@elytracms/studio 0.0.65 → 0.0.67

package/dist/components/collection-view/cms-collection-view-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"cms-collection-view-source.js","sourceRoot":"","sources":["../../../src/components/collection-view/cms-collection-view-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAMvG,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAA;AAErF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,YAAoB;IAC7D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAA;IACtC,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAExE,+EAA+E;IAC/E,MAAM,iBAAiB,GAAG,OAAO,CAC/B,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,EAAE,IAAI,OAAO,EACpE,CAAC,GAAG,CAAC,WAAW,CAAC,CAClB,CAAA;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,UAAU,GAAG,OAAO,CACxB,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,KAAK,YAAY,CAAC,EAC5F,CAAC,YAAY,CAAC,CACf,CAAA;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAC3C,MAAM,GAAG,GAAG;YACV,MAAM,EAAE,uBAAuB,EAAE;YACjC,WAAW,EAAE,4BAA4B,EAAE;YAC3C,YAAY,EAAE,GAAG,CAAC,YAAY;SAC/B,CAAA;QACD,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAA;QAC1C,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAA;YAC9F,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAE/E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;IACvF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;IACxF,MAAM,YAAY,GAAG,WAAW,CAC9B,CAAC,MAA2D,EAAE,EAAE,CAC9D,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,EACzC,CAAC,GAAG,EAAE,YAAY,CAAC,CACpB,CAAA;IACD,qFAAqF;IACrF,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;QACrC,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC;QAC9C,SAAS,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;KAC/D,CAAC,EACF,CAAC,GAAG,EAAE,YAAY,CAAC,CACpB,CAAA;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;IACvF,MAAM,OAAO,GAAG,OAAO,CACrB,GAAG,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,KAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,EAC3F,CAAC,GAAG,EAAE,YAAY,CAAC,CACpB,CAAA;IACD,MAAM,YAAY,GAAG,WAAW,CAC9B,CAAC,EAAU,EAA6B,EAAE;QACxC,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC7B,OAAO;YACL,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAA;IACH,CAAC,EACD,CAAC,UAAU,CAAC,CACb,CAAA;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAE5D,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAC5B,MAAM,YAAY,GAA+B;YAC/C,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;YACrC,YAAY,EAAE,IAAI;SACnB,CAAA;QACD,MAAM,MAAM,GAAyB;YACnC,YAAY;YACZ,MAAM,EAAE,UAAU;YAClB,YAAY;YACZ,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,iBAAiB;YACjB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,SAAS;YACT,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,6EAA6E;YAC7E,gFAAgF;YAChF,mBAAmB,EAAE,GAAG,CAAC,WAAW;YACpC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,YAAY;YAC3B,cAAc,EAAE,GAAG,CAAC,iBAAiB;YACrC,2EAA2E;YAC3E,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,GAAG,CAAC,uBAAuB,EAAE,CAAA;gBACnC,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAA;YAC9B,CAAC;YACD,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC;YACpE,QAAQ,EAAE,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC;YAChD,SAAS;YACT,YAAY;YACZ,KAAK;YACL,OAAO;YACP,MAAM;YACN,IAAI,EAAE,GAAG,CAAC,YAAY;YACtB,MAAM,EAAE,GAAG,CAAC,cAAc;YAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC;YACjF,UAAU,EAAE;gBACV,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EAAE,GAAG,CAAC,eAAe;gBAC5B,SAAS,EAAE,GAAG,CAAC,iBAAiB;gBAChC,QAAQ;aACT;YACD,UAAU,EAAE;gBACV,OAAO,EAAE,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAK,EAAE,EAAE,CACpD,GAAG,CAAC,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;gBACjD,2EAA2E;gBAC3E,qEAAqE;gBACrE,IAAI,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;oBAC/B,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAA;oBAC5B,OAAO,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBACtC,CAAC;aACF;YACD,aAAa,EAAE;gBACb,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;aACnD;SACF,CAAA;QACD,OAAO,MAAM,CAAA;IACf,CAAC,EAAE;QACD,UAAU;QACV,YAAY;QACZ,GAAG;QACH,UAAU;QACV,SAAS;QACT,SAAS;QACT,YAAY;QACZ,KAAK;QACL,OAAO;QACP,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,iBAAiB;KAClB,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { useCallback, useMemo } from 'react'\nimport { isHierarchical, urlForDocument } from '@elytracms/core/cms-core'\nimport type { DocumentRef, DocumentUrl } from '@elytracms/core/cms-core'\nimport { studioPath } from '@elytracms/studio/router'\nimport { resolveDeploymentFrontendUrl, resolveDeploymentRoutes } from '@elytracms/studio/lib/workspace'\nimport type {\n  CollectionViewCapabilities,\n  CollectionViewSource,\n  ResolvedAsset,\n} from '@elytracms/studio/lib/collection-view/collection-view-source'\nimport { useCms } from '../cms/cms-store'\nimport { useOptionalAssets } from '../assets/assets-store'\nimport { usePublishedDocuments } from '@elytracms/studio/lib/cms/published-documents'\n\n/**\n * Assemble a {@link CollectionViewSource} for a `cmsDocuments` collection from the\n * ambient `CmsStore` + its side contexts (assets, published pool) + the\n * deployment config reads (EC-240 / AD-19). This is the CMS adapter: a\n * behaviour-preserving pass-through so the portable list + edit surfaces render\n * over the source instead of `useCms()` directly, byte-for-byte as before.\n *\n * Returns `null` for an unknown collection id (the caller renders the fallback).\n *\n * Referential stability: collection-parameterised methods are `useCallback`-bound\n * and the source object is `useMemo`-ed, so the surfaces' `useMemo` dependency\n * arrays stay stable across renders (the inline-edit order snapshot depends on it).\n */\nexport function useCmsCollectionViewSource(collectionId: string): CollectionViewSource | null {\n  const cms = useCms()\n  const assetStore = useOptionalAssets()\n  const collection = cms.getCollection(collectionId)\n  const publishedDocs = usePublishedDocuments(cms.projectId, collectionId)\n\n  // The asset collection id is resolved once from the schema (as the cell does).\n  const assetCollectionId = useMemo(\n    () => cms.collections.find((c) => c.kind === 'asset')?.id ?? 'asset',\n    [cms.collections],\n  )\n\n  // Live-URL column: the published pool × deployment routes, memoised exactly as\n  // the table did — derived from PUBLISHED snapshots, never draft rows (EC-205).\n  const isRoutable = useMemo(\n    () => resolveDeploymentRoutes().some((route) => route.document?.collection === collectionId),\n    [collectionId],\n  )\n  const liveUrlMap = useMemo(() => {\n    if (!collection || !isRoutable) return null\n    const cfg = {\n      routes: resolveDeploymentRoutes(),\n      frontendUrl: resolveDeploymentFrontendUrl(),\n      localeConfig: cms.localeConfig,\n    }\n    const siblings = [...publishedDocs.byId.values()]\n    const map = new Map<string, DocumentUrl>()\n    for (const published of siblings) {\n      const url = urlForDocument(cfg, collection, published, { siblings, locale: cms.activeLocale })\n      if (url) map.set(published.id, url)\n    }\n    return map\n  }, [collection, isRoutable, publishedDocs, cms.localeConfig, cms.activeLocale])\n\n  const documents = useCallback(() => cms.documentsOf(collectionId), [cms, collectionId])\n  const viewState = useCallback(() => cms.tableStateOf(collectionId), [cms, collectionId])\n  const setViewState = useCallback(\n    (update: Parameters<CollectionViewSource['setViewState']>[0]) =>\n      cms.setTableState(collectionId, update),\n    [cms, collectionId],\n  )\n  // Named views (EC-246b): config-as-code lenses the header selector switches between.\n  const views = useMemo(\n    () => ({\n      list: () => cms.viewsOf(collectionId),\n      activeId: () => cms.activeViewId(collectionId),\n      setActive: (id: string) => cms.setActiveView(collectionId, id),\n    }),\n    [cms, collectionId],\n  )\n  const create = useCallback(() => cms.createDocument(collectionId), [cms, collectionId])\n  const imports = useMemo(\n    () => ({ importDocuments: (items: unknown[]) => cms.importDocuments(collectionId, items) }),\n    [cms, collectionId],\n  )\n  const resolveAsset = useCallback(\n    (id: string): ResolvedAsset | undefined => {\n      const record = assetStore?.assets.find((asset) => asset.id === id)\n      if (!record) return undefined\n      return {\n        ...(record.url !== undefined ? { url: record.url } : {}),\n        contentType: record.contentType,\n        ...(record.title !== undefined ? { title: record.title } : {}),\n        filename: record.filename,\n        ...(record.alt !== undefined ? { alt: record.alt } : {}),\n      }\n    },\n    [assetStore],\n  )\n  const liveUrls = useCallback(() => liveUrlMap, [liveUrlMap])\n\n  return useMemo(() => {\n    if (!collection) return null\n    const capabilities: CollectionViewCapabilities = {\n      publish: true,\n      versions: true,\n      locales: true,\n      inlineEdit: true,\n      create: true,\n      remove: true,\n      bulk: true,\n      liveUrl: isRoutable,\n      hierarchy: isHierarchical(collection),\n      importExport: true,\n    }\n    const source: CollectionViewSource = {\n      collectionId,\n      schema: collection,\n      capabilities,\n      ...(cms.projectId !== undefined ? { projectId: cms.projectId } : {}),\n      assetCollectionId,\n      localeConfig: cms.localeConfig,\n      activeLocale: cms.activeLocale,\n      documents,\n      get: cms.getDocument,\n      titleOf: cms.titleOf,\n      // References are collection-based (EC-072): resolve candidates of ANY target\n      // collection the schema declares — the workspace doc store already serves them.\n      referenceCandidates: cms.documentsOf,\n      collections: cms.collections,\n      isFieldReadOnly: cms.isFieldReadOnly,\n      validate: cms.validate,\n      resolveAsset,\n      lastError: cms.persistError,\n      clearLastError: cms.clearPersistError,\n      // Baseline + queue flush, so a pre-flight reference-index read is current.\n      flush: async () => {\n        await cms.ensurePersistedBaseline()\n        await cms.flushPersistence()\n      },\n      detailPath: (id: string) => studioPath.cmsDocument(collectionId, id),\n      listPath: studioPath.cmsCollection(collectionId),\n      viewState,\n      setViewState,\n      views,\n      imports,\n      create,\n      save: cms.saveDocument,\n      remove: cms.deleteDocument,\n      bulk: (ids, action, setField) => cms.runBulk(collectionId, ids, action, setField),\n      publishing: {\n        isPublished: cms.isPublished,\n        publish: cms.publishDocument,\n        unpublish: cms.unpublishDocument,\n        liveUrls,\n      },\n      versioning: {\n        restore: (ref: DocumentRef, version: number, scope) =>\n          cms.restoreDocumentVersion(ref, version, scope),\n        // Flush-before-read ordering folds into the loader (EC-224) so any surface\n        // that mutated the history still lists an authoritative version set.\n        load: async (ref: DocumentRef) => {\n          await cms.flushPersistence()\n          return cms.loadDocumentVersions(ref)\n        },\n      },\n      inlineEditing: {\n        commitField: (input) => cms.commitFieldEdit(input),\n      },\n    }\n    return source\n  }, [\n    collection,\n    collectionId,\n    cms,\n    isRoutable,\n    documents,\n    viewState,\n    setViewState,\n    views,\n    imports,\n    create,\n    resolveAsset,\n    liveUrls,\n    assetCollectionId,\n  ])\n}\n"]}
+{"version":3,"file":"cms-collection-view-source.js","sourceRoot":"","sources":["../../../src/components/collection-view/cms-collection-view-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAMvG,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAA;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAE5D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,YAAoB;IAC7D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAA;IACtC,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAExE,+EAA+E;IAC/E,MAAM,iBAAiB,GAAG,OAAO,CAC/B,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,EAAE,IAAI,OAAO,EACpE,CAAC,GAAG,CAAC,WAAW,CAAC,CAClB,CAAA;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,UAAU,GAAG,OAAO,CACxB,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,KAAK,YAAY,CAAC,EAC5F,CAAC,YAAY,CAAC,CACf,CAAA;IACD,2EAA2E;IAC3E,uEAAuE;IACvE,8EAA8E;IAC9E,sDAAsD;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAA;QAC1C,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,sBAAsB,CAAC;gBACjC,MAAM,EAAE,uBAAuB,EAAE;gBACjC,WAAW,EAAE,4BAA4B,EAAE;gBAC3C,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU;gBACV,GAAG,EAAE,SAAS;gBACd,QAAQ;gBACR,MAAM,EAAE,GAAG,CAAC,YAAY;aACzB,CAAC,CAAA;YACF,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAE/E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;IACvF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;IACxF,MAAM,YAAY,GAAG,WAAW,CAC9B,CAAC,MAA2D,EAAE,EAAE,CAC9D,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,EACzC,CAAC,GAAG,EAAE,YAAY,CAAC,CACpB,CAAA;IACD,qFAAqF;IACrF,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;QACrC,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC;QAC9C,SAAS,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;KAC/D,CAAC,EACF,CAAC,GAAG,EAAE,YAAY,CAAC,CACpB,CAAA;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;IACvF,MAAM,OAAO,GAAG,OAAO,CACrB,GAAG,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,KAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,EAC3F,CAAC,GAAG,EAAE,YAAY,CAAC,CACpB,CAAA;IACD,MAAM,YAAY,GAAG,WAAW,CAC9B,CAAC,EAAU,EAA6B,EAAE;QACxC,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC7B,OAAO;YACL,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAA;IACH,CAAC,EACD,CAAC,UAAU,CAAC,CACb,CAAA;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAE5D,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAC5B,MAAM,YAAY,GAA+B;YAC/C,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;YACrC,YAAY,EAAE,IAAI;SACnB,CAAA;QACD,MAAM,MAAM,GAAyB;YACnC,YAAY;YACZ,MAAM,EAAE,UAAU;YAClB,YAAY;YACZ,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,iBAAiB;YACjB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,SAAS;YACT,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,6EAA6E;YAC7E,gFAAgF;YAChF,mBAAmB,EAAE,GAAG,CAAC,WAAW;YACpC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,YAAY;YAC3B,cAAc,EAAE,GAAG,CAAC,iBAAiB;YACrC,2EAA2E;YAC3E,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,GAAG,CAAC,uBAAuB,EAAE,CAAA;gBACnC,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAA;YAC9B,CAAC;YACD,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC;YACpE,QAAQ,EAAE,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC;YAChD,SAAS;YACT,YAAY;YACZ,KAAK;YACL,OAAO;YACP,MAAM;YACN,IAAI,EAAE,GAAG,CAAC,YAAY;YACtB,MAAM,EAAE,GAAG,CAAC,cAAc;YAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC;YACjF,UAAU,EAAE;gBACV,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EAAE,GAAG,CAAC,eAAe;gBAC5B,SAAS,EAAE,GAAG,CAAC,iBAAiB;gBAChC,QAAQ;aACT;YACD,UAAU,EAAE;gBACV,OAAO,EAAE,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAK,EAAE,EAAE,CACpD,GAAG,CAAC,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;gBACjD,2EAA2E;gBAC3E,qEAAqE;gBACrE,IAAI,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;oBAC/B,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAA;oBAC5B,OAAO,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBACtC,CAAC;aACF;YACD,aAAa,EAAE;gBACb,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;aACnD;SACF,CAAA;QACD,OAAO,MAAM,CAAA;IACf,CAAC,EAAE;QACD,UAAU;QACV,YAAY;QACZ,GAAG;QACH,UAAU;QACV,SAAS;QACT,SAAS;QACT,YAAY;QACZ,KAAK;QACL,OAAO;QACP,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,iBAAiB;KAClB,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { useCallback, useMemo } from 'react'\nimport { isHierarchical } from '@elytracms/core/cms-core'\nimport type { DocumentRef, DocumentUrl } from '@elytracms/core/cms-core'\nimport { studioPath } from '@elytracms/studio/router'\nimport { resolveDeploymentFrontendUrl, resolveDeploymentRoutes } from '@elytracms/studio/lib/workspace'\nimport type {\n  CollectionViewCapabilities,\n  CollectionViewSource,\n  ResolvedAsset,\n} from '@elytracms/studio/lib/collection-view/collection-view-source'\nimport { useCms } from '../cms/cms-store'\nimport { useOptionalAssets } from '../assets/assets-store'\nimport { usePublishedDocuments } from '@elytracms/studio/lib/cms/published-documents'\nimport { resolveDocumentLiveUrl } from '../cms/use-live-url'\n\n/**\n * Assemble a {@link CollectionViewSource} for a `cmsDocuments` collection from the\n * ambient `CmsStore` + its side contexts (assets, published pool) + the\n * deployment config reads (EC-240 / AD-19). This is the CMS adapter: a\n * behaviour-preserving pass-through so the portable list + edit surfaces render\n * over the source instead of `useCms()` directly, byte-for-byte as before.\n *\n * Returns `null` for an unknown collection id (the caller renders the fallback).\n *\n * Referential stability: collection-parameterised methods are `useCallback`-bound\n * and the source object is `useMemo`-ed, so the surfaces' `useMemo` dependency\n * arrays stay stable across renders (the inline-edit order snapshot depends on it).\n */\nexport function useCmsCollectionViewSource(collectionId: string): CollectionViewSource | null {\n  const cms = useCms()\n  const assetStore = useOptionalAssets()\n  const collection = cms.getCollection(collectionId)\n  const publishedDocs = usePublishedDocuments(cms.projectId, collectionId)\n\n  // The asset collection id is resolved once from the schema (as the cell does).\n  const assetCollectionId = useMemo(\n    () => cms.collections.find((c) => c.kind === 'asset')?.id ?? 'asset',\n    [cms.collections],\n  )\n\n  // Live-URL column: the published pool × deployment routes, memoised exactly as\n  // the table did — derived from PUBLISHED snapshots, never draft rows (EC-205).\n  const isRoutable = useMemo(\n    () => resolveDeploymentRoutes().some((route) => route.document?.collection === collectionId),\n    [collectionId],\n  )\n  // EC-384: `resolveDocumentLiveUrl` merges the stored routes with the kit's\n  // fallback-home rule (same as the document editor's header affordance,\n  // `use-live-url.ts`) — otherwise a fallback-addressed home page showed no URL\n  // in this column even though the live site serves it.\n  const liveUrlMap = useMemo(() => {\n    if (!collection || !isRoutable) return null\n    const siblings = [...publishedDocs.byId.values()]\n    const map = new Map<string, DocumentUrl>()\n    for (const published of siblings) {\n      const url = resolveDocumentLiveUrl({\n        routes: resolveDeploymentRoutes(),\n        frontendUrl: resolveDeploymentFrontendUrl(),\n        localeConfig: cms.localeConfig,\n        collection,\n        doc: published,\n        siblings,\n        locale: cms.activeLocale,\n      })\n      if (url) map.set(published.id, url)\n    }\n    return map\n  }, [collection, isRoutable, publishedDocs, cms.localeConfig, cms.activeLocale])\n\n  const documents = useCallback(() => cms.documentsOf(collectionId), [cms, collectionId])\n  const viewState = useCallback(() => cms.tableStateOf(collectionId), [cms, collectionId])\n  const setViewState = useCallback(\n    (update: Parameters<CollectionViewSource['setViewState']>[0]) =>\n      cms.setTableState(collectionId, update),\n    [cms, collectionId],\n  )\n  // Named views (EC-246b): config-as-code lenses the header selector switches between.\n  const views = useMemo(\n    () => ({\n      list: () => cms.viewsOf(collectionId),\n      activeId: () => cms.activeViewId(collectionId),\n      setActive: (id: string) => cms.setActiveView(collectionId, id),\n    }),\n    [cms, collectionId],\n  )\n  const create = useCallback(() => cms.createDocument(collectionId), [cms, collectionId])\n  const imports = useMemo(\n    () => ({ importDocuments: (items: unknown[]) => cms.importDocuments(collectionId, items) }),\n    [cms, collectionId],\n  )\n  const resolveAsset = useCallback(\n    (id: string): ResolvedAsset | undefined => {\n      const record = assetStore?.assets.find((asset) => asset.id === id)\n      if (!record) return undefined\n      return {\n        ...(record.url !== undefined ? { url: record.url } : {}),\n        contentType: record.contentType,\n        ...(record.title !== undefined ? { title: record.title } : {}),\n        filename: record.filename,\n        ...(record.alt !== undefined ? { alt: record.alt } : {}),\n      }\n    },\n    [assetStore],\n  )\n  const liveUrls = useCallback(() => liveUrlMap, [liveUrlMap])\n\n  return useMemo(() => {\n    if (!collection) return null\n    const capabilities: CollectionViewCapabilities = {\n      publish: true,\n      versions: true,\n      locales: true,\n      inlineEdit: true,\n      create: true,\n      remove: true,\n      bulk: true,\n      liveUrl: isRoutable,\n      hierarchy: isHierarchical(collection),\n      importExport: true,\n    }\n    const source: CollectionViewSource = {\n      collectionId,\n      schema: collection,\n      capabilities,\n      ...(cms.projectId !== undefined ? { projectId: cms.projectId } : {}),\n      assetCollectionId,\n      localeConfig: cms.localeConfig,\n      activeLocale: cms.activeLocale,\n      documents,\n      get: cms.getDocument,\n      titleOf: cms.titleOf,\n      // References are collection-based (EC-072): resolve candidates of ANY target\n      // collection the schema declares — the workspace doc store already serves them.\n      referenceCandidates: cms.documentsOf,\n      collections: cms.collections,\n      isFieldReadOnly: cms.isFieldReadOnly,\n      validate: cms.validate,\n      resolveAsset,\n      lastError: cms.persistError,\n      clearLastError: cms.clearPersistError,\n      // Baseline + queue flush, so a pre-flight reference-index read is current.\n      flush: async () => {\n        await cms.ensurePersistedBaseline()\n        await cms.flushPersistence()\n      },\n      detailPath: (id: string) => studioPath.cmsDocument(collectionId, id),\n      listPath: studioPath.cmsCollection(collectionId),\n      viewState,\n      setViewState,\n      views,\n      imports,\n      create,\n      save: cms.saveDocument,\n      remove: cms.deleteDocument,\n      bulk: (ids, action, setField) => cms.runBulk(collectionId, ids, action, setField),\n      publishing: {\n        isPublished: cms.isPublished,\n        publish: cms.publishDocument,\n        unpublish: cms.unpublishDocument,\n        liveUrls,\n      },\n      versioning: {\n        restore: (ref: DocumentRef, version: number, scope) =>\n          cms.restoreDocumentVersion(ref, version, scope),\n        // Flush-before-read ordering folds into the loader (EC-224) so any surface\n        // that mutated the history still lists an authoritative version set.\n        load: async (ref: DocumentRef) => {\n          await cms.flushPersistence()\n          return cms.loadDocumentVersions(ref)\n        },\n      },\n      inlineEditing: {\n        commitField: (input) => cms.commitFieldEdit(input),\n      },\n    }\n    return source\n  }, [\n    collection,\n    collectionId,\n    cms,\n    isRoutable,\n    documents,\n    viewState,\n    setViewState,\n    views,\n    imports,\n    create,\n    resolveAsset,\n    liveUrls,\n    assetCollectionId,\n  ])\n}\n"]}

