@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/core/types.d.ts

@@ -1,361 +0,0 @@
-import { ConvexError } from "convex/values";
-import { FunctionReference } from "convex/server";
-
-//#region src/client/core/types.d.ts
-/**
- * Structural interface for any Convex client.
- * Satisfied by `ConvexClient` (`convex/browser`),
- * `ConvexReactClient` (`convex/react`), and similar transports.
- *
- * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`
- * but not on the simplified `ConvexClient`. When available we call it
- * during sign-out for a clean deauthentication.
- */
-interface ConvexTransport {
-  action(action: any, args: any): Promise<any>;
-  setAuth(fetchToken: (args: {
-    forceRefreshToken: boolean;
-  }) => Promise<string | null | undefined>, onChange?: (isAuthenticated: boolean) => void): void;
-  clearAuth?(): void;
-}
-/** Pluggable key-value storage (defaults to `localStorage`). */
-interface Storage {
-  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;
-  setItem(key: string, value: string): void | Promise<void>;
-  removeItem(key: string): void | Promise<void>;
-}
-/**
- * Device code response returned when signing in with the `"device"` provider.
- *
- * The device displays the `userCode` (or `verificationUriComplete`) and
- * polls via `auth.device.poll()` until the user authorizes.
- */
-type DeviceCodeResult = {
-  /** High-entropy device code used for polling (keep secret). */deviceCode: string; /** Short human-readable code the user enters (e.g. "WDJB-MJHT"). */
-  userCode: string; /** Base verification URL (e.g. "https://myapp.com/device"). */
-  verificationUri: string; /** Verification URL with user code pre-filled as `?code=XXXX-XXXX`. */
-  verificationUriComplete: string; /** Lifetime of the codes in seconds. */
-  expiresIn: number; /** Minimum polling interval in seconds. */
-  interval: number;
-};
-/**
- * Result of a `signIn` call.
- *
- * - `kind: "signedIn"` — credentials were accepted and the user is authenticated.
- * - `kind: "redirect"` — OAuth flow initiated; redirect the user to `redirect.toString()`.
- * - `kind: "totpRequired"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.
- * - `kind: "deviceCode"` — device flow initiated; display the code and poll via `auth.device.poll()`.
- * - `kind: "started"` — a non-immediate flow started (for example email/phone verification).
- *
- * @see {@link AuthState}
- */
-type SignInResult = {
-  kind: "signedIn";
-} | {
-  kind: "redirect";
-  redirect: URL;
-  verifier: string;
-} | {
-  kind: "totpRequired";
-  verifier: string;
-} | {
-  kind: "deviceCode";
-  deviceCode: DeviceCodeResult;
-} | {
-  kind: "started";
-};
-/**
- * Reactive auth state snapshot returned by `auth.state` and `auth.onChange`.
- *
- * @see {@link SignInResult}
- */
-type AuthState = {
-  /** High-level auth phase for deterministic UI state handling. */phase: "loading" | "handshake" | "authenticated" | "unauthenticated"; /** `true` during initial hydration before the first token is resolved. */
-  isLoading: boolean; /** `true` only after Convex confirms authentication with the backend. */
-  isAuthenticated: boolean; /** The raw JWT string, or `null` when not authenticated. */
-  token: string | null;
-};
-/**
- * Typed Convex API references for the auth functions.
- * Pass these from your generated `api` object.
- *
- * @typeParam HasPasskey - Whether the passkey provider is configured.
- * @typeParam HasTotp - Whether the TOTP provider is configured.
- * @typeParam HasDevice - Whether the device provider is configured.
- */
-type AuthApiRefs<HasPasskey extends boolean = boolean, HasTotp extends boolean = boolean, HasDevice extends boolean = boolean> = {
-  signIn: FunctionReference<"action", "public", any, any>;
-  signOut: FunctionReference<"action", "public", any, any>;
-  store: FunctionReference<"mutation", "public", any, any>;
-};
-/**
- * Passkey (WebAuthn) client-side helpers.
- *
- * @see {@link TotpClient}
- * @see {@link DeviceClient}
- */
-interface PasskeyClient {
-  /**
-   * Check whether the current runtime exposes WebAuthn passkey APIs.
-   *
-   * @returns `true` when `navigator.credentials` is available.
-   *
-   * @example
-   * ```ts
-   * if (auth.passkey.isSupported()) {
-   *   // Show passkey registration button
-   * }
-   * ```
-   */
-  isSupported(): boolean;
-  /**
-   * Check whether conditional mediation (autofill-style passkeys) is available.
-   *
-   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.
-   *
-   * @example
-   * ```ts
-   * if (await auth.passkey.isAutofillSupported()) {
-   *   await auth.passkey.authenticate({ autofill: true });
-   * }
-   * ```
-   */
-  isAutofillSupported(): Promise<boolean>;
-  /**
-   * Start a passkey registration flow and complete the WebAuthn ceremony.
-   *
-   * Creates a new credential bound to the current user's account.
-   *
-   * @param opts - Optional registration hints.
-   * @param opts.name - Human-readable name for the passkey (e.g. `"MacBook Pro"`).
-   * @param opts.email - Email hint for discoverable credentials.
-   * @param opts.userName - WebAuthn `user.name` override.
-   * @param opts.userDisplayName - WebAuthn `user.displayName` override.
-   * @returns A {@link SignInResult} — typically `{ kind: "signedIn" }` on success.
-   *
-   * @example
-   * ```ts
-   * const result = await auth.passkey.register({ name: "My laptop" });
-   * ```
-   */
-  register(opts?: Record<string, any>): Promise<SignInResult>;
-  /**
-   * Authenticate with an existing passkey and complete the WebAuthn ceremony.
-   *
-   * @param opts - Optional authentication hints.
-   * @param opts.email - Email hint to filter discoverable credentials.
-   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.
-   * @returns A {@link SignInResult} — typically `{ kind: "signedIn" }` on success.
-   *
-   * @example
-   * ```ts
-   * const result = await auth.passkey.authenticate();
-   * ```
-   */
-  authenticate(opts?: Record<string, any>): Promise<SignInResult>;
-}
-/**
- * TOTP two-factor authentication client-side helpers.
- *
- * @see {@link PasskeyClient}
- * @see {@link DeviceClient}
- */
-interface TotpClient {
-  /**
-   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.
-   *
-   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code
-   * for the user to scan with their authenticator app.
-   *
-   * @param opts - Optional setup hints.
-   * @param opts.name - Issuer name shown in the authenticator app.
-   * @param opts.accountName - Account label in the authenticator app.
-   * @returns An object with `{ uri, secret, verifier, totpId }`.
-   *
-   * @example
-   * ```ts
-   * const { uri, secret, verifier, totpId } = await auth.totp.setup();
-   * // Render `uri` as a QR code, then confirm:
-   * await auth.totp.confirm({ code: userCode, verifier, totpId });
-   * ```
-   */
-  setup(opts?: Record<string, any>): Promise<Record<string, any>>;
-  /**
-   * Confirm a newly created TOTP factor with the first authenticator code.
-   *
-   * Call this after the user scans the QR code and enters the first OTP.
-   *
-   * @param opts - Confirmation parameters.
-   * @param opts.code - The 6-digit TOTP code from the authenticator app.
-   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.
-   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.
-   *
-   * @example
-   * ```ts
-   * await auth.totp.confirm({ code: "123456", verifier, totpId });
-   * ```
-   */
-  confirm(opts: Record<string, any>): Promise<void>;
-  /**
-   * Complete a sign-in that is waiting on TOTP verification.
-   *
-   * Called when `signIn()` returns `{ kind: "totpRequired" }`.
-   *
-   * @param opts - Verification parameters.
-   * @param opts.code - The 6-digit TOTP code from the authenticator app.
-   * @param opts.verifier - The verifier string from the `totpRequired` result.
-   *
-   * @example
-   * ```ts
-   * const result = await auth.signIn("password", { email, password });
-   * if (result.kind === "totpRequired") {
-   *   await auth.totp.verify({ code: totpCode, verifier: result.verifier });
-   * }
-   * ```
-   */
-  verify(opts: Record<string, any>): Promise<void>;
-}
-/**
- * Device authorization (RFC 8628) client-side helpers.
- *
- * @see {@link PasskeyClient}
- * @see {@link TotpClient}
- */
-interface DeviceClient {
-  /**
-   * Poll until a device flow is approved or expires.
-   *
-   * Polls the server at the interval specified in the {@link DeviceCodeResult}
-   * until the user authorizes the device or the code expires.
-   *
-   * @param opts - Poll options.
-   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn("device")`.
-   * @throws `ConvexError({ code: "DEVICE_CODE_EXPIRED" })` when the code expires before authorization.
-   *
-   * @example
-   * ```ts
-   * const result = await auth.signIn("device");
-   * if (result.kind === "deviceCode") {
-   *   // Display result.deviceCode.userCode to the user
-   *   await auth.device.poll({ code: result.deviceCode });
-   *   console.log("Device authorized!");
-   * }
-   * ```
-   */
-  poll(opts: {
-    code: DeviceCodeResult;
-  }): Promise<void>;
-  /**
-   * Approve a device flow from the verification page using the displayed user code.
-   *
-   * Call this on the authorization page where the user enters the short code
-   * shown on the device screen.
-   *
-   * @param opts - Verification options.
-   * @param opts.code - The user code string (e.g. `"WDJB-MJHT"`).
-   * @throws `ConvexError({ code: "DEVICE_AUTHORIZATION_FAILED" })` when verification fails.
-   *
-   * @example
-   * ```ts
-   * await auth.device.verify({ code: "WDJB-MJHT" });
-   * ```
-   */
-  verify(opts: {
-    code: string;
-  }): Promise<void>;
-}
-/**
- * Extract capability flags from an AuthApiRefs type.
- *
- * @typeParam Api - An AuthApiRefs type to extract capability flags from.
- */
-type InferCaps<Api extends AuthApiRefs<boolean, boolean, boolean>> = Api extends AuthApiRefs<infer P, infer T, infer D> ? {
-  passkey: P;
-  totp: T;
-  device: D;
-} : {
-  passkey: boolean;
-  totp: boolean;
-  device: boolean;
-};
-/** Pending invite detected from URL or recovered from storage after redirect. */
-interface PendingInvite {
-  /**
-   * Raw one-time invite token. Pass to your invite acceptance mutation.
-   * @readonly
-   */
-  readonly token: string;
-  /**
-   * Invite email from the URL or stored redirect state, if available.
-   * @readonly
-   */
-  readonly email: string | null;
-  /**
-   * Consume the invite: clears storage/URL params and returns the token.
-   *
-   * @returns The invite token.
-   * @throws When there is no pending invite to accept.
-   */
-  accept(): Promise<{
-    token: string;
-  }>;
-}
-/** Base auth client — always present. */
-interface AuthClientBase {
-  /**
-   * Reactive auth state snapshot.
-   * @readonly
-   */
-  readonly state: AuthState;
-  /** SSR-safe query-param reader. */
-  param: (name: string) => string | null;
-  /**
-   * Pending invite recovered from the URL or storage, if present.
-   * @readonly
-   */
-  readonly invite: PendingInvite | null;
-  /** Start a sign-in flow for a provider. */
-  signIn: (provider: string, params?: Record<string, any>) => Promise<SignInResult>;
-  /** Sign out and clear local auth state. */
-  signOut: () => Promise<void>;
-  /** Subscribe to auth state changes. Returns an unsubscribe function. */
-  onChange: (callback: (state: AuthState) => void) => () => void;
-  /** Tear down listeners and reject in-flight handshakes. */
-  destroy: () => void;
-}
-/**
- * Auth client return type — conditionally includes `passkey`, `totp`, and
- * `device` helpers based on the capabilities in the `AuthApiRefs` type.
- *
- * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.
- */
-type AuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = AuthClientBase & (InferCaps<Api>["passkey"] extends true ? {
-  passkey: PasskeyClient;
-} : {}) & (InferCaps<Api>["totp"] extends true ? {
-  totp: TotpClient;
-} : {}) & (InferCaps<Api>["device"] extends true ? {
-  device: DeviceClient;
-} : {});
-/**
- * Options for {@link client}.
- *
- * @typeParam Api - An AuthApiRefs type.
- */
-type ClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = {
-  /** Any Convex client implementation used to run auth actions. */convex: ConvexTransport; /** Typed auth function refs from your generated `api` object. */
-  api?: Api; /** Explicit Convex deployment URL when it cannot be inferred from the client. */
-  url?: string;
-  /**
-   * Storage backend for persisted tokens; defaults to `localStorage` in SPA mode.
-   *
-   * @defaultValue localStorage
-   */
-  storage?: Storage | null; /** Override how OAuth code cleanup updates the current URL. */
-  replaceUrl?: (relativeUrl: string) => void | Promise<void>; /** SSR proxy endpoint used instead of direct Convex auth calls. */
-  proxyPath?: string; /** Server-provided JWT seed used for flash-free SSR hydration. */
-  tokenSeed?: string | null; /** SSR-safe URL source for reading query parameters. */
-  location?: URL | (() => URL | null);
-};
-//#endregion
-export { AuthApiRefs, AuthClient, AuthState, ClientOptions, DeviceClient, DeviceCodeResult, PasskeyClient, PendingInvite, SignInResult, Storage, TotpClient };
-//# sourceMappingURL=types.d.ts.map

