@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/schema.js

@@ -1,6 +1,6 @@
-import { vApiKeyRateLimit, vApiKeyRateLimitState, vApiKeyScope, vAuditActorType, vAuditStatus, vDeviceStatus, vEnterprisePolicy, vEnterpriseSecretKind, vEnterpriseStatus, vInviteStatus, vScimResourceType, vScimStatus, vTag, vWebhookDeliveryStatus, vWebhookEndpointStatus } from "./model.js";
-import { defineSchema, defineTable } from "convex/server";
+import { vApiKeyRateLimit, vApiKeyRateLimitState, vApiKeyScope, vAuditActorType, vAuditStatus, vDeviceStatus, vGroupConnectionPolicy, vGroupConnectionProtocol, vGroupConnectionSecretKind, vGroupConnectionStatus, vInviteStatus, vScimResourceType, vScimStatus, vTag, vWebhookDeliveryStatus, vWebhookEndpointStatus } from "./model.js";
 import { v } from "convex/values";
+import { defineSchema, defineTable } from "convex/server";
 
 //#region src/component/schema.ts
 /**
@@ -99,6 +99,7 @@ var schema_default = defineSchema({
 		rootGroupId: v.optional(v.id("Group")),
 		isRoot: v.optional(v.boolean()),
 		tags: v.optional(v.array(vTag)),
+		policy: v.optional(vGroupConnectionPolicy),
 		extend: v.optional(v.any())
 	}).index("slug", ["slug"]).index("parent_group_id", ["parentGroupId"]).index("root_group_id", ["rootGroupId"]).index("is_root", ["isRoot"]).index("type", ["type"]).index("type_parent_group_id", ["type", "parentGroupId"]),
 	GroupTag: defineTable({
@@ -127,51 +128,51 @@ var schema_default = defineSchema({
 		acceptedTime: v.optional(v.number()),
 		extend: v.optional(v.any())
 	}).index("token_hash", ["tokenHash"]).index("status", ["status"]).index("email_status", ["email", "status"]).index("invited_by_user_id_status", ["invitedByUserId", "status"]).index("group_id", ["groupId"]).index("group_id_status", ["groupId", "status"]),
-	Enterprise: defineTable({
+	GroupConnection: defineTable({
 		groupId: v.id("Group"),
 		slug: v.optional(v.string()),
 		name: v.optional(v.string()),
-		status: vEnterpriseStatus,
-		policy: v.optional(vEnterprisePolicy),
+		protocol: vGroupConnectionProtocol,
+		status: vGroupConnectionStatus,
 		config: v.optional(v.any()),
 		extend: v.optional(v.any())
 	}).index("group_id", ["groupId"]).index("slug", ["slug"]).index("status", ["status"]),
-	EnterpriseDomain: defineTable({
-		enterpriseId: v.id("Enterprise"),
+	GroupConnectionDomain: defineTable({
+		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),
 		domain: v.string(),
 		isPrimary: v.boolean(),
 		verifiedAt: v.optional(v.number())
-	}).index("enterprise_id", ["enterpriseId"]).index("group_id", ["groupId"]).index("domain", ["domain"]),
-	EnterpriseDomainVerification: defineTable({
-		enterpriseId: v.id("Enterprise"),
+	}).index("connection_id", ["connectionId"]).index("group_id", ["groupId"]).index("domain", ["domain"]),
+	GroupConnectionDomainVerification: defineTable({
+		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),
-		domainId: v.id("EnterpriseDomain"),
+		domainId: v.id("GroupConnectionDomain"),
 		domain: v.string(),
 		recordName: v.string(),
 		token: v.string(),
 		tokenHash: v.string(),
 		requestedAt: v.number(),
 		expiresAt: v.number()
-	}).index("enterprise_id", ["enterpriseId"]).index("domain_id", ["domainId"]).index("token_hash", ["tokenHash"]),
-	EnterpriseSecret: defineTable({
-		enterpriseId: v.id("Enterprise"),
+	}).index("connection_id", ["connectionId"]).index("domain_id", ["domainId"]).index("token_hash", ["tokenHash"]),
+	GroupConnectionSecret: defineTable({
+		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),