package/dist/lib/auth/auth-adapter.d.ts

@@ -27,6 +27,18 @@ export interface AuthUser {
 export interface AuthSession {
     readonly user: AuthUser;
 }
+/**
+ * Tri-state outcome of a proactive session probe (EC-415).
+ *
+ * - `valid` — the backend confirmed the session.
+ * - `invalid` — the backend ANSWERED and rejected/lost the session (expired or
+ *   revoked token, deleted server-side session). The adapter clears its stored
+ *   token; callers may raise the re-auth treatment.
+ * - `unreachable` — no authoritative answer (network blip, backend down).
+ *   The stored token MUST survive and callers MUST NOT treat this as
+ *   signed-out — recovery is silent once the backend returns.
+ */
+export type SessionProbeResult = 'valid' | 'invalid' | 'unreachable';
 export interface SignInCredentials {
     readonly email: string;
     readonly password: string;
@@ -76,6 +88,16 @@ export type ChangePasswordResult = {
 export interface AuthAdapter {
     /** Restore the current session, if any (page load / refresh). */
     currentSession(): Promise<AuthSession | null>;
+    /**
+     * Proactively re-check the current session (EC-415) WITHOUT the destructive
+     * catch-all of {@link currentSession} (which treats ANY failure — including a
+     * transient network drop — as signed-out and clears the stored token, so a
+     * focus/interval poll built on it would sign editors out on a network blip).
+     * The probe distinguishes the cases: only `invalid` (the backend answered and
+     * rejected/lost the session) clears the token; `unreachable` never clears it.
+     * Must never throw — an unclassifiable failure is `unreachable`.
+     */
+    probeSession(): Promise<SessionProbeResult>;
     /** Password sign-in. Resolves a structured result; never throws for bad input. */
     signIn(credentials: SignInCredentials): Promise<SignInResult>;
     /**

