@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/server/auth.ts"],"mappings":";;;;;;;;;;;;;;;;KAqDY,eAAA,GAAkB,IAAA,CAAK,gBAAA;;;;;;;;;;;;;;;;cAqBtB,IAAA;;mBAEM,KAAA;;WAED,MAAA,EAAQ,UAAA,QAAkB,MAAA;;WAE1B,OAAA,EAAS,UAAA,QAAkB,MAAA;;WAE3B,KAAA,EAAO,UAAA,QAAkB,MAAA;;MAIrC,IAAA,CAAA;;YAJ6B,cAAA,CAAA,IAAA;IAAA;;;;;;;;;gBA0F9B,WAAA;;;;;;;;;;;;;;;;;;;;;MApFC,OAAA,CAAA;;;;;;eAyNA,SAAA;IAAA;;;MAvNA,QAAA,CAAA;;kBA+SiU,SAAA;eAAyC,MAAA;IAAA;;;;;;MA7S1W,OAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAEA,KAAA,CAAA;;;;;;aA2S2wD,KAAA;;;;eAA0D,MAAA;IAAA;;;;;;;;;kBAAqpC,KAAA;;;;kBAA6D,KAAA;;;;;;;;;;;;;;;;;;iBAAmwE,MAAA;MAAA;;;;;;;;;;;;;;;;;;;MAzS1xK,MAAA,CAAA;;;;;;;;;eAySogS,MAAA;IAAA;;;;;;;;;;;;;;;;;;;;;MAvSpgS,OAAA,CAAA;;;;;;;;MAEA,IAAA,CAAA;;;;;;;MAEA,GAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAMQ,SAAA,EAAW,YAAA,EAAkB,MAAA,EAAQ,eAAA;;MA8C7C,IAAA,CAAA;gBA9C4D,cAAA,CAAA,UAAA;;;;;;;UA6Ruu6B,cAAA,CAAA,gBAAA;;;;;;;;;;;;;;;;;;;KAhO7x6B,OAAA,GAAU,GAAA;;;;;;;KAQV,aAAA,kBACO,MAAA,oBAA0B,MAAA;EAuNmU;;;;;;EA/M9W,QAAA;EA9FI;;;;;EAoGJ,OAAA,IACE,GAAA,OACA,IAAA,EAAM,OAAA,KACH,OAAA,CAAQ,QAAA,IAAY,QAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuEX,OAAA,kBACG,MAAA,oBAA0B,MAAA,gBAAA,CAE3C,IAAA,EAAM,IAAA,EACN,MAAA,EAAQ,aAAA,CAAc,QAAA;EAAc,QAAA;AAAA;EAEpC,IAAA;EACA,KAAA,GACE,GAAA,OACA,KAAA,OACA,MAAA,WACG,OAAA;IACH,GAAA;MACE,IAAA;QACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;QAC/B,MAAA,EAAQ,SAAA;QACR,IAAA,EAAM,OAAA;MAAA,IACJ,QAAA;IAAA;IAEN,IAAA;EAAA;AAAA;;;;iBAMY,OAAA,kBACG,MAAA,oBAA0B,MAAA,gBAAA,CAE3C,IAAA,EAAM,IAAA,EACN,MAAA,GAAS,aAAA,CAAc,QAAA;EAEvB,IAAA;EACA,KAAA,GACE,GAAA,OACA,KAAA,OACA,MAAA,WACG,OAAA;IACH,GAAA;MACE,IAAA;QACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;QAC/B,MAAA,EAAQ,SAAA;QACR,IAAA,EAAM,OAAA;MAAA,IACJ,QAAA;IAAA;IAEN,IAAA;EAAA;AAAA;;;;;;;;;;;;;;;;KAgFQ,SAAA;EACE,KAAA,MAAW,IAAA,YAAgB,OAAA;IAAU,GAAA;MAAO,IAAA;IAAA;EAAA;AAAA,KACtD,OAAA,CAAQ,UAAA,CAAW,CAAA"}
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/server/auth.ts"],"mappings":";;;;;;;;;;AAmC6D;;KAAjD,UAAA,GAAa,IAAA,CAAK,gBAAA;AAAA,KAEzB,0BAAA,wBACoB,uBAAA,gBACrB,IAAA,CACF,UAAA,QAAkB,MAAA;EAGlB,MAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,mCAEpB,IAAA;IACE,OAAA;IACA,MAAA;IACA,OAAA,GAAU,UAAA,CAAW,cAAA;IACrB,MAAA;IACA,MAAA,GAAS,MAAA;EAAA,MAER,OAAA;IAAU,EAAA;IAAU,QAAA;EAAA;EACzB,IAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,iCAEpB,IAAA;IACE,KAAA;MACE,OAAA;MACA,MAAA;MACA,MAAA,GAAS,UAAA,CAAW,cAAA;MACpB,MAAA;IAAA;IAEF,KAAA;IACA,MAAA;IACA,OAAA;IACA,KAAA;EAAA,MAEC,UAAA,CAAW,UAAA,QAAkB,MAAA;EAClC,MAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,mCAEpB,QAAA,UACA,IAAA,EAAM,MAAA;IAA4B,OAAA,GAAU,UAAA,CAAW,cAAA;EAAA,MACpD,OAAA;IAAU,EAAA;IAAU,QAAA;EAAA;EACzB,OAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,oCAEpB,IAAA;IACE,MAAA;IACA,OAAA;IACA,QAAA;IACA,OAAA,GAAU,UAAA,CAAW,cAAA;IACrB,MAAA,GAAS,SAAA,CAAU,cAAA;IACnB,QAAA;EAAA,MAEC,UAAA,CAAW,UAAA,QAAkB,MAAA;AAAA;;;;;;;;;;;;;;;;KAmBxB,WAAA,wBACa,uBAAA;EAEvB,MAAA,EAAQ,UAAA,QAAkB,MAAA;EAC1B,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,KAAA,EAAO,UAAA,QAAkB,MAAA;EACzB,IAAA,EAAM,UAAA,QAAkB,MAAA;EACxB,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,QAAA,EAAU,UAAA,QAAkB,MAAA;EAC5B,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,KAAA,EAAO,UAAA,QAAkB,MAAA;EACzB,MAAA,EAAQ,0BAAA,CAA2B,cAAA;EACnC,MAAA,EAAQ,UAAA,QAAkB,MAAA;EAC1B,GAAA,EAAK,UAAA,QAAkB,MAAA;EACvB,IAAA,EAAM,UAAA,QAAkB,MAAA;EA/DlB;;;;;;;;;;;;;;;;;;;;;;;;EAwFN,OAAA,GAAU,GAAA,UAAa,OAAA,CAAQ,mBAAA;EAvE1B;;;;;;;;;;;;;;;;;;;;;;;;AAgCP;;;;;;;;;;;;;;;EA+EE,GAAA;IACE,IAAA,EAAM,MAAA;IACN,KAAA,GAAQ,GAAA,UAAa,OAAA;MACnB,GAAA;QAAO,IAAA,EAAM,mBAAA;MAAA;MACb,IAAA,EAAM,MAAA;IAAA;EAAA;AAAA;;;;;;;;KAYA,mBAAA;EAda,4CAgBvB,MAAA,UAhB8B;EAkB9B,IAAA,OAlGuB;EAoGvB,OAAA,iBAlGQ;EAoGR,IAAA,iBAnGA;EAqGA,MAAA;AAAA;AAAA,KAGG,cAAA,GAAiB,UAAA,QAAkB,MAAA;AAAA,KAEnC,iBAAA;EACH,UAAA,EAAY,cAAA;IACV,MAAA;MACE,IAAA,EAAM,cAAA;MACN,QAAA,EAAU,cAAA;MACV,GAAA,GACE,GAAA,EAAK,UAAA,CAAW,cAAA,8BAChB,YAAA,UACA,OAAA,EAAS,KAAA;QACP,MAAA;QACA,SAAA;MAAA,OAEC,OAAA;QACH,EAAA;QACA,YAAA;QACA,OAAA,EAAS,KAAA;UACP,QAAA;UACA,MAAA;UACA,SAAA;UACA,QAAA;UACA,UAAA;QAAA;MAAA;MAGJ,YAAA;QACE,OAAA,GACE,GAAA,EAAK,UAAA,CAAW,cAAA,8BAChB,IAAA;UAAQ,YAAA;UAAsB,MAAA;QAAA,MAC3B,OAAA;UACH,EAAA;UACA,YAAA;UACA,MAAA;UACA,WAAA;UACA,SAAA;UACA,SAAA;YACE,UAAA;YACA,UAAA;YACA,WAAA;UAAA;QAAA;QAGJ,OAAA,GACE,GAAA,EAAK,UAAA,CAAW,cAAA,8BAChB,IAAA;UAAQ,YAAA;UAAsB,MAAA;QAAA,MAC3B,OAAA;UACH,EAAA;UACA,YAAA;UACA,MAAA;UACA,UAAA;UACA,MAAA,EAAQ,KAAA;YAAQ,IAAA;YAAc,EAAA;YAAa,OAAA;UAAA;QAAA;MAAA;IAAA;EAAA;EAKnD,IAAA,EAAM,IAAA,CAAK,cAAA;EACX,IAAA,EAAM,IAAA,CAAK,cAAA;EACX,MAAA,EAAQ,cAAA;EACR,KAAA;IACE,IAAA,EAAM,cAAA;EAAA;EAER,OAAA;IACE,QAAA,EAAU,cAAA;IACV,QAAA;MACE,IAAA,EAAM,cAAA;IAAA;EAAA;AAAA;AAAA,KAKP,kBAAA;EACH,MAAA,EAAQ,cAAA;EACR,QAAA,EAAU,cAAA;AAAA;AAAA,KAGP,YAAA;EACH,KAAA,EAAO,iBAAA;EACP,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAGL,aAAA;EACH,KAAA,EAAO,IAAA,CAAK,cAAA;AAAA;;;;;;;;;;;;;;;;KAkBF,OAAA,wBACa,uBAAA,4BACrB,WAAA,CAAY,cAAA;EACd,GAAA,EAAK,YAAA;EACL,IAAA,EAAM,aAAA;AAAA;;;;;;;;;;;;;;;;KAkBI,gBAAA,WACA,kBAAA,2BACa,uBAAA,4BAEvB,MAAA,CAAO,CAAA,iBACH,OAAA,CAAQ,cAAA,IACR,WAAA,CAAY,cAAA;;;;;;;;;;;;;;;;;;KAmBN,cAAA,MACV,CAAA,SAAU,gBAAA,YACN,WAAA,CACE,kBAAA,CAAmB,CAAA,GACnB,eAAA,CAAgB,CAAA,GAChB,iBAAA,CAAkB,CAAA,KAEpB,WAAA;AAAA,iBAmEU,UAAA,WACJ,kBAAA,2BACa,uBAAA,yBAAA,CAEvB,SAAA,EAAW,gBAAA,eACX,MAAA,EAAQ,IAAA,CAAK,UAAA;EACX,SAAA,EAAW,CAAA;EACX,aAAA,GAAgB,cAAA;AAAA,IAEjB,gBAAA,CAAiB,CAAA,EAAG,cAAA;;KA2MX,OAAA,GAAU,GAAA;;;;;;;KAQV,aAAA,kBACO,MAAA,oBAA0B,MAAA;EA1YnC,8EA6YR,QAAA;EA3YQ;;;EA+YR,OAAA,IAAW,GAAA,OAAU,IAAA,EAAM,OAAA,KAAY,OAAA,CAAQ,QAAA,IAAY,QAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;AA/XnC;;iBAyZV,OAAA,kBACG,MAAA,oBAA0B,MAAA,gBAAA,CAE3C,IAAA,EAAM,QAAA,EACN,MAAA,EAAQ,aAAA,CAAc,QAAA;EAAc,QAAA;AAAA;EAEpC,IAAA;EACA,KAAA,GACE,GAAA,OACA,KAAA,OACA,MAAA,WACG,OAAA;IACH,GAAA;MACE,IAAA;QACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;QAC/B,MAAA,EAAQ,SAAA;QACR,IAAA,EAAM,OAAA;MAAA,IACJ,QAAA;IAAA;IAEN,IAAA;EAAA;AAAA;;;;AAhawB;;;;;;;;;AAsB5B;;;;;;;;;;;iBAoagB,OAAA,kBACG,MAAA,oBAA0B,MAAA,gBAAA,CAE3C,IAAA,EAAM,QAAA,EACN,MAAA,GAAS,aAAA,CAAc,QAAA;EAEvB,IAAA;EACA,KAAA,GACE,GAAA,OACA,KAAA,OACA,MAAA,WACG,OAAA;IACH,GAAA;MACE,IAAA;QACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;QAC/B,MAAA,EAAQ,SAAA;QACR,IAAA,EAAM,OAAA;MAAA,IACJ,QAAA;IAAA;IAEN,IAAA;EAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;AAxYJ;;KAkeY,SAAA;EACE,KAAA,MAAW,IAAA,YAAgB,OAAA;IAAU,GAAA;MAAO,IAAA;IAAA;EAAA;AAAA,KACtD,OAAA,CAAQ,UAAA,CAAW,CAAA"}

package/dist/server/auth.js

@@ -1,143 +1,224 @@
-import email from "../providers/email.js";
-import { throwAuthError } from "./errors.js";
-import { Auth as Auth$1 } from "./implementation/index.js";
-import { defaultMagicLinkEmail } from "./templates.js";
+import { AuthError } from "./authError.js";
+import { Auth } from "./runtime.js";
+import { Fx } from "@robelest/fx";
 
 //#region src/server/auth.ts
 /**
-* Main entry point for Convex Auth. Instantiate with your component
-* reference and config to get all the exports you need.
