@robelest/convex-auth 0.0.4-preview.28 → 0.0.4-preview.29

package/dist/server/mutations/credentialsSignIn.js

@@ -0,0 +1,114 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { verify } from "../crypto.js";
+import { authDb } from "../db.js";
+import { log, maybeRedact } from "../log.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { withSpan } from "../utils/span.js";
+import { issueSession } from "../sessions.js";
+import { getSignInRateLimitState, isStateRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/credentialsSignIn.ts
+const credentialsSignInArgs = v.object({
+	provider: v.string(),
+	account: v.object({
+		id: v.string(),
+		secret: v.string()
+	}),
+	generateTokens: v.boolean(),
+	requireVerifiedEmail: v.boolean(),
+	enforceTotp: v.boolean()
+});
+async function credentialsSignInImpl(ctx, args, getProviderOrThrow, config) {
+	return withSpan("convex-auth.mutations.credentialsSignIn", {
+		provider: args.provider,
+		generateTokens: args.generateTokens
+	}, () => credentialsSignInInner(ctx, args, getProviderOrThrow, config));
+}
+async function credentialsSignInInner(ctx, args, getProviderOrThrow, config) {
+	const { provider: providerId, account, generateTokens, requireVerifiedEmail, enforceTotp } = args;
+	const db = authDb(ctx, config);
+	log(LOG_LEVELS.DEBUG, "credentialsSignInImpl args:", {
+		provider: providerId,
+		account: {
+			id: account.id,
+			secret: maybeRedact(account.secret)
+		},
+		generateTokens,
+		requireVerifiedEmail,
+		enforceTotp
+	});
+	const existingAccount = await db.accounts.get(providerId, account.id);
+	if (existingAccount === null) return { kind: "invalidAccount" };
+	const [user, rateLimitState] = await Promise.all([db.users.getById(existingAccount.userId), getSignInRateLimitState(ctx, existingAccount._id, config)]);
+	if (user === null) {
+		log(LOG_LEVELS.ERROR, `Account ${existingAccount._id} links to missing user ${existingAccount.userId}`);
+		return { kind: "invalidAccount" };
+	}
+	if (isStateRateLimited(rateLimitState)) return { kind: "tooManyAttempts" };
+	if (!await withSpan("convex-auth.credentials.verify", { providerId }, () => verify(getProviderOrThrow(providerId), account.secret, existingAccount.secret ?? ""))) {
+		await recordFailedSignIn(ctx, existingAccount._id, config, rateLimitState);
+		return { kind: "invalidSecret" };
+	}
+	if (requireVerifiedEmail && !existingAccount.emailVerified) {
+		await resetSignInRateLimit(ctx, existingAccount._id, config, rateLimitState);
+		return {
+			kind: "emailVerificationRequired",
+			account: {
+				_id: existingAccount._id,
+				emailVerified: existingAccount.emailVerified
+			},
+			user: {
+				_id: user._id,
+				email: user.email
+			}
+		};
+	}
+	let hasTotp = user.hasTotp;
+	if (enforceTotp && hasTotp === void 0) {
+		const memberResolveRef = config.component.public["totpGetVerifiedByUserId"];
+		hasTotp = await ctx.runQuery(memberResolveRef, { userId: existingAccount.userId }) !== null;
+		await db.users.patch(existingAccount.userId, { hasTotp });
+	}
+	const totpRequired = enforceTotp && hasTotp === true;
+	const [issuance] = await Promise.all([issueSession(ctx, config, {
+		userId: existingAccount.userId,
+		generateTokens: generateTokens && !totpRequired
+	}), resetSignInRateLimit(ctx, existingAccount._id, config, rateLimitState)]);
+	if (totpRequired) return {
+		kind: "totpRequired",
+		issuance,
+		account: {
+			_id: existingAccount._id,
+			emailVerified: existingAccount.emailVerified
+		},
+		user: {
+			_id: user._id,
+			email: user.email
+		}
+	};
+	return {
+		kind: "signedIn",
+		issuance,
+		account: {
+			_id: existingAccount._id,
+			emailVerified: existingAccount.emailVerified
+		},
+		user: {
+			_id: user._id,
+			email: user.email,
+			hasTotp
+		}
+	};
+}
+/** @internal */
+const callCredentialsSignIn = async (ctx, args) => {
+	return await ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "credentialsSignIn",
+		...args
+	} });
+};
+
+//#endregion
+export { callCredentialsSignIn, credentialsSignInArgs, credentialsSignInImpl };
+//# sourceMappingURL=credentialsSignIn.js.map

