@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/core.js

@@ -1,9 +1,8 @@
 import { getSessionUserId } from "./context.js";
-import { materializeProvider } from "./config.js";
-import { TOKEN_SUB_CLAIM_DIVIDER, generateRandomString, sha256 } from "./utils.js";
+import { generateRandomString, sha256 } from "./random.js";
 import { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey } from "./keys.js";
-import { signInImpl } from "./signin.js";
-import { Cv } from "@robelest/fx/convex";
+import { TOKEN_SUB_CLAIM_DIVIDER } from "./constants.js";
+import { ConvexError } from "convex/values";
 
 //#region src/server/core.ts
 /**
@@ -20,7 +19,7 @@ import { Cv } from "@robelest/fx/convex";
 * @returns The core domain namespaces consumed by the auth factory.
 */
 function createCoreDomains(deps) {
-	const { config, getAuth, callInvalidateSessions, callCreateAccountFromCredentials, callRetrieveAccountWithCredentials, callModifyAccount, getEnrichCtx, inviteTokenAlphabet, inviteTokenLength } = deps;
+	const { config, callInvalidateSessions, callCreateAccountFromCredentials, callRetrieveAccountWithCredentials, callModifyAccount, inviteTokenAlphabet, inviteTokenLength } = deps;
 	const roleDefinitions = config.authorization.roles;
 	const getRoleDefinition = (roleId) => {
 		return roleDefinitions[roleId] ?? null;
@@ -28,7 +27,7 @@ function createCoreDomains(deps) {
 	const normalizeRoleIds = (roleIds) => {
 		const normalized = Array.from(new Set(roleIds ?? []));
 		const invalid = normalized.filter((id) => getRoleDefinition(id) === null);
-		if (invalid.length > 0) throw Cv.error({
+		if (invalid.length > 0) throw new ConvexError({
 			code: "INVALID_ROLE_IDS",
 			message: "One or more role IDs are invalid.",
 			invalidRoleIds: invalid
@@ -74,11 +73,12 @@ function createCoreDomains(deps) {
 	};
 	const AUTH_CACHE = Symbol("__convexAuthCache");
 	function cache(ctx) {
-		if (!ctx[AUTH_CACHE]) ctx[AUTH_CACHE] = {
+		const cachedCtx = ctx;
+		if (!cachedCtx[AUTH_CACHE]) cachedCtx[AUTH_CACHE] = {
 			users: /* @__PURE__ */ new Map(),
 			groups: /* @__PURE__ */ new Map()
 		};
-		return ctx[AUTH_CACHE];
+		return cachedCtx[AUTH_CACHE];
 	}
 	const user = {
 		get: async (ctx, userId) => {
@@ -142,7 +142,7 @@ function createCoreDomains(deps) {
 				ctx.runQuery(config.component.public.totpListByUserId, { userId })
 			]);
 			const totalLinked = sessions.length + accounts.length + keys.length + members.length + passkeys.length + totps.length;
-			if (!cascade && totalLinked > 0) throw Cv.error({
+			if (!cascade && totalLinked > 0) throw new ConvexError({
 				code: "INVALID_PARAMETERS",
 				message: "The provided parameters are invalid."
 			});
@@ -194,11 +194,11 @@ function createCoreDomains(deps) {
 		},
 		delete: async (ctx, accountId) => {
 			const doc = await ctx.runQuery(config.component.public.accountGetById, { accountId });
-			if (doc === null) throw Cv.error({
+			if (doc === null) throw new ConvexError({
 				code: "ACCOUNT_NOT_FOUND",
 				message: "Account not found."
 			});
-			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) throw Cv.error({
+			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) throw new ConvexError({
 				code: "INVALID_PARAMETERS",
 				message: "The provided parameters are invalid."
 			});
@@ -227,16 +227,9 @@ function createCoreDomains(deps) {
 			return { totpId };
 		}
 	};
-	const provider = { signIn: async (ctx, providerConfig, args) => {
-		const result = await signInImpl(getEnrichCtx()(ctx), materializeProvider(providerConfig), args, {
-			generateTokens: false,
-			allowExtraProviders: true
-		});
-		return result.kind === "signedIn" ? result.signedIn !== null ? {
-			userId: result.signedIn.userId,
-			sessionId: result.signedIn.sessionId
-		} : null : null;
-	} };
+	const provider = { signIn: deps.signInForProvider ? async (ctx, providerConfig, args) => {
+		return deps.signInForProvider(ctx, providerConfig, args);