package/dist/lib/auth/auth-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG","sourcesContent":["/**\n * Project-owned auth boundary (EC-150, vision AD-7). The studio talks to\n * authentication ONLY through {@link AuthAdapter} — the Convex Auth\n * implementation (`convex-auth-adapter.ts`) and the deterministic local\n * implementation (`local-auth-adapter.ts`) both satisfy it, mirroring how\n * `PersistenceAdapter` keeps Convex out of the app's type graph.\n *\n * Swapping providers (e.g. Convex Auth → Clerk) means writing one new\n * implementation of this interface and teaching `selectAuthAdapter` to pick\n * it; no UI or store code changes.\n */\n\n/** The signed-in user as the studio sees it. */\nexport interface AuthUser {\n  /** Stable user id — the key `projectMembers.userId` is matched against. */\n  readonly id: string\n  readonly email: string\n  readonly name?: string\n  /**\n   * Global (workspace-level) capability flags forwarded onto the operations\n   * `Principal.roles`, e.g. `system` (internal tooling only). Per-project roles\n   * do NOT live here — they live in the members repository. Currently no\n   * browser-session flag is granted: project creation is config/CLI-owned\n   * (AD-11), so there is no `create-projects` capability.\n   */\n  readonly globalFlags?: readonly string[]\n}\n\nexport interface AuthSession {\n  readonly user: AuthUser\n}\n\nexport interface SignInCredentials {\n  readonly email: string\n  readonly password: string\n}\n\n/**\n * Structured sign-in outcome — invalid credentials are a state, not a throw.\n *\n * `deployment-misconfigured` (EC-257) is distinct from `invalid-credentials`: the\n * deployment can't sign the session JWT (missing `JWT_PRIVATE_KEY`/`JWKS`/\n * `CONVEX_SITE_URL`, or a malformed signing key), so EVERY sign-in fails regardless\n * of the password. Surfacing it as its own reason lets the sign-in screen tell the\n * truth (\"run `npx @convex-dev/auth`\") instead of the old lying \"password too short\".\n */\nexport type SignInResult =\n  | { readonly ok: true; readonly session: AuthSession }\n  | {\n      readonly ok: false\n      readonly reason:\n        | 'invalid-credentials'\n        | 'account-exists'\n        | 'deployment-misconfigured'\n        // Onboarding is invite-based (EC-324): a sign-up whose email is neither the\n        // first-user bootstrap nor on the admin's invite allowlist is rejected\n        // server-side. Distinct from `invalid-credentials` so the screen tells the\n        // truth (\"ask an admin to invite you\") instead of \"password too short\".\n        | 'not-invited'\n        | 'unavailable'\n      readonly message: string\n    }\n\n/** Self-service identity edit (EC-240 H-tail item 2) — auth-owned name/avatar. */\nexport interface UpdateProfileInput {\n  readonly name?: string\n  readonly avatar?: string\n}\n\nexport type UpdateProfileResult =\n  | { readonly ok: true; readonly session: AuthSession }\n  | {\n      readonly ok: false\n      readonly reason: 'not-authenticated' | 'unavailable' | 'unsupported'\n      readonly message: string\n    }\n\n/** Self-service password change (EC-240 H-tail item 3) — provider-delegated. */\nexport interface ChangePasswordInput {\n  readonly currentPassword: string\n  readonly newPassword: string\n}\n\nexport type ChangePasswordResult =\n  | { readonly ok: true }\n  | {\n      readonly ok: false\n      readonly reason:\n        | 'invalid-credentials'\n        | 'weak-password'\n        | 'not-authenticated'\n        | 'unavailable'\n        | 'unsupported'\n      readonly message: string\n    }\n\nexport interface AuthAdapter {\n  /** Restore the current session, if any (page load / refresh). */\n  currentSession(): Promise<AuthSession | null>\n  /** Password sign-in. Resolves a structured result; never throws for bad input. */\n  signIn(credentials: SignInCredentials): Promise<SignInResult>\n  /**\n   * Create a password account and sign in (EC-179). One project per backend, so\n   * a freshly-provisioned deployment starts with no users — the first member\n   * registers here, then is granted a role. `account-exists` is a state, not a\n   * throw.\n   */\n  signUp(credentials: SignInCredentials): Promise<SignInResult>\n  /** End the session (idempotent). */\n  signOut(): Promise<void>\n  /**\n   * Update the signed-in user's OWN identity — name / avatar (EC-240 H-tail item\n   * 2). These are AUTH-owned (the provider's `users` row), so they flow through\n   * the adapter, not the members-rail `users.save`. Self-scoped: the provider\n   * patches only the caller's record. Returns the refreshed session so the shell\n   * reflects the new name immediately.\n   */\n  updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult>\n  /**\n   * Change the signed-in user's OWN password (EC-240 H-tail item 3), gated by the\n   * current password. **Seam only:** the raw credential values are handed straight\n   * to the provider adapter — never logged, stored, or inspected by app code, and\n   * never routed through the operations layer. Self-scoped.\n   */\n  changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult>\n}\n"]}
+{"version":3,"file":"auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG","sourcesContent":["/**\n * Project-owned auth boundary (EC-150, vision AD-7). The studio talks to\n * authentication ONLY through {@link AuthAdapter} — the Convex Auth\n * implementation (`convex-auth-adapter.ts`) and the deterministic local\n * implementation (`local-auth-adapter.ts`) both satisfy it, mirroring how\n * `PersistenceAdapter` keeps Convex out of the app's type graph.\n *\n * Swapping providers (e.g. Convex Auth → Clerk) means writing one new\n * implementation of this interface and teaching `selectAuthAdapter` to pick\n * it; no UI or store code changes.\n */\n\n/** The signed-in user as the studio sees it. */\nexport interface AuthUser {\n  /** Stable user id — the key `projectMembers.userId` is matched against. */\n  readonly id: string\n  readonly email: string\n  readonly name?: string\n  /**\n   * Global (workspace-level) capability flags forwarded onto the operations\n   * `Principal.roles`, e.g. `system` (internal tooling only). Per-project roles\n   * do NOT live here — they live in the members repository. Currently no\n   * browser-session flag is granted: project creation is config/CLI-owned\n   * (AD-11), so there is no `create-projects` capability.\n   */\n  readonly globalFlags?: readonly string[]\n}\n\nexport interface AuthSession {\n  readonly user: AuthUser\n}\n\n/**\n * Tri-state outcome of a proactive session probe (EC-415).\n *\n * - `valid` — the backend confirmed the session.\n * - `invalid` — the backend ANSWERED and rejected/lost the session (expired or\n *   revoked token, deleted server-side session). The adapter clears its stored\n *   token; callers may raise the re-auth treatment.\n * - `unreachable` — no authoritative answer (network blip, backend down).\n *   The stored token MUST survive and callers MUST NOT treat this as\n *   signed-out — recovery is silent once the backend returns.\n */\nexport type SessionProbeResult = 'valid' | 'invalid' | 'unreachable'\n\nexport interface SignInCredentials {\n  readonly email: string\n  readonly password: string\n}\n\n/**\n * Structured sign-in outcome — invalid credentials are a state, not a throw.\n *\n * `deployment-misconfigured` (EC-257) is distinct from `invalid-credentials`: the\n * deployment can't sign the session JWT (missing `JWT_PRIVATE_KEY`/`JWKS`/\n * `CONVEX_SITE_URL`, or a malformed signing key), so EVERY sign-in fails regardless\n * of the password. Surfacing it as its own reason lets the sign-in screen tell the\n * truth (\"run `npx @convex-dev/auth`\") instead of the old lying \"password too short\".\n */\nexport type SignInResult =\n  | { readonly ok: true; readonly session: AuthSession }\n  | {\n      readonly ok: false\n      readonly reason:\n        | 'invalid-credentials'\n        | 'account-exists'\n        | 'deployment-misconfigured'\n        // Onboarding is invite-based (EC-324): a sign-up whose email is neither the\n        // first-user bootstrap nor on the admin's invite allowlist is rejected\n        // server-side. Distinct from `invalid-credentials` so the screen tells the\n        // truth (\"ask an admin to invite you\") instead of \"password too short\".\n        | 'not-invited'\n        | 'unavailable'\n      readonly message: string\n    }\n\n/** Self-service identity edit (EC-240 H-tail item 2) — auth-owned name/avatar. */\nexport interface UpdateProfileInput {\n  readonly name?: string\n  readonly avatar?: string\n}\n\nexport type UpdateProfileResult =\n  | { readonly ok: true; readonly session: AuthSession }\n  | {\n      readonly ok: false\n      readonly reason: 'not-authenticated' | 'unavailable' | 'unsupported'\n      readonly message: string\n    }\n\n/** Self-service password change (EC-240 H-tail item 3) — provider-delegated. */\nexport interface ChangePasswordInput {\n  readonly currentPassword: string\n  readonly newPassword: string\n}\n\nexport type ChangePasswordResult =\n  | { readonly ok: true }\n  | {\n      readonly ok: false\n      readonly reason:\n        | 'invalid-credentials'\n        | 'weak-password'\n        | 'not-authenticated'\n        | 'unavailable'\n        | 'unsupported'\n      readonly message: string\n    }\n\nexport interface AuthAdapter {\n  /** Restore the current session, if any (page load / refresh). */\n  currentSession(): Promise<AuthSession | null>\n  /**\n   * Proactively re-check the current session (EC-415) WITHOUT the destructive\n   * catch-all of {@link currentSession} (which treats ANY failure — including a\n   * transient network drop — as signed-out and clears the stored token, so a\n   * focus/interval poll built on it would sign editors out on a network blip).\n   * The probe distinguishes the cases: only `invalid` (the backend answered and\n   * rejected/lost the session) clears the token; `unreachable` never clears it.\n   * Must never throw — an unclassifiable failure is `unreachable`.\n   */\n  probeSession(): Promise<SessionProbeResult>\n  /** Password sign-in. Resolves a structured result; never throws for bad input. */\n  signIn(credentials: SignInCredentials): Promise<SignInResult>\n  /**\n   * Create a password account and sign in (EC-179). One project per backend, so\n   * a freshly-provisioned deployment starts with no users — the first member\n   * registers here, then is granted a role. `account-exists` is a state, not a\n   * throw.\n   */\n  signUp(credentials: SignInCredentials): Promise<SignInResult>\n  /** End the session (idempotent). */\n  signOut(): Promise<void>\n  /**\n   * Update the signed-in user's OWN identity — name / avatar (EC-240 H-tail item\n   * 2). These are AUTH-owned (the provider's `users` row), so they flow through\n   * the adapter, not the members-rail `users.save`. Self-scoped: the provider\n   * patches only the caller's record. Returns the refreshed session so the shell\n   * reflects the new name immediately.\n   */\n  updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult>\n  /**\n   * Change the signed-in user's OWN password (EC-240 H-tail item 3), gated by the\n   * current password. **Seam only:** the raw credential values are handed straight\n   * to the provider adapter — never logged, stored, or inspected by app code, and\n   * never routed through the operations layer. Self-scoped.\n   */\n  changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult>\n}\n"]}

package/dist/lib/auth/convex-auth-adapter.d.ts

@@ -1,5 +1,5 @@
 import type { ConvexHttpClient } from 'convex/browser';
-import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter.js';
+import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SessionProbeResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter.js';
 import type { SessionStore } from './local-auth-adapter.js';
 /**
  * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a
@@ -41,6 +41,35 @@ export declare function isDeploymentMisconfigured(message: string): boolean;
  * string (our gates) or a structured object (future gates) — both are folded in.
  */
 export declare function convexErrorClassifierText(error: unknown): string;
+/**
+ * Does this transport-error text carry Convex's POSITIVE "the token was
+ * rejected" signal? (EC-415 probe classification.)
+ *
+ * Derivation (drift-proof, from the real transport): a rejected JWT on
+ * `/api/query` makes the Convex backend answer HTTP 401 with a raw blob the
+ * installed `convex@1.42.1` `ConvexHttpClient` re-throws VERBATIM as
+ * `new Error(await response.text())` (`dist/esm/browser/http_client.js`,
+ * `queryInner`: `if (!response.ok && response.status !== STATUS_CODE_UDF_FAILED)
+ * throw new Error(await response.text())`). Two rejection codes exist, both
+ * observed against a REAL deployment:
+ *
+ * - `{"code":"Unauthenticated","message":"Could not verify OIDC token claim: …"}`
+ *   — an EXPIRED/revoked (but well-signed) session. The SAME markers
+ *   `lib/auth-errors.ts#isSessionExpiredError` pins for the reactive path
+ *   (EC-403).
+ * - `{"code":"InvalidAuthHeader","message":"Could not parse JWT payload…"}` /
+ *   `"Could not parse as OIDC ID token…"` — a malformed or unverifiable token
+ *   (captured LIVE from a convex.cloud deployment during EC-415 verification).
+ *   Equally authoritative: the backend answered and positively rejected the
+ *   credential; keeping such a token would just wedge every future probe.
+ *
+ * Deliberately narrow: an UNREACHABLE backend never produces this text — there
+ * `fetch` itself rejects (a `TypeError`: "Failed to fetch" in Chromium,
+ * "Load failed" in WebKit, "fetch failed" in Node/undici) and the client
+ * propagates that rejection unwrapped. Anything not positively matched here is
+ * treated as `unreachable`, which can never clear a valid token.
+ */
+export declare function isUnauthenticatedTransportText(text: string): boolean;
 type SignInFailure = Extract<SignInResult, {
     ok: false;
 }>;
@@ -110,6 +139,18 @@ export declare class ConvexAuthAdapter implements AuthAdapter {
     /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */
     deploymentUrl?: string);
     currentSession(): Promise<AuthSession | null>;
+    /**
+     * Tri-state session probe (EC-415). Same `users:me` round-trip as
+     * {@link currentSession}, but WITHOUT its destructive catch-all: only a
+     * POSITIVE token rejection from the backend ({@link
+     * isUnauthenticatedTransportText} over the data-first error text) — or the
+     * backend answering "no identity" (`users:me` → `null`, e.g. the server-side
+     * session row was deleted) — clears the stored token. Every other failure
+     * (fetch rejection, 5xx, unclassifiable) is `unreachable`: the token survives
+     * so a network blip can never sign an editor out. `currentSession()` keeps
+     * its existing external behavior for its callers; never throws.
+     */
+    probeSession(): Promise<SessionProbeResult>;
     signIn(credentials: SignInCredentials): Promise<SignInResult>;
     signUp(credentials: SignInCredentials): Promise<SignInResult>;
     /**

