@robelest/convex-auth 0.0.4-preview.27 → 0.0.4-preview.28

package/dist/server/totp.js

@@ -1,12 +1,10 @@
 import { userIdFromIdentitySubject } from "./identity.js";
-import { authFlowError } from "../shared/errors.js";
-import { toConvexError } from "./errors.js";
-import { callVerifierSignature } from "./mutations/signature.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
+import { authFlowError } from "../shared/errors.js";
+import { toConvexError } from "./errors.js";
 import { mutateTotpInsert, mutateTotpMarkVerified, mutateTotpUpdateLastUsed, mutateVerifierDelete, queryTotpById, queryTotpVerifiedByUserId, queryUserById, queryVerifierById } from "./types.js";
 import { ConvexError } from "convex/values";
-import { Effect, Match } from "effect";
 import { encodeBase32LowerCaseNoPadding } from "@oslojs/encoding";
 import { createTOTPKeyURI, verifyTOTPWithGracePeriod } from "@oslojs/otp";
 
@@ -26,135 +24,174 @@ const TOTP_FLOWS = [
 ];
 const convexError = (code, message) => toConvexError(authFlowError(code, message));
 const asConvexError = (error, code, message) => error instanceof ConvexError ? error : error instanceof Error ? toConvexError(authFlowError(code, error.message || message)) : convexError(code, message);
-const resolveTotpFlowFx = (params) => {
+function resolveTotpFlow(params) {
 	const flow = params.flow;
-	return typeof flow === "string" && TOTP_FLOWS.includes(flow) ? Effect.succeed(flow) : Effect.fail(convexError("TOTP_MISSING_FLOW", "Missing `flow` parameter. Expected one of: setup, confirm, verify"));
-};
-const requireTotpVerifierFx = (verifier) => verifier != null ? Effect.succeed(verifier) : Effect.fail(convexError("TOTP_MISSING_VERIFIER", "Missing verifier for TOTP operation."));
-const requireTotpCodeFx = (params) => typeof params.code === "string" ? Effect.succeed(params.code) : Effect.fail(convexError("TOTP_MISSING_CODE", "Missing TOTP code."));
-const requireTotpIdFx = (params) => typeof params.totpId === "string" ? Effect.succeed(params.totpId) : Effect.fail(convexError("TOTP_MISSING_ID", "Missing TOTP enrollment ID."));
-const resolveTotpDispatchFx = (params, verifier) => Effect.flatMap(resolveTotpFlowFx(params), (flow) => Match.value(flow).pipe(Match.when("setup", () => Effect.succeed({
-	flow: "setup",
-	params
-})), Match.when("confirm", () => Effect.gen(function* () {
-	const resolvedVerifier = yield* requireTotpVerifierFx(verifier);
-	return {
-		flow: "confirm",
-		code: yield* requireTotpCodeFx(params),
-		totpId: yield* requireTotpIdFx(params),
-		verifier: resolvedVerifier
+	if (typeof flow === "string" && TOTP_FLOWS.includes(flow)) return flow;
+	throw convexError("TOTP_MISSING_FLOW", "Missing `flow` parameter. Expected one of: setup, confirm, verify");
+}
+function requireTotpVerifier(verifier) {
+	if (verifier != null) return verifier;
+	throw convexError("TOTP_MISSING_VERIFIER", "Missing verifier for TOTP operation.");
+}
+function requireTotpCode(params) {
+	if (typeof params.code === "string") return params.code;
+	throw convexError("TOTP_MISSING_CODE", "Missing TOTP code.");
+}
+function requireTotpId(params) {
+	if (typeof params.totpId === "string") return params.totpId;
+	throw convexError("TOTP_MISSING_ID", "Missing TOTP enrollment ID.");
+}
+function resolveTotpDispatch(params, verifier) {
+	const flow = resolveTotpFlow(params);
+	if (flow === "setup") return {
+		flow: "setup",
+		params
 	};
-})), Match.when("verify", () => Effect.gen(function* () {
-	const resolvedVerifier = yield* requireTotpVerifierFx(verifier);
+	if (flow === "confirm") {
+		const resolvedVerifier$1 = requireTotpVerifier(verifier);
+		return {
+			flow: "confirm",
+			code: requireTotpCode(params),
+			totpId: requireTotpId(params),
+			verifier: resolvedVerifier$1
+		};
+	}
+	const resolvedVerifier = requireTotpVerifier(verifier);
 	return {
 		flow: "verify",
-		code: yield* requireTotpCodeFx(params),
+		code: requireTotpCode(params),
 		verifier: resolvedVerifier
 	};
-})), Match.exhaustive));
-const requireAuthenticatedUserId = (ctx) => Effect.flatMap(Effect.tryPromise({
-	try: () => ctx.auth.getUserIdentity(),
-	catch: (error) => asConvexError(error, "INTERNAL_ERROR", String(error))
-}), (identity) => Match.value(identity).pipe(Match.when(null, () => Effect.fail(convexError("TOTP_AUTH_REQUIRED", "Sign in first, then set up two-factor authentication."))), Match.orElse((identity$1) => Effect.succeed(userIdFromIdentitySubject(identity$1.subject)))));
