@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/component/group.js

@@ -0,0 +1,431 @@
+import { ErrorCode } from "../shared/codes.js";
+import { vGroupConnectionPolicy, vGroupDoc, vPaginated } from "./model.js";
+import schema_default from "./schema.js";
+import { internal } from "./_generated/api.js";
+import { internalMutation, mutation, query } from "./_generated/server.js";
+import { ConvexError, v } from "convex/values";
+import { paginationOptsValidator } from "convex/server";
+import { stream } from "convex-helpers/server/stream";
+import { paginator } from "convex-helpers/server/pagination";
+
+//#region src/component/group.ts
+/**
+* `component.group.*` — hierarchical groups (the group entity root;
+* members/invites are sub-resources under `group.member` / `group.invite`).
+*
+* `ancestors` is a kept domain read (hierarchy walk).
+*
+* @module
+*/
+/**
+* Read a group by `id`, or batch-read by `ids` (result aligned to input
+* order, with `null` for missing ids and duplicates preserved).
+*/
+const get = query({
+	args: {
+		id: v.optional(v.id("Group")),
+		ids: v.optional(v.array(v.id("Group")))
+	},
+	returns: v.union(vGroupDoc, v.null(), v.array(v.union(vGroupDoc, v.null()))),
+	handler: async (ctx, args) => {
+		if (args.ids !== void 0) {
+			if (args.ids.length === 0) return [];
+			const unique = Array.from(new Set(args.ids));
+			const docs = await Promise.all(unique.map((id) => ctx.db.get("Group", id)));
+			const byId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));
+			return args.ids.map((id) => byId.get(id) ?? null);
+		}
+		if (args.id === void 0) return null;
+		return await ctx.db.get("Group", args.id);
+	}
+});
+/**
+* Walk the parent chain from a group up to the root, returning the ordered
+* ancestor docs. Flags `cycleDetected` and `maxDepthReached` so callers can
+* tell a truncated walk from a complete one; `includeSelf` prepends the
+* starting group.
+*/
+const ancestors = query({
+	args: {
+		id: v.id("Group"),
+		maxDepth: v.optional(v.number()),
+		includeSelf: v.optional(v.boolean())
+	},
+	returns: v.object({
+		ancestors: v.array(vGroupDoc),
+		cycleDetected: v.boolean(),
+		maxDepthReached: v.boolean()
+	}),
+	handler: async (ctx, { id: groupId, maxDepth, includeSelf }) => {
+		const limit = Math.max(0, Math.floor(maxDepth ?? 32));
+		const visited = /* @__PURE__ */ new Set();
+		const ancestors = [];
+		let cycleDetected = false;
+		let maxDepthReached = false;
+		let current = groupId;
+		let depth = 0;
+		let first = true;
+		while (current !== void 0) {
+			if (depth > limit) {
+				maxDepthReached = true;
+				break;
+			}
+			if (visited.has(current)) {
+				cycleDetected = true;
+				break;
+			}
+			visited.add(current);
+			const doc = await ctx.db.get("Group", current);
+			if (doc === null) break;
+			if (first) {
+				first = false;
+				if (includeSelf === true) ancestors.push(doc);
+			} else ancestors.push(doc);
+			current = doc.parentGroupId;
+			depth += 1;
+		}
+		return {
+			ancestors,
+			cycleDetected,
+			maxDepthReached
+		};
+	}
+});
+/** List groups, paginated, optionally filtered by `where` and sorted via `orderBy`/`order`. */
+const list = query({
+	args: {
+		where: v.optional(v.object({
+			slug: v.optional(v.string()),
+			type: v.optional(v.string()),
+			parentGroupId: v.optional(v.id("Group")),
+			name: v.optional(v.string()),
+			isRoot: v.optional(v.boolean())
+		})),
+		paginationOpts: paginationOptsValidator,
+		orderBy: v.optional(v.union(v.literal("_creationTime"), v.literal("name"), v.literal("slug"), v.literal("type"))),
+		order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
+	},
+	returns: vPaginated(vGroupDoc),
+	handler: async (ctx, args) => {
+		const where = args.where ?? {};
+		const order = args.order ?? "desc";
+		const orderBy = args.orderBy ?? "_creationTime";
