@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/types.d.ts

@@ -1,949 +0,0 @@
-import _default from "../schema.js";
-import { OAuthProviderInstance } from "../providers/oauth.js";
-import { CredentialsConfig } from "../providers/credentials.js";
-import { Password } from "../providers/password.js";
-import { Passkey } from "../providers/passkey.js";
-import { Totp } from "../providers/totp.js";
-import { Anonymous } from "../providers/anonymous.js";
-import { Device } from "../providers/device.js";
-import { SSO } from "../providers/sso.js";
-import { Email } from "../providers/email.js";
-import { Phone } from "../providers/phone.js";
-import "../model.js";
-import { AnyDataModel, DataModelFromSchemaDefinition, DocumentByName, GenericActionCtx, GenericDataModel, GenericMutationCtx, GenericQueryCtx, TableNamesInDataModel } from "convex/server";
-import { GenericId, Infer, Value } from "convex/values";
-import * as arctic0 from "arctic";
-
-//#region src/server/types.d.ts
-/**
- * A value that is either `T` or a `PromiseLike<T>`.
- *
- * @typeParam T - The underlying value type.
- */
-type Awaitable<T> = T | PromiseLike<T>;
-/**
- * A single role definition within the authorization config.
- *
- * Each role has an optional human-readable label and a list of grant strings
- * that members with this role receive.
- *
- * @see {@link AuthAuthorizationConfig}
- */
-type AuthRoleDefinition = {
-  /** Optional stable identifier (defaults to the record key). */id?: string; /** Human-readable label for admin UIs. */
-  label?: string; /** Permission grant strings conferred by this role. */
-  grants: string[];
-};
-/**
- * Authorization configuration mapping role IDs to {@link AuthRoleDefinition}s.
- *
- * Passed as `authorization.roles` in {@link ConvexAuthConfig}.
- *
- * @see {@link AuthRoleDefinition}
- * @see {@link ConvexAuthConfig}
- */
-type AuthAuthorizationConfig = {
-  roles: Record<string, AuthRoleDefinition>;
-};
-/**
- * Extracts the union of role ID strings from an authorization config.
- *
- * When `TAuthorization` is defined, this resolves to the literal key union
- * of the `roles` record. Otherwise falls back to `string`.
- *
- * @typeParam TAuthorization - The authorization config type, or `undefined`.
- *
- * @see {@link AuthGrant}
- */
-type AuthRoleId<TAuthorization extends AuthAuthorizationConfig | undefined> = TAuthorization extends {
-  roles: infer TRoles extends Record<string, any>;
-} ? keyof TRoles & string : string;
-/**
- * Extracts the union of grant strings from all roles in an authorization config.
- *
- * When `TAuthorization` is defined, this resolves to the literal union
- * of all `grants` array elements across every role. Otherwise falls back to `string`.
- *
- * @typeParam TAuthorization - The authorization config type, or `undefined`.
- *
- * @see {@link AuthRoleId}
- */
-type AuthGrant<TAuthorization extends AuthAuthorizationConfig | undefined> = TAuthorization extends {
-  roles: infer TRoles extends Record<string, {
-    grants: readonly any[];
-  }>;
-} ? TRoles[keyof TRoles]["grants"][number] & string : string;
-/**
- * The config for the Convex Auth library, passed to `createAuth`.
- */
-type ConvexAuthConfig = {
-  /**
-   * A list of authentication provider configs.
-   *
-   * You can import existing configs from
-   * `@robelest/convex-auth/providers/<provider-name>`
-   */
-  providers: AuthProviderConfig[];
-  /**
-   * Auth component reference from `components.auth`.
-   *
-   * Core auth storage operations are executed through
-   * the component API boundary.
-   */
-  component: AuthComponentApi;
-  /**
-   * Session configuration.
-   */
-  session?: {
-    /**
-     * How long can a user session last without the user reauthenticating.
-     *
-     * Defaults to 30 days.
-     *
-     * @defaultValue 2_592_000_000
-     */
-    totalDurationMs?: number;
-    /**
-     * How long can a user session last without the user being active.
-     *
-     * Defaults to 30 days.
-     *
-     * @defaultValue 2_592_000_000
-     */
-    inactiveDurationMs?: number;
-  };
-  /**
-   * JWT configuration.
-   */
-  jwt?: {
-    /**
-     * How long is the JWT valid for after it is signed initially.
