@robelest/convex-auth 0.0.4-preview.30 → 0.0.4-preview.31

package/dist/server/passkey.js

@@ -28,17 +28,20 @@ import { COSEKeyType, ClientDataType, coseAlgorithmES256, coseAlgorithmRS256, cr
 *
 * @module
 */
-const PASSKEY_FLOW = {
-	registerOptions: "registerOptions",
-	registerVerify: "registerVerify",
-	authOptions: "authOptions",
-	authVerify: "authVerify"
-};
+/**
+* Passkey provider has three single-word flows:
+*
+* - `register` — issue a WebAuthn registration challenge (phase 1).
+* - `signIn`   — issue a WebAuthn authentication challenge (phase 1).
+* - `verify`   — consume the WebAuthn response (phase 2). The server
+*                auto-detects whether this completes a registration
+*                (`attestationObject` present) or a sign-in
+*                (`signature` + `credentialId` present).
+*/
 const PASSKEY_FLOWS = [
-	PASSKEY_FLOW.registerOptions,
-	PASSKEY_FLOW.registerVerify,
-	PASSKEY_FLOW.authOptions,
-	PASSKEY_FLOW.authVerify
+	"register",
+	"signIn",
+	"verify"
 ];
 const requireStringParam = (value, name) => {
 	if (typeof value !== "string") throw convexError("INVALID_PARAMETERS", `Missing \`${name}\` parameter.`);
@@ -107,7 +110,7 @@ function verifyUserFlags(authData, rp) {
 function resolvePasskeyDispatch(params) {
 	const flow = params.flow;
 	if (typeof flow === "string" && PASSKEY_FLOWS.includes(flow)) return { flow };
-	throw convexError("PASSKEY_MISSING_FLOW", "Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify");
+	throw convexError("PASSKEY_MISSING_FLOW", "Missing `flow` parameter. Expected one of: " + PASSKEY_FLOWS.join(", "));
 }
 function requirePasskeyVerifier(verifier) {
 	if (verifier != null) return verifier;
@@ -163,8 +166,112 @@ function verifyAssertionSignature(passkey, signature, messageHash) {
 async function handlePasskeyFx(ctx, provider, args) {
 	const params = args.params ?? {};
 	const dispatch = resolvePasskeyDispatch(params);
+	const handleRegisterVerify = async () => {
+		const userId = await requireAuthenticatedUserId(ctx);
+		const rp = resolveRpOptions(provider);
+		const verifier = requirePasskeyVerifier(args.verifier);
+		const clientData = parseClientDataJSON(decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON")));
+		verifyClientDataType(clientData, ClientDataType.Create, "webauthn.create");
+		verifyOrigin(clientData, rp);
+		await verifyAndConsumeChallenge(clientData, ctx, verifier);
+		const authData = parseAttestationObject(decodeBase64urlIgnorePadding(requireStringParam(params.attestationObject, "attestationObject"))).authenticatorData;
+		verifyRpId(authData, rp.rpId);
+		verifyUserFlags(authData, rp);
+		if (authData.credential == null) throw convexError("PASSKEY_NO_CREDENTIAL", "No credential in attestation.");
+		const credential = authData.credential;
+		const credentialId = encodeBase64urlNoPadding(credential.id);
+		const publicKey = credential.publicKey;
+		const algorithm = publicKey.isAlgorithmDefined() ? publicKey.algorithm() : publicKey.type() === COSEKeyType.EC2 ? coseAlgorithmES256 : publicKey.type() === COSEKeyType.RSA ? coseAlgorithmRS256 : coseAlgorithmES256;
+		const publicKeyBytes = resolveRegistrationPublicKeyBytes(publicKey, algorithm);
+		try {
+			const deviceType = params.deviceType ?? "single-device";
+			const backedUp = params.backedUp ?? false;
+			await authDb(ctx, ctx.auth.config).accounts.create({
+				userId,
+				provider: provider.id,
+				providerAccountId: credentialId
+			});
+			const passkeyId = await mutatePasskeyInsert(ctx, {
+				userId,
+				credentialId,
+				publicKey: publicKeyBytes.buffer.slice(publicKeyBytes.byteOffset, publicKeyBytes.byteOffset + publicKeyBytes.byteLength),
+				algorithm,
+				counter: authData.signatureCounter,
+				transports: params.transports,
+				deviceType,
+				backedUp,
+				name: params.passkeyName,
+				createdAt: Date.now()
+			});
+			await ctx.auth.config.callbacks?.after?.(ctx, {
+				kind: "passkeyAdded",
+				userId,
+				passkeyId,
+				credentialId
+			});
+		} catch {
+			throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+		}
+		let signInResult;
+		try {
+			signInResult = await callSignIn(ctx, {
+				userId,
+				generateTokens: true
+			});
