@robelest/convex-auth 0.0.4-preview.22 → 0.0.4-preview.24

package/dist/server/mutations/store.d.ts

@@ -1,10 +1,10 @@
 import { Doc, MutationCtx, SessionInfo } from "../types.js";
 import { Config, GetProviderOrThrowFunc } from "../crypto.js";
-import * as convex_values41 from "convex/values";
+import * as convex_values39 from "convex/values";
 import { Infer } from "convex/values";
 
 //#region src/server/mutations/store.d.ts
-declare const storeArgs: convex_values41.VObject<{
+declare const storeArgs: convex_values39.VObject<{
   args: {
     sessionId?: string | undefined;
     type: "signIn";
@@ -30,26 +30,26 @@ declare const storeArgs: convex_values41.VObject<{
     signature: string;
   } | {
     accountExtend?: any;
-    profile: any;
     type: "userOAuth";
     provider: string;
     signature: string;
     providerAccountId: string;
+    profile: any;
   } | {
-    phone?: string | undefined;
     email?: string | undefined;
     accountId?: string | undefined;
-    code: string;
+    phone?: string | undefined;
     type: "createVerificationCode";
     provider: string;
     allowExtraProviders: boolean;
+    code: string;
     expirationTime: number;
   } | {
     shouldLinkViaEmail?: boolean | undefined;
     shouldLinkViaPhone?: boolean | undefined;
-    profile: any;
     type: "createAccountFromCredentials";
     provider: string;
+    profile: any;
     account: {
       secret?: string | undefined;
       id: string;
@@ -74,7 +74,7 @@ declare const storeArgs: convex_values41.VObject<{
     userId: string;
   };
 }, {
-  args: convex_values41.VUnion<{
+  args: convex_values39.VUnion<{
     sessionId?: string | undefined;
     type: "signIn";
     userId: string;
@@ -99,26 +99,26 @@ declare const storeArgs: convex_values41.VObject<{
     signature: string;
   } | {
     accountExtend?: any;
-    profile: any;
     type: "userOAuth";
     provider: string;
     signature: string;
     providerAccountId: string;
+    profile: any;
   } | {
-    phone?: string | undefined;
     email?: string | undefined;
     accountId?: string | undefined;
-    code: string;
+    phone?: string | undefined;
     type: "createVerificationCode";
     provider: string;
     allowExtraProviders: boolean;
+    code: string;
     expirationTime: number;
   } | {
     shouldLinkViaEmail?: boolean | undefined;
     shouldLinkViaPhone?: boolean | undefined;
-    profile: any;
     type: "createAccountFromCredentials";
     provider: string;
+    profile: any;
     account: {
       secret?: string | undefined;
       id: string;
@@ -141,27 +141,27 @@ declare const storeArgs: convex_values41.VObject<{
     except?: string[] | undefined;
     type: "invalidateSessions";
     userId: string;
-  }, [convex_values41.VObject<{
+  }, [convex_values39.VObject<{
     sessionId?: string | undefined;
     type: "signIn";
     userId: string;
     generateTokens: boolean;
   }, {
-    userId: convex_values41.VString<string, "required">;
-    sessionId: convex_values41.VString<string | undefined, "optional">;
-    generateTokens: convex_values41.VBoolean<boolean, "required">;
-    type: convex_values41.VLiteral<"signIn", "required">;
-  }, "required", "type" | "userId" | "sessionId" | "generateTokens">, convex_values41.VObject<{
+    userId: convex_values39.VString<string, "required">;
+    sessionId: convex_values39.VString<string | undefined, "optional">;
+    generateTokens: convex_values39.VBoolean<boolean, "required">;
+    type: convex_values39.VLiteral<"signIn", "required">;
+  }, "required", "type" | "userId" | "sessionId" | "generateTokens">, convex_values39.VObject<{
     type: "signOut";
   }, {
-    type: convex_values41.VLiteral<"signOut", "required">;
-  }, "required", "type">, convex_values41.VObject<{
+    type: convex_values39.VLiteral<"signOut", "required">;
+  }, "required", "type">, convex_values39.VObject<{
     type: "refreshSession";
     refreshToken: string;
   }, {
-    refreshToken: convex_values41.VString<string, "required">;
-    type: convex_values41.VLiteral<"refreshSession", "required">;
-  }, "required", "type" | "refreshToken">, convex_values41.VObject<{
+    refreshToken: convex_values39.VString<string, "required">;
+    type: convex_values39.VLiteral<"refreshSession", "required">;
+  }, "required", "type" | "refreshToken">, convex_values39.VObject<{
     provider?: string | undefined;
     verifier?: string | undefined;
     type: "verifyCodeAndSignIn";
@@ -169,80 +169,80 @@ declare const storeArgs: convex_values41.VObject<{
     generateTokens: boolean;
     allowExtraProviders: boolean;
   }, {
-    params: convex_values41.VAny<any, "required", string>;
-    provider: convex_values41.VString<string | undefined, "optional">;
-    verifier: convex_values41.VString<string | undefined, "optional">;
-    generateTokens: convex_values41.VBoolean<boolean, "required">;
-    allowExtraProviders: convex_values41.VBoolean<boolean, "required">;
-    type: convex_values41.VLiteral<"verifyCodeAndSignIn", "required">;
-  }, "required", "type" | "provider" | "params" | "verifier" | "generateTokens" | "allowExtraProviders" | `params.${string}`>, convex_values41.VObject<{
+    params: convex_values39.VAny<any, "required", string>;
+    provider: convex_values39.VString<string | undefined, "optional">;
+    verifier: convex_values39.VString<string | undefined, "optional">;
+    generateTokens: convex_values39.VBoolean<boolean, "required">;
+    allowExtraProviders: convex_values39.VBoolean<boolean, "required">;
+    type: convex_values39.VLiteral<"verifyCodeAndSignIn", "required">;
+  }, "required", "type" | "provider" | "params" | "verifier" | "generateTokens" | "allowExtraProviders" | `params.${string}`>, convex_values39.VObject<{
     type: "verifier";
   }, {
-    type: convex_values41.VLiteral<"verifier", "required">;
-  }, "required", "type">, convex_values41.VObject<{
+    type: convex_values39.VLiteral<"verifier", "required">;
+  }, "required", "type">, convex_values39.VObject<{
     type: "verifierSignature";
     verifier: string;
     signature: string;
   }, {
-    verifier: convex_values41.VString<string, "required">;
-    signature: convex_values41.VString<string, "required">;
-    type: convex_values41.VLiteral<"verifierSignature", "required">;
-  }, "required", "type" | "verifier" | "signature">, convex_values41.VObject<{
