@elytracms/studio 0.0.51 → 0.0.52

package/convex/auth.ts

@@ -1,11 +1,140 @@
 import { convexAuth } from '@convex-dev/auth/server'
 import { Password } from '@convex-dev/auth/providers/Password'
+import type { AnyDataModel, GenericMutationCtx } from 'convex/server'
 import { ConvexError } from 'convex/values'
+import type { GenericId } from 'convex/values'
 import { classifyInviteSignup, normalizeInviteEmail } from '@elytracms/core/persistence'
+import type { InviteSignupDecision } from '@elytracms/core/persistence'
 
 /** The provider list `convexAuth` accepts, derived from its own signature. */
 type ConvexAuthProviders = Parameters<typeof convexAuth>[0]['providers']
 
+/** The (non-schema-bound) mutation ctx the `convexAuth` callbacks receive. */
+type AuthCallbackCtx = GenericMutationCtx<AnyDataModel>
+
+/**
+ * Gather the invite-gate facts for a principal and classify them (EC-324).
+ * The ONE decision lives in the pure `classifyInviteSignup`
+ * (`@elytracms/core/persistence`, shared with its tests):
+ *
+ * - **existing member** → normal re-sign-in; no-op (also recovers a member-less
+ *   account it created earlier and never lets the deployment lock itself out).
+ * - **first user** (no members yet) → bootstrap as `admin`.
+ * - **invited** → grant the invited role (+ consume the invite).
+ * - **uninvited** → REJECT (closes the EC-304 open-sign-up hole).
+ */
+async function decideInviteGate(
+  ctx: AuthCallbackCtx,
+  args: { userId: GenericId<'users'>; email: string | null },
+): Promise<{ decision: InviteSignupDecision; invite: { _id: string; role: string } | null }> {
+  // The convexAuth callback ctx is `AnyDataModel` (not schema-bound), so use
+  // `.filter()` rather than `.withIndex()` here. The members/invites tables are
+  // tiny (single-tenant), and this runs only at account creation / sign-in.
+  const existingMember = await ctx.db
+    .query('members')
+    .filter((q) => q.eq(q.field('userId'), args.userId))
+    .first()
+  const anyMember = existingMember ?? (await ctx.db.query('members').first())
+  const email = args.email ? normalizeInviteEmail(args.email) : null
+  const invite = email
+    ? await ctx.db
+        .query('invites')
+        .filter((q) => q.eq(q.field('email'), email))
+        .first()
+    : null
+
+  const decision = classifyInviteSignup({
+    hasAnyMember: anyMember !== null,
+    existingRole: existingMember?.role ?? null,
+    invite: invite ? { role: invite.role } : null,
+  })
+  return { decision, invite }
+}
+
+/**
+ * EC-358 — the ACCOUNT-CREATION gate. Wired as `afterUserCreatedOrUpdated`,
+ * which Convex Auth calls inside the SAME `auth:store` mutation that creates
+ * the principal's rows — after the `users` insert, **before** the
+ * `authAccounts` insert (`upsertUserAndAccount`). A Convex mutation is one
+ * atomic transaction, so throwing here rolls the `users` insert back and the
+ * `authAccounts` row is never written: an uninvited sign-up leaves ZERO rows.
+ *
+ * Why this hook: the EC-324 gate lived only in `beforeSessionCreation`, which
+ * runs in a LATER store mutation — by then the password `authAccounts` + `users`
+ * rows were already committed, so a rejected uninvited sign-up left an orphan
+ * account carrying an attacker-chosen password that a later invite would
+ * silently promote (proven live 2026-07-08). The alternative pre-create hook,
+ * `createOrUpdateUser`, REPLACES the library's user-creation/linking mechanics
+ * wholesale — a far bigger seam than this scope allows; this hook keeps the
+ * default mechanics and only adds the veto.
+ *
+ * Only REJECT throws here; membership granting/consuming stays in
+ * `beforeSessionCreation` (the account-creation callback also fires for
+ * verification/OAuth account flows where a session may not follow immediately).
+ * For credentials providers this fires exactly on `createAccount` (sign-UP),
+ * not on re-sign-in.
+ */
+export async function gateAccountCreation(
+  ctx: AuthCallbackCtx,
+  args: { userId: GenericId<'users'>; profile: { email?: string } },
+): Promise<void> {
+  const email = typeof args.profile.email === 'string' ? args.profile.email : null
+  const { decision } = await decideInviteGate(ctx, { userId: args.userId, email })
+  if (decision.kind === 'reject') throw new ConvexError(decision.reason)
+}
+
+/**
+ * Invite-based onboarding gate + first-principal bootstrap (EC-324 / EC-150).
+ * Wired as `beforeSessionCreation`: fires on EVERY sign-in (not just account
+ * creation), right before the session is persisted — throwing here rejects the
+ * sign-in. See {@link decideInviteGate} for the decision table.
+ *
+ * The `ConvexError` message ("not-invited: …") survives to the client even in
+ * production, so the sign-in screen tells the truth instead of the old
+ * "password too short". The `ConvexAuthAdapter` classifies it to a distinct
+ * `not-invited` `SignInResult` reason.
+ *
+ * Single-tenant: one `members` table per deployment. Invite mechanism: a plain
+ * email allowlist (`invites` table) — the simplest server-enforced design, no
+ * token infrastructure.