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to finalize passkey registration.");
+		}
+		return {
+			kind: "signedIn",
+			session: signInResult
+		};
+	};
+	const handleAuthVerify = async () => {
+		const rp = resolveRpOptions(provider);
+		const verifier = requirePasskeyVerifier(args.verifier);
+		const clientDataJSON = decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON"));
+		const clientData = parseClientDataJSON(clientDataJSON);
+		verifyClientDataType(clientData, ClientDataType.Get, "webauthn.get");
+		verifyOrigin(clientData, rp);
+		await verifyAndConsumeChallenge(clientData, ctx, verifier);
+		const credentialId = params.credentialId;
+		if (credentialId == null) throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Missing credential ID");
+		let passkey;
+		try {
+			passkey = await queryPasskeyByCredentialId(ctx, credentialId);
+		} catch {
+			throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown passkey credential.");
+		}
+		if (passkey === null) throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown credential");
+		const authenticatorDataBytes = decodeBase64urlIgnorePadding(requireStringParam(params.authenticatorData, "authenticatorData"));
+		const authenticatorData = parseAuthenticatorData(authenticatorDataBytes);
+		const signatureBytes = decodeBase64urlIgnorePadding(requireStringParam(params.signature, "signature"));
+		const messageHash = sha256(createAssertionSignatureMessage(authenticatorDataBytes, clientDataJSON));
+		verifyRpId(authenticatorData, rp.rpId);
+		verifyUserFlags(authenticatorData, rp);
+		verifyAssertionSignature(passkey, signatureBytes, messageHash);
+		if (passkey.counter !== 0 && authenticatorData.signatureCounter !== 0 && authenticatorData.signatureCounter <= passkey.counter) throw convexError("PASSKEY_COUNTER_ERROR", "Authenticator counter did not increase — possible credential cloning detected.");
+		try {
+			await mutatePasskeyUpdateCounter(ctx, passkey._id, authenticatorData.signatureCounter, Date.now());
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to update passkey counter.");
+		}
+		let signInResult;
+		try {
+			signInResult = await callSignIn(ctx, {
+				userId: passkey.userId,
+				generateTokens: true
+			});
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to finalize passkey sign-in.");
+		}
+		return {
+			kind: "signedIn",
+			session: signInResult
+		};
+	};
 	const handler = {
-		registerOptions: async () => {
+		register: async () => {
 			const userId = await requireAuthenticatedUserId(ctx);
 			const rp = resolveRpOptions(provider);
 			const challenge = new Uint8Array(32);
@@ -225,61 +332,7 @@ async function handlePasskeyFx(ctx, provider, args) {
 				verifier
 			};
 		},
-		registerVerify: async () => {
-			const userId = await requireAuthenticatedUserId(ctx);
-			const rp = resolveRpOptions(provider);
-			const verifier = requirePasskeyVerifier(args.verifier);
-			const clientData = parseClientDataJSON(decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON")));
-			verifyClientDataType(clientData, ClientDataType.Create, "webauthn.create");
-			verifyOrigin(clientData, rp);
-			await verifyAndConsumeChallenge(clientData, ctx, verifier);
-			const authData = parseAttestationObject(decodeBase64urlIgnorePadding(requireStringParam(params.attestationObject, "attestationObject"))).authenticatorData;
-			verifyRpId(authData, rp.rpId);
-			verifyUserFlags(authData, rp);
-			if (authData.credential == null) throw convexError("PASSKEY_NO_CREDENTIAL", "No credential in attestation.");
-			const credential = authData.credential;
-			const credentialId = encodeBase64urlNoPadding(credential.id);
-			const publicKey = credential.publicKey;
-			const algorithm = publicKey.isAlgorithmDefined() ? publicKey.algorithm() : publicKey.type() === COSEKeyType.EC2 ? coseAlgorithmES256 : publicKey.type() === COSEKeyType.RSA ? coseAlgorithmRS256 : coseAlgorithmES256;
-			const publicKeyBytes = resolveRegistrationPublicKeyBytes(publicKey, algorithm);
-			try {
-				const deviceType = params.deviceType ?? "single-device";
-				const backedUp = params.backedUp ?? false;
-				await authDb(ctx, ctx.auth.config).accounts.create({
-					userId,