+	} : void 0 };
 	const group = {
 		create: async (ctx, data) => {
 			return { groupId: await ctx.runMutation(config.component.public.groupCreate, data) };
@@ -345,7 +338,8 @@ function createCoreDomains(deps) {
 			let membership = null;
 			if (useAncestry) {
 				const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
-				membership = (await ctx.runQuery(config.component.public.memberResolve, {
+				const memberResolveRef = config.component.public["memberResolve"];
+				membership = (await ctx.runQuery(memberResolveRef, {
 					userId: opts.userId,
 					groupId: opts.groupId,
 					maxDepth,
@@ -378,18 +372,18 @@ function createCoreDomains(deps) {
 				ancestry: opts.ancestry,
 				maxDepth: opts.maxDepth
 			});
-			if (result.membership === null) throw Cv.error({
+			if (result.membership === null) throw new ConvexError({
 				code: "NOT_A_MEMBER",
 				message: "User is not a member of this group.",
 				groupId: opts.groupId
 			});
-			if (roleFilter !== null && !result.roleIds.some((roleId) => roleFilter.has(roleId))) throw Cv.error({
+			if (roleFilter !== null && !result.roleIds.some((roleId) => roleFilter.has(roleId))) throw new ConvexError({
 				code: "NOT_A_MEMBER",
 				message: "User is not a member of this group.",
 				groupId: opts.groupId
 			});
 			const missingGrants = requiredGrants.filter((grant) => !result.grants.includes(grant));
-			if (missingGrants.length > 0) throw Cv.error({
+			if (missingGrants.length > 0) throw new ConvexError({
 				code: "MISSING_GRANTS",
 				message: "User is missing required grants.",
 				groupId: opts.groupId,
@@ -473,23 +467,23 @@ function createCoreDomains(deps) {
 		verify: async (ctx, rawKey) => {
 			const hashedKey = await hashApiKey(rawKey);
 			const doc = await ctx.runQuery(config.component.public.keyGetByHashedKey, { hashedKey });
-			if (!doc) throw Cv.error({
+			if (!doc) throw new ConvexError({
 				code: "INVALID_API_KEY",
 				message: "Invalid API key."
 			});
 			const k = doc;
-			if (k.revoked) throw Cv.error({
+			if (k.revoked) throw new ConvexError({
 				code: "API_KEY_REVOKED",
 				message: "This API key has been revoked."
 			});
-			if (k.expiresAt && k.expiresAt < Date.now()) throw Cv.error({
+			if (k.expiresAt && k.expiresAt < Date.now()) throw new ConvexError({
 				code: "API_KEY_EXPIRED",
 				message: "This API key has expired."
 			});
 			const patchData = { lastUsedAt: Date.now() };
 			if (k.rateLimit) {
 				const { limited, newState } = checkKeyRateLimit(k.rateLimit, k.rateLimitState ?? void 0);
-				if (limited) throw Cv.error({
+				if (limited) throw new ConvexError({
 					code: "API_KEY_RATE_LIMITED",
 					message: "API key rate limit exceeded. Please try again later."
 				});
@@ -537,11 +531,12 @@ function createCoreDomains(deps) {
 		},
 		rotate: async (ctx, keyId, opts) => {
 			const existing = await ctx.runQuery(config.component.public.keyGetById, { keyId });
-			if (!existing) throw Cv.error({
+			if (!existing) throw new ConvexError({
 				code: "INVALID_PARAMETERS",
 				message: "The provided parameters are invalid."
 			});
-			if (existing.revoked === true) throw Cv.error({
+			const typedExisting = existing;
+			if (typedExisting.revoked === true) throw new ConvexError({
 				code: "API_KEY_REVOKED",
 				message: "This API key has been revoked."
 			});
@@ -550,12 +545,12 @@ function createCoreDomains(deps) {
 				data: { revoked: true }
 			});
 			return await key.create(ctx, {
-				userId: existing.userId,
-				name: opts?.name ?? existing.name,
-				scopes: existing.scopes ?? [],
-				rateLimit: existing.rateLimit,
+				userId: typedExisting.userId,
+				name: opts?.name ?? typedExisting.name ?? keyId,
+				scopes: typedExisting.scopes ?? [],
+				rateLimit: typedExisting.rateLimit,
 				expiresAt: opts?.expiresAt,
-				metadata: existing.metadata
+				metadata: typedExisting.metadata
 			});
 		}
 	};

