@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/types.d.ts

@@ -1,18 +1,8 @@
-import { OAuthProviderInstance } from "../providers/oauth.js";
-import { CredentialsConfig } from "../providers/credentials.js";
-import { Password } from "../providers/password.js";
-import { Passkey } from "../providers/passkey.js";
-import { Totp } from "../providers/totp.js";
-import { Device } from "../providers/device.js";
-import { SSO } from "../providers/sso.js";
-import { Email } from "../providers/email.js";
-import { Phone } from "../providers/phone.js";
-import { vApiKeyDoc, vAuthVerifierDoc, vDeviceCodeDoc, vPasskeyDoc, vTotpFactorDoc } from "../component/model.js";
+import { vApiKeyDoc } from "../component/model.js";
 import { _default } from "../component/schema.js";
-import { Anonymous } from "../providers/anonymous.js";
-import { AnyDataModel, DataModelFromSchemaDefinition, DocumentByName, GenericActionCtx, GenericDataModel, GenericMutationCtx, GenericQueryCtx, TableNamesInDataModel } from "convex/server";
+import { CredentialsConfig } from "../providers/credentials.js";
 import { GenericId, Infer, Value } from "convex/values";
-import * as arctic0 from "arctic";
+import { AnyDataModel, DataModelFromSchemaDefinition, DocumentByName, FunctionReference, GenericActionCtx, GenericDataModel, GenericMutationCtx, GenericQueryCtx, TableNamesInDataModel } from "convex/server";
 
 //#region src/server/types.d.ts
 /**
@@ -56,7 +46,7 @@ type AuthAuthorizationConfig = {
  * @see {@link AuthGrant}
  */
 type AuthRoleId<TAuthorization extends AuthAuthorizationConfig | undefined> = TAuthorization extends {
-  roles: infer TRoles extends Record<string, any>;
+  roles: infer TRoles extends Record<string, unknown>;
 } ? keyof TRoles & string : string;
 /**
  * Extracts the union of grant strings from all roles in an authorization config.
@@ -70,7 +60,7 @@ type AuthRoleId<TAuthorization extends AuthAuthorizationConfig | undefined> = TA
  */
 type AuthGrant<TAuthorization extends AuthAuthorizationConfig | undefined> = TAuthorization extends {
   roles: infer TRoles extends Record<string, {
-    grants: readonly any[];
+    grants: readonly unknown[];
   }>;
 } ? TRoles[keyof TRoles]["grants"][number] & string : string;
 /**
@@ -84,6 +74,32 @@ type ConvexAuthConfig = {
    * `@robelest/convex-auth/providers/<provider-name>`
    */
   providers: AuthProviderConfig[];
+  sso?: {
+    hooks?: {
+      profileResolved?: (args: {
+        protocol: "oidc" | "saml" | "scim";
+        connectionId?: string;
+        profile: Record<string, unknown>;
+      }) => Awaitable<Record<string, unknown> | void>;
+      beforeProvision?: (args: {
+        protocol: "oidc" | "saml" | "scim";
+        connectionId?: string;
+        profile: Record<string, unknown>;
+      }) => Awaitable<Record<string, unknown> | void>;
+      afterProvision?: (args: {
+        protocol: "oidc" | "saml" | "scim";
+        connectionId?: string;
+        profile: Record<string, unknown>;
+        userId: string;
+      }) => Awaitable<void>;
+      allowLink?: (args: {
+        protocol: "oidc" | "saml" | "scim";
+        connectionId?: string;
+        profile: Record<string, unknown>;
+        userId: string;
+      }) => Awaitable<boolean | void>;
+    };
+  };
   /**
    * Auth component reference from `components.auth`.
    *
@@ -303,102 +319,140 @@ type ConvexAuthConfig = {
 /**
  * Union of all supported auth provider config types.
  *
- * Includes Arctic-based OAuth providers (via the `OAuth()` factory),
- * plus library-native providers: credentials, email, phone, passkey
- * (WebAuthn), and TOTP (2FA). Each can be passed as a config object
- * or a factory function.
+ * Includes materialized provider configs plus optional config factories.
  */
-type AuthProviderConfig = OAuthProviderInstance | Password | Passkey | Totp | Anonymous | Device | SSO | Email | Phone | OAuthMaterializedConfig | ConvexCredentialsConfig | ((...args: any) => ConvexCredentialsConfig) | EmailConfig | ((...args: any) => EmailConfig) | PhoneConfig | ((...args: any) => PhoneConfig) | PasskeyProviderConfig | ((...args: any) => PasskeyProviderConfig) | TotpProviderConfig | ((...args: any) => TotpProviderConfig) | DeviceProviderConfig | ((...args: any) => DeviceProviderConfig) | SSOProviderConfig;
+type AuthProviderConfig = OAuthMaterializedConfig | ConvexCredentialsConfig | (() => ConvexCredentialsConfig) | EmailConfig | (() => EmailConfig) | PhoneConfig | (() => PhoneConfig) | PasskeyProviderConfig | (() => PasskeyProviderConfig) | TotpProviderConfig | (() => TotpProviderConfig) | DeviceProviderConfig | (() => DeviceProviderConfig) | SSOProviderConfig;
 /**
  * Minimal config stored for the SSO provider at runtime.
- * No options — enterprise configuration is entirely per-tenant runtime state.
+ * No options — connection configuration is entirely per-tenant runtime state.
  */
 interface SSOProviderConfig {
   id: string;
   type: "sso";
+  /**
+   * Optional shared callback URI for all OIDC group connections.
+   * When omitted, each connection gets its own callback path.
