@robelest/convex-auth 0.0.4-preview.28 → 0.0.4-preview.29

package/dist/server/services/group.js

@@ -17,21 +17,29 @@ function createGroupService(deps) {
 			kind
 		});
 	};
-	const getGroupConnectionOidcConfigWithSecret = async (ctx, connection) => {
+	/**
+	* Core OIDC config resolver. Fires the connection fetch (when only the ID
+	* is known) in parallel with the secret fetch, and decrypts lazily once the
+	* secret is available. All three operations are independent until the final
+	* merge, so doing them sequentially was costing 30–60ms per OIDC lookup.
+	*/
+	const resolveOidcConfigWithSecret = async (ctx, connectionId, preloadedConnection) => {
+		const [connection, secret] = await Promise.all([preloadedConnection !== void 0 ? Promise.resolve(preloadedConnection) : getGroupConnection(ctx, config.component.public, connectionId), getGroupConnectionSecret$1(ctx, connectionId, "oidc_client_secret")]);
+		if (!connection) throw convexError({
+			code: "INVALID_PARAMETERS",
+			message: connectionNotFoundError
+		});
 		const oidc = getOidcConfig(connection.config);
-		const secret = await getGroupConnectionSecret$1(ctx, connection._id, "oidc_client_secret");
-		if (secret) {
-			const decrypted = await decryptSecret(secret.ciphertext);
-			const existingClient = typeof oidc.client === "object" && oidc.client !== null ? oidc.client : {};
-			return {
-				...oidc,
-				client: {
-					...existingClient,
-					secret: decrypted
-				}
-			};
-		}
-		return oidc;
+		if (!secret) return oidc;
+		const decrypted = await decryptSecret(secret.ciphertext);
+		const existingClient = typeof oidc.client === "object" && oidc.client !== null ? oidc.client : {};
+		return {
+			...oidc,
+			client: {
+				...existingClient,
+				secret: decrypted
+			}
+		};
 	};
 	const loadGroupPolicyOrThrow = async (ctx, groupId) => {
 		const group = await getGroup(ctx, config.component.public, groupId);
@@ -84,8 +92,7 @@ function createGroupService(deps) {
 		};
 	};
 	const loadConnectionOidcOrThrow = async (ctx, connectionId) => {
-		const connection = await loadActiveGroupConnectionOrThrow(ctx, connectionId);
-		const oidc = await getGroupConnectionOidcConfigWithSecret(ctx, connection);
+		const [connection, oidc] = await Promise.all([loadActiveGroupConnectionOrThrow(ctx, connectionId), resolveOidcConfigWithSecret(ctx, connectionId)]);
 		if (oidc.enabled !== true) throw convexError({
 			code: "PROVIDER_NOT_CONFIGURED",
 			message: "OIDC is not configured for this connection."

package/dist/server/sessions.d.ts

@@ -0,0 +1,21 @@
+import "./types.js";
+import { GenericId } from "convex/values";
+
+//#region src/server/sessions.d.ts
+/**
+ * Mutation-side session issuance result. The mutation creates the session
+ * and refresh-token rows; JWT signing happens on the action side so the
+ * transaction commits without paying the signing CPU cost.
+ */
+type SessionIssuance = {
+  userId: GenericId<"User">;
+  sessionId: GenericId<"Session">;
+  /**
+   * Encoded refresh token (`${refreshTokenId}|${sessionId}`), or `null` when
+   * the caller opted out of refresh-token issuance (e.g. TOTP step-up).
+   */
+  refreshToken: string | null;
+};
+//#endregion
+export { SessionIssuance };
+//# sourceMappingURL=sessions.d.ts.map

package/dist/server/sessions.js

@@ -3,23 +3,43 @@ import { authDb } from "./db.js";
 import { envOptionalNumber, readConfigSync } from "./env.js";
 import { log, maybeRedact } from "./log.js";
 import { REFRESH_TOKEN_DIVIDER, refreshTokenExpirationTime } from "./refresh.js";
+import { withSpan } from "./utils/span.js";
 import { TOKEN_SUB_CLAIM_DIVIDER, generateToken } from "./tokens.js";
 