package/dist/core/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/client/core/types.ts"],"mappings":";;;;;;AAYA;;;;;;;UAAiB,eAAA;EACf,MAAA,CAAO,MAAA,OAAa,IAAA,QAAY,OAAA;EAChC,OAAA,CACE,UAAA,GAAa,IAAA;IACX,iBAAA;EAAA,MACI,OAAA,6BACN,QAAA,IAAY,eAAA;EAEd,SAAA;AAAA;;UAIe,OAAA;EACf,OAAA,CACE,GAAA,uCAC6B,OAAA;EAC/B,OAAA,CAAQ,GAAA,UAAa,KAAA,kBAAuB,OAAA;EAC5C,UAAA,CAAW,GAAA,kBAAqB,OAAA;AAAA;;;;;;;KAqCtB,gBAAA;EA+BF,+DA7BR,UAAA,UAoCmB;EAlCnB,QAAA,UAkCmB;EAhCnB,eAAA,UAoCA;EAlCA,uBAAA,UAsCA;EApCA,SAAA,UAoCK;EAlCL,QAAA;AAAA;;;;;;;;;;;;KAcU,YAAA;EACN,IAAA;AAAA;EACA,IAAA;EAAkB,QAAA,EAAU,GAAA;EAAK,QAAA;AAAA;EACjC,IAAA;EAAsB,QAAA;AAAA;EACtB,IAAA;EAAoB,UAAA,EAAY,gBAAA;AAAA;EAChC,IAAA;AAAA;;;;;;KAOM,SAAA;EAuFV,iEArFA,KAAA,iEAqFS;EAnFT,SAAA,WAmF8C;EAjF9C,eAAA,WAgGoB;EA9FpB,KAAA;AAAA;;;;AAuGF;;;;;KA5FY,WAAA;EAKV,MAAA,EAAQ,iBAAA;EACR,OAAA,EAAS,iBAAA;EACT,KAAA,EAAO,iBAAA;AAAA;;;;;;;UAeQ,aAAA;EA0Gf;;;;;;;;;;AA4BF;;EAzHE,WAAA;EA8ImB;;;;;;;;;;;;EAhInB,mBAAA,IAAuB,OAAA;EAiJS;;;AAQlC;;;;;;;;;;;;;;EAtIE,QAAA,CAAS,IAAA,GAAO,MAAA,gBAAsB,OAAA,CAAQ,YAAA;EAuIhB;;;;;;;;;;;;;EAxH9B,YAAA,CAAa,IAAA,GAAO,MAAA,gBAAsB,OAAA,CAAQ,YAAA;AAAA;;;;;;;UASnC,UAAA;EAqIK;;;AAItB;;;;;;;;;;;;;;;EAtHE,KAAA,CAAM,IAAA,GAAO,MAAA,gBAAsB,OAAA,CAAQ,MAAA;EAkIlC;;;;;;;;;;;;;;;EAjHT,OAAA,CAAQ,IAAA,EAAM,MAAA,gBAAsB,OAAA;EA4H7B;AAST;;;;;;;;;;;;;;;;EAlHE,MAAA,CAAO,IAAA,EAAM,MAAA,gBAAsB,OAAA;AAAA;;;;;;;UASpB,YAAA;EA6Gd;;;;;;;;;;AAQH;;;;;;;;;;EAhGE,IAAA,CAAK,IAAA;IAAQ,IAAA,EAAM,gBAAA;EAAA,IAAqB,OAAA;EAiGxC;;;;;;;;;;;;;;;EAhFA,MAAA,CAAO,IAAA;IAAQ,IAAA;EAAA,IAAiB,OAAA;AAAA;;;;;;KAQtB,SAAA,aAAsB,WAAA,+BAChC,GAAA,SAAY,WAAA;EACN,OAAA,EAAS,CAAA;EAAG,IAAA,EAAM,CAAA;EAAG,MAAA,EAAQ,CAAA;AAAA;EAC7B,OAAA;EAAkB,IAAA;EAAe,MAAA;AAAA;;UAGxB,aAAA;;;;;WAKN,KAAA;;;;;WAKA,KAAA;;;;;;;EAOT,MAAA,IAAU,OAAA;IAAU,KAAA;EAAA;AAAA;;UAIL,cAAA;;;;;WAKN,KAAA,EAAO,SAAA;;EAEhB,KAAA,GAAQ,IAAA;;;;;WAKC,MAAA,EAAQ,aAAA;;EAEjB,MAAA,GACE,QAAA,UACA,MAAA,GAAS,MAAA,kBACN,OAAA,CAAQ,YAAA;;EAEb,OAAA,QAAe,OAAA;;EAEf,QAAA,GAAW,QAAA,GAAW,KAAA,EAAO,SAAA;;EAE7B,OAAA;AAAA;;;;;;;KASU,UAAA,aACE,WAAA,8BAAyC,WAAA,IACnD,cAAA,IACD,SAAA,CAAU,GAAA;EAAiC,OAAA,EAAS,aAAA;AAAA,WACpD,SAAA,CAAU,GAAA;EAA8B,IAAA,EAAM,UAAA;AAAA,WAC9C,SAAA,CAAU,GAAA;EAAgC,MAAA,EAAQ,YAAA;AAAA;;;;;;KAOzC,aAAA,aACE,WAAA,8BAAyC,WAAA;mEAGrD,MAAA,EAAQ,eAAA;EAER,GAAA,GAAM,GAAA;EAEN,GAAA;;;;;;EAMA,OAAA,GAAU,OAAA;EAEV,UAAA,IAAc,WAAA,oBAA+B,OAAA;EAE7C,SAAA;EAEA,SAAA;EAEA,QAAA,GAAW,GAAA,UAAa,GAAA;AAAA"}