-					provider: provider.id,
-					providerAccountId: credentialId
-				});
-				await mutatePasskeyInsert(ctx, {
-					userId,
-					credentialId,
-					publicKey: publicKeyBytes.buffer.slice(publicKeyBytes.byteOffset, publicKeyBytes.byteOffset + publicKeyBytes.byteLength),
-					algorithm,
-					counter: authData.signatureCounter,
-					transports: params.transports,
-					deviceType,
-					backedUp,
-					name: params.passkeyName,
-					createdAt: Date.now()
-				});
-			} catch {
-				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
-			}
-			let signInResult;
-			try {
-				signInResult = await callSignIn(ctx, {
-					userId,
-					generateTokens: true
-				});
-			} catch (error) {
-				throw asConvexError(error, "INTERNAL_ERROR", "Failed to finalize passkey registration.");
-			}
-			return {
-				kind: "signedIn",
-				session: signInResult
-			};
-		},
-		authOptions: async () => {
+		signIn: async () => {
 			const rp = resolveRpOptions(provider);
 			const challenge = new Uint8Array(32);
 			crypto.getRandomValues(challenge);
@@ -326,49 +379,12 @@ async function handlePasskeyFx(ctx, provider, args) {
 				verifier
 			};
 		},
-		authVerify: async () => {
-			const rp = resolveRpOptions(provider);
-			const verifier = requirePasskeyVerifier(args.verifier);
-			const clientDataJSON = decodeBase64urlIgnorePadding(requireStringParam(params.clientDataJSON, "clientDataJSON"));
-			const clientData = parseClientDataJSON(clientDataJSON);
-			verifyClientDataType(clientData, ClientDataType.Get, "webauthn.get");
-			verifyOrigin(clientData, rp);
-			await verifyAndConsumeChallenge(clientData, ctx, verifier);
-			const credentialId = params.credentialId;
-			if (credentialId == null) throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Missing credential ID");
-			let passkey;
-			try {
-				passkey = await queryPasskeyByCredentialId(ctx, credentialId);
-			} catch {
-				throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown passkey credential.");
-			}
-			if (passkey === null) throw convexError("PASSKEY_UNKNOWN_CREDENTIAL", "Unknown credential");
-			const authenticatorDataBytes = decodeBase64urlIgnorePadding(requireStringParam(params.authenticatorData, "authenticatorData"));
-			const authenticatorData = parseAuthenticatorData(authenticatorDataBytes);
-			const signatureBytes = decodeBase64urlIgnorePadding(requireStringParam(params.signature, "signature"));
-			const messageHash = sha256(createAssertionSignatureMessage(authenticatorDataBytes, clientDataJSON));
-			verifyRpId(authenticatorData, rp.rpId);
-			verifyUserFlags(authenticatorData, rp);
-			verifyAssertionSignature(passkey, signatureBytes, messageHash);
-			if (passkey.counter !== 0 && authenticatorData.signatureCounter !== 0 && authenticatorData.signatureCounter <= passkey.counter) throw convexError("PASSKEY_COUNTER_ERROR", "Authenticator counter did not increase — possible credential cloning detected.");
-			try {
-				await mutatePasskeyUpdateCounter(ctx, passkey._id, authenticatorData.signatureCounter, Date.now());
-			} catch (error) {
-				throw asConvexError(error, "INTERNAL_ERROR", "Failed to update passkey counter.");
-			}
-			let signInResult;
-			try {
-				signInResult = await callSignIn(ctx, {
-					userId: passkey.userId,
-					generateTokens: true
-				});
-			} catch (error) {
-				throw asConvexError(error, "INTERNAL_ERROR", "Failed to finalize passkey sign-in.");
-			}
-			return {
-				kind: "signedIn",
-				session: signInResult
-			};
+		verify: async () => {
+			const isRegistration = typeof params.attestationObject === "string" && params.attestationObject.length > 0;
+			const isAuthentication = typeof params.signature === "string" && params.signature.length > 0;
+			if (isRegistration && !isAuthentication) return await handleRegisterVerify();
+			if (isAuthentication && !isRegistration) return await handleAuthVerify();
+			throw convexError("PASSKEY_INVALID_VERIFY", "`verify` flow requires either `attestationObject` (to complete a `register`) or `signature` + `credentialId` (to complete a `signIn`).");
 		}
 	}[dispatch.flow];
 	if (!handler) throw convexError("PASSKEY_MISSING_FLOW", `Unknown passkey flow: ${dispatch.flow}`);