package/dist/server/mutations/index.js

@@ -1,5 +1,6 @@
 import { callModifyAccount } from "./account.js";
 import { callCreateVerificationCode } from "./code.js";
+import { callCredentialsSignIn } from "./credentialsSignIn.js";
 import { callInvalidateSessions } from "./invalidate.js";
 import { callUserOAuth } from "./oauth.js";
 import { callRefreshSession } from "./refresh.js";
@@ -12,4 +13,4 @@ import { callVerifier } from "./verifier.js";
 import { callVerifyCodeAndSignIn } from "./verify.js";
 import { storeArgs, storeImpl } from "./store.js";
 
-export { callCreateAccountFromCredentials, callCreateVerificationCode, callInvalidateSessions, callModifyAccount, callRefreshSession, callRetrieveAccountWithCredentials, callSignIn, callSignOut, callUserOAuth, callVerifier, callVerifierSignature, callVerifyCodeAndSignIn, storeArgs, storeImpl };
+export { callCreateAccountFromCredentials, callCreateVerificationCode, callCredentialsSignIn, callInvalidateSessions, callModifyAccount, callRefreshSession, callRetrieveAccountWithCredentials, callSignIn, callSignOut, callUserOAuth, callVerifier, callVerifierSignature, callVerifyCodeAndSignIn, storeArgs, storeImpl };

package/dist/server/mutations/refresh.js

@@ -1,13 +1,21 @@
 import { authDb } from "../db.js";
 import { log, maybeRedact } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
-import { REFRESH_TOKEN_REUSE_WINDOW_MS, parseRefreshToken, refreshTokenExpirationTime } from "../refresh.js";
-import { generateTokensForSession } from "../sessions.js";
+import { REFRESH_TOKEN_DIVIDER, REFRESH_TOKEN_REUSE_WINDOW_MS, parseRefreshToken, refreshTokenExpirationTime } from "../refresh.js";
 import { withSpan } from "../utils/span.js";
+import { finalizeSessionIssuance } from "../sessions.js";
 import { v } from "convex/values";
 
 //#region src/server/mutations/refresh.ts
 const refreshSessionArgs = v.object({ refreshToken: v.string() });
+/**
+* Exchange a refresh token and mint the next pair of session IDs + refresh
+* token string. The RSA-2048 JWT signing used to live here; it has been
+* moved to the action wrapper ({@link callRefreshSession}) so the mutation
+* can commit without paying 5–30ms of CPU per refresh.
+*
+* @internal
+*/
 async function refreshSessionImpl(ctx, args, config) {
 	const db = authDb(ctx, config);
 	return withSpan("convex-auth.refresh.session", { hasRefreshToken: true }, async () => {
@@ -33,15 +41,11 @@ async function refreshSessionImpl(ctx, args, config) {
 				throw new RefreshFailure("Failed to exchange refresh token");
 			}
 			if (exchanged === null) return null;
-			try {
-				return await generateTokensForSession(config, {
-					userId: exchanged.userId,
-					sessionId: exchanged.sessionId,
-					refreshTokenId: exchanged.refreshTokenId
-				});
-			} catch {
-				throw new RefreshFailure("Failed to generate refresh-session tokens");
-			}
+			return {
+				userId: exchanged.userId,
+				sessionId: exchanged.sessionId,
+				refreshToken: `${exchanged.refreshTokenId}${REFRESH_TOKEN_DIVIDER}${exchanged.sessionId}`
+			};
 		} catch (e) {
 			if (e instanceof RefreshFailure) {
 				log("DEBUG", e.reason);
@@ -57,11 +61,20 @@ var RefreshFailure = class extends Error {
 		this.reason = reason;
 	}
 };
+/**
+* Action-side wrapper: exchange the refresh token via the mutation, then
+* sign the next JWT outside the mutation transaction. See
+* {@link refreshSessionImpl} for the rationale.
+*
+* @internal
+*/
 const callRefreshSession = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
+	const issuance = await ctx.runMutation(AUTH_STORE_REF, { args: {
 		type: "refreshSession",
 		...args
 	} });
+	if (issuance === null || issuance.refreshToken === null) return null;
+	return (await finalizeSessionIssuance(ctx.auth.config, issuance)).tokens;
 };
 
