cvx-kit 0.1.8 → 0.1.11

package/docs/auth.md

@@ -64,9 +64,139 @@ export const {
 Every function in the app is then built from these — raw `query`/`mutation`
 imports from `_generated/server` appear **only** in this file.
 
+## One shared Effect function foundation
+
+Use `createEffectAuthFunctions` from `cvx-kit/effect` in `convex/functions.ts`
+to configure all twelve constructors once. Its first argument is the same
+`AuthFunctionsConfig` used by `createAuthFunctions`; its second argument has
+six explicit policies: `query`, `mutation`, `action`, `systemQuery`,
+`systemMutation`, and `systemAction`. Each accepts `services`, `context`, and
+`mapError`, like `effectZodApiBuilder`. Pass `{}` when no additions are needed.
+
+Type the auth config with your generated `DataModel` and role vocabulary,
+then let the factory infer its generics from both arguments. Do not supply
+partial generic arguments, which would fix the remaining inference defaults.
+The following public-package example defines a reusable app factory; the
+host passes its auth, membership, trigger, and RLS policy as `config`.
+
+<!-- packed-effect-example -->
+
+```ts
+import {
+	defineSchema,
+	defineTable,
+	makeFunctionReference,
+	type DataModelFromSchemaDefinition,
+	type GenericQueryCtx,
+	type GenericMutationCtx,
+} from 'convex/server'
+import { v } from 'convex/values'
+import { Effect } from 'effect'
+import { z } from 'zod'
+import type { AuthFunctionsConfig, AuthBundle } from 'cvx-kit/auth'
+import { createEffectAuthFunctions, createEffectFoundation } from 'cvx-kit/effect'
+
+const schema = defineSchema({ notes: defineTable({ tenant: v.string(), title: v.string() }) })
+type Model = DataModelFromSchemaDefinition<typeof schema>
+type Role = 'owner' | 'viewer'
+const input = z.object({ title: z.string().trim().min(1) })
+const saveRef = makeFunctionReference<'mutation', z.input<typeof input>, null>('notes:save')
+
+export function createApplicationFunctions(config: AuthFunctionsConfig<Model, Role>) {
+	const foundation = createEffectFoundation({
+		observability: {
+			enabled: false,
+			classifyError: () => ({ outcome: 'failed', errorCode: 'FAILED' }),
+		},
+		writeAudit: () => undefined, // supply the app's transactional audit writer in production
+	})
+	const queries = foundation.Query({
+		context: (ctx: (GenericQueryCtx<Model> | GenericMutationCtx<Model>) & AuthBundle<Role>) => ctx,
+		operations: ({ query }) => ({
+			actor: query({
+				input: z.object({}),
+				result: z.string(),
+				handler: (_input, ctx) => ctx.actor.userId,
+			}),
+		}),
+	})
+	const commands = foundation.Command({
+		context: (ctx: GenericMutationCtx<Model> & AuthBundle<Role>) => ctx,
+		operations: ({ command }) => ({
+			save: command({
+				input,
+				result: z.null(),
+				classification: 'business',
+				audit: () => null,
+				handler: (args, ctx) =>
+					Effect.promise(async () => {
+						await ctx.db.insert('notes', { title: args.title, tenant: ctx.tenant })
+						return null
+					}),
+			}),
+		}),
+	})
+	const functions = createEffectAuthFunctions(config, {
+		query: { context: (ctx) => ({ queries: queries.withContext(ctx) }) },
+		mutation: {
+			context: (ctx) => ({
+				queries: queries.withContext(ctx),
+				commands: commands.withContext(ctx),
+			}),
+		},
+		action: {
+			context: (ctx) => ({
+				commands: {
+					save: (args: z.input<typeof input>) =>
+						Effect.promise(() => ctx.runMutation(saveRef, args)),
+				},
+			}),
+		},
+		systemQuery: {},
+		systemMutation: {},
+		systemAction: {},
+	})
+	const save = functions.roleMutation('owner')({
+		args: input.shape,
+		returns: z.null(),
+		handler: (ctx, args) => ctx.commands.exec('save', args),
+	})
+	return { ...functions, save }
+}
+```
+
+Export the returned constructors once from `convex/functions.ts`, and export
+`save` at the registered `notes:save` mutation path. Endpoint modules can then
+use `ctx.commands` or `ctx.queries` directly. The callbacks run per invocation
+after auth, role checks, triggers/RLS wrapping, and live action membership
+refresh. Binding is lazy; do not cache an authenticated `withContext` handle
+at module scope. Denied requests never run the callbacks.
+
+| Policy                                            | Available authority and capabilities                                                                                                                                   |
+| ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `query`                                           | Trusted auth bundle, secured DB reader, `include`; bind read registries only.                                                                                          |
+| `mutation`                                        | Trusted auth bundle, secured triggered DB writer, `include`; bind queries and mutation commands.                                                                       |
+| `action`                                          | Live-verified auth bundle, `runQuery`/`runMutation`; use action-compatible registries or forward to registered functions. No DB or `include`.                          |
+| `systemQuery` / `systemMutation` / `systemAction` | Existing internal authority, configured separately. No fabricated actor or inherited public handles; system mutations retain triggers and bypass public RLS as before. |
+
+Every auth/role/admin constructor of a kind shares that kind's policy. System
+policies are deliberately explicit; choose their trusted capabilities rather
+than synthesizing public credentials. An action forwarding to `runMutation`
+creates a separate registered mutation transaction; it does not turn the
+whole action into a transaction or carry its live role into that mutation's
+JWT-based auth policy.
+
+Additions cannot replace native or auth context keys: static checks reject
+known collisions and runtime checks also reject inherited keys before the
+handler executes. Put class-based handles under named properties in the
+returned plain record. Scoped services, required Effect services, Zod raw and
+parsed argument/result types, function references, and error projection retain
+the existing adapter's behavior. Let failures escape registered mutations so
+nested command writes, triggers, and audit writes roll back together.
+
 ## Shared Effect execution after authentication
 