package/dist/factors/device.js

@@ -1,104 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { ConvexError } from "convex/values";
-
-//#region src/client/factors/device.ts
-/** @internal */
-function createDeviceClient(deps) {
-	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
-	return {
-		poll: async (opts) => {
-			const { code } = opts;
-			const intervalMs = code.interval * 1e3;
-			const expiresAt = Date.now() + code.expiresIn * 1e3;
-			while (Date.now() < expiresAt) {
-				await new Promise((resolve) => setTimeout(resolve, intervalMs));
-				const pollResult = await Fx.run(Fx.from({
-					ok: async () => {
-						let result;
-						const params = {
-							flow: "poll",
-							deviceCode: code.deviceCode
-						};
-						if (proxy) result = await proxyFetch({
-							action: "auth:signIn",
-							args: {
-								provider: "device",
-								params
-							}
-						});
-						else result = await convex.action(requireApiRefs().signIn, {
-							provider: "device",
-							params
-						});
-						return result;
-					},
-					err: (e) => e
-				}).pipe(Fx.recover((e) => {
-					const dispatch = e instanceof ConvexError ? { tag: e.data?.code === "DEVICE_AUTHORIZATION_PENDING" ? "continue" : e.data?.code === "DEVICE_SLOW_DOWN" ? "slowDown" : "fatal" } : { tag: "fatal" };
-					return Fx.match(dispatch, dispatch.tag, {
-						continue: () => Fx.succeed({ _poll: "continue" }),
-						slowDown: () => Fx.succeed({ _poll: "slow_down" }),
-						fatal: () => Fx.fatal(e)
-					});
-				})));
-				if ("_poll" in pollResult) {
-					if (pollResult._poll === "slow_down") await new Promise((resolve) => setTimeout(resolve, intervalMs));
-					continue;
-				}
-				if (pollResult.tokens) {
-					if (proxy) await setTokenAndMaybeWait({
-						shouldStore: false,
-						tokens: pollResult.tokens === null ? null : { token: pollResult.tokens.token },
-						waitForHandshake: true,
-						context: {
-							provider: "device",
-							flow: "poll"
-						}
-					});
-					else await setTokenAndMaybeWait({
-						shouldStore: true,
-						tokens: pollResult.tokens ?? null,
-						waitForHandshake: true,
-						context: {
-							provider: "device",
-							flow: "poll"
-						}
-					});
-					return;
-				}
-			}
-			throw new ConvexError({
-				code: "DEVICE_CODE_EXPIRED",
-				message: "Device code expired before authorization was completed."
-			});
-		},
-		verify: async (opts) => {
-			const params = {
-				flow: "verify",
-				userCode: opts.code
-			};
-			try {
-				if (proxy) await proxyFetch({
-					action: "auth:signIn",
-					args: {
-						provider: "device",
-						params
-					}
-				});
-				else await convex.action(requireApiRefs().signIn, {
-					provider: "device",
-					params
-				});
-			} catch (e) {
-				throw new ConvexError({
-					code: "DEVICE_AUTHORIZATION_FAILED",
-					message: e instanceof Error ? e.message : "Invalid or expired code."
-				});
-			}
-		}
-	};
-}
-
-//#endregion
-export { createDeviceClient };
-//# sourceMappingURL=device.js.map

package/dist/factors/device.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"device.js","names":[],"sources":["../../src/client/factors/device.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { ConvexError } from \"convex/values\";\n\nimport type {\n  AuthSession,\n  ConvexTransport,\n  DeviceClient,\n  DeviceCodeResult,\n} from \"../core/types\";\n\ntype DeviceDeps = {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => { signIn: any };\n  proxyFetch: (body: Record<string, unknown>) => Promise<any>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthSession | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: string } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n};\n\n/** @internal */\nexport function createDeviceClient(deps: DeviceDeps): DeviceClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } =\n    deps;\n\n  return {\n    poll: async (opts: { code: DeviceCodeResult }): Promise<void> => {\n      const { code } = opts;\n      const intervalMs = code.interval * 1000;\n      const expiresAt = Date.now() + code.expiresIn * 1000;\n\n      while (Date.now() < expiresAt) {\n        await new Promise((resolve) => setTimeout(resolve, intervalMs));\n\n        const pollResult = await Fx.run(\n          Fx.from({\n            ok: async () => {\n              let result: any;\n              const params: Record<string, any> = {\n                flow: \"poll\",\n                deviceCode: code.deviceCode,\n              };\n\n              if (proxy) {\n                result = await proxyFetch({\n                  action: \"auth:signIn\",\n                  args: { provider: \"device\", params },\n                });\n              } else {\n                result = await convex.action(requireApiRefs().signIn, {\n                  provider: \"device\",\n                  params,\n                });\n              }\n\n              return result;\n            },\n            err: (e) => e,\n          }).pipe(\n            Fx.recover((e: unknown) => {\n              const dispatch =\n                e instanceof ConvexError\n                  ? {\n                      tag:\n                        (e.data as Record<string, unknown> | undefined)\n                          ?.code === \"DEVICE_AUTHORIZATION_PENDING\"\n                          ? \"continue\"\n                          : (e.data as Record<string, unknown> | undefined)\n                                ?.code === \"DEVICE_SLOW_DOWN\"\n                            ? \"slowDown\"\n                            : \"fatal\",\n                    }\n                  : ({ tag: \"fatal\" } as const);\n\n              return Fx.match(dispatch, dispatch.tag, {\n                continue: () => Fx.succeed({ _poll: \"continue\" as const }),\n                slowDown: () => Fx.succeed({ _poll: \"slow_down\" as const }),\n                fatal: () => Fx.fatal(e),\n              });\n            }),\n          ),\n        );\n\n        if (\"_poll\" in pollResult) {\n          if (pollResult._poll === \"slow_down\") {\n            await new Promise((resolve) => setTimeout(resolve, intervalMs));\n          }\n          continue;\n        }\n\n        if (pollResult.tokens) {\n          if (proxy) {\n            await setTokenAndMaybeWait({\n              shouldStore: false,\n              tokens:\n                pollResult.tokens === null\n                  ? null\n                  : { token: pollResult.tokens.token },\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          } else {\n            await setTokenAndMaybeWait({\n              shouldStore: true,\n              tokens: (pollResult.tokens as AuthSession | null) ?? null,\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          }\n          return;\n        }\n      }\n\n      throw new ConvexError({\n        code: \"DEVICE_CODE_EXPIRED\",\n        message: \"Device code expired before authorization was completed.\",\n      });\n    },\n\n    verify: async (opts: { code: string }): Promise<void> => {\n      const params: Record<string, any> = {\n        flow: \"verify\",\n        userCode: opts.code,\n      };\n\n      try {\n        if (proxy) {\n          await proxyFetch({\n            action: \"auth:signIn\",\n            args: { provider: \"device\", params },\n          });\n        } else {\n          await convex.action(requireApiRefs().signIn, {\n            provider: \"device\",\n            params,\n          });\n        }\n      } catch (e: unknown) {\n        throw new ConvexError({\n          code: \"DEVICE_AUTHORIZATION_FAILED\",\n          message: e instanceof Error ? e.message : \"Invalid or expired code.\",\n        });\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AAiCA,SAAgB,mBAAmB,MAAgC;CACjE,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBACjD;AAEF,QAAO;EACL,MAAM,OAAO,SAAoD;GAC/D,MAAM,EAAE,SAAS;GACjB,MAAM,aAAa,KAAK,WAAW;GACnC,MAAM,YAAY,KAAK,KAAK,GAAG,KAAK,YAAY;AAEhD,UAAO,KAAK,KAAK,GAAG,WAAW;AAC7B,UAAM,IAAI,SAAS,YAAY,WAAW,SAAS,WAAW,CAAC;IAE/D,MAAM,aAAa,MAAM,GAAG,IAC1B,GAAG,KAAK;KACN,IAAI,YAAY;MACd,IAAI;MACJ,MAAM,SAA8B;OAClC,MAAM;OACN,YAAY,KAAK;OAClB;AAED,UAAI,MACF,UAAS,MAAM,WAAW;OACxB,QAAQ;OACR,MAAM;QAAE,UAAU;QAAU;QAAQ;OACrC,CAAC;UAEF,UAAS,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;OACpD,UAAU;OACV;OACD,CAAC;AAGJ,aAAO;;KAET,MAAM,MAAM;KACb,CAAC,CAAC,KACD,GAAG,SAAS,MAAe;KACzB,MAAM,WACJ,aAAa,cACT,EACE,KACG,EAAE,MACC,SAAS,iCACT,aACC,EAAE,MACG,SAAS,qBACb,aACA,SACT,GACA,EAAE,KAAK,SAAS;AAEvB,YAAO,GAAG,MAAM,UAAU,SAAS,KAAK;MACtC,gBAAgB,GAAG,QAAQ,EAAE,OAAO,YAAqB,CAAC;MAC1D,gBAAgB,GAAG,QAAQ,EAAE,OAAO,aAAsB,CAAC;MAC3D,aAAa,GAAG,MAAM,EAAE;MACzB,CAAC;MACF,CACH,CACF;AAED,QAAI,WAAW,YAAY;AACzB,SAAI,WAAW,UAAU,YACvB,OAAM,IAAI,SAAS,YAAY,WAAW,SAAS,WAAW,CAAC;AAEjE;;AAGF,QAAI,WAAW,QAAQ;AACrB,SAAI,MACF,OAAM,qBAAqB;MACzB,aAAa;MACb,QACE,WAAW,WAAW,OAClB,OACA,EAAE,OAAO,WAAW,OAAO,OAAO;MACxC,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;SAEF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAS,WAAW,UAAiC;MACrD,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;AAEJ;;;AAIJ,SAAM,IAAI,YAAY;IACpB,MAAM;IACN,SAAS;IACV,CAAC;;EAGJ,QAAQ,OAAO,SAA0C;GACvD,MAAM,SAA8B;IAClC,MAAM;IACN,UAAU,KAAK;IAChB;AAED,OAAI;AACF,QAAI,MACF,OAAM,WAAW;KACf,QAAQ;KACR,MAAM;MAAE,UAAU;MAAU;MAAQ;KACrC,CAAC;QAEF,OAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;KAC3C,UAAU;KACV;KACD,CAAC;YAEG,GAAY;AACnB,UAAM,IAAI,YAAY;KACpB,MAAM;KACN,SAAS,aAAa,QAAQ,EAAE,UAAU;KAC3C,CAAC;;;EAGP"}