 //#endregion

package/dist/server/mutations/retrieve.js

@@ -3,6 +3,7 @@ import { verify } from "../crypto.js";
 import { authDb } from "../db.js";
 import { log, maybeRedact } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
+import { withSpan } from "../utils/span.js";
 import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
 import { v } from "convex/values";
 
@@ -30,7 +31,7 @@ async function retrieveAccountWithCredentialsImpl(ctx, args, getProviderOrThrow,
 		if (account.secret !== void 0) {
 			const accountSecret = account.secret;
 			if (await isSignInRateLimited(ctx, existingAccount._id, config)) return "TooManyFailedAttempts";
-			if (!await verify(getProviderOrThrow(providerId), accountSecret, existingAccount.secret ?? "")) {
+			if (!await withSpan("convex-auth.credentials.verify", { providerId }, () => verify(getProviderOrThrow(providerId), accountSecret, existingAccount.secret ?? ""))) {
 				await recordFailedSignIn(ctx, existingAccount._id, config);
 				return "InvalidSecret";
 			}

package/dist/server/mutations/signin.js

@@ -1,7 +1,8 @@
 import { LOG_LEVELS } from "../../shared/log.js";
 import { log } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
-import { getAuthSessionId, issueSession } from "../sessions.js";
+import { withSpan } from "../utils/span.js";
+import { finalizeSessionIssuance, getAuthSessionId, issueSession } from "../sessions.js";
 import { v } from "convex/values";
 
 //#region src/server/mutations/signin.ts
@@ -11,20 +12,37 @@ const signInArgs = v.object({
 	generateTokens: v.boolean()
 });
 async function signInImpl(ctx, args, config) {
-	log(LOG_LEVELS.DEBUG, "signInImpl args:", args);
-	const { userId, sessionId: existingSessionId, generateTokens } = args;
-	return await issueSession(ctx, config, {
-		userId,
-		existingSessionId,
-		replaceSessionId: existingSessionId === void 0 ? await getAuthSessionId(ctx) ?? void 0 : void 0,
-		generateTokens
+	return withSpan("convex-auth.mutations.signIn", {
+		hasExistingSession: args.sessionId !== void 0,
+		generateTokens: args.generateTokens
+	}, async () => {
+		log(LOG_LEVELS.DEBUG, "signInImpl args:", args);
+		const { userId, sessionId: existingSessionId, generateTokens } = args;
+		return await issueSession(ctx, config, {
+			userId,
+			existingSessionId,
+			replaceSessionId: existingSessionId === void 0 ? await getAuthSessionId(ctx) ?? void 0 : void 0,
+			generateTokens
+		});
 	});
 }
+/**
+* Run the sign-in mutation, then sign the JWT on the action side.
+*
+* Splitting the work like this keeps the 5–30ms of RSA-2048 CPU out of the
+* mutation transaction so the mutation can commit quickly even on a cold
+* worker. The refresh-token string itself is cheap to compute and stays
+* inside the mutation (returned on the {@link SessionIssuance}); only the
+* JWT signing moves here.
+*
+* @internal
+*/
 const callSignIn = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
+	const issuance = await ctx.runMutation(AUTH_STORE_REF, { args: {
 		type: "signIn",
 		...args
 	} });
+	return await finalizeSessionIssuance(ctx.auth.config, issuance);
 };
 
