@elytracms/studio 0.0.51 → 0.0.53

package/dist/lib/auth/convex-auth-adapter.d.ts

@@ -1,6 +1,6 @@
 import type { ConvexHttpClient } from 'convex/browser';
-import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter';
-import type { SessionStore } from './local-auth-adapter';
+import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter.js';
+import type { SessionStore } from './local-auth-adapter.js';
 /**
  * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a
  * credential problem (EC-257). Matches the Convex Auth signing-path throws:
@@ -12,6 +12,56 @@ import type { SessionStore } from './local-auth-adapter';
  * fallback is the neutral "unavailable" branch (never "password too short").
  */
 export declare function isDeploymentMisconfigured(message: string): boolean;
+/**
+ * Reduce a thrown Convex error to the text used for classification (EC-362).
+ *
+ * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex
+ * deployment REDACTS a UDF's thrown-error `.message` to a generic
+ * `"[Request ID: …] Server Error"`, but a `ConvexError`'s `.data` payload
+ * survives to the client. Proven in the installed `convex@1.42.1` browser
+ * client: on an `"error"` response `ConvexHttpClient.action` throws
+ * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,
+ * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`
+ * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps
+ * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the
+ * only classifiable text that survives prod is the `.data` of a `ConvexError` —
+ * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments
+ * nothing is redacted, so `.message` also carries the token (the regex ladder
+ * still matches); non-Convex errors only have a `.message`.
+ *
+ * Duck-types the `data` property rather than `instanceof ConvexError`: two
+ * copies of the `convex` module can coexist under Vite (transformed vs
+ * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a
+ * string (our gates) or a structured object (future gates) — both are folded in.
+ */
+export declare function convexErrorClassifierText(error: unknown): string;
+type SignInFailure = Extract<SignInResult, {
+    ok: false;
+}>;
+/**
+ * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the
+ * regex ladder over {@link convexErrorClassifierText} output (data-first).
+ *
+ * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited
+ * sign-up (EC-324) are each checked BEFORE the credential regex so neither
+ * degrades to the lying "password too short". The final fallback is HONEST
+ * ("unexpected server error — check the deployment logs"), never "unavailable":
+ * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by
+ * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts
+ * them to `"Server Error"` with no `.data` and they legitimately land here.
+ */
+export declare function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure;
+type ChangePasswordFailure = Extract<ChangePasswordResult, {
+    ok: false;
+}>;
+/**
+ * Pure password-change error classifier (EC-240 H-tail / EC-362). Same
+ * data-first text + honest fallback discipline as {@link classifySignInError};
+ * `deployment-misconfigured` collapses onto the `unavailable` reason
+ * (`ChangePasswordResult` has no dedicated reason for it) with a specific
+ * remediation message.
+ */
+export declare function classifyChangePasswordError(text: string): ChangePasswordFailure;
 /**
  * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a
  * session is scoped to its deployment: signing into Aurora's backend must not
@@ -64,3 +114,4 @@ export declare class ConvexAuthAdapter implements AuthAdapter {
     private toUser;
     private clearToken;
 }
+export {};

