceMappingURL=credentials.js.map

package/dist/providers/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../src/providers/credentials.ts"],"sourcesContent":["/**\n * Credentials provider for custom authentication flows.\n *\n * ```ts\n * import { Credentials } from \"@robelest/convex-auth/providers\";\n *\n * new Credentials({\n *   authorize: async (credentials, ctx) => {\n *     // Your custom logic here...\n *   },\n * })\n * ```\n *\n * @module\n */\n\nimport {\n  AuthProviderConfig,\n  ConvexCredentialsConfig,\n  GenericActionCtxWithAuthConfig,\n} from \"@robelest/convex-auth/component\";\nimport { GenericDataModel } from \"convex/server\";\nimport { GenericId, Value } from \"convex/values\";\n\n/**\n * Configuration for the Credentials provider.\n */\nexport interface CredentialsConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  /** Uniquely identifies the provider. Defaults to `\"credentials\"`. */\n  id?: string;\n  /**\n   * Handle credentials received from the client-side `signIn` call.\n   *\n   * @returns A user ID for successful login, or `null` to reject.\n   */\n  authorize: (\n    credentials: Partial<Record<string, Value | undefined>>,\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => Promise<{\n    userId: GenericId<\"user\">;\n    sessionId?: GenericId<\"session\">;\n  } | null>;\n  /**\n   * Provide hashing and verification functions for account secrets.\n   */\n  crypto?: {\n    hashSecret: (secret: string) => Promise<string>;\n    verifySecret: (secret: string, hash: string) => Promise<boolean>;\n  };\n  /**\n   * Extra providers used internally (e.g. email verification in password flow).\n   * Not exposed to clients.\n   */\n  extraProviders?: (AuthProviderConfig | undefined)[];\n}\n\n/**\n * Credentials provider for custom authentication flows.\n *\n * This is the escape hatch for fully custom auth logic. For email/password\n * flows, use the `Password` class instead.\n *\n * @example\n * ```ts\n * import { Credentials } from \"@robelest/convex-auth/providers\";\n *\n * new Credentials({\n *   authorize: async (credentials, ctx) => {\n *     const user = await validateUser(credentials);\n *     return user ? { userId: user._id } : null;\n *   },\n * })\n * ```\n */\nexport class Credentials<DataModel extends GenericDataModel = GenericDataModel> {\n  readonly id: string;\n  readonly type = \"credentials\" as const;\n  readonly config: CredentialsConfig<DataModel>;\n\n  constructor(config: CredentialsConfig<DataModel>) {\n    this.id = config.id ?? \"credentials\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): ConvexCredentialsConfig {\n    return {\n      ...this.config,\n      id: this.id,\n      type: \"credentials\",\n    } as ConvexCredentialsConfig;\n  }\n}\n\n// Keep the old factory function as default export for backward compatibility\n// during the transition. New code should use `new Credentials(...)`.\n\n/** @deprecated Use `new Credentials(config)` instead. */\nexport default function credentials<DataModel extends GenericDataModel>(\n  config: CredentialsConfig<DataModel>,\n): ConvexCredentialsConfig {\n  return new Credentials(config)._toMaterialized();\n}\n\n// Re-export the old type name for backward compat\nexport type CredentialsUserConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> = CredentialsConfig<DataModel>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA4EA,IAAa,cAAb,MAAgF;CAC9E,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,QAAsC;AAChD,OAAK,KAAK,OAAO,MAAM;AACvB,OAAK,SAAS;;;CAIhB,kBAA2C;AACzC,SAAO;GACL,GAAG,KAAK;GACR,IAAI,KAAK;GACT,MAAM;GACP;;;;AAQL,SAAwB,YACtB,QACyB;AACzB,QAAO,IAAI,YAAY,OAAO,CAAC,iBAAiB"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../src/providers/credentials.ts"],"sourcesContent":["/**\n * Credentials provider for custom authentication flows.\n *\n * ```ts\n * import { Credentials } from \"@robelest/convex-auth/providers\";\n *\n * new Credentials({\n *   authorize: async (credentials, ctx) => {\n *     // Your custom logic here...\n *   },\n * })\n * ```\n *\n * @module\n */\n\nimport { GenericDataModel } from \"convex/server\";\nimport { GenericId, Value } from \"convex/values\";\n\nimport type {\n  AuthProviderConfig,\n  ConvexCredentialsConfig,\n  GenericActionCtxWithAuthConfig,\n} from \"../server/types\";\n\n/**\n * Configuration for the Credentials provider.\n *\n * @typeParam DataModel - The Convex data model.\n */\nexport interface CredentialsConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  /** Uniquely identifies the provider. Defaults to `\"credentials\"`. */\n  id?: string;\n  /**\n   * Handle credentials received from the client-side `signIn` call.\n   *\n   * @returns A user ID for successful login, or `null` to reject.\n   */\n  authorize: (\n    credentials: Partial<Record<string, Value | undefined>>,\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => Promise<{\n    userId: GenericId<\"User\">;\n    sessionId?: GenericId<\"Session\">;\n  } | null>;\n  /**\n   * Provide hashing and verification functions for account secrets.\n   */\n  crypto?: {\n    hashSecret: (secret: string) => Promise<string>;\n    verifySecret: (secret: string, hash: string) => Promise<boolean>;\n  };\n  /**\n   * Extra providers used internally (e.g. email verification in password flow).\n   * Not exposed to clients.\n   */\n  extraProviders?: (AuthProviderConfig | undefined)[];\n}\n\n/**\n * Credentials provider for custom authentication flows.\n *\n * This is the escape hatch for fully custom auth logic. For email/password\n * flows, use the `Password` class instead.\n *\n * @typeParam DataModel - The Convex data model.\n *\n * @example\n * ```ts\n * import { Credentials } from \"@robelest/convex-auth/providers\";\n *\n * new Credentials({\n *   authorize: async (credentials, ctx) => {\n *     const user = await validateUser(credentials);\n *     return user ? { userId: user._id } : null;\n *   },\n * })\n * ```\n */\nexport class Credentials<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  readonly id: string;\n  readonly type = \"credentials\" as const;\n  readonly config: CredentialsConfig<DataModel>;\n\n  constructor(config: CredentialsConfig<DataModel>) {\n    this.id = config.id ?? \"credentials\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): ConvexCredentialsConfig {\n    return {\n      ...this.config,\n      id: this.id,\n      type: \"credentials\",\n    } as ConvexCredentialsConfig;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiFA,IAAa,cAAb,MAEE;CACA,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,QAAsC;AAChD,OAAK,KAAK,OAAO,MAAM;AACvB,OAAK,SAAS;;;CAIhB,kBAA2C;AACzC,SAAO;GACL,GAAG,KAAK;GACR,IAAI,KAAK;GACT,MAAM;GACP"}