package/dist/server/crypto.js

@@ -1,55 +1,45 @@
-import { errorMessage } from "./utils.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
+import { ConvexError } from "convex/values";
 
 //#region src/server/crypto.ts
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+const credentialsError = (code, message) => new ConvexError({
+	code,
+	message
+});
+function asCredentialsProvider(provider) {
+	if (provider.type !== "credentials") throw credentialsError("INVALID_CREDENTIALS_PROVIDER", `Provider ${provider.id} is not a credentials provider`);
+	return provider;
+}
 /**
 * Hash a secret using the provider's `crypto.hashSecret` function.
-*
-* Validates that the provider is a credentials provider and has the
-* required crypto function, returning typed errors through the Fx channel.
+* @internal
 */
-/** @internal */
-const hash = (provider, secret) => Fx.gen(function* () {
-	if (provider.type !== "credentials") return yield* Cv.fail({
-		code: "INVALID_CREDENTIALS_PROVIDER",
-		message: `Provider ${provider.id} is not a credentials provider`
-	});
-	const hashSecretFn = provider.crypto?.hashSecret;
-	if (!hashSecretFn) return yield* Cv.fail({
-		code: "MISSING_CRYPTO_FUNCTION",
-		message: `Provider ${provider.id} does not have a \`crypto.hashSecret\` function`
-	});
-	return yield* Fx.from({
-		ok: () => hashSecretFn(secret),
-		err: (e) => Cv.error({
-			code: "INTERNAL_ERROR",
-			message: `Hash failed: ${errorMessage(e)}`
-		})
-	});
-});
+async function hash(provider, secret) {
+	const credProvider = asCredentialsProvider(provider);
+	const hashSecret = credProvider.crypto?.hashSecret;
+	if (!hashSecret) throw credentialsError("MISSING_CRYPTO_FUNCTION", `Provider ${credProvider.id} does not have a \`crypto.hashSecret\` function`);
+	try {
+		return await hashSecret(secret);
+	} catch (error) {
+		throw credentialsError("INTERNAL_ERROR", `Hash failed: ${errorMessage(error)}`);
+	}
+}
 /**
 * Verify a secret against a hash using the provider's `crypto.verifySecret` function.
+* @internal
 */
-/** @internal */
-const verify = (provider, secret, hashValue) => Fx.gen(function* () {
-	if (provider.type !== "credentials") return yield* Cv.fail({
-		code: "INVALID_CREDENTIALS_PROVIDER",
-		message: `Provider ${provider.id} is not a credentials provider`
-	});
-	const verifySecretFn = provider.crypto?.verifySecret;
-	if (!verifySecretFn) return yield* Cv.fail({
-		code: "MISSING_CRYPTO_FUNCTION",
-		message: `Provider ${provider.id} does not have a \`crypto.verifySecret\` function`
-	});
-	return yield* Fx.from({
-		ok: () => verifySecretFn(secret, hashValue),
-		err: (e) => Cv.error({
-			code: "INTERNAL_ERROR",
-			message: `Verify failed: ${errorMessage(e)}`
-		})
-	});
-});
+async function verify(provider, secret, hashValue) {
+	const credProvider = asCredentialsProvider(provider);
+	const verifySecret = credProvider.crypto?.verifySecret;
+	if (!verifySecret) throw credentialsError("MISSING_CRYPTO_FUNCTION", `Provider ${credProvider.id} does not have a \`crypto.verifySecret\` function`);
+	try {
+		return await verifySecret(secret, hashValue);
+	} catch (error) {
+		throw credentialsError("INTERNAL_ERROR", `Verify failed: ${errorMessage(error)}`);
+	}
+}
 