package/dist/lib/auth/convex-auth-adapter.js

@@ -1,4 +1,4 @@
-import { actionRef, mutationRef, queryRef } from '../persistence/convex-client';
+import { actionRef, mutationRef, queryRef } from '../persistence/convex-client.js';
 /**
  * Convex Auth implementation of the project-owned {@link AuthAdapter}
  * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over
@@ -35,6 +35,146 @@ const TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt';
 export function isDeploymentMisconfigured(message) {
     return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key/i.test(message);
 }
+/**
+ * Reduce a thrown Convex error to the text used for classification (EC-362).
+ *
+ * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex
+ * deployment REDACTS a UDF's thrown-error `.message` to a generic
+ * `"[Request ID: …] Server Error"`, but a `ConvexError`'s `.data` payload
+ * survives to the client. Proven in the installed `convex@1.42.1` browser
+ * client: on an `"error"` response `ConvexHttpClient.action` throws
+ * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,
+ * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`
+ * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps
+ * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the
+ * only classifiable text that survives prod is the `.data` of a `ConvexError` —
+ * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments
+ * nothing is redacted, so `.message` also carries the token (the regex ladder
+ * still matches); non-Convex errors only have a `.message`.
+ *
+ * Duck-types the `data` property rather than `instanceof ConvexError`: two
+ * copies of the `convex` module can coexist under Vite (transformed vs
+ * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a
+ * string (our gates) or a structured object (future gates) — both are folded in.
+ */
+export function convexErrorClassifierText(error) {
+    const parts = [];
+    if (typeof error === 'object' && error !== null && 'data' in error) {
+        const data = error.data;
+        if (typeof data === 'string') {
+            parts.push(data);
+        }
+        else if (data !== null && data !== undefined) {
+            try {
+                parts.push(JSON.stringify(data));
+            }
+            catch {
+                // Non-serializable data (cycles) — ignore; fall back to the message.
+            }
+        }
+    }
+    if (error instanceof Error)
+        parts.push(error.message);
+    else if (typeof error === 'string')
+        parts.push(error);
+    if (parts.length === 0)
+        parts.push(String(error));
+    return parts.join('\n');
+}
+/**
+ * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the
+ * regex ladder over {@link convexErrorClassifierText} output (data-first).
+ *
+ * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited
+ * sign-up (EC-324) are each checked BEFORE the credential regex so neither
+ * degrades to the lying "password too short". The final fallback is HONEST
+ * ("unexpected server error — check the deployment logs"), never "unavailable":
+ * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by
+ * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts
+ * them to `"Server Error"` with no `.data` and they legitimately land here.
+ */
+export function classifySignInError(flow, text) {
+    // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be
+    // classified FIRST so it never falls through to the lying "password too short".
+    // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`
+    // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth` never
+    // run) the `requireEnv`/`importPKCS8` call throws AFTER the password is validated,
+    // so EVERY sign-in fails regardless of the password.
+    if (isDeploymentMisconfigured(text)) {
+        return {
+            ok: false,
+            reason: 'deployment-misconfigured',
+            message: 'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',
+        };
+    }
+    // EC-324: an uninvited sign-up is rejected server-side (`gateAccountCreation`/
+    // `gateSessionCreation` throw `ConvexError(NOT_INVITED_REASON)`, whose `.data`
+    // survives to the client even in production). Checked BEFORE the credential regex.
+    if (/not-invited|invite-only|invite only/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'not-invited',
+            message: 'This deployment is invite-only. Ask an admin to invite your email, then create your account.',
+        };
+    }
+    if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'account-exists',
+            message: 'An account with this email already exists — sign in instead.',
+        };
+    }
+    if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'invalid-credentials',
+            message: flow === 'signUp'
+                ? 'That email or password can’t be used (password too short?).'
+                : 'Email or password is incorrect.',
+        };
+    }
+    const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in';
+    return {
+        ok: false,
+        reason: 'unavailable',
+        message: `${verb} failed (unexpected server error) — check the deployment logs.`,
+    };
+}
+/**
+ * Pure password-change error classifier (EC-240 H-tail / EC-362). Same
+ * data-first text + honest fallback discipline as {@link classifySignInError};
+ * `deployment-misconfigured` collapses onto the `unavailable` reason
+ * (`ChangePasswordResult` has no dedicated reason for it) with a specific
+ * remediation message.
+ */
+export function classifyChangePasswordError(text) {
+    if (isDeploymentMisconfigured(text)) {
+        return {
+            ok: false,
+            reason: 'unavailable',
+            message: 'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',
+        };
+    }
+    if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'invalid-credentials',
+            message: 'Your current password is incorrect.',
+        };
+    }
+    if (/at least|too short|8 characters|password requirement|weak/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'weak-password',
+            message: 'Choose a stronger password (at least 8 characters).',
+        };
+    }
+    return {
+        ok: false,
+        reason: 'unavailable',
+        message: 'Password change failed (unexpected server error) — check the deployment logs.',
+    };
+}
 /**
  * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a
  * session is scoped to its deployment: signing into Aurora's backend must not
@@ -120,50 +260,10 @@ export class ConvexAuthAdapter {
         }
         catch (error) {
             // Convex Auth surfaces credential/registration problems as thrown errors.
-            const message = error instanceof Error ? error.message : String(error);
-            // EC-257: a DEPLOYMENT-misconfiguration — not a credential problem — must be
-            // classified FIRST so it never falls through to the lying "password too short".
-            // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`
-            // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth`
-            // never run) the `requireEnv`/`importPKCS8` call throws *after* the password
-            // is validated, so EVERY sign-in fails regardless of the password. This is
-            // the exact footgun that cost hours on the Konditorei proof (2026-06-22).
-            if (isDeploymentMisconfigured(message)) {
-                return {
-                    ok: false,
-                    reason: 'deployment-misconfigured',
-                    message: 'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',
-                };
-            }
-            // EC-324: an uninvited sign-up is rejected server-side (`beforeSessionCreation`
-            // throws a `ConvexError('not-invited: …')`, whose data survives to the client
-            // even in production). Classified BEFORE the credential regex so it never
-            // degrades to "password too short".
-            if (/not-invited|invite-only|invite only/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'not-invited',
-                    message: 'This deployment is invite-only. Ask an admin to invite your email, then create your account.',
-                };
-            }
-            if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'account-exists',
-                    message: 'An account with this email already exists — sign in instead.',
-                };
-            }
-            if (/InvalidSecret|InvalidAccountId|credential|password/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'invalid-credentials',
-                    message: flow === 'signUp'
-                        ? 'That email or password can’t be used (password too short?).'
-                        : 'Email or password is incorrect.',
-                };
-            }
-            const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in';
-            return { ok: false, reason: 'unavailable', message: `${verb} is currently unavailable.` };
+            // Classify from the DATA-FIRST text (a `ConvexError`'s `.data` survives prod
+            // redaction, the redacted `.message` does not — EC-362), then apply the pure
+            // regex ladder. See `convexErrorClassifierText` / `classifySignInError`.
+            return classifySignInError(flow, convexErrorClassifierText(error));
         }
         if (!result.tokens) {
             return {
@@ -239,29 +339,10 @@ export class ConvexAuthAdapter {
             return { ok: true };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (isDeploymentMisconfigured(message)) {
-                return {
-                    ok: false,
-                    reason: 'unavailable',
-                    message: 'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',
-                };
-            }
-            if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'invalid-credentials',
-                    message: 'Your current password is incorrect.',
-                };
-            }
-            if (/at least|too short|8 characters|password requirement|weak/i.test(message)) {
-                return {
-                    ok: false,
-                    reason: 'weak-password',
-                    message: 'Choose a stronger password (at least 8 characters).',
-                };
-            }
-            return { ok: false, reason: 'unavailable', message: 'Password change is currently unavailable.' };
+            // Data-first classification (EC-362): the change-password ACTION runs on the
+            // same deployment, so a prod redaction erases the thrown `.message` the same
+            // way — read a surviving `ConvexError.data` first.
+            return classifyChangePasswordError(convexErrorClassifierText(error));
         }
     }
     toUser(me) {