-     *
-     * Defaults to 1 hour.
-     *
-     * @defaultValue 3_600_000
-     */
-    durationMs?: number;
-  };
-  /**
-   * Sign-in configuration.
-   */
-  signIn?: {
-    /**
-     * How many times can the user fail to provide the correct credentials
-     * (password, OTP) per hour.
-     *
-     * Defaults to 10 times per hour (that is 10 failed attempts, and then
-     * allow another one every 6 minutes).
-     *
-     * @defaultValue 10
-     */
-    maxFailedAttemptsPerHour?: number;
-  };
-  /**
-   * Lifecycle callbacks for customizing sign-in behavior.
-   *
-   * Use `redirect` to control post-OAuth redirect URLs, and
-   * `createOrUpdateUser` or `afterUserCreatedOrUpdated` to
-   * customize account linking and user document creation.
-   */
-  callbacks?: {
-    /**
-     * Control which URLs are allowed as a destination after OAuth sign-in
-     * and for magic links:
-     *
-     * ```ts
-     * import { createAuth } from "@robelest/convex-auth/component";
-     * import { components } from "./_generated/api";
-     *
-     * const auth = createAuth(components.auth, {
-     *   providers: [google],
-     *   callbacks: {
-     *     async redirect({ redirectTo }) {
-     *       // Check that redirectTo is valid
-     *       // and return the relative or absolute URL
-     *       // to redirect to.
-     *     },
-     *   },
-     * });
-     * ```
-     *
-     * Convex Auth performs redirect only during OAuth sign-in. By default,
-     * it redirects back to the URL specified via the `SITE_URL` environment
-     * variable. Similarly magic links link to `SITE_URL`. Additional frontend
-     * origins can be listed in `SECONDARY_URL` for flows like passkeys.
-     *
-     * You can customize that behavior by providing a `redirectTo` param
-     * to the `signIn` function:
-     *
-     * ```ts
-     * signIn("google", { redirectTo: "/dashboard" })
-     * ```
-     *
-     * You can even redirect to a different site.
-     *
-     * This callback, if specified, is then called with the provided
-     * `redirectTo` param. Otherwise, only query params, relative paths
-     * and URLs starting with `SITE_URL` are allowed.
-     */
-    redirect?: (params: {
-      /**
-       * The param value passed to the `signIn` function.
-       */
-      redirectTo: string;
-    }) => Promise<string>;
-    /**
-     * Completely control account linking via this callback.
-     *
-     * This callback is called during the sign-in process,
-     * before account creation and token generation.
-     * If specified, this callback is responsible for creating
-     * or updating the user document.
-     *
-     * For "credentials" providers, the callback is only called
-     * when `createAccount` is called.
-     */
-    createOrUpdateUser?: (ctx: GenericMutationCtx<AnyDataModel>, args: {
-      /**
-       * If this is a sign-in to an existing account,
-       * this is the existing user ID linked to that account.
-       */
-      existingUserId: GenericId<"User"> | null;
-      /**
-       * The provider type or "verification" if this callback is called
-       * after an email or phone token verification.
-       */
-      type: "oauth" | "credentials" | "email" | "phone" | "verification";
-      /**
-       * The provider used for the sign-in, or the provider
-       * tied to the account which is having the email or phone verified.
-       */
-      provider: AuthProviderMaterializedConfig;
-      /**
-       * - The profile returned by the OAuth provider's `profile` method.
-       * - The profile passed to `createAccount` from a ConvexCredentials
-       * config.
-       * - The email address to which an email will be sent.
-       * - The phone number to which a text will be sent.
-       */
-      profile: Record<string, unknown> & {
-        email?: string;
-        phone?: string;
-        emailVerified?: boolean;
-        phoneVerified?: boolean;
-      };
-      /**
-       * The `shouldLink` argument passed to `createAccount`.
-       */
-      shouldLink?: boolean;
-    }) => Promise<GenericId<"User">>;
-    /**
-     * Perform additional writes after a user is created.
-     *
-     * This callback is called during the sign-in process,
-     * after the user is created or updated,
-     * before account creation and token generation.
-     *
-     * **This callback is only called if `createOrUpdateUser`
-     * is not specified.** If `createOrUpdateUser` is specified,
-     * you can perform any additional writes in that callback.