+}
+async function requireAuthenticatedUserId(ctx) {
+	let identity;
+	try {
+		identity = await ctx.auth.getUserIdentity();
+	} catch (error) {
+		throw asConvexError(error, "INTERNAL_ERROR", String(error));
+	}
+	if (identity === null) throw convexError("TOTP_AUTH_REQUIRED", "Sign in first, then set up two-factor authentication.");
+	return userIdFromIdentitySubject(identity.subject);
+}
 /** @internal */
-const handleTotp = (ctx, provider, args) => {
-	const params = args.params ?? {};
-	return Effect.flatMap(resolveTotpDispatchFx(params, args.verifier), (dispatch) => Match.value(dispatch).pipe(Match.when({ flow: "setup" }, ({ params: params$1 }) => Effect.gen(function* () {
-		const userId = yield* requireAuthenticatedUserId(ctx);
-		const secret = new Uint8Array(20);
-		crypto.getRandomValues(secret);
-		let accountName = params$1.accountName;
-		if (!accountName) accountName = (yield* Effect.tryPromise({
-			try: () => queryUserById(ctx, userId),
-			catch: (error) => asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`)
-		}))?.email ?? "user";
-		const uri = createTOTPKeyURI(provider.options.issuer, accountName, secret, provider.options.period, provider.options.digits);
-		const base32Secret = encodeBase32LowerCaseNoPadding(secret);
-		const verifier = yield* Effect.tryPromise({
-			try: () => callVerifier(ctx),
-			catch: (error) => asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`)
-		});
-		yield* Effect.tryPromise({
-			try: () => callVerifierSignature(ctx, {
-				verifier,
-				signature: JSON.stringify({
+const handleTotp = async (ctx, provider, args) => {
+	const dispatch = resolveTotpDispatch(args.params ?? {}, args.verifier);
+	const handler = {
+		setup: async () => {
+			const { params: setupParams } = dispatch;
+			const userId = await requireAuthenticatedUserId(ctx);
+			const secret = new Uint8Array(20);
+			crypto.getRandomValues(secret);
+			let accountName = setupParams.accountName;
+			if (!accountName) {
+				let user;
+				try {
+					user = await queryUserById(ctx, userId);
+				} catch (error) {
+					throw asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`);
+				}
+				accountName = user?.email ?? "user";
+			}
+			const uri = createTOTPKeyURI(provider.options.issuer, accountName, secret, provider.options.period, provider.options.digits);
+			const base32Secret = encodeBase32LowerCaseNoPadding(secret);
+			let verifier;
+			try {
+				verifier = await callVerifier(ctx, JSON.stringify({
 					secret: Array.from(secret),
 					userId,
 					digits: provider.options.digits,
 					period: provider.options.period
-				})
-			}),
-			catch: (error) => asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`)
-		});
-		return {
-			kind: "totpSetup",
-			uri,
-			secret: base32Secret,
-			verifier,
-			totpId: yield* Effect.tryPromise({
-				try: () => mutateTotpInsert(ctx, {
+				}));
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`);
+			}
+			let totpId;
+			try {
+				totpId = await mutateTotpInsert(ctx, {
 					userId,
 					secret: secret.buffer.slice(secret.byteOffset, secret.byteOffset + secret.byteLength),
 					digits: provider.options.digits,
 					period: provider.options.period,
 					verified: false,
-					name: typeof params$1.name === "string" ? params$1.name : void 0,
+					name: typeof setupParams.name === "string" ? setupParams.name : void 0,
 					createdAt: Date.now()
-				}),
-				catch: (error) => asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`)
-			})
-		};
-	})), Match.when({ flow: "confirm" }, ({ code, totpId, verifier }) => Effect.gen(function* () {
-		const userId = yield* requireAuthenticatedUserId(ctx);
-		const doc = yield* Effect.tryPromise({
-			try: () => queryTotpById(ctx, totpId),
-			catch: () => convexError("TOTP_NOT_FOUND", "TOTP enrollment not found.")
-		});
-		const totpDoc = yield* Match.value(doc).pipe(Match.when(null, () => Effect.fail(convexError("TOTP_NOT_FOUND", "TOTP enrollment not found."))), Match.orElse((doc$1) => Effect.succeed(doc$1)));
-		if (totpDoc.verified) return yield* Effect.fail(convexError("TOTP_ALREADY_VERIFIED", "TOTP enrollment is already verified."));
-		if (!verifyTOTPWithGracePeriod(new Uint8Array(totpDoc.secret), provider.options.period, provider.options.digits, code, 30)) return yield* Effect.fail(convexError("TOTP_INVALID_CODE", "Invalid TOTP code."));
-		return {
-			kind: "signedIn",
-			signedIn: yield* Effect.tryPromise({