 //#endregion
 export { hash, verify };

package/dist/server/db.js

@@ -35,12 +35,16 @@ function authDb(ctx, config) {
 				userId,
 				expirationTime
 			}),
+			issue: (args) => ctx.runMutation(component.public.sessionIssue, args),
 			getById: (sessionId) => ctx.runQuery(component.public.sessionGetById, { sessionId }),
 			delete: (sessionId) => ctx.runMutation(component.public.sessionDelete, { sessionId }),
 			listByUser: (userId) => ctx.runQuery(component.public.sessionListByUser, { userId })
 		},
 		verifiers: {
-			create: (sessionId) => ctx.runMutation(component.public.verifierCreate, { sessionId }),
+			create: (sessionId, signature) => ctx.runMutation(component.public.verifierCreate, {
+				sessionId,
+				signature
+			}),
 			getById: (verifierId) => ctx.runQuery(component.public.verifierGetById, { verifierId }),
 			getBySignature: (signature) => ctx.runQuery(component.public.verifierGetBySignature, { signature }),
 			patch: (verifierId, data) => ctx.runMutation(component.public.verifierPatch, {
@@ -57,6 +61,7 @@ function authDb(ctx, config) {
 		},
 		refreshTokens: {
 			create: (args) => ctx.runMutation(component.public.refreshTokenCreate, args),
+			exchange: (args) => ctx.runMutation(component.public.refreshTokenExchange, args),
 			getById: (refreshTokenId) => ctx.runQuery(component.public.refreshTokenGetById, { refreshTokenId }),
 			patch: (refreshTokenId, data) => ctx.runMutation(component.public.refreshTokenPatch, {
 				refreshTokenId,

package/dist/server/device.js

@@ -1,22 +1,15 @@
 import { userIdFromIdentitySubject } from "./identity.js";
-import { generateRandomString, requireEnv, sha256 } from "./utils.js";
+import { generateRandomString, sha256 } from "./random.js";
+import { requireEnv } from "./env.js";
 import { callSignIn } from "./mutations/signin.js";
+import { AuthFlowError, authFlowError } from "../shared/errors.js";
+import { toConvexError } from "./errors.js";
 import { mutateDeviceAuthorize, mutateDeviceDelete, mutateDeviceInsert, mutateDeviceUpdateLastPolled, queryDeviceByCodeHash, queryDeviceByUserCode } from "./types.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
 import { ConvexError } from "convex/values";
 