-     *
-     * For "credentials" providers, the callback is only called
-     * when `createAccount` is called.
-     */
-    afterUserCreatedOrUpdated?: (ctx: GenericMutationCtx<AnyDataModel>, args: {
-      /**
-       * The ID of the user that is being signed in.
-       */
-      userId: GenericId<"User">;
-      /**
-       * If this is a sign-in to an existing account,
-       * this is the existing user ID linked to that account.
-       */
-      existingUserId: GenericId<"User"> | null;
-      /**
-       * The provider type or "verification" if this callback is called
-       * after an email or phone token verification.
-       */
-      type: "oauth" | "credentials" | "email" | "phone" | "verification";
-      /**
-       * The provider used for the sign-in, or the provider
-       * tied to the account which is having the email or phone verified.
-       */
-      provider: AuthProviderMaterializedConfig;
-      /**
-       * - The profile returned by the OAuth provider's `profile` method.
-       * - The profile passed to `createAccount` from a ConvexCredentials
-       * config.
-       * - The email address to which an email will be sent.
-       * - The phone number to which a text will be sent.
-       */
-      profile: Record<string, unknown> & {
-        email?: string;
-        phone?: string;
-        emailVerified?: boolean;
-        phoneVerified?: boolean;
-      };
-      /**
-       * The `shouldLink` argument passed to `createAccount`.
-       */
-      shouldLink?: boolean;
-    }) => Promise<void>;
-  };
-  /**
-   * Application-defined role and grant model used by membership access checks.
-   */
-  authorization?: {
-    roles: Record<string, {
-      label?: string;
-      grants: string[];
-    }>;
-  };
-};
-/**
- * Union of all supported auth provider config types.
- *
- * Includes Arctic-based OAuth providers (via the `OAuth()` factory),
- * plus library-native providers: credentials, email, phone, passkey
- * (WebAuthn), and TOTP (2FA). Each can be passed as a config object
- * or a factory function.
- */
-type AuthProviderConfig = OAuthProviderInstance | Password | Passkey | Totp | Anonymous | Device | SSO | Email | Phone | OAuthMaterializedConfig | ConvexCredentialsConfig | ((...args: any) => ConvexCredentialsConfig) | EmailConfig | ((...args: any) => EmailConfig) | PhoneConfig | ((...args: any) => PhoneConfig) | PasskeyProviderConfig | ((...args: any) => PasskeyProviderConfig) | TotpProviderConfig | ((...args: any) => TotpProviderConfig) | DeviceProviderConfig | ((...args: any) => DeviceProviderConfig) | SSOProviderConfig;
-/**
- * Minimal config stored for the SSO provider at runtime.
- * No options — enterprise configuration is entirely per-tenant runtime state.
- */
-interface SSOProviderConfig {
-  id: string;
-  type: "sso";
-}
-/**
- * Account linking strategy for enterprise SSO sign-in.
- *
- * - `"verifiedEmail"` — link accounts when the IdP-provided email matches a verified email on an existing user.
- * - `"none"` — never auto-link; always create a new account.
- */
-type EnterpriseAccountLinkingPolicy = "verifiedEmail" | "none";
-/**
- * Policy for reusing existing users during SCIM provisioning.
- *
- * - `"externalId"` — match by the SCIM `externalId` to reuse a previously provisioned user.
- * - `"none"` — always create a new user for each SCIM provision request.
- */
-type EnterpriseScimReuseUserPolicy = "externalId" | "none";
-/**
- * Just-in-time provisioning mode for enterprise SSO.
- *
- * - `"off"` — no JIT provisioning; users must be pre-provisioned.
- * - `"createUser"` — create a user record on first SSO sign-in.
- * - `"createUserAndMembership"` — create a user and add them to the enterprise group on first SSO sign-in.
- */
-type EnterpriseJitProvisioningMode = "off" | "createUser" | "createUserAndMembership";
-/**
- * Deprovisioning strategy when a SCIM user is deleted.
- *
- * - `"soft"` — mark the user as inactive but preserve the record.
- * - `"hard"` — permanently delete the user and associated data.
- */
-type EnterpriseDeprovisionMode = "soft" | "hard";
-/**
- * Effective enterprise policy document stored for an SSO/SCIM tenant.
- *
- * Controls account linking, JIT provisioning, SCIM reuse behavior,
- * deprovisioning, and any app-defined extension metadata.