-Wrap the constructors returned by `createAuthFunctions` with
+For an individual constructor, wrap the builder returned by `createAuthFunctions` with
 `effectZodApiBuilder` from `cvx-kit/effect`. The original constructor resolves
 authentication, authorization, tenant policy, and the wrapped database before
 the service provider runs. Keep that ordering when adding Effect; use the Zod

package/docs/effect.md

@@ -384,11 +384,17 @@ only when you want a typed error channel.
 The [command guide](./commands.md) documents the current lifecycle and migration
 steps; the [deprecated API reference](./commands-legacy.md) retains old examples.
 The [authentication guide](./auth.md)
-shows how to wrap trusted custom builders with `effectZodApiBuilder`, so auth,
+shows the shared `createEffectAuthFunctions(config, policies)` factory and how
+to wrap individual trusted builders with `effectZodApiBuilder`, so auth,
 tenancy, validators, row-level policies, and triggers run through their
 existing builder before Effect request services are provisioned.
 
-Optional request context can be added through the existing Effect API adapter's
+For an app-wide foundation, configure `query`, `mutation`, and `action` policies
+once with `createEffectAuthFunctions` and explicit separate system policies.
+Query handles bind readers, mutation handles bind the secured triggered writer,
+and action handles use `runMutation` rather than a mutation database.
+
+Optional request context can also be added through the existing Effect API adapter's
 `context` callback. Bind selected registries with `commands.withContext(value)`
 and consume `ctx.commands.exec(name, input)` through the application's existing
 function helper names. Keep dependencies local to each feature; explicit execution

package/docs/llms.md

@@ -22,7 +22,7 @@
 cvx-kit is a reusable Convex application kit: zod table boundaries, auth-aware
 function constructors, a trigger registry, an audited command protocol
 (Foundation component), and a declarative approvals component. Peer deps:
-`convex ^1.45.0`, `zod ^4.5.4`; command implementations also install
+`convex ^1.46.0`, `zod ^4.5.4`; command implementations also install
 `effect >=4.0.1 <5` and import `cvx-kit/effect`.
 