package/dist/providers/device.d.ts

@@ -1,6 +1,18 @@
-import { DeviceProviderConfig } from "../server/types.js";
-
 //#region src/providers/device.d.ts
+/**
+ * Device authorization provider (RFC 8628).
+ *
+ * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate
+ * by displaying a short code that the user enters on a secondary device.
+ *
+ * ```ts
+ * import { Device } from "@robelest/convex-auth/providers";
+ *
+ * new Device()
+ * ```
+ *
+ * @module
+ */
 /**
  * Configuration for the Device authorization provider.
  */
@@ -35,9 +47,11 @@ interface DeviceConfig {
  *
  * @example
  * ```ts
+ * import { createAuth } from "@robelest/convex-auth/component";
  * import { Device } from "@robelest/convex-auth/providers";
+ * import { components } from "./_generated/api";
  *
- * const auth = new Auth(components.auth, {
+ * const auth = createAuth(components.auth, {
  *   providers: [new Device()],
  * });
  * ```
@@ -47,13 +61,7 @@ declare class Device {
   readonly type: "device";
   readonly config: DeviceConfig;
   constructor(config?: DeviceConfig);
-  /** @internal Convert to the internal materialized config shape. */
-  _toMaterialized(): DeviceProviderConfig;
 }
-/**
- * @deprecated Use `new Device(config)` instead.
- */
-declare function device(config?: DeviceConfig): DeviceProviderConfig;
 //#endregion
-export { Device, DeviceConfig, device as default };
+export { Device, DeviceConfig };
 //# sourceMappingURL=device.d.ts.map