-				try: async () => {
-					await mutateTotpMarkVerified(ctx, totpId, Date.now());
-					await mutateVerifierDelete(ctx, verifier);
-					return callSignIn(ctx, {
-						userId,
-						generateTokens: true
-					});
-				},
-				catch: (error) => asConvexError(error, "INTERNAL_ERROR", String(error))
-			})
-		};
-	})), Match.when({ flow: "verify" }, ({ code, verifier }) => Effect.gen(function* () {
-		const doc = yield* Effect.tryPromise({
-			try: () => queryVerifierById(ctx, verifier),
-			catch: () => convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.")
-		});
-		const verifierDoc = yield* Match.value(doc).pipe(Match.when(null, () => Effect.fail(convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier."))), Match.orElse((doc$1) => Effect.succeed(doc$1)));
-		const userId = JSON.parse(verifierDoc.signature).userId;
-		const totp = yield* Effect.tryPromise({
-			try: () => queryTotpVerifiedByUserId(ctx, userId),
-			catch: () => convexError("TOTP_NO_ENROLLMENT", "No verified TOTP enrollment found.")
-		});
-		const totpDoc = yield* Match.value(totp).pipe(Match.when(null, () => Effect.fail(convexError("TOTP_NO_ENROLLMENT", "No verified TOTP enrollment found."))), Match.orElse((doc$1) => Effect.succeed(doc$1)));
-		if (!verifyTOTPWithGracePeriod(new Uint8Array(totpDoc.secret), totpDoc.period, totpDoc.digits, code, 30)) return yield* Effect.fail(convexError("TOTP_INVALID_CODE", "Invalid TOTP code."));
-		return {
-			kind: "signedIn",
-			signedIn: yield* Effect.tryPromise({
-				try: async () => {
-					await mutateTotpUpdateLastUsed(ctx, totpDoc._id, Date.now());
-					await mutateVerifierDelete(ctx, verifier);
-					return callSignIn(ctx, {
-						userId,
-						generateTokens: true
-					});
-				},
-				catch: (error) => asConvexError(error, "INTERNAL_ERROR", String(error))
-			})
-		};
-	})), Match.exhaustive));
+				});
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`);
+			}
+			return {
+				kind: "totpSetup",
+				uri,
+				secret: base32Secret,
+				verifier,
+				totpId
+			};
+		},
+		confirm: async () => {
+			const { code, totpId, verifier } = dispatch;
+			const userId = await requireAuthenticatedUserId(ctx);
+			let doc;
+			try {
+				doc = await queryTotpById(ctx, totpId);
+			} catch {
+				throw convexError("TOTP_NOT_FOUND", "TOTP enrollment not found.");
+			}
+			if (doc === null) throw convexError("TOTP_NOT_FOUND", "TOTP enrollment not found.");
+			if (doc.verified) throw convexError("TOTP_ALREADY_VERIFIED", "TOTP enrollment is already verified.");
+			if (!verifyTOTPWithGracePeriod(new Uint8Array(doc.secret), provider.options.period, provider.options.digits, code, 30)) throw convexError("TOTP_INVALID_CODE", "Invalid TOTP code.");
+			let signInResult;
+			try {
+				await mutateTotpMarkVerified(ctx, totpId, Date.now());
+				await mutateVerifierDelete(ctx, verifier);
+				signInResult = await callSignIn(ctx, {
+					userId,
+					generateTokens: true
+				});
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", String(error));
+			}
+			return {
+				kind: "signedIn",
+				signedIn: signInResult
+			};
+		},
+		verify: async () => {
+			const { code, verifier } = dispatch;
+			let doc;
+			try {
+				doc = await queryVerifierById(ctx, verifier);
+			} catch {
+				throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
+			}
+			if (doc === null) throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
+			const userId = JSON.parse(doc.signature).userId;
+			let totp;
+			try {
+				totp = await queryTotpVerifiedByUserId(ctx, userId);
+			} catch {
+				throw convexError("TOTP_NO_ENROLLMENT", "No verified TOTP enrollment found.");
+			}
+			if (totp === null) throw convexError("TOTP_NO_ENROLLMENT", "No verified TOTP enrollment found.");
+			if (!verifyTOTPWithGracePeriod(new Uint8Array(totp.secret), totp.period, totp.digits, code, 30)) throw convexError("TOTP_INVALID_CODE", "Invalid TOTP code.");
+			let signInResult;
+			try {
+				await mutateTotpUpdateLastUsed(ctx, totp._id, Date.now());
+				await mutateVerifierDelete(ctx, verifier);
+				signInResult = await callSignIn(ctx, {
+					userId,
+					generateTokens: true
+				});
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", String(error));
+			}
+			return {
+				kind: "signedIn",
+				signedIn: signInResult
+			};
+		}
+	}[dispatch.flow];
+	if (!handler) throw convexError("TOTP_MISSING_FLOW", `Unknown TOTP flow: ${dispatch.flow}`);
+	return handler();
 };
 