+		const base = stream(ctx.db, schema_default).query("Group");
+		let q;
+		if (orderBy === "name") q = where.parentGroupId !== void 0 ? where.name !== void 0 ? base.withIndex("parent_group_id_name", (idx) => idx.eq("parentGroupId", where.parentGroupId).eq("name", where.name)) : base.withIndex("parent_group_id_name", (idx) => idx.eq("parentGroupId", where.parentGroupId)) : base.withIndex("name");
+		else if (orderBy === "slug") q = where.parentGroupId !== void 0 ? where.slug !== void 0 ? base.withIndex("parent_group_id_slug", (idx) => idx.eq("parentGroupId", where.parentGroupId).eq("slug", where.slug)) : base.withIndex("parent_group_id_slug", (idx) => idx.eq("parentGroupId", where.parentGroupId)) : where.slug !== void 0 ? base.withIndex("slug", (idx) => idx.eq("slug", where.slug)) : base.withIndex("slug");
+		else if (orderBy === "type") q = where.parentGroupId !== void 0 ? where.type !== void 0 ? base.withIndex("parent_group_id_type", (idx) => idx.eq("parentGroupId", where.parentGroupId).eq("type", where.type)) : base.withIndex("parent_group_id_type", (idx) => idx.eq("parentGroupId", where.parentGroupId)) : where.type !== void 0 ? base.withIndex("type", (idx) => idx.eq("type", where.type)) : base.withIndex("type");
+		else if (where.type !== void 0 && where.parentGroupId !== void 0) q = base.withIndex("type_parent_group_id", (idx) => idx.eq("type", where.type).eq("parentGroupId", where.parentGroupId));
+		else if (where.slug !== void 0) q = base.withIndex("slug", (idx) => idx.eq("slug", where.slug));
+		else if (where.type !== void 0) q = base.withIndex("type", (idx) => idx.eq("type", where.type));
+		else if (where.parentGroupId !== void 0) q = base.withIndex("parent_group_id", (idx) => idx.eq("parentGroupId", where.parentGroupId));
+		else if (where.isRoot !== void 0) q = base.withIndex("is_root", (idx) => idx.eq("isRoot", where.isRoot));
+		else q = base;
+		return await q.order(order).filterWith(async (d) => (where.slug === void 0 || d.slug === where.slug) && (where.type === void 0 || d.type === where.type) && (where.parentGroupId === void 0 || d.parentGroupId === where.parentGroupId) && (where.name === void 0 || d.name === where.name) && (where.isRoot === void 0 || d.isRoot === where.isRoot)).paginate(args.paginationOpts);
+	}
+});
+/**
+* Insert a new group. A group with no `parentGroupId` is a root and is
+* back-patched to point `rootGroupId` at itself; otherwise it inherits the
+* parent's `rootGroupId`.
+*/
+const create = mutation({
+	args: {
+		name: v.string(),
+		slug: v.optional(v.string()),
+		type: v.optional(v.string()),
+		parentGroupId: v.optional(v.id("Group")),
+		extend: v.optional(v.any())
+	},
+	returns: v.id("Group"),
+	handler: async (ctx, args) => {
+		const isRoot = !args.parentGroupId;
+		let rootGroupId;
+		if (!isRoot && args.parentGroupId) {
+			await assertGroupCanAcceptChild(ctx, args.parentGroupId);
+			rootGroupId = (await ctx.db.get("Group", args.parentGroupId))?.rootGroupId ?? args.parentGroupId;
+		}
+		const groupId = await ctx.db.insert("Group", {
+			...args,
+			isRoot,
+			rootGroupId: isRoot ? void 0 : rootGroupId
+		});
+		if (isRoot) await ctx.db.patch("Group", groupId, { rootGroupId: groupId });
+		return groupId;
+	}
+});
+/** Small subtrees keep the original synchronous, all-or-nothing behavior. */
+const INLINE_GROUP_LIMIT = 48;
+const INLINE_RELATION_LIMIT = 384;
+/** Durable jobs deliberately use small pages to leave transaction headroom. */
+const PLAN_ITEMS_PER_RUN = 4;
+const CHILDREN_PER_PAGE = 32;
+const APPLY_ITEMS_PER_RUN = 16;
+const RELATIONS_PER_RUN = 64;
+const CLEANUP_ITEMS_PER_RUN = 128;
+/**
+* Collect a subtree only while it is known to fit comfortably in one
+* transaction. Returning `null` is not an error: it selects the durable path,
+* and no hierarchy row has been changed yet.