-		kind: vEnterpriseSecretKind,
+		kind: vGroupConnectionSecretKind,
 		ciphertext: v.string(),
 		updatedAt: v.number()
-	}).index("enterprise_id", ["enterpriseId"]).index("enterprise_id_kind", ["enterpriseId", "kind"]).index("group_id", ["groupId"]),
-	EnterpriseScimConfig: defineTable({
-		enterpriseId: v.id("Enterprise"),
+	}).index("connection_id", ["connectionId"]).index("connection_id_kind", ["connectionId", "kind"]).index("group_id", ["groupId"]),
+	GroupConnectionScimConfig: defineTable({
+		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),
 		status: vScimStatus,
 		basePath: v.string(),
 		tokenHash: v.string(),
 		lastRotatedAt: v.optional(v.number()),
 		extend: v.optional(v.any())
-	}).index("enterprise_id", ["enterpriseId"]).index("group_id", ["groupId"]).index("token_hash", ["tokenHash"]).index("status", ["status"]),
-	EnterpriseScimIdentity: defineTable({
-		enterpriseId: v.id("Enterprise"),
+	}).index("group_connection_id", ["connectionId"]).index("group_id", ["groupId"]).index("token_hash", ["tokenHash"]).index("status", ["status"]),
+	GroupConnectionScimIdentity: defineTable({
+		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),
 		resourceType: vScimResourceType,
 		externalId: v.string(),
@@ -180,13 +181,13 @@ var schema_default = defineSchema({
 		lastProvisionedAt: v.optional(v.number()),
 		active: v.optional(v.boolean()),
 		raw: v.optional(v.any())
-	}).index("enterprise_id", ["enterpriseId"]).index("group_id", ["groupId"]).index("enterprise_id_resource_type_external_id", [
-		"enterpriseId",
+	}).index("group_connection_id", ["connectionId"]).index("group_id", ["groupId"]).index("group_connection_id_resource_type_external_id", [
+		"connectionId",
 		"resourceType",
 		"externalId"
-	]).index("enterprise_id_user_id", ["enterpriseId", "userId"]).index("user_id", ["userId"]).index("mapped_group_id", ["mappedGroupId"]),
-	EnterpriseAuditEvent: defineTable({
-		enterpriseId: v.id("Enterprise"),
+	]).index("group_connection_id_user_id", ["connectionId", "userId"]).index("user_id", ["userId"]).index("mapped_group_id", ["mappedGroupId"]),
+	GroupAuditEvent: defineTable({
+		connectionId: v.optional(v.id("GroupConnection")),
 		groupId: v.id("Group"),
 		eventType: v.string(),
 		actorType: vAuditActorType,
@@ -198,9 +199,9 @@ var schema_default = defineSchema({
 		requestId: v.optional(v.string()),
 		ip: v.optional(v.string()),
 		metadata: v.optional(v.any())
-	}).index("enterprise_id_occurred_at", ["enterpriseId", "occurredAt"]).index("group_id_occurred_at", ["groupId", "occurredAt"]).index("event_type_occurred_at", ["eventType", "occurredAt"]),
-	EnterpriseWebhookEndpoint: defineTable({
-		enterpriseId: v.id("Enterprise"),
+	}).index("group_connection_id_occurred_at", ["connectionId", "occurredAt"]).index("group_id_occurred_at", ["groupId", "occurredAt"]).index("event_type_occurred_at", ["eventType", "occurredAt"]),
+	GroupWebhookEndpoint: defineTable({
+		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),
 		url: v.string(),
 		status: vWebhookEndpointStatus,
@@ -211,11 +212,11 @@ var schema_default = defineSchema({
 		lastFailureAt: v.optional(v.number()),
 		failureCount: v.number(),
 		extend: v.optional(v.any())
-	}).index("enterprise_id", ["enterpriseId"]).index("group_id", ["groupId"]).index("status", ["status"]),
-	EnterpriseWebhookDelivery: defineTable({
-		enterpriseId: v.id("Enterprise"),
-		endpointId: v.id("EnterpriseWebhookEndpoint"),
-		auditEventId: v.optional(v.id("EnterpriseAuditEvent")),