package/dist/lib/auth/convex-auth-adapter.js

@@ -87,6 +87,39 @@ export function convexErrorClassifierText(error) {
         parts.push(String(error));
     return parts.join('\n');
 }
+/**
+ * Does this transport-error text carry Convex's POSITIVE "the token was
+ * rejected" signal? (EC-415 probe classification.)
+ *
+ * Derivation (drift-proof, from the real transport): a rejected JWT on
+ * `/api/query` makes the Convex backend answer HTTP 401 with a raw blob the
+ * installed `convex@1.42.1` `ConvexHttpClient` re-throws VERBATIM as
+ * `new Error(await response.text())` (`dist/esm/browser/http_client.js`,
+ * `queryInner`: `if (!response.ok && response.status !== STATUS_CODE_UDF_FAILED)
+ * throw new Error(await response.text())`). Two rejection codes exist, both
+ * observed against a REAL deployment:
+ *
+ * - `{"code":"Unauthenticated","message":"Could not verify OIDC token claim: …"}`
+ *   — an EXPIRED/revoked (but well-signed) session. The SAME markers
+ *   `lib/auth-errors.ts#isSessionExpiredError` pins for the reactive path
+ *   (EC-403).
+ * - `{"code":"InvalidAuthHeader","message":"Could not parse JWT payload…"}` /
+ *   `"Could not parse as OIDC ID token…"` — a malformed or unverifiable token
+ *   (captured LIVE from a convex.cloud deployment during EC-415 verification).
+ *   Equally authoritative: the backend answered and positively rejected the
+ *   credential; keeping such a token would just wedge every future probe.
+ *
+ * Deliberately narrow: an UNREACHABLE backend never produces this text — there
+ * `fetch` itself rejects (a `TypeError`: "Failed to fetch" in Chromium,
+ * "Load failed" in WebKit, "fetch failed" in Node/undici) and the client
+ * propagates that rejection unwrapped. Anything not positively matched here is
+ * treated as `unreachable`, which can never clear a valid token.
+ */
+export function isUnauthenticatedTransportText(text) {
+    return (/\bUnauthenticated\b/.test(text) ||
+        /\bInvalidAuthHeader\b/.test(text) ||
+        /could not verify oidc token/i.test(text));
+}
 /**
  * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362 / EC-363).
  * Runs the regex ladder over {@link convexErrorClassifierText} output
@@ -292,6 +325,42 @@ export class ConvexAuthAdapter {
             return null;
         }
     }
+    /**
+     * Tri-state session probe (EC-415). Same `users:me` round-trip as
+     * {@link currentSession}, but WITHOUT its destructive catch-all: only a
+     * POSITIVE token rejection from the backend ({@link
+     * isUnauthenticatedTransportText} over the data-first error text) — or the
+     * backend answering "no identity" (`users:me` → `null`, e.g. the server-side
+     * session row was deleted) — clears the stored token. Every other failure
+     * (fetch rejection, 5xx, unclassifiable) is `unreachable`: the token survives
+     * so a network blip can never sign an editor out. `currentSession()` keeps
+     * its existing external behavior for its callers; never throws.
+     */
+    async probeSession() {
+        const token = this.store.getItem(this.tokenKey);
+        if (!token)
+            return 'invalid';
+        this.client.setAuth(token);
+        try {
+            const me = (await this.client.query(queryRef('users:me'), {}));
+            if (!me) {
+                // The backend answered: the token verified but no identity exists
+                // (session revoked/deleted server-side) — the session is dead.
+                this.clearToken();
+                return 'invalid';
+            }
+            return 'valid';
+        }
+        catch (error) {
+            if (isUnauthenticatedTransportText(convexErrorClassifierText(error))) {
+                this.clearToken();
+                return 'invalid';
+            }
+            // No authoritative answer — NEVER clear the token here (the EC-403
+            // finding's exact hazard: a focus poll signing editors out on a blip).
+            return 'unreachable';
+        }
+    }
     async signIn(credentials) {
         return this.authenticate('signIn', credentials);
     }