package/dist/lib/auth/convex-auth-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAa/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,sFAAsF,CAAC,IAAI,CAChG,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,6EAA6E;YAC7E,gFAAgF;YAChF,4EAA4E;YAC5E,0EAA0E;YAC1E,6EAA6E;YAC7E,2EAA2E;YAC3E,0EAA0E;YAC1E,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,0BAA0B;oBAClC,OAAO,EACL,oLAAoL;iBACvL,CAAA;YACH,CAAC;YACD,gFAAgF;YAChF,8EAA8E;YAC9E,0EAA0E;YAC1E,oCAAoC;YACpC,IAAI,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,aAAa;oBACrB,OAAO,EACL,8FAA8F;iBACjG,CAAA;YACH,CAAC;YACD,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,gBAAgB;oBACxB,OAAO,EAAE,8DAA8D;iBACxE,CAAA;YACH,CAAC;YACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qBAAqB;oBAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;wBACf,CAAC,CAAC,6DAA6D;wBAC/D,CAAC,CAAC,iCAAiC;iBACxC,CAAA;YACH,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,4BAA4B,EAAE,CAAA;QAC3F,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,EAAE;gBAC7D,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBAC1D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,aAAa;oBACrB,OAAO,EACL,0GAA0G;iBAC7G,CAAA;YACH,CAAC;YACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qBAAqB;oBAC7B,OAAO,EAAE,qCAAqC;iBAC/C,CAAA;YACH,CAAC;YACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,qDAAqD;iBAC/D,CAAA;YACH,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAA;QACnG,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF","sourcesContent":["import type { ConvexHttpClient } from 'convex/browser'\nimport { actionRef, mutationRef, queryRef } from '../persistence/convex-client'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nimport type { SessionStore } from './local-auth-adapter'\n\n/**\n * Convex Auth implementation of the project-owned {@link AuthAdapter}\n * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over\n * Clerk — self-contained on the Convex stack, sessions in our own tables, no\n * extra vendor; reachable only through this adapter so a swap stays local.\n *\n * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):\n * 1. `signIn` calls the `auth:signIn` action with the Password provider\n *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.\n * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every\n *    subsequent persistence query/mutation runs authenticated and the\n *    server-side `requireRole` guards see the caller.\n * 3. `currentSession` restores the JWT from storage and asks `users:me`.\n * 4. `signOut` calls `auth:signOut` and clears the JWT.\n *\n * v1 scope note: the stored JWT is short-lived and this adapter does not yet\n * run the refresh-token loop (the official `@convex-dev/auth/react` client\n * does); an expired session simply resolves to \"signed out\" and the user signs\n * in again. Live-deployment hardening is EC-156. No live deployment exists in\n * this repo — this file is typecheck-verified and exercised against the local\n * adapter's shared interface.\n */\n\nconst TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt'\n\n/**\n * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a\n * credential problem (EC-257). Matches the Convex Auth signing-path throws:\n * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ \"Missing environment\n * variable …\") and `importPKCS8` on a malformed key. Deliberately narrow — a genuine\n * wrong-password error carries none of these tokens — and checked BEFORE the credential\n * regex so it always wins. Note: a PRODUCTION deployment redacts non-`ConvexError`\n * messages to a generic \"Server Error\", which this can't match; there the honest\n * fallback is the neutral \"unavailable\" branch (never \"password too short\").\n */\nexport function isDeploymentMisconfigured(message: string): boolean {\n  return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key/i.test(\n    message,\n  )\n}\n\n/**\n * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a\n * session is scoped to its deployment: signing into Aurora's backend must not\n * carry a JWT to Northwind's. Keying the stored token by the deployment URL\n * makes each backend's session independent — switching to a project on a\n * not-yet-authenticated backend reads no token and the guard asks for sign-in.\n * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid\n * on every deployment, collapsing this back to a single session.)\n */\nexport function tokenStorageKey(deploymentUrl?: string): string {\n  return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX\n}\n\n/**\n * Best-effort \"is there a session for this deployment?\" — a synchronous token\n * presence check used to label per-backend projects in the switcher/launcher\n * (EC-179). It does not validate the token (an expired one still redirects to\n * sign-in on entry); it just answers \"has the user signed into this backend?\".\n */\nexport function hasStoredConvexSession(\n  deploymentUrl: string,\n  store: SessionStore = defaultStore(),\n): boolean {\n  return store.getItem(tokenStorageKey(deploymentUrl)) !== null\n}\n\ninterface SignInActionResult {\n  tokens?: { token: string; refreshToken: string } | null\n}\n\ninterface MeResult {\n  id: string\n  email: string\n  name?: string\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class ConvexAuthAdapter implements AuthAdapter {\n  private readonly tokenKey: string\n\n  constructor(\n    private readonly client: ConvexHttpClient,\n    private readonly store: SessionStore = defaultStore(),\n    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */\n    deploymentUrl?: string,\n  ) {\n    this.tokenKey = tokenStorageKey(deploymentUrl)\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return null\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        this.clearToken()\n        return null\n      }\n      return { user: this.toUser(me) }\n    } catch {\n      // Expired/invalid JWT or unreachable backend → treat as signed out.\n      this.clearToken()\n      return null\n    }\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signIn', credentials)\n  }\n\n  async signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signUp', credentials)\n  }\n\n  /**\n   * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by\n   * the Convex Auth `flow` param; both return a token + load `users:me`.\n   */\n  private async authenticate(\n    flow: 'signIn' | 'signUp',\n    credentials: SignInCredentials,\n  ): Promise<SignInResult> {\n    let result: SignInActionResult\n    try {\n      result = (await this.client.action(actionRef('auth:signIn'), {\n        provider: 'password',\n        params: {\n          email: credentials.email.trim().toLowerCase(),\n          password: credentials.password,\n          flow,\n        },\n      })) as SignInActionResult\n    } catch (error) {\n      // Convex Auth surfaces credential/registration problems as thrown errors.\n      const message = error instanceof Error ? error.message : String(error)\n      // EC-257: a DEPLOYMENT-misconfiguration — not a credential problem — must be\n      // classified FIRST so it never falls through to the lying \"password too short\".