+    verifier: convex_values39.VString<string, "required">;
+    signature: convex_values39.VString<string, "required">;
+    type: convex_values39.VLiteral<"verifierSignature", "required">;
+  }, "required", "type" | "verifier" | "signature">, convex_values39.VObject<{
     accountExtend?: any;
-    profile: any;
     type: "userOAuth";
     provider: string;
     signature: string;
     providerAccountId: string;
+    profile: any;
   }, {
-    provider: convex_values41.VString<string, "required">;
-    providerAccountId: convex_values41.VString<string, "required">;
-    profile: convex_values41.VAny<any, "required", string>;
-    signature: convex_values41.VString<string, "required">;
-    accountExtend: convex_values41.VAny<any, "optional", string>;
-    type: convex_values41.VLiteral<"userOAuth", "required">;
-  }, "required", "profile" | "type" | "provider" | "signature" | "providerAccountId" | "accountExtend" | `profile.${string}` | `accountExtend.${string}`>, convex_values41.VObject<{
-    phone?: string | undefined;
+    provider: convex_values39.VString<string, "required">;
+    providerAccountId: convex_values39.VString<string, "required">;
+    profile: convex_values39.VAny<any, "required", string>;
+    signature: convex_values39.VString<string, "required">;
+    accountExtend: convex_values39.VAny<any, "optional", string>;
+    type: convex_values39.VLiteral<"userOAuth", "required">;
+  }, "required", "type" | "provider" | "signature" | "providerAccountId" | "profile" | "accountExtend" | `profile.${string}` | `accountExtend.${string}`>, convex_values39.VObject<{
     email?: string | undefined;
     accountId?: string | undefined;
-    code: string;
+    phone?: string | undefined;
     type: "createVerificationCode";
     provider: string;
     allowExtraProviders: boolean;
+    code: string;
     expirationTime: number;
   }, {
-    accountId: convex_values41.VString<string | undefined, "optional">;
-    provider: convex_values41.VString<string, "required">;
-    email: convex_values41.VString<string | undefined, "optional">;
-    phone: convex_values41.VString<string | undefined, "optional">;
-    code: convex_values41.VString<string, "required">;
-    expirationTime: convex_values41.VFloat64<number, "required">;
-    allowExtraProviders: convex_values41.VBoolean<boolean, "required">;
-    type: convex_values41.VLiteral<"createVerificationCode", "required">;
-  }, "required", "phone" | "email" | "code" | "type" | "provider" | "allowExtraProviders" | "accountId" | "expirationTime">, convex_values41.VObject<{
+    accountId: convex_values39.VString<string | undefined, "optional">;
+    provider: convex_values39.VString<string, "required">;
+    email: convex_values39.VString<string | undefined, "optional">;
+    phone: convex_values39.VString<string | undefined, "optional">;
+    code: convex_values39.VString<string, "required">;
+    expirationTime: convex_values39.VFloat64<number, "required">;
+    allowExtraProviders: convex_values39.VBoolean<boolean, "required">;
+    type: convex_values39.VLiteral<"createVerificationCode", "required">;
+  }, "required", "email" | "type" | "provider" | "allowExtraProviders" | "accountId" | "phone" | "code" | "expirationTime">, convex_values39.VObject<{
     shouldLinkViaEmail?: boolean | undefined;
     shouldLinkViaPhone?: boolean | undefined;
-    profile: any;
     type: "createAccountFromCredentials";
     provider: string;
+    profile: any;
     account: {
       secret?: string | undefined;
       id: string;
     };
   }, {
-    provider: convex_values41.VString<string, "required">;
-    account: convex_values41.VObject<{
+    provider: convex_values39.VString<string, "required">;
+    account: convex_values39.VObject<{
       secret?: string | undefined;
       id: string;
     }, {
-      id: convex_values41.VString<string, "required">;
-      secret: convex_values41.VString<string | undefined, "optional">;
+      id: convex_values39.VString<string, "required">;
+      secret: convex_values39.VString<string | undefined, "optional">;
     }, "required", "id" | "secret">;
-    profile: convex_values41.VAny<any, "required", string>;
-    shouldLinkViaEmail: convex_values41.VBoolean<boolean | undefined, "optional">;
-    shouldLinkViaPhone: convex_values41.VBoolean<boolean | undefined, "optional">;
-    type: convex_values41.VLiteral<"createAccountFromCredentials", "required">;
-  }, "required", "profile" | "type" | "provider" | `profile.${string}` | "account" | "shouldLinkViaEmail" | "shouldLinkViaPhone" | "account.id" | "account.secret">, convex_values41.VObject<{
+    profile: convex_values39.VAny<any, "required", string>;
+    shouldLinkViaEmail: convex_values39.VBoolean<boolean | undefined, "optional">;
+    shouldLinkViaPhone: convex_values39.VBoolean<boolean | undefined, "optional">;
+    type: convex_values39.VLiteral<"createAccountFromCredentials", "required">;
+  }, "required", "type" | "provider" | "profile" | `profile.${string}` | "account" | "shouldLinkViaEmail" | "shouldLinkViaPhone" | "account.id" | "account.secret">, convex_values39.VObject<{
     type: "retrieveAccountWithCredentials";
     provider: string;
     account: {
@@ -250,16 +250,16 @@ declare const storeArgs: convex_values41.VObject<{
       id: string;
     };
   }, {
-    provider: convex_values41.VString<string, "required">;
-    account: convex_values41.VObject<{
+    provider: convex_values39.VString<string, "required">;
+    account: convex_values39.VObject<{
       secret?: string | undefined;
       id: string;
     }, {
-      id: convex_values41.VString<string, "required">;
-      secret: convex_values41.VString<string | undefined, "optional">;
+      id: convex_values39.VString<string, "required">;
+      secret: convex_values39.VString<string | undefined, "optional">;
     }, "required", "id" | "secret">;
-    type: convex_values41.VLiteral<"retrieveAccountWithCredentials", "required">;
-  }, "required", "type" | "provider" | "account" | "account.id" | "account.secret">, convex_values41.VObject<{
+    type: convex_values39.VLiteral<"retrieveAccountWithCredentials", "required">;
+  }, "required", "type" | "provider" | "account" | "account.id" | "account.secret">, convex_values39.VObject<{
     type: "modifyAccount";
     provider: string;
     account: {
@@ -267,28 +267,28 @@ declare const storeArgs: convex_values41.VObject<{