package/dist/factors/passkey.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey.js","names":[],"sources":["../../src/client/factors/passkey.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\n\nimport type {\n  AuthSession,\n  ConvexTransport,\n  PasskeyClient,\n  SignInActionResult,\n  SignInResult,\n} from \"../core/types\";\nimport { base64urlDecode, base64urlEncode } from \"../runtime/browser\";\n\ntype PasskeyDeps = {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => { signIn: any };\n  proxyFetch: (body: Record<string, unknown>) => Promise<any>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthSession | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: string } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n};\n\n/** @internal */\nexport function createPasskeyClient(deps: PasskeyDeps): PasskeyClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } =\n    deps;\n\n  const handleSignedInResult = async (\n    result: SignInActionResult,\n    flow: string,\n  ): Promise<SignInResult> => {\n    return Fx.run(\n      Fx.match(result, result.kind, {\n        signedIn: (signedInResult) =>\n          Fx.promise(async () => {\n            const signingIn = await setTokenAndMaybeWait(\n              proxy\n                ? {\n                    shouldStore: false as const,\n                    tokens:\n                      signedInResult.tokens === null\n                        ? null\n                        : { token: signedInResult.tokens.token },\n                    waitForHandshake: true,\n                    context: { provider: \"passkey\", flow },\n                  }\n                : {\n                    shouldStore: true as const,\n                    tokens: signedInResult.tokens,\n                    waitForHandshake: true,\n                    context: { provider: \"passkey\", flow },\n                  },\n            );\n            return signingIn\n              ? ({ kind: \"signedIn\" as const } as SignInResult)\n              : ({ kind: \"started\" as const } as SignInResult);\n          }),\n        redirect: () => Fx.succeed({ kind: \"started\" as const }),\n        started: () => Fx.succeed({ kind: \"started\" as const }),\n        passkeyOptions: () => Fx.succeed({ kind: \"started\" as const }),\n        totpRequired: () => Fx.succeed({ kind: \"started\" as const }),\n        totpSetup: () => Fx.succeed({ kind: \"started\" as const }),\n        deviceCode: () => Fx.succeed({ kind: \"started\" as const }),\n      }),\n    );\n  };\n\n  return {\n    isSupported: (): boolean => {\n      return (\n        typeof window !== \"undefined\" &&\n        typeof window.PublicKeyCredential !== \"undefined\"\n      );\n    },\n\n    isAutofillSupported: async (): Promise<boolean> => {\n      if (typeof window === \"undefined\") return false;\n      if (typeof window.PublicKeyCredential === \"undefined\") return false;\n      if (\n        typeof (window.PublicKeyCredential as any)\n          .isConditionalMediationAvailable !== \"function\"\n      ) {\n        return false;\n      }\n      return (\n        window.PublicKeyCredential as any\n      ).isConditionalMediationAvailable();\n    },\n\n    register: async (opts?: {\n      name?: string;\n      email?: string;\n      userName?: string;\n      userDisplayName?: string;\n    }): Promise<SignInResult> => {\n      const phase1Params = {\n        flow: \"registerOptions\",\n        email: opts?.email,\n        userName: opts?.userName,\n        userDisplayName: opts?.userDisplayName,\n      };\n\n      let phase1Result: SignInActionResult;\n      if (proxy) {\n        phase1Result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"passkey\", params: phase1Params },\n        })) as SignInActionResult;\n      } else {\n        phase1Result = (await convex.action(requireApiRefs().signIn, {\n          provider: \"passkey\",\n          params: phase1Params,\n        })) as SignInActionResult;\n      }\n\n      if (phase1Result.kind !== \"passkeyOptions\") {\n        throw new Error(\"Server did not return passkey registration options\");\n      }\n\n      const options = phase1Result.options;\n      const createOptions: CredentialCreationOptions = {\n        publicKey: {\n          rp: options.rp,\n          user: {\n            id: base64urlDecode(options.user.id).buffer as ArrayBuffer,\n            name: options.user.name,\n            displayName: options.user.displayName,\n          },\n          challenge: base64urlDecode(options.challenge).buffer as ArrayBuffer,\n          pubKeyCredParams: options.pubKeyCredParams,\n          timeout: options.timeout,\n          attestation: options.attestation,\n          authenticatorSelection: options.authenticatorSelection,\n          excludeCredentials: (options.excludeCredentials ?? []).map(\n            (cred: any) => ({\n              type: cred.type ?? \"public-key\",\n              id: base64urlDecode(cred.id).buffer as ArrayBuffer,\n              transports: cred.transports,\n            }),\n          ),\n        },\n      };\n\n      const credential = (await navigator.credentials.create(\n        createOptions,\n      )) as PublicKeyCredential | null;\n      if (!credential) {\n        throw new Error(\"Passkey registration was cancelled\");\n      }\n\n      const response = credential.response as AuthenticatorAttestationResponse;\n      const transports =\n        typeof response.getTransports === \"function\"\n          ? response.getTransports()\n          : undefined;\n\n      const phase2Params = {\n        flow: \"registerVerify\",\n        clientDataJSON: base64urlEncode(response.clientDataJSON),\n        attestationObject: base64urlEncode(response.attestationObject),\n        transports,\n        passkeyName: opts?.name,\n        email: opts?.email,\n      };\n\n      let phase2Result: SignInActionResult;\n      if (proxy) {\n        phase2Result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: {\n            provider: \"passkey\",\n            params: phase2Params,\n            verifier: phase1Result.verifier,\n          },\n        })) as SignInActionResult;\n      } else {\n        phase2Result = (await convex.action(requireApiRefs().signIn, {\n          provider: \"passkey\",\n          params: phase2Params,\n          verifier: phase1Result.verifier,\n        })) as SignInActionResult;\n      }\n\n      return handleSignedInResult(phase2Result, \"registerVerify\");\n    },\n\n    authenticate: async (opts?: {\n      email?: string;\n      autofill?: boolean;\n    }): Promise<SignInResult> => {\n      const phase1Params = {\n        flow: \"authOptions\",\n        email: opts?.email,\n      };\n\n      let phase1Result: SignInActionResult;\n      if (proxy) {\n        phase1Result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"passkey\", params: phase1Params },\n        })) as SignInActionResult;\n      } else {\n        phase1Result = (await convex.action(requireApiRefs().signIn, {\n          provider: \"passkey\",\n          params: phase1Params,\n        })) as SignInActionResult;\n      }\n\n      if (phase1Result.kind !