@elytracms/studio 0.0.54 → 0.0.56

package/dist/components/sign-in-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-view.js","sourceRoot":"","sources":["../../src/components/sign-in-view.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEhC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAA;AACnE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE9F,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAqCzF,6EAA6E;AAC7E,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAA;IACjC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAA;IACnC,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC1F,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,CAAA;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,SAAS,EAAE,WAAW,EAAmB;IACpE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA0B,CAAA;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAEhC,OAAO,CACL,KAAC,YAAY,IACX,WAAW,EAAE,iBAAiB,EAAE,EAChC,cAAc,EAAE,QAAQ,EAAE,KAAK,QAAQ,EACvC,cAAc,EAAE,QAAQ,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAC1E,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CACtC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAEjF,eAAe,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,GACnE,CACH,CAAA;AACH,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,WAAW,EACX,cAAc,EACd,cAAc,EACd,SAAS,EACT,WAAW,GAAG,QAAQ,EACtB,YAAY,EACZ,eAAe,GACG;IAClB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC5C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAY,MAAM,CAAC,CAAA;IACrD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAW,QAAQ,CAAC,CAAA;IACpD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,KAAK,UAAU,YAAY,CAAC,KAAiC;QAC3D,KAAK,CAAC,cAAc,EAAE,CAAA;QACtB,QAAQ,CAAC,YAAY,CAAC,CAAA;QACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACxD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,eAAe,EAAE,CAAA;YACvB,OAAM;QACR,CAAC;QACD,8EAA8E;QAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB;YAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QACzD,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACxB,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,KAAK,YAAY,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAA;IAElC,OAAO,CACL,cAAK,SAAS,EAAC,qDAAqD,YAClE,MAAC,KAAK,IAAC,GAAG,EAAC,GAAG,EAAC,SAAS,EAAC,iBAAiB,aACxC,MAAC,KAAK,IAAC,GAAG,EAAC,GAAG,EAAC,KAAK,EAAC,QAAQ,aAC1B,SAAS,IAAI,eAAM,SAAS,EAAC,wCAAwC,wBAAe,EACrF,KAAC,OAAO,IAAC,IAAI,EAAC,IAAI,YACf,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,WAAW,EAAE,GACvD,EACV,KAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,YACzB,WAAW;gCACV,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,IAAI,WAAW,GAAG;gCAC/D,CAAC,CAAC,sCAAsC,GACrC,IACD,EAER,KAAC,IAAI,cACH,KAAC,WAAW,IAAC,SAAS,EAAC,MAAM,YAC3B,eAAM,QAAQ,EAAE,YAAY,EAAE,UAAU,kBACtC,MAAC,KAAK,IAAC,GAAG,EAAC,GAAG,aACZ,KAAC,KAAK,IAAC,KAAK,EAAC,OAAO,EAAC,OAAO,EAAC,eAAe,EAAC,QAAQ,kBACnD,KAAC,KAAK,IACJ,EAAE,EAAC,eAAe,EAClB,IAAI,EAAC,OAAO,EACZ,YAAY,EAAC,OAAO,EACpB,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,WAAW,EAAC,iBAAiB,EAC7B,QAAQ,EAAE,UAAU,GACpB,GACI,EACR,KAAC,KAAK,IAAC,KAAK,EAAC,UAAU,EAAC,OAAO,EAAC,kBAAkB,EAAC,QAAQ,QAAC,KAAK,EAAE,KAAK,YACtE,KAAC,KAAK,IACJ,EAAE,EAAC,kBAAkB,EACrB,IAAI,EAAC,UAAU,EACf,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,EAC5D,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,QAAQ,EAAE,UAAU,GACpB,GACI,EACR,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAC,QAAQ,YAC3D,UAAU;4CACT,CAAC,CAAC,QAAQ;gDACR,CAAC,CAAC,mBAAmB;gDACrB,CAAC,CAAC,aAAa;4CACjB,CAAC,CAAC,QAAQ;gDACR,CAAC,CAAC,gBAAgB;gDAClB,CAAC,CAAC,SAAS,GACR,IACH,GACH,GACK,GACT,EAEN,cAAc,CAAC,CAAC,CAAC,CAChB,MAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,SAAS,EAAC,aAAa,aACjD,QAAQ,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,8BAA8B,EACxF,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,6DAA6D,EACvE,OAAO,EAAE,GAAG,EAAE;gCACZ,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;gCACvC,QAAQ,CAAC,IAAI,CAAC,CAAA;4BAChB,CAAC,YAEA,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,GACpC,IACJ,CACR,CAAC,CAAC,CAAC,IAAI,EAEP,cAAc,CAAC,CAAC,CAAC,KAAC,kBAAkB,IAAC,OAAO,EAAE,cAAc,GAAI,CAAC,CAAC,CAAC,IAAI,IAClE,GACJ,CACP,CAAA;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,EAAE,OAAO,EAAyC;IAC5E,OAAO,CACL,KAAC,IAAI,IAAC,SAAS,EAAC,eAAe,YAC7B,KAAC,WAAW,IAAC,SAAS,EAAC,MAAM,YAC3B,MAAC,KAAK,IAAC,GAAG,EAAC,GAAG,aACZ,KAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,SAAS,EAAC,aAAa,2DAE7C,EACN,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACtB,MAAC,IAAI,IAAqB,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,SAAS,EAAC,WAAW,aACnE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAK,KAAK,CAAC,QAAQ,KAD3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAEjB,CACR,CAAC,IACI,GACI,GACT,CACR,CAAA;AACH,CAAC","sourcesContent":["import { useState } from 'react'\nimport type { FormEvent, ReactNode } from 'react'\nimport { useNavigate, useSearch } from '@tanstack/react-router'\nimport { Button, Card, CardContent, Field, Heading, Input, Stack, Text } from '@elytracms/studio/ui'\nimport { useAuth } from '@elytracms/studio/components/auth-context'\nimport { LOCAL_DEV_CREDENTIALS, authMode, postSignInTarget } from '@elytracms/studio/lib/auth'\nimport type { SignInResult } from '@elytracms/studio/lib/auth'\nimport { getActiveProjectSlug, getWorkspaceState } from '@elytracms/studio/lib/workspace'\n\n/**\n * Engine-shipped `/sign-in` screen (EC-150; consolidated from the copy-pasted\n * consumer route by EC-375, EC-369 finding #8). The consumer route file keeps\n * only the route object — `createFileRoute('/sign-in')({ validateSearch,\n * component: SignInView })` — because TanStack Router requires the route object\n * to live in the consumer's route tree; the ~140-line body lives here so a\n * copy never drifts.\n *\n * Deterministic states: idle → submitting → (signed-in redirect | inline\n * structured failure). Invalid credentials are a rendered state, never a silent\n * failure or crash. In playground (in-memory) mode the seeded dev credentials\n * are listed so the whole flow works offline.\n *\n * Split into a `SignInView` container (owns the router + auth seams) and a\n * provider-free `SignInScreen` (pure local form state + injected callbacks) so\n * the screen static-renders in a node smoke test without the full provider tree.\n */\n\ntype FormPhase = 'idle' | 'submitting'\ntype AuthMode = 'signin' | 'signup'\n\n/** A seeded dev-credential entry surfaced in playground mode (fixtures, not secrets). */\ntype DevCredential = (typeof LOCAL_DEV_CREDENTIALS)[number]\n\nexport interface SignInViewProps {\n  /**\n   * Brand mark rendered above the heading. Defaults to the neutral studio\n   * placeholder square — a future logo just passes a node here (e.g.\n   * `component: () => <SignInView brandMark={<Logo />} />`), no engine change.\n   */\n  brandMark?: ReactNode\n  /** Product name in the \"Sign in to …\" heading. Default: `'Elytra'`. */\n  productName?: string\n}\n\n/** The project whose backend this sign-in authenticates against (EC-179). */\nfunction activeProjectName(): string | null {\n  const state = getWorkspaceState()\n  if (state.kind !== 'config') return null\n  const slug = getActiveProjectSlug()\n  const project = (slug && state.projects.find((p) => p.slug === slug)) || state.projects[0]\n  return project?.name ?? null\n}\n\n/**\n * The `/sign-in` route component. Container: reads the router (post-sign-in\n * redirect target from the route search) + auth seams and hands the pure\n * presentational screen its data plus an `authenticate` callback.\n */\nexport function SignInView({ brandMark, productName }: SignInViewProps) {\n  const auth = useAuth()\n  const navigate = useNavigate()\n  // Self-source the redirect (loose search — the consumer route's `validateSearch`\n  // guarantees `{ redirect?: string }`), so the route file needs no wrapper.