 //#region src/server/sessions.ts
 const DEFAULT_SESSION_TOTAL_DURATION_MS = 1e3 * 60 * 60 * 24 * 30;
 const sessionExpirationTime = (config, now = Date.now()) => now + (config.session?.totalDurationMs ?? readConfigSync(envOptionalNumber("AUTH_SESSION_TOTAL_DURATION_MS")) ?? DEFAULT_SESSION_TOTAL_DURATION_MS);
 const encodeRefreshToken = (refreshTokenId, sessionId) => `${refreshTokenId}${REFRESH_TOKEN_DIVIDER}${sessionId}`;
-/** @internal */
-async function maybeGenerateTokensForSession(config, args, generateTokens) {
-	return {
-		userId: args.userId,
-		sessionId: args.sessionId,
-		tokens: generateTokens && args.refreshTokenId !== void 0 ? await generateTokensForSession(config, {
-			userId: args.userId,
-			sessionId: args.sessionId,
-			refreshTokenId: args.refreshTokenId
-		}) : null
-	};
+/**
+* Convert a {@link SessionIssuance} returned from a mutation into the
+* external `SessionInfo` shape by signing the JWT on the action side.
+*
+* Must be called from an action context because `generateToken` performs
+* RSA-2048 JWT signing that would otherwise block the mutation commit.
+*
+* @internal
+*/
+async function finalizeSessionIssuance(config, issuance) {
+	return withSpan("convex-auth.session.finalize", { hasRefreshToken: issuance.refreshToken !== null }, async () => {
+		if (issuance.refreshToken === null) return {
+			userId: issuance.userId,
+			sessionId: issuance.sessionId,
+			tokens: null
+		};
+		const token = await generateToken({
+			userId: issuance.userId,
+			sessionId: issuance.sessionId
+		}, config);
+		log(LOG_LEVELS.DEBUG, `Generated token ${maybeRedact(token)} and refresh token ${maybeRedact(issuance.refreshToken)} for session ${maybeRedact(issuance.sessionId)}`);
+		return {
+			userId: issuance.userId,
+			sessionId: issuance.sessionId,
+			tokens: {
+				token,
+				refreshToken: issuance.refreshToken
+			}
+		};
+	});
 }
 /** @internal */
 async function issueSession(ctx, config, args) {
@@ -30,23 +50,13 @@ async function issueSession(ctx, config, args) {
 		sessionExpirationTime: sessionExpirationTime(config),
 		refreshTokenExpirationTime: args.generateTokens ? refreshTokenExpirationTime(config) : void 0
 	});
-	return await maybeGenerateTokensForSession(config, {
+	const sessionId = issued.sessionId;
+	const refreshTokenId = issued.refreshTokenId;
+	return {
 		userId: issued.userId,
-		sessionId: issued.sessionId,
-		refreshTokenId: issued.refreshTokenId
-	}, args.generateTokens);
-}
-/** @internal */
-async function generateTokensForSession(config, args) {
-	const result = {
-		token: await generateToken({
-			userId: args.userId,
-			sessionId: args.sessionId
-		}, config),
-		refreshToken: encodeRefreshToken(args.refreshTokenId, args.sessionId)
+		sessionId,
+		refreshToken: args.generateTokens && refreshTokenId !== void 0 ? encodeRefreshToken(refreshTokenId, sessionId) : null
 	};
-	log(LOG_LEVELS.DEBUG, `Generated token ${maybeRedact(result.token)} and refresh token ${maybeRedact(args.refreshTokenId)} for session ${maybeRedact(args.sessionId)}`);
-	return result;
 }
 /** @internal */
 async function deleteSession(ctx, session, config) {
@@ -68,5 +78,5 @@ async function getAuthSessionId(ctx) {
 }
 
 //#endregion
-export { deleteSession, generateTokensForSession, getAuthSessionId, issueSession };
+export { deleteSession, finalizeSessionIssuance, getAuthSessionId, issueSession };
 //# sourceMappingURL=sessions.js.map