       secret: string;
     };
   }, {
-    provider: convex_values41.VString<string, "required">;
-    account: convex_values41.VObject<{
+    provider: convex_values39.VString<string, "required">;
+    account: convex_values39.VObject<{
       id: string;
       secret: string;
     }, {
-      id: convex_values41.VString<string, "required">;
-      secret: convex_values41.VString<string, "required">;
+      id: convex_values39.VString<string, "required">;
+      secret: convex_values39.VString<string, "required">;
     }, "required", "id" | "secret">;
-    type: convex_values41.VLiteral<"modifyAccount", "required">;
-  }, "required", "type" | "provider" | "account" | "account.id" | "account.secret">, convex_values41.VObject<{
+    type: convex_values39.VLiteral<"modifyAccount", "required">;
+  }, "required", "type" | "provider" | "account" | "account.id" | "account.secret">, convex_values39.VObject<{
     except?: string[] | undefined;
     type: "invalidateSessions";
     userId: string;
   }, {
-    userId: convex_values41.VString<string, "required">;
-    except: convex_values41.VArray<string[] | undefined, convex_values41.VString<string, "required">, "optional">;
-    type: convex_values41.VLiteral<"invalidateSessions", "required">;
-  }, "required", "type" | "userId" | "except">], "required", "phone" | "email" | "profile" | "code" | "type" | "provider" | "params" | "verifier" | "refreshToken" | "userId" | "sessionId" | "generateTokens" | "allowExtraProviders" | `params.${string}` | "signature" | "providerAccountId" | "accountExtend" | `profile.${string}` | `accountExtend.${string}` | "accountId" | "expirationTime" | "account" | "shouldLinkViaEmail" | "shouldLinkViaPhone" | "account.id" | "account.secret" | "except">;
-}, "required", "args" | "args.phone" | "args.email" | "args.profile" | "args.code" | "args.type" | "args.provider" | "args.params" | "args.verifier" | "args.refreshToken" | "args.userId" | "args.sessionId" | "args.generateTokens" | "args.allowExtraProviders" | `args.params.${string}` | "args.signature" | "args.providerAccountId" | "args.accountExtend" | `args.profile.${string}` | `args.accountExtend.${string}` | "args.accountId" | "args.expirationTime" | "args.account" | "args.shouldLinkViaEmail" | "args.shouldLinkViaPhone" | "args.account.id" | "args.account.secret" | "args.except">;
+    userId: convex_values39.VString<string, "required">;
+    except: convex_values39.VArray<string[] | undefined, convex_values39.VString<string, "required">, "optional">;
+    type: convex_values39.VLiteral<"invalidateSessions", "required">;
+  }, "required", "type" | "userId" | "except">], "required", "email" | "type" | "provider" | "params" | "verifier" | "refreshToken" | "userId" | "sessionId" | "generateTokens" | "allowExtraProviders" | `params.${string}` | "signature" | "providerAccountId" | "profile" | "accountExtend" | `profile.${string}` | `accountExtend.${string}` | "accountId" | "phone" | "code" | "expirationTime" | "account" | "shouldLinkViaEmail" | "shouldLinkViaPhone" | "account.id" | "account.secret" | "except">;
+}, "required", "args" | "args.email" | "args.type" | "args.provider" | "args.params" | "args.verifier" | "args.refreshToken" | "args.userId" | "args.sessionId" | "args.generateTokens" | "args.allowExtraProviders" | `args.params.${string}` | "args.signature" | "args.providerAccountId" | "args.profile" | "args.accountExtend" | `args.profile.${string}` | `args.accountExtend.${string}` | "args.accountId" | "args.phone" | "args.code" | "args.expirationTime" | "args.account" | "args.shouldLinkViaEmail" | "args.shouldLinkViaPhone" | "args.account.id" | "args.account.secret" | "args.except">;
 declare const storeImpl: (ctx: MutationCtx, fnArgs: Infer<typeof storeArgs>, getProviderOrThrow: GetProviderOrThrowFunc, config: Config) => Promise<string | void | {
-  userId: convex_values41.GenericId<"User">;
-  sessionId: convex_values41.GenericId<"Session">;
+  userId: convex_values39.GenericId<"User">;
+  sessionId: convex_values39.GenericId<"Session">;
 } | (string & {
   __tableName: "AuthVerifier";
 }) | SessionInfo | {

package/dist/server/mutations/store.js

@@ -50,32 +50,17 @@ const storeImpl = async (ctx, fnArgs, getProviderOrThrow, config) => {
 	const args = fnArgs.args;
 	logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
 	return Fx.run(Fx.match(args, args.type, {
-		signIn: (a) => Fx.from({
-			ok: () => signInImpl(ctx, a, config),
-			err: (e) => e
-		}),
+		signIn: (a) => Fx.promise(() => signInImpl(ctx, a, config)),
 		signOut: () => signOutImpl(ctx, config),
-		refreshSession: (a) => Fx.from({
-			ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
-		verifyCodeAndSignIn: (a) => Fx.from({
-			ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
+		refreshSession: (a) => Fx.promise(() => refreshSessionImpl(ctx, a, getProviderOrThrow, config)),
+		verifyCodeAndSignIn: (a) => Fx.promise(() => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config)),
 		verifier: () => verifierImpl(ctx, config),
-		verifierSignature: (a) => verifierSignatureImpl(ctx, a, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
-		userOAuth: (a) => userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
-		createVerificationCode: (a) => Fx.from({
-			ok: () => createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
-		createAccountFromCredentials: (a) => Fx.from({
-			ok: () => createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
+		verifierSignature: (a) => verifierSignatureImpl(ctx, a, config).pipe(Fx.recover((e) => Fx.fatal(e))),
+		userOAuth: (a) => userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e))),
+		createVerificationCode: (a) => Fx.promise(() => createVerificationCodeImpl(ctx, a, getProviderOrThrow, config)),
+		createAccountFromCredentials: (a) => Fx.promise(() => createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config)),
 		retrieveAccountWithCredentials: (a) => retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
-		modifyAccount: (a) => modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
+		modifyAccount: (a) => modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e))),
 		invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config)
 	}));
 };