 **Command API selection:** use `createEffectFoundation` and declare handlers
@@ -38,12 +38,13 @@ copy that API into new implementations.
    `convex/functions.ts`** (the `createAuthFunctions` call). All other
    functions use `authQuery/authMutation/authAction`, `roleQuery/...`,
    `adminQuery/...` (public) or `systemQuery/systemMutation/systemAction` (internal),
-   wrapped once with `effectZodApiBuilder` when their handlers return Effects.
+   built once with `createEffectAuthFunctions(config, policies)` from `cvx-kit/effect`
+   for shared Effect handles, or individually wrapped with `effectZodApiBuilder`.
    This is what guarantees auth, triggers, and bounded reads.
 3. **Every public query returns DTOs** via `<table>.toPublicDto(row)` —
    runtime redaction, not just types.
 4. **Every read is bounded**: `ctx.include(ctx.db.query('t')).matching(...)
-.execute(limit)` with `1 ≤ limit ≤ 100`. `.resolve()` falls back to a full
+   .execute(limit)` with `1 ≤ limit ≤ 100`. `.resolve()` falls back to a full
    table scan — avoid it.
 5. **State changes are Effect commands**: declare
    `Command({ context, operations: ({ command }) => ({ ... }), defaults })`.
@@ -78,23 +79,23 @@ copy that API into new implementations.
 
 ## Exports map
 
-| Import                          | Provides                                                                                                                                                                                                                                                                |
-| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `cvx-kit`                       | Non-Effect helpers and component clients; import the optional Effect facade explicitly from `cvx-kit/effect`. |
-| `cvx-kit/zod-table`             | `zodTable`, `tenantTable`, `createModule`, `paginated`, `zodVariantTable`, `jsonSafeZid`, `TIMESTAMP_FIELDS`                                                                                                                                                            |
-| `cvx-kit/effect`                | Recommended command/query API: `createEffectFoundation`, `effectApiBuilder`, `effectZodApiBuilder`, `createEffectCrud`, idempotency/workflow adapters and operation tools. |
-| `cvx-kit/auth`                  | `createAuthFunctions` (incl. optional `security` RLS config), `createInclude`, `defaultRoleMap`                                                                                                                                                                         |
-| `cvx-kit/tenancy`               | `createTenantRules`, `composeRules`, `requireTenantReference`, `assertTenantOwned`, `TENANT_FIELD`                                                                                                                                                                      |
-| `cvx-kit/crud`                  | Compatibility CRUD factory using the deprecated Promise command facade; use `createEffectCrud` from `cvx-kit/effect` for new domains. |
-| `cvx-kit/state-machine`         | `createStateMachine` — typed transitions from constants tuples; `assert` drops into command guards                                                                                                                                                                      |
-| `cvx-kit/middleware`            | `rateLimit` — packaged middleware over an injected rate-limiter instance; keyed by `ctx.tenant`, missing key = config error                                                                                                                                             |
-| `cvx-kit/webhooks`              | `createWebhookBoundary`, `recordWebhookEvent`, `webhookEventsTable` — raw-body verify, natural-key dedup in the mutation                                                                                                                                                |
-| `cvx-kit/agent-tools`           | `createAgentTools` — tool records from table masks; mutation handlers route through command executors                                                                                                                                                                   |
-| `cvx-kit/triggers`              | `createTriggers`, `timestamps`, `appendOnly`, `noDelete`, `tenantOwnership`, `Triggers`                                                                                                                                                                                 |
-| `cvx-kit/errors`                | `KitError`, `defaultErrors`, `ErrorFactory`                                                                                                                                                                                                                             |
-| `cvx-kit/components/foundation` | Component client and types; `Foundation.Command` is deprecated. The component and other capabilities remain available. New command registries use `cvx-kit/effect`. |
-| `cvx-kit/components/approvals`  | `Approvals` client; default export = component config for `app.use`                                                                                                                                                                                                     |
-| `cvx-kit/test`                  | `registerFoundation(t)`, `registerApprovals(t)` for convex-test                                                                                                                                                                                                         |
+| Import                          | Provides                                                                                                                                                                                                |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cvx-kit`                       | Non-Effect helpers and component clients; import the optional Effect facade explicitly from `cvx-kit/effect`.                                                                                           |
+| `cvx-kit/zod-table`             | `zodTable`, `tenantTable`, `createModule`, `paginated`, `zodVariantTable`, `jsonSafeZid`, `TIMESTAMP_FIELDS`                                                                                            |
+| `cvx-kit/effect`                | Recommended command/query API: `createEffectFoundation`, `createEffectAuthFunctions`, `effectApiBuilder`, `effectZodApiBuilder`, `createEffectCrud`, idempotency/workflow adapters and operation tools. |
+| `cvx-kit/auth`                  | `createAuthFunctions` (incl. optional `security` RLS config), `createInclude`, `defaultRoleMap`                                                                                                         |
+| `cvx-kit/tenancy`               | `createTenantRules`, `composeRules`, `requireTenantReference`, `assertTenantOwned`, `TENANT_FIELD`                                                                                                      |
+| `cvx-kit/crud`                  | Compatibility CRUD factory using the deprecated Promise command facade; use `createEffectCrud` from `cvx-kit/effect` for new domains.                                                                   |
+| `cvx-kit/state-machine`         | `createStateMachine` — typed transitions from constants tuples; `assert` drops into command guards                                                                                                      |
+| `cvx-kit/middleware`            | `rateLimit` — packaged middleware over an injected rate-limiter instance; keyed by `ctx.tenant`, missing key = config error                                                                             |
+| `cvx-kit/webhooks`              | `createWebhookBoundary`, `recordWebhookEvent`, `webhookEventsTable` — raw-body verify, natural-key dedup in the mutation                                                                                |
+| `cvx-kit/agent-tools`           | `createAgentTools` — tool records from table masks; mutation handlers route through command executors                                                                                                   |
+| `cvx-kit/triggers`              | `createTriggers`, `timestamps`, `appendOnly`, `noDelete`, `tenantOwnership`, `Triggers`                                                                                                                 |
+| `cvx-kit/errors`                | `KitError`, `defaultErrors`, `ErrorFactory`                                                                                                                                                             |
+| `cvx-kit/components/foundation` | Component client and types; `Foundation.Command` is deprecated. The component and other capabilities remain available. New command registries use `cvx-kit/effect`.                                     |
+| `cvx-kit/components/approvals`  | `Approvals` client; default export = component config for `app.use`                                                                                                                                     |
+| `cvx-kit/test`                  | `registerFoundation(t)`, `registerApprovals(t)` for convex-test                                                                                                                                         |
 