+	}).index("group_connection_id", ["connectionId"]).index("group_id", ["groupId"]).index("status", ["status"]),
+	GroupWebhookDelivery: defineTable({
+		connectionId: v.id("GroupConnection"),
+		endpointId: v.id("GroupWebhookEndpoint"),
+		auditEventId: v.optional(v.id("GroupAuditEvent")),
 		eventType: v.string(),
 		status: vWebhookDeliveryStatus,
 		attemptCount: v.number(),
@@ -224,7 +225,7 @@ var schema_default = defineSchema({
 		lastResponseStatus: v.optional(v.number()),
 		lastError: v.optional(v.string()),
 		payload: v.any()
-	}).index("enterprise_id", ["enterpriseId"]).index("status_next_attempt_at", ["status", "nextAttemptAt"]).index("endpoint_id_status", ["endpointId", "status"]).index("audit_event_id", ["auditEventId"]),
+	}).index("group_connection_id", ["connectionId"]).index("status_next_attempt_at", ["status", "nextAttemptAt"]).index("endpoint_id_status", ["endpointId", "status"]).index("audit_event_id", ["auditEventId"]),
 	ApiKey: defineTable({
 		userId: v.id("User"),
 		prefix: v.string(),

package/dist/core/index.d.ts

@@ -0,0 +1,380 @@
+import { ComponentCtx, ComponentReadCtx } from "../server/componentContext.js";
+import { AuthAuthorizationConfig, ConvexAuthConfig, KeyDoc, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "../server/types.js";
+import { AuthProfile } from "../server/payloads.js";
+import { AuthConfig, AuthContext, AuthContextConfig, AuthContextFactory as AuthContextFactory$1, AuthContextResolver as AuthContextResolver$1, OptionalAuthContext, UserDoc } from "../server/auth-context.js";
+import "../component/index.js";
+import * as convex_values0 from "convex/values";
+import * as convex_server0 from "convex/server";
+import * as fluent_convex0 from "fluent-convex";
+
+//#region src/core/index.d.ts
+type AuthContextResolver = AuthContextResolver$1;
+type AuthContextFactory = AuthContextFactory$1;
+/**
+ * Create a lightweight auth context object.
+ *
+ * Returns the same `user`, `session`, `member`, `group`, `account`,
+ * `invite`, `key`, `context`, and `ctx` APIs as `createAuth`, but
+ * without `signIn`, `signOut`, `store`, `http`, or provider logic.
+ *
+ * Use this in query/mutation files that only need to resolve the
+ * current user — it avoids loading provider, OAuth, and crypto code.
+ *
+ * @example
+ * ```ts
+ * // convex/auth-core.ts
+ * import { createAuthContext } from "@robelest/convex-auth/core";
+ * import { components } from "./_generated/api";
+ *
+ * export const auth = createAuthContext(components.auth);
+ *
+ * // convex/functions.ts
+ * import { auth } from "./auth-core";
+ * export const authQuery = customQuery(query, auth.ctx());
+ * ```
+ */
+declare function createAuthContext(component: ConvexAuthConfig["component"], config?: Omit<AuthConfig, "providers"> & {
+  authorization?: AuthAuthorizationConfig;
+}): {
+  user: {
+    get: (ctx: ComponentReadCtx, userId: string) => Promise<any>;
+    list: (ctx: ComponentReadCtx, opts?: {
+      where?: UserWhere;
+      limit?: number;
+      cursor?: string | null;
+      orderBy?: UserOrderBy;
+      order?: "asc" | "desc";
+    }) => Promise<any>;
+    viewer: (ctx: ComponentReadCtx & {
+      auth: convex_server0.Auth;
+    }) => Promise<any>;
+    update: (ctx: ComponentCtx, userId: string, data: Record<string, unknown>) => Promise<{
+      userId: string;
+    }>;
+    setActiveGroup: (ctx: ComponentCtx, opts: {
+      userId: string;
+      groupId: string | null;
+    }) => Promise<{
+      userId: string;
+      groupId: null;
+    } | {
+      userId: string;
+      groupId: string;
+    }>;