== \"passkeyOptions\") {\n        throw new Error(\"Server did not return passkey authentication options\");\n      }\n\n      const options = phase1Result.options;\n      const getOptions: CredentialRequestOptions = {\n        publicKey: {\n          challenge: base64urlDecode(options.challenge).buffer as ArrayBuffer,\n          timeout: options.timeout,\n          rpId: options.rpId,\n          userVerification: options.userVerification,\n          allowCredentials: (options.allowCredentials ?? []).map(\n            (cred: any) => ({\n              type: cred.type ?? \"public-key\",\n              id: base64urlDecode(cred.id).buffer as ArrayBuffer,\n              transports: cred.transports,\n            }),\n          ),\n        },\n        ...(opts?.autofill ? { mediation: \"conditional\" as any } : {}),\n      };\n\n      const credential = (await navigator.credentials.get(\n        getOptions,\n      )) as PublicKeyCredential | null;\n      if (!credential) {\n        throw new Error(\"Passkey authentication was cancelled\");\n      }\n\n      const response = credential.response as AuthenticatorAssertionResponse;\n      const phase2Params = {\n        flow: \"authVerify\",\n        credentialId: base64urlEncode(credential.rawId),\n        clientDataJSON: base64urlEncode(response.clientDataJSON),\n        authenticatorData: base64urlEncode(response.authenticatorData),\n        signature: base64urlEncode(response.signature),\n      };\n\n      let phase2Result: SignInActionResult;\n      if (proxy) {\n        phase2Result = (await proxyFetch({\n          action: \"auth:signIn\",\n          args: {\n            provider: \"passkey\",\n            params: phase2Params,\n            verifier: phase1Result.verifier,\n          },\n        })) as SignInActionResult;\n      } else {\n        phase2Result = (await convex.action(requireApiRefs().signIn, {\n          provider: \"passkey\",\n          params: phase2Params,\n          verifier: phase1Result.verifier,\n        })) as SignInActionResult;\n      }\n\n      return handleSignedInResult(phase2Result, \"authVerify\");\n    },\n  };\n}\n"],"mappings":";;;;;AAkCA,SAAgB,oBAAoB,MAAkC;CACpE,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBACjD;CAEF,MAAM,uBAAuB,OAC3B,QACA,SAC0B;AAC1B,SAAO,GAAG,IACR,GAAG,MAAM,QAAQ,OAAO,MAAM;GAC5B,WAAW,mBACT,GAAG,QAAQ,YAAY;AAmBrB,WAlBkB,MAAM,qBACtB,QACI;KACE,aAAa;KACb,QACE,eAAe,WAAW,OACtB,OACA,EAAE,OAAO,eAAe,OAAO,OAAO;KAC5C,kBAAkB;KAClB,SAAS;MAAE,UAAU;MAAW;MAAM;KACvC,GACD;KACE,aAAa;KACb,QAAQ,eAAe;KACvB,kBAAkB;KAClB,SAAS;MAAE,UAAU;MAAW;MAAM;KACvC,CACN,GAEI,EAAE,MAAM,YAAqB,GAC7B,EAAE,MAAM,WAAoB;KACjC;GACJ,gBAAgB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GACxD,eAAe,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GACvD,sBAAsB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GAC9D,oBAAoB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GAC5D,iBAAiB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GACzD,kBAAkB,GAAG,QAAQ,EAAE,MAAM,WAAoB,CAAC;GAC3D,CAAC,CACH;;AAGH,QAAO;EACL,mBAA4B;AAC1B,UACE,OAAO,WAAW,eAClB,OAAO,OAAO,wBAAwB;;EAI1C,qBAAqB,YAA8B;AACjD,OAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,OAAI,OAAO,OAAO,wBAAwB,YAAa,QAAO;AAC9D,OACE,OAAQ,OAAO,oBACZ,oCAAoC,WAEvC,QAAO;AAET,UACE,OAAO,oBACP,iCAAiC;;EAGrC,UAAU,OAAO,SAKY;GAC3B,MAAM,eAAe;IACnB,MAAM;IACN,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,iBAAiB,MAAM;IACxB;GAED,IAAI;AACJ,OAAI,MACF,gBAAgB,MAAM,WAAW;IAC/B,QAAQ;IACR,MAAM;KAAE,UAAU;KAAW,QAAQ;KAAc;IACpD,CAAC;OAEF,gBAAgB,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV,QAAQ;IACT,CAAC;AAGJ,OAAI,aAAa,SAAS,iBACxB,OAAM,IAAI,MAAM,qDAAqD;GAGvE,MAAM,UAAU,aAAa;GAC7B,MAAM,gBAA2C,EAC/C,WAAW;IACT,IAAI,QAAQ;IACZ,MAAM;KACJ,IAAI,gBAAgB,QAAQ,KAAK,GAAG,CAAC;KACrC,MAAM,QAAQ,KAAK;KACnB,aAAa,QAAQ,KAAK;KAC3B;IACD,WAAW,gBAAgB,QAAQ,UAAU,CAAC;IAC9C,kBAAkB,QAAQ;IAC1B,SAAS,QAAQ;IACjB,aAAa,QAAQ;IACrB,wBAAwB,QAAQ;IAChC,qBAAqB,QAAQ,sBAAsB,EAAE,EAAE,KACpD,UAAe;KACd,MAAM,KAAK,QAAQ;KACnB,IAAI,gBAAgB,KAAK,GAAG,CAAC;KAC7B,YAAY,KAAK;KAClB,EACF;IACF,EACF;GAED,MAAM,aAAc,MAAM,UAAU,YAAY,OAC9C,cACD;AACD,OAAI,CAAC,WACH,OAAM,IAAI,MAAM,qCAAqC;GAGvD,MAAM,WAAW,WAAW;GAC5B,MAAM,aACJ,OAAO,SAAS,kBAAkB,aAC9B,SAAS,eAAe,GACxB;GAEN,MAAM,eAAe;IACnB,MAAM;IACN,gBAAgB,gBAAgB,SAAS,eAAe;IACxD,mBAAmB,gBAAgB,SAAS,kBAAkB;IAC9D;IACA,aAAa,MAAM;IACnB,OAAO,MAAM;IACd;GAED,IAAI;AACJ,OAAI,MACF,gBAAgB,MAAM,WAAW;IAC/B,QAAQ;IACR,MAAM;KACJ,UAAU;KACV,QAAQ;KACR,UAAU,aAAa;KACxB;IACF,CAAC;OAEF,gBAAgB,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV,QAAQ;IACR,UAAU,aAAa;IACxB,CAAC;AAGJ,UAAO,qBAAqB,cAAc,iBAAiB;;EAG7D,cAAc,OAAO,SAGQ;GAC3B,MAAM,eAAe;IACnB,MAAM;IACN,OAAO,MAAM;IACd;GAED,IAAI;AACJ,OAAI,MACF,gBAAgB,MAAM,WAAW;IAC/B,QAAQ;IACR,MAAM;KAAE,UAAU;KAAW,QAAQ;KAAc;IACpD,CAAC;OAEF,gBAAgB,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV,QAAQ;IACT,CAAC;AAGJ,OAAI,aAAa,SAAS,iBACxB,OAAM,IAAI,MAAM,uDAAuD;GAGzE,MAAM,UAAU,aAAa;GAC7B,MAAM,aAAuC;IAC3C,WAAW;KACT,WAAW,gBAAgB,QAAQ,UAAU,CAAC;KAC9C,SAAS,QAAQ;KACjB,MAAM,QAAQ;KACd,kBAAkB,QAAQ;KAC1B,mBAAmB,QAAQ,oBAAoB,EAAE,EAAE,KAChD,UAAe;MACd,MAAM,KAAK,QAAQ;MACnB,IAAI,gBAAgB,KAAK,GAAG,CAAC;MAC7B,YAAY,KAAK;MAClB,EACF;KACF;IACD,GAAI,MAAM,WAAW,EAAE,WAAW,eAAsB,GAAG,EAAE;IAC9D;GAED,MAAM,aAAc,MAAM,UAAU,YAAY,IAC9C,WACD;AACD,OAAI,CAAC,WACH,OAAM,IAAI,MAAM,uCAAuC;GAGzD,MAAM,WAAW,WAAW;GAC5B,MAAM,eAAe;IACnB,MAAM;IACN,cAAc,gBAAgB,WAAW,MAAM;IAC/C,gBAAgB,gBAAgB,SAAS,eAAe;IACxD,mBAAmB,gBAAgB,SAAS,kBAAkB;IAC9D,WAAW,gBAAgB,SAAS,UAAU;IAC/C;GAED,IAAI;AACJ,OAAI,MACF,gBAAgB,MAAM,WAAW;IAC/B,QAAQ;IACR,MAAM;KACJ,UAAU;KACV,QAAQ;KACR,UAAU,aAAa;KACxB;IACF,CAAC;OAEF,gBAAgB,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC3D,UAAU;IACV,QAAQ;IACR,UAAU,aAAa;IACxB,CAAC;AAGJ,UAAO,qBAAqB,cAAc,aAAa;;EAE1D"}