package/dist/server/signin.js

@@ -1,8 +1,9 @@
 import { generateRandomString } from "./random.js";
 import { envOptionalString, readConfigSync, requireEnv } from "./env.js";
 import { log } from "./log.js";
-import { callCreateVerificationCode } from "./mutations/code.js";
 import { withSpan } from "./utils/span.js";
+import { finalizeSessionIssuance } from "./sessions.js";
+import { callCreateVerificationCode } from "./mutations/code.js";
 import { callRefreshSession } from "./mutations/refresh.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
@@ -178,7 +179,7 @@ async function handleCredentialsFx(ctx, provider, args, options) {
 	return withSpan("convex-auth.signin.credentials", {}, async () => {
 		let result;
 		try {
-			result = await provider.authorize(args.params ?? {}, ctx);
+			result = await withSpan("convex-auth.signin.credentials.authorize", { providerId: provider.id }, () => provider.authorize(args.params ?? {}, ctx));
 		} catch (error) {
 			throw asCredentialsError(error);
 		}
@@ -186,19 +187,27 @@ async function handleCredentialsFx(ctx, provider, args, options) {
 			kind: "signedIn",
 			signedIn: null
 		};
+		const hintedHasTotp = result.hasTotp;
+		const preIssuedIssuance = result.issuance;
 		let hasTotpEnrolled;
-		try {
-			hasTotpEnrolled = await queryTotpVerifiedByUserId(ctx, result.userId) !== null;
+		if (hintedHasTotp === false) hasTotpEnrolled = false;
+		else if (hintedHasTotp === true) hasTotpEnrolled = true;
+		else if (preIssuedIssuance !== void 0 && preIssuedIssuance.refreshToken === null) hasTotpEnrolled = true;
+		else try {
+			hasTotpEnrolled = await withSpan("convex-auth.signin.credentials.totp-check", { hinted: hintedHasTotp ?? "unknown" }, () => queryTotpVerifiedByUserId(ctx, result.userId)) !== null;
 		} catch (error) {
 			throw asConvexError(error, "INTERNAL_ERROR", "Failed to load TOTP enrollment.");
 		}
 		if (hasTotpEnrolled) {
-			try {
-				await callSignIn(ctx, {
+			if (preIssuedIssuance === void 0) try {
+				await withSpan("convex-auth.signin.credentials.issue-session", {
+					generateTokens: false,
+					totpStepUp: true
+				}, () => callSignIn(ctx, {
 					userId: result.userId,
 					sessionId: result.sessionId,
 					generateTokens: false
-				});
+				}));
 			} catch (error) {
 				throw asConvexError(error, "INTERNAL_ERROR", "Failed to start TOTP sign-in.");
 			}
@@ -213,13 +222,27 @@ async function handleCredentialsFx(ctx, provider, args, options) {
 				verifier
 			};
 		}
+		if (preIssuedIssuance !== void 0) try {
+			return {
+				kind: "signedIn",
+				signedIn: await withSpan("convex-auth.signin.credentials.finalize", {
+					generateTokens: options.generateTokens,
+					fromAuthorize: true
+				}, () => finalizeSessionIssuance(ctx.auth.config, {
+					...preIssuedIssuance,
+					refreshToken: options.generateTokens ? preIssuedIssuance.refreshToken : null
+				}))
+			};
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to finalize sign-in.");
+		}
 		let idsAndTokens;
 		try {
-			idsAndTokens = await callSignIn(ctx, {
+			idsAndTokens = await withSpan("convex-auth.signin.credentials.issue-session", { generateTokens: options.generateTokens }, () => callSignIn(ctx, {
 				userId: result.userId,
 				sessionId: result.sessionId,
 				generateTokens: options.generateTokens
-			});
+			}));
 		} catch (error) {
 			throw asConvexError(error, "INTERNAL_ERROR", "Failed to complete sign-in.");
 		}

package/dist/server/sso/domain.js

@@ -184,12 +184,11 @@ function createGroupConnectionDomain(deps) {
 				};
 			},
 			status: async (ctx, connectionId) => {
-				const connection = await getGroupConnection(ctx, config.component.public, connectionId);
+				const [connection, domains] = await Promise.all([getGroupConnection(ctx, config.component.public, connectionId), listConnectionDomains(ctx, config.component.public, connectionId)]);
 				if (connection === null) throw convexError({
 					code: "INVALID_PARAMETERS",
 					message: connectionNotFoundError
 				});
-				const domains = await listConnectionDomains(ctx, config.component.public, connectionId);
 				const primaryDomain = domains.find((domain) => domain.isPrimary) ?? null;
 				const verifiedDomains = domains.filter((domain) => domain.verifiedAt !== void 0);
 				const pendingChallenges = (await Promise.all(domains.map(async (domain) => {