 //#endregion

package/dist/server/types.d.ts

@@ -2,7 +2,7 @@ import { vApiKeyDoc } from "../component/model.js";
 import { _default } from "../component/schema.js";
 import { CredentialsConfig } from "../providers/credentials.js";
 import { GenericId, Infer, Value } from "convex/values";
-import { AnyDataModel, DataModelFromSchemaDefinition, DocumentByName, FunctionReference, GenericActionCtx, GenericDataModel, GenericMutationCtx, TableNamesInDataModel } from "convex/server";
+import { AnyDataModel, DataModelFromSchemaDefinition, DocumentByName, FunctionReference, GenericActionCtx, GenericDataModel, GenericMutationCtx, GenericQueryCtx, TableNamesInDataModel } from "convex/server";
 
 //#region src/server/types.d.ts
 /**
@@ -1157,5 +1157,5 @@ type AuthDataModel = DataModelFromSchemaDefinition<typeof _default>;
 type Doc<T extends TableNamesInDataModel<AuthDataModel>> = GenericDoc<AuthDataModel, T>;
 type KeyDoc = Infer<typeof vApiKeyDoc>;
 //#endregion
-export { AuthAuthorizationConfig, AuthGrant, AuthProviderConfig, AuthRoleId, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, GenericActionCtxWithAuthConfig, GroupConnectionDeprovisionMode, GroupConnectionPolicy, GroupConnectionPolicyPatch, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider, HttpKeyContext, KeyDoc, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PasskeyProviderConfig, PhoneConfig, SSOProviderConfig, ScopeChecker, TotpProviderConfig, UserOrderBy, UserWhere };
+export { AuthAuthorizationConfig, AuthGrant, AuthProviderConfig, AuthRoleId, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, GenericActionCtxWithAuthConfig, GenericDoc, GroupConnectionDeprovisionMode, GroupConnectionPolicy, GroupConnectionPolicyPatch, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider, HttpKeyContext, KeyDoc, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PasskeyProviderConfig, PhoneConfig, PhoneUserConfig, SSOProviderConfig, ScopeChecker, TotpProviderConfig, UserOrderBy, UserWhere };
 //# sourceMappingURL=types.d.ts.map