\n  const search = useSearch({ strict: false }) as { redirect?: string }\n  const redirect = search.redirect\n\n  return (\n    <SignInScreen\n      projectName={activeProjectName()}\n      showModeToggle={authMode() === 'convex'}\n      devCredentials={authMode() === 'playground' ? LOCAL_DEV_CREDENTIALS : null}\n      brandMark={brandMark}\n      productName={productName}\n      authenticate={(mode, email, password) =>\n        mode === 'signup' ? auth.signUp(email, password) : auth.signIn(email, password)\n      }\n      onAuthenticated={() => navigate({ to: postSignInTarget(redirect) })}\n    />\n  )\n}\n\ninterface SignInScreenProps {\n  projectName: string | null\n  /** Whether to offer the sign-in ↔ create-account toggle (convex mode only). */\n  showModeToggle: boolean\n  /** Seeded dev accounts to list (playground mode), or null to hide the hint. */\n  devCredentials: readonly DevCredential[] | null\n  brandMark?: ReactNode\n  productName?: string\n  /** Attempt auth for the chosen mode. The container maps this to signIn/signUp. */\n  authenticate: (mode: AuthMode, email: string, password: string) => Promise<SignInResult>\n  /** Called once, after a successful authentication (the container navigates). */\n  onAuthenticated: () => void | Promise<void>\n}\n\n/**\n * Provider-free presentational sign-in screen. Owns only local form state and\n * calls injected callbacks — no context hooks — so it static-renders in tests.\n */\nexport function SignInScreen({\n  projectName,\n  showModeToggle,\n  devCredentials,\n  brandMark,\n  productName = 'Elytra',\n  authenticate,\n  onAuthenticated,\n}: SignInScreenProps) {\n  const [email, setEmail] = useState('')\n  const [password, setPassword] = useState('')\n  const [phase, setPhase] = useState<FormPhase>('idle')\n  const [mode, setMode] = useState<AuthMode>('signin')\n  const [error, setError] = useState<string | null>(null)\n\n  async function handleSubmit(event: FormEvent<HTMLFormElement>) {\n    event.preventDefault()\n    setPhase('submitting')\n    setError(null)\n    const result = await authenticate(mode, email, password)\n    if (result.ok) {\n      await onAuthenticated()\n      return\n    }\n    // A fresh backend has no account yet: nudge sign-in → create, and vice versa.\n    if (result.reason === 'account-exists') setMode('signin')\n    setError(result.message)\n    setPhase('idle')\n  }\n\n  const submitting = phase === 'submitting'\n  const creating = mode === 'signup'\n\n  return (\n    <div className=\"grid min-h-dvh place-items-center bg-background p-6\">\n      <Stack gap=\"4\" className=\"w-full max-w-sm\">\n        <Stack gap=\"1\" align=\"center\">\n          {brandMark ?? <span className=\"size-8 rounded-lg bg-primary shadow-sm\" aria-hidden />}\n          <Heading size=\"h2\">\n            {creating ? 'Create your account' : `Sign in to ${productName}`}\n          </Heading>\n          <Text size=\"sm\" tone=\"muted\">\n            {projectName\n              ? `${creating ? 'Register on' : 'Continue to'} ${projectName}.`\n              : 'Use your studio account to continue.'}\n          </Text>\n        </Stack>\n\n        <Card>\n          <CardContent className=\"pt-5\">\n            <form onSubmit={handleSubmit} noValidate>\n              <Stack gap=\"4\">\n                <Field label=\"Email\" htmlFor=\"sign-in-email\" required>\n                  <Input\n                    id=\"sign-in-email\"\n                    type=\"email\"\n                    autoComplete=\"email\"\n                    value={email}\n                    onChange={(e) => setEmail(e.target.value)}\n                    placeholder=\"you@example.com\"\n                    disabled={submitting}\n                  />\n                </Field>\n                <Field label=\"Password\" htmlFor=\"sign-in-password\" required error={error}>\n                  <Input\n                    id=\"sign-in-password\"\n                    type=\"password\"\n                    autoComplete={creating ? 'new-password' : 'current-password'}\n                    value={password}\n                    onChange={(e) => setPassword(e.target.value)}\n                    disabled={submitting}\n                  />\n                </Field>\n                <Button type=\"submit\" disabled={submitting} className=\"w-full\">\n                  {submitting\n                    ? creating\n                      ? 'Creating account…'\n                      : 'Signing in…'\n                    : creating\n                      ? 'Create account'\n                      : 'Sign in'}\n                </Button>\n              </Stack>\n            </form>\n          </CardContent>\n        </Card>\n\n        {showModeToggle ? (\n          <Text size=\"sm\" tone=\"muted\" className=\"text-center\">\n            {creating ? 'Already have an account on this backend? ' : 'First time on this backend? '}\n            <button\n              type=\"button\"\n              className=\"font-medium text-primary underline-offset-2 hover:underline\"\n              onClick={() => {\n                setMode(creating ? 'signin' : 'signup')\n                setError(null)\n              }}\n            >\n              {creating ? 'Sign in' : 'Create an account'}\n            </button>\n          </Text>\n        ) : null}\n\n        {devCredentials ? <DevCredentialsHint entries={devCredentials} /> : null}\n      </Stack>\n    </div>\n  )\n}\n\n/** Seeded dev accounts for the explicit playground mode — fixtures, not secrets. */\nfunction DevCredentialsHint({ entries }: { entries: readonly DevCredential[] }) {\n  return (\n    <Card className=\"border-dashed\">\n      <CardContent className=\"pt-4\">\n        <Stack gap=\"1\">\n          <Text size=\"xs\" tone=\"muted\" className=\"font-medium\">\n            Playground mode — seeded dev accounts\n          </Text>\n          {entries.map((entry) => (\n            <Text key={entry.user.id} size=\"xs\" tone=\"muted\" className=\"font-mono\">\n              {entry.user.email} / {entry.password}\n            </Text>\n          ))}\n        </Stack>\n      </CardContent>\n    </Card>\n  )\n}\n"]}

package/dist/lib/auth/convex-auth-adapter.d.ts

@@ -5,11 +5,15 @@ import type { SessionStore } from './local-auth-adapter.js';
  * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a
  * credential problem (EC-257). Matches the Convex Auth signing-path throws:
  * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ "Missing environment
- * variable …") and `importPKCS8` on a malformed key. Deliberately narrow — a genuine
- * wrong-password error carries none of these tokens — and checked BEFORE the credential
- * regex so it always wins. Note: a PRODUCTION deployment redacts non-`ConvexError`
- * messages to a generic "Server Error", which this can't match; there the honest
- * fallback is the neutral "unavailable" branch (never "password too short").
+ * variable …") and `importPKCS8` on a malformed key — plus the EC-363 server code
+ * `deployment-misconfigured` (`defineStudioAuth` wraps those library throws in a
+ * `ConvexError` whose `.data` survives prod redaction, so this classifies on
+ * PRODUCTION deployments too once their functions are redeployed). Deliberately
+ * narrow — a genuine wrong-password error carries none of these tokens — and checked
+ * BEFORE the credential regex so it always wins. On a prod deployment whose
+ * functions PREDATE EC-363 the plain-`Error` message is redacted to "Server Error",
+ * which this can't match; there the honest fallback is the neutral "unavailable"
+ * branch (never "password too short").