package/dist/server/mutations/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","names":[],"sources":["../../../src/server/mutations/store.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { modifyAccountArgs, modifyAccountImpl } from \"./account\";\nimport { createVerificationCodeArgs, createVerificationCodeImpl } from \"./code\";\nimport { invalidateSessionsArgs, invalidateSessionsImpl } from \"./invalidate\";\nimport { userOAuthArgs, userOAuthImpl } from \"./oauth\";\nimport { refreshSessionArgs, refreshSessionImpl } from \"./refresh\";\nimport {\n  createAccountFromCredentialsArgs,\n  createAccountFromCredentialsImpl,\n} from \"./register\";\nimport {\n  retrieveAccountWithCredentialsArgs,\n  retrieveAccountWithCredentialsImpl,\n} from \"./retrieve\";\nimport { verifierSignatureArgs, verifierSignatureImpl } from \"./signature\";\nimport { signInArgs, signInImpl } from \"./signin\";\nimport { signOutImpl } from \"./signout\";\nimport { verifierImpl } from \"./verifier\";\nimport { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from \"./verify\";\n\nexport const storeArgs = v.object({\n  args: v.union(\n    v.object({\n      type: v.literal(\"signIn\"),\n      ...signInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"signOut\"),\n    }),\n    v.object({\n      type: v.literal(\"refreshSession\"),\n      ...refreshSessionArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifyCodeAndSignIn\"),\n      ...verifyCodeAndSignInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifier\"),\n    }),\n    v.object({\n      type: v.literal(\"verifierSignature\"),\n      ...verifierSignatureArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"userOAuth\"),\n      ...userOAuthArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createVerificationCode\"),\n      ...createVerificationCodeArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createAccountFromCredentials\"),\n      ...createAccountFromCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"retrieveAccountWithCredentials\"),\n      ...retrieveAccountWithCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"modifyAccount\"),\n      ...modifyAccountArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"invalidateSessions\"),\n      ...invalidateSessionsArgs.fields,\n    }),\n  ),\n});\n\nexport const storeImpl = async (\n  ctx: MutationCtx,\n  fnArgs: Infer<typeof storeArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n) => {\n  const args = fnArgs.args;\n  logWithLevel(LOG_LEVELS.INFO, `\\`auth:store\\` type: ${args.type}`);\n  return Fx.run(\n    Fx.match(args, args.type, {\n      signIn: (a) =>\n        Fx.from({\n          ok: () => signInImpl(ctx, a, config),\n          err: (e) => e as never,\n        }),\n      signOut: () => signOutImpl(ctx, config),\n      refreshSession: (a) =>\n        Fx.from({\n          ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),\n          err: (e) => e as never,\n        }),\n      verifyCodeAndSignIn: (a) =>\n        Fx.from({\n          ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),\n          err: (e) => e as never,\n        }),\n      verifier: () => verifierImpl(ctx, config),\n      verifierSignature: (a) =>\n        verifierSignatureImpl(ctx, a, config).pipe(\n          Fx.recover((e) => Fx.fatal(e.toConvexError())),\n        ),\n      userOAuth: (a) =>\n        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e.toConvexError())),\n        ),\n      createVerificationCode: (a) =>\n        Fx.from({\n          ok: () =>\n            createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),\n          err: (e) => e as never,\n        }),\n      createAccountFromCredentials: (a) =>\n        Fx.from({\n          ok: () =>\n            createAccountFromCredentialsImpl(\n              ctx,\n              a,\n              getProviderOrThrow,\n              config,\n            ),\n          err: (e) => e as never,\n        }),\n      retrieveAccountWithCredentials: (a) =>\n        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),\n      modifyAccount: (a) =>\n        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e.toConvexError())),\n        ),\n      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),\n    }),\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY,EAAE,OAAO,EAChC,MAAM,EAAE,MACN,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,GAAG,WAAW;CACf,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,UAAU,EAC3B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iBAAiB;CACjC,GAAG,mBAAmB;CACvB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,sBAAsB;CACtC,GAAG,wBAAwB;CAC5B,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,WAAW,EAC5B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,oBAAoB;CACpC,GAAG,sBAAsB;CAC1B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,YAAY;CAC5B,GAAG,cAAc;CAClB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,yBAAyB;CACzC,GAAG,2BAA2B;CAC/B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,+BAA+B;CAC/C,GAAG,iCAAiC;CACrC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iCAAiC;CACjD,GAAG,mCAAmC;CACvC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,gBAAgB;CAChC,GAAG,kBAAkB;CACtB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,qBAAqB;CACrC,GAAG,uBAAuB;CAC3B,CAAC,CACH,EACF,CAAC;AAEF,MAAa,YAAY,OACvB,KACA,QACA,oBACA,WACG;CACH,MAAM,OAAO,OAAO;AACpB,cAAa,WAAW,MAAM,wBAAwB,KAAK,OAAO;AAClE,QAAO,GAAG,IACR,GAAG,MAAM,MAAM,KAAK,MAAM;EACxB,SAAS,MACP,GAAG,KAAK;GACN,UAAU,WAAW,KAAK,GAAG,OAAO;GACpC,MAAM,MAAM;GACb,CAAC;EACJ,eAAe,YAAY,KAAK,OAAO;EACvC,iBAAiB,MACf,GAAG,KAAK;GACN,UAAU,mBAAmB,KAAK,GAAG,oBAAoB,OAAO;GAChE,MAAM,MAAM;GACb,CAAC;EACJ,sBAAsB,MACpB,GAAG,KAAK;GACN,UAAU,wBAAwB,KAAK,GAAG,oBAAoB,OAAO;GACrE,MAAM,MAAM;GACb,CAAC;EACJ,gBAAgB,aAAa,KAAK,OAAO;EACzC,oBAAoB,MAClB,sBAAsB,KAAK,GAAG,OAAO,CAAC,KACpC,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAC/C;EACH,YAAY,MACV,cAAc,KAAK,GAAG,oBAAoB,OAAO,CAAC,KAChD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAC/C;EACH,yBAAyB,MACvB,GAAG,KAAK;GACN,UACE,2BAA2B,KAAK,GAAG,oBAAoB,OAAO;GAChE,MAAM,MAAM;GACb,CAAC;EACJ,+BAA+B,MAC7B,GAAG,KAAK;GACN,UACE,iCACE,KACA,GACA,oBACA,OACD;GACH,MAAM,MAAM;GACb,CAAC;EACJ,iCAAiC,MAC/B,mCAAmC,KAAK,GAAG,oBAAoB,OAAO;EACxE,gBAAgB,MACd,kBAAkB,KAAK,GAAG,oBAAoB,OAAO,CAAC,KACpD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAC/C;EACH,qBAAqB,MAAM,uBAAuB,KAAK,GAAG,OAAO;EAClE,CAAC,CACH"}