+* Create an auth API object.
 *
+* When `new SSO()` is included in providers, `auth.sso` and `auth.scim`
+* are available on the returned object. Without it, those namespaces are
+* absent and accessing them is a TypeScript compile error.
+*
+* @param component - The installed auth component reference from
+*   `components.auth` in your Convex app definition.
+* @param config - Auth configuration including `providers` and optional
+*   `authorization`. All fields from {@link AuthConfig} are accepted
+*   except `component` (passed as the first argument).
+* @returns A {@link ConvexAuthResult} object — either {@link AuthApi}
+*   (with `sso`/`scim`) or {@link AuthApiBase}, depending on whether
+*   an SSO provider is present.
+*
+* @example
 * ```ts
-* export const auth = new Auth(components.auth, {
-*   providers: [google, password],
-*   email: {
-*     from: "My App <noreply@example.com>",
-*     send: (ctx, params) => resend.sendEmail(ctx, params),
-*   },
+* export const auth = createAuth(components.auth, {
+*   providers: [password(), google()],
+*   authorization: { roles },
 * });
-* export const { signIn, signOut, store } = auth;
 * ```
+*
+* @see {@link AuthCtx}
 */
-var Auth = class {
-	/** The inner `auth` helper object from AuthFactory() */
-	_auth;
-	/** The signIn action — export this from your convex/auth.ts */
-	signIn;
-	/** The signOut action — export this from your convex/auth.ts */
-	signOut;
-	/** The store internal mutation — export this from your convex/auth.ts */
-	store;
-	/** User helpers: `.current(ctx)`, `.require(ctx)`, `.get(ctx, userId)`, `.patch(ctx, userId, data)`, `.viewer(ctx)`, `.group.list(ctx, ...)`, `.group.get(ctx, ...)` */
-	get user() {
-		return this._auth.user;
-	}
-	/** Session helpers: `.current(ctx)`, `.invalidate(ctx, { userId, except? })` */
-	get session() {
-		return this._auth.session;
-	}
-	/** Provider helpers: `.signIn(ctx, provider, args)` */
-	get provider() {
-		return this._auth.provider;
-	}
-	/** Account helpers: `.create(ctx, args)`, `.get(ctx, args)`, `.update(ctx, args)` */
-	get account() {
-		return this._auth.account;
-	}
-	/** Group helpers: `.create(ctx, ...)`, `.get(ctx, id)`, `.list(ctx, ...)`, `.update(ctx, ...)`, `.delete(ctx, id)`, `.member.*` */
-	get group() {
-		return this._auth.group;
-	}
-	/** Invite helpers: `.create(ctx, ...)`, `.get(ctx, id)`, `.list(ctx, ...)`, `.accept(ctx, ...)`, `.revoke(ctx, id)` */
-	get invite() {
-		return this._auth.invite;
-	}
-	/** Passkey helpers: `.list(ctx, { userId })`, `.rename(ctx, id, name)`, `.remove(ctx, id)` */
-	get passkey() {
-		return this._auth.passkey;
-	}
-	/** TOTP helpers: `.list(ctx, { userId })`, `.remove(ctx, id)` */
-	get totp() {
-		return this._auth.totp;
-	}
-	/** API key helpers: `.create(ctx, ...)`, `.verify(ctx, rawKey)`, `.list(ctx, ...)`, `.get(ctx, id)`, `.update(ctx, ...)`, `.revoke(ctx, id)`, `.remove(ctx, id)` */
-	get key() {
-		return this._auth.key;
-	}
-	/**
-	* @param component - The auth component reference from `components.auth`.
-	* @param config - Auth configuration (providers, email transport, session, JWT, callbacks).
-	*/
-	constructor(component, config) {
-		const emailTransport = config.email;
-		const providers = [...config.providers];
-		const hasUserEmailProvider = providers.some((p) => typeof p === "object" && "id" in p && p.id === "email");
-		if (emailTransport && !hasUserEmailProvider) providers.push(email({
-			id: "email",
-			maxAge: 3600 * 24,
-			authorize: void 0,
-			async sendVerificationRequest({ identifier, url }, ctx) {
-				if (!ctx) throwAuthError("MISSING_ACTION_CONTEXT");
-				const { host } = new URL(url);
-				await emailTransport.send(ctx, {
-					from: emailTransport.from,
-					to: identifier,
-					subject: `Sign in to ${host}`,
-					html: defaultMagicLinkEmail(url, host)
-				});
-			}
-		}));
-		const authResult = Auth$1({
-			...config,
-			component,
-			providers
+/**
+* Resolve auth context for the current user. Returns the enriched
+* `ctx.auth` object or `null` when unauthenticated.