  */
 export declare function isDeploymentMisconfigured(message: string): boolean;
 /**
@@ -25,9 +29,11 @@ export declare function isDeploymentMisconfigured(message: string): boolean;
  * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps
  * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the
  * only classifiable text that survives prod is the `.data` of a `ConvexError` —
- * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments
- * nothing is redacted, so `.message` also carries the token (the regex ladder
- * still matches); non-Convex errors only have a `.message`.
+ * our invite gate's `ConvexError(NOT_INVITED_REASON)` and, since EC-363, the
+ * coded `ConvexError({ code })` that `defineStudioAuth` wraps around the
+ * library's credential/env throws. On DEV deployments nothing is redacted, so
+ * `.message` also carries the token (the regex ladder still matches);
+ * non-Convex errors only have a `.message`.
  *
  * Duck-types the `data` property rather than `instanceof ConvexError`: two
  * copies of the `convex` module can coexist under Vite (transformed vs
@@ -39,16 +45,25 @@ type SignInFailure = Extract<SignInResult, {
     ok: false;
 }>;
 /**
- * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the
- * regex ladder over {@link convexErrorClassifierText} output (data-first).
+ * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362 / EC-363).
+ * Runs the regex ladder over {@link convexErrorClassifierText} output
+ * (data-first).
+ *
+ * EC-363: `defineStudioAuth` now wraps `@convex-dev/auth`'s plain-`Error`
+ * credential/env throws server-side in a `ConvexError` carrying a stable code
+ * in `.data` (`{"code":"invalid-credentials" | "too-many-attempts" |
+ * "account-exists" | "deployment-misconfigured"}`). The data-first text folds
+ * that JSON in, so the SAME ladder classifies the codes (they survive prod
+ * redaction) AND the raw dev-shape messages — a deployment whose functions
+ * predate EC-363 still classifies exactly as before (dev: full message; prod:
+ * the honest generic below).
  *
  * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited
  * sign-up (EC-324) are each checked BEFORE the credential regex so neither
  * degrades to the lying "password too short". The final fallback is HONEST
  * ("unexpected server error — check the deployment logs"), never "unavailable":
- * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by
- * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts
- * them to `"Server Error"` with no `.data` and they legitimately land here.
+ * unknown errors — and any plain `Error` a pre-EC-363 prod deployment redacts
+ * to `"Server Error"` with no `.data` — legitimately land here.
  */
 export declare function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure;
 type ChangePasswordFailure = Extract<ChangePasswordResult, {

package/dist/lib/auth/convex-auth-adapter.js

@@ -26,14 +26,18 @@ const TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt';
  * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a
  * credential problem (EC-257). Matches the Convex Auth signing-path throws:
  * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ "Missing environment
- * variable …") and `importPKCS8` on a malformed key. Deliberately narrow — a genuine
- * wrong-password error carries none of these tokens — and checked BEFORE the credential
- * regex so it always wins. Note: a PRODUCTION deployment redacts non-`ConvexError`
- * messages to a generic "Server Error", which this can't match; there the honest
- * fallback is the neutral "unavailable" branch (never "password too short").
+ * variable …") and `importPKCS8` on a malformed key — plus the EC-363 server code
+ * `deployment-misconfigured` (`defineStudioAuth` wraps those library throws in a
+ * `ConvexError` whose `.data` survives prod redaction, so this classifies on
+ * PRODUCTION deployments too once their functions are redeployed). Deliberately
+ * narrow — a genuine wrong-password error carries none of these tokens — and checked
+ * BEFORE the credential regex so it always wins. On a prod deployment whose
+ * functions PREDATE EC-363 the plain-`Error` message is redacted to "Server Error",
+ * which this can't match; there the honest fallback is the neutral "unavailable"
+ * branch (never "password too short").
  */
 export function isDeploymentMisconfigured(message) {
-    return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key/i.test(message);
+    return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key|deployment-misconfigured/i.test(message);
 }
 /**
  * Reduce a thrown Convex error to the text used for classification (EC-362).
@@ -48,9 +52,11 @@ export function isDeploymentMisconfigured(message) {
  * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps
  * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the
  * only classifiable text that survives prod is the `.data` of a `ConvexError` —
- * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments
- * nothing is redacted, so `.message` also carries the token (the regex ladder
- * still matches); non-Convex errors only have a `.message`.
+ * our invite gate's `ConvexError(NOT_INVITED_REASON)` and, since EC-363, the
+ * coded `ConvexError({ code })` that `defineStudioAuth` wraps around the
+ * library's credential/env throws. On DEV deployments nothing is redacted, so
+ * `.message` also carries the token (the regex ladder still matches);
+ * non-Convex errors only have a `.message`.
  *
  * Duck-types the `data` property rather than `instanceof ConvexError`: two
  * copies of the `convex` module can coexist under Vite (transformed vs
@@ -82,16 +88,25 @@ export function convexErrorClassifierText(error) {
     return parts.join('\n');
 }
 /**
- * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the
- * regex ladder over {@link convexErrorClassifierText} output (data-first).
+ * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362 / EC-363).
+ * Runs the regex ladder over {@link convexErrorClassifierText} output
+ * (data-first).
+ *
+ * EC-363: `defineStudioAuth` now wraps `@convex-dev/auth`'s plain-`Error`
+ * credential/env throws server-side in a `ConvexError` carrying a stable code
+ * in `.data` (`{"code":"invalid-credentials" | "too-many-attempts" |
+ * "account-exists" | "deployment-misconfigured"}`). The data-first text folds
+ * that JSON in, so the SAME ladder classifies the codes (they survive prod
+ * redaction) AND the raw dev-shape messages — a deployment whose functions
+ * predate EC-363 still classifies exactly as before (dev: full message; prod:
+ * the honest generic below).
  *
  * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited
  * sign-up (EC-324) are each checked BEFORE the credential regex so neither
  * degrades to the lying "password too short". The final fallback is HONEST
  * ("unexpected server error — check the deployment logs"), never "unavailable":
- * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by
- * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts
- * them to `"Server Error"` with no `.data` and they legitimately land here.
+ * unknown errors — and any plain `Error` a pre-EC-363 prod deployment redacts
+ * to `"Server Error"` with no `.data` — legitimately land here.
  */
 export function classifySignInError(flow, text) {
     // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be
@@ -117,6 +132,20 @@ export function classifySignInError(flow, text) {
             message: 'This deployment is invite-only. Ask an admin to invite your email, then create your account.',
         };
     }
+    // EC-363: the sign-in rate limit. New deployments code it server-side
+    // (`{"code":"too-many-attempts"}` survives prod redaction); dev/old
+    // deployments surface the library's plain `TooManyFailedAttempts`. Checked
+    // BEFORE the credential regex; truthful wait-and-retry copy on the existing
+    // `unavailable` reason (a throttled deployment "can't sign you in right
+    // now" — the adapter contract gains no new reason for a transient state).