+    getActiveGroup: (ctx: ComponentReadCtx, opts: {
+      userId: string;
+    }) => Promise<string | null>;
+    delete: (ctx: ComponentCtx, userId: string, opts?: {
+      cascade?: boolean;
+    }) => Promise<{
+      userId: string;
+    }>;
+  };
+  session: {
+    current: (ctx: {
+      auth: convex_server0.Auth;
+    }) => Promise<convex_values0.GenericId<"Session"> | null>;
+    invalidate: <DataModel extends fluent_convex0.GenericDataModel>(ctx: convex_server0.GenericActionCtx<DataModel>, args: {
+      userId: convex_values0.GenericId<"User">;
+      except?: convex_values0.GenericId<"Session">[];
+    }) => Promise<{
+      userId: convex_values0.GenericId<"User">;
+      except: convex_values0.GenericId<"Session">[];
+    }>;
+    get: (ctx: ComponentReadCtx, sessionId: string) => Promise<any>;
+    list: (ctx: ComponentReadCtx, opts: {
+      userId: string;
+    }) => Promise<any>;
+  };
+  account: {
+    create: <DataModel extends fluent_convex0.GenericDataModel>(ctx: convex_server0.GenericActionCtx<DataModel>, args: {
+      provider: string;
+      account: {
+        id: string;
+        secret?: string;
+      };
+      profile: AuthProfile;
+      shouldLinkViaEmail?: boolean;
+      shouldLinkViaPhone?: boolean;
+    }) => Promise<{
+      account: {
+        _id: string;
+        userId: string;
+        secret?: string | null;
+      };
+      user: Record<string, unknown>;
+    }>;
+    get: <DataModel extends fluent_convex0.GenericDataModel>(ctx: convex_server0.GenericActionCtx<DataModel>, args: {
+      provider: string;
+      account: {
+        id: string;
+        secret?: string;
+      };
+    }) => Promise<{
+      account: {
+        _id: string;
+        userId: string;
+        secret?: string | null;
+      };
+      user: Record<string, unknown>;
+    } | null>;
+    update: <DataModel extends fluent_convex0.GenericDataModel>(ctx: convex_server0.GenericActionCtx<DataModel>, args: {
+      provider: string;
+      account: {
+        id: string;
+        secret: string;
+      };
+    }) => Promise<{
+      accountId: string;
+    }>;
+    delete: (ctx: ComponentCtx, accountId: string) => Promise<{
+      accountId: string;
+    }>;
+    listPasskeys: (ctx: ComponentReadCtx, opts: {
+      userId: string;
+    }) => Promise<any>;
+    renamePasskey: (ctx: ComponentCtx, passkeyId: string, name: string) => Promise<{
+      passkeyId: string;
+    }>;
+    deletePasskey: (ctx: ComponentCtx, passkeyId: string) => Promise<{
+      passkeyId: string;
+    }>;
+    listTotps: (ctx: ComponentReadCtx, opts: {
+      userId: string;
+    }) => Promise<any>;
+    deleteTotp: (ctx: ComponentCtx, totpId: string) => Promise<{
+      totpId: string;
+    }>;
+  };
+  group: {
+    create: (ctx: ComponentCtx, data: {
+      name: string;
+      slug?: string;
+      type?: string;
+      parentGroupId?: string;
+      tags?: Array<{
+        key: string;
+        value: string;
+      }>;
+      extend?: Record<string, unknown>;
+    }) => Promise<{
+      groupId: string;
+    }>;
+    get: (ctx: ComponentReadCtx, groupId: string) => Promise<any>;
+    list: (ctx: ComponentReadCtx, opts?: {
+      where?: {
+        slug?: string;
+        type?: string;
+        parentGroupId?: string;
+        name?: string;
+        isRoot?: boolean;
+        tagsAll?: Array<{
+          key: string;
+          value: string;
+        }>;
+        tagsAny?: Array<{
+          key: string;
+          value: string;
+        }>;
+      };
+      limit?: number;
+      cursor?: string | null;