package/dist/server/prefetch.js

@@ -239,10 +239,17 @@ function convexSiteIssuerFromCloudUrl(value) {
 	parsed.hostname = parsed.hostname.slice(0, -13) + ".convex.site";
 	return normalizeIssuer(parsed.toString());
 }
+function appendAuthIssuerPrefix(value) {
+	const issuer = normalizeIssuer(value);
+	return issuer.endsWith("/auth") ? issuer : `${issuer}/auth`;
+}
 function defaultAcceptedIssuersForUrl(value) {
 	const issuers = [normalizeIssuer(value)];
 	const siteIssuer = convexSiteIssuerFromCloudUrl(value);
-	if (siteIssuer !== null) issuers.push(siteIssuer);
+	if (siteIssuer !== null) {
+		issuers.push(siteIssuer);
+		issuers.push(appendAuthIssuerPrefix(siteIssuer));
+	}
 	return issuers;
 }
 /**

package/dist/server/redirects.js

@@ -8,15 +8,23 @@ const describeUnknown = (value) => {
 	return JSON.stringify(value) ?? Object.prototype.toString.call(value);
 };
 /** @internal */
-async function redirectAbsoluteUrl(config, params) {
+async function redirectAbsoluteUrl(ctx, config, params) {
 	if (params.redirectTo === void 0) return requireEnv("SITE_URL").replace(/\/$/, "");
 	if (typeof params.redirectTo !== "string") throw new ConvexError({
 		code: "INVALID_REDIRECT",
 		message: `Expected \`redirectTo\` to be a string, got ${describeUnknown(params.redirectTo)}`
 	});
-	const redirectCallback = config.callbacks?.redirect ?? defaultRedirectCallback;
+	const redirectTo = params.redirectTo;
 	try {
-		return await redirectCallback({ redirectTo: params.redirectTo });
+		const before = config.callbacks?.before;
+		if (before !== void 0) {
+			const result = await before(ctx, {
+				kind: "redirect",
+				redirectTo
+			});
+			if (typeof result === "string") return result;
+		}
+		return await defaultRedirectCallback({ redirectTo });
 	} catch {
 		throw new ConvexError({
 			code: "INTERNAL_ERROR",

package/dist/server/refresh.js

@@ -10,8 +10,13 @@ const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1e3;
 const refreshTokenExpirationTime = (config, now = Date.now()) => now + (config.session?.inactiveDurationMs ?? readConfigSync(envOptionalNumber("AUTH_SESSION_INACTIVE_DURATION_MS")) ?? DEFAULT_SESSION_INACTIVE_DURATION_MS);
 /** @internal */
 const parseRefreshToken = (refreshToken) => {
-	const [refreshTokenId, sessionId] = refreshToken.split(REFRESH_TOKEN_DIVIDER);
+	const parts = refreshToken.split(REFRESH_TOKEN_DIVIDER);
 	const message = `Can't parse refresh token: ${maybeRedact(refreshToken)}`;
+	if (parts.length !== 2) throw new ConvexError({
+		code: "INVALID_REFRESH_TOKEN",
+		message
+	});
+	const [refreshTokenId, sessionId] = parts;
 	if (refreshTokenId == null || sessionId == null) throw new ConvexError({
 		code: "INVALID_REFRESH_TOKEN",
 		message

package/dist/server/runtime.d.ts

@@ -1,13 +1,16 @@
 import { AuthProviderConfig, ConvexAuthConfig, CorsConfig, Doc, HttpKeyContext, KeyDoc, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "./types.js";
-import { ComponentCtx, ComponentReadCtx } from "./componentContext.js";
+import { ComponentCtx, ComponentReadCtx } from "./component/context.js";
 import { AuthProfile, SignInParams } from "./payloads.js";
 import { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext } from "./http.js";
 import { createGroupConnectionDomain } from "./sso/domain.js";
-import * as convex_values86 from "convex/values";
-import * as convex_server80 from "convex/server";
+import { GenericId } from "convex/values";
+import * as convex_server105 from "convex/server";
 import { GenericActionCtx, GenericDataModel, HttpRouter } from "convex/server";
 