+    if (/too-many-attempts|TooManyFailedAttempts/i.test(text)) {
+        return {
+            ok: false,
+            reason: 'unavailable',
+            message: 'Too many failed sign-in attempts — wait a moment, then try again.',
+        };
+    }
+    // The EC-363 code `account-exists` matches via `exists`.
     if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {
         return {
             ok: false,
@@ -124,6 +153,7 @@ export function classifySignInError(flow, text) {
             message: 'An account with this email already exists — sign in instead.',
         };
     }
+    // The EC-363 code `invalid-credentials` matches via `credential`.
     if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {
         return {
             ok: false,

package/dist/lib/auth/convex-auth-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAa/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,sFAAsF,CAAC,IAAI,CAChG,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAA;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,YAAY,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAID;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB,EAAE,IAAY;IACzE,kFAAkF;IAClF,gFAAgF;IAChF,4EAA4E;IAC5E,gFAAgF;IAChF,mFAAmF;IACnF,qDAAqD;IACrD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EACL,oLAAoL;SACvL,CAAA;IACH,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,8FAA8F;SACjG,CAAA;IACH,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,8DAA8D;SACxE,CAAA;IACH,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,iCAAiC;SACxC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,GAAG,IAAI,gEAAgE;KACjF,CAAA;AACH,CAAC;AAID;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,0GAA0G;SAC7G,CAAA;IACH,CAAC;IACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,qCAAqC;SAC/C,CAAA;IACH,CAAC;IACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,+EAA+E;KACzF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,yEAAyE;YACzE,OAAO,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,EAAE;gBAC7D,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBAC1D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,6EAA6E;YAC7E,mDAAmD;YACnD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF","sourcesContent":["import type { ConvexHttpClient } from 'convex/browser'\nimport { actionRef, mutationRef, queryRef } from '../persistence/convex-client'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nimport type { SessionStore } from './local-auth-adapter'\n\n/**\n * Convex Auth implementation of the project-owned {@link AuthAdapter}\n * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over\n * Clerk — self-contained on the Convex stack, sessions in our own tables, no\n * extra vendor; reachable only through this adapter so a swap stays local.\n *\n * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):\n * 1. `signIn` calls the `auth:signIn` action with the Password provider\n *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.\n * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every\n *    subsequent persistence query/mutation runs authenticated and the\n *    server-side `requireRole` guards see the caller.\n * 3. `currentSession` restores the JWT from storage and asks `users:me`.\n * 4. `signOut` calls `auth:signOut` and clears the JWT.\n *\n * v1 scope note: the stored JWT is short-lived and this adapter does not yet\n * run the refresh-token loop (the official `@convex-dev/auth/react` client\n * does); an expired session simply resolves to \"signed out\" and the user signs\n * in again. Live-deployment hardening is EC-156. No live deployment exists in\n * this repo — this file is typecheck-verified and exercised against the local\n * adapter's shared interface.\n */\n\nconst TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt'\n\n/**\n * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a\n * credential problem (EC-257). Matches the Convex Auth signing-path throws:\n * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ \"Missing environment\n * variable …\") and `importPKCS8` on a malformed key. Deliberately narrow — a genuine\n * wrong-password error carries none of these tokens — and checked BEFORE the credential\n * regex so it always wins. Note: a PRODUCTION deployment redacts non-`ConvexError`\n * messages to a generic \"Server Error\", which this can't match; there the honest\n * fallback is the neutral \"unavailable\" branch (never \"password too short\").\n */\nexport function isDeploymentMisconfigured(message: string): boolean {\n  return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key/i.test(\n    message,\n  )\n}\n\n/**\n * Reduce a thrown Convex error to the text used for classification (EC-362).\n *\n * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex\n * deployment REDACTS a UDF's thrown-error `.message` to a generic\n * `\"[Request ID: …] Server Error\"`, but a `ConvexError`'s `.data` payload\n * survives to the client. Proven in the installed `convex@1.42.1` browser\n * client: on an `\"error\"` response `ConvexHttpClient.action` throws\n * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,\n * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`\n * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps\n * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the\n * only classifiable text that survives prod is the `.data` of a `ConvexError` —\n * e.g. our invite gate's `ConvexError(NOT_INVITED_REASON)`. On DEV deployments\n * nothing is redacted, so `.message` also carries the token (the regex ladder\n * still matches); non-Convex errors only have a `.message`.\n *\n * Duck-types the `data` property rather than `instanceof ConvexError`: two\n * copies of the `convex` module can coexist under Vite (transformed vs\n * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a\n * string (our gates) or a structured object (future gates) — both are folded in.\n */\nexport function convexErrorClassifierText(error: unknown): string {\n  const parts: string[] = []\n  if (typeof error === 'object' && error !== null && 'data' in error) {\n    const data = (error as { data: unknown }).data\n    if (typeof data === 'string') {\n      parts.push(data)\n    } else if (data !== null && data !== undefined) {\n      try {\n        parts.push(JSON.stringify(data))\n      } catch {\n        // Non-serializable data (cycles) — ignore; fall back to the message.\n      }\n    }\n  }\n  if (error instanceof Error) parts.push(error.message)\n  else if (typeof error === 'string') parts.push(error)\n  if (parts.length === 0) parts.push(String(error))\n  return parts.join('\\n')\n}\n\ntype SignInFailure = Extract<SignInResult, { ok: false }>\n\n/**\n * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362). Runs the\n * regex ladder over {@link convexErrorClassifierText} output (data-first).\n *\n * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited\n * sign-up (EC-324) are each checked BEFORE the credential regex so neither\n * degrades to the lying \"password too short\". The final fallback is HONEST\n * (\"unexpected server error — check the deployment logs\"), never \"unavailable\":\n * on a prod deployment the credential/`InvalidAccountId`/env errors thrown by\n * `@convex-dev/auth` are PLAIN `Error`s (not `ConvexError`s), so prod redacts\n * them to `\"Server Error\"` with no `.data` and they legitimately land here.\n */\nexport function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure {\n  // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be\n  // classified FIRST so it never falls through to the lying \"password too short\".\n  // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`\n  // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth` never\n  // run) the `requireEnv`/`importPKCS8` call throws AFTER the password is validated,\n  // so EVERY sign-in fails regardless of the password.\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'deployment-misconfigured',\n      message:\n        'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',\n    }\n  }\n  // EC-324: an uninvited sign-up is rejected server-side (`gateAccountCreation`/\n  // `gateSessionCreation` throw `ConvexError(NOT_INVITED_REASON)`, whose `.data`\n  // survives to the client even in production). Checked BEFORE the credential regex.\n  if (/not-invited|invite-only|invite only/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'not-invited',\n      message:\n        'This deployment is invite-only. Ask an admin to invite your email, then create your account.',\n    }\n  }\n  if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'account-exists',\n      message: 'An account with this email already exists — sign in instead.',\n    }\n  }\n  if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message:\n        flow === 'signUp'\n          ? 'That email or password can’t be used (password too short?).'\n          : 'Email or password is incorrect.',\n    }\n  }\n  const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in'\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: `${verb} failed (unexpected server error) — check the deployment logs.`,\n  }\n}\n\ntype ChangePasswordFailure = Extract<ChangePasswordResult, { ok: false }>\n\n/**\n * Pure password-change error classifier (EC-240 H-tail / EC-362). Same\n * data-first text + honest fallback discipline as {@link classifySignInError};\n * `deployment-misconfigured` collapses onto the `unavailable` reason\n * (`ChangePasswordResult` has no dedicated reason for it) with a specific\n * remediation message.