\n      // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`\n      // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth`\n      // never run) the `requireEnv`/`importPKCS8` call throws *after* the password\n      // is validated, so EVERY sign-in fails regardless of the password. This is\n      // the exact footgun that cost hours on the Konditorei proof (2026-06-22).\n      if (isDeploymentMisconfigured(message)) {\n        return {\n          ok: false,\n          reason: 'deployment-misconfigured',\n          message:\n            'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',\n        }\n      }\n      // EC-324: an uninvited sign-up is rejected server-side (`beforeSessionCreation`\n      // throws a `ConvexError('not-invited: …')`, whose data survives to the client\n      // even in production). Classified BEFORE the credential regex so it never\n      // degrades to \"password too short\".\n      if (/not-invited|invite-only|invite only/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'not-invited',\n          message:\n            'This deployment is invite-only. Ask an admin to invite your email, then create your account.',\n        }\n      }\n      if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'account-exists',\n          message: 'An account with this email already exists — sign in instead.',\n        }\n      }\n      if (/InvalidSecret|InvalidAccountId|credential|password/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'invalid-credentials',\n          message:\n            flow === 'signUp'\n              ? 'That email or password can’t be used (password too short?).'\n              : 'Email or password is incorrect.',\n        }\n      }\n      const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in'\n      return { ok: false, reason: 'unavailable', message: `${verb} is currently unavailable.` }\n    }\n    if (!result.tokens) {\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(this.tokenKey, result.tokens.token)\n    this.client.setAuth(result.tokens.token)\n    const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n    if (!me) {\n      this.clearToken()\n      return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' }\n    }\n    return { ok: true, session: { user: this.toUser(me) } }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      await this.client.action(actionRef('auth:signOut'), {})\n    } catch {\n      // Already signed out / unreachable — clearing local state is what matters.\n    }\n    this.clearToken()\n  }\n\n  /**\n   * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN\n   * auth `users` row (name / avatar) via the self-scoped `users:updateProfile`\n   * mutation, then re-reads `users:me` so the returned session carries the new\n   * name. Auth-owned fields never flow through the members-rail `users.save`.\n   */\n  async updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.mutation(mutationRef('users:updateProfile'), {\n        ...(input.name !== undefined ? { name: input.name } : {}),\n        ...(input.avatar !== undefined ? { avatar: input.avatar } : {}),\n      })\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n      }\n      return { ok: true, session: { user: this.toUser(me) } }\n    } catch {\n      return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n    }\n  }\n\n  /**\n   * Self-service password change (EC-240 H-tail item 3). Delegates entirely to\n   * the provider via the self-scoped `users:changePassword` ACTION (which calls\n   * Convex Auth's `retrieveAccount` to verify the current password, then\n   * `modifyAccountCredentials` to set the new one). **Seam only:** the raw\n   * password values are forwarded to the provider and NEVER logged or inspected\n   * here.\n   */\n  async changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.action(actionRef('users:changePassword'), {\n        currentPassword: input.currentPassword,\n        newPassword: input.newPassword,\n      })\n      return { ok: true }\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error)\n      if (isDeploymentMisconfigured(message)) {\n        return {\n          ok: false,\n          reason: 'unavailable',\n          message:\n            'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',\n        }\n      }\n      if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'invalid-credentials',\n          message: 'Your current password is incorrect.',\n        }\n      }\n      if (/at least|too short|8 characters|password requirement|weak/i.test(message)) {\n        return {\n          ok: false,\n          reason: 'weak-password',\n          message: 'Choose a stronger password (at least 8 characters).',\n        }\n      }\n      return { ok: false, reason: 'unavailable', message: 'Password change is currently unavailable.' }\n    }\n  }\n\n  private toUser(me: MeResult): AuthSession['user'] {\n    return {\n      id: me.id,\n      email: me.email,\n      ...(me.name ? { name: me.name } : {}),\n      // No global flags: project creation is config/CLI-owned (AD-11), so there\n      // is no in-studio `create-projects` capability. Per-project roles come\n      // from `projectMembers`.\n      globalFlags: [],\n    }\n  }\n\n  private clearToken(): void {\n    this.store.removeItem(this.tokenKey)\n    this.client.clearAuth()\n  }\n}\n"]}
+{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAa/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,sFAAsF,CAAC,IAAI,CAChG,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAA;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,YAAY,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAID;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB,EAAE,IAAY;IACzE,kFAAkF;IAClF,gFAAgF;IAChF,4EAA4E;IAC5E,gFAAgF;IAChF,mFAAmF;IACnF,qDAAqD;IACrD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EACL,oLAAoL;SACvL,CAAA;IACH,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,8FAA8F;SACjG,CAAA;IACH,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,8DAA8D;SACxE,CAAA;IACH,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,iCAAiC;SACxC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,GAAG,IAAI,gEAAgE;KACjF,CAAA;AACH,CAAC;AAID;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,0GAA0G;SAC7G,CAAA;IACH,CAAC;IACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,qCAAqC;SAC/C,CAAA;IACH,CAAC;IACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,+EAA+E;KACzF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,yEAAyE;YACzE,OAAO,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,EAAE;gBAC7D,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBAC1D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,6EAA6E;YAC7E,mDAAmD;YACnD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF","sourcesContent":["import type { ConvexHttpClient } from 'convex/browser'\nimport { actionRef, mutationRef, queryRef } from '../persistence/convex-client'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nimport type { SessionStore } from './local-auth-adapter'\n\n/**\n * Convex Auth implementation of the project-owned {@link AuthAdapter}\n * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over\n * Clerk — self-contained on the Convex stack, sessions in our own tables, no\n * extra vendor; reachable only through this adapter so a swap stays local.