+      orderBy?: "_creationTime" | "name" | "slug" | "type";
+      order?: "asc" | "desc";
+    }) => Promise<any>;
+    update: (ctx: ComponentCtx, groupId: string, data: Record<string, unknown>) => Promise<{
+      groupId: string;
+    }>;
+    delete: (ctx: ComponentCtx, groupId: string) => Promise<{
+      groupId: string;
+    }>;
+    ancestors: (ctx: ComponentReadCtx, opts: {
+      groupId: string;
+      maxDepth?: number;
+      includeSelf?: boolean;
+    }) => Promise<{
+      ancestors: Record<string, unknown>[];
+      cycleDetected: boolean;
+      maxDepthReached: boolean;
+    }>;
+  };
+  member: {
+    create: (ctx: ComponentCtx, data: {
+      groupId: string;
+      userId: string;
+      roleIds?: string[];
+      status?: string;
+      extend?: Record<string, unknown>;
+    }) => Promise<{
+      memberId: string;
+    }>;
+    get: (ctx: ComponentReadCtx, memberId: string) => Promise<any>;
+    list: (ctx: ComponentReadCtx, opts?: {
+      where?: {
+        groupId?: string;
+        userId?: string;
+        roleId?: string;
+        status?: string;
+      };
+      limit?: number;
+      cursor?: string | null;
+      orderBy?: "_creationTime" | "status";
+      order?: "asc" | "desc";
+    }) => Promise<any>;
+    delete: (ctx: ComponentCtx, memberId: string) => Promise<{
+      memberId: string;
+    }>;
+    update: (ctx: ComponentCtx, memberId: string, data: Record<string, unknown>) => Promise<{
+      memberId: string;
+    }>;
+    inspect: (ctx: ComponentReadCtx, opts: {
+      userId: string;
+      groupId: string;
+      ancestry?: boolean;
+      maxDepth?: number;
+    }) => Promise<{
+      membership: null;
+      roleIds: string[];
+      grants: string[];
+    } | {
+      membership: {
+        _id: string;
+        _creationTime: number;
+        groupId: string;
+        userId: string;
+        role?: string;
+        roleIds?: string[];
+        status?: string;
+        extend?: Record<string, unknown>;
+      };
+      roleIds: string[];
+      grants: string[];
+    }>;
+    require: (ctx: ComponentReadCtx, opts: {
+      userId: string;
+      groupId: string;
+      ancestry?: boolean;
+      roleIds?: string[];
+      grants?: string[];
+      maxDepth?: number;
+    }) => Promise<{
+      membership: {
+        _id: string;
+        _creationTime: number;
+        groupId: string;
+        userId: string;
+        role?: string;
+        roleIds?: string[];
+        status?: string;
+        extend?: Record<string, unknown>;
+      };
+      roleIds: string[];
+      grants: string[];
+    }>;
+  };
+  invite: {
+    create: (ctx: ComponentCtx, data: {
+      groupId?: string;
+      invitedByUserId?: string;
+      email?: string;
+      roleIds?: string[];
+      expiresTime?: number;
+      extend?: Record<string, unknown>;
+    }) => Promise<{
+      inviteId: string;
+      token: string;
+    }>;
+    get: (ctx: ComponentReadCtx, inviteId: string) => Promise<any>;
+    token: {
+      get: (ctx: ComponentReadCtx, token: string) => Promise<any>;
+      accept: (ctx: ComponentCtx, args: {
+        token: string;
+        acceptedByUserId: string;
+      }) => Promise<any>;
+    };
+    list: (ctx: ComponentReadCtx, opts?: {
+      where?: {
+        tokenHash?: string;
+        groupId?: string;
+        status?: "pending" | "accepted" | "revoked" | "expired";
+        email?: string;
+        invitedByUserId?: string;
+        roleId?: string;
+        acceptedByUserId?: string;
+      };
+      limit?: number;