+ */
+export async function gateSessionCreation(
+  ctx: AuthCallbackCtx,
+  args: { userId: GenericId<'users'> },
+): Promise<void> {
+  const now = new Date().toISOString()
+  const user = await ctx.db.get(args.userId)
+  const rawEmail = (user as { email?: string } | null)?.email
+  const { decision, invite } = await decideInviteGate(ctx, {
+    userId: args.userId,
+    email: rawEmail ?? null,
+  })
+
+  switch (decision.kind) {
+    case 'existing-member':
+      return
+    case 'bootstrap-admin':
+      await ctx.db.insert('members', {
+        userId: args.userId,
+        role: 'admin',
+        createdAt: now,
+        updatedAt: now,
+      })
+      return
+    case 'grant-role':
+      await ctx.db.insert('members', {
+        userId: args.userId,
+        role: decision.role,
+        createdAt: now,
+        updatedAt: now,
+      })
+      if (invite) await ctx.db.delete(invite._id as GenericId<'invites'>)
+      return
+    case 'reject':
+      throw new ConvexError(decision.reason)
+  }
+}
+
 /**
  * EC-252 — the studio's Convex Auth (EC-150) as a **default + override seam**. Only the
  * PROVIDER choice is legitimately consumer-specific; the first-principal admin bootstrap
@@ -30,69 +159,13 @@ export function defineStudioAuth(options?: { providers?: ConvexAuthProviders })
   return convexAuth({
     providers: options?.providers ?? [Password],
     callbacks: {
-      /**
-       * Invite-based onboarding gate + first-principal bootstrap (EC-324 / EC-150).
-       * Fires on EVERY sign-in (not just account creation), right before the session
-       * is persisted — throwing here rejects the sign-in. The ONE decision lives in
-       * the pure `classifyInviteSignup` (shared with its tests):
-       *
-       * - **existing member** → normal re-sign-in; no-op (also recovers a member-less
-       *   account it created earlier and never lets the deployment lock itself out).
-       * - **first user** (no members yet) → bootstrap as `admin` (was the only case).
-       * - **invited** → grant the invited role + CONSUME the invite (delete the row).
-       * - **uninvited** → REJECT. This closes the open-sign-up hole (EC-304): an
-       *   anonymous person can no longer self-register into the deployment. The
-       *   `ConvexError` message ("not-invited: …") survives to the client even in
-       *   production, so the sign-in screen tells the truth.
-       *
-       * Single-tenant: one `members` table per deployment. Invite mechanism: a plain
-       * email allowlist (`invites` table) — the simplest server-enforced design, no
-       * token infrastructure.
-       */
+      /** EC-358: reject uninvited account creation BEFORE any row commits. */
+      async afterUserCreatedOrUpdated(ctx, { userId, profile }) {
+        await gateAccountCreation(ctx, { userId, profile })
+      },
+      /** EC-324: the every-sign-in gate — bootstrap / grant / consume / reject. */
       async beforeSessionCreation(ctx, { userId }) {
-        const now = new Date().toISOString()
-        // The convexAuth callback ctx is `AnyDataModel` (not schema-bound), so use
-        // `.filter()` rather than `.withIndex()` here. The members/invites tables are
-        // tiny (single-tenant), and this runs only at sign-in.
-        const existingMember = await ctx.db
-          .query('members')
-          .filter((q) => q.eq(q.field('userId'), userId))
-          .first()
-        const anyMember = existingMember ?? (await ctx.db.query('members').first())
-        const user = await ctx.db.get(userId)
-        const rawEmail = (user as { email?: string } | null)?.email
-        const email = rawEmail ? normalizeInviteEmail(rawEmail) : null
-        const invite = email
-          ? await ctx.db
-              .query('invites')
-              .filter((q) => q.eq(q.field('email'), email))
-              .first()
-          : null
-
-        const decision = classifyInviteSignup({
-          hasAnyMember: anyMember !== null,
-          existingRole: existingMember?.role ?? null,
-          invite: invite ? { role: invite.role } : null,
-        })
-
-        switch (decision.kind) {
-          case 'existing-member':
-            return
-          case 'bootstrap-admin':
-            await ctx.db.insert('members', { userId, role: 'admin', createdAt: now, updatedAt: now })
-            return
-          case 'grant-role':
-            await ctx.db.insert('members', {
-              userId,
-              role: decision.role,
-              createdAt: now,
-              updatedAt: now,
-            })
-            if (invite) await ctx.db.delete(invite._id)
-            return
-          case 'reject':
-            throw new ConvexError(decision.reason)
-        }
+        await gateSessionCreation(ctx, { userId })
       },
     },
   })

package/convex/invites.ts

@@ -1,5 +1,7 @@
 import { v } from 'convex/values'
+import { selectOrphanCredentialPurges } from '@elytracms/core/persistence'
 import { mutation, query } from './functions'
+import type { MutationCtx } from './functions'
 import { requireCapability } from './guard'
 
 /**
@@ -17,6 +19,78 @@ import { requireCapability } from './guard'
 
 const normalizeEmail = (email: string): string => email.trim().toLowerCase()
 
+/**
+ * EC-358 — an invite must never adopt pre-existing orphan credentials.
+ *
+ * Threat: an attacker pre-registers a password for someone's email; before
+ * EC-358's account-creation gate that left an orphan (member-less)
+ * `users` + `authAccounts` pair, and a later invite for that email would have
+ * silently promoted the ATTACKER's credentials at their next sign-in. Creating
+ * an invite is therefore the purge chokepoint: purging at gate-promotion time
+ * would be too late by construction — the promotion is *triggered by* whoever
+ * holds the password. Purged here, the invited person always sets their own.
+ *
+ * WHAT is purged, per member-less user matching the invited email (selection is
+ * the pure `selectOrphanCredentialPurges`, normalized-email matched): their
+ * `authSessions` (+ `authRefreshTokens`), `authAccounts`
+ * (+ `authVerificationCodes`), and the `users` row itself — so no stale session
+ * or reset code survives the credential purge. A user with a `members` row is
+ * NEVER touched, whatever their email. Runs in the invite-creation mutation, so
+ * purge + invite land in one atomic transaction.
+ *
+ * The `users` table is tiny (single-tenant studio principals), so the
+ * collect-and-match scan is fine — and required, because the auth provider
+ * stores emails as typed at sign-up (an index lookup on the normalized email
+ * would miss case-varied orphans the sign-in gate would still promote).