 //#endregion

package/dist/server/mutations/store.js

@@ -2,6 +2,7 @@ import { LOG_LEVELS } from "../../shared/log.js";
 import { log } from "../log.js";
 import { modifyAccountArgs, modifyAccountImpl } from "./account.js";
 import { createVerificationCodeArgs, createVerificationCodeImpl } from "./code.js";
+import { credentialsSignInArgs, credentialsSignInImpl } from "./credentialsSignIn.js";
 import { invalidateSessionsArgs, invalidateSessionsImpl } from "./invalidate.js";
 import { userOAuthArgs, userOAuthImpl } from "./oauth.js";
 import { refreshSessionArgs } from "./refresh.js";
@@ -42,6 +43,9 @@ const storeArgs = v.object({ args: v.union(v.object({
 }), v.object({
 	type: v.literal("retrieveAccountWithCredentials"),
 	...retrieveAccountWithCredentialsArgs.fields
+}), v.object({
+	type: v.literal("credentialsSignIn"),
+	...credentialsSignInArgs.fields
 }), v.object({
 	type: v.literal("modifyAccount"),
 	...modifyAccountArgs.fields
@@ -65,6 +69,7 @@ const storeImpl = async (ctx, fnArgs, services) => {
 		createVerificationCode: (a) => createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
 		createAccountFromCredentials: (a) => createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),
 		retrieveAccountWithCredentials: (a) => retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
+		credentialsSignIn: (a) => credentialsSignInImpl(ctx, a, getProviderOrThrow, config),
 		modifyAccount: (a) => modifyAccountImpl(ctx, a, getProviderOrThrow, config),
 		invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config)
 	}[args.type];

package/dist/server/mutations/verify.js

@@ -4,12 +4,13 @@ import { authDb } from "../db.js";
 import { requireEnv } from "../env.js";
 import { log } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
-import { getAuthSessionId, issueSession } from "../sessions.js";
+import { withSpan } from "../utils/span.js";
+import { finalizeSessionIssuance, getAuthSessionId, issueSession } from "../sessions.js";
 import { upsertUserAndAccount } from "../users.js";
+import { getSignInRateLimitState, isStateRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
 import { payloadRecordValidator } from "../payloads.js";
 import { isGroupProviderId } from "../sso/shared.js";
 import { createSyntheticOAuthMaterializedConfig } from "../sso/oidc.js";
-import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
 import { v } from "convex/values";
 
 //#region src/server/mutations/verify.ts
@@ -21,9 +22,17 @@ const verifyCodeAndSignInArgs = v.object({
 	allowExtraProviders: v.boolean()
 });
 async function verifyCodeAndSignInImpl(ctx, args, getProviderOrThrow, config) {
+	return withSpan("convex-auth.mutations.verifyCodeAndSignIn", {
+		provider: args.provider ?? "",
+		generateTokens: args.generateTokens
+	}, () => verifyCodeAndSignInImplInner(ctx, args, getProviderOrThrow, config));
+}
+async function verifyCodeAndSignInImplInner(ctx, args, getProviderOrThrow, config) {
 	const params = args.params;
 	const { generateTokens, provider, allowExtraProviders } = args;
 	const identifier = typeof params.email === "string" ? params.email : typeof params.phone === "string" ? params.phone : void 0;