- *
- * @see {@link EnterprisePolicyPatch}
- */
-interface EnterprisePolicy {
-  version: 1;
-  identity: {
-    accountLinking: {
-      oidc: EnterpriseAccountLinkingPolicy;
-      saml: EnterpriseAccountLinkingPolicy;
-    };
-  };
-  provisioning: {
-    scimReuse: {
-      user: EnterpriseScimReuseUserPolicy;
-    };
-    jit: {
-      mode: EnterpriseJitProvisioningMode;
-      defaultRoleIds: string[];
-    };
-    deprovision: {
-      mode: EnterpriseDeprovisionMode;
-    };
-  };
-  extend?: Record<string, unknown>;
-}
-/**
- * Partial update payload for {@link EnterprisePolicy}.
- *
- * Use this when patching only selected enterprise policy sections without
- * replacing the entire stored policy document.
- */
-interface EnterprisePolicyPatch {
-  identity?: {
-    accountLinking?: {
-      oidc?: EnterpriseAccountLinkingPolicy;
-      saml?: EnterpriseAccountLinkingPolicy;
-    };
-  };
-  provisioning?: {
-    scimReuse?: {
-      user?: EnterpriseScimReuseUserPolicy;
-    };
-    jit?: {
-      mode?: EnterpriseJitProvisioningMode;
-      defaultRoleIds?: string[];
-    };
-    deprovision?: {
-      mode?: EnterpriseDeprovisionMode;
-    };
-  };
-  extend?: Record<string, unknown>;
-}
-/**
- * Email provider config for magic link / OTP sign-in.
- *
- * @typeParam DataModel - The Convex data model for typed action contexts.
- */
-interface EmailConfig<DataModel extends GenericDataModel = GenericDataModel> {
-  /** Provider identifier (e.g. `"email"`, `"resend"`). */
-  id: string;
-  /** Discriminant for provider type routing. */
-  type: "email";
-  /** Display name for this provider. */
-  name?: string;
-  /** Sender address (e.g. `"My App <noreply@example.com>"`). */
-  from?: string;
-  /**
-   * Token expiration in seconds. Defaults to 86 400 (24 hours).
-   *
-   * @defaultValue 86400
-   */
-  maxAge?: number;
-  /**
-   * Send the verification token to the user.
-   *
-   * Accepts an optional Convex action context as the second argument,
-   * enabling use with Convex components like `@convex-dev/resend`.
-   */
-  sendVerificationRequest: (params: {
-    identifier: string;
-    url: string;
-    expires: Date;
-    provider: EmailConfig;
-    token: string;
-    request: Request;
-  }, ctx?: GenericActionCtx<AnyDataModel>) => Awaitable<void>;
-  /**
-   * Override to generate a custom verification token.
-   * Tokens shorter than 24 characters are treated as OTPs and
-   * require the original email to be re-submitted for verification.
-   */
-  generateVerificationToken?: () => Awaitable<string>;
-  /**
-   * Normalize the email address before storage / lookup.
-   * Defaults to lowercasing and trimming whitespace.
-   */
-  normalizeIdentifier?: (identifier: string) => string;
-  /**
-   * Before the token is verified, check other
-   * provided parameters.
-   *
-   * Used to make sure that OTPs are accompanied
-   * with the correct email address.
-   */
-  authorize?: (
-  /**
-   * The values passed to the `signIn` function.
-   */
-  params: Record<string, Value | undefined>, account: GenericDoc<DataModel, "Account">) => Promise<void>;
-  /** Raw user options before merging with defaults. */
-  options: EmailUserConfig<DataModel>;
-}
-/**
- * User-facing configuration shape accepted by the email provider.
- *
- * Equivalent to `Partial<EmailConfig>` without internal runtime-only fields.
- *
- * @typeParam DataModel - The Convex data model.
- */
-type EmailUserConfig<DataModel extends GenericDataModel = GenericDataModel> = Omit<Partial<EmailConfig<DataModel>>, "options" | "type">;
-/**
- * Same as email provider config, but verifies
- * phone number instead of the email address.
- *
- * @typeParam DataModel - The Convex data model for typed action contexts.
- */
-interface PhoneConfig<DataModel extends GenericDataModel = GenericDataModel> {
-  id: string;
-  type: "phone";
-  /**
-   * Token expiration in seconds.