+ */
+export async function purgeOrphanCredentials(
+  ctx: Pick<MutationCtx, 'db'>,
+  invitedEmail: string,
+): Promise<number> {
+  const members = await ctx.db.query('members').collect()
+  const memberIds = new Set(members.map((member) => member.userId))
+  const users = await ctx.db.query('users').collect()
+  const purgeIds = new Set(
+    selectOrphanCredentialPurges(
+      invitedEmail,
+      users.map((user) => ({
+        id: String(user._id),
+        email: user.email ?? null,
+        isMember: memberIds.has(String(user._id)),
+      })),
+    ),
+  )
+  const orphans = users.filter((user) => purgeIds.has(String(user._id)))
+  for (const orphan of orphans) {
+    const sessions = await ctx.db
+      .query('authSessions')
+      .withIndex('userId', (q) => q.eq('userId', orphan._id))
+      .collect()
+    for (const session of sessions) {
+      const tokens = await ctx.db
+        .query('authRefreshTokens')
+        .withIndex('sessionId', (q) => q.eq('sessionId', session._id))
+        .collect()
+      for (const token of tokens) await ctx.db.delete(token._id)
+      await ctx.db.delete(session._id)
+    }
+    const accounts = await ctx.db
+      .query('authAccounts')
+      .withIndex('userIdAndProvider', (q) => q.eq('userId', orphan._id))
+      .collect()
+    for (const account of accounts) {
+      const codes = await ctx.db
+        .query('authVerificationCodes')
+        .withIndex('accountId', (q) => q.eq('accountId', account._id))
+        .collect()
+      for (const code of codes) await ctx.db.delete(code._id)
+      await ctx.db.delete(account._id)
+    }
+    await ctx.db.delete(orphan._id)
+  }
+  return orphans.length
+}
+
 export const list = query({
   args: {},
   handler: async (ctx) => {
@@ -37,6 +111,9 @@ export const create = mutation({
   handler: async (ctx, args) => {
     await requireCapability(ctx, 'project.administer')
     const email = normalizeEmail(args.email)
+    // EC-358: never adopt orphan credentials — purge member-less auth rows for
+    // this email atomically with the invite, so the invitee sets their own password.
+    await purgeOrphanCredentials(ctx, email)
     const existing = await ctx.db
       .query('invites')
       .withIndex('by_email', (q) => q.eq('email', email))

package/dist/lib/auth/convex-auth-adapter.d.ts

@@ -12,6 +12,56 @@ import type { SessionStore } from './local-auth-adapter';
  * fallback is the neutral "unavailable" branch (never "password too short").
  */
 export declare function isDeploymentMisconfigured(message: string): boolean;
+/**
+ * Reduce a thrown Convex error to the text used for classification (EC-362).
+ *
+ * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex
+ * deployment REDACTS a UDF's thrown-error `.message` to a generic
+ * `"[Request ID: …] Server Error"`, but a `ConvexError`'s `.data` payload
+ * survives to the client. Proven in the installed `convex@1.42.1` browser
+ * client: on an `"error"` response `ConvexHttpClient.action` throws
+ * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,
+ * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`
+ * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps
+ * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the
+ * only classifiable text that survives prod is the `.data` of a `ConvexError` —
+ * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments
+ * nothing is redacted, so `.message` also carries the token (the regex ladder
+ * still matches); non-Convex errors only have a `.message`.
+ *
+ * Duck-types the `data` property rather than `instanceof ConvexError`: two
+ * copies of the `convex` module can coexist under Vite (transformed vs
+ * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a
+ * string (our gates) or a structured object (future gates) — both are folded in.
+ */
+export declare function convexErrorClassifierText(error: unknown): string;
+type SignInFailure = Extract<SignInResult, {
+    ok: false;
+}>;
+/**
+ * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the
+ * regex ladder over {@link convexErrorClassifierText} output (data-first).
+ *
+ * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited
+ * sign-up (EC-324) are each checked BEFORE the credential regex so neither
+ * degrades to the lying "password too short". The final fallback is HONEST
+ * ("unexpected server error — check the deployment logs"), never "unavailable":
+ * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by
+ * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts
+ * them to `"Server Error"` with no `.data` and they legitimately land here.
+ */
+export declare function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure;
+type ChangePasswordFailure = Extract<ChangePasswordResult, {
+    ok: false;
+}>;
+/**
+ * Pure password-change error classifier (EC-240 H-tail / EC-362). Same
+ * data-first text + honest fallback discipline as {@link classifySignInError};
+ * `deployment-misconfigured` collapses onto the `unavailable` reason
+ * (`ChangePasswordResult` has no dedicated reason for it) with a specific
+ * remediation message.
+ */
+export declare function classifyChangePasswordError(text: string): ChangePasswordFailure;
 /**
  * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a
  * session is scoped to its deployment: signing into Aurora's backend must not
@@ -64,3 +114,4 @@ export declare class ConvexAuthAdapter implements AuthAdapter {
     private toUser;
     private clearToken;
 }
+export {};

package/dist/lib/auth/convex-auth-adapter.js

@@ -35,6 +35,146 @@ const TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt';
 export function isDeploymentMisconfigured(message) {
     return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key/i.test(message);
 }
+/**
+ * Reduce a thrown Convex error to the text used for classification (EC-362).
+ *
+ * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex
+ * deployment REDACTS a UDF's thrown-error `.message` to a generic
+ * `"[Request ID: …] Server Error"`, but a `ConvexError`'s `.data` payload
+ * survives to the client. Proven in the installed `convex@1.42.1` browser
+ * client: on an `"error"` response `ConvexHttpClient.action` throws
+ * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,
+ * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`
+ * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps
+ * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the
+ * only classifiable text that survives prod is the `.data` of a `ConvexError` —
+ * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments
+ * nothing is redacted, so `.message` also carries the token (the regex ladder
+ * still matches); non-Convex errors only have a `.message`.
+ *
+ * Duck-types the `data` property rather than `instanceof ConvexError`: two
+ * copies of the `convex` module can coexist under Vite (transformed vs
+ * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a
+ * string (our gates) or a structured object (future gates) — both are folded in.