package/dist/lib/auth/convex-auth-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAa/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,+GAA+G,CAAC,IAAI,CACzH,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAA;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,YAAY,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB,EAAE,IAAY;IACzE,kFAAkF;IAClF,gFAAgF;IAChF,4EAA4E;IAC5E,gFAAgF;IAChF,mFAAmF;IACnF,qDAAqD;IACrD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EACL,oLAAoL;SACvL,CAAA;IACH,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,8FAA8F;SACjG,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,mEAAmE;SAC7E,CAAA;IACH,CAAC;IACD,yDAAyD;IACzD,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,8DAA8D;SACxE,CAAA;IACH,CAAC;IACD,kEAAkE;IAClE,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,iCAAiC;SACxC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,GAAG,IAAI,gEAAgE;KACjF,CAAA;AACH,CAAC;AAID;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,gEAAgE;IAChE,2DAA2D;IAC3D,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,0GAA0G;SAC7G,CAAA;IACH,CAAC;IACD,8EAA8E;IAC9E,6EAA6E;IAC7E,mEAAmE;IACnE,yEAAyE;IACzE,oEAAoE;IACpE,kCAAkC;IAClC,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,2DAA2D;SACrE,CAAA;IACH,CAAC;IACD,6EAA6E;IAC7E,gCAAgC;IAChC,IAAI,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,qCAAqC;SAC/C,CAAA;IACH,CAAC;IACD,sDAAsD;IACtD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,+EAA+E;KACzF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,yEAAyE;YACzE,OAAO,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,EAAE;gBAC7D,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBAC1D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,6EAA6E;YAC7E,mDAAmD;YACnD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF","sourcesContent":["import type { ConvexHttpClient } from 'convex/browser'\nimport { actionRef, mutationRef, queryRef } from '../persistence/convex-client'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nimport type { SessionStore } from './local-auth-adapter'\n\n/**\n * Convex Auth implementation of the project-owned {@link AuthAdapter}\n * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over\n * Clerk — self-contained on the Convex stack, sessions in our own tables, no\n * extra vendor; reachable only through this adapter so a swap stays local.\n *\n * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):\n * 1. `signIn` calls the `auth:signIn` action with the Password provider\n *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.\n * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every\n *    subsequent persistence query/mutation runs authenticated and the\n *    server-side `requireRole` guards see the caller.\n * 3. `currentSession` restores the JWT from storage and asks `users:me`.\n * 4. `signOut` calls `auth:signOut` and clears the JWT.\n *\n * v1 scope note: the stored JWT is short-lived and this adapter does not yet\n * run the refresh-token loop (the official `@convex-dev/auth/react` client\n * does); an expired session simply resolves to \"signed out\" and the user signs\n * in again. Live-deployment hardening is EC-156. No live deployment exists in\n * this repo — this file is typecheck-verified and exercised against the local\n * adapter's shared interface.\n */\n\nconst TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt'\n\n/**\n * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a\n * credential problem (EC-257). Matches the Convex Auth signing-path throws:\n * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ \"Missing environment\n * variable …\") and `importPKCS8` on a malformed key — plus the EC-363 server code\n * `deployment-misconfigured` (`defineStudioAuth` wraps those library throws in a\n * `ConvexError` whose `.data` survives prod redaction, so this classifies on\n * PRODUCTION deployments too once their functions are redeployed). Deliberately\n * narrow — a genuine wrong-password error carries none of these tokens — and checked\n * BEFORE the credential regex so it always wins. On a prod deployment whose\n * functions PREDATE EC-363 the plain-`Error` message is redacted to \"Server Error\",\n * which this can't match; there the honest fallback is the neutral \"unavailable\"\n * branch (never \"password too short\").\n */\nexport function isDeploymentMisconfigured(message: string): boolean {\n  return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key|deployment-misconfigured/i.test(\n    message,\n  )\n}\n\n/**\n * Reduce a thrown Convex error to the text used for classification (EC-362).\n *\n * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex\n * deployment REDACTS a UDF's thrown-error `.message` to a generic\n * `\"[Request ID: …] Server Error\"`, but a `ConvexError`'s `.data` payload\n * survives to the client. Proven in the installed `convex@1.42.1` browser\n * client: on an `\"error\"` response `ConvexHttpClient.action` throws\n * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,\n * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`\n * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps\n * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the\n * only classifiable text that survives prod is the `.data` of a `ConvexError` —\n * our invite gate's `ConvexError(NOT_INVITED_REASON)` and, since EC-363, the\n * coded `ConvexError({ code })` that `defineStudioAuth` wraps around the\n * library's credential/env throws. On DEV deployments nothing is redacted, so\n * `.message` also carries the token (the regex ladder still matches);\n * non-Convex errors only have a `.message`.\n *\n * Duck-types the `data` property rather than `instanceof ConvexError`: two\n * copies of the `convex` module can coexist under Vite (transformed vs\n * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a\n * string (our gates) or a structured object (future gates) — both are folded in.\n */\nexport function convexErrorClassifierText(error: unknown): string {\n  const parts: string[] = []\n  if (typeof error === 'object' && error !== null && 'data' in error) {\n    const data = (error as { data: unknown }).data\n    if (typeof data === 'string') {\n      parts.push(data)\n    } else if (data !== null && data !== undefined) {\n      try {\n        parts.push(JSON.stringify(data))\n      } catch {\n        // Non-serializable data (cycles) — ignore; fall back to the message.\n      }\n    }\n  }\n  if (error instanceof Error) parts.push(error.message)\n  else if (typeof error === 'string') parts.push(error)\n  if (parts.length === 0) parts.push(String(error))\n  return parts.join('\\n')\n}\n\ntype SignInFailure = Extract<SignInResult, { ok: false }>\n\n/**\n * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362 / EC-363).\n * Runs the regex ladder over {@link convexErrorClassifierText} output\n * (data-first).\n *\n * EC-363: `defineStudioAuth` now wraps `@convex-dev/auth`'s plain-`Error`\n * credential/env throws server-side in a `ConvexError` carrying a stable code\n * in `.data` (`{\"code\":\"invalid-credentials\" | \"too-many-attempts\" |\n * \"account-exists\" | \"deployment-misconfigured\"}`). The data-first text folds\n * that JSON in, so the SAME ladder classifies the codes (they survive prod\n * redaction) AND the raw dev-shape messages — a deployment whose functions\n * predate EC-363 still classifies exactly as before (dev: full message; prod:\n * the honest generic below).\n *\n * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited\n * sign-up (EC-324) are each checked BEFORE the credential regex so neither\n * degrades to the lying \"password too short\". The final fallback is HONEST\n * (\"unexpected server error — check the deployment logs\"), never \"unavailable\":\n * unknown errors — and any plain `Error` a pre-EC-363 prod deployment redacts\n * to `\"Server Error\"` with no `.data` — legitimately land here.\n */\nexport function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure {\n  // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be\n  // classified FIRST so it never falls through to the lying \"password too short\".\n  // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`\n  // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth` never\n  // run) the `requireEnv`/`importPKCS8` call throws AFTER the password is validated,\n  // so EVERY sign-in fails regardless of the password.\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'deployment-misconfigured',\n      message:\n        'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',\n    }\n  }\n  // EC-324: an uninvited sign-up is rejected server-side (`gateAccountCreation`/\n  // `gateSessionCreation` throw `ConvexError(NOT_INVITED_REASON)`, whose `.data`\n  // survives to the client even in production). Checked BEFORE the credential regex.\n  if (/not-invited|invite-only|invite only/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'not-invited',\n      message:\n        'This deployment is invite-only. Ask an admin to invite your email, then create your account.',\n    }\n  }\n  // EC-363: the sign-in rate limit. New deployments code it server-side\n  // (`{\"code\":\"too-many-attempts\"}` survives prod redaction); dev/old\n  // deployments surface the library's plain `TooManyFailedAttempts`. Checked\n  // BEFORE the credential regex; truthful wait-and-retry copy on the existing\n  // `unavailable` reason (a throttled deployment \"can't sign you in right\n  // now\" — the adapter contract gains no new reason for a transient state).\n  if (/too-many-attempts|TooManyFailedAttempts/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message: 'Too many failed sign-in attempts — wait a moment, then try again.',\n    }\n  }\n  // The EC-363 code `account-exists` matches via `exists`.\n  if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'account-exists',\n      message: 'An account with this email already exists — sign in instead.',\n    }\n  }\n  // The EC-363 code `invalid-credentials` matches via `credential`.\n  if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message:\n        flow === 'signUp'\n          ? 'That email or password can’t be used (password too short?).'\n          : 'Email or password is incorrect.',\n    }\n  }\n  const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in'\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: `${verb} failed (unexpected server error) — check the deployment logs.`,\n  }\n}\n\ntype ChangePasswordFailure = Extract<ChangePasswordResult, { ok: false }>\n\n/**\n * Pure password-change error classifier (EC-240 H-tail / EC-362 / EC-377). Same\n * data-first text + honest fallback discipline as {@link classifySignInError};\n * `deployment-misconfigured` collapses onto the `unavailable` reason\n * (`ChangePasswordResult` has no dedicated reason for it) with a specific\n * remediation message.\n *\n * EC-377: `users:changePassword` now codes its provider throws server-side with\n * the EC-363 `toCodedSignInError` wrap (`{\"code\":\"invalid-credentials\" |\n * \"too-many-attempts\" | \"deployment-misconfigured\"}`) plus a coded\n * `weak-password` min-length guard — the data-first text folds those in, so the\n * SAME ladder classifies the codes (they survive prod redaction) AND the raw\n * dev-shape messages. A deployment whose functions predate EC-377 classifies\n * exactly as before (dev: full message; prod: the honest generic below).\n */\nexport function classifyChangePasswordError(text: string): ChangePasswordFailure {\n  // The EC-363/EC-377 code `deployment-misconfigured` matches via\n  // `isDeploymentMisconfigured` (it carries the code token).\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message:\n        'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',\n    }\n  }\n  // EC-377: `retrieveAccount` rate-limits failed CURRENT-password attempts like\n  // sign-ins. New deployments code it (`{\"code\":\"too-many-attempts\"}` survives\n  // prod redaction); dev/old deployments surface the library's plain\n  // `TooManyFailedAttempts`. Checked BEFORE the credential regex; truthful\n  // wait-and-retry copy on the existing `unavailable` reason (mirrors\n  // `classifySignInError`, EC-363).\n  if (/too-many-attempts|TooManyFailedAttempts/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message: 'Too many failed attempts — wait a moment, then try again.',\n    }\n  }\n  // `invalid-credentials` is the EC-377 code token; the rest is the pre-EC-377\n  // dev-message ladder, verbatim.\n  if (/invalid-credentials|InvalidSecret|InvalidAccountId|current password|incorrect/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message: 'Your current password is incorrect.',\n    }\n  }\n  // The EC-377 code `weak-password` matches via `weak`.\n  if (/at least|too short|8 characters|password requirement|weak/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'weak-password',\n      message: 'Choose a stronger password (at least 8 characters).',\n    }\n  }\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: 'Password change failed (unexpected server error) — check the deployment logs.',\n  }\n}\n\n/**\n * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a\n * session is scoped to its deployment: signing into Aurora's backend must not\n * carry a JWT to Northwind's. Keying the stored token by the deployment URL\n * makes each backend's session independent — switching to a project on a\n * not-yet-authenticated backend reads no token and the guard asks for sign-in.\n * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid\n * on every deployment, collapsing this back to a single session.)\n */\nexport function tokenStorageKey(deploymentUrl?: string): string {\n  return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX\n}\n\n/**\n * Best-effort \"is there a session for this deployment?\" — a synchronous token\n * presence check used to label per-backend projects in the switcher/launcher\n * (EC-179). It does not validate the token (an expired one still redirects to\n * sign-in on entry); it just answers \"has the user signed into this backend?\".\n */\nexport function hasStoredConvexSession(\n  deploymentUrl: string,\n  store: SessionStore = defaultStore(),\n): boolean {\n  return store.getItem(tokenStorageKey(deploymentUrl)) !== null\n}\n\ninterface SignInActionResult {\n  tokens?: { token: string; refreshToken: string } | null\n}\n\ninterface MeResult {\n  id: string\n  email: string\n  name?: string\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class ConvexAuthAdapter implements AuthAdapter {\n  private readonly tokenKey: string\n\n  constructor(\n    private readonly client: ConvexHttpClient,\n    private readonly store: SessionStore = defaultStore(),\n    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */\n    deploymentUrl?: string,\n  ) {\n    this.tokenKey = tokenStorageKey(deploymentUrl)\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return null\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        this.clearToken()\n        return null\n      }\n      return { user: this.toUser(me) }\n    } catch {\n      // Expired/invalid JWT or unreachable backend → treat as signed out.\n      this.clearToken()\n      return null\n    }\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signIn', credentials)\n  }\n\n  async signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signUp', credentials)\n  }\n\n  /**\n   * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by\n   * the Convex Auth `flow` param; both return a token + load `users:me`.\n   */\n  private async authenticate(\n    flow: 'signIn' | 'signUp',\n    credentials: SignInCredentials,\n  ): Promise<SignInResult> {\n    let result: SignInActionResult\n    try {\n      result = (await this.client.action(actionRef('auth:signIn'), {\n        provider: 'password',\n        params: {\n          email: credentials.email.trim().toLowerCase(),\n          password: credentials.password,\n          flow,\n        },\n      })) as SignInActionResult\n    } catch (error) {\n      // Convex Auth surfaces credential/registration problems as thrown errors.\n      // Classify from the DATA-FIRST text (a `ConvexError`'s `.data` survives prod\n      // redaction, the redacted `.message` does not — EC-362), then apply the pure\n      // regex ladder. See `convexErrorClassifierText` / `classifySignInError`.\n      return classifySignInError(flow, convexErrorClassifierText(error))\n    }\n    if (!result.tokens) {\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(this.tokenKey, result.tokens.token)\n    this.client.setAuth(result.tokens.token)\n    const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n    if (!me) {\n      this.clearToken()\n      return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' }\n    }\n    return { ok: true, session: { user: this.toUser(me) } }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      await this.client.action(actionRef('auth:signOut'), {})\n    } catch {\n      // Already signed out / unreachable — clearing local state is what matters.\n    }\n    this.clearToken()\n  }\n\n  /**\n   * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN\n   * auth `users` row (name / avatar) via the self-scoped `users:updateProfile`\n   * mutation, then re-reads `users:me` so the returned session carries the new\n   * name. Auth-owned fields never flow through the members-rail `users.save`.\n   */\n  async updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.mutation(mutationRef('users:updateProfile'), {\n        ...(input.name !== undefined ? { name: input.name } : {}),\n        ...(input.avatar !== undefined ? { avatar: input.avatar } : {}),\n      })\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n      }\n      return { ok: true, session: { user: this.toUser(me) } }\n    } catch {\n      return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n    }\n  }\n\n  /**\n   * Self-service password change (EC-240 H-tail item 3). Delegates entirely to\n   * the provider via the self-scoped `users:changePassword` ACTION (which calls\n   * Convex Auth's `retrieveAccount` to verify the current password, then\n   * `modifyAccountCredentials` to set the new one). **Seam only:** the raw\n   * password values are forwarded to the provider and NEVER logged or inspected\n   * here.\n   */\n  async changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.action(actionRef('users:changePassword'), {\n        currentPassword: input.currentPassword,\n        newPassword: input.newPassword,\n      })\n      return { ok: true }\n    } catch (error) {\n      // Data-first classification (EC-362): the change-password ACTION runs on the\n      // same deployment, so a prod redaction erases the thrown `.message` the same\n      // way — read a surviving `ConvexError.data` first.\n      return classifyChangePasswordError(convexErrorClassifierText(error))\n    }\n  }\n\n  private toUser(me: MeResult): AuthSession['user'] {\n    return {\n      id: me.id,\n      email: me.email,\n      ...(me.name ? { name: me.name } : {}),\n      // No global flags: project creation is config/CLI-owned (AD-11), so there\n      // is no in-studio `create-projects` capability. Per-project roles come\n      // from `projectMembers`.\n      globalFlags: [],\n    }\n  }\n\n  private clearToken(): void {\n    this.store.removeItem(this.tokenKey)\n    this.client.clearAuth()\n  }\n}\n"]}