+*
+* Resolution flow:
+* 1. `user.id(ctx)` → userId or null (exit early)
+* 2. `user.get(ctx, userId)` → user doc (cached per-execution)
+* 3. `user.getActiveGroup(ctx, { userId })` → groupId or null
+* 4. If groupId → `member.resolve(ctx, { userId, groupId })` → role + grants
+*/
+async function resolveAuthContext(auth, ctx) {
+	const userId = await auth.user.id(ctx);
+	if (!userId) return null;
+	const user = await auth.user.get(ctx, userId);
+	const groupId = await auth.user.getActiveGroup(ctx, { userId });
+	let role = null;
+	let grants = [];
+	if (groupId) {
+		const resolved = await auth.member.resolve(ctx, {
+			userId,
+			groupId
 		});
-		this._auth = authResult.auth;
-		this.signIn = authResult.signIn;
-		this.signOut = authResult.signOut;
-		this.store = authResult.store;
-	}
-	/** HTTP namespace — route registration and Bearer-authenticated endpoints. */
-	get http() {
-		return this._auth.http;
+		if (resolved.membership) {
+			role = resolved.roleIds[0] ?? null;
+			grants = resolved.grants;
+		}
 	}
-};
-function AuthCtx(auth, config) {
-	const authHelper = auth._auth;
 	return {
-		args: {},
-		input: async (ctx, _args, _extra) => {
-			const nativeAuth = ctx.auth;
-			if (config?.optional) {
-				const userId$1 = await authHelper.user.current(ctx);
-				if (!userId$1) return {
-					ctx: { auth: {
-						getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),
-						userId: null,
-						user: null
-					} },
-					args: {}
-				};
-				const user$1 = await authHelper.user.get(ctx, userId$1);
-				const extra$1 = config.resolve ? await config.resolve(ctx, user$1) : {};
+		userId,
+		user,
+		groupId,
+		role,
+		grants
+	};
+}
+function createAuth(component, config) {
+	const authResult = Auth({
+		...config,
+		component,
+		providers: [...config.providers]
+	});
+	const { domain: domainApi, scim: scimApi, connection: connectionApi, audit: auditApi, webhook: webhookApi, oidc: oidcApi, saml: samlApi, ...restSso } = authResult.auth.sso;
+	const setEnterpriseDomains = async (ctx, enterpriseId, domains) => {
+		const enterprise = await connectionApi.get(ctx, enterpriseId);
+		if (enterprise === null) throw new AuthError("INVALID_PARAMETERS", "Enterprise not found.").toConvexError();
+		const normalized = domains.map((entry) => ({
+			...entry,
+			domain: entry.domain.trim().toLowerCase()
+		}));
+		const deduped = /* @__PURE__ */ new Map();
+		for (const entry of normalized) {
+			if (entry.domain.length === 0) throw new AuthError("INVALID_PARAMETERS", "Domain must not be empty.").toConvexError();
+			if (deduped.has(entry.domain)) throw new AuthError("INVALID_PARAMETERS", `Duplicate domain: ${entry.domain}`).toConvexError();
+			deduped.set(entry.domain, entry);
+		}
+		const nextDomains = [...deduped.values()];
+		const primaryCount = nextDomains.filter((entry) => entry.isPrimary).length;
+		if (primaryCount > 1) throw new AuthError("INVALID_PARAMETERS", "Only one primary domain may be set.").toConvexError();
+		if (nextDomains.length > 0 && primaryCount === 0) nextDomains[0] = {
+			...nextDomains[0],
+			isPrimary: true
+		};
+		const currentDomains = await domainApi.list(ctx, enterpriseId);
+		const currentByDomain = new Map(currentDomains.map((entry) => [entry.domain.toLowerCase(), entry]));
+		for (const existing of currentDomains) if (!deduped.has(existing.domain.toLowerCase())) await domainApi.remove(ctx, existing._id);
+		for (const nextDomain of nextDomains) {
+			const current = currentByDomain.get(nextDomain.domain);
+			if (current && current.isPrimary === Boolean(nextDomain.isPrimary)) continue;
+			if (current) await domainApi.remove(ctx, current._id);
+			const domainId = await domainApi.add(ctx, {
+				enterpriseId: enterprise._id,
+				groupId: enterprise.groupId,
+				domain: nextDomain.domain,
+				isPrimary: nextDomain.isPrimary
+			});
+			if (current?.verifiedAt !== void 0) await ctx.runMutation(component.public.enterpriseDomainVerify, {
+				domainId,
+				verifiedAt: current.verifiedAt
+			});
+		}
+		return {
+			ok: true,
+			enterpriseId,
+			domains: (await domainApi.list(ctx, enterpriseId)).map((domain) => ({
+				domainId: domain._id,
+				domain: domain.domain,
+				isPrimary: domain.isPrimary,
+				verified: domain.verifiedAt !== void 0,
+				verifiedAt: domain.verifiedAt ?? null
+			}))
+		};
+	};
+	const publicSso = {
+		admin: {
+			...restSso,
+			oidc: { ...oidcApi },
+			saml: { ...samlApi },
+			connection: {
+				...connectionApi,
+				domain: {
+					list: domainApi.list,
+					validate: domainApi.validate,
+					set: setEnterpriseDomains,
+					verification: {
+						request: domainApi.verification.request,
+						confirm: domainApi.verification.confirm
+					}
+				}
+			},
+			policy: restSso.policy,
+			audit: { list: auditApi.list },
+			webhook: {
+				endpoint: webhookApi.endpoint,
+				delivery: { list: webhookApi.delivery.list }
+			}
+		},
+		client: {
+			signIn: oidcApi.signIn,
+			metadata: samlApi.metadata
+		}
+	};
+	return {
+		signIn: authResult.signIn,
+		signOut: authResult.signOut,
+		store: authResult.store,
+		user: authResult.auth.user,
+		session: authResult.auth.session,
+		provider: authResult.auth.provider,
+		account: authResult.auth.account,
+		group: authResult.auth.group,
+		member: authResult.auth.member,
+		invite: authResult.auth.invite,
+		key: authResult.auth.key,
+		sso: publicSso,
+		scim: { admin: {
+			configure: scimApi.configure,
+			get: scimApi.get,
+			validate: scimApi.validate
+		} },
+		http: authResult.auth.http,
+		resolve: (ctx) => resolveAuthContext(authResult.auth, ctx),
+		ctx: () => ({
+			args: {},
+			input: async (ctx) => {
 				return {
-					ctx: { auth: {
-						getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),
-						userId: userId$1,
-						user: user$1,
-						...extra$1
-					} },
+					ctx: { auth: await resolveAuthContext(authResult.auth, ctx) },
 					args: {}
 				};
 			}
-			const userId = await authHelper.user.require(ctx);
-			const user = await authHelper.user.get(ctx, userId);
-			const extra = config?.resolve ? await config.resolve(ctx, user) : {};
+		})
+	};
+}
+function AuthCtx(auth, config) {
+	return {
+		args: {},
+		input: async (ctx, _args, _extra) => {
+			const nativeAuth = ctx.auth;
+			const modeDispatch = config?.optional === true ? { mode: "optional" } : { mode: "required" };
+			const userContext = await Fx.run(Fx.match(modeDispatch, modeDispatch.mode, {
+				optional: async () => {
+					const userId = await auth.user.id(ctx);
+					if (!userId) return null;
+					return {
+						userId,
+						user: await auth.user.get(ctx, userId)
+					};
+				},
+				required: async () => {
+					const userId = await auth.user.id(ctx);
+					if (!userId) return null;
+					return {
+						userId,
+						user: await auth.user.get(ctx, userId)
+					};
+				}
+			}));
+			if (userContext === null) return {
+				ctx: { auth: {
+					getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),
+					userId: null,
+					user: null
+				} },
+				args: {}
+			};
+			const extra = config?.resolve ? await config.resolve(ctx, userContext.user) : {};
 			return {
 				ctx: { auth: {
 					getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),
-					userId,
-					user,
+					userId: userContext.userId,
+					user: userContext.user,
 					...extra
 				} },
 				args: {}
@@ -147,5 +228,5 @@ function AuthCtx(auth, config) {
 }
 
 //#endregion
-export { Auth, AuthCtx };
+export { AuthCtx, createAuth };
 //# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["emailProvider","AuthFactory","userId","user","extra"],"sources":["../../src/server/auth.ts"],"sourcesContent":["/**\n * The `Auth` class — the main entry point for Convex Auth.\n *\n * Main entry point for authentication and authorization helpers:\n *\n * ```ts\n * // convex/auth.ts\n * import { Auth } from \"@robelest/convex-auth/component\";\n * import { components } from \"./_generated/api\";\n *\n * export const auth = new Auth(components.auth, {\n *   providers: [{ id: \"google\", type: \"oauth\" as const }],\n *   email: {\n *     from: \"My App <noreply@example.com>\",\n *     send: async (_ctx, { from, to, subject, html }) => {\n *       await fetch(\"https://api.resend.com/emails\", {\n *         method: \"POST\",\n *         headers: {\n *           Authorization: `Bearer ${process.env.AUTH_RESEND_KEY}`,\n *           \"Content-Type\": \"application/json\",\n *         },\n *         body: JSON.stringify({ from, to, subject, html }),\n *       });\n *     },\n *   },\n * });\n * export const { signIn, signOut, store } = auth;\n * ```\n *\n * @module\n */\n\nimport type { UserIdentity } from \"convex/server\";\nimport type { GenericId } from \"convex/values\";\nimport type { Doc } from \"./implementation/types\";\nimport type { ComponentApi as AuthComponentApi } from \"../component/_generated/component\";\nimport { Auth as AuthFactory } from \"./implementation/index\";\nimport type { ConvexAuthConfig } from \"./types\";\nimport { defaultMagicLinkEmail } from \"./templates\";\nimport emailProvider from \"../providers/email\";\nimport { throwAuthError } from \"./errors\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Config for the Auth class. Extends the standard auth config\n * minus `component` (which is passed as the first constructor argument).\n *\n * When `email` is configured, the library auto-registers a\n * magic link provider (`id: \"email\"`) for user-facing sign-in.\n */\nexport type AuthClassConfig = Omit<ConvexAuthConfig, \"component\">;\n\n// ============================================================================\n// Auth class\n// ============================================================================\n\n/**\n * Main entry point for Convex Auth. Instantiate with your component\n * reference and config to get all the exports you need.