+*/
+async function collectInlineSubtree(ctx, groupId, includeRelations) {
+	const queue = [groupId];
+	const seen = /* @__PURE__ */ new Set();
+	const groups = [];
+	const members = [];
+	const invites = [];
+	for (let head = 0; head < queue.length; head += 1) {
+		const id = queue[head];
+		if (seen.has(id)) continue;
+		seen.add(id);
+		if (seen.size > INLINE_GROUP_LIMIT) return null;
+		const group = await ctx.db.get("Group", id);
+		if (group === null) continue;
+		groups.push(group);
+		const children = await ctx.db.query("Group").withIndex("parent_group_id", (q) => q.eq("parentGroupId", id)).take(INLINE_GROUP_LIMIT + 1);
+		if (children.length > INLINE_GROUP_LIMIT) return null;
+		queue.push(...children.map((child) => child._id));
+		if (queue.length > INLINE_GROUP_LIMIT * 2) return null;
+		if (!includeRelations) continue;
+		const groupMembers = await ctx.db.query("GroupMember").withIndex("group_id", (q) => q.eq("groupId", id)).take(INLINE_RELATION_LIMIT + 1);
+		const groupInvites = await ctx.db.query("GroupInvite").withIndex("group_id", (q) => q.eq("groupId", id)).take(INLINE_RELATION_LIMIT + 1);
+		members.push(...groupMembers);
+		invites.push(...groupInvites);
+		if (members.length + invites.length > INLINE_RELATION_LIMIT) return null;
+	}
+	return {
+		groups,
+		members,
+		invites
+	};
+}
+async function scheduleHierarchyOperation(ctx, operationId) {
+	await ctx.scheduler.runAfter(0, internal.group.processGroupHierarchy, { operationId });
+}
+async function createHierarchyOperation(ctx, args) {
+	const operationId = await ctx.db.insert("GroupHierarchyOperation", {
+		...args,
+		phase: "planning"
+	});
+	await ctx.db.insert("GroupHierarchyWork", {
+		operationId,
+		kind: args.kind,
+		groupId: args.groupId,
+		depth: 0,
+		planned: false,
+		applied: false
+	});
+	await scheduleHierarchyOperation(ctx, operationId);
+	return operationId;
+}
+async function activeRemovalForGroup(ctx, groupId) {
+	const work = await ctx.db.query("GroupHierarchyWork").withIndex("group_id_kind", (q) => q.eq("groupId", groupId).eq("kind", "remove")).take(1);
+	for (const item of work) {
+		const operation = await ctx.db.get("GroupHierarchyOperation", item.operationId);
+		if (operation?.kind === "remove" && operation.phase !== "cleaning") return operation;
+	}
+	return null;
+}
+async function activeHierarchyOperationForGroup(ctx, groupId) {
+	const work = await ctx.db.query("GroupHierarchyWork").withIndex("group_id", (q) => q.eq("groupId", groupId)).first();
+	return work === null ? null : await ctx.db.get("GroupHierarchyOperation", work.operationId);
+}
+async function assertGroupNotBeingRemoved(ctx, groupId) {
+	if (await activeRemovalForGroup(ctx, groupId) !== null) throw new ConvexError({
+		code: ErrorCode.INVALID_PARAMETERS,
+		message: `Group ${groupId} is being removed and cannot be changed.`
+	});
+}
+async function assertGroupCanAcceptChild(ctx, groupId) {
+	if (await activeHierarchyOperationForGroup(ctx, groupId) !== null) throw new ConvexError({
+		code: ErrorCode.INVALID_PARAMETERS,
+		message: `Group ${groupId} has a hierarchy operation in progress and cannot accept a child.`
+	});
+}