 ## Minimal app wiring (the five root files)
 
@@ -291,3 +292,23 @@ Optional request context can be added through the existing Effect API adapter's
 and consume `ctx.commands.exec(name, input)` through the application's existing
 function helper names. Keep dependencies local to each feature; explicit execution
 and input-only command handlers remain supported. See [optional context injection](./command-context.md).
+
+## Shared auth and Effect context
+
+Configure `createEffectAuthFunctions` once in `convex/functions.ts` using a typed
+`AuthFunctionsConfig<DataModel, Role>` and inferred factory generics. Supply six
+explicit policies: `query`, `mutation`, `action`, `systemQuery`, `systemMutation`,
+and `systemAction`; use `{}` for no additions. Each supports `services`,
+`context`, and `mapError`. All auth/role/admin constructors share the policy
+for their kind. Services and context initialize only after successful auth and
+role checks, using the secured DB and refreshed live action membership.
+
+Bind query registries only in queries. Mutations can bind queries and commands
+with their secured triggered writer. Actions have no DB; bind action-compatible
+registries or delegate with `runMutation`/`runQuery`. Each registered mutation
+has its own transaction and JWT auth; an action is not one transaction. Configure
+internal system authority separately, without fabricated actors or inherited
+public handles. Return plain records with handles under named keys; native/auth
+key collisions are rejected, including inherited keys at runtime. Keep bound
+handles request-local, return lazy Effects, and let failures escape mutations
+for rollback. See `auth.md` for a packed-compiled shared factory example.

package/docs/oxlint.md

@@ -27,7 +27,7 @@ Loading a plugin does not enable its rules. For example:
 
 With Vite+, place those fields under `lint` in `vite.config.ts`. The plugin
 exports a default plugin object, named `rules`, and the `RuleName` type. It is
-tested with Oxlint 1.79.0 and Vite+ 0.3.0.
+tested with Oxlint 1.87.0 and Vite+ 1.1.0.
 