\n *\n * ```ts\n * export const auth = new Auth(components.auth, {\n *   providers: [google, password],\n *   email: {\n *     from: \"My App <noreply@example.com>\",\n *     send: (ctx, params) => resend.sendEmail(ctx, params),\n *   },\n * });\n * export const { signIn, signOut, store } = auth;\n * ```\n */\nexport class Auth {\n  /** The inner `auth` helper object from AuthFactory() */\n  private readonly _auth: ReturnType<typeof AuthFactory>[\"auth\"];\n  /** The signIn action — export this from your convex/auth.ts */\n  public readonly signIn: ReturnType<typeof AuthFactory>[\"signIn\"];\n  /** The signOut action — export this from your convex/auth.ts */\n  public readonly signOut: ReturnType<typeof AuthFactory>[\"signOut\"];\n  /** The store internal mutation — export this from your convex/auth.ts */\n  public readonly store: ReturnType<typeof AuthFactory>[\"store\"];\n\n  // ---- Proxied auth helper sub-objects ----\n  /** User helpers: `.current(ctx)`, `.require(ctx)`, `.get(ctx, userId)`, `.patch(ctx, userId, data)`, `.viewer(ctx)`, `.group.list(ctx, ...)`, `.group.get(ctx, ...)` */\n  get user() { return this._auth.user; }\n  /** Session helpers: `.current(ctx)`, `.invalidate(ctx, { userId, except? })` */\n  get session() { return this._auth.session; }\n  /** Provider helpers: `.signIn(ctx, provider, args)` */\n  get provider() { return this._auth.provider; }\n  /** Account helpers: `.create(ctx, args)`, `.get(ctx, args)`, `.update(ctx, args)` */\n  get account() { return this._auth.account; }\n  /** Group helpers: `.create(ctx, ...)`, `.get(ctx, id)`, `.list(ctx, ...)`, `.update(ctx, ...)`, `.delete(ctx, id)`, `.member.*` */\n  get group() { return this._auth.group; }\n  /** Invite helpers: `.create(ctx, ...)`, `.get(ctx, id)`, `.list(ctx, ...)`, `.accept(ctx, ...)`, `.revoke(ctx, id)` */\n  get invite() { return this._auth.invite; }\n  /** Passkey helpers: `.list(ctx, { userId })`, `.rename(ctx, id, name)`, `.remove(ctx, id)` */\n  get passkey() { return this._auth.passkey; }\n  /** TOTP helpers: `.list(ctx, { userId })`, `.remove(ctx, id)` */\n  get totp() { return this._auth.totp; }\n  /** API key helpers: `.create(ctx, ...)`, `.verify(ctx, rawKey)`, `.list(ctx, ...)`, `.get(ctx, id)`, `.update(ctx, ...)`, `.revoke(ctx, id)`, `.remove(ctx, id)` */\n  get key() { return this._auth.key; }\n\n  /**\n   * @param component - The auth component reference from `components.auth`.\n   * @param config - Auth configuration (providers, email transport, session, JWT, callbacks).\n   */\n  constructor(component: AuthComponentApi, config: AuthClassConfig) {\n    const emailTransport = config.email;\n    const providers = [...config.providers];\n\n    // Auto-register user-facing magic link provider when email is configured.\n    // Skipped if the user already registered their own provider with id \"email\".\n    const hasUserEmailProvider = providers.some(\n      (p) => typeof p === \"object\" && \"id\" in p && p.id === \"email\",\n    );\n    if (emailTransport && !hasUserEmailProvider) {\n      providers.push(\n        emailProvider({\n          id: \"email\",\n          maxAge: 60 * 60 * 24, // 24 hours\n          authorize: undefined, // Magic link — no OTP email check needed\n          async sendVerificationRequest({ identifier, url }, ctx) {\n            if (!ctx) {\n              throwAuthError(\"MISSING_ACTION_CONTEXT\");\n            }\n            const { host } = new URL(url);\n            await emailTransport.send(ctx, {\n              from: emailTransport.from,\n              to: identifier,\n              subject: `Sign in to ${host}`,\n              html: defaultMagicLinkEmail(url, host),\n            });\n          },\n        }),\n      );\n    }\n\n    // Initialize the core AuthFactory()\n    const authResult = AuthFactory({\n      ...config,\n      component,\n      providers,\n    });\n\n    this._auth = authResult.auth;\n    this.signIn = authResult.signIn;\n    this.signOut = authResult.signOut;\n    this.store = authResult.store;\n\n  }\n\n  /** HTTP namespace — route registration and Bearer-authenticated endpoints. */\n  get http() {\n    return this._auth.http;\n  }\n}\n\n// ============================================================================\n// AuthCtx — ctx enrichment for customQuery / customMutation\n// ============================================================================\n\n/**\n * The shape of a user document from the auth component's `user` table.\n *\n * Includes system fields (`_id`, `_creationTime`) plus the schema fields\n * (`name`, `email`, `image`, `extend`, etc.).\n */\nexport type UserDoc = Doc<\"user\">;\n\n/**\n * Configuration for auth context enrichment.\n *\n * @typeParam TResolve - The shape returned by the `resolve` callback.\n *   Inferred automatically — you usually don't need to supply this manually.\n */\nexport type AuthCtxConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n> = {\n  /**\n   * When `true`, unauthenticated requests set `ctx.auth.userId` and\n   * `ctx.auth.user` to `null` instead of throwing.\n   *\n   * @default false\n   */\n  optional?: boolean;\n  /**\n   * Resolve additional context after authentication succeeds (e.g.\n   * group/role for multi-tenant apps). The returned object is spread\n   * into `ctx.auth`.\n   */\n  resolve?: (\n    ctx: any,\n    user: UserDoc,\n  ) => Promise<TResolve> | TResolve;\n};\n\n/**\n * Create a `convex-helpers`–compatible customization object that\n * enriches `ctx.auth` with the authenticated user's data.\n *\n * Standalone function (not a class method) because Convex's bundler\n * can trace `export const x = fn(instance)` but not `instance.method()`.\n *\n * ### Basic usage (with `convex-helpers`)\n *\n * ```ts\n * // convex/functions.ts\n * import { customQuery, customMutation } from \"convex-helpers/server/customFunctions\";\n * import { query as rawQuery, mutation as rawMutation } from \"./_generated/server\";\n * import { AuthCtx } from \"\\@robelest/convex-auth/component\";\n * import { auth } from \"./auth\";\n *\n * const authCtx = AuthCtx(auth);\n *\n * export const query = customQuery(rawQuery, authCtx);\n * export const mutation = customMutation(rawMutation, authCtx);\n * ```\n *\n * Then in any function file:\n *\n * ```ts\n * // convex/messages.ts\n * import { query, mutation } from \"./functions\";\n *\n * export const list = query({\n *   args: {},\n *   handler: async (ctx) => {\n *     // ctx.auth.userId and ctx.auth.user are already resolved\n *     return ctx.db.query(\"messages\").collect();\n *   },\n * });\n * ```\n *\n * ### Optional auth (public routes)\n *\n * ```ts\n * export const publicQuery = customQuery(rawQuery, AuthCtx(auth, { optional: true }));\n * // ctx.auth.userId is null when unauthenticated\n * ```\n *\n * ### Multi-tenant with group resolution\n *\n * ```ts\n * const authCtx = AuthCtx(auth, {\n *   resolve: async (ctx, user) => {\n *     const groupId = user?.extend?.lastActiveGroup;\n *     const membership = await auth.user.group.get(ctx, {\n *       userId: user._id,\n *       groupId,\n *     });\n *     return { groupId, role: membership?.role ?? \"member\" };\n *   },\n * });\n * // ctx.auth.groupId and ctx.auth.role available in handlers\n * ```\n *\n * @param auth - The `Auth` class instance from your `convex/auth.ts`.\n * @param config - Optional configuration for optional auth and group resolution.\n * @returns A `{ args, input }` customization object compatible with\n *          `customQuery` / `customMutation` from `convex-helpers`.\n */\n/**\n * Overload: optional auth — `userId` and `user` may be `null`.\n */\nexport function AuthCtx<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n>(\n  auth: Auth,\n  config: AuthCtxConfig<TResolve> & { optional: true },\n): {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: {\n        getUserIdentity: () => Promise<UserIdentity | null>;\n        userId: GenericId<\"user\"> | null;\n        user: UserDoc | null;\n      } & TResolve;\n    };\n    args: {};\n  }>;\n};\n/**\n * Overload: required auth (default) — `userId` and `user` are never `null`.\n */\nexport function AuthCtx<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n>(\n  auth: Auth,\n  config?: AuthCtxConfig<TResolve>,\n): {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: {\n        getUserIdentity: () => Promise<UserIdentity | null>;\n        userId: GenericId<\"user\">;\n        user: UserDoc;\n      } & TResolve;\n    };\n    args: {};\n  }>;\n};\n// Implementation\nexport function AuthCtx(auth: Auth, config?: AuthCtxConfig<any>) {\n  const authHelper = (auth as any)._auth;\n\n  return {\n    args: {},\n    input: async (ctx: any, _args: any, _extra?: any) => {\n      const nativeAuth = ctx.auth;\n\n      if (config?.optional) {\n        const userId = await authHelper.user.current(ctx);\n        if (!userId) {\n          return {\n            ctx: {\n              auth: {\n                getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n                userId: null,\n                user: null,\n              },\n            },\n            args: {},\n          };\n        }\n        const user = await authHelper.user.get(ctx, userId);\n        const extra = config.resolve\n          ? await config.resolve(ctx, user)\n          : {};\n        return {\n          ctx: {\n            auth: {\n              getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n              userId,\n              user,\n              ...extra,\n            },\n          },\n          args: {},\n        };\n      }\n\n      // Required mode (default): throws NOT_SIGNED_IN\n      const userId = await authHelper.user.require(ctx);\n      const user = await authHelper.user.get(ctx, userId);\n      const extra = config?.resolve\n        ? await config.resolve(ctx, user)\n        : {};\n\n      return {\n        ctx: {\n          auth: {\n            getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n            userId,\n            user,\n            ...extra,\n          },\n        },\n        args: {},\n      };\n    },\n  };\n}\n\n/**\n * Extract the `ctx.auth` shape from an {@link AuthCtx} result.