package/dist/providers/device.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device.d.ts","names":[],"sources":["../../src/providers/device.ts"],"mappings":";;;;;;UAoBiB,YAAA;EAqDI;;;;EAhDnB,OAAA;EAwCS;EAtCT,cAAA;;EAEA,SAAA;EAsCY;EApCZ,QAAA;EA0CmB;;;AAWpB;;;;EA7CC,eAAA;AAAA;;;;;;;;;;;;;;;;;;cAuBW,MAAA;EAAA,SACF,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,YAAA;cAEL,MAAA,GAAQ,YAAA;;EAMpB,eAAA,CAAA,GAAmB,oBAAA;AAAA;;;;iBAoBG,MAAA,CACtB,MAAA,GAAS,YAAA,GACR,oBAAA"}
+{"version":3,"file":"device.d.ts","names":[],"sources":["../../src/providers/device.ts"],"mappings":";;AAoBA;;;;;;;;;;;AA4CA;;;;;UA5CiB,YAAA;EA+CN;;;;EA1CT,OAAA;EA4CqC;EA1CrC,cAAA;;EAEA,SAAA;;EAEA,QAAA;;;;;;;;EAQA,eAAA;AAAA;;;;;;;;;;;;;;;;;;;;cAyBW,MAAA;EAAA,SACF,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,YAAA;cAEL,MAAA,GAAQ,YAAA;AAAA"}

package/dist/providers/device.js

@@ -11,9 +11,11 @@ const DEFAULT_CHARSET = "BCDFGHJKLMNPQRSTVWXZ";
 *
 * @example
 * ```ts
+* import { createAuth } from "@robelest/convex-auth/component";
 * import { Device } from "@robelest/convex-auth/providers";
+* import { components } from "./_generated/api";
 *
-* const auth = new Auth(components.auth, {
+* const auth = createAuth(components.auth, {
 *   providers: [new Device()],
 * });
 * ```
@@ -39,13 +41,7 @@ var Device = class {
 		};
 	}
 };
-/**
-* @deprecated Use `new Device(config)` instead.
-*/
-function device(config) {
-	return new Device(config)._toMaterialized();
-}
 
 //#endregion
-export { Device, device as default };
+export { Device };
 //# sourceMappingURL=device.js.map