package/dist/server/sso/oidc.js

@@ -1,7 +1,7 @@
 import { log } from "../log.js";
+import { withSpan } from "../utils/span.js";
 import { createCache } from "../utils/cache.js";
 import { retryWithBackoff } from "../utils/retry.js";
-import { withSpan } from "../utils/span.js";
 import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
 import { getGroupOidcUrls, groupOidcProviderId } from "./shared.js";
 import { sha256 } from "@oslojs/crypto/sha2";

package/dist/server/tokens.js

@@ -1,5 +1,6 @@
 import { generateRandomString } from "./random.js";
 import { requireEnv } from "./env.js";
+import { withSpan } from "./utils/span.js";
 import { SignJWT, importPKCS8 } from "jose";
 
 //#region src/server/tokens.ts
@@ -9,19 +10,34 @@ const TOKEN_JTI_LENGTH = 24;
 const TOKEN_JTI_ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
 let cachedPrivateKeyPromise = null;
 let cachedIssuer = null;
+const JWT_ALG = "EdDSA";
 const getPrivateKey = () => {
-	if (cachedPrivateKeyPromise === null) cachedPrivateKeyPromise = importPKCS8(requireEnv("JWT_PRIVATE_KEY"), "RS256");
+	if (cachedPrivateKeyPromise === null) try {
+		cachedPrivateKeyPromise = importPKCS8(requireEnv("JWT_PRIVATE_KEY"), JWT_ALG).catch((error) => {
+			cachedPrivateKeyPromise = null;
+			throw error;
+		});
+	} catch (error) {
+		cachedPrivateKeyPromise = null;
+		throw error;
+	}
 	return cachedPrivateKeyPromise;
 };
 const getIssuer = () => {
 	if (cachedIssuer === null) cachedIssuer = requireEnv("CONVEX_SITE_URL");
 	return cachedIssuer;
 };
+try {
+	getPrivateKey().catch(() => {});
+} catch {}
+try {
+	getIssuer();
+} catch {}
 /** @internal */
 async function generateToken(args, config) {
-	const privateKey = await getPrivateKey();
+	const privateKey = await withSpan("convex-auth.tokens.import-key", { alg: JWT_ALG }, () => getPrivateKey());
 	const expirationTime = new Date(Date.now() + (config.jwt?.durationMs ?? DEFAULT_JWT_DURATION_MS));
-	return await new SignJWT({ sub: args.userId + TOKEN_SUB_CLAIM_DIVIDER + args.sessionId }).setProtectedHeader({ alg: "RS256" }).setIssuedAt().setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET)).setIssuer(getIssuer()).setAudience("convex").setExpirationTime(expirationTime).sign(privateKey);
+	return await withSpan("convex-auth.tokens.sign", { alg: JWT_ALG }, () => new SignJWT({ sub: args.userId + TOKEN_SUB_CLAIM_DIVIDER + args.sessionId }).setProtectedHeader({ alg: JWT_ALG }).setIssuedAt().setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET)).setIssuer(getIssuer()).setAudience("convex").setExpirationTime(expirationTime).sign(privateKey));
 }
 
 //#endregion

package/dist/server/users.js

@@ -61,8 +61,9 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 	const shouldLinkViaPhone = args.shouldLinkViaPhone || phoneVerified || provider.type === "phone";
 	let userId = existingUserId ?? existingUserIdOverride;
 	if (existingUserId === null) {
-		const existingUserWithVerifiedEmailId = typeof profile.email === "string" && shouldLinkViaEmail ? (await uniqueUserWithVerifiedEmail(ctx, profile.email, config))?._id ?? null : null;
-		const existingUserWithVerifiedPhoneId = typeof profile.phone === "string" && shouldLinkViaPhone ? (await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))?._id ?? null : null;
+		const [emailLookup, phoneLookup] = await Promise.all([typeof profile.email === "string" && shouldLinkViaEmail ? uniqueUserWithVerifiedEmail(ctx, profile.email, config) : Promise.resolve(null), typeof profile.phone === "string" && shouldLinkViaPhone ? uniqueUserWithVerifiedPhone(ctx, profile.phone, config) : Promise.resolve(null)]);
+		const existingUserWithVerifiedEmailId = emailLookup?._id ?? null;
+		const existingUserWithVerifiedPhoneId = phoneLookup?._id ?? null;
 		if (existingUserWithVerifiedEmailId !== null && existingUserWithVerifiedPhoneId !== null) {
 			log(LOG_LEVELS.DEBUG, `Found existing email and phone verified users, so not linking: email: ${existingUserWithVerifiedEmailId}, phone: ${existingUserWithVerifiedPhoneId}`);
 			userId = null;