package/dist/factors/totp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.js","names":["result"],"sources":["../../src/client/factors/totp.ts"],"sourcesContent":["import type { AuthSession, ConvexTransport, TotpClient } from \"../core/types\";\n\ntype TotpDeps = {\n  proxy: string | undefined;\n  convex: ConvexTransport;\n  requireApiRefs: () => { signIn: any };\n  proxyFetch: (body: Record<string, unknown>) => Promise<any>;\n  setTokenAndMaybeWait: (\n    args:\n      | {\n          shouldStore: true;\n          tokens: AuthSession | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        }\n      | {\n          shouldStore: false;\n          tokens: { token: string } | null;\n          waitForHandshake: boolean;\n          context: { provider?: string; flow: string };\n        },\n  ) => Promise<boolean>;\n};\n\n/** @internal */\nexport function createTotpClient(deps: TotpDeps): TotpClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } =\n    deps;\n\n  return {\n    setup: async (opts?: {\n      name?: string;\n      accountName?: string;\n    }): Promise<{\n      uri: string;\n      secret: string;\n      verifier: string;\n      totpId: string;\n    }> => {\n      const params: Record<string, any> = { flow: \"setup\" };\n      if (opts?.name) params.name = opts.name;\n      if (opts?.accountName) params.accountName = opts.accountName;\n\n      if (proxy) {\n        const result = await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"totp\", params },\n        });\n        return {\n          uri: result.totpSetup.uri,\n          secret: result.totpSetup.secret,\n          verifier: result.verifier,\n          totpId: result.totpSetup.totpId,\n        };\n      }\n\n      const result = await convex.action(requireApiRefs().signIn, {\n        provider: \"totp\",\n        params,\n      });\n      return {\n        uri: result.totpSetup.uri,\n        secret: result.totpSetup.secret,\n        verifier: result.verifier,\n        totpId: result.totpSetup.totpId,\n      };\n    },\n\n    confirm: async (opts: {\n      code: string;\n      verifier: string;\n      totpId: string;\n    }): Promise<void> => {\n      const params: Record<string, any> = {\n        flow: \"confirm\",\n        code: opts.code,\n        totpId: opts.totpId,\n      };\n\n      if (proxy) {\n        const result = await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"totp\", params, verifier: opts.verifier },\n        });\n        if (result.tokens) {\n          await setTokenAndMaybeWait({\n            shouldStore: false,\n            tokens:\n              result.tokens === null ? null : { token: result.tokens.token },\n            waitForHandshake: true,\n            context: { provider: \"totp\", flow: \"confirm\" },\n          });\n        }\n        return;\n      }\n\n      const result = await convex.action(requireApiRefs().signIn, {\n        provider: \"totp\",\n        params,\n        verifier: opts.verifier,\n      });\n      if (result.tokens) {\n        await setTokenAndMaybeWait({\n          shouldStore: true,\n          tokens: (result.tokens as AuthSession | null) ?? null,\n          waitForHandshake: true,\n          context: { provider: \"totp\", flow: \"confirm\" },\n        });\n      }\n    },\n\n    verify: async (opts: { code: string; verifier: string }): Promise<void> => {\n      const params: Record<string, any> = {\n        flow: \"verify\",\n        code: opts.code,\n      };\n\n      if (proxy) {\n        const result = await proxyFetch({\n          action: \"auth:signIn\",\n          args: { provider: \"totp\", params, verifier: opts.verifier },\n        });\n        if (result.tokens) {\n          await setTokenAndMaybeWait({\n            shouldStore: false,\n            tokens:\n              result.tokens === null ? null : { token: result.tokens.token },\n            waitForHandshake: true,\n            context: { provider: \"totp\", flow: \"verify\" },\n          });\n        }\n        return;\n      }\n\n      const result = await convex.action(requireApiRefs().signIn, {\n        provider: \"totp\",\n        params,\n        verifier: opts.verifier,\n      });\n      if (result.tokens) {\n        await setTokenAndMaybeWait({\n          shouldStore: true,\n          tokens: (result.tokens as AuthSession | null) ?? null,\n          waitForHandshake: true,\n          context: { provider: \"totp\", flow: \"verify\" },\n        });\n      }\n    },\n  };\n}\n"],"mappings":";;AAyBA,SAAgB,iBAAiB,MAA4B;CAC3D,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBACjD;AAEF,QAAO;EACL,OAAO,OAAO,SAQR;GACJ,MAAM,SAA8B,EAAE,MAAM,SAAS;AACrD,OAAI,MAAM,KAAM,QAAO,OAAO,KAAK;AACnC,OAAI,MAAM,YAAa,QAAO,cAAc,KAAK;AAEjD,OAAI,OAAO;IACT,MAAMA,WAAS,MAAM,WAAW;KAC9B,QAAQ;KACR,MAAM;MAAE,UAAU;MAAQ;MAAQ;KACnC,CAAC;AACF,WAAO;KACL,KAAKA,SAAO,UAAU;KACtB,QAAQA,SAAO,UAAU;KACzB,UAAUA,SAAO;KACjB,QAAQA,SAAO,UAAU;KAC1B;;GAGH,MAAM,SAAS,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC1D,UAAU;IACV;IACD,CAAC;AACF,UAAO;IACL,KAAK,OAAO,UAAU;IACtB,QAAQ,OAAO,UAAU;IACzB,UAAU,OAAO;IACjB,QAAQ,OAAO,UAAU;IAC1B;;EAGH,SAAS,OAAO,SAIK;GACnB,MAAM,SAA8B;IAClC,MAAM;IACN,MAAM,KAAK;IACX,QAAQ,KAAK;IACd;AAED,OAAI,OAAO;IACT,MAAMA,WAAS,MAAM,WAAW;KAC9B,QAAQ;KACR,MAAM;MAAE,UAAU;MAAQ;MAAQ,UAAU,KAAK;MAAU;KAC5D,CAAC;AACF,QAAIA,SAAO,OACT,OAAM,qBAAqB;KACzB,aAAa;KACb,QACEA,SAAO,WAAW,OAAO,OAAO,EAAE,OAAOA,SAAO,OAAO,OAAO;KAChE,kBAAkB;KAClB,SAAS;MAAE,UAAU;MAAQ,MAAM;MAAW;KAC/C,CAAC;AAEJ;;GAGF,MAAM,SAAS,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC1D,UAAU;IACV;IACA,UAAU,KAAK;IAChB,CAAC;AACF,OAAI,OAAO,OACT,OAAM,qBAAqB;IACzB,aAAa;IACb,QAAS,OAAO,UAAiC;IACjD,kBAAkB;IAClB,SAAS;KAAE,UAAU;KAAQ,MAAM;KAAW;IAC/C,CAAC;;EAIN,QAAQ,OAAO,SAA4D;GACzE,MAAM,SAA8B;IAClC,MAAM;IACN,MAAM,KAAK;IACZ;AAED,OAAI,OAAO;IACT,MAAMA,WAAS,MAAM,WAAW;KAC9B,QAAQ;KACR,MAAM;MAAE,UAAU;MAAQ;MAAQ,UAAU,KAAK;MAAU;KAC5D,CAAC;AACF,QAAIA,SAAO,OACT,OAAM,qBAAqB;KACzB,aAAa;KACb,QACEA,SAAO,WAAW,OAAO,OAAO,EAAE,OAAOA,SAAO,OAAO,OAAO;KAChE,kBAAkB;KAClB,SAAS;MAAE,UAAU;MAAQ,MAAM;MAAU;KAC9C,CAAC;AAEJ;;GAGF,MAAM,SAAS,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ;IAC1D,UAAU;IACV;IACA,UAAU,KAAK;IAChB,CAAC;AACF,OAAI,OAAO,OACT,OAAM,qBAAqB;IACzB,aAAa;IACb,QAAS,OAAO,UAAiC;IACjD,kBAAkB;IAClB,SAAS;KAAE,UAAU;KAAQ,MAAM;KAAU;IAC9C,CAAC;;EAGP"}