\n *\n * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):\n * 1. `signIn` calls the `auth:signIn` action with the Password provider\n *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.\n * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every\n *    subsequent persistence query/mutation runs authenticated and the\n *    server-side `requireRole` guards see the caller.\n * 3. `currentSession` restores the JWT from storage and asks `users:me`.\n * 4. `signOut` calls `auth:signOut` and clears the JWT.\n *\n * v1 scope note: the stored JWT is short-lived and this adapter does not yet\n * run the refresh-token loop (the official `@convex-dev/auth/react` client\n * does); an expired session simply resolves to \"signed out\" and the user signs\n * in again. Live-deployment hardening is EC-156. No live deployment exists in\n * this repo — this file is typecheck-verified and exercised against the local\n * adapter's shared interface.\n */\n\nconst TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt'\n\n/**\n * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a\n * credential problem (EC-257). Matches the Convex Auth signing-path throws:\n * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ \"Missing environment\n * variable …\") and `importPKCS8` on a malformed key. Deliberately narrow — a genuine\n * wrong-password error carries none of these tokens — and checked BEFORE the credential\n * regex so it always wins. Note: a PRODUCTION deployment redacts non-`ConvexError`\n * messages to a generic \"Server Error\", which this can't match; there the honest\n * fallback is the neutral \"unavailable\" branch (never \"password too short\").\n */\nexport function isDeploymentMisconfigured(message: string): boolean {\n  return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key/i.test(\n    message,\n  )\n}\n\n/**\n * Reduce a thrown Convex error to the text used for classification (EC-362).\n *\n * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex\n * deployment REDACTS a UDF's thrown-error `.message` to a generic\n * `\"[Request ID: …] Server Error\"`, but a `ConvexError`'s `.data` payload\n * survives to the client. Proven in the installed `convex@1.42.1` browser\n * client: on an `\"error\"` response `ConvexHttpClient.action` throws\n * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,\n * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`\n * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps\n * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the\n * only classifiable text that survives prod is the `.data` of a `ConvexError` —\n * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments\n * nothing is redacted, so `.message` also carries the token (the regex ladder\n * still matches); non-Convex errors only have a `.message`.\n *\n * Duck-types the `data` property rather than `instanceof ConvexError`: two\n * copies of the `convex` module can coexist under Vite (transformed vs\n * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a\n * string (our gates) or a structured object (future gates) — both are folded in.\n */\nexport function convexErrorClassifierText(error: unknown): string {\n  const parts: string[] = []\n  if (typeof error === 'object' && error !== null && 'data' in error) {\n    const data = (error as { data: unknown }).data\n    if (typeof data === 'string') {\n      parts.push(data)\n    } else if (data !== null && data !== undefined) {\n      try {\n        parts.push(JSON.stringify(data))\n      } catch {\n        // Non-serializable data (cycles) — ignore; fall back to the message.\n      }\n    }\n  }\n  if (error instanceof Error) parts.push(error.message)\n  else if (typeof error === 'string') parts.push(error)\n  if (parts.length === 0) parts.push(String(error))\n  return parts.join('\\n')\n}\n\ntype SignInFailure = Extract<SignInResult, { ok: false }>\n\n/**\n * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the\n * regex ladder over {@link convexErrorClassifierText} output (data-first).\n *\n * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited\n * sign-up (EC-324) are each checked BEFORE the credential regex so neither\n * degrades to the lying \"password too short\". The final fallback is HONEST\n * (\"unexpected server error — check the deployment logs\"), never \"unavailable\":\n * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by\n * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts\n * them to `\"Server Error\"` with no `.data` and they legitimately land here.\n */\nexport function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure {\n  // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be\n  // classified FIRST so it never falls through to the lying \"password too short\".\n  // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`\n  // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth` never\n  // run) the `requireEnv`/`importPKCS8` call throws AFTER the password is validated,\n  // so EVERY sign-in fails regardless of the password.\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'deployment-misconfigured',\n      message:\n        'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',\n    }\n  }\n  // EC-324: an uninvited sign-up is rejected server-side (`gateAccountCreation`/\n  // `gateSessionCreation` throw `ConvexError(NOT_INVITED_REASON)`, whose `.data`\n  // survives to the client even in production). Checked BEFORE the credential regex.\n  if (/not-invited|invite-only|invite only/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'not-invited',\n      message:\n        'This deployment is invite-only. Ask an admin to invite your email, then create your account.',\n    }\n  }\n  if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'account-exists',\n      message: 'An account with this email already exists — sign in instead.',\n    }\n  }\n  if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message:\n        flow === 'signUp'\n          ? 'That email or password can’t be used (password too short?).'\n          : 'Email or password is incorrect.',\n    }\n  }\n  const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in'\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: `${verb} failed (unexpected server error) — check the deployment logs.`,\n  }\n}\n\ntype ChangePasswordFailure = Extract<ChangePasswordResult, { ok: false }>\n\n/**\n * Pure password-change error classifier (EC-240 H-tail / EC-362). Same\n * data-first text + honest fallback discipline as {@link classifySignInError};\n * `deployment-misconfigured` collapses onto the `unavailable` reason\n * (`ChangePasswordResult` has no dedicated reason for it) with a specific\n * remediation message.