+   */
+  redirectURI?: string;
 }
 /**
- * Account linking strategy for enterprise SSO sign-in.
+ * Account linking strategy for group SSO sign-in.
  *
  * - `"verifiedEmail"` — link accounts when the IdP-provided email matches a verified email on an existing user.
  * - `"none"` — never auto-link; always create a new account.
  */
-type EnterpriseAccountLinkingPolicy = "verifiedEmail" | "none";
+type GroupConnectionAccountLinkingPolicy = "verifiedEmail" | "none";
 /**
  * Policy for reusing existing users during SCIM provisioning.
  *
  * - `"externalId"` — match by the SCIM `externalId` to reuse a previously provisioned user.
  * - `"none"` — always create a new user for each SCIM provision request.
  */
-type EnterpriseScimReuseUserPolicy = "externalId" | "none";
+type GroupConnectionScimReuseUserPolicy = "externalId" | "none";
 /**
- * Just-in-time provisioning mode for enterprise SSO.
+ * Just-in-time provisioning mode for group SSO.
  *
  * - `"off"` — no JIT provisioning; users must be pre-provisioned.
  * - `"createUser"` — create a user record on first SSO sign-in.
- * - `"createUserAndMembership"` — create a user and add them to the enterprise group on first SSO sign-in.
+ * - `"createUserAndMembership"` — create a user and add them to the group on first SSO sign-in.
  */
-type EnterpriseJitProvisioningMode = "off" | "createUser" | "createUserAndMembership";
+type GroupConnectionJitProvisioningMode = "off" | "createUser" | "createUserAndMembership";
 /**
  * Deprovisioning strategy when a SCIM user is deleted.
  *
  * - `"soft"` — mark the user as inactive but preserve the record.
  * - `"hard"` — permanently delete the user and associated data.
  */
-type EnterpriseDeprovisionMode = "soft" | "hard";
+type GroupConnectionDeprovisionMode = "soft" | "hard";
+type GroupConnectionProfileUpdateMode = "never" | "missing" | "always";
+type GroupConnectionProvisioningAuthority = "app" | "sso" | "scim";
+type GroupConnectionGroupSyncMode = "ignore" | "sync";
+type GroupConnectionRoleSyncMode = "ignore" | "map";
 /**
- * Effective enterprise policy document stored for an SSO/SCIM tenant.
+ * Effective group policy document stored for an SSO/SCIM tenant.
  *
  * Controls account linking, JIT provisioning, SCIM reuse behavior,
  * deprovisioning, and any app-defined extension metadata.
  *
- * @see {@link EnterprisePolicyPatch}
+ * @see {@link GroupConnectionPolicyPatch}
  */
-interface EnterprisePolicy {
+interface GroupConnectionPolicy {
   version: 1;
   identity: {
     accountLinking: {
-      oidc: EnterpriseAccountLinkingPolicy;
-      saml: EnterpriseAccountLinkingPolicy;
+      oidc: GroupConnectionAccountLinkingPolicy;
+      saml: GroupConnectionAccountLinkingPolicy;
     };
   };
   provisioning: {
+    user: {
+      createOnSignIn: boolean;
+      updateProfileOnLogin: GroupConnectionProfileUpdateMode;
+      updateProfileFromScim: GroupConnectionProfileUpdateMode;
+      authority: GroupConnectionProvisioningAuthority;
+    };
     scimReuse: {
-      user: EnterpriseScimReuseUserPolicy;
+      user: GroupConnectionScimReuseUserPolicy;
     };
     jit: {
-      mode: EnterpriseJitProvisioningMode;
+      mode: GroupConnectionJitProvisioningMode;
       defaultRoleIds: string[];
     };
     deprovision: {
-      mode: EnterpriseDeprovisionMode;
+      mode: GroupConnectionDeprovisionMode;
+    };
+    groups: {
+      mode: GroupConnectionGroupSyncMode;
+      source: "protocol";
+      mapping?: Record<string, string[]>;
+    };
+    roles: {
+      mode: GroupConnectionRoleSyncMode;
+      source: "protocol";
+      mapping?: Record<string, string[]>;
     };
   };
   extend?: Record<string, unknown>;
 }
 /**
- * Partial update payload for {@link EnterprisePolicy}.
+ * Partial update payload for {@link GroupConnectionPolicy}.
  *
- * Use this when patching only selected enterprise policy sections without
+ * Use this when patching only selected group policy sections without
  * replacing the entire stored policy document.
  */
-interface EnterprisePolicyPatch {
+interface GroupConnectionPolicyPatch {
   identity?: {
     accountLinking?: {
-      oidc?: EnterpriseAccountLinkingPolicy;
-      saml?: EnterpriseAccountLinkingPolicy;
+      oidc?: GroupConnectionAccountLinkingPolicy;
+      saml?: GroupConnectionAccountLinkingPolicy;
     };
   };
   provisioning?: {
+    user?: {
+      createOnSignIn?: boolean;
+      updateProfileOnLogin?: GroupConnectionProfileUpdateMode;
+      updateProfileFromScim?: GroupConnectionProfileUpdateMode;
+      authority?: GroupConnectionProvisioningAuthority;
+    };
     scimReuse?: {
-      user?: EnterpriseScimReuseUserPolicy;
+      user?: GroupConnectionScimReuseUserPolicy;
     };
     jit?: {
-      mode?: EnterpriseJitProvisioningMode;
+      mode?: GroupConnectionJitProvisioningMode;
       defaultRoleIds?: string[];
     };
     deprovision?: {
-      mode?: EnterpriseDeprovisionMode;
+      mode?: GroupConnectionDeprovisionMode;
+    };
+    groups?: {
+      mode?: GroupConnectionGroupSyncMode;
+      source?: "protocol";
+      mapping?: Record<string, string[]>;
+    };
+    roles?: {
+      mode?: GroupConnectionRoleSyncMode;
+      source?: "protocol";
+      mapping?: Record<string, string[]>;
     };
   };
   extend?: Record<string, unknown>;
@@ -504,7 +558,8 @@ interface PhoneConfig<DataModel extends GenericDataModel = GenericDataModel> {
    * Any tokens shorter than 24 characters are assumed to not
    * be secure enough on their own, and require providing
    * the original `phone` used in the initial `signIn` call.