 All rules default to `convex/` relative to the linter's working directory.
 For another location, set `convexDir` on **each enabled rule**:

package/docs/upgrading.md

@@ -1,5 +1,13 @@
 # Upgrading to 0.1.0 — the new way of things
 
+## Current dependency requirements
+
+Install Convex 1.46 or newer and convex-helpers 0.1.127 or newer (below 0.2.0).
+These minimums match workflow 0.4.10. Regenerate your lockfile after updating.
+Auth declarations retain native Convex context types across package versions;
+the regression fixture also checks Convex 1.45, which is below the current
+full-package dependency minimum.
+
 ## Current command API — Effect declarations
 
 `Foundation.Command` and its separate `exec({ operation, handler })` API are
@@ -67,7 +75,7 @@ Install `convex-helpers` as a direct peer, using one compatible instance:
 bun add cvx-kit@0.1.3 convex-helpers@0.1.124
 ```
 
-The peer range is `>=0.1.123 <0.2.0`. Remove overrides that force a
+The peer range was `>=0.1.123 <0.2.0`. Remove overrides that force a
 separate helper copy and regenerate the installation without discarding
 unrelated dependency choices. This release is validated with Convex 1.45.0,
 Zod 4.5.4, and convex-test 0.0.56.

package/docs/zod-table.md

@@ -29,7 +29,7 @@ export const documents = zodTable(
 
 ### Shared ID validation (0.1.3)
 
-Install one compatible `convex-helpers` peer (`>=0.1.123 <0.2.0`) alongside
+Install one compatible `convex-helpers` peer (`>=0.1.127 <0.2.0`) alongside
 cvx-kit. ID metadata lives in a helper-instance registry: copying schemas
 between separately installed helper instances can silently turn an ID into
 `v.any()`. An exact nested dependency previously caused that failure even

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cvx-kit",
-	"version": "0.1.8",
+	"version": "0.1.11",
 	"description": "Reusable Convex application kit: foundation kernels, approvals component, zod table boundaries, WorkOS-backed auth function constructors, and audited command protocol.",
 	"keywords": [
 		"component",
@@ -133,6 +133,7 @@
 		"test:package:ids": "bun run build && node scripts/test-packed-ids.mjs",
 		"test:package:oxlint": "bun run build && node scripts/test-packed-oxlint.mjs",
 		"test:package:effect": "bun run build && node scripts/test-packed-effect.mjs",
+		"test:package:auth": "bun run build && node scripts/test-packed-auth.mjs",
 		"test:package:smoke:effect": "bun run build && node scripts/smoke-packed-effect.mjs",
 		"test:package:smoke:bun": "bun scripts/smoke-packed-components.mjs bun",
 		"test:package:smoke:npm": "node scripts/smoke-packed-components.mjs npm",
@@ -143,28 +144,30 @@
 		"release:minor": "npm version minor && git push --follow-tags"
 	},
 	"dependencies": {
-		"@convex-dev/workflow": "0.4.6",
-		"@oxlint/plugins": "1.79.0",
+		"@convex-dev/workflow": "0.4.10",
+		"@oxlint/plugins": "1.87.0",
+		"@standard-schema/spec": "^1.1.0",
 		"convex-audit-log": "^0.2.0",
-		"oxc-parser": "0.150.0",
+		"oxc-parser": "0.153.0",
 		"oxc-resolver": "11.24.2"
 	},
 	"devDependencies": {
 		"@edge-runtime/vm": "^5.0.0",
-		"@types/node": "^26.6.1",
-		"convex": "1.45.0",
-		"convex-helpers": "0.1.124",
-		"convex-test": "^0.0.56",
-		"effect": "4.0.1",
-		"oxlint": "1.79.0",
-		"publint": "^0.3.24",
+		"@types/node": "^26.6.5",
+		"convex": "1.46.0",
+		"convex-helpers": "0.1.128",
+		"convex-test": "^0.0.61",
+		"effect": "4.0.2",
+		"oxlint": "1.87.0",
+		"publint": "^0.3.25",
 		"typescript": "7.0.2",
-		"vite-plus": "0.3.0",
-		"zod": "4.5.4"
+		"vite": "npm:@voidzero-dev/vite-plus-core@1.1.0",
+		"vite-plus": "1.1.0",
+		"zod": "4.6.5"
 	},
 	"peerDependencies": {
-		"convex": "^1.45.0",
-		"convex-helpers": ">=0.1.123 <0.2.0",
+		"convex": "^1.46.0",
+		"convex-helpers": ">=0.1.127 <0.2.0",
 		"effect": ">=4.0.1 <5",