\n */\nexport function classifyChangePasswordError(text: string): ChangePasswordFailure {\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message:\n        'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',\n    }\n  }\n  if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message: 'Your current password is incorrect.',\n    }\n  }\n  if (/at least|too short|8 characters|password requirement|weak/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'weak-password',\n      message: 'Choose a stronger password (at least 8 characters).',\n    }\n  }\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: 'Password change failed (unexpected server error) — check the deployment logs.',\n  }\n}\n\n/**\n * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a\n * session is scoped to its deployment: signing into Aurora's backend must not\n * carry a JWT to Northwind's. Keying the stored token by the deployment URL\n * makes each backend's session independent — switching to a project on a\n * not-yet-authenticated backend reads no token and the guard asks for sign-in.\n * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid\n * on every deployment, collapsing this back to a single session.)\n */\nexport function tokenStorageKey(deploymentUrl?: string): string {\n  return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX\n}\n\n/**\n * Best-effort \"is there a session for this deployment?\" — a synchronous token\n * presence check used to label per-backend projects in the switcher/launcher\n * (EC-179). It does not validate the token (an expired one still redirects to\n * sign-in on entry); it just answers \"has the user signed into this backend?\".\n */\nexport function hasStoredConvexSession(\n  deploymentUrl: string,\n  store: SessionStore = defaultStore(),\n): boolean {\n  return store.getItem(tokenStorageKey(deploymentUrl)) !== null\n}\n\ninterface SignInActionResult {\n  tokens?: { token: string; refreshToken: string } | null\n}\n\ninterface MeResult {\n  id: string\n  email: string\n  name?: string\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class ConvexAuthAdapter implements AuthAdapter {\n  private readonly tokenKey: string\n\n  constructor(\n    private readonly client: ConvexHttpClient,\n    private readonly store: SessionStore = defaultStore(),\n    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */\n    deploymentUrl?: string,\n  ) {\n    this.tokenKey = tokenStorageKey(deploymentUrl)\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return null\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        this.clearToken()\n        return null\n      }\n      return { user: this.toUser(me) }\n    } catch {\n      // Expired/invalid JWT or unreachable backend → treat as signed out.\n      this.clearToken()\n      return null\n    }\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signIn', credentials)\n  }\n\n  async signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signUp', credentials)\n  }\n\n  /**\n   * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by\n   * the Convex Auth `flow` param; both return a token + load `users:me`.\n   */\n  private async authenticate(\n    flow: 'signIn' | 'signUp',\n    credentials: SignInCredentials,\n  ): Promise<SignInResult> {\n    let result: SignInActionResult\n    try {\n      result = (await this.client.action(actionRef('auth:signIn'), {\n        provider: 'password',\n        params: {\n          email: credentials.email.trim().toLowerCase(),\n          password: credentials.password,\n          flow,\n        },\n      })) as SignInActionResult\n    } catch (error) {\n      // Convex Auth surfaces credential/registration problems as thrown errors.\n      // Classify from the DATA-FIRST text (a `ConvexError`'s `.data` survives prod\n      // redaction, the redacted `.message` does not — EC-362), then apply the pure\n      // regex ladder. See `convexErrorClassifierText` / `classifySignInError`.\n      return classifySignInError(flow, convexErrorClassifierText(error))\n    }\n    if (!result.tokens) {\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(this.tokenKey, result.tokens.token)\n    this.client.setAuth(result.tokens.token)\n    const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n    if (!me) {\n      this.clearToken()\n      return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' }\n    }\n    return { ok: true, session: { user: this.toUser(me) } }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      await this.client.action(actionRef('auth:signOut'), {})\n    } catch {\n      // Already signed out / unreachable — clearing local state is what matters.\n    }\n    this.clearToken()\n  }\n\n  /**\n   * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN\n   * auth `users` row (name / avatar) via the self-scoped `users:updateProfile`\n   * mutation, then re-reads `users:me` so the returned session carries the new\n   * name. Auth-owned fields never flow through the members-rail `users.save`.\n   */\n  async updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.mutation(mutationRef('users:updateProfile'), {\n        ...(input.name !== undefined ? { name: input.name } : {}),\n        ...(input.avatar !== undefined ? { avatar: input.avatar } : {}),\n      })\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n      }\n      return { ok: true, session: { user: this.toUser(me) } }\n    } catch {\n      return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n    }\n  }\n\n  /**\n   * Self-service password change (EC-240 H-tail item 3). Delegates entirely to\n   * the provider via the self-scoped `users:changePassword` ACTION (which calls\n   * Convex Auth's `retrieveAccount` to verify the current password, then\n   * `modifyAccountCredentials` to set the new one). **Seam only:** the raw\n   * password values are forwarded to the provider and NEVER logged or inspected\n   * here.\n   */\n  async changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.action(actionRef('users:changePassword'), {\n        currentPassword: input.currentPassword,\n        newPassword: input.newPassword,\n      })\n      return { ok: true }\n    } catch (error) {\n      // Data-first classification (EC-362): the change-password ACTION runs on the\n      // same deployment, so a prod redaction erases the thrown `.message` the same\n      // way — read a surviving `ConvexError.data` first.\n      return classifyChangePasswordError(convexErrorClassifierText(error))\n    }\n  }\n\n  private toUser(me: MeResult): AuthSession['user'] {\n    return {\n      id: me.id,\n      email: me.email,\n      ...(me.name ? { name: me.name } : {}),\n      // No global flags: project creation is config/CLI-owned (AD-11), so there\n      // is no in-studio `create-projects` capability. Per-project roles come\n      // from `projectMembers`.\n      globalFlags: [],\n    }\n  }\n\n  private clearToken(): void {\n    this.store.removeItem(this.tokenKey)\n    this.client.clearAuth()\n  }\n}\n"]}
+{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAa/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,+GAA+G,CAAC,IAAI,CACzH,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAA;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,YAAY,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB,EAAE,IAAY;IACzE,kFAAkF;IAClF,gFAAgF;IAChF,4EAA4E;IAC5E,gFAAgF;IAChF,mFAAmF;IACnF,qDAAqD;IACrD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EACL,oLAAoL;SACvL,CAAA;IACH,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,8FAA8F;SACjG,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,mEAAmE;SAC7E,CAAA;IACH,CAAC;IACD,yDAAyD;IACzD,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,8DAA8D;SACxE,CAAA;IACH,CAAC;IACD,kEAAkE;IAClE,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,iCAAiC;SACxC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,GAAG,IAAI,gEAAgE;KACjF,CAAA;AACH,CAAC;AAID;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,0GAA0G;SAC7G,CAAA;IACH,CAAC;IACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,qCAAqC;SAC/C,CAAA;IACH,CAAC;IACD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,+EAA+E;KACzF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,yEAAyE;YACzE,OAAO,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,EAAE;gBAC7D,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBAC1D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,6EAA6E;YAC7E,mDAAmD;YACnD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF","sourcesContent":["import type { ConvexHttpClient } from 'convex/browser'\nimport { actionRef, mutationRef, queryRef } from '../persistence/convex-client'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nimport type { SessionStore } from './local-auth-adapter'\n\n/**\n * Convex Auth implementation of the project-owned {@link AuthAdapter}\n * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over\n * Clerk — self-contained on the Convex stack, sessions in our own tables, no\n * extra vendor; reachable only through this adapter so a swap stays local.\n *\n * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):\n * 1. `signIn` calls the `auth:signIn` action with the Password provider\n *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.\n * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every\n *    subsequent persistence query/mutation runs authenticated and the\n *    server-side `requireRole` guards see the caller.\n * 3. `currentSession` restores the JWT from storage and asks `users:me`.\n * 4. `signOut` calls `auth:signOut` and clears the JWT.\n *\n * v1 scope note: the stored JWT is short-lived and this adapter does not yet\n * run the refresh-token loop (the official `@convex-dev/auth/react` client\n * does); an expired session simply resolves to \"signed out\" and the user signs\n * in again. Live-deployment hardening is EC-156. No live deployment exists in\n * this repo — this file is typecheck-verified and exercised against the local\n * adapter's shared interface.