package/dist/providers/anonymous.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"anonymous.d.ts","names":[],"sources":["../../src/providers/anonymous.ts"],"mappings":";;;;;;;;UA4BiB,eAAA,mBAAkC,gBAAA;EAAlB;;;;EAK/B,EAAA;EASyB;;;;EAJzB,OAAA;EAUK;;;EANH,MAAA,EAAQ,MAAA,SAAe,KAAA;EAOZ;;AAkBf;;EApBI,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,mBAAA,CAAoB,cAAA,CAAe,SAAA;IACtC,WAAA;EAAA;AAAA;;;;;;;;;;;;;;;cAkBS,SAAA,mBAA4B,gBAAA,GAAmB,gBAAA;EAAA,SACjD,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,eAAA,CAAgB,SAAA;cAG/B,MAAA,GAAQ,eAAA,CAAgB,SAAA;AAAA"}

package/dist/providers/anonymous.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"anonymous.js","names":[],"sources":["../../src/providers/anonymous.ts"],"sourcesContent":["/**\n * Anonymous authentication provider.\n *\n * ```ts\n * import { Anonymous } from \"@robelest/convex-auth/providers\";\n *\n * new Anonymous()\n * ```\n *\n * @module\n */\n\nimport {\n  DocumentByName,\n  GenericDataModel,\n  WithoutSystemFields,\n} from \"convex/server\";\nimport { Value } from \"convex/values\";\n\nimport type {\n  GenericActionCtxWithAuthConfig,\n  ConvexCredentialsConfig,\n} from \"../server/types\";\nimport { Credentials } from \"./credentials\";\n\n/**\n * The available options to an {@link Anonymous} provider for Convex Auth.\n */\nexport interface AnonymousConfig<DataModel extends GenericDataModel> {\n  /**\n   * Uniquely identifies the provider, allowing to use\n   * multiple different {@link Anonymous} providers.\n   */\n  id?: string;\n  /**\n   * Perform checks on provided params and customize the user\n   * information stored after sign in.\n   */\n  profile?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    /**\n     * Convex ActionCtx in case you want to read from or write to\n     * the database.\n     */\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => WithoutSystemFields<DocumentByName<DataModel, \"User\">> & {\n    isAnonymous: true;\n  };\n}\n\n/**\n * Anonymous authentication provider.\n *\n * Creates a new anonymous user account without requiring any\n * user-provided information. Useful for guest access or\n * progressive profiling.\n *\n * @example\n * ```ts\n * import { Anonymous } from \"@robelest/convex-auth/providers\";\n *\n * new Anonymous()\n * ```\n */\nexport class Anonymous<DataModel extends GenericDataModel = GenericDataModel> {\n  readonly id: string;\n  readonly type = \"credentials\" as const;\n  readonly config: AnonymousConfig<DataModel>;\n\n  constructor(\n    config: AnonymousConfig<DataModel> = {} as AnonymousConfig<DataModel>,\n  ) {\n    this.id = config.id ?? \"anonymous\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): ConvexCredentialsConfig {\n    const config = this.config;\n    const provider = this.id;\n\n    return new Credentials<DataModel>({\n      id: \"anonymous\",\n      authorize: async (params, ctx) => {\n        const profile = config.profile?.(params, ctx) ?? { isAnonymous: true };\n        const { user } = await ctx.auth.account.create(ctx, {\n          provider,\n          account: { id: crypto.randomUUID() },\n          profile: profile as any,\n        });\n        return { userId: user._id };\n      },\n      ...config,\n    })._toMaterialized();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAmEA,IAAa,YAAb,MAA8E;CAC5E,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YACE,SAAqC,EAAE,EACvC;AACA,OAAK,KAAK,OAAO,MAAM;AACvB,OAAK,SAAS;;;CAIhB,kBAA2C;EACzC,MAAM,SAAS,KAAK;EACpB,MAAM,WAAW,KAAK;AAEtB,SAAO,IAAI,YAAuB;GAChC,IAAI;GACJ,WAAW,OAAO,QAAQ,QAAQ;IAChC,MAAM,UAAU,OAAO,UAAU,QAAQ,IAAI,IAAI,EAAE,aAAa,MAAM;IACtE,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;KAClD;KACA,SAAS,EAAE,IAAI,OAAO,YAAY,EAAE;KAC3B;KACV,CAAC;AACF,WAAO,EAAE,QAAQ,KAAK,KAAK;;GAE7B,GAAG;GACJ,CAAC,CAAC,iBAAiB"}

package/dist/providers/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","names":[],"sources":["../../src/providers/credentials.ts"],"mappings":";;;;;;;;;;UA8BiB,iBAAA,mBACG,gBAAA,GAAmB,gBAAA;EAAnB;EAGlB,EAAA;EAAA;;;;;EAMA,SAAA,GACE,WAAA,EAAa,OAAA,CAAQ,MAAA,SAAe,KAAA,gBACpC,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA;IACH,MAAA,EAAQ,SAAA;IACR,SAAA,GAAY,SAAA;EAAA;EAFT;;;EAOL,MAAA;IACE,UAAA,GAAa,MAAA,aAAmB,OAAA;IAChC,YAAA,GAAe,MAAA,UAAgB,IAAA,aAAiB,OAAA;EAAA;EADnC;;;;EAOf,cAAA,IAAkB,kBAAA;AAAA;;;;;AAuBpB;;;;;;;;;;;;;;;;cAAa,WAAA,mBACO,gBAAA,GAAmB,gBAAA;EAAA,SAE5B,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,iBAAA,CAAkB,SAAA;cAEvB,MAAA,EAAQ,iBAAA,CAAkB,SAAA;AAAA"}

package/dist/providers/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../src/providers/credentials.ts"],"sourcesContent":["/**\n * Credentials provider for custom authentication flows.\n *\n * ```ts\n * import { Credentials } from \"@robelest/convex-auth/providers\";\n *\n * new Credentials({\n *   authorize: async (credentials, ctx) => {\n *     // Your custom logic here...\n *   },\n * })\n * ```\n *\n * @module\n */\n\nimport { GenericDataModel } from \"convex/server\";\nimport { GenericId, Value } from \"convex/values\";\n\nimport type {\n  AuthProviderConfig,\n  ConvexCredentialsConfig,\n  GenericActionCtxWithAuthConfig,\n} from \"../server/types\";\n\n/**\n * Configuration for the Credentials provider.\n *\n * @typeParam DataModel - The Convex data model.\n */\nexport interface CredentialsConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  /** Uniquely identifies the provider. Defaults to `\"credentials\"`. */\n  id?: string;\n  /**\n   * Handle credentials received from the client-side `signIn` call.\n   *\n   * @returns A user ID for successful login, or `null` to reject.\n   */\n  authorize: (\n    credentials: Partial<Record<string, Value | undefined>>,\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => Promise<{\n    userId: GenericId<\"User\">;\n    sessionId?: GenericId<\"Session\">;\n  } | null>;\n  /**\n   * Provide hashing and verification functions for account secrets.\n   */\n  crypto?: {\n    hashSecret: (secret: string) => Promise<string>;\n    verifySecret: (secret: string, hash: string) => Promise<boolean>;\n  };\n  /**\n   * Extra providers used internally (e.g. email verification in password flow).\n   * Not exposed to clients.\n   */\n  extraProviders?: (AuthProviderConfig | undefined)[];\n}\n\n/**\n * Credentials provider for custom authentication flows.\n *\n * This is the escape hatch for fully custom auth logic. For email/password\n * flows, use the `Password` class instead.\n *\n * @typeParam DataModel - The Convex data model.\n *\n * @example\n * ```ts\n * import { Credentials } from \"@robelest/convex-auth/providers\";\n *\n * new Credentials({\n *   authorize: async (credentials, ctx) => {\n *     const user = await validateUser(credentials);\n *     return user ? { userId: user._id } : null;\n *   },\n * })\n * ```\n */\nexport class Credentials<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  readonly id: string;\n  readonly type = \"credentials\" as const;\n  readonly config: CredentialsConfig<DataModel>;\n\n  constructor(config: CredentialsConfig<DataModel>) {\n    this.id = config.id ?? \"credentials\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): ConvexCredentialsConfig {\n    return {\n      ...this.config,\n      id: this.id,\n      type: \"credentials\",\n    } as ConvexCredentialsConfig;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiFA,IAAa,cAAb,MAEE;CACA,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,QAAsC;AAChD,OAAK,KAAK,OAAO,MAAM;AACvB,OAAK,SAAS;;;CAIhB,kBAA2C;AACzC,SAAO;GACL,GAAG,KAAK;GACR,IAAI,KAAK;GACT,MAAM;GACP"}

package/dist/providers/device.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"device.d.ts","names":[],"sources":["../../src/providers/device.ts"],"mappings":";;AAoBA;;;;;;;;;;;AA4CA;;;;;UA5CiB,YAAA;EA+CN;;;;EA1CT,OAAA;EA4CqC;EA1CrC,cAAA;;EAEA,SAAA;;EAEA,QAAA;;;;;;;;EAQA,eAAA;AAAA;;;;;;;;;;;;;;;;;;;;cAyBW,MAAA;EAAA,SACF,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,YAAA;cAEL,MAAA,GAAQ,YAAA;AAAA"}