\n */\nexport function classifyChangePasswordError(text: string): ChangePasswordFailure {\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message:\n        'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',\n    }\n  }\n  if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message: 'Your current password is incorrect.',\n    }\n  }\n  if (/at least|too short|8 characters|password requirement|weak/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'weak-password',\n      message: 'Choose a stronger password (at least 8 characters).',\n    }\n  }\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: 'Password change failed (unexpected server error) — check the deployment logs.',\n  }\n}\n\n/**\n * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a\n * session is scoped to its deployment: signing into Aurora's backend must not\n * carry a JWT to Northwind's. Keying the stored token by the deployment URL\n * makes each backend's session independent — switching to a project on a\n * not-yet-authenticated backend reads no token and the guard asks for sign-in.\n * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid\n * on every deployment, collapsing this back to a single session.)\n */\nexport function tokenStorageKey(deploymentUrl?: string): string {\n  return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX\n}\n\n/**\n * Best-effort \"is there a session for this deployment?\" — a synchronous token\n * presence check used to label per-backend projects in the switcher/launcher\n * (EC-179). It does not validate the token (an expired one still redirects to\n * sign-in on entry); it just answers \"has the user signed into this backend?\".\n */\nexport function hasStoredConvexSession(\n  deploymentUrl: string,\n  store: SessionStore = defaultStore(),\n): boolean {\n  return store.getItem(tokenStorageKey(deploymentUrl)) !== null\n}\n\ninterface SignInActionResult {\n  tokens?: { token: string; refreshToken: string } | null\n}\n\ninterface MeResult {\n  id: string\n  email: string\n  name?: string\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class ConvexAuthAdapter implements AuthAdapter {\n  private readonly tokenKey: string\n\n  constructor(\n    private readonly client: ConvexHttpClient,\n    private readonly store: SessionStore = defaultStore(),\n    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */\n    deploymentUrl?: string,\n  ) {\n    this.tokenKey = tokenStorageKey(deploymentUrl)\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return null\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        this.clearToken()\n        return null\n      }\n      return { user: this.toUser(me) }\n    } catch {\n      // Expired/invalid JWT or unreachable backend → treat as signed out.\n      this.clearToken()\n      return null\n    }\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signIn', credentials)\n  }\n\n  async signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signUp', credentials)\n  }\n\n  /**\n   * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by\n   * the Convex Auth `flow` param; both return a token + load `users:me`.\n   */\n  private async authenticate(\n    flow: 'signIn' | 'signUp',\n    credentials: SignInCredentials,\n  ): Promise<SignInResult> {\n    let result: SignInActionResult\n    try {\n      result = (await this.client.action(actionRef('auth:signIn'), {\n        provider: 'password',\n        params: {\n          email: credentials.email.trim().toLowerCase(),\n          password: credentials.password,\n          flow,\n        },\n      })) as SignInActionResult\n    } catch (error) {\n      // Convex Auth surfaces credential/registration problems as thrown errors.\n      // Classify from the DATA-FIRST text (a `ConvexError`'s `.data` survives prod\n      // redaction, the redacted `.message` does not — EC-362), then apply the pure\n      // regex ladder. See `convexErrorClassifierText` / `classifySignInError`.\n      return classifySignInError(flow, convexErrorClassifierText(error))\n    }\n    if (!result.tokens) {\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(this.tokenKey, result.tokens.token)\n    this.client.setAuth(result.tokens.token)\n    const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n    if (!me) {\n      this.clearToken()\n      return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' }\n    }\n    return { ok: true, session: { user: this.toUser(me) } }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      await this.client.action(actionRef('auth:signOut'), {})\n    } catch {\n      // Already signed out / unreachable — clearing local state is what matters.\n    }\n    this.clearToken()\n  }\n\n  /**\n   * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN\n   * auth `users` row (name / avatar) via the self-scoped `users:updateProfile`\n   * mutation, then re-reads `users:me` so the returned session carries the new\n   * name. Auth-owned fields never flow through the members-rail `users.save`.\n   */\n  async updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.mutation(mutationRef('users:updateProfile'), {\n        ...(input.name !== undefined ? { name: input.name } : {}),\n        ...(input.avatar !== undefined ? { avatar: input.avatar } : {}),\n      })\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n      }\n      return { ok: true, session: { user: this.toUser(me) } }\n    } catch {\n      return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n    }\n  }\n\n  /**\n   * Self-service password change (EC-240 H-tail item 3). Delegates entirely to\n   * the provider via the self-scoped `users:changePassword` ACTION (which calls\n   * Convex Auth's `retrieveAccount` to verify the current password, then\n   * `modifyAccountCredentials` to set the new one). **Seam only:** the raw\n   * password values are forwarded to the provider and NEVER logged or inspected\n   * here.\n   */\n  async changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.action(actionRef('users:changePassword'), {\n        currentPassword: input.currentPassword,\n        newPassword: input.newPassword,\n      })\n      return { ok: true }\n    } catch (error) {\n      // Data-first classification (EC-362): the change-password ACTION runs on the\n      // same deployment, so a prod redaction erases the thrown `.message` the same\n      // way — read a surviving `ConvexError.data` first.\n      return classifyChangePasswordError(convexErrorClassifierText(error))\n    }\n  }\n\n  private toUser(me: MeResult): AuthSession['user'] {\n    return {\n      id: me.id,\n      email: me.email,\n      ...(me.name ? { name: me.name } : {}),\n      // No global flags: project creation is config/CLI-owned (AD-11), so there\n      // is no in-studio `create-projects` capability. Per-project roles come\n      // from `projectMembers`.\n      globalFlags: [],\n    }\n  }\n\n  private clearToken(): void {\n    this.store.removeItem(this.tokenKey)\n    this.client.clearAuth()\n  }\n}\n"]}