\n */\n\nconst TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt'\n\n/**\n * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a\n * credential problem (EC-257). Matches the Convex Auth signing-path throws:\n * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ \"Missing environment\n * variable …\") and `importPKCS8` on a malformed key — plus the EC-363 server code\n * `deployment-misconfigured` (`defineStudioAuth` wraps those library throws in a\n * `ConvexError` whose `.data` survives prod redaction, so this classifies on\n * PRODUCTION deployments too once their functions are redeployed). Deliberately\n * narrow — a genuine wrong-password error carries none of these tokens — and checked\n * BEFORE the credential regex so it always wins. On a prod deployment whose\n * functions PREDATE EC-363 the plain-`Error` message is redacted to \"Server Error\",\n * which this can't match; there the honest fallback is the neutral \"unavailable\"\n * branch (never \"password too short\").\n */\nexport function isDeploymentMisconfigured(message: string): boolean {\n  return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key|deployment-misconfigured/i.test(\n    message,\n  )\n}\n\n/**\n * Reduce a thrown Convex error to the text used for classification (EC-362).\n *\n * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex\n * deployment REDACTS a UDF's thrown-error `.message` to a generic\n * `\"[Request ID: …] Server Error\"`, but a `ConvexError`'s `.data` payload\n * survives to the client. Proven in the installed `convex@1.42.1` browser\n * client: on an `\"error\"` response `ConvexHttpClient.action` throws\n * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,\n * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`\n * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps\n * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the\n * only classifiable text that survives prod is the `.data` of a `ConvexError` —\n * our invite gate's `ConvexError(NOT_INVITED_REASON)` and, since EC-363, the\n * coded `ConvexError({ code })` that `defineStudioAuth` wraps around the\n * library's credential/env throws. On DEV deployments nothing is redacted, so\n * `.message` also carries the token (the regex ladder still matches);\n * non-Convex errors only have a `.message`.\n *\n * Duck-types the `data` property rather than `instanceof ConvexError`: two\n * copies of the `convex` module can coexist under Vite (transformed vs\n * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a\n * string (our gates) or a structured object (future gates) — both are folded in.\n */\nexport function convexErrorClassifierText(error: unknown): string {\n  const parts: string[] = []\n  if (typeof error === 'object' && error !== null && 'data' in error) {\n    const data = (error as { data: unknown }).data\n    if (typeof data === 'string') {\n      parts.push(data)\n    } else if (data !== null && data !== undefined) {\n      try {\n        parts.push(JSON.stringify(data))\n      } catch {\n        // Non-serializable data (cycles) — ignore; fall back to the message.\n      }\n    }\n  }\n  if (error instanceof Error) parts.push(error.message)\n  else if (typeof error === 'string') parts.push(error)\n  if (parts.length === 0) parts.push(String(error))\n  return parts.join('\\n')\n}\n\ntype SignInFailure = Extract<SignInResult, { ok: false }>\n\n/**\n * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362 / EC-363).\n * Runs the regex ladder over {@link convexErrorClassifierText} output\n * (data-first).\n *\n * EC-363: `defineStudioAuth` now wraps `@convex-dev/auth`'s plain-`Error`\n * credential/env throws server-side in a `ConvexError` carrying a stable code\n * in `.data` (`{\"code\":\"invalid-credentials\" | \"too-many-attempts\" |\n * \"account-exists\" | \"deployment-misconfigured\"}`). The data-first text folds\n * that JSON in, so the SAME ladder classifies the codes (they survive prod\n * redaction) AND the raw dev-shape messages — a deployment whose functions\n * predate EC-363 still classifies exactly as before (dev: full message; prod:\n * the honest generic below).\n *\n * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited\n * sign-up (EC-324) are each checked BEFORE the credential regex so neither\n * degrades to the lying \"password too short\". The final fallback is HONEST\n * (\"unexpected server error — check the deployment logs\"), never \"unavailable\":\n * unknown errors — and any plain `Error` a pre-EC-363 prod deployment redacts\n * to `\"Server Error\"` with no `.data` — legitimately land here.\n */\nexport function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure {\n  // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be\n  // classified FIRST so it never falls through to the lying \"password too short\".\n  // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`\n  // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth` never\n  // run) the `requireEnv`/`importPKCS8` call throws AFTER the password is validated,\n  // so EVERY sign-in fails regardless of the password.\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'deployment-misconfigured',\n      message:\n        'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',\n    }\n  }\n  // EC-324: an uninvited sign-up is rejected server-side (`gateAccountCreation`/\n  // `gateSessionCreation` throw `ConvexError(NOT_INVITED_REASON)`, whose `.data`\n  // survives to the client even in production). Checked BEFORE the credential regex.\n  if (/not-invited|invite-only|invite only/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'not-invited',\n      message:\n        'This deployment is invite-only. Ask an admin to invite your email, then create your account.',\n    }\n  }\n  // EC-363: the sign-in rate limit. New deployments code it server-side\n  // (`{\"code\":\"too-many-attempts\"}` survives prod redaction); dev/old\n  // deployments surface the library's plain `TooManyFailedAttempts`. Checked\n  // BEFORE the credential regex; truthful wait-and-retry copy on the existing\n  // `unavailable` reason (a throttled deployment \"can't sign you in right\n  // now\" — the adapter contract gains no new reason for a transient state).\n  if (/too-many-attempts|TooManyFailedAttempts/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message: 'Too many failed sign-in attempts — wait a moment, then try again.',\n    }\n  }\n  // The EC-363 code `account-exists` matches via `exists`.\n  if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'account-exists',\n      message: 'An account with this email already exists — sign in instead.',\n    }\n  }\n  // The EC-363 code `invalid-credentials` matches via `credential`.\n  if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message:\n        flow === 'signUp'\n          ? 'That email or password can’t be used (password too short?).'\n          : 'Email or password is incorrect.',\n    }\n  }\n  const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in'\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: `${verb} failed (unexpected server error) — check the deployment logs.`,\n  }\n}\n\ntype ChangePasswordFailure = Extract<ChangePasswordResult, { ok: false }>\n\n/**\n * Pure password-change error classifier (EC-240 H-tail / EC-362). Same\n * data-first text + honest fallback discipline as {@link classifySignInError};\n * `deployment-misconfigured` collapses onto the `unavailable` reason\n * (`ChangePasswordResult` has no dedicated reason for it) with a specific\n * remediation message.\n */\nexport function classifyChangePasswordError(text: string): ChangePasswordFailure {\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message:\n        'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',\n    }\n  }\n  if (/InvalidSecret|InvalidAccountId|current password|incorrect/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message: 'Your current password is incorrect.',\n    }\n  }\n  if (/at least|too short|8 characters|password requirement|weak/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'weak-password',\n      message: 'Choose a stronger password (at least 8 characters).',\n    }\n  }\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: 'Password change failed (unexpected server error) — check the deployment logs.',\n  }\n}\n\n/**\n * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a\n * session is scoped to its deployment: signing into Aurora's backend must not\n * carry a JWT to Northwind's. Keying the stored token by the deployment URL\n * makes each backend's session independent — switching to a project on a\n * not-yet-authenticated backend reads no token and the guard asks for sign-in.\n * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid\n * on every deployment, collapsing this back to a single session.)\n */\nexport function tokenStorageKey(deploymentUrl?: string): string {\n  return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX\n}\n\n/**\n * Best-effort \"is there a session for this deployment?\" — a synchronous token\n * presence check used to label per-backend projects in the switcher/launcher\n * (EC-179). It does not validate the token (an expired one still redirects to\n * sign-in on entry); it just answers \"has the user signed into this backend?\".\n */\nexport function hasStoredConvexSession(\n  deploymentUrl: string,\n  store: SessionStore = defaultStore(),\n): boolean {\n  return store.getItem(tokenStorageKey(deploymentUrl)) !== null\n}\n\ninterface SignInActionResult {\n  tokens?: { token: string; refreshToken: string } | null\n}\n\ninterface MeResult {\n  id: string\n  email: string\n  name?: string\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class ConvexAuthAdapter implements AuthAdapter {\n  private readonly tokenKey: string\n\n  constructor(\n    private readonly client: ConvexHttpClient,\n    private readonly store: SessionStore = defaultStore(),\n    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */\n    deploymentUrl?: string,\n  ) {\n    this.tokenKey = tokenStorageKey(deploymentUrl)\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return null\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        this.clearToken()\n        return null\n      }\n      return { user: this.toUser(me) }\n    } catch {\n      // Expired/invalid JWT or unreachable backend → treat as signed out.