+async function planHierarchyOperation(ctx, operation) {
+	const items = await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_planned", (q) => q.eq("operationId", operation._id).eq("planned", false)).take(PLAN_ITEMS_PER_RUN);
+	for (const item of items) {
+		const page = await paginator(ctx.db, schema_default).query("Group").withIndex("parent_group_id", (q) => q.eq("parentGroupId", item.groupId)).paginate({
+			numItems: CHILDREN_PER_PAGE,
+			cursor: item.scanCursor ?? null
+		});
+		for (const child of page.page) if (await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_group_id", (q) => q.eq("operationId", operation._id).eq("groupId", child._id)).unique() === null) await ctx.db.insert("GroupHierarchyWork", {
+			operationId: operation._id,
+			kind: operation.kind,
+			groupId: child._id,
+			parentWorkId: item._id,
+			expectedParentGroupId: item.groupId,
+			depth: item.depth + 1,
+			planned: false,
+			applied: false
+		});
+		await ctx.db.patch("GroupHierarchyWork", item._id, {
+			planned: page.isDone,
+			scanCursor: page.isDone ? void 0 : page.continueCursor
+		});
+	}
+	if (await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_planned", (q) => q.eq("operationId", operation._id).eq("planned", false)).first() === null) await ctx.db.patch("GroupHierarchyOperation", operation._id, { phase: "applying" });
+	await scheduleHierarchyOperation(ctx, operation._id);
+}
+async function applyRemoval(ctx, operation) {
+	const items = await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_applied_depth", (q) => q.eq("operationId", operation._id).eq("applied", false)).order("desc").take(APPLY_ITEMS_PER_RUN);
+	for (const item of items) {
+		if (await ctx.db.get("Group", item.groupId) === null) {
+			await ctx.db.patch("GroupHierarchyWork", item._id, { applied: true });
+			continue;
+		}
+		const children = await ctx.db.query("Group").withIndex("parent_group_id", (q) => q.eq("parentGroupId", item.groupId)).take(2);
+		let hasBlockingChild = false;
+		for (const child of children) {
+			const childWork = await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_group_id", (q) => q.eq("operationId", operation._id).eq("groupId", child._id)).unique();
+			if (childWork === null || childWork.depth > item.depth) {
+				hasBlockingChild = true;
+				break;
+			}
+		}
+		if (hasBlockingChild) continue;
+		const members = await ctx.db.query("GroupMember").withIndex("group_id", (q) => q.eq("groupId", item.groupId)).take(RELATIONS_PER_RUN);
+		const invites = await ctx.db.query("GroupInvite").withIndex("group_id", (q) => q.eq("groupId", item.groupId)).take(RELATIONS_PER_RUN);
+		for (const member of members) await ctx.db.delete("GroupMember", member._id);
+		for (const invite of invites) await ctx.db.delete("GroupInvite", invite._id);
+		if (members.length === RELATIONS_PER_RUN || invites.length === RELATIONS_PER_RUN) continue;
+		await ctx.db.delete("Group", item.groupId);
+		await ctx.db.patch("GroupHierarchyWork", item._id, { applied: true });
+	}
+	if (await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_applied_depth", (q) => q.eq("operationId", operation._id).eq("applied", false)).first() === null) await ctx.db.patch("GroupHierarchyOperation", operation._id, { phase: "cleaning" });