+{"version":3,"file":"store.js","names":[],"sources":["../../../src/server/mutations/store.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { modifyAccountArgs, modifyAccountImpl } from \"./account\";\nimport { createVerificationCodeArgs, createVerificationCodeImpl } from \"./code\";\nimport { invalidateSessionsArgs, invalidateSessionsImpl } from \"./invalidate\";\nimport { userOAuthArgs, userOAuthImpl } from \"./oauth\";\nimport { refreshSessionArgs, refreshSessionImpl } from \"./refresh\";\nimport {\n  createAccountFromCredentialsArgs,\n  createAccountFromCredentialsImpl,\n} from \"./register\";\nimport {\n  retrieveAccountWithCredentialsArgs,\n  retrieveAccountWithCredentialsImpl,\n} from \"./retrieve\";\nimport { verifierSignatureArgs, verifierSignatureImpl } from \"./signature\";\nimport { signInArgs, signInImpl } from \"./signin\";\nimport { signOutImpl } from \"./signout\";\nimport { verifierImpl } from \"./verifier\";\nimport { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from \"./verify\";\n\nexport const storeArgs = v.object({\n  args: v.union(\n    v.object({\n      type: v.literal(\"signIn\"),\n      ...signInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"signOut\"),\n    }),\n    v.object({\n      type: v.literal(\"refreshSession\"),\n      ...refreshSessionArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifyCodeAndSignIn\"),\n      ...verifyCodeAndSignInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifier\"),\n    }),\n    v.object({\n      type: v.literal(\"verifierSignature\"),\n      ...verifierSignatureArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"userOAuth\"),\n      ...userOAuthArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createVerificationCode\"),\n      ...createVerificationCodeArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createAccountFromCredentials\"),\n      ...createAccountFromCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"retrieveAccountWithCredentials\"),\n      ...retrieveAccountWithCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"modifyAccount\"),\n      ...modifyAccountArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"invalidateSessions\"),\n      ...invalidateSessionsArgs.fields,\n    }),\n  ),\n});\n\nexport const storeImpl = async (\n  ctx: MutationCtx,\n  fnArgs: Infer<typeof storeArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n) => {\n  const args = fnArgs.args;\n  logWithLevel(LOG_LEVELS.INFO, `\\`auth:store\\` type: ${args.type}`);\n  return Fx.run(\n    Fx.match(args, args.type, {\n      signIn: (a) => Fx.promise(() => signInImpl(ctx, a, config)),\n      signOut: () => signOutImpl(ctx, config),\n      refreshSession: (a) =>\n        Fx.promise(() =>\n          refreshSessionImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      verifyCodeAndSignIn: (a) =>\n        Fx.promise(() =>\n          verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      verifier: () => verifierImpl(ctx, config),\n      verifierSignature: (a) =>\n        verifierSignatureImpl(ctx, a, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      userOAuth: (a) =>\n        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      createVerificationCode: (a) =>\n        Fx.promise(() =>\n          createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      createAccountFromCredentials: (a) =>\n        Fx.promise(() =>\n          createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      retrieveAccountWithCredentials: (a) =>\n        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),\n      modifyAccount: (a) =>\n        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),\n    }),\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY,EAAE,OAAO,EAChC,MAAM,EAAE,MACN,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,GAAG,WAAW;CACf,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,UAAU,EAC3B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iBAAiB;CACjC,GAAG,mBAAmB;CACvB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,sBAAsB;CACtC,GAAG,wBAAwB;CAC5B,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,WAAW,EAC5B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,oBAAoB;CACpC,GAAG,sBAAsB;CAC1B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,YAAY;CAC5B,GAAG,cAAc;CAClB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,yBAAyB;CACzC,GAAG,2BAA2B;CAC/B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,+BAA+B;CAC/C,GAAG,iCAAiC;CACrC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iCAAiC;CACjD,GAAG,mCAAmC;CACvC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,gBAAgB;CAChC,GAAG,kBAAkB;CACtB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,qBAAqB;CACrC,GAAG,uBAAuB;CAC3B,CAAC,CACH,EACF,CAAC;AAEF,MAAa,YAAY,OACvB,KACA,QACA,oBACA,WACG;CACH,MAAM,OAAO,OAAO;AACpB,cAAa,WAAW,MAAM,wBAAwB,KAAK,OAAO;AAClE,QAAO,GAAG,IACR,GAAG,MAAM,MAAM,KAAK,MAAM;EACxB,SAAS,MAAM,GAAG,cAAc,WAAW,KAAK,GAAG,OAAO,CAAC;EAC3D,eAAe,YAAY,KAAK,OAAO;EACvC,iBAAiB,MACf,GAAG,cACD,mBAAmB,KAAK,GAAG,oBAAoB,OAAO,CACvD;EACH,sBAAsB,MACpB,GAAG,cACD,wBAAwB,KAAK,GAAG,oBAAoB,OAAO,CAC5D;EACH,gBAAgB,aAAa,KAAK,OAAO;EACzC,oBAAoB,MAClB,sBAAsB,KAAK,GAAG,OAAO,CAAC,KACpC,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,YAAY,MACV,cAAc,KAAK,GAAG,oBAAoB,OAAO,CAAC,KAChD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,yBAAyB,MACvB,GAAG,cACD,2BAA2B,KAAK,GAAG,oBAAoB,OAAO,CAC/D;EACH,+BAA+B,MAC7B,GAAG,cACD,iCAAiC,KAAK,GAAG,oBAAoB,OAAO,CACrE;EACH,iCAAiC,MAC/B,mCAAmC,KAAK,GAAG,oBAAoB,OAAO;EACxE,gBAAgB,MACd,kBAAkB,KAAK,GAAG,oBAAoB,OAAO,CAAC,KACpD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,qBAAqB,MAAM,uBAAuB,KAAK,GAAG,OAAO;EAClE,CAAC,CACH"}

package/dist/server/mutations/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","names":[],"sources":["../../../src/server/mutations/verifier.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../crypto\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\ntype ReturnType = GenericId<\"AuthVerifier\">;\n\nexport function verifierImpl(\n  ctx: MutationCtx,\n  config: Provider.Config,\n): Fx<ReturnType, never> {\n  return Fx.gen(function* () {\n    return (yield* Fx.promise(async () =>\n      authDb(ctx, config).verifiers.create(\n        (await getAuthSessionId(ctx)) ?? undefined,\n      ),\n    )) as ReturnType;\n  });\n}\n\nexport const callVerifier = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifier\",\n    },\n  });\n};\n"],"mappings":";;;;;;AAYA,SAAgB,aACd,KACA,QACuB;AACvB,QAAO,GAAG,IAAI,aAAa;AACzB,SAAQ,OAAO,GAAG,QAAQ,YACxB,OAAO,KAAK,OAAO,CAAC,UAAU,OAC3B,MAAM,iBAAiB,IAAI,IAAK,OAClC,CACF;GACD;;AAGJ,MAAa,eAAe,OAC1B,QACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM,EACJ,MAAM,YACP,EACF,CAAC"}