package/dist/providers/device.js.map

@@ -1 +1 @@
-{"version":3,"file":"device.js","names":[],"sources":["../../src/providers/device.ts"],"sourcesContent":["/**\n * Device authorization provider (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short code that the user enters on a secondary device.\n *\n * ```ts\n * import { Device } from \"@robelest/convex-auth/providers\";\n *\n * new Device()\n * ```\n *\n * @module\n */\n\nimport type { DeviceProviderConfig } from \"../server/types\";\n\n/**\n * Configuration for the Device authorization provider.\n */\nexport interface DeviceConfig {\n  /**\n   * User code character set.\n   * Default: `\"BCDFGHJKLMNPQRSTVWXZ\"` (base-20, no vowels per RFC 8628 §6.1).\n   */\n  charset?: string;\n  /** User code length (before formatting). Default: 8. */\n  userCodeLength?: number;\n  /** Device code + user code lifetime in seconds. Default: 900 (15 min). */\n  expiresIn?: number;\n  /** Minimum polling interval in seconds. Default: 5. */\n  interval?: number;\n  /**\n   * Base URL for the verification page where users enter the device code.\n   *\n   * Example: `\"http://localhost:3000/device\"` or `\"https://myapp.com/device\"`.\n   *\n   * If not provided, falls back to `SITE_URL + \"/device\"`.\n   */\n  verificationUri?: string;\n}\n\n/** No-vowel base-20 charset per RFC 8628 §6.1 recommendation. */\nconst DEFAULT_CHARSET = \"BCDFGHJKLMNPQRSTVWXZ\";\n\n/**\n * Device authorization provider (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short user code. The user visits a verification page\n * on a secondary device, signs in with any existing provider, and\n * enters the code to authorize the device.\n *\n * @example\n * ```ts\n * import { Device } from \"@robelest/convex-auth/providers\";\n *\n * const auth = new Auth(components.auth, {\n *   providers: [new Device()],\n * });\n * ```\n */\nexport class Device {\n  readonly id: string;\n  readonly type = \"device\" as const;\n  readonly config: DeviceConfig;\n\n  constructor(config: DeviceConfig = {}) {\n    this.id = \"device\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): DeviceProviderConfig {\n    return {\n      id: this.id,\n      type: \"device\",\n      charset: this.config.charset ?? DEFAULT_CHARSET,\n      userCodeLength: this.config.userCodeLength ?? 8,\n      expiresIn: this.config.expiresIn ?? 900,\n      interval: this.config.interval ?? 5,\n      verificationUri: this.config.verificationUri,\n    };\n  }\n}\n\n// ============================================================================\n// Backward-compatible default export\n// ============================================================================\n\n/**\n * @deprecated Use `new Device(config)` instead.\n */\nexport default function device(\n  config?: DeviceConfig,\n): DeviceProviderConfig {\n  return new Device(config)._toMaterialized();\n}\n"],"mappings":";;AA2CA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;AAmBxB,IAAa,SAAb,MAAoB;CAClB,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,SAAuB,EAAE,EAAE;AACrC,OAAK,KAAK;AACV,OAAK,SAAS;;;CAIhB,kBAAwC;AACtC,SAAO;GACL,IAAI,KAAK;GACT,MAAM;GACN,SAAS,KAAK,OAAO,WAAW;GAChC,gBAAgB,KAAK,OAAO,kBAAkB;GAC9C,WAAW,KAAK,OAAO,aAAa;GACpC,UAAU,KAAK,OAAO,YAAY;GAClC,iBAAiB,KAAK,OAAO;GAC9B;;;;;;AAWL,SAAwB,OACtB,QACsB;AACtB,QAAO,IAAI,OAAO,OAAO,CAAC,iBAAiB"}
+{"version":3,"file":"device.js","names":[],"sources":["../../src/providers/device.ts"],"sourcesContent":["/**\n * Device authorization provider (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short code that the user enters on a secondary device.\n *\n * ```ts\n * import { Device } from \"@robelest/convex-auth/providers\";\n *\n * new Device()\n * ```\n *\n * @module\n */\n\nimport type { DeviceProviderConfig } from \"../server/types\";\n\n/**\n * Configuration for the Device authorization provider.\n */\nexport interface DeviceConfig {\n  /**\n   * User code character set.\n   * Default: `\"BCDFGHJKLMNPQRSTVWXZ\"` (base-20, no vowels per RFC 8628 §6.1).\n   */\n  charset?: string;\n  /** User code length (before formatting). Default: 8. */\n  userCodeLength?: number;\n  /** Device code + user code lifetime in seconds. Default: 900 (15 min). */\n  expiresIn?: number;\n  /** Minimum polling interval in seconds. Default: 5. */\n  interval?: number;\n  /**\n   * Base URL for the verification page where users enter the device code.\n   *\n   * Example: `\"http://localhost:3000/device\"` or `\"https://myapp.com/device\"`.\n   *\n   * If not provided, falls back to `SITE_URL + \"/device\"`.\n   */\n  verificationUri?: string;\n}\n\n/** No-vowel base-20 charset per RFC 8628 §6.1 recommendation. */\nconst DEFAULT_CHARSET = \"BCDFGHJKLMNPQRSTVWXZ\";\n\n/**\n * Device authorization provider (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short user code. The user visits a verification page\n * on a secondary device, signs in with any existing provider, and\n * enters the code to authorize the device.\n *\n * @example\n * ```ts\n * import { createAuth } from \"@robelest/convex-auth/component\";\n * import { Device } from \"@robelest/convex-auth/providers\";\n * import { components } from \"./_generated/api\";\n *\n * const auth = createAuth(components.auth, {\n *   providers: [new Device()],\n * });\n * ```\n */\nexport class Device {\n  readonly id: string;\n  readonly type = \"device\" as const;\n  readonly config: DeviceConfig;\n\n  constructor(config: DeviceConfig = {}) {\n    this.id = \"device\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): DeviceProviderConfig {\n    return {\n      id: this.id,\n      type: \"device\",\n      charset: this.config.charset ?? DEFAULT_CHARSET,\n      userCodeLength: this.config.userCodeLength ?? 8,\n      expiresIn: this.config.expiresIn ?? 900,\n      interval: this.config.interval ?? 5,\n      verificationUri: this.config.verificationUri,\n    };\n  }\n}\n"],"mappings":";;AA2CA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;AAqBxB,IAAa,SAAb,MAAoB;CAClB,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,SAAuB,EAAE,EAAE;AACrC,OAAK,KAAK;AACV,OAAK,SAAS;;;CAIhB,kBAAwC;AACtC,SAAO;GACL,IAAI,KAAK;GACT,MAAM;GACN,SAAS,KAAK,OAAO,WAAW;GAChC,gBAAgB,KAAK,OAAO,kBAAkB;GAC9C,WAAW,KAAK,OAAO,aAAa;GACpC,UAAU,KAAK,OAAO,YAAY;GAClC,iBAAiB,KAAK,OAAO;GAC9B"}