 //#region src/server/device.ts
 /**
 * Server-side device authorization flow logic (RFC 8628).
-*
-* Handles the three phases of the device flow:
-* 1. (default) — Generate a device code + user code pair
-* 2. poll      — Device checks whether the user has authorized yet
-* 3. verify    — Authenticated user links a user code to their session
-*
-* Uses `@oslojs/crypto/random` for code generation and
-* `@oslojs/crypto/sha2` for hashing device codes before storage.
 */
 const DEVICE_CODE_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 const DEVICE_CODE_LENGTH = 40;
@@ -25,127 +18,100 @@ const DEVICE_FLOWS = [
 	"poll",
 	"verify"
 ];
+const deviceError = authFlowError;
+const assertFlow = (flow) => {
+	if (DEVICE_FLOWS.includes(flow)) return flow;
+	throw deviceError("DEVICE_MISSING_FLOW", "Missing `flow` parameter. Expected one of: create, poll, verify");
+};
+async function handleCreate(ctx, provider) {
+	const deviceCode = generateRandomString(DEVICE_CODE_LENGTH, DEVICE_CODE_ALPHABET);
+	const deviceCodeHash = await sha256(deviceCode);
+	const rawUserCode = generateRandomString(provider.userCodeLength, provider.charset);
+	const mid = Math.floor(rawUserCode.length / 2);
+	const userCode = rawUserCode.slice(0, mid) + "-" + rawUserCode.slice(mid);
+	await mutateDeviceInsert(ctx, {
+		deviceCodeHash,
+		userCode,
+		expiresAt: Date.now() + provider.expiresIn * 1e3,
+		interval: provider.interval,
+		status: "pending"
+	});
+	const verificationUri = provider.verificationUri ?? `${process.env.SITE_URL ?? requireEnv("SITE_URL")}/device`;
+	return {
+		kind: "deviceCode",
+		deviceCode,
+		userCode,
+		verificationUri,
+		verificationUriComplete: `${verificationUri}?code=${encodeURIComponent(userCode)}`,
+		expiresIn: provider.expiresIn,
+		interval: provider.interval
+	};
+}
+async function handlePoll(ctx, params) {
+	if (typeof params.deviceCode !== "string") throw deviceError("DEVICE_MISSING_FLOW", "Missing `deviceCode` parameter for poll flow.");
+	const doc = await queryDeviceByCodeHash(ctx, await sha256(params.deviceCode));
+	if (doc === null) throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
+	if (Date.now() > doc.expiresAt) {
+		await mutateDeviceDelete(ctx, doc._id);
+		throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
+	}
+	if (doc.lastPolledAt !== void 0 && (Date.now() - doc.lastPolledAt) / 1e3 < doc.interval) throw deviceError("DEVICE_SLOW_DOWN", "Polling too frequently. Increase the interval between requests.");
+	await mutateDeviceUpdateLastPolled(ctx, doc._id, Date.now());
+	if (doc.status === "pending") throw deviceError("DEVICE_AUTHORIZATION_PENDING", "The user has not yet authorized this device.");
+	if (doc.status === "denied") {
+		await mutateDeviceDelete(ctx, doc._id);
+		throw deviceError("DEVICE_CODE_DENIED", "The authorization request was denied.");
+	}
+	if (!doc.userId || !doc.sessionId) throw deviceError("INTERNAL_ERROR", "Authorized device code missing userId or sessionId");
+	await mutateDeviceDelete(ctx, doc._id);
+	return {
+		kind: "signedIn",
+		signedIn: await callSignIn(ctx, {
+			userId: doc.userId,
+			sessionId: doc.sessionId,
+			generateTokens: true
+		})
+	};
+}
+async function handleDeviceVerify(ctx, params) {
+	if (typeof params.userCode !== "string") throw deviceError("DEVICE_INVALID_USER_CODE", "Missing `userCode` parameter for verify flow.");
+	const identity = await ctx.auth.getUserIdentity();
+	if (identity === null) throw deviceError("NOT_SIGNED_IN", "You must be signed in to authorize a device.");
+	const userId = userIdFromIdentitySubject(identity.subject);
+	const doc = await queryDeviceByUserCode(ctx, params.userCode);
+	if (doc === null) throw deviceError("DEVICE_INVALID_USER_CODE", "Invalid or expired user code.");
+	if (Date.now() > doc.expiresAt) {
+		await mutateDeviceDelete(ctx, doc._id);
+		throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
+	}
+	if (doc.status !== "pending") throw deviceError("DEVICE_ALREADY_AUTHORIZED", "This device code has already been authorized.");
+	const signInResult = await callSignIn(ctx, {
+		userId,
+		generateTokens: false
+	});
+	await mutateDeviceAuthorize(ctx, doc._id, signInResult.userId, signInResult.sessionId);
+	return {
+		kind: "signedIn",
+		signedIn: null
+	};
+}
 /** @internal */
-const handleDevice = (ctx, provider, args) => Fx.from({
-	ok: async () => {
+const handleDevice = async (ctx, provider, args) => {
+	try {
 		const params = args.params ?? {};
-		const flow = typeof params.flow === "string" ? params.flow : "create";
-		if (!DEVICE_FLOWS.some((candidate) => candidate === flow)) throw Cv.error({
-			code: "DEVICE_MISSING_FLOW",
-			message: "Missing `flow` parameter. Expected one of: create, poll, verify"