+      cursor?: string | null;
+      orderBy?: "_creationTime" | "status" | "email" | "expiresTime" | "acceptedTime";
+      order?: "asc" | "desc";
+    }) => Promise<any>;
+    accept: (ctx: ComponentCtx, inviteId: string, acceptedByUserId?: string) => Promise<{
+      inviteId: string;
+      acceptedByUserId: string | null;
+    }>;
+    revoke: (ctx: ComponentCtx, inviteId: string) => Promise<{
+      inviteId: string;
+    }>;
+  };
+  key: {
+    create: (ctx: ComponentCtx, opts: {
+      userId: string;
+      name: string;
+      scopes: KeyScope[];
+      rateLimit?: {
+        maxRequests: number;
+        windowMs: number;
+      };
+      expiresAt?: number;
+      metadata?: Record<string, unknown>;
+    }) => Promise<{
+      keyId: string;
+      secret: string;
+    }>;
+    verify: (ctx: ComponentCtx, rawKey: string) => Promise<{
+      userId: string;
+      keyId: string;
+      scopes: ScopeChecker;
+    }>;
+    list: (ctx: ComponentReadCtx, opts?: {
+      where?: {
+        userId?: string;
+        revoked?: boolean;
+        name?: string;
+        prefix?: string;
+      };
+      limit?: number;
+      cursor?: string | null;
+      orderBy?: "_creationTime" | "name" | "lastUsedAt" | "expiresAt" | "revoked";
+      order?: "asc" | "desc";
+    }) => Promise<any>;
+    get: (ctx: ComponentReadCtx, keyId: string) => Promise<KeyDoc | null>;
+    update: (ctx: ComponentCtx, keyId: string, data: {
+      name?: string;
+      scopes?: KeyScope[];
+      rateLimit?: {
+        maxRequests: number;
+        windowMs: number;
+      };
+    }) => Promise<{
+      keyId: string;
+    }>;
+    revoke: (ctx: ComponentCtx, keyId: string) => Promise<{
+      keyId: string;
+    }>;
+    delete: (ctx: ComponentCtx, keyId: string) => Promise<{
+      keyId: string;
+    }>;
+    rotate: (ctx: ComponentCtx, keyId: string, opts?: {
+      name?: string;
+      expiresAt?: number;
+    }) => Promise<{
+      keyId: string;
+      secret: string;
+    }>;
+  };
+  context: AuthContextResolver;
+  ctx: AuthContextFactory;
+};
+//#endregion
+export { type AuthContext, type AuthContextConfig, type OptionalAuthContext, type UserDoc, createAuthContext };
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.js

@@ -0,0 +1,83 @@
+import { assertAuthResolverContext, createAuthContextCustomization, createPublicAuthContext } from "../server/auth-context.js";
+import { configDefaults } from "../server/config.js";
+import { createCoreDomains } from "../server/core.js";
+import { callModifyAccount } from "../server/mutations/account.js";
+import { callInvalidateSessions } from "../server/mutations/invalidate.js";
+import { callCreateAccountFromCredentials } from "../server/mutations/register.js";
+import { callRetrieveAccountWithCredentials } from "../server/mutations/retrieve.js";
+
+//#region src/core/index.ts
+/**
+* Lightweight auth context entry point for `@robelest/convex-auth/core`.
+*
+* Provides auth context resolution, user/session/member/group lookups,
+* and authorization helpers without pulling in provider implementations,
+* OAuth, crypto, or sign-in logic.
+*
+* @module
+*/
+/**
+* Create a lightweight auth context object.
+*
+* Returns the same `user`, `session`, `member`, `group`, `account`,
+* `invite`, `key`, `context`, and `ctx` APIs as `createAuth`, but
+* without `signIn`, `signOut`, `store`, `http`, or provider logic.
+*
+* Use this in query/mutation files that only need to resolve the
+* current user — it avoids loading provider, OAuth, and crypto code.