-   */
-  maxAge: number;
-  /**
-   * Send the phone number verification request.
-   */
-  sendVerificationRequest: (params: {
-    identifier: string;
-    url: string;
-    expires: Date;
-    provider: PhoneConfig;
-    token: string;
-  }, ctx: GenericActionCtxWithAuthConfig<DataModel>) => Promise<void>;
-  /**
-   * Defaults to `process.env.AUTH_<PROVIDER_ID>_KEY`.
-   */
-  apiKey?: string;
-  /**
-   * Override this to generate a custom token.
-   * Note that the tokens are assumed to be cryptographically secure.
-   * Any tokens shorter than 24 characters are assumed to not
-   * be secure enough on their own, and require providing
-   * the original `phone` used in the initial `signIn` call.
-   * @returns
-   */
-  generateVerificationToken?: () => Promise<string>;
-  /**
-   * Normalize the phone number.
-   * @param identifier Passed as `phone` in params of `signIn`.
-   * @returns The phone number used in `sendVerificationRequest`.
-   */
-  normalizeIdentifier?: (identifier: string) => string;
-  /**
-   * Before the token is verified, check other
-   * provided parameters.
-   *
-   * Used to make sure tha OTPs are accompanied
-   * with the correct phone number.
-   */
-  authorize?: (
-  /**
-   * The values passed to the `signIn` function.
-   */
-  params: Record<string, Value | undefined>, account: GenericDoc<DataModel, "Account">) => Promise<void>;
-  options: PhoneUserConfig<DataModel>;
-}
-/**
- * User-facing configuration shape accepted by the phone provider.
- *
- * Equivalent to `Partial<PhoneConfig>` without internal runtime-only fields.
- *
- * @typeParam DataModel - The Convex data model.
- */
-type PhoneUserConfig<DataModel extends GenericDataModel = GenericDataModel> = Omit<Partial<PhoneConfig<DataModel>>, "options" | "type">;
-/**
- * Credentials provider config used by Convex Auth.
- */
-type ConvexCredentialsConfig = CredentialsConfig<any> & {
-  type: "credentials";
-  id: string;
-};
-/**
- * Configuration for the passkey (WebAuthn) provider.
- */
-interface PasskeyProviderConfig {
-  id: string;
-  type: "passkey";
-  options: {
-    /** Relying Party display name. Defaults to SITE_URL hostname. */rpName?: string; /** Relying Party ID (hostname). Defaults to SITE_URL hostname. */
-    rpId?: string; /** Allowed origins for credential verification. Defaults to SITE_URL plus SECONDARY_URL. */
-    origin?: string | string[];
-    /**
-     * Attestation conveyance preference. Defaults to "none".
-     *
-     * @defaultValue "none"
-     */
-    attestation?: "none" | "direct";
-    /**
-     * User verification requirement. Defaults to "required".
-     *
-     * @defaultValue "required"
-     */
-    userVerification?: "required" | "preferred" | "discouraged";
-    /**
-     * Resident key (discoverable credential) preference. Defaults to "preferred".
-     *
-     * @defaultValue "preferred"
-     */
-    residentKey?: "required" | "preferred" | "discouraged"; /** Restrict to platform or cross-platform authenticators. */
-    authenticatorAttachment?: "platform" | "cross-platform";
-    /**
-     * Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)].
-     *
-     * @defaultValue [-7, -257]
-     */
-    algorithms?: number[];
-    /**
-     * Challenge expiration in ms. Defaults to 300_000 (5 minutes).
-     *
-     * @defaultValue 300_000
-     */
-    challengeExpirationMs?: number;
-  };
-}
-/**
- * Configuration for the TOTP two-factor authentication provider.
- */
-interface TotpProviderConfig {
-  id: string;
-  type: "totp";
-  options: {
-    /** Issuer name shown in authenticator apps (e.g. "My App"). */issuer: string;
-    /**
-     * Number of digits in each code (default: 6).
-     *
-     * @defaultValue 6
-     */
-    digits: number;
-    /**
-     * Time period in seconds for code rotation (default: 30).
-     *
-     * @defaultValue 30
-     */
-    period: number;
-  };
-}
-/**
- * Normalized user profile returned by an OAuth provider.
- *
- * `id` is the provider-specific account identifier (e.g. GitHub user ID).