+ */
+export function convexErrorClassifierText(error) {
+    const parts = [];
+    if (typeof error === 'object' && error !== null && 'data' in error) {
+        const data = error.data;
+        if (typeof data === 'string') {
+            parts.push(data);
+        }
+        else if (data !== null && data !== undefined) {
+            try {
+                parts.push(JSON.stringify(data));
+            }
+            catch {
+                // Non-serializable data (cycles) — ignore; fall back to the message.
+            }
+        }
+    }
+    if (error instanceof Error)
+        parts.push(error.message);
+    else if (typeof error === 'string')
+        parts.push(error);
+    if (parts.length === 0)
+        parts.push(String(error));
+    return parts.join('\n');
+}
+/**
+ * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the
+ * regex ladder over {@link convexErrorClassifierText} output (data-first).
+ *
+ * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited
+ * sign-up (EC-324) are each checked BEFORE the credential regex so neither
+ * degrades to the lying "password too short". The final fallback is HONEST
+ * ("unexpected server error — check the deployment logs"), never "unavailable":
+ * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by
+ * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts
+ * them to `"Server Error"` with no `.data` and they legitimately land here.
+ */
+export function classifySignInError(flow, text) {
+    // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be
+    // classified FIRST so it never falls through to the lying "password too short".
+    // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`
+    // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth` never
+    // run) the `requireEnv`/`importPKCS8` call throws AFTER the password is validated,
+    // so EVERY sign-in fails regardless of the password.
+    if (isDeploymentMisconfigured(text)) {
+        return {
+            ok: false,
+            reason: 'deployment-misconfigured',
+            message: 'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',
+        };
+    }
+    // EC-324: an uninvited sign-up is rejected server-side (`gateAccountCreation`/
+    // `gateSessionCreation` throw `ConvexError(NOT_INVITED_REASON)`, whose `.data`
+    // survives to the client even in production). Checked BEFORE the credential regex.
+    if (/not-invited|invite-only|invite only/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'not-invited',
+            message: 'This deployment is invite-only. Ask an admin to invite your email, then create your account.',
+        };
+    }
+    if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'account-exists',
+            message: 'An account with this email already exists — sign in instead.',
+        };
+    }
+    if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'invalid-credentials',
+            message: flow === 'signUp'
+                ? 'That email or password can’t be used (password too short?).'
+                : 'Email or password is incorrect.',
+        };
+    }
+    const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in';
+    return {
+        ok: false,
+        reason: 'unavailable',
+        message: `${verb} failed (unexpected server error) — check the deployment logs.`,
+    };
+}
+/**
+ * Pure password-change error classifier (EC-240 H-tail / EC-362). Same
+ * data-first text + honest fallback discipline as {@link classifySignInError};
+ * `deployment-misconfigured` collapses onto the `unavailable` reason
+ * (`ChangePasswordResult` has no dedicated reason for it) with a specific
+ * remediation message.
+ */
+export function classifyChangePasswordError(text) {
+    if (isDeploymentMisconfigured(text)) {
+        return {
+            ok: false,
+            reason: 'unavailable',
+            message: 'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',
+        };
+    }
+    if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'invalid-credentials',
+            message: 'Your current password is incorrect.',
+        };
+    }
+    if (/at least|too short|8 characters|password requirement|weak/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'weak-password',
+            message: 'Choose a stronger password (at least 8 characters).',
+        };
+    }
+    return {
+        ok: false,
+        reason: 'unavailable',
+        message: 'Password change failed (unexpected server error) — check the deployment logs.',
+    };
+}
 /**
  * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a
  * session is scoped to its deployment: signing into Aurora's backend must not
@@ -120,50 +260,10 @@ export class ConvexAuthAdapter {
         }
         catch (error) {
             // Convex Auth surfaces credential/registration problems as thrown errors.
-            const message = error instanceof Error ? error.message : String(error);
-            // EC-257: a DEPLOYMENT-misconfiguration — not a credential problem — must be
-            // classified FIRST so it never falls through to the lying "password too short".
-            // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`
-            // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth`
-            // never run) the `requireEnv`/`importPKCS8` call throws *after* the password
-            // is validated, so EVERY sign-in fails regardless of the password. This is
-            // the exact footgun that cost hours on the Konditorei proof (2026-06-22).
-            if (isDeploymentMisconfigured(message)) {
-                return {
-                    ok: false,
-                    reason: 'deployment-misconfigured',
-                    message: 'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',
-                };
-            }
-            // EC-324: an uninvited sign-up is rejected server-side (`beforeSessionCreation`
-            // throws a `ConvexError('not-invited: …')`, whose data survives to the client
-            // even in production). Classified BEFORE the credential regex so it never
-            // degrades to "password too short".
-            if (/not-invited|invite-only|invite only/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'not-invited',
-                    message: 'This deployment is invite-only. Ask an admin to invite your email, then create your account.',
-                };
-            }
-            if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'account-exists',
-                    message: 'An account with this email already exists — sign in instead.',
-                };
-            }
-            if (/InvalidSecret|InvalidAccountId|credential|password/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'invalid-credentials',
-                    message: flow === 'signUp'
-                        ? 'That email or password can’t be used (password too short?).'
-                        : 'Email or password is incorrect.',
-                };
-            }
-            const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in';
-            return { ok: false, reason: 'unavailable', message: `${verb} is currently unavailable.` };
+            // Classify from the DATA-FIRST text (a `ConvexError`'s `.data` survives prod
+            // redaction, the redacted `.message` does not — EC-362), then apply the pure
+            // regex ladder. See `convexErrorClassifierText` / `classifySignInError`.
+            return classifySignInError(flow, convexErrorClassifierText(error));
         }
         if (!result.tokens) {
             return {
@@ -239,29 +339,10 @@ export class ConvexAuthAdapter {
             return { ok: true };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (isDeploymentMisconfigured(message)) {
-                return {
-                    ok: false,
-                    reason: 'unavailable',
-                    message: 'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',
-                };
-            }
-            if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'invalid-credentials',
-                    message: 'Your current password is incorrect.',
-                };
-            }
-            if (/at least|too short|8 characters|password requirement|weak/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'weak-password',
-                    message: 'Choose a stronger password (at least 8 characters).',
-                };
-            }
-            return { ok: false, reason: 'unavailable', message: 'Password change is currently unavailable.' };
+            // Data-first classification (EC-362): the change-password ACTION runs on the
+            // same deployment, so a prod redaction erases the thrown `.message` the same
+            // way — read a surviving `ConvexError.data` first.