+{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAc/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,+GAA+G,CAAC,IAAI,CACzH,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAA;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,YAAY,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,OAAO,CACL,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAA;AACH,CAAC;AAID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB,EAAE,IAAY;IACzE,kFAAkF;IAClF,gFAAgF;IAChF,4EAA4E;IAC5E,gFAAgF;IAChF,mFAAmF;IACnF,qDAAqD;IACrD,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EACL,oLAAoL;SACvL,CAAA;IACH,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,8FAA8F;SACjG,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,mEAAmE;SAC7E,CAAA;IACH,CAAC;IACD,yDAAyD;IACzD,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,8DAA8D;SACxE,CAAA;IACH,CAAC;IACD,kEAAkE;IAClE,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,iCAAiC;SACxC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,GAAG,IAAI,gEAAgE;KACjF,CAAA;AACH,CAAC;AAID;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,gEAAgE;IAChE,2DAA2D;IAC3D,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,0GAA0G;SAC7G,CAAA;IACH,CAAC;IACD,8EAA8E;IAC9E,6EAA6E;IAC7E,mEAAmE;IACnE,yEAAyE;IACzE,oEAAoE;IACpE,kCAAkC;IAClC,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,2DAA2D;SACrE,CAAA;IACH,CAAC;IACD,6EAA6E;IAC7E,gCAAgC;IAChC,IAAI,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,qCAAqC;SAC/C,CAAA;IACH,CAAC;IACD,sDAAsD;IACtD,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,+EAA+E;KACzF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,kEAAkE;gBAClE,+DAA+D;gBAC/D,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,8BAA8B,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,mEAAmE;YACnE,uEAAuE;YACvE,OAAO,aAAa,CAAA;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,6EAA6E;YAC7E,6EAA6E;YAC7E,yEAAyE;YACzE,OAAO,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,EAAE;gBAC7D,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;QAClG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE;gBAC1D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,6EAA6E;YAC7E,mDAAmD;YACnD,OAAO,2BAA2B,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF","sourcesContent":["import type { ConvexHttpClient } from 'convex/browser'\nimport { actionRef, mutationRef, queryRef } from '../persistence/convex-client'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SessionProbeResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nimport type { SessionStore } from './local-auth-adapter'\n\n/**\n * Convex Auth implementation of the project-owned {@link AuthAdapter}\n * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over\n * Clerk — self-contained on the Convex stack, sessions in our own tables, no\n * extra vendor; reachable only through this adapter so a swap stays local.\n *\n * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):\n * 1. `signIn` calls the `auth:signIn` action with the Password provider\n *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.\n * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every\n *    subsequent persistence query/mutation runs authenticated and the\n *    server-side `requireRole` guards see the caller.\n * 3. `currentSession` restores the JWT from storage and asks `users:me`.\n * 4. `signOut` calls `auth:signOut` and clears the JWT.\n *\n * v1 scope note: the stored JWT is short-lived and this adapter does not yet\n * run the refresh-token loop (the official `@convex-dev/auth/react` client\n * does); an expired session simply resolves to \"signed out\" and the user signs\n * in again. Live-deployment hardening is EC-156. No live deployment exists in\n * this repo — this file is typecheck-verified and exercised against the local\n * adapter's shared interface.\n */\n\nconst TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt'\n\n/**\n * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a\n * credential problem (EC-257). Matches the Convex Auth signing-path throws:\n * `requireEnv('JWT_PRIVATE_KEY'|'JWKS'|'CONVEX_SITE_URL')` (→ \"Missing environment\n * variable …\") and `importPKCS8` on a malformed key — plus the EC-363 server code\n * `deployment-misconfigured` (`defineStudioAuth` wraps those library throws in a\n * `ConvexError` whose `.data` survives prod redaction, so this classifies on\n * PRODUCTION deployments too once their functions are redeployed). Deliberately\n * narrow — a genuine wrong-password error carries none of these tokens — and checked\n * BEFORE the credential regex so it always wins. On a prod deployment whose\n * functions PREDATE EC-363 the plain-`Error` message is redacted to \"Server Error\",\n * which this can't match; there the honest fallback is the neutral \"unavailable\"\n * branch (never \"password too short\").\n */\nexport function isDeploymentMisconfigured(message: string): boolean {\n  return /JWT_PRIVATE_KEY|JWKS|CONVEX_SITE_URL|Missing environment variable|PKCS8|private key|deployment-misconfigured/i.test(\n    message,\n  )\n}\n\n/**\n * Reduce a thrown Convex error to the text used for classification (EC-362).\n *\n * **Read `.data` FIRST, then `.message`** — because a PRODUCTION Convex\n * deployment REDACTS a UDF's thrown-error `.message` to a generic\n * `\"[Request ID: …] Server Error\"`, but a `ConvexError`'s `.data` payload\n * survives to the client. Proven in the installed `convex@1.42.1` browser\n * client: on an `\"error\"` response `ConvexHttpClient.action` throws\n * `forwardErrorData(respJSON.errorData, new ConvexError(respJSON.errorMessage))`,\n * and `forwardErrorData` sets `error.data = jsonToConvex(errorData)`\n * (`dist/esm/browser/http_client.js`, ~L388-396 + L459-461). The server keeps\n * `errorData` for a `ConvexError` in prod while redacting `errorMessage`. So the\n * only classifiable text that survives prod is the `.data` of a `ConvexError` —\n * our invite gate's `ConvexError(NOT_INVITED_REASON)` and, since EC-363, the\n * coded `ConvexError({ code })` that `defineStudioAuth` wraps around the\n * library's credential/env throws. On DEV deployments nothing is redacted, so\n * `.message` also carries the token (the regex ladder still matches);\n * non-Convex errors only have a `.message`.\n *\n * Duck-types the `data` property rather than `instanceof ConvexError`: two\n * copies of the `convex` module can coexist under Vite (transformed vs\n * pre-bundled), so `instanceof` can spuriously fail (EC-357). `.data` may be a\n * string (our gates) or a structured object (future gates) — both are folded in.\n */\nexport function convexErrorClassifierText(error: unknown): string {\n  const parts: string[] = []\n  if (typeof error === 'object' && error !== null && 'data' in error) {\n    const data = (error as { data: unknown }).data\n    if (typeof data === 'string') {\n      parts.push(data)\n    } else if (data !== null && data !== undefined) {\n      try {\n        parts.push(JSON.stringify(data))\n      } catch {\n        // Non-serializable data (cycles) — ignore; fall back to the message.\n      }\n    }\n  }\n  if (error instanceof Error) parts.push(error.message)\n  else if (typeof error === 'string') parts.push(error)\n  if (parts.length === 0) parts.push(String(error))\n  return parts.join('\\n')\n}\n\n/**\n * Does this transport-error text carry Convex's POSITIVE \"the token was\n * rejected\" signal? (EC-415 probe classification.)\n *\n * Derivation (drift-proof, from the real transport): a rejected JWT on\n * `/api/query` makes the Convex backend answer HTTP 401 with a raw blob the\n * installed `convex@1.42.1` `ConvexHttpClient` re-throws VERBATIM as\n * `new Error(await response.text())` (`dist/esm/browser/http_client.js`,\n * `queryInner`: `if (!response.ok && response.status !== STATUS_CODE_UDF_FAILED)\n * throw new Error(await response.text())`). Two rejection codes exist, both\n * observed against a REAL deployment:\n *\n * - `{\"code\":\"Unauthenticated\",\"message\":\"Could not verify OIDC token claim: …\"}`\n *   — an EXPIRED/revoked (but well-signed) session. The SAME markers\n *   `lib/auth-errors.ts#isSessionExpiredError` pins for the reactive path\n *   (EC-403).\n * - `{\"code\":\"InvalidAuthHeader\",\"message\":\"Could not parse JWT payload…\"}` /\n *   `\"Could not parse as OIDC ID token…\"` — a malformed or unverifiable token\n *   (captured LIVE from a convex.cloud deployment during EC-415 verification).\n *   Equally authoritative: the backend answered and positively rejected the\n *   credential; keeping such a token would just wedge every future probe.\n *\n * Deliberately narrow: an UNREACHABLE backend never produces this text — there\n * `fetch` itself rejects (a `TypeError`: \"Failed to fetch\" in Chromium,\n * \"Load failed\" in WebKit, \"fetch failed\" in Node/undici) and the client\n * propagates that rejection unwrapped. Anything not positively matched here is\n * treated as `unreachable`, which can never clear a valid token.\n */\nexport function isUnauthenticatedTransportText(text: string): boolean {\n  return (\n    /\\bUnauthenticated\\b/.test(text) ||\n    /\\bInvalidAuthHeader\\b/.test(text) ||\n    /could not verify oidc token/i.test(text)\n  )\n}\n\ntype SignInFailure = Extract<SignInResult, { ok: false }>\n\n/**\n * Pure sign-in/sign-up error classifier (EC-257 / EC-324 / EC-362 / EC-363).\n * Runs the regex ladder over {@link convexErrorClassifierText} output\n * (data-first).\n *\n * EC-363: `defineStudioAuth` now wraps `@convex-dev/auth`'s plain-`Error`\n * credential/env throws server-side in a `ConvexError` carrying a stable code\n * in `.data` (`{\"code\":\"invalid-credentials\" | \"too-many-attempts\" |\n * \"account-exists\" | \"deployment-misconfigured\"}`). The data-first text folds\n * that JSON in, so the SAME ladder classifies the codes (they survive prod\n * redaction) AND the raw dev-shape messages — a deployment whose functions\n * predate EC-363 still classifies exactly as before (dev: full message; prod:\n * the honest generic below).\n *\n * Order matters: a DEPLOYMENT-misconfiguration (EC-257) and an uninvited\n * sign-up (EC-324) are each checked BEFORE the credential regex so neither\n * degrades to the lying \"password too short\". The final fallback is HONEST\n * (\"unexpected server error — check the deployment logs\"), never \"unavailable\":\n * unknown errors — and any plain `Error` a pre-EC-363 prod deployment redacts\n * to `\"Server Error\"` with no `.data` — legitimately land here.\n */\nexport function classifySignInError(flow: 'signIn' | 'signUp', text: string): SignInFailure {\n  // EC-257: a DEPLOYMENT-misconfiguration — its auth signing key is unset — must be\n  // classified FIRST so it never falls through to the lying \"password too short\".\n  // Convex Auth signs the session JWT with the deployment's `JWT_PRIVATE_KEY`\n  // (+ `JWKS`/`CONVEX_SITE_URL`); when any is unset (`npx @convex-dev/auth` never\n  // run) the `requireEnv`/`importPKCS8` call throws AFTER the password is validated,\n  // so EVERY sign-in fails regardless of the password.\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'deployment-misconfigured',\n      message:\n        'This deployment can’t sign you in: its auth signing key is not set. Run `npx @convex-dev/auth` against this deployment, then retry. (The deployment-setup check reports the same.)',\n    }\n  }\n  // EC-324: an uninvited sign-up is rejected server-side (`gateAccountCreation`/\n  // `gateSessionCreation` throw `ConvexError(NOT_INVITED_REASON)`, whose `.data`\n  // survives to the client even in production). Checked BEFORE the credential regex.\n  if (/not-invited|invite-only|invite only/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'not-invited',\n      message:\n        'This deployment is invite-only. Ask an admin to invite your email, then create your account.',\n    }\n  }\n  // EC-363: the sign-in rate limit. New deployments code it server-side\n  // (`{\"code\":\"too-many-attempts\"}` survives prod redaction); dev/old\n  // deployments surface the library's plain `TooManyFailedAttempts`. Checked\n  // BEFORE the credential regex; truthful wait-and-retry copy on the existing\n  // `unavailable` reason (a throttled deployment \"can't sign you in right\n  // now\" — the adapter contract gains no new reason for a transient state).\n  if (/too-many-attempts|TooManyFailedAttempts/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message: 'Too many failed sign-in attempts — wait a moment, then try again.',\n    }\n  }\n  // The EC-363 code `account-exists` matches via `exists`.\n  if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'account-exists',\n      message: 'An account with this email already exists — sign in instead.',\n    }\n  }\n  // The EC-363 code `invalid-credentials` matches via `credential`.\n  if (/InvalidSecret|InvalidAccountId|credential|password/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message:\n        flow === 'signUp'\n          ? 'That email or password can’t be used (password too short?).'\n          : 'Email or password is incorrect.',\n    }\n  }\n  const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in'\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: `${verb} failed (unexpected server error) — check the deployment logs.`,\n  }\n}\n\ntype ChangePasswordFailure = Extract<ChangePasswordResult, { ok: false }>\n\n/**\n * Pure password-change error classifier (EC-240 H-tail / EC-362 / EC-377). Same\n * data-first text + honest fallback discipline as {@link classifySignInError};\n * `deployment-misconfigured` collapses onto the `unavailable` reason\n * (`ChangePasswordResult` has no dedicated reason for it) with a specific\n * remediation message.\n *\n * EC-377: `users:changePassword` now codes its provider throws server-side with\n * the EC-363 `toCodedSignInError` wrap (`{\"code\":\"invalid-credentials\" |\n * \"too-many-attempts\" | \"deployment-misconfigured\"}`) plus a coded\n * `weak-password` min-length guard — the data-first text folds those in, so the\n * SAME ladder classifies the codes (they survive prod redaction) AND the raw\n * dev-shape messages. A deployment whose functions predate EC-377 classifies\n * exactly as before (dev: full message; prod: the honest generic below).\n */\nexport function classifyChangePasswordError(text: string): ChangePasswordFailure {\n  // The EC-363/EC-377 code `deployment-misconfigured` matches via\n  // `isDeploymentMisconfigured` (it carries the code token).\n  if (isDeploymentMisconfigured(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message:\n        'This deployment can’t change your password: its auth signing key is not set. Run `npx @convex-dev/auth`.',\n    }\n  }\n  // EC-377: `retrieveAccount` rate-limits failed CURRENT-password attempts like\n  // sign-ins. New deployments code it (`{\"code\":\"too-many-attempts\"}` survives\n  // prod redaction); dev/old deployments surface the library's plain\n  // `TooManyFailedAttempts`. Checked BEFORE the credential regex; truthful\n  // wait-and-retry copy on the existing `unavailable` reason (mirrors\n  // `classifySignInError`, EC-363).\n  if (/too-many-attempts|TooManyFailedAttempts/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message: 'Too many failed attempts — wait a moment, then try again.',\n    }\n  }\n  // `invalid-credentials` is the EC-377 code token; the rest is the pre-EC-377\n  // dev-message ladder, verbatim.\n  if (/invalid-credentials|InvalidSecret|InvalidAccountId|current password|incorrect/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'invalid-credentials',\n      message: 'Your current password is incorrect.',\n    }\n  }\n  // The EC-377 code `weak-password` matches via `weak`.\n  if (/at least|too short|8 characters|password requirement|weak/i.test(text)) {\n    return {\n      ok: false,\n      reason: 'weak-password',\n      message: 'Choose a stronger password (at least 8 characters).',\n    }\n  }\n  return {\n    ok: false,\n    reason: 'unavailable',\n    message: 'Password change failed (unexpected server error) — check the deployment logs.',\n  }\n}\n\n/**\n * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a\n * session is scoped to its deployment: signing into Aurora's backend must not\n * carry a JWT to Northwind's. Keying the stored token by the deployment URL\n * makes each backend's session independent — switching to a project on a\n * not-yet-authenticated backend reads no token and the guard asks for sign-in.\n * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid\n * on every deployment, collapsing this back to a single session.)\n */\nexport function tokenStorageKey(deploymentUrl?: string): string {\n  return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX\n}\n\n/**\n * Best-effort \"is there a session for this deployment?\" — a synchronous token\n * presence check used to label per-backend projects in the switcher/launcher\n * (EC-179). It does not validate the token (an expired one still redirects to\n * sign-in on entry); it just answers \"has the user signed into this backend?\".\n */\nexport function hasStoredConvexSession(\n  deploymentUrl: string,\n  store: SessionStore = defaultStore(),\n): boolean {\n  return store.getItem(tokenStorageKey(deploymentUrl)) !== null\n}\n\ninterface SignInActionResult {\n  tokens?: { token: string; refreshToken: string } | null\n}\n\ninterface MeResult {\n  id: string\n  email: string\n  name?: string\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class ConvexAuthAdapter implements AuthAdapter {\n  private readonly tokenKey: string\n\n  constructor(\n    private readonly client: ConvexHttpClient,\n    private readonly store: SessionStore = defaultStore(),\n    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */\n    deploymentUrl?: string,\n  ) {\n    this.tokenKey = tokenStorageKey(deploymentUrl)\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return null\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        this.clearToken()\n        return null\n      }\n      return { user: this.toUser(me) }\n    } catch {\n      // Expired/invalid JWT or unreachable backend → treat as signed out.\n      this.clearToken()\n      return null\n    }\n  }\n\n  /**\n   * Tri-state session probe (EC-415). Same `users:me` round-trip as\n   * {@link currentSession}, but WITHOUT its destructive catch-all: only a\n   * POSITIVE token rejection from the backend ({@link\n   * isUnauthenticatedTransportText} over the data-first error text) — or the\n   * backend answering \"no identity\" (`users:me` → `null`, e.g. the server-side\n   * session row was deleted) — clears the stored token. Every other failure\n   * (fetch rejection, 5xx, unclassifiable) is `unreachable`: the token survives\n   * so a network blip can never sign an editor out. `currentSession()` keeps\n   * its existing external behavior for its callers; never throws.\n   */\n  async probeSession(): Promise<SessionProbeResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) return 'invalid'\n    this.client.setAuth(token)\n    try {\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        // The backend answered: the token verified but no identity exists\n        // (session revoked/deleted server-side) — the session is dead.\n        this.clearToken()\n        return 'invalid'\n      }\n      return 'valid'\n    } catch (error) {\n      if (isUnauthenticatedTransportText(convexErrorClassifierText(error))) {\n        this.clearToken()\n        return 'invalid'\n      }\n      // No authoritative answer — NEVER clear the token here (the EC-403\n      // finding's exact hazard: a focus poll signing editors out on a blip).\n      return 'unreachable'\n    }\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signIn', credentials)\n  }\n\n  async signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.authenticate('signUp', credentials)\n  }\n\n  /**\n   * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by\n   * the Convex Auth `flow` param; both return a token + load `users:me`.\n   */\n  private async authenticate(\n    flow: 'signIn' | 'signUp',\n    credentials: SignInCredentials,\n  ): Promise<SignInResult> {\n    let result: SignInActionResult\n    try {\n      result = (await this.client.action(actionRef('auth:signIn'), {\n        provider: 'password',\n        params: {\n          email: credentials.email.trim().toLowerCase(),\n          password: credentials.password,\n          flow,\n        },\n      })) as SignInActionResult\n    } catch (error) {\n      // Convex Auth surfaces credential/registration problems as thrown errors.\n      // Classify from the DATA-FIRST text (a `ConvexError`'s `.data` survives prod\n      // redaction, the redacted `.message` does not — EC-362), then apply the pure\n      // regex ladder. See `convexErrorClassifierText` / `classifySignInError`.\n      return classifySignInError(flow, convexErrorClassifierText(error))\n    }\n    if (!result.tokens) {\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(this.tokenKey, result.tokens.token)\n    this.client.setAuth(result.tokens.token)\n    const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n    if (!me) {\n      this.clearToken()\n      return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' }\n    }\n    return { ok: true, session: { user: this.toUser(me) } }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      await this.client.action(actionRef('auth:signOut'), {})\n    } catch {\n      // Already signed out / unreachable — clearing local state is what matters.\n    }\n    this.clearToken()\n  }\n\n  /**\n   * Self-service identity edit (EC-240 H-tail item 2). Patches the caller's OWN\n   * auth `users` row (name / avatar) via the self-scoped `users:updateProfile`\n   * mutation, then re-reads `users:me` so the returned session carries the new\n   * name. Auth-owned fields never flow through the members-rail `users.save`.\n   */\n  async updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.mutation(mutationRef('users:updateProfile'), {\n        ...(input.name !== undefined ? { name: input.name } : {}),\n        ...(input.avatar !== undefined ? { avatar: input.avatar } : {}),\n      })\n      const me = (await this.client.query(queryRef('users:me'), {})) as MeResult | null\n      if (!me) {\n        return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n      }\n      return { ok: true, session: { user: this.toUser(me) } }\n    } catch {\n      return { ok: false, reason: 'unavailable', message: 'Profile update is currently unavailable.' }\n    }\n  }\n\n  /**\n   * Self-service password change (EC-240 H-tail item 3). Delegates entirely to\n   * the provider via the self-scoped `users:changePassword` ACTION (which calls\n   * Convex Auth's `retrieveAccount` to verify the current password, then\n   * `modifyAccountCredentials` to set the new one). **Seam only:** the raw\n   * password values are forwarded to the provider and NEVER logged or inspected\n   * here.\n   */\n  async changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    const token = this.store.getItem(this.tokenKey)\n    if (!token) {\n      return { ok: false, reason: 'not-authenticated', message: 'You are not signed in.' }\n    }\n    this.client.setAuth(token)\n    try {\n      await this.client.action(actionRef('users:changePassword'), {\n        currentPassword: input.currentPassword,\n        newPassword: input.newPassword,\n      })\n      return { ok: true }\n    } catch (error) {\n      // Data-first classification (EC-362): the change-password ACTION runs on the\n      // same deployment, so a prod redaction erases the thrown `.message` the same\n      // way — read a surviving `ConvexError.data` first.\n      return classifyChangePasswordError(convexErrorClassifierText(error))\n    }\n  }\n\n  private toUser(me: MeResult): AuthSession['user'] {\n    return {\n      id: me.id,\n      email: me.email,\n      ...(me.name ? { name: me.name } : {}),\n      // No global flags: project creation is config/CLI-owned (AD-11), so there\n      // is no in-studio `create-projects` capability. Per-project roles come\n      // from `projectMembers`.\n      globalFlags: [],\n    }\n  }\n\n  private clearToken(): void {\n    this.store.removeItem(this.tokenKey)\n    this.client.clearAuth()\n  }\n}\n"]}