- */
-interface OAuthProfile {
-  id: string;
-  name?: string;
-  email?: string;
-  image?: string;
-  /** Additional claims from the ID token or userinfo endpoint. */
-  [key: string]: unknown;
-}
-/** Credentials identifying a provider account (e.g. email + hashed password). */
-type AuthAccountCredentials = {
-  /** Provider-specific account identifier (e.g. email address). */id: string; /** Optional secret (e.g. hashed password). */
-  secret?: string;
-};
-/** Arguments for `auth.account.create()`. */
-type AuthCreateAccountArgs = {
-  provider: string;
-  account: AuthAccountCredentials;
-  profile: Record<string, unknown> & {
-    email?: string;
-    phone?: string;
-    emailVerified?: boolean;
-    phoneVerified?: boolean;
-  };
-  shouldLinkViaEmail?: boolean;
-  shouldLinkViaPhone?: boolean;
-};
-/** Arguments for `auth.account.get()`. */
-type AuthRetrieveAccountArgs = {
-  provider: string;
-  account: AuthAccountCredentials;
-};
-/** Arguments for `auth.account.update()`. */
-type AuthUpdateAccountArgs = {
-  provider: string;
-  account: {
-    id: string;
-    secret: string;
-  };
-};
-/** Arguments for `auth.session.invalidate()`. */
-type AuthInvalidateSessionsArgs = {
-  userId: GenericId<"User">;
-  except?: GenericId<"Session">[];
-};
-/** Arguments for `auth.provider.signIn()`. */
-type AuthProviderSignInArgs = {
-  accountId?: GenericId<"Account">;
-  params?: Record<string, Value | undefined>;
-};
-/** Return type of `auth.provider.signIn()` — user and session IDs, or `null` on failure. */
-type AuthProviderSignInResult = {
-  userId: GenericId<"User">;
-  sessionId: GenericId<"Session">;
-} | null;
-/** Arguments for `auth.member.inspect()`. */
-type AuthMemberInspectArgs = {
-  userId: GenericId<"User">;
-  groupId: GenericId<"Group">;
-  ancestry?: boolean;
-  maxDepth?: number;
-};
-/** Result of `auth.member.inspect()` — membership state and derived access details. */
-type AuthMemberInspectResult = {
-  membership: GenericDoc<GenericDataModel, "GroupMember"> | null;
-  roleIds: string[];
-  grants: string[];
-};
-/** Arguments for `auth.member.require()`. */
-type AuthMemberRequireArgs = AuthMemberInspectArgs & {
-  roleIds?: string[];
-  grants?: string[];
-};
-/**
- * Server-side auth helper methods injected into `ctx.auth` within provider actions.
- *
- * Provides programmatic access to account management, session lifecycle,
- * membership resolution, and provider sign-in from within Convex actions
- * that use {@link GenericActionCtxWithAuthConfig}.
- *
- * @see {@link GenericActionCtxWithAuthConfig}
- *
- * @example
- * ```ts
- * // Inside a credentials provider's authorize callback:
- * const { account, user } = await ctx.auth.account.get(ctx, {
- *   provider: "password",
- *   account: { id: email },
- * });
- * ```
- */
-type AuthServerHelpers = {
-  /** Account management: create, retrieve, and update provider-linked accounts. */account: {
-    create: (ctx: GenericActionCtx<any>, args: AuthCreateAccountArgs) => Promise<{
-      account: GenericDoc<GenericDataModel, "Account">;
-      user: GenericDoc<GenericDataModel, "User">;
-    }>;
-    get: (ctx: GenericActionCtx<any>, args: AuthRetrieveAccountArgs) => Promise<{
-      account: GenericDoc<GenericDataModel, "Account">;
-      user: GenericDoc<GenericDataModel, "User">;
-    }>;
-    update: (ctx: GenericActionCtx<any>, args: AuthUpdateAccountArgs) => Promise<{
-      accountId: GenericId<"Account">;
-    }>;
-  };
-  session: {
-    current: (ctx: {
-      auth: GenericActionCtx<GenericDataModel>["auth"];
-    }) => Promise<GenericId<"Session"> | null>;
-    invalidate: (ctx: GenericActionCtx<any>, args: AuthInvalidateSessionsArgs) => Promise<{
-      userId: GenericId<"User">;
-      except: GenericId<"Session">[];
-    }>;
-  };
-  member: {
-    inspect: (ctx: GenericActionCtx<any>, args: AuthMemberInspectArgs) => Promise<AuthMemberInspectResult>;
-    require: (ctx: GenericActionCtx<any>, args: AuthMemberRequireArgs) => Promise<AuthMemberInspectResult>;
-  };
-  provider: {
-    signIn: (ctx: GenericActionCtx<any>, provider: AuthProviderConfig, args: AuthProviderSignInArgs) => Promise<AuthProviderSignInResult>;
-  };
-};
-/**
- * Your `ActionCtx` enriched with `ctx.auth.config` field with
- * the config passed to `createAuth`.