package/dist/providers/email.d.ts

@@ -1,35 +1,62 @@
-import { EmailConfig, EmailUserConfig } from "../server/types.js";
-import { GenericDataModel } from "convex/server";
-
 //#region src/providers/email.d.ts
 /**
- * Email providers send a token to the user's email address
- * for sign-in.
+ * Email (magic link / OTP) authentication provider.
  *
- * When you use this function to create your config, by default it
- * checks that there is an `email` field during token verification
- * that matches the `email` used during the initial `signIn` call.
+ * @module
+ */
+/**
+ * User-facing configuration for the {@link Email} provider.
  *
- * If you want the "magic link behavior", where only the token is needed,
- * you can override the `authorize` method to skip the check:
+ * Use this to wire your email delivery service into Convex Auth's magic-link
+ * or OTP flow.
+ */
+interface EmailProviderConfig {
+  /** Sender address (e.g. "My App <noreply@example.com>"). */
+  from: string;
+  /** Send the verification email. Receives the Convex action context. */
+  send: (ctx: any, opts: {
+    from: string;
+    to: string;
+    subject: string;
+    html: string;
+  }) => Promise<void>;
+  /** Override to generate a custom verification token. */
+  generateVerificationToken?: () => Promise<string>;
+  /** Provider ID override. Defaults to "email". */
+  id?: string;
+  /** Token expiration in seconds. Defaults to 86400 (24 hours). */
+  maxAge?: number;
+}
+/**
+ * Email provider for magic-link or one-time-code sign-in.
  *
+ * Sends verification emails through your `send()` implementation and converts
+ * the result into Convex Auth's internal email-provider runtime shape.
+ *
+ * @example
  * ```ts
- * import email from "@robelest/convex-auth/providers/email";
- * import { Auth } from "@robelest/convex-auth/component";
+ * import { Email } from "@robelest/convex-auth/providers";
  *
- * export const { auth, signIn, signOut, store } = Auth({
- *   providers: [
- *     email({ authorize: undefined }),
- *   ],
+ * const email = new Email({
+ *   from: "My App <noreply@example.com>",
+ *   send: async (_ctx, { to, subject, html }) => {
+ *     await resend.emails.send({ from: "noreply@example.com", to, subject, html });
+ *   },
  * });
  * ```
- *
- * Make sure the token has high enough entropy to be secure.
- *
- * @param config - Email provider options including `sendVerificationRequest`.
- * @returns An `EmailConfig` to include in your `providers` array.
  */
-declare function email<DataModel extends GenericDataModel>(config: EmailUserConfig<DataModel> & Pick<EmailConfig, "sendVerificationRequest">): EmailConfig<DataModel>;
+declare class Email {
+  readonly config: EmailProviderConfig;
+  readonly id: string;
+  readonly type: "email";
+  /**
+   * Create an email provider instance.
+   *
+   * @param config - Email transport and provider settings.
+   * @throws {Error} When `config.from` is empty or whitespace-only.
+   */
+  constructor(config: EmailProviderConfig);
+}
 //#endregion
-export { email as default };
+export { Email, EmailProviderConfig };
 //# sourceMappingURL=email.d.ts.map

package/dist/providers/email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.ts","names":[],"sources":["../../src/providers/email.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoCwB,KAAA,mBAAwB,gBAAA,CAAA,CAC9C,MAAA,EAAQ,eAAA,CAAgB,SAAA,IACtB,IAAA,CAAK,WAAA,+BACN,WAAA,CAAY,SAAA"}
+{"version":3,"file":"email.d.ts","names":[],"sources":["../../src/providers/email.ts"],"mappings":";;AAeA;;;;;;;;;;UAAiB,mBAAA;EAMb;EAJF,IAAA;EAOA;EALA,IAAA,GACE,GAAA,OACA,IAAA;IAAQ,IAAA;IAAc,EAAA;IAAY,OAAA;IAAiB,IAAA;EAAA,MAChD,OAAA;EA2BW;EAzBhB,yBAAA,SAAkC,OAAA;EAmCqB;EAjCvD,EAAA;EAiCoC;EA/BpC,MAAA;AAAA;;;;;;;;;;;;;;;;;;;cAqBW,KAAA;EAAA,SAUiB,MAAA,EAAQ,mBAAA;EAAA,SAT3B,EAAA;EAAA,SACA,IAAA;;;;;;;cAQmB,MAAA,EAAQ,mBAAA;AAAA"}