package/dist/lib/auth/dev-auto-login-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter';
+import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter.js';
 /**
  * Dev-only unattended-auth decorator (testing de-friction). Wraps any
  * {@link AuthAdapter}: when no session can be restored, it transparently signs

package/dist/lib/auth/index.d.ts

@@ -1,12 +1,12 @@
-import type { StudioBackendMode } from '../persistence/backend-mode';
-import type { AuthAdapter } from './auth-adapter';
-export type { AuthAdapter, AuthSession, AuthUser, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult, } from './auth-adapter';
-export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter';
-export type { SessionStore } from './local-auth-adapter';
-export { ConvexAuthAdapter } from './convex-auth-adapter';
-export { DevAutoLoginAdapter } from './dev-auto-login-adapter';
-export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard';
-export type { AuthStatus, RouteGuardDecision } from './route-guard';
+import type { StudioBackendMode } from '../persistence/backend-mode.js';
+import type { AuthAdapter } from './auth-adapter.js';
+export type { AuthAdapter, AuthSession, AuthUser, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult, } from './auth-adapter.js';
+export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter.js';
+export type { SessionStore } from './local-auth-adapter.js';
+export { ConvexAuthAdapter } from './convex-auth-adapter.js';
+export { DevAutoLoginAdapter } from './dev-auto-login-adapter.js';
+export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard.js';
+export type { AuthStatus, RouteGuardDecision } from './route-guard.js';
 /**
  * Select the auth backend (EC-150/EC-153), mirroring `selectPersistenceAdapter`
  * exactly: Convex mode means Convex Auth (over the same shared client the

package/dist/lib/auth/index.js

@@ -1,13 +1,13 @@
-import { getConvexClient } from '../persistence/convex-client';
-import { resolveBackendConfig, resolveDevAutoLogin } from '../persistence/backend-mode';
-import { deploymentUrlForSlug, resolveDeploymentUrl } from '../workspace';
-import { ConvexAuthAdapter, hasStoredConvexSession } from './convex-auth-adapter';
-import { DevAutoLoginAdapter } from './dev-auto-login-adapter';
-import { LocalAuthAdapter } from './local-auth-adapter';
-export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter';
-export { ConvexAuthAdapter } from './convex-auth-adapter';
-export { DevAutoLoginAdapter } from './dev-auto-login-adapter';
-export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard';
+import { getConvexClient } from '../persistence/convex-client.js';
+import { resolveBackendConfig, resolveDevAutoLogin } from '../persistence/backend-mode.js';
+import { deploymentUrlForSlug, resolveDeploymentUrl } from '../workspace/index.js';
+import { ConvexAuthAdapter, hasStoredConvexSession } from './convex-auth-adapter.js';
+import { DevAutoLoginAdapter } from './dev-auto-login-adapter.js';
+import { LocalAuthAdapter } from './local-auth-adapter.js';
+export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter.js';
+export { ConvexAuthAdapter } from './convex-auth-adapter.js';
+export { DevAutoLoginAdapter } from './dev-auto-login-adapter.js';
+export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard.js';
 /**
  * Select the auth backend (EC-150/EC-153), mirroring `selectPersistenceAdapter`
  * exactly: Convex mode means Convex Auth (over the same shared client the

package/dist/lib/auth/local-auth-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { AuthAdapter, AuthSession, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileResult } from './auth-adapter';
+import type { AuthAdapter, AuthSession, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileResult } from './auth-adapter.js';
 /**
  * Deterministic local auth (EC-150) for the in-memory persistence mode: the
  * whole sign-in → role-enforcement → sign-out flow works offline, in tests,

package/dist/lib/auth/route-guard.d.ts

@@ -1,5 +1,5 @@
 import type { Principal } from '@elytracms/core/operations';
-import type { AuthSession } from './auth-adapter';
+import type { AuthSession } from './auth-adapter.js';
 /**
  * Pure route-guard + principal-mapping logic (EC-150), kept free of React and
  * router types so it is unit-testable and deterministic. The `__root` layout

package/dist/lib/auth-errors.d.ts

@@ -1,4 +1,4 @@
-import type { OperationError } from './operations';
+import type { OperationError } from './operations/index.js';
 /**
  * Session-expiry detection + plain-language mapping (EC-177 gap 9).
  *

package/dist/lib/clipboard/index.d.ts

@@ -2,6 +2,6 @@
  * Studio clipboard helpers (EC-175): paste-target resolution, permissive-paste
  * diffing, and the OS-clipboard transport over the EC-174 fragment format.
  */
-export * from './paste-target';
-export * from './paste-issues';
-export * from './os-clipboard';
+export * from './paste-target.js';
+export * from './paste-issues.js';
+export * from './os-clipboard.js';

package/dist/lib/clipboard/index.js

@@ -2,7 +2,7 @@
  * Studio clipboard helpers (EC-175): paste-target resolution, permissive-paste
  * diffing, and the OS-clipboard transport over the EC-174 fragment format.
  */
-export * from './paste-target';
-export * from './paste-issues';
-export * from './os-clipboard';
+export * from './paste-target.js';
+export * from './paste-issues.js';
+export * from './os-clipboard.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/cms/published-documents.d.ts