 		"zod": "^4.5.4"
 	},
@@ -173,6 +176,9 @@
 			"optional": true
 		}
 	},
+	"overrides": {
+		"vite": "npm:@voidzero-dev/vite-plus-core@1.1.0"
+	},
 	"devEngines": {
 		"packageManager": {
 			"name": "bun",

package/scripts/test-packed-auth.mjs

@@ -0,0 +1,72 @@
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join, resolve } from 'node:path'
+
+const root = resolve(import.meta.dirname, '..')
+const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+const temporary = mkdtempSync(join(tmpdir(), 'cvx-kit-auth-'))
+function run(command, args, cwd) {
+	try {
+		return execFileSync(command, args, { cwd, encoding: 'utf8', stdio: 'pipe' })
+	} catch (error) {
+		if (!args.includes('install')) {
+			process.stderr.write(error.stdout ?? '')
+			process.stderr.write(error.stderr ?? '')
+		}
+		throw new Error(`${command} ${args.join(' ')} failed in ${basename(cwd)}`, {
+			cause: error.code,
+		})
+	}
+}
+try {
+	run('bun', ['pm', 'pack', '--ignore-scripts', '--destination', temporary], root)
+	const tarball = join(temporary, `${manifest.name}-${manifest.version}.tgz`)
+	// 1.45 is a declaration regression target, below the current workflow peer floor.
+	for (const convex of ['1.45.0', '1.46.0']) {
+		const fixture = mkdtempSync(join(temporary, `convex-${convex}-`))
+		writeFileSync(
+			join(fixture, 'package.json'),
+			JSON.stringify({
+				private: true,
+				type: 'module',
+				dependencies: {
+					'cvx-kit': `file:${tarball}`,
+					convex,
+					'convex-helpers': manifest.devDependencies['convex-helpers'],
+					effect: manifest.devDependencies.effect,
+					zod: manifest.devDependencies.zod,
+					typescript: manifest.devDependencies.typescript,
+					'@types/node': manifest.devDependencies['@types/node'],
+				},
+			}),
+		)
+		writeFileSync(
+			join(fixture, 'auth.ts'),
+			readFileSync(join(root, 'test/auth-native-context-types.ts')),
+		)
+		writeFileSync(
+			join(fixture, 'shared-auth.ts'),
+			readFileSync(join(root, 'test/effect-auth-types.ts')),
+		)
+		writeFileSync(
+			join(fixture, 'tsconfig.json'),
+			JSON.stringify({
+				compilerOptions: {
+					strict: true,
+					noEmit: true,
+					skipLibCheck: true,
+					target: 'ES2025',
+					module: 'ESNext',
+					moduleResolution: 'bundler',
+				},
+				include: ['auth.ts', 'shared-auth.ts'],
+			}),
+		)
+		run('bun', ['install', '--ignore-scripts'], fixture)
+		run('bun', ['x', '--no-install', 'tsc', '--project', 'tsconfig.json'], fixture)
+		console.log(`Packed auth native contexts pass on Convex ${convex}`)
+	}
+} finally {
+	rmSync(temporary, { recursive: true, force: true })
+}

package/scripts/test-packed-effect.mjs

@@ -15,7 +15,7 @@ const root = resolve(import.meta.dirname, '..')
 const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
 const temporary = mkdtempSync(join(tmpdir(), 'cvx-kit-effect-'))
 const effectVersion = '4.0.1'
-const helpersVersion = '0.1.123'
+const helpersVersion = '0.1.127'
 const nodeTypesVersion = '26.6.1'
 const domainGuidePath = join(root, 'src/docs/domain-operations.md')
 const domainGuideImports = new Set([
@@ -396,6 +396,7 @@ try {
 					'effect-foundation-types.ts',
 					'effect-api-types.ts',
 					'effect-api-zod-types.ts',
+					'effect-auth-types.ts',
 					'effect-registry-review-types.ts',
 					'operation-contract-types.ts',
 					'effect-schema-types.ts',

package/scripts/test-packed-ids.mjs

@@ -25,7 +25,7 @@ try {
 				type: 'module',
 				dependencies: {
 					'cvx-kit': `file:${join(temporary, `cvx-kit-${manifest.version}.tgz`)}`,
-					'convex-helpers': '0.1.123',
+					'convex-helpers': '0.1.127',
 					convex: manifest.devDependencies.convex,
 					zod: manifest.devDependencies.zod,
 				},
@@ -142,7 +142,7 @@ it('registers concrete and generic backends from the packed package', () => {