-		});
-		if (flow === "create") {
-			const deviceCode = generateRandomString(DEVICE_CODE_LENGTH, DEVICE_CODE_ALPHABET);
-			const deviceCodeHash = await sha256(deviceCode);
-			const rawUserCode = generateRandomString(provider.userCodeLength, provider.charset);
-			const mid = Math.floor(rawUserCode.length / 2);
-			const userCode = rawUserCode.slice(0, mid) + "-" + rawUserCode.slice(mid);
-			await mutateDeviceInsert(ctx, {
-				deviceCodeHash,
-				userCode,
-				expiresAt: Date.now() + provider.expiresIn * 1e3,
-				interval: provider.interval,
-				status: "pending"
-			});
-			const verificationUri = provider.verificationUri ?? `${process.env.SITE_URL ?? requireEnv("SITE_URL")}/device`;
-			return {
-				kind: "deviceCode",
-				deviceCode,
-				userCode,
-				verificationUri,
-				verificationUriComplete: `${verificationUri}?user_code=${encodeURIComponent(userCode)}`,
-				expiresIn: provider.expiresIn,
-				interval: provider.interval
-			};
-		}
-		if (flow === "poll") {
-			if (typeof params.deviceCode !== "string") throw Cv.error({
-				code: "DEVICE_MISSING_FLOW",
-				message: "Missing `deviceCode` parameter for poll flow."
-			});
-			const doc$1 = await queryDeviceByCodeHash(ctx, await sha256(params.deviceCode));
-			if (doc$1 === null) throw Cv.error({
-				code: "DEVICE_CODE_EXPIRED",
-				message: "The device code has expired. Please start a new authorization request."
-			});
-			if (Date.now() > doc$1.expiresAt) {
-				await mutateDeviceDelete(ctx, doc$1._id);
-				throw Cv.error({
-					code: "DEVICE_CODE_EXPIRED",
-					message: "The device code has expired. Please start a new authorization request."
-				});
-			}
-			if (doc$1.lastPolledAt !== void 0 && (Date.now() - doc$1.lastPolledAt) / 1e3 < doc$1.interval) throw Cv.error({
-				code: "DEVICE_SLOW_DOWN",
-				message: "Polling too frequently. Increase the interval between requests."
-			});
-			await mutateDeviceUpdateLastPolled(ctx, doc$1._id, Date.now());
-			if (doc$1.status === "pending") throw Cv.error({
-				code: "DEVICE_AUTHORIZATION_PENDING",
-				message: "The user has not yet authorized this device."
-			});
-			if (doc$1.status === "denied") {
-				await mutateDeviceDelete(ctx, doc$1._id);
-				throw Cv.error({
-					code: "DEVICE_CODE_DENIED",
-					message: "The authorization request was denied."
-				});
-			}
-			if (!doc$1.userId || !doc$1.sessionId) throw Cv.error({
-				code: "INTERNAL_ERROR",
-				message: "Authorized device code missing userId or sessionId"
-			});
-			await mutateDeviceDelete(ctx, doc$1._id);
-			return {
-				kind: "signedIn",
-				signedIn: await callSignIn(ctx, {
-					userId: doc$1.userId,
-					sessionId: doc$1.sessionId,
-					generateTokens: true
-				})
-			};
-		}
-		if (typeof params.userCode !== "string") throw Cv.error({
-			code: "DEVICE_INVALID_USER_CODE",
-			message: "Missing `userCode` parameter for verify flow."
-		});
-		const identity = await ctx.auth.getUserIdentity();
-		if (identity === null) throw Cv.error({
-			code: "NOT_SIGNED_IN",
-			message: "You must be signed in to authorize a device."
-		});
-		const userId = userIdFromIdentitySubject(identity.subject);
-		const doc = await queryDeviceByUserCode(ctx, params.userCode);
-		if (doc === null) throw Cv.error({
-			code: "DEVICE_INVALID_USER_CODE",
-			message: "Invalid or expired user code."
-		});
-		if (Date.now() > doc.expiresAt) {
-			await mutateDeviceDelete(ctx, doc._id);
-			throw Cv.error({
-				code: "DEVICE_CODE_EXPIRED",
-				message: "The device code has expired. Please start a new authorization request."
-			});
-		}
-		if (doc.status !== "pending") throw Cv.error({
-			code: "DEVICE_ALREADY_AUTHORIZED",
-			message: "This device code has already been authorized."
-		});
-		const signInResult = await callSignIn(ctx, {
-			userId,
-			generateTokens: false
-		});
-		await mutateDeviceAuthorize(ctx, doc._id, signInResult.userId, signInResult.sessionId);
-		return {
-			kind: "signedIn",
-			signedIn: null
-		};
-	},
-	err: (e) => e instanceof ConvexError ? e : Cv.error({
-		code: "INTERNAL_ERROR",
-		message: `Device flow failed: ${String(e)}`
-	})
-});
+		const flow = assertFlow(typeof params.flow === "string" ? params.flow : "create");
+		return await new Map([
+			["create", () => handleCreate(ctx, provider)],
+			["poll", () => handlePoll(ctx, params)],
+			["verify", () => handleDeviceVerify(ctx, params)]
+		]).get(flow)();
+	} catch (error) {
+		if (error instanceof ConvexError) throw error;
+		if (error instanceof AuthFlowError) throw toConvexError(error);
+		if (error instanceof Error) throw toConvexError(authFlowError("INTERNAL_ERROR", `Device flow failed: ${error.message}`));
+		throw toConvexError(error);
+	}
+};
 