+            return classifyChangePasswordError(convexErrorClassifierText(error));
         }
     }
     toUser(me) {

package/dist/lib/auth/convex-auth-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAa/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,sFAAsF,CAAC,IAAI,CAChG,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,6EAA6E;YAC7E,gFAAgF;YAChF,4EAA4E;YAC5E,0EAA0E;YAC1E,6EAA6E;YAC7E,2EAA2E;YAC3E,0EAA0E;YAC1E,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,0BAA0B;oBAClC,OAAO,EACL,oLAAoL;iBACvL,CAAA;YACH,CAAC;YACD,gFAAgF;YAChF,8EAA8E;YAC9E,0EAA0E;YAC1E,oCAAoC;YACpC,IAAI,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,aAAa;oBACrB,OAAO,EACL,8FAA8F;iBACjG,CAAA;YACH,CAAC;YACD,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,gBAAgB;oBACxB,OAAO,EAAE,8DAA8D;iBACxE,CAAA;YACH,CAAC;YACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qBAAqB;oBAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;wBACf,CAAC,CAAC,6DAA6D;wBAC/D,CAAC,CAAC,iCAAiC;iBACxC,CAAA;YACH,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,4BAA4B,EAAE,CAAA;QAC3F,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,EAAE;gBAC7D,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBAC1D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,aAAa;oBACrB,OAAO,EACL,0GAA0G;iBAC7G,CAAA;YACH,CAAC;YACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qBAAqB;oBAC7B,OAAO,EAAE,qCAAqC;iBAC/C,CAAA;YACH,CAAC;YACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,qDAAqD;iBAC/D,CAAA;YACH,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAA;QACnG,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF","sourcesContent":["import type { ConvexHttpClient } from 'convex/browser'\nimport { actionRef, mutationRef, queryRef } from '../persistence/convex-client'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nimport type { SessionStore } from './local-auth-adapter'\n\n/**\n * Convex Auth implementation of the project-owned {@link AuthAdapter}\n * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over\n * Clerk — self-contained on the Convex stack, sessions in our own tables, no\n * extra vendor; reachable only through this adapter so a swap stays local.\n *\n * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):\n * 1. `signIn` calls the `auth:signIn` action with the Password provider\n *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.\n * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every\n *    subsequent persistence query/mutation runs authenticated and the\n *    server-side `requireRole` guards see the caller.\n * 3. `currentSession` restores the JWT from storage and asks `users:me`.\n * 4. `signOut` calls `auth:signOut` and clears the JWT.\n *\n * v1 scope note: the stored JWT is short-lived and this adapter does not yet\n * run the refresh-token loop (the official `@convex-dev/auth/react` client\n * does); an expired session simply resolves to \"signed out\" and the user signs\n * in again. Live-deployment hardening is EC-156. No live deployment exists in\n * this repo — this file is typecheck-verified and exercised against the local\n * adapter's shared interface.\n */\n\nconst TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt'\n\n/**\n * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a\n * credential problem (EC-257). Matches the Convex Auth signing-path throws:\n * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ \"Missing environment\n * variable …\") and `importPKCS8` on a malformed key. Deliberately narrow — a genuine\n * wrong-password error carries none of these tokens — and checked BEFORE the credential\n * regex so it always wins. Note: a PRODUCTION deployment redacts non-`ConvexError`\n * messages to a generic \"Server Error\", which this can't match; there the honest\n * fallback is the neutral \"unavailable\" branch (never \"password too short\").\n */\nexport function isDeploymentMisconfigured(message: string): boolean {\n  return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key/i.test(\n    message,\n  )\n}\n\n/**\n * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a\n * session is scoped to its deployment: signing into Aurora's backend must not\n * carry a JWT to Northwind's. Keying the stored token by the deployment URL\n * makes each backend's session independent — switching to a project on a\n * not-yet-authenticated backend reads no token and the guard asks for sign-in.\n * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid\n * on every deployment, collapsing this back to a single session.)\n */\nexport function tokenStorageKey(deploymentUrl?: string): string {\n  return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX\n}\n\n/**\n * Best-effort \"is there a session for this deployment?\" — a synchronous token\n * presence check used to label per-backend projects in the switcher/launcher\n * (EC-179). It does not validate the token (an expired one still redirects to\n * sign-in on entry); it just answers \"has the user signed into this backend?\".\n */\nexport function hasStoredConvexSession(\n  deploymentUrl: string,\n  store: SessionStore = defaultStore(),\n): boolean {\n  return store.getItem(tokenStorageKey(deploymentUrl)) !== null\n}\n\ninterface SignInActionResult {\n  tokens?: { token: string; refreshToken: string } | null\n}\n\ninterface MeResult {\n  id: string\n  email: string\n  name?: string\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class ConvexAuthAdapter implements AuthAdapter {\n  private readonly tokenKey: string\n\n  constructor(\n    private readonly client: ConvexHttpClient,\n    private readonly store: SessionStore = defaultStore(),\n    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */\n    deploymentUrl?: string,\n  ) {\n    this.tokenKey = tokenStorageKey(deploymentUrl)\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return null\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        this.clearToken()\n        return null\n      }\n      return { user: this.toUser(me) }\n    } catch {\n      // Expired/invalid JWT or unreachable backend → treat as signed out.\n      this.clearToken()\n      return null\n    }\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signIn', credentials)\n  }\n\n  async signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signUp', credentials)\n  }\n\n  /**\n   * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by\n   * the Convex Auth `flow` param; both return a token + load `users:me`.\n   */\n  private async authenticate(\n    flow: 'signIn' | 'signUp',\n    credentials: SignInCredentials,\n  ): Promise<SignInResult> {\n    let result: SignInActionResult\n    try {\n      result = (await this.client.action(actionRef('auth:signIn'), {\n        provider: 'password',\n        params: {\n          email: credentials.email.trim().toLowerCase(),\n          password: credentials.password,\n          flow,\n        },\n      })) as SignInActionResult\n    } catch (error) {\n      // Convex Auth surfaces credential/registration problems as thrown errors.\n      const message = error instanceof Error ? error.message : String(error)\n      // EC-257: a DEPLOYMENT-misconfiguration — not a credential problem — must be\n      // classified FIRST so it never falls through to the lying \"password too short\".