-   * @returns
+   *
+   * @returns The verification token to send to the user.
    */
   generateVerificationToken?: () => Promise<string>;
   /**
@@ -537,8 +592,13 @@ interface PhoneConfig<DataModel extends GenericDataModel = GenericDataModel> {
 type PhoneUserConfig<DataModel extends GenericDataModel = GenericDataModel> = Omit<Partial<PhoneConfig<DataModel>>, "options" | "type">;
 /**
  * Credentials provider config used by Convex Auth.
+ *
+ * Extends the user-facing {@link CredentialsConfig} with the stable provider
+ * `id` and `type` fields injected by the library.
+ *
+ * @typeParam DataModel - The Convex data model used by the auth context.
  */
-type ConvexCredentialsConfig = CredentialsConfig<any> & {
+type ConvexCredentialsConfig<DataModel extends GenericDataModel = GenericDataModel> = CredentialsConfig<DataModel> & {
   type: "credentials";
   id: string;
 };
@@ -620,6 +680,35 @@ interface OAuthProfile {
   /** Additional claims from the ID token or userinfo endpoint. */
   [key: string]: unknown;
 }
+/**
+ * Stable OAuth token shape exposed to provider callbacks.
+ *
+ * This contract is owned by convex-auth so users are insulated from changes
+ * to the underlying OAuth implementation.
+ */
+interface OAuthTokens {
+  accessToken?: string;
+  refreshToken?: string;
+  idToken?: string;
+  accessTokenExpiresAt?: Date;
+  refreshTokenExpiresAt?: Date;
+  scopes?: string[];
+  raw?: unknown;
+}
+interface OAuthRuntimeClient {
+  readonly pkce: "required" | "optional" | "never";
+  createAuthorizationURL(args: {
+    state: string;
+    codeVerifier?: string;
+    scopes: string[];
+    nonce?: string;
+    loginHint?: string;
+  }): URL;
+  validateAuthorizationCode(args: {
+    code: string;
+    codeVerifier?: string;
+  }): Promise<OAuthTokens>;
+}
 /** Credentials identifying a provider account (e.g. email + hashed password). */
 type AuthAccountCredentials = {
   /** Provider-specific account identifier (e.g. email address). */id: string; /** Optional secret (e.g. hashed password). */
@@ -704,15 +793,15 @@ type AuthMemberRequireArgs = AuthMemberInspectArgs & {
  */
 type AuthServerHelpers = {
   /** Account management: create, retrieve, and update provider-linked accounts. */account: {
-    create: (ctx: GenericActionCtx<any>, args: AuthCreateAccountArgs) => Promise<{
+    create: (ctx: GenericActionCtx<GenericDataModel>, args: AuthCreateAccountArgs) => Promise<{
       account: GenericDoc<GenericDataModel, "Account">;
       user: GenericDoc<GenericDataModel, "User">;
     }>;
-    get: (ctx: GenericActionCtx<any>, args: AuthRetrieveAccountArgs) => Promise<{
+    get: (ctx: GenericActionCtx<GenericDataModel>, args: AuthRetrieveAccountArgs) => Promise<{
       account: GenericDoc<GenericDataModel, "Account">;
       user: GenericDoc<GenericDataModel, "User">;
     }>;
-    update: (ctx: GenericActionCtx<any>, args: AuthUpdateAccountArgs) => Promise<{
+    update: (ctx: GenericActionCtx<GenericDataModel>, args: AuthUpdateAccountArgs) => Promise<{
       accountId: GenericId<"Account">;
     }>;
   };
@@ -720,17 +809,17 @@ type AuthServerHelpers = {
     current: (ctx: {
       auth: GenericActionCtx<GenericDataModel>["auth"];
     }) => Promise<GenericId<"Session"> | null>;
-    invalidate: (ctx: GenericActionCtx<any>, args: AuthInvalidateSessionsArgs) => Promise<{
+    invalidate: (ctx: GenericActionCtx<GenericDataModel>, args: AuthInvalidateSessionsArgs) => Promise<{
       userId: GenericId<"User">;
       except: GenericId<"Session">[];
     }>;
   };
   member: {
-    inspect: (ctx: GenericActionCtx<any>, args: AuthMemberInspectArgs) => Promise<AuthMemberInspectResult>;
-    require: (ctx: GenericActionCtx<any>, args: AuthMemberRequireArgs) => Promise<AuthMemberInspectResult>;
+    inspect: (ctx: GenericActionCtx<GenericDataModel>, args: AuthMemberInspectArgs) => Promise<AuthMemberInspectResult>;
+    require: (ctx: GenericActionCtx<GenericDataModel>, args: AuthMemberRequireArgs) => Promise<AuthMemberInspectResult>;
   };
   provider: {
-    signIn: (ctx: GenericActionCtx<any>, provider: AuthProviderConfig, args: AuthProviderSignInArgs) => Promise<AuthProviderSignInResult>;
+    signIn: (ctx: GenericActionCtx<GenericDataModel>, provider: AuthProviderConfig, args: AuthProviderSignInArgs) => Promise<AuthProviderSignInResult>;
   };
 };
 /**
@@ -752,30 +841,24 @@ type GenericActionCtxWithAuthConfig<DataModel extends GenericDataModel> = Generi
  */
 type ConvexAuthMaterializedConfig = {
   providers: AuthProviderMaterializedConfig[];
-} & Pick<ConvexAuthConfig, "component" | "session" | "jwt" | "signIn" | "callbacks" | "authorization">;
-/**
- * Maps SAML assertion attribute names to user profile fields.