package/dist/server/utils/span.js

@@ -7,13 +7,31 @@ import { SpanStatusCode, trace } from "@opentelemetry/api";
 * @module
 */
 const tracer = trace.getTracer("convex-auth");
+const INVALID_TRACE_ID = "00000000000000000000000000000000";
+const ACTIVE_CHECK_INTERVAL_MS = 5e3;
+let cachedActiveAt = 0;
+let cachedActive = false;
+function isTracingActive() {
+	const now = Date.now();
+	if (now - cachedActiveAt < ACTIVE_CHECK_INTERVAL_MS) return cachedActive;
+	const probe = tracer.startSpan("__convex-auth.probe");
+	const active = probe.isRecording() || probe.spanContext().traceId !== INVALID_TRACE_ID;
+	probe.end();
+	cachedActive = active;
+	cachedActiveAt = now;
+	return active;
+}
 /**
 * Run `fn` inside an OpenTelemetry span.
 *
 * If `fn` throws, the span is marked as errored and the exception is
 * recorded before re-throwing.
+*
+* When no tracer provider is registered, this is a cheap passthrough that
+* skips span creation altogether.
 */
 async function withSpan(name, attributes, fn) {
+	if (!isTracingActive()) return fn();
 	return tracer.startActiveSpan(name, { attributes }, async (span) => {
 		try {
 			return await fn();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robelest/convex-auth",
-  "version": "0.0.4-preview.28",
+  "version": "0.0.4-preview.29",
   "description": "Authentication for Convex",
   "keywords": [
     "auth",