\n      // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`\n      // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth`\n      // never run) the `requireEnv`/`importPKCS8` call throws *after* the password\n      // is validated, so EVERY sign-in fails regardless of the password. This is\n      // the exact footgun that cost hours on the Konditorei proof (2026-06-22).\n      if (isDeploymentMisconfigured(message)) {\n        return {\n          ok: false,\n          reason: 'deployment-misconfigured',\n          message:\n            'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',\n        }\n      }\n      // EC-324: an uninvited sign-up is rejected server-side (`beforeSessionCreation`\n      // throws a `ConvexError('not-invited: …')`, whose data survives to the client\n      // even in production). Classified BEFORE the credential regex so it never\n      // degrades to \"password too short\".\n      if (/not-invited|invite-only|invite only/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'not-invited',\n          message:\n            'This deployment is invite-only. Ask an admin to invite your email, then create your account.',\n        }\n      }\n      if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'account-exists',\n          message: 'An account with this email already exists — sign in instead.',\n        }\n      }\n      if (/InvalidSecret|InvalidAccountId|credential|password/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'invalid-credentials',\n          message:\n            flow === 'signUp'\n              ? 'That email or password can’t be used (password too short?).'\n              : 'Email or password is incorrect.',\n        }\n      }\n      const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in'\n      return { ok: false, reason: 'unavailable', message: `${verb} is currently unavailable.` }\n    }\n    if (!result.tokens) {\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(this.tokenKey, result.tokens.token)\n    this.client.setAuth(result.tokens.token)\n    const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n    if (!me) {\n      this.clearToken()\n      return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' }\n    }\n    return { ok: true, session: { user: this.toUser(me) } }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      await this.client.action(actionRef('auth:signOut'), {})\n    } catch {\n      // Already signed out / unreachable — clearing local state is what matters.\n    }\n    this.clearToken()\n  }\n\n  /**\n   * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN\n   * auth `users` row (name / avatar) via the self-scoped `users:updateProfile`\n   * mutation, then re-reads `users:me` so the returned session carries the new\n   * name. Auth-owned fields never flow through the members-rail `users.save`.\n   */\n  async updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.mutation(mutationRef('users:updateProfile'), {\n        ...(input.name !== undefined ? { name: input.name } : {}),\n        ...(input.avatar !== undefined ? { avatar: input.avatar } : {}),\n      })\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n      }\n      return { ok: true, session: { user: this.toUser(me) } }\n    } catch {\n      return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n    }\n  }\n\n  /**\n   * Self-service password change (EC-240 H-tail item 3). Delegates entirely to\n   * the provider via the self-scoped `users:changePassword` ACTION (which calls\n   * Convex Auth's `retrieveAccount` to verify the current password, then\n   * `modifyAccountCredentials` to set the new one). **Seam only:** the raw\n   * password values are forwarded to the provider and NEVER logged or inspected\n   * here.\n   */\n  async changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.action(actionRef('users:changePassword'), {\n        currentPassword: input.currentPassword,\n        newPassword: input.newPassword,\n      })\n      return { ok: true }\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error)\n      if (isDeploymentMisconfigured(message)) {\n        return {\n          ok: false,\n          reason: 'unavailable',\n          message:\n            'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',\n        }\n      }\n      if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'invalid-credentials',\n          message: 'Your current password is incorrect.',\n        }\n      }\n      if (/at least|too short|8 characters|password requirement|weak/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'weak-password',\n          message: 'Choose a stronger password (at least 8 characters).',\n        }\n      }\n      return { ok: false, reason: 'unavailable', message: 'Password change is currently unavailable.' }\n    }\n  }\n\n  private toUser(me: MeResult): AuthSession['user'] {\n    return {\n      id: me.id,\n      email: me.email,\n      ...(me.name ? { name: me.name } : {}),\n      // No global flags: project creation is config/CLI-owned (AD-11), so there\n      // is no in-studio `create-projects` capability. Per-project roles come\n      // from `projectMembers`.\n      globalFlags: [],\n    }\n  }\n\n  private clearToken(): void {\n    this.store.removeItem(this.tokenKey)\n    this.client.clearAuth()\n  }\n}\n"]}
+{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAa/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,sFAAsF,CAAC,IAAI,CAChG,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAA;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,YAAY,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAID;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB,EAAE,IAAY;IACzE,kFAAkF;IAClF,gFAAgF;IAChF,4EAA4E;IAC5E,gFAAgF;IAChF,mFAAmF;IACnF,qDAAqD;IACrD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EACL,oLAAoL;SACvL,CAAA;IACH,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,8FAA8F;SACjG,CAAA;IACH,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,8DAA8D;SACxE,CAAA;IACH,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,iCAAiC;SACxC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,GAAG,IAAI,gEAAgE;KACjF,CAAA;AACH,CAAC;AAID;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,0GAA0G;SAC7G,CAAA;IACH,CAAC;IACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,qCAAqC;SAC/C,CAAA;IACH,CAAC;IACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,+EAA+E;KACzF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,yEAAyE;YACzE,OAAO,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,EAAE;gBAC7D,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBAC1D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,6EAA6E;YAC7E,mDAAmD;YACnD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF","sourcesContent":["import type { ConvexHttpClient } from 'convex/browser'\nimport { actionRef, mutationRef, queryRef } from '../persistence/convex-client'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nimport type { SessionStore } from './local-auth-adapter'\n\n/**\n * Convex Auth implementation of the project-owned {@link AuthAdapter}\n * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over\n * Clerk — self-contained on the Convex stack, sessions in our own tables, no\n * extra vendor; reachable only through this adapter so a swap stays local.