 			fixture,
 		)
 		console.log(
-			`${installer}: packed IDs, table/tool types, registration, and command lifecycle pass with host convex-helpers 0.1.123`,
+			`${installer}: packed IDs, table/tool types, registration, and command lifecycle pass with host convex-helpers 0.1.127`,
 		)
 	}
 } finally {

package/dist/node_modules/@standard-schema/spec/dist/index.d.mts

@@ -1,79 +0,0 @@
-//#region node_modules/@standard-schema/spec/dist/index.d.ts
-/** The Standard Typed interface. This is a base type extended by other specs. */
-interface StandardTypedV1<Input = unknown, Output = Input> {
-  /** The Standard properties. */
-  readonly "~standard": StandardTypedV1.Props<Input, Output>;
-}
-declare namespace StandardTypedV1 {
-  /** The Standard Typed properties interface. */
-  interface Props<Input = unknown, Output = Input> {
-    /** The version number of the standard. */
-    readonly version: 1;
-    /** The vendor name of the schema library. */
-    readonly vendor: string;
-    /** Inferred types associated with the schema. */
-    readonly types?: Types<Input, Output> | undefined;
-  }
-  /** The Standard Typed types interface. */
-  interface Types<Input = unknown, Output = Input> {
-    /** The input type of the schema. */
-    readonly input: Input;
-    /** The output type of the schema. */
-    readonly output: Output;
-  }
-  /** Infers the input type of a Standard Typed. */
-  type InferInput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["input"];
-  /** Infers the output type of a Standard Typed. */
-  type InferOutput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["output"];
-}
-/** The Standard Schema interface. */
-interface StandardSchemaV1<Input = unknown, Output = Input> {
-  /** The Standard Schema properties. */
-  readonly "~standard": StandardSchemaV1.Props<Input, Output>;
-}
-declare namespace StandardSchemaV1 {
-  /** The Standard Schema properties interface. */
-  interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<Input, Output> {
-    /** Validates unknown input values. */
-    readonly validate: (value: unknown, options?: StandardSchemaV1.Options | undefined) => Result<Output> | Promise<Result<Output>>;
-  }
-  /** The result interface of the validate function. */
-  type Result<Output> = SuccessResult<Output> | FailureResult;
-  /** The result interface if validation succeeds. */
-  interface SuccessResult<Output> {
-    /** The typed output value. */
-    readonly value: Output;
-    /** A falsy value for `issues` indicates success. */
-    readonly issues?: undefined;
-  }
-  interface Options {
-    /** Explicit support for additional vendor-specific parameters, if needed. */
-    readonly libraryOptions?: Record<string, unknown> | undefined;
-  }
-  /** The result interface if validation fails. */
-  interface FailureResult {
-    /** The issues of failed validation. */
-    readonly issues: ReadonlyArray<Issue>;
-  }
-  /** The issue interface of the failure output. */
-  interface Issue {
-    /** The error message of the issue. */
-    readonly message: string;
-    /** The path of the issue, if any. */
-    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
-  }
-  /** The path segment interface of the issue. */
-  interface PathSegment {
-    /** The key representing a path segment. */
-    readonly key: PropertyKey;
-  }
-  /** The Standard types interface. */
-  interface Types<Input = unknown, Output = Input> extends StandardTypedV1.Types<Input, Output> {}
-  /** Infers the input type of a Standard. */
-  type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
-  /** Infers the output type of a Standard. */
-  type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
-}
-//#endregion
-export { StandardSchemaV1, StandardTypedV1 };
-//# sourceMappingURL=index.d.mts.map