+	await scheduleHierarchyOperation(ctx, operation._id);
+}
+async function applyRestamp(ctx, operation) {
+	const newRootGroupId = operation.newRootGroupId;
+	if (newRootGroupId === void 0) {
+		await ctx.db.patch("GroupHierarchyOperation", operation._id, { phase: "cleaning" });
+		await scheduleHierarchyOperation(ctx, operation._id);
+		return;
+	}
+	const items = await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_applied_depth", (q) => q.eq("operationId", operation._id).eq("applied", false)).order("asc").take(APPLY_ITEMS_PER_RUN);
+	for (const item of items) {
+		const group = await ctx.db.get("Group", item.groupId);
+		let eligible = false;
+		if (group !== null) {
+			if (item.parentWorkId === void 0) eligible = group.parentGroupId === operation.expectedParentGroupId && group.rootGroupId === newRootGroupId;
+			else eligible = (await ctx.db.get("GroupHierarchyWork", item.parentWorkId))?.eligible === true && group.parentGroupId === item.expectedParentGroupId;
+			if (eligible && group.rootGroupId !== newRootGroupId) await ctx.db.patch("Group", group._id, { rootGroupId: newRootGroupId });
+		}
+		await ctx.db.patch("GroupHierarchyWork", item._id, {
+			eligible,
+			applied: true
+		});
+	}
+	if (await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_applied_depth", (q) => q.eq("operationId", operation._id).eq("applied", false)).first() === null) await ctx.db.patch("GroupHierarchyOperation", operation._id, { phase: "cleaning" });
+	await scheduleHierarchyOperation(ctx, operation._id);
+}
+async function cleanupHierarchyOperation(ctx, operation) {
+	const work = await ctx.db.query("GroupHierarchyWork").withIndex("operation_id_group_id", (q) => q.eq("operationId", operation._id)).take(CLEANUP_ITEMS_PER_RUN);
+	for (const item of work) await ctx.db.delete("GroupHierarchyWork", item._id);
+	if (work.length === 0) await ctx.db.delete("GroupHierarchyOperation", operation._id);
+	else await scheduleHierarchyOperation(ctx, operation._id);
+}
+/** Durable, idempotent continuation for large hierarchy operations. */
+const processGroupHierarchy = internalMutation({
+	args: { operationId: v.id("GroupHierarchyOperation") },
+	returns: v.null(),
+	handler: async (ctx, { operationId }) => {
+		const operation = await ctx.db.get("GroupHierarchyOperation", operationId);
+		if (operation === null) return null;
+		if (operation.phase === "planning") await planHierarchyOperation(ctx, operation);
+		else if (operation.phase === "applying" && operation.kind === "remove") await applyRemoval(ctx, operation);
+		else if (operation.phase === "applying") await applyRestamp(ctx, operation);
+		else await cleanupHierarchyOperation(ctx, operation);
+		return null;
+	}
+});
+/**
+* Patch fields on a group. Re-parenting (a `patch.parentGroupId`) recomputes
+* `isRoot`/`rootGroupId` and cascades the new `rootGroupId` to every
+* descendant in the moved subtree. Small subtrees update atomically. Large
+* subtrees use a durable planned work queue; stale continuations verify their
+* target and parent lineage before writing, so a newer move always wins.