\n *\n * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):\n * 1. `signIn` calls the `auth:signIn` action with the Password provider\n *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.\n * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every\n *    subsequent persistence query/mutation runs authenticated and the\n *    server-side `requireRole` guards see the caller.\n * 3. `currentSession` restores the JWT from storage and asks `users:me`.\n * 4. `signOut` calls `auth:signOut` and clears the JWT.\n *\n * v1 scope note: the stored JWT is short-lived and this adapter does not yet\n * run the refresh-token loop (the official `@convex-dev/auth/react` client\n * does); an expired session simply resolves to \"signed out\" and the user signs\n * in again. Live-deployment hardening is EC-156. No live deployment exists in\n * this repo — this file is typecheck-verified and exercised against the local\n * adapter's shared interface.\n */\n\nconst TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt'\n\n/**\n * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a\n * credential problem (EC-257). Matches the Convex Auth signing-path throws:\n * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ \"Missing environment\n * variable …\") and `importPKCS8` on a malformed key. Deliberately narrow — a genuine\n * wrong-password error carries none of these tokens — and checked BEFORE the credential\n * regex so it always wins. Note: a PRODUCTION deployment redacts non-`ConvexError`\n * messages to a generic \"Server Error\", which this can't match; there the honest\n * fallback is the neutral \"unavailable\" branch (never \"password too short\").\n */\nexport function isDeploymentMisconfigured(message: string): boolean {\n  return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key/i.test(\n    message,\n  )\n}\n\n/**\n * Reduce a thrown Convex error to the text used for classification (EC-362).\n *\n * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex\n * deployment REDACTS a UDF's thrown-error `.message` to a generic\n * `\"[Request ID: …] Server Error\"`, but a `ConvexError`'s `.data` payload\n * survives to the client. Proven in the installed `convex@1.42.1` browser\n * client: on an `\"error\"` response `ConvexHttpClient.action` throws\n * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,\n * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`\n * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps\n * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the\n * only classifiable text that survives prod is the `.data` of a `ConvexError` —\n * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments\n * nothing is redacted, so `.message` also carries the token (the regex ladder\n * still matches); non-Convex errors only have a `.message`.\n *\n * Duck-types the `data` property rather than `instanceof ConvexError`: two\n * copies of the `convex` module can coexist under Vite (transformed vs\n * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a\n * string (our gates) or a structured object (future gates) — both are folded in.\n */\nexport function convexErrorClassifierText(error: unknown): string {\n  const parts: string[] = []\n  if (typeof error === 'object' && error !== null && 'data' in error) {\n    const data = (error as { data: unknown }).data\n    if (typeof data === 'string') {\n      parts.push(data)\n    } else if (data !== null && data !== undefined) {\n      try {\n        parts.push(JSON.stringify(data))\n      } catch {\n        // Non-serializable data (cycles) — ignore; fall back to the message.\n      }\n    }\n  }\n  if (error instanceof Error) parts.push(error.message)\n  else if (typeof error === 'string') parts.push(error)\n  if (parts.length === 0) parts.push(String(error))\n  return parts.join('\\n')\n}\n\ntype SignInFailure = Extract<SignInResult, { ok: false }>\n\n/**\n * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the\n * regex ladder over {@link convexErrorClassifierText} output (data-first).\n *\n * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited\n * sign-up (EC-324) are each checked BEFORE the credential regex so neither\n * degrades to the lying \"password too short\". The final fallback is HONEST\n * (\"unexpected server error — check the deployment logs\"), never \"unavailable\":\n * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by\n * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts\n * them to `\"Server Error\"` with no `.data` and they legitimately land here.\n */\nexport function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure {\n  // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be\n  // classified FIRST so it never falls through to the lying \"password too short\".\n  // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`\n  // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth` never\n  // run) the `requireEnv`/`importPKCS8` call throws AFTER the password is validated,\n  // so EVERY sign-in fails regardless of the password.\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'deployment-misconfigured',\n      message:\n        'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',\n    }\n  }\n  // EC-324: an uninvited sign-up is rejected server-side (`gateAccountCreation`/\n  // `gateSessionCreation` throw `ConvexError(NOT_INVITED_REASON)`, whose `.data`\n  // survives to the client even in production). Checked BEFORE the credential regex.\n  if (/not-invited|invite-only|invite only/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'not-invited',\n      message:\n        'This deployment is invite-only. Ask an admin to invite your email, then create your account.',\n    }\n  }\n  if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'account-exists',\n      message: 'An account with this email already exists — sign in instead.',\n    }\n  }\n  if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message:\n        flow === 'signUp'\n          ? 'That email or password can’t be used (password too short?).'\n          : 'Email or password is incorrect.',\n    }\n  }\n  const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in'\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: `${verb} failed (unexpected server error) — check the deployment logs.`,\n  }\n}\n\ntype ChangePasswordFailure = Extract<ChangePasswordResult, { ok: false }>\n\n/**\n * Pure password-change error classifier (EC-240 H-tail / EC-362). Same\n * data-first text + honest fallback discipline as {@link classifySignInError};\n * `deployment-misconfigured` collapses onto the `unavailable` reason\n * (`ChangePasswordResult` has no dedicated reason for it) with a specific\n * remediation message.