package/dist/lib/auth/dev-auto-login-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter.js';
+import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SessionProbeResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter.js';
 /**
  * Dev-only unattended-auth decorator (testing de-friction). Wraps any
  * {@link AuthAdapter}: when no session can be restored, it transparently signs
@@ -19,6 +19,7 @@ export declare class DevAutoLoginAdapter implements AuthAdapter {
     private readonly credentials;
     constructor(inner: AuthAdapter, credentials: SignInCredentials);
     currentSession(): Promise<AuthSession | null>;
+    probeSession(): Promise<SessionProbeResult>;
     signIn(credentials: SignInCredentials): Promise<SignInResult>;
     signUp(credentials: SignInCredentials): Promise<SignInResult>;
     signOut(): Promise<void>;

package/dist/lib/auth/dev-auto-login-adapter.js

@@ -27,6 +27,12 @@ export class DevAutoLoginAdapter {
         const result = await this.inner.signIn(this.credentials);
         return result.ok ? result.session : null;
     }
+    probeSession() {
+        // A probe is a probe — no auto-sign-in here. If the session died, the
+        // blocking re-auth overlay (EC-403) is the correct surface; a reload's
+        // `currentSession` restore is where the auto-login convenience lives.
+        return this.inner.probeSession();
+    }
     signIn(credentials) {
         return this.inner.signIn(credentials);
     }

package/dist/lib/auth/dev-auto-login-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev-auto-login-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/dev-auto-login-adapter.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,KAAkB,EAClB,WAA8B;QAD9B,UAAK,GAAL,KAAK,CAAa;QAClB,gBAAW,GAAX,WAAW,CAAmB;IAC9C,CAAC;IAEJ,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAA;QAClD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED,MAAM,CAAC,WAA8B;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,CAAC,WAA8B;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IAC7B,CAAC;IAED,aAAa,CAAC,KAAyB;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IAED,cAAc,CAAC,KAA0B;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IACzC,CAAC;CACF","sourcesContent":["import type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\n\n/**\n * Dev-only unattended-auth decorator (testing de-friction). Wraps any\n * {@link AuthAdapter}: when no session can be restored, it transparently signs\n * in with the configured dev credentials so the studio boots already\n * authenticated for local/automated testing.\n *\n * This is **not** an auth bypass — it performs a real {@link AuthAdapter.signIn},\n * so the resulting session is a genuine backend session and the server-side\n * role guards still apply (a non-member or wrong password surfaces as the normal\n * signed-out state, not silent access). It is only ever constructed in a dev\n * build (see `resolveDevAutoLogin`), so it cannot reach production.\n *\n * Every method but {@link currentSession} delegates unchanged; `currentSession`\n * adds the auto-sign-in fallback after the wrapped adapter reports no session.\n */\nexport class DevAutoLoginAdapter implements AuthAdapter {\n  constructor(\n    private readonly inner: AuthAdapter,\n    private readonly credentials: SignInCredentials,\n  ) {}\n\n  async currentSession(): Promise<AuthSession | null> {\n    const restored = await this.inner.currentSession()\n    if (restored) return restored\n    const result = await this.inner.signIn(this.credentials)\n    return result.ok ? result.session : null\n  }\n\n  signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.inner.signIn(credentials)\n  }\n\n  signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.inner.signUp(credentials)\n  }\n\n  signOut(): Promise<void> {\n    return this.inner.signOut()\n  }\n\n  updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    return this.inner.updateProfile(input)\n  }\n\n  changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    return this.inner.changePassword(input)\n  }\n}\n"]}
+{"version":3,"file":"dev-auto-login-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/dev-auto-login-adapter.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,KAAkB,EAClB,WAA8B;QAD9B,UAAK,GAAL,KAAK,CAAa;QAClB,gBAAW,GAAX,WAAW,CAAmB;IAC9C,CAAC;IAEJ,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAA;QAClD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED,YAAY;QACV,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAA;IAClC,CAAC;IAED,MAAM,CAAC,WAA8B;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,CAAC,WAA8B;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IAC7B,CAAC;IAED,aAAa,CAAC,KAAyB;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IAED,cAAc,CAAC,KAA0B;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IACzC,CAAC;CACF","sourcesContent":["import type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SessionProbeResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\n\n/**\n * Dev-only unattended-auth decorator (testing de-friction). Wraps any\n * {@link AuthAdapter}: when no session can be restored, it transparently signs\n * in with the configured dev credentials so the studio boots already\n * authenticated for local/automated testing.\n *\n * This is **not** an auth bypass — it performs a real {@link AuthAdapter.signIn},\n * so the resulting session is a genuine backend session and the server-side\n * role guards still apply (a non-member or wrong password surfaces as the normal\n * signed-out state, not silent access). It is only ever constructed in a dev\n * build (see `resolveDevAutoLogin`), so it cannot reach production.\n *\n * Every method but {@link currentSession} delegates unchanged; `currentSession`\n * adds the auto-sign-in fallback after the wrapped adapter reports no session.\n */\nexport class DevAutoLoginAdapter implements AuthAdapter {\n  constructor(\n    private readonly inner: AuthAdapter,\n    private readonly credentials: SignInCredentials,\n  ) {}\n\n  async currentSession(): Promise<AuthSession | null> {\n    const restored = await this.inner.currentSession()\n    if (restored) return restored\n    const result = await this.inner.signIn(this.credentials)\n    return result.ok ? result.session : null\n  }\n\n  probeSession(): Promise<SessionProbeResult> {\n    // A probe is a probe — no auto-sign-in here. If the session died, the\n    // blocking re-auth overlay (EC-403) is the correct surface; a reload's\n    // `currentSession` restore is where the auto-login convenience lives.\n    return this.inner.probeSession()\n  }\n\n  signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.inner.signIn(credentials)\n  }\n\n  signUp(credentials: SignInCredentials): Promise<SignInResult> {\n    return this.inner.signUp(credentials)\n  }\n\n  signOut(): Promise<void> {\n    return this.inner.signOut()\n  }\n\n  updateProfile(input: UpdateProfileInput): Promise<UpdateProfileResult> {\n    return this.inner.updateProfile(input)\n  }\n\n  changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult> {\n    return this.inner.changePassword(input)\n  }\n}\n"]}

package/dist/lib/auth/index.d.ts

@@ -1,6 +1,6 @@
 import type { StudioBackendMode } from '../persistence/backend-mode.js';
 import type { AuthAdapter } from './auth-adapter.js';
-export type { AuthAdapter, AuthSession, AuthUser, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult, } from './auth-adapter.js';
+export type { AuthAdapter, AuthSession, AuthUser, ChangePasswordInput, ChangePasswordResult, SessionProbeResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult, } from './auth-adapter.js';
 export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter.js';
 export type { SessionStore } from './local-auth-adapter.js';
 export { ConvexAuthAdapter } from './convex-auth-adapter.js';

package/dist/lib/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAGzE,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAavD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAA;AAGtB;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QACxE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,gBAAgB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAA;IACjF,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAA;IACzC,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAC9E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ;IACtB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnE,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AACvE,CAAC","sourcesContent":["import { getConvexClient } from '../persistence/convex-client'\nimport { resolveBackendConfig, resolveDevAutoLogin } from '../persistence/backend-mode'\nimport { deploymentUrlForSlug, resolveDeploymentUrl } from '../workspace'\nimport type { StudioBackendMode } from '../persistence/backend-mode'\nimport type { AuthAdapter } from './auth-adapter'\nimport { ConvexAuthAdapter, hasStoredConvexSession } from './convex-auth-adapter'\nimport { DevAutoLoginAdapter } from './dev-auto-login-adapter'\nimport { LocalAuthAdapter } from './local-auth-adapter'\n\nexport type {\n  AuthAdapter,\n  AuthSession,\n  AuthUser,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nexport { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter'\nexport type { SessionStore } from './local-auth-adapter'\nexport { ConvexAuthAdapter } from './convex-auth-adapter'\nexport { DevAutoLoginAdapter } from './dev-auto-login-adapter'\nexport {\n  SIGN_IN_PATH,\n  isPublicPath,\n  postSignInTarget,\n  resolveRouteGuard,\n  sessionPrincipal,\n} from './route-guard'\nexport type { AuthStatus, RouteGuardDecision } from './route-guard'\n\n/**\n * Select the auth backend (EC-150/EC-153), mirroring `selectPersistenceAdapter`\n * exactly: Convex mode means Convex Auth (over the same shared client the\n * persistence adapter uses, so the session JWT authenticates every call); the\n * explicit playground mode means the deterministic local adapter with the\n * seeded dev users. A misconfigured backend is a hard error here too — never\n * a silent local fallback (the `DeploymentSetupGate` renders it before this runs).\n */\nexport function selectAuthAdapter(): AuthAdapter {\n  const config = resolveBackendConfig()\n  if (config.kind === 'convex') {\n    // The active project (EC-179) selects the deployment; the session token is\n    // scoped to that deployment URL so each backend keeps its own session.\n    const url = resolveDeploymentUrl(config.url)\n    const base = new ConvexAuthAdapter(getConvexClient(url), undefined, url)\n    return withDevAutoLogin(base)\n  }\n  if (config.kind === 'playground') return withDevAutoLogin(new LocalAuthAdapter())\n  throw new Error(config.detail)\n}\n\n/**\n * Dev-only: wrap an adapter so the studio auto-signs-in for unattended testing\n * when `VITE_ELYTRA_DEV_LOGIN` is configured in a dev build. No-op otherwise\n * (and dead-code-eliminated in production builds — see `resolveDevAutoLogin`).\n */\nfunction withDevAutoLogin(adapter: AuthAdapter): AuthAdapter {\n  const credentials = resolveDevAutoLogin()\n  return credentials ? new DevAutoLoginAdapter(adapter, credentials) : adapter\n}\n\n/** Mirrors `persistenceMode()` — auth and persistence always agree (EC-150). */\nexport function authMode(): StudioBackendMode {\n  const config = resolveBackendConfig()\n  if (config.kind === 'misconfigured') throw new Error(config.detail)\n  return config.kind\n}\n\n/**\n * Whether the user has a session on a given project's backend (EC-179). One\n * project per backend, so this is the per-project sign-in state the switcher and\n * launcher surface (\"Sign in\" vs \"Open project\"). Playground mode is a single\n * local backend — always \"signed in\". Best-effort (token presence, see\n * {@link hasStoredConvexSession}); entry still enforces a valid session.\n */\nexport function hasProjectSession(slug: string): boolean {\n  const config = resolveBackendConfig()\n  if (config.kind !== 'convex') return true\n  return hasStoredConvexSession(deploymentUrlForSlug(slug, config.url))\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAGzE,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAcvD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAA;AAGtB;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QACxE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,gBAAgB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAA;IACjF,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAA;IACzC,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAC9E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ;IACtB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnE,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AACvE,CAAC","sourcesContent":["import { getConvexClient } from '../persistence/convex-client'\nimport { resolveBackendConfig, resolveDevAutoLogin } from '../persistence/backend-mode'\nimport { deploymentUrlForSlug, resolveDeploymentUrl } from '../workspace'\nimport type { StudioBackendMode } from '../persistence/backend-mode'\nimport type { AuthAdapter } from './auth-adapter'\nimport { ConvexAuthAdapter, hasStoredConvexSession } from './convex-auth-adapter'\nimport { DevAutoLoginAdapter } from './dev-auto-login-adapter'\nimport { LocalAuthAdapter } from './local-auth-adapter'\n\nexport type {\n  AuthAdapter,\n  AuthSession,\n  AuthUser,\n  ChangePasswordInput,\n  ChangePasswordResult,\n  SessionProbeResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileInput,\n  UpdateProfileResult,\n} from './auth-adapter'\nexport { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter'\nexport type { SessionStore } from './local-auth-adapter'\nexport { ConvexAuthAdapter } from './convex-auth-adapter'\nexport { DevAutoLoginAdapter } from './dev-auto-login-adapter'\nexport {\n  SIGN_IN_PATH,\n  isPublicPath,\n  postSignInTarget,\n  resolveRouteGuard,\n  sessionPrincipal,\n} from './route-guard'\nexport type { AuthStatus, RouteGuardDecision } from './route-guard'\n\n/**\n * Select the auth backend (EC-150/EC-153), mirroring `selectPersistenceAdapter`\n * exactly: Convex mode means Convex Auth (over the same shared client the\n * persistence adapter uses, so the session JWT authenticates every call); the\n * explicit playground mode means the deterministic local adapter with the\n * seeded dev users. A misconfigured backend is a hard error here too — never\n * a silent local fallback (the `DeploymentSetupGate` renders it before this runs).\n */\nexport function selectAuthAdapter(): AuthAdapter {\n  const config = resolveBackendConfig()\n  if (config.kind === 'convex') {\n    // The active project (EC-179) selects the deployment; the session token is\n    // scoped to that deployment URL so each backend keeps its own session.\n    const url = resolveDeploymentUrl(config.url)\n    const base = new ConvexAuthAdapter(getConvexClient(url), undefined, url)\n    return withDevAutoLogin(base)\n  }\n  if (config.kind === 'playground') return withDevAutoLogin(new LocalAuthAdapter())\n  throw new Error(config.detail)\n}\n\n/**\n * Dev-only: wrap an adapter so the studio auto-signs-in for unattended testing\n * when `VITE_ELYTRA_DEV_LOGIN` is configured in a dev build. No-op otherwise\n * (and dead-code-eliminated in production builds — see `resolveDevAutoLogin`).\n */\nfunction withDevAutoLogin(adapter: AuthAdapter): AuthAdapter {\n  const credentials = resolveDevAutoLogin()\n  return credentials ? new DevAutoLoginAdapter(adapter, credentials) : adapter\n}\n\n/** Mirrors `persistenceMode()` — auth and persistence always agree (EC-150). */\nexport function authMode(): StudioBackendMode {\n  const config = resolveBackendConfig()\n  if (config.kind === 'misconfigured') throw new Error(config.detail)\n  return config.kind\n}\n\n/**\n * Whether the user has a session on a given project's backend (EC-179). One\n * project per backend, so this is the per-project sign-in state the switcher and\n * launcher surface (\"Sign in\" vs \"Open project\"). Playground mode is a single\n * local backend — always \"signed in\". Best-effort (token presence, see\n * {@link hasStoredConvexSession}); entry still enforces a valid session.\n */\nexport function hasProjectSession(slug: string): boolean {\n  const config = resolveBackendConfig()\n  if (config.kind !== 'convex') return true\n  return hasStoredConvexSession(deploymentUrlForSlug(slug, config.url))\n}\n"]}