\n *\n * Follows the same pattern as `Infer<typeof validator>` in Convex\n * and `z.infer<typeof schema>` in Zod.\n *\n * @example\n * ```ts\n * const authCtx = AuthCtx(auth, {\n *   resolve: async (ctx, user) => ({ groupId: \"abc\", role: \"admin\" }),\n * });\n * type MyAuth = InferAuth<typeof authCtx>;\n * // { getUserIdentity, userId, user, groupId: string, role: string }\n * ```\n */\nexport type InferAuth<\n  T extends { input: (...args: any[]) => Promise<{ ctx: { auth: any } }> },\n> = Awaited<ReturnType<T[\"input\"]>>[\"ctx\"][\"auth\"];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0EA,IAAa,OAAb,MAAkB;;CAEhB,AAAiB;;CAEjB,AAAgB;;CAEhB,AAAgB;;CAEhB,AAAgB;;CAIhB,IAAI,OAAO;AAAE,SAAO,KAAK,MAAM;;;CAE/B,IAAI,UAAU;AAAE,SAAO,KAAK,MAAM;;;CAElC,IAAI,WAAW;AAAE,SAAO,KAAK,MAAM;;;CAEnC,IAAI,UAAU;AAAE,SAAO,KAAK,MAAM;;;CAElC,IAAI,QAAQ;AAAE,SAAO,KAAK,MAAM;;;CAEhC,IAAI,SAAS;AAAE,SAAO,KAAK,MAAM;;;CAEjC,IAAI,UAAU;AAAE,SAAO,KAAK,MAAM;;;CAElC,IAAI,OAAO;AAAE,SAAO,KAAK,MAAM;;;CAE/B,IAAI,MAAM;AAAE,SAAO,KAAK,MAAM;;;;;;CAM9B,YAAY,WAA6B,QAAyB;EAChE,MAAM,iBAAiB,OAAO;EAC9B,MAAM,YAAY,CAAC,GAAG,OAAO,UAAU;EAIvC,MAAM,uBAAuB,UAAU,MACpC,MAAM,OAAO,MAAM,YAAY,QAAQ,KAAK,EAAE,OAAO,QACvD;AACD,MAAI,kBAAkB,CAAC,qBACrB,WAAU,KACRA,MAAc;GACZ,IAAI;GACJ,QAAQ,OAAU;GAClB,WAAW;GACX,MAAM,wBAAwB,EAAE,YAAY,OAAO,KAAK;AACtD,QAAI,CAAC,IACH,gBAAe,yBAAyB;IAE1C,MAAM,EAAE,SAAS,IAAI,IAAI,IAAI;AAC7B,UAAM,eAAe,KAAK,KAAK;KAC7B,MAAM,eAAe;KACrB,IAAI;KACJ,SAAS,cAAc;KACvB,MAAM,sBAAsB,KAAK,KAAK;KACvC,CAAC;;GAEL,CAAC,CACH;EAIH,MAAM,aAAaC,OAAY;GAC7B,GAAG;GACH;GACA;GACD,CAAC;AAEF,OAAK,QAAQ,WAAW;AACxB,OAAK,SAAS,WAAW;AACzB,OAAK,UAAU,WAAW;AAC1B,OAAK,QAAQ,WAAW;;;CAK1B,IAAI,OAAO;AACT,SAAO,KAAK,MAAM;;;AA+JtB,SAAgB,QAAQ,MAAY,QAA6B;CAC/D,MAAM,aAAc,KAAa;AAEjC,QAAO;EACL,MAAM,EAAE;EACR,OAAO,OAAO,KAAU,OAAY,WAAiB;GACnD,MAAM,aAAa,IAAI;AAEvB,OAAI,QAAQ,UAAU;IACpB,MAAMC,WAAS,MAAM,WAAW,KAAK,QAAQ,IAAI;AACjD,QAAI,CAACA,SACH,QAAO;KACL,KAAK,EACH,MAAM;MACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;MAC5D,QAAQ;MACR,MAAM;MACP,EACF;KACD,MAAM,EAAE;KACT;IAEH,MAAMC,SAAO,MAAM,WAAW,KAAK,IAAI,KAAKD,SAAO;IACnD,MAAME,UAAQ,OAAO,UACjB,MAAM,OAAO,QAAQ,KAAKD,OAAK,GAC/B,EAAE;AACN,WAAO;KACL,KAAK,EACH,MAAM;MACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;MAC5D;MACA;MACA,GAAGC;MACJ,EACF;KACD,MAAM,EAAE;KACT;;GAIH,MAAM,SAAS,MAAM,WAAW,KAAK,QAAQ,IAAI;GACjD,MAAM,OAAO,MAAM,WAAW,KAAK,IAAI,KAAK,OAAO;GACnD,MAAM,QAAQ,QAAQ,UAClB,MAAM,OAAO,QAAQ,KAAK,KAAK,GAC/B,EAAE;AAEN,UAAO;IACL,KAAK,EACH,MAAM;KACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;KAC5D;KACA;KACA,GAAG;KACJ,EACF;IACD,MAAM,EAAE;IACT;;EAEJ"}
+{"version":3,"file":"auth.js","names":["AuthFactory"],"sources":["../../src/server/auth.ts"],"sourcesContent":["/**\n * Auth configuration helpers for Convex Auth.\n *\n * @module\n */\n\nimport type { UserIdentity } from \"convex/server\";\nimport type { GenericId } from \"convex/values\";\n\nimport type { AuthApiRefs } from \"../client/index\";\nimport { Auth as AuthFactory } from \"./runtime\";\nimport { Fx } from \"@robelest/fx\";\nimport { AuthError } from \"./authError\";\nimport type { Doc } from \"./types\";\nimport type {\n  AuthAuthorizationConfig,\n  AuthGrant,\n  AuthProviderConfig,\n  AuthRoleDefinition,\n  AuthRoleId,\n  ConvexAuthConfig,\n  HasDeviceProvider,\n  HasPasskeyProvider,\n  HasSSO,\n  HasTotpProvider,\n} from \"./types\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Config for auth setup. Extends the standard auth config\n * minus `component` (which is passed as the first constructor argument).\n */\nexport type AuthConfig = Omit<ConvexAuthConfig, \"component\">;\n\ntype MemberApiWithAuthorization<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = Omit<\n  ReturnType<typeof AuthFactory>[\"auth\"][\"member\"],\n  \"create\" | \"list\" | \"update\" | \"resolve\"\n> & {\n  create: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"create\"]\n    >[0],\n    data: {\n      groupId: string;\n      userId: string;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      status?: string;\n      extend?: Record<string, unknown>;\n    },\n  ) => Promise<{ ok: true; memberId: string }>;\n  list: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"list\"]\n    >[0],\n    opts?: {\n      where?: {\n        groupId?: string;\n        userId?: string;\n        roleId?: AuthRoleId<TAuthorization>;\n        status?: string;\n      };\n      limit?: number;\n      cursor?: string | null;\n      orderBy?: \"_creationTime\" | \"status\";\n      order?: \"asc\" | \"desc\";\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"list\"]>;\n  update: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"update\"]\n    >[0],\n    memberId: string,\n    data: Record<string, unknown> & { roleIds?: AuthRoleId<TAuthorization>[] },\n  ) => Promise<{ ok: true; memberId: string }>;\n  resolve: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"resolve\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      ancestry?: boolean;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      grants?: AuthGrant<TAuthorization>[];\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"resolve\"]>;\n};\n\n\n/**\n * The base auth API surface returned by {@link createAuth}.\n *\n * Provides core namespaces — `signIn`, `signOut`, `user`, `session`,\n * `member`, `invite`, `group`, `key`, and `http` — that are\n * always available regardless of which providers are configured.\n * Enterprise namespaces (`sso`, `scim`) are added conditionally by\n * {@link AuthApi} when an SSO provider is present.\n *\n * Use this type when you want to describe code that only depends on the\n * standard auth surface and should not assume enterprise features exist.\n *\n * @typeParam TAuthorization - The authorization config, used to narrow\n *   role IDs and grant strings on the `member` API.\n */\nexport type AuthApiBase<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> = {\n  signIn: ReturnType<typeof AuthFactory>[\"signIn\"];\n  signOut: ReturnType<typeof AuthFactory>[\"signOut\"];\n  store: ReturnType<typeof AuthFactory>[\"store\"];\n  user: ReturnType<typeof AuthFactory>[\"auth\"][\"user\"];\n  session: ReturnType<typeof AuthFactory>[\"auth\"][\"session\"];\n  provider: ReturnType<typeof AuthFactory>[\"auth\"][\"provider\"];\n  account: ReturnType<typeof AuthFactory>[\"auth\"][\"account\"];\n  group: ReturnType<typeof AuthFactory>[\"auth\"][\"group\"];\n  member: MemberApiWithAuthorization<TAuthorization>;\n  invite: ReturnType<typeof AuthFactory>[\"auth\"][\"invite\"];\n  key: ReturnType<typeof AuthFactory>[\"auth\"][\"key\"];\n  http: ReturnType<typeof AuthFactory>[\"auth\"][\"http\"];\n  /**\n   * Resolve the current user's auth context. Framework-agnostic — use\n   * this in fluent-convex middleware, custom wrappers, or anywhere you\n   * need the resolved `{ userId, user, groupId, role, grants }` object.\n   *\n   * Returns `null` when unauthenticated. Does not throw.\n   *\n   * @param ctx - Convex query, mutation, or action context.\n   * @returns The resolved auth context, or `null`.\n   *\n   * @example fluent-convex middleware\n   * ```ts\n   * const withAuth = convex.createMiddleware(async (ctx, next) => {\n   *   return next({ ...ctx, auth: await auth.resolve(ctx) });\n   * });\n   * ```\n   *\n   * @example Direct usage in a handler\n   * ```ts\n   * const resolved = await auth.resolve(ctx);\n   * if (!resolved) return { ok: false, code: \"NOT_SIGNED_IN\" };\n   * const { userId, grants } = resolved;\n   * ```\n   */\n  resolve: (ctx: any) => Promise<AuthResolvedContext | null>;\n  /**\n   * Context enrichment for convex-helpers `customQuery` / `customMutation` /\n   * `customAction`.\n   *\n   * Resolves the current user's identity, active group, membership role,\n   * and grants, then attaches them to `ctx.auth`. Returns a `Customization`\n   * object compatible with convex-helpers' custom function builders.\n   *\n   * `ctx.auth` is `{ userId, user, groupId, role, grants }` when\n   * authenticated, `null` when unauthenticated. No throwing — your\n   * handler decides how to respond.\n   *\n   * @returns A convex-helpers `Customization` object.\n   *\n   * @example One-time setup in `convex/functions.ts`\n   * ```ts\n   * import { query, mutation, action } from \"./_generated/server\";\n   * import { customQuery, customMutation, customAction } from \"convex-helpers/server/customFunctions\";\n   * import { auth } from \"./auth\";\n   *\n   * export const authQuery = customQuery(query, auth.ctx());\n   * export const authMutation = customMutation(mutation, auth.ctx());\n   * export const authAction = customAction(action, auth.ctx());\n   * ```\n   *\n   * @example Per-function usage\n   * ```ts\n   * import { authQuery } from \"./functions\";\n   *\n   * export const list = authQuery({\n   *   args: { workspaceId: v.string() },\n   *   handler: async (ctx, args) => {\n   *     if (!ctx.auth) return [];\n   *     const { userId, groupId, grants } = ctx.auth;\n   *     // business logic\n   *   },\n   * });\n   * ```\n   */\n  ctx: () => {\n    args: Record<string, never>;\n    input: (ctx: any) => Promise<{\n      ctx: { auth: AuthResolvedContext | null };\n      args: Record<string, never>;\n    }>;\n  };\n};\n\n/**\n * Resolved auth context injected into `ctx.auth` by `auth.ctx()`.