 //#region src/server/runtime.d.ts
+type AuthHttpRouteOptions = {
+  /** Prefix where auth HTTP routes are mounted, e.g. `/auth`. */prefix?: string;
+};
 /**
  * Configure the Convex Auth library. Returns an object with
  * functions and `auth` helper. You must export the functions
@@ -20,16 +23,16 @@ import { GenericActionCtx, GenericDataModel, HttpRouter } from "convex/server";
  * export const auth = createAuth(components.auth, {
  *   providers: [],
  * });
- * export const { signIn, signOut, store } = auth;
+ * export const signIn = auth.signIn;
+ * export const signOut = auth.signOut;
+ * export const store = auth.store;
+ * export const http = auth.http;
  * ```
  *
  * @returns An object with fields you should reexport from your
  *          `convex/auth.ts` file.
  */
 declare function Auth(config_: ConvexAuthConfig): {
-  /**
-   * Helper for configuring HTTP actions.
-   */
   auth: {
     user: {
       get: {
@@ -44,7 +47,7 @@ declare function Auth(config_: ConvexAuthConfig): {
         order?: "asc" | "desc";
       }) => Promise<any>;
       viewer: (ctx: ComponentReadCtx & {
-        auth: convex_server80.Auth;
+        auth: convex_server105.Auth;
       }) => Promise<Doc<"User"> | null>;
       update: (ctx: ComponentCtx, userId: string, data: Record<string, unknown>) => Promise<{
         userId: string;
@@ -70,11 +73,11 @@ declare function Auth(config_: ConvexAuthConfig): {
     };
     session: {
       invalidate: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: {
-        userId: convex_values86.GenericId<"User">;
-        except?: convex_values86.GenericId<"Session">[];
+        userId: GenericId<"User">;
+        except?: GenericId<"Session">[];
       }) => Promise<{
-        userId: convex_values86.GenericId<"User">;
-        except: convex_values86.GenericId<"Session">[];
+        userId: GenericId<"User">;
+        except: GenericId<"Session">[];
       }>;
       get: (ctx: ComponentReadCtx, sessionId: string) => Promise<any>;
       list: (ctx: ComponentReadCtx, opts: {
@@ -143,7 +146,7 @@ declare function Auth(config_: ConvexAuthConfig): {
     };
     provider: {
       signIn: (<DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, providerConfig: AuthProviderConfig, args: {
-        accountId?: convex_values86.GenericId<"Account">;
+        accountId?: GenericId<"Account">;
         params?: SignInParams;
       }) => Promise<{
         userId: string;
@@ -397,7 +400,7 @@ declare function Auth(config_: ConvexAuthConfig): {
   } & {
     sso: ReturnType<typeof createGroupConnectionDomain>;
   } & {
-    http: {
+    request: {
       /**
        * Register core HTTP routes for JWT verification and OAuth sign-in.
        *
@@ -405,26 +408,39 @@ declare function Auth(config_: ConvexAuthConfig): {
        * import { httpRouter } from "convex/server";
        * import { auth } from "./auth";
        *
-       * const http = httpRouter();
-       *
-       * auth.http.add(http);
-       *
-       * export default http;
+       * export default auth.http();
        * ```
        *
        * The following routes are handled always:
        *
        * - `/.well-known/openid-configuration`
        * - `/.well-known/jwks.json`
+       * - `/.well-known/webauthn` (returns 404 unless `WEBAUTHN_ALT_ORIGINS` or
+       *   `SECONDARY_URL` is set)
        *
        * The following routes are handled if OAuth is configured:
        *
-       * - `/api/auth/signin/*`
-       * - `/api/auth/callback/*`
+       * - `/signin/*`
+       * - `/callback/*`
        *
        * @param http your HTTP router
+       * @param options.prefix where to mount auth protocol routes, e.g. `/auth`
        */
-      add: (http: HttpRouter) => void;
+      add: (http: HttpRouter, options?: AuthHttpRouteOptions) => void;
+      /**
+       * Create a Convex HTTP router with auth protocol routes already mounted.
+       *
+       * Defaults to the `/auth` prefix. Use {@link request.add add} instead when
+       * you need to compose auth routes with app-specific HTTP routes in the same
+       * router.
+       *
+       * ```ts
+       * import { auth } from "./auth";
+       *
+       * export default auth.http();
+       * ```
+       */
+      router: (options?: AuthHttpRouteOptions) => HttpRouter;
       /**
        * Resolve mixed HTTP auth for a raw `httpAction`.
        *
@@ -439,7 +455,7 @@ declare function Auth(config_: ConvexAuthConfig): {
        *   path: "/api/data",
        *   method: "GET",
        *   handler: httpAction(async (ctx, request) => {
-       *     const authContext = await auth.http.context(ctx, request);
+       *     const authContext = await auth.request.context(ctx, request);
        *     return Response.json({
        *       userId: authContext.userId,
        *       source: authContext.source,