+	let rateLimitState = null;
+	let rateLimitLoaded = false;
 	try {
 		log(LOG_LEVELS.DEBUG, "verifyCodeAndSignInImpl args:", {
 			params: {
@@ -41,7 +50,9 @@ async function verifyCodeAndSignInImpl(ctx, args, getProviderOrThrow, config) {
 			requireEnv("CONVEX_SITE_URL");
 		}
 		if (identifier !== void 0) {
-			if (await isSignInRateLimited(ctx, identifier, config)) throw new VerifyFailure("Too many failed attempts to verify code for this email");
+			rateLimitState = await getSignInRateLimitState(ctx, identifier, config);
+			rateLimitLoaded = true;
+			if (isStateRateLimited(rateLimitState)) throw new VerifyFailure("Too many failed attempts to verify code for this email");
 		}
 		const db = authDb(ctx, config);
 		const verifier = args.verifier;
@@ -50,7 +61,6 @@ async function verifyCodeAndSignInImpl(ctx, args, getProviderOrThrow, config) {
 		const hash = await sha256(codeValue);
 		const code = await db.verificationCodes.getByCode(hash);
 		if (code === null) throw new VerifyFailure("Invalid verification code");
-		await db.verificationCodes.delete(code._id);
 		if (code.verifier !== verifier) throw new VerifyFailure("Invalid verifier");
 		if (code.expirationTime < Date.now()) throw new VerifyFailure("Expired verification code");
 		if (provider !== void 0 && code.provider !== provider) throw new VerifyFailure(`Invalid provider "${provider}" for given \`code\``);
@@ -73,16 +83,20 @@ async function verifyCodeAndSignInImpl(ctx, args, getProviderOrThrow, config) {
 				} : {}
 			}
 		}, config)).userId;
-		if (identifier !== void 0) await resetSignInRateLimit(ctx, identifier, config);
+		const [, , replaceSessionId] = await Promise.all([
+			db.verificationCodes.delete(code._id),
+			identifier !== void 0 ? resetSignInRateLimit(ctx, identifier, config, rateLimitState) : Promise.resolve(),
+			getAuthSessionId(ctx)
+		]);
 		return await issueSession(ctx, config, {
 			userId,
-			replaceSessionId: await getAuthSessionId(ctx) ?? void 0,
+			replaceSessionId: replaceSessionId ?? void 0,
 			generateTokens
 		});
 	} catch (error) {
 		if (error instanceof VerifyFailure) {
 			log(LOG_LEVELS.ERROR, error.reason);
-			if (identifier !== void 0) await recordFailedSignIn(ctx, identifier, config);
+			if (identifier !== void 0) await recordFailedSignIn(ctx, identifier, config, rateLimitLoaded ? rateLimitState : void 0);
 			return null;
 		}
 		throw error;
@@ -98,11 +112,21 @@ var VerifyFailure = class extends Error {
 		this.name = "VerifyFailure";
 	}
 };
+/**
+* Run the verify-code-and-sign-in mutation, then sign the JWT on the action
+* side. See {@link callSignIn} for the rationale — the mutation returns
+* `SessionIssuance` (cheap string-encoded refresh token + IDs), and this
+* wrapper does the RSA-2048 work outside the mutation transaction.
+*
+* @internal
+*/
 const callVerifyCodeAndSignIn = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
+	const issuance = await ctx.runMutation(AUTH_STORE_REF, { args: {
 		type: "verifyCodeAndSignIn",
 		...args
 	} });
+	if (issuance === null) return null;
+	return await finalizeSessionIssuance(ctx.auth.config, issuance);
 };
 