\n *\n * - `null` when unauthenticated.\n * - `groupId` is `null` when the user has no active group set.\n * - `role` / `grants` are `null` / `[]` when no active group or no membership.\n */\nexport type AuthResolvedContext = {\n  /** The authenticated user's document ID. */\n  userId: string;\n  /** The authenticated user's full document. */\n  user: any;\n  /** The user's active group ID, or `null` if none set. */\n  groupId: string | null;\n  /** The user's primary role in the active group, or `null`. */\n  role: string | null;\n  /** Resolved grant strings from the user's role definitions. */\n  grants: string[];\n};\n\ntype InternalSsoApi = ReturnType<typeof AuthFactory>[\"auth\"][\"sso\"];\n\ntype PublicSsoAdminApi = {\n  connection: InternalSsoApi[\"connection\"] & {\n    domain: {\n      list: InternalSsoApi[\"domain\"][\"list\"];\n      validate: InternalSsoApi[\"domain\"][\"validate\"];\n      set: (\n        ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n        enterpriseId: string,\n        domains: Array<{\n          domain: string;\n          isPrimary?: boolean;\n        }>,\n      ) => Promise<{\n        ok: true;\n        enterpriseId: string;\n        domains: Array<{\n          domainId: string;\n          domain: string;\n          isPrimary: boolean;\n          verified: boolean;\n          verifiedAt: number | null;\n        }>;\n      }>;\n      verification: {\n        request: (\n          ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n          args: { enterpriseId: string; domain: string },\n        ) => Promise<{\n          ok: true;\n          enterpriseId: string;\n          domain: string;\n          requestedAt: number;\n          expiresAt: number;\n          challenge: {\n            recordType: \"TXT\";\n            recordName: string;\n            recordValue: string;\n          };\n        }>;\n        confirm: (\n          ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n          args: { enterpriseId: string; domain: string },\n        ) => Promise<{\n          ok: boolean;\n          enterpriseId: string;\n          domain: string;\n          verifiedAt?: number;\n          checks: Array<{ name: string; ok: boolean; message?: string }>;\n        }>;\n      };\n    };\n  };\n  oidc: Omit<InternalSsoApi[\"oidc\"], \"signIn\">;\n  saml: Omit<InternalSsoApi[\"saml\"], \"metadata\">;\n  policy: InternalSsoApi[\"policy\"];\n  audit: {\n    list: InternalSsoApi[\"audit\"][\"list\"];\n  };\n  webhook: {\n    endpoint: InternalSsoApi[\"webhook\"][\"endpoint\"];\n    delivery: {\n      list: InternalSsoApi[\"webhook\"][\"delivery\"][\"list\"];\n    };\n  };\n};\n\ntype PublicSsoClientApi = {\n  signIn: InternalSsoApi[\"oidc\"][\"signIn\"];\n  metadata: InternalSsoApi[\"saml\"][\"metadata\"];\n};\n\ntype PublicSsoApi = {\n  admin: PublicSsoAdminApi;\n  client: PublicSsoClientApi;\n};\n\ntype PublicScimApi = {\n  admin: Omit<InternalSsoApi[\"scim\"], \"getConfigByToken\" | \"identity\">;\n};\n\n/**\n * Extended auth API that includes enterprise SSO and SCIM namespaces.\n *\n * This type is the union of {@link AuthApiBase} plus `sso` (SSO connection\n * management, OIDC/SAML, domain verification, policies, audit, webhooks)\n * and `scim` (SCIM provisioning configuration). It is returned by\n * {@link createAuth} only when `new SSO()` is included in the providers\n * array; otherwise the narrower {@link AuthApiBase} is returned instead.\n * Attempting to access `auth.sso` or `auth.scim` without an SSO provider\n * produces a compile-time error because the return type narrows back to\n * {@link AuthApiBase}.\n *\n * @typeParam TAuthorization - The authorization config, forwarded to\n *   {@link AuthApiBase} for typed role IDs and grant strings.\n */\nexport type AuthApi<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> = AuthApiBase<TAuthorization> & {\n  sso: PublicSsoApi;\n  scim: PublicScimApi;\n};\n\n/**\n * The return type of {@link createAuth}.\n *\n * Resolves to {@link AuthApi} (with `sso` and `scim` namespaces) when\n * `new SSO()` is present in the providers array, or to the narrower\n * {@link AuthApiBase} otherwise. This conditional type ensures that\n * enterprise-only APIs are only accessible when the SSO provider is\n * configured, producing a compile-time error if you try to access\n * `auth.sso` without it.\n * This lets application code keep a single `createAuth()` call while still\n * getting provider-aware typing on the resulting API object.\n *\n * @typeParam P - The tuple of provider configs passed to `createAuth`.\n * @typeParam TAuthorization - Optional authorization config for typed roles/grants.\n */\nexport type ConvexAuthResult<\n  P extends AuthProviderConfig[],\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> =\n  HasSSO<P> extends true\n    ? AuthApi<TAuthorization>\n    : AuthApiBase<TAuthorization>;\n\n/**\n * Infer the typed `AuthApiRefs` for the client SDK from a `createAuth` call.\n *\n * Use this as the generic parameter for `client()` on the frontend:\n *\n * ```ts\n * // convex/auth.ts\n * export const auth = createAuth(components.auth, { providers: [...] });\n *\n * // Frontend\n * import type { auth } from \"../convex/auth\";\n * import type { InferClientApi } from \"@robelest/convex-auth/server\";\n * const c = client<InferClientApi<typeof auth>>({ convex, api: api.auth });\n * ```\n *\n * @typeParam T - A ConvexAuthResult to extract the client API from.\n */\nexport type InferClientApi<T> =\n  T extends ConvexAuthResult<infer P>\n    ? AuthApiRefs<\n        HasPasskeyProvider<P>,\n        HasTotpProvider<P>,\n        HasDeviceProvider<P>\n      >\n    : AuthApiRefs;\n\n/** @internal */\nexport type AuthLike = Pick<AuthApiBase, \"user\">;\n\n// ============================================================================\n// Auth setup APIs\n// ============================================================================\n\n/**\n * Create an auth API object.\n *\n * When `new SSO()` is included in providers, `auth.sso` and `auth.scim`\n * are available on the returned object. Without it, those namespaces are\n * absent and accessing them is a TypeScript compile error.\n *\n * @param component - The installed auth component reference from\n *   `components.auth` in your Convex app definition.\n * @param config - Auth configuration including `providers` and optional\n *   `authorization`. All fields from {@link AuthConfig} are accepted\n *   except `component` (passed as the first argument).\n * @returns A {@link ConvexAuthResult} object — either {@link AuthApi}\n *   (with `sso`/`scim`) or {@link AuthApiBase}, depending on whether\n *   an SSO provider is present.\n *\n * @example\n * ```ts\n * export const auth = createAuth(components.auth, {\n *   providers: [password(), google()],\n *   authorization: { roles },\n * });\n * ```\n *\n * @see {@link AuthCtx}\n */\n\n// ---------------------------------------------------------------------------\n// Function builders — shared auth resolution logic\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve auth context for the current user. Returns the enriched\n * `ctx.auth` object or `null` when unauthenticated.\n *\n * Resolution flow:\n * 1. `user.id(ctx)` → userId or null (exit early)\n * 2. `user.get(ctx, userId)` → user doc (cached per-execution)\n * 3. `user.getActiveGroup(ctx, { userId })` → groupId or null\n * 4. If groupId → `member.resolve(ctx, { userId, groupId })` → role + grants\n */\nasync function resolveAuthContext(auth: any, ctx: any) {\n  const userId = await auth.user.id(ctx);\n  if (!userId) return null;\n  const user = await auth.user.get(ctx, userId);\n  const groupId = await auth.user.getActiveGroup(ctx, { userId });\n  let role: string | null = null;\n  let grants: string[] = [];\n  if (groupId) {\n    const resolved = await auth.member.resolve(ctx, { userId, groupId });\n    if (resolved.membership) {\n      role = resolved.roleIds[0] ?? null;\n      grants = resolved.grants;\n    }\n  }\n  return { userId, user, groupId, role, grants };\n}\n\nexport function createAuth<\n  P extends AuthProviderConfig[],\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  component: ConvexAuthConfig[\"component\"],\n  config: Omit<AuthConfig, \"providers\" | \"authorization\"> & {\n    providers: P;\n    authorization?: TAuthorization;\n  },\n): ConvexAuthResult<P, TAuthorization> {\n  const authResult = AuthFactory({\n    ...config,\n    component,\n    providers: [...config.providers],\n  });\n  const {\n    domain: domainApi,\n    scim: scimApi,\n    connection: connectionApi,\n    audit: auditApi,\n    webhook: webhookApi,\n    oidc: oidcApi,\n    saml: samlApi,\n    ...restSso\n  } = authResult.auth.sso as InternalSsoApi;\n\n  type SetEnterpriseDomains = PublicSsoAdminApi[\"connection\"][\"domain\"][\"set\"];\n  type EnterpriseDomainInput = Array<{\n    domain: string;\n    isPrimary?: boolean;\n  }>;\n  const setEnterpriseDomains: PublicSsoAdminApi[\"connection\"][\"domain\"][\"set\"] =\n    async (\n      ctx: Parameters<SetEnterpriseDomains>[0],\n      enterpriseId: Parameters<SetEnterpriseDomains>[1],\n      domains: EnterpriseDomainInput,\n    ) => {\n      const enterprise = await connectionApi.get(ctx, enterpriseId);\n      if (enterprise === null) {\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Enterprise not found.