+{"version":3,"file":"verifier.js","names":[],"sources":["../../../src/server/mutations/verifier.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\ntype ReturnType = GenericId<\"AuthVerifier\">;\n\nexport function verifierImpl(\n  ctx: MutationCtx,\n  config: Provider.Config,\n): Fx<ReturnType, never> {\n  return Fx.gen(function* () {\n    return (yield* Fx.promise(async () =>\n      authDb(ctx, config).verifiers.create(\n        (await getAuthSessionId(ctx)) ?? undefined,\n      ),\n    )) as ReturnType;\n  });\n}\n\nexport const callVerifier = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifier\",\n    },\n  });\n};\n"],"mappings":";;;;;;AAYA,SAAgB,aACd,KACA,QACuB;AACvB,QAAO,GAAG,IAAI,aAAa;AACzB,SAAQ,OAAO,GAAG,QAAQ,YACxB,OAAO,KAAK,OAAO,CAAC,UAAU,OAC3B,MAAM,iBAAiB,IAAI,IAAK,OAClC,CACF;GACD;;AAGJ,MAAa,eAAe,OAC1B,QACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM,EACJ,MAAM,YACP,EACF,CAAC"}

package/dist/server/mutations/verify.d.ts

@@ -1,22 +1,22 @@
 import { MutationCtx, SessionInfo } from "../types.js";
 import { Config, GetProviderOrThrowFunc } from "../crypto.js";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
-import * as convex_values30 from "convex/values";
+import * as convex_values22 from "convex/values";
 import { Infer } from "convex/values";
 
 //#region src/server/mutations/verify.d.ts
-declare const verifyCodeAndSignInArgs: convex_values30.VObject<{
+declare const verifyCodeAndSignInArgs: convex_values22.VObject<{
   provider?: string | undefined;
   verifier?: string | undefined;
   params: any;
   generateTokens: boolean;
   allowExtraProviders: boolean;
 }, {
-  params: convex_values30.VAny<any, "required", string>;
-  provider: convex_values30.VString<string | undefined, "optional">;
-  verifier: convex_values30.VString<string | undefined, "optional">;
-  generateTokens: convex_values30.VBoolean<boolean, "required">;
-  allowExtraProviders: convex_values30.VBoolean<boolean, "required">;
+  params: convex_values22.VAny<any, "required", string>;
+  provider: convex_values22.VString<string | undefined, "optional">;
+  verifier: convex_values22.VString<string | undefined, "optional">;
+  generateTokens: convex_values22.VBoolean<boolean, "required">;
+  allowExtraProviders: convex_values22.VBoolean<boolean, "required">;
 }, "required", "provider" | "params" | "verifier" | "generateTokens" | "allowExtraProviders" | `params.${string}`>;
 type ReturnType = null | SessionInfo;
 declare function verifyCodeAndSignInImpl(ctx: MutationCtx, args: Infer<typeof verifyCodeAndSignInArgs>, getProviderOrThrow: GetProviderOrThrowFunc, config: Config): Promise<ReturnType>;

package/dist/server/mutations/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","names":[],"sources":["../../../src/server/mutations/verify.ts"],"mappings":";;;;;;;cA0Ba,uBAAA,kBAAuB,OAAA;;;;;;;UAMlC,eAAA,CAAA,IAAA;;;;;;KAEG,UAAA,UAAoB,WAAA;AAAA,iBAgBH,uBAAA,CACpB,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,uBAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,OAAA,CAAQ,UAAA;AAAA,cAsIE,uBAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,uBAAA,MAClB,OAAA,CAAQ,UAAA"}
+{"version":3,"file":"verify.d.ts","names":[],"sources":["../../../src/server/mutations/verify.ts"],"mappings":";;;;;;;cAwBa,uBAAA,kBAAuB,OAAA;;;;;;;UAMlC,eAAA,CAAA,IAAA;;;;;;KAEG,UAAA,UAAoB,WAAA;AAAA,iBAgBH,uBAAA,CACpB,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,uBAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,OAAA,CAAQ,UAAA;AAAA,cAsIE,uBAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,uBAAA,MAClB,OAAA,CAAQ,UAAA"}

package/dist/server/mutations/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","names":[],"sources":["../../../src/server/mutations/verify.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../crypto\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport {\n  createNewAndDeleteExistingSession,\n  getAuthSessionId,\n  maybeGenerateTokensForSession,\n} from \"../sessions\";\nimport {\n  createSyntheticOAuthMaterializedConfig,\n} from \"../enterprise/oidc\";\nimport { isEnterpriseProviderId } from \"../enterprise/shared\";\nimport { MutationCtx, SessionInfo } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, sha256 } from \"../utils\";\nimport { requireEnv } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifyCodeAndSignInArgs = v.object({\n  params: v.any(),\n  provider: v.optional(v.string()),\n  verifier: v.optional(v.string()),\n  generateTokens: v.boolean(),\n  allowExtraProviders: v.boolean(),\n});\n\ntype ReturnType = null | SessionInfo;\n\n// ============================================================================\n// Small validators for the verification pipeline\n// ============================================================================\n\n/** A soft verification failure — logged and collapsed to null at the boundary. */\nclass VerifyFailure {\n  readonly _tag = \"VerifyFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function verifyCodeAndSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"verifyCodeAndSignInImpl args:\", {\n    params: { email: args.params.email, phone: args.params.phone },\n    provider: args.provider,\n    verifier: args.verifier,\n    generateTokens: args.generateTokens,\n    allowExtraProviders: args.allowExtraProviders,\n  });\n\n  const { generateTokens, provider, allowExtraProviders } = args;\n  if (generateTokens) {\n    requireEnv(\"JWT_PRIVATE_KEY\");\n    requireEnv(\"JWKS\");\n    requireEnv(\"CONVEX_SITE_URL\");\n  }\n  const identifier: string | undefined = args.params.email ?? args.params.phone;\n\n  try {\n    if (identifier !== undefined) {\n      const limited = await Fx.run(\n        isSignInRateLimited(ctx, identifier, config),\n      );\n      if (limited) {\n        throw new VerifyFailure(\n          \"Too many failed attempts to verify code for this email\",\n        );\n      }\n    }\n\n    const db = authDb(ctx, config);\n    const { params, verifier } = args;\n    const hash = await sha256(params.code);\n    const code = await db.verificationCodes.getByCode(hash);\n    if (code === null) {\n      throw new VerifyFailure(\"Invalid verification code\");\n    }\n\n    await db.verificationCodes.delete(code._id);\n\n    if (code.verifier !