package/dist/server/users.js

@@ -2,7 +2,6 @@ import { LOG_LEVELS } from "../shared/log.js";
 import { authDb } from "./db.js";
 import { log } from "./log.js";
 import { ConvexError } from "convex/values";
-import { Effect, Match } from "effect";
 
 //#region src/server/users.ts
 function mergeExtend(existing, incoming) {
@@ -64,24 +63,19 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 	if (existingUserId === null) {
 		const existingUserWithVerifiedEmailId = typeof profile.email === "string" && shouldLinkViaEmail ? (await uniqueUserWithVerifiedEmail(ctx, profile.email, config))?._id ?? null : null;
 		const existingUserWithVerifiedPhoneId = typeof profile.phone === "string" && shouldLinkViaPhone ? (await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))?._id ?? null : null;
-		const linkDispatch = {
-			tag: existingUserWithVerifiedEmailId !== null && existingUserWithVerifiedPhoneId !== null ? "both" : existingUserWithVerifiedEmailId !== null ? "email" : existingUserWithVerifiedPhoneId !== null ? "phone" : "none",
-			existingUserWithVerifiedEmailId,
-			existingUserWithVerifiedPhoneId
-		};
-		userId = await Effect.runPromise(Match.value(linkDispatch).pipe(Match.when({ tag: "both" }, ({ existingUserWithVerifiedEmailId: existingUserWithVerifiedEmailId$1, existingUserWithVerifiedPhoneId: existingUserWithVerifiedPhoneId$1 }) => Effect.sync(() => {
-			log(LOG_LEVELS.DEBUG, `Found existing email and phone verified users, so not linking: email: ${existingUserWithVerifiedEmailId$1}, phone: ${existingUserWithVerifiedPhoneId$1}`);
-			return null;
-		})), Match.when({ tag: "email" }, ({ existingUserWithVerifiedEmailId: existingUserWithVerifiedEmailId$1 }) => Effect.sync(() => {
-			log(LOG_LEVELS.DEBUG, `Found existing email verified user, linking: ${existingUserWithVerifiedEmailId$1}`);
-			return existingUserWithVerifiedEmailId$1;
-		})), Match.when({ tag: "phone" }, ({ existingUserWithVerifiedPhoneId: existingUserWithVerifiedPhoneId$1 }) => Effect.sync(() => {
-			log(LOG_LEVELS.DEBUG, `Found existing phone verified user, linking: ${existingUserWithVerifiedPhoneId$1}`);
-			return existingUserWithVerifiedPhoneId$1;
-		})), Match.when({ tag: "none" }, () => Effect.sync(() => {
+		if (existingUserWithVerifiedEmailId !== null && existingUserWithVerifiedPhoneId !== null) {
+			log(LOG_LEVELS.DEBUG, `Found existing email and phone verified users, so not linking: email: ${existingUserWithVerifiedEmailId}, phone: ${existingUserWithVerifiedPhoneId}`);
+			userId = null;
+		} else if (existingUserWithVerifiedEmailId !== null) {
+			log(LOG_LEVELS.DEBUG, `Found existing email verified user, linking: ${existingUserWithVerifiedEmailId}`);
+			userId = existingUserWithVerifiedEmailId;
+		} else if (existingUserWithVerifiedPhoneId !== null) {
+			log(LOG_LEVELS.DEBUG, `Found existing phone verified user, linking: ${existingUserWithVerifiedPhoneId}`);
+			userId = existingUserWithVerifiedPhoneId;
+		} else {
 			log(LOG_LEVELS.DEBUG, "No existing verified users found, creating new user");
-			return null;
-		})), Match.exhaustive));
+			userId = null;
+		}
 		if (userId !== null && config.sso?.hooks?.allowLink !== void 0 && (args.provider.type === "oauth" || args.provider.type === "sso")) {
 			if (await config.sso.hooks.allowLink({
 				protocol: args.provider.type === "oauth" && typeof args.accountExtend?.identity?.protocol === "string" ? args.accountExtend.identity.protocol : "oidc",
@@ -107,13 +101,14 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 			mode
 		});
 		if (Object.keys(patchData).length === 0) return userId;
-		await Effect.runPromise(Effect.tryPromise({
-			try: () => db.users.patch(currentUserId, patchData),
-			catch: (error) => new ConvexError({
+		try {
+			await db.users.patch(currentUserId, patchData);
+		} catch (error) {
+			throw new ConvexError({
 				code: "USER_UPDATE_FAILED",
 				message: `Could not update user document with ID \`${currentUserId}\`, either the user has been deleted but their account has not, or the profile data doesn't match the \`users\` table schema: ${error instanceof Error ? error.message : String(error)}`
-			})
-		}));
+			});
+		}
 	} else {
 		if (source === "login" && provisioningUser?.createOnSignIn === false) throw new ConvexError({
 			code: "NOT_AUTHORIZED",