\",\n        ).toConvexError();\n      }\n\n      const normalized = domains.map((entry: (typeof domains)[number]) => ({\n        ...entry,\n        domain: entry.domain.trim().toLowerCase(),\n      }));\n      const deduped = new Map<string, (typeof normalized)[number]>();\n      for (const entry of normalized) {\n        if (entry.domain.length === 0) {\n          throw new AuthError(\n            \"INVALID_PARAMETERS\",\n            \"Domain must not be empty.\",\n          ).toConvexError();\n        }\n        if (deduped.has(entry.domain)) {\n          throw new AuthError(\n            \"INVALID_PARAMETERS\",\n            `Duplicate domain: ${entry.domain}`,\n          ).toConvexError();\n        }\n        deduped.set(entry.domain, entry);\n      }\n\n      const nextDomains = [...deduped.values()];\n      const primaryCount = nextDomains.filter(\n        (entry) => entry.isPrimary,\n      ).length;\n      if (primaryCount > 1) {\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Only one primary domain may be set.\",\n        ).toConvexError();\n      }\n      if (nextDomains.length > 0 && primaryCount === 0) {\n        nextDomains[0] = { ...nextDomains[0], isPrimary: true };\n      }\n\n      const currentDomains = await domainApi.list(ctx, enterpriseId);\n      const currentByDomain = new Map<string, (typeof currentDomains)[number]>(\n        currentDomains.map((entry: (typeof currentDomains)[number]) => [\n          entry.domain.toLowerCase(),\n          entry,\n        ]),\n      );\n\n      for (const existing of currentDomains) {\n        if (!deduped.has(existing.domain.toLowerCase())) {\n          await domainApi.remove(ctx, existing._id);\n        }\n      }\n\n      for (const nextDomain of nextDomains) {\n        const current = currentByDomain.get(nextDomain.domain);\n        if (current && current.isPrimary === Boolean(nextDomain.isPrimary)) {\n          continue;\n        }\n        if (current) {\n          await domainApi.remove(ctx, current._id);\n        }\n        const domainId = await domainApi.add(ctx, {\n          enterpriseId: enterprise._id,\n          groupId: enterprise.groupId,\n          domain: nextDomain.domain,\n          isPrimary: nextDomain.isPrimary,\n        });\n        if (current?.verifiedAt !== undefined) {\n          await (ctx as any).runMutation(\n            component.public.enterpriseDomainVerify,\n            {\n              domainId,\n              verifiedAt: current.verifiedAt,\n            },\n          );\n        }\n      }\n\n      const updatedDomains = await domainApi.list(ctx, enterpriseId);\n      return {\n        ok: true as const,\n        enterpriseId,\n        domains: updatedDomains.map(\n          (domain: (typeof updatedDomains)[number]) => ({\n            domainId: domain._id,\n            domain: domain.domain,\n            isPrimary: domain.isPrimary,\n            verified: domain.verifiedAt !== undefined,\n            verifiedAt: domain.verifiedAt ?? null,\n          }),\n        ),\n      };\n    };\n\n  const publicSso: PublicSsoApi = {\n    admin: {\n      ...restSso,\n      oidc: {\n        ...oidcApi,\n      },\n      saml: {\n        ...samlApi,\n      },\n      connection: {\n        ...connectionApi,\n        domain: {\n          list: domainApi.list,\n          validate: domainApi.validate,\n          set: setEnterpriseDomains,\n          verification: {\n            request: domainApi.verification.request,\n            confirm: domainApi.verification.confirm,\n          },\n        },\n      },\n      policy: restSso.policy,\n      audit: {\n        list: auditApi.list,\n      },\n      webhook: {\n        endpoint: webhookApi.endpoint,\n        delivery: {\n          list: webhookApi.delivery.list,\n        },\n      },\n    },\n    client: {\n      signIn: oidcApi.signIn,\n      metadata: samlApi.metadata,\n    },\n  };\n\n  return {\n    signIn: authResult.signIn,\n    signOut: authResult.signOut,\n    store: authResult.store,\n    user: authResult.auth.user,\n    session: authResult.auth.session,\n    provider: authResult.auth.provider,\n    account: authResult.auth.account,\n    group: authResult.auth.group,\n    member: authResult.auth.member,\n    invite: authResult.auth.invite,\n    key: authResult.auth.key,\n    sso: publicSso,\n    scim: {\n      admin: {\n        configure: scimApi.configure,\n        get: scimApi.get,\n        validate: scimApi.validate,\n      },\n    },\n    http: authResult.auth.http,\n\n    resolve: (ctx: any) => resolveAuthContext(authResult.auth, ctx),\n\n    ctx: () => ({\n      args: {},\n      input: async (ctx: any) => {\n        const authCtx = await resolveAuthContext(authResult.auth, ctx);\n        return { ctx: { auth: authCtx }, args: {} };\n      },\n    }),\n  } as unknown as ConvexAuthResult<P, TAuthorization>;\n}\n\n// ============================================================================\n// AuthCtx — ctx enrichment for customQuery / customMutation\n// ============================================================================\n\n/** Canonical user document type exposed by Convex Auth. */\nexport type UserDoc = Doc<\"User\">;\n\n/**\n * Configuration for {@link AuthCtx} context enrichment.\n *\n * @typeParam TResolve - Extra fields returned from `resolve()` and merged into\n *   the resulting `ctx.auth` object.\n */\nexport type AuthCtxConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n> = {\n  /** Allow unauthenticated callers and return `userId: null` / `user: null`. */\n  optional?: boolean;\n  /**\n   * Attach additional derived fields to the auth context after the user is resolved.\n   */\n  resolve?: (ctx: any, user: UserDoc) => Promise<TResolve> | TResolve;\n};\n\n/**\n * Create a context enrichment for `customQuery` / `customMutation` — optional auth.\n *\n * When `optional: true` is set, unauthenticated requests are allowed.\n * The enriched `ctx.auth` will have `userId: null` and `user: null`\n * for unauthenticated callers.\n *\n * @param auth - The auth API object returned by {@link createAuth}.\n * @param config - Configuration with `optional: true` and an optional\n *   `resolve` callback for attaching extra fields to the auth context.\n * @returns An object with `args` and `input` compatible with Convex\n *   custom function builders.\n *\n * @example\n * ```ts\n * const authCtx = AuthCtx(auth, {\n *   optional: true,\n *   resolve: async (_ctx, user) => ({ plan: user?.extend?.plan ?? null }),\n * });\n * ```\n *\n * @see {@link createAuth}\n */\nexport function AuthCtx<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n>(\n  auth: AuthLike,\n  config: AuthCtxConfig<TResolve> & { optional: true },\n): {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: {\n        getUserIdentity: () => Promise<UserIdentity | null>;\n        userId: GenericId<\"User\"> | null;\n        user: UserDoc | null;\n      } & TResolve;\n    };\n    args: {};\n  }>;\n};\n/**\n * Create a context enrichment for `customQuery` / `customMutation` — required auth (default).\n *\n * When `optional` is omitted or `false`, the inferred type is the authenticated\n * auth shape. At runtime this helper still resolves instead of throwing, so if\n * no user is signed in the returned `ctx.auth.userId` and `ctx.auth.user` are\n * `null`.\n *\n * @param auth - The auth API object returned by {@link createAuth}.\n * @param config - Optional configuration with a `resolve` callback\n *   for attaching extra fields to the auth context.\n * @returns An object with `args` and `input` compatible with Convex\n *   custom function builders.\n *\n * @example\n * ```ts\n * const authCtx = AuthCtx(auth, {\n *   resolve: async (_ctx, user) => ({ email: user.email }),\n * });\n * ```\n *\n * @see {@link createAuth}\n */\nexport function AuthCtx<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n>(\n  auth: AuthLike,\n  config?: AuthCtxConfig<TResolve>,\n): {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: {\n        getUserIdentity: () => Promise<UserIdentity | null>;\n        userId: GenericId<\"User\">;\n        user: UserDoc;\n      } & TResolve;\n    };\n    args: {};\n  }>;\n};\n// Implementation\nexport function AuthCtx(auth: AuthLike, config?: AuthCtxConfig<any>) {\n  return {\n    args: {},\n    input: async (ctx: any, _args: any, _extra?: any) => {\n      const nativeAuth = ctx.auth;\n      const modeDispatch =\n        config?.optional === true\n          ? { mode: \"optional\" as const }\n          : { mode: \"required\" as const };\n\n      const userContext = await Fx.run(\n        Fx.match(modeDispatch, modeDispatch.mode, {\n          optional: async () => {\n            const userId = await auth.user.id(ctx);\n            if (!userId) {\n              return null;\n            }\n            const user = await auth.user.get(ctx, userId);\n            return { userId, user };\n          },\n          required: async () => {\n            const userId = await auth.user.id(ctx);\n            if (!userId) {\n              return null;\n            }\n            const user = await auth.user.get(ctx, userId);\n            return { userId, user };\n          },\n        }),\n      );\n\n      if (userContext === null) {\n        return {\n          ctx: {\n            auth: {\n              getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n              userId: null,\n              user: null,\n            },\n          },\n          args: {},\n        };\n      }\n\n      const extra = config?.resolve\n        ? await config.resolve(ctx, userContext.user)\n        : {};\n\n      return {\n        ctx: {\n          auth: {\n            getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n            userId: userContext.userId,\n            user: userContext.user,\n            ...extra,\n          },\n        },\n        args: {},\n      };\n    },\n  };\n}\n\n/**\n * Extract the resolved `auth` context type from an {@link AuthCtx} instance.