- *
- * Use this to tell the SSO flow which SAML attributes correspond to
- * the user's subject identifier, email, and display name fields.
- */
-interface SAMLAttributeMapping {
-  /** SAML attribute for the unique subject identifier (NameID). */
+} & Pick<ConvexAuthConfig, "component" | "session" | "jwt" | "signIn" | "callbacks" | "authorization" | "sso">;
+interface SSOProfileMapping {
   subject?: string;
-  /** SAML attribute for the user's email address. */
   email?: string;
-  /** SAML attribute for the user's full display name. */
+  emailVerified?: string;
   name?: string;
-  /** SAML attribute for the user's first / given name. */
   firstName?: string;
-  /** SAML attribute for the user's last / family name. */
   lastName?: string;
+  image?: string;
+  phone?: string;
+  active?: string;
+  externalId?: string;
+  groups?: string;
+  roles?: string;
 }
+interface OIDCClaimMapping extends Pick<SSOProfileMapping, "subject" | "email" | "emailVerified" | "name" | "image" | "groups" | "roles"> {}
 /**
- * Materialized OAuth provider config (Arctic-based).
- *
- * Carries the Arctic provider instance along with scopes and profile config.
- * Produced by materializing an `OAuthProviderInstance` during `configDefaults`.
+ * Materialized OAuth provider config.
  */
 interface OAuthMaterializedConfig {
   /**
@@ -789,10 +872,10 @@ interface OAuthMaterializedConfig {
    */
   readonly type: "oauth";
   /**
-   * The Arctic provider instance.
+   * The runtime client used for the authorization code flow.
    * @readonly
    */
-  readonly provider: any;
+  readonly provider: OAuthRuntimeClient | null;
   /**
    * OAuth scopes to request.
    * @readonly
@@ -802,7 +885,13 @@ interface OAuthMaterializedConfig {
    * User-provided profile extraction callback.
    * @readonly
    */
-  readonly profile?: (tokens: arctic0.OAuth2Tokens) => Promise<OAuthProfile>;
+  readonly profile?: (tokens: OAuthTokens) => Promise<OAuthProfile>;
+  /** Whether to issue and verify a nonce cookie during the callback flow. */
+  readonly nonce?: boolean;
+  /** Optional token validation hook after code exchange. */
+  readonly validateTokens?: (tokens: OAuthTokens, ctx: {
+    nonce?: string;
+  }) => Promise<void>;
   /**
    * Account-linking policy for OAuth identities. Defaults to verified email linking.
    * @readonly
@@ -839,15 +928,23 @@ interface DeviceProviderConfig {
  */
 type AuthProviderMaterializedConfig = OAuthMaterializedConfig | EmailConfig | PhoneConfig | ConvexCredentialsConfig | PasskeyProviderConfig | TotpProviderConfig | DeviceProviderConfig | SSOProviderConfig;
 /**
- * Resolves to `true` when the providers list includes `SSO`, otherwise `false`.
+ * Resolves to `true` when the providers list includes `sso()`, otherwise `false`.
  *
- * Used to make `auth.sso` conditionally present on the `createAuth`
- * return type — it only appears when `new SSO()` is in the providers array.
+ * Used to make `auth.group.sso` conditionally present on the `createAuth`
+ * return type — it only appears when `sso()` is in the providers array.
  */
-type HasSSO<P extends AuthProviderConfig[]> = SSO extends P[number] ? true : false;
-type HasPasskeyProvider<P extends AuthProviderConfig[]> = Passkey extends P[number] ? true : false;
-type HasTotpProvider<P extends AuthProviderConfig[]> = Totp extends P[number] ? true : false;
-type HasDeviceProvider<P extends AuthProviderConfig[]> = Device extends P[number] ? true : false;
+type HasSSO<P extends AuthProviderConfig[]> = Extract<P[number], {
+  type: "sso";
+}> extends never ? false : true;
+type HasPasskeyProvider<P extends AuthProviderConfig[]> = Extract<P[number], {
+  type: "passkey";
+}> extends never ? false : true;
+type HasTotpProvider<P extends AuthProviderConfig[]> = Extract<P[number], {
+  type: "totp";
+}> extends never ? false : true;
+type HasDeviceProvider<P extends AuthProviderConfig[]> = Extract<P[number], {
+  type: "device";
+}> extends never ? false : true;
 /**
  * A single scope entry stored per API key.
  * Uses a resource:action pattern for structured permissions.
@@ -877,129 +974,6 @@ interface ScopeChecker {
   /** The raw scope entries from the key. */
   scopes: KeyScope[];
 }
-/**
- * An API key record as returned by `auth.key.list()` and `auth.key.get()`.
- * Never includes the raw key material — only the display prefix.
- */
-interface KeyRecord {
-  /** Document ID. */
-  _id: string;
-  /** Owner user ID. */
-  userId: string;
-  /** Display prefix (e.g. `"sk_abc1"`). Safe to show in UIs. */
-  prefix: string;
-  /** Human-readable name (e.g. "CI Pipeline"). */
-  name: string;
-  /** Resource:action permissions granted to this key. */
-  scopes: KeyScope[];
-  /** Per-key rate limit, if configured. */
-  rateLimit?: {
-    maxRequests: number;
-    windowMs: number;
-  };
-  /** Expiration timestamp (ms since epoch), or `undefined` for no expiry. */
-  expiresAt?: number;
-  /** Timestamp of last successful verification, or `undefined` if never used. */
-  lastUsedAt?: number;
-  /** Creation timestamp (ms since epoch). */
-  createdAt: number;
-  /** `true` when the key has been revoked (soft-deleted). */
-  revoked: boolean;
-  /** Arbitrary app-specific metadata attached to the key. */
-  metadata?: Record<string, unknown>;
-}
-/**
- * Options for paginated list queries. Every entity list method uses this
- * same shape with entity-specific `TWhere` and `TOrderBy` type parameters.
- *
- * @typeParam TWhere - The type of the optional filter object.
- * @typeParam TOrderBy - The union of sortable field names.
- *
- * ```ts
- * const result = await auth.group.list(ctx, {
- *   where: { type: "team" },
- *   limit: 20,
- *   orderBy: "name",
- *   order: "asc",
- * });
- * ```
- */
-type ListOptions<TWhere extends Record<string, unknown>, TOrderBy extends string> = {
-  /** Serializable filter — only known fields for the entity. */where?: TWhere; /** Maximum number of items to return. Defaults to 50, max 100. */
-  limit?: number; /** Opaque cursor from a previous `ListResult.nextCursor`. */
-  cursor?: string | null; /** Field to sort by. Defaults to `"_creationTime"`. */
-  orderBy?: TOrderBy; /** Sort direction. Defaults to `"desc"`. */
-  order?: "asc" | "desc";
-};
-/**
- * Paginated list result returned by every entity list method.
- *
- * @typeParam T - The type of items in the result array.
- */
-type ListResult<T> = {
-  /** The page of items. */items: T[]; /** Opaque cursor for the next page, or `null` when exhausted. */
-  nextCursor: string | null;
-};
-/**
- * A single key/value tag for group classification.
- *
- * Tags are normalized at write time: both `key` and `value` are
- * trimmed and lowercased. Filtering is strict exact-match only.
- */
-type GroupTag = {
-  key: string;
-  value: string;
-};
-/** Filter fields for `auth.group.list()`. All optional. */
-type GroupWhere = {
-  slug?: string;
-  type?: string;
-  parentGroupId?: string;
-  name?: string; /** When `true`, return only root groups (no parent). When `false`, only non-root. */
-  isRoot?: boolean;
-  /**
-   * Return only groups that have **all** of the specified tags.
-   * Each tag is matched exactly on normalized `(key, value)`.
-   */
-  tagsAll?: GroupTag[];
-  /**
-   * Return only groups that have **at least one** of the specified tags.
-   * Each tag is matched exactly on normalized `(key, value)`.
-   */
-  tagsAny?: GroupTag[];
-};
-/** Sortable fields for `auth.group.list()`. */
-type GroupOrderBy = "_creationTime" | "name" | "slug" | "type";
-/** Filter fields for `auth.member.list()`. All optional. */
-type MemberWhere = {
-  groupId?: string;
-  userId?: string;
-  roleId?: string;
-  status?: string;
-};
-/** Sortable fields for `auth.member.list()`. */
-type MemberOrderBy = "_creationTime" | "status";
-/** Filter fields for `auth.invite.list()`. All optional. */
-type InviteWhere = {
-  tokenHash?: string;
-  groupId?: string;
-  status?: "pending" | "accepted" | "revoked" | "expired";
-  email?: string;
-  invitedByUserId?: string;
-  roleId?: string;
-  acceptedByUserId?: string;
-};
-/** Sortable fields for `auth.invite.list()`. */
-type InviteOrderBy = "_creationTime" | "status" | "email" | "expiresTime" | "acceptedTime";
-/** Filter fields for `auth.key.list()`. All optional. */
-type KeyWhere = {
-  userId?: string;
-  revoked?: boolean;
-  name?: string;
-  prefix?: string;
-};
-/** Sortable fields for `auth.key.list()`. */
-type KeyOrderBy = "_creationTime" | "name" | "lastUsedAt" | "expiresAt" | "revoked";
 /** Filter fields for `auth.user.list()`. All optional. */
 type UserWhere = {
   email?: string;
@@ -1037,13 +1011,139 @@ interface HttpKeyContext {
  * CORS configuration for Bearer-authenticated HTTP endpoints.
  */
 interface CorsConfig {
-  /** Allowed origin(s). Defaults to `"*"`. */
-  origin?: string;
+  /**
+   * Allowed origins. Defaults to the site URLs from environment
+   * (`SITE_URL` and `SECONDARY_URL`). Pass `["*"]` to allow any origin.
+   */
+  origins?: string[];
   /** Allowed HTTP methods. Defaults to `"GET,POST,PUT,PATCH,DELETE,OPTIONS"`. */
   methods?: string;
   /** Allowed request headers. Defaults to `"Content-Type,Authorization"`. */
   headers?: string;
 }
+/**
+ * Component function references required by core auth runtime.
+ */
+type AuthComponentApi = {
+  public: {
+    userGetById: FunctionReference<"query", "internal">;
+    userList: FunctionReference<"query", "internal">;
+    userFindByVerifiedEmail: FunctionReference<"query", "internal">;
+    userFindByVerifiedPhone: FunctionReference<"query", "internal">;
+    userInsert: FunctionReference<"mutation", "internal">;
+    userUpsert: FunctionReference<"mutation", "internal">;
+    userPatch: FunctionReference<"mutation", "internal">;
+    userDelete: FunctionReference<"mutation", "internal">;
+    accountGet: FunctionReference<"query", "internal">;
+    accountGetById: FunctionReference<"query", "internal">;
+    accountInsert: FunctionReference<"mutation", "internal">;
+    accountListByUser: FunctionReference<"query", "internal">;
+    accountPatch: FunctionReference<"mutation", "internal">;
+    accountDelete: FunctionReference<"mutation", "internal">;
+    sessionCreate: FunctionReference<"mutation", "internal">;
+    sessionGetById: FunctionReference<"query", "internal">;
+    sessionDelete: FunctionReference<"mutation", "internal">;
+    sessionListByUser: FunctionReference<"query", "internal">;
+    verifierCreate: FunctionReference<"mutation", "internal">;
+    verifierGetById: FunctionReference<"query", "internal">;
+    verifierGetBySignature: FunctionReference<"query", "internal">;
+    verifierPatch: FunctionReference<"mutation", "internal">;
+    verifierDelete: FunctionReference<"mutation", "internal">;
+    verificationCodeGetByAccountId: FunctionReference<"query", "internal">;
+    verificationCodeGetByCode: FunctionReference<"query", "internal">;
+    verificationCodeCreate: FunctionReference<"mutation", "internal">;
+    verificationCodeDelete: FunctionReference<"mutation", "internal">;
+    refreshTokenCreate: FunctionReference<"mutation", "internal">;
+    refreshTokenGetById: FunctionReference<"query", "internal">;
+    refreshTokenPatch: FunctionReference<"mutation", "internal">;
+    refreshTokenGetChildren: FunctionReference<"query", "internal">;
+    refreshTokenListBySession: FunctionReference<"query", "internal">;
+    refreshTokenDeleteAll: FunctionReference<"mutation", "internal">;
+    refreshTokenGetActive: FunctionReference<"query", "internal">;
+    rateLimitGet: FunctionReference<"query", "internal">;
+    rateLimitCreate: FunctionReference<"mutation", "internal">;
+    rateLimitPatch: FunctionReference<"mutation", "internal">;
+    rateLimitDelete: FunctionReference<"mutation", "internal">;
+    groupCreate: FunctionReference<"mutation", "internal">;
+    groupGet: FunctionReference<"query", "internal">;
+    groupList: FunctionReference<"query", "internal">;
+    groupUpdate: FunctionReference<"mutation", "internal">;
+    groupDelete: FunctionReference<"mutation", "internal">;
+    memberAdd: FunctionReference<"mutation", "internal">;
+    memberGet: FunctionReference<"query", "internal">;
+    memberList: FunctionReference<"query", "internal">;
+    memberGetByGroupAndUser: FunctionReference<"query", "internal">;
+    memberRemove: FunctionReference<"mutation", "internal">;
+    memberUpdate: FunctionReference<"mutation", "internal">;
+    inviteCreate: FunctionReference<"mutation", "internal">;
+    inviteGet: FunctionReference<"query", "internal">;
+    inviteGetByTokenHash: FunctionReference<"query", "internal">;
+    inviteList: FunctionReference<"query", "internal">;
+    inviteAccept: FunctionReference<"mutation", "internal">;
+    inviteAcceptByToken: FunctionReference<"mutation", "internal">;
+    inviteRevoke: FunctionReference<"mutation", "internal">;
+    keyInsert: FunctionReference<"mutation", "internal">;
+    keyGetByHashedKey: FunctionReference<"query", "internal">;
+    keyGetById: FunctionReference<"query", "internal">;
+    keyList: FunctionReference<"query", "internal">;
+    keyPatch: FunctionReference<"mutation", "internal">;
+    keyDelete: FunctionReference<"mutation", "internal">;
+    passkeyInsert: FunctionReference<"mutation", "internal">;
+    passkeyGetByCredentialId: FunctionReference<"query", "internal">;
+    passkeyListByUserId: FunctionReference<"query", "internal">;
+    passkeyUpdateCounter: FunctionReference<"mutation", "internal">;
+    passkeyUpdateMeta: FunctionReference<"mutation", "internal">;
+    passkeyDelete: FunctionReference<"mutation", "internal">;
+    totpInsert: FunctionReference<"mutation", "internal", any, any>;
+    totpGetVerifiedByUserId: FunctionReference<"query", "internal", any, any>;
+    totpListByUserId: FunctionReference<"query", "internal", any, any>;
+    totpGetById: FunctionReference<"query", "internal", any, any>;
+    totpMarkVerified: FunctionReference<"mutation", "internal", any, any>;
+    totpUpdateLastUsed: FunctionReference<"mutation", "internal", any, any>;
+    totpDelete: FunctionReference<"mutation", "internal", any, any>;
+    deviceInsert: FunctionReference<"mutation", "internal", any, any>;
+    deviceGetByCodeHash: FunctionReference<"query", "internal", any, any>;
+    deviceGetByUserCode: FunctionReference<"query", "internal", any, any>;
+    deviceAuthorize: FunctionReference<"mutation", "internal", any, any>;
+    deviceUpdateLastPolled: FunctionReference<"mutation", "internal", any, any>;
+    deviceDelete: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionCreate: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionGet: FunctionReference<"query", "internal", any, any>;
+    groupConnectionGetByDomain: FunctionReference<"query", "internal", any, any>;
+    groupConnectionList: FunctionReference<"query", "internal", any, any>;
+    groupConnectionUpdate: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionDelete: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionDomainAdd: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionDomainList: FunctionReference<"query", "internal", any, any>;
+    groupConnectionDomainDelete: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionDomainVerificationGet: FunctionReference<"query", "internal", any, any>;
+    groupConnectionDomainVerificationUpsert: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionDomainVerificationDelete: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionDomainVerify: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionSecretUpsert: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionSecretGet: FunctionReference<"query", "internal", any, any>;
+    groupConnectionSecretDelete: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionScimConfigUpsert: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionScimConfigGetByGroupConnection: FunctionReference<"query", "internal", any, any>;
+    groupConnectionScimConfigGetByTokenHash: FunctionReference<"query", "internal", any, any>;
+    groupConnectionScimIdentityGet: FunctionReference<"query", "internal", any, any>;
+    groupConnectionScimIdentityGetByUser: FunctionReference<"query", "internal", any, any>;
+    groupConnectionScimIdentityGetByGroupConnectionAndUser: FunctionReference<"query", "internal", any, any>;
+    groupConnectionScimIdentityGetByMappedGroup: FunctionReference<"query", "internal", any, any>;
+    groupConnectionScimIdentityListByGroupConnection: FunctionReference<"query", "internal", any, any>;
+    groupConnectionScimIdentityUpsert: FunctionReference<"mutation", "internal", any, any>;
+    groupConnectionScimIdentityDelete: FunctionReference<"mutation", "internal", any, any>;
+    groupAuditEventCreate: FunctionReference<"mutation", "internal", any, any>;
+    groupAuditEventList: FunctionReference<"query", "internal", any, any>;
+    groupWebhookEndpointCreate: FunctionReference<"mutation", "internal", any, any>;
+    groupWebhookEndpointList: FunctionReference<"query", "internal", any, any>;
+    groupWebhookEndpointGet: FunctionReference<"query", "internal", any, any>;
+    groupWebhookEndpointUpdate: FunctionReference<"mutation", "internal", any, any>;
+    groupWebhookDeliveryEnqueue: FunctionReference<"mutation", "internal", any, any>;
+    groupWebhookDeliveryListReady: FunctionReference<"query", "internal", any, any>;
+    groupWebhookDeliveryPatch: FunctionReference<"mutation", "internal", any, any>;
+  };
+};
 /**
  * Convex document from a given table.
  */
@@ -1053,99 +1153,9 @@ type GenericDoc<DataModel extends GenericDataModel, TableName extends TableNames
 };
 /** Data model derived from the component schema. */
 type AuthDataModel = DataModelFromSchemaDefinition<typeof _default>;
-/** Action context typed to the auth component's data model. */
-type ActionCtx = GenericActionCtx<AuthDataModel>;
-/** Mutation context typed to the auth component's data model. */
-type MutationCtx = GenericMutationCtx<AuthDataModel>;
-/** Query context typed to the auth component's data model. */
-type QueryCtx = GenericQueryCtx<AuthDataModel>;
 /** A document from any table in the auth component schema. */
 type Doc<T extends TableNamesInDataModel<AuthDataModel>> = GenericDoc<AuthDataModel, T>;
-/** A pair of JWT access token and refresh token. */
-type Tokens = {
-  token: string;
-  refreshToken: string;
-};
-/** Session information returned after authentication. */
-type SessionInfo = {
-  userId: GenericId<"User">;
-  sessionId: GenericId<"Session">;
-  tokens: Tokens | null;
-};
-/** Session information with guaranteed non-null tokens. */
-type SessionInfoWithTokens = {
-  userId: GenericId<"User">;
-  sessionId: GenericId<"Session">;
-  tokens: Tokens;
-};
-type TotpDoc = Infer<typeof vTotpFactorDoc>;
-type PasskeyDoc = Infer<typeof vPasskeyDoc>;
-type VerifierDoc = Infer<typeof vAuthVerifierDoc>;
 type KeyDoc = Infer<typeof vApiKeyDoc>;
-declare function queryUserById(ctx: ComponentCallCtx, userId: string): Promise<CrossComponentUserDoc | null>;
-declare function queryUserByVerifiedEmail(ctx: ComponentCallCtx, email: string): Promise<CrossComponentUserDoc | null>;
-declare function queryVerifierById(ctx: ComponentCallCtx, verifierId: string): Promise<VerifierDoc | null>;
-declare function mutateVerifierDelete(ctx: ComponentCallCtx, verifierId: string): Promise<void>;
-declare function queryTotpById(ctx: ComponentCallCtx, totpId: string): Promise<TotpDoc | null>;
-declare function queryTotpVerifiedByUserId(ctx: ComponentCallCtx, userId: string): Promise<TotpDoc | null>;
-declare function mutateTotpInsert(ctx: ComponentCallCtx, args: {
-  userId: string;
-  secret: ArrayBuffer;
-  digits: number;
-  period: number;
-  verified: boolean;
-  name?: string;
-  createdAt: number;
-}): Promise<string>;
-declare function mutateTotpMarkVerified(ctx: ComponentCallCtx, totpId: string, lastUsedAt: number): Promise<void>;
-declare function mutateTotpUpdateLastUsed(ctx: ComponentCallCtx, totpId: string, lastUsedAt: number): Promise<void>;
-declare function queryPasskeysByUserId(ctx: ComponentCallCtx, userId: string): Promise<PasskeyDoc[]>;
-declare function queryPasskeyByCredentialId(ctx: ComponentCallCtx, credentialId: string): Promise<PasskeyDoc | null>;
-declare function mutatePasskeyInsert(ctx: ComponentCallCtx, args: {
-  userId: string;
-  credentialId: string;
-  publicKey: ArrayBuffer | ArrayBufferLike;
-  algorithm: number;
-  counter: number;
-  transports?: string[];
-  deviceType: string;
-  backedUp: boolean;
-  name?: string;
-  createdAt: number;
-}): Promise<string>;
-declare function mutatePasskeyUpdateCounter(ctx: ComponentCallCtx, passkeyId: string, counter: number, lastUsedAt: number): Promise<void>;
-declare function mutateKeyInsert(ctx: ComponentCallCtx, args: {
-  userId: string;
-  prefix: string;
-  hashedKey: string;
-  name: string;
-  scopes: Array<{
-    resource: string;
-    actions: string[];
-  }>;
-  rateLimit?: {
-    maxRequests: number;
-    windowMs: number;
-  };
-  expiresAt?: number;
-}): Promise<string>;
-declare function queryKeysByUserId(ctx: ComponentCallCtx, userId: string): Promise<KeyDoc[]>;
-declare function queryKeyById(ctx: ComponentCallCtx, keyId: string): Promise<KeyDoc | null>;
-declare function mutateKeyPatch(ctx: ComponentCallCtx, keyId: string, data: Record<string, unknown>): Promise<void>;
-declare function mutateKeyDelete(ctx: ComponentCallCtx, keyId: string): Promise<void>;
-type DeviceDoc = Infer<typeof vDeviceCodeDoc>;
-declare function mutateDeviceInsert(ctx: ComponentCallCtx, args: {
-  deviceCodeHash: string;
-  userCode: string;
-  expiresAt: number;
-  interval: number;
-  status: "pending" | "authorized" | "denied";
-}): Promise<string>;
-declare function queryDeviceByCodeHash(ctx: ComponentCallCtx, deviceCodeHash: string): Promise<DeviceDoc | null>;
-declare function queryDeviceByUserCode(ctx: ComponentCallCtx, userCode: string): Promise<DeviceDoc | null>;
-declare function mutateDeviceAuthorize(ctx: ComponentCallCtx, deviceId: string, userId: string, sessionId: string): Promise<void>;
-declare function mutateDeviceUpdateLastPolled(ctx: ComponentCallCtx, deviceId: string, lastPolledAt: number): Promise<void>;
-declare function mutateDeviceDelete(ctx: ComponentCallCtx, deviceId: string): Promise<void>;
 //#endregion
-export { ActionCtx, AuthAccountCredentials, AuthAuthorizationConfig, AuthCreateAccountArgs, AuthDataModel, AuthGrant, AuthInvalidateSessionsArgs, AuthMemberInspectArgs, AuthMemberInspectResult, AuthMemberRequireArgs, AuthProviderConfig, AuthProviderMaterializedConfig, AuthProviderSignInArgs, AuthProviderSignInResult, AuthRetrieveAccountArgs, AuthRoleDefinition, AuthRoleId, AuthServerHelpers, AuthUpdateAccountArgs, Awaitable, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceDoc, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, EnterpriseAccountLinkingPolicy, EnterpriseDeprovisionMode, EnterpriseJitProvisioningMode, EnterprisePolicy, EnterprisePolicyPatch, EnterpriseScimReuseUserPolicy, GenericActionCtxWithAuthConfig, GenericDoc, GroupOrderBy, GroupTag, GroupWhere, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider, HttpKeyContext, InviteOrderBy, InviteWhere, KeyDoc, KeyOrderBy, KeyRecord, KeyScope, KeyWhere, ListOptions, ListResult, MemberOrderBy, MemberWhere, MutationCtx, OAuthMaterializedConfig, OAuthProfile, PasskeyDoc, PasskeyProviderConfig, PhoneConfig, PhoneUserConfig, QueryCtx, SAMLAttributeMapping, SSOProviderConfig, ScopeChecker, SessionInfo, SessionInfoWithTokens, Tokens, TotpDoc, TotpProviderConfig, UserOrderBy, UserWhere, VerifierDoc, mutateDeviceAuthorize, mutateDeviceDelete, mutateDeviceInsert, mutateDeviceUpdateLastPolled, mutateKeyDelete, mutateKeyInsert, mutateKeyPatch, mutatePasskeyInsert, mutatePasskeyUpdateCounter, mutateTotpInsert, mutateTotpMarkVerified, mutateTotpUpdateLastUsed, mutateVerifierDelete, queryDeviceByCodeHash, queryDeviceByUserCode, queryKeyById, queryKeysByUserId, queryPasskeyByCredentialId, queryPasskeysByUserId, queryTotpById, queryTotpVerifiedByUserId, queryUserById, queryUserByVerifiedEmail, queryVerifierById };
+export { AuthAuthorizationConfig, AuthGrant, AuthProviderConfig, AuthRoleId, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, GenericActionCtxWithAuthConfig, GenericDoc, GroupConnectionDeprovisionMode, GroupConnectionPolicy, GroupConnectionPolicyPatch, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider, HttpKeyContext, KeyDoc, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PasskeyProviderConfig, PhoneConfig, PhoneUserConfig, SSOProviderConfig, ScopeChecker, TotpProviderConfig, UserOrderBy, UserWhere };
 //# sourceMappingURL=types.d.ts.map