- *
- * @typeParam DataModel - The Convex data model.
- */
-type GenericActionCtxWithAuthConfig<DataModel extends GenericDataModel> = GenericActionCtx<DataModel> & {
-  auth: GenericActionCtx<DataModel>["auth"] & {
-    config: ConvexAuthMaterializedConfig;
-  } & AuthServerHelpers;
-};
-/**
- * The config for the Convex Auth library, passed to `createAuth`,
- * with defaults and initialized providers.
- *
- * See {@link ConvexAuthConfig}
- */
-type ConvexAuthMaterializedConfig = {
-  providers: AuthProviderMaterializedConfig[];
-} & Pick<ConvexAuthConfig, "component" | "session" | "jwt" | "signIn" | "callbacks" | "authorization">;
-/**
- * Materialized OAuth provider config (Arctic-based).
- *
- * Carries the Arctic provider instance along with scopes and profile config.
- * Produced by materializing an `OAuthProviderInstance` during `configDefaults`.
- */
-interface OAuthMaterializedConfig {
-  /**
-   * Provider identifier (e.g. `"google"`, `"github"`).
-   * @readonly
-   */
-  readonly id: string;
-  /**
-   * Discriminant for provider type routing.
-   * @readonly
-   */
-  readonly type: "oauth";
-  /**
-   * The Arctic provider instance.
-   * @readonly
-   */
-  readonly provider: any;
-  /**
-   * OAuth scopes to request.
-   * @readonly
-   */
-  readonly scopes: string[];
-  /**
-   * User-provided profile extraction callback.
-   * @readonly
-   */
-  readonly profile?: (tokens: arctic0.OAuth2Tokens) => Promise<OAuthProfile>;
-  /**
-   * Account-linking policy for OAuth identities. Defaults to verified email linking.
-   * @readonly
-   */
-  readonly accountLinking?: "verifiedEmail" | "none";
-}
-/**
- * Device authorization provider config (RFC 8628).
- *
- * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate
- * by displaying a short code that the user enters on a secondary device.
- */
-interface DeviceProviderConfig {
-  id: string;
-  type: "device";
-  /** User code character set. Default: `"BCDFGHJKLMNPQRSTVWXZ"` (base-20, no vowels). */
-  charset: string;
-  /** User code length. Default: 8. */
-  userCodeLength: number;
-  /** Device code + user code lifetime in seconds. Default: 900 (15 min). */
-  expiresIn: number;
-  /** Minimum polling interval in seconds. Default: 5. */
-  interval: number;
-  /**
-   * Base URL for the verification page (e.g. `"http://localhost:3000/device"`).
-   *
-   * This is where users go to enter the device code. If not provided,
-   * falls back to `SITE_URL + "/device"`.
-   */
-  verificationUri?: string;
-}
-/**
- * Materialized auth provider config — the fully resolved form stored at runtime.
- */
-type AuthProviderMaterializedConfig = OAuthMaterializedConfig | EmailConfig | PhoneConfig | ConvexCredentialsConfig | PasskeyProviderConfig | TotpProviderConfig | DeviceProviderConfig | SSOProviderConfig;
-/**
- * Resolves to `true` when the providers list includes `SSO`, otherwise `false`.
- *
- * Used to make `auth.sso` conditionally present on the `createAuth`
- * return type — it only appears when `new SSO()` is in the providers array.
- */
-type HasSSO<P extends AuthProviderConfig[]> = SSO extends P[number] ? true : false;
-/**
- * A single scope entry stored per API key.
- * Uses a resource:action pattern for structured permissions.
- *
- * ```ts
- * { resource: "users", actions: ["read", "list"] }
- * ```
- */
-interface KeyScope {
-  resource: string;
-  actions: string[];
-}
-/**
- * Result of scope verification. Provides a `.can()` helper
- * for checking if a key has a specific permission.