+*
+* @example
+* ```ts
+* // convex/auth-core.ts
+* import { createAuthContext } from "@robelest/convex-auth/core";
+* import { components } from "./_generated/api";
+*
+* export const auth = createAuthContext(components.auth);
+*
+* // convex/functions.ts
+* import { auth } from "./auth-core";
+* export const authQuery = customQuery(query, auth.ctx());
+* ```
+*/
+function createAuthContext(component, config) {
+	const fullConfig = configDefaults({
+		component,
+		providers: [],
+		...config
+	});
+	const INVITE_TOKEN_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+	const INVITE_TOKEN_LENGTH = 48;
+	const enrichCtx = (ctx) => ctx;
+	const domains = createCoreDomains({
+		config: fullConfig,
+		callInvalidateSessions,
+		callCreateAccountFromCredentials,
+		callRetrieveAccountWithCredentials,
+		callModifyAccount,
+		getEnrichCtx: () => enrichCtx,
+		inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
+		inviteTokenLength: INVITE_TOKEN_LENGTH
+	});
+	const authLike = {
+		user: domains.user,
+		member: domains.member
+	};
+	return {
+		user: domains.user,
+		session: domains.session,
+		account: domains.account,
+		group: domains.group,
+		member: domains.member,
+		invite: domains.invite,
+		key: domains.key,
+		context: ((ctx, config$1) => {
+			assertAuthResolverContext(ctx);
+			return createPublicAuthContext(authLike, ctx, config$1);
+		}),
+		ctx: ((config$1) => createAuthContextCustomization(authLike, config$1))
+	};
+}
+
+//#endregion
+export { createAuthContext };
+//# sourceMappingURL=index.js.map

package/dist/otel.d.ts

@@ -0,0 +1,69 @@
+import { Attributes } from "@opentelemetry/api";
+import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
+import { WebTracerProvider } from "@opentelemetry/sdk-trace-web";
+import { LogRecordProcessor } from "@opentelemetry/sdk-logs";
+import { MetricReader } from "@opentelemetry/sdk-metrics";
+import { SpanProcessor, TracerConfig } from "@opentelemetry/sdk-trace-base";
+
+//#region src/otel.d.ts
+/**
+ * Consumer-provided telemetry configuration for Convex Auth spans.
+ *
+ * The host application decides the service name, exporters, processors, and
+ * readers.
+ */
+type TelemetryConfig = {
+  /** Service name reported to the telemetry backend. */serviceName: string; /** Optional service version reported alongside the service name. */
+  serviceVersion?: string; /** Additional OpenTelemetry resource attributes to attach to all spans. */
+  attributes?: Attributes; /** Span processor or processors used for tracing export. */
+  spanProcessor?: SpanProcessor | ReadonlyArray<SpanProcessor>; /** Optional tracer configuration forwarded to the underlying SDK. */
+  tracerConfig?: Omit<TracerConfig, "resource">; /** Metric reader or readers used for metrics export. */
+  metricReader?: MetricReader | ReadonlyArray<MetricReader>; /** Log record processor or processors used for logs export. */
+  logRecordProcessor?: LogRecordProcessor | ReadonlyArray<LogRecordProcessor>;
+};
+/**
+ * Build a Node.js OpenTelemetry tracer provider for an app using Convex Auth.
+ *
+ * Convex Auth does not install this provider automatically. Provide it from your
+ * application runtime when you want server-side spans, metrics, or logs to be
+ * exported.
+ *
+ * @param config - Telemetry configuration supplied by the host application.
+ * @returns A registered {@link NodeTracerProvider}.
+ *
+ * @example
+ * ```ts
+ * import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
+ * import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+ * import { nodeTelemetry } from "@robelest/convex-auth/otel";
+ *
+ * const provider = nodeTelemetry({
+ *   serviceName: "my-app",
+ *   spanProcessor: new BatchSpanProcessor(new OTLPTraceExporter()),
+ * });
+ * ```
+ */
+declare function nodeTelemetry(config: TelemetryConfig): NodeTracerProvider;
+/**
+ * Build a browser OpenTelemetry tracer provider for an app using Convex Auth.
+ *
+ * Convex Auth does not install this provider automatically. Provide it from your
+ * browser runtime when you want client-side Convex Auth spans to be exported.
+ *
+ * @param config - Telemetry configuration supplied by the host application.
+ * @returns A registered {@link WebTracerProvider}.
+ *
+ * @example
+ * ```ts
+ * import { browserTelemetry } from "@robelest/convex-auth/otel";
+ *
+ * const provider = browserTelemetry({
+ *   serviceName: "my-web-app",
+ *   attributes: { deployment: "production" },
+ * });
+ * ```
+ */
+declare function browserTelemetry(config: TelemetryConfig): WebTracerProvider;
+//#endregion
+export { TelemetryConfig, browserTelemetry, nodeTelemetry };
+//# sourceMappingURL=otel.d.ts.map