 //#endregion

package/dist/server/runtime.d.ts

@@ -1,10 +1,10 @@
 import { ComponentCtx, ComponentReadCtx } from "./componentContext.js";
-import { AuthProviderConfig, ConvexAuthConfig, CorsConfig, HttpKeyContext, KeyDoc, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "./types.js";
+import { AuthProviderConfig, ConvexAuthConfig, CorsConfig, Doc, HttpKeyContext, KeyDoc, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "./types.js";
 import { AuthProfile, SignInParams } from "./payloads.js";
 import { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext } from "./http.js";
 import { createGroupConnectionDomain } from "./sso/domain.js";
-import * as convex_values1133 from "convex/values";
-import * as convex_server106 from "convex/server";
+import * as convex_values1137 from "convex/values";
+import * as convex_server108 from "convex/server";
 import { GenericActionCtx, GenericDataModel, HttpRouter } from "convex/server";
 
 //#region src/server/runtime.d.ts
@@ -32,7 +32,10 @@ declare function Auth(config_: ConvexAuthConfig): {
    */
   auth: {
     user: {
-      get: (ctx: ComponentReadCtx, userId: string) => Promise<any>;
+      get: {
+        (ctx: ComponentReadCtx, userId: string): Promise<Doc<"User"> | null>;
+        (ctx: ComponentReadCtx, userIds: readonly string[]): Promise<Array<Doc<"User"> | null>>;
+      };
       list: (ctx: ComponentReadCtx, opts?: {
         where?: UserWhere;
         limit?: number;
@@ -41,8 +44,8 @@ declare function Auth(config_: ConvexAuthConfig): {
         order?: "asc" | "desc";
       }) => Promise<any>;
       viewer: (ctx: ComponentReadCtx & {
-        auth: convex_server106.Auth;
-      }) => Promise<any>;
+        auth: convex_server108.Auth;
+      }) => Promise<Doc<"User"> | null>;
       update: (ctx: ComponentCtx, userId: string, data: Record<string, unknown>) => Promise<{
         userId: string;
       }>;
@@ -67,14 +70,17 @@ declare function Auth(config_: ConvexAuthConfig): {
     };
     session: {
       current: (ctx: {
-        auth: convex_server106.Auth;
-      }) => Promise<convex_values1133.GenericId<"Session"> | null>;
+        auth: convex_server108.Auth;
+      }) => Promise<convex_values1137.GenericId<"Session"> | null>;
+      userId: (ctx: {
+        auth: convex_server108.Auth;
+      }) => Promise<convex_values1137.GenericId<"User"> | null>;
       invalidate: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: {
-        userId: convex_values1133.GenericId<"User">;
-        except?: convex_values1133.GenericId<"Session">[];
+        userId: convex_values1137.GenericId<"User">;
+        except?: convex_values1137.GenericId<"Session">[];
       }) => Promise<{
-        userId: convex_values1133.GenericId<"User">;
-        except: convex_values1133.GenericId<"Session">[];
+        userId: convex_values1137.GenericId<"User">;
+        except: convex_values1137.GenericId<"Session">[];
       }>;
       get: (ctx: ComponentReadCtx, sessionId: string) => Promise<any>;
       list: (ctx: ComponentReadCtx, opts: {
@@ -143,7 +149,7 @@ declare function Auth(config_: ConvexAuthConfig): {
     };
     provider: {
       signIn: (<DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, providerConfig: AuthProviderConfig, args: {
-        accountId?: convex_values1133.GenericId<"Account">;
+        accountId?: convex_values1137.GenericId<"Account">;
         params?: SignInParams;
       }) => Promise<{
         userId: string;
@@ -164,7 +170,10 @@ declare function Auth(config_: ConvexAuthConfig): {
       }) => Promise<{
         groupId: string;
       }>;
-      get: (ctx: ComponentReadCtx, groupId: string) => Promise<any>;
+      get: {
+        (ctx: ComponentReadCtx, groupId: string): Promise<Doc<"Group"> | null>;
+        (ctx: ComponentReadCtx, groupIds: readonly string[]): Promise<Array<Doc<"Group"> | null>>;
+      };
       list: (ctx: ComponentReadCtx, opts?: {
         where?: {
           slug?: string;
@@ -197,7 +206,7 @@ declare function Auth(config_: ConvexAuthConfig): {
         maxDepth?: number;
         includeSelf?: boolean;
       }) => Promise<{
-        ancestors: Record<string, unknown>[];
+        ancestors: Array<Exclude<Doc<"Group"> | null, null>>;
         cycleDetected: boolean;
         maxDepthReached: boolean;
       }>;
@@ -231,29 +240,44 @@ declare function Auth(config_: ConvexAuthConfig): {
       update: (ctx: ComponentCtx, memberId: string, data: Record<string, unknown>) => Promise<{
         memberId: string;
       }>;
-      inspect: (ctx: ComponentReadCtx, opts: {
-        userId: string;
-        groupId: string;
-        ancestry?: boolean;
-        maxDepth?: number;
-      }) => Promise<{
-        membership: null;
-        roleIds: string[];
-        grants: string[];
-      } | {
-        membership: {
-          _id: string;
-          _creationTime: number;
+      inspect: {
+        (ctx: ComponentReadCtx, opts: {
+          userId: string;
           groupId: string;
+          ancestry?: boolean;
+          maxDepth?: number;
+        }): Promise<{
+          membership: {
+            _id: string;
+            _creationTime: number;
+            groupId: string;
+            userId: string;
+            role?: string;
+            roleIds?: string[];
+            status?: string;
+            extend?: Record<string, unknown>;