@@ -451,22 +467,22 @@ declare function Auth(config_: ConvexAuthConfig): {
       context: {
         <TResolve extends Record<string, unknown> = Record<string, never>, TCtx extends {
           auth: {
-            getUserIdentity: () => Promise<convex_server80.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server105.UserIdentity | null>;
           };
         } & ComponentReadCtx = {
           auth: {
-            getUserIdentity: () => Promise<convex_server80.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server105.UserIdentity | null>;
           };
         } & ComponentReadCtx>(ctx: TCtx, request: Request, config: HttpAuthContextConfig<TResolve, TCtx> & {
           optional: true;
         }): Promise<OptionalHttpAuthContext & TResolve>;
         <TResolve extends Record<string, unknown> = Record<string, never>, TCtx extends {
           auth: {
-            getUserIdentity: () => Promise<convex_server80.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server105.UserIdentity | null>;
           };
         } & ComponentReadCtx = {
           auth: {
-            getUserIdentity: () => Promise<convex_server80.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server105.UserIdentity | null>;
           };
         } & ComponentReadCtx>(ctx: TCtx, request: Request, config?: HttpAuthContextConfig<TResolve, TCtx>): Promise<HttpAuthContext & TResolve>;
       };
@@ -483,7 +499,7 @@ declare function Auth(config_: ConvexAuthConfig): {
        * are merged and the response is passed through.
        *
        * ```ts
-       * const handler = auth.http.action(async (ctx, request) => {
+       * const handler = auth.request.action(async (ctx, request) => {
        *   const data = await ctx.runQuery(api.data.get, { userId: ctx.key.userId });
        *   return { data };
        * });
@@ -500,13 +516,13 @@ declare function Auth(config_: ConvexAuthConfig): {
           action: string;
         };
         cors?: CorsConfig;
-      }) => convex_server80.PublicHttpAction;
+      }) => convex_server105.PublicHttpAction;
       /**
        * Register a Bearer-authenticated route **and** its OPTIONS preflight
        * in a single call.
        *
        * ```ts
-       * auth.http.route(http, {
+       * auth.request.route(http, {
        *   path: "/api/messages",
        *   method: "POST",
        *   handler: async (ctx, request) => {
@@ -546,7 +562,7 @@ declare function Auth(config_: ConvexAuthConfig): {
    *
    * Also used for refreshing the session.
    */
-  signIn: convex_server80.RegisteredAction<"public", {
+  signIn: convex_server105.RegisteredAction<"public", {
     provider?: string | undefined;
     verifier?: string | undefined;
     params?: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null> | undefined;
@@ -556,12 +572,12 @@ declare function Auth(config_: ConvexAuthConfig): {
   /**
    * Action called by the client to invalidate the current session.
    */
-  signOut: convex_server80.RegisteredAction<"public", {}, Promise<void>>;
+  signOut: convex_server105.RegisteredAction<"public", {}, Promise<void>>;
   /**
    * Internal mutation used by the library to read and write
    * to the database during signin and signout.
    */
-  store: convex_server80.RegisteredMutation<"internal", {
+  store: convex_server105.RegisteredMutation<"internal", {
     args: {
       sessionId?: string | undefined;
       type: "signIn";
@@ -604,11 +620,11 @@ declare function Auth(config_: ConvexAuthConfig): {
           sessionIndex?: string | undefined;
         } | undefined;
       } | undefined;
-      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       type: "userOAuth";
       provider: string;
       providerAccountId: string;
       signature: string;
+      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
     } | {
       email?: string | undefined;
       phone?: string | undefined;
@@ -621,9 +637,9 @@ declare function Auth(config_: ConvexAuthConfig): {
     } | {
       shouldLinkViaEmail?: boolean | undefined;
       shouldLinkViaPhone?: boolean | undefined;
-      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       type: "createAccountFromCredentials";
       provider: string;
+      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       account: {
         secret?: string | undefined;
         id: string;
@@ -657,7 +673,13 @@ declare function Auth(config_: ConvexAuthConfig): {
       type: "invalidateSessions";
       userId: string;
     };
-  }, Promise<unknown>>;
+  }, Promise<unknown>>; /** App-side HTTP protocol delegate retained for generated API compatibility. */
+  http: ((options?: AuthHttpRouteOptions) => HttpRouter) & {
+    isConvexFunction: true;
+    isAction: true;
+  } & {
+    isPublic: true;
+  };
 };
 //#endregion
 export { Auth };