package/dist/server/utils/cache.js

@@ -0,0 +1,51 @@
+//#region src/server/utils/cache.ts
+/**
+* Create a synchronous TTL cache.
+*
+* ```ts
+* const jwksCache = createCache({
+*   capacity: 128,
+*   timeToLiveMs: 60 * 60 * 1000,
+*   lookup: (url) => createRemoteJWKSet(new URL(url)),
+* });
+* const jwks = jwksCache.get(url);
+* ```
+*/
+function createCache(opts) {
+	const { capacity, timeToLiveMs, lookup } = opts;
+	const store = /* @__PURE__ */ new Map();
+	function evictExpired() {
+		const now = Date.now();
+		for (const [key, entry] of store) if (entry.expiresAt <= now) store.delete(key);
+	}
+	function evictOldest() {
+		if (store.size < capacity) return;
+		const firstKey = store.keys().next().value;
+		if (firstKey !== void 0) store.delete(firstKey);
+	}
+	return {
+		get(key) {
+			const existing = store.get(key);
+			if (existing && existing.expiresAt > Date.now()) return existing.value;
+			if (existing) store.delete(key);
+			evictExpired();
+			evictOldest();
+			const value = lookup(key);
+			store.set(key, {
+				value,
+				expiresAt: Date.now() + timeToLiveMs
+			});
+			return value;
+		},
+		invalidate(key) {
+			store.delete(key);
+		},
+		clear() {
+			store.clear();
+		}
+	};
+}
+
+//#endregion
+export { createCache };
+//# sourceMappingURL=cache.js.map

package/dist/server/utils/dispatch.js

@@ -0,0 +1,36 @@
+//#region src/server/utils/dispatch.ts
+/**
+* Build a dispatch function from a handler record.
+*
+* ```ts
+* const run = createDispatch({
+*   signIn:  (args) => handleSignIn(args),
+*   signOut: (args) => handleSignOut(args),
+* });
+* return await run("signIn", args);
+* ```
+*/
+function createDispatch(handlers) {
+	const map = new Map(Object.entries(handlers));
+	return ((key, ...args) => {
+		const handler = map.get(key);
+		if (!handler) throw new Error(`Unknown dispatch key: "${key}"`);
+		return handler(...args);
+	});
+}
+/**
+* Compose multiple dispatch tables into one.
+*
+* ```ts
+* const dispatch = composeDispatch(coreHandlers, ssoHandlers);
+* ```
+*/
+function composeDispatch(a, b) {
+	return {
+		...a,
+		...b
+	};
+}
+
+//#endregion
+export { composeDispatch, createDispatch };