+*/
+const update = mutation({
+	args: {
+		id: v.id("Group"),
+		patch: v.object({
+			name: v.optional(v.string()),
+			slug: v.optional(v.string()),
+			type: v.optional(v.string()),
+			parentGroupId: v.optional(v.id("Group")),
+			rootGroupId: v.optional(v.id("Group")),
+			isRoot: v.optional(v.boolean()),
+			policy: v.optional(vGroupConnectionPolicy),
+			extend: v.optional(v.any())
+		})
+	},
+	returns: v.null(),
+	handler: async (ctx, { id: groupId, patch }) => {
+		await assertGroupNotBeingRemoved(ctx, groupId);
+		if (patch.parentGroupId !== void 0) {
+			await assertGroupCanAcceptChild(ctx, patch.parentGroupId);
+			const oldRootGroupId = (await ctx.db.get("Group", groupId))?.rootGroupId;
+			const newParentGroupId = patch.parentGroupId;
+			const newIsRoot = !newParentGroupId;
+			let newRootGroupId;
+			if (newIsRoot) newRootGroupId = groupId;
+			else newRootGroupId = (await ctx.db.get("Group", newParentGroupId))?.rootGroupId ?? newParentGroupId;
+			patch.isRoot = newIsRoot;
+			patch.rootGroupId = newRootGroupId;
+			const existingRestamp = await ctx.db.query("GroupHierarchyOperation").withIndex("group_id_kind_parent_root", (q) => q.eq("groupId", groupId).eq("kind", "restamp").eq("expectedParentGroupId", newParentGroupId).eq("newRootGroupId", newRootGroupId)).first();
+			if (existingRestamp !== null) await scheduleHierarchyOperation(ctx, existingRestamp._id);
+			else if (oldRootGroupId && oldRootGroupId !== newRootGroupId) {
+				const inline = await collectInlineSubtree(ctx, groupId, false);
+				if (inline === null) await createHierarchyOperation(ctx, {
+					groupId,
+					kind: "restamp",
+					newRootGroupId,
+					expectedParentGroupId: newParentGroupId
+				});
+				else for (const group of inline.groups) if (group._id !== groupId && group.rootGroupId !== newRootGroupId) await ctx.db.patch("Group", group._id, { rootGroupId: newRootGroupId });
+			}
+		}
+		await ctx.db.patch("Group", groupId, patch);
+		return null;
+	}
+});
+/**
+* Delete a group and cascade-delete its descendant groups, memberships, and
+* invites. Small subtrees delete atomically. Large subtrees are fully planned
+* before application begins, then drained bottom-up through durable,
+* idempotent continuations. Retrying `remove` resumes the same operation.
+*/
+const remove = mutation({
+	args: { id: v.id("Group") },
+	returns: v.null(),
+	handler: async (ctx, { id: groupId }) => {
+		const exactOperation = await ctx.db.query("GroupHierarchyOperation").withIndex("group_id_kind", (q) => q.eq("groupId", groupId).eq("kind", "remove")).first();
+		if (exactOperation !== null) {
+			await scheduleHierarchyOperation(ctx, exactOperation._id);
+			return null;
+		}
+		const ancestorOperation = await activeRemovalForGroup(ctx, groupId);
+		if (ancestorOperation !== null) {
+			await scheduleHierarchyOperation(ctx, ancestorOperation._id);
+			return null;
+		}
+		if (await ctx.db.get("Group", groupId) === null) return null;
+		const inline = await collectInlineSubtree(ctx, groupId, true);
+		if (inline === null) {
+			await createHierarchyOperation(ctx, {
+				groupId,
+				kind: "remove"
+			});
+			return null;
+		}
+		for (const member of inline.members) await ctx.db.delete("GroupMember", member._id);
+		for (const invite of inline.invites) await ctx.db.delete("GroupInvite", invite._id);
+		for (const group of [...inline.groups].reverse()) await ctx.db.delete("Group", group._id);
+		return null;
+	}
+});
+
+//#endregion
+export { ancestors, create, get, list, processGroupHierarchy, remove, update };
+//# sourceMappingURL=group.js.map

package/dist/component/http.js

@@ -0,0 +1,9 @@
+import { httpRouter } from "convex/server";
+
+//#region src/component/http.ts
+const http = httpRouter();
+var http_default = http;
+
+//#endregion
+export { http_default as default };
+//# sourceMappingURL=http.js.map

package/dist/component/index.d.ts

@@ -0,0 +1,5 @@
+import { AuthProviderConfig, ConvexAuthConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, EmailConfig, EmailUserConfig, GenericDoc, GroupConnectionPolicy, GroupConnectionPolicyPatch, HttpKeyContext, KeyRecord, KeyScope, PhoneConfig, PhoneUserConfig, ScopeChecker } from "../server/types.js";
+import { AuthContext, AuthContextConfig, OptionalAuthContext, UserDoc } from "../server/context.js";
+import { AuthConfig, InferAuth } from "../server/facade.js";
+import { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext } from "../server/http.js";
+import { AuthApi, defineAuth } from "../server/auth.js";

package/dist/component/index.js

@@ -0,0 +1,3 @@
+import { defineAuth } from "../server/auth.js";
+
+export { defineAuth };

package/dist/component/limits.js

@@ -0,0 +1,103 @@
+import { mutation, query } from "./_generated/server.js";
+import { v } from "convex/values";
+
+//#region src/component/limits.ts
+/**
+* `component.limits.*` — sign-in token buckets stored with auth state.