@@ -1,5 +1,5 @@
 import type { CmsDocument } from '@elytracms/core/cms-core';
-import type { OperationsClient } from '../operations';
+import type { OperationsClient } from '../operations/index.js';
 /**
  * The PUBLISHED-perspective documents of a collection (EC-205, "live = published")
  * — the pinned published snapshot of each currently-published document, keyed by

package/dist/lib/cms-views/index.d.ts

@@ -4,5 +4,5 @@
  * (EC-246b) — the DB saved-view store is retired; `view-model.configViewsFor`
  * resolves the named views a collection declares in `cms/`.
  */
-export * from './view-model';
-export * from './selection';
+export * from './view-model.js';
+export * from './selection.js';

package/dist/lib/cms-views/index.js

@@ -4,6 +4,6 @@
  * (EC-246b) — the DB saved-view store is retired; `view-model.configViewsFor`
  * resolves the named views a collection declares in `cms/`.
  */
-export * from './view-model';
-export * from './selection';
+export * from './view-model.js';
+export * from './selection.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/collection-view/collection-view-source.d.ts

@@ -1,10 +1,10 @@
 import type { CmsDocument, CollectionDef, DocumentRef, DocumentUrl, FieldDef, Locale, LocaleConfig, LocalizedString, RestoreScope } from '@elytracms/core/cms-core';
 import type { CmsValidationIssue } from '@elytracms/core/cms-core';
 import type { OperationError } from '@elytracms/core/operations';
-import type { TableViewState } from '../cms-views/view-model';
-import type { CellCommitInput, CellCommitOutcome } from '../../components/cms/cell-edit';
-import type { BulkAction, BulkReport, BulkSetField } from '../../components/cms/bulk-actions';
-import type { DocumentVersionsView, ImportReport } from '../../components/cms/cms-store';
+import type { TableViewState } from '../cms-views/view-model.js';
+import type { CellCommitInput, CellCommitOutcome } from '../../components/cms/cell-edit.js';
+import type { BulkAction, BulkReport, BulkSetField } from '../../components/cms/bulk-actions.js';
+import type { DocumentVersionsView, ImportReport } from '../../components/cms/cms-store.js';
 /**
  * `CollectionViewSource` — the studio's UNIVERSAL interaction seam (EC-240,
  * vision AD-19).

package/dist/lib/data/collection-content.js

@@ -1,6 +1,6 @@
 import { createContentClient, createContentContext, } from '@elytracms/core/content';
 import { documentKey, resolveDocumentTitle, sampleLocaleConfig } from '@elytracms/core/cms-core';
-import { getStudioLocale } from '../locale/locale-store';
+import { getStudioLocale } from '../locale/locale-store.js';
 /**
  * Default (no-session) collection schema: EMPTY. The studio ships no demo content
  * (Oli, 2026-06-19) — with no backend/content session configured, there is nothing

package/dist/lib/data/data-store.js

@@ -1,14 +1,14 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { useCallback, useEffect, useMemo, useReducer, useState } from 'react';
 import { SourceRegistry, captureSample, inferSchema, resolveBinding, resolveCondition, tokensForSchema, } from '@elytracms/core/data-binding';
-import { getStudioOperations } from '../operations';
+import { getStudioOperations } from '../operations/index.js';
 import { useOperationCache, useOperationQuery } from '@elytracms/studio/lib/query';
 import { createRequiredContext } from '@elytracms/studio/lib/required-context';
-import { STUDIO_SYSTEM_COLLECTION_IDS } from '../operations/session-hydration';
-import { resolveDeploymentCollections } from '../workspace';
-import { hasContentSession } from './collection-content';
-import { captureSourceSample, cmsSourceForCollection } from './sample-capture';
-import { deleteDataSource, loadDataSources, saveDataSource } from './sources-store';
+import { STUDIO_SYSTEM_COLLECTION_IDS } from '../operations/session-hydration.js';
+import { resolveDeploymentCollections } from '../workspace/index.js';
+import { hasContentSession } from './collection-content.js';
+import { captureSourceSample, cmsSourceForCollection } from './sample-capture.js';
+import { deleteDataSource, loadDataSources, saveDataSource } from './sources-store.js';
 function upsert(sources, source) {
     const exists = sources.some((s) => s.id === source.id);
     return exists ? sources.map((s) => (s.id === source.id ? source : s)) : [...sources, source];

package/dist/lib/data/index.d.ts

@@ -1,4 +1,4 @@
-export * from './data-store';
-export * from './sample-capture';
-export * from './sources-store';
-export * from './collection-content';
+export * from './data-store.js';
+export * from './sample-capture.js';
+export * from './sources-store.js';
+export * from './collection-content.js';

package/dist/lib/data/index.js

@@ -1,7 +1,7 @@
-export * from './data-store';
-export * from './sample-capture';
-export * from './sources-store';
-export * from './collection-content';
+export * from './data-store.js';
+export * from './sample-capture.js';
+export * from './sources-store.js';
+export * from './collection-content.js';
 // Data providers (EC-167) are imported from './providers' directly: the module
 // exports a `DataProvider` domain type that would collide with the store's
 // `<DataProvider>` React provider in a wildcard barrel.