\n      this.clearToken()\n      return null\n    }\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signIn', credentials)\n  }\n\n  async signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signUp', credentials)\n  }\n\n  /**\n   * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by\n   * the Convex Auth `flow` param; both return a token + load `users:me`.\n   */\n  private async authenticate(\n    flow: 'signIn' | 'signUp',\n    credentials: SignInCredentials,\n  ): Promise<SignInResult> {\n    let result: SignInActionResult\n    try {\n      result = (await this.client.action(actionRef('auth:signIn'), {\n        provider: 'password',\n        params: {\n          email: credentials.email.trim().toLowerCase(),\n          password: credentials.password,\n          flow,\n        },\n      })) as SignInActionResult\n    } catch (error) {\n      // Convex Auth surfaces credential/registration problems as thrown errors.\n      // Classify from the DATA-FIRST text (a `ConvexError`'s `.data` survives prod\n      // redaction, the redacted `.message` does not — EC-362), then apply the pure\n      // regex ladder. See `convexErrorClassifierText` / `classifySignInError`.\n      return classifySignInError(flow, convexErrorClassifierText(error))\n    }\n    if (!result.tokens) {\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(this.tokenKey, result.tokens.token)\n    this.client.setAuth(result.tokens.token)\n    const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n    if (!me) {\n      this.clearToken()\n      return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' }\n    }\n    return { ok: true, session: { user: this.toUser(me) } }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      await this.client.action(actionRef('auth:signOut'), {})\n    } catch {\n      // Already signed out / unreachable — clearing local state is what matters.\n    }\n    this.clearToken()\n  }\n\n  /**\n   * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN\n   * auth `users` row (name / avatar) via the self-scoped `users:updateProfile`\n   * mutation, then re-reads `users:me` so the returned session carries the new\n   * name. Auth-owned fields never flow through the members-rail `users.save`.\n   */\n  async updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.mutation(mutationRef('users:updateProfile'), {\n        ...(input.name !== undefined ? { name: input.name } : {}),\n        ...(input.avatar !== undefined ? { avatar: input.avatar } : {}),\n      })\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n      }\n      return { ok: true, session: { user: this.toUser(me) } }\n    } catch {\n      return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n    }\n  }\n\n  /**\n   * Self-service password change (EC-240 H-tail item 3). Delegates entirely to\n   * the provider via the self-scoped `users:changePassword` ACTION (which calls\n   * Convex Auth's `retrieveAccount` to verify the current password, then\n   * `modifyAccountCredentials` to set the new one). **Seam only:** the raw\n   * password values are forwarded to the provider and NEVER logged or inspected\n   * here.\n   */\n  async changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.action(actionRef('users:changePassword'), {\n        currentPassword: input.currentPassword,\n        newPassword: input.newPassword,\n      })\n      return { ok: true }\n    } catch (error) {\n      // Data-first classification (EC-362): the change-password ACTION runs on the\n      // same deployment, so a prod redaction erases the thrown `.message` the same\n      // way — read a surviving `ConvexError.data` first.\n      return classifyChangePasswordError(convexErrorClassifierText(error))\n    }\n  }\n\n  private toUser(me: MeResult): AuthSession['user'] {\n    return {\n      id: me.id,\n      email: me.email,\n      ...(me.name ? { name: me.name } : {}),\n      // No global flags: project creation is config/CLI-owned (AD-11), so there\n      // is no in-studio `create-projects` capability. Per-project roles come\n      // from `projectMembers`.\n      globalFlags: [],\n    }\n  }\n\n  private clearToken(): void {\n    this.store.removeItem(this.tokenKey)\n    this.client.clearAuth()\n  }\n}\n"]}

package/dist/lib/persistence/backend-mode.d.ts

@@ -35,8 +35,60 @@ export type EnvRecord = Record<string, string | undefined>;
  * use this instead — keeping results independent of any developer `.env.local`.
  */
 export declare function setStudioEnvOverrideForTests(env: EnvRecord | null): void;
-/** Resolve the configured studio env (Vite client env wins over process.env). */
+/**
+ * Install the CONSUMER-captured env as the studio's env source (EC-357). The root
+ * cause this fixes: the engine used to read `import.meta.env.VITE_*` inside
+ * `@elytracms` package code, which Vite dep-optimizes in a real consumer — on
+ * Vite ≥8 those values are simply absent at runtime in the optimized chunk (the
+ * backend URL / mode / dev-login silently vanish and every sign-in fails), and on
+ * Vite 7 they froze at optimize time (stale until `node_modules/.vite` is wiped).
+ *
+ * The consumer's own entry module is code Vite ALWAYS transforms live, so the env
+ * is captured there and handed down: `createStudio(config, studioConfig, { env:
+ * import.meta.env })`. When a provided env exists it REPLACES the engine-visible
+ * Vite layer entirely (never merged with it — a stale optimizer snapshot must not
+ * shadow a removed key); `process.env` stays underneath as the SSR/tooling base.
+ *
+ * `DEV` is captured alongside (it gates dev auto-login): in a production consumer
+ * build Vite statically inlines `import.meta.env` with `DEV: false`, so the
+ * dev-login gate keeps failing closed exactly as before. Non-string values other
+ * than `DEV` are dropped — the studio env surface is a string record.
+ *
+ * Passing `null`/`undefined` is a no-op (a consumer entry that predates the option
+ * keeps today's engine-visible fallback behavior, plus a loud runtime warning when
+ * that fallback is provably broken — see {@link maybeWarnEngineEnvUnreachable}).
+ */
+export declare function provideStudioEnv(env: Record<string, unknown> | null | undefined): void;
+/** Test seam: clear the mount-provided env. Never used by app code. */
+export declare function resetProvidedStudioEnvForTests(): void;
+/**
+ * Resolve the configured studio env. Precedence: the test override, else the
+ * mount-provided env (over `process.env`), else the engine-visible Vite env
+ * (over `process.env`).
+ */
 export declare function studioEnv(): EnvRecord;
+/** The env keys whose loss/staleness breaks boot or sign-in. */
+export declare const STUDIO_ENV_KEYS: readonly string[];
+export type StudioEnvAnomaly = 
+/** No mount-provided env AND the engine module has no `import.meta.env` at all. */
+{
+    kind: 'engine-env-unreachable';
+}
+/** The engine-visible env disagrees with the mount-provided env (stale optimizer cache). */
+ | {
+    kind: 'engine-env-stale';
+    keys: string[];
+};
+/**
+ * Pure anomaly detection over the two env views (unit-testable core of the boot
+ * warnings). `engineVisible === null` means the engine module has no
+ * `import.meta.env` — expected under dep optimization WITH a provided env (silent),
+ * fatal without one (the values can never arrive). A stale mismatch fires only for
+ * keys the ENGINE sees with a different value than the mount provided (the Vite 7
+ * freeze); keys the engine simply lacks (Vite 8) are not anomalies — the provided
+ * env is authoritative and in effect.
+ */
+export declare function detectStudioEnvAnomaly(provided: EnvRecord | null, engineVisible: EnvRecord | null, inBrowser: boolean): StudioEnvAnomaly | null;
 /**
  * Pure mode decision — testable with a plain env record. The app calls it with
  * {@link studioEnv}; `CONVEX_URL` (Node-side alias) is honored for SSR/tools.

package/dist/lib/persistence/backend-mode.js

@@ -15,10 +15,22 @@
 export const MODE_ENV_VAR = 'VITE_ELYTRA_MODE';
 export const PLAYGROUND_MODE = 'playground';
 export const CONVEX_URL_ENV_VAR = 'VITE_CONVEX_URL';
-function viteEnv() {
+/**
+ * The ENGINE-visible `import.meta.env`, or `null` when the module has none at all.
+ * `null` is a meaningful signal (EC-357): every module Vite transforms live gets an
+ * `import.meta.env`, so its complete absence in a browser means this engine module
+ * was served from Vite's dep-optimizer cache — where Vite ≥8 no longer inlines
+ * custom `VITE_*` values (and Vite 7 froze them at optimize time). Engine code must
+ * therefore never trust this view when a mount-provided env exists — see
+ * {@link provideStudioEnv}.
+ */
+function engineVisibleEnv() {
     if (typeof import.meta === 'undefined')
-        return {};
-    return import.meta.env ?? {};
+        return null;
+    return import.meta.env ?? null;
+}
+function viteEnv() {
+    return engineVisibleEnv() ?? {};
 }
 function nodeEnv() {
     return typeof process !== 'undefined' ? (process.env ?? {}) : {};
@@ -37,9 +49,119 @@ let envOverride = null;
 export function setStudioEnvOverrideForTests(env) {
     envOverride = env;
 }
-/** Resolve the configured studio env (Vite client env wins over process.env). */
+let providedEnv = null;
+/**
+ * Install the CONSUMER-captured env as the studio's env source (EC-357). The root
+ * cause this fixes: the engine used to read `import.meta.env.VITE_*` inside
+ * `@elytracms` package code, which Vite dep-optimizes in a real consumer — on
+ * Vite ≥8 those values are simply absent at runtime in the optimized chunk (the
+ * backend URL / mode / dev-login silently vanish and every sign-in fails), and on
+ * Vite 7 they froze at optimize time (stale until `node_modules/.vite` is wiped).