package/dist/server/utils/retry.js

@@ -0,0 +1,24 @@
+//#region src/server/utils/retry.ts
+/**
+* Retry `fn` with exponential backoff until it succeeds or retries are
+* exhausted. On final failure the last error is re-thrown.
+*/
+async function retryWithBackoff(fn, opts = {}) {
+	const { maxRetries = 2, baseMs = 200, jitter = true } = opts;
+	let lastError;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await fn();
+	} catch (error) {
+		lastError = error;
+		if (attempt < maxRetries) {
+			const delay = baseMs * 2 ** attempt;
+			const jitterMs = jitter ? Math.random() * delay : 0;
+			await new Promise((resolve) => setTimeout(resolve, delay + jitterMs));
+		}
+	}
+	throw lastError;
+}
+
+//#endregion
+export { retryWithBackoff };
+//# sourceMappingURL=retry.js.map

package/dist/server/utils/span.js

@@ -0,0 +1,32 @@
+import { SpanStatusCode, trace } from "@opentelemetry/api";
+
+//#region src/server/utils/span.ts
+/**
+* Thin wrapper around `@opentelemetry/api` tracing.
+*
+* @module
+*/
+const tracer = trace.getTracer("convex-auth");
+/**
+* Run `fn` inside an OpenTelemetry span.
+*
+* If `fn` throws, the span is marked as errored and the exception is
+* recorded before re-throwing.
+*/
+async function withSpan(name, attributes, fn) {
+	return tracer.startActiveSpan(name, { attributes }, async (span) => {
+		try {
+			return await fn();
+		} catch (error) {
+			span.setStatus({ code: SpanStatusCode.ERROR });
+			if (error instanceof Error) span.recordException(error);
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+
+//#endregion
+export { withSpan };
+//# sourceMappingURL=span.js.map

package/dist/shared/errors.js

@@ -1,7 +1,13 @@
-import { Data } from "effect";
-
 //#region src/shared/errors.ts
-var AuthFlowError = class extends Data.TaggedError("AuthFlowError") {};
+var AuthFlowError = class extends Error {
+	_tag = "AuthFlowError";
+	code;
+	constructor({ code, message }) {
+		super(message);
+		this.code = code;
+		this.name = "AuthFlowError";
+	}
+};
 /** @internal */
 const authFlowError = (code, message) => new AuthFlowError({
 	code,

package/dist/shared/log.js

@@ -1,5 +1,3 @@
-import { Cause, Effect, Match } from "effect";
-
 //#region src/shared/log.ts
 const LOG_LEVELS = {
 	ERROR: "ERROR",
@@ -18,28 +16,28 @@ function serialize(value) {
 }
 function logMessage(module, level, args, configuredLogLevel = "INFO") {
 	const message = args.map(serialize).join(" ");
-	return Match.value(level).pipe(Match.when("ERROR", () => Effect.runSync(Effect.logError(message).pipe(Effect.annotateLogs({
+	const meta = {
 		module,
 		level
-	})))), Match.when("WARN", () => {
-		if (configuredLogLevel === "ERROR") return;
-		return Effect.runSync(Effect.logWarning(message).pipe(Effect.annotateLogs({
-			module,
-			level
-		})));
-	}), Match.when("INFO", () => {
-		if (configuredLogLevel !== "INFO" && configuredLogLevel !== "DEBUG") return;
-		return Effect.runSync(Effect.logInfo(message).pipe(Effect.annotateLogs({
-			module,
-			level
-		})));
-	}), Match.when("DEBUG", () => {
-		if (configuredLogLevel !== "DEBUG") return;
-		return Effect.runSync(Effect.logDebug(message).pipe(Effect.annotateLogs({
-			module,
-			level
-		})));
-	}), Match.exhaustive);
+	};
+	const handler = {
+		ERROR: () => {
+			console.error(`[${meta.module}] [${meta.level}]`, message);
+		},
+		WARN: () => {
+			if (configuredLogLevel === "ERROR") return;
+			console.warn(`[${meta.module}] [${meta.level}]`, message);
+		},
+		INFO: () => {
+			if (configuredLogLevel !== "INFO" && configuredLogLevel !== "DEBUG") return;
+			console.info(`[${meta.module}] [${meta.level}]`, message);
+		},
+		DEBUG: () => {
+			if (configuredLogLevel !== "DEBUG") return;
+			console.debug(`[${meta.module}] [${meta.level}]`, message);
+		}
+	}[level];
+	if (handler) handler();
 }
 
 //#endregion