package/dist/providers/device.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"device.js","names":[],"sources":["../../src/providers/device.ts"],"sourcesContent":["/**\n * Device authorization provider (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short code that the user enters on a secondary device.\n *\n * ```ts\n * import { Device } from \"@robelest/convex-auth/providers\";\n *\n * new Device()\n * ```\n *\n * @module\n */\n\nimport type { DeviceProviderConfig } from \"../server/types\";\n\n/**\n * Configuration for the Device authorization provider.\n */\nexport interface DeviceConfig {\n  /**\n   * User code character set.\n   * Default: `\"BCDFGHJKLMNPQRSTVWXZ\"` (base-20, no vowels per RFC 8628 §6.1).\n   */\n  charset?: string;\n  /** User code length (before formatting). Default: 8. */\n  userCodeLength?: number;\n  /** Device code + user code lifetime in seconds. Default: 900 (15 min). */\n  expiresIn?: number;\n  /** Minimum polling interval in seconds. Default: 5. */\n  interval?: number;\n  /**\n   * Base URL for the verification page where users enter the device code.\n   *\n   * Example: `\"http://localhost:3000/device\"` or `\"https://myapp.com/device\"`.\n   *\n   * If not provided, falls back to `SITE_URL + \"/device\"`.\n   */\n  verificationUri?: string;\n}\n\n/** No-vowel base-20 charset per RFC 8628 §6.1 recommendation. */\nconst DEFAULT_CHARSET = \"BCDFGHJKLMNPQRSTVWXZ\";\n\n/**\n * Device authorization provider (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short user code. The user visits a verification page\n * on a secondary device, signs in with any existing provider, and\n * enters the code to authorize the device.\n *\n * @example\n * ```ts\n * import { createAuth } from \"@robelest/convex-auth/component\";\n * import { Device } from \"@robelest/convex-auth/providers\";\n * import { components } from \"./_generated/api\";\n *\n * const auth = createAuth(components.auth, {\n *   providers: [new Device()],\n * });\n * ```\n */\nexport class Device {\n  readonly id: string;\n  readonly type = \"device\" as const;\n  readonly config: DeviceConfig;\n\n  constructor(config: DeviceConfig = {}) {\n    this.id = \"device\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): DeviceProviderConfig {\n    return {\n      id: this.id,\n      type: \"device\",\n      charset: this.config.charset ?? DEFAULT_CHARSET,\n      userCodeLength: this.config.userCodeLength ?? 8,\n      expiresIn: this.config.expiresIn ?? 900,\n      interval: this.config.interval ?? 5,\n      verificationUri: this.config.verificationUri,\n    };\n  }\n}\n"],"mappings":";;AA2CA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;AAqBxB,IAAa,SAAb,MAAoB;CAClB,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,SAAuB,EAAE,EAAE;AACrC,OAAK,KAAK;AACV,OAAK,SAAS;;;CAIhB,kBAAwC;AACtC,SAAO;GACL,IAAI,KAAK;GACT,MAAM;GACN,SAAS,KAAK,OAAO,WAAW;GAChC,gBAAgB,KAAK,OAAO,kBAAkB;GAC9C,WAAW,KAAK,OAAO,aAAa;GACpC,UAAU,KAAK,OAAO,YAAY;GAClC,iBAAiB,KAAK,OAAO;GAC9B"}

package/dist/providers/email.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"email.d.ts","names":[],"sources":["../../src/providers/email.ts"],"mappings":";;AAeA;;;;;;;;;;UAAiB,mBAAA;EAMb;EAJF,IAAA;EAOA;EALA,IAAA,GACE,GAAA,OACA,IAAA;IAAQ,IAAA;IAAc,EAAA;IAAY,OAAA;IAAiB,IAAA;EAAA,MAChD,OAAA;EA2BW;EAzBhB,yBAAA,SAAkC,OAAA;EAmCqB;EAjCvD,EAAA;EAiCoC;EA/BpC,MAAA;AAAA;;;;;;;;;;;;;;;;;;;cAqBW,KAAA;EAAA,SAUiB,MAAA,EAAQ,mBAAA;EAAA,SAT3B,EAAA;EAAA,SACA,IAAA;;;;;;;cAQmB,MAAA,EAAQ,mBAAA;AAAA"}

package/dist/providers/email.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"email.js","names":[],"sources":["../../src/providers/email.ts"],"sourcesContent":["/**\n * Email (magic link / OTP) authentication provider.\n *\n * @module\n */\n\nimport { defaultMagicLinkEmail } from \"../server/templates\";\nimport type { EmailConfig } from \"../server/types\";\n\n/**\n * User-facing configuration for the {@link Email} provider.\n *\n * Use this to wire your email delivery service into Convex Auth's magic-link\n * or OTP flow.\n */\nexport interface EmailProviderConfig {\n  /** Sender address (e.g. \"My App <noreply@example.com>\"). */\n  from: string;\n  /** Send the verification email. Receives the Convex action context. */\n  send: (\n    ctx: any,\n    opts: { from: string; to: string; subject: string; html: string },\n  ) => Promise<void>;\n  /** Override to generate a custom verification token. */\n  generateVerificationToken?: () => Promise<string>;\n  /** Provider ID override. Defaults to \"email\". */\n  id?: string;\n  /** Token expiration in seconds. Defaults to 86400 (24 hours). */\n  maxAge?: number;\n}\n\n/**\n * Email provider for magic-link or one-time-code sign-in.\n *\n * Sends verification emails through your `send()` implementation and converts\n * the result into Convex Auth's internal email-provider runtime shape.\n *\n * @example\n * ```ts\n * import { Email } from \"@robelest/convex-auth/providers\";\n *\n * const email = new Email({\n *   from: \"My App <noreply@example.com>\",\n *   send: async (_ctx, { to, subject, html }) => {\n *     await resend.emails.send({ from: \"noreply@example.com\", to, subject, html });\n *   },\n * });\n * ```\n */\nexport class Email {\n  readonly id: string;\n  readonly type = \"email\" as const;\n\n  /**\n   * Create an email provider instance.\n   *\n   * @param config - Email transport and provider settings.\n   * @throws {Error} When `config.from` is empty or whitespace-only.\n   */\n  constructor(public readonly config: EmailProviderConfig) {\n    const from = config.from.trim();\n    if (from.length === 0) {\n      throw new Error(\n        \"Email provider requires a non-empty `from` address \" +\n          '(for example, `\"My App <noreply@example.com>\"`).',\n      );\n    }\n    this.id = config.id ?? \"email\";\n  }\n\n  /** @internal */\n  _toMaterialized(): EmailConfig {\n    const from = this.config.from.trim();\n    const { send } = this.config;\n    const { generateVerificationToken } = this.config;\n    return {\n      id: this.id,\n      type: \"email\",\n      name: \"Email\",\n      from,\n      maxAge: this.config.maxAge ?? 60 * 60 * 24,\n      authorize: undefined,\n      sendVerificationRequest: async ({ identifier, url }, ctx) => {\n        if (!ctx) {\n          throw new Error(\"Email provider requires a Convex action context.\");\n        }\n        const { host } = new URL(url);\n        await send(ctx, {\n          from,\n          to: identifier,\n          subject: `Sign in to ${host}`,\n          html: defaultMagicLinkEmail(url, host),\n        });\n      },\n      generateVerificationToken,\n      options: { from } as any,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa,QAAb,MAAmB;CACjB,AAAS;CACT,AAAS,OAAO;;;;;;;CAQhB,YAAY,AAAgB,QAA6B;EAA7B;AAE1B,MADa,OAAO,KAAK,MAAM,CACtB,WAAW,EAClB,OAAM,IAAI,MACR,wGAED;AAEH,OAAK,KAAK,OAAO,MAAM;;;CAIzB,kBAA+B;EAC7B,MAAM,OAAO,KAAK,OAAO,KAAK,MAAM;EACpC,MAAM,EAAE,SAAS,KAAK;EACtB,MAAM,EAAE,8BAA8B,KAAK;AAC3C,SAAO;GACL,IAAI,KAAK;GACT,MAAM;GACN,MAAM;GACN;GACA,QAAQ,KAAK,OAAO,UAAU,OAAU;GACxC,WAAW;GACX,yBAAyB,OAAO,EAAE,YAAY,OAAO,QAAQ;AAC3D,QAAI,CAAC,IACH,OAAM,IAAI,MAAM,mDAAmD;IAErE,MAAM,EAAE,SAAS,IAAI,IAAI,IAAI;AAC7B,UAAM,KAAK,KAAK;KACd;KACA,IAAI;KACJ,SAAS,cAAc;KACvB,MAAM,sBAAsB,KAAK,KAAK;KACvC,CAAC;;GAEJ;GACA,SAAS,EAAE,MAAM;GAClB"}