+ *
+ * The consumer's own entry module is code Vite ALWAYS transforms live, so the env
+ * is captured there and handed down: `createStudio(config, studioConfig, { env:
+ * import.meta.env })`. When a provided env exists it REPLACES the engine-visible
+ * Vite layer entirely (never merged with it — a stale optimizer snapshot must not
+ * shadow a removed key); `process.env` stays underneath as the SSR/tooling base.
+ *
+ * `DEV` is captured alongside (it gates dev auto-login): in a production consumer
+ * build Vite statically inlines `import.meta.env` with `DEV: false`, so the
+ * dev-login gate keeps failing closed exactly as before. Non-string values other
+ * than `DEV` are dropped — the studio env surface is a string record.
+ *
+ * Passing `null`/`undefined` is a no-op (a consumer entry that predates the option
+ * keeps today's engine-visible fallback behavior, plus a loud runtime warning when
+ * that fallback is provably broken — see {@link maybeWarnEngineEnvUnreachable}).
+ */
+export function provideStudioEnv(env) {
+    if (env === null || env === undefined)
+        return;
+    const record = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (typeof value === 'string')
+            record[key] = value;
+    }
+    providedEnv = {
+        record,
+        dev: env.DEV === true ? true : env.DEV === false ? false : undefined,
+    };
+    maybeWarnEngineEnvStale();
+}
+/** Test seam: clear the mount-provided env. Never used by app code. */
+export function resetProvidedStudioEnvForTests() {
+    providedEnv = null;
+    warnedStale = false;
+    warnedUnreachable = false;
+}
+/**
+ * Resolve the configured studio env. Precedence: the test override, else the
+ * mount-provided env (over `process.env`), else the engine-visible Vite env
+ * (over `process.env`).
+ */
 export function studioEnv() {
-    return envOverride ?? { ...nodeEnv(), ...viteEnv() };
+    if (envOverride)
+        return envOverride;
+    if (providedEnv)
+        return { ...nodeEnv(), ...providedEnv.record };
+    maybeWarnEngineEnvUnreachable();
+    return { ...nodeEnv(), ...viteEnv() };
+}
+// --- Boot-time env self-check (EC-357, Oli: "easier to catch") ---------------
+/** The env keys whose loss/staleness breaks boot or sign-in. */
+export const STUDIO_ENV_KEYS = [
+    'VITE_ELYTRA_MODE',
+    'VITE_CONVEX_URL',
+    'VITE_ELYTRA_DEV_LOGIN',
+];
+/**
+ * Pure anomaly detection over the two env views (unit-testable core of the boot
+ * warnings). `engineVisible === null` means the engine module has no
+ * `import.meta.env` — expected under dep optimization WITH a provided env (silent),
+ * fatal without one (the values can never arrive). A stale mismatch fires only for
+ * keys the ENGINE sees with a different value than the mount provided (the Vite 7
+ * freeze); keys the engine simply lacks (Vite 8) are not anomalies — the provided
+ * env is authoritative and in effect.
+ */
+export function detectStudioEnvAnomaly(provided, engineVisible, inBrowser) {
+    if (!inBrowser)
+        return null;
+    if (!provided)
+        return engineVisible === null ? { kind: 'engine-env-unreachable' } : null;
+    if (engineVisible === null)
+        return null;
+    const stale = STUDIO_ENV_KEYS.filter((key) => {
+        const engineValue = readEnv(engineVisible, key);
+        return engineValue !== undefined && engineValue !== readEnv(provided, key);
+    });
+    return stale.length > 0 ? { kind: 'engine-env-stale', keys: stale } : null;
+}
+function inBrowser() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+let warnedUnreachable = false;
+function maybeWarnEngineEnvUnreachable() {
+    if (warnedUnreachable)
+        return;
+    const anomaly = detectStudioEnvAnomaly(null, engineVisibleEnv(), inBrowser());
+    if (anomaly?.kind !== 'engine-env-unreachable')
+        return;
+    warnedUnreachable = true;
+    console.warn('[elytra] The engine cannot see import.meta.env — this @elytracms module was dep-optimized by Vite, ' +
+        'so VITE_CONVEX_URL / VITE_ELYTRA_MODE / VITE_ELYTRA_DEV_LOGIN cannot reach it at runtime. ' +
+        'Fix: pass your studio entry’s env to the mount — createStudio(config, studioConfig, { env: import.meta.env }) — ' +
+        "or add optimizeDeps.exclude: ['@elytracms/studio', '@elytracms/core'] to the studio vite.config.ts.");
+}
+let warnedStale = false;
+function maybeWarnEngineEnvStale() {
+    if (warnedStale || !providedEnv)
+        return;
+    const anomaly = detectStudioEnvAnomaly(providedEnv.record, engineVisibleEnv(), inBrowser());
+    if (anomaly?.kind !== 'engine-env-stale')
+        return;
+    warnedStale = true;
+    console.warn(`[elytra] import.meta.env inside the engine disagrees with the studio mount's env for: ${anomaly.keys.join(', ')}. ` +
+        "The engine copy is a stale Vite dep-optimizer snapshot; the mount-provided values are in effect. " +
+        'Delete node_modules/.vite to drop the stale copy.');
 }
 /**
  * Pure mode decision — testable with a plain env record. The app calls it with
@@ -62,7 +184,11 @@ export function resolveBackendConfig(env = studioEnv()) {
     return {
         kind: 'misconfigured',
         reason: 'missing-convex-url',
-        detail: `No persistence backend is configured. Set ${CONVEX_URL_ENV_VAR} to your Convex deployment URL (see docs/backend-setup.md), or opt into the ephemeral local playground with ${MODE_ENV_VAR}=${PLAYGROUND_MODE}.`,
+        // EC-357: name BOTH causes — the var may be genuinely unset, or set but never
+        // reaching the client at runtime (Vite dep-optimized engine code; see
+        // `provideStudioEnv`). The paired fix text (deployment-ready `FIX.backendUrl`)
+        // carries the full remedy for the second cause.
+        detail: `No persistence backend is configured — ${CONVEX_URL_ENV_VAR} is unset or is not reaching the client at runtime. Set it to your Convex deployment URL (see docs/backend-setup.md), or opt into the ephemeral local playground with ${MODE_ENV_VAR}=${PLAYGROUND_MODE}.`,
     };
 }
 /** True when the studio runs in the explicit, labeled playground mode. */
@@ -75,12 +201,17 @@ export function isPlaygroundMode() {
 /** `email:password` for unattended dev sign-in (gitignored `.env.local`). */
 export const DEV_LOGIN_ENV_VAR = 'VITE_ELYTRA_DEV_LOGIN';
 /**
- * Is this a Vite *dev* build? `import.meta.env.DEV` is statically `true` under
- * `vite dev` and statically `false` in any production build — so gating dev
- * auto-login on it means the whole feature **dead-code-eliminates** out of a
- * production bundle, even if `VITE_ELYTRA_DEV_LOGIN` were somehow present.
+ * Is this a Vite *dev* build? The mount-provided env's captured `DEV` flag wins
+ * (EC-357 — inside dep-optimized engine code the engine-visible flag is absent on
+ * Vite ≥8 and frozen on Vite 7); the consumer's `import.meta.env.DEV` is statically
+ * `true` under `vite dev` and statically `false` in any production build, so the
+ * dev auto-login gate still fails closed in production. Without a provided env the
+ * engine-visible static flag applies as before (where it also dead-code-eliminates
+ * the feature out of a directly-bundled production build).
  */
 function isViteDevBuild() {
+    if (providedEnv?.dev !== undefined)
+        return providedEnv.dev;
     if (typeof import.meta === 'undefined')
         return false;
     return import.meta.env?.DEV === true;