package/dist/lib/auth/local-auth-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { AuthAdapter, AuthSession, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileResult } from './auth-adapter.js';
+import type { AuthAdapter, AuthSession, ChangePasswordResult, SessionProbeResult, SignInCredentials, SignInResult, UpdateProfileResult } from './auth-adapter.js';
 /**
  * Deterministic local auth (EC-150) for the in-memory persistence mode: the
  * whole sign-in → role-enforcement → sign-out flow works offline, in tests,
@@ -51,6 +51,7 @@ export declare class LocalAuthAdapter implements AuthAdapter {
     private readonly store;
     constructor(store?: SessionStore);
     currentSession(): Promise<AuthSession | null>;
+    probeSession(): Promise<SessionProbeResult>;
     signIn(credentials: SignInCredentials): Promise<SignInResult>;
     signUp(): Promise<SignInResult>;
     signOut(): Promise<void>;

package/dist/lib/auth/local-auth-adapter.js

@@ -47,6 +47,13 @@ export class LocalAuthAdapter {
         const entry = LOCAL_DEV_CREDENTIALS.find((c) => c.user.id === userId);
         return entry ? { user: entry.user } : null;
     }
+    async probeSession() {
+        // Playground sessions live entirely in local storage — there is no backend
+        // that could expire or reject them, so the probe is trivially `valid` and
+        // proactive re-validation is a no-op (EC-415 scope 4: byte-identical
+        // playground behavior).
+        return 'valid';
+    }
     async signIn(credentials) {
         const email = credentials.email.trim().toLowerCase();
         const entry = LOCAL_DEV_CREDENTIALS.find((c) => c.user.email === email);

package/dist/lib/auth/local-auth-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/local-auth-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAUvD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE;IACnD,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;IACrD,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;CAC7C,CAAA;AAEV,MAAM,WAAW,GAAG,2BAA2B,CAAA;AAS/C,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,KAAK,CAAc;IAEpC,YAAY,QAAsB,YAAY,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;QACrE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QACvE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;YACtD,8DAA8D;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,MAAM;QACV,yEAAyE;QACzE,4EAA4E;QAC5E,cAAc;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,6EAA6E;SACvF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,+EAA+E;QAC/E,kFAAkF;QAClF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;CACF","sourcesContent":["import { DEV_USERS } from '@elytracms/core/persistence'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileResult,\n} from './auth-adapter'\n\n/**\n * Deterministic local auth (EC-150) for the in-memory persistence mode: the\n * whole sign-in → role-enforcement → sign-out flow works offline, in tests,\n * and in fixtures with zero backend setup. User ids are the canonical\n * `DEV_USERS` ids from `@elytracms/core/persistence`, which the seeded\n * `projectMembers` fixtures reference — so `admin@example.com` is admin,\n * `editor@…` editor, `viewer@…` viewer on every sample project.\n *\n * Dev credentials (fixed, documented, local-only):\n * - admin@example.com  / elytra-admin\n * - editor@example.com / elytra-editor\n * - viewer@example.com / elytra-viewer\n *\n * Adminness is the `projectMembers` role, not a global flag — project creation\n * is config/CLI-owned now (AD-11), so there is no in-studio `create-projects`\n * capability to grant.\n *\n * The session survives reloads via injected storage (defaults to\n * `sessionStorage` in the browser, an in-memory map elsewhere).\n */\n\nexport const LOCAL_DEV_CREDENTIALS = [\n  { user: DEV_USERS.admin, password: 'elytra-admin' },\n  { user: DEV_USERS.editor, password: 'elytra-editor' },\n  { user: DEV_USERS.viewer, password: 'elytra-viewer' },\n] as const\n\nconst STORAGE_KEY = 'elytra.local-auth.user-id'\n\n/** The storage slice the adapter needs (sessionStorage-compatible). */\nexport interface SessionStore {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class LocalAuthAdapter implements AuthAdapter {\n  private readonly store: SessionStore\n\n  constructor(store: SessionStore = defaultStore()) {\n    this.store = store\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const userId = this.store.getItem(STORAGE_KEY)\n    if (!userId) return null\n    const entry = LOCAL_DEV_CREDENTIALS.find((c) => c.user.id === userId)\n    return entry ? { user: entry.user } : null\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    const email = credentials.email.trim().toLowerCase()\n    const entry = LOCAL_DEV_CREDENTIALS.find((c) => c.user.email === email)\n    if (!entry || entry.password !== credentials.password) {\n      // Deliberately identical for unknown email vs wrong password.\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(STORAGE_KEY, entry.user.id)\n    return { ok: true, session: { user: entry.user } }\n  }\n\n  async signUp(): Promise<SignInResult> {\n    // Playground mode has a fixed, documented set of dev users — there is no\n    // registration. Surfaced as a state, not a throw, so the sign-in screen can\n    // explain it.\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message: 'Sign-up isn’t available in playground mode — use the dev credentials below.',\n    }\n  }\n\n  async signOut(): Promise<void> {\n    this.store.removeItem(STORAGE_KEY)\n  }\n\n  async updateProfile(): Promise<UpdateProfileResult> {\n    // Playground users are fixed, documented fixtures — there is no persistence to\n    // write. Surfaced as a state, not a throw, so the account surface can explain it.\n    return {\n      ok: false,\n      reason: 'unsupported',\n      message: 'Profile editing isn’t available in playground mode.',\n    }\n  }\n\n  async changePassword(): Promise<ChangePasswordResult> {\n    return {\n      ok: false,\n      reason: 'unsupported',\n      message: 'Password change isn’t available in playground mode.',\n    }\n  }\n}\n"]}
+{"version":3,"file":"local-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/local-auth-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAWvD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE;IACnD,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;IACrD,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;CAC7C,CAAA;AAEV,MAAM,WAAW,GAAG,2BAA2B,CAAA;AAS/C,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,KAAK,CAAc;IAEpC,YAAY,QAAsB,YAAY,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;QACrE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,wBAAwB;QACxB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QACvE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;YACtD,8DAA8D;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,MAAM;QACV,yEAAyE;QACzE,4EAA4E;QAC5E,cAAc;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,6EAA6E;SACvF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,+EAA+E;QAC/E,kFAAkF;QAClF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,qDAAqD;SAC/D,CAAA;IACH,CAAC;CACF","sourcesContent":["import { DEV_USERS } from '@elytracms/core/persistence'\nimport type {\n  AuthAdapter,\n  AuthSession,\n  ChangePasswordResult,\n  SessionProbeResult,\n  SignInCredentials,\n  SignInResult,\n  UpdateProfileResult,\n} from './auth-adapter'\n\n/**\n * Deterministic local auth (EC-150) for the in-memory persistence mode: the\n * whole sign-in → role-enforcement → sign-out flow works offline, in tests,\n * and in fixtures with zero backend setup. User ids are the canonical\n * `DEV_USERS` ids from `@elytracms/core/persistence`, which the seeded\n * `projectMembers` fixtures reference — so `admin@example.com` is admin,\n * `editor@…` editor, `viewer@…` viewer on every sample project.\n *\n * Dev credentials (fixed, documented, local-only):\n * - admin@example.com  / elytra-admin\n * - editor@example.com / elytra-editor\n * - viewer@example.com / elytra-viewer\n *\n * Adminness is the `projectMembers` role, not a global flag — project creation\n * is config/CLI-owned now (AD-11), so there is no in-studio `create-projects`\n * capability to grant.\n *\n * The session survives reloads via injected storage (defaults to\n * `sessionStorage` in the browser, an in-memory map elsewhere).\n */\n\nexport const LOCAL_DEV_CREDENTIALS = [\n  { user: DEV_USERS.admin, password: 'elytra-admin' },\n  { user: DEV_USERS.editor, password: 'elytra-editor' },\n  { user: DEV_USERS.viewer, password: 'elytra-viewer' },\n] as const\n\nconst STORAGE_KEY = 'elytra.local-auth.user-id'\n\n/** The storage slice the adapter needs (sessionStorage-compatible). */\nexport interface SessionStore {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nfunction defaultStore(): SessionStore {\n  if (typeof window !== 'undefined' && window.sessionStorage) return window.sessionStorage\n  const memory = new Map<string, string>()\n  return {\n    getItem: (key) => memory.get(key) ?? null,\n    setItem: (key, value) => void memory.set(key, value),\n    removeItem: (key) => void memory.delete(key),\n  }\n}\n\nexport class LocalAuthAdapter implements AuthAdapter {\n  private readonly store: SessionStore\n\n  constructor(store: SessionStore = defaultStore()) {\n    this.store = store\n  }\n\n  async currentSession(): Promise<AuthSession | null> {\n    const userId = this.store.getItem(STORAGE_KEY)\n    if (!userId) return null\n    const entry = LOCAL_DEV_CREDENTIALS.find((c) => c.user.id === userId)\n    return entry ? { user: entry.user } : null\n  }\n\n  async probeSession(): Promise<SessionProbeResult> {\n    // Playground sessions live entirely in local storage — there is no backend\n    // that could expire or reject them, so the probe is trivially `valid` and\n    // proactive re-validation is a no-op (EC-415 scope 4: byte-identical\n    // playground behavior).\n    return 'valid'\n  }\n\n  async signIn(credentials: SignInCredentials): Promise<SignInResult> {\n    const email = credentials.email.trim().toLowerCase()\n    const entry = LOCAL_DEV_CREDENTIALS.find((c) => c.user.email === email)\n    if (!entry || entry.password !== credentials.password) {\n      // Deliberately identical for unknown email vs wrong password.\n      return {\n        ok: false,\n        reason: 'invalid-credentials',\n        message: 'Email or password is incorrect.',\n      }\n    }\n    this.store.setItem(STORAGE_KEY, entry.user.id)\n    return { ok: true, session: { user: entry.user } }\n  }\n\n  async signUp(): Promise<SignInResult> {\n    // Playground mode has a fixed, documented set of dev users — there is no\n    // registration. Surfaced as a state, not a throw, so the sign-in screen can\n    // explain it.\n    return {\n      ok: false,\n      reason: 'unavailable',\n      message: 'Sign-up isn’t available in playground mode — use the dev credentials below.',\n    }\n  }\n\n  async signOut(): Promise<void> {\n    this.store.removeItem(STORAGE_KEY)\n  }\n\n  async updateProfile(): Promise<UpdateProfileResult> {\n    // Playground users are fixed, documented fixtures — there is no persistence to\n    // write. Surfaced as a state, not a throw, so the account surface can explain it.\n    return {\n      ok: false,\n      reason: 'unsupported',\n      message: 'Profile editing isn’t available in playground mode.',\n    }\n  }\n\n  async changePassword(): Promise<ChangePasswordResult> {\n    return {\n      ok: false,\n      reason: 'unsupported',\n      message: 'Password change isn’t available in playground mode.',\n    }\n  }\n}\n"]}