+*
+* @module
+*/
+const HOUR_MS = 3600 * 1e3;
+const args = {
+	identifier: v.string(),
+	maxAttemptsPerHour: v.number()
+};
+const returns = v.object({
+	ok: v.boolean(),
+	retryAfter: v.optional(v.number())
+});
+async function readBucket(ctx, identifier) {
+	return await ctx.db.query("SignInLimit").withIndex("identifier", (q) => q.eq("identifier", identifier)).unique();
+}
+function bucketStatus(bucket, maxAttemptsPerHour, now) {
+	const capacity = Math.max(0, maxAttemptsPerHour);
+	if (capacity === 0) return {
+		tokens: 0,
+		retryAfter: HOUR_MS
+	};
+	const elapsed = bucket === null ? 0 : Math.max(0, now - bucket.updatedAt);
+	const previous = bucket?.tokens ?? capacity;
+	const tokens = Math.min(capacity, previous + elapsed * capacity / HOUR_MS);
+	return {
+		tokens,
+		retryAfter: tokens >= 1 ? void 0 : Math.ceil((1 - tokens) * HOUR_MS / capacity)
+	};
+}
+/** Read token-bucket headroom without another component call. @internal */
+async function checkSignInLimit(ctx, input) {
+	const status = bucketStatus(await readBucket(ctx, input.identifier), input.maxAttemptsPerHour, Date.now());
+	return {
+		ok: status.tokens >= 1,
+		retryAfter: status.retryAfter
+	};
+}
+/** Consume one guessable-secret attempt in the caller's mutation. @internal */
+async function recordSignInLimit(ctx, input) {
+	const now = Date.now();
+	const bucket = await readBucket(ctx, input.identifier);
+	const status = bucketStatus(bucket, input.maxAttemptsPerHour, now);
+	if (status.tokens < 1) {
+		if (bucket !== null) await ctx.db.patch("SignInLimit", bucket._id, {
+			tokens: status.tokens,
+			updatedAt: now
+		});
+		return {
+			ok: false,
+			retryAfter: status.retryAfter
+		};
+	}
+	const tokens = status.tokens - 1;
+	if (bucket === null) await ctx.db.insert("SignInLimit", {
+		identifier: input.identifier,
+		tokens,
+		updatedAt: now
+	});
+	else await ctx.db.patch("SignInLimit", bucket._id, {
+		tokens,
+		updatedAt: now
+	});
+	return {
+		ok: true,
+		retryAfter: void 0
+	};
+}
+/** Clear a token bucket in the caller's mutation. @internal */
+async function resetSignInLimit(ctx, identifier) {
+	const bucket = await readBucket(ctx, identifier);
+	if (bucket !== null) await ctx.db.delete("SignInLimit", bucket._id);
+}
+/** Peek at sign-in rate-limit headroom for `identifier` without consuming a token. */
+const signInCheck = query({
+	args,
+	returns,
+	handler: checkSignInLimit
+});
+/** Consume one sign-in token for `identifier`; `ok: false` when throttled. */
+const signInRecord = mutation({
+	args,
+	returns,
+	handler: recordSignInLimit
+});
+/** Clear the sign-in rate-limit counter for `identifier` after success. */
+const signInReset = mutation({
+	args: { identifier: v.string() },
+	returns: v.null(),
+	handler: async (ctx, { identifier }) => {
+		await resetSignInLimit(ctx, identifier);
+		return null;
+	}
+});
+
+//#endregion
+export { checkSignInLimit, recordSignInLimit, resetSignInLimit, signInCheck, signInRecord, signInReset };
+//# sourceMappingURL=limits.js.map