+          } | null;
+          roleIds: string[];
+          grants: string[];
+        }>;
+        (ctx: ComponentReadCtx, opts: {
           userId: string;
-          role?: string;
-          roleIds?: string[];
-          status?: string;
-          extend?: Record<string, unknown>;
-        };
-        roleIds: string[];
-        grants: string[];
-      }>;
+          groupIds: readonly string[];
+        }): Promise<Array<{
+          membership: {
+            _id: string;
+            _creationTime: number;
+            groupId: string;
+            userId: string;
+            role?: string;
+            roleIds?: string[];
+            status?: string;
+            extend?: Record<string, unknown>;
+          } | null;
+          roleIds: string[];
+          grants: string[];
+        }>>;
+      };
       require: (ctx: ComponentReadCtx, opts: {
         userId: string;
         groupId: string;
@@ -271,7 +295,7 @@ declare function Auth(config_: ConvexAuthConfig): {
           roleIds?: string[];
           status?: string;
           extend?: Record<string, unknown>;
-        };
+        } | null;
         roleIds: string[];
         grants: string[];
       }>;
@@ -433,22 +457,22 @@ declare function Auth(config_: ConvexAuthConfig): {
       context: {
         <TResolve extends Record<string, unknown> = Record<string, never>, TCtx extends {
           auth: {
-            getUserIdentity: () => Promise<convex_server106.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server108.UserIdentity | null>;
           };
         } & ComponentReadCtx = {
           auth: {
-            getUserIdentity: () => Promise<convex_server106.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server108.UserIdentity | null>;
           };
         } & ComponentReadCtx>(ctx: TCtx, request: Request, config: HttpAuthContextConfig<TResolve, TCtx> & {
           optional: true;
         }): Promise<OptionalHttpAuthContext & TResolve>;
         <TResolve extends Record<string, unknown> = Record<string, never>, TCtx extends {
           auth: {
-            getUserIdentity: () => Promise<convex_server106.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server108.UserIdentity | null>;
           };
         } & ComponentReadCtx = {
           auth: {
-            getUserIdentity: () => Promise<convex_server106.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server108.UserIdentity | null>;
           };
         } & ComponentReadCtx>(ctx: TCtx, request: Request, config?: HttpAuthContextConfig<TResolve, TCtx>): Promise<HttpAuthContext & TResolve>;
       };
@@ -482,7 +506,7 @@ declare function Auth(config_: ConvexAuthConfig): {
           action: string;
         };
         cors?: CorsConfig;
-      }) => convex_server106.PublicHttpAction;
+      }) => convex_server108.PublicHttpAction;
       /**
        * Register a Bearer-authenticated route **and** its OPTIONS preflight
        * in a single call.
@@ -528,7 +552,7 @@ declare function Auth(config_: ConvexAuthConfig): {
    *
    * Also used for refreshing the session.
    */
-  signIn: convex_server106.RegisteredAction<"public", {
+  signIn: convex_server108.RegisteredAction<"public", {
     provider?: string | undefined;
     verifier?: string | undefined;
     params?: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null> | undefined;
@@ -538,12 +562,12 @@ declare function Auth(config_: ConvexAuthConfig): {
   /**
    * Action called by the client to invalidate the current session.
    */
-  signOut: convex_server106.RegisteredAction<"public", {}, Promise<void>>;
+  signOut: convex_server108.RegisteredAction<"public", {}, Promise<void>>;
   /**
    * Internal mutation used by the library to read and write
    * to the database during signin and signout.
    */
-  store: convex_server106.RegisteredMutation<"internal", {
+  store: convex_server108.RegisteredMutation<"internal", {
     args: {
       sessionId?: string | undefined;
       type: "signIn";
@@ -586,11 +610,11 @@ declare function Auth(config_: ConvexAuthConfig): {
           sessionIndex?: string | undefined;
         } | undefined;
       } | undefined;
-      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       type: "userOAuth";
       provider: string;
       providerAccountId: string;
       signature: string;
+      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
     } | {
       email?: string | undefined;
       phone?: string | undefined;
@@ -603,9 +627,9 @@ declare function Auth(config_: ConvexAuthConfig): {
     } | {
       shouldLinkViaEmail?: boolean | undefined;
       shouldLinkViaPhone?: boolean | undefined;
-      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       type: "createAccountFromCredentials";
       provider: string;
+      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       account: {
         secret?: string | undefined;
         id: string;
@@ -617,6 +641,16 @@ declare function Auth(config_: ConvexAuthConfig): {
         secret?: string | undefined;
         id: string;
       };
+    } | {
+      type: "credentialsSignIn";
+      provider: string;
+      generateTokens: boolean;
+      account: {
+        id: string;
+        secret: string;
+      };
+      requireVerifiedEmail: boolean;
+      enforceTotp: boolean;
     } | {
       type: "modifyAccount";
       provider: string;