\n */\nexport function classifyChangePasswordError(text: string): ChangePasswordFailure {\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message:\n        'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',\n    }\n  }\n  if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message: 'Your current password is incorrect.',\n    }\n  }\n  if (/at least|too short|8 characters|password requirement|weak/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'weak-password',\n      message: 'Choose a stronger password (at least 8 characters).',\n    }\n  }\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: 'Password change failed (unexpected server error) — check the deployment logs.',\n  }\n}\n\n/**\n * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a\n * session is scoped to its deployment: signing into Aurora's backend must not\n * carry a JWT to Northwind's. Keying the stored token by the deployment URL\n * makes each backend's session independent — switching to a project on a\n * not-yet-authenticated backend reads no token and the guard asks for sign-in.\n * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid\n * on every deployment, collapsing this back to a single session.)\n */\nexport function tokenStorageKey(deploymentUrl?: string): string {\n  return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX\n}\n\n/**\n * Best-effort \"is there a session for this deployment?\" — a synchronous token\n * presence check used to label per-backend projects in the switcher/launcher\n * (EC-179). It does not validate the token (an expired one still redirects to\n * sign-in on entry); it just answers \"has the user signed into this backend?\".\n */\nexport function hasStoredConvexSession(\n  deploymentUrl: string,\n  store: SessionStore = defaultStore(),\n): boolean {\n  return store.getItem(tokenStorageKey(deploymentUrl)) !== null\n}\n\ninterface SignInActionResult {\n  tokens?: { token: string; refreshToken: string } | null\n}\n\ninterface MeResult {\n  id: string\n  email: string\n  name?: string\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class ConvexAuthAdapter implements AuthAdapter {\n  private readonly tokenKey: string\n\n  constructor(\n    private readonly client: ConvexHttpClient,\n    private readonly store: SessionStore = defaultStore(),\n    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */\n    deploymentUrl?: string,\n  ) {\n    this.tokenKey = tokenStorageKey(deploymentUrl)\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return null\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        this.clearToken()\n        return null\n      }\n      return { user: this.toUser(me) }\n    } catch {\n      // Expired/invalid JWT or unreachable backend → treat as signed out.\n      this.clearToken()\n      return null\n    }\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signIn', credentials)\n  }\n\n  async signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signUp', credentials)\n  }\n\n  /**\n   * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by\n   * the Convex Auth `flow` param; both return a token + load `users:me`.\n   */\n  private async authenticate(\n    flow: 'signIn' | 'signUp',\n    credentials: SignInCredentials,\n  ): Promise<SignInResult> {\n    let result: SignInActionResult\n    try {\n      result = (await this.client.action(actionRef('auth:signIn'), {\n        provider: 'password',\n        params: {\n          email: credentials.email.trim().toLowerCase(),\n          password: credentials.password,\n          flow,\n        },\n      })) as SignInActionResult\n    } catch (error) {\n      // Convex Auth surfaces credential/registration problems as thrown errors.\n      // Classify from the DATA-FIRST text (a `ConvexError`'s `.data` survives prod\n      // redaction, the redacted `.message` does not — EC-362), then apply the pure\n      // regex ladder. See `convexErrorClassifierText` / `classifySignInError`.\n      return classifySignInError(flow, convexErrorClassifierText(error))\n    }\n    if (!result.tokens) {\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(this.tokenKey, result.tokens.token)\n    this.client.setAuth(result.tokens.token)\n    const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n    if (!me) {\n      this.clearToken()\n      return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' }\n    }\n    return { ok: true, session: { user: this.toUser(me) } }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      await this.client.action(actionRef('auth:signOut'), {})\n    } catch {\n      // Already signed out / unreachable — clearing local state is what matters.\n    }\n    this.clearToken()\n  }\n\n  /**\n   * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN\n   * auth `users` row (name / avatar) via the self-scoped `users:updateProfile`\n   * mutation, then re-reads `users:me` so the returned session carries the new\n   * name. Auth-owned fields never flow through the members-rail `users.save`.\n   */\n  async updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.mutation(mutationRef('users:updateProfile'), {\n        ...(input.name !== undefined ? { name: input.name } : {}),\n        ...(input.avatar !== undefined ? { avatar: input.avatar } : {}),\n      })\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n      }\n      return { ok: true, session: { user: this.toUser(me) } }\n    } catch {\n      return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n    }\n  }\n\n  /**\n   * Self-service password change (EC-240 H-tail item 3). Delegates entirely to\n   * the provider via the self-scoped `users:changePassword` ACTION (which calls\n   * Convex Auth's `retrieveAccount` to verify the current password, then\n   * `modifyAccountCredentials` to set the new one). **Seam only:** the raw\n   * password values are forwarded to the provider and NEVER logged or inspected\n   * here.\n   */\n  async changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.action(actionRef('users:changePassword'), {\n        currentPassword: input.currentPassword,\n        newPassword: input.newPassword,\n      })\n      return { ok: true }\n    } catch (error) {\n      // Data-first classification (EC-362): the change-password ACTION runs on the\n      // same deployment, so a prod redaction erases the thrown `.message` the same\n      // way — read a surviving `ConvexError.data` first.\n      return classifyChangePasswordError(convexErrorClassifierText(error))\n    }\n  }\n\n  private toUser(me: MeResult): AuthSession['user'] {\n    return {\n      id: me.id,\n      email: me.email,\n      ...(me.name ? { name: me.name } : {}),\n      // No global flags: project creation is config/CLI-owned (AD-11), so there\n      // is no in-studio `create-projects` capability. Per-project roles come\n      // from `projectMembers`.\n      globalFlags: [],\n    }\n  }\n\n  private clearToken(): void {\n    this.store.removeItem(this.tokenKey)\n    this.client.clearAuth()\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@elytracms/studio",
   "author": "finaldream <hi@finaldream.de>",
-  "version": "0.0.51",
+  "version": "0.0.52",
   "private": false,
   "description": "The Elytra studio engine (UI + lib + routes + data-only Convex schema) as an importable package. Extraction staged in EXTRACTION.md (EC-223); Stages 1-2 = UI primitives + router-free lib leaves.",
   "license": "MIT",
@@ -136,7 +136,7 @@
     "lucide-react": "^1.23.0",
     "tailwind-merge": "^3.6.0",
     "zod": "^4.4.3",
-    "@elytracms/core": "^0.0.51"
+    "@elytracms/core": "^0.0.52"
   },
   "peerDependencies": {
     "@tanstack/react-router": "^1.170.0",