package/README.md

@@ -1,161 +0,0 @@
-# @robelest/convex-auth
-
-Component-first authentication for [Convex](https://convex.dev). One component,
-one setup API, full TypeScript support.
-
-## Features
-
-- **Convex-native setup API** — `createAuth(components.auth, { providers })`
-  gives you everything.
-- **First-party OAuth providers** — Google, GitHub, Apple, and Microsoft with
-  product-owned wrappers and sane defaults.
-- **Fluent Convex builders (recommended)** — cleaner auth-aware API handling
-  with middleware and explicit `.public()` / `.internal()` exports.
-- **Password, passkeys, TOTP, magic links, OTP, phone, anonymous** — all built
-  in.
-- **Device Authorization (RFC 8628)** — authenticate CLIs, smart TVs, and IoT
-  devices.
-- **API keys** — scoped permissions, SHA-256 hashed storage, optional rate
-  limiting.
-- **Groups, memberships, invites** — hierarchical multi-tenancy with roles.
-- **SSR support** — framework-agnostic httpOnly cookie API (SvelteKit, TanStack
-  Start, Next.js).
-- **Context enrichment** — zero-boilerplate `ctx.auth.userId` via `auth.ctx()`.
-
-## Install
-
-```bash
-bun add @robelest/convex-auth
-```
-
-> Renamed package: if you are migrating from earlier previews, replace
-> `@convex-dev/auth` with `@robelest/convex-auth` in imports and CLI commands.
-
-## Quick Start
-
-Before running setup:
-
-- Run from your app project root (must include `package.json`).
-- Make sure a Convex deployment can be resolved. By default the CLI reads a
-  typed `CONVEX_DEPLOYMENT` like `dev:my-deployment` (usually set by
-  `npx convex dev`), or you can pass `--prod`, `--preview-name`,
-  `--deployment-name`, `--url`, or `--admin-key`.
-- Use `--url` for explicit or self-hosted targets. Typed deployment and
-  admin-key parsing only applies to Convex Cloud selections.
-
-```bash
-bunx @robelest/convex-auth
-```
-
-The interactive CLI sets up your Convex component, auth config, and HTTP routes
-in under a minute.
-
-## Manual Setup
-
-```ts
-// convex/convex.config.ts
-import { defineApp } from "convex/server";
-import auth from "@robelest/convex-auth/convex.config";
-
-const app = defineApp();
-app.use(auth);
-export default app;
-```
-
-```ts
-// convex/auth.ts
-import { createAuth } from "@robelest/convex-auth/component";
-import { github } from "@robelest/convex-auth/providers";
-import { components } from "./_generated/api";
-
-const auth = createAuth(components.auth, {
-  providers: [
-    github({
-      clientId: process.env.AUTH_GITHUB_ID!,
-      clientSecret: process.env.AUTH_GITHUB_SECRET!,
-    }),
-  ],
-});
-
-export { auth };
-export const { signIn, signOut, store } = auth;
-```
-
-```ts
-// convex/http.ts
-import { httpRouter } from "convex/server";
-import { auth } from "./auth";
-
-const http = httpRouter();
-auth.http.add(http);
-export default http;
-```
-
-## Recommended Convex API Handling (`fluent-convex`)
-
-For new projects, we recommend `fluent-convex` for auth middleware composition
-and cleaner API exports.
-
-```ts
-// convex/functions.ts
-import { createBuilder } from "fluent-convex";
-import { WithZod } from "fluent-convex/zod";
-import type { DataModel } from "./_generated/dataModel";
-import { auth } from "./auth";
-
-const convex = createBuilder<DataModel>();
-
-// `auth.context(ctx)` resolves { userId, user, groupId, role, grants }
-// and throws before the handler runs when unauthenticated.
-const withRequiredAuth = convex.createMiddleware(async (ctx, next) => {
-  return next({ ...ctx, auth: await auth.context(ctx) });
-});
-
-export const query = convex.query().use(withRequiredAuth).extend(WithZod);
-export const mutation = convex.mutation().use(withRequiredAuth).extend(WithZod);
-```
-
-`auth.ctx()` works with `convex-helpers` and other custom builder setups.
-
-## Providers
-
-| Provider          | Import                                                        |
-| ----------------- | ------------------------------------------------------------- |
-| Google            | `import { google } from "@robelest/convex-auth/providers"`    |
-| GitHub            | `import { github } from "@robelest/convex-auth/providers"`    |
-| Apple             | `import { apple } from "@robelest/convex-auth/providers"`     |
-| Microsoft         | `import { microsoft } from "@robelest/convex-auth/providers"` |
-| Password          | `import { password } from "@robelest/convex-auth/providers"`  |
-| Passkey           | `import { passkey } from "@robelest/convex-auth/providers"`   |
-| TOTP              | `import { totp } from "@robelest/convex-auth/providers"`      |
-| Phone/SMS         | `import { phone } from "@robelest/convex-auth/providers"`     |
-| Anonymous         | `import { anonymous } from "@robelest/convex-auth/providers"` |
-| Device (RFC 8628) | `import { device } from "@robelest/convex-auth/providers"`    |
-| Custom OAuth      | `import { custom } from "@robelest/convex-auth/providers"`    |
-
-OAuth provider-specific setup details live in the docs:
-
-- Google, GitHub, Apple, Microsoft: `/getting-started/providers`
-- Required env vars: `/getting-started/environment`
-
-## Group SSO
-
-The group direction is a headless SDK/API rather than a hosted admin UI.
-
-- `auth.group.sso.*` stores group connection config alongside `auth.group`, with
-  group-level policy owned by `auth.group.sso.policy.*`.
-- Standardized helpers are exposed as `auth.group.sso.connection.*`,
-  `auth.group.sso.connection.domain.*`, `auth.group.sso.oidc.*`,
-  `auth.group.sso.saml.*`, `auth.group.sso.policy.*`,
-  `auth.group.sso.audit.list`, `auth.group.sso.webhook.endpoint.*`,
-  `auth.group.sso.signIn`, `auth.group.sso.metadata`, and
-  `auth.group.sso.scim.configure/get/validate`.
-- Group SSO helpers are server-side primitives. Consumers can build and expose
-  their own Convex RPC wrappers when needed.
-- `auth.group.sso.metadata(...)` uses the local `@robelest/samlify` package to
-  parse IdP metadata and generate SP metadata from the same setup state.
-
-## Documentation
-
-See the full [README](https://github.com/robelest/convex-auth#readme) for
-detailed usage, API reference, SSR integration, and more.