\n *\n * Use this to type function parameters or variables that receive the\n * enriched auth context produced by `AuthCtx`. The inferred type includes\n * `userId`, `user`, `getUserIdentity`, and any additional fields added\n * by the `resolve` callback. This is the generic utility for reusing the\n * enriched auth shape without manually duplicating conditional auth types.\n *\n * @typeParam T - An `AuthCtx` return value (must have an `input` method\n *   that returns `{ ctx: { auth: ... } }`).\n *\n * @example\n * ```ts\n * const authCtx = AuthCtx(auth, {\n *   resolve: async (ctx, user) => ({ orgId: user.orgId }),\n * });\n * type Auth = InferAuth<typeof authCtx>;\n * // Auth = { userId: Id<\"User\">; user: UserDoc; getUserIdentity: ...; orgId: string }\n * ```\n *\n * @see {@link createAuth}\n */\nexport type InferAuth<\n  T extends { input: (...args: any[]) => Promise<{ ctx: { auth: any } }> },\n> = Awaited<ReturnType<T[\"input\"]>>[\"ctx\"][\"auth\"];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmaA,eAAe,mBAAmB,MAAW,KAAU;CACrD,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,IAAI;AACtC,KAAI,CAAC,OAAQ,QAAO;CACpB,MAAM,OAAO,MAAM,KAAK,KAAK,IAAI,KAAK,OAAO;CAC7C,MAAM,UAAU,MAAM,KAAK,KAAK,eAAe,KAAK,EAAE,QAAQ,CAAC;CAC/D,IAAI,OAAsB;CAC1B,IAAI,SAAmB,EAAE;AACzB,KAAI,SAAS;EACX,MAAM,WAAW,MAAM,KAAK,OAAO,QAAQ,KAAK;GAAE;GAAQ;GAAS,CAAC;AACpE,MAAI,SAAS,YAAY;AACvB,UAAO,SAAS,QAAQ,MAAM;AAC9B,YAAS,SAAS;;;AAGtB,QAAO;EAAE;EAAQ;EAAM;EAAS;EAAM;EAAQ;;AAGhD,SAAgB,WAId,WACA,QAIqC;CACrC,MAAM,aAAaA,KAAY;EAC7B,GAAG;EACH;EACA,WAAW,CAAC,GAAG,OAAO,UAAU;EACjC,CAAC;CACF,MAAM,EACJ,QAAQ,WACR,MAAM,SACN,YAAY,eACZ,OAAO,UACP,SAAS,YACT,MAAM,SACN,MAAM,SACN,GAAG,YACD,WAAW,KAAK;CAOpB,MAAM,uBACJ,OACE,KACA,cACA,YACG;EACH,MAAM,aAAa,MAAM,cAAc,IAAI,KAAK,aAAa;AAC7D,MAAI,eAAe,KACjB,OAAM,IAAI,UACR,sBACA,wBACD,CAAC,eAAe;EAGnB,MAAM,aAAa,QAAQ,KAAK,WAAqC;GACnE,GAAG;GACH,QAAQ,MAAM,OAAO,MAAM,CAAC,aAAa;GAC1C,EAAE;EACH,MAAM,0BAAU,IAAI,KAA0C;AAC9D,OAAK,MAAM,SAAS,YAAY;AAC9B,OAAI,MAAM,OAAO,WAAW,EAC1B,OAAM,IAAI,UACR,sBACA,4BACD,CAAC,eAAe;AAEnB,OAAI,QAAQ,IAAI,MAAM,OAAO,CAC3B,OAAM,IAAI,UACR,sBACA,qBAAqB,MAAM,SAC5B,CAAC,eAAe;AAEnB,WAAQ,IAAI,MAAM,QAAQ,MAAM;;EAGlC,MAAM,cAAc,CAAC,GAAG,QAAQ,QAAQ,CAAC;EACzC,MAAM,eAAe,YAAY,QAC9B,UAAU,MAAM,UAClB,CAAC;AACF,MAAI,eAAe,EACjB,OAAM,IAAI,UACR,sBACA,sCACD,CAAC,eAAe;AAEnB,MAAI,YAAY,SAAS,KAAK,iBAAiB,EAC7C,aAAY,KAAK;GAAE,GAAG,YAAY;GAAI,WAAW;GAAM;EAGzD,MAAM,iBAAiB,MAAM,UAAU,KAAK,KAAK,aAAa;EAC9D,MAAM,kBAAkB,IAAI,IAC1B,eAAe,KAAK,UAA2C,CAC7D,MAAM,OAAO,aAAa,EAC1B,MACD,CAAC,CACH;AAED,OAAK,MAAM,YAAY,eACrB,KAAI,CAAC,QAAQ,IAAI,SAAS,OAAO,aAAa,CAAC,CAC7C,OAAM,UAAU,OAAO,KAAK,SAAS,IAAI;AAI7C,OAAK,MAAM,cAAc,aAAa;GACpC,MAAM,UAAU,gBAAgB,IAAI,WAAW,OAAO;AACtD,OAAI,WAAW,QAAQ,cAAc,QAAQ,WAAW,UAAU,CAChE;AAEF,OAAI,QACF,OAAM,UAAU,OAAO,KAAK,QAAQ,IAAI;GAE1C,MAAM,WAAW,MAAM,UAAU,IAAI,KAAK;IACxC,cAAc,WAAW;IACzB,SAAS,WAAW;IACpB,QAAQ,WAAW;IACnB,WAAW,WAAW;IACvB,CAAC;AACF,OAAI,SAAS,eAAe,OAC1B,OAAO,IAAY,YACjB,UAAU,OAAO,wBACjB;IACE;IACA,YAAY,QAAQ;IACrB,CACF;;AAKL,SAAO;GACL,IAAI;GACJ;GACA,UAJqB,MAAM,UAAU,KAAK,KAAK,aAAa,EAIpC,KACrB,YAA6C;IAC5C,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,WAAW,OAAO;IAClB,UAAU,OAAO,eAAe;IAChC,YAAY,OAAO,cAAc;IAClC,EACF;GACF;;CAGL,MAAM,YAA0B;EAC9B,OAAO;GACL,GAAG;GACH,MAAM,EACJ,GAAG,SACJ;GACD,MAAM,EACJ,GAAG,SACJ;GACD,YAAY;IACV,GAAG;IACH,QAAQ;KACN,MAAM,UAAU;KAChB,UAAU,UAAU;KACpB,KAAK;KACL,cAAc;MACZ,SAAS,UAAU,aAAa;MAChC,SAAS,UAAU,aAAa;MACjC;KACF;IACF;GACD,QAAQ,QAAQ;GAChB,OAAO,EACL,MAAM,SAAS,MAChB;GACD,SAAS;IACP,UAAU,WAAW;IACrB,UAAU,EACR,MAAM,WAAW,SAAS,MAC3B;IACF;GACF;EACD,QAAQ;GACN,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GACnB;EACF;AAED,QAAO;EACL,QAAQ,WAAW;EACnB,SAAS,WAAW;EACpB,OAAO,WAAW;EAClB,MAAM,WAAW,KAAK;EACtB,SAAS,WAAW,KAAK;EACzB,UAAU,WAAW,KAAK;EAC1B,SAAS,WAAW,KAAK;EACzB,OAAO,WAAW,KAAK;EACvB,QAAQ,WAAW,KAAK;EACxB,QAAQ,WAAW,KAAK;EACxB,KAAK,WAAW,KAAK;EACrB,KAAK;EACL,MAAM,EACJ,OAAO;GACL,WAAW,QAAQ;GACnB,KAAK,QAAQ;GACb,UAAU,QAAQ;GACnB,EACF;EACD,MAAM,WAAW,KAAK;EAEtB,UAAU,QAAa,mBAAmB,WAAW,MAAM,IAAI;EAE/D,YAAY;GACV,MAAM,EAAE;GACR,OAAO,OAAO,QAAa;AAEzB,WAAO;KAAE,KAAK,EAAE,MADA,MAAM,mBAAmB,WAAW,MAAM,IAAI,EAC/B;KAAE,MAAM,EAAE;KAAE;;GAE9C;EACF;;AAsHH,SAAgB,QAAQ,MAAgB,QAA6B;AACnE,QAAO;EACL,MAAM,EAAE;EACR,OAAO,OAAO,KAAU,OAAY,WAAiB;GACnD,MAAM,aAAa,IAAI;GACvB,MAAM,eACJ,QAAQ,aAAa,OACjB,EAAE,MAAM,YAAqB,GAC7B,EAAE,MAAM,YAAqB;GAEnC,MAAM,cAAc,MAAM,GAAG,IAC3B,GAAG,MAAM,cAAc,aAAa,MAAM;IACxC,UAAU,YAAY;KACpB,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,IAAI;AACtC,SAAI,CAAC,OACH,QAAO;AAGT,YAAO;MAAE;MAAQ,MADJ,MAAM,KAAK,KAAK,IAAI,KAAK,OAAO;MACtB;;IAEzB,UAAU,YAAY;KACpB,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,IAAI;AACtC,SAAI,CAAC,OACH,QAAO;AAGT,YAAO;MAAE;MAAQ,MADJ,MAAM,KAAK,KAAK,IAAI,KAAK,OAAO;MACtB;;IAE1B,CAAC,CACH;AAED,OAAI,gBAAgB,KAClB,QAAO;IACL,KAAK,EACH,MAAM;KACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;KAC5D,QAAQ;KACR,MAAM;KACP,EACF;IACD,MAAM,EAAE;IACT;GAGH,MAAM,QAAQ,QAAQ,UAClB,MAAM,OAAO,QAAQ,KAAK,YAAY,KAAK,GAC3C,EAAE;AAEN,UAAO;IACL,KAAK,EACH,MAAM;KACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;KAC5D,QAAQ,YAAY;KACpB,MAAM,YAAY;KAClB,GAAG;KACJ,EACF;IACD,MAAM,EAAE;IACT;;EAEJ"}

package/dist/server/authError.d.ts

@@ -0,0 +1,46 @@
+import { AuthErrorCode } from "./errors.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/authError.d.ts
+/**
+ * Typed error for the Fx error channel.
+ *
+ * Use with `Fx.fail(new AuthError("CODE"))` in pipelines.
+ * At Convex boundaries, {@link toConvexError} converts these to `ConvexError`.
+ */
+declare class AuthError extends Error {
+  /**
+   * Machine-readable error code.
+   * @readonly
+   */
+  readonly code: AuthErrorCode;
+  /**
+   * Optional structured context for diagnostics.
+   * @readonly
+   */
+  readonly context?: Record<string, unknown> | undefined;
+  /**
+   * Discriminant tag for error channel matching.
+   * @readonly
+   */
+  readonly _tag: "AuthError";
+  constructor(
+  /**
+   * Machine-readable error code.
+   * @readonly
+   */
+  code: AuthErrorCode, message?: string,
+  /**
+   * Optional structured context for diagnostics.
+   * @readonly
+   */
+  context?: Record<string, unknown> | undefined);
+  /** Convert to the `ConvexError` shape the Convex runtime expects. */
+  toConvexError(): ConvexError<{
+    code: AuthErrorCode;
+    message: string;
+  }>;
+}
+//#endregion
+export { AuthError };
+//# sourceMappingURL=authError.d.ts.map

package/dist/server/authError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authError.d.ts","names":[],"sources":["../../src/server/authError.ts"],"mappings":";;;;;;AAYA;;;;cAAa,SAAA,SAAkB,KAAA;EAYZ;;;;EAAA,SAAN,IAAA,EAAM,aAAA;EAZiB;;;;EAAA,SAkBvB,OAAA,GAAU,MAAA;EAAV;;;;EAAA,SAbF,IAAA;;EAQP;;;;EADS,IAAA,EAAM,aAAA,EACf,OAAA;EAW6B;;;;EANpB,OAAA,GAAU,MAAA;;EAMrB,aAAA,CAAA,GAAiB,WAAA;IAAc,IAAA,EAAM,aAAA;IAAe,OAAA;EAAA;AAAA"}

package/dist/server/authError.js

@@ -0,0 +1,34 @@
+import { AUTH_ERRORS } from "./errors.js";
+import { Cv } from "@robelest/fx/convex";
+
+//#region src/server/authError.ts
+/**
+* Typed error for the Fx error channel.
+*
+* Use with `Fx.fail(new AuthError("CODE"))` in pipelines.
+* At Convex boundaries, {@link toConvexError} converts these to `ConvexError`.
+*/
+var AuthError = class extends Error {
+	/**
+	* Discriminant tag for error channel matching.
+	* @readonly
+	*/
+	_tag = "AuthError";
+	constructor(code, message, context) {
+		super(message ?? AUTH_ERRORS[code]);
+		this.code = code;
+		this.context = context;
+	}
+	/** Convert to the `ConvexError` shape the Convex runtime expects. */
+	toConvexError() {
+		return Cv.error({
+			code: this.code,
+			message: this.message,
+			...this.context
+		});
+	}
+};
+
+//#endregion
+export { AuthError };
+//# sourceMappingURL=authError.js.map

package/dist/server/authError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authError.js","names":[],"sources":["../../src/server/authError.ts"],"sourcesContent":["import { Cv } from \"@robelest/fx/convex\";\nimport type { ConvexError } from \"convex/values\";\n\nimport { AUTH_ERRORS } from \"./errors\";\nimport type { AuthErrorCode } from \"./errors\";\n\n/**\n * Typed error for the Fx error channel.\n *\n * Use with `Fx.fail(new AuthError(\"CODE\"))` in pipelines.\n * At Convex boundaries, {@link toConvexError} converts these to `ConvexError`.\n */\nexport class AuthError extends Error {\n  /**\n   * Discriminant tag for error channel matching.\n   * @readonly\n   */\n  readonly _tag = \"AuthError\" as const;\n\n  constructor(\n    /**\n     * Machine-readable error code.\n     * @readonly\n     */\n    readonly code: AuthErrorCode,\n    message?: string,\n    /**\n     * Optional structured context for diagnostics.\n     * @readonly\n     */\n    readonly context?: Record<string, unknown>,\n  ) {\n    super(message ?? AUTH_ERRORS[code]);\n  }\n\n  /** Convert to the `ConvexError` shape the Convex runtime expects. */\n  toConvexError(): ConvexError<{ code: AuthErrorCode; message: string }> {\n    return Cv.error({\n      code: this.code,\n      message: this.message,\n      ...this.context,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;AAYA,IAAa,YAAb,cAA+B,MAAM;;;;;CAKnC,AAAS,OAAO;CAEhB,YAKE,AAAS,MACT,SAKA,AAAS,SACT;AACA,QAAM,WAAW,YAAY,MAAM;EAR1B;EAMA;;;CAMX,gBAAuE;AACrE,SAAO,GAAG,MAAM;GACd,MAAM,KAAK;GACX,SAAS,KAAK;GACd,GAAG,KAAK;GACT,CAAC"}

package/dist/server/config.d.ts

@@ -0,0 +1 @@
+export { };