- *
- * ```ts
- * const result = await auth.key.verify(ctx, rawKey);
- * if (result.scopes.can("users", "read")) {
- *   // authorized
- * }
- * ```
- */
-interface ScopeChecker {
-  /** Check if the key has permission for a given resource:action. */
-  can(resource: string, action: string): boolean;
-  /** The raw scope entries from the key. */
-  scopes: KeyScope[];
-}
-/**
- * An API key record as returned by `auth.key.list()` and `auth.key.get()`.
- * Never includes the raw key material — only the display prefix.
- */
-interface KeyRecord {
-  /** Document ID. */
-  _id: string;
-  /** Owner user ID. */
-  userId: string;
-  /** Display prefix (e.g. `"sk_abc1"`). Safe to show in UIs. */
-  prefix: string;
-  /** Human-readable name (e.g. "CI Pipeline"). */
-  name: string;
-  /** Resource:action permissions granted to this key. */
-  scopes: KeyScope[];
-  /** Per-key rate limit, if configured. */
-  rateLimit?: {
-    maxRequests: number;
-    windowMs: number;
-  };
-  /** Expiration timestamp (ms since epoch), or `undefined` for no expiry. */
-  expiresAt?: number;
-  /** Timestamp of last successful verification, or `undefined` if never used. */
-  lastUsedAt?: number;
-  /** Creation timestamp (ms since epoch). */
-  createdAt: number;
-  /** `true` when the key has been revoked (soft-deleted). */
-  revoked: boolean;
-  /** Arbitrary app-specific metadata attached to the key. */
-  metadata?: Record<string, unknown>;
-}
-/**
- * Context injected into `auth.http.action()` and `auth.http.route()` handlers.
- *
- * The handler's `ctx` receives these fields after Bearer token verification:
- *
- * ```ts
- * auth.http.route(http, {
- *   path: "/api/data",
- *   method: "GET",
- *   handler: async (ctx, request) => {
- *     ctx.key.userId;               // owner of the API key
- *     ctx.key.keyId;                // the key document ID
- *     ctx.key.scopes.can("data", "read"); // scope check
- *   },
- * });
- * ```
- */
-interface HttpKeyContext {
-  key: {
-    /** The user ID that owns the verified API key. */userId: string; /** The API key document ID. */
-    keyId: string; /** Scope checker for the verified key's permissions. */
-    scopes: ScopeChecker;
-  };
-}
-/**
- * CORS configuration for Bearer-authenticated HTTP endpoints.
- */
-interface CorsConfig {
-  /** Allowed origin(s). Defaults to `"*"`. */
-  origin?: string;
-  /** Allowed HTTP methods. Defaults to `"GET,POST,PUT,PATCH,DELETE,OPTIONS"`. */
-  methods?: string;
-  /** Allowed request headers. Defaults to `"Content-Type,Authorization"`. */
-  headers?: string;
-}
-/**
- * Convex document from a given table.
- */
-type GenericDoc<DataModel extends GenericDataModel, TableName extends TableNamesInDataModel<DataModel>> = DocumentByName<DataModel, TableName> & {
-  _id: GenericId<TableName>;
-  _creationTime: number;
-};
-/** Data model derived from the component schema. */
-type AuthDataModel = DataModelFromSchemaDefinition<typeof _default>;
-/** A document from any table in the auth component schema. */
-type Doc<T extends TableNamesInDataModel<AuthDataModel>> = GenericDoc<AuthDataModel, T>;
-/** A pair of JWT access token and refresh token. */
-type Tokens = {
-  token: string;
-  refreshToken: string;
-};
-/** Session information returned after authentication. */
-type SessionInfo = {
-  userId: GenericId<"User">;
-  sessionId: GenericId<"Session">;
-  tokens: Tokens | null;
-};
-//#endregion
-export { AuthAuthorizationConfig, AuthGrant, AuthProviderConfig, AuthRoleId, ConvexAuthConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, EnterprisePolicy, EnterprisePolicyPatch, GenericActionCtxWithAuthConfig, GenericDoc, HasSSO, HttpKeyContext, KeyRecord, KeyScope, OAuthProfile, PhoneConfig, PhoneUserConfig, ScopeChecker, SessionInfo };
-//# sourceMappingURL=types.d.ts.map