 //#endregion
 export { handleDevice };

package/dist/server/env.js

@@ -0,0 +1,48 @@
+import { ConvexError } from "convex/values";
+
+//#region src/server/env.ts
+function readEnv(name) {
+	const value = typeof process === "undefined" ? void 0 : process.env?.[name];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/** @internal */
+const readConfigSync = (value) => value;
+/** @internal */
+const envString = (name) => {
+	const value = readEnv(name);
+	if (value === void 0) throw new Error(`Missing environment variable \`${name}\``);
+	return value;
+};
+/** @internal */
+const envOptionalString = (name) => readEnv(name);
+/** @internal */
+const envOptionalNumber = (name) => {
+	const value = readEnv(name);
+	if (value === void 0) return;
+	const parsed = Number(value);
+	if (!Number.isFinite(parsed)) throw new Error(`Invalid numeric environment variable \`${name}\``);
+	return parsed;
+};
+/** @internal */
+const envBoolean = (name) => {
+	const value = readEnv(name);
+	if (value === void 0) return;
+	if (value === "true") return true;
+	if (value === "false") return false;
+	throw new Error(`Invalid boolean environment variable \`${name}\``);
+};
+/** @internal */
+function requireEnv(name) {
+	try {
+		return readConfigSync(envString(name));
+	} catch {
+		throw new ConvexError({
+			code: "MISSING_ENV_VAR",
+			message: `Missing environment variable \`${name}\``
+		});
+	}
+}
+
+//#endregion
+export { envBoolean, envOptionalNumber, envOptionalString, readConfigSync, requireEnv };
+//# sourceMappingURL=env.js.map

package/dist/server/errors.js

@@ -0,0 +1,20 @@
+import { AuthFlowError } from "../shared/errors.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/errors.ts
+/** @internal */
+const toConvexError = (error) => {
+	if (error instanceof ConvexError) return error;
+	if (error instanceof AuthFlowError) return new ConvexError({
+		code: error.code,
+		message: error.message
+	});
+	return new ConvexError({
+		code: "INTERNAL_ERROR",
+		message: error instanceof Error ? error.message : String(error)
+	});
+};
+
+//#endregion
+export { toConvexError };
+//# sourceMappingURL=errors.js.map