== verifier) {\n      throw new VerifyFailure(\"Invalid verifier\");\n    }\n    if (code.expirationTime < Date.now()) {\n      throw new VerifyFailure(\"Expired verification code\");\n    }\n    if (provider !== undefined && code.provider !== provider) {\n      throw new VerifyFailure(\n        `Invalid provider \"${provider}\" for given \\`code\\``,\n      );\n    }\n\n    const account = await db.accounts.getById(code.accountId);\n    if (account === null) {\n      throw new VerifyFailure(\n        \"Account associated with this email has been deleted\",\n      );\n    }\n\n    const codeProvider = isEnterpriseProviderId(code.provider)\n      ? createSyntheticOAuthMaterializedConfig(code.provider)\n      : getProviderOrThrow(code.provider, allowExtraProviders);\n\n    if (\n      codeProvider !== null &&\n      (codeProvider.type === \"email\" || codeProvider.type === \"phone\") &&\n      codeProvider.authorize !== undefined\n    ) {\n      await codeProvider.authorize(args.params, account);\n    }\n\n    const methodProvider = isEnterpriseProviderId(account.provider)\n      ? createSyntheticOAuthMaterializedConfig(account.provider)\n      : getProviderOrThrow(account.provider);\n\n    const userId =\n      methodProvider.type === \"oauth\"\n        ? account.userId\n        : (\n            await upsertUserAndAccount(\n              ctx,\n              await getAuthSessionId(ctx),\n              { existingAccount: account },\n              {\n                type: \"verification\",\n                provider: methodProvider,\n                profile: {\n                  ...(code.emailVerified !== undefined\n                    ? { email: code.emailVerified, emailVerified: true }\n                    : {}),\n                  ...(code.phoneVerified !== undefined\n                    ? { phone: code.phoneVerified, phoneVerified: true }\n                    : {}),\n                },\n              },\n              config,\n            )\n          ).userId;\n\n    if (identifier !== undefined) {\n      await Fx.run(resetSignInRateLimit(ctx, identifier, config));\n    }\n\n    const sessionId = await createNewAndDeleteExistingSession(\n      ctx,\n      config,\n      userId,\n    );\n    return await maybeGenerateTokensForSession(\n      ctx,\n      config,\n      userId,\n      sessionId,\n      generateTokens,\n    );\n  } catch (error) {\n    if (error instanceof VerifyFailure) {\n      logWithLevel(LOG_LEVELS.ERROR, error.reason);\n      if (identifier !== undefined) {\n        await Fx.run(recordFailedSignIn(ctx, identifier, config));\n      }\n      return null;\n    }\n    logWithLevel(\n      LOG_LEVELS.ERROR,\n      `verifyCodeAndSignInImpl failed: ${String(error)}`,\n    );\n    return null;\n  }\n}\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callVerifyCodeAndSignIn = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifyCodeAndSignIn\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;AA0BA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,gBAAgB,EAAE,SAAS;CAC3B,qBAAqB,EAAE,SAAS;CACjC,CAAC;;AASF,IAAM,gBAAN,MAAoB;CAClB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,wBACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,iCAAiC;EAC9D,QAAQ;GAAE,OAAO,KAAK,OAAO;GAAO,OAAO,KAAK,OAAO;GAAO;EAC9D,UAAU,KAAK;EACf,UAAU,KAAK;EACf,gBAAgB,KAAK;EACrB,qBAAqB,KAAK;EAC3B,CAAC;CAEF,MAAM,EAAE,gBAAgB,UAAU,wBAAwB;AAC1D,KAAI,gBAAgB;AAClB,aAAW,kBAAkB;AAC7B,aAAW,OAAO;AAClB,aAAW,kBAAkB;;CAE/B,MAAM,aAAiC,KAAK,OAAO,SAAS,KAAK,OAAO;AAExE,KAAI;AACF,MAAI,eAAe,QAIjB;OAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,YAAY,OAAO,CAC7C,CAEC,OAAM,IAAI,cACR,yDACD;;EAIL,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,OAAO,MAAM,OAAO,OAAO,KAAK;EACtC,MAAM,OAAO,MAAM,GAAG,kBAAkB,UAAU,KAAK;AACvD,MAAI,SAAS,KACX,OAAM,IAAI,cAAc,4BAA4B;AAGtD,QAAM,GAAG,kBAAkB,OAAO,KAAK,IAAI;AAE3C,MAAI,KAAK,aAAa,SACpB,OAAM,IAAI,cAAc,mBAAmB;AAE7C,MAAI,KAAK,iBAAiB,KAAK,KAAK,CAClC,OAAM,IAAI,cAAc,4BAA4B;AAEtD,MAAI,aAAa,UAAa,KAAK,aAAa,SAC9C,OAAM,IAAI,cACR,qBAAqB,SAAS,sBAC/B;EAGH,MAAM,UAAU,MAAM,GAAG,SAAS,QAAQ,KAAK,UAAU;AACzD,MAAI,YAAY,KACd,OAAM,IAAI,cACR,sDACD;EAGH,MAAM,eAAe,uBAAuB,KAAK,SAAS,GACtD,uCAAuC,KAAK,SAAS,GACrD,mBAAmB,KAAK,UAAU,oBAAoB;AAE1D,MACE,iBAAiB,SAChB,aAAa,SAAS,WAAW,aAAa,SAAS,YACxD,aAAa,cAAc,OAE3B,OAAM,aAAa,UAAU,KAAK,QAAQ,QAAQ;EAGpD,MAAM,iBAAiB,uBAAuB,QAAQ,SAAS,GAC3D,uCAAuC,QAAQ,SAAS,GACxD,mBAAmB,QAAQ,SAAS;EAExC,MAAM,SACJ,eAAe,SAAS,UACpB,QAAQ,UAEN,MAAM,qBACJ,KACA,MAAM,iBAAiB,IAAI,EAC3B,EAAE,iBAAiB,SAAS,EAC5B;GACE,MAAM;GACN,UAAU;GACV,SAAS;IACP,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACN,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACP;GACF,EACD,OACD,EACD;AAER,MAAI,eAAe,OACjB,OAAM,GAAG,IAAI,qBAAqB,KAAK,YAAY,OAAO,CAAC;AAQ7D,SAAO,MAAM,8BACX,KACA,QACA,QARgB,MAAM,kCACtB,KACA,QACA,OACD,EAMC,eACD;UACM,OAAO;AACd,MAAI,iBAAiB,eAAe;AAClC,gBAAa,WAAW,OAAO,MAAM,OAAO;AAC5C,OAAI,eAAe,OACjB,OAAM,GAAG,IAAI,mBAAmB,KAAK,YAAY,OAAO,CAAC;AAE3D,UAAO;;AAET,eACE,WAAW,OACX,mCAAmC,OAAO,MAAM,GACjD;AACD,SAAO;;;AAQX,MAAa,0BAA0B,OAGrC,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"verify.js","names":[],"sources":["../../../src/server/mutations/verify.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { createSyntheticOAuthMaterializedConfig } from \"../enterprise/oidc\";\nimport { isEnterpriseProviderId } from \"../enterprise/shared\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport {\n  createNewAndDeleteExistingSession,\n  getAuthSessionId,\n  maybeGenerateTokensForSession,\n} from \"../sessions\";\nimport { MutationCtx, SessionInfo } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, sha256 } from \"../utils\";\nimport { requireEnv } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifyCodeAndSignInArgs = v.object({\n  params: v.any(),\n  provider: v.optional(v.string()),\n  verifier: v.optional(v.string()),\n  generateTokens: v.boolean(),\n  allowExtraProviders: v.boolean(),\n});\n\ntype ReturnType = null | SessionInfo;\n\n// ============================================================================\n// Small validators for the verification pipeline\n// ============================================================================\n\n/** A soft verification failure — logged and collapsed to null at the boundary. */\nclass VerifyFailure {\n  readonly _tag = \"VerifyFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function verifyCodeAndSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"verifyCodeAndSignInImpl args:\", {\n    params: { email: args.params.email, phone: args.params.phone },\n    provider: args.provider,\n    verifier: args.verifier,\n    generateTokens: args.generateTokens,\n    allowExtraProviders: args.allowExtraProviders,\n  });\n\n  const { generateTokens, provider, allowExtraProviders } = args;\n  if (generateTokens) {\n    requireEnv(\"JWT_PRIVATE_KEY\");\n    requireEnv(\"JWKS\");\n    requireEnv(\"CONVEX_SITE_URL\");\n  }\n  const identifier: string | undefined = args.params.email ?? args.params.phone;\n\n  try {\n    if (identifier !== undefined) {\n      const limited = await Fx.run(\n        isSignInRateLimited(ctx, identifier, config),\n      );\n      if (limited) {\n        throw new VerifyFailure(\n          \"Too many failed attempts to verify code for this email\",\n        );\n      }\n    }\n\n    const db = authDb(ctx, config);\n    const { params, verifier } = args;\n    const hash = await sha256(params.code);\n    const code = await db.verificationCodes.getByCode(hash);\n    if (code === null) {\n      throw new VerifyFailure(\"Invalid verification code\");\n    }\n\n    await db.verificationCodes.delete(code._id);\n\n    if (code.verifier !== verifier) {\n      throw new VerifyFailure(\"Invalid verifier\");\n    }\n    if (code.expirationTime < Date.now()) {\n      throw new VerifyFailure(\"Expired verification code\");\n    }\n    if (provider !== undefined && code.provider !== provider) {\n      throw new VerifyFailure(\n        `Invalid provider \"${provider}\" for given \\`code\\``,\n      );\n    }\n\n    const account = await db.accounts.getById(code.accountId);\n    if (account === null) {\n      throw new VerifyFailure(\n        \"Account associated with this email has been deleted\",\n      );\n    }\n\n    const codeProvider = isEnterpriseProviderId(code.provider)\n      ? createSyntheticOAuthMaterializedConfig(code.provider)\n      : getProviderOrThrow(code.provider, allowExtraProviders);\n\n    if (\n      codeProvider !== null &&\n      (codeProvider.type === \"email\" || codeProvider.type === \"phone\") &&\n      codeProvider.authorize !== undefined\n    ) {\n      await codeProvider.authorize(args.params, account);\n    }\n\n    const methodProvider = isEnterpriseProviderId(account.provider)\n      ? createSyntheticOAuthMaterializedConfig(account.provider)\n      : getProviderOrThrow(account.provider);\n\n    const userId =\n      methodProvider.type === \"oauth\"\n        ? account.userId\n        : (\n            await upsertUserAndAccount(\n              ctx,\n              await getAuthSessionId(ctx),\n              { existingAccount: account },\n              {\n                type: \"verification\",\n                provider: methodProvider,\n                profile: {\n                  ...(code.emailVerified !== undefined\n                    ? { email: code.emailVerified, emailVerified: true }\n                    : {}),\n                  ...(code.phoneVerified !== undefined\n                    ? { phone: code.phoneVerified, phoneVerified: true }\n                    : {}),\n                },\n              },\n              config,\n            )\n          ).userId;\n\n    if (identifier !== undefined) {\n      await Fx.run(resetSignInRateLimit(ctx, identifier, config));\n    }\n\n    const sessionId = await createNewAndDeleteExistingSession(\n      ctx,\n      config,\n      userId,\n    );\n    return await maybeGenerateTokensForSession(\n      ctx,\n      config,\n      userId,\n      sessionId,\n      generateTokens,\n    );\n  } catch (error) {\n    if (error instanceof VerifyFailure) {\n      logWithLevel(LOG_LEVELS.ERROR, error.reason);\n      if (identifier !== undefined) {\n        await Fx.run(recordFailedSignIn(ctx, identifier, config));\n      }\n      return null;\n    }\n    logWithLevel(\n      LOG_LEVELS.ERROR,\n      `verifyCodeAndSignInImpl failed: ${String(error)}`,\n    );\n    return null;\n  }\n}\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callVerifyCodeAndSignIn = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifyCodeAndSignIn\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;AAwBA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,gBAAgB,EAAE,SAAS;CAC3B,qBAAqB,EAAE,SAAS;CACjC,CAAC;;AASF,IAAM,gBAAN,MAAoB;CAClB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,wBACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,iCAAiC;EAC9D,QAAQ;GAAE,OAAO,KAAK,OAAO;GAAO,OAAO,KAAK,OAAO;GAAO;EAC9D,UAAU,KAAK;EACf,UAAU,KAAK;EACf,gBAAgB,KAAK;EACrB,qBAAqB,KAAK;EAC3B,CAAC;CAEF,MAAM,EAAE,gBAAgB,UAAU,wBAAwB;AAC1D,KAAI,gBAAgB;AAClB,aAAW,kBAAkB;AAC7B,aAAW,OAAO;AAClB,aAAW,kBAAkB;;CAE/B,MAAM,aAAiC,KAAK,OAAO,SAAS,KAAK,OAAO;AAExE,KAAI;AACF,MAAI,eAAe,QAIjB;OAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,YAAY,OAAO,CAC7C,CAEC,OAAM,IAAI,cACR,yDACD;;EAIL,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,OAAO,MAAM,OAAO,OAAO,KAAK;EACtC,MAAM,OAAO,MAAM,GAAG,kBAAkB,UAAU,KAAK;AACvD,MAAI,SAAS,KACX,OAAM,IAAI,cAAc,4BAA4B;AAGtD,QAAM,GAAG,kBAAkB,OAAO,KAAK,IAAI;AAE3C,MAAI,KAAK,aAAa,SACpB,OAAM,IAAI,cAAc,mBAAmB;AAE7C,MAAI,KAAK,iBAAiB,KAAK,KAAK,CAClC,OAAM,IAAI,cAAc,4BAA4B;AAEtD,MAAI,aAAa,UAAa,KAAK,aAAa,SAC9C,OAAM,IAAI,cACR,qBAAqB,SAAS,sBAC/B;EAGH,MAAM,UAAU,MAAM,GAAG,SAAS,QAAQ,KAAK,UAAU;AACzD,MAAI,YAAY,KACd,OAAM,IAAI,cACR,sDACD;EAGH,MAAM,eAAe,uBAAuB,KAAK,SAAS,GACtD,uCAAuC,KAAK,SAAS,GACrD,mBAAmB,KAAK,UAAU,oBAAoB;AAE1D,MACE,iBAAiB,SAChB,aAAa,SAAS,WAAW,aAAa,SAAS,YACxD,aAAa,cAAc,OAE3B,OAAM,aAAa,UAAU,KAAK,QAAQ,QAAQ;EAGpD,MAAM,iBAAiB,uBAAuB,QAAQ,SAAS,GAC3D,uCAAuC,QAAQ,SAAS,GACxD,mBAAmB,QAAQ,SAAS;EAExC,MAAM,SACJ,eAAe,SAAS,UACpB,QAAQ,UAEN,MAAM,qBACJ,KACA,MAAM,iBAAiB,IAAI,EAC3B,EAAE,iBAAiB,SAAS,EAC5B;GACE,MAAM;GACN,UAAU;GACV,SAAS;IACP,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACN,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACP;GACF,EACD,OACD,EACD;AAER,MAAI,eAAe,OACjB,OAAM,GAAG,IAAI,qBAAqB,KAAK,YAAY,OAAO,CAAC;AAQ7D,SAAO,MAAM,8BACX,KACA,QACA,QARgB,MAAM,kCACtB,KACA,QACA,OACD,EAMC,eACD;UACM,OAAO;AACd,MAAI,iBAAiB,eAAe;AAClC,gBAAa,WAAW,OAAO,MAAM,OAAO;AAC5C,OAAI,eAAe,OACjB,OAAM,GAAG,IAAI,mBAAmB,KAAK,YAAY,OAAO,CAAC;AAE3D,UAAO;;AAET,eACE,WAAW,OACX,mCAAmC,OAAO,MAAM,GACjD;AACD